ETWReader is a C++ application designed to create an Event Tracing for Windows (ETW) session, connect to a specific provider (in this case, Microsoft-Windows-Kernel-Process), and read specific event IDs (1, 2, 3, 4, 5, and 6).

This program captures and displays events generated by the Microsoft-Windows-Kernel-Process provider. The targeted events include:

1. Start Process (Event ID 1): Triggered when a new process is created.
2. Stop Process (Event ID 2): Triggered when a process terminates.
3. Start Thread (Event ID 3): Triggered when a new thread is created.
4. Stop Thread (Event ID 4): Triggered when a thread terminates.
5. Load Image (Event ID 5): Triggered when an image (e.g., DLL or EXE) is loaded into a process.
6. Unload Image (Event ID 6): Triggered when an image is unloaded from a process.

To start a trace session and connect to a provider, use the following command:

.\ETWReader.exe {SESSION_NAME} {GUID}

To delete an existing trace session, add the -d flag:

.\ETWReader.exe {SESSION_NAME} {GUID} -d

To connect to the Microsoft-Windows-Kernel-Process provider and start a session, use the following command:

.\ETWReader.exe GlobalSession "{22fb2cd6-0e7b-422b-a0c7-2fad1fd0e716}"