By luck, I'm a bit ahead of this hint and this API keeps on feeling like it was designed for DEFCON participants. Thank you for turning The Ultimate Sadness into a fun challenge
So my wild guess is the following: would it be possible to emit a custom ETW event for "begin" and "end" sample and request that PMC data is attached to it..
I don't want to give anything away,.so I will simply say, those are all good ideas to pursue, but keep in mind that ETW isn't going to let you do something that straightforward - so don't be afraid to get creative when it thwarts your plans :)
By luck, I'm a bit ahead of this hint and this API keeps on feeling like it was designed for DEFCON participants. Thank you for turning The Ultimate Sadness into a fun challenge
Absolutely. It feels more like "hack this system" than "use this API" :)
- Casey
Hi Casey!
Some sources indicate that you should be able to PMC data to an ETW event:
* https://learn.microsoft.com/en-us/windows-hardware/test/wpt/recording-pmu-events#collecting-pmu-events--on-etw-events
* https://randomascii.wordpress.com/2016/11/27/cpu-performance-counters-on-windows/
So my wild guess is the following: would it be possible to emit a custom ETW event for "begin" and "end" sample and request that PMC data is attached to it..
You would then parse the ETW log (oh, joy!) file search for begin/end traces and extract the PMC values. The Benchmark.net library might be doing something similar (https://github.com/dotnet/BenchmarkDotNet/blob/master/samples/BenchmarkDotNet.Samples/IntroHardwareCounters.cs).
Not sure if the counter values are maintained per-thread. So we might also handle context switch events..
I don't want to give anything away,.so I will simply say, those are all good ideas to pursue, but keep in mind that ETW isn't going to let you do something that straightforward - so don't be afraid to get creative when it thwarts your plans :)
- Casey