diff --git a/wtrace/Handlers/AlpcTraceEventHandler.cs b/wtrace/Handlers/AlpcTraceEventHandler.cs index 9e7b940..df1c62b 100644 --- a/wtrace/Handlers/AlpcTraceEventHandler.cs +++ b/wtrace/Handlers/AlpcTraceEventHandler.cs @@ -56,7 +56,7 @@ private void HandleALPCReceiveMessage(ALPCReceiveMessageTraceData data) traceOutput.WriteLine($"{data.TimeStampRelativeMSec:0.0000} ({data.ProcessID}.{data.ThreadID}) ALPC {data.ProcessName} " + $"<--(0x{data.MessageID:X})--- {senderProcess.Item2} ({senderProcess.Item1}.{senderProcess.Item3})"); } else if (senderProcess.Item1 == pid) { - connectedProcesses.Add($"{data.ProcessName} ({data.ProcessID}.{data.ThreadID})"); + connectedProcesses.Add($"{data.ProcessName} ({data.ProcessID})"); traceOutput.WriteLine($"{data.TimeStampRelativeMSec:0.0000} ({senderProcess.Item1}.{senderProcess.Item3}) ALPC {senderProcess.Item2} " + $"---(0x{data.MessageID:X})--> {data.ProcessName} ({data.ProcessID}.{data.ThreadID})"); } diff --git a/wtrace/Handlers/RpcTraceEventHandler.cs b/wtrace/Handlers/RpcTraceEventHandler.cs index 34dffef..fba1564 100644 --- a/wtrace/Handlers/RpcTraceEventHandler.cs +++ b/wtrace/Handlers/RpcTraceEventHandler.cs @@ -15,6 +15,8 @@ sealed class RpcTraceEventHandler : ITraceEventHandler private readonly TextWriter traceOutput; private readonly int pid; private readonly Dictionary rpcSummary = new Dictionary(); + private readonly Dictionary, string> awaitingClientCalls = new Dictionary, string>(); + private readonly Dictionary rpcActivity = new Dictionary(); public RpcTraceEventHandler(int pid, TextWriter output, TraceOutputOptions options) { @@ -25,9 +27,9 @@ public RpcTraceEventHandler(int pid, TextWriter output, TraceOutputOptions optio public void PrintStatistics() { - //if (networkIoSummary.Count == 0) { - // return; - //} + if (rpcSummary.Count == 0) { + return; + } summaryOutput.WriteLine("======= RPC ======="); summaryOutput.WriteLine("Interface (Endpoint) Number of interactions"); foreach (var summary in rpcSummary.AsEnumerable().OrderByDescending(kv => kv.Value)) { @@ -45,33 +47,75 @@ public void SubscribeToEvents(TraceEventParser parser) rpcParser.RpcServerCallStop += RpcServerCallStop; } - private void RpcServerCallStop(RpcServerCallStopArgs ev) + private void RpcServerCallStop(RpcServerCallStopArgs data) { + string rpcConnectionInfo; + if (rpcActivity.TryGetValue(data.ActivityID, out rpcConnectionInfo)) { + traceOutput.WriteLine($"{data.TimeStampRelativeMSec:0.0000} ({data.ProcessID}.{data.ThreadID}) {data.EventName} " + + rpcConnectionInfo); + rpcActivity.Remove(data.ActivityID); + } } private void RpcServerCallStart(RpcServerCallStartArgs data) { - //traceOutput.WriteLine($"{data.TimeStampRelativeMSec:0.0000} ({pid}) {data.EventName} " + - // $"<-- {data.Protocol} --- ({data.ProcessID}.{data.ThreadID}) {data.InterfaceUuid} " + - // $"({data.Endpoint}) {data.ProcNum} {data.NetworkAddress}"); + if (data.ProcessID == pid) { + var rpcConnectionInfo = $"--- {data.Protocol} --> {data.InterfaceUuid} ({data.Endpoint}) {data.ProcNum} {data.NetworkAddress}"; + rpcActivity.Add(data.ActivityID, rpcConnectionInfo); + + traceOutput.WriteLine($"{data.TimeStampRelativeMSec:0.0000} ({data.ProcessID}.{data.ThreadID}) {data.EventName} " + + rpcConnectionInfo); + + IncrementStatistics($"{data.InterfaceUuid} ({data.Endpoint})"); + } else if (data.Protocol == ProtocolSequences.LRPC ) { + var key = new Tuple(data.InterfaceUuid, data.Endpoint, data.ProcNum); + string clientProcessInfo; + if (awaitingClientCalls.TryGetValue(key, out clientProcessInfo)) { + var rpcConnectionInfo = $"<-- {data.Protocol} --- {data.InterfaceUuid} ({data.Endpoint}) {data.ProcNum} " + + $"{data.NetworkAddress} ({data.ProcessID}.{data.ThreadID})"; + rpcActivity.Add(data.ActivityID, rpcConnectionInfo); + + traceOutput.WriteLine($"{data.TimeStampRelativeMSec:0.0000} ({clientProcessInfo}) {data.EventName} " + + rpcConnectionInfo); + awaitingClientCalls.Remove(key); + } + } } - private void RpcClientCallStop(RpcClientCallStopArgs ev) + private void RpcClientCallStop(RpcClientCallStopArgs data) { + string rpcConnectionInfo; + if (rpcActivity.TryGetValue(data.ActivityID, out rpcConnectionInfo)) { + traceOutput.WriteLine($"{data.TimeStampRelativeMSec:0.0000} ({data.ProcessID}.{data.ThreadID}) {data.EventName} " + + rpcConnectionInfo); + rpcActivity.Remove(data.ActivityID); + } } private void RpcClientCallStart(RpcClientCallStartArgs data) { if (data.ProcessID == pid) { + var rpcConnectionInfo = $"--- {data.Protocol} --> {data.InterfaceUuid} ({data.Endpoint}) {data.ProcNum} {data.NetworkAddress}"; + rpcActivity.Add(data.ActivityID, rpcConnectionInfo); + traceOutput.WriteLine($"{data.TimeStampRelativeMSec:0.0000} ({data.ProcessID}.{data.ThreadID}) {data.EventName} " + - $"--- {data.Protocol} --> {data.InterfaceUuid} ({data.Endpoint}) {data.ProcNum} {data.NetworkAddress}"); + rpcConnectionInfo); - string summaryKey = $"{data.InterfaceUuid} ({data.Endpoint})"; - if (!rpcSummary.ContainsKey(summaryKey)) { - rpcSummary.Add(summaryKey, 1); - } else { - rpcSummary[summaryKey]++; + if (data.Protocol == ProtocolSequences.LRPC) { + awaitingClientCalls.Add(new Tuple( + data.InterfaceUuid, data.Endpoint, data.ProcNum), $"{data.ProcessID}.{data.ThreadID}"); } + + IncrementStatistics($"{data.InterfaceUuid} ({data.Endpoint})"); + } + } + + private void IncrementStatistics(string summaryKey) + { + if (!rpcSummary.ContainsKey(summaryKey)) { + rpcSummary.Add(summaryKey, 1); + } else { + rpcSummary[summaryKey]++; } } }