03. [20p] Process Monitor
Task A - Checking Logging File
For this task we will use Logs.exe and GoodLog.exe inside the Task-03/Task-A folder.
We want to see what is the difference between Logs.exe and GoodLog.exe. After running both programs we can see that the output is identical. Still, Logs.exe takes much longer to complete compared to GoodLog.exe. We will use Process Monitor to determine the problem.
Follow the steps to analyze the programs.
- Open Process Monitor and add a filter for Logs.exe (and GoodLog.exe afterwards). To do this create a filter of the format 'Process Name' 'is' 'Logs.exe'.
- Open the Command Prompt and run Logs.exe, while Process Monitor is running.
- Save the capture and reset all events (Ctrl + X).
- Repeat the first 3 steps for GoodLog.exe.
- Open both saved PML files and notice the differences.
We now know why one program is faster than the other.
If we want to go more in depth to find what code generated an event we can still use Process Monitor.
- Go to Options → Configure Symbols. Here you can configure the path for the symbols and the source code.
- Now we can double click on events like CreateFile and check the code by going to the Stack tab and clicking on an entry from our program.
Task B - Investigating a Handle Leak
For this task we will use bad.exe and good.exe inside the Task-03/Task-B folder.
Both executables have the same outcome. The difference is their running time.
Identify the problem. Hint: Process Monitor
Open up a terminal and run bad.exe. Check out the Details tab in Task Manager after adding the Handles column.
