fireeye / pywintrace

ETW Python Library
Apache License 2.0
267 stars 59 forks source link

Add process whitelist/blacklist by PID #28

Closed EccoTheFlintstone closed 5 years ago

EccoTheFlintstone commented 5 years ago

Add a PID whitelist + blacklist 2 new params : pid_whitelist and pid_blacklist which are lists of PID to whitelist/blacklist

If the whitelist is not empty, only events from PID in the whitelist will be kept If the blacklist is not empty, events from PID in it won't be kept

One can dynamically add/remove PIDs from the whitelist and blacklist during the session (if a new process is spawed and we want to blacklist it, it's possible this way)

On windows 7, ProcessID/ThreadID in ETW header is not always set (it can be 0xFFFFFFFF for image load from Kernel Trace for instance). This seems to be a bug as it's working as intended (PID/TID with correct value) on Windows 10.

The idea for this PR stems from processes generating lot of noise (lot of ETW events) that we want to filter out. We could filter those in the callbacks but a lot of CPU is wasted formatting/converting values (TdhFormatProperty..) for events we will discard anyway. With this, we can filter those ASAP.

a = ETW(..., pid_blacklist=[512])
a.start()
...
[PID 1000 : new process we don't want]
a.add_pid_blacklist(1000)
[PID 1000 ends, we want events from new processes with this PID if it is reused]
a.remove_pid_blacklist(1000)

Would it be possible to bump version to 0.2.1 for instance and publish a new version to pypi?

EccoTheFlintstone commented 5 years ago

@abergl, any idea about this one?