Collection failed - [Instrumentation Engine]: SYSCALL_INSPECTOR:

[Marek_K_1]

Hello,
for any kind of profiling, after my application finishes, I get:

[Instrumentation Engine]: SYSCALL_INSPECTOR: The
NTDLL!NtSetContextThread function jumps out of NTDLL, at 0x077960400.
It may be hooked by a PIN-incompatible software installed on the system
Incompatible operating system or incompatible software installed on the
system Pin is exiting due to fatal error

What can cause that?

Thanks, Marek.

[David_A_Intel1]

Please try building and profiling one of the sample apps included in the VTune Amplifier installation, for example, tachyon or matrix.  See "C:\Program Files (x86)\Intel\VTune Amplifier XE 2015\samples\en\C++", if you installed in the default location.

If it works, something is weird with your app.  If it produces the same error, something is weird with your OS. :p

I've never seen this error or heard of it being reported before, so I have no idea what is happening, but the message seems to be pretty self-explanatory.  Best to run 'amplxe-feedback -create-bug-report report.zip' from a writable directory and submit an issue at our free, secure technical support website, Intel® Premier Support.  

Please include some information about your application, as well.  For example, is it C, C++, C#, Fortran?  Does it use COM?  Is it a Windows* service?  Are you attaching to the application after it starts or configuring VTune Amplifier to launch the application?

Since there is some conflict with PIN, does your app contain self-modifying code?  Does it JIT any code?

[Marek_K_1]

Hello Mr Anderson,
thanks for reply. I will try your suggestion with sample apps later this day. For now I can tell that it was simple C++, no COM, no Windows service. Application starts by VTune, I'm not attaching to running appplication. No JIT. Just simple multithreading app compiled on Visual Studio 20113.
I'm using 30-day trial so have no special expectations - just wanted to see how that profiler works. Additionally I can tell that couple of first attempts gives proper reports but at some point VTune started to print out that error message and for now just don't work.

Additionally can you explain me what is "PIN-incompatible software"?

Thanks!

[Alexey_B_Intel]

Hi Marek,

This may happen if the application you are trying to profile is hooked by Antivirus sofware. You may check Antivirus settings and modify it to explicitly ignore the application process.

Regards,

Alexey

[Marek_K_1]

Hello Alexey, thanks for advise, I had also an idea that antivirus can be a problem, I'm using Avast Antivirus, so I turned it off till next PC restart, unfortunately, it did not help. Regards, Marek

[Peter_W_Intel]

@ Marek

As Alexey said, this issue was caused by Anti-virus SW which might had a patch of ntdll.dll, so VTune Amplifier (use PIN technology) cannot do dynamical instrumenting. Sometime it is hard to say it was caused by Anti-virus SW, maybe virus or other 3rd-party SW.

The solution are:

1. Uninstall 3rd-party SW if you can doubt it.

2. You still can use other event-based sampling (e.g. advanced-hotspots), all user-mode samplings (basic-hotspots, concurrency, locksandwaits) don't work, because they will use PIN technology.

3. Find another machine, which install a few 3rd-party SW. 

[Marek_K_1]

Hi All,
Thank you for your help, complete uninstallation of antivirus software (Avast) solved the issue, turning off AV protection (as I did previously) is not enough.

Thanks again,
Regards,
Marek

[Bernard]

..>>>turning off AV protection (as I did previously) is not enough.>>>

Probably because of hooks still present in import/export tables.