SpyStudio lets you compare two traces to find the differences between them. For example, we use this feature to create virtual profiles for applications. Sometimes there is a problem with a COM object, a missing dll, a window that cannot be created or a missing registry key. These errors are easy to spot by comparing traces in SpyStudio. The differences in the traces are recognized and interpreted by SpyStudio to highlight the most probable causes of errors.
You could also use this feature when you have an application that is running well on a system but you cannot make it work on another.
1. Capture two traces and save them.
The first thing you need is two traces to compare. Normally, you will get a trace of a process in an environment where it performs well and another in an environment where it doesn't. If you don't know how to get a process trace, take a look at this article: Trace an application from startup. Take into account that the comparison will be much more accurate if you trace the executions from startup.
To save the traces, just go to "File"->"Save log" as seen below.
2. Start comparison
Go to "Compare" -> "Traces" and wait for SpyStudio to process both traces and display the comparison window.
This example shows a comparison between the traces of a custom application (ThinAppLegacyApp) running on Windows 7 x64 and the same application running on Windows XP. In Windows 7, the application crashes during start-up.
Interpreting results in the Trace tab
Calls: each field in trace control represents a specific call which can be in one of the files or in both.
Time: time that took the call/s in milliseconds.
Calls: each field represents a group of calls that have the same parameters.
Count: number of calls that were grouped in the field
Time: time that took the calls in milliseconds.
Only for Registry tab
White: low importance events that exist in both files
Gray: mid-importance events that exist in both files
Black: high importance events that exist in both files
Magenta: events that exist in both files which results are different (first place to look for errors)
Blue: events that exist only in the first file
Green: events that exist only in the second file
This tab shows the list of COM objects instantiated by both processes. Here we can see that a COM object which was successfully instantiated in Windows XP, couldn't be instantiated in Windows 7. Hence, the process stopped prematurely under Windows 7 and didn't got to instantiate all the COM objects that were instantiated under Windows XP.
This tab shows the windows created by both processes. Again, we can see the differences between both traces. The process wasn't able to load completely on Windows 7, so it didn't got to open all the windows that were created under XP.
It shows files opened in both traces. Here you can see that most file accesses are unmatched, since the different versions of windows have different versions of system files.
This tab shows the registry entries accessed by the processes. Here we can see differences in the registry usage too.
You can apply a filter from 'Edit' menu, click 'Filter ...' item or just press CTRL-L. In this example you can see calls filtered to see only those which ParamMain contains clsid, and doesn't contain uxtheme.dll