On Sep 7, 5:54 am, "Pavel Lebedinsky [MSFT]"
Thanks, the user mode debugger "works" even though I was kind of
hoping to see output from the loading of the first dlls as well (not
ntdll.dll obviously). I also think this almost entirely contradicts
the help entry for Show loader snaps (and the gflags gui):
Show loader snaps
The Show loader snaps flag captures detailed information about the
loading and unloading of executable images and their supporting
library modules and displays the data in the -->kernel debugger
Destination -->System-wide registry entry, kernel flag<--, image file
For system-wide (registry or kernel flag), this flag displays
information about driver loading and unloading operations.
For per-process (image file), this flag displays information about
loading and unloading of DLLs.