ETW has an extension distributed with the debugger, WMITRACE.dll. The
extension can show the contents of the ETW buffers in the debugger.
!wmitrace.help to get all the options available.
!wmitrace.strdump Dump the Wmi Trace Event Structures
!wmitrace.searchpath sets the search path for TMF
The extension is very useful when you enable tracing at boot time or at
any time and can see the events on your trace session in the debugger.
One way to use this is to start the session in real time mode, tracelog
-rt -kd and then view the events, you must also set the search path
for the TMF files for all this to work. To extract the TMF files use
tracepdb -f .
The extension works very well in Vista because the public symbols
contain the required info for the extension. The problem pre-Vista is
that the public symbols do not export those required ETW symbols for the
extension. The fix that exported the symbols is expected to reach the
down level. I will investigate what the status of that is.
How to Enable Debugging without starting an ETW trace session
First you need to define the WPP_DEBUG macro and build your code.
A sample for a the DDK’s Tracedrv.sys sample driver below:
#define WPP_DEBUG(b) DbgPrint b, DbgPrint(“\n”);
You can use most formats and arguments with WPP_DEBUG. However, you
cannot use extended format specifications, such as %!HEXDUMP!%.
On the Kernel Debugger:
You will need to set the levels and flags values for the WPP control
structure.
1- Locate the address of the WPP control structure in Vista is
WPP_MAIN_CB, else use WPP_GLOBAL_Control
kd> x tracedrv!WPP_MAIN_CB // tracedrv is the WPP instrumented
driver
9fbf3040 tracedrv!WPP_MAIN_CB = union WPP_PROJECT_CONTROL_BLOCK [1]
kd>dt WPP_TRACE_CONTROL_BLOCK 9fbf3040
+0x000 Callback : 0x9fbf127c tracedrv!WppTraceCallback+0
+0x004 ControlGuid : 0x9fbf206c _GUID
{d58c126f-b309-11d1-969e-0000f875a5bc}
+0x008 Next : (null)
+0x010 Logger : 0
+0x018 RegistryPath : (null)
+0x01c FlagsLen : 0x1 ‘’
+0x01d Level : 0x0 ‘’ <— Set the Level
+0x01e Reserved : 0
+0x020 Flags : [1] 0x0 <— Set the Flag
2 - Set the value for the Level and Flags, in our case enable tracing at
level=5 and flags = 0xf
kd>eb 9fbf305d 5 // setting the level value to 5
kd>ed 9fbf3060 0xf // setting the flag value to 0xf
Thanks,
Jose Sua
Microsoft Corporation
This posting is provided “AS IS” with no warranties and confers no
rights.
-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Jan Bottorff
Sent: Thursday, May 11, 2006 3:19 PM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] Unnecessary obfuscation, “Hey I can’t see my spew
because of your spew!!!”
#define WPP_DEBUG(m)
I know about WPP_DEBUG and didn’t find I liked it. The m parameter is
the format string followed by all the values. I wanted to still be able
to pass through the level+mask, so I could control WHICH DbgPrints came
out. I believe I could modify the WPP template file, but didn’t offhand
see a way to make a local copy of the template file in my projects
directory. It’s more effort to change a file that’s part of the DDK and
is installed on all the other team members systems. The DDK files are
not checked into our version control system, so I have no way to
automagically update them on other team members system. I’d probably get
some frown on modifying a standard DDK file too.
At the moment, I’m using statements like:
DebugPrint((TRACE_LEVEL_ERROR, IRP_MASK, “the value is
%x\n”,someValue));
I can use a -func:DebugPrint((LEVEL,MASK,MSG,…)) option in WPP to turn
this into a WPP message or I can
#define DebugPrint(args) DebugPrintVa args
and have it route to a global function DebugPrintVa(level, mask,
fmt,…) that uses va_start/va_list/va_end and such to build a buffer
that gets DbgPrinted.
I’d really like to be able to say:
#define DebugPrint(args) DebugPrintWPP args; \
DebugPrintVa args
But unfortunately the WPP processor runs before the C preprocessor, so
this does not work. I could possible put a WPP print inside my
DebugPrintVa function, using a formatting string of “MyDriver!%s”, but
this does all the formatting work at message print time, counter to the
WPP ideal.
I supposed the other option is I write ugly code like:
#ifdef WITH_WPP
DebugPrintWPP(TRACE_LEVEL_ERROR, IRP_MASK, “the value is
%x\n”,someValue); #else DebugPrintWPP(TRACE_LEVEL_ERROR, IRP_MASK, “the
value is %x\n”,someValue); DebugPrintVa(TRACE_LEVEL_ERROR, IRP_MASK,
“the value is %x\n”,someValue); #endif
Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256
To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer
Reading messages about it here I’m glad I decided to not try it. Our trace macros work well, are more flexible and I only once encountered the situation where run-time formatting caused that the problem wasn’t reproducible any way. So I spent 30 minutes to change macros implementation to not use formatting and instead, store file, line and arguments to circular buffer. User reproduced problem and invoked crashdump and then I spent some time with manual extracting necessary info from the buffer. Still probably much faster than trying to port our trace macros for WPP.