modsnap: DLL inventory without debugger overhead

Date: February 05, 2026

modsnap is exactly what you want when you need quick module truth for a PID: table, paths, CSV, or just count.

Fastest Signal

_test\modsnap.exe --self --count

4

For scripts and health checks, this single integer can be enough to detect load drift.

Workflow 1: Capture Scriptable Baseline

_test\modsnap.exe --self --csv

pid,base,size,module,path
4632,"0x00007FF69C120000",163840,"modsnap.exe","C:\tools\_test\modsnap.exe"
4632,"0x00007FFDDD000000",2523136,"ntdll.dll","C:\WINDOWS\SYSTEM32\ntdll.dll"
4632,"0x00007FFDDC010000",823296,"KERNEL32.DLL","C:\WINDOWS\System32\KERNEL32.DLL"

Store this in build artifacts, then diff between runs to catch unexpected module injections or dependency shifts.

Workflow 2: Export Paths for Follow-up Tooling

_test\modsnap.exe --self --paths

C:\tools\_test\modsnap.exe
C:\WINDOWS\SYSTEM32\ntdll.dll
C:\WINDOWS\System32\KERNEL32.DLL
C:\WINDOWS\System32\KERNELBASE.dll

Pipe directly into signature checks, hash scans, PE metadata tooling, or allowlist validation.

Guardrails

Expect permission limits on protected targets and cross-bitness quirks. `modsnap` is for rapid visibility, not full loader telemetry.