void kernel_trace_004::start()
{
krabs::kernel_trace trace(L"Memory Trace");
krabs::kernel::virtual_alloc_provider provider;
// Kernel providers accept all the typical callback mechanisms.
provider.add_on_event_callback([](const EVENT_RECORD& record, const krabs::trace_context& trace_context) {
krabs::schema schema(record, trace_context.schema_locator);
for (int i = 0; i < record.ExtendedDataCount; i++) {
//auto extended_data_item = &record.ExtendedData[i];
}
});
CLASSIC_EVENT_ID StackTracingEvents[2];
StackTracingEvents[0].EventGuid = krabs::guids::page_fault;
StackTracingEvents[0].Type = 98; // VirtualAlloc
memset(StackTracingEvents[0].Reserved, 0, sizeof(StackTracingEvents[0].Reserved));
StackTracingEvents[1].EventGuid = krabs::guids::page_fault;
StackTracingEvents[1].Type = 99; // VirtualFree
memset(StackTracingEvents[1].Reserved, 0, sizeof(StackTracingEvents[1].Reserved));
trace.set_trace_information(TraceStackTracingInfo, &StackTracingEvents, sizeof(StackTracingEvents));
trace.enable(provider);
trace.start();
}
virtual alloc trace is easy, but record.ExtendedDataCount is 0, how to get call stack?
Thanks.
virtual alloc trace is easy, but record.ExtendedDataCount is 0, how to get call stack?
Thanks.