Function LogProcessTelemetryLoggingFlags

RedEdrDriver/kcallbacks.c:125–175

Query and debug-log the current PROCESS_LOGGING_INFORMATION flags for a process.

// Query and debug-log the current PROCESS_LOGGING_INFORMATION flags for a process.
static void LogProcessTelemetryLoggingFlags(PEPROCESS Process, HANDLE pid) {
    HANDLE hProcess = NULL;
    NTSTATUS status;

    status = ObOpenObjectByPointer(
        Process,
        OBJ_KERNEL_HANDLE,
        NULL,
        PROCESS_ALL_ACCESS,
        *PsProcessType,
        KernelMode,
        &hProcess
    );
    if (!NT_SUCCESS(status)) {
        LOG_A(LOG_INFO, "[RedEdr] LogProcessTelemetryLoggingFlags: ObOpenObjectByPointer failed for pid %llu: 0x%08X\n", (ULONG64)pid, status);
        return;
    }

    if (g_ZwQueryInformationProcess == NULL) {
        ZwClose(hProcess);
        return;
    }

    PROCESS_LOGGING_INFORMATION loggingInfo = { 0 };
    ULONG returnLength = 0;
    status = g_ZwQueryInformationProcess(
        hProcess,
        ProcessLoggingInformation,
        &loggingInfo,
        sizeof(loggingInfo),
        &returnLength
    );
    ZwClose(hProcess);

    if (!NT_SUCCESS(status)) {
        LOG_A(LOG_INFO, "[RedEdr] LogProcessTelemetryLoggingFlags: ZwQueryInformationProcess failed for pid %llu: 0x%08X\n", (ULONG64)pid, status);
        return;
    }

    LOG_A(LOG_INFO, "[RedEdr] pid %llu ETW-TI flags=0x%02X: ReadVM=%d WriteVM=%d ProcSuspRes=%d ThrSuspRes=%d LocalExecProt=%d RemoteExecProt=%d Impersonation=%d reserved=0x%02X\n",
        (ULONG64)pid,
        loggingInfo.Flags,
        loggingInfo.Bits.EnableReadVmLogging,
        loggingInfo.Bits.EnableWriteVmLogging,
        loggingInfo.Bits.EnableProcessSuspendResumeLogging,
        loggingInfo.Bits.EnableThreadSuspendResumeLogging,
        loggingInfo.Bits.EnableLocalExecProtectVmLogging,
        loggingInfo.Bits.EnableRemoteExecProtectVmLogging,
        loggingInfo.Bits.EnableImpersonationLogging,
        loggingInfo.Bits.Reserved);
}


// Enumerate all running processes and call EnableProcessTelemetryLogging for