Get a Loaded DLL for a process on Remote machine

The method below with get you the loaded dll for a process running on a remote machine.
The language used in C# and powershell cmdlet is used to get the information

you will need these two namespaces to be used for the same.
using System.Management.Automation;
using System.Management.Automation.Runspaces;

public bool getDLLLoadedOnRemoteMachine(string processName, string dLLToCheck, string MachineName, string strDomainAdminUser, string domainUserPassword)
{

var runspace = RunspaceFactory.CreateRunspace();
runspace.Open();
var pipe = runspace.CreatePipeline();
pipe.Commands.AddScript("$PSComputer = '" + MachineName + "'");
pipe.Commands.AddScript("$username = \"" + strDomainAdminUser + "\"");
pipe.Commands.AddScript("$password = convertto-securestring \"" + domainUserPassword + "\" -asplaintext -force");
pipe.Commands.AddScript("$cred = new-object -typename System.Management.Automation.PSCredential -argumentlist $username, $password");
pipe.Commands.AddScript("$Session = New-PSSession -ComputerName $PSComputer -Credential $cred -ConfigurationName \"microsoft.powershell32\"");
pipe.Commands.AddScript("$AllModules = Invoke-Command -Session $Session -ScriptBlock{(Get-Process " + processName + ").Modules }");
pipe.Commands.AddScript("Remove-PSSession $Session");
pipe.Commands.AddScript("$AllModules");

try
{
foreach (PSObject result in pipe.Invoke())
{
var str = result.ToString();
if (str.ToUpper().IndexOf(dLLToCheck.ToUpper()) != -1)
{
return true;
}
}
return false;
}
catch (Exception e)
{
if (e.InnerException != null)
{
Console.WriteLine("Invoke Exception: " + e.InnerException.ToString());
return false;
}
else
{
Console.WriteLine("Invoke Exception: " + e.Message.ToString());
return false;
}
}
}

You will need to add a reference to your project.

System.Management.automation

For Win7/2008r2 you need to install Windows Management Framework 3.0 Please find the link to the download provided below.
http://www.microsoft.com/en-us/download/details.aspx?id=34595

Leave a comment