There is a situation in which RealTemp.exe doesn't read its INI file. For a little background (not necessary) see this thread:
https://jpsoft.com/forums/threads/difference-in-exection-with-and-without-start.6497/
In a nutshell, when TCC (command interpreter from jpsoft) uses its START command (much like CMD's START) to start RealTemp.exe, RealTemp.exe does not read its INI file and apparently tries (66 times) to read INI data from its own EXE.
In my most recent test ...
I started RealTemp.exe and suspended it immediately, like this:
Then I attached to RealTemp.exe with WinDbg and created a breakpoint at GetPrivateProfileStringW. I also started ProcessMonitor (SysInternals) and asked it to monitor file system activity by RealTemp.exe.
When I resumed RealTemp.exe, it broke at GetPrivateProfileStringW (as expected) and these events (far below) were logged by ProcessMonitor. 65 more such events would follow, on each call to GetPrivateProfileString. As can be seen, it's querying the wrong file (the EXE). That's unlike starting RealTemp.exe by other means, when those 66 queries are aimed at the INI file.
TCC's START command ultimately uses CreateProcess with correct looking first two arguments. As a programmer, I can't imagine how anything in a call to CreateProcess could cause another app to misbehave that way. I also can't imagine how an app might attempt to use GetPrivateProfileStringW on its own EXE file. And I'm very curious about what's going on.
- Vince
https://jpsoft.com/forums/threads/difference-in-exection-with-and-without-start.6497/
In a nutshell, when TCC (command interpreter from jpsoft) uses its START command (much like CMD's START) to start RealTemp.exe, RealTemp.exe does not read its INI file and apparently tries (66 times) to read INI data from its own EXE.
In my most recent test ...
I started RealTemp.exe and suspended it immediately, like this:
Code:
c:\users\vefatica\desktop\realtemp> start RealTemp.exe & priority /s %_startpid
Suspending thread 278
Then I attached to RealTemp.exe with WinDbg and created a breakpoint at GetPrivateProfileStringW. I also started ProcessMonitor (SysInternals) and asked it to monitor file system activity by RealTemp.exe.
When I resumed RealTemp.exe, it broke at GetPrivateProfileStringW (as expected) and these events (far below) were logged by ProcessMonitor. 65 more such events would follow, on each call to GetPrivateProfileString. As can be seen, it's querying the wrong file (the EXE). That's unlike starting RealTemp.exe by other means, when those 66 queries are aimed at the INI file.
TCC's START command ultimately uses CreateProcess with correct looking first two arguments. As a programmer, I can't imagine how anything in a call to CreateProcess could cause another app to misbehave that way. I also can't imagine how an app might attempt to use GetPrivateProfileStringW on its own EXE file. And I'm very curious about what's going on.
- Vince
Code:
21:33:22.9039054 REALTEMP.EXE 1536 IRP_MJ_CREATE C:\Users\vefatica\Desktop\RealTemp\RealTemp.exe SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened
21:33:22.9039428 REALTEMP.EXE 1536 FASTIO_LOCK C:\Users\vefatica\Desktop\RealTemp\RealTemp.exe FAST IO DISALLOWED Exclusive: False, Offset: 0, Length: 4,294,967,295, Fail Immediately: False
21:33:22.9039505 REALTEMP.EXE 1536 IRP_MJ_LOCK_CONTROL C:\Users\vefatica\Desktop\RealTemp\RealTemp.exe SUCCESS Lock Type: Lock, Exclusive: False, Offset: 0, Length: 4,294,967,295, Fail Immediately: False
21:33:22.9039635 REALTEMP.EXE 1536 FASTIO_QUERY_INFORMATION C:\Users\vefatica\Desktop\RealTemp\RealTemp.exe SUCCESS Type: QueryStandardInformationFile, AllocationSize: 217,088, EndOfFile: 216,064, NumberOfLinks: 1, DeletePending: False, Directory: False
21:33:22.9042307 REALTEMP.EXE 1536 IRP_MJ_READ C:\Users\vefatica\Desktop\RealTemp\RealTemp.exe SUCCESS Offset: 0, Length: 216,064, Priority: Low
21:33:22.9050060 REALTEMP.EXE 1536 FASTIO_UNLOCK_SINGLE C:\Users\vefatica\Desktop\RealTemp\RealTemp.exe FAST IO DISALLOWED Offset: 0, Length: 4,294,967,295
21:33:22.9050133 REALTEMP.EXE 1536 IRP_MJ_LOCK_CONTROL C:\Users\vefatica\Desktop\RealTemp\RealTemp.exe SUCCESS Lock Type: UnlockSingle, Offset: 0, Length: 4,294,967,295
21:33:22.9050326 REALTEMP.EXE 1536 IRP_MJ_CLEANUP C:\Users\vefatica\Desktop\RealTemp\RealTemp.exe SUCCESS
Last edited: