Process.Start - getting different output when running command using this method than I am if I run same command in CMD prompt

Question

Hi
Creating an application to analyze .dmp files - all working well except this odd issue
If I open command prompt and enter this command:-
kd -z C:\Windows\MiniDump\042414-24632-01.dmp -c "!analyze -v"
Then it works and shows me all the output I need (shown at bottom of post)
If I run same command in VB.net using following code - then it doesn't give the same output - the bits I need at the end created by the !analyze -v switch don't appear
Any ideas why it is not seeing the switch correctly - setting a breakpoint and checking contents of startinfo seems to be showing correct cmd line i.e. "kd -z C:\windows\minidump\042414-24632-01.dmp -c "!analyze –v;q""
Dim myprocess As New Process()
myprocess.StartInfo.FileName = "C:\Program Files (x86)\Windows Kits\8.1\Debuggers\x86\kd"
myprocess.StartInfo.Arguments = "-z C:\windows\minidump\042414-24632-01.dmp -c ""!analyze –v;q"""
myprocess.StartInfo.UseShellExecute = False
myprocess.StartInfo.RedirectStandardOutput = True
myprocess.StartInfo.CreateNoWindow = True
myprocess.Start()
TextBox1.AppendText(myprocess.StandardOutput.ReadToEnd())
Output when run from cmd prompt:-
C:\Program Files (x86)\Windows Kits\8.1\Debuggers\x86>kd -z C:\Windows\MiniDump\042414-24632-01.dmp -c "!analyze -v;q"
Microsoft (R) Windows Debugger Version 6.3.9600.17298 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Windows\MiniDump\042414-24632-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: *** Invalid ***
* Symbol loading may be unreliable without a symbol search path. *
* Use .symfix to have the debugger choose a symbol path. *
* After setting your symbol path, use .reload to refresh symbol locations. *
Executable search path is:
* Symbols can not be loaded because symbol path is not initialized. *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
Unable to load image \SystemRoot\system32\ntkrnlpa.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntkrnlpa.exe
*** ERROR: Module load completed but symbols could not be loaded for ntkrnlpa.exe
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.18205.x86fre.win7sp1_gdr.130708-1532
Machine Name:
Kernel base = 0x82e3e000 PsLoadedModuleList = 0x82f874d0
Debug session time: Thu Apr 24 13:36:18.672 2014 (UTC + 1:00)
System Uptime: 0 days 0:00:38.703
* Symbols can not be loaded because symbol path is not initialized. *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
Unable to load image \SystemRoot\system32\ntkrnlpa.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntkrnlpa.exe
*** ERROR: Module load completed but symbols could not be loaded for ntkrnlpa.exe
Loading Kernel Symbols
Loading User Symbols
Loading unloaded module list
************* Symbol Loading Error Summary **************
Module name Error
ntkrnlpa The system cannot find the file specified
You can troubleshoot most symbol related issues by turning on symbol loading diagnostics (!sym noisy) and repeating the
command that caused symbols to be loaded.
You should also verify that your symbol search path (.sympath) is correct.
* Bugcheck Analysis *
Use !analyze -v to get detailed debugging information.
BugCheck 50, {afa99150, 0, 88c557d7, 0}
*** WARNING: Unable to verify timestamp for mssmbios.sys
*** ERROR: Module load completed but symbols could not be loaded for mssmbios.sys
*** WARNING: Unable to verify timestamp for mfehidk.sys
*** ERROR: Module load completed but symbols could not be loaded for mfehidk.sys
*** WARNING: Unable to verify timestamp for HipShieldK.sys
*** ERROR: Module load completed but symbols could not be loaded for HipShieldK.sys
***** Kernel symbols are WRONG. Please fix symbols to do analysis.
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** Type referenced: nt!_KPRCB ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** Type referenced: nt!_KPRCB ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** Type referenced: nt!_KPRCB ***
Probably caused by : mfehidk.sys ( mfehidk+377d7 )
Followup: MachineOwner
1: kd> kd: Reading initial command '!analyze -v;q'
* Bugcheck Analysis *
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: afa99150, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: 88c557d7, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 00000000, (reserved)
Debugging Details:
***** Kernel symbols are WRONG. Please fix symbols to do analysis.
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** Type referenced: nt!_KPRCB ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** Type referenced: nt!_KPRCB ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** Type referenced: nt!_KPRCB ***
ADDITIONAL_DEBUG_TEXT:
You can run '.symfix; .reload' to try to fix the symbol path and load symbols.
