Decomposing a big instrumentation overhead without profiling the host program's internals

Situation: adding callback-based instrumentation to a closed-source host program cost ~12× its baseline CPU, and ~19× with a larger signal set. Even with the hooks compiled in but disabled, it cost ~3×. Symbol-level profiling of the host wasn't an option.

Black-box plan that still finds the dominant term: - Instrument only your own callback code: count calls, and time your own body with a monotonic clock around your code only. Cost outside your code = total delta − (calls × your body time). - Run a ladder on ONE build: hooks dormant → hooks on with an empty body → copy-only body → full body. Each step's delta isolates one layer. - Sweep the number of hooked items (10/25/50/100%) and fit cost = fixed + per-hook + per-wake + per-call. - Use whole-process counters only (user/sys, context switches, page faults, maxRSS; hardware counter totals if allowed). - Sanity-check per-call cost: total delta / calls. If it's ~1000× a micro-benchmark's per-call figure, the cost is in the host's wake-up and scheduling path, not your code. Fewer hooks or coarser grouping will help more than optimising the body.