Trace Chromium Network Traffic: RayFo/Chromium

[R Fowkes (rayfo)]

Trace Chromium Network Traffic: Chrome, Edge, WebView2 browsers

This commit adds the "Chromium" protocol class to the main NetBlame data table (in addition to WinINet, WinHTTP, Winsock, TcpIp).
It also adds a new Chromium-specific table: "NetBlame Chromium Requests"
In the DEBUG build (enable AUX_TABLES) there is also a table oriented around HTTP2/3 Streams.

It enables these Providers for Chrome, Edge, WebView2:

{d2d578d9-2936-45b6-a09f-30e32715f42d} : Google.Chrome
{3A5F2396-5C8F-4F1F-9B67-6CCA6C990E61} : Microsoft.MSEdgeStable
{BD089BAA-4E52-4794-A887-9E96868570D2} : Microsoft.MSEdgeBeta
{C56B8664-45C5-4E65-B3C7-A8D6BD3F2E67} : Microsoft.MSEdgeCanary
{D30B5C9F-B58F-4DC9-AFAF-134405D72107} : Microsoft.MSEdgeDev
{E16EC3D2-BB0F-4E8F-BDB8-DE0BEA82DC3D} : Microsoft.MSEdgeWebView2

Update NetBlame Add-in
Add Chromium ETW processing:
.\src\netblame\providers\chromium.cs
.\src\netblame\gathertables.cs
.\src\netblame\tables\netblametable.url.cs
.\src\netblame\netblamedataprocessor.cs
.\src\netblame\auxiliary\callstack.cs
.\src\netblame\auxiliary\extensions.cs
.\src\netblame\auxiliary\netutil.cs
Minor Update:
.\src\netblame\providers\dnsclient.cs
.\src\netblame\providers\winsockafd.cs
Nits:
.\src\netblame\providers\tcpip.cs
.\src\netblame\tables\netblametable.webio.request.cs
.\src\netblame\tables\netblametable.winsock.cs
.\src\netblame\tables\tablebase.cs

Update Scripts
PowerShell:
.\src\tracenetwork.ps1
.\src\beta\tracenetwork.ps1
WPR Profiles:
.\src\wprp\edgechrome.15002.wprp
.\src\wprp\edgechrome.wprp
Comments for Build:
.\src\netblame\.editorconfig

BUILD
RELEASE: dotnet build -c RELEASE
DEBUG: dotnet build -c DEBUG -p AUX_TABLES=1

TEST
Capture a trace:
.\src\TraceNetwork Start
Launch Edge or Chrome and navigate to a site.
.\src\TraceNetwork Stop

The script knows how to pick up the built version of the NetBlame add-in:
.\src\BETA\TraceNetwork View -fastsym -verbose

This update resolves #50
Chromium Integration into NetBlame WPA Network Plug-in

[R Fowkes (rayfo)]

Harold Pratt (@htpiv)   Rob Grimes (@rgrimes-ms)   Can you please take a look and approve the pull to main?

I'll update the documentation once there's a new build.
Chromium Network Tracing

Thank you!

[R Fowkes (rayfo)]

FYI, WPA (x64 or ARM64) loads these modules as provided by the NETBLAME installation.
We should make sure that the auto-build includes at least these:

	\BETA\ADDIN\NetBlameAddIn.dll
	
	\BETA\ADDIN\Dia2Lib.dll
	\BETA\ADDIN\Microsoft.Diagnostics.FastSerialization.dll
	\BETA\ADDIN\Microsoft.Diagnostics.NETCore.Client.dll
	\BETA\ADDIN\Microsoft.Diagnostics.Tracing.TraceEvent.dll
	\BETA\ADDIN\Microsoft.Extensions.DependencyInjection.Abstractions.dll
	\BETA\ADDIN\Microsoft.Extensions.DependencyInjection.dll
	\BETA\ADDIN\Microsoft.Extensions.Logging.Abstractions.dll
	\BETA\ADDIN\Microsoft.Extensions.Logging.dll
	\BETA\ADDIN\Microsoft.Extensions.Options.dll
	\BETA\ADDIN\Microsoft.Extensions.Primitives.dll
	\BETA\ADDIN\Microsoft.Windows.EventTracing.Events.dll
	\BETA\ADDIN\Microsoft.Windows.EventTracing.Metadata.dll
	\BETA\ADDIN\Microsoft.Windows.EventTracing.Processes.dll
	\BETA\ADDIN\Microsoft.Windows.EventTracing.Processing.dll
	\BETA\ADDIN\System.Collections.Immutable.dll
	\BETA\ADDIN\System.Reflection.Metadata.dll
	\BETA\ADDIN\System.Text.Encodings.Web.dll
	\BETA\ADDIN\System.Text.Json.dll
	\BETA\ADDIN\TraceReloggerLib.dll

