{
	"id": "303526c2-a57f-4a8e-8ce2-ef04fc15815b",
	"created_at": "2026-04-06T00:14:31.972282Z",
	"updated_at": "2026-04-10T03:21:04.392363Z",
	"deleted_at": null,
	"sha1_hash": "e47b108fe4ef3522fe7ebcf0719c59a67b786b27",
	"title": "Registry-Free Profiler Startup and Attach",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 36366,
	"plain_text": "Registry-Free Profiler Startup and Attach\r\nBy Archiveddocs\r\nArchived: 2026-04-05 23:46:21 UTC\r\nUpdated: January 2012\r\nStarting with the .NET Framework version 4, you can attach profilers both at application startup time (startup\r\nloading) and while applications are running (attach loading). (Before the .NET Framework 4, startup loading was\r\nthe only way to load a profiler.) Both options provide the ability to start up profilers that have not been registered\r\nas COM components.\r\nStartup loading and attach loading use different protocols for starting profilers and are discussed in the following\r\nsections.\r\nA startup-load profiler is loaded when the application to be profiled starts. The profiler is registered through the\r\nvalue of the following environment variable:\r\nCOR_ENABLE_PROFILING=1\r\nStarting with the .NET Framework 4, you use either the COR_PROFILER or the COR_PROFILER_PATH\r\nenvironment variable to specify the location of the profiler. (Only COR_PROFILER is available in earlier\r\nversions of the .NET Framework.)\r\nCOR_PROFILER={CLSID of profiler}\r\nCOR_PROFILER_PATH=full path of the profiler DLL\r\nIf COR_PROFILER_PATH is not present, the common language runtime (CLR) uses the CLSID from\r\nCOR_PROFILER to locate the profiler in the HKEY_CLASSES_ROOT of the registry. If\r\nCOR_PROFILER_PATH is present, the CLR uses its value to locate the profiler and skips registry lookup.\r\n(However, you still have to set COR_PROFILER, as discussed in the following list of rules.)\r\nStarting with the .NET Framework 4, the rules for loading a profiler at startup are as follows:\r\nYou must set COR_ENABLE_PROFILING to 1. If COR_ENABLE_PROFILING is absent or is set to 0\r\n(zero), the runtime system will not connect the process to the profiler.\r\nYou must set the COR_PROFILER environment variable to the CLSID of the profiler, even if you specify\r\nCOR_PROFILER_PATH, because the runtime still has to pass the CLSID of the profiler to the\r\nCreateInstance call for the class factory.\r\nIf you specify COR_PROFILER_PATH, the CLR uses the path you specify, even if it is invalid, and does\r\nnot check the registry to find the path. If you specify an invalid path, the profiler is not loaded.\r\nhttps://docs.microsoft.com/en-us/previous-versions/dotnet/netframework-4.0/ee471451(v=vs.100)\r\nPage 1 of 2\n\nIf COR_PROFILER_PATH is not present, the CLR uses the CLSID specified by COR_PROFILER to find\r\nthe full path to your profiler DLL in the registry. As with any COM server DLL, the CLR looks for the\r\nCLSID under HKEY_CLASSES_ROOT, which merges the classes from HKEY_LOCALE_MACHINE\r\nand HKEY_CURRENT_USER.\r\nStarting with the .NET Framework 4, you can attach a profiler to a running application. For more information\r\nabout this functionality, see Profiler Attach and Detach. An attach-load profiler uses the wszProfilerPath parameter\r\nof the ICLRProfiling::AttachProfiler method to find the location of the profiler DLL file. If wszProfilerPath is\r\nnull, the runtime tries to locate the profiler by looking in the registry for the CLSID that is specified in the\r\npClsidProfiler parameter.\r\nProfiling Overview\r\nProfiling (Unmanaged API Reference)\r\nUnmanaged API Reference\r\nDate History Reason\r\nJanuary 2012 Clarified information. Information enhancement.\r\nSource: https://docs.microsoft.com/en-us/previous-versions/dotnet/netframework-4.0/ee471451(v=vs.100)\r\nhttps://docs.microsoft.com/en-us/previous-versions/dotnet/netframework-4.0/ee471451(v=vs.100)\r\nPage 2 of 2",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"MITRE"
	],
	"references": [
		"https://docs.microsoft.com/en-us/previous-versions/dotnet/netframework-4.0/ee471451(v=vs.100)"
	],
	"report_names": [
		"ee471451(v=vs.100)"
	],
	"threat_actors": [],
	"ts_created_at": 1775434471,
	"ts_updated_at": 1775791264,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/e47b108fe4ef3522fe7ebcf0719c59a67b786b27.pdf",
		"text": "https://archive.orkl.eu/e47b108fe4ef3522fe7ebcf0719c59a67b786b27.txt",
		"img": "https://archive.orkl.eu/e47b108fe4ef3522fe7ebcf0719c59a67b786b27.jpg"
	}
}