Cannot load data file (data file is corrupted)

[Ida_Norderhaug_D_]

I just installed VTune Amplifier XE 2015. Trying to run the tachyon tutorial example I get the error: "Cannot load data file `D:\tmp\r000hs\data.0\7576-2976.0.trace' (Data file is corrupted)." I also get the warning: "Cannot find data to precompute. Skipping the precomputation step."

I tried to follow the instructions in this thread: https://software.intel.com/en-us/forums/topic/279872. This did not help. I am running VTune Amplifier XE 2015 Update 1 through Visual Studio 2010 on Win7. Running as an administrator does not help. Changing results directory does not help. Disabling "high accurate cpu time" does not help.

Command line:

"C:\Program Files (x86)\Intel\VTune Amplifier XE 2015\bin32\amplxe-cl" -collect hotspots -app-working-dir D:\tmp --search-dir sym=C:\Users\INOD\Desktop\tmp_vtune\tachyon\vc10\find_hotspots_x64_Release --search-dir sym=C:\Users\INOD\Desktop\tmp_vtune\tachyon\vc10 --search-dir sym=srv*C:\Users\INOD\AppData\Local\Temp\SymbolCache --search-dir sym=srv*C:\Users\INOD\AppData\Local\Temp\SymbolCache*http:\\msdl.microsoft.com\download\symbols --search-dir sym=C:\Users\INOD\Desktop\tmp_vtune\tachyon\vc10\analyze_locks_x64_Release -- C:\Users\INOD\Desktop\tmp_vtune\tachyon\vc10\find_hotspots_x64_Release\find_hotspots.exe

[Ida_Norderhaug_D_]

Would it help to reinstall Windows?

[Marián__VooDooMan__M]

Ida Norderhaug D. wrote:

Would it help to reinstall Windows?

IMHO to reinstall Windows* is overhead. IMHO it should be sufficient to uninstall antivirus software, which is not costly than reinstalling Windows*.

[Marián__VooDooMan__M]

Marián "VooDooMan" Meravý wrote:

Quote:

Ida Norderhaug D. wrote:

Would it help to reinstall Windows?

IMHO to reinstall Windows* is overhead. IMHO it should be sufficient to uninstall antivirus software, which is not as costly than reinstalling Windows*.

[Bernard]

Ida Norderhaug D. wrote:

Thank you so much for your help. This is becoming a bit advanced for me though. So I should check for hooks, and if I find them we need to find a way to remove them? A short guide on how to check for hooks would help. Thanks!

You can use free anti-rootkit software for doing that. Another option is to use windbg !chkimg metacommand which will compare currently loaded ntdll.dll with the "clean" version.

[Marián__VooDooMan__M]

iliyapolak wrote:

Quote:

Ida Norderhaug D. wrote:

Thank you so much for your help. This is becoming a bit advanced for me though. So I should check for hooks, and if I find them we need to find a way to remove them? A short guide on how to check for hooks would help. Thanks!

You can use free anti-rootkit software for doing that. Another option is to use windbg !chkimg metacommand which will compare currently loaded ntdll.dll with the "clean" version.

@iliyapolak: just out of my couriosity, please could you mention the name(s) of anti-rootkit SW ? are they FOSS or proprietary? I am really interested in it, though I need it for something else. Please, could you mention one/few of such SW?

TIA!

[Ida_Norderhaug_D_]

Marián "VooDooMan" Meravý wrote:

Quote:

Ida Norderhaug D. wrote:

Would it help to reinstall Windows?

IMHO to reinstall Windows* is overhead. IMHO it should be sufficient to uninstall antivirus software, which is not costly than reinstalling Windows*.

I do not have permission to uninstall antivirus software on my computer. Also, it doesn't seem like a good idea to uninstall antivirus software. Or am I misunderstanding?

I might have to re-install Windows anyway because of another issue..

[Robert_L_Intel1]

Peter's comments also provide a means of testing for the hooks in ntdll.  IOW, if advanced hotspots works and basic does not, then it's possible you do have a hook in ntdll that's causing a problem.  I don't see where you tried advanced hotspots.  Did you?  That is a quick way, other than using windbg and rootkit tools and such.

In most cases, you can disable the anti-virus product selectively.  However, in order to remove the hook, you may have to boot into safe mode, change the AV configuration and then reboot again.  So, you could try to disable the AV software only for vtune and other target processes, assuming you do determine that as the cause using the methods above.  You can also use process explorer to see what libraries are getting loaded in the target processes.  If they are AV software libraries, they are probably hooks.

It should only be a problem when it hooks the ntdll.dll or user32.dll that's loaded into the target process and/or the amplifier process, unless you are profiling the whole system, maybe.

