mirror of
https://github.com/microsoft/krabsetw
synced 2026-06-06 16:14:32 +00:00
Zac Brown
c81c3c41f6
* - Make projects for Managed and Native example code. - Create a 'tests' directory. - Remove SampleCSharpKrabsExe as it is redundant with respect to the example code. Signed-off-by: Zac Brown (ODSP SECURITY) <zbrown@microsoft.com> * - Add note about TYPEASSERT and NDEBUG compilation flags to README.md. - Add /W4 /WX compiler flags to NativeExample project. - vcxproj.filters updates based on VS magic. Signed-off-by: Zac Brown (ODSP SECURITY) <zbrown@microsoft.com>
54 lines
2.2 KiB
C#
54 lines
2.2 KiB
C#
// Copyright (c) Microsoft. All rights reserved.
|
|
// Licensed under the MIT license. See LICENSE file in the project root for full license information.
|
|
|
|
// This example shows how to quickly load up a kernel trace that prints out
|
|
// a notice whenever a binary image (executable or DLL) is loaded.
|
|
|
|
using System;
|
|
using O365.Security.ETW;
|
|
using Kernel = O365.Security.ETW.Kernel;
|
|
|
|
namespace ManagedExamples
|
|
{
|
|
public static class KernelTrace001
|
|
{
|
|
public static void Start()
|
|
{
|
|
// Kernel traces use the KernelTrace class, which looks and acts
|
|
// a lot like the UserTrace class. A strange quirk about kernel
|
|
// ETW traces is that prior to Win8, the trace was required to
|
|
// have a specific name. On machines where this is the case, this
|
|
// name we provide is ignored and the required one is used.
|
|
var trace = new KernelTrace("My trace name");
|
|
|
|
// Lobster provides a bunch of convenience providers for kernel
|
|
// traces. The set of providers that are allowed by kernel traces
|
|
// is hardcoded by Windows, and Lobster provides simple objects to
|
|
// represent these. If other providers were enabled without an
|
|
// update to Lobster, the same thing could be achieved with:
|
|
// var provider = new KernelProvider(SOME_BITMASK_VALUE, SOME_GUID);
|
|
var processProvider = new Kernel.ProcessProvider();
|
|
|
|
// Kernel providers accept callbacks and event filters, as user
|
|
// providers do.
|
|
processProvider.OnEvent += (record) =>
|
|
{
|
|
if (record.Opcode == 0x01)
|
|
{
|
|
var image = record.GetAnsiString("ImageFileName", "Unknown");
|
|
var pid = record.GetUInt32("ProcessId", 0);
|
|
Console.WriteLine($"{image} started with PID {pid}");
|
|
}
|
|
};
|
|
|
|
// From here, a KernelTrace is indistinguishable from a UserTrace
|
|
// in how it's used.
|
|
trace.Enable(processProvider);
|
|
|
|
// Another quirk here is that kernel traces can only be done by
|
|
// administrators. :( :( :(
|
|
trace.Start();
|
|
}
|
|
}
|
|
}
|