Implement event filtering - Githubissues

n4r1b / ferrisetw

Basically a KrabsETW rip-off written in Rust

Other

64 stars 23 forks source link

Implement event filtering #6

Open n4r1b opened 3 years ago

n4r1b commented 3 years ago

Info ETW allows filters to be defined for a Provider in a session. MSDN - Defining Filters. KrabsETW already provides a mechanism to do filtering either by events_id or by using more complicated predicates

https://github.com/microsoft/krabsetw/tree/master/krabs/krabs/filtering

TODO

[ ] Research best way to introduce filters into Ferris
[x] Implement a basic filtering based on events_id
[ ] Research and implement a filtering based on more complex predicates

daladim commented 1 year ago

We're now able to filter by Event ID.

Predicates are left TODO