WinBatch Tech Support Home

Database Search

If you can't find the information using the categories below, post a question over in our WinBatch Tech Support Forum.

TechHome

WinBatch
Functions

Can't find the information you are looking for here? Then leave a message over on our WinBatch Tech Support Forum.

IntControl 92 and the Performance Monitor

 Keywords: perflib Process Counters Performance Monitoring IntControl 92 Redirection 64 32 bit AppExist tlistProc

Question:

Here is what is happening: I don't originally have the Disable Performance Counters. However, while I was testing, I was switching between using notepad (32-bit) and notepad (64-bit). I was switching back and forth by using: 
origvalue = IntControl( 92, "disable", 0, 0, 0 )
Run("c:\windows\system32\notepad","")
Timedelay(5)
If AppExist("notepad.exe")
                message("testing","notepad is up")
else
                message("testing","NO notepad")
endif
IntControl( 92, "revert", origvalue, 0, 0 )
When it executes the "If AppExist("notepad.exe")" using the notepad (64-bit), it adds the registry entry to HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\PerfProc\Performance[Disable Performance Counters] and sets it to DWORD=2. From that point on, AppExist doesn't work. If I remove it, things work at least until I do an AppExist pointing to notepad 64-bit. Is it something in AppExist or in the IntControl(92….) that is causing the registry entry to be added?

Also this is wrtten to the event viewer: 

Windows cannot open the 64-bit extensible counter DLL PerfProc in a 32-bit environment. Contact the file vendor to obtain a 32-bit version. 
Alternatively if you are running a 64-bit native environment, you can open the 64-bit extensible counter DLL by using the 64-bit version of 
Performance Monitor. To use this tool, open the Windows folder, open the System32 folder, and then start Perfmon.exe.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Answer:

This is an interesting issue. This is why there is the big warning for IntControl 92. In short, redirection *MUST* be turned back on immediately after the Run call.

IntControl 92 disables or reverts file system redirection when running in WOW64 (32-bit emulation under 64-bit Windows).

WinBatch is a 32 bit application. When it is run a 64 bit Windows platform the Windows file system auto-magically redirects file operations that refer to 64 bit directories to the 32 bit equivalents. For example, the %windir%\System32 directory is reserved for 64-bit applications. Since most System DLL file names were not changed when porting to 64-bit, 32-bit applications must use a different directory as their System32 directory. WOW64 hides this difference using file system redirection. Whenever a 32-bit application, like WinBatch, attempts to access %windir%\System32, the access is redirected to a new directory, %windir%\SysWOW64. IntControl 92 can be used to disable this functionality.

IntControl 92's underlying API is Wow64DisableWow64FsRedirection: http://msdn.microsoft.com/en-us/library/aa365743(VS.85).aspx.

When WinBatch first opens HKEY_PERFORMANCE_DATA for process performance data the system calls the export OpenPerformanceData of all performance providers that supply the kind of process counter data WinBatch is looking for. Since WinBatch is a the 32-bit process the 'system' in this case is also 32-bit. However, because redirection is turned off, the system tries to call OpenPerformanceData for some 64-dlls. And as we all know, you can't call into a 64-bit dll from a 32-bit process. The performance counts monitoring service detects this sin and turns off any provider that has a 64-bit presents on the system.

NOTE: It is IMPORTANT to minimize the code run when the File System Redirection is disabled, especially when loading extenders, instantiating or using COM object, or doing anything that asks Windows to loads any new DLLs or anything. The problem is that while File System Redirection is disabled, your code will be looking at the 'wrong' version of windows and will attempt to load wrong (64 instead of 32 bit) versions of modules, and usually fail, GP Fault, or otherwise not function properly.

If you attempt to call AppExist, tListProc or any other function that depends on performance monitoring, while the script is in disable redirection mode, that it could cause this message in the event viewer: 

Windows cannot open the 64-bit extensible counter DLL PerfProc in a 32-bit environment. Contact the file vendor to obtain a 32-bit version. Alternatively if you are running a 64-bit native environment, you can open the 64-bit extensible counter DLL by using the 64-bit version of Performance Monitor. To use this tool, open the Windows folder, open the System32 folder, and then start Perfmon.exe.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp

Note: "Disable Performance Counter" registry entry value of 2 indicates: The Win32 version is disabled on computers running a Win64 version of the operating system. http://technet.microsoft.com/en-us/library/cc784382.aspx. This document states that you can prevent Perflib from disabling counters, set the 0x2 (10) bit in the value of the Configuration Flags entry.

To avoid these issue in the first place be very careful what functions you call when redirection is disabled!

You code should look something like this: 

origvalue = IntControl( 92, "disable", 0, 0, 0 )
Run("c:\windows\system32\notepad","")
IntControl( 92, "revert", origvalue, 0, 0 )
Timedelay(5)
If AppExist("notepad.exe")
                message("testing","notepad is up")
else
                message("testing","NO notepad")
endif

Article ID:   W17897

Filename:   IntControl 92 and the Performance Monitor.txt
File Created: 2009:04:03:14:28:56
Last Updated: 2009:04:03:14:28:56