UIforETW with circular-buffer and Chrome improvements

This release of UIforETW makes circular-buffer tracing more robust, adds tracing of Chrome's "media" and "loading" categories, and various minor fixes and upgrades.

The full list of changes can be found with:
git log --oneline ad63428..70bbcaa

A partial list includes:

70bbcaa Add instructions for updating version checking
e6420a3 Increase version number to 1.53
0176654 Fix lost-event failures in circular buffer tracing
77058c3 Change UIforETW to build with VS 2019
387e1c9 Optionally record the xperf command used
e662a87 Improve trace_timer_intervals
fd322d5 Updates to IdentifyChromeProcesses.py
5d1bece Add media and loading Chrome tracing categories
3d683e4 Add batch file to record process creation
a4b358a Merge pull request #138 from lukastvrdy/fix/locale-datetime-etwheapsnapshot-bat
a659145 Fix the locale dependent date parsing used for the output heap trace filename
3d33017 Update etwpmc_record.bat to find tracelog.exe
924685d Upgrade ConditionalCount project to VS 2019

The etwpackage*.zip file contains 32-bit and 64-bit versions of UIforETW.exe, statically linked so that they will run anywhere. No compilation required. It also includes 64-bit versions of the Windows Performance Toolkit (WPT) installers.

To use this release just download etwpackage*.zip, unzip it, then run bin\UIforETW.exe (signed). WPT 10 will be installed as needed. Symbols are available on this symbol server: https://randomascii-symbols.commondatastorage.googleapis.com

For more information see https://tinyurl.com/etwcentral (aka https://randomascii.wordpress.com/2015/09/24/etw-central/)

UIforETW with spring 2019 WPT

This release of UIforETW upgrades to the spring 2019 version of the Windows Performance Toolkit, adds support for recording and analyzing heap snapshots (etwheapsnapshot.bat and HeapSnapshot.wpaProfile), improves the default WPA startup profile (consider copying it over to get new goodness), adds a script for summarizing timer interrupt changes over time (trace_timer_intervals.bat), adds some samples of using a C# API to analyze ETW traces, and various minor cleanups:

The full list of changes can be found with:
git log 2404996..ad63428 --oneline

A partial list includes:

11197e0 Change version-checking code
b1771bf Upgraded preferred WPT version to Windows 10 1903
4ccaa87 Update version number to 1.52
cefb3c7 Sign DelayedCreateProcess.exe
c855eab Update startup profile
2078229 Add script for enumerating Randomascii presets
1578739 Update CPUUsageByProcess.wpaProfile column names
0a5e608 Add script to summarize CPU usage by command line
799e56b Update summarize_timer_intervals.py for Python 3
2bfd848 Update for Python 3 compatibility
91586a0 Remove WPT 8.1 support from UIforETW
410fc6e Use -capturestate to reliably record window focus
984b58a Update ETW batch files
1f6d9a7 Adding a heap snapshot profile
ca1bf17 Add a tool to summarize CPU usage
6e3f0b4 Refactor IdentifyChromeProcesses.cs
169dcfb Make C# and Python process identification virtually identical
2c349b6 Improvements to ETW PMC report generation
b50fdef Add a batch file to record ETW heap snapshots
772147a Add C# version of IdentifyChromeProcesses.py
ffa6da9 Sort browsers and child processes by pid
51eb6bb Fix process-tree script with new .csv name
c5fcbc0 Add scripts for reporting on timer frequency changes
f198783 Add .pyc to .gitignore
530541c Make IdentifyChromeProcesses a callable module

The etwpackage*.zip file contains 32-bit and 64-bit versions of UIforETW.exe, statically linked so that they will run anywhere. No compilation required. It also includes 64-bit versions of the Windows Performance Toolkit (WPT) installers.

