obtrace

NTDEV
1

Hi ,
Is it possible to use !obtrace on Windows XP? thanks in advance .

2

yes, but the trace won’t include tags - they were added in Vista

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of yushang
Sent: Monday, January 24, 2011 3:11 PM
To: Windows System Software Devs Interest List
Subject: [ntdev] obtrace

Hi ,
Is it possible to use !obtrace on Windows XP? thanks in advance .

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

3

How to enable it?

2011/1/24 Petr Kurtin :
> yes

4

You need to enable it with GFlags, see the !obtrace documentation:

http://msdn.microsoft.com/en-us/library/ff564594(v=vs.85).aspx

http://msdn.microsoft.com/en-us/library/ff543116(v=vs.85).aspx

-scott

–
Scott Noone
Consulting Associate and Chief System Problem Analyst
OSR Open Systems Resources, Inc.
http://www.osronline.com

Hope to see you at the next OSR kernel debugging class February 14th in
Columbia, MD!

“yushang” wrote in message news:xxxxx@ntdev…

How to enable it?

2011/1/24 Petr Kurtin :
> yes

5

>gflags /ko
GFLAGS: Object Reference Tracing is not enabled for this version of the OS
I’m using XP SP3

2011/1/24 Scott Noone :
> You need to enable it with GFlags

6

“yushang” wrote in message news:xxxxx@ntdev…

gflags /ko
GFLAGS: Object Reference Tracing is not enabled for this version of the OS
I’m using XP SP3

I don’t think that you can enable the tracing at runtime on the legacy O/S
releases, you can only do it via the registry. However, it doesn’t looks
like GFlags will even let you do that, which is a bug. You need to configure
it manually in the registry then:

http://msdn.microsoft.com/en-us/library/ff549577(v=vs.85).aspx

However, you have bigger problems. It looks like !obtrace doesn’t work with
public symbols on XP due to missing type info:

kd> .show_sym_failures /t
Show symbol lookup failures: no
Show type lookup failures: yes
kd> !obtrace 83bd54a8
type lookup ‘nt!_OBJECT_REF_STACK_INFO’ failure.
type lookup ‘nt!_OBJECT_REF_INFO’ failure.
Unable to read ObRefInfo fd06c000

Unless you can find the definition of these structures and merge them into
the PDB yourself this command just isn’t going to work.

-scott

–
Scott Noone
Consulting Associate and Chief System Problem Analyst
OSR Open Systems Resources, Inc.
http://www.osronline.com

Hope to see you at the next OSR kernel debugging class February 14th in
Columbia, MD!