// Allocate memory for the session properties. The memory must // be large enough to include the log file name and session name, // which get appended to the end of the session properties structure.
BufferSize = sizeof(EVENT_TRACE_PROPERTIES) + sizeof(LOGFILE_PATH) + sizeof(KERNEL_LOGGER_NAME); pSessionProperties = (EVENT_TRACE_PROPERTIES*)malloc(BufferSize); if (NULL == pSessionProperties) { wprintf(L"Unable to allocate %d bytes for properties structure.\n", BufferSize); goto cleanup; }
// Set the session properties. You only append the log file name // to the properties structure; the StartTrace function appends // the session name for you.
// Add Kernel Process Provider GUID to the session's enabled events status = EnableTrace(TRUE, 0, 0, &KernelProcessProviderGuid);
if (status != ERROR_SUCCESS) { wprintf(L"EnableTrace failed with %lu\n", status); goto cleanup; }
// Create the trace session.
status = StartTrace(&SessionHandle, SESSION_NAME_FILE, pSessionProperties);
if (ERROR_SUCCESS != status) { if (ERROR_ALREADY_EXISTS == status) { wprintf(L"The NT Kernel Logger session is already in use.\n"); } else { wprintf(L"EnableTrace() failed with %lu\n", status); }
VOID WINAPI EventCallback(PEVENT_RECORD EventRecord){ // 检查 Extended Data if (EventRecord->ExtendedDataCount > 0) { for (USHORT i = 0; i < EventRecord->ExtendedDataCount; i++) { // 获取扩展数据描述符 PEVENT_HEADER_EXTENDED_DATA_ITEM data = &EventRecord->ExtendedData[i];
BOOL WINAPI CtrlCHandlerRoutine( _In_ DWORD dwCtrlType ) { if (dwCtrlType == CTRL_C_EVENT) { // // Ctrl+C was pressed, stop the trace session. // printf("Ctrl+C pressed, stopping trace session...\n");
TraceStop(); }
return FALSE; }
ULONG NTAPI TraceStart( VOID ) { ULONG status = ERROR_SUCCESS; TRACEHANDLE SessionHandle = 0; EVENT_TRACE_PROPERTIES* pSessionProperties = NULL; ULONG BufferSize = 0; // Set up the callback for processing the trace events EVENT_TRACE_LOGFILE logFile = { 0 }; TRACEHANDLE traceHandle=NULL; EVENT_TRACE_LOGFILEW m_Logfile = { 0 }; ULONG rc=NULL; // Allocate memory for the session properties. The memory must // be large enough to include the log file name and session name, // which get appended to the end of the session properties structure.
BufferSize = sizeof(EVENT_TRACE_PROPERTIES) + sizeof(LOGFILE_PATH) + sizeof(KERNEL_LOGGER_NAME); pSessionProperties = (EVENT_TRACE_PROPERTIES*)malloc(BufferSize); if (NULL == pSessionProperties) { wprintf(L"Unable to allocate %d bytes for properties structure.\n", BufferSize); goto Exit; }
// Set the session properties. You only append the log file name // to the properties structure; the StartTrace function appends // the session name for you.
//// Add Kernel Process Provider GUID to the session's enabled events //status = EnableTrace(TRUE, 0, 0, &KernelProcessProviderGuid);
if (status != ERROR_SUCCESS) { wprintf(L"EnableTrace failed with %lu\n", status); goto Exit; }
// Create the trace session.
status = StartTrace(&SessionHandle, SESSION_NAME_FILE, pSessionProperties);
if (ERROR_SUCCESS != status) { if (ERROR_ALREADY_EXISTS == status) { wprintf(L"The NT Kernel Logger session is already in use.\n"); } else { wprintf(L"EnableTrace() failed with %lu\n", status); }
goto Exit; }
// Enable the trace for Kernel Process events status = EnableTrace(TRUE, 0, 0, &ProviderGuid, SessionHandle);
if (ERROR_SUCCESS != status) { wprintf(L"ProcessTrace() failed with %lu\n", status); goto Exit; }
BOOL WINAPI CtrlCHandlerRoutine( _In_ DWORD dwCtrlType ) { if (dwCtrlType == CTRL_C_EVENT) { // // Ctrl+C was pressed, stop the trace session. // printf("Ctrl+C pressed, stopping trace session...\n");
TraceStop(); }
return FALSE; }
ULONG NTAPI TraceStart( VOID ) { ULONG status = ERROR_SUCCESS; TRACEHANDLE SessionHandle = 0; EVENT_TRACE_PROPERTIES* pSessionProperties = NULL; ULONG BufferSize = 0; // Set up the callback for processing the trace events EVENT_TRACE_LOGFILE logFile = { 0 }; TRACEHANDLE traceHandle = NULL; EVENT_TRACE_LOGFILEW m_Logfile = { 0 }; ULONG rc = NULL; // Allocate memory for the session properties. The memory must // be large enough to include the log file name and session name, // which get appended to the end of the session properties structure.
