You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
I've written a basic consumer application that parses the events into a struct.
use ferristetw::*;fnmain(){let test_provider = provider::Provider::by_guid("3B9CAB28-762A-4740-A82B-B6829CC90ADF").add_callback(test_callback).build();let test_trace = UserTrace::new().enable(test_provider).start_and_process().unwrap();
std::thread::sleep(std::time::Duration::new(60,0));
test_trace.stop().unwrap();}fntest_callback(record:&EventRecord,schema_locator:&SchemaLocator){match schema_locator.event_schema(record){Err(err) => println!("Unable to get the ETW schema for event: {:?}", err),Ok(schema) => parse_event(&schema, record)}}fnparse_event(schema:&schema::Schema,record:&EventRecord){let parser = parser::Parser::create(record, schema);match parser.try_parse::<u8>("EventId").unwrap_or(0){2 => {let event = ThreadCreatedEvent{id:2,description:String::from("Thread created"),creator_pid: parser.try_parse::<u32>("CreatorPid").unwrap_or(0),creator_process_name: parser.try_parse::<String>("CreatorProcessName").unwrap_or_else(|_| String::from("")),target_pid: parser.try_parse::<u32>("TargetPid").unwrap_or(0),target_process_name: parser.try_parse::<String>("TargetProcessName").unwrap_or_else(|_| String::from("")),target_thread_id: parser.try_parse::<u32>("TargetThreadId").unwrap_or(0),sid: parser.try_parse::<String>("Sid").unwrap_or_else(|_| String::from(""))};println!("{:?}", event);}
_ => {}}}
In the example, I emit Event 1 once before emitting Event 2 five times. My problem is that all instances of Event 2 will fail to parse correctly (specifically with TdhNativeError(IoError(Os { code: 1168, kind: Uncategorized, message: "Element not found." })). If I remove the line containing EmitEID1() from the example, the events will parse properly. I'm not exactly sure why I'm unable to parse multiple events and any help would be much appreciated.
The text was updated successfully, but these errors were encountered:
matterpreter
changed the title
Unable to process different events from the same provider
Unable to process different events from the same TraceLogging provider
Aug 6, 2023
I have a provider binary that emits
n
number of different events over the same provider GUID using TraceLogging. Here's an example:I've written a basic consumer application that parses the events into a struct.
In the example, I emit
Event 1
once before emittingEvent 2
five times. My problem is that all instances ofEvent 2
will fail to parse correctly (specifically withTdhNativeError(IoError(Os { code: 1168, kind: Uncategorized, message: "Element not found." }))
. If I remove the line containingEmitEID1()
from the example, the events will parse properly. I'm not exactly sure why I'm unable to parse multiple events and any help would be much appreciated.The text was updated successfully, but these errors were encountered: