generate code execution/cpu time flame-graph of library DLL (Noob question)

Question

I have a library DLL which I'm trying to analyze, and I have a basic understanding of its function and behavior (and can modify some input to affect how long certain operations will take to execute/how often it will execute), but I'm not sure where exactly in the DLL the functions which I know exist are located, and finding them by following program flow manually in a disassembler is non-trivial. It would be very helpful to be able to have some sort of "flame-graph" code coverage tool which would show me how many times a given line of assembly has been executed. I don't need function calls or anything like that, just the raw number of executions per line (or CPU time per line) from some kind of sampling.

Additionally, as a library DLL, it has to be called from another process, and in this case must be called by a very specific program.

Is this possible with a DLL that doesn't have any debugging symbols attached? Or am I asking for a holy grail?

Thanks!

Answer 1

not sure what you are looking for
if you want to concentrate on one single line of assembly
you can employ a skip number of passes with a high count

for example with windbg you could do bp ntdll!memcmp 5000 and hit g to run the binary

which would either break if it has been hit 0x5000 times or

will show how many times it has been hit if you display the status of break point with bl

see a demo below

C:\WINDOWS\system32>cdb cdb

Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64
irrelevent output snipped setting a breakpoint as above
0:000> bp ntdll!memcmp 5000
0:000> g
again irrelevent output snipped 
ntdll!NtTerminateProcess+0x14:
00007ffe`5f94d644 c3              ret

the process has finished running but no break 
so memcmp must have been hit a few times but less than the 
threshold of 0x5000 hits
lets check how many times it has been hit      

0:000> bl
 0 e 00007ffe`5f940100     4f45 (5000)  0:**** ntdll!memcmp  <<<<<<<<< 
memcmp a single assembly line has been hit **(0x500- 0x4f45)** about 186 
times between start and end of process 
0:000>

breaking on the last but one hit on memcmp

0:000> bp ntdll!memcmp 0xba
0:000> g
Breakpoint 0 hit
ntdll!memcmp:
00007ffe`5f940100 482bd1          sub     rdx,rcx
0:000> bl
 0 e 00007ffe`5f940100     0001 (00ba)  0:**** ntdll!memcmp  < on hit left to reach threahhold
0:000>

or you can count like this employing a script

0:000> r $t1=0
0:000> bp ntdll!memcmp "r $t1=@$t1+1;?@$t1;gc"
0:000> g
Evaluate expression: 1 = 00000000`00000001
Evaluate expression: 2 = 00000000`00000002
Evaluate expression: 3 = 00000000`00000003
Evaluate expression: 4 = 00000000`00000004
Evaluate expression: 5 = 00000000`00000005

sniped irrelevent output

ModLoad: 00007ffe`5e230000 00007ffe`5e2dd000   C:\WINDOWS\System32\shcore.dll
Evaluate expression: 182 = 00000000`000000b6
Evaluate expression: 183 = 00000000`000000b7
Evaluate expression: 184 = 00000000`000000b8
Evaluate expression: 185 = 00000000`000000b9
Evaluate expression: 186 = 00000000`000000ba
Evaluate expression: 187 = 00000000`000000bb

Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.

Failed to open \\.\com1
Kernel debugger failed initialization, Win32 error 0n2
    "The system cannot find the file specified."
Debuggee initialization failed, Win32 error 0n2
The system cannot find the file specified.
ntdll!NtTerminateProcess+0x14:
00007ffe`5f94d644 c3              ret
0:000>

btw fwiw the old ollydbg32 bit debugger had a feature called hittrace that could count how many times each line was executed not sure if either ollydbg64 or its 64bit competitor x64dbg implements such feature