Zac Brown cf8c1dde88 Add support for ends_with/iends_with property value matching in filter code. (#18) ...

* Create a debug version of the Lobsters nuspec.

* Create UsingMessageAnalyzerToFindETWSources.md

* Add guide for using Message Analyzer

Signed-off-by: Zac Brown <zac@zacbrown.io>

* Update links to images.

Signed-off-by: Zac Brown <zac@zacbrown.io>

* Add link to Message Analyzer howto in README.

* Force usage of TDH to get property size of array types. Should this prove to be a performance penalty in the longterm, we will revisit optimizing for heuristic sizing.

Signed-off-by: Zac Brown (ODSP SECURITY) <zbrown@microsoft.com>

* More general solution for handling when property Flags are set on EVENT_PROPERTY_INFO.

1) If flags are not set, try to get the length from the property 'length' field. Otherwise, try the heuristic.
2) if we couldn't get a length, fall back to calling TDH.

Signed-off-by: Zac Brown (ODSP SECURITY) <zbrown@microsoft.com>

* Add support for EndsWith/IEndsWith in property value matching.

Signed-off-by: Zac Brown (ODSP SECURITY) <zbrown@microsoft.com>

* Fix broken test in GitHub build.

Signed-off-by: Zac Brown (ODSP SECURITY) <zbrown@microsoft.com>

* Add tests for ends_with/iends_with.

Signed-off-by: Zac Brown (ODSP SECURITY) <zbrown@microsoft.com>

2017-03-24 14:44:17 -07:00

..

krabstests

Add support for ends_with/iends_with property value matching in filter code. (#18)

2017-03-24 14:44:17 -07:00

ManagedETWTests

- Make projects for Managed and Native example code. (#3)

2016-11-28 14:06:40 -08:00