Add support for reading EVENT_HEADER_EXT_TYPE_PROCESS_START_KEY from
ETW extended data items, enabled via EVENT_ENABLE_PROPERTY_PROCESS_START_KEY.
The ProcessStartKey uniquely identifies a process instance across a boot
session (unlike PID which can be recycled).
Changes:
- Native C++: schema::process_start_key() in schema.hpp
- Managed .NET: TryGetProcessStartKey() on IEventRecordMetadata/EventRecordMetadata
- Test support: extended_data_builder::add_process_start_key()
- New example: UserTrace008_ProcessStartKey.cs
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* added user-mode rundown support
* [bugfix] EVENT_TRACE_FLAG_DISK_FILE_IO enables events for the FileIo provider
* added examples for kernel rundown events (#138)
* added user-mode rundown support to C++/CLI API
* Add support in C++/CLI for native ETW filtering
* Update nuspec
* Fix constructor comments
* Define a marshal_as template for List<T> to vector<T>
* Revert back to a helper method
* Add a generic list -> vector converter
Extract to a separate file
* CR feedback
* - Make projects for Managed and Native example code.
- Create a 'tests' directory.
- Remove SampleCSharpKrabsExe as it is redundant with respect to the example code.
Signed-off-by: Zac Brown (ODSP SECURITY) <zbrown@microsoft.com>
* - Add note about TYPEASSERT and NDEBUG compilation flags to README.md.
- Add /W4 /WX compiler flags to NativeExample project.
- vcxproj.filters updates based on VS magic.
Signed-off-by: Zac Brown (ODSP SECURITY) <zbrown@microsoft.com>
suvenka