void IFunctionTracer.OnExitBreakpointHit(DkmRuntimeBreakpoint bp, DkmThread thread, bool hasException) { FunctionTraceEntryDataItem traceDataItem = bp.GetDataItem <FunctionTraceEntryDataItem>(); if (OnFunctionExited != null) { DkmStackWalkFrame frame = thread.GetTopStackWalkFrame(bp.RuntimeInstance); StackFrameAnalyzer exitAnalyzer = null; if (traceDataItem != null) { DkmSystemInformationFlags systemInformationFlags = frame.ModuleInstance.Process.SystemInformation.Flags; bool isTarget64Bit = systemInformationFlags.HasFlag(DkmSystemInformationFlags.Is64Bit); int pointerSize = (isTarget64Bit) ? 8 : 4; exitAnalyzer = new CachedFrameAnalyzer( frameAnalyzer.Parameters, traceDataItem.EntryArgumentValues, pointerSize); } OnFunctionExited(frame, exitAnalyzer); } // Since this was a one-shot breakpoint, it is unconditionally closed. bp.Close(); }
void IFunctionTracer.OnEntryBreakpointHit(DkmRuntimeBreakpoint bp, DkmThread thread, bool hasException) { // The function was just entered. Install the exit breakpoint on the calling thread at the // return address, and notify any listeners. DkmStackWalkFrame frame = thread.GetTopStackWalkFrame(bp.RuntimeInstance); bool suppressExitBreakpoint = false; if (OnFunctionEntered != null) { OnFunctionEntered(frame, frameAnalyzer, out suppressExitBreakpoint); } if (!suppressExitBreakpoint) { ulong ret = frame.VscxGetReturnAddress(); DkmInstructionAddress retAddr = thread.Process.CreateNativeInstructionAddress(ret); DkmRuntimeInstructionBreakpoint exitBp = DkmRuntimeInstructionBreakpoint.Create( Guids.Source.FunctionTraceExit, thread, retAddr, false, null); // Capture the value of every argument now, since when the exit breakpoint gets hit, the // target function will have already returned and its frame will be cleaned up. exitBp.SetDataItem(DkmDataCreationDisposition.CreateAlways, new FunctionTraceEntryDataItem { EntryArgumentValues = frameAnalyzer.GetAllArgumentValues(frame) }); exitBp.SetDataItem(DkmDataCreationDisposition.CreateAlways, new FunctionTraceDataItem { Tracer = this }); exitBp.Enable(); } }
void IFunctionTracer.OnEntryBreakpointHit(DkmRuntimeBreakpoint bp, DkmThread thread, bool hasException) { // The function was just entered. Install the exit breakpoint on the calling thread at the // return address, and notify any listeners. DkmStackWalkFrame frame = thread.GetTopStackWalkFrame(bp.RuntimeInstance); bool suppressExitBreakpoint = false; if (OnFunctionEntered != null) OnFunctionEntered(frame, frameAnalyzer, out suppressExitBreakpoint); if (!suppressExitBreakpoint) { ulong ret = frame.VscxGetReturnAddress(); DkmInstructionAddress retAddr = thread.Process.CreateNativeInstructionAddress(ret); DkmRuntimeInstructionBreakpoint exitBp = DkmRuntimeInstructionBreakpoint.Create( Guids.Source.FunctionTraceExit, thread, retAddr, false, null); // Capture the value of every argument now, since when the exit breakpoint gets hit, the // target function will have already returned and its frame will be cleaned up. exitBp.SetDataItem(DkmDataCreationDisposition.CreateAlways, new FunctionTraceEntryDataItem { EntryArgumentValues = frameAnalyzer.GetAllArgumentValues(frame) }); exitBp.SetDataItem(DkmDataCreationDisposition.CreateAlways, new FunctionTraceDataItem { Tracer = this }); exitBp.Enable(); } }
void IFunctionTracer.OnExitBreakpointHit(DkmRuntimeBreakpoint bp, DkmThread thread, bool hasException) { FunctionTraceEntryDataItem traceDataItem = bp.GetDataItem<FunctionTraceEntryDataItem>(); if (OnFunctionExited != null) { DkmStackWalkFrame frame = thread.GetTopStackWalkFrame(bp.RuntimeInstance); StackFrameAnalyzer exitAnalyzer = null; if (traceDataItem != null) { DkmSystemInformationFlags systemInformationFlags = frame.ModuleInstance.Process.SystemInformation.Flags; bool isTarget64Bit = systemInformationFlags.HasFlag(DkmSystemInformationFlags.Is64Bit); int pointerSize = (isTarget64Bit) ? 8 : 4; exitAnalyzer = new CachedFrameAnalyzer( frameAnalyzer.Parameters, traceDataItem.EntryArgumentValues, pointerSize); } OnFunctionExited(frame, exitAnalyzer); } // Since this was a one-shot breakpoint, it is unconditionally closed. bp.Close(); }