jauntePE 0.1.6 dlls ready for use/testing

Message

chezduong · #16 Post by **chezduong** » Tue Sep 11, 2007 12:33 pm

@redllar, don't get me wrong. On my posts I try to be factual, adding what I think is important for those who are more technically gifted than me to help them/you to figure out. My comments/posts are by no means criticism.

For me, version 0.1.4 works very very well and is extremely stable for the applications I run -- it is my default. So when I write that I revert back, it is simply to say that I tested, found some strange behavior and went back to stable version so there is no pressure to get something new, improved, whiter, bright and lemony fresh scent out for us geeks to test.

sgp · #17 Post by **sgp** » Tue Sep 11, 2007 11:13 pm

redllar wrote:
chezduong wrote: I reverted back to 0.1.4 dll.
Yeah, it's been a waste of my time too.

Not entirely. It did make very significant progress in working with ecco and eccoext, so there's something good in it.

Whatever it is, it isn't working too well with very recent WinXP makes. I reinstalled a fresh copy of Windows XP pro SP2 and now 0.1.6 isn't working well on my PC (foxit not running, unknown exception error boxes, etc.) Previously 0.1.6 was working just fine on my Windows XP pro SP1 upgraded to SP2.

Chris · #18 Post by **Chris** » Tue Sep 11, 2007 11:58 pm

Version 0.1.6.1 is working great with the test about redirecting file-system or file-manipulations using regedit, I don't get any dead-lock condition. I only get JauntePE Runtime Warning telling that regedit is attempting a SHFileOperation call... even that, it still works wonderfully. Now I'm confident to do file manipulations in JPEized Winamp. And It works like a charm with Objectdock too. Thank you, redllar.

Unfortunatelly, my Firefox gives the same message like what chezduong experiencing: "The program must close to allow a previous installation attempt to complete. Please restart."

redllar · #19 Post by **redllar** » Wed Sep 12, 2007 3:07 pm

chezduong, I really was agreeing with you. That was mostly "redllar the JPE user" posting there. "redllar the JPE user" still uses 011 for all of his apps. "redllar the JPE dev" would also rather be coding for the 020 plugin version than bug hunting. Especially since there's very little time for either now.

Regarding the app-ending crashes, I'll try and put in an option for how the api unhooking is handled and give you a few different ways to try. I tried to leave it up to the madCodeHook auto-unhook feature this go around but obviously it has its own set of problems correctly unwinding all of the hooks made within a multi-threaded app.

Regarding Firefox 2.*, I'm pretty sure I already mentioned that the module inclusion list might need to be adjusted since I felt that prior jpe versions weren't correctly determining the module making the call. So I'd suggest playing around with that as your pre-015-derived list is probably out of synch with the 015 and 016 inner workings. I'd also suggest using the jpe log dll with Sysinternal's DebugView running. It should give you a good idea of where the problem is.

sgp wrote:Whatever it is, it isn't working too well with very recent WinXP makes. I reinstalled a fresh copy of Windows XP pro SP2 and now 0.1.6 isn't working well on my PC (foxit not running, unknown exception error boxes, etc.) Previously 0.1.6 was working just fine on my Windows XP pro SP1 upgraded to SP2.

Did you try 0161 yet? There were 2 places where I found potential re-entrancy problems in 0160 that I fixed in 0161. I also applied a couple more MS-suggested patches to their C++ STL code. And try the jpe log dll with Sysinternal's DebugView running with foxit.

Chris wrote:I only get JauntePE Runtime Warning telling that regedit is attempting a SHFileOperation call...

If you could run the jpe log dll with Sysinternal's DebugView running you should be able to do a find on SHFileOperation and locate the call being made. Then post that info so I can have a look and set up a test condition here to get that problem fixed.

sgp · #20 Post by **sgp** » Thu Sep 13, 2007 11:47 am

redllar wrote:
sgp wrote:Whatever it is, it isn't working too well with very recent WinXP makes. I reinstalled a fresh copy of Windows XP pro SP2 and now 0.1.6 isn't working well on my PC (foxit not running, unknown exception error boxes, etc.) Previously 0.1.6 was working just fine on my Windows XP pro SP1 upgraded to SP2.
Did you try 0161 yet? There were 2 places where I found potential re-entrancy problems in 0160 that I fixed in 0161. I also applied a couple more MS-suggested patches to their C++ STL code. And try the jpe log dll with Sysinternal's DebugView running with foxit.

I gave up using 0161 because it can't start foxit. Took a look at the debugview but it's over my head. Apparently dll hooking succeeds, then a few registry open/query/close calls are logged then nothing else.

redllar · #21 Post by **redllar** » Fri Sep 14, 2007 5:15 am

sgp wrote:Apparently dll hooking succeeds, then a few registry open/query/close calls are logged then nothing else.

It looks pretty obvious to me that you're really not interested in being pro-active about this, or interested in putting any sort of thought and time into this, so I guess I'll just leave you be.

sgp · #22 Post by **sgp** » Fri Sep 14, 2007 3:06 pm

redllar wrote:
sgp wrote:Apparently dll hooking succeeds, then a few registry open/query/close calls are logged then nothing else.
It looks pretty obvious to me that you're really not interested in being pro-active about this, or interested in putting any sort of thought and time into this, so I guess I'll just leave you be.

Sorry Redllar, I'm putting off several fires here and my time is very limited. I very much thank you for the time you're putting into jauntePE. When I'll have more time I'll go back and look again at the 0161 log file. ATM it really is mostly Greek to me.

Ttech · #23 Post by **Ttech** » Sat Sep 15, 2007 7:37 pm

Cool.. Thanks...

redllar · #24 Post by **redllar** » Sun Sep 16, 2007 7:34 am

sgp wrote:Sorry Redllar, I'm putting off several fires here and my time is very limited. I very much thank you for the time you're putting into jauntePE. When I'll have more time I'll go back and look again at the 0161 log file. ATM it really is mostly Greek to me.

