Question

I’m having problems attaching to a process spawned from one of my own processes. When I attempt to attach to the process using Visual Studio 2005 (Debug -> Attach to process) I receive the error message: “Unable to attach to the process. The system cannot find the file specified.”

In my program, I spawned the process that I later want to attach to using the command

BOOL res = CreateProcess(exe, cmdLine, NULL, NULL, FALSE, 0, NULL,
                         workingDir, &startupInfo, &procInfo);

If I manually start the second process from the command prompt, I can attach to it without any problems. I am also able to attach to it using WinDbg, just not Visual Studio 2005. There is no difference whether I’ve started the first process from within VS (thus running as an administrator) or if I’ve started it from the command prompt as a regular user. I am running Visual Studio as an administrator under Vista 64 bit and the executables are all 64-bit.

Has anyone seen this before or have any ideas of what I might be doing wrong? Any help is appreciated.

Update:
I’ve also tried to set the security attributes for the new process and thread using the following code:

DWORD dwRes, dwDisposition;
PSID pEveryoneSID = NULL, pAdminSID = NULL;
PACL pACL = NULL;
PSECURITY_DESCRIPTOR pSD = NULL;
EXPLICIT_ACCESS ea[2];
SID_IDENTIFIER_AUTHORITY SIDAuthWorld =
    SECURITY_WORLD_SID_AUTHORITY;
SID_IDENTIFIER_AUTHORITY SIDAuthNT = SECURITY_NT_AUTHORITY;
SECURITY_ATTRIBUTES sa;
LONG lRes;
HKEY hkSub = NULL;

// Create a well-known SID for the Everyone group.
if(!AllocateAndInitializeSid(&SIDAuthWorld, 1, SECURITY_WORLD_RID,
    0, 0, 0, 0, 0, 0, 0, &pEveryoneSID))
{...}

// Initialize an EXPLICIT_ACCESS structure for an ACE.
// The ACE will allow Everyone read access to the key.
ZeroMemory(&ea, 2 * sizeof(EXPLICIT_ACCESS));
ea[0].grfAccessPermissions = GENERIC_ALL;
ea[0].grfAccessMode = SET_ACCESS;
ea[0].grfInheritance= SUB_CONTAINERS_AND_OBJECTS_INHERIT;
ea[0].Trustee.TrusteeForm = TRUSTEE_IS_SID;
ea[0].Trustee.TrusteeType = TRUSTEE_IS_WELL_KNOWN_GROUP;
ea[0].Trustee.ptstrName  = (LPTSTR) pEveryoneSID;

// Create a SID for the BUILTIN\Administrators group.
if(! AllocateAndInitializeSid(&SIDAuthNT, 2, SECURITY_BUILTIN_DOMAIN_RID,
    DOMAIN_ALIAS_RID_ADMINS, 0, 0, 0, 0, 0, 0, &pAdminSID)) 
{...}

// Initialize an EXPLICIT_ACCESS structure for an ACE.
// The ACE will allow the Administrators group full access to
// the key.
ea[1].grfAccessPermissions = GENERIC_ALL;
ea[1].grfAccessMode = SET_ACCESS;
ea[1].grfInheritance= SUB_CONTAINERS_AND_OBJECTS_INHERIT;
ea[1].Trustee.TrusteeForm = TRUSTEE_IS_SID;
ea[1].Trustee.TrusteeType = TRUSTEE_IS_GROUP;
ea[1].Trustee.ptstrName  = (LPTSTR) pAdminSID;

// Create a new ACL that contains the new ACEs.
dwRes = SetEntriesInAcl(2, ea, NULL, &pACL);
if (ERROR_SUCCESS != dwRes) 
{...}

// Initialize a security descriptor.  
pSD = (PSECURITY_DESCRIPTOR) LocalAlloc(LPTR, SECURITY_DESCRIPTOR_MIN_LENGTH); 
if (NULL == pSD) 
{...} 

if (!InitializeSecurityDescriptor(pSD, SECURITY_DESCRIPTOR_REVISION)) 
{...} 

// Add the ACL to the security descriptor. 
if (!SetSecurityDescriptorDacl(pSD, TRUE, pACL, FALSE))
{...} 

// Initialize a security attributes structure.
sa.nLength = sizeof (SECURITY_ATTRIBUTES);
sa.lpSecurityDescriptor = pSD;
sa.bInheritHandle = FALSE;

    CreateProcess(exe, cmdLine, &sa, &sa, ...

with no luck.

Update: I am also able to attach to the process using Visual Studio 2008 (still compiled using VS2005), which solves my immediate needs. Since this is under Vista x64, could there be some form of “Vista magic” at play here, where VS2005 does not play nice with Vista? Why this is the case only for processes that I’ve built and started from my code I cannot really understand…

Answer 1

Ok, I finally found out what caused this problem. I’ll post it here in case anyone else encounters this (from the scarcity of answers I guess it ain’t that common, but hey…).

The problem was that the path used to launch the executable contained a path element consisting of a single dot, like this:

c:\dir1\.\dir2\program.exe

which apparently made VS2005 go look for an executable at

c:\dir1\dir1\dir2\program.exe

that of course does not exist… Thank you Mark for Process Monitor! Removing the . made attaching to the process work as expected again.