public void TraceRunningProcess(int pid, bool traceChildProcesses, bool collectDriverStats) { using (var hProcess = Kernel32.OpenProcess(Kernel32.ACCESS_MASK.StandardRight.SYNCHRONIZE, false, pid)) { if (hProcess.IsInvalid) { Console.Error.WriteLine("ERROR: the process with a given PID was not found or you don't have access to it."); return; } using (TraceCollector kernelTraceCollector = new TraceCollector(KernelTraceEventParser.KernelSessionName), customTraceCollector = new TraceCollector(WinTraceUserTraceSessionName)) { InitializeSystemHandlers(kernelTraceCollector, collectDriverStats); InitializeProcessHandlers(kernelTraceCollector, customTraceCollector, pid, traceChildProcesses); ThreadPool.QueueUserWorkItem((o) => { Kernel32.WaitForSingleObject(hProcess, Constants.INFINITE); StopCollectors(kernelTraceCollector, customTraceCollector); stopEvent.Set(); }); stopTraceCollectors = () => { StopCollectors(kernelTraceCollector, customTraceCollector); }; ThreadPool.QueueUserWorkItem((o) => { kernelTraceCollector.Start(); }); ThreadPool.QueueUserWorkItem((o) => { customTraceCollector.Start(); }); stopEvent.WaitOne(); } } }
public void TraceSystemOnly() { using (TraceCollector kernelTraceCollector = new TraceCollector(KernelTraceEventParser.KernelSessionName)) { InitializeSystemHandlers(kernelTraceCollector, true); stopTraceCollectors = () => { StopCollector(kernelTraceCollector); }; ThreadPool.QueueUserWorkItem((o) => { kernelTraceCollector.Start(); }); stopEvent.WaitOne(); } }
public void TraceNewProcess(IEnumerable <string> procargs, bool spawnNewConsoleWindow, bool traceChildProcesses, bool collectDriverStats) { using (var process = new ProcessCreator(procargs) { SpawnNewConsoleWindow = spawnNewConsoleWindow }) { process.StartSuspended(); using (TraceCollector kernelTraceCollector = new TraceCollector(KernelTraceEventParser.KernelSessionName), customTraceCollector = new TraceCollector(WinTraceUserTraceSessionName)) { InitializeSystemHandlers(kernelTraceCollector, collectDriverStats); InitializeProcessHandlers(kernelTraceCollector, customTraceCollector, process.ProcessId, traceChildProcesses); ThreadPool.QueueUserWorkItem((o) => { process.Join(); StopCollectors(kernelTraceCollector, customTraceCollector); stopEvent.Set(); }); stopTraceCollectors = () => { StopCollectors(kernelTraceCollector, customTraceCollector); }; ThreadPool.QueueUserWorkItem((o) => { kernelTraceCollector.Start(); }); ThreadPool.QueueUserWorkItem((o) => { customTraceCollector.Start(); }); Thread.Sleep(1000); // resume thread process.Resume(); stopEvent.WaitOne(); } } }