This project has moved and is read-only. For the latest updates, please go here.

snoop not showing any applications

Nov 29, 2010 at 7:03 AM


got a little problem here with Snoop on a 64 bit Windows 7. I love this tool and was using it on my "old" XP dev machine for quite some time. Now I switched to a Windows 7 system for development. Unfortunately snoop is not showing any running applications :(. I downloaded the latest Version and also tried to build it myself from source. I just noticed that I CAN snoop 3.5 applications. I created a fresh WPF application with .Net version set to 4.0 ... nothing.  Switched to 3.5 ... snoop is showing the application just fine. What I understand from the blog posts is that Snoop should be able to handle 4.0 apps, right? I already browsed the other discussions. Running snoop with admin privileges or starting the application from the command line does not help. I must admit I haven't tried to debug snoop ... but maybe someone else already ran into this issue!? I'm sure I'm missing something obvious here.

Any ideas? 



Nov 29, 2010 at 4:18 PM

Hmm. The first thing I would suggest ... is a mismatch between Snoop not having elevated permissions and yet the application you are trying to Snoop does have elevated permissions. Yet, you say you already tried running Snoop as Admin.

Snoop does handle WPF 4.0 applications just fine. I am surprised that a fresh WPF 4.0 application does not work for you.

It seems as if something funky is going on.

I had a situation where I would get an exception when trying to actually Snoop an application (i.e. clicking the binoculars) that was already showing up in the list. This was caused by not having the MSVC++ redistributables on the machine. Snoop needs the MSVCR100.dll to run (for the case of WPF 4.0). Maybe this is your problem as well? I mean I know your application isn't even shown in the list ... and thus the problem seems different ... but you might want to check and see if you have MSVCR100.dll on your machine.

I will likely not be able to sleuth into this problem for you ... it is likely an issue on your machine somehow ... if I were you, I would definitely debug into the Snoop source code to see if that reveals anything.

Please post back here (for everyone's benefit) ... if you figure anything out!

Nov 29, 2010 at 7:48 PM

Thanks for the answer!

I started debugging Snoop and found out that IsValidProcess returns false since there is no Module PresentationFramework.dll or With that info is found the "WPF 4 App does not show up on list" issue ( This is somehow related. I just don't really know how. When I set the Plattform to "x86" it is not showing up in Snoop, if I select "Any CPU" it is. In the other post IntelliTrace was mentioned. I would disable it, but to be honest I've no idea what it is and if I even have it. Google says it comes with VS Ultimate .. I'm working with the Professional version so I stopped digging. I'll have another look in the next few days. I'd like to figure out if the PresentationFramework assembly is really not loaded or just not discovered by the GetModules method.

Great job on Snoop by the way! Really helps a lot.

Nov 29, 2010 at 8:44 PM

Interesting ... I had forgotten about the issue where IntelliTrace is involved ... thanks for bringing that up. I believe you are right ... I think IntelliTrace only comes with Visual Studio Ultimate.

You could use ProcessExplorer (Sysinternals) to see what assemblies are loaded ... and in particular to see if PresentationFramework.dll is loaded or not ... as you pointed out ... this is exactly how Snoop determines if an application is a WPF application or not.

Hmm. Very odd about 'x86' versus 'Any CPU'. When set to 'Any CPU', your application will be running as 64-bit ... while when set to 'x86', it will be running as 32-bit. So, your 64-bit application is showing up, but not your 32-bit application. Hmm. Odd. In typical situations, Snoop handles this situation (32-bit vs. 64-bit) just fine.

Thanks for the feedback on Snoop ... I am always glad to hear that my efforts have been helpful ... and again, post back here if you figure it out ... because that way, you're helping others too.

Nov 30, 2010 at 8:06 AM

Just a quick update. The PresentationFramework.dll is definitely loaded. So it's just not picked up by the CreateToolhelp32Snapshot call. Unfortunately the remark on the MSDN doku on CreateToolhelp32Snapshot is not quite clear to me:

"64-bit Windows:

Using this flag in a 32-bit process includes the 32-bit modules of the process specified in th32ProcessID, while using it in a 64-bit process includes the 64-bit modules. To include the 32-bit modules of the process specified in th32ProcessID from a 64-bit process, use the TH32CS_SNAPMODULE32 flag."

That does not cover the situation when you try to get the modules of a 64 bit application from 32 bit. Anyway ... even if build Snoop explicit for x86 it does not pick up the process.

Have you tried to reproduce this behavior on your own already? I'm just wondering if I'm the only one with this problem!?

I'll dig deeper into this next weekend ... have to get back to work now :)




Nov 30, 2010 at 3:54 PM

Yes, I can Snoop both 32-bit applications and 64-bit applications from Snoop. I just double checked.

Snoop itself runs as Any CPU (32-bit on 32-bit operating systems and 64-bit on 64-bit operating systems).

I don't know if you are the only one with this issue. :-) I do think that ... if it wasn't working for the bulk of people out there ... I would have a ton of Discussion items on the subject. That, however, doesn't mean that others aren't having the same issue as you. Keep looking into it ... as you have time! Good luck.

Dec 16, 2010 at 9:45 AM


i also had the problem that Snoop didnt show any applications.
I do not know why it stopped working, but it worked some time. My other colleagues dont have this problem - but their software and system configuration is the same.

I tracked down the problem to the following:
Snoop does not find the PresentationFramework.dll in the Modules list of the inspected Process.

To fix the problem i added a check for "wpfgfx_v0400.dll" in Injector.Suffix() and WindowInfo.IsValidProcess. It now finally works!

Reading the .NET 4 breaking changes list i can imagine why Snoop cannot find the PresentationFramework.dll:



To prevent redundant loading of assemblies and to save virtual address space, the CLR now loads assemblies by using only the Win32 MapViewOfFile function. It no longer also calls the LoadLibrary function.

This change affects diagnostic applications in the following ways:

  • A ProcessModuleCollection will no longer contain any modules from a class library (.dll file), as obtained from a call to Process.GetCurrentProcess().Modules.

  • Win32 applications that use the EnumProcessModules function will not see all managed modules listed.


This explains why Snoop does not see the managed modules!


Best regards,




Dec 16, 2010 at 11:59 AM

Thanks cproch for posting ... this is very interesting indeed.

awerner, can you try this out? I would love to hear that this works for you.

Dec 16, 2010 at 1:11 PM


Thanks for the message. I'm travelling right now. But I will try this tomorrow and get back to you.

Best regards!

Dec 16, 2010 at 4:43 PM
cproch wrote:

My other colleagues dont have this problem - but their software and system configuration is the same.

What is weird to me ... is that some people have this problem and that others do not ... however, I do think it is a good idea to add wpfgfx_v0400.dll to Injector.Suffix() and WindowInfo.IsValidProcess.

I'm going to create a work item for this ... and do just this.

Dec 16, 2010 at 5:45 PM
This discussion has been copied to a work item. Click here to go to the work item and continue the discussion.