[Robert_L_Intel1]

Oh, okay, I see it now.  So, yes, you can also use process explorer to look for hook DLLs.  However, before you re-install the OS, unless, as you said, you have another reason to do so, you might try booting into safe mode and re-configuring the AV software to ignore amplifier and target process(es).

[Bernard]

Marián "VooDooMan" Meravý wrote:

Quote:

iliyapolak wrote:

Quote:

Ida Norderhaug D. wrote:

Thank you so much for your help. This is becoming a bit advanced for me though. So I should check for hooks, and if I find them we need to find a way to remove them? A short guide on how to check for hooks would help. Thanks!

You can use free anti-rootkit software for doing that. Another option is to use windbg !chkimg metacommand which will compare currently loaded ntdll.dll with the "clean" version.

@iliyapolak: just out of my couriosity, please could you mention the name(s) of anti-rootkit SW ? are they FOSS or proprietary? I am really interested in it, though I need it for something else. Please, could you mention one/few of such SW?

TIA!

One of the recommended standalone anti-rootkit is Sysinternals "Rootkit Revealer". I would rather choose more comprehensive AV software like those one from Symantec or Kaspersky.

[Bernard]

@Ida

I posted link to Mark Russinovich (developer of Process Explorer) blog where you can follow his advise and articles on how to use his tools

http://blogs.technet.com/b/markrussinovich/archive/2011/05/10/3422212.aspx

[shahnejat__ahmad]

Hi,

I am using "Intel System Studio-->Intel VTune 2018" to profile and derive the control flow dependencies by making use of the Intel_PT PMU under the system:

Kernel: 4.15.0-13-generic, 64bit Ubuntu

CPU: Intel® Core™ i7-7820X @ 3.60GHz × 16 

I started with the following commands:

1- amplxe-perf record -o a.perf -T -e intel_pt// -- ps

  PID TTY          TIME CMD
21471 pts/1    00:00:00 amplxe-perf
21472 pts/1    00:00:00 ps
58693 pts/1    00:00:00 sudo
58694 pts/1    00:00:00 su
58695 pts/1    00:00:00 bash
[ perf record: Woken up 2 times to write data ]
[ perf record: Captured and wrote 3.154 MB a.perf ]

2- amplxe-cl -import a.perf -r folder

amplxe: Importing a new result 100 % done                                      
amplxe: Using result path `/home/amad/May2/folder'
amplxe: Executing actions 12 % Loading 'a.perf' file                           
amplxe: Error: Cannot load data file `/home/amad/May2/folder/data.0/a.perf' (Data file is corrupted).
amplxe: Executing actions 50 % done                                            
amplxe: Error: 0x4000001e (Cannot load raw collector data)

Although intel_pt data has not been successfully imported, the data for other kernel PMU events like "cpu-cycles" and "instructions" could be properly handled:

1- amplxe-perf record -o p.perf -T -e cpu-cycles,instructions -- ps

  PID TTY          TIME CMD
 8410 pts/0    00:00:00 sudo
 8458 pts/0    00:00:00 amplxe-perf
 8467 pts/0    00:00:00 ps
[ perf record: Woken up 1 times to write data ]
[ perf record: Captured and wrote 0.024 MB p.perf (96 samples) ]

2- amplxe-cl -import p.perf -r r2

amplxe: Importing a new result 100 % done                                      
amplxe: Using result path `/home/amad/r2'
amplxe: Executing actions 19 % Resolving information for `libprocps.so.6.0.0'  
amplxe: Warning: Cannot locate debugging information for file `/lib/x86_64-linux-gnu/libprocps.so.6.0.0'.
amplxe: Executing actions 21 % Resolving information for `vmlinux'             
amplxe: Warning: Cannot locate debugging information for the Linux kernel. Source-level analysis will not be possible. Function-level analysis will be limited to kernel symbol tables. See the Enabling Linux Kernel Analysis topic in the product online help for instructions.
amplxe: Executing actions 75 % Generating a report                             
Collection and Platform Info
----------------------------
Parameter         r2                                  
----------------  ------------------------------------
Operating System  4.15.0-13-generic                   
Computer Name     amad-pc                             
Result Size       2766877                             
Collector Type    Driverless Perf per-process sampling

CPU
---
Parameter          r2        
-----------------  ----------
Frequency          3600000000
Logical CPU Count  16        

Summary
-------
Elapsed Time:             0.011
Paused Time:              0.0  
CPU Time:                 0.011
Average CPU Utilization:  0.897

Event summary
-------------
Hardware Event Type  Hardware Event Count:Self  Hardware Event Sample Count:Self  Events Per Sample
-------------------  -------------------------  --------------------------------  -----------------
cpu-cycles                            40521584                                45  4000             
instructions                          36302909                                51  4000             
amplxe: Executing actions 100 % done

What is wrong with Intel_pt data?

Thanks