To use this release just download etwpackage*.zip, unzip it, then run bin\UIforETW.exe (signed). WPT 10 will be installed as needed. Symbols are available on this symbol server: https://randomascii-symbols.commondatastorage.googleapis.com

For more information see https://tinyurl.com/etwcentral (aka https://randomascii.wordpress.com/2015/09/24/etw-central/)

UIforETW with fall 2018 WPT

This release of UIforETW upgrades to the fall 2018 version of the Windows Performance Toolkit, adds support for the new symcache format, adds support for tracing Chrome's blink.user_timing events, records the traced machine's QPC frequency, and adds remembering the UIforETW window size, plus various bug fixes.

There is a bug in the fall 2018 installer for WPT which may cause microsoft.performance.core4.data.dll to not be installed. If WPA fails to run after running the latest UIforETW then you can do a repair install of Windows Performance Toolkit or the Windows 10 SDK, or install the 1903 version of the Windows 10 SDK.

The full list of changes can be found with:

git log --oneline 7a8d7a7..head

A partial list includes:

2404996 Increment version number from 1.50b to 1.51
f916345 Check for fall 2018 WPT
c3d6fdf Add support for v3.1.0 symcache format to ETWPackSymbols.py
ac8387c Update StripChromeSymbols.py to new symcache format
92efb38 Add WPT directory to the path
bb164db Copy dbghelp.dll and symsrv.dll to bin directory (so that RetrieveSymbols works reliably)
d6dc320 Add logging of Performance API events exclusively - add blink.user_timing
efc2e50 Record QueryPerformanceFrequency
1339ade Implement feature to remember width and height of UIForETW Dialog

The etwpackage*.zip file contains 32-bit and 64-bit versions of UIforETW.exe, statically linked so that they will run anywhere. No compilation required. It also includes 64-bit versions of the Windows Performance Toolkit (WPT) installers.

To use this release just download etwpackage*.zip, unzip it, then run bin\UIforETW.exe (signed). WPT 10 will be installed as needed. Symbols are available on this symbol server: https://randomascii-symbols.commondatastorage.googleapis.com

For more information see https://tinyurl.com/etwcentral (aka https://randomascii.wordpress.com/2015/09/24/etw-central/)

Bug fixes to v1.50

This release of UIforETW fixes some bugs in the v1.50 release of UIforETW, including a bug that prevented normal tracing unless heap tracing was configured.

The list of important recent changes is:

7a8d7a7 Put PDB files in symbol server format
fa1b9ea Only check and set heap args when heap tracing
fcca3d9 Print correct version number when WPT is installed.
61eaa9d Update IdentifyChromeProcesses.py
49875c8 Don't use OutputDebugString in release builds
45d5eae Remove double-Windows typo

The etwpackage*.zip file contains 32-bit and 64-bit versions of UIforETW.exe, statically linked so that they will run anywhere. No compilation required. It also includes 64-bit versions of the Windows Performance Toolkit (WPT) installers.

To use this release just download etwpackage*.zip, unzip it, then run bin\UIforETW.exe (signed). WPT 10 will be installed as needed. etwsymbols*.zip (with source indexing) can be downloaded if needed for debugging. The etwsymbols*.zip file contains the PDBs for UIforETW in symbol server format - just unzip them to your local symbol server cache so that all debuggers and profilers and other tools can use them.

For more information see https://tinyurl.com/etwcentral (aka https://randomascii.wordpress.com/2015/09/24/etw-central/)

Windows 10 April 2018 release

This release of UIforETW includes the April 2018 version of the Windows Performance Toolkit, and some improvements to heap tracing. Upgrading WPT was delayed because Chrome M68's symbol paths were incompatible with it, but M69 shipped a while ago.

Probably the most important changes are that heap tracing can be triggered by specifying the PID (or two PIDs) of a running process, and the startup profile contains an improved heap analysis preset, also available in bin\HeapAnalysis.wpaProfile. Use Settings-> Copy startup profiles to get the new startup profile. Heap tracing details will be posted to https://randomascii.wordpress.com/2015/04/27/etw-heap-tracingevery-allocation-recorded/

The list of important recent changes is:

