5.1

VMware, Inc. 97
Chapter 9 Monitoring and Troubleshooting ThinApp
 <- indicates the process of the call returning to the original caller. For call exit log entries, ThinApp
displays the output parameters. These parameters are out and in/out parameters.
 kernel32.dll indicates the DLL where the API call lands.
 7c81b1f0 indicates the address of the API inside kernel32 where the call lands. If you disassemble
kernel32.dll at the 7c81b1f0 address, you find the code for the SetConsoleMode function.
 ->BOOL=1h indicates the API returns the value of 1 and the return code has the BOOL type.
Application Startup Information
The following entries shows basic information about the application, such as the module name and
process ID (PID), and about Log Monitor, such as the version and options.
000001 0a88 Logging started for Module=C:\test\cmd_test\bin\cmd.exe
Using archive=
PID=0xec
CommandLine = cmd
000002 0a88 Logging options: CAP_LEVEL=9 MAX_CAP_ARY=25 MAX_CAP_STR=150
MAX_NEST=100
VERSION=3.090
000003 0a88 System Current Directory = C:\test\cmd_test\bin Virtual Current Directory =
C:\test\cmd_test\bin
000004 0a88 |start_env_var| =::=::\
000005 0a88 |start_env_var| =C:=C:\test\cmd_test\bin
000006 0a88 |start_env_var| =ExitCode=00000000
000007 0a88 |start_env_var| ALLUSERSPROFILE=C:\Documents and Settings\All Users.WINDOWS
...
...
...
List of DLLs Loaded into Memory During Runtime
The Modules loaded section is located near the end of the log file and describes the DLLs that are loaded into
memory at runtime and the DLL addresses. The information shows whether Windows or ThinApp loads the
DLLs.
This example includes a summary of the length of the longest calls and the following entries:
 SYSTEM_LOADED indicates that Windows loads the DLL. The file must exist on the disk.
 MEMORY_MAPPED_ANON indicates that ThinApp loads the DLL. ThinApp might load the file from the
virtual file system.
 46800000-46873fff indicates the address range in virtual memory where the DLL resides.
 PRELOADED_BY_SYSTEM and PRELOADED_MAP are duplicate entries and refer to the memory address range
where the executable image file is mapped into memory.
---Modules loaded --
PRELOADED_MAP 00400000-00452fff, C:\Program Files\Adobe\Reader
8.0\Reader\AcroRd32.exe
PRELOADED_BY_SYSTEM 00400000-00452fff, C:\Program Files\Adobe\Reader
8.0\Reader\AcroRd32.exe
SYSTEM_LOADED 00400000-00452fff, C:\test\AcroRd32.exe
MEMORY_MAPPED_ANON 013b0000-020affff, C:\Program Files\Adobe\Reader
8.0\Reader\AcroRd32.dll
----Timing Report: list of slowest 150 objects profiled ---
8255572220 total cycles (2955.56 ms): |sprof| thinapp_LoadLibrary2
765380728 cycles (274.01 ms) on log entry 21753
428701805 cycles (153.48 ms) on log entry 191955
410404281 cycles (146.93 ms) on log entry 193969
.