microsoft / krabsetw

KrabsETW provides a modern C++ wrapper and a .NET wrapper around the low-level ETW trace consumption functions.
Other
610 stars 149 forks source link

[Help] i use c++ 11 and i create a payload filter then failed , status = ERROR_NOT_FOUND #213

Open ShiverZm opened 1 year ago

ShiverZm commented 1 year ago

just a part of code, just referen to this msdn

` PayloadPredicateCreate( &Predicates[PredicateCount++], (PWSTR)L"event_id", PAYLOADFIELD_EQ, (PWSTR)L"1214");

//PayloadPredicateCreate(
//    &Predicates[PredicateCount++],
//    L"version",
//    PAYLOADFIELD_IS,
//    L"0");

Status = TdhCreatePayloadFilter(
    &guid,
    &TCPIPTransportPacketDropsEvent,
    FALSE,      // Match all predicates (AND)
    PredicateCount,
    Predicates,
    &EventFilters[FilterCount++]);
if (Status != ERROR_SUCCESS) {
    printf("TdhCreatePayloadFilter() failed with %lu\n", Status);
    return -1;
}

// Combine the interim filters into a final filter descriptor.

Status = TdhAggregatePayloadFilters(
    FilterCount,
    EventFilters,
    NULL,
    &FilterDescriptor);
if (Status != ERROR_SUCCESS) {
    printf("TdhAggregatePayloadFilters() failed with %lu\n", Status);
    return -1;
}
`

Status = ERROR_NOT_FOUND