microsoft-krabsetw

admin/microsoft-krabsetw

Fork 0

mirror of https://github.com/microsoft/krabsetw synced 2026-06-06 16:14:32 +00:00

Commit Graph

Select branches

Hide Pull Requests

master

tracelogging_support

users/ashroff/sfi

users/mswann/error-handling

users/mswann/on-error

users/mswann/unexpected-events

#10

#100

#102

#104

#105

#107

#108

#110

#111

#112

#113

#115

#116

#117

#118

#119

#12

#120

#121

#123

#124

#125

#126

#127

#128

#129

#130

#131

#132

#134

#135

#14

#140

#141

#144

#145

#146

#148

#149

#151

#153

#154

#155

#158

#16

#162

#163

#164

#166

#167

#168

#169

#170

#171

#172

#174

#175

#179

#18

#180

#181

#185

#186

#19

#191

#194

#196

#198

#204

#206

#207

#209

#21

#210

#215

#22

#226

#227

#23

#231

#234

#236

#239

#24

#241

#242

#243

#244

#250

#254

#255

#256

#257

#258

#261

#265

#267

#269

#271

#272

#273

#274

#275

#276

#28

#29

#3

#30

#32

#34

#35

#38

#40

#41

#43

#45

#46

#48

#51

#54

#55

#56

#57

#59

#60

#65

#68

#7

#72

#75

#8

#82

#84

#86

#9

#90

#91

#92

#93

#94

#95

#96

#97

6900de05d8 Merge pull request #275 from jdu2600/parser_performance_name_scan master Kyle Reed 2026-04-14 15:16:35 -07:00
99869be3e8 Add parse hints (native-layer only) John Uhlmann 2026-04-10 10:21:26 +08:00
27a72734e5 replace name->property map with hinted linear scan John Uhlmann 2026-04-01 15:16:34 +08:00
f0934fd7f4 Parser performance (#273) John U 2026-03-27 09:18:46 +08:00
38b8992e78 Merge pull request #272 from microsoft/users/suvenka/newVersion Suhas Venkatesha Murthy 2026-03-09 14:18:33 -07:00
78e6e9d39b Update release notes for version 4.4.7 suvenka 2026-03-09 14:13:28 -07:00
34be38ad54 Update NuGet package version to 4.4.7 suvenka 2026-03-09 14:04:00 -07:00
c40eee4521 Merge pull request #271 from microsoft/users/suvenka/processStartKey Kyle Reed 2026-03-09 10:57:15 -07:00
dab7f9e0ce Add unit tests for process_start_key extended data suvenka 2026-03-06 20:31:08 -08:00
a6d38ba3c0 Address PR review: null checks and parameter lifetime fix suvenka 2026-03-06 17:00:25 -08:00
a16f78a4a7 Fix CI build: pin .NET SDK to 8.0.x via global.json suvenka 2026-03-06 16:29:28 -08:00
676d948235 Add process_start_key() to read ProcessStartKey from extended data suvenka 2026-03-06 16:18:29 -08:00
eaa17e2f92 Move enum def into enum (#269) Kyle Reed 2025-12-15 14:00:24 -08:00
1b26db44b0 Add constructor for schema from EVENT_RECORD and PTRACE_EVENT_INFO (#265) wwh1004 2025-12-03 00:45:18 +08:00
924a28ed8d Update for .NET Core 8 (#267) Kyle Reed 2025-11-19 16:47:22 -08:00
f18605233f Merge pull request #261 from microsoft/users/mijeong/update_GenerateRefAssemblies.ps1 mjeong92 2025-03-10 14:16:57 -07:00
8f4c980525 Fix GenerateRefAssemblies.ps1 error due to breaking change with Refasmer Min Jeong 2025-03-10 14:05:41 -07:00
7db7d806a2 Update Nuget Versions (#258) Kyle Reed 2025-03-04 12:19:16 -08:00
4601b11ee3 Merge pull request #255 from wwh1004/schema-no-throw Kyle Reed 2025-03-04 12:09:38 -08:00
62a3dea877 Merge branch 'master' into schema-no-throw wwh1004 2025-02-06 09:25:06 +08:00
025d68ecba Merge pull request #257 from wwh1004/managed-off Kyle Reed 2025-02-05 11:16:44 -08:00
7d5abba7f0 Merge branch 'master' into managed-off Kyle Reed 2025-02-05 10:49:46 -08:00
71a366f873 Merge pull request #256 from wwh1004/tdh-provider-name-to-guid Kyle Reed 2025-02-05 10:45:24 -08:00
20b465b757 Merge branch 'master' into tdh-provider-name-to-guid Kyle Reed 2025-02-05 10:39:06 -08:00
50fe0ab2c3 Merge branch 'master' into managed-off Kyle Reed 2025-02-05 10:36:58 -08:00
9c72468199 Merge pull request #254 from wwh1004/mof-wpp-enable Kyle Reed 2025-02-05 10:36:24 -08:00
8c0ea124b9 Fix code style and docs wwh1004 2025-02-05 11:01:59 +08:00
aad9b3f028 Use template to implement CombineOrRemoveDelegate instead of macro. Rename CallbackBridge::Create* to CallbackBridge::Wrap* wwh1004 2025-02-05 10:53:02 +08:00
c4adaa97b0 Disable MSIL generation for krabs .NET wrapper native part to significantly reduce binary size wwh1004 2025-02-01 19:44:44 +08:00
27178d04ab Use TdhEnumerateProviders to obtain GUIDs to speed up the conversion and avoid conflicts with CoInitializeEx. wwh1004 2025-02-01 19:05:26 +08:00
4ba137cc0a Unify. NET wrappers of callbacks and use error code checking instead of exception handling wwh1004 2025-02-01 17:44:58 +08:00
0380a58c3d Expose more functions to. NET wrapper: - EventRecord.DecodingSource - EventRecordMetadata.GetEventType() - UserTrace/KernelTrace.BuffersProcessed - UserTrace.MOFEventProcessingEnabled/WPPEventProcessingEnabled wwh1004 2025-02-01 15:04:30 +08:00
aea558addf Add get_event_type function and add set_wpp_event_processing_enabled wwh1004 2025-02-01 14:20:10 +08:00
988e0573d1 Rename ignore_mof_events to mof_events_enabled wwh1004 2025-01-31 18:22:15 +08:00
ff96d20ac7 Add a trace interface to enable ignoring MOF events Septor 2023-05-02 15:55:01 -04:00
af17f4c79a Merge pull request #250 from microsoft/users/mijeong/remove_raw_provider_allocation mjeong92 2024-11-12 15:41:45 -08:00
3a7b787275 Bump nuget versions Min Jeong 2024-11-12 15:30:38 -08:00
5d5552f3de Update comment Min Jeong 2024-11-12 15:18:33 -08:00
f8744b4685 Add comment Min Jeong 2024-11-12 15:00:07 -08:00
5b9e81e372 Use Update() method instead of exposing the internal fields on EventRecordMetadata Min Jeong 2024-11-12 14:56:20 -08:00
2c19173bdc Only allocate one EventRecordMetadata^ and reuse it for RawProvider events Min Jeong 2024-11-12 13:46:42 -08:00
55e5de9baa Add or update NuGet.Config per Microsoft SFI requirements users/ashroff/sfi Amar Shroff 2024-09-23 16:32:00 -07:00
4b1456c39a Merge pull request #243 from microsoft/user/kylereedmsft/update_nuget Kyle Reed 2024-09-19 15:29:54 -07:00
b2d85e9daf Update nuspec versions. Kyle Reed 2024-09-19 15:21:41 -07:00
a29a1f2b56 Merge pull request #242 from kylereedmsft/tracelogging_support Kyle Reed 2024-09-19 14:33:16 -07:00
3a1f2a7750 Comment style Kyle Reed 2024-09-19 13:52:02 -07:00
9d259adcd0 Fix assertion tracelogging_support Kyle Reed 2024-09-19 11:39:49 -07:00
7eabb99cd9 Use string_view instead of raw pointers, update unit tests Kyle Reed 2024-09-19 10:56:46 -07:00
7d5cf669c4 Add support for parsing and caching TraceLogging events. Kyle Reed 2024-09-18 17:20:59 -07:00
6b3152dbe3 Correctly handle kernel addresses in an x86 stack trace (#241) Mihai PANDURU 2024-08-14 00:46:28 +03:00
e39e9b766a Align assembly version with package version. (#239) HydrophobicMinghao 2024-06-19 22:17:01 +08:00
496d5153bb Update package versions and release notes. (#236) HydrophobicMinghao 2024-06-07 01:05:41 +08:00
338d486440 Add Windows ARM64 port for managed wrappers. (#234) HydrophobicMinghao 2024-06-04 23:46:15 +08:00
42b3c17ae4 Fix errors in clang (#231) gmh 2024-03-21 08:05:19 +08:00
550f5edfdb #214 (#215) kaaleksandr 2023-09-25 17:25:27 +00:00
3bc145fb55 Add a method to return the provider GUID from a given schema (#209) Septor 2023-05-02 19:53:34 -04:00
da66c3a28a Add trace parsing from a file instead of realtime (#206) Septor 2023-04-03 18:41:03 -04:00
394eb6c52a add call stack enrichment to the C# example (#204) John U 2022-11-20 15:37:07 +11:00
db46f40cb4 Microsoft mandatory file (#196) microsoft-github-policy-service[bot] 2022-08-03 13:17:46 -07:00
3d6868d956 update test run settings (#198) henriblMSFT 2022-08-03 12:38:33 -07:00
8900ed0f42 Merge pull request #194 from microsoft/users/henribl/net6.0 henriblMSFT 2022-08-03 09:02:43 -07:00
6ce05a62b2 address code review feedback Henri-Bastien Lamontagne 2022-08-03 07:42:45 -07:00
c31d39497a build and package krabs etw with .net 6.0 support Henri-Bastien Lamontagne 2022-08-01 10:53:59 -07:00
