Solved

Process Mode ABCDEF~1.EXE or Abcdefghijk.exe

Posted on 2008-06-23
16
341 Views
Last Modified: 2013-11-14
We have a software application that is running on several hundred machines. There are several machines we have found it will not work on. An observation is that machines the software works correctly on the process appears in the list as ABCDEF~1.EXE; and on the machines it will not run on it appears in the process list as Abcdefghijk.exe. I believe it is choosing to run the process in 16 bit mode, and this is a possible clue to a resolve.

My question is this;

How does the operating system choose which mode it will run a given process in and, can an administrator force the operating system to run a process in a choosen mode?

 I hope this solution will lead us toward finding a resolve to getting our software running on the few remaining machines.

Thank you in advance for your guidance.

Owen
0
Comment
Question by:rivusglobal
  • 7
  • 5
  • 4
16 Comments
 
LVL 7

Expert Comment

by:BobintheNoc
ID: 21847928
Hmmmm.   If the application is a 16 bit application, Windows should automatically launch and execute the application in 16 bit mode, I believe in a WoW session (Windows on Windows), typically below a process called WowExec.

You may also be able to force this via Application Compatibility mode.  Right clicking the shortcut and choosing properties, you might have a tab called something along the lines of "Compatibility", where you can spec the environment.  You might even be able to create a PIF (program information file), which is typically used for older DOS based applications.

A handy way to find out HOW an application was launched is to use the forever handy utility from the Sysinternals guys of Microsoft:  Process Explorer.  Get it at www.systernals.com, it's free and amazing.  After launching process explorer, you'll need to add a couple columns from the View Select Columns menu:  Command Line and Image Path.  It'll show you practically anything that can be know about a process.  Additionally, you might turn on the lower pane in DLL mode and also switch to handle mode to see the associated references that might clue you in on how the process was launched.

Another thought, from one of the misbehaving PCs, try browsing to the shortcut on a machine that has it working fully and launch with that shortcut.  A quick way to do this: click START...RUN...  then type:
\\computername\c$\Documents and Settings\theparticularusername\startmenu\programs.....
In the above line, you'll substitue the computername for the ACTUAL name of the computer you want to browse, and the path, after the C$\ is the typical location of start menu icons, you'll have to add to or modify to fit the location exactly, especially if in a program group/nested menu.

Good Luck!

Bob In the Noc
0
 
LVL 2

Expert Comment

by:Jamsb
ID: 21847955
The operating system looks at the Pre Execution header in 32bit applications. Have a read here:
http://en.wikipedia.org/wiki/Portable_Executable

Not entirely sure how it identifies if it is 16bit. (Perhaps if this header is absent?)
Have a read of this Microsoft article, it might help you: http://www.microsoft.com/windowsxp/using/security/learnmore/spot16bit.mspx
0
 
LVL 2

Expert Comment

by:Jamsb
ID: 21848008
I should have typed "Portable executable"
0
 
LVL 10

Author Comment

by:rivusglobal
ID: 21848266
Thanks for your suggestions; after further examining this process / application executable it is certainly 32 bit (we wrote it on the .NET platform in XP so that should also lead us to the answer :P). Still curious as to why on the working machines it shows in the process list as ABCDEF~1.EXE and on the non-working machines it shows the actual name Abcdefghi.exe.

Looking into more detailed process info based on the Sysinternals recommendation from Bob (May take some time).

Any other suggestions, please feel free to input.

Thanks again,

Owen
0
 
LVL 7

Expert Comment

by:BobintheNoc
ID: 21848296
Some quick research, sometimes 16 bit applications, especially those that use OLE linking, may not recognize launch paths or references to supporting files in full, extended naming.  For these things, it may be necessary to make sure that the START IN (working directory) and any pathing references to the shortcuts and registrations are made with the truncated 8.3 naming conventions.

Determination of 16 bit vs. 32, appears to mostly be the literal calls/references and commands that are used by the process.  If particular functions are used that only existed in 16bit APIs, and no longer exist in 32 bit environments, it's pretty clear that the process is 16 bit.  Frequently, I send an EXE to notepad to examine the raw content, I've always noticed that 32 bit windows apps have, in the beginning of their texts, something to the effect "This program cannot be run in DOS mode."  Which suggests that the beginning portion of the file does have some sort of header information to let windows know what's ahead.

Bob
0
 
LVL 7

Expert Comment

by:BobintheNoc
ID: 21848316
Definitely, examine those shortcuts that are used to launch.  Check the naming convention of the paths specified, and the actual command line to execute.  The procexp.exe running to get the initiating command to run, really, is much simpler that I'd made it sound.  It's a quick download, and quick execution, literally, taking just a few minutes.

Bob
0
 
LVL 10

Author Comment

by:rivusglobal
ID: 21848396
Hi Bob,

I checked into the shortcuts on both the working machines, and the ones not working. It seems that both use the full path encapsulated with quotes. Neither are using the truncated 8.3 naming conventions for specifying the path in the shortcut. Also, the same problem occurs in running the application directly from it's install directory.

