void IFunctionTracer.OnExitBreakpointHit(DkmRuntimeBreakpoint bp, DkmThread thread, bool hasException)
{
FunctionTraceEntryDataItem traceDataItem = bp.GetDataItem <FunctionTraceEntryDataItem>();
if (OnFunctionExited != null)
{
DkmStackWalkFrame frame = thread.GetTopStackWalkFrame(bp.RuntimeInstance);
StackFrameAnalyzer exitAnalyzer = null;
if (traceDataItem != null)
{
DkmSystemInformationFlags systemInformationFlags =
frame.ModuleInstance.Process.SystemInformation.Flags;
bool isTarget64Bit = systemInformationFlags.HasFlag(DkmSystemInformationFlags.Is64Bit);
int pointerSize = (isTarget64Bit) ? 8 : 4;
exitAnalyzer = new CachedFrameAnalyzer(
frameAnalyzer.Parameters,
traceDataItem.EntryArgumentValues,
pointerSize);
}
OnFunctionExited(frame, exitAnalyzer);
}
// Since this was a one-shot breakpoint, it is unconditionally closed.
bp.Close();
}
void IFunctionTracer.OnEntryBreakpointHit(DkmRuntimeBreakpoint bp, DkmThread thread, bool hasException)
{
// The function was just entered. Install the exit breakpoint on the calling thread at the
// return address, and notify any listeners.
DkmStackWalkFrame frame = thread.GetTopStackWalkFrame(bp.RuntimeInstance);
bool suppressExitBreakpoint = false;
if (OnFunctionEntered != null)
{
OnFunctionEntered(frame, frameAnalyzer, out suppressExitBreakpoint);
}
if (!suppressExitBreakpoint)
{
ulong ret = frame.VscxGetReturnAddress();
DkmInstructionAddress retAddr = thread.Process.CreateNativeInstructionAddress(ret);
DkmRuntimeInstructionBreakpoint exitBp = DkmRuntimeInstructionBreakpoint.Create(
Guids.Source.FunctionTraceExit, thread, retAddr, false, null);
// Capture the value of every argument now, since when the exit breakpoint gets hit, the
// target function will have already returned and its frame will be cleaned up.
exitBp.SetDataItem(DkmDataCreationDisposition.CreateAlways,
new FunctionTraceEntryDataItem {
EntryArgumentValues = frameAnalyzer.GetAllArgumentValues(frame)
});
exitBp.SetDataItem(DkmDataCreationDisposition.CreateAlways,
new FunctionTraceDataItem {
Tracer = this
});
exitBp.Enable();
}
}
void IFunctionTracer.OnEntryBreakpointHit(DkmRuntimeBreakpoint bp, DkmThread thread, bool hasException) {
// The function was just entered. Install the exit breakpoint on the calling thread at the
// return address, and notify any listeners.
DkmStackWalkFrame frame = thread.GetTopStackWalkFrame(bp.RuntimeInstance);
bool suppressExitBreakpoint = false;
if (OnFunctionEntered != null)
OnFunctionEntered(frame, frameAnalyzer, out suppressExitBreakpoint);
if (!suppressExitBreakpoint) {
ulong ret = frame.VscxGetReturnAddress();
DkmInstructionAddress retAddr = thread.Process.CreateNativeInstructionAddress(ret);
DkmRuntimeInstructionBreakpoint exitBp = DkmRuntimeInstructionBreakpoint.Create(
Guids.Source.FunctionTraceExit, thread, retAddr, false, null);
// Capture the value of every argument now, since when the exit breakpoint gets hit, the
// target function will have already returned and its frame will be cleaned up.
exitBp.SetDataItem(DkmDataCreationDisposition.CreateAlways,
new FunctionTraceEntryDataItem {
EntryArgumentValues = frameAnalyzer.GetAllArgumentValues(frame)
});
exitBp.SetDataItem(DkmDataCreationDisposition.CreateAlways,
new FunctionTraceDataItem { Tracer = this });
exitBp.Enable();
}
}
void IFunctionTracer.OnExitBreakpointHit(DkmRuntimeBreakpoint bp, DkmThread thread, bool hasException) {
FunctionTraceEntryDataItem traceDataItem = bp.GetDataItem<FunctionTraceEntryDataItem>();
if (OnFunctionExited != null) {
DkmStackWalkFrame frame = thread.GetTopStackWalkFrame(bp.RuntimeInstance);
StackFrameAnalyzer exitAnalyzer = null;
if (traceDataItem != null) {
DkmSystemInformationFlags systemInformationFlags =
frame.ModuleInstance.Process.SystemInformation.Flags;
bool isTarget64Bit = systemInformationFlags.HasFlag(DkmSystemInformationFlags.Is64Bit);
int pointerSize = (isTarget64Bit) ? 8 : 4;
exitAnalyzer = new CachedFrameAnalyzer(
frameAnalyzer.Parameters,
traceDataItem.EntryArgumentValues,
pointerSize);
}
OnFunctionExited(frame, exitAnalyzer);
}
// Since this was a one-shot breakpoint, it is unconditionally closed.
bp.Close();
}
