Quickly Configure Symbol Information for Process Monitor & Process Explorer
Posted by William Diaz on May 1, 2012
I often find myself running Process Monitor and Process Explorer on user workstations. But to get the most of either of these tools, you really need to configure symbols so you can accurately read thread and stack information when doing a deeper analysis of a process. This can often be a nuisance because I am a cut and paste type of guy and even after doing it numerous times, I still have trouble recalling the Microsoft symbol path. On top of that, many times I run these tools with the user connected so speed is a necessity. To work around that, I decided to write a small script that I can run from a file server that will do it for me. Run the script before your start either tool.
There is one prerequisite, however: you need the full dbghelp.dll from the Windows Debugging Tools as the debug help DLL in system32 is not sufficient. If you are running on both 32 and 64 bit systems, you will need to get both the 64 bit and 32 bit versions. Store them away on network share and modify the script below to look to that share. In my case, we are still a mixed environment so I renamed the 32 bit dbghelp to dbghelp32.dll while the 64 bit version remains unchanged and created two different scripts. The respective DLL will copied into a folder C:\DbgHelp on the local system .
I also added a 5 second duration for new open and close processes and threads.
|
const HKEY_CURRENT_USER = &H80000001 strValueName = "DbgHelpPath" strValueName = "SymbolPath" strValueName = "HighlightDuration" ‘Process Monitor 64 strKeyPath = "Software\Sysinternals\Process Monitor" strValueName = "DbgHelpPath" strValueName = "SymbolPath" ‘Copy full dbghelp.dll 64 bit to folder DbgHelp. Set oFSO = CreateObject("Scripting.FileSystemObject") Set FSO = CreateObject("Scripting.FileSystemObject") |
Windows Explored 
Leave a comment