| 62 | } |
| 63 | |
| 64 | static bool CopyRecordingToggleHistory(std::vector<uint64_t>* recordingToggleHistory) |
| 65 | { |
| 66 | std::vector<uint64_t> newToggles; |
| 67 | bool currentRecordingState; |
| 68 | { |
| 69 | EnterCriticalSection(&gRecordingToggleCS); |
| 70 | newToggles.swap(gRecordingToggleHistory); |
| 71 | currentRecordingState = gIsRecording; |
| 72 | LeaveCriticalSection(&gRecordingToggleCS); |
| 73 | } |
| 74 | |
| 75 | recordingToggleHistory->insert(recordingToggleHistory->end(), newToggles.begin(), newToggles.end()); |
| 76 | return currentRecordingState; |
| 77 | } |
| 78 | |
| 79 | // Processes are handled differently when running in realtime collection vs. |
| 80 | // ETL collection. When reading an ETL, we receive NT_PROCESS events whenever |