-
Notifications
You must be signed in to change notification settings - Fork 139
Excluding selected functions
hasherezade edited this page Aug 11, 2023
·
11 revisions
In some cases, we want to exclude specific functions from tracing, in order to reduce the noise.
We can do it by defining a list of such functions in excluded.txt
.
The exclusions need to be defined in the following format (;
is the delimiter):
{module};{function}
Example:
kernelbase;InitializeCriticalSectionEx
If the function is excluded, the call to it will not be listed in the .tag
file. Also, the parameters of the function will not be dumped (even if it was defined in params.txt
).
- The tracelog of a demo application, before the exclusions were defined:
7f56c;section: [.text]
7f5a4;CPUID:0
7f602;CPUID:1
7f69d;CPUID:7
82c4c;kernel32.LoadLibraryExW
82ce3;kernel32.GetProcAddress
GetProcAddress:
Arg[0] = ptr 0x00007ff81b340000 -> {MZ\x90\x00\x03\x00\x00\x00}
Arg[1] = ptr 0x00007ff621e5a5d8 -> "InitializeCriticalSectionEx"
82c4c;kernel32.LoadLibraryExW
82ce3;kernel32.GetProcAddress
GetProcAddress:
Arg[0] = ptr 0x00007ff81b340000 -> {MZ\x90\x00\x03\x00\x00\x00}
Arg[1] = ptr 0x00007ff621e5a5a0 -> "FlsAlloc"
82da7;kernelbase.FlsAlloc
[...]
- We exclude function GetProcAddress from tracing.
excluded.txt:
kernel32;GetProcAddress
The tracelog:
7f56c;section: [.text]
7f5a4;CPUID:0
7f602;CPUID:1
7f69d;CPUID:7
82c4c;kernel32.LoadLibraryExW
82c4c;kernel32.LoadLibraryExW
82da7;kernelbase.FlsAlloc