79e8af192e add stack trace helpers (#26) (#191) John U 2022-04-25 11:13:42 +10:00
d4688217e0 Rename targets file (#186) Matt Swann 2021-10-08 08:40:55 -07:00
0409b3ecfa Add trace::set_trace_information method (#181) Pierric Gimmig 2021-09-23 08:28:22 -07:00
ac27477861 Check offset before accessing task name property (#180) Matt Swann 2021-09-22 12:44:32 -07:00
9eb52258b7 Do not specify an explicit start time when calling ProcessTrace (#179) Matt Swann 2021-09-22 09:05:17 -07:00
b41b57cd42 Send schema errors to OnError callback in all cases (#175) Matt Swann 2021-09-06 12:28:18 -07:00
6eff7b68df Gracefully handle schema errors when applying filters users/mswann/on-error Matt Swann 2021-09-03 14:14:39 -07:00
ee996771c9 Add additional filtering to prevent unexpected event IDs when using provider-based filtering users/mswann/unexpected-events Matt Swann 2021-09-02 16:00:56 -07:00
7ff33a266e Bump nuget version (#170) Matt Swann 2021-09-02 08:46:48 -07:00
30874bbeaa Merge branch 'master' of https://github.com/microsoft/krabsetw into users/mswann/error-handling users/mswann/error-handling Matt Swann 2021-09-02 08:39:30 -07:00
d7b03cd8c9 Bump nuget version number Matt Swann 2021-09-02 08:38:33 -07:00
916881ec51 Include record context when handling schema and unexpected errors (#169) Matt Swann 2021-09-02 08:35:58 -07:00
28b8851650 Include record context when handling schema and unexpected errors Matt Swann 2021-09-02 08:26:55 -07:00
9910a173a3 Merge pull request #168 from microsoft/users/nibassen/license-info Nicole Bassen 2021-07-16 16:22:46 -07:00
d9688dc0d9 Updated license metadata Nicole 2021-07-16 16:10:36 -07:00
2966352480 Merge pull request #167 from microsoft/users/nibassen/spectre-mitigations nibassen 2021-07-16 12:00:26 -07:00
c2b9516cea Updated .nuspec version for O365.Security.Native.ETW Nicole 2021-07-16 11:14:34 -07:00
5830247e8c Updated the version Nicole 2021-07-16 11:03:07 -07:00
405abd59fb Upgraded toolset and target platform; enabled Spectre mitigation on Release builds Nicole 2021-07-16 10:45:43 -07:00
665a0a124e C++ 20 fixes: convert wstring to string in provider name logging, replace deprecated traits check (#166) vpa1977 2021-06-30 06:18:17 +12:00
64be6670e9 Add <clear/> to nuget.config (#164) Matt Swann 2021-06-11 09:37:25 -07:00
e12177933a Add missing <clear/> statement (#163) Matt Swann 2021-06-11 09:12:12 -07:00
d7b8a19a91 Replace "min" by "std::min<size_t>" to support NOMINMAX (#162) Pierric Gimmig 2021-06-10 16:07:30 -07:00
41f100e4d9 catch invalid_parameter in register_trace() (#158) zeze 2021-05-26 04:45:58 +08:00
31679cf84b Rundown event support and examples (#155) John U 2021-01-20 10:13:44 +11:00
3fb208ff92 Save size of data in socket_address struct (#154) starix 2021-01-11 23:56:38 +03:00
313101032b Add compatibility with 'phnt' library (https://github.com/processhacker/phnt) (#149) starix 2021-01-09 01:43:02 +03:00
fa2f89a583 added ability to set a default event callback (#147) (#151) John U 2020-12-24 07:52:22 +11:00
b9b1a52e0b Fix parsing of boolean type (#148) starix 2020-12-08 20:16:50 +03:00
c526c45e5b add support for MOF providers, and update WPP example (#143) (#145) John U 2020-11-20 11:30:12 +11:00
0d0f20efa7 Fix setup-nuget step (#146) Matt Swann 2020-11-19 16:24:18 -08:00
2a34d22d08 Improve performance for GUID std::hash specialization (#144) Matt Swann 2020-11-13 11:39:16 -08:00
bdaa25c52f Remove unused changelog (#141) Matt Swann 2020-11-06 15:07:20 -08:00
74a35d706a Ignore struct padding when computing std::hash<schema_key> (#140) Matt Swann 2020-11-06 14:47:55 -08:00
84b77ed850 added a WPP trace example (#66) (#135) John U 2020-08-06 10:56:42 +10:00
66294b50b7 Remove krabs.cpp reference and add missing header (#134) pravic 2020-07-07 23:04:59 +03:00
17b4289d11 Enable parsing TDH_IN_POINTER types (#132) path/to/file 2020-05-23 05:06:19 +10:00

1 2 3 4 5 ...