Last time for debugging library load issues I had to use
gflags utility from Microsoft. I was wondering what it was doing exactly.
So i started with monitoring registery tweaks when executing command
gflags -i notepad.exe +sls and
gflags -i notepad.exe -sls and it was quite evident that it was just setting up a new registry value.
C:\WINDOWS\system32>gflags -i notepad.exe +sls Current Registry Settings for notepad.exe executable are: 00000002 sls - Show Loader Snaps C:\WINDOWS\system32>gflags -i notepad.exe -sls Current Registry Settings for notepad.exe executable are: 00000000
Now, we know that we need to create a registry entry
Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe and a value named
GlobalFlag with value
StringValue set to
2 for enabling and
0 for disabling LoaderSnaps.
with this, we can roll out our own
gflags for loadsnaps (just need to ensure that you run appropriate priviledges for registry tweaks)