n4r1b / ferrisetw

Basically a KrabsETW rip-off written in Rust
Other
65 stars 24 forks source link

Callbacks now use a reference to an `EVENT_RECORD` #36

Closed daladim closed 2 years ago

daladim commented 2 years ago

API wise: this now prevents from mutating the given EVENT_RECORD (which does not make sense)

Performance-wise: depending on how the compiler optimizes copies of structs that are not mutated, this either does not change much, or save multiple actual copies or EVENT_RECORDs, that are quite large objects. That's a first step towards #25. An upcoming PR will change the Schema so that it no longer owns an EVENT_RECORD