[GH-ISSUE #2370] [Feature] Inspect caller-selected recorded EventPipe traces #784

New issue

Open

opened 2026-10-15 18:28:20 +00:00 by bsakaguchi · 1 comment

bsakaguchi commented

2026-10-15 18:28:20 +00:00

Owner

Originally created by @matbrgz on GitHub (Oct 12, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/2370

Requested capability

Managed inspection is static and the contracts do not declare a recorded .nettrace/EventPipe input profile. Saved event streams can answer which runtime events were actually recorded without attaching REA to a running CLR process.

Acceptance criteria

Define supported recording versions, provider/event identities, timestamp units and recorded process/thread metadata.
Decode a documented initial event subset with explicit loss, sampling, unknown-event and stream-coverage states.
Preserve input hashes and source provenance; do not infer that an unrecorded event did not occur or pair a historical PID with a live process.
Verify original saved traces, malformed/truncated streams, resource limits, cancellation and CLI/MCP parity; live trace collection is out of scope.

References and boundaries

https://learn.microsoft.com/en-us/dotnet/core/diagnostics/eventpipe

This feature needs its own docs/specs//spec.md, plan.md and tasks.md before code. Current upstream sources and existing issues were searched before filing. A new REA provider or expanded execution authority requires the maintainer scope decision specified by CONTRIBUTING.md; this proposal does not supply that decision.

Originally created by @matbrgz on GitHub (Oct 12, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/2370 [![Type: Feature](https://img.shields.io/badge/type-feature-blue.svg?style=flat-square)](https://github.com/morluto/rea) [![Domain: Reverse Engineering](https://img.shields.io/badge/domain-reverse_engineering-blueviolet.svg?style=flat-square)](https://github.com/morluto/rea) [![Status: Proposed](https://img.shields.io/badge/status-proposed-blue.svg?style=flat-square)](https://github.com/morluto/rea) [![Ecosystem: REA](https://img.shields.io/badge/ecosystem-morluto%2Frea-8A2BE2.svg?style=flat-square)](https://github.com/morluto/rea) ## Requested capability Managed inspection is static and the contracts do not declare a recorded .nettrace/EventPipe input profile. Saved event streams can answer which runtime events were actually recorded without attaching REA to a running CLR process. ## Acceptance criteria - [ ] Define supported recording versions, provider/event identities, timestamp units and recorded process/thread metadata. - [ ] Decode a documented initial event subset with explicit loss, sampling, unknown-event and stream-coverage states. - [ ] Preserve input hashes and source provenance; do not infer that an unrecorded event did not occur or pair a historical PID with a live process. - [ ] Verify original saved traces, malformed/truncated streams, resource limits, cancellation and CLI/MCP parity; live trace collection is out of scope. ## References and boundaries - https://learn.microsoft.com/en-us/dotnet/core/diagnostics/eventpipe This feature needs its own docs/specs/<feature>/spec.md, plan.md and tasks.md before code. Current upstream sources and existing issues were searched before filing. A new REA provider or expanded execution authority requires the maintainer scope decision specified by CONTRIBUTING.md; this proposal does not supply that decision.

bsakaguchi added the

area: runtime

enhancement

P2: medium

labels

2026-10-15 18:28:20 +00:00

bsakaguchi commented

2026-10-15 18:28:21 +00:00

Author

Owner

@matbrgz commented on GitHub (Oct 12, 2026):

Implementation & Format Triage Notes

Objective (ELI5):
Read and decode offline .NET EventPipe traces (.nettrace files generated via dotnet-trace) without requiring a live CLR target.

Implementation Strategy:

Pure static binary parser reading the NetTrace format specification: FastSerialization blocks, metadata blocks, and thread event streams.
Extract high-level GC events, exceptions thrown, and method execution timings.

@matbrgz commented on GitHub (Oct 12, 2026): ### Implementation & Format Triage Notes **Objective (ELI5):** Read and decode offline .NET EventPipe traces (`.nettrace` files generated via `dotnet-trace`) without requiring a live CLR target. **Implementation Strategy:** - Pure static binary parser reading the NetTrace format specification: FastSerialization blocks, metadata blocks, and thread event streams. - Extract high-level GC events, exceptions thrown, and method execution timings.

bsakaguchi referenced this issue

2026-10-16 21:16:05 +00:00

[PR #784] [CLOSED] Feat/binary ninja mcp #2239

bsakaguchi added

enhancement

and removed

enhancement

labels

2026-10-31 00:29:36 +00:00