OACR vs. command line prefast

Hi,

I’m using the Win7 RC WDK. I notice that the OACR results and the results I get from running “prefast build -cz” on the command line are not the same. I use “no filter” in the results window for both.

?

Thanks,
Matt

Could you attach the build logs ? If you could elaborate it will be helpful.

Thanks,
Sandeep

Can you attach build logs ? or If you could elaborate more it would be helpful

Thanks,
Sandeep

Could you please send the build logs ? or elaborate more on the issue?

Thanks,
Sandeep Sheshadri

I think Don Burn should tell us what he thinks about OACR…

Peter
OSR

Peter,

Since you baited me. I find OACR as it is configured in the WDK
extremely annoying. In addition, the concept of configuration by changing
files in the WDK directory is something I consider a poor design, touching
the WDK directory should never have to happen.

If one digs down into OACR there appear to be a huge number of options
and capabilities which may make the tool useful, but since at the present
time there is no decent documentation or NT Insider article on how to use
OACR other than the ugly default from the WDK, I have no reason yet to find
value with the tool.


Don Burn (MVP, Windows DKD)
Windows Filesystem and Driver Consulting
Website: http://www.windrvr.com
Blog: http://msmvps.com/blogs/WinDrvr

wrote in message news:xxxxx@ntdev…
>
> I think Don Burn should tell us what he thinks about OACR…
>
> Peter
> OSR
>
>
>
> Information from ESET NOD32 Antivirus, version of virus
> signature database 4267 (20090722)

>
> The message was checked by ESET NOD32 Antivirus.
>
> http://www.eset.com
>
>
>

Information from ESET NOD32 Antivirus, version of virus signature database 4267 (20090722)

The message was checked by ESET NOD32 Antivirus.

http://www.eset.com

Today I just found OACR is polling the following registry value a few times
per second:
HKCU\Software\Microsoft\OACR<path>\Settings Value:NoModalMsg

While the repetitive output is disturbing when using a registry monitoring
utility, the deed is useless as they could have used a registry change
notification to avoid wasting MINUTES of CPU time. The problem is, once you
build with OACR it remains resident by default.

If it weren’t I had heard about Prefast before I would have tossed it along
with OACR altogether. The nasty invading red screen is another factor which
makes sure that this tool bypasses all of its possible goals.

//Daniel

“Don Burn” wrote in message news:xxxxx@ntdev…
> Peter,
>
> Since you baited me. I find OACR as it is configured in the WDK
> extremely annoying. In addition, the concept of configuration by changing
> files in the WDK directory is something I consider a poor design, touching
> the WDK directory should never have to happen.
>
> If one digs down into OACR there appear to be a huge number of
> options and capabilities which may make the tool useful, but since at the
> present time there is no decent documentation or NT Insider article on how
> to use OACR other than the ugly default from the WDK, I have no reason yet
> to find value with the tool.
>
>
> –
> Don Burn (MVP, Windows DKD)
> Windows Filesystem and Driver Consulting
> Website: http://www.windrvr.com
> Blog: http://msmvps.com/blogs/WinDrvr
>
>
> wrote in message news:xxxxx@ntdev…
>>
>> I think Don Burn should tell us what he thinks about OACR…
>>
>> Peter
>> OSR
>>
>>
>>
>> Information from ESET NOD32 Antivirus, version of virus
>> signature database 4267 (20090722)

>>
>> The message was checked by ESET NOD32 Antivirus.
>>
>> http://www.eset.com
>>
>>
>>
>
>
>
> Information from ESET NOD32 Antivirus, version of virus
> signature database 4267 (20090722)

>
> The message was checked by ESET NOD32 Antivirus.
>
> http://www.eset.com
>
>
>
>
>

[Previous conversation about OACR being annoying.]

You can turn off OACR by editing C:\WINDDK\7100.0.0\bin\x86\OACR\OACR.INI and change either “OACR” to 0 or “MonitorAutoStart” to 0.

Here’s the Microsoft page with more info: http://msdn.microsoft.com/en-us/library/dd445211.aspx

The automated approaches actually do not turn it off, it just stops it from
running prefast and getting in the way. It still is running the monitor,
and while I can not prove it seems to have a slow memory leak. So the only
sure way is every time you run setenv or open a build window, you manuall
say “oacr stop” A lot of the problems with the tool as noted before is the
documentation and even the little that is there is incorrect.


Don Burn (MVP, Windows DKD)
Windows Filesystem and Driver Consulting
Website: http://www.windrvr.com
Blog: http://msmvps.com/blogs/WinDrvr

wrote in message news:xxxxx@ntdev…
> [Previous conversation about OACR being annoying.]
>
> You can turn off OACR by editing C:\WINDDK\7100.0.0\bin\x86\OACR\OACR.INI
> and change either “OACR” to 0 or “MonitorAutoStart” to 0.
>
> Here’s the Microsoft page with more info:
> http://msdn.microsoft.com/en-us/library/dd445211.aspx
>
>
>
> Information from ESET NOD32 Antivirus, version of virus
> signature database 4286 (20090728)

>
> The message was checked by ESET NOD32 Antivirus.
>
> http://www.eset.com
>
>
>

Information from ESET NOD32 Antivirus, version of virus signature database 4286 (20090728)

The message was checked by ESET NOD32 Antivirus.

http://www.eset.com

> The automated approaches actually do not turn it off, it just stops it from

running prefast and getting in the way. It still is running the monitor,

With OACR enabled, I see it open that key and read that value every 5 seconds. I just disabled OACR in the OACR.ini as I described, and it no longer has that behavior. So, it does seem to get disabled as advertised.

I’ve reported this to the owner of OACR who says he’s removed the polling. Not sure when the update would make its way outside MS though. Sorry about that.

-p

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@vertical.com
Sent: Tuesday, July 28, 2009 8:59 PM
To: Windows System Software Devs Interest List
Subject: RE:[ntdev] OACR vs. command line prefast

The automated approaches actually do not turn it off, it just stops it
from running prefast and getting in the way. It still is running the
monitor,

With OACR enabled, I see it open that key and read that value every 5 seconds. I just disabled OACR in the OACR.ini as I described, and it no longer has that behavior. So, it does seem to get disabled as advertised.


NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer