System Activity Monitor (SAM) is a research tool that enables detailed recording of system and application behavior and resource usage.

Bypassing Event Tracing for Windows (ETW) with CSharp

flatkrabsetw is a flat-C wrapper around the krabsetw C++ library. It's primarily meant for FFI usage in other languages.

Open Power Performance Analysis Tool

The internal Windows structures hack to create the in-process private ETW session

A simple example application to collect DNS queries logs using etw-api

This script is used to bypass DLL Hooking using a fresh mapped copy of ntdll file, patch the ETW and trigger a shellcode with process hollowing

Sampling profiler for native applications on Windows, based on ETW

Simple project that demonstrates how an ETW consumer can be created just by using NTDLL

让Etwhook再次伟大! Make InfinityHook Great Again!

KrabsETW provides a modern C++ wrapper and a .NET wrapper around the low-level ETW trace consumption functions.

C/C++ Performance Profiler