Is there a more reliable Win32 syscall tracing method than procmon?

Question

I'm building a Haskell command-line application in Windows 10, and am trying to debug an issue around the Windows 260-character file path limitation by tracing system calls and seeing which ones fail.

I've used procmon (https://learn.microsoft.com/en-us/sysinternals/downloads/procmon) for this, which seems quite nice, but although it displays many related log entries, I was surprised to find that it doesn't display an entry for the particular CreateFileW call that actually exceeds 260 chars and crashes my application.

I briefly tried Win32 API Monitor (https://www.apimonitor.com) but couldn't make heads or tails of it; it seems better suited to attaching to already-running GUI applications than command-line applications that need to be launched in a particular directory, etc.

Is there a better alternative to these, or a better approach?

Answer 1

@RemyLebeau's comment was the one I needed:

"I was surprised to find that it doesn't display an entry for the particular CreateFileW call that actually exceeds 260 chars and crashes my application"

Because there is nothing for it to log. The call likely gets rejected at the higher level API layer, when the input data is first validated, long before it reaches the file system layer. Procmon logs lower level activity, not higher level APIs. Tools like API Monitor are what you are looking for. If you are having trouble with it, ask a new question about that.

My eventual solution to the problem that inspired this was to upgrade from base-4.11 to base-4.12 which handles windows paths > 260 chars better.

I don't think I'd even need the registry switch anymore.