What are some nice command line ways to inspect DLL/EXE details?
With most Windows executables (DLL, EXE...), version and other details can be viewed using "Details" tab in "Properties" (Alt+Enter).
I wonder: is there also a command-line way to do this? I'm particularly interested for Product version, but also other things could be useful.
Following properties are desired, in order of precedence:
- accept exe/dll path as a parameter
- output to standard output (so you can process the rest via
|pipe) - available by default in all supported Windows (XP+)
- available by default in Windows Vista+
- available by default in Windows XP
- usable in commercial environment
- free license (GPL-like)
- portable (ie. standalone exe, maybe accompanied with DLL)
5 Answers
In powershell, get-command "full-path-to-executable" | format-list would do the trick. Powershell is the new command-line
for Vista and later Windows, can be installed in XP.
Use the Microsoft's DUMPBIN utility.
It has lots of useful options, however, it depends on what do you want to do.
However, it's not free, but I believe can be obtained freely with Windows SDK.
1You can use sigcheck.exe portable tool which is part of Sysinternals Suite, e.g.
$ sigcheck.exe some_app.exe
Sigcheck v2.51 - File version and signature viewer
Copyright (C) 2004-2016 Mark Russinovich
Sysinternals -
C:/Program Files (x86)/Foo App\some_app.exe: Verified: Signed Signing date: 14:48 23/12/2015 Publisher: X Company: X Description: X Product: Some App Prod version: 5.0.0.1241 File version: 5.0.0.1241 MachineType: 32-bitFor older version of Windows such as XP/2k/2003 (it still works in new), use filever.exe tool (check the direct link at exedll.info) to obtain specific information about a file such as:
- The platform on which the file runs
- The version of the file
- The attributes of the file
- The file type
- The language of the file
- Whether the file is a shipping type or a debug type
- The file size
- The date that the file was created
- The path of the file
Some other to consider:
The Microsoft COFF Binary File Dumper (DUMPBIN.EXE)
Displays information about Common Object File Format (COFF) binary files. You can use DUMPBIN to examine COFF object files, standard libraries of COFF objects, executable files, and dynamic-link libraries (DLLs).
binwalk- search the specified file(s) for executable opcodes common to a variety of CPU architectures. Easy to use tool for analyzing, reverse engineering, and extracting interesting files/data from binary files.
For more commands, check:
- Command line tool to dump Windows DLL version?
- Quick way to tell if an installed application is 64-bit or 32-bit
Function GetProductVersion (sFilePath, sProgram)
Dim objShell, objFolder, objFolderItem, i
If FSO.FileExists(sFilePath & "\" & sProgram) Then Set objShell = CreateObject("Shell.Application") Set objFolder = objShell.Namespace(sFilePath) Set objFolderItem = objFolder.ParseName(sProgram) Dim arrHeaders(300) For i = 0 To 300 arrHeaders(i) = objFolder.GetDetailsOf(objFolder.Items, i) 'WScript.Echo i &"- " & arrHeaders(i) & ": " & objFolder.GetDetailsOf(objFolderItem, i) If lcase(arrHeaders(i))= "product version" Then GetProductVersion= objFolder.GetDetailsOf(objFolderItem, i) Exit For End If Next
End If
End Function Source is a link to a .vbs file that can get the file version for you, and you can take that and use the output however you want.
Ships will all versions of windows, not sure about the license, very portable, but not exe or DLL.
2Powershell is the way to go. You can:
- run cmd.exe as the Administrator/Domain Admin user that has local admin rights on the remote server.
- start "\\C$" or which ever drive share and folder you need to inspect.
- Powershell.exe
- PS C:\Windows\System32> (Get-Item "umrdp.dll").VersionInfo.ProductVersion 10.0.18362.752
