Output of GFlags "Show Loader Snaps" not visible in DebugView

Mario Rössel 0

"Show Loader Snaps" is a very useful GFlag to investigate dependency issue of an application.

When using it, I will get the debug output of this flag in the Debug Output windows of Visual Studio 2022 - that is nice.

But when using the famous DebugView instead of a debug session in Visual Studio I don't get the output of "Show Loader Snaps" in DebugView.

Does DebugView support the output of "Show Loader Snaps"?
If not, why is that the case?

Searching the internet I found out, I'm not the only one who stumbled upon this issue.

https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/show-loader-snaps

https://learn.microsoft.com/en-us/sysinternals/downloads/debugview

Gary Nebbett 5,721 Reputation points

2024-04-24T13:19:27.9566667+00:00
Hello Mario,

The documentation for DebugView says:

Under Windows 2000, XP, Server 2003 and Vista DebugView will capture:

Win32 OutputDebugString

Kernel-mode DbgPrint

All kernel-mode variants of DbgPrint implemented in Windows XP and Server 2003

However the loader snap output does not match any of those cases. Using "sxe out" in a debugger to break on debug output, the top of the stack looks like:

ntdll!vDbgPrintExWithPrefixInternal ntdll!LdrpLogDbgPrint ntdll!LdrpLogInternal ntdll!LdrLoadDll KERNELBASE!LoadLibraryExW

So the output is produced in user mode and does not use OutputDebugString; that might explain why DebugView does not capture the output.

An alternative would be to use Event Tracing for Windows (ETW) to capture the same information (that would involve starting an ETW trace session with the ImageLoad provider (GUID {2cb15d1d-5fc1-11d2-abe1-00a0c911f518}) and setting a trace flag for the process in "Image File Execution Options" (TracingFlags = 4)).

Gary