private void OnKernelStackEvent(StackWalkStackTraceData stack)
        {
            ++TotalEventsSeen;

            if (!ProcessFilter(stack.ProcessID))
            {
                return;
            }

            ulong[] addresses   = new ulong[stack.FrameCount];
            int     recordedIdx = 0;

            for (int originalFrameIdx = 0; originalFrameIdx < stack.FrameCount; ++originalFrameIdx)
            {
                ulong ip = stack.InstructionPointer(originalFrameIdx);
                if (_includeKernelFrames || (ip < 0x8000000000000000))
                {
                    addresses[recordedIdx++] = ip;
                }
            }
            if (recordedIdx > 0) // This could have been a purely kernel stack
            {
                Stacks.AddStack(stack.ProcessID, addresses);
            }
        }
Beispiel #2
0
        private void Parser_StackWalkStack(StackWalkStackTraceData obj)
        {
            AlpcEvent evt;

            if (_threadToEvent.TryRemove(obj.ThreadID, out evt))
            {
                evt.Stack = Enumerable.Range(0, obj.FrameCount).Select(i => obj.InstructionPointer(i)).ToArray();
            }
        }
        private void Kernel_StackWalkStack(StackWalkStackTraceData stack)
        {
            _lastAllocationDataByThread.TryGetValue(stack.ThreadID, out var lastAllocationData);

            ulong[] addresses = new ulong[stack.FrameCount];
            for (int i = 0; i < addresses.Length; ++i)
            {
                addresses[i] = stack.InstructionPointer(i);
            }

            if (lastAllocationData != null && lastAllocationData.Stack == null)
            {
                lastAllocationData.Stack = Stacks.AddStack(stack.ProcessID, addresses, lastAllocationData.AllocSize);
            }
        }