2009-05-06, 10:22 PM
Found the counter addresses in the dump at 001e59dc... now just need to figure out where that address actually is from inside the exe address space (dump has the entire wincrt runtime included)
Also the counters are stored on a 32bit stride (which I guessed might be the case -- though I assumed like 00AB00AC00AB, whereas they're AB00AC00AB00) Dunno if the intermediary bits are used for anything. They're all 00 in my dump.
Hopefully I can use this free trial download I have to find out what the start of the SoM's address space proper looks like...
Also the counters are stored on a 32bit stride (which I guessed might be the case -- though I assumed like 00AB00AC00AB, whereas they're AB00AC00AB00) Dunno if the intermediary bits are used for anything. They're all 00 in my dump.
Hopefully I can use this free trial download I have to find out what the start of the SoM's address space proper looks like...