MODULE_NAME: mfehidk
FAULTING_MODULE: 82e3e000 nt
DEBUG_FLR_IMAGE_TIMESTAMP: 4d2e1e3e
READ_ADDRESS: GetPointerFromAddress: unable to read from 00000000
GetPointerFromAddress: unable to read from 00000000
unable to get nt!MmSpecialPoolStart
unable to get nt!MmSpecialPoolEnd
unable to get nt!MmPagedPoolEnd
unable to get nt!MmNonPagedPoolStart
unable to get nt!MmSizeOfNonPagedPoolInBytes
afa99150
FAULTING_IP:
mfehidk+377d7
88c557d7 0fb70c06 movzx ecx,word ptr [esi+eax]
MM_INTERNAL_CODE: 0
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT
BUGCHECK_STR: 0x50
CURRENT_IRQL: 0
ANALYSIS_VERSION: 6.3.9600.17298 (debuggers(dbg).141024-1500) x86fre
LAST_CONTROL_TRANSFER: from 82e7eaa8 to 82ecb879
STACK_TEXT:
WARNING: Stack unwind information not available. Following frames may be wrong.
ad0baf90 82e7eaa8 00000000 afa99150 00000000 nt+0x8d879
ad0bafa8 88c557d7 badb0d00 00000000 88c4ceb0 nt+0x40aa8
ad0bb040 88c4f97d 001a99b0 afa91000 00000000 mfehidk+0x377d7
ad0bb090 88c52b16 00770220 ad0bb0fc 00000010 mfehidk+0x3197d
ad0bb0bc 98d5fb73 ae770220 ad0bb0fc 00000010 mfehidk+0x34b16
ad0bb140 98d5fc43 ae738c30 98d6b62a aace7220 HipShieldK+0xb73
ad0bb168 98d6b882 ad0bb19c 00000000 98d77b44 HipShieldK+0xc43
ad0bb1b8 98d631a9 00000bd4 0000102c ad0bb208 HipShieldK+0xc882
ad0bb330 88c47795 00000bd4 0000102c ad0bb401 HipShieldK+0x41a9
ad0bb400 88c22b57 0000102c ad0bb460 85b3dee0 mfehidk+0x29795
ad0bb41c 88c232c6 ad0bb430 0000000c 8c4b6ce0 mfehidk+0x4b57
ad0bb43c 830a5acb adb6b9b8 0000102c ad0bb460 mfehidk+0x52c6
ad0bb4f4 830adaf8 adb16030 01b6b9b8 ad0bb550 nt+0x267acb
ad0bbc00 82e7b8c6 038ae710 038ae6ec 02000000 nt+0x26faf8
ad0bbc34 77a470f4 badb0d00 038ae3dc 00000000 nt+0x3d8c6
ad0bbc38 badb0d00 038ae3dc 00000000 00000000 0x77a470f4
ad0bbc3c 038ae3dc 00000000 00000000 00000000 0xbadb0d00
ad0bbc40 00000000 00000000 00000000 00000000 0x38ae3dc
STACK_COMMAND: kb
FOLLOWUP_IP:
mfehidk+377d7
88c557d7 0fb70c06 movzx ecx,word ptr [esi+eax]
SYMBOL_STACK_INDEX: 2
SYMBOL_NAME: mfehidk+377d7
FOLLOWUP_NAME: MachineOwner
IMAGE_NAME: mfehidk.sys
BUCKET_ID: WRONG_SYMBOLS
FAILURE_BUCKET_ID: WRONG_SYMBOLS
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:wrong_symbols
FAILURE_ID_HASH: {70b057e8-2462-896f-28e7-ac72d4d365f8}
Followup: MachineOwner
quit:
output when run in my app:-
Microsoft (R) Windows Debugger Version 6.3.9600.17298 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Windows\MiniDump\042414-24632-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: *** Invalid ***
* Symbol loading may be unreliable without a symbol search path. *
* Use .symfix to have the debugger choose a symbol path. *
* After setting your symbol path, use .reload to refresh symbol locations. *
Executable search path is:
* Symbols can not be loaded because symbol path is not initialized. *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
Unable to load image \SystemRoot\system32\ntkrnlpa.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntkrnlpa.exe
*** ERROR: Module load completed but symbols could not be loaded for ntkrnlpa.exe
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.18205.x86fre.win7sp1_gdr.130708-1532
Machine Name:
