ETWReader is a C++ application designed to create an Event Tracing for Windows (ETW) session, connect to a specific provider (in this case, Microsoft-Windows-Kernel-Process
), and read specific event IDs (1, 2, 3, 4, 5, and 6).
This program captures and displays events generated by the Microsoft-Windows-Kernel-Process
provider. The targeted events include:
- Start Process (Event ID 1): Triggered when a new process is created.
- Stop Process (Event ID 2): Triggered when a process terminates.
- Start Thread (Event ID 3): Triggered when a new thread is created.
- Stop Thread (Event ID 4): Triggered when a thread terminates.
- Load Image (Event ID 5): Triggered when an image (e.g., DLL or EXE) is loaded into a process.
- Unload Image (Event ID 6): Triggered when an image is unloaded from a process.
To start a trace session and connect to a provider, use the following command:
.\ETWReader.exe {SESSION_NAME} {GUID}
To delete an existing trace session, add the -d flag:
.\ETWReader.exe {SESSION_NAME} {GUID} -d
To connect to the Microsoft-Windows-Kernel-Process
provider and start a session, use the following command:
.\ETWReader.exe GlobalSession "{22fb2cd6-0e7b-422b-a0c7-2fad1fd0e716}"