search

microsoft / krabsetw

KrabsETW provides a modern C++ wrapper and a .NET wrapper around the low-level ETW trace consumption functions.
Other
610 stars 149 forks source link

Getting PMC data #237

Closed SpencerTSmith closed 5 months ago

SpencerTSmith commented 5 months ago

How would you go about getting PMC data? I read the other closed issue about the same topic, but it didn't have a concrete answer. Any help would be greatly appreciated. Thank you.

SpencerTSmith commented 5 months ago

I was able to figure this out... all you have to do is use the windows api function TraceSetInformation() with both information classes TraceSampledProfileIntervalInfo and TraceProfileSourceConfigInfo, both of these must be set with the trace handle argument in TraceSetInformation() set to 0 (has to be global apparently). Use these classes to pick your interval sample rate and which PMC's you want to use. You might also have to set permissions beforehand, I did.

Then it's a normal krabsETW trace. The provider is a krabs::kernel_provider name_of_provider(krabs::guids::perf_info, PERF_PMC_PROFILE); For the callback, the opcode of the event you want is 47. I think that's it.