{"id":1253,"date":"2011-07-24T20:55:47","date_gmt":"2011-07-24T18:55:47","guid":{"rendered":"https:\/\/alax.info\/blog\/?p=1253"},"modified":"2011-07-25T09:29:23","modified_gmt":"2011-07-25T07:29:23","slug":"directshow-spy-intelligent-connect-trace-selective-process-black-listing","status":"publish","type":"post","link":"https:\/\/alax.info\/blog\/1253","title":{"rendered":"DirectShow Spy: Intelligent Connect Trace, Selective Process Black Listing"},"content":{"rendered":"<p>DirectShow Spy is updated with a few new features:<\/p>\n<ul>\n<li>retroactive Intelligent Connect trace<\/li>\n<li>log output for IAMGraphBuilderCallback-related activity<\/li>\n<li>process name based black list to selectively exclude processes from spying<\/li>\n<\/ul>\n<h4>Intelligent Connect Trace<\/h4>\n<p>The utility received a capability to read back from its own log file (DirectShowSpy.log, located typically in C:\\ProgramData directory) and reconstruct graph building sequence, including steps taken by DirectShow <a href=\"http:\/\/msdn.microsoft.com\/en-us\/library\/dd390342%28VS.85%29.aspx\">Intelligent Connect<\/a>.<\/p>\n<p><a href=\"https:\/\/alax.info\/blog\/wp-content\/uploads\/2011\/07\/Image0012.png\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-large wp-image-1254\" title=\"Intelligent Connect Trace\" src=\"https:\/\/alax.info\/blog\/wp-content\/uploads\/2011\/07\/Image0012-582x600.png\" alt=\"\" width=\"582\" height=\"600\" srcset=\"https:\/\/alax.info\/blog\/wp-content\/uploads\/2011\/07\/Image0012-582x600.png 582w, https:\/\/alax.info\/blog\/wp-content\/uploads\/2011\/07\/Image0012-310x320.png 310w, https:\/\/alax.info\/blog\/wp-content\/uploads\/2011\/07\/Image0012.png 876w\" sizes=\"auto, (max-width: 582px) 100vw, 582px\" \/><\/a><\/p>\n<p>In order to activate the Intelligent Connect Trace property sheet, one needs to call exported function &#8220;<em>DoGraphBuilderCallbackPropertySheetModal<\/em>&#8220;, such as using <em>runndll32<\/em> tool:<\/p>\n<p style=\"text-align: left; padding-left: 30px;\">C:\\DirectShowSpy&gt;rundll32 DirectShowSpy.dll,DoGraphBuilderCallbackPropertySheetModal<\/p>\n<p style=\"text-align: left;\">The upper part of the property page displays recently created DirectShow fitler graphs, newest to older. For a selected graph, the lower part displays events in chronological order. The events include:<\/p>\n<ul>\n<li>Adding a filter, at <a href=\"http:\/\/msdn.microsoft.com\/en-us\/library\/dd390016%28VS.85%29.aspx\">IFilterGraph2::AddFilter<\/a> method<\/li>\n<li>Removing a filter, at <a href=\"http:\/\/msdn.microsoft.com\/en-us\/library\/dd390022%28VS.85%29.aspx\">IFilterGraph2::RemoveFilter<\/a> method<\/li>\n<li>Selecting a filter, at Intelligent Connect&#8217;s callback at <a href=\"http:\/\/msdn.microsoft.com\/en-us\/library\/dd389378%28VS.85%29.aspx\">IAMGraphBuilderCallback::SelectedFilter<\/a><\/li>\n<li>Creating a filter, at <a href=\"http:\/\/msdn.microsoft.com\/en-us\/library\/dd389377%28VS.85%29.aspx\">IAMGraphBuilderCallback::CreatedFilter<\/a><\/li>\n<\/ul>\n<p>The latter two methods also show &#8220;Application Result&#8221; column and values, which are HRESULT values returned by IAMGraphBuilderCallback callback provided by the application. Typically, a failure HRESULT code indicates that the application rejected the filter.<\/p>\n<p>The trace log is good to expose all DirectShow junk installed in the system. For example,<\/p>\n<p><!--more--><a href=\"https:\/\/alax.info\/blog\/wp-content\/uploads\/2011\/07\/Image0022.png\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-large wp-image-1255\" title=\"Junk: ffdshowBC.ax\" src=\"https:\/\/alax.info\/blog\/wp-content\/uploads\/2011\/07\/Image0022-800x496.png\" alt=\"\" width=\"620\" height=\"384\" srcset=\"https:\/\/alax.info\/blog\/wp-content\/uploads\/2011\/07\/Image0022-800x496.png 800w, https:\/\/alax.info\/blog\/wp-content\/uploads\/2011\/07\/Image0022-320x198.png 320w, https:\/\/alax.info\/blog\/wp-content\/uploads\/2011\/07\/Image0022.png 826w\" sizes=\"auto, (max-width: 620px) 100vw, 620px\" \/><\/a><\/p>\n<p>In an attempt to build graph to decode FourCC &#8216;LXH4&#8217; video (which is a private alias for H.264 media type), Filter Graph Manager tried to apply &#8216;ffdshow Video Decoder&#8217; filter, which is unable to process the feed, but is registered at an extremely high merit and violating the guidelines.