How can I measure the number of instructions a Windows (or Linux or XNU) kernel driver/module executed after, say, an IOCTL or a SYSCALL? My only ideas are the following:

  • Using WinDBG or remote GDB, debug the whole operating system, put breakpoints in each basic block/function/instruction of the driver or step-trace inside it. Very slow and likely going to cause problems due to the large number of breakpoints to be added.
  • From user-land, use instructions like RDTSC to try to "measure" the number of (non different) instructions executed by checking the times it took to execute it. Likely going to give "false" results for many reasons (i.e., the very same call to a syscall or ioctl can take different times for many different reasons).

Any idea or option in any of the mentioned kernels to determine the number of instructions and, preferably, the number of different instructions executed?

  • if you haven't yet done give wt (watch and trace ) command a spin in windbg it does this counting stuff in the statistics it provides at the end of tracing a complete function may be you can leverage it with a custom windbg extension
    – blabb
    Commented Sep 30, 2014 at 7:07

2 Answers 2


I'd recommend using Bochs. It'll allow you to write code to count the number of instructions (and/or number of different instructions) executed between a SYSCALL/SYSRET, SYSENTER/SYSEXIT, etc.

  • 1
    Yes, I think it's the best one can one as of today. Slow as hell, but probed to work. Thanks! Commented Oct 9, 2014 at 7:41

You can also give a try to pin. There is even an example in the documentation explaining exactly what you want to do.

  • Sure, tell me how to use Intel PIN, which is a completely user-land toolkit, in Kernel. Commented Oct 5, 2014 at 8:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.