> I appreciate the tip about falling back on the relay debug channel, > but may I ask how you know the problem is with BlockInput not existing? > Is there something from the output that I'm not understanding, or do > you just know that because you're familiar with the kernel32.dll > code?
Molle's right--it just looks suspicious, since it's the last thing that's called before ExitProcess. I didn't copy-paste any more of the log, but there were a whole bunch of GetProcAddress calls prior to this that succeeded, which raises the probability that this was the cause. And, as Molle suggested, a quick glance at the kernel32 code shows that BlockInput is missing. As far as how did I spot this in the log--well, that's just experience. You can learn it pretty quickly though, especially when an app dies early. I just scroll through a log from the end toward the beginning, and look for a change in pattern on the screen. Different things are starting to happen there, so I slow down for a closer look. If it looks like normal shutdown code--and there's usually hundreds of lines of this stuff--I ignore it and move on. As far as how to deal with this, try modifying kernel32.spec to add a stub for BlockInput, like: @ stub BlockInput and see if the program gets any further. Chances are it'll crash somewhere else down the line, so you'll have to do the usual wash-rinse-repeat. You should also take a look through KeePass's source code and try to find out what's going on. --Juan __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com