	\BETA\ADDIN\x64\wpt\msdia140.dll
	\BETA\ADDIN\x64\wpt\perf_dynamic.dll
	\BETA\ADDIN\x64\wpt\perf_nt.dll
	\BETA\ADDIN\x64\wpt\perfcore.dll
	\BETA\ADDIN\x64\wpt\symcache.dll
	\BETA\ADDIN\x64\wpt\symsrv.dll

	\BETA\ADDIN\arm64\wpt\msdia140.dll
	\BETA\ADDIN\arm64\wpt\perf_dynamic.dll
	\BETA\ADDIN\arm64\wpt\perf_nt.dll
	\BETA\ADDIN\arm64\wpt\perfcore.dll
	\BETA\ADDIN\arm64\wpt\symcache.dll
	\BETA\ADDIN\arm64\wpt\symsrv.dll

[R Fowkes (rayfo)]

Quick Steps to Download, Build, and Run this version/PR via PowerShell:

• Download and unzip the Source Code:

  • Invoke-WebRequest -uri "https://github.com/microsoft/MSO-Scripts/archive/refs/pull/52/merge.zip" -outfile "$Env:TEMP\Pull52.zip"
  • Expand-Archive -path "$Env:TEMP\Pull52.zip" -destinationpath "$Env:TEMP"
  • mv "$Env:TEMP\MSO-Scripts-refs-pull-52-merge\" "c:\MSO-Scripts\"

• If needed, install DotNet (v8, 9, or 10) (only required when building the 'NetBlame' WPA Plug-In locally):

  • winget install --id Microsoft.DotNet.Runtime.10
  • winget install --id Microsoft.DotNet.SDK.10

• Build the WPA Plug-in:

  • cd "c:\MSO-Scripts\src\NetBlame"
  • & $Env:ProgramFiles\dotnet\dotnet build -c Release

• Collect a Network Trace (requires Administrator privilege):

  • cd "c:\MSO-Scripts\src"
  • .\BETA\TraceNetwork.bat Start
  • Launch Chrome or Edge and visit a site.
  • .\BETA\TraceNetwork.bat Stop

• If needed, download the Windows Performance Analyzer (WPA)

• Launch the Viewer:

  • .\BETA\TraceNetwork.bat View
  • Within WPA: New Tab
  • Within WPA's Graph Explorer (Ctrl-G): Network > dbl-click: NetBlame Chromium Requests

[R Fowkes (rayfo)]

src\netblame\providers\chromium.cs Dispatch_Connect()

case "CONNECT_JOB":
  soc.cxn.cbSend = soc.cxn.cbRecv = 0;
What happens between CONNECT_JOB.Begin/.End is known to be Chromium connection overhead (usually SSL), not HTTP object/data transfer.
Due to Chromium optimizations, the Socket could get abandoned, and therefore the Socket's cbSend/Recv will surface in the default NetBlame table as a standalone Socket. But we don't want to leave the impression of Chromium/HTTP data traffic being orphaned, so zero what Chromium handshake overhead traffic was collected to that point.

src\netblame\providers\winsockafd.cs Connection Clone()

cxn.iDNS = 0;
We clone a Winsock Connection and give it a different remote address. But we also need to zero its iDNS, which indexes the DNS record which contains that address. (When cxn.iDNS==0, it gets updated later.)

src\netblame\gathertables.cs
src\netblame\providers\dnsclient.cs IFindAddress()

int iAddr = dnsE.rgIpAddr.IndexOf(ipAddr);
Simplify IFindAddress, which is currently invoked from only one place. Fail if the address is not found in the indexed DNS record, which should not happen [see above].

src\netblame\providers\tcpip.cs FMatch()

if (this.FClosed) return false;
Each WinSock Connection should link with a TCP or UDP object. We were getting inconsistencies because FMatch was considering UDP connections already closed.

src\netblame\readme.md

Rewrite NetBlame/ReadMe.md to include:

• Updated list of ETW Providers processed
• Updated, more detailed steps for building and running the NetBlame plug-in
• Instructions for debugging under vscode
• A list of NetBlame graphs/tables available

[Ricardo Esquivel (richybourne)]

Resubmitting "request changes" PR review on GH account with access to repo.