private void OnKernelStackEvent(StackWalkStackTraceData stack) { ++TotalEventsSeen; if (!ProcessFilter(stack.ProcessID)) { return; } ulong[] addresses = new ulong[stack.FrameCount]; int recordedIdx = 0; for (int originalFrameIdx = 0; originalFrameIdx < stack.FrameCount; ++originalFrameIdx) { ulong ip = stack.InstructionPointer(originalFrameIdx); if (_includeKernelFrames || (ip < 0x8000000000000000)) { addresses[recordedIdx++] = ip; } } if (recordedIdx > 0) // This could have been a purely kernel stack { Stacks.AddStack(stack.ProcessID, addresses); } }
private void Parser_StackWalkStack(StackWalkStackTraceData obj) { AlpcEvent evt; if (_threadToEvent.TryRemove(obj.ThreadID, out evt)) { evt.Stack = Enumerable.Range(0, obj.FrameCount).Select(i => obj.InstructionPointer(i)).ToArray(); } }
private void Kernel_StackWalkStack(StackWalkStackTraceData stack) { _lastAllocationDataByThread.TryGetValue(stack.ThreadID, out var lastAllocationData); ulong[] addresses = new ulong[stack.FrameCount]; for (int i = 0; i < addresses.Length; ++i) { addresses[i] = stack.InstructionPointer(i); } if (lastAllocationData != null && lastAllocationData.Stack == null) { lastAllocationData.Stack = Stacks.AddStack(stack.ProcessID, addresses, lastAllocationData.AllocSize); } }