KrabsETW provides a modern C++ wrapper and a .NET wrapper around the low-level ETW trace consumption functions.
610
stars
149
forks
source link
[Help] i use c++ 11 and i create a payload filter then failed , status = ERROR_NOT_FOUND #213
Open
ShiverZm opened 1 year ago
just a part of code, just referen to this msdn
` PayloadPredicateCreate( &Predicates[PredicateCount++], (PWSTR)L"event_id", PAYLOADFIELD_EQ, (PWSTR)L"1214");
Status = ERROR_NOT_FOUND