search

microsoft / krabsetw

KrabsETW provides a modern C++ wrapper and a .NET wrapper around the low-level ETW trace consumption functions.
Other
589 stars 147 forks source link

Fixed Windows 7 support (#110) #113

Closed jdu2600 closed 4 years ago

jdu2600 commented 4 years ago

This is an alternate fix using the native API.

jrave commented 4 years ago

Looking okay to me. Just thinking that it would be great to also add the defines WINVER=0x0601;_WIN32_WINNT=0x601; to make it a bit harder to use unavailable APIs going forward.

jrave commented 4 years ago

On second thought I am wondering on whether this would actually work on Windows 7. According to https://geoffchappell.com/studies/windows/km/ntoskrnl/api/etw/tracesup/groupmask.htm :

Note that although EventTraceGroupMaskInformation is valid for querying in version 6.0 and higher, versions before 6.2 reject it for setting. The returned error code is ERROR_NOT_IMPLEMENTED.

Would that not mean that kt::enable_providers would always throw an exception on Windows 7, meaning you could not create any kernel trace providers on Windows 7. Or am I misunderstanding something here?

jdu2600 commented 4 years ago

No. I missed something. The call is now only made if a group_mask has been supplied.

jrave commented 4 years ago

Thanks. I think the updated code has a chance of working.

jdu2600 commented 4 years ago

@jrave - let me know if anything isn't behaving as expected (on Windows 7).