mirror of
https://github.com/microsoft/krabsetw
synced 2026-06-06 16:14:32 +00:00
Zac Brown
8ff48197d1
* Ensure that comparers.hpp is compiled as unmanaged code when /clr is set. This is necessary to ensure that when boost::* makes use of the std::locale lock, we only take the lock on the native side. If the std::locale lock is taken on the managed side, we introduce a loader lock. Signed-off-by: Zac Brown (ODSP SECURITY) <zbrown@microsoft.com> * Fix bug in krabs::schema_key. Kernel traces differentiate events on opcode, user traces use unique event ids. This change adds opcode to the schema_key object used in the schema cache, allowing us to properly cache for kernel traces. Signed-off-by: Zac Brown (ODSP SECURITY) <zbrown@microsoft.com> * Add EventHeader.EventDescriptor.Level as well for schema_key fields. Signed-off-by: Zac Brown (ODSP SECURITY) <zbrown@microsoft.com> * Remove forced unmanaged code compilation in comparers.hpp when working with C++/CLI. There is a potential for perf impact that needs to be further evaluated. Signed-off-by: Zac Brown (ODSP SECURITY) <zbrown@microsoft.com> * Better error reporting for when system is out of ETW trace sessions for registering. Signed-off-by: Zac Brown (ODSP SECURITY) <zbrown@microsoft.com> * Fix EventRecord.Name to return correct name. Signed-off-by: Zac Brown <zacbrown@users.noreply.github.com> * Add ability to grab event's process id. Signed-off-by: Zac Brown <zacbrown@users.noreply.github.com> * Add ability to set trace flags for a provider. * Update sign.cmd. * Add UserTraceFlags to provider object. Signed-off-by: Zac Brown (ODSP SECURITY) <zacbrown@users.noreply.github.com> * Fix naming of TraceFlags for User provider in O365.Security.ETW. * Support SocketAddress/sockaddr_in/sockaddr/sockaddr_in6 type explicitly in parser.
Overview
Krabs is a C++ library that simplifies interacting with ETW. It allows for any number of traces and providers to be enabled and for client code to register for event notifications from these traces.
Krabs also provides code to simplify parsing generic event data into strongly typed data types.
O365.Security.Native.ETW is a C++ CLI (.NET) wrapper around Krabs. It provides the same functionality as Krabs to .NET applications and is used in production by the ODSP Security team. It's affectionately referred to as Lobsters.
Examples & Documentation
- An ETW Primer.
- Simple examples can be found in the
examplesfolder. - Please refer to KrabsExample.md and LobstersExample.md for detailed examples.
- SampleKrabsCSharpExe is a non-trivial example demonstrating how to manage the trace objects.
- Using Message Analyzer to find new ETW event sources.
Important Notes
krabsetwandO365.Security.Native.ETWonly support x64. No effort has been made to support x86.krabsetwandO365.Security.Native.ETWare only supported on Windows 7 or Windows 2008R2 machines and above.- Throwing exceptions in the event handler callback or krabsetw or O365.Security.Native.ETW will cause the trace to stop processing events.
- The call to "start" on the trace object is blocking so thread management may be necessary.
- The Visual Studio solution is krabs\krabs.sln.
- When building a native code binary using the
krabsetwpackage, please refer to the compilation readme for notes about the TYPEASSERT and NDEBUG compilation flags.
NuGet Packages
NuGet packages are available both for the krabsetw C++ headers and the O365.Security.Native.ETW .NET library:
- https://www.nuget.org/packages/O365.Security.Native.ETW/
- https://www.nuget.org/packages/O365.Security.Native.ETW.Debug/ (for development - provides type asserts)
- https://www.nuget.org/packages/krabsetw/
For verifying the .NET binaries, you can use the following command:
sn -T O365.Security.Native.ETW.dll
The expected output is:
Microsoft (R) .NET Framework Strong Name Utility Version 4.0.30319.0
Copyright (c) Microsoft Corporation. All rights reserved.
Public key token is bc3a2e4ba4c5fbd5
Community & Contact
Please feel free to file issues through GitHub for bugs and feature requests and we'll respond to them as quickly as we're able.