Add support for reading EVENT_HEADER_EXT_TYPE_PROCESS_START_KEY from
ETW extended data items, enabled via EVENT_ENABLE_PROPERTY_PROCESS_START_KEY.
The ProcessStartKey uniquely identifies a process instance across a boot
session (unlike PID which can be recycled).
Changes:
- Native C++: schema::process_start_key() in schema.hpp
- Managed .NET: TryGetProcessStartKey() on IEventRecordMetadata/EventRecordMetadata
- Test support: extended_data_builder::add_process_start_key()
- New example: UserTrace008_ProcessStartKey.cs
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* Update for .NET Core 8
Clean up the netcore vcxproj files
* Update test assembly path
* Don't define a runtime lib in release builds (this is how it was before)
* Remove assemblyDebug from release builds
* Remember to actually save file after changing it
* Gracefully handle schema errors when applying filters
* Gracefully handle schema errors when applying filters
* Fix error message
Dispose managed error callbacks
* Improve error callback on event_filter
* Rename event callback for improved readability
* Add additional ETW trace flags described in public documentation or Microsoft open-source projects
* Remove TODO which has already been resolved through IEventRecordMetadata
* Add an interface for EventRecordError to enable unit-testing
* Address code review feedback
* Delete extraneous file
* Fix delegate name
* Resolve nits identified during self-review
* added user-mode rundown support
* [bugfix] EVENT_TRACE_FLAG_DISK_FILE_IO enables events for the FileIo provider
* added examples for kernel rundown events (#138)
* added user-mode rundown support to C++/CLI API
* add support for MOF providers, and update WPP example (#143)
* updated predicate vector example doco
Co-authored-by: Matt Swann <mswann@Microsoft.com>
* Improve wording for ETW interface
Rename nightmare.hpp to etw.hpp to reflect its function,
and remove opinions on the ETW API in the comments.
* Add vim files to .gitignore
* Port Readme.txt to markdown and improve its formatting
* Improve .gitignore wording
* Fix typo in krabs/README.md
* Rename O365.Security.Native.ETW to Microsoft.O365.Security.Native.ETW
- change all occurrences in solution and project files;
- rename the directory containing the project;
- rename the project files.
* Add support in C++/CLI for native ETW filtering
* Update nuspec
* Fix constructor comments
* Define a marshal_as template for List<T> to vector<T>
* Revert back to a helper method
* Add a generic list -> vector converter
Extract to a separate file
* CR feedback
* Disable strict compliance on tests project to work around a VS2017 compiler bug: https://developercommunity.visualstudio.com/content/problem/288560/cppunittestassert-doesnt-compile-with-permissive-i.html
* Disabling /permissive- for all build flavors
* Add ESRP delay signing key
* Add Microsoft prefix per MSFT requirements
* Sign.cmd is no longer needed
* Update assembly namespace to match nuget id
* Fix nuget file references
* Update expected public key
* Bump nuget version to 2.0.0
* - Make projects for Managed and Native example code.
- Create a 'tests' directory.
- Remove SampleCSharpKrabsExe as it is redundant with respect to the example code.
Signed-off-by: Zac Brown (ODSP SECURITY) <zbrown@microsoft.com>
* - Add note about TYPEASSERT and NDEBUG compilation flags to README.md.
- Add /W4 /WX compiler flags to NativeExample project.
- vcxproj.filters updates based on VS magic.
Signed-off-by: Zac Brown (ODSP SECURITY) <zbrown@microsoft.com>
suvenka