Skip to content

Debugging Tool WPAExporter

Mainkill1 edited this page Sep 21, 2026 · 1 revision

WPAExporter

← Debugging Tools and Commands

WPAExporter turns saved ETL data and a WPA profile into repeatable CSV exports suitable for review, automation, and privacy-minimized attribution.

Property Details
Supported OS Windows.
Install Install the Windows Performance Toolkit feature from the Windows ADK or Windows SDK.
Verify wpaexporter.exe -help
Primary output See the workflow below.

When to use it

Once the useful tables, PID, TID, and time range are known, prefer reproducible export over repeatedly clicking through the GUI.

Our portable tooling lives under:

xemu-perf-tests/utils/wpa-attribution/

See the repository README there for the source-pinned implementation.

Derive a bounded WPA profile

python3 derive-wpa-profile.py \
  --seed-profile "$SEED_PROFILE" \
  --output-profile "$PROFILE" \
  --manifest "$PROFILE_MANIFEST" \
  --pid "$PID" \
  --process-name "$PROCESS_NAME" \
  --pfifo-tid "$PFIFO_TID"

The accepted profile should contain the intended graph types and filters. If the PFIFO TID is not yet proven, omit --pfifo-tid and use the broad sampled-CPU export only for discovery.

Do not select PFIFO merely because a thread has the largest sample total. Use thread name or an independent source-exclusive identity proof.

Export the saved ETL

Run on the Windows analysis host:

powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -File .\invoke-wpa-export.ps1 `
  -Exporter $ExporterPath `
  -Etl $EtlPath `
  -Profile $ProfilePath `
  -OutputDirectory $FreshOutputDirectory `
  -StartNs $StartNanoseconds `
  -EndNs $EndNanoseconds `
  -Prefix $OutputPrefix `
  -ExpectedCsvCount 3 `
  -MaximumOutputBytes 268435456

Read the export result

An exporter process returning exit code 0 is not enough.

Require the wrapper/manifest to confirm:

  • correct ETL hash;
  • correct profile hash;
  • correct exporter/tool identity;
  • exact requested time range;
  • expected CSV count;
  • no error markers;
  • complete final CSV records/terminal line ending;
  • expected row counts;
  • no owned exporter process left behind.

We observed a WPA raw export that returned exit code 0 while logging an export error and stopping mid-row after 7,804 complete records. Those totals were rejected.

That is why export integrity is part of the analysis, not housekeeping.


Boundaries and common mistakes

Use a fresh output directory and a bounded wrapper. Exit code zero alone is insufficient: verify expected tables, row counts, terminal records, hashes, error markers, size limits, and owned-process cleanup.

A filtered export cannot answer questions excluded by its profile. Preserve the profile and manifest with the CSV files.

Evidence to retain

  • Tool name and exact version.
  • Source commit/tree and executable SHA-256.
  • The complete command or saved profile used.
  • Input artifact hashes and the explicitly selected time or address range.
  • Raw output plus any derived report; do not retain only a screenshot or conclusion.
  • Admission failures, warnings, dropped events, incomplete rows, or unsupported operations.

Official references

Related xemu guides

Clone this wiki locally