Tracing VirtualAlloc With Xperf: Difference between revisions

Updated to use WPR UI instead of xperf command line
(Updated to use WPR UI instead of xperf command line)
Line 1: Line 1:
Tracing calls to VirtualAlloc can sometimes help track down address space fragmentation or suspicious memory allocations.
Tracing calls to VirtualAlloc can sometimes help track down address space fragmentation or suspicious memory allocations.
Note: xperf was the previous name for this toolset. Microsoft has revamped the tool and split it into the Windows Performance Recorder (WPR) and the Windows Performance Analyzer (WPA), together forming the Windows Performance Toolkit (WPT). The new tools are much easier to use. These instructions will refer to WPT but the page title says xperf to preserve links.
== Prerequisites ==
== Prerequisites ==


* Windows 7 or higher
* Windows 7 or higher
* Administrator access to machine
* Administrator access to machine
* Willingness to share a system-wide log with the bug investigator. Xperf records information about all processes running during the trace. These files can be large (hundreds of MB compressed).
* Willingness to share a system-wide log with the bug investigator. WPR records information about all processes running during the trace. These files can be large (hundreds of MB compressed).


== Installing xperf ==
== Installing WPT ==


Xperf is included in the Windows Performance Toolkit from Microsoft.
WPT is included in the Windows Assessment and Deployment Kit from Microsoft.


* Download from http://www.microsoft.com/en-US/download/details.aspx?id=39982
* Download from http://www.microsoft.com/en-US/download/details.aspx?id=39982
* Run the installer, select only "Windows Performance Toolkit"
* Run the installer, select only "Windows Performance Toolkit"
* After the installer finishes, xperf.exe will be installed here:
* After the installer finishes, WPT will be installed here:
** On 32-bit Windows: C:\Program Files\Windows Kits\8.1\Windows Performance Toolkit <br>
** On 32-bit Windows: C:\Program Files\Windows Kits\8.1\Windows Performance Toolkit <br>
** On 64-bit Windows: C:\Program Files (x86)\Windows Kits\8.1\Windows Performance Toolkit
** On 64-bit Windows: C:\Program Files (x86)\Windows Kits\8.1\Windows Performance Toolkit
Line 24: Line 27:
  REG ADD "HKLM\System\CurrentControlSet\Control\Session Manager\Memory Management" -v DisablePagingExecutive -d 0x1 -t REG_DWORD -f  
  REG ADD "HKLM\System\CurrentControlSet\Control\Session Manager\Memory Management" -v DisablePagingExecutive -d 0x1 -t REG_DWORD -f  
* Reboot the machine
* Reboot the machine
== Create a tracing script ==
Save this script as xperf_virtualalloc.cmd in the same directory as xperf.exe:
@echo off
xperf -on PROC_THREAD+LOADER+CSWITCH+VIRT_ALLOC -stackwalk VirtualAlloc+VirtualFree -BufferSize 1024 -MinBuffers 1024 -MaxBuffers 1024 -MaxFile 2048
echo Tracing started. Press a key to stop.
pause >NUL
echo Stopping...
xperf -stop -d trace.etl


== Collect a trace ==
== Collect a trace ==


# Open an administrator command prompt
# From the WPT install location, run WPRUI.exe
# cd into your xperf directory
# Select "More options"
# Run xperf_virtualalloc.cmd. It will start tracing.
# Check the boxes for "First level Triage" and "VirtualAlloc usage" (under Resource Analysis)
# Launch Firefox and use it like normal. Try to reproduce your bug (crash, etc.).
# Click "Start"
# To stop tracing, go back to your script window and press any key.
# Launch Firefox and use it like normal. Try to reproduce your bug (crash, etc.)
# You will get a file called trace.etl.
# To stop tracing, go back to the WPR window and click "Save"
# Enter a file name for the trace file and a description of the bug
# Compress (zip) the trace file. This is important because traces can be large.
# Compress (zip) the trace file. This is important because traces can be large.
# Send the compressed trace to the bug investigator. You may be able to attach small files in Bugzilla. For larger files you may need to use a dropbox or similar service.
# Send the compressed file to the bug investigator. You may be able to attach small files in Bugzilla. For larger files you may need to use a dropbox or similar service.
 


Note the privacy message from xperf.exe:<br>
Please take note of the privacy message from WPR:<br>
<tt>The trace you have just captured "trace.etl" may contain personally identifiable information, including but not necessarily limited to paths to files accessed, paths to registry accessed and process names. Exact information depends on the events that were logged. Please be aware of this when sharing out this trace with other people.</tt>
<tt>This recording may contain personally identifiable or security related information, including but not necessarily limited to paths to files accessed, paths to registry access and process names. Exact information depends on the events that were logged. Please be aware of this when sharing out this trace with other people.</tt>


== Troubleshooting ==
== Troubleshooting ==
Symptom:
While tracing is enabled, the WPR window will show the status of the trace buffers. If the buffers get close to 100%, or there are any "Events dropped", then the trace file will be missing some information. In this case please try to record a shorter trace.
xperf: error: NT Kernel Logger: Transferred copy name was not recognized as acceptable by WMI data provider (0x1069).
A likely cause for this failure is running out of space in xperf's tracing buffers. If possible, try to take a shorter trace, or close background programs. Otherwise you can try increasing the buffer sizes, but the trace files will get even more huge.


== See also ==
== See also ==
https://wiki.mozilla.org/Using_XPerf (mostly for SpiderMonkey)
https://wiki.mozilla.org/Using_XPerf (mostly for SpiderMonkey)
Confirmed users
27

edits