Finding who calls a system function

Asked Oct 26 '16 at 13:30

Active Oct 26 '16 at 13:30

Viewed 89 times

I have a C++ application, developed with VisualStudio 2015 (update 2).

Profiling with AMD Code XL shows that the program spends almost 20% of its time in the function RtlUpcaseUnicodeToMultiByteN, from the module ntdll.dll. Apparently it converts unicode tsrings to upper case.

As it makes no sense to spend that much time doing that, I need to know who is calling the function. Turns out it isn't easy.

What I'd want to do is set a breakpoint, then see the call stack. However, I cannot set it the usual way without the source code.

I tried Windbg, but the stack trace was essentially useless.

Then I found there is a way to set a "function breakpoint" in VisualStudio; but the program never did break; even though the "modules" window showed ntdll.dll as "symbols loaded" status.

What more can I do?

asked Oct 26 '16 at 13:30

Francesco Dondi

1,064
9
17

5

Shouldn’t your profiler give you the call stack? – Konrad Rudolph Oct 26 '16 at 13:33
Should it? I didn't think it would. I'll look into it, thanks! – Francesco Dondi Oct 26 '16 at 13:38
1

Most (all?) profilers do, in some form or another, since without a stack trace this information is completely useless (as you’ve yourself discovered). – Konrad Rudolph Oct 26 '16 at 13:39
1

Indeed it did! For future reference: right-click, "open in Call Graph". – Francesco Dondi Oct 26 '16 at 13:42
1

need set breakpoint to RtlUpcaseUnicodeToMultiByteN and if "stack trace was useless" debug step by step until not found call source – RbMm Oct 26 '16 at 17:01

Finding who calls a system function

0 Answers0