5db4c58 Print whenever heap tracing flags change
63d4fa5 Add Heap Analysis preset to the startup profile
ee98c51 Fix Chrome process identification to support crashpad parents
5618e5d Enhanced heap tracing abilities
a34225a Update list of Edge Processes
060e21d Enable Control Flow Guard
d3b46f0 Changed to be able to support linking with lld-link.
b8f52da Update list of which Chrome categories to trace
9be3ba4 Added support for WPT installation in atypical locations.
da408ec Rearrange hidden columns in default WPA profile
546ec0e Make ChildProcess class more reusable
61f21d7 Enable C++ Core Check for static analysis
69fd379 Change Stop Tracing to Cancel Tracing
379a0dc Handle "Unknown" process in CPU Usage Summary

The etwpackage*.zip file contains 32-bit and 64-bit versions of UIforETW.exe, statically linked so that they will run anywhere. No compilation required. It also includes 64-bit versions of the Windows Performance Toolkit (WPT) installers.

To use this release just download etwpackage*.zip, unzip it, then run bin\UIforETW.exe (signed). WPT 10 will be installed as needed. etwsymbols*.zip (with source indexing) can be downloaded if needed for debugging. The PDBs can be added to your local symbol server cache with this command (adjust c:\symbols as needed):

"c:\Program Files (x86)\Windows Kits\10\Debuggers\x64\symstore.exe" add /r /f *.pdb /s c:\symbols /t UIforETW

For more information see https://tinyurl.com/etwcentral (aka https://randomascii.wordpress.com/2015/09/24/etw-central/)

Fall Creators [sic] Update release

This release of UIforETW includes updates for the Fall Creators Update (October 2017) version of Windows 10.

This version has a new global shortcut for starting/stopping recording of traces, and it contains the latest version of WPT. And, all of the binaries are now signed, finally.

Having the latest version of the Windows Performance Toolkit (WPT) is important because otherwise some types of recording (GPU tracing in some cases) will not work on the Fall Creators Update version of Windows 10.

The list of important recent changes is:

b7430f2 Auto-install Fall Creators Update WPT
cb2c53a Widen about box for build date details (second try)
a45032b Replacement for stolen global keyboard shortcut
73f5058 Update packaging script to sign all binaries

Additionally, an updated version was released on March 21st which renames the Stop Tracing button to Cancel Tracing, to avoid confusion reported in issue #113

The etwpackage*.zip file contains 32-bit and 64-bit versions of UIforETW.exe, statically linked so that they will run anywhere. No compilation required. It also includes 64-bit versions of the Windows Performance Toolkit (WPT) installers.

To use this release just download etwpackage*.zip, unzip it, then run bin\UIforETW.exe (signed). WPT 10 will be installed as needed. etwsymbols*.zip (with source indexing) can be downloaded if needed for debugging.

For more information see https://tinyurl.com/etwcentral (aka https://randomascii.wordpress.com/2015/09/24/etw-central/)

Lab and power updates

This release of UIforETW includes updates for power monitoring, lab tracing, and miscellaneous fixes.

The list of important recent changes is:

02a3c58 Add support for disabling background monitoring
a068e88 Improve per-process CPU report
c01b535 Fix Python 3 compatibility bug
e563000 Update an assert to handle another error code
a5b027a Adding output directory support to lab scripts
6ee1daa Merge pull request #102 from CalebRouleau/master
561e167 Fix UnboundLocalError in SummarizeData.py.
ca03153 Identify the V8 Proxy Resolver utility process
9542e92 Add option to summarize Chrome CPU usage
a4c401e Identify Chrome extension processes
3ef4a88 Record POWER provider by default in lab traces
6cc4926 Add a detailed flag to the lab start_tracing.bat

The etwpackage*.zip file contains 32-bit and 64-bit versions of UIforETW.exe, statically linked so that they will run anywhere. No compilation required. It also includes 64-bit versions of the Windows Performance Toolkit (WPT) installers.

To use this release just download etwpackage*.zip, unzip it, then run bin\UIforETW.exe (signed). WPT 10 will be installed as needed. etwsymbols*.zip (with source indexing) can be downloaded if needed for debugging.

