mirror of
https://github.com/microsoft/krabsetw
synced 2026-06-06 16:14:32 +00:00
John U
9863c2cb8a
* [poc] inject schema_locator * Apply suggestions from code review Co-Authored-By: Kyle Reed <kareed@kallanreed.com> * inject schema_locator [C++/CLI] * inject schema_locator into predicate * Update krabs/krabs/schema.hpp Co-Authored-By: Kyle Reed <kareed@kallanreed.com> * updated docs * updated nuspec Co-authored-by: Kyle Reed <kareed@kallanreed.com>
64 lines
2.8 KiB
C++
64 lines
2.8 KiB
C++
// Copyright (c) Microsoft. All rights reserved.
|
|
// Licensed under the MIT license. See LICENSE file in the project root for full license information.
|
|
|
|
// This example shows the event faking functionality krabs offers. This is useful
|
|
// for generating fake events that can be used to test client code.
|
|
|
|
#include <iostream>
|
|
#include <cassert>
|
|
|
|
#include "..\..\krabs\krabs.hpp"
|
|
#include "examples.h"
|
|
|
|
void testing_001::start()
|
|
{
|
|
krabs::user_trace trace(L"My Named Trace");
|
|
|
|
krabs::guid powershell(L"{A0C1853B-5C40-4B15-8766-3CF1C58F985A}");
|
|
krabs::provider<> powershellProvider(powershell);
|
|
powershellProvider.any(0xf0010000000003ff);
|
|
|
|
powershellProvider.add_on_event_callback([](const EVENT_RECORD &record, const krabs::trace_context &trace_context) {
|
|
krabs::schema schema(record, trace_context.schema_locator);
|
|
krabs::parser parser(schema);
|
|
std::wstring context = parser.parse<std::wstring>(L"ContextInfo");
|
|
std::wcout << L"Event called with context " << context << std::endl;
|
|
});
|
|
|
|
trace.enable(powershellProvider);
|
|
|
|
// Normally, one would call trace.start() to begin listening, but we want
|
|
// to test our code without actually starting a trace and listening for an
|
|
// event. We kick up a proxy for the user trace to offer us this functionality.
|
|
krabs::testing::user_trace_proxy proxy(trace);
|
|
|
|
// In order to push an event through the trace, we need to manufacture an
|
|
// event. We can use record_builder to do this.
|
|
krabs::testing::record_builder builder(powershell, krabs::id(7937), krabs::version(1));
|
|
|
|
// For some events, there may be flags that need to be set to some arcane values. Forcing
|
|
// event schema lookup like this without a real event is a little shady anyway, so this
|
|
// is only marginally supported by doing something like the following:
|
|
// builder.header().Flags = EVENT_HEADER_FLAG_CLASSIC_HEADER
|
|
// | EVENT_HEADER_FLAG_64_BIT_HEADER
|
|
// | EVENT_HEADER_FLAG_PROCESSOR_INDEX;
|
|
//
|
|
// These values are often derived by looking at a real event in a debugger and setting
|
|
// the Flags to the appropriate values.
|
|
|
|
|
|
// We can add our own property values to the builder.
|
|
builder.add_properties()
|
|
(L"ContextInfo", L"Some silly test values here")
|
|
(L"Data", L"Some other data here");
|
|
|
|
// We need to pack the property into an EVENT_RECORD structure. There are two functions
|
|
// that allow for this -- pack and pack_incomplete. pack validates that we've filled all
|
|
// the properties in the schema for the event we're composing. pack_incomplete allows for
|
|
// us to only fill some events and default-fills the ones we didn't bother with.
|
|
auto record = builder.pack_incomplete();
|
|
|
|
// Now that we've got an event, we can push it through the trace.
|
|
proxy.push_event(record);
|
|
}
|