main.cpp

#include "stdafx.h"

// ============================================
// EtwTi-FluctuationMonitor v3.0
// 主程序入口
// 
// 功能：监控ETW-TI事件和内核回调事件
// ============================================

// 全局ETW追踪对象
krabs::user_trace g_trace(L"EtwTi-FluctuationMonitor_v3.0");

// 全局标志
static std::atomic<bool> g_Running(true);
static std::atomic<bool> g_UseDriver(true);
static std::atomic<uint64_t> g_totalEvents(0);
static std::atomic<uint64_t> g_errorEvents(0);

// 驱动设备句柄
static HANDLE g_DriverDevice = INVALID_HANDLE_VALUE;

// ============================================
// 辅助函数
// ============================================

bool IsCrossProcessOperation(DWORD CallingProcessId, DWORD TargetProcessId) {
    return CallingProcessId != TargetProcessId;
}

std::wstring SafeProcessName(DWORD processId) {
    try {
        return ProcessName(processId);
    }
    catch (...) {
        wchar_t buffer[64];
        wsprintf(buffer, L"pid:%d", processId);
        return buffer;
    }
}

// NT路径转DOS路径
// 输入: \Device\HarddiskVolume3\Windows\System32\cmd.exe
// 输出: C:\Windows\System32\cmd.exe
std::wstring NtPathToDosPath(const std::wstring& ntPath) {
    if (ntPath.empty()) {
        return L"";
    }
    
    // 检查是否是NT路径格式
    if (ntPath.find(L"\\Device\\") != 0) {
        // 不是NT路径，直接返回
        return ntPath;
    }
    
    static std::vector<std::pair<std::wstring, std::wstring>> driveMap;
    static bool initialized = false;
    
    // 初始化驱动器映射
    if (!initialized) {
        for (wchar_t drive = L'A'; drive <= L'Z'; drive++) {
            wchar_t drivePath[] = L"X:";
            drivePath[0] = drive;
            
            wchar_t targetPath[MAX_PATH];
            if (QueryDosDeviceW(drivePath, targetPath, MAX_PATH) > 0) {
                driveMap.push_back({ std::wstring(targetPath), std::wstring(drivePath) + L"\\" });
            }
        }
        initialized = true;
    }
    
    // 查找匹配的驱动器
    for (const auto& pair : driveMap) {
        const std::wstring& devicePath = pair.first;
        const std::wstring& dosPath = pair.second;
        
        if (ntPath.length() >= devicePath.length() &&
            _wcsnicmp(ntPath.c_str(), devicePath.c_str(), devicePath.length()) == 0) {
            // 找到匹配，替换为DOS路径
            return dosPath + ntPath.substr(devicePath.length());
        }
    }
    
    // 未找到映射，返回原始路径
    return ntPath;
}

// 从完整路径提取文件名
std::wstring ExtractFileName(const std::wstring& fullPath) {
    if (fullPath.empty()) {
        return L"";
    }
    
    size_t lastSlash = fullPath.find_last_of(L"\\/");
    if (lastSlash != std::wstring::npos && lastSlash < fullPath.length() - 1) {
        return fullPath.substr(lastSlash + 1);
    }
    
    return fullPath;
}

// ============================================
// 启用进程 ETW-TI 日志记录
// 用于捕获跨进程读写等事件
// ============================================

// ProcessInformationClass 值定义
#define ProcessEnableLogging 0x60
#define ProcessEnableReadWriteVmLogging 0x57


// PROCESS_LOGGING_INFORMATION 结构体定义
// 用于 NtSetInformationProcess 的 ProcessEnableLogging (0x60) 信息类
typedef struct _PROCESS_LOGGING_INFORMATION {
    union {
        struct {
            ULONG EnableReadVmLogging : 1;              // 位 0: 启用 ReadVM 日志
            ULONG EnableWriteVmLogging : 1;             // 位 1: 启用 WriteVM 日志
            ULONG EnableProcessSuspendResumeLogging : 1; // 位 2: 启用进程挂起/恢复日志
            ULONG EnableThreadSuspendResumeLogging : 1;  // 位 3: 启用线程挂起/恢复日志
            ULONG Reserved : 28;                         // 位 4-31: 保留
        } DUMMYSTRUCTNAME;
        ULONG Flags;                                     // 完整标志位
    } DUMMYUNIONNAME;
} PROCESS_LOGGING_INFORMATION, *PPROCESS_LOGGING_INFORMATION;

typedef struct _PROCESS_READWRITEVM_LOGGING_INFORMATION
{
    union
    {
        UCHAR Flags;
        struct
        {
            UCHAR EnableReadVmLogging : 1;  // Enable logging of read operations to virtual memory.
            UCHAR EnableWriteVmLogging : 1; // Enable logging of write operations to virtual memory.
            UCHAR Unused : 6;
        };
    };
} PROCESS_READWRITEVM_LOGGING_INFORMATION, *PPROCESS_READWRITEVM_LOGGING_INFORMATION;

// 函数类型定义 - 使用 LONG 代替 NTSTATUS 以提高兼容性
typedef LONG(NTAPI* PNtSetInformationProcess)(HANDLE, ULONG, PVOID, ULONG);

// 启用 SeDebugPrivilege 权限
bool EnableDebugPrivilege() {
    HANDLE hToken = nullptr;
    TOKEN_PRIVILEGES tp;
    LUID luid;
    
    // 打开当前进程的令牌
    if (!OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &hToken)) {
        printf("[!] OpenProcessToken failed: %d\n", GetLastError());
        return false;
    }
    
    // 查找 SeDebugPrivilege 的 LUID
    if (!LookupPrivilegeValueW(nullptr, SE_DEBUG_NAME, &luid)) {
        printf("[!] LookupPrivilegeValue failed: %d\n", GetLastError());
        CloseHandle(hToken);
        return false;
    }
    
    // 设置权限
    tp.PrivilegeCount = 1;
    tp.Privileges[0].Luid = luid;
    tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
    
    if (!AdjustTokenPrivileges(hToken, FALSE, &tp, sizeof(TOKEN_PRIVILEGES), nullptr, nullptr)) {
        printf("[!] AdjustTokenPrivileges failed: %d\n", GetLastError());
        CloseHandle(hToken);
        return false;
    }
    
    CloseHandle(hToken);
    
    if (GetLastError() == ERROR_NOT_ALL_ASSIGNED) {
        printf("[!] The token does not have the specified privilege\n");
        return false;
    }
    
    printf("[+] SeDebugPrivilege enabled successfully\n");
    return true;
}

// 启用指定进程的 ETW-TI 日志记录
// 包括 ReadVM、WriteVM、进程/线程挂起恢复事件
bool EnableProcessTiLogging(DWORD processId) {
    static PNtSetInformationProcess NtSetInformationProcess = nullptr;
    static bool initialized = false;
    static bool debugPrivEnabled = false;
    
    // 延迟初始化 - 只执行一次
    if (!initialized) {
        // 首先启用 SeDebugPrivilege 权限
        debugPrivEnabled = EnableDebugPrivilege();
        
        // 获取 NtSetInformationProcess 函数地址
        HMODULE hNtdll = GetModuleHandleW(L"ntdll.dll");
        if (hNtdll != nullptr) {
            NtSetInformationProcess = (PNtSetInformationProcess)GetProcAddress(hNtdll, "NtSetInformationProcess");
        }
        initialized = true;
        
        if (NtSetInformationProcess == nullptr) {
            printf("[!] Failed to get NtSetInformationProcess address\n");
            return false;
        }
    }
    
    if (NtSetInformationProcess == nullptr) {
        return false;
    }
    
    // 打开进程句柄 - 使用 PROCESS_ALL_ACCESS
    HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, processId);
    if (hProcess == nullptr) {
        // 进程可能已经退出或权限不足
        return false;
    }
    
    // 准备 PROCESS_LOGGING_INFORMATION 结构体
    PROCESS_LOGGING_INFORMATION loggingInfo = { 0 };
    loggingInfo.EnableReadVmLogging = 1;                  // 启用 ReadVM 日志
    loggingInfo.EnableWriteVmLogging = 1;                 // 启用 WriteVM 日志
    loggingInfo.EnableProcessSuspendResumeLogging = 1;    // 启用进程挂起/恢复日志
    loggingInfo.EnableThreadSuspendResumeLogging = 1;     // 启用线程挂起/恢复日志
    loggingInfo.Reserved = 0;                              // 保留字段设为 0
    
