Here are
63 public repositories
matching this topic...
C/C++ Performance Profiler
Command line tracing tool for Windows, based on ETW.
A wireshark plugin to instrument ETW
KrabsETW provides a modern C++ wrapper and a .NET wrapper around the low-level ETW trace consumption functions.
My notes collected while debugging various problems in .NET applications.
Updated
Feb 18, 2022
ASP.NET
Updated
Aug 1, 2019
Python
Meterpreter_Payload_Detection.exe tool for detecting Meterpreter in memory like IPS-IDS and Forensics tool
系统监控开发套件（sysmon、promon、edr、终端安全、主机安全、零信任、上网行为管理）
Event Tracing For Windows (ETW) Resources
Simple project that demonstrates how an ETW consumer can be created just by using NTDLL
Collects network traces of .NET applications.
让Etwhook再次伟大! Make InfinityHook Great Again!
ETWProcessMon2 is for Monitoring Process/Thread/Memory/Imageloads/TCPIP via ETW + Detection for Remote-Thread-Injection & Payload Detection by VirtualMemAlloc Events (in-memory) etc.
Capture and parse CDP and LLDP packets on local or remote computers
Updated
Nov 4, 2021
PowerShell
Tool and library to convert ETW logs to JSON files
Logs key Windows process performance metrics. #nsacyber
An IDA plugin to deal with Event Tracing for Windows (ETW)
Updated
Jun 2, 2020
Python
Trace ScriptBlock execution for powershell v2
Go library for ETW (Event Tracing for Windows) events processing
Win32 memory leak detector with ETW
ETWNetMonv3 is simple C# code for Monitoring TCP Network Connection via ETW & ETWProcessMon/2 is for Monitoring Process/Thread/Memory/Imageloads/TCPIP via ETW + Detection for Remote-Thread-Injection & Payload Detection by VirtualMemAlloc Events (in-memory) etc.
A Splunk Technology Add-on to forward filtered ETW events.
Open Power Performance Analysis Tool
Basically a KrabsETW rip-off written in Rust
Updated
Oct 28, 2021
Rust
Splunk Technology Add-On (TA) for collecting ETW events from Windows systems
Command line tool to analyze one/many ETW file/s with simple queries for common issues.
Log to Event Tracing for Windows (ETW)
Improve this page
Add a description, image, and links to the
etw
topic page so that developers can more easily learn about it.
Curate this topic
Add this topic to your repo
To associate your repository with the
etw
topic, visit your repo's landing page and select "manage topics."
Learn more
You can’t perform that action at this time.
You signed in with another tab or window. Reload to refresh your session.
You signed out in another tab or window. Reload to refresh your session.
Currently, profiling can end because of two “triggers” (not considering errors):
Point 1.) is achieved with waiting on the target process’ HANDLE, and explicitly stopping the profiler, when the object gets signaled.
Point 2.) is dealt with using a Console Control Handler.
It would be useful to introduce another mechani