Download VMware ThinApp User`s Manual

Chapter 5 Monitoring and Troubleshooting ThinApp
The first is obtained by calling GetCurrentDirectoryW, and the second is from calling GetFullPathNameW with “.” as the path specifies. In both cases, this returns the path for the current working directory, making it clear exactly how cmd.exe is obtaining this path. You can see in the log file how cmd.exe creates the c:\test\cmd_test\bin> prompt. This is accomplished by querying the environment variable “PROMPT” that returns “$P$G” and uses the API function WriteConsoleW to print the prompt to the screen after internally expanding “$P$G” to c:\test\cmd_test\bin>.
000824 0a88 cmd.exe :4ad0697a<-ADVAPI32.dll:77dd038f FormatMessageW
->DWORD=29h
(OUT LPWSTR lpBuffer=*4AD38BA0h->L"(C) Copyright 1985-2001 Microsoft
Corp.\0Dh\0Ah")
000825 0a88 cmd.exe :4ad069d1->ADVAPI32.dll:77dd038f FormatMessageW (IN DWORD
dwFlags=1800h, IN LPCVOID lpSource=*0h, IN DWORD dwMessageId=2334h, IN DWORD
dwLanguageId=0h, IN DWORD nSize=2000h, IN *Arguments=*13DD40h->...)
000826 0a88
FormatMessageW
FORMAT_MESSAGE_FROM_HMODULE FORMAT_MESSAGE_FROM_SYSTEM
line_width=unlimited lpSource=0x0, dwMessageId=0x2334, dwLanguageId=0x0
-> 0x29 ((C) Copyright 1985-2001 Microsoft
Corp.
)
000827 0a88 cmd.exe :4ad069d1<-ADVAPI32.dll:77dd038f FormatMessageW
->DWORD=29h
(OUT LPWSTR lpBuffer=*4AD38BA0h->L"(C) Copyright 1985-2001 Microsoft
Corp.\0Dh\0Ah")
000828 0a88 cmd.exe :4ad08d01->kernel32.dll:7c835484 WriteConsoleW (IN
HANDLE
hConsoleOutput=7h, IN const *lpBuffer=*4AD38BA0h, IN DWORD
nNumberOfCharsToWrite=29h, IN
LPVOID lpReserved=*0h)
000829 0a88 cmd.exe :4ad08d01<-kernel32.dll:7c835484 WriteConsoleW ->BOOL=1h
(OUT
LPDWORD lpNumberOfCharsWritten=*13DD24h->29h)
000830 0a88 cmd.exe :4ad048f4->msctfime.ime:755c039b GetModuleHandleW (IN
LPCWSTR
lpModuleName=*4AD0498Ch->L"KERNEL32.DLL")
000831
0a88 GetModuleHandleW 'KERNEL32.DLL' ->
7c800000
000832 0a88 cmd.exe :4ad048f4<-msctfime.ime:755c039b GetModuleHandleW ->HMODULE=7c800000h ()
000833 0a88 cmd.exe :4ad04907->AcGenral.DLL:6f880364 GetProcAddress (IN
HMODULE hModule=7c800000h, IN LPCSTR lpProcName=*4AD04980h->"CopyFileExW")
000834 0a88
GetProcAddress
mod=7c800000/C:\WINDOWS\system32\kernel32.dll () 'CopyFileExW' -> 7feb1fcf
000835 0a88 cmd.exe :4ad04907<-AcGenral.DLL:6f880364 GetProcAddress ->FARPROC=*7FEB1FCFh ()
000836 0a88 cmd.exe :4ad04919->AcGenral.DLL:6f880364 GetProcAddress (IN
HMODULE
hModule=7c800000h, IN LPCSTR lpProcName=*4AD0496Ch->"IsDebuggerPresent")
VMware, Inc.
81