Skip to content

v0.5 - Process Callback

Choose a tag to compare

View all tags
@HalfTimeOfLife HalfTimeOfLife released this 02 Aug 11:57
· 21 commits to main since this release
v0.5
ac76b9b

The first sensor is live: process create/exit events are now captured, queued, and written to disk as structured JSONL.

Added

  • process_callback.c/process_callback.h: PsSetCreateProcessNotifyRoutineEx callback, logs process create/exit
  • Registered/unregistered in DriverEntry/DriverUnload
  • event_types.h: KDAMON_PROCESS_EVENT_DATA (PID, PPID, create/exit flag, fixed-size image name)
  • log_writer.c: KdaMonLogWriterWriteProcessEvent, dispatched via switch in KdaMonLogWriterWriteEvent
  • log_writer.c: KdaMonJsonEscapeW helper for safe JSON string escaping of NT-style paths
  • Reuses event_queue.c (v0.3) and the log writer pipeline (v0.4) unchanged

Fixed

  • EventBuffer in log_writer.c undersized for worst-case process event payload (256 → 1000 bytes), causing silent event drops on long paths
  • ppid now serialized as JSON null instead of 0 for exit events, where no parent PID is provided by the kernel

Notes

  • Validated on Windows test VM: process create/exit lifecycle confirmed via DbgView and resulting .jsonl
Assets 2
Loading