Under the hood of the ATI Ace Event Log

Or, Why is the event log maxing out the log with useless user information.

Anyone that has the Catalyst Control Center may have noticed the Ace Event Log.

Mine seems to stay full of errors and if you clear the log it will fill up again with just normal system use and not even opening the Catalyst Control Center to make any changes or to run any test. 

You can find this log by opening up the event viewer and then open the the application and services log and then you will see the Ace Event log.

Lets start with the test system specs.

Microsoft® Windows Vista™ Ultimate
6.0.6002.131072
Service Pack 2

AMD Phenom(tm) II X4 945 Processor
AMD64 Family 16 Model 4 Stepping 2    Revision 1026
64 bit Quad Core (Socket AM3) (125 watt)

ASUS M4A79T Deluxe Last available Bios Update(BIOS Date: 03/12/10 10:11:53 Ver: 08.00.15)

XFX HD-489X-ZSFC Radeon HD 4890 1GB 256-bit GDDR5 Pci Express 2.0 x16

Corsair
Part Number: CM3X2048-1333C9 8GB (4 x 2 gig modules Paired)
Type:DDR3-SDRAM PC3-10700 (667MHz)  –  [DDR3-1333]

DirectX 11

Driver Packaging Version    8.97.100.7-121116a-151639C-ATI
Catalyst Version    13.1
Provider    Advanced Micro Devices, Inc.
2D Driver Version    8.01.01.1248
2D Driver File Path    /REGISTRY/MACHINE/SYSTEM/ControlSet001/Control/CLASS/{4D36E968-E325-11CE-BFC1-08002BE10318}/0000
Direct3D Version    7.14.10.0911
OpenGL Version    6.14.10.11672
AMD VISION Engine Control Center Version    2012.1116.1515.27190

NOTE: On AMD CPU based systems it is now called “AMD Vision Engine Control Center” and on Intel CPU based systems it it is still called “Catalyst Control Center”
http://support.amd.com/en-us/search/faq/57

 

The Control Center is a module based system where the functionality is spread out among multiple modules.

Most of the modules are located in “C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static” and its sub folders. On my system Explorer says there are 341 files and 38 folder in the directory some folders are just language specific . That’s allot of files to keep track of and update for each new release.

If we take a look using Sysinternals Process Explorer We see that it starts with Mom.exe which in turn launches CCC.exe.

We can also see in the properties that these two are written in .Net clr version 2.0.50727

Using Process Explorer or a program I made to view the loaded modules we see that Mom.exe list 54 modules including, itself, the ATI modules and the .Net and system files required. Looking at CCC.exe it has 229 and over half of those are ATI modules.

Now lets get a look at the Ace Event Log.

One of the first things you notice is there are 731 events and they all have an event ID of “0” zero. Now that’s real helpful.

Another thing you may notice is , by the time stamps that they hit in groups.

So lets dig into a few of these and see if we can see why they are logged.

This is the error returned:
_IDEMDeviceDFP2Settings_0812.GetDFP2ITCFlag failed with status 2
Error

By the function:
ATI.ACE.CLI.Aspect.DeviceDFP.Graphics.Runtime.RT_DeviceDFP::PrivateRefresh

In order to dig in and see what is going on here we need to decompile the the modules and follow from module to module to get all of the information.

Here we will use a program called IlSpy which you can find here http://ilspy.net/ .

You can view the code and IL, C#, or VB.Net although some functions crashed the program while trying to view as VB.Net. I ended up staying in C# most of the time.

So how do we find this thing. Lets start by breaking down the function name.

ATI.ACE.CLI.Aspect.DeviceDFP.Graphics.Runtime.RT_DeviceDFP::PrivateRefresh

ATI.ACE. = the folder name that the file is in (C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static) the Core-Static holds the bulk of these modules.

Next look in that folder for the file named ( CLI.Aspect.DeviceDFP.Graphics.Runtime )

Personally I copy the files I’m working with to a separate drive and folder and work with the copies.

Now we open this file with IlSpy and look for the class RT_DeviceDFP and then the function PrivateRefresh . Here is what we see.

The error shown here is not what was returned so lets dig deeper into the get method.

The get method traces down to the

// ATI.ACE.CLI.Aspect.DeviceDFP.Graphics.Runtime.RT_DeviceDFP
private void Parse(bool refreshDeviceInfo)

If we follow the get function we see:

// ATI.ACE.DEM.Graphics.IDEMDeviceDFP2Settings_0812
int GetDFP2ITCFlag(int demAdapterIndex, int displayIndex, ref bool itcFlagSupport, ref int itcFlag, ref int itcFlagDefault);

So it takes the parameters as input and somehow returns an integer value, perhaps it is adding the values or counting the ones that are not “0” zero. Without stepping thru this in a debugger it is difficult to know what the values are for the index’s.

The result was 2 in the error.

Looking at the code unless the index values are “0” zero then it will always throw this error because the other values are set to “0”, Boolean False = “0” .

This took almost a full day to sift thru the code and follow it thru multiple modules.

Next lets try an easier one (hopefully).

 

This one appears to be trying to subscribe to the registry key change event.

Looking thru the code on this one there are several problems with it.

First of all the path returned in the error, “HKCU;Software\wow6432node\ATI\ACE\Settings\AEM” does not exist on this system, this alone will cause it to fail every time.

For what ever reason they are using “;” instead of “\” in the output of the error message, perhaps to use a split Char later.  Also subscribe is misspelled in the error message.  (oops).

This function calls to the Windows API to open the registry key and does not appear to be checking for fails from those calls.

Those long numbers convert to the values of the default registry keys.

http://msdn.microsoft.com/en-us/library/aa393286.aspx
-2147483646
0xFFFFFFFF80000002

2147483650
0x80000002

At this point I’m not sure where the sub key name came from so this is as far as I can go with this one.

Doing a string search it may be coming from:
C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe

CLIStart.exe is a 32 bit unmanaged application so may be getting messed up with registry virtualization on a 64 bit system.

 

Lets try one more and we will call it a day.

 

This is the easiest one of all the file “ CLI.AIB.TutorialInfoCentre.Tutorial.Dashboard” just plain does not exist on this system. Thus the error that it can not be loaded.

I was not able to track down what tried to launch it to start with.

 

In conclusion this code base is so large and complicated that it is riddled with errors and it is also possible that due to the size of the code base and the registry keys that a previous version was not completely uninstalled and merged with the new version and is causing the problems. It would take a very long time to even attempt to track down the source of all of these errors.

If you don’t need the AMD/ATI user interface for overclocking  you could always uninstall it and just use the video drivers without the Catalyst Control Center.

I may test that next, after a normal uninstall and reboot see what is left and then cleaning all of the extra files and registry keys off the system .

That’s all for now I hope I was able to pass on some information oh how to dig into these although it can be difficult solve without being able to see the values in a debugger to solve some of them. There is a good chance you can not solve these without upgrading to a new version.

This version I’m using is already listed as legacy product. and it appears that there is another newer update since I last checked.

Update:

After uninstalling the old version, MSI crash and several reboots later and clearing the log file , there were still several files in the  windows\system32 folder.

Upon installing the new version with in and hour there were already over 230 new entry’s.

Go figure.