3 ms·
I know what ETW is and how it works. I don't know what your point is, sorry.
by ksk 10y ago
I know what ETW is and how it works. I don't know what your point is, sorry.
- nitrogen 10y agoSometimes conversations are less like arrows and more like trees -- few points, lots of branches.
- rixed 10y agoI think his point was: you really should read about dtrace, esp. how to instrument user programs (without instrumentation).
- ksk 10y agoErr, if you already know the memory map of the functions inside a process image, then understanding the call stacks is trivial for any debugging or performance tool - on any platform. This does not require any instrumentation. And if you're reverse engineering, then dtrace is the wrong tool anyway. So, can _you_ point to any common use case of dtrace where the probes aren't already present in the kernel/libs/user code?