Addition of Tracing hooks

[cccs-mog]

No description provided.

[cccs-kevin]

👀

[kevoreilly]

It would be great to get these hooks tested and merged - are you able to provide something to test them, either a sample or compiled test code?

[cccs-mog]

I have been using an exe version of https://github.com/asgarciap/etw-dns, https://github.com/microsoft/dotnet-samples/tree/master/Microsoft.Diagnostics.Tracing, https://github.com/mxProject/EtwLogViewer, https://github.com/zodiacon/ProcMonXv2(or directly procmon for network events) and https://github.com/hasherezade/hollows_hunter. I also have been using https://learn.microsoft.com/en-us/windows-hardware/test/wpt/xperf-command-line-reference (Xperf for simple tests in bash script). Should be able to provide that using the usual method.

[kevoreilly]

Thanks for the info - I just set about compiling the PR in order to start testing. Unfortunately the code seems to be generating a large number of warnings relating to string types.

For example, looking at the first warning:

1>d:\work\cape\capemon\hook_trace.c(31): warning C4133: 'function': incompatible types - from 'LPWSTR' to 'char *const '

It relates to the line:

sprintf( str, fmt, pSid->Revision,

Here the type definition is LPWSTR str which is a wide string, but sprintf takes type char*. The rest of the warnings are similar making me wonder how you are compiling at your end. But ultimately it needs to compile in VS2017, would you be able to address these warnings?

[cccs-mog]

Fixed the warning, haven't had a chance to test the change yet. Will comment back/commit after being able to test the recent change. Thanks