blondie

Collect CPU callstack samples from a windows process.

Since the "SampledProfile" ETW events we use come from a "kernel event provider"(PerfInfo) we must use the ETW "Kernel Logger session", which requires elevated priviledges. Therefore, you must run blondie as administrator in order for it to work.

The blondie binary can be used to generate a text file with the sample count of each call stack, or a flamegraph using the inferno library.

The blondie_dtrace binary can be used as a dtrace replacement in cargo-flamegraph via the DTRACE environment variable.

Examples:

./blondie.exe flamegraph ./target/debug/some_binary_with_debuginfo.exe arg1 arg2
./flamegraph.svg

cargo build --release --bin blondie_dtrace
$ENV:DTRACE = "current_dir/target/release/blondie_dtrace.exe" # Or set DTRACE="current_dir/target/release/blondie_dtrace.exe" in cmd.exe
cd some/other/project
cargo flamegraph ; ./flamegraph.svg

I wrote this to be able to get flamegraphs using https://github.com/flamegraph-rs on windows.

This is built using the ETW(Event Tracing for Windows) API to collect CPU samples and DLL/EXE load events, and the DbgHelp Symbol Handler API to translate the virtual addresses ETW gives us to symbol names.

Future work?

• Test on windows 7 and probably fix the things that don't work.
• Make it possible to trace a pre-existing pid instead of requiring a command to launch. (Thanks to @felstead for implementing this!)
• Use ETW filters to only receive events for the target process (We currently filter ourselves and discard events from other processes). See https://docs.microsoft.com/en-us/windows/win32/api/evntrace/nf-evntrace-starttracea https://docs.microsoft.com/en-us/windows/win32/api/evntrace/ns-evntrace-event_trace_properties_v2 https://docs.microsoft.com/en-us/windows/win32/api/evntprov/ns-evntprov-event_filter_descriptor specifically EVENT_FILTER_TYPE_PID (note: Does not work on Win7 via StartTrace, would need to use EnableTraceEx2 if we care about Win7)
• Write a general ETW rust library.

Example output

Example flamegraph from a hello world rust program:

Here's a bit of example output from running blondie on dust:

Name

It's a reference to this song from a band called blondie. Something about "Call Me" and callstacks. Look, I don't know, a friend suggested it and I went with it.