No apologies necessary. Your post looked like you were either giving up, which disappointed me, or trying to play the "stupid user" card, which I know you're not.

What would be great is if you could post here the log lines for the last few Reg... sections. Maybe from the next-to-last RegOpenKeyEx call to the end of the log. That way we can go over it together at our leisure and see if something stands out that's different in the last sequence from the next-to-last sequence.

sgp · #25 Post by **sgp** » Sun Sep 16, 2007 12:36 pm

redllar wrote:post here the log lines for the last few Reg... sections. Maybe from the next-to-last RegOpenKeyEx call to the end of the log. That way we can go over it together at our leisure and see if something stands out that's different in the last sequence from the next-to-last sequence.

OK, the last 3 RegOpenKeyEx sections to the end of the log. This log looks quite different from the previous ones. There's a return 6 code that I had never seen before. Since my first foxit post and now I had to reinstall Windows twice due to serious I/O problems. Now my system is stable. Foxit + 0161 still failing as before, though. Here's the log

Code: Select all

00000639	1.00665140	[2620] 00002620-00003600(00603)=RegOpenKeyExA (hKey=80000001, other=Keyboard Layout\Toggle)	
00000640	1.00666487	[2620] 00002620-00003600(00604)=    ** caller= ** (other=msctf.dll)	
00000641	1.00670898	[2620] 00002620-00003600(00605)=    bypass call?  (other=** NO **)	
00000642	1.00675893	[2620] 00002620-00003600(00606)=    ByPassItA: bypassing (hKey=80000001, other=Keyboard Layout\Toggle)	
00000643	1.00681591	[2620] 00002620-00003600(00607)=    return code: 0	
00000644	1.00693047	[2620] 00002620-00003600(00608)=RegQueryValueExA (hKey=000002E0, other=Language Hotkey)	
00000645	1.00697541	[2620] 00002620-00003600(00609)=    ** caller= ** (other=msctf.dll)	
00000646	1.00698805	[2620] 00002620-00003600(00610)=    bypass call?  (other=** NO **)	
00000647	1.00705540	[2620] 00002620-00003600(00611)=    KeyName: IN  (hKey=000002E0, other=USER\S-1-5-21-73586283-1844237615-725345543-1001\Keyboard Layout\Toggle)	
00000648	1.00711286	[2620] 00002620-00003600(00612)=    KeyName: OUT (hKey=000002E0, other=HKEY_CURRENT_USER\Keyboard Layout\Toggle)	
00000649	1.00716436	[2620] 00002620-00003600(00613)=    ByPassItA: bypassing (hKey=000002E0, other=)	
00000650	1.00720954	[2620] 00002620-00003600(00614)=    Calling system registry due to bypass	
00000651	1.00725591	[2620] 00002620-00003600(00615)=    return code: 2	
00000652	1.00733304	[2620] 00002620-00003600(00616)=RegQueryValueExA (hKey=000002E0, other=Hotkey)	
00000653	1.00740826	[2620] 00002620-00003600(00617)=    ** caller= ** (other=msctf.dll)	
00000654	1.00746524	[2620] 00002620-00003600(00618)=    bypass call?  (other=** NO **)	
00000655	1.00747836	[2620] 00002620-00003600(00619)=    KeyName: IN  (hKey=000002E0, other=USER\S-1-5-21-73586283-1844237615-725345543-1001\Keyboard Layout\Toggle)	
00000656	1.00753498	[2620] 00002620-00003600(00620)=    KeyName: OUT (hKey=000002E0, other=HKEY_CURRENT_USER\Keyboard Layout\Toggle)	
00000657	1.00758612	[2620] 00002620-00003600(00621)=    ByPassItA: bypassing (hKey=000002E0, other=)	
00000658	1.00763118	[2620] 00002620-00003600(00622)=    Calling system registry due to bypass	
00000659	1.00774097	[2620] 00002620-00003600(00623)=    return code: 2	
00000660	1.00778568	[2620] 00002620-00003600(00624)=RegQueryValueExA (hKey=000002E0, other=Layout Hotkey)	
00000661	1.00779879	[2620] 00002620-00003600(00625)=    ** caller= ** (other=msctf.dll)	
00000662	1.00784266	[2620] 00002620-00003600(00626)=    bypass call?  (other=** NO **)	
00000663	1.00789988	[2620] 00002620-00003600(00627)=    KeyName: IN  (hKey=000002E0, other=USER\S-1-5-21-73586283-1844237615-725345543-1001\Keyboard Layout\Toggle)	
00000664	1.00796413	[2620] 00002620-00003600(00628)=    KeyName: OUT (hKey=000002E0, other=HKEY_CURRENT_USER\Keyboard Layout\Toggle)	
00000665	1.00804937	[2620] 00002620-00003600(00629)=    ByPassItA: bypassing (hKey=000002E0, other=)	
00000666	1.00809538	[2620] 00002620-00003600(00630)=    Calling system registry due to bypass	
00000667	1.00810802	[2620] 00002620-00003600(00631)=    return code: 2	
00000668	1.00819492	[2620] 00002620-00003600(00632)=RegCloseKey (hKey=000002E0)	
00000669	1.00824010	[2620] 00002620-00003600(00633)=    ** caller= ** (other=msctf.dll)	
00000670	1.00828481	[2620] 00002620-00003600(00634)=    bypass call?  (other=** NO **)	
00000671	1.00838315	[2620] 00002620-00003600(00635)=    KeyName: IN  (hKey=000002E0, other=USER\S-1-5-21-73586283-1844237615-725345543-1001\Keyboard Layout\Toggle)	
00000672	1.00843513	[2620] 00002620-00003600(00636)=    KeyName: OUT (hKey=000002E0, other=HKEY_CURRENT_USER\Keyboard Layout\Toggle)	
00000673	1.00844884	[2620] 00002620-00003600(00637)=    ByPassItA: bypassing (hKey=000002E0, other=)	
00000674	1.00849414	[2620] 00002620-00003600(00638)=    return code: 0	
00000675	1.00868988	[2620] 00002620-00003600(00639)=RegOpenKeyExA (hKey=80000002, other=SOFTWARE\Microsoft\CTF\)	
