From b1f74b3a81ce296f9014b99e5a9993d3826fc0a3 Mon Sep 17 00:00:00 2001
From: loland <73586395+loland@users.noreply.github.com>
Date: Mon, 1 Dec 2025 01:57:25 +0800
Subject: [PATCH] fixed crash

fixed a strange crash that occurs when using a more comprehensive capture.

logman create trace "DotNetFullTrace" -p "{e13c0d23-ccbc-4e12-931b-d9cc2eee27e4}" 0xFFFFFFFFFFFFFFFF 5 -o "C:\Users\root\Desktop\full_trace.etl" -ets
---
 inlineExecute/inlineExecute.o | Bin 15623 -> 15623 bytes
 src/EtwBypass.cs              |   2 +-
 src/inlineExecute.c           |   2 +-
 3 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/inlineExecute/inlineExecute.o b/inlineExecute/inlineExecute.o
index 880d27d20cb46ac77c0e0e3e98b39191dbbcf505..da15b0b3c8f3075a123e1d42226a3d340dbcf0b1 100644
GIT binary patch
delta 46
zcmV+}0MY-4dWU)kWQGU;mGvdD2Z9y>0keu0Q4|Q@A}PtkJtK&d<0|9?Kg^@)v&$<y
E5tbklZ~y=R

delta 46
zcmZp#YOi8XY2#q1_SD$O-XzAzu(?YtP=q5-SgU`()12><A8S2fS>?q3Wb<il8$kec
Cei0l1

diff --git a/src/EtwBypass.cs b/src/EtwBypass.cs
index e4b6476..4c9ab2f 100644
--- a/src/EtwBypass.cs
+++ b/src/EtwBypass.cs
@@ -121,7 +121,7 @@ namespace EtwBypass {
 
         static void TurnOffETW(IntPtr DotNETRuntimeHandle_addr, out long DotNETRuntimeHandle_val) {
             DotNETRuntimeHandle_val = Marshal.ReadInt64(DotNETRuntimeHandle_addr);
-            Marshal.WriteInt64(DotNETRuntimeHandle_addr, 0);
+            Marshal.WriteInt64(DotNETRuntimeHandle_addr, 1);
             Console.WriteLine("DotNETRuntimeHandle: 0x" + DotNETRuntimeHandle_val.ToString("X"));
         }
 
diff --git a/src/inlineExecute.c b/src/inlineExecute.c
index 72895b4..db4995c 100644
--- a/src/inlineExecute.c
+++ b/src/inlineExecute.c
@@ -594,7 +594,7 @@ int* findDotNetRuntimeHandle() {
 
 void turnOffEtw(int* handleAddr, int* handleVal) {
     *handleVal = *handleAddr;
-    *handleAddr = 0;
+    *handleAddr = 1;
 }
 
 void turnOnEtw(int* handleAddr, int handleVal) {