 Dobin Rutishauser
|
16bd7233d3
|
refactor: add "etw_time -> event_time" to all subsystems
|
2026-08-01 16:46:20 +02:00 |
|
|
Dobin Rutishauser
|
7c66b11d00
|
refactor: ppl log message now logged with ETW (not via log file)
|
2026-06-22 19:58:47 +02:00 |
|
|
Dobin Rutishauser
|
ba773a7232
|
fix: just send the dll name without path because of length restrictions
|
2026-06-21 10:40:46 +02:00 |
|
|
Dobin Rutishauser
|
93b63bd85f
|
feature: support MsSense.exe too to MsMpEng.exe
|
2026-06-19 08:52:59 +02:00 |
|
|
Dobin Rutishauser
|
656a0045a5
|
feature: dump defender version (mpengine.dll and registry)
|
2026-06-17 13:05:06 +02:00 |
|
|
Dobin Rutishauser
|
26fd2c862d
|
fix: correct defender dll dump
|
2026-06-16 09:37:24 +02:00 |
|
|
Dobin Rutishauser
|
1586065fc7
|
feature: send defender dlls events on start
|
2026-06-16 08:41:23 +02:00 |
|
|
Dobin Rutishauser
|
8ff471643c
|
feature: make defender dll's available in ProcessResolver
|
2026-06-16 06:27:23 +02:00 |
|
|
Dobin Rutishauser
|
4b0a6e6073
|
refactor: defender loaded dlls in one event
|
2026-06-14 20:15:53 +02:00 |
|
|
Dobin Rutishauser
|
9be1e468a3
|
feature: defender modules logging
|
2026-06-14 17:36:01 +02:00 |
|
|
Dobin Rutishauser
|
f2e69a8571
|
fix: observe msmepeng.exe with DefenderTrace enabled (and not the target process)
|
2026-06-14 13:43:16 +02:00 |
|
|
Dobin Rutishauser
|
167445a51c
|
fix: add *.user as it contains fucking important information fucking visual studio
|
2026-05-03 11:16:42 +02:00 |
|
|
Dobin Rutishauser
|
943d622f57
|
fix: pplservice not applying new target
|
2026-04-12 12:52:10 +02:00 |
|
|
Dobin Rutishauser
|
3df3c51974
|
feature: defender msmpeng.exe related events in etw-ti
|
2026-04-11 18:48:05 +02:00 |
|
|
Dobin
|
96d4e73952
|
refactor: split and compartementalize process-observe and process-info (mem_static to process)
|
2025-09-26 12:53:34 +01:00 |
|
|
Dobin
|
88658da134
|
featur: check commandline of processes (if possible) - for rundll32 support
|
2025-08-29 10:32:39 +01:00 |
|
|
Dobin
|
b971a98d9e
|
feature: wait for ETW to load
|
2025-08-29 10:08:10 +01:00 |
|
|
Dobin
|
4f6d055212
|
refactor: cleanup teh includes so further incidents may be easier to debug
|
2025-08-22 13:09:48 +01:00 |
|
|
Dobin
|
722dd80dbe
|
feature: process names for PPL events (refactor objcache -> ProcessResolver)
|
2025-08-22 12:26:11 +01:00 |
|
|
Dobin
|
30c1df632a
|
feature: add process name to log events (ETW)
|
2025-08-22 10:14:40 +01:00 |
|
|
Dobin
|
fc786433c1
|
fix: correct multiple processes handling, ETW-TI
|
2025-08-19 09:44:00 +01:00 |
|
|
Dobin Rutishauser
|
1d6ef27bdc
|
feature: support multiplce processes for ppl
|
2025-08-15 18:31:07 +02:00 |
|
|
Dobin
|
d75224db25
|
feature: pipe names (for better debugging)
|
2025-08-09 12:31:46 +01:00 |
|
|
Dobin
|
34b8d6df17
|
refactor: remove shared logging completely (& compiler warnings fix)
|
2025-08-09 12:02:32 +01:00 |
|
|
Dobin
|
7ef04aa841
|
refactor: fix ppl communication, and ppl logging
|
2025-08-09 10:14:11 +01:00 |
|
|
Dobin
|
3fc797824b
|
refactor: add some logs
|
2025-08-09 07:47:00 +01:00 |
|
|
Dobin
|
105c66d2f6
|
refactor: rededr <-> ppl communication cleanup and reliability
|
2025-08-08 19:09:04 +01:00 |
|
|
Dobin
|
3634e47fdc
|
fix: ppl reload
|
2025-08-03 15:09:47 +01:00 |
|
|
Dobin
|
27dbc4f3e5
|
fix: again ppl shutdown
|
2025-08-03 07:25:09 +01:00 |
|
|
Dobin
|
a372efec98
|
fix: better ppl shutdown hopefully
|
2025-08-03 06:55:11 +01:00 |
|
|
Dobin
|
d9b6617486
|
feature: ppl service logs to file
|
2025-08-03 06:55:00 +01:00 |
|
|
Dobin
|
e009bfcf5e
|
fix: make ppl/etwti work again by fixing process matching + cleanup
|
2025-08-02 08:32:22 +01:00 |
|
|
Dobin
|
d27ed5f509
|
fix: compilation (claude oopsies)
|
2025-07-11 14:02:13 +01:00 |
|
|
Dobin
|
f3f901070a
|
refactor: fix various PPLService things (Claude)
|
2025-07-11 13:26:32 +01:00 |
|
|
Dobin
|
16535cedd1
|
refactor: add dedicated pipe for PPL/ETWTI events (mostly Claude)
|
2025-07-11 12:42:14 +01:00 |
|
|
Dobin Rutishauser
|
9a921bc582
|
refactor: add comments about etw
|
2025-02-08 12:51:39 +01:00 |
|
|
Dobin Rutishauser
|
b22b7a06b5
|
refactor: rededr version in common.h
|
2025-01-11 21:43:50 +01:00 |
|
 admin
|
d74d4816cc
|
refactor: standardize utils naming
|
2025-01-10 21:06:47 +01:00 |
|
|
admin
|
4388eeebea
|
refactor: to std::string 5: ppl service
|
2025-01-10 20:39:39 +01:00 |
|
|
admin
|
d57f76a73a
|
fix: re-add dependency so it compiles in the VM
|
2025-01-10 13:57:26 +01:00 |
|
|
Dobin
|
3984d74257
|
fix: remove restriction on specific version to make it compilable easier
|
2025-01-03 10:46:47 +00:00 |
|
|
admin
|
bc95713f0b
|
refactor: remove MAX_BUF_SIZE and other constants
|
2024-12-23 22:43:02 +01:00 |
|
|
admin
|
eb70f34ef2
|
refactor: make buffer sizes more precise
|
2024-12-23 22:16:04 +01:00 |
|
|
Dobin Rutishauser
|
3d511449f7
|
merge
|
2024-12-22 19:50:54 +01:00 |
|
|
Dobin Rutishauser
|
969f3af439
|
refactor: put a etw function in Shared, fix 120 include errors
|
2024-12-22 19:40:47 +01:00 |
|
|
admin
|
0fc369a26d
|
refactor: unify buffer sizes to one
|
2024-12-22 14:02:20 +01:00 |
|
|
admin
|
f733495a75
|
feature: augment etw callstacks
|
2024-12-22 13:14:01 +01:00 |
|
|
admin
|
b0e9fb20cd
|
fix: make PPL service compilable again
|
2024-12-22 12:47:39 +01:00 |
|
|
admin
|
ce6c920b9c
|
refactor: small ETWTI improvements
|
2024-12-22 12:47:25 +01:00 |
|
|
admin
|
5533320785
|
fix: make PPL compilable again
|
2024-12-22 11:01:13 +01:00 |
|