如何使用 ProcMon 检查 Win32 CreateProcess() 失败原因。 排除 GetLastError()

Question

I am having an issue with checking CreateProcess() failure reason, there was a code in production which doesn't log GetLastError() when CreateProcess() failed so i am running ProcMon to check the reason but unable to find the reason (Will procMon log the failure reason something like "C:\\dummy.exe path not found or permission denied" ?).

Is there a way (tools ?) to check why CreateProcess() is failing without considering GetLastError() ?

I can't debug customer environment (no access to me) but I can change the code & provide new build & it takes long time due to process. i am currently looking for quick options available . Below is the sample code not exact production code.

int main()
{
    STARTUPINFO info = { sizeof(info) };
    PROCESS_INFORMATION processInfo;

    TCHAR dymmypath[_MAX_PATH] = _T("C:\\dummy.exe");
    static TCHAR TempPathString[_MAX_PATH];

    STARTUPINFO         si = { sizeof(si) };        //default set up
    PROCESS_INFORMATION pi;                     //data structure for CreateProcess

    si.dwFlags = STARTF_USESHOWWINDOW;
    si.wShowWindow = SW_SHOWMINIMIZED;

    if (!CreateProcess(dymmypath, NULL, NULL, NULL, FALSE, NORMAL_PRIORITY_CLASS, NULL, TempPathString, &si, &pi))
    {
        printf("Failed");
    }
    else {
        printf("Success");
    }

    return 0;
}

Answer 1

i am running ProcMon to check the reason but unable to find the reason (Will procMon log the failure reason something like "C:\\dummy.exe path not found or permission denied" ?).

Only if the request reaches the filesystem, ie to look for the EXE file, which in your case it sounds like it is not doing that, likely because CreateProcess() is failing to validate your input parameters before it reaches into the filesystem.

Is there a way (tools ?) to check why CreateProcess() is failing without considering GetLastError() ?

As others said, you could try attaching a debugger to your running app, and put a breakpoint in the CreateProcess function itself.

Another option is to use a tool like API Monitor , which will show you the actual API calls your program makes, what their parameter values are, reported error codes, etc.

I can't debug customer environment (no access to me) but I can change the code & provide new build

Then that is what you should do. Fix your code to do proper logging of error codes, don't ignore them anymore.

it takes long time due to process.

Well, that is your own fault for not optimizing your build process better, or breaking up your app into more manageable pieces, etc.

Answer 2

Just at first glance, I see TempPathString is initialized to "" , which is not a valid path. So while you're fixing that issue, that's your chance to add proper error handling.

The tool you're looking for is a debugger. You should attach the debugger of your choice, set a breakpoint on the return of CreateProcess , and check the error there.

Besides debugging and error handling (logging etc), you'll have to just get creative. Compare a working environment against production for example.