| 25 | |
| 26 | |
| 27 | BOOL ManagerApplyNewTargets(std::vector<std::string> traceNames) { |
| 28 | LOG_A(LOG_INFO, "Trace targets: %zu targets", traceNames.size()); |
| 29 | for (const auto& target : traceNames) { |
| 30 | LOG_A(LOG_INFO, " - %s", target.c_str()); |
| 31 | } |
| 32 | g_Config.targetProcessNames = traceNames; |
| 33 | |
| 34 | // DLL |
| 35 | // -> Automatic upon connect of DLL (initiated by Kernel) |
| 36 | |
| 37 | // ETW |
| 38 | if (g_Config.do_etw) { |
| 39 | // Re-evaluate all cached processes with the new target names |
| 40 | g_ProcessResolver.SetTargetNames(g_Config.targetProcessNames); |
| 41 | g_ProcessResolver.RefreshTargetMatching(); |
| 42 | } |
| 43 | |
| 44 | // Kernel Config |
| 45 | if (g_Config.do_kernel) { |
| 46 | // Kernel driver only supports one target at a time, use the first one |
| 47 | LOG_A(LOG_INFO, "Manager: Configure kernel module"); |
| 48 | if (!ConfigureKernelDriver(true)) { |
| 49 | LOG_A(LOG_ERROR, "Manager: Could not communicate with kernel driver, aborting."); |
| 50 | return FALSE; |
| 51 | } |
| 52 | } |
| 53 | |
| 54 | // PPL |
| 55 | if (g_Config.do_etwti) { |
| 56 | LOG_A(LOG_INFO, "Manager: Tell ETW-TI about new targets: %zu names", g_Config.targetProcessNames.size()); |
| 57 | if (!EnablePplProducer(true, g_Config.targetProcessNames, g_Config.do_defendertrace)) { |
| 58 | LOG_A(LOG_ERROR, "Manager: Failed to enable PPL producer"); |
| 59 | return FALSE; |
| 60 | } |
| 61 | } |
| 62 | |
| 63 | return TRUE; |
| 64 | } |
| 65 | |
| 66 | |
| 67 | BOOL ManagerStart(std::vector<HANDLE>& threads) { |
no test coverage detected