search

microsoft / krabsetw

KrabsETW provides a modern C++ wrapper and a .NET wrapper around the low-level ETW trace consumption functions.
Other
581 stars 149 forks source link

Expose ExtendedData #222

Open ps1337 opened 7 months ago

ps1337 commented 7 months ago

Hello :)

Currently, only the UserData is accessible from Lobster and only a few Attributes of the ExtendedData are accessible via Getters, like StackTrace(). It would be convenient to be able to access the ExtendedData, for example to gather the UserSID and other information.

Are there any thoughts or plans to add this ability? Or should I file a PR to define a getter for the missing ExtendedAttributes?

Thanks!

swannman commented 7 months ago

Hi @ps1337, it seems reasonable to add getters for the ExtendedAttributes that are missing. If you submit a PR I'd be happy to review!