n4r1b / ferrisetw

Basically a KrabsETW rip-off written in Rust
Other
65 stars 24 forks source link

Reviewed parser structs #39

Closed daladim closed 2 years ago

daladim commented 2 years ago

This depends on #36, that must be merged first.

This PR changes the way Parsers work and own their data.

It is probably easier to review this PR commit-by-commit.

Also refs #18 and #25

daladim commented 2 years ago

Note: this PR, along with another one I haven't pushed yet (and that will depend on this one) drastically improves performance. Handling a message, checking its event ID, and parsing a property will be ~4 times faster (and even up to ~12 times faster if the event contains variable-length strings).