[Bug 13913] Process Monitor can not capture live events

[wine-bugs at winehq.org]

http://bugs.winehq.org/show_bug.cgi?id=13913


Anastasius Focht <focht at gmx.net> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |focht at gmx.net




--- Comment #3 from Anastasius Focht <focht at gmx.net>  2008-06-15 04:21:01 ---
Hello,

--- quote ---
If this program uses kernel driver to intercept/read events, then it's a won't
fix.
--- quote ---

Yes, procmon uses a kernel mode filter driver as many other tools from the
suite.

The error message is due to failing filter API check.
Even if you fix it by using the native filter library (Fltlib.dll), this won't
work anyway.
Most Sysinternals tools use NtLoadDriver() to load the accompanying helper
kernel driver.
Those drivers hook kernel services and peek into windows kernel structures.
This is not in the scope of wine.

WONTFIX.

While you're at it, close http://bugs.winehq.org/show_bug.cgi?id=13012 (regmon)
too.
Same problem domain there.

Just out of curiosity ... why don't you use wine's builtin facilities (debug
channels) for process monitoring?

Regards


-- 
Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email
Do not reply to this email, post in Bugzilla using the
above URL to reply.
------- You are receiving this mail because: -------
You are watching all bug changes.