00000676	1.00873685	[2620] 00002620-00003600(00640)=    ** caller= ** (other=msctf.dll)	
00000677	1.00881708	[2620] 00002620-00003600(00641)=    bypass call?  (other=** NO **)	
00000678	1.00887036	[2620] 00002620-00003600(00642)=    ByPassItA: bypassing (hKey=80000002, other=SOFTWARE\Microsoft\CTF\)	
00000679	1.00888383	[2620] 00002620-00003600(00643)=    return code: 0	
00000680	1.00896430	[2620] 00002620-00003600(00644)=RegQueryValueExA (hKey=000002E4, other=EnableAnchorContext)	
00000681	1.00901401	[2620] 00002620-00003600(00645)=    ** caller= ** (other=msctf.dll)	
00000682	1.00905836	[2620] 00002620-00003600(00646)=    bypass call?  (other=** NO **)	
00000683	1.00918865	[2620] 00002620-00003600(00647)=    KeyName: IN  (hKey=000002E4, other=MACHINE\SOFTWARE\Microsoft\CTF)	
00000684	1.00924087	[2620] 00002620-00003600(00648)=    KeyName: OUT (hKey=000002E4, other=HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF)	
00000685	1.00943410	[2620] 00002620-00003600(00649)=    ByPassItA: bypassing (hKey=000002E4, other=)	
00000686	1.00948250	[2620] 00002620-00003600(00650)=    Calling system registry due to bypass	
00000687	1.00952864	[2620] 00002620-00003600(00651)=    return code: 2	
00000688	1.00961101	[2620] 00002620-00003600(00652)=RegCloseKey (hKey=000002E4)	
00000689	1.00968647	[2620] 00002620-00003600(00653)=    ** caller= ** (other=msctf.dll)	
00000690	1.00974286	[2620] 00002620-00003600(00654)=    bypass call?  (other=** NO **)	
00000691	1.00975573	[2620] 00002620-00003600(00655)=    KeyName: IN  (hKey=000002E4, other=MACHINE\SOFTWARE\Microsoft\CTF)	
00000692	1.00981128	[2620] 00002620-00003600(00656)=    KeyName: OUT (hKey=000002E4, other=HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF)	
00000693	1.00986218	[2620] 00002620-00003600(00657)=    ByPassItA: bypassing (hKey=000002E4, other=)	
00000694	1.00990772	[2620] 00002620-00003600(00658)=    return code: 0	
00000695	1.04065549	[2620] 00002620-00003600(00659)=RegOpenKeyW (hKey=80000002, other=Software\Microsoft\Windows NT\CurrentVersion\IMM)	
00000696	1.04071414	[2620] 00002620-00003600(00660)=    ** caller= ** (other=imm32.dll)	
00000697	1.04077804	[2620] 00002620-00003600(00661)=    bypass call?  (other=** NO **)	
00000698	1.04089594	[2620] 00002620-00003600(00662)=    ByPassItW: bypassing (hKey=80000002, other=Software\Microsoft\Windows NT\CurrentVersion\IMM)	
00000699	1.04094231	[2620] 00002620-00003600(00663)=RegOpenKeyExW (hKey=80000002, other=Software\Microsoft\Windows NT\CurrentVersion\IMM)	
00000700	1.04098678	[2620] 00002620-00003600(00664)=    ** caller= ** (other=advapi32.dll)	
00000701	1.04323924	[2620] 00002620-00003600(00665)=    bypass call?  (other=** NO **)	
00000702	1.04330444	[2620] 00002620-00003600(00666)=    ByPassItW: bypassing (hKey=80000002, other=Software\Microsoft\Windows NT\CurrentVersion\IMM)	
00000703	1.04335189	[2620] 00002620-00003600(00667)=    return code: 0	
00000704	1.04341722	[2620] 00002620-00003600(00668)=    return code: 0	
00000705	1.04346228	[2620] 00002620-00003600(00669)=RegQueryValueExW (hKey=000002FC, other=Ime File)	
00000706	1.04350615	[2620] 00002620-00003600(00670)=    ** caller= ** (other=imm32.dll)	
00000707	1.04565358	[2620] 00002620-00003600(00671)=    bypass call?  (other=** NO **)	
00000708	1.04571414	[2620] 00002620-00003600(00672)=    KeyName: IN  (hKey=000002FC, other=MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IMM)	
00000709	1.04577088	[2620] 00002620-00003600(00673)=    KeyName: OUT (hKey=000002FC, other=HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IMM)	
00000710	1.04582262	[2620] 00002620-00003600(00674)=    ByPassItW: bypassing (hKey=000002FC, other=)	
00000711	1.04588461	[2620] 00002620-00003600(00675)=    return code: 0	
00000712	1.04592824	[2620] 00002620-00003600(00676)=RegCloseKey (hKey=000002FC)	
00000713	1.04807258	[2620] 00002620-00003600(00677)=    ** caller= ** (other=imm32.dll)	
00000714	1.04813325	[2620] 00002620-00003600(00678)=    bypass call?  (other=** NO **)	
00000715	1.04818881	[2620] 00002620-00003600(00679)=    KeyName: IN  (hKey=000002FC, other=MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IMM)	
00000716	1.04824138	[2620] 00002620-00003600(00680)=    KeyName: OUT (hKey=000002FC, other=HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IMM)	
00000717	1.04828799	[2620] 00002620-00003600(00681)=    ByPassItA: bypassing (hKey=000002FC, other=)	
00000718	1.04834664	[2620] 00002620-00003600(00682)=    return code: 0	
00000719	1.05050361	[2620] 00002620-00003600(00683)=RegCloseKey	
00000720	1.05055118	[2620] 00002620-00003600(00684)=    ** caller= ** (other=imm32.dll)	
00000721	1.05059969	[2620] 00002620-00003600(00685)=    bypass call?  (other=** NO **)	
00000722	1.05064666	[2620] 00002620-00003600(00686)=    KeyName: NOT FOUND	
00000723	1.05069411	[2620] 00002620-00003600(00687)=    KeyName: OUT (other=HKEY_UNKNOWN)	
00000724	1.05073667	[2620] 00002620-00003600(00688)=    ===== Didn't find key in ini - passing onto system for processing	
00000725	1.05878460	[2620] 00002620-00003600(00689)=    return code: 6

redllar · #26 Post by **redllar** » Sun Sep 16, 2007 2:29 pm

sgp wrote:OK, the last 3 RegOpenKeyEx sections to the end of the log. This log looks quite different from the previous ones. There's a return 6 code that I had never seen before. Since my first foxit post and now I had to reinstall Windows twice due to serious I/O problems. Now my system is stable. Foxit + 0161 still failing as before, though. Here's the log

I don't see anything in that log posting that makes me think that this is a JPE-related problem since JPE is logging a return from its api-hooking functions for each hooked api call. So either something happened "up above" that Foxit had not yet processed (which is possible since there are no Foxit Reader.exe related entries in the log posting) or it's not a JPE-related problem.

But that key that the imm32 module is passing in to the RegCloseKey api function is definitely not valid. It's basically a NULL (no value) key, which is a no-no. Which is also why JPE said it wasn't one of its keys and the system returned the error code 6 value. I don't know if that's what's causing Foxit to crash though. It shouldn't but who knows how robust these apps are. And since it's a NULL key there's no way to track it through the log file to see where it originated.

So, I need to see more of the log output from before what you posted. If you can, please upload it somewhere where I can get my hands on it or email it to me.

In the meantime, you might take a look at your Foxit .reg file to see if there's any input method and speech recognition related entries in there. Wiping them out as well as excluding the msctf.dll and imm32.dll modules from redirection might fix the problem. Maybe the .reg got contaminated some how so that Foxit is telling the system to use a locale for which the system then decides it needs these features loaded. You might also try just wiping out the .reg entirely and trying that. And try using a JPE runtime ini that excludes everything but the Foxit Reader.exe module.

And if you haven't done it already, re-verify that the previous JPE dll you were using still works since the Windows re-install. It also wouldn't hurt to see if Foxit runs okay outside of JPE on the same system. I can give you a list of all of the registry keys it mucks with if you need them.

Chris · #27 Post by **Chris** » Mon Sep 17, 2007 2:26 am

If you could run the jpe log dll with Sysinternal's DebugView running you should be able to do a find on SHFileOperation and locate the call being made. Then post that info so I can have a look and set up a test condition here to get that problem fixed.

Apologize for my late reply. I have use the Debugview you told me to and here is the result: http://mihd.net/xp7q2f . If you don't like to download from that kind of site, I will send you via Email. Just let me know.
I tried to clear Dbgview entries until the point it gave me the SHFileOperation message, but it still contains a lot entries.
It takes some time to capture using Dbgview, maybe if the capture type is lesser would it be faster?

sgp · #28 Post by **sgp** » Mon Sep 17, 2007 7:33 am

redllar wrote:
sgp wrote:I don't see anything in that log posting that makes me think that this is a JPE-related problem [snip]

But that key that the imm32 module is passing in to the RegCloseKey api function is definitely not valid. It's basically a NULL (no value) key [snip]

you might take a look at your Foxit .reg file [snip]
excluding the msctf.dll and imm32.dll modules from redirection might fix the problem. Maybe the .reg got contaminated [snip]
And try using a JPE runtime ini that excludes everything but the Foxit Reader.exe module. [snip]

And if you haven't done it already, re-verify that the previous JPE dll you were using still works since the Windows re-install. It also wouldn't hurt to see if Foxit runs okay outside of JPE on the same system.

I don't know that it's a JPE-related problem, all I can observe is that the same prog works with 015 but not 0161.

I could never reproduce again the case of a NULL key being passed by imm32. At least not in the log file.

My ini file is

Code: Select all

[Redirection]
Logging=0
FlashDisco=1
IconDisco=1
ModFrame=1
RedirMisc=0

[Registry] 
Use=1 
Data=.\Registry\%appname%.reg 

[Filesystem] 
Use=0 
Data=.\FileSystem\ 

[RegistryExclude] 
1=*

[RegistryInclude] 
1=HKEY_CURRENT_USER\software\Foxit Software\Foxit Reader
2=HKEY_CLASSES_ROOT\FoxitReader.Document
3=HKEY_CLASSES_ROOT\.pdf
4=HKEY_CLASSES_ROOT\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}
5=HKEY_CLASSES_ROOT\MIME\Database\Content Type\application/pdf
6=HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf

[RegistryIgnore] 
1=HKEY_CURRENT_USER\software\Foxit Software\Foxit Reader
2=HKEY_CLASSES_ROOT\FoxitReader.Document
3=HKEY_CLASSES_ROOT\.pdf
4=HKEY_CLASSES_ROOT\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}
5=HKEY_CLASSES_ROOT\MIME\Database\Content Type\application/pdf
6=HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf

