- Enable .Net auto monitoring : Hook all compiled function, using information provided in .exe itself for finding functions names and parameters.
- Disable optimization : allow to hook small function. Check it if you see some message like "Function XXX can't be hooked (Too short). Check "Disable Optimization" in .NET options dialog to hook this function" during a monitoring sequence.
This is the result of Microsoft jitting way. If no optimization in made, quite all functions are jitted with frame saving (push ebp + mov ebp,esp) giving us more bytes to install hooks.
- Disable framework monitoring : Very fast but you won't get all information in logs.
- Enable framework monitoring : Provides all information (return value, more stack information and exception information) and allow to monitor framework functions like System.X.Y methods
Since 6.0 version , you have easy filters that allow to quickly filter the framework monitoring
 |
- Using this options is slow as each method of the framework must be jitted
before it's first call - Do not use "Enable framework monitoring" with "All even .NET Framework" filter and option "Enable .Net auto monitoring" set else you will get more than 30000 logs before your first Form appears |