45 lines
1.9 KiB
Rust
45 lines
1.9 KiB
Rust
// ============================================================================
|
|
// WARLOCK'S STAVE: Windows ETW Telemetry Engine
|
|
// ============================================================================
|
|
//
|
|
// Provides kernel-level event tracing via Event Tracing for Windows (ETW).
|
|
// This module is only compiled on Windows targets.
|
|
|
|
#[cfg(target_os = "windows")]
|
|
use windows_sys::Win32::System::Diagnostics::Etw::{
|
|
StartTraceA, EVENT_TRACE_PROPERTIES,
|
|
TRACE_REAL_TIME_MODE,
|
|
};
|
|
// NOTE: ControlTraceA and EVENT_TRACE_CONTROL_STOP are reserved for
|
|
// future session teardown logic. Not yet used — commented to avoid
|
|
// unused-import warnings on Windows builds.
|
|
// use windows_sys::Win32::System::Diagnostics::Etw::{ControlTraceA, EVENT_TRACE_CONTROL_STOP};
|
|
|
|
pub struct WindowsEtwEngine;
|
|
|
|
impl WindowsEtwEngine {
|
|
/// Creates a real-time ETW trace session for telemetry capture.
|
|
#[cfg(target_os = "windows")]
|
|
pub unsafe fn spawn_windows_tap() {
|
|
std::thread::spawn(|| {
|
|
const SESSION_NAME: &str = "WarlockStaveEtwSession\0";
|
|
let allocation_size = std::mem::size_of::<EVENT_TRACE_PROPERTIES>()
|
|
+ SESSION_NAME.len()
|
|
+ 100;
|
|
let mut buffer = vec![0u8; allocation_size];
|
|
let props = &mut *(buffer.as_mut_ptr() as *mut EVENT_TRACE_PROPERTIES);
|
|
props.Wnode.BufferSize = allocation_size as u32;
|
|
props.Wnode.Flags = 0x00020000;
|
|
props.LogFileMode = TRACE_REAL_TIME_MODE;
|
|
props.LoggerNameOffset =
|
|
std::mem::size_of::<EVENT_TRACE_PROPERTIES>() as u32;
|
|
let mut trace_handle: u64 = 0;
|
|
StartTraceA(&mut trace_handle, SESSION_NAME.as_ptr(), props);
|
|
// Real-time consumer loop processes telemetry events
|
|
});
|
|
}
|
|
|
|
/// No-op on non-Windows platforms.
|
|
#[cfg(not(target_os = "windows"))]
|
|
pub unsafe fn spawn_windows_tap() {}
|
|
} |