Waiting for a program is essentially the same as injection except that instead of injecting into a running program, Thread Validator watches for the process starting up and then injects.
If the process is a service, Thread Validator won't be able to attach to it as services can't have process handles opened by third party applications, even with Administrator privileges.
Wait for Application can be accessed by one of these methods:
Or click on the Wait (timer) icon on the session toolbar.
Or use the shortcut:
Wait for application
The following applies only if you did not start Thread Validator in administrator mode.
If the application you want to wait for is running with Administrator privileges, Thread Validator will also need to run with Administrator privileges.
When choosing the 'wait for program' method described in this topic, a restart of Thread Validator with administrator privileges will be required to proceed.
If your process is a service, Thread Validator won't be able to attach to it.
Services can't have process handles opened by third party applications, even with Administrator privileges.
In order to work with services, you can use the NT service API and monitor the service
The wait for application dialog lets you specify the application or choose one that you've waited for previously.
If you choose a previously waited for application the Application Path Policy will be set to the same value as used with that application.
•Collect data from application do want to collect data from the instant you attach to the application?
Depending on your application, and what you want to validate, you may want to start collecting data as soon as injection has happened, or do it later.
If your program has a complex start-up procedure, initialising lots of data, it may be much faster not to collect data until the program has launched.
If it's the startup procedure you want to validate, obviously start collecting data from launch.
•Application Path Policy specify how the specified executable is treated
oPath to executable exists the executable will be checked that it exists and is appropriate for Thread Validator to work with
oPath to executable is created dynamically most pre-wait checks are not performed - use this if the path the executable is on does not exist at the time you start waiting for the process to start
•Application to wait for type or Browse to set the application name to launch
Alternatively, select a previously waited for application from the list.
•Full path shows the full path to the process executable in the list
•Image Name shows the short program name without path
•Reset clears the list
•Wait For Process start waiting for the specified executable to start
•Stop Waiting stop waiting for the specified executable to start
The program you're waiting for might already be running, in which case you'll be given the option to cancel or attach to the existing process:
Timing issues are inherit with native injecting into a program as it starts up.
This could cause the injection to fail in unpredictable ways and you may see dialogs like that below:
One case when this dialog can occur is if the program needs to run at an elevated privilege and is waiting for the user to give permission via the UAC dialog.
Injection may fail for different reasons and you might see the following information dialog showing:
•messages relating to the specific failure
•a selection of reasons why failure might be occurring
•some possible solutions to the problem
Sometimes retrying a few times might catch a better moment for attaching to the process.