| 65 | |
| 66 | |
| 67 | BOOL ManagerStart(std::vector<HANDLE>& threads) { |
| 68 | LOG_A(LOG_INFO, "Manager: Starting all subsystems..."); |
| 69 | try { |
| 70 | // Kernel: Load module, and reader |
| 71 | if (g_Config.do_kernel) { |
| 72 | // Kernel: Driver load |
| 73 | if (!IsServiceRunning(g_Config.driverName)) { |
| 74 | LOG_A(LOG_INFO, "Manager: Kernel Driver load"); |
| 75 | if (!LoadKernelDriver()) { |
| 76 | LOG_A(LOG_ERROR, "Manager: Kernel driver could not be loaded"); |
| 77 | return FALSE; |
| 78 | } |
| 79 | } |
| 80 | |
| 81 | // Kernel: Start Reader Thread |
| 82 | LOG_A(LOG_INFO, "Manager: Kernel Reader init"); |
| 83 | if (!KernelReaderInit(threads)) { |
| 84 | LOG_A(LOG_ERROR, "Manager: Failed to initialize kernel reader"); |
| 85 | return FALSE; |
| 86 | } |
| 87 | } |
| 88 | if (g_Config.do_hook || g_Config.debug_dllreader) { |
| 89 | // Hook: Start DLL Reader Thread |
| 90 | LOG_A(LOG_INFO, "Manager: InjectedDll reader thread start"); |
| 91 | if (!DllReaderInit(threads)) { |
| 92 | LOG_A(LOG_ERROR, "Manager: Failed to initialize DLL reader"); |
| 93 | return FALSE; |
| 94 | } |
| 95 | } |
| 96 | |
| 97 | // Load: ETW-TI |
| 98 | if (g_Config.do_etwti) { |
| 99 | // Start PPL service first (if not already) |
| 100 | LOG_A(LOG_INFO, "Manager: Start ETW-TI PPL service"); |
| 101 | if (!StartThePplService()) { |
| 102 | LOG_A(LOG_ERROR, "Manager: Failed to initialize PPL service"); |
| 103 | return FALSE; |
| 104 | } |
| 105 | |
| 106 | // Start PPL Reader Thread for dedicated data pipe |
| 107 | // will wait for client connection |
| 108 | LOG_A(LOG_INFO, "Manager: PPL Reader init"); |
| 109 | if (!PplReaderInit(threads)) { |
| 110 | LOG_A(LOG_ERROR, "Manager: Failed to initialize PPL reader"); |
| 111 | return FALSE; |
| 112 | } |
| 113 | |
| 114 | |
| 115 | // Connect to PPL service pipe |
| 116 | // it will connect back to the pipe created above when we connect |
| 117 | LOG_A(LOG_INFO, "Manager: Connect to ETW-TI PPL service pipe"); |
| 118 | if (!ConnectPplService()) { |
| 119 | LOG_A(LOG_ERROR, "ETW-TI: Failed to connect to PPL service pipe"); |
| 120 | return FALSE; |
| 121 | } |
| 122 | |
| 123 | // notify service about initial target |
| 124 | LOG_A(LOG_INFO, "Manager: Configure ETW-TI PPL"); |
no test coverage detected