Coobbi
HomeWeb ToolsAppsTutorialsContact
Portable Executable analysis

DLL Inspector

Inspect Windows DLL headers, architecture, sections, imports and exports without loading or uploading the library.

Analyze a Windows DLL fileStatic analysis only—the library is never loaded.
Local processing

Drop a DLL file here

or choose a PE file from your device for local structural analysis.

The selected file stays on your device. This tool does not load it or send its contents to a server.

PE32 & PE32+x86, x64, ARM and ARM64 structures.
Imports & exportsBounded directory parsing with search.
Static onlyThe selected library is never loaded.
Understand the result

How to inspect a DLL file without loading it

A Windows DLL normally uses the same Portable Executable container as an EXE, but it is designed to be loaded by another process. This inspector reads selected PE headers and directories locally so you can review the library's structure without registering or loading it.

Inspect a DLL in three steps

  1. Choose a DLL file or drop it into the area above.
  2. Verify that the PE characteristics identify a DLL and check its format and processor architecture.
  3. Search exported names, imported APIs and section information to understand the library's public surface and dependencies.

Questions the result can help answer

  • Is the file structurally a DLL even if its extension is missing or incorrect?
  • Does it target x86, x64, ARM or ARM64 Windows?
  • Which DLLs and functions does it import, and which symbols does it expose?
  • Does the PE contain a CLR/.NET directory or an Authenticode certificate table?

DLL header fields explained

A DLL is more than a list of exported function names. Its PE headers describe how Windows maps and links the image.

Characteristics

Detected type

The DLL characteristic distinguishes a library image from a conventional EXE. Renaming a file does not change this header flag.

PE32 / PE32+

Format

Identifies the optional-header layout. Combine it with Architecture when checking compatibility with a host process.

Machine

Architecture

Shows the intended processor family. A 32-bit process normally cannot load an ordinary 64-bit DLL, and vice versa.

Export Directory

Exports

Lists public names and ordinals that other images may import. A DLL can export by name, ordinal, both or neither.

Import Directory

Imports

Lists external DLLs and symbols this library asks the Windows loader to resolve before or during use.

Section Table

Sections

Describes code and data regions, their disk and memory sizes, relative virtual addresses, flags and calculated entropy.

AddressOfEntryPoint

Entry point

For many native DLLs this points to initialization code such as a DllMain entry routine, although source-level names are not stored here.

CLR Directory

.NET indicator

A CLR runtime header indicates a managed or mixed-mode image. It does not identify the exact framework compatibility by itself.

Certificate Table

Authenticode

The inspector reports whether a bounded certificate-table directory is present; it does not validate trust, revocation or the signature chain.

Example DLL result

This illustrative result describes a 32-bit managed DLL with a standard PE32 layout. An actual .NET assembly may expose managed metadata that is outside this tool's current bounded view.

Detected type  DLL
Format         PE32
Architecture   x86
CLR / .NET     Present
Entry point    0x00001000
Image base     0x00400000
Export         Exported (ordinal 1)

DLL Inspector FAQ

Answers to common questions about Windows library files.

What is the difference between a DLL and an EXE?

Both normally use the PE format. An EXE is usually launched as a program, while a DLL is normally loaded by another process and may expose reusable functions or resources. The PE characteristics help distinguish the intended image type.

Does inspecting a DLL register or load it?

No. The tool reads bytes through the browser File API. It does not call LoadLibrary, run initialization code or register the file with Windows.

Why does a DLL have no named exports?

It may export only by ordinal, expose managed .NET types instead of native export names, resolve behavior dynamically, be packed, or simply contain resources. An empty export table does not mean the file is invalid.

Can a DLL contain executable code?

Yes. Native DLLs commonly contain code that runs when a host process loads the library or calls an exported function. That is why untrusted DLLs should not be loaded merely to inspect them.

Can I open a DLL file on Android?

Android cannot natively load ordinary Windows DLL files. Coobbi's Android app can display PE metadata and file details on a phone, but it does not execute Windows code.

Move from the PE overview to raw bytes, strings, hashes or the matching EXE workflow.

Technical terminology follows Microsoft's Portable Executable and COFF specification. Last reviewed August 14, 2026.