public static bool TryEnableAutoLogger(ITracer tracer)
{
try
{
if (WindowsPlatform.GetValueFromRegistry(RegistryHive.LocalMachine, PrjFltAutoLoggerKey, PrjFltAutoLoggerStartValue) != null)
{
if (WindowsPlatform.TrySetDWordInRegistry(RegistryHive.LocalMachine, PrjFltAutoLoggerKey, PrjFltAutoLoggerStartValue, 1))
{
return(true);
}
}
}
catch (UnauthorizedAccessException e)
{
EventMetadata metadata = CreateEventMetadata(e);
tracer.RelatedError(metadata, $"{nameof(TryEnableAutoLogger)}: UnauthorizedAccessException caught while trying to enable auto-logger");
}
catch (SecurityException e)
{
EventMetadata metadata = CreateEventMetadata(e);
tracer.RelatedError(metadata, $"{nameof(TryEnableAutoLogger)}: SecurityException caught while trying to enable auto-logger");
}
tracer.RelatedError($"{nameof(TryEnableAutoLogger)}: Failed to find AutoLogger Start value in registry");
return(false);
}
public static bool IsAutoLoggerEnabled(ITracer tracer)
{
object startValue;
try
{
startValue = WindowsPlatform.GetValueFromRegistry(RegistryHive.LocalMachine, PrjFltAutoLoggerKey, PrjFltAutoLoggerStartValue);
if (startValue == null)
{
tracer.RelatedError($"{nameof(IsAutoLoggerEnabled)}: Failed to find current Start value setting");
return(false);
}
}
catch (UnauthorizedAccessException e)
{
EventMetadata metadata = CreateEventMetadata(e);
tracer.RelatedError(metadata, $"{nameof(IsAutoLoggerEnabled)}: UnauthorizedAccessException caught while trying to determine if auto-logger is enabled");
return(false);
}
catch (SecurityException e)
{
EventMetadata metadata = CreateEventMetadata(e);
tracer.RelatedError(metadata, $"{nameof(IsAutoLoggerEnabled)}: SecurityException caught while trying to determine if auto-logger is enabled");
return(false);
}
try
{
return(Convert.ToInt32(startValue) == 1);
}
catch (Exception e)
{
EventMetadata metadata = CreateEventMetadata(e);
metadata.Add(nameof(startValue), startValue);
tracer.RelatedError(metadata, $"{nameof(IsAutoLoggerEnabled)}: Exception caught while trying to determine if auto-logger is enabled");
return(false);
}
}