etw-providers-docs | Document ETW providers | Command Line Interface library

by repnz C Version: Current License: No License

X-Ray Key Features Code Snippets Community Discussions(1)Vulnerabilities Install Support

kandi X-RAY | etw-providers-docs Summary

etw-providers-docs is a C library typically used in Utilities, Command Line Interface applications. etw-providers-docs has no bugs, it has no vulnerabilities and it has low support. You can download it from GitHub.

Windows 7 - /Manifests-Win7-7600. Windows 10 - /Manifests-Win10-17134. Windows provides the ETW framework for event tracing. The ETW framework comes with many built-in ETW providers, but most of them are not documented very well. Using tdh.h API provider information can be dumped. For manifest based providers, a manifest can be recreated using the same method perfview uses: ((this is not the original manifest, because manifests are compiled) For non-manifest based providers, currently only keywords are dumped. But theoretically you can register to the provider and just cache all the results from all the events (in this case the event must be raised for it to be documented).

Support

Quality

Security

License

Reuse

Support

etw-providers-docs has a low active ecosystem.

It has 133 star(s) with 36 fork(s). There are 10 watchers for this library.

It had no major release in the last 6 months.

There are 0 open issues and 2 have been closed. On average issues are closed in 49 days. There are no pull requests.

It has a neutral sentiment in the developer community.

The latest version of etw-providers-docs is current.

Quality

etw-providers-docs has 0 bugs and 0 code smells.

Security

etw-providers-docs has no vulnerabilities reported, and its dependent libraries have no vulnerabilities reported.

etw-providers-docs code analysis shows 0 unresolved vulnerabilities.

There are 0 security hotspots that need review.

License

etw-providers-docs does not have a standard license declared.

Check the repository for any license declaration and review the terms closely.

Without a license, all rights are reserved, and you cannot use the library in your applications.

Reuse

etw-providers-docs releases are not available. You will need to build from source code and install.

It has 632226 lines of code, 0 functions and 2421 files.

It has low code complexity. Code complexity directly impacts maintainability of the code.

Top functions reviewed by kandi - BETA

kandi's functional review helps you automatically verify the functionalities of the libraries and avoid rework.
Currently covering the most popular Java, JavaScript and Python libraries. See a Sample of etw-providers-docs

Get all kandi verified functions for this library.

etw-providers-docs Key Features

No Key Features are available at this moment for etw-providers-docs.

etw-providers-docs Examples and Code Snippets

No Code Snippets are available at this moment for etw-providers-docs.

Community Discussions

Trending Discussions on etw-providers-docs

How capture Etw in kernelmode?

QUESTION

How capture Etw in kernelmode?

Asked 2020-Mar-12 at 17:35

I'm trying to capture some syscalls using Etw in my driver, to be more precise I need capture NtWriteVirtualMemory and NtReadVirtualMemory usermode calls, i tried using the provider: Microsoft Windows Threat Intelligence, I used PerfView to dump the Threat Inteligence xml for Windows 10 1909 and used message compiler to compile the manifest(exactly what microsoft said to do) and checked Microsoft Etw sample code, but for some reason my callback is called only once(when EtwRegister is called in my DriverEntry), to register my callback i just called EtwRegister, what i should do for my callback be called? I'm using Microsoft sample code with a header file that was generated by mc.exe(message compiler)

...

ANSWER

Answered 2020-Mar-12 at 17:35

The sample you looked at is for an ETW Provider, not a consumer. I'm not sure there is a documented way to consume ETW events from kernel. You can check samples for consuming events from user mode: https://github.com/microsoft/Windows-driver-samples/tree/master/general/tracing/SystemTraceControl

Also note that Microsoft Windows Threat Intelligence ETW provider can only be consumed in Anti-Malware PPL type process. It requires having an Early Launch AntiMalware driver with a matching AntiMalware service. More info can be found at: https://docs.microsoft.com/en-us/windows-hardware/drivers/install/early-launch-antimalware https://docs.microsoft.com/en-us/windows/win32/services/protecting-anti-malware-services-

Source https://stackoverflow.com/questions/60344846

Community Discussions, Code Snippets contain sources that include Stack Exchange Network

Vulnerabilities

No vulnerabilities reported

Install etw-providers-docs

You can download it from GitHub.

Support

For any new features, suggestions and bugs create an issue on GitHub. If you have any questions check and ask questions on community page Stack Overflow .

Find more information at: