3

TL;DR - How does the Spy++ tool really construct its process list?

Stage

We have an MFC desktop application (running on Windows XP) that is hanging in that it doesn't react to any user input anymore. It is redrawn when switching to it via alt-tab however. (It does receive WM_SETFOCUS, WM_ACTIVATE, etc. It apparently does not receive any mouse or keyboard messages.)

Since the app is hanging in some limbo, we pulled a few process dumps, but these were of little help so far. Enter:

Spy++

We used Spy++ to find the information I gave above about the window messages this application seems to be processing. We did this by Opening the Windows View Windows View and selecting our application Window and in the Messages properties selected Windows of same process and Messages to View : Select All.

However we first tried to view all messages of this process by opening the Processes View Processes View of Spy++ and our application is not shown in this process list. Cross checking on another PC where the app is running normally, the process is also normally shown in the processes list of Spy++.

Can anything about the misbehaving app be inferred from the fact that the process is not shown in Spy++'s Process View, but the main window of the app is shown in the Windows View. Why would a process with a main window that is visible not be shown in Spy++'s Processes View?

The process is listed in Task Manager and in the Attach Process Window of Visual Studio 2005. So these tools apparently use a different method to list processes than Spy++ ... ?

The system where the app is currently hanging is a Windows XP SP2 system and we've used the Spy++ Utility that comes with Visual Studio 2005.

The behavior does recur occasionally, but only after the App has been running for several days!

nobody
  • 19,814
  • 17
  • 56
  • 77
Martin Ba
  • 37,187
  • 33
  • 183
  • 337
  • If your app is run elevated (as administrator), and Spy++ is not elevated, it may not be able to see your process. – Aidan Ryan Nov 18 '11 at 18:31
  • @Aidan - this is on a Windows XP box. No elevation around. :-) – Martin Ba Nov 18 '11 at 18:36
  • 1
    Given that the process is not responding to all messages, there's a good chance that it is not responding to whatever message is sent by Spy++ to get the Window title, etc. This may cause your process not to appear in the Processes View either. – Aidan Ryan Nov 21 '11 at 14:16

3 Answers3

2

Running Vista or later? Your process is probably elevated and Spy++ is not. Newer versions of Spy++ require elevation. So, try elevating Spy++ explicitly and see if that helps.

l33t
  • 18,692
  • 16
  • 103
  • 180
  • Having the same problem, I tried Spy++ both elevated and non-elevated, and my task both elevated and non-elevated. None of the combinations worked. It can't be a bitness problem either, because I have a 32-bit system. – Medinoc Apr 01 '14 at 19:07
0

Spy++ requires the following two values in the registry to be disabled (0) to display the processes/threads list AT ALL:

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib
HKLM\System\CurrentControlSet\Services\PerfProc\Performance

    Disable Performance Counters -> either 0 or not present

Was going insane trying to find out why it refused to display them. It's some kind of bad joke - this debugger requires itself a debugger to get it working! Not that WinDBG would display any meaningful info, MS doesn't even provide a symbol file on their symbol server, pfft.

Anyway, maybe it doesn't display processes that have their performance counters disabled, because I think, this can be set on individual basis, at least for services, like:

HKLM\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance

    Disable Performance Counters

So it's basically always a value of the "Performance" subkey. All this stuff is undocumented, it makes use of advapi32.dll functions like "PerfRegQueryValue" and "PerfRegQueryInfoKey"... don't ask me.

WRFan
  • 147
  • 1
  • 3
0

Yes, of course things can be inferred from this. Don't take anything I say too seriously in this context, I'd have to go look at the code. But I believe that Spy goes off and looks at the EnumProcesses API. (http://msdn.microsoft.com/en-us/library/ms682629.aspx)

So, if your process isn't showing up there... hrm.

But, what is different between the system where it's working and the one where it's not?

Kevin Williams
  • 190
  • 3
  • Not really any *readily known* differences in the systems. That is, with all the hardware the app is communication with, it's very hard to get an exact replica. I just cross checked a bare-bone configuration of the app on my developer machine to have *some* reference point. – Martin Ba Nov 18 '11 at 10:24
  • Wouldn't EnumProcesses also be what TaskManager uses? – Martin Ba Nov 18 '11 at 10:36