Re:Reviewing Microsoft's Automatic Insertion of Telemetry in...
by ksk on Thursday June 09, 2016 @07:26PM
(#11873153)
I know what ETW is and how it works. I don't know what your point is, sorry.
[ Parent
| on HN ]
Re:Reviewing Microsoft's Automatic Insertion of Telemetry in...
by nitrogen on Thursday June 09, 2016 @11:07PM
(#11874022)
Sometimes conversations are less like arrows and more like trees -- few points, lots of branches.
Re:Reviewing Microsoft's Automatic Insertion of Telemetry in...
by rixed on Friday June 10, 2016 @12:24AM
(#11874290)
I think his point was: you really should read about dtrace, esp. how to instrument user programs (without instrumentation).
Re:Reviewing Microsoft's Automatic Insertion of Telemetry in...
by ksk on Friday June 10, 2016 @11:31AM
(#11877065)
Err, if you already know the memory map of the functions inside a process image, then understanding the call stacks is trivial for any debugging or performance tool - on any platform. This does not require any instrumentation. And if you're reverse engineering, then dtrace is the wrong tool anyway. So, can _you_ point to any common use case of dtrace where the probes aren't already present in the kernel/libs/user code?