Debugging

[Juan Lang]

> I appreciate the tip about falling back on the relay debug channel,
> but may I ask how you know the problem is with BlockInput not existing?
> Is there something from the output that I'm not understanding, or do
> you just know that because you're familiar with the kernel32.dll
> code?

Molle's right--it just looks suspicious, since it's the last thing that's
called before ExitProcess.  I didn't copy-paste any more of the log, but
there were a whole bunch of GetProcAddress calls prior to this that
succeeded, which raises the probability that this was the cause.  And, as
Molle suggested, a quick glance at the kernel32 code shows that BlockInput
is missing.

As far as how did I spot this in the log--well, that's just experience. 
You can learn it pretty quickly though, especially when an app dies early.
   I just scroll through a log from the end toward the beginning, and look
for a change in pattern on the screen.  Different things are starting to
happen there, so I slow down for a closer look.  If it looks like normal
shutdown code--and there's usually hundreds of lines of this stuff--I
ignore it and move on.

As far as how to deal with this, try modifying kernel32.spec to add a stub
for BlockInput, like:
@ stub BlockInput
and see if the program gets any further.  Chances are it'll crash
somewhere else down the line, so you'll have to do the usual
wash-rinse-repeat.  You should also take a look through KeePass's source
code and try to find out what's going on.

--Juan

__________________________________________________
Do You Yahoo!?
Tired of spam?  Yahoo! Mail has the best spam protection around 
http://mail.yahoo.com