
VxDMon


by Mark Russinovich and Bryce Cogswell

Click here to download VXDMON.ZIP. This is a new version which includes 
online help.

Introduction

VxDMon is a tool meant to allow for profiling of Windows 95 VxD 
performance and behavior. VxDMon's functionality is built on VxD service 
hooking. By using service hooking, VxDMon is able to monitor and time, 
via the Pentium's rdtsc (ReaD Time Stamp Counter) instruction, any and 
all VxD services including those of VxDs built into Windows and those 
added by a developer. In addition, VxDMon keeps track of VxD service 
call histories so that it can display useful information such as the 
list of all services that were called by a particular service during a 
monitoring session. This combination of VxD performance and call history 
information provides a never-before-seen look into the behavior of 
Windows. 

VxD Service Hooking

Most VxDs export services that other VxDs can call through a mechanism 
similar to the dynamic linking used by DLLs. Because service calls go 
through a level of indirection, they can be hooked by patching a VxD's 
service table with addresses of hook procedures. VxDMon uses this 
facility to insert itself on the call path for VxD services selected in 
the user interface. It is then notified whenenver a VxD service starts 
as well as when it completes. 

Peformance Monitoring

VxDMon uses the Pentiums built-in cycle counter to measure the duration 
of VxD service calls. The cycle counter is a 64-bit value that is 
incremented on every processor cycle, and an instruction, whose assembly 
language mnemonic is rdtsc (ReaD-Time-Stamp-Counter), is used to read 
the value of the counter. VxDMon records the value of the counter 
whenever a service is called, and then updates the accumulated time 
spent in the service by adding the elapsed cycles seen when the service 
finishes. VxDMon also keeps track of how many times each VxD service 
being monitored is executed and uses this information to report the 
average number of cycles taken by individual calls to the service. 

Control-Flow Monitoring

In addition to performance monitoring, the service wrappers that VxDMon 
uses for its service hooks also keep track of control-flow information. 
They do this by maintaining a list of services called by each monitored 
service. When a VxD service is called, VxDMon checks to see if it was 
called by another service, and if so, updates the callers list of called 
services. The user interface processes this information in order to 
generate both caller and callee views of particular VxD services 
behavior when the user requests it. 

Using VxDMon

VxDMon was designed for Pentium processors and requires that VXDMON.EXE 
be in the same directory as VXDMON.VXD. It will run on a 386 or 486 
processor, but performance information will not be available since only 
the Pentium has a cycle counter. VXDMON.VXD is a dynamic VxD, meaning 
that no changes to system.ini or the registry are necessary. The typical 
way VxDMON is used is demonstrated in the following steps: 
1.	Select services to be monitored 
2.	Collect performance and control-flow information 
3.	View the gathered statistics 

Selecting a Hook Profile

When VxDMon is started it checks to see if a hook profile exists in a 
file in the current directory called profile.dat. If a profile exists, 
VxDMon will ask if you desire that the services listed in the profile 
should be hooked. If no profile exists, the main window will open 
without a prompt. To create a hook profile the Options|Select Services 
menu item must be selected, which will open a tree-view containing all 
the services listed in a file called services.dat. When a service is 
clicked upon in this view, it will toggle between a selected state, 
indicated with a green icon, and an unselected state, indicated with a 
red icon. Yellow icons are used to identify VxDs that have some, but not 
all, of their services selected for monitoring. After a profile has been 
created, VxDMon must be told to begin monitoring the services selected. 
Choose the Options|Hook Now menu item in the selection window. A profile 
can be saved by choosing Options|Save Hook List. 

Updating Statistics

Monitoring begins as soon as the services are hooked, and the statistics 
gathered by VxDMons VxD can be imported into the user interface by 
choosing Options|Update Statistics in the main window. The latest 
statistics are read from the VxD by selecting Options|Update, and reset 
to zero by selecting Options|Reset. Depending on the value of the 
Preferences|Zero Statistics on Update selection, Options|Update either 
accumulates the counts (off), or gives the counts since the previous 
Update (on). 

Viewing Control-Flow Information

Control-flow information can be seen by double clicking on a service in 
the main window, or by highlighting a service and choosing Options|Show 
Ancestors or Options|Show Descendants. A services ancestors are all 
services that preceeded the service in the control-flow. The immediate 
ancestors of a service include all the services that directly called it. 
Correspondingly, the descendants of a service are those services that 
followed it in the control-flow. The immediate descendants are those 
services that were directly called by the service. When ancestor or 
descendant information is selected, a new sub-window is opened that 
displays the control-flow hierarchy as a tree-view. The same 
ancestor/descendant selection facilities are available in the sub-window 
so that other services can have control-flow windows opened for them. 
Finally, both the main window and the control-flow windows have save 
capabilities that dump the windows contents in formatted ASCII to a 
file. 