5.0

VMware, Inc. 91
Chapter 9 Monitoring and Troubleshooting ThinApp
[FS missing in view 0][fs entry not found %SystemRoot%\foobar]
Perform Advanced Examination for cmd.exe Log Entries
AmorethoroughexaminationofanentryfromthePotential Errorssectionofatracefilemightinvolve
searchingthefullbodyoftheLogMonitortracefileforthatspecificentryandreviewingthesystemcallsand
conditionsleadingtothepotentialerror.
Forexample,thefollowingentryforthecmd.exe
utilityinthePotential Errorssectionmightrequirea
morethoroughexaminationthroughouttheLogMonitortracefile.
001550 00185994582578 00000c78 00001334 *** FindFirstFileW ’C:\test\cmd_test\bin\foobar.*' ->
INVALID_HANDLE_VALUE *** failed
Perform an advanced examination of the cmd.exe entry
1Todeterminewhythecmd.exeutilityprobesc:\test\cmd_test\bin,scanthelogforthislogentry
numberanddeterminewhatoccursbeforethiscall.
2Todeterminethelocationswherethecmd.exeutilityobtainsthec:\test\cmd_test path,scanthelog
forGetCurrentDirectoryWandGetFullPathNameWentries.
000861 00184029262193 00000c78 00001334 cmd.exe :4ad01580->USERENV.dll :769c0396
GetCurrentDirectoryW (IN DWORD
nBufferLength=104h)
000862 00184037503381 00000c78 00001334 GetCurrentDirectoryW -> 0x14 (C:\test\cmd_test\bin)
000863 00184355766742 00000c78 00001334 cmd.exe :4ad01580<-USERENV.dll :769c0396
GetCurrentDirectoryW ->DWORD=14h
(OUT LPWSTR lpBuffer=*4AD34400h->L"C:\test\cmd_test\bin")
000864 00184362179933 00000c78 00001334 cmd.exe :4ad05b74->ole32.dll :774e03f0 Getfile type
(IN HANDLE hFile=7h)
000865 00185208991133 00000c78 00001334 Getfile type 7 -> 0x2
000866 00185212957170 00000c78 00001334 cmd.exe :4ad05b74<-ole32.dll :774e03f0 Getfile type
->DWORD=2h ()
.
.
001533 00185221099590 00000c78 00001334 cmd.exe :4ad01b0d<-kernel32.dll:7c80ac0f SetErrorMode
->UINT=0h ()
0001534 00185221215368 00000c78 00001334 cmd.exe :4ad01b13->kernel32.dll:7c80ac0f
SetErrorMode (IN UINT uMode=1h)
001535 00185221343489 00000c78 00001334 cmd.exe :4ad01b13<-kernel32.dll:7c80ac0f SetErrorMode
->UINT=0h ()
001536 00185727216844 00000c78 00001334 cmd.exe :4ad01b24->IMM32.DLL :7639039b
GetFullPathNameW (IN LPCWSTR
lpFileName=*1638C0h->L."," IN DWORD nBufferLength=208h)
001537 00185731151471 00000c78 00001334 GetFullPathNameW . -> 20 (buf=C:\test\cmd_test\bin,
001538 00185734164499 00000c78 00001334 cmd.exe :4ad01b24<-IMM32.DLL :7639039b
GetFullPathNameW ->DWORD=14h
(OUT LPWSTR lpBuffer=*163D60h->L"C:\test\cmd_test\bin," OUT *lpFilePart=*13D8D4h
->*163D82h->L"bin")
.
.
001549 00185993599811 00000c78 00001334 cmd.exe :4ad01b5f->USERENV.dll :769c03fa
FindFirstFileW (IN LPCWSTR
lpFileName=*1638C0h->L"C:\test\cmd_test\bin\foobar.*")
001550 00185994582578 00000c78 00001334 FindFirstFileW ’C:\test\cmd_test\bin\foobar.*’ ->
INVALID_HANDLE_VALUE *** failed [system probe C:\test\cmd_test\bin\foobar.*
-> ffffffffh][no virtual or system matches]
Thecmd.exeutilityobtainsthefirstlocationbycallingGetCurrentDirectoryWandthesecondlocation
bycallingGetFullPathNameWwithʺ.ʺasthepathspecifies.Thesecallsreturnthepathforthecurrent
workingdirectory.Thelogfileshowsthatthecmd.exeutilitycreatestheC:\test\cmd_test\bin>
prompt.TheutilityqueriesthePROMPTenvironment
variablethatreturns$P$Gandusesthe
WriteConsoleWAPIfunctiontoprinttheprompttothescreenafterinternallyexpanding$P$Gto
C:\test\cmd_test\bin>.