topic Quote:Vadim K. wrote: in Software Tuning, Performance Optimization & Platform Monitoring

Question about the Intel Performance Counter Monitor

Yen-Yu_C_ — Tue, 10 Mar 2015 15:24:49 GMT

Hello

I want to use PCM to monitor the performance of the program.

I follow the instructions described in the document and have built PCM.exe and got msr.sys.

Howerver, when I run the PCM.exe, it shows messages as follows

Intel(r) Performance Counter Monitor V2.8 (2014-12-18 12:52:39 +0100 ID=ba39a89)

Starting MSR service failed with error 1275 This driver has been blocked from loading
Trying to load winring0.dll/winring0.sys driver...
Failed to load winring0.dll/winring0.sys driver.

Cannot access CPU counters
You must have signed msr.sys driver in your current directory and have administrator rights to run this program
Access to Intel(r) Performance Counter Monitor has denied (no MSR or PCI CFG space access).

Can anyone tell me how to deal with it?

Thanks.

Thank you for using Intel PCM

Thomas_W_Intel — Tue, 10 Mar 2015 16:14:08 GMT

Thank you for using Intel PCM.

> You must have signed msr.sys driver in your current directory and have administrator rights to run this program

Did you sign your msr.sys driver and run pcm.exe as administrator? Otherwise, Windows will refuse to load the driver.

Microsoft also provides a way to disable this requirement, e.g. during driver development. The process is described on their website.

An alternative to building your own driver is using the signed third-party driver WinRing0.sys. Please refer to the Windows HowTo that is included in the PCM package.

Adding on to Thomas Reply,

Prasanna_Subburaj — Sun, 19 Apr 2015 01:36:29 GMT

Adding on to Thomas Reply,

You can download WinRing0.dll,WinRing0.sys,WinRing0x64.dll,WinRing0x64.sys from

http://www.techpowerup.com/realtemp/

and winpmem_64.sys from

https://code.google.com/p/volatility/source/browse/branches/scudette/tools/windows/winpmem/binaries/amd64/winpmem_64.sys?r=2615 ;

and paste them all in the place where you have your pcm.exe and run it as administrator to see the result

Hi All

Vadim_K_2 — Wed, 29 Jun 2016 12:47:49 GMT

Hi All

I write about winpmem_64.sys .

link from previous message is wrong =((( https://code.google.com/p/volatility/source/browse/branches/scudette/tools/windows/winpmem/binaries/amd64/winpmem_64.sys?r=2615

Where can I download this file to a different location?

Good wishes,Vadim

Quote:Vadim K. wrote:

Erons_O_ — Tue, 05 Jul 2016 07:04:41 GMT

Vadim K. wrote:

Hi All

I write about winpmem_64.sys .

link from previous message is wrong =((( https://code.google.com/p/volatility/source/browse/branches/scudette/too...

Where can I download this file to a different location?

Good wishes,Vadim

Hey Vadim K,

This is the new location

https://github.com/google/rekall/tree/df4c820de7b3a21bd241336c99c12b3b9dde4015/tools/pmem/resources/winpmem

Change the name from winpmen_x64 to winpmen64.

Best Regards,

EronsJ