New subject: Debugging

24 Feb 2006


      ...
I appreciate the tip about falling back on the relay debug channel,
but may I ask how you know the problem is with BlockInput not existing?
Is there something from the output that I'm not understanding, or do
you just know that because you're familiar with the kernel32.dll
code?
Molle's right--it just looks suspicious, since it's the last thing that's
called before ExitProcess.  I didn't copy-paste any more of the log, but
there were a whole bunch of GetProcAddress calls prior to this that
succeeded, which raises the probability that this was the cause.  And, as
Molle suggested, a quick glance at the kernel32 code shows that BlockInput
is missing.
As far as how did I spot this in the log--well, that's just experience. 
You can learn it pretty quickly though, especially when an app dies early.
   I just scroll through a log from the end toward the beginning, and look
for a change in pattern on the screen.  Different things are starting to
happen there, so I slow down for a closer look.  If it looks like normal
shutdown code--and there's usually hundreds of lines of this stuff--I
ignore it and move on.
As far as how to deal with this, try modifying kernel32.spec to add a stub
for BlockInput, like:
@ stub BlockInput
and see if the program gets any further.  Chances are it'll crash
somewhere else down the line, so you'll have to do the usual
wash-rinse-repeat.  You should also take a look through KeePass's source
code and try to find out what's going on.
--Juan
__________________________________________________
Do You Yahoo!?
Tired of spam?  Yahoo! Mail has the best spam protection around 
http://mail.yahoo.com

Re: Debugging