    // 或者直接设置 Flags = 0xF (二进制: 1111)
    // loggingInfo.Flags = 0xF;
    
    // 设置 ProcessEnableLogging (0x60)
    LONG status = NtSetInformationProcess(
        hProcess,
        ProcessEnableLogging,
        &loggingInfo,
        sizeof(PROCESS_LOGGING_INFORMATION)
    );
    
    if (status < 0) {
        // 静默失败，避免刷屏（进程可能已退出或权限不足）
    }

    PROCESS_READWRITEVM_LOGGING_INFORMATION RWloggingInfo = {0};
    RWloggingInfo.EnableWriteVmLogging = 1;
    RWloggingInfo.EnableReadVmLogging = 1;

    // 设置 ProcessEnableReadWriteVmLogging (0x57)
    status = NtSetInformationProcess(
        hProcess,
        ProcessEnableReadWriteVmLogging,
        &RWloggingInfo,
        sizeof(PROCESS_READWRITEVM_LOGGING_INFORMATION)
    );
    
    if (status < 0) {
        // 静默失败，避免刷屏（进程可能已退出或权限不足）
    }

    CloseHandle(hProcess);
    
    return status >= 0;
}

// ============================================
// 进程信息缓存（进程实体管理）
// ============================================

// 进程信息结构
struct ProcessInfo {
    DWORD processId;
    std::wstring path;
    std::wstring name;
    std::wstring commandLine;
    std::chrono::steady_clock::time_point createTime;
    std::chrono::steady_clock::time_point exitTime;  // 进程退出时间（用于延迟删除）
    bool isValid;
    bool isExiting;  // 标记进程是否正在退出
};

// 进程信息缓存（进程创建时存储，退出后延迟5秒移除）
static std::unordered_map<DWORD, ProcessInfo> g_processCache;
static std::mutex g_processCacheMutex;

// 缓存保留时间（秒）- 进程退出后保留缓存以便处理延迟的TI事件
constexpr int CACHE_RETENTION_SECONDS = 5;

// 获取进程路径
std::wstring GetProcessPath(DWORD processId) {
    HANDLE hProcess = OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION, FALSE, processId);
    if (hProcess == nullptr) {
        return L"";
    }
    
    wchar_t path[MAX_PATH * 4];
    DWORD size = MAX_PATH * 4;
    
    std::wstring result;
    if (QueryFullProcessImageNameW(hProcess, 0, path, &size)) {
        result = path;
    }
    
    CloseHandle(hProcess);
    return result;
}

// 获取进程命令行（通过PEB读取）
std::wstring GetProcessCommandLine(DWORD processId) {
    std::wstring result;
    
    HANDLE hProcess = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ, FALSE, processId);
    if (hProcess == nullptr) {
        return L"";
    }
    
    // 定义函数指针类型
    typedef LONG(NTAPI* pNtQueryInformationProcess)(HANDLE, ULONG, PVOID, ULONG, PULONG);
    
    static pNtQueryInformationProcess NtQueryInformationProcess = nullptr;
    if (NtQueryInformationProcess == nullptr) {
        HMODULE hNtdll = GetModuleHandleW(L"ntdll.dll");
        if (hNtdll) {
            NtQueryInformationProcess = (pNtQueryInformationProcess)GetProcAddress(hNtdll, "NtQueryInformationProcess");
        }
    }
    
    if (NtQueryInformationProcess) {
        PROCESS_BASIC_INFORMATION pbi = { 0 };
        ULONG returnLength = 0;
        LONG status = NtQueryInformationProcess(hProcess, ProcessBasicInformation, &pbi, sizeof(pbi), &returnLength);
        
        if (status >= 0 && pbi.PebBaseAddress) {
            PEB peb = { 0 };
            SIZE_T bytesRead = 0;
            if (ReadProcessMemory(hProcess, pbi.PebBaseAddress, &peb, sizeof(peb), &bytesRead)) {
                RTL_USER_PROCESS_PARAMETERS procParams = { 0 };
                if (ReadProcessMemory(hProcess, peb.ProcessParameters, &procParams, sizeof(procParams), &bytesRead)) {
                    if (procParams.CommandLine.Length > 0 && procParams.CommandLine.Buffer) {
                        wchar_t* cmdLine = new wchar_t[procParams.CommandLine.Length / sizeof(wchar_t) + 1];
                        if (ReadProcessMemory(hProcess, procParams.CommandLine.Buffer, cmdLine,
                            procParams.CommandLine.Length, &bytesRead)) {
                            cmdLine[procParams.CommandLine.Length / sizeof(wchar_t)] = L'\0';
                            result = cmdLine;
                        }
                        delete[] cmdLine;
                    }
                }
            }
        }
    }
    
