mirror of
https://github.com/microsoft/krabsetw
synced 2026-06-06 16:14:32 +00:00
suvenka
676d948235
Add support for reading EVENT_HEADER_EXT_TYPE_PROCESS_START_KEY from ETW extended data items, enabled via EVENT_ENABLE_PROPERTY_PROCESS_START_KEY. The ProcessStartKey uniquely identifies a process instance across a boot session (unlike PID which can be recycled). Changes: - Native C++: schema::process_start_key() in schema.hpp - Managed .NET: TryGetProcessStartKey() on IEventRecordMetadata/EventRecordMetadata - Test support: extended_data_builder::add_process_start_key() - New example: UserTrace008_ProcessStartKey.cs Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
26 lines
818 B
C#
26 lines
818 B
C#
// Copyright (c) Microsoft. All rights reserved.
|
|
// Licensed under the MIT license. See LICENSE file in the project root for full license information.
|
|
|
|
namespace ManagedExamples
|
|
{
|
|
class Program
|
|
{
|
|
static void Main(string[] args)
|
|
{
|
|
// Comment in/out the particular example you'd like to run.
|
|
KernelTrace001.Start();
|
|
//KernelTrace002.Start();
|
|
//UserTrace001.Start();
|
|
//UserTrace002.Start();
|
|
//UserTrace003.Start();
|
|
//UserTrace004.Start();
|
|
//UserTrace005.Start();
|
|
//UserTrace006_Rundown.Start();
|
|
//UserTrace007_StackTrace.Start();
|
|
//UserTrace008_ProcessStartKey.Start();
|
|
//FakingEvents001.Start();
|
|
//WppTrace001.Start();
|
|
}
|
|
}
|
|
}
|