BufferSize = sizeof(EVENT_TRACE_PROPERTIES) + sizeof(LOGFILE_PATH) + sizeof(KERNEL_LOGGER_NAME); pSessionProperties = (EVENT_TRACE_PROPERTIES*)malloc(BufferSize); if (NULL == pSessionProperties) { wprintf(L"Unable to allocate %d bytes for properties structure.\n", BufferSize); goto Exit; }
// Set the session properties. You only append the log file name // to the properties structure; the StartTrace function appends // the session name for you.
//// Add Kernel Process Provider GUID to the session's enabled events //status = EnableTrace(TRUE, 0, 0, &KernelProcessProviderGuid);
if (status != ERROR_SUCCESS) { wprintf(L"EnableTrace failed with %lu\n", status); goto Exit; }
// Create the trace session.
status = StartTrace(&SessionHandle, SESSION_NAME_FILE, pSessionProperties);
if (ERROR_SUCCESS != status) { if (ERROR_ALREADY_EXISTS == status) { wprintf(L"The NT Kernel Logger session is already in use.\n"); } else { wprintf(L"EnableTrace() failed with %lu\n", status); }
goto Exit; }
// Enable the trace for Kernel Process events status = EnableTrace(TRUE, 0, 0, &ProviderGuid, SessionHandle);
if (ERROR_SUCCESS != status) { wprintf(L"ProcessTrace() failed with %lu\n", status); goto Exit; }
// Store initialized process handles for symbol resolution std::unordered_map<DWORD, HANDLE> processHandleMap;
// Initialize the symbol handler for a specific process boolInitializeSymbolHandlerForProcess(DWORD processId){ HANDLE hProcess = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ, FALSE, processId); if (hProcess == nullptr) { std::cerr << "Failed to open process " << processId << ". Error: " << GetLastError() << std::endl; returnfalse; }
if (!SymInitialize(hProcess, NULL, TRUE)) { std::cerr << "Failed to initialize symbol handler for process " << processId << ". Error: " << GetLastError() << std::endl; CloseHandle(hProcess); returnfalse; }
// Store the process handle processHandleMap[processId] = hProcess; returntrue; }
// Cleanup all symbol handlers and process handles voidCleanupSymbolHandlers(){ for (auto& entry : processHandleMap) { SymCleanup(entry.second); CloseHandle(entry.second); } processHandleMap.clear(); }
// Helper to resolve function name from address for a specific process std::string ResolveFunctionNameForProcess(HANDLE hProcess, ULONG64 address){ char buffer[sizeof(SYMBOL_INFO) + MAX_SYM_NAME * sizeof(TCHAR)] = { 0 }; PSYMBOL_INFO symbol = reinterpret_cast<PSYMBOL_INFO>(buffer); symbol->SizeOfStruct = sizeof(SYMBOL_INFO); symbol->MaxNameLen = MAX_SYM_NAME;
// Global variable to store the last stack address or memory address ULONG64 lastAddress = 0; int flag = 0; // Callback function to process events VOID WINAPI EventCallback(PEVENT_RECORD EventRecord){
// Ensure the symbol handler for this process is initialized if (processHandleMap.find(processId) == processHandleMap.end()) { if (!InitializeSymbolHandlerForProcess(processId)) { //std::cout << " Failed to initialize symbol handler for Process ID " << processId << "." << std::endl; return; } }
HANDLE hProcess = processHandleMap[processId];
// Check for stack trace data if (EventRecord->ExtendedDataCount > 0) {
for (USHORT i = 0; i < EventRecord->ExtendedDataCount; i++) {
traceHandle = OpenTrace(&logFile); if (traceHandle == INVALID_PROCESSTRACE_HANDLE) { std::cerr << "Failed to open trace. Error: " << GetLastError() << std::endl; StopTrace(sessionHandle, sessionName, traceProperties); free(traceProperties); return1; }
std::cout << "Listening for ETW events. Press Ctrl+C to stop..." << std::endl;
// Process the events status = ProcessTrace(&traceHandle, 1, NULL, NULL); if (status != ERROR_SUCCESS) { std::cerr << "Failed to process trace. Error: " << status << std::endl; }
// Clean up CloseTrace(traceHandle); StopTrace(sessionHandle, sessionName, traceProperties); free(traceProperties);