    CloseHandle(hProcess);
    return result;
}

// 缓存进程信息（进程创建时调用）
void CacheProcessInfo(DWORD processId, const std::wstring& cmdLineFromDriver = L"") {
    std::lock_guard<std::mutex> lock(g_processCacheMutex);
    
    ProcessInfo info;
    info.processId = processId;
    info.createTime = std::chrono::steady_clock::now();
    info.isValid = false;
    info.isExiting = false;
    
    // 获取进程路径
    info.path = GetProcessPath(processId);
    if (!info.path.empty()) {
        info.name = ExtractFileName(info.path);
        info.isValid = true;
    }
    
    // 获取命令行：优先使用驱动提供的，否则从进程读取
    if (!cmdLineFromDriver.empty()) {
        info.commandLine = cmdLineFromDriver;
    } else {
        info.commandLine = GetProcessCommandLine(processId);
    }
    
    g_processCache[processId] = info;
}

// 获取进程信息（从缓存获取，不阻塞）
// 如果进程已退出且超过保留时间，返回空信息
ProcessInfo GetProcessInfo(DWORD processId) {
    std::lock_guard<std::mutex> lock(g_processCacheMutex);
    
    auto it = g_processCache.find(processId);
    if (it != g_processCache.end()) {
        // 检查进程是否已退出且超过保留时间
        if (it->second.isExiting) {
            auto now = std::chrono::steady_clock::now();
            auto elapsed = std::chrono::duration_cast<std::chrono::seconds>(now - it->second.exitTime);
            if (elapsed.count() >= CACHE_RETENTION_SECONDS) {
                // 超过保留时间，移除缓存并返回空
                ProcessInfo info;
                info.processId = processId;
                info.isValid = false;
                return info;
            }
        }
        return it->second;
    }
    
    // 缓存中没有，返回空信息
    ProcessInfo info;
    info.processId = processId;
    info.isValid = false;
    return info;
}

// 异步富化进程信息（用于路径为空的进程）
void EnrichProcessInfoAsync(DWORD processId) {
    std::thread([processId]() {
        Sleep(100);  // 等待进程初始化
        
        std::lock_guard<std::mutex> lock(g_processCacheMutex);
        auto it = g_processCache.find(processId);
        if (it != g_processCache.end() && it->second.path.empty()) {
            it->second.path = GetProcessPath(processId);
            if (!it->second.path.empty()) {
                it->second.name = ExtractFileName(it->second.path);
                it->second.isValid = true;
            }
            if (it->second.commandLine.empty()) {
                it->second.commandLine = GetProcessCommandLine(processId);
            }
        }
    }).detach();
}

// 标记进程退出（进程退出时调用，延迟5秒后真正删除缓存）
void MarkProcessExiting(DWORD processId) {
    std::lock_guard<std::mutex> lock(g_processCacheMutex);
    
    auto it = g_processCache.find(processId);
    if (it != g_processCache.end()) {
        it->second.isExiting = true;
        it->second.exitTime = std::chrono::steady_clock::now();
    }
    
    // 启动延迟删除线程（5秒后删除）
    std::thread([processId]() {
        Sleep(CACHE_RETENTION_SECONDS * 1000);
        std::lock_guard<std::mutex> lock(g_processCacheMutex);
        g_processCache.erase(processId);
    }).detach();
}

// ============================================
// 驱动事件处理
// ============================================

void HandleDriverProcessEvent(PPROCESS_EVENT_DATA eventData) {
    const char* eventTypeStr = (eventData->EventType == EventProcessCreate) ? "PROCESS_CREATE" : "PROCESS_EXIT";
    
    if (eventData->EventType == EventProcessCreate) {
        // 进程创建：缓存进程信息
        std::wstring cmdLine;
        if (eventData->CommandLineLength > 0 && eventData->CommandLine[0] != L'\0') {
            cmdLine = eventData->CommandLine;
        }
        CacheProcessInfo(eventData->ProcessId, cmdLine);
        
