1

I found some events in the Windows Event Log, and I was wondering which binary caused them.

The event I am curious about is Event ID 27 from Hyper-V

Hyper-V launch failed; the Hyper-V boot loader was unable to allocate sufficient resources to perform the launch.

Any ideas on how to track which binary was in charge of emitting that event? I want to understand what resource is the one failing.

Improve this question
3
  • 1) If this were a linux program, I would run it with strace and search for libraries associated (your code likely load those dynamically) with the file descriptor that writes THIS PARTICULAR log message. There is something here related to strace equivalentes on windows (stackoverflow.com/questions/864839/…). Sysinternals is probably the place to start. 2) If you have source, you could search for HV_EVENTLOG_BAL_INSUFFICIENT_RESOURCES in a source file.
    – jmcarter9t
    Commented Apr 10, 2021 at 13:04
  • One of the problems is that I don't even know which binary is causing the event to be fired, and this happens early in boot, so I don't think strace would be of much help. I am thinking of remotely attaching WinDBG an check if I can see something from there
    – Marco
    Commented Apr 10, 2021 at 19:49
  • So you are doing process forensics on the windows boot-up process? Guess I didn't think deeply enough about the "boot loader" part of the message. Not an easy route, but you could emulate the system in Qemu (qemu.readthedocs.io/en/latest/system/gdb.html), halt it early in the boot with the monitor, attach GDB and do some forensics. More complex would be using Panda (github.com/panda-re/panda).
    – jmcarter9t
    Commented Apr 11, 2021 at 14:59

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.