microsoft / krabsetw

KrabsETW provides a modern C++ wrapper and a .NET wrapper around the low-level ETW trace consumption functions.
Other
581 stars 149 forks source link

Could not load Microsoft.O365.Security.Native.ETW in C# .NET 6.0 #238

Closed gleen-code closed 1 month ago

gleen-code commented 1 month ago

Hi,

I am using C# with the .NET 6.0 framework and trying to use the NuGet Microsoft.O365.Security.Native.ETW package (https://www.nuget.org/packages/Microsoft.O365.Security.Native.ETW/).

Although all the dependencies are resolved and the library is installed correctly, at run it says that it cannot load the library. This is the exception:

System.IO.FileNotFoundException
  HResult=0x80070002
  Message=Could not load file or assembly 'Microsoft.O365.Security.Native.ETW, Version=1.0.8668.31639, Culture=neutral, PublicKeyToken=31bf3856ad364e35'. The system cannot find the file specified.
  Source=MyProject

Inspecting the library dependencies, in the folder where it has been compiled, I can see that ijwhost.dll is not found.

TM5qGN3J

Although the dependency is located in the same directory, in the following path: runtimes\win-x64\native\Ijwhost.dll

This is the directory bin\Debug\net6.0-windows7.0 structure:

If I change the .NET framework version to 5.0, everything works fine. Above 6.0, it does not work with any version. Any ideas?

swannman commented 1 month ago

A bit of background:

The best way we've found to get the DLL into the output directory is to edit the .csproj file and add an msbuild copy step:

<ItemGroup> <PackageReference Include="Microsoft.O365.Security.Native.ETW" Version="4.3.2">       <GeneratePathProperty>true</GeneratePathProperty>     </PackageReference> </ItemGroup>

<Target Name="CopyFiles" AfterTargets="Build"> <ItemGroup> <File Include="$(PkgMicrosoft_O365_Security_Native_ETW)\runtimes\win-x64\native\Ijwhost.dll"></File> </ItemGroup> <Copy SourceFiles="@(File)" DestinationFolder="$(OutDir)"></Copy> </Target>

Want to give this a try and let us know whether it works?

gleen-code commented 1 month ago

Thank you very much, @swannman. That's works and makes sense.

I think you should document this, I've found more people with the same issue, and it's not very intuitive to solve.