I fear pink.

I didn't realize I fear pink until this morning.  As I was stepping into the shower, I noticed I had a pink towel set aside for myself, and I shuddered.

I'm a pinkophobe.  I had no idea.

I saw my male neighbor, wearing a pink shirt, out in his yard a couple weeks ago.  I noted, to myself, just how *wrong* that was.  I didn't say anything to anyone though.  I knew my wife would regard such comments with scowling.

Now, I'm admitting my fear.  I not only don't like pink, I fear it.  I'm afraid to wear pink.  I'm afraid to use pink. 

Don't get me wrong, I toweled off with my pink towel.  I'm not that far gone, yet.  I wouldn't, by choice, select pink for just about anything, though -- clothing, paint, decorations, etc.

I'll buy my daughters pink items and gladly allow them to wear pink.  I'll not comment on my wife's use of pink.  Maybe I'm not a true, blue, pinkophobe.  Is there a word for a half-phobe?  A semi-phobe?

I don't run in fear from pink, and I don't cower away from pink.  I suppose I'm a pinkosemiphobe then. 

I will use a pink highlighter.  I just noticed I have on in my large coffee cup on my desk.  On second thought, I think I'll go trade it in for a blue or yellow highlighter.

---Dan---

As you can see, I have little control over the current font I'm using in my BLOG.

I think we have a newer version of the BLOG editing tool out now.  I'll check it out.

Remember way, way, way back when Microsoft shipped Windows 95 ®?

Anyway, we had the control panel option where you'd see a map for the timezone and clickity-click on the map in a timezone area, and that would highlight the map along a border-line and select your timezone for you.

Wasn't that cool?  Heck yeah.  I thought so.  We changed it though.  We still had the map, but you couldn't clickity-click on the map and get a highlighted area.  Clicking did nothing for changing your timezone.

Wanna know why?

Well, there is a county, and I won't mention it's name, but said country is in constant border disputes with another country.  Microsoft drew the border-line "incorrectly" according to said country.

They threatened to never, ever, ever allow us to sell that software in their country if we didn't "fix" the border-line.

We learned not to highlight timezones and border-lines any more.

---Dan---

I got a real comment (not from Ivanna).

10/01/2003 8:57 AM

I see above that you've fixed this already, but IIRC John Robbins' book "Debugging Applications for Microsoft .NET and Microsoft Windows" details how to debug a service on startup. IIRC, it involves setting the ImageFileOptions key in the registry.

Mike Dimmick

Thanks Mike.  I actually set it up.  We know how to debug services on startup.  I did too.  However, I had a problem with timing.  The service auto-unloaded after a specific amount of time and my debug was worthless.  I would've needed an extra step.

Plus, now I know how to log WebClient.  Well, really, the code only supports "live debug output".  The logging part I uncommented and added code to get to work.  Regardless, part of that experience was preparing for the future.  I'll be way better prepared for the next WebClient issue I see.

I hope.

Thanks for the comment!

Okay, so I finally figured out why the binary wasn't writing to the log file.

The code was commented out.

I can build it, so I modify the code.  I always copy the file and make a backup of the original.  Then, I go to down on the old file.  Rebuild.  Errors.  Okay.  Some more stuff needed to be actually uncommented out.  You can't have a:

dwMyDwordValue = 10;

and not have

DWORD dwMyDwordValue;

up above it.  Yeah, that's real basic C programming, but heck, who'd know if you didn't write it all yourself?

Well, I got the log and it showed me the problem.  I didn't have to kernel debug after all.  I was able to provide a solution to the customer, so I 'm hoping all is well now.  Basically, with the other service (I think it's a third party service) that was running, our workstation service wasn't loading fast enough for webclient.  If you make webclient dependent upon LanManWorkstation, it works.

Makes sense as to why you could boot with webclient turned off and actually run it fine.  The issue was related to timing.

That logging ability was nice.  I'm checking with our dev folks to see if we can send that logging binary to customers.  Please don't email me and ask me for it.  If I need to, I'll know when to use it.

Would it have been easier to kernel debug to begin with?  Probably, but I wouldn't have learned how to log this stuff and that may pay off big time in the future over and over again.  I hope so.

I'm still working on that webclient issue.

I think I'm going to have to setup a kernel-mode debug, which is pretty easy to do except I need a second system to do the debugging from.  I think I'll just use my laptop rather than asking the lab to create one for me.

