4.5

VMware, Inc. 123
Chapter 10 Monitoring and Troubleshooting ThinApp
Theexampleshowsthe%drive_C%\test\cmd_test\bin,%SystemSystem%\foobar,and
%SystemRoot%\foobarpathsasthelocationsinthevirtualfilesystemthatThinAppprobes.
----Potential Errors Detected ---
*** Unable to determine if any services need to be auto-started, error 2
001550 *** FindFirstFileW ’C:\test\cmd_test\bin\foobar.*’ -> INVALID_HANDLE_VALUE *** failed
[system probe C:\test\cmd_test\bin\foobar.* -> ffffffffh][no virtual or system matches]
*** FindFirstFileW ->HANDLE=ffffffffh .. *** GetLastError() returns 2 [203]: The system cannot
find the file specified.
*** FindFirstFileW ’C:\test\cmd_test\bin\foobar’ -> INVALID_HANDLE_VALUE *** failed [FS
missing in view 0][fs entry not found %drive_C%\test\cmd_test\bin\foobar][fs entry not found
%drive_C%\test\cmd_test\bin]
*** FindFirstFileW ’C:\WINDOWS\system32\foobar.*’ -> INVALID_HANDLE_VALUE *** failed [system
probe C:\WINDOWS\system32\foobar.* -> ffffffffh][no virtual or system matches]
*** FindFirstFileW ’C:\WINDOWS\system32\foobar’ -> INVALID_HANDLE_VALUE *** failed [FS missing
in view 0][fs entry not found %SystemSystem%\foobar]
*** FindFirstFileW ’C:\WINDOWS\foobar.*’ -> INVALID_HANDLE_VALUE *** failed [system probe
C:\WINDOWS\foobar.* -> ffffffffh][no virtual or system matches]
*** FindFirstFileW ’C:\WINDOWS\foobar’ -> INVALID_HANDLE_VALUE *** failed [FS missing in view
0][fs entry not found %SystemRoot%\foobar]
Perform Advanced Examination for cmd.exe Log Entries
AmorethoroughexaminationofanentryfromthePotential Errorssectionofatracefilemightinvolve
searchingthefullbodyoftheLogMonitortracefileforthatspecificentryandreviewingthesystemcallsand
conditionsleadingtothepotentialerror.
Forexample,thefollowingentryforthecmd.exe
utilityinthePotential Errorssectionmightrequirea
morethoroughexaminationthroughouttheLogMonitortracefile.
001550 *** FindFirstFileW ’C:\test\cmd_test\bin\foobar.*' -> INVALID_HANDLE_VALUE *** failed
[system probe
To perform an advanced examination of the cmd.exe entry
1Todeterminewhythecmd.exeutilityprobesc:\test\cmd_test\bin,scanthelogforthislogentry
numberanddeterminewhatoccursbeforethiscall.
2Todeterminethelocationswherethecmd.exeutilityobtainsthec:\test\cmd_test path,scanthelog
forGetCurrentDirectoryWandGetFullPathNameWentries.
000861 0a88 cmd.exe :4ad01580->USERENV.dll :769c0396 GetCurrentDirectoryW (IN DWORD
nBufferLength=104h)
000862 0a88 GetCurrentDirectoryW -> 0x14 (C:\test\cmd_test\bin)
000863 0a88 cmd.exe :4ad01580<-USERENV.dll :769c0396 GetCurrentDirectoryW ->DWORD=14h
(OUT LPWSTR lpBuffer=*4AD34400h->L"C:\test\cmd_test\bin")
000864 0a88 cmd.exe :4ad05b74->ole32.dll :774e03f0 Getfile type (IN HANDLE hFile=7h)
000865 0a88 Getfile type 7 -> 0x2
000866 0a88 cmd.exe :4ad05b74<-ole32.dll :774e03f0 Getfile type ->DWORD=2h ()
.
.
001533 0a88 cmd.exe :4ad01b0d<-kernel32.dll:7c80ac0f SetErrorMode ->UINT=0h ()
001534 0a88 cmd.exe :4ad01b13->kernel32.dll:7c80ac0f SetErrorMode (IN UINT uMode=1h)
001535 0a88 cmd.exe :4ad01b13<-kernel32.dll:7c80ac0f SetErrorMode ->UINT=0h ()
001536 0a88 cmd.exe :4ad01b24->IMM32.DLL :7639039b GetFullPathNameW (IN LPCWSTR
lpFileName=*1638C0h->L."," IN DWORD nBufferLength=208h)
001537 0a88 GetFullPathNameW . -> 20 (buf=C:\test\cmd_test\bin,
file_part=bin)
001538 0a88 cmd.exe :4ad01b24<-IMM32.DLL :7639039b GetFullPathNameW ->DWORD=14h
(OUT LPWSTR lpBuffer=*163D60h->L"C:\test\cmd_test\bin," OUT *lpFilePart=*13D8D4h-
>*163D82h->L"bin")
.
.
001549 0a88 cmd.exe :4ad01b5f->USERENV.dll :769c03fa FindFirstFileW (IN LPCWSTR
lpFileName=*1638C0h->L"C:\test\cmd_test\bin\foobar.*")
001550 0a88 FindFirstFileW ’C:\test\cmd_test\bin\foobar.*’ ->
INVALID_HANDLE_VALUE *** failed [system probe C:\test\cmd_test\bin\foobar.* -> ffffffffh][no
virtual or system matches]