search

nasbench / EVTX-ETW-Resources

Event Tracing For Windows (ETW) Resources
MIT License
343 stars 68 forks source link

Channel element in manifests #53

Open frendguo opened 6 months ago

frendguo commented 6 months ago

Why doesn't -> in the manifest file contain a description of the channel type? Please.

AndrewRathbun commented 6 months ago

What exactly are you referring to? Can you provide a screenshot of what's missing and what exactly you think should be there?

frendguo commented 6 months ago

@AndrewRathbun Sorry, I didn't express myself clearly. image As shown above, from Microsoft-Windows-Windows defender, for each channel of a provider, a channel type is needed to describe what type of channel it belongs to, Operational or Debug. But in Channels does not have the type field.

nasbench commented 1 month ago

Sorry for the late response @frendguo

The missing field is due to the tool we used to dump those XML manifests. We used WEPExplorer and as you can see here the code doesn't extract the channel type into its own field from the XML. The source code needs to be modified to take that into consideration while taking edge cases (no channel assigned).

Unfortunately for now the only way to get that info so is to extract it from the path.