search

microsoft / krabsetw

KrabsETW provides a modern C++ wrapper and a .NET wrapper around the low-level ETW trace consumption functions.
Other
589 stars 147 forks source link

Error Not Found when trying to parse events from SCM provider #136

Closed bclin717 closed 4 years ago

bclin717 commented 4 years ago

Hi, I have a problem parsing events provided by SCM provider {555908d1-a6d7-4695-8e1e-26931d2012f4} . krabs::could_not_find_schema() is thrown because tdhGetEventInformation() (schema_locator.hpp line:138) returns error 1168. I found that there are all zero in the record->EventHeader->EventDescriptor in the events, so tdhGetEventInformation() can't parse without event id.

I was wondering if there's any way to parse event properties in the event provided by SCM provider. Thanks!