5

I have an application, that I want to profile using Windows Performance Analyzer. It all works, but I don't get any reasonable stack traces from my application.

The application in question is a demo application. This is to give me a good feeling if all checks out. Then I want to profile another application. Since I have full control over my demo application, I included some marker functions, that should show up in the stack trace.

When running the application on Windwos 71, Process Explorer shows the correct stack trace for the part, that I want to profile. Here is the stack trace with the marker functions in lines 7 - 9:

Process Explorer Stack Trace

Since I installed all performance analytics tools insinde a Windows 10 VM2, I started profiling there. The first thing to notice: Process Explorer does not show the correct stack trace. The marker functions that I implemented are nowhere to be found.

Nevertheless, I recorded performance traces using UIforETW and Windows Performance Recorder. When opening them in WPA and focussing on the target application, this is the stack trace:

WPA Stack Trace

All the information, I'm interested in is missing. The stack shows up as <Application>.exe!<Missing ImageId event>

What did I do wrong?

If this gives you a hint, here is the relevant software, that is installed:

1: The Windows 7 computer has Visual Studio (C#) installed.

2: The Windows 10 VM dowsn't have Visual Studio, but has WinDBG (Preview) and Windows Performance Toolkit installed.

I tagged , because the target application is written in Delphi.

rollstuhlfahrer
  • 3,988
  • 9
  • 25
  • 38

2 Answers2

6

The Windows 10 WPA (as well as Windows 8.1, to a lesser extent) dropped support for older debug symbol formats; it now only supports the "RSDS" format that has been standard since MSVC 7. PE files using older symbol file formats (for example, VB6 generates NB10 PDB files) will result in that "Missing ImageId event" error.

(The message itself is technically incorrect; there likely is an ImageId even in the trace file but it is looking for an ImageId/DbgID_RSDS event, which can't be generated for non-RSDS PDBs)

Zhentar
  • 244
  • 1
  • 5
  • 1
    What could be done to overcome `` – vivek_reddy Jan 08 '20 at 09:58
  • 1
    Use win 7 (or possibly win 8.1) WPT to record & view the trace, or use a relogger library such as TraceEvent to inject fake RSDS data for the images of concern & doctor the pdbs to have a matching RSDS signature, or write a WPA add-in along the lines of https://github.com/Zhentar/Wpa.Demystifier that performs a fallback symbol lookup. – Zhentar Jan 09 '20 at 21:08
1

<Missing ImageId event> will also be reported when the session is not merged with the "NT Kernel Logger" which provides some information necessary to resolve the symbols.

The "proper" way to stop the session is:

xperf.exe -stop my_trace -stop -d merged_trace.etl

Note that second -stop in necessary to stop another session (implicitly "NT Kernel Logger"), and -d to merge both into the merged_trace.etl.

Lukasz Mendakiewicz
  • 452
  • 3
  • 8