Well, looking at the web client code, I seem to see some logging functionality.  I love to jump on logging functionality -- even if it's a waste of my time. 

Well, none of my logging experimentation has panned out.  I have no log file.  I've broken into the process to see if the debug logging functionality even exists in the binary I built.  We'll see.

As I'm investigating further, I find I am stupid and don't know hex.  Now, I also find the log file won't be created if it's not there.  I create it but it still can't access it.  I set permissions to Everyone Full Control, and now it can access it but it doesn't write to it.

Well, I'm still trying to figure this out.  At the minimum, I should be able to get a debug monitor output, but I want more!

That's all for today.

Well, if you read what I wrote yesterday, you read that I put a service all by itself in a separate SVCHOST.EXE proces.

Windows XP SP1

Service of interest:  WebClnt

Binary of interest:  WEBCLNT.DLL

Problem:  Hangs on startup.

If you run a CMD.EXE prompt (command prompt) and type:   TASKLIST /SVC you'll see an output like this:

F:\Documents and Settings\danvdw>tasklist /SVC

Image Name                   PID Services
========================= ====== =============================================
System Idle Process            0          N/A
System                                 4          N/A
services.exe                        416       Eventlog, PlugPlay
lsass.exe                             428        Netlogon, PolicyAgent, ProtectedStorage, SamSs
svchost.exe                         636        RpcSs
svchost.exe                         660        AudioSrv, BITS, CryptSvc, Dhcp, dmserver, ERSvc, EventSystem,                                                                lanmanserver, lanmanworkstation, Messenger, Netman, Nla,
                                                           Schedule, seclogon, SENS, ShellHWDetection,
                                                           srservice, TermService, Themes, uploadmgr,
                                                           W32Time, winmgmt, wuauserv, WZCSVC
svchost.exe                         772         Dnscache
svchost.exe                         796         LmHosts, RemoteRegistry, SSDPSRV, WebClient
spoolsv.exe                         876         Spooler
inetinfo.exe                       1084         IISADMIN, SMTPSVC, W3SVC

<Cut Short to Eliminate Boredom>

I'm interested in the one that has WebClient in it.  I see it's Process ID (PID) 796.

That's nice to know, but not really want I want.  What I want to see is WebClient all alone in an SVCHOST.EXE process.  Exactly like DNSCACHE is doing.  Why can't my webclient do that too?  I think it can!

If you read Raymond Chen's blog, you'll see he refers to Q314056 about SVCHOST.EXE.

Now, I mucked with the registry on this system.  If you muck with your registry, make sure you make backups of the stuff before you fool with it.  I will not be held responsible for anything you do to your registry even if it's something I write about.

Are we clear on that?

HKLM\Software\Microsoft\WindowsNT\CurrentVersion\svchost

Right there, under svchost, are keys and values.  I'm interested in the *value* that is Localservice and I see it's a REG_MULTI_SZ and is:

Alerter
WebClient
LmHosts
RemoteRegistry
upnphost
SSDPSRV

There's my WebClient.  What if I just highlight it and take it out of there with a DEL button press?  That works.

Okay.  But, I want it in it's own SVCHOST.EXE.  Can I do that?  Well, I think I can if I hack some.  So, let's hack:

I notice that the *keys* are similar to these values.  Let's do a new key and value.  I'll call it WebClntSvc.

So, I add a Key and a Value called WebClntSvc.  I could have called it anything, like AnyNameAnything, but I called it WebClntSvc.

So, I make a REG_MULTI_SZ *value* entry called WebClntSvc and add:  WebClient.

I also make a Value entry and call it WebClntSvc.  What to add there?  Heck, I just copied what was in the Localservice key. That key had:

AuthenticationCapabilities, REG_DWORD, 0x2000 and CoInitializeSecurityParam, REG_DWORD, 0x1

So, I added them both.  Is that it?

No, because I see that HKLM\System\CurrentControlSet\Services is of interest to me, based on the KB article.

If I look at HKLM\System\CurrentControlSet\Services\WebClient, I see an ImagePath value that's a REG_SZ.  I think I want to edit that and change it from:

%SystemRoot%\System32\svchost.exe -k LocalService

to

%SystemRoot%\System32\svchost.exe -k WebClntSvc

We can confirm this works by checking the interface.  That's right-click on My Computer, Select Manage, then go into the Services, find WebClient and open it up.

