Mftrace not working...

Jeff Roberts 21 Reputation points
2020-11-20T19:15:02.317+00:00
"c:\Program Files (x86)\Windows Kits\10\bin\x64\mftrace.exe" -v test.exe
### Inproc Trace ON
### Added all MFDetours providers (mask 0x0000000000000000, level 5)
### Inproc Trace ON
### pszDllFullPath: c:\Program Files (x86)\Windows Kits\10\bin\x64\mfdetours.dll
### Skipping MFDbgLog enabling, registry key already exists: 'SOFTWARE\Microsoft\DirectShow\Debug\GLOBAL'
### Skipping MFDbgLog enabling, registry key already exists: 'SOFTWARE\Microsoft\Windows Media Foundation\MFDbgLog\GLOBAL'
### Enable providers - begin (2 providers)
### Enable providers - end
### Looking for tracing DLL
### pszDllFullPath: c:\Program Files (x86)\Windows Kits\10\bin\x64\mfdetours.dll
Listening to ETW events (CTRL+C to end)
### Opening real-time session for event processing: 'mftrace-session'
### Calling command line 'c:\devel\projects\test.exe'
           __M_F_T_R_A_C_E___LOG__

PID, TID    Time (UTC)    TraceMessage
--------- --------------  ------------
### hr=0x80070057 ERROR_INVALID_PARAMETER from 'DetourCreateProcessWithDllW( 0, strCmdLineLocal.GetBuffer(), 0, 0 , 0, 0x04000000, 0, 0, &si, &pi, CW2A( pszDetoursDllFullPath ), 0 )'
###   at avcore\mf\samples\mf360\mftrace\mftrace\lib\mftracedprocess.cpp:344
### hr=0x80070057 ERROR_INVALID_PARAMETER from 'StartProcess( pszCmdLine, pszDetoursDllFullPath, &hProcess )'
###   at avcore\mf\samples\mf360\mftrace\mftrace\lib\mftracedprocess.cpp:217
### BuffersWritten : 0
### Trace session stopped
           __M_F_T_R_A_C_E___LOG__
Total events received: 0
### hr=0x80070057 ERROR_INVALID_PARAMETER from 'g_tracedProcess.Run( strCmdLine )'
###   at avcore\mf\samples\mf360\mftrace\mftrace\exe\main.cpp:957
Failed with hr=0x80070057 (ERROR_INVALID_PARAMETER)
Windows API - Win32
Windows API - Win32
A core set of Windows application programming interfaces (APIs) for desktop and server applications. Previously known as Win32 API.
2,610 questions
{count} vote

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.