At work I am part of the engineering team for an enterprise-scale information management product. The product is a Windows based solution used by large enterprises for their information management needs. It been around for a pretty long time and over the years the source code has been migrated to various versions of Visual Studio which is the primary development environment.
Older versions of software get replaced by newer version and for security purposes products are supposed to use older libraries. One of the activities we often have to repeat is finding out if which parts of our software along with other 3rd party software still uses a particular version of the Visual Studio runtime and then upgrade those component to use the newer runtime. This blog post summarises some of the information we search for every time and refer to while making these decisions.
Some useful links
First of all some useful links which tell you more about redistributing Visual Studio runtime. If you are writing Windows applications, this is something you should definitely read once.
Visual Studio versions and runtime files
Since Visual Studio 2013, ATL library is statically linked to projects and the DLLs is no longer needed. You will find all the required redistribules in their binary form at the following location: C:\Program Files (x86)\Microsoft Visual Studio <VERSION>\VC\redist. Merge modules for the redistributables are usually located at the following folder: C:\Program Files (x86)\Common Files\Merge Modules
Visual Studio 2017 seems to have changes these locations a bit. The redistributable binaries are located at:
C:\Program Files (x86)\Microsoft Visual Studio\2017\<VERSION>\VC\Redist\MSVC
E.g.:
C:\Program Files (x86)\Microsoft Visual Studio\2017\Enterprise\VC\Redist\MSVC.
You'll find both the binaries as well as the merge-modules under this folder. If you have noticed, both VS 2015
and 2017 have the same set of redistributables, read more about this
here.
Scanning for references
You can use the PEInfo utility to scan through all your bianries and looks for VC runtime DLLs being referenced. This method will not work if for some reason you have code which dynamically loads these DLLs using LoadLibrary(), you'll then have to scan through your code for any such references.