Debugging / troubleshooting Windows applications without source code

A few days ago I ran into this problem at work, and I was wondering if there was a way to wash more data from the script than heading to Microsoft. There were so many such cases, and I wanted to investigate this as a window designer, that the best / best way to get most of the information is this. I will describe the situation:

1) The office application when printing with certain settings, including the CMYK color space, causes a dialog box error with a poor description. "The file% s could not be opened because it was blocked by some other application." It does not give a file name and does not have an event viewer. Printing aborted.

2) when using "procmon", we find a "file locking error" in several files when the CreatefileMapping api is called by involved processes, such as an office application, spooler, splwow64.exe (yes, its 64-bit system and application are 32 bit).

3) the problem is not there when there is no splwow64, this means using a 64-bit application on 64-bit os.

I want to know which tools will be useful for more information in such situations. This includes using MS characters with windbg and building debugging if necessary. Basically I need the name of a file that is locked, which appears as% s and the root of the problem.

Thanks, Koshik

+4
1

. , , , . .

Diff 64- 32-

64- , , . Process Monitor CSV , . ,

  • .
  • , .
  • DLL

, Excel.

, , Process Monitor . , , , .

, , . , . , , . SysInternals Handle. , . , DOS Process Explorer (. ).

API, API- - . , (ReadFile, ReadFileEx, LockFile, LockFileEx, WriteFile, WriteFileEx,...).

WinDbg , , , , . bp.

, , %s, - .

, , . , , . handle.

  • ,
  • WinDbg
  • , . NTFS Unicode, du <address> .

, . ..

, , . , , , - .

,

  • WinDbg , .
  • .logopen /t /u c:\firstchanceexceptions.log
  • sxe -c ".exr -1;k;g" *. g , () -.
  • g
  • , .logclose
  • /
  • ,
  • , ( du <address>)

,

, , . - , :

,

, "% s":

  • Process Explorer

  • Find/Find handle DLL Ctrl + F

+3

Source: https://habr.com/ru/post/1542684/


All Articles