dotnet clr: I'm using the clr profiling API to monitor function enter and leave events.
For some applications I'm profiling the number of enter and leave events does
not match which makes it impossible to maintain a shadow stack. All events
are synchronized using a critical section.

Any ideas?

Thanks

Hi,

Are you sure all function leaves should be called?, here are several reasons
for Getting more function enters then function leaves:
1. The application generate a system exception ( e.g. __try __except fashion
) and implement an Unhandled exception handler, this way, even if the
exception information is showed or handled the function generated the
exception will not execute code following the code that triggered the
exception, a good sample for such an exception is access violation exception.
2. The executing thread is terminated in an abnormal fashion such as
TerminateThread although I am not sure if System.Threading.Thread.Abort uses
TerminateThread internally, this could easily be verified through the rotor
implementation of the cli ( look for sscli in google ).
3. Process cleanup is not done correctly, e.g. upon process termination not
all of the contained threads are being shutdown gracefully ( e.g.
....Thread.Join )

If still you suspect the Profiling API you can instrument the managed
methods your-self by adding header & footer to their IL code, this could be
done through the 'JITCompilationStarted' callback of the ICorProfilerCallback
interface in combination with 'GetFunctionInfo' and 'GetILFunctionBody' of
the ICorProfilerInfo interface.

Hope this helps

Nadav
http://www.ddevel.com

[quoted text, click to view]