mirror of
https://github.com/microsoft/krabsetw
synced 2026-06-06 16:14:32 +00:00
path/to/file
8034e9fa08
* added new and/or/none predicate functions that compare a vectorlist of arbitrary predicates * added examples and tests * reverted visual studio version in krabs.sln * improved comments in predicate_base * fixed formatting in user_trace_006_predicate_vectors.cpp * reverted change to sln * renamed vector predicates * updated versions and releaseNotes in nuspec files
47 lines
1.6 KiB
C++
47 lines
1.6 KiB
C++
// Copyright (c) Microsoft. All rights reserved.
|
|
// Licensed under the MIT license. See LICENSE file in the project root for full license information.
|
|
|
|
// This example shows how to use a user_trace to extract powershell command
|
|
// invocations. It demonstrates provider-level filtering to make event handling
|
|
// code a little simpler.
|
|
|
|
#include <iostream>
|
|
#include <cassert>
|
|
|
|
#include "..\..\krabs\krabs.hpp"
|
|
#include "examples.h"
|
|
|
|
void user_trace_006_predicate_vectors::start()
|
|
{
|
|
krabs::user_trace trace(L"My Named Trace");
|
|
|
|
// We will use the Process Trace
|
|
krabs::provider<> provider(L"Microsoft-Windows-Kernel-Process");
|
|
provider.any(0x10);
|
|
|
|
// We'll log events where ome of the following is true
|
|
// - The Opcode is 1,
|
|
// - The Event ID is 2, or
|
|
// - The Version is 3
|
|
krabs::predicates::opcode_is opcode_is_1 = krabs::predicates::opcode_is(1);
|
|
krabs::predicates::id_is eventid_is_2 = krabs::predicates::id_is(2);
|
|
krabs::predicates::version_is version_is_3 = krabs::predicates::version_is(3);
|
|
|
|
krabs::event_filter filter(
|
|
krabs::predicates::any_of({
|
|
&opcode_is_1,
|
|
&eventid_is_2,
|
|
&version_is_3,
|
|
})
|
|
);
|
|
filter.add_on_event_callback([](const EVENT_RECORD& record, const krabs::trace_context& trace_context) {
|
|
krabs::schema schema(record, trace_context.schema_locator);
|
|
assert(schema.event_id() == 1 || schema.event_id() == 2);
|
|
printf("Event ID: %d || Opcode: %d || Version %d\n", schema.event_id(), schema.event_opcode(), schema.event_version());
|
|
});
|
|
|
|
provider.add_filter(filter);
|
|
trace.enable(provider);
|
|
trace.start();
|
|
}
|