Hacker News Reader

Comment by pram | Hacker News Reader

This would have been easy if Windows had something like strace.

ProcMon fills that role a little bit.

I also think that if the author here used that in the first place they would have arrived at the registry problems much sooner. ProcMon is often the first thing I reach for when dealing with a 'missing files' kind of problem on Windows.

I was looking how to automate procmon on CI and found this (but info there might be bit outdated, had to reset my procmon registry to get it back to work) - https://gist.github.com/balaprasathr/ae424eec0e9e2860aa84a85... and whole article that goes deep into it - but can't find it now - I think I've stumbled on to it from the link above.

> I also think that if the author here used that in the first place they would have arrived at the registry problems much sooner.

You're absolutely correct. Doing this again, I'd probably get to start from the middle. I went the way I did because I was essentially starting it blind - technically capable but with no idea how one should do this. Discovering and reasoning my way through potential causes and tools helped it be a massive learning experience and I'm glad I did.

Also Rohitab Batra's API Monitor v2 - http://www.rohitab.com/ - very powerful - especially if you are hunting down who uses "getenv" (well not really getenv, but you get the picture)

And there is "strace" (not the one from cygwin/mingw, which mostly traces apps written for their runtime), but from DrMemory's - https://drmemory.org/page_drstrace.html

Then you have the realtively recent Detours released, and tons of other tooling TBH, just all over.

API Monitor is an amazing tool that I've used a few times in the past when procmon wasn't enough. But I wish the author would either return to working on it or open source it. As it is, many calls it can capture are opaque because it only captures the address that a parameter is pointing to instead of following the pointer to get the actual data.

It does, sort of. https://docs.microsoft.com/en-us/sysinternals/downloads/proc...

This was a 5 minute job with windbg. If I was the author I'd be too embarrassed to post this write-up.

Talk about embarrassing posts...

Hi. I'm the author.

I'm not embarrassed.

What I've done is written up my learning experience from near-nought in the hopes that others find it either informative or enjoyable.

Why should I be embarrassed of that?

Reply on news.ycombinator.com