Post by JJ
Check what file it tries to open using Microsoft Process Monitor
I've just done so, but I can't find a way to run-and-capture/view the file
access. I do not see any kind of log file either. In other words:
if-and-when it tries to open a file it goes way to fast for me to notice (if
it gets displayed at all that is).
Post by JJ Post by R.Wieser
The problem is that the listing ends (for all but the last fileparts)
with an ERAR_EOPEN error (which I assume means it couldn't
find the next filepart).
I was wrong in the above assumption by the way: the ERAR_EOPEN is returned
by the RARProcessFile (using RAR_SKIP) function, after which the
RARReadHeader ends with the ERAR_END_ARCHIVE state. In other words, it
terminates normally - just not continuing with the next file.
I could also verify that it really is the very last (partial!) file in the
file, as it showed a "continues in next volume" flag (0x01) in the
RARHeaderData -> Flags field.
I also tried something else to see which files the program and/or dll
attempts to open, which involves injecting a DLL in the programs addres
space. But for some reason the program aborts (exit code -1 (minus one)
) whenever I do such an injection, regardles of which DLL I'm injecting
(my own, or a windows standard one, like ws2_32). Do you have any idea
what could cause it ?
 I can see three message-loop events in the rarviewer program,
wm_setfont, wm_destroy and wm_ncdestroy.