microsoft / microsoft/krabsetw

how to trace VirtualAlloc + CallStack?

Open
#278 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
C++
Stars
801
Forks
167
Avg merge
3d 15m
Merged PRs (30d)
2

Description

void kernel_trace_004::start()
{
    krabs::kernel_trace trace(L"Memory Trace");


    krabs::kernel::virtual_alloc_provider provider;

    // Kernel providers accept all the typical callback mechanisms.
    provider.add_on_event_callback([](const EVENT_RECORD& record, const krabs::trace_context& trace_context) {
        krabs::schema schema(record, trace_context.schema_locator);

        for (int i = 0; i < record.ExtendedDataCount; i++) {
            //auto extended_data_item = &record.ExtendedData[i];

        }
    });

    CLASSIC_EVENT_ID StackTracingEvents[2];

    StackTracingEvents[0].EventGuid = krabs::guids::page_fault;
    StackTracingEvents[0].Type = 98;                 // VirtualAlloc
    memset(StackTracingEvents[0].Reserved, 0, sizeof(StackTracingEvents[0].Reserved));

    StackTracingEvents[1].EventGuid = krabs::guids::page_fault;
    StackTracingEvents[1].Type = 99;                 // VirtualFree
    memset(StackTracingEvents[1].Reserved, 0, sizeof(StackTracingEvents[1].Reserved));

    trace.set_trace_information(TraceStackTracingInfo, &StackTracingEvents, sizeof(StackTracingEvents));

    trace.enable(provider);
    trace.start();
}

virtual alloc trace is easy, but record.ExtendedDataCount is 0, how to get call stack?
Thanks.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with kernel_trace_004::start(), the virtual_alloc_provider callback, and the TraceStackTracingInfo configuration shown in the issue. Check how krabs exposes stack-tracing data through EVENT_RECORD and ExtendedData; done means documenting or demonstrating a reliable way to retrieve the VirtualAlloc call stack.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
observability
Issue type
Documentation
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Needs clarification
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.