        // 为新创建的进程启用 ETW-TI 日志记录
        EnableProcessTiLogging(eventData->ProcessId);
    }
    
    // 获取进程信息
    ProcessInfo procInfo = GetProcessInfo(eventData->ProcessId);
    
    // 新格式输出
    printf("[%s]\n", GetCurrentTimestamp().c_str());
    printf("PROCESS: %S | PID: %lu | PATH: %S | COMMANDLINE: %S | EVENT: %s\n",
        procInfo.name.empty() ? L"<unknown>" : procInfo.name.c_str(),
        eventData->ProcessId,
        procInfo.path.empty() ? L"<unknown>" : procInfo.path.c_str(),
        procInfo.commandLine.empty() ? L"<none>" : procInfo.commandLine.c_str(),
        eventTypeStr);
    
    // 进程创建事件：显示创建者进程信息
    if (eventData->EventType == EventProcessCreate && eventData->ParentProcessId != 0) {
        ProcessInfo parentProc = GetProcessInfo(eventData->ParentProcessId);
        printf("CREATED_BY: %S | ParentPID: %lu\n",
            parentProc.name.empty() ? L"<unknown>" : parentProc.name.c_str(),
            eventData->ParentProcessId);
    }
    
    // 打印调用栈（创建者进程调用CreateProcess的调用栈）
    if (eventData->StackDepth > 0) {
        printf("CALLSTACK: ");
        for (USHORT i = 0; i < eventData->StackDepth; i++) {
            if (i > 0) printf(" | ");
            printf("0x%llx", eventData->StackTrace[i]);
        }
        printf("\n");
    }
    
    if (eventData->EventType == EventProcessExit) {
        // 进程退出：标记为退出状态，延迟5秒后删除缓存
        MarkProcessExiting(eventData->ProcessId);
    }
    else if (procInfo.path.empty()) {
        // 如果路径为空，异步富化
        EnrichProcessInfoAsync(eventData->ProcessId);
    }
}

void HandleDriverThreadEvent(PTHREAD_EVENT_DATA eventData) {
    if (eventData->EventType != EventThreadCreate) {
        return;
    }
    
    // 获取目标进程信息 (线程所属进程)
    ProcessInfo targetProc = GetProcessInfo(eventData->ProcessId);
    
    // 获取创建者进程信息
    ProcessInfo creatorProc = GetProcessInfo(eventData->CreatorProcessId);
    
    // 判断是否为远程线程创建
    bool isRemoteThread = (eventData->CreatorProcessId != eventData->ProcessId);
    const char* eventTypeStr = isRemoteThread ? "REMOTE_THREAD_CREATE" : "THREAD_CREATE";
    
    // 新格式输出
    printf("[%s]\n", GetCurrentTimestamp().c_str());
    printf("PROCESS: %S | PID: %lu | PATH: %S | COMMANDLINE: %S | EVENT: %s\n",
        creatorProc.name.empty() ? L"<unknown>" : creatorProc.name.c_str(),
        eventData->CreatorProcessId,
        creatorProc.path.empty() ? L"<unknown>" : creatorProc.path.c_str(),
        creatorProc.commandLine.empty() ? L"<unknown>" : creatorProc.commandLine.c_str(),
        eventTypeStr);
    
    if (isRemoteThread) {
        // 远程线程创建：显示详细信息
        printf("INFO: CreatorProcess=%S(%lu) -> TargetProcess=%S(%lu) TargetTID=%lu\n",
            creatorProc.name.empty() ? L"<unknown>" : creatorProc.name.c_str(),
            eventData->CreatorProcessId,
            targetProc.name.empty() ? L"<unknown>" : targetProc.name.c_str(),
            eventData->ProcessId,
            eventData->ThreadId);
    } else {
        // 本地线程创建
        printf("INFO: ThreadId=%lu\n", eventData->ThreadId);
    }
    
