The Executive Profile Object

The EPROFILE structure is the kernel’s representation of an executive profile object such as can be created from user mode by the NtCreateProfile and NtCreateProfileEx functions and worked with through the NtStartProfile and NtStopProfile functions.

The name EPROFILE is hypothesised, Microsoft’s name not being known even from symbol files. That is some measure of the structure’s being internal to the kernel. Against that, however, is that the structure does model a formal object that exists precisely so that a handle can be obtained from user mode. As for any handle, it can be useful to inspect the corresponding object when doing kernel-mode debugging. Indeed, any user-mode program that knows the handle can obtain the kernel-mode address of the object via NtQuerySystemInformation without needing unusual privilege and can even read from the address with the help of a kernel-mode driver (which sounds more demanding than it often is).

Layout

Though the EPROFILE is too internal to be described even in symbol files, it is almost as stable as many a documented structure, presumably as a side-effect of its very tightly constrained use. After version 3.51 allowed for specification of the profile source and of which processors will have their execution profiled, the only formal change is for Windows 7 to support more than 32 or 64 processors by way of processor groups. That the size then increases for 64-bit Windows 8 is simply from allowing for more processor groups.

The layout below does not attempt any C-language definition of members as if such things can be inferred from type information in symbol files. Types in a fixed-pitch font as if for programming are ventured only where the member is copied from a function argument such that Microsoft’s choice of formal type is known and plausibly (but not certainly) passes into the structure.

PVOID

SIZE_T

ULONG *

ULONG

ULONG

Appended for Version 3.51

KPROFILE_SOURCE