Kernel base = 0x82e3e000 PsLoadedModuleList = 0x82f874d0
Debug session time: Thu Apr 24 13:36:18.672 2014 (UTC + 1:00)
System Uptime: 0 days 0:00:38.703
* Symbols can not be loaded because symbol path is not initialized. *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
Unable to load image \SystemRoot\system32\ntkrnlpa.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntkrnlpa.exe
*** ERROR: Module load completed but symbols could not be loaded for ntkrnlpa.exe
Loading Kernel Symbols
Loading User Symbols
Loading unloaded module list
************* Symbol Loading Error Summary **************
Module name Error
ntkrnlpa The system cannot find the file specified
You can troubleshoot most symbol related issues by turning on symbol loading diagnostics (!sym noisy) and repeating the
command that caused symbols to be loaded.
You should also verify that your symbol search path (.sympath) is correct.
* Bugcheck Analysis *
Use !analyze -v to get detailed debugging information.
BugCheck 50, {afa99150, 0, 88c557d7, 0}
*** WARNING: Unable to verify timestamp for mssmbios.sys
*** ERROR: Module load completed but symbols could not be loaded for mssmbios.sys
*** WARNING: Unable to verify timestamp for mfehidk.sys
*** ERROR: Module load completed but symbols could not be loaded for mfehidk.sys
*** WARNING: Unable to verify timestamp for HipShieldK.sys
*** ERROR: Module load completed but symbols could not be loaded for HipShieldK.sys
***** Kernel symbols are WRONG. Please fix symbols to do analysis.
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** Type referenced: nt!_KPRCB ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** Type referenced: nt!_KPRCB ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** Type referenced: nt!_KPRCB ***
Probably caused by : mfehidk.sys ( mfehidk+377d7 )
Followup: MachineOwner
Darren Rose

Answer 1

Try it by opening the Cmd prompt as the actual process and passing the Filename and its arguments as the arguments of the Cmd process.  If you notice there is a "-C" before the Filename and Arguments in this example.  The "-C"
tells the cmd to execute the commands and then close itself.  You can also use a "-K" which tells the cmd to execute the commands and keep itself open.  Being you are not showing the cmd window you don`t want to keep it opened because the
user can`t close it so, that is why i used "-C".
 I don`t have the program so, you can just experiment to see what it does.  Maybe you should try using "-K" and show the cmd window by commenting out the CreateNoWindow line so you can see what is in the cmd window while testing.
Private Sub Button1_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles Button1.Click
Dim filepath As String = """C:\Program Files (x86)\Windows Kits\8.1\Debuggers\x86\kd"""
Dim args As String = " -z C:\windows\minidump\042414-24632-01.dmp -c ""!analyze –v;q"""
Dim p As New Process
With p.StartInfo
.FileName = "cmd.exe"
.Arguments = "-c " & filepath & args
.UseShellExecute = False
.CreateNoWindow = True
.RedirectStandardOutput = True
End With
p.Start()
TextBox1.Text = p.StandardOutput.ReadToEnd
End Sub
If you say it can`t be done then i`ll try it