5.1

ThinApp User’s Guide
96 VMware, Inc.
 Search for the error message displayed in dialog boxes.
Some applications call the MessageBox Win32 API function to display unexpected errors at runtime. You
can search a trace file for MessageBox or the contents of the string displayed in the error and determine
what the application was running just before the dialog box appeared.
 Narrow the focus on calls originating from a specific DLL and thread.
The log format specifies the DLL and thread that makes a call. You can often ignore the calls from system
DLLs.
Log Format
A trace file includes the following sections:
 System configuration
This section includes information about the operating system, drives, installed software, environment
variables, process list, services, and drivers.
The information starts with a Dump started on string and ends with a Dump ended on string.
 Header
This section shows contextual information for the instance of the process that Log Monitor tracks. Some
of the displayed attributes show logging options, address ranges when the operating system runtime is
loaded, and macro mapping to actual system paths.
ThinApp marks the beginning of the header section with sequence number 000001. In typical
circumstances, ThinApp marks the end of this section with a message about the Application Sync utility.
 Body
This section includes trace activity as the application starts and performs operations. Each line represents
function calls that target executable files or one of the DLLs make.
The section starts with a New Modules detected in memory entry, followed by the SYSTEM_LOADED
modules list. The section ends with a Modules Loaded entry.
 Summary
This section includes modules that the captured application loads, potential errors, and a profile of the
150 slowest calls.
The section starts with the Modules Loaded message.
General API Log Message Format
The following message shows a format example for API calls.
000257 0a88 mydll.dll :4ad0576d->kernel32.dll:7c81b1f0 SetConsoleMode (IN HANDLE
hConsoleHandle=7h, IN DWORD dwMode=3h)
000258 0a88 mydll.dll :4ad0576d<-kernel32.dll:7c81b1f0 SetConsoleMode ->BOOL=1h ()
This example includes the following entries:
 000257 indicates the log entry number. Each log entry has a unique number.
 0a88 indicates the current running thread ID. If the application has one thread, this number does not
change. If two or more threads record data to the log file, you might use the thread ID to follow
thread-specific sequential actions because ThinApp records log entries in the order in which they occur.
 mydll.dll indicates the DLL that makes the API call.
 4ad0576d indicates the return address for the API call that mydll.dll makes. In typical circumstances,
the return address is the address in the code where the call originates.
 -> indicates the process of entering the call. For the call entry log element, ThinApp displays the input
parameters. These parameters are in and in/out parameters.