Why do profilers need administrative privs (on Windows)

Question

I've been evaluating profilers and memory checking tools for native C++ programs on Windows and all of them want to be installed and run with administrator privileges. I rarely log in as admin on my machine. If I need to install something or do something that requires administrative privileges, I use runas and it works pretty well.

Is it legitimate for a profiler to require admin privileges, or are the profiler developers just being lazy? Am I being unreasonable by rejecting all of these tools on this basis?

I'm developing with VS 2005 on an XP Pro machine.

Answer 1

I've been reading about this and I'm slowly coming to the conclusion that profiler-like tools in general do not require administrative access, but stating that you require it is an easy way for the tool makers to avoid all problems related to insufficient privileges.

So, I guess they are being lazy but also somewhat pragmatic.

Correct me if I'm wrong (I'm no expert on the Windows security model), but I believe one way to handle this situation would be to require admin privileges only at install time. Then create a ProfilerUsers user group and grant any necessary privileges to that group, then ask which computer users should be added to that group.

The most shocking thing I've discovered is that a lot of developers run all the time with administrative privileges.

Answer 2

Because they have to look at other process' memory, which is normally taboo.

Answer 3

some cpu profilers actually do a statistic averaging using OS interrupts... obviously they cannot do this without privileges for that :)

Answer 4

Sounds like a design choice by the developers. They may have thought it was a good idea to request admin rights before probing around in memory or dynamically altering code in memory since this behaviour is to be expected from some types of malware.

Answer 5

The most likely explanation is that they are implemented as specialised debuggers, using the Win32 debugging APIs like DebugActiveProcess(). These functions need PROCESS_ALL_ACCESS (as detailed in the documentation) and I would expect that you will need admin rights for that.

IIRC the Visual Studio debugger won't work (properly) either unless you have local admin rights on your system, at least for C++.