3 ms·
This would have been easy if Windows had something like strace.
by pram 5y ago
This would have been easy if Windows had something like strace.
- jimrandomh 5y agoIt does, sort of. https://docs.microsoft.com/en-us/sysinternals/downloads/procmon https://docs.microsoft.com/en-us/sysinternals/downloads/proc...
- genocidicbunny 5y agoProcMon fills that role a little bit. I also think that if the author here used that in the first place they would have arrived at the registry problems much sooner. ProcMon is often the first thing I reach for when dealing with a 'missing files' kind of problem on Windows.
- malkia 5y agoI was looking how to automate procmon on CI and found this (but info there might be bit outdated, had to reset my procmon registry to get it back to work) - https://gist.github.com/balaprasathr/ae424eec0e9e2860aa84a854244f53c3 https://gist.github.com/balaprasathr/ae424eec0e9e2860aa84a85... and whole article that goes deep into it - but can't find it now - I think I've stumbled on to it from the link above.
- Slortibort 5y ago> I also think that if the author here used that in the first place they would have arrived at the registry problems much sooner. You're absolutely correct. Doing this again, I'd probably get to start from the middle. I went the way I did because I was essentially starting it blind - technically capable but with no idea how one should do this. Discovering and reasoning my way through potential causes and tools helped it be a massive learning experience and I'm glad I did.
- malkia 5y agoAlso Rohitab Batra's API Monitor v2 - http://www.rohitab.com/ http://www.rohitab.com/ - very powerful - especially if you are hunting down who uses "getenv" (well not really getenv, but you get the picture) And there is "strace" (not the one from cygwin/mingw, which mostly traces apps written for their runtime), but from DrMemory's - https://drmemory.org/page_drstrace.html https://drmemory.org/page_drstrace.html Then you have the realtively recent Detours released, and tons of other tooling TBH, just all over.
- ziml77 5y agoAPI Monitor is an amazing tool that I've used a few times in the past when procmon wasn't enough. But I wish the author would either return to working on it or open source it. As it is, many calls it can capture are opaque because it only captures the address that a parameter is pointing to instead of following the pointer to get the actual data.
- creamytaco 5y agoThis was a 5 minute job with windbg. If I was the author I'd be too embarrassed to post this write-up.
- kbelder 5y agoTalk about embarrassing posts...
- Slortibort 5y agoHi. I'm the author. I'm not embarrassed. What I've done is written up my learning experience from near-nought in the hopes that others find it either informative or enjoyable. Why should I be embarrassed of that?