[ModuleExclude]
1=*
;2=msctf.dll
;3=imm32.dll

[ModuleInclude]
1=%appname%.exe

Foxit always hangs at this call stack

Code: Select all

==================================================
TID               : 3796
Start Address     : !IJS_Runtime::IJS_Runtime+0x2ca9b
==================================================
TID               : 3928
Start Address     : !RegDeleteKeyW+0xfd
==================================================
TID               : 2204
Start Address     : ntdll.dll!RtlConvertUiListToApiList+0x276
==================================================

and the complete log file doesn't seem to uncover any errors (more after log file)

Code: Select all

00000000	0.00000000	[2268] *************************jauntePE::ProcessAttach - begin *************************	
00000001	0.00009862	[2268] 00002268-00002564(00001)=***** Calling pipe (create or wait, transact, close)	
00000002	0.00083335	[2268] 00002268-00002564(00002)=SetPrfA: Reading RegistryExclude paths	
00000003	0.00099258	[2268] 00002268-00002564(00003)=    *	
00000004	0.00104874	[2268] 00002268-00002564(00004)=SetPrfA: Reading RegistryInclude paths	
00000005	0.00122585	[2268] 00002268-00002564(00005)=    hkey_current_user\software\foxit software\foxit reader	
00000006	0.00130268	[2268] 00002268-00002564(00006)=    hkey_classes_root\foxitreader.document	
00000007	0.00134654	[2268] 00002268-00002564(00007)=    hkey_classes_root\.pdf	
00000008	0.00135827	[2268] 00002268-00002564(00008)=    hkey_classes_root\clsid\{14e8bbd8-1d1c-4d56-a4da-d20b75eb814e}	
00000009	0.00140409	[2268] 00002268-00002564(00009)=    hkey_classes_root\mime\database\content type\application/pdf	
00000010	0.00144879	[2268] 00002268-00002564(00010)=    hkey_current_user\software\microsoft\windows\currentversion\explorer\fileexts\.pdf	
00000011	0.00150773	[2268] 00002268-00002564(00011)=SetPrfA: Reading RegistryIgnore paths	
00000012	0.00170608	[2268] 00002268-00002564(00012)=    hkey_current_user\software\foxit software\foxit reader	
00000013	0.00175162	[2268] 00002268-00002564(00013)=    hkey_classes_root\foxitreader.document	
00000014	0.00176363	[2268] 00002268-00002564(00014)=    hkey_classes_root\.pdf	
00000015	0.00180610	[2268] 00002268-00002564(00015)=    hkey_classes_root\clsid\{14e8bbd8-1d1c-4d56-a4da-d20b75eb814e}	
00000016	0.00185219	[2268] 00002268-00002564(00016)=    hkey_classes_root\mime\database\content type\application/pdf	
00000017	0.00189577	[2268] 00002268-00002564(00017)=    hkey_current_user\software\microsoft\windows\currentversion\explorer\fileexts\.pdf	
00000018	0.00209664	[2268] 00002268-00002564(00018)=SetPrfA: Reading ModuleExclude paths	
00000019	0.00214692	[2268] 00002268-00002564(00019)=    *	
00000020	0.00215810	[2268] 00002268-00002564(00020)=    msctf.dll	
00000021	0.00220112	[2268] 00002268-00002564(00021)=    imm32.dll	
00000022	0.00224973	[2268] 00002268-00002564(00022)=SetPrfA: Reading ModuleInclude paths	
00000023	0.00239863	[2268] 00002268-00002564(00023)=    foxitreader.exe	
00000024	0.00258692	[2268] 00002268-00002564(00024)=SetPrfA: Reading ModuleIgnore paths	
00000025	0.00263525	[2268] 00002268-00002564(00025)=SetPrfA: Portable Registry.	
00000026	0.00264698	[2268] 00002268-00002564(00026)=SetPrfA: Ini1 used (C:\temp\foxit\FoxitReader_jauntePE.ini).	
00000027	0.00269392	[2268] 00002268-00002564(00027)=SetPrfA: Ini2 used (C:\temp\foxit\FoxitReader_jauntePE.ini).	
00000028	0.00274057	[2268] 00002268-00002564(00028)=SetPrfA: Redirection on (C:\temp\foxit\Registry\FoxitReader.reg).	
00000029	0.00278471	[2268] 00002268-00002564(00029)=SetPrfA: 7 excludes read in.	
00000030	0.00285651	[2268] 00002268-00002564(00030)=SetPrfA: 6 includes read in.	
00000031	0.00290037	[2268] 00002268-00002564(00031)=SetPrfA: 6 ignores  read in.	
00000032	0.00291182	[2268] 00002268-00002564(00032)=SetPrfA: ini1=*****C:\temp\foxit\FoxitReader_jauntePE.ini*****	
00000033	0.00295457	[2268] 00002268-00002564(00033)=SetPrfA: ini2=*****C:\temp\foxit\FoxitReader_jauntePE.ini*****	
00000034	0.00299759	[2268] 00002268-00002564(00034)=SetPrfA: dat =*****C:\temp\foxit\Registry\FoxitReader.reg*****	
00000035	0.00351693	[2268] 00002268-00002564(00035)=SetPrfA: Reading FilesystemExclude paths	
00000036	0.00380579	[2268] 00002268-00002564(00036)=SetPrfA: Reading FilesystemInclude paths	
00000037	0.00395721	[2268] 00002268-00002564(00037)=SetPrfA: Reading FilesystemIgnore paths	
00000038	0.00396978	[2268] 00002268-00002564(00038)=SetPrfA: Portable Filesystem.	
00000039	0.00401671	[2268] 00002268-00002564(00039)=SetPrfA: Ini1 used (C:\temp\foxit\FoxitReader_jauntePE.ini).	
00000040	0.00406811	[2268] 00002268-00002564(00040)=SetPrfA: Ini2 used (C:\temp\foxit\FoxitReader_jauntePE.ini).	
00000041	0.00411197	[2268] 00002268-00002564(00041)=SetPrfA: No redirection.	
00000042	0.00418349	[2268] 00002268-00002564(00042)=SetPrfA: No excludes read in.	
00000043	0.00422568	[2268] 00002268-00002564(00043)=SetPrfA: No includes read in.	
00000044	0.00423713	[2268] 00002268-00002564(00044)=SetPrfA: No ignores  read in.	
00000045	0.00427959	[2268] 00002268-00002564(00045)=SetPrfA: ini1=*****C:\temp\foxit\FoxitReader_jauntePE.ini*****	
00000046	0.00432262	[2268] 00002268-00002564(00046)=SetPrfA: ini2=*****C:\temp\foxit\FoxitReader_jauntePE.ini*****	
00000047	0.00436508	[2268] 00002268-00002564(00047)=SetPrfA: dat =*****C:\temp\foxit\FileSystem\*****	
00000048	0.00444554	[2268] 00002268-00002564(00048)=ModExcludeAll=no, ModGetCaller=yes, WFSExcludeAll=no, WFSCheckSkip=no	
00000049	0.00448940	[2268] 00002268-00002564(00049)=    Successfully read from the pipe	
