Skip to content

Commit

Permalink
Set ETW provider info so it's always treated as TraceLogging
Browse files Browse the repository at this point in the history
Signed-off-by: Kevin Parsons <[email protected]>
  • Loading branch information
Kevin Parsons committed Jan 17, 2019
1 parent 6c8aa41 commit 7dba96a
Show file tree
Hide file tree
Showing 4 changed files with 38 additions and 3 deletions.
1 change: 1 addition & 0 deletions internal/etw/etw.go
Original file line number Diff line number Diff line change
Expand Up @@ -12,3 +12,4 @@ package etw
//sys eventRegister(providerId *windows.GUID, callback uintptr, callbackContext uintptr, providerHandle *providerHandle) (win32err error) = advapi32.EventRegister
//sys eventUnregister(providerHandle providerHandle) (win32err error) = advapi32.EventUnregister
//sys eventWriteTransfer(providerHandle providerHandle, descriptor *EventDescriptor, activityID *windows.GUID, relatedActivityID *windows.GUID, dataDescriptorCount uint32, dataDescriptors *eventDataDescriptor) (win32err error) = advapi32.EventWriteTransfer
//sys eventSetInformation(providerHandle providerHandle, class eventInfoClass, information uintptr, length uint32) (win32err error) = advapi32.EventSetInformation
6 changes: 6 additions & 0 deletions internal/etw/eventopt.go
Original file line number Diff line number Diff line change
Expand Up @@ -36,6 +36,12 @@ func WithKeyword(keyword uint64) EventOpt {
}
}

func WithChannel(channel Channel) EventOpt {
return func(options *eventOptions) {
options.descriptor.Channel = channel
}
}

// WithTags specifies the tags of the event to be written. Tags is a 28-bit
// value (top 4 bits are ignored) which are interpreted by the event consumer.
func WithTags(newTags uint32) EventOpt {
Expand Down
19 changes: 19 additions & 0 deletions internal/etw/provider.go
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,7 @@ import (
"encoding/binary"
"strings"
"unicode/utf16"
"unsafe"

"golang.org/x/sys/windows"
)
Expand Down Expand Up @@ -41,6 +42,15 @@ const (
ProviderStateCaptureState
)

type eventInfoClass uint32

const (
eventInfoClassProviderBinaryTrackInfo eventInfoClass = iota
eventInfoClassProviderSetReserved1
eventInfoClassProviderSetTraits
eventInfoClassProviderUseDescriptorType
)

// EnableCallback is the form of the callback function that receives provider
// enable/disable notifications from ETW.
type EnableCallback func(*windows.GUID, ProviderState, Level, uint64, uint64, uintptr)
Expand Down Expand Up @@ -133,6 +143,15 @@ func NewProviderWithID(name string, id *windows.GUID, callback EnableCallback) (
binary.LittleEndian.PutUint16(metadata.Bytes(), uint16(metadata.Len())) // Update the size at the beginning of the buffer
provider.metadata = metadata.Bytes()

if err := eventSetInformation(
provider.handle,
eventInfoClassProviderSetTraits,
uintptr(unsafe.Pointer(&provider.metadata[0])),
uint32(len(provider.metadata))); err != nil {

return nil, err
}

return provider, nil
}

Expand Down
15 changes: 12 additions & 3 deletions internal/etw/zsyscall_windows.go

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

0 comments on commit 7dba96a

Please sign in to comment.