0
 
LVL 2

Expert Comment

by:Jamsb
ID: 21849274
rivusglobal:

Are those machines Windows2000 machines by any chance? I seem to member that Win2k would truncate long process namesb yplacing a tilde at the end.
0
How to improve team productivity

Quip adds documents, spreadsheets, and tasklists to your Slack experience
- Elevate ideas to Quip docs
- Share Quip docs in Slack
- Get notified of changes to your docs
- Available on iOS/Android/Desktop/Web
- Online/Offline

 
LVL 2

Expert Comment

by:Jamsb
ID: 21849357
Sorry. I was mistaken Win2k often misses chars from the end of the string but doesnt place a tilde in the name.
0
 
LVL 2

Expert Comment

by:Jamsb
ID: 21849391
Here is somthing else you could try from the microsoft site:
http://support.microsoft.com/kb/103656
0
 
LVL 7

Accepted Solution

by:
BobintheNoc earned 500 total points
ID: 21849474
Sounds like a fairly esoteric issue, there's got to be something different between the working and the non-working, perhaps a dll or something that's already running, internet explorer versioning, service pack, office version, who knows--that can be tricky to isolate, although you should definitely start thinking in those terms--there's something common amongst the machines that WON'T run.  

I'd suspect that since you've posted on Experts Exchange, that the app vendor isn't available for support?  Also, that abcdefghi.exe isn't the real name of the application.  Can you mention the name of the actual application and it's version?  One tool that might be of assistance, but, definitely a little involved, The Microsoft Application Compatibility Toolkit.  This tool allows you to set many more variables and test modes for an application to determine it's needs in the Win environment.  After running through it's installs and sql db install, you'll have invested 1-2 hours alone, before even having tried to test.  It could take a couple of days worth of iterations to identify.  On several occasions though, I have found it to be helpful in identifying the needs of a particular program and why or why it wouldn't work.

I would start though, with process explorer and process monitor (sysinternals) before the App Compat toolkit--just because they're quickies.

If you don't have the time to investigate this further and are pressed for a deadline, perhaps you might consider farming this task out, if this application is critical, and you don't have the resource internally to troubleshoot it, a few hours of engagement time with someone who can systematically isolate and identify the process req's might cost you a few hundred dollars, but in the scope, may save you a ton of time, frustration and hair.  I can scope this for you if you'd like.

Continuing to research for you though, as I type.
0
 
LVL 7

Expert Comment

by:BobintheNoc
ID: 21849506
Jamsb,
The app has already been identified as a 32bit process.

rivusglobal:
Ahh, just remembered that you'd mentioned that this app is inhouse written--so the support from the vendor isn't an option.

Bob
0
 
LVL 7

Expert Comment

by:BobintheNoc
ID: 21849713
Few more questions:

Are there any really buried paths, ones that might be longer than 255 characters in length?

Do you use MS Installer technologies to 'install' the app, or is it just a file copy/dump?

Is any compression software such as WinZIP or Winrar used in the distribution/installation?

All just likely goosechases, but each of these CAN produce anomalies leading to truncation..
0
 
LVL 10

Author Comment

by:rivusglobal
ID: 21850220
Hi Bob,

Thanks for the help. I'm starting to doubt this issue has any direct relation to the truncation, rather it is simply an observation in the difference between the system that does run the app successfully, and those which it will not run.

In answer to your questions:

- Buried paths are no more than a simple install into the sub-directory of "Program Files".
- We do use MS Installer to install the application.
- No compression used in the distribution

We systematically started to re-image and one by one deploy updates / office applications after testing the result each time. Hopefully we can isolate this back to a couple of candidates.

We have this application running on several hundred machines, and this error has only been occurring on two recent laptop installs. The laptops have some similarities, but are different manufacturers; so i'm pretty sure it's a software issue.

I like your suggestion of the Microsoft Application Compatibility Toolkit. I'll look into that soon after this post.

If you can think of any other tools to test the requirements of the application against the system build I would much appreciated your suggestions.

Owen


0
 
LVL 7

Expert Comment

by:BobintheNoc
ID: 21850412
Another coupled of tools from Sysinternals that I use almost daily:  REGMON and FILEMON, gives you a peek at what/where the application is attempting to do to both file and reg locations, with results of success/failures.  Also, the Microsoft Kernel Debugger with Symbols allow you to step through a condition/execution, but is definitely more of a programmer's tool and not as much on my favs list.

Two laptops out of hundreds of PCs?  Not bad, and if those two never work, sobeit!  Sometimes, while we know there's an answer SOMEWHERE, it's just not worth finding.

Bob
0
 
LVL 10

Author Closing Comment

by:rivusglobal
ID: 31469825
I haven't been able to locate and resolve this issue yet, but Bob's assistance has helped to put me on the right path. Thanks for your help!
0

Featured Post

Enabling OSINT in Activity Based Intelligence

Activity based intelligence (ABI) requires access to all available sources of data. Recorded Future allows analysts to observe structured data on the open, deep, and dark web.

Join & Write a Comment

I. Introduction There's an interesting discussion going on now in an Experts Exchange Group — Attachments with no extension (http://www.experts-exchange.com/discussions/210281/Attachments-with-no-extension.html). This reminded me of questions tha…
When you start your Windows 10 PC and got an "Operating system not found" error or just saw  "Auto repair for startup". After a while, you have entered a loop for Auto repair which does not fix anything and you will be in a  panic as all your work w…
With the advent of Windows 10, Microsoft is pushing a Get Windows 10 icon into the notification area (system tray) of qualifying computers. There are many reasons for wanting to remove this icon. This two-part Experts Exchange video Micro Tutorial s…
With the advent of Windows 10, Microsoft is pushing a Get Windows 10 icon into the notification area (system tray) of qualifying computers. There are many reasons for wanting to remove this icon. This two-part Experts Exchange video Micro Tutorial s…

746 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

10 Experts available now in Live!

Get 1:1 Help Now