<\/p>\n<p>The tool shows that the file hosting the filter is &#8220;<em>ffdshowBC.ax<\/em>&#8221; and shows its location. The application however appears to be aware of this piece of trash, and returned E_FAIL (0x80004005) rejecting the filter.<\/p>\n<p>How comes the garbage is hooking into place where it is not supposed to be, yet is sophisticated enough to reach such internals of operating system? This module is a clone\/branch of well-known <a href=\"http:\/\/www.google.com\/search?q=ffdshow\">ffdshow<\/a> software, which by default registers itself with abnormally high merit &#8220;with good intentions in mind&#8221;. A short-sighted manufacturer of cheap stuff IP camera duplicated the project, changed the GUIDs, packaged the pathetic crap into ActiveX control cabinet and started distributing it over clean and virgin workstations around the globe.<\/p>\n<p>Going further with the the trace being checked, there are more things to enjoy:<\/p>\n<p><a href=\"https:\/\/alax.info\/blog\/wp-content\/uploads\/2011\/07\/Image0033.png\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-large wp-image-1256\" title=\"Junk: MainConcept Showcase\" src=\"https:\/\/alax.info\/blog\/wp-content\/uploads\/2011\/07\/Image0033-800x553.png\" alt=\"\" width=\"620\" height=\"428\" srcset=\"https:\/\/alax.info\/blog\/wp-content\/uploads\/2011\/07\/Image0033-800x553.png 800w, https:\/\/alax.info\/blog\/wp-content\/uploads\/2011\/07\/Image0033-320x221.png 320w, https:\/\/alax.info\/blog\/wp-content\/uploads\/2011\/07\/Image0033.png 839w\" sizes=\"auto, (max-width: 620px) 100vw, 620px\" \/><\/a><\/p>\n<p>Trying to decode the same H.264 video feed, the Filter Graph Manager mounting three demultiplexers made\u00c2\u00a0 by MainConcept in a row, for MP4, MPEG and MXF containers. The utility immediately indicates that this trash contribution was brought by <a href=\"http:\/\/www.mainconcept.com\/products\/sdks\/others\/showcase.html\">MainConcept Showcase<\/a> 8.7.0.28412. One might wanted to install it for a purpose, and it started killing other DirectShow software it shares workstation with.<\/p>\n<p>The good news is that the method is friendly for production environment and only requires to register spy and collect log file. You don&#8217;t eve need to check the UI at the same computer, it is possible to transfer the log file into development environment and have spy read the log there.<\/p>\n<p>The &#8220;Copy to Clipboard&#8221; link is a convenient option to transfer the findings into tab-separated values format, such as to paste into Microsoft Excel:<\/p>\n<p><a href=\"https:\/\/alax.info\/blog\/wp-content\/uploads\/2011\/07\/Image0042.png\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-large wp-image-1257\" title=\"Data Transfered to Microsoft Excel\" src=\"https:\/\/alax.info\/blog\/wp-content\/uploads\/2011\/07\/Image0042-800x394.png\" alt=\"\" width=\"620\" height=\"305\" srcset=\"https:\/\/alax.info\/blog\/wp-content\/uploads\/2011\/07\/Image0042-800x394.png 800w, https:\/\/alax.info\/blog\/wp-content\/uploads\/2011\/07\/Image0042-320x157.png 320w, https:\/\/alax.info\/blog\/wp-content\/uploads\/2011\/07\/Image0042.png 1200w\" sizes=\"auto, (max-width: 620px) 100vw, 620px\" \/><\/a><\/p>\n<h4>Process Black Listing<\/h4>\n<p>The utility received a capability to selectively not load into specific processes. DirectShowSpy is a developer tool and is not intended for production environment, nor it is guaranteed to be issue-free. So in case of specific conflict it is