DOCSEARCHbyAlgolia
Submit Docs

UIforETW

repository·main·Indexed 40 days ago

https://github.com/randomascii/uiforetw

A collection of scripts and binaries for Windows performance analysis using Event Tracing for Windows (ETW) and Xperf. Features include the UIforETW automation tool for recording and managing traces, flame_graph.exe for generating text-based flame graphs from ETL files, and CPUByCommandLine.py for aggregating CPU usage data from WPA exported CSVs. It also provides a specialized WPA profile (CPUUsageByCommandLine.wpaProfile) and tools like DummyChrome to register Chrome's ETW providers.

Tokens
24.7K
Snippets
71
Records
127
Agent score
97%

What's inside UIforETW

  1. Overview of custom ETW event emission via DLL

    main
    This project provides a DLL designed to emit custom Event Tracing for Windows (ETW) events. Integrating this DLL into your own projects allows you to inject custom events into ETW traces, which can act as signposts or provide additional context during trace analysis. This makes it significantly easier to correlate application-specific logic with system-level events.

  2. Overview of available Xperf scripts and tools

    main

    This directory contains several specialized scripts and binaries for working with ETW (Event Tracing for Windows) and Xperf, categorized by their original source blog posts:

    Process Tree Analysis

    Used to derive process parentage from an Xperf trace.

    • XperfProcessParentage.py
    • XperfProcessParentage.wpaProfile

    Trace Recording and Batch Automation

    Batch files related to recording ETW traces.

    • etwrecord.bat (and other related batch files)

    Symbol Management

    Tools for managing symbols, specifically for Chromium/Chrome.

    • StripChromeSymbols.py: Used to strip symbols, often called by etwrecord.bat if using the Chromium symbol server. Requires pdbcopy.exe.
    • RetrieveSymbols.exe: Used by StripChromeSymbols.py. Requires x86 versions of dbghelp.dll and symsrv.dll.

    CPU Usage Visualization

    Converts Xperf data into formats suitable for flame graphs.

    • xperf_to_collapsedstacks.py

    UI for ETW

    • UIforETW.exe: A graphical interface to make Windows performance analysis easier.

  3. Use DummyChrome to register Chrome's ETW providers

    main
    The DummyChrome project provides DummyChrome.dll, which is used to register Chrome's Event Tracing for Windows (ETW) providers. This approach is used as a simpler alternative to locating the specific installation path of Chrome, which is particularly useful when working with older versions of Chrome that may not have ETW providers natively available or easily accessible.

  4. Extend analysis with custom WPA profiles

    main

    To add additional types of analysis to the automated export, you must:

    1. Ensure the appropriate data is being recorded during the start_tracing.bat phase (being mindful not to increase the data rate excessively to avoid affecting the measurements).
    2. Add .wpaProfile files to the configuration to define the specific data you want to be exported.

  5. Use UIforETW.exe for integrated event emitting and tracing

    main
    If you are not in a specialized lab environment requiring separate batch files for tracing, you should use UIforETW.exe instead of EventEmitter.exe. UIforETW.exe provides an integrated experience by both emitting events and controlling the tracing process that listens for them.

  6. Install UIforETW and Windows Performance Toolkit (WPT)

    main
    To use the scripts and binaries in this directory, you must have the Windows Performance Toolkit (WPT) installed. The most reliable way to set up the environment is to download the etwpackage*.zip from the UIforETW releases, unzip it, and run bin\UIforETW.exe. Running this executable will install WPT and provide the necessary environment for the included scripts.
    bin\UIforETW.exe

  7. Start and stop event emitting with EventEmitter.exe

    main

    The EventEmitter.exe tool is used to monitor system activity and emit events that can be captured by ETW (Event Tracing for Windows) listeners, such as etwrecord.bat.

    In lab settings where tracing is controlled by separate batch files, you must run EventEmitter.exe independently to provide the event stream. For maximum robustness, it is recommended to execute the -kill command before starting a new session to ensure no stale processes from previous runs are active.

    # Kill any existing EventEmitter processes to ensure a clean state
bin\EventEmitter.exe -kill

# Start emitting events
bin\EventEmitter.exe

  8. Measure GPU usage with ETW in a lab scenario

    main

    This directory provides a set of scripts to measure GPU usage using Event Tracing for Windows (ETW), designed for lab scenarios like regression testing. The workflow involves starting a trace, running the target workload, and stopping the trace to generate processed reports.

    Prerequisites

    • Administrator Privileges: Both start_tracing.bat and stop_tracing.bat must be executed from an administrator command prompt.
    • Windows Performance Toolkit (WPT): The WPT tools must be available in your system PATH (either installed or manually copied to the test machine).
    • Operating System: While designed to work on Windows 7, these scripts have been verified on Windows 10.

  9. Manage and manipulate ETW traces

    main

    The UI provides a trace list that allows you to manage existing recordings in your tracedir. You can perform the following actions on traces:

    • Delete traces: Remove unwanted recording files.
    • Compress traces: Reduce the storage footprint of traces.
    • Explore: Open the trace directory in File Explorer.
    • Copy name/path: Copy the trace's file path or name to the clipboard.
    • Run StripChromeSymbols.py: Execute the symbol stripping script on a specific trace.
    • Rename traces: Use keyboard accelerators (F2 to start renaming, Enter to finish, ESC to cancel) to rename traces and their associated files.

  10. Retrieve PE files using image metadata

    main

    To download a specific PE (Portable Executable) file, use RetrieveSymbols with the time date stamp, the size of the image, and the executable name.

    Workflow:

    1. Run dumpbin /headers <path_to_exe>.
    2. Extract the time date stamp (from the first line) and the size of image.
    3. Pass these values to RetrieveSymbols.
    # Example dumpbin output lines:
# 54E3AECF time date stamp Tue Feb 17 13:12:47 2015
# D3000 size of image

# Command to retrieve the PE file:
RetrieveSymbols 54E3AECF D3000 chrome.exe

  11. How to record traces for custom ETW providers using UIforETW

    main

    To record ETW traces that capture the events emitted by this DLL, it is recommended to use UIforETW. UIforETW is capable of registering the DLL and recording traces specifically configured to listen to its providers.

    For implementation examples, refer to the UIforETW and ETWEventDemo projects available in the repository.

  12. Measure CPU and GPU usage with ETW tracing

    main

    Use the provided batch scripts to record and analyze CPU and GPU usage in lab scenarios like regression testing.

    Prerequisites:

    • An Administrator command prompt must be used to run the scripts.
    • WPT (Windows Performance Toolkit) must be in your system PATH.
    • The scripts are tested on Windows 10, though they may work on Windows 7.

    Workflow:

    1. Create an output directory.
    2. Start tracing (optionally with detailed mode).
    3. Perform the action you wish to profile.
    4. Stop tracing and specify the output directory.

    Results are provided as .csv files and a summary results.json file.

    :: 1. Create output directory
mkdir %temp%\output

:: 2. Start tracing (optionally use 'detailed' flag)
start_tracing.bat detailed

:: 3. Perform your test/action here...

:: 4. Stop tracing and save to the directory
stop_tracing.bat %temp%\output