Skip to content

v0.8.8 — symbols strict-GUID matching + capture memory-mode selection

Choose a tag to compare

View all tags
@nijosmsft nijosmsft released this 26 Jun 21:16
v0.8.8
8a736ee

etw-mcp v0.8.8 — Combined Symbols + Capture-Profiles Release

This is a combined release covering two streams of parity work that landed together:

fix(symbols): Strict GUID+Age PDB matching — check_symbols & diagnose now always agree (#29)

Fixes nijosmsft/mcp-servers#3, #8, #15, #19, #21.

The root cause across the symbols stream: check_symbols trusted a cached SymbolSource="pdb" without verifying the PDB on disk matched the trace's RSDS GUID+Age, causing it to disagree with diagnose_symbol_load. All tools now apply the same strict GUID+Age rule and match on the authoritative symstore folder name (<GUID32><hexAge>), readable even for MSFZ-compressed PDBs.

Fixes:

  • #3 — New MISMATCHED_PDB status; tcpip.sys/afd.sys now correctly flagged (was false-OK). diagnose_symbol_load is folder-name aware; ntoskrnl.exe MSFZ folder match stays trusted. The two tools never disagree for the same module/trace.
  • #3 (secondary) — read_pdb_signature reads PDB Info Stream (stream 1) not stream 0, fixing GUID misread on normal PDBs.
  • #8 — resolve_symbols prefers native in-process symbolizer; xperf access-violation (0xC0000005) detected and reported gracefully.
  • #15 / #19 — check_symbols surfaces PRE_RESOLVED for dotnet pre-symbolized rows instead of false 0% / MISSING.
  • #21 — Stack rebuild warns clearly when symbolizer raises on bulk_resolve instead of silently producing all-unknown frames.

Tests: 16 new symbol regression tests (test_symbols_regression.py). Full suite post-merge: 1108 passed / 16 skipped.

feat(capture): First-class memory logging-mode selection on capture tools (#30)

Fixes nijosmsft/mcp-servers#9.

get_capture_commands and get_capture_instructions now accept a mode parameter ("file" default | "memory"). Previously, memory-mode captures required hand-editing; wpr -start <p>.wprp (no -filemode) silently failed with 0xc5584017 for callers who didn't realize file mode was hard-wired.

Behaviour:

  • mode="memory" — live wpr -start <profile>.wprp with no -filemode, selecting the bundled LoggingMode="Memory" variant (fixed-size RAM ring, merged to ETL at -stop). Preferred for high-rate captures where file mode drops events.
  • mode="file" — existing -filemode behaviour (safe default; no caller breakage).
  • Unselected mode rendered as a commented-out alternative in the PowerShell block.
  • Unknown mode → friendly error. pktmon ignores mode (no WPR logging mode).

Tests: 7 new capture-profile mode tests. Full suite post-merge: 1111 passed / 16 skipped.

Assets

  • etw_mcp-0.8.8-py3-none-any.whl — installable wheel
  • etw_mcp-0.8.8.tar.gz — source distribution
Assets 4
Loading