Snoop 64-bit WPF 3.5 Requires Elevated Privileges

Feb 23, 2010 at 9:44 PM

Hi, just downloaded Snoop 64-bit Installer for WPF 3.5 and ran it but it couldn't detect my app at first. So I ran it with elevated privileges and it detects my application fine. Just an FYI.

Feb 23, 2010 at 10:13 PM

Hmm. That's odd. I've never had a problem with that ... and typically don't run Snoop with elevated privileges.

Just to clarify, Snoop was able to run fine (when not elevated) ... it just couldn't detect your app, right?

Has anyone else seen this?

Feb 24, 2010 at 3:01 AM

Yeah thats it. I've done some more researching and it detects my application fine when I open it with windows, but when I run it with the debugger in visual studio it wont detect it. Running it with elevated privileges detects it.

Mar 10, 2010 at 8:21 PM

same here

Mar 10, 2010 at 9:06 PM

Boy, I'm at a loss here. I've never seen this ... but obviously there are some situations where it happens.

I would encourage you all to try and diagnose what is going on (as I can't reproduce it). In particular, take a look at the AppChooser code (specifically the code that determines what applications you can Snoop).

If you figure out anything, let me know.

Mar 11, 2010 at 1:32 PM

I've found out what's going on. When snooping an elevated process from snoop that is not elevated you get a Win32Exception (Access Denied). This comes from when trying to read the modules loaded within a process in the AppChooser code. Unfortunately there's no way round this other than running snoop in elevated mode. The only way I can think of is to find an alternative method of identifying whether an application is WPF based.

Mar 11, 2010 at 5:39 PM

Ah. That makes perfect sense. Thanks for posting your finding back here leetreveil ... I'm sure it will help others.

For now, I think it is fair to expect you to run Snoop elevated, if the application you are Snooping is elevated. Maybe when I start toying around with some ideas I have (in regards to how you select the application you want to Snoop) ... maybe a better solution will fall out at that time. I'll keep it mind.