README
1 Traceline is a Windows utility to intercept, time, and log system calls. This
2 is achieved by injecting code into a target process, along with dynamically
3 generated assembly hook stubs. One of the major goals was to skew performance
4 timings as little as possible. This lead to a design in which the log buffer
5 (which is called the playground) is kept within the process, and the logger
6 routines use atomic instructions to log their events to this buffer. At the
7 end of the processes lifetime, this buffer is pulled out of the process and
8 used to generated JSON output. In addition to hooking system call activity,
9 other hooks of interest have been written, including heap allocation functions.
10 Symbols are supported with a command line flag. This works by capturing the
11 process shutdown, and doing an intrusive symbol attach with dbghelp.dll
12
13 NOTES:
14 - You should copy dbghelp.dll from a windbg installation into this directory.
15 The version shipped with Windows is old, and symbol support won't work.
16 - You will need a bit of cygwin if you want to use the Makefile. Otherwise
17 it is pretty clear how to build the files manually.
18 - The output JSON data will be printed out stdout. It is likely that you
19 will want to pipe the output of this program into a file.
20
21 Dean McNamee <deanm (a] chromium.org>
22