microsoft / DTrace-on-Windows

Code for the cross platform, single source, OpenDTrace implementation
Other
485 stars 43 forks source link

Do not raise IRQL for BEGIN probe #36

Closed CodeMaxx closed 1 year ago

CodeMaxx commented 1 year ago

Why is this change being made?

BEGIN erroneously detects its execution context as elevated IRQL. This causes issues such as Live Kernel Dump failing silently.

What changed?

Instead of raising IRQL and disabling interrupts for BEGIN probe, now we set dtrace's affinity to the current processor for the begin probe.

How was the change tested?

Tested on a VM.