Exclusions from tracing

By default, TinyTracer logs all API calls. In some cases, we want to filter out the log to reduce the noise. We can do it by defining a list of exclusions.

Two levels of exclusion are available:

• per module
• per function

If the function is excluded, the call to it will not be listed in the .tag file. Also, the parameters of the function will not be dumped (even if it was defined in params.txt).

If the full module is excluded, the above will be applied to each and every function that was called from it.

Global and local exclusion lists

TinyTracer allows to provide two types of exclusion lists:

• global (excluded.txt, defined in install32_64 )¹
• local: ([module].[ext].excluded.txt) relative to the traced module, provided in the same directory where the TAG file will be generated

Both lists follow identical format.

¹ It is possible to change the default path, which is explained in the next paragraph.

Changing the path to the global list

By default, this list is expected to be in install32_64/excluded.txt. The default path can be changed in run_me.bat (Winows) or tiny_runner.sh (Linux), by editing analogous lines:

rem List of functions that will be excluded from logging
set EXCLUDED_FUNC=%PIN_TOOLS_DIR%\excluded.txt

Exclusion format

Excluding a module

If we want to exclude a full module, we can simply add its name to the list:

[module_name]

Excluding a function

In case of more targeted exclusions, that filter out only specific calls from a specific modules, it can be defined in the following way (; is the delimiter):

[module_name];[func_name]

Example:

kernelbase;InitializeCriticalSectionEx

Demo

1. The tracelog of a demo application, before the exclusions were defined:

7f56c;section: [.text]
7f5a4;CPUID:0
7f602;CPUID:1
7f69d;CPUID:7
82c4c;kernel32.LoadLibraryExW
82ce3;kernel32.GetProcAddress
GetProcAddress:
	Arg[0] = ptr 0x00007ff81b340000 -> {MZ\x90\x00\x03\x00\x00\x00}
	Arg[1] = ptr 0x00007ff621e5a5d8 -> "InitializeCriticalSectionEx"

82c4c;kernel32.LoadLibraryExW
82ce3;kernel32.GetProcAddress
GetProcAddress:
	Arg[0] = ptr 0x00007ff81b340000 -> {MZ\x90\x00\x03\x00\x00\x00}
	Arg[1] = ptr 0x00007ff621e5a5a0 -> "FlsAlloc"

82da7;kernelbase.FlsAlloc
[...]

2. We exclude function GetProcAddress from tracing.

excluded.txt:

kernel32;GetProcAddress

The tracelog:

7f56c;section: [.text]
7f5a4;CPUID:0
7f602;CPUID:1
7f69d;CPUID:7
82c4c;kernel32.LoadLibraryExW
82c4c;kernel32.LoadLibraryExW
82da7;kernelbase.FlsAlloc

The entries corresponding to the GetProcAddress are now excluded from the tracelog.