possible to exclude specific process from applying a spy using registry:<\/p>\n<p><a href=\"https:\/\/alax.info\/blog\/wp-content\/uploads\/2011\/07\/Image0051.png\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-large wp-image-1258\" title=\"Black List Registry\" src=\"https:\/\/alax.info\/blog\/wp-content\/uploads\/2011\/07\/Image0051-800x424.png\" alt=\"\" width=\"620\" height=\"328\" srcset=\"https:\/\/alax.info\/blog\/wp-content\/uploads\/2011\/07\/Image0051-800x424.png 800w, https:\/\/alax.info\/blog\/wp-content\/uploads\/2011\/07\/Image0051-320x169.png 320w, https:\/\/alax.info\/blog\/wp-content\/uploads\/2011\/07\/Image0051.png 913w\" sizes=\"auto, (max-width: 620px) 100vw, 620px\" \/><\/a><\/p>\n<p>The values are under <em>HKLM, SOFTWARE\\[Wow6432Node\\]Alax.Info\\Utilities\\DirectShowSpy<\/em> key, and there are three values defined:<\/p>\n<ul>\n<li>CFilterMapperSpy Black List &#8211; defines exclusion for filter mapper spying<\/li>\n<li>CSpy Black List &#8211; defines exclusion for filter graph spy (effective for most applications)<\/li>\n<li>CNoThreadSpy Black List &#8211; defines exclusion for filter graphs created with <a href=\"http:\/\/msdn.microsoft.com\/en-us\/library\/dd375786%28VS.85%29.aspx\">CLSID_FilterGraphNoThread<\/a><\/li>\n<\/ul>\n<p>The exclusion value is a comma-separated list of process names, exact case-insensitive match for executable file names without directory and extension.<\/p>\n<p>It is recommended that filter mapper spy has at least as rich exclusion list as the filter graph spy entires (otherwise, it is possible that spy might raise unexpected exceptions).<\/p>\n<p>Partial Visual C++ .NET 2008 source code is <a href=\"http:\/\/code.assembla.com\/roatl-utilities\/subversion\/nodes\/trunk\/FilterGraphSpy\">available from SVN<\/a>, release binary included (<a href=\"http:\/\/code.assembla.com\/roatl-utilities\/subversion\/nodes\/trunk\/FilterGraphSpy\/Release%20Trace\/Win32\/DirectShowSpy.dll?format=raw\">Win32<\/a>, <a href=\"http:\/\/code.assembla.com\/roatl-utilities\/subversion\/nodes\/trunk\/FilterGraphSpy\/Release%20Trace\/x64\/DirectShowSpy.dll?format=raw\">x64<\/a>); installation instructions are in <a href=\"..\/777\">another post<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>DirectShow Spy is updated with a few new features: retroactive Intelligent Connect trace log output for IAMGraphBuilderCallback-related activity process name based black list to selectively exclude processes from spying Intelligent Connect Trace The utility received a capability to read back from its own log file (DirectShowSpy.log, located typically in C:\\ProgramData directory) and reconstruct graph building&hellip; <\/p>\n<p><a class=\"moretag\" href=\"https:\/\/alax.info\/blog\/1253\">Read the full article<\/a><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[78,119,163,282,357,217,164,358],"class_list":["post-1253","post","type-post","status-publish","format-standard","hentry","category-utilities","tag-directshow","tag-filter","tag-graph","tag-hook","tag-intelligent-connect","tag-memory","tag-spy","tag-trace"],"_links":{"self":[{"href":"https:\/\/alax.info\/blog\/wp-json\/wp\/v2\/posts\/1253","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/alax.info\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/alax.info\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/alax.info\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/alax.info\/blog\/wp-json\/wp\/v2\/comments?post=1253"}],"version-history":[{"count":0,"href":"https:\/\/alax.info\/blog\/wp-json\/wp\/v2\/posts\/1253\/revisions"}],"wp:attachment":[{"href":"https:\/\/alax.info\/blog\/wp-json\/wp\/v2\/media?parent=1253"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/alax.info\/blog\/wp-json\/wp\/v2\/categories?post=1253"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/alax.info\/blog\/wp-json\/wp\/v2\/tags?post=1253"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}