Here at Microsoft, we are always looking to engage with open source communities to produce better solutions for the community and our customers . One of the more useful debugging advances that have a...
Updated Dec 12, 2022
Version 4.0
Blog Post
Gopikrishna Kannan
Microsoft
Microsoft
Nenad_Noveljic
The current DTrace version does not support user mode stack trace. I tested Profile-1 on two machines.
It's worked on machine running build 18361 (see below).
C:\WINDOWS\system32>dtrace -n " profile-1 /$target == pid/ { @[pid, stack(), execname]=count();}" -c taskmgr.exe
dtrace: description ' profile-1 ' matched 1 probe
3544
nt`KeAccumulateTicks+0x18619b
nt`KeClockInterruptNotify+0xcf
hal.dll`HalpTimerClockIpiRoutine+0x21
nt`KiCallInterruptServiceRoutine+0xa5
nt`KiInterruptSubDispatchNoLockNoEtw+0xfa
nt`KiInterruptDispatchNoLockNoEtw+0x37
Taskmgr.exe 2
3544
nt`KiDispatchInterruptContinue
nt`KiDpcInterruptBypass+0x25
nt`KiInterruptDispatchNoLockNoEtw+0xb1
Taskmgr.exe
However, it did not work on machine running an older build. It turned out that i was running with secure boot enabled and that blocks access to kernel. That is by design. In this case, I will need to attach KD to get the script working. I get the below error even without predicates. Can you confirm if you have secure boot turned ON?
dtrace -n " profile-1 { @[pid, stack(), execname]=count();}"
dtrace: description ' profile-1 ' matched 1 probe
dtrace: error on enabled probe ID 1 (ID 3633: profile:::profile-1): unknown fault in action #2 at DIF offset 0
dtrace: error on enabled probe ID 1 (ID 3633: profile:::profile-1): unknown fault in action #2 at DIF offset 0
dtrace: error on enabled probe ID 1 (ID 3633: profile:::profile-1): unknown fault in action #2 at DIF offset 0
dtrace: error on enabled probe ID 1 (ID 3633: profile:::profile-1): unknown fault in action #2 at DIF offset 0