Intel® Software Network

I am trying to profile an ISAPI extension dll using VTune analyzer. I did it according to the instructions at
http://cache-www.intel.com/cd/00/00/21/92/219276_callgraph.pdf , in the "Using Call Graph to Analyze Microsoft Internet Server API (ISAPI) DLLs" section.

The problem I have is that I am getting a "Invalid access to memory location" message in the browser whenever I try to access my web server. This does not happen when I run it outside the VTune analyzer.

Any ideas why it happens?

What OS are you running on and what version?

We have recently discovered that in the newer releases of Microsoft* operating systems, such as Windows* 2003 Server SP2, call graph is thwarted by some new Microsoft technology, specifically, Windows* File Protection.

Evidently, Microsoft added IIS executables to their Windows* File Protection (WFP) service recently.  The VTune analyzer can not provide call graph support if an external service/feature prevents intrusion to the profiled process. WFP is an intrusion prevention service like certified images, McAfee* Host Intrusion Prevention, etc.  When such a service is active, the VTune analyzer can not profile the specific protected image or the process. The only way to resolve the issue is to disable the service for profiling purposes. Please see http://www.microsoft.com/whdc/archive/wfp.mspx and http://support.microsoft.com/kb/222473 for information on disabling WFP.  However, you should realize that disabling WFP can lead to system instability, per Microsoft, and you should only attempt to disable it on a system that is fully backed up or otherwise restorable.

The VTune™ analyzer callgraph technology instruments or changes the disk image of the binary or executable.   Where the OS or system takes special protective action to prevent changes to binaries and files, this callgraph technology, which is core to its design, will not work.    As a result we will, unfortunately, be unable to provide a fix for this problem.   The best work around at this time will be to use an older release of the OS so you can disable Windows File Protection (WFP).

---

Regards,
"Mr. Anderson"

Hi,
Thanks for you response. I've been emailing the intel support guys and they are saying the same stuff.
As I see it, my options are:
1. Work with windows 2003 server SP1 instead of SP2.
2. Use SfcDisable = 1 or 2 and work with a kernel debugger attached.
regarding option #2 - Will this hurt the performance I am trying to measure?

Thanks,
Hagai.

Hi,
I tried running it with server 2003 SP1, same results (invalid access to memory location in the browser).
Any point in trying to uninstall SP1?

Thanks,
Hagai.

I also installed the basic version of win2k3 (no service packs), and wfp is also enabled on it.