For more information see https://tinyurl.com/etwcentral (aka https://randomascii.wordpress.com/2015/09/24/etw-central/)

UIforETW, updated for Windows 10 Creators Update

This release of UIforETW is updated for the Windows 10 Creators Update. It packages the new 10.0.15063 version of the Windows Performance Toolkit, and has a few tweaks to work better with the new WPA and the new WIndows.

The list of important recent changes is:

8b3f9bd Updates for Windows 10 Creators Update
9bfe0ce Update thread names
93dc13e Fix crash in IdentifyChromeProcesses.py

The Creators Update changes include the new WPT, retiring the Chrome symbol stripping/downloading hack (finally!), and supporting the new thread naming API.

The etwpackage*.cab file contains an etwpackage*.zip file that contains 32-bit and 64-bit versions of UIforETW.exe, statically linked so that they will run anywhere. No compilation required. It also includes 64-bit versions of the Windows Performance Toolkit (WPT) installers.

To use this release just download etwpackage*.cab and extract the .zip file. Then unzip etwpackage*.zip and run bin\UIforETW. WPT 10 will be installed as needed. etwsymbols*.zip (with source indexing) can be downloaded if needed for debugging. Apologies for the extra step, but .cab files can be signed and .zip files can't. Check the signature of the .cab file if you want to be sure you're getting the real thing.

For more information see https://tinyurl.com/etwcentral (aka https://randomascii.wordpress.com/2015/09/24/etw-central/)

UIforETW, now with digital signatures

This release of UIforETW has a toggle to control pre-trace recording (used when tracing across Chrome upgrade restarts) and adds support for TraceLogging providers. But mostly it now has signed binaries and a signed CAB file.

The list of important recent changes is:

cd47a9d Add a check-box to control pre-trace recording
b75199a Update packaging script to sign and create .cab
a68459b Added support for TraceLogging providers

The etwpackage*.cab file contains an etwpackage*.zip file that contains 32-bit and 64-bit versions of UIforETW.exe, statically linked so that they will run anywhere. No compilation required. It also includes 64-bit versions of the Windows Performance Toolkit (WPT) installers.

To use this release just download etwpackage*.cab and extract the .zip file. Then unzip etwpackage*.zip and run bin\UIforETW. WPT 10 will be installed as needed. etwsymbols*.zip (with source indexing) can be downloaded if needed for debugging. Apologies for the extra step, but .cab files can be signed and .zip files can't.

For more information see https://tinyurl.com/etwcentral (aka https://randomascii.wordpress.com/2015/09/24/etw-central/)

UIforETW - better tracing for all

This release of UIforETW has some robustness improvements. It may make circular buffer tracing work better. It improves tracing of Chrome upgrades. It adds support for CPU performance counter (PMC) tracing, fixes high-DPI problems, and lets Ctrl+Win+C be used both to start and stop tracing.

The list of important recent changes is:

8c93010 Update package_etw.bat to put version number in .zip files
0814142 Allow using Ctrl+Win+C to start and stop tracing
500fa43 Record VirtualFree stacks when VirtualAlloc stacks are requested
c042f43 Record imageID only trace when starting Chrome tracing
93d8435 Halve the buffer counts when tracing to circular buffers
9a7b897 Adds a general lab tracing setup
b919c2a Add no-wrap attribute to static text to avoid wrapping
3f57bef Record CPU and analyze CPU performance counters using ETW
092fa4d Make trace starting more robust
6368343 Add an option to use an alternate kernel logger

As usual the etwpackage*.zip file contains 32-bit and 64-bit versions of UIforETW.exe, statically linked so that they will run anywhere. No compilation required. It also includes 64-bit versions of the Windows Performance Toolkit (WPT) installers.

To use this release just download and unzip etwpackage*.zip and run bin\UIforETW. WPT 10 will be installed as needed. etwsymbols*.zip (with source indexing) can be downloaded if needed for debugging.

Some anti-virus programs have occasionally flagged UIforETW*.exe as being malware. The cause of this flagging is not known but the flagging is assumed to be spurious. See #71 for a discussion of this issue.

For more information see https://tinyurl.com/etwcentral (aka https://randomascii.wordpress.com/2015/09/24/etw-central/)