00000050	0.00450113	[2268] 00002268-00002564(00050)=         Pipe version:         117510401	
00000051	0.00450113	[2268] 	
00000052	0.00454359	[2268] 00002268-00002564(00051)=         Inject children:      no	
00000053	0.00454359	[2268] 	
00000054	0.00458634	[2268] 00002268-00002564(00052)=         Redirect MSI:         yes	
00000055	0.00458634	[2268] 	
00000056	0.00462880	[2268] 00002268-00002564(00053)=         Redirect registry:    yes	
00000057	0.00462880	[2268] 	
00000058	0.00470004	[2268] 00002268-00002564(00054)=         Redirect file system: no	
00000059	0.00470004	[2268] 	
00000060	0.00474250	[2268] 00002268-00002564(00055)=         In-memory registry:   1	
00000061	0.00474250	[2268] 	
00000062	0.00475535	[2268] 00002268-00002564(00056)=         Build hierarchy:      no	
00000063	0.00475535	[2268] 	
00000064	0.00479726	[2268] 00002268-00002564(00057)=         Discovery mode:       no	
00000065	0.00479726	[2268] 	
00000066	0.00483972	[2268] 00002268-00002564(00058)=         Draw titlebar icons:  yes	
00000067	0.00483972	[2268] 	
00000068	0.00488246	[2268] 00002268-00002564(00059)=         Draw frame border:    yes	
00000069	0.00488246	[2268] 	
00000070	0.00495286	[2268] 00002268-00002564(00060)=         Flash on disconnect:  yes	
00000071	0.00495286	[2268] 	
00000072	0.00499617	[2268] 00002268-00002564(00061)=         Icon  on disconnect:  yes	
00000073	0.00499617	[2268] 	
00000074	0.00500902	[2268] 00002268-00002564(00062)=         Start suspended:      no	
00000075	0.00500902	[2268] 	
00000076	0.00505595	[2268] 00002268-00002564(00063)=         Single thread:        no	
00000077	0.00505595	[2268] 	
00000078	0.00510093	[2268] 00002268-00002564(00064)=         Inner border RGB:     032, 032, 032 (2105376)	
00000079	0.00510093	[2268] 	
00000080	0.00514591	[2268] 00002268-00002564(00065)=         Outer border RGB:     255, 032, 032 (2105599)	
00000081	0.00514591	[2268] 	
00000082	0.00522050	[2268] 00002268-00002564(00066)=         Registry ini:         C:\temp\foxit\FoxitReader_jauntePE.ini	
00000083	0.00522050	[2268] 	
00000084	0.00526519	[2268] 00002268-00002564(00067)=         Registry data:        C:\temp\foxit\Registry\FoxitReader.reg	
00000085	0.00526519	[2268] 	
00000086	0.00528503	[2268] 00002268-00002564(00068)=         File system ini:      C:\temp\foxit\FoxitReader_jauntePE.ini	
00000087	0.00528503	[2268] 	
00000088	0.00532889	[2268] 00002268-00002564(00069)=         File system data:     C:\temp\foxit\FileSystem\\	
00000089	0.00532889	[2268] 	
00000090	0.00536912	[2268] TLS<BOOL/int>::count=5	
00000091	0.00536912	[2268] TLS<CHAR*>   ::count=1	
00000092	0.00541493	[2268] 00002268-00002564(00070)=    CreateDirHierarchyA (other=C:\temp\foxit\Registry\FoxitReader.reg)	
00000093	0.00552417	[2268] 00002268-00002564(00071)=    CreateDirHierarchyA - exists  (other=C:\temp)	
00000094	0.00558619	[2268] 00002268-00002564(00072)=    CreateDirHierarchyA - exists  (other=C:\temp\foxit)	
00000095	0.00559876	[2268] 00002268-00002564(00073)=    CreateDirHierarchyA - exists  (other=C:\temp\foxit\Registry)	
00000096	0.00573369	[2268] *************************jauntePE::ProcessAttach - before .reg memory loading *************************	
00000097	0.00586220	[2268] *************************jauntePE::ProcessAttach - after  .reg memory loading *************************	
00000098	0.00605580	[2268] 00002268-00002564(00074)=    KeyName: NOT FOUND (hKey=80000001)	
00000099	0.00612955	[2268] 00002268-00002564(00075)=    KeyName: OUT (hKey=80000001, other=HKEY_UNKNOWN)	
00000100	0.01659792	[2268] *************************jauntePE::ProcessAttach - before api hooking         *************************	
00000101	0.09377673	[2268] *************************jauntePE::ProcessAttach - after  api hooking         *************************	
00000102	0.09384237	[2268] 00002268-00002564(00076)=    ***** BEGIN In memory profile contents BEGIN *****	
00000103	0.09388596	[2268] 00002268-00002564(00077)=          BEGIN ***** gLines ************* BEGIN	
00000104	0.09393457	[2268] 00002268-00002564(00078)=    Windows Registry Editor Version 5.00	
00000105	0.09400441	[2268] 00002268-00002564(00079)=    	
00000106	0.09404548	[2268] 00002268-00002564(00080)=          ENDIN ***** gLines ************* ENDIN	
00000107	0.09408654	[2268] 00002268-00002564(00081)=          BEGIN ***** gSectKeys ********** BEGIN	
00000108	0.09412789	[2268] 00002268-00002564(00082)=          ENDIN ***** gSectKeys ********** ENDIN	
00000109	0.09416252	[2268] 00002268-00002564(00083)=    ***** ENDIN In memory profile contents ENDIN *****	
00000110	0.09422175	[2268] *************************jauntePE::ProcessAttach - end   *************************	
00000111	0.09425611	[2268] *************************jauntePE::ProcessAttach - stats begin *************************	
00000112	0.09429047	[2268] Process  was created  at  15:0:27:750.	
00000113	0.09429047	[2268] Hook dll was attached at  15:0:27:828.	
00000114	0.09429047	[2268] Hook dll was finished at  15:0:27:921.	
00000115	0.09429047	[2268] 	
00000116	0.09429047	[2268] 78 ms for hook dll attach.	
00000117	0.09429047	[2268] 93 ms for hook dll attach to finish.	
00000118	0.10040801	[2268] *************************jauntePE::ProcessAttach - stats end   *************************	
00000119	0.33240789	[2268] 00002268-00002124(00084)=RegOpenKeyExW (hKey=000002D4, other=Software\Microsoft\Windows\CurrentVersion\ThemeManager)	
00000120	0.33247718	[2268] 00002268-00002124(00085)=    ** caller= ** (other=uxtheme.dll)	
00000121	0.33259645	[2268] 00002268-00002124(00086)=    bypass call?  (other=** NO **)	
00000122	0.33266798	[2268] 00002268-00002124(00087)=    KeyName: IN  (hKey=000002D4, other=USER\S-1-5-21-73586283-1844237615-725345543-1001)	
