n4r1b / ferrisetw

Basically a KrabsETW rip-off written in Rust
Other
64 stars 23 forks source link

Configure kernel traces with TraceSetInformation #105

Open burgerindividual opened 1 year ago

burgerindividual commented 1 year ago

I've hit a roadblock when using this library to gather stack walking information on sampled profiles. Even when wrangling the control handle from the trace with transmutes after calling start(), it's too late to set what I need, and it ends up not working.

I noticed there was this comment: // TODO: For kernel traces, implement enable_provider function for providers that require call to TraceSetInformation with extended PERFINFO_GROUPMASK

If either a simple callback with the control handle, or a full solution for managing kernel trace information could be added, that would save a lot of headaches.