private void OnKernelStackEvent(StackWalkStackTraceData stack)
{
++TotalEventsSeen;
if (!ProcessFilter(stack.ProcessID))
{
return;
}
ulong[] addresses = new ulong[stack.FrameCount];
int recordedIdx = 0;
for (int originalFrameIdx = 0; originalFrameIdx < stack.FrameCount; ++originalFrameIdx)
{
ulong ip = stack.InstructionPointer(originalFrameIdx);
if (_includeKernelFrames || (ip < 0x8000000000000000))
{
addresses[recordedIdx++] = ip;
}
}
if (recordedIdx > 0) // This could have been a purely kernel stack
{
Stacks.AddStack(stack.ProcessID, addresses);
}
}
private void Parser_StackWalkStack(StackWalkStackTraceData obj)
{
AlpcEvent evt;
if (_threadToEvent.TryRemove(obj.ThreadID, out evt))
{
evt.Stack = Enumerable.Range(0, obj.FrameCount).Select(i => obj.InstructionPointer(i)).ToArray();
}
}
private void Kernel_StackWalkStack(StackWalkStackTraceData stack)
{
_lastAllocationDataByThread.TryGetValue(stack.ThreadID, out var lastAllocationData);
ulong[] addresses = new ulong[stack.FrameCount];
for (int i = 0; i < addresses.Length; ++i)
{
addresses[i] = stack.InstructionPointer(i);
}
if (lastAllocationData != null && lastAllocationData.Stack == null)
{
lastAllocationData.Stack = Stacks.AddStack(stack.ProcessID, addresses, lastAllocationData.AllocSize);
}
}