• Convergence Security Journal
• /
• v.18 no.5_1
• /
• pp.67-73
• /
• 2018

From a software engineering point of view, tracing is a special form of logging that records program execution information. Tracers using dedicated hardware are often used because of the characteristics of tracers that need to generate and decode huge amounts of data in real time. Intel(R) PT uses proprietary hardware to record all information about software execution on each hardware thread. When the software execution is completed, the PT can process the trace data of the software and reconstruct the correct program flow. The hardware trace program can be integrated into the operating system, but in the case of the window system, the integration is not tight due to problems such as the kernel opening. Also, it is possible to trace only a single process and not provide a way to trace multiple process streams. In this paper, we propose a method to extend existing PT trace program to support multi - process stream traceability in Windows environment in order to overcome these disadvantages.