Symbolic Debugger — Windows Performance Analyzer

Start small

Jerry Ho
Jerry Ho
Sep 9, 2018 · 3 min read
Seriously, this one’s too hard to me (at least for now).

My graduation thesis’s not finished yet, but I still wanna learn something quick as … a leisure activity I guess?

Credit to Tom Wijsman for giving me idea about it.

I got to debug my 6 years old Windows 10 installation, since an image viewer called XnView takes ~10 seconds to open various sizes of files, no exception.

That’s definitely not right even considered the spec of my (rather old AM3+) PC.


Choose the right tool

This neat tool enables you to record and log x86/x86–64 windows application behavior. IDA pro, static analysis or dynamic analysis are not suitable for me, since the learning curve is very steep.

By following this guide, and a little bit of google research, I successfully separated the issue out of this case.


Stuck, side channel it

In the beginning, it took me a lot of time to solve the issue of symbol not found.

Qt5WidgetsXn.dll!<PDB not found>
Tough issue

Although in the end I did not solve it, cause it’s very troublesome — check this post: https://bugreports.qt.io/browse/QTBUG-3934

I will not jump into yet another deep deep rabbit hole only to get the symbolic file for debugger.

Finally, by looking other system calls, I figured out what’s happening on my Windows machine.


Filtering

It took a while to figure out the idea and flow of process call / process stack, since I don’t have a solid CS background.

This diagram really helped, visualization rules!

Assuming the XnView release itself is fine, the problem definitely lies in my windows installation. Therefore, I need to filter out the longest wait() system call to see if it’s a single reason bottleneck, or a series of complex interactions which caused the sluggishness of XnView.

7+ whole seconds, feels like forever.

HOW on earth is this related to an image viewer?

I refuse to believe it. But it’s real.

After poking and filtering with the overly detailed log, I finally found the problem.

It seems that I simply installed too many fonts.

You can see the calls in the image. While hard to believe, the truth is that after I deleted 150~250 fonts and rebuild the font cache, It only took 2 seconds to open an image now. 400% increase.

YAY.

So once again, the day is saved! Thanks to the Powerpuff Girls!


Of course, maybe one should blame the way QTQt5GuiXn.dll interacted with font. Also I’ve heard that photoshop suffered the same issue.

But that’s the research topic for another day.

Jerry Ho

A cryptographer, rigorous defender of civil liberties on blockchain. Trilingual in Mandarin, Japanese and English, I embrace the idea of self-sovereign identity.

Jerry Ho

Written by

Jerry Ho

A cryptographer, rigorous defender of civil liberties on blockchain. Trilingual in Mandarin, Japanese and English, I firmly believe in self-sovereign identity.

Jerry Ho

Jerry Ho

A cryptographer, rigorous defender of civil liberties on blockchain. Trilingual in Mandarin, Japanese and English, I embrace the idea of self-sovereign identity.