microsoft / microsoft/krabsetw
how to trace VirtualAlloc + CallStack?
Open
Nobody has claimed this yet.
- Dominant language
- C++
- Stars
- 801
- Forks
- 167
- Avg merge
- 3d 15m
- Merged PRs (30d)
- 2
Description
void kernel_trace_004::start()
{
krabs::kernel_trace trace(L"Memory Trace");
krabs::kernel::virtual_alloc_provider provider;
// Kernel providers accept all the typical callback mechanisms.
provider.add_on_event_callback([](const EVENT_RECORD& record, const krabs::trace_context& trace_context) {
krabs::schema schema(record, trace_context.schema_locator);
for (int i = 0; i < record.ExtendedDataCount; i++) {
//auto extended_data_item = &record.ExtendedData[i];
}
});
CLASSIC_EVENT_ID StackTracingEvents[2];
StackTracingEvents[0].EventGuid = krabs::guids::page_fault;
StackTracingEvents[0].Type = 98; // VirtualAlloc
memset(StackTracingEvents[0].Reserved, 0, sizeof(StackTracingEvents[0].Reserved));
StackTracingEvents[1].EventGuid = krabs::guids::page_fault;
StackTracingEvents[1].Type = 99; // VirtualFree
memset(StackTracingEvents[1].Reserved, 0, sizeof(StackTracingEvents[1].Reserved));
trace.set_trace_information(TraceStackTracingInfo, &StackTracingEvents, sizeof(StackTracingEvents));
trace.enable(provider);
trace.start();
}
virtual alloc trace is easy, but record.ExtendedDataCount is 0, how to get call stack?
Thanks.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with kernel_trace_004::start(), the virtual_alloc_provider callback, and the TraceStackTracingInfo configuration shown in the issue. Check how krabs exposes stack-tracing data through EVENT_RECORD and ExtendedData; done means documenting or demonstrating a reliable way to retrieve the VirtualAlloc call stack.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- observability
- Issue type
- Documentation
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Needs clarification
- Newbie friendliness
- 45/100