mirror of
https://github.com/microsoft/krabsetw
synced 2026-06-06 16:14:32 +00:00
Zac Brown
c81c3c41f6
* - Make projects for Managed and Native example code. - Create a 'tests' directory. - Remove SampleCSharpKrabsExe as it is redundant with respect to the example code. Signed-off-by: Zac Brown (ODSP SECURITY) <zbrown@microsoft.com> * - Add note about TYPEASSERT and NDEBUG compilation flags to README.md. - Add /W4 /WX compiler flags to NativeExample project. - vcxproj.filters updates based on VS magic. Signed-off-by: Zac Brown (ODSP SECURITY) <zbrown@microsoft.com>
41 lines
1.6 KiB
C++
41 lines
1.6 KiB
C++
// Copyright (c) Microsoft. All rights reserved.
|
|
// Licensed under the MIT license. See LICENSE file in the project root for full license information.
|
|
|
|
// This example shows how to quickly load up a kernel trace that prints out
|
|
// a notice whenever a binary image (executable or DLL) is loaded.
|
|
|
|
#include <iostream>
|
|
#include "..\..\krabs\krabs.hpp"
|
|
#include "examples.h"
|
|
|
|
void kernel_trace_001::start()
|
|
{
|
|
// Kernel traces use the kernel_trace class, which looks and acts a lot like the
|
|
// user_trace class.
|
|
krabs::kernel_trace trace(L"My magic trace");
|
|
|
|
// Krabs provides a bunch of convenience providers for kernel traces. The set of
|
|
// providers that are allowed by kernel traces is hardcoded by Windows ETW, and
|
|
// Krabs provides simple objects to represent these. If other providers were
|
|
// enabled without krabs being updated, the same thing could be done like so:
|
|
// krabs::kernel_provider provider(SOME_ULONG_VALUE, SOME_GUID);
|
|
krabs::kernel::image_load_provider provider;
|
|
|
|
// Kernel providers accept all the typical callback mechanisms.
|
|
provider.add_on_event_callback([](const EVENT_RECORD &record) {
|
|
krabs::schema schema(record);
|
|
|
|
std::wstring event_name = schema.event_name();
|
|
if (event_name == L"Load") {
|
|
krabs::parser parser(schema);
|
|
std::wstring filename = parser.parse<std::wstring>(L"FileName");
|
|
std::wcout << L"Loaded image from file " << filename << std::endl;
|
|
}
|
|
});
|
|
|
|
// From here on out, a kernel_trace is indistinguishable from a user_trace in how
|
|
// it is used.
|
|
trace.enable(provider);
|
|
trace.start();
|
|
}
|