0

I'm trying to tweak a configuration file for Adplus.exe and I've encountered an Action EventLog which is, by default, turned on for second chance exceptions. However, I compared the logs with and without EventLog but it seems the effects are just the same. I expected it to generate an Event Viewer log, but it didn't.

Here is my cfg snippet:

<Exception Code='eh'>
  <Actions1> Log;stack;</Actions1>
  <ReturnAction1> GN </ReturnAction1>
</Exception>
<Exception Code='AV'>
  <Actions1> Log;stack;FullDump;EventLog</Actions1>
  <ReturnAction1> GN </ReturnAction1>
</Exception>
<Exception Code='*'>
  <Actions1> Log;stack </Actions1>
  <ReturnAction1> GN </ReturnAction1>
</Exception>
<Exception Code='epr'>
  <Actions1> Log;</Actions1>
</Exception>
<Exception Code='bpe'>
  <Actions1> Log </Actions1>
  <ReturnAction1> GN </ReturnAction1>
</Exception>

Please take note of the EventLog in Exception Code='AV' (Sorry, I can't highlight or bold that part). I tried enabling/disabling this and the generated logs are just exactly the same. Is it really working? If yes, where can the eventlog be found? Or was it already depreciated?

Also, I checked the Adplus v7 documentation and EventLog is not included there, but like I said, UPDATE: It is not in the documentation but is displayed when we run ADPlus –HelpConfig .

by default, it's enabled for 2nd chance exceptions as seen on the generated DebuggerScript.txt below

*| Default Exception Behavior:
*|     Action1: Log
*|     Return1: GN
*|     Action2: Log;Time;Stack;FullDump;EventLog
*|     Return2: Q
*| Default Event Behavior:
*|     Action1: Log
*|     Return1: GN
*| 
*| Exceptions:
*| av-AccessViolation
*|     Action1: Log;stack;FullDump
*|     Return1: GN
*|     Action2: Log;Time;Stack;FullDump;EventLog
*|     Return2: Q
*| ch-InvalidHandle
*|     Action1: Log
*|     Return1: GN
*|     Action2: Log;Time;Stack;FullDump;EventLog
*|     Return2: Q

Advance thanks!

Cyberpau
  • 125
  • 9

1 Answers1

0

Found it. It's on the DebuggerScript.txt with prefix !elog_str.

Adding/Removing EventLog in Actions didn't changed anything in the log since it's always enabled by default for Second Chance Exceptions. Also, the eventlog displays only the description of the actual eventviewer log.

Actual event viewer log sample:

The description for Event ID 0 from source Application cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.

If the event originated on another computer, the display information had to be saved with the event.

The following information was included with the event: 

ADPlus detected a SecondChance_clr_NET_CLR in ExceptionGenerator.exe with Process ID 5516 and the output directory is logs\20180312_084515_Crash_Mode

the message resource is present but the message is not found in the string/message table

Adplus EventLog sample:

!elog_str ADPlus detected a SecondChance_av_AccessViolation in AdpProcName with Process ID AdpProcID and the output directory is AdpDumpDir;Q"
Cyberpau
  • 125
  • 9