mirror of
https://github.com/microsoft/krabsetw
synced 2026-06-06 16:14:32 +00:00
Zac Brown
8ff48197d1
* Ensure that comparers.hpp is compiled as unmanaged code when /clr is set. This is necessary to ensure that when boost::* makes use of the std::locale lock, we only take the lock on the native side. If the std::locale lock is taken on the managed side, we introduce a loader lock. Signed-off-by: Zac Brown (ODSP SECURITY) <zbrown@microsoft.com> * Fix bug in krabs::schema_key. Kernel traces differentiate events on opcode, user traces use unique event ids. This change adds opcode to the schema_key object used in the schema cache, allowing us to properly cache for kernel traces. Signed-off-by: Zac Brown (ODSP SECURITY) <zbrown@microsoft.com> * Add EventHeader.EventDescriptor.Level as well for schema_key fields. Signed-off-by: Zac Brown (ODSP SECURITY) <zbrown@microsoft.com> * Remove forced unmanaged code compilation in comparers.hpp when working with C++/CLI. There is a potential for perf impact that needs to be further evaluated. Signed-off-by: Zac Brown (ODSP SECURITY) <zbrown@microsoft.com> * Better error reporting for when system is out of ETW trace sessions for registering. Signed-off-by: Zac Brown (ODSP SECURITY) <zbrown@microsoft.com> * Fix EventRecord.Name to return correct name. Signed-off-by: Zac Brown <zacbrown@users.noreply.github.com> * Add ability to grab event's process id. Signed-off-by: Zac Brown <zacbrown@users.noreply.github.com> * Add ability to set trace flags for a provider. * Update sign.cmd. * Add UserTraceFlags to provider object. Signed-off-by: Zac Brown (ODSP SECURITY) <zacbrown@users.noreply.github.com> * Fix naming of TraceFlags for User provider in O365.Security.ETW. * Support SocketAddress/sockaddr_in/sockaddr/sockaddr_in6 type explicitly in parser.
7 lines
547 B
Batchfile
7 lines
547 B
Batchfile
msbuild %~dp0..\krabs\krabs.sln /t:Rebuild /property:Configuration=DebugSigning;Platform="x64" /m:8 /nologo
|
|
msbuild %~dp0..\krabs\krabs.sln /t:Rebuild /property:Configuration=ReleaseSigning;Platform="x64" /m:8 /nologo
|
|
sn -R %~dp0..\krabs\x64\DebugSigning\O365.Security.Native.ETW.dll %~dp0\O365.Security.pfx
|
|
sn -R %~dp0..\krabs\x64\ReleaseSigning\O365.Security.Native.ETW.dll %~dp0\O365.Security.pfx
|
|
nuget pack %~dp0..\O365.Security.Native.ETW.nuspec
|
|
nuget pack %~dp0..\O365.Security.Native.ETW.Debug.nuspec
|
|
nuget pack %~dp0..\krabsetw.nuspec |