ETW system calls tracing

我们两清 提交于 2019-12-25 15:18:09

问题


How one could get a process id who generated the system call in ETW? As long as ProcessID and ThreadID members of event header are = to -1, this can't be used. I heard about activating CSWitch flag to capture every single context switch, but that only gives me, NewThreadId and OldThreadId according the MOF class. I want the process id too.

Thanks

来源:https://stackoverflow.com/questions/26440639/etw-system-calls-tracing

标签
易学教程内所有资源均来自网络或用户发布的内容,如有违反法律规定的内容欢迎反馈
该文章没有解决你所遇到的问题?点击提问,说说你的问题,让更多的人一起探讨吧!