为什么我的自定义分析代码总是让我感觉到PC是在KeFastSystemCallRet()?

时间:2015-05-11 03:01:05

标签: c winapi profiling ntdll

我试图在我的框架中描述滞后;因为我使用MinGW,gprof doesn't work with DLLs(对我来说它甚至给了我一些垃圾信息,比如初始化函数运行数千次而不是一次),并且Windows上不支持gperftools的分析器(但是),我尝试滚动自己的分析代码inspired by Cygwin's

// 10 may 2015
#include "uipriv_windows.h"

static FILE *fprof = NULL;

static DWORD WINAPI profilerThread(LPVOID th)
{
    HANDLE thread = (HANDLE) th;
    LARGE_INTEGER counter;
    CONTEXT ctxt;

    // TODO check for errors
    if (SetThreadPriority(GetCurrentThread(), THREAD_PRIORITY_TIME_CRITICAL) == 0)
        complain("error setting thread priority in profilerThread()");
    for (;;) {
        if (SuspendThread(thread) == (DWORD) (-1))
            complain("error suspending thread in profilerThread()");
        QueryPerformanceCounter(&counter);
        ZeroMemory(&ctxt, sizeof (CONTEXT));
        ctxt.ContextFlags = CONTEXT_CONTROL;
        if (GetThreadContext(thread, &ctxt) == 0)
            complain("error getting thread context in profilerThread()");
        fprintf(fprof, "%I64X %I64d\n",
            (DWORD64) (ctxt.Eip),
            counter.QuadPart);
        fflush(fprof);
        if (ResumeThread(thread) == (DWORD) (-1))
            complain("error resuming thread in profilerThread()");
        Sleep(100);
    }
    return 0;
}

void initprofiler(HANDLE thread)
{
    fprof = fopen("profiler.out", "w");
    if (fprof == NULL) {
        fprintf(stderr, "error opening profiler output file\n");
        abort();
    }
    if (CreateThread(NULL, 0, profilerThread, thread, 0, NULL) == NULL)
        complain("error creating profiler thread");
}

但是,返回的配置文件是无用的:

F77B0C03 3571425665428
F77B0C03 3571426671982
F77B0C03 3571427677119
F77B0C03 3571428683227
F77B0C03 3571429689442
F77B0C03 3571430696476
F77B0C03 3571431702590
F77B0C03 3571432708622

这个特殊值是葡萄酒,重定向到__kernel_vsyscall+0x3。真正的Windows会改为7C90E514,而是重定向到ntdll!KeFastSystemCallRet

我猜测(给出葡萄酒堆栈痕迹)这是因为它被卡在GetMessage()中。

如果我将睡眠持续时间从100更改为1,我会偶尔获得更有意义的值

我有什么遗失的东西吗?是否有更好的分析选项,或者我在某种程度上是否存在根本错误?

感谢。

0 个答案:

没有答案