00000123	0.33272496	[2268] 00002268-00002124(00088)=    KeyName: OUT (hKey=000002D4, other=HKEY_CURRENT_USER)	
00000124	0.33323258	[2268] 00002268-00002124(00089)=    ByPassItW: bypassing (hKey=000002D4, other=Software\Microsoft\Windows\CurrentVersion\ThemeManager)	
00000125	0.33331081	[2268] 00002268-00002124(00090)=    return code: 0	
00000126	0.33336499	[2268] 00002268-00002124(00091)=RegQueryValueExW (hKey=000002DC, other=Compositing)	
00000127	0.33340886	[2268] 00002268-00002124(00092)=    ** caller= ** (other=uxtheme.dll)	
00000128	0.33347255	[2268] 00002268-00002124(00093)=    bypass call?  (other=** NO **)	
00000129	0.33353066	[2268] 00002268-00002124(00094)=    KeyName: IN  (hKey=000002DC, other=USER\S-1-5-21-73586283-1844237615-725345543-1001\Software\Microsoft\Windows\CurrentVersion\ThemeManager)	
00000130	0.33359995	[2268] 00002268-00002124(00095)=    KeyName: OUT (hKey=000002DC, other=HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\ThemeManager)	
00000131	0.33365357	[2268] 00002268-00002124(00096)=    ByPassItW: bypassing (hKey=000002DC, other=)	
00000132	0.33371699	[2268] 00002268-00002124(00097)=    return code: 2	
00000133	0.33376142	[2268] 00002268-00002124(00098)=RegCloseKey (hKey=000002DC)	
00000134	0.33380473	[2268] 00002268-00002124(00099)=    ** caller= ** (other=uxtheme.dll)	
00000135	0.33386311	[2268] 00002268-00002124(00100)=    bypass call?  (other=** NO **)	
00000136	0.33392930	[2268] 00002268-00002124(00101)=    KeyName: IN  (hKey=000002DC, other=USER\S-1-5-21-73586283-1844237615-725345543-1001\Software\Microsoft\Windows\CurrentVersion\ThemeManager)	
00000137	0.33398324	[2268] 00002268-00002124(00102)=    KeyName: OUT (hKey=000002DC, other=HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\ThemeManager)	
00000138	0.33403015	[2268] 00002268-00002124(00103)=    ByPassItA: bypassing (hKey=000002DC, other=)	
00000139	0.33409107	[2268] 00002268-00002124(00104)=    return code: 0	
00000140	0.33413494	[2268] 00002268-00002124(00105)=RegCloseKey (hKey=000002D4)	
00000141	0.33418241	[2268] 00002268-00002124(00106)=    ** caller= ** (other=uxtheme.dll)	
00000142	0.33424723	[2268] 00002268-00002124(00107)=    bypass call?  (other=** NO **)	
00000143	0.33430141	[2268] 00002268-00002124(00108)=    KeyName: IN  (hKey=000002D4, other=USER\S-1-5-21-73586283-1844237615-725345543-1001)	
00000144	0.33435199	[2268] 00002268-00002124(00109)=    KeyName: OUT (hKey=000002D4, other=HKEY_CURRENT_USER)	
00000145	0.33439669	[2268] 00002268-00002124(00110)=    ByPassItA: bypassing (hKey=000002D4, other=)	
00000146	0.33449000	[2268] 00002268-00002124(00111)=    return code: 0	
00000147	0.33453524	[2268] 00002268-00002124(00112)=RegOpenKeyExW (hKey=000002DC, other=Control Panel\Desktop)	
00000148	0.33458918	[2268] 00002268-00002124(00113)=    ** caller= ** (other=uxtheme.dll)	
00000149	0.33464393	[2268] 00002268-00002124(00114)=    bypass call?  (other=** NO **)	
00000150	0.33469728	[2268] 00002268-00002124(00115)=    KeyName: IN  (hKey=000002DC, other=USER\S-1-5-21-73586283-1844237615-725345543-1001)	
00000151	0.33475539	[2268] 00002268-00002124(00116)=    KeyName: OUT (hKey=000002DC, other=HKEY_CURRENT_USER)	
00000152	0.33480987	[2268] 00002268-00002124(00117)=    ByPassItW: bypassing (hKey=000002DC, other=Control Panel\Desktop)	
00000153	0.33487579	[2268] 00002268-00002124(00118)=    return code: 0	
00000154	0.33530602	[2268] 00002268-00002124(00119)=RegQueryValueExW (hKey=000002D4, other=LameButtonText)	
00000155	0.33535659	[2268] 00002268-00002124(00120)=    ** caller= ** (other=uxtheme.dll)	
00000156	0.33541554	[2268] 00002268-00002124(00121)=    bypass call?  (other=** NO **)	
00000157	0.33547086	[2268] 00002268-00002124(00122)=    KeyName: IN  (hKey=000002D4, other=USER\S-1-5-21-73586283-1844237615-725345543-1001\Control Panel\Desktop)	
00000158	0.33552700	[2268] 00002268-00002124(00123)=    KeyName: OUT (hKey=000002D4, other=HKEY_CURRENT_USER\Control Panel\Desktop)	
00000159	0.33558118	[2268] 00002268-00002124(00124)=    ByPassItW: bypassing (hKey=000002D4, other=)	
00000160	0.33591112	[2268] 00002268-00002124(00125)=    return code: 2	
00000161	0.33595973	[2268] 00002268-00002124(00126)=RegCloseKey (hKey=000002D4)	
00000162	0.33600444	[2268] 00002268-00002124(00127)=    ** caller= ** (other=uxtheme.dll)	
00000163	0.33606142	[2268] 00002268-00002124(00128)=    bypass call?  (other=** NO **)	
00000164	0.33612120	[2268] 00002268-00002124(00129)=    KeyName: IN  (hKey=000002D4, other=USER\S-1-5-21-73586283-1844237615-725345543-1001\Control Panel\Desktop)	
00000165	0.33617261	[2268] 00002268-00002124(00130)=    KeyName: OUT (hKey=000002D4, other=HKEY_CURRENT_USER\Control Panel\Desktop)	
00000166	0.33651036	[2268] 00002268-00002124(00131)=    ByPassItA: bypassing (hKey=000002D4, other=)	
00000167	0.33657628	[2268] 00002268-00002124(00132)=    return code: 0	
00000168	0.33662128	[2268] 00002268-00002124(00133)=RegCloseKey (hKey=000002DC)	
00000169	0.33666486	[2268] 00002268-00002124(00134)=    ** caller= ** (other=uxtheme.dll)	
00000170	0.33672407	[2268] 00002268-00002124(00135)=    bypass call?  (other=** NO **)	
00000171	0.33677772	[2268] 00002268-00002124(00136)=    KeyName: IN  (hKey=000002DC, other=USER\S-1-5-21-73586283-1844237615-725345543-1001)	
00000172	0.33713362	[2268] 00002268-00002124(00137)=    KeyName: OUT (hKey=000002DC, other=HKEY_CURRENT_USER)	
00000173	0.33718252	[2268] 00002268-00002124(00138)=    ByPassItA: bypassing (hKey=000002DC, other=)	
00000174	0.34029940	[2268] 00002268-00002124(00139)=    return code: 0

