* Ensure that comparers.hpp is compiled as unmanaged code when /clr is set. This is necessary to ensure that when boost::* makes use of the std::locale lock, we only take the lock on the native side. If the std::locale lock is taken on the managed side, we introduce a loader lock.
Signed-off-by: Zac Brown (ODSP SECURITY) <zbrown@microsoft.com>
* Fix bug in krabs::schema_key. Kernel traces differentiate events on opcode, user traces use unique event ids. This change adds opcode to the schema_key object used in the schema cache, allowing us to properly cache for kernel traces.
Signed-off-by: Zac Brown (ODSP SECURITY) <zbrown@microsoft.com>
* Add EventHeader.EventDescriptor.Level as well for schema_key fields.
Signed-off-by: Zac Brown (ODSP SECURITY) <zbrown@microsoft.com>
* Remove forced unmanaged code compilation in comparers.hpp when working with C++/CLI. There is a potential for perf impact that needs to be further evaluated.
Signed-off-by: Zac Brown (ODSP SECURITY) <zbrown@microsoft.com>
* Better error reporting for when system is out of ETW trace sessions for registering.
Signed-off-by: Zac Brown (ODSP SECURITY) <zbrown@microsoft.com>
* Fix EventRecord.Name to return correct name.
Signed-off-by: Zac Brown <zacbrown@users.noreply.github.com>
* Add ability to grab event's process id.
Signed-off-by: Zac Brown <zacbrown@users.noreply.github.com>
* Add ability to set trace flags for a provider.
* Update sign.cmd.
* Add UserTraceFlags to provider object.
Signed-off-by: Zac Brown (ODSP SECURITY) <zacbrown@users.noreply.github.com>
* Fix naming of TraceFlags for User provider in O365.Security.ETW.
* Support SocketAddress/sockaddr_in/sockaddr/sockaddr_in6 type explicitly in parser.
Zac Brown