Make sure the "Path to Executable" was changed.  Mine would say:

F:\WINDOWS\System32\svchost.exe -k WebClntSvc.

F: is my system drive here.  Don't ask me why.  You don't want to know.

That would make sense, right?  Does to me.  Then, I reboot.  Now, I have a separate instance of SVCHOST.EXE running with WebClient in it.

I do.

Now, to debug it is simple.  Right, I just attach my debugger to the process that exists as SVCHOST.EXE with the one and only service in it that's WebClient.

However, I don't want to debug it as it is, I want to debug it as it starts.  Hmm... How do to that?

Well, it's tricky and I have one trick up my sleeve to use that is this:  Copy SVCHOST.EXE to SVCHOST1.EXE in the same place as SVCHOST.EXE and use SVCHOST1.EXE in my ImageFileExecutionOptions registry setting and use SVCHOST1.EXE in the registry location for the service for the executable.

Now, when I check the interface, my path says:

F:\WINDOWS\System32\svchost1.exe -k WebClntSvc.

There is a problem here.  The default SVCHOST.EXE has a timeout for any service.  If it doesn't start in X seconds, you get a nifty dialog telling you it didn't start, blah blah blah.

You don't get the dialog for the failure on startup, but it's not running regarless.

I'm guessing there is a way around this, but I don't know what yet.....

Last night, my wife called me into a room for a "private conference."  She doesn't like me sharing about our lives publically.

She's very private.  At least, that's what she tells me.  Yeah.  I'd agree.  We've been married 20 years, so I probably know that.  Anyway, I know better than to expect her to change.  I just didn't realize sharing info about the family in a BLOG would bother her much.

I won't be sharing a whole lot more of family stuff.  I guess I'll do more work stuff. 

Remember I mentioned Brittany is sewing?  Well, last night, Bekah who is 5 years old, came upstairs into the bonus room with this huge, gargantuan piece of lime-green cloth and scissors.  She starts cutting and humming a little tune while she cuts.

Me and the boys, playing our video games, look down at her, sitting on the flooor humming and cutting along, and freak.  "Are you supposed to be cutting that, Bekah?"

Yes. 

You sure?

Yes.

Ben runs out of the room to check with the Overlord or the OIT to see if this statement of cutting allowability is true.

Apparently, the voluminous lime-green cloth was deemed too ugly to use.  Hence, Bekah's humming and cutting.  She had a terrific time.

What?  I didn't say anything about my family, did I?

Apparently, I'm encouraged to and supposed to talk about what I do at work some in the blog.  Well, we can't divulge sensitive information.

Okay.  Work related, huh?  Here's something.

I got a DVD ROM image from a large department store IT group a few weeks back.  It had <NAME OF DEPT STORE> CONFIDENTIAL written in hand all over the DVD ROM.

Like what, we have spies from other department stores to worry about?  Uh oh.  Be on the look out for those department store IT spies.  You know, the guys seeking the CONFIDENTIAL information about the other department stores.

Maybe they're having a special sale!  Whoo hoo!

Anyway, having the DVD image to restore on a lab computer is really one of the best ways I have of solving problems.  This customer has a Microsoft service that's not starting when Windows XP starts up.

Using Publically Documented information, I moved the service from where it was running under SVCHOST.EXE with a number of other services to where it runs under its own SVCHOST.EXE.  How?  I can't remember as that was this morning and now is this afternoon.  But I did. 

The problem still occurs, but now, when I break into that instance of SVCHOST.EXE (as it's attempting to load that service that's not loading), I get two threads with a simple stack each to look at.  Makes it much, much easier for me to see what's going on.  Of course, I have no clue what's going on.  I have to figure this out.

Interestingly enough, if another, third-party service that's running is disabled, this problem doesn't occur.  Neither service is running in the same process.  What does that mean?  Who knows.  I would *love* to be able to blame the problem on the other, third-party service, but I can't without first figuring out what's going on.

I guess that's why I get all those dollars -- figure out the tough stuff.  I'm a hundredaire you know.  I have like $100.00 or more in the bank now.  I wonder if I can tell people I have a hundred dollars in the bank in a blog?  I hope so.

Anyway, if I can recreate my steps to moving the service into it's own process, I'll post them 'cause that might be interesting to you and I figured it out from a single KB article that's public.