microsoft / krabsetw

KrabsETW provides a modern C++ wrapper and a .NET wrapper around the low-level ETW trace consumption functions.
Other
610 stars 149 forks source link

need support vs2022 #216

Open WangHHY19931001 opened 1 year ago

WangHHY19931001 commented 1 year ago

need support vs2022 cmake: set(VCPKG_ROOT "C:/vcpkg") set(CMAKE_TOOLCHAIN_FILE "${VCPKG_ROOT}/scripts/buildsystems/vcpkg.cmake") set(VCPKG_TARGET_TRIPLET "x64-windows") set(LIB_NEED_COMPILE_ADD_OP "") set(LIB_NEED_LINK_ADD_OP "") set(EXE_NEED_COMPILE_ADD_OP "") set(EXE_NEED_LINK_ADD_OP -subsystem:windows -entry:mainCRTStartup) cmake_minimum_required (VERSION 3.8)

if (POLICY CMP0141) cmake_policy(SET CMP0141 NEW) set(CMAKE_MSVC_DEBUG_INFORMATION_FORMAT "$<IF:$<AND:$,$>,$<$<CONFIG:Debug,RelWithDebInfo>:EditAndContinue>,$<$<CONFIG:Debug,RelWithDebInfo>:ProgramDatabase>>") endif()

project ("netWorkM") if (WIN32) add_definitions("-DUNICODE" "-D_UNICODE") endif() find_path(KRABSETW_INCLUDE_DIRS "krabs.hpp") add_executable (netWorkM "netWorkM.cpp" "netWorkM.h")

target_include_directories(netWorkM PRIVATE ${KRABSETW_INCLUDE_DIRS})

if (CMAKE_VERSION VERSION_GREATER 3.12) set_property(TARGET netWorkM PROPERTY CXX_STANDARD 20) endif()

netWorkM.cpp:

include

include

include "krabs.hpp"

using namespace krabs;

void HandleNetworkEvent(const EVENT_RECORD& record) { auto user_data = record.user_data(); if (user_data.size() > 0) { auto pid = reinterpret_cast<const uint32_t*>(user_data.data())[0]; std::cout << "Process ID: " << pid << std::endl;

    // 在这里添加特定进程的网络出入量处理逻辑
    // 根据需要提取数据并进行记录或计算
}

}

int main() { try { kernel_trace trace(L"NetworkTrace"); trace.enable_network_provider(network_trace_provider::tcpip); // 可以根据需要启用其他网络提供者,例如 network_trace_provider::udp

    auto callback = [](const EVENT_RECORD& record)
        {
            HandleNetworkEvent(record);
        };

    trace.start(callback);

    // 等待按下任意键停止事件跟踪
    std::cout << "Press any key to stop the trace..." << std::endl;
    std::getchar();

    trace.stop();
}
catch (const std::exception& ex)
{
    std::cerr << "Error: " << ex.what() << std::endl;
    return 1;
}

return 0;

} image