Add support for reading EVENT_HEADER_EXT_TYPE_PROCESS_START_KEY from
ETW extended data items, enabled via EVENT_ENABLE_PROPERTY_PROCESS_START_KEY.
The ProcessStartKey uniquely identifies a process instance across a boot
session (unlike PID which can be recycled).
Changes:
- Native C++: schema::process_start_key() in schema.hpp
- Managed .NET: TryGetProcessStartKey() on IEventRecordMetadata/EventRecordMetadata
- Test support: extended_data_builder::add_process_start_key()
- New example: UserTrace008_ProcessStartKey.cs
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* Update for .NET Core 8
Clean up the netcore vcxproj files
* Update test assembly path
* Don't define a runtime lib in release builds (this is how it was before)
* Remove assemblyDebug from release builds
* Remember to actually save file after changing it
* Add trace parsing from a file instead of realtime
Add a new interface set_trace_filename() that will enable reading from
an ETL file rather than real-time capture.
Also added a new NativeExample that demonstrates this capability.
* Minor cleanup to address code review items.
* Bump nuget version
* Gracefully handle schema errors when applying filters
* Gracefully handle schema errors when applying filters
* Fix error message
Dispose managed error callbacks
* Improve error callback on event_filter
* Rename event callback for improved readability
* Add additional ETW trace flags described in public documentation or Microsoft open-source projects
* Remove TODO which has already been resolved through IEventRecordMetadata
* Add an interface for EventRecordError to enable unit-testing
* Address code review feedback
* Delete extraneous file
* Fix delegate name
* Resolve nits identified during self-review
* added user-mode rundown support
* [bugfix] EVENT_TRACE_FLAG_DISK_FILE_IO enables events for the FileIo provider
* added examples for kernel rundown events (#138)
* added user-mode rundown support to C++/CLI API
* add support for MOF providers, and update WPP example (#143)
* updated predicate vector example doco
Co-authored-by: Matt Swann <mswann@Microsoft.com>
* refactor predicate comparers to use std algorithms in place of boost algorithms
* update implementation of contains() to match semantics of boost::contains()
* update implementation based on feedback from PR review
* refactor unecessary use of std::distance and refactor parameter names for consistency with STL
* update solution configuration to remove boost dependency and bump package version
* added new and/or/none predicate functions that compare a vectorlist of arbitrary predicates
* added examples and tests
* reverted visual studio version in krabs.sln
* improved comments in predicate_base
* fixed formatting in user_trace_006_predicate_vectors.cpp
* reverted change to sln
* renamed vector predicates
* updated versions and releaseNotes in nuspec files
* .stop() should always call ControlTrace(STOP), and ignore any trace not found errors
* query_stats() should always call ControlTrace(QUERY),
and gracefully handle 'trace not found'
* tabs -> spaces
Co-authored-by: Matt Swann <3lemenopy@gmail.com>
* Improve wording for ETW interface
Rename nightmare.hpp to etw.hpp to reflect its function,
and remove opinions on the ETW API in the comments.
* Add vim files to .gitignore
* Port Readme.txt to markdown and improve its formatting
* Improve .gitignore wording
* Fix typo in krabs/README.md
* Rename O365.Security.Native.ETW to Microsoft.O365.Security.Native.ETW
- change all occurrences in solution and project files;
- rename the directory containing the project;
- rename the project files.
* Add support in C++/CLI for native ETW filtering
* Update nuspec
* Fix constructor comments
* Define a marshal_as template for List<T> to vector<T>
* Revert back to a helper method
* Add a generic list -> vector converter
Extract to a separate file
* CR feedback
* add native support for event filters via API
* not finished:
created one unittest to show usage of native filtering...
* adjust memory usage out of scope....
* file delete event in tests....
* resolving issue 1 in comments of pull request
* issue 2 in pull request comments
* comment 3 in pull request: indentation
* issue 4: identation of if
* excessive comment
* fixed typedef
* removing hungarian convention
* camelCase to snake_case
* snake_case
* fixing more comments in pull request
* uncommenting the first test
* applying comments of pull request
* supporting native event filtering alternated with predicates on other settings
* fix identation
* fixing style
* fixing tabs to spaces
* fix identation
* basing on last change requests except the different method for filterDesc composition which is reasked by me if we could ignore or not.
* fix to reference
* undo excessive change in styling. The file whole written in other style
* fixing indentation of for loop
* Disable strict compliance on tests project to work around a VS2017 compiler bug: https://developercommunity.visualstudio.com/content/problem/288560/cppunittestassert-doesnt-compile-with-permissive-i.html
* Disabling /permissive- for all build flavors
* Add ESRP delay signing key
* Add Microsoft prefix per MSFT requirements
* Sign.cmd is no longer needed
* Update assembly namespace to match nuget id
* Fix nuget file references
* Update expected public key
* Bump nuget version to 2.0.0
* - Make projects for Managed and Native example code.
- Create a 'tests' directory.
- Remove SampleCSharpKrabsExe as it is redundant with respect to the example code.
Signed-off-by: Zac Brown (ODSP SECURITY) <zbrown@microsoft.com>
* - Add note about TYPEASSERT and NDEBUG compilation flags to README.md.
- Add /W4 /WX compiler flags to NativeExample project.
- vcxproj.filters updates based on VS magic.
Signed-off-by: Zac Brown (ODSP SECURITY) <zbrown@microsoft.com>
suvenka