Sys internals Process Monitior and FBWF

[David Pryce]

Hi Group,

I have a question about sys internals process monitor and fbwf on
Windows XPe.

From trial and error I have discovered that fbwf component needs to be
added to the image Target Designer to allow the process monitor to
work.

For various reasons I prefer not to use fbwf in my image. However I
want to be able to run process monitor to trace and debug applications
on Windows XPe.

Is this correct that fbwf must be installed to run process monitor?
Or is fbwf including something else that process monitor uses - that I
could just include?

I am thinking to install fbwf and just uncheck the enable check box if
I must include fbwf component. Is this the best path of action?

Thanks

David

 

[Sean Liming \(MVP\)]

I don't see how the two are realated. You might want to post to the
Sysinternals group and ask about the requirements for Process Monitor. You
might be mising a DLL that is getting pulled on by FBWF.

--
Regards,

Sean Liming
www.sjjmicro.com / www.seanliming.com
Book Author - XP Embedded Advanced, XP Embedded Supplemental Toolkit

 

[Mike Zelina]

Hi David,

If you don't have a copy of the dependency viewer get one here:
http://www.dependencywalker.com/

This will show you all the DLLs needed for a particular EXE. Sometimes
the viewer opens with all the DLLs expanded. Just collapse everything
and make sure all the top level DLLs are in your XPe build. If not,
locate the DLLs in the XP embedded repository by doing a normal
windows search in c:\Windows Embedded Data (or wherever you put the
repository files on install.

Either manually copy any missing DLLs to the exported image or figure
out what component you need to add. Do NOT grab the DLLs from your
actual c:\windows\sytem32 folder or you might run into trouble. Also,
remember that if you manually copy the DLLs, you will need to do it
again if you re-export the build since it cleans out the folder before
export.

Good luck,
Mike

 

[Stephane Barizien]

You can use the following steps to get Process Monitor working on a system
whose image doesn't have the required components:

- copy fltlib.dll to c:\windows\system32 if missing
- copy fltmgr.sys to c:\windows\system32\drivers if missing
- merge in the attached Services_FltMgt.reg into the registry (from an
admin account)
- merge in the attached CCS_Enum_Root_FltMgr.reg into the registry using
a RegEdit running under the SYSTEM account (you can get one by running
'psexec -sid c:\windows\regedit.exe')
- reboot

 

[David Pryce]

Hi

Yes I need the Filter Manager component to run Process Monitor. FBWF
includes this.

David

 

[Darrin Morrow]

Thanks for this info. Coincidentally I asked the same question in the MS
Embedded Standard forum a few days ago but I got no responses. Although I
appreciate that Sean monitors the forums I think this NG is a better
resource and I regret that MS is trying to drain its vitality by emphasizing
the forums.

I enabled boot time monitoring for procmon in my XPe image and found that
monitoring did not automatically start on the next boot. Has anyone figured
out how to make boot time monitoring work?

DM