I noticed that if I explicitly exclude msctf.dll and imm32.dll in the ini file, but also leave the 1=* exclusion in, jauntePe thinks that there isn't an ExcludeModuleAll filter on. This is a small glitch that you could fix.

I also tried excluding nothing, or just msctf and imm32, to no avail.

Foxit works for me with 015 on my rebuilt system.

redllar · #29 Post by **redllar** » Mon Sep 17, 2007 7:32 pm

Chris wrote:Apologize for my late reply. I have use the Debugview you told me to and here is the result: http://mihd.net/xp7q2f . If you don't like to download from that kind of site, I will send you via Email. Just let me know.
I tried to clear Dbgview entries until the point it gave me the SHFileOperation message, but it still contains a lot entries.

Got it. Thanks. Based on the log you weren't supposed to get that popup though, so it looks like I have another bug to fix. Sorry about that.

Chris wrote:It takes some time to capture using Dbgview, maybe if the capture type is lesser would it be faster?

Not really. Due to the way the debug output function works, it's just slow. What I really need to do is make my own JPE logger window to dump to. That would also give us the opportunity to do more sophisticated types of output manipulation. It would even make for a good discover-while-redirecting list which could be used to help build inclusion/exclusion lists directly.

redllar · #30 Post by **redllar** » Mon Sep 17, 2007 7:41 pm

Hey sgp, thanks for all of the useful tries and info. I'll try and remember to put in a fix for that strange exclusion list set you created.

I was about to "give up the ship" when I decided to download GoogleTalk and try it again, since I knew it was one that used to work but now is causing problems on other's machines.

And 'lo and behold it worked fine via 011 but I got an error popup with 0161 just running through the installer - with all dll versions and with the single-threaded setting on or off. So I finally have an app here that I can use to figure out what's going on and hopefully once I do my fix(es) will translate into working apps for you guys as well.

So thanks all for sticking it out with me. I hope to reward your hardwork with a really solid version soon.