    // 打印调用栈 (创建者进程调用CreateThread/CreateRemoteThread的调用栈)
    if (eventData->StackDepth > 0) {
        printf("CALLSTACK: ");
        for (USHORT i = 0; i < eventData->StackDepth; i++) {
            if (i > 0) printf(" | ");
            printf("0x%llx", eventData->StackTrace[i]);
        }
        printf("\n");
    }
}

void HandleDriverImageEvent(PIMAGE_EVENT_DATA eventData) {
    // 获取进程信息
    ProcessInfo procInfo = GetProcessInfo(eventData->ProcessId);
    
    // 转换NT路径到DOS路径
    std::wstring imagePath = NtPathToDosPath(eventData->ImagePath);
    
    // 新格式输出
    printf("[%s]\n", GetCurrentTimestamp().c_str());
    printf("PROCESS: %S | PID: %lu | PATH: %S | COMMANDLINE: %S | EVENT: IMAGE_LOAD\n",
        procInfo.name.empty() ? L"<unknown>" : procInfo.name.c_str(),
        eventData->ProcessId,
        procInfo.path.empty() ? L"<unknown>" : procInfo.path.c_str(),
        procInfo.commandLine.empty() ? L"<unknown>" : procInfo.commandLine.c_str());
    printf("INFO: ImagePath=%S BaseAddress=0x%llx ImageSize=0x%lx\n",
        imagePath.c_str(), eventData->ImageBase, eventData->ImageSize);
    
    // 打印调用栈
    if (eventData->StackDepth > 0) {
        printf("CALLSTACK: ");
        for (USHORT i = 0; i < eventData->StackDepth; i++) {
            if (i > 0) printf(" | ");
            printf("0x%llx", eventData->StackTrace[i]);
        }
        printf("\n");
    }
}

// 驱动事件读取线程
DWORD WINAPI DriverEventThread(LPVOID param) {
    // 增大缓冲区以适应调用栈数据
    UCHAR buffer[8192];
    ULONG bytesReturned;
    
    while (g_Running) {
        if (ReadDriverEvent(g_DriverDevice, buffer, sizeof(buffer), &bytesReturned)) {
            if (bytesReturned >= sizeof(ULONG)) {
                PULONG eventType = (PULONG)buffer;
                
                g_totalEvents++;
                
                switch (*eventType) {
                case EventProcessCreate:
                case EventProcessExit:
                    if (bytesReturned >= sizeof(PROCESS_EVENT_DATA)) {
                        HandleDriverProcessEvent((PPROCESS_EVENT_DATA)buffer);
                    }
                    break;
                    
                case EventThreadCreate:
                    // 线程退出事件不再监控
                    if (bytesReturned >= sizeof(THREAD_EVENT_DATA)) {
                        HandleDriverThreadEvent((PTHREAD_EVENT_DATA)buffer);
                    }
                    break;
                    
                case ImageLoad:
                    if (bytesReturned >= sizeof(IMAGE_EVENT_DATA)) {
                        HandleDriverImageEvent((PIMAGE_EVENT_DATA)buffer);
                    }
                    break;
                }
            }
        }
        else {
            // 短暂休眠避免CPU占用过高
            Sleep(10);
        }
    }
    
    return 0;
}

// ============================================
// ETW事件回调处理函数
// ============================================

// 事件ID转换为可读字符串 (基于 doc/etw-ti.yaml 中的事件定义)
// 返回格式: "EVENT_NAME(ID)"
std::string GetEventString(USHORT eventId) {
    std::string eventName;
    switch (eventId) {
        // 基础事件 (REMOTE 变体)
        case 1: eventName = "ALLOCVM_REMOTE"; break;
        case 2: eventName = "PROTECTVM_REMOTE"; break;
        case 3: eventName = "MAPVIEW_REMOTE"; break;
        case 4: eventName = "QUEUEUSERAPC_REMOTE"; break;
        case 5: eventName = "SETTHREADCONTEXT_REMOTE"; break;
        // 基础事件 (LOCAL 变体)
        case 6: eventName = "ALLOCVM_LOCAL"; break;
        case 7: eventName = "PROTECTVM_LOCAL"; break;
        case 8: eventName = "MAPVIEW_LOCAL"; break;
        // READ/WRITE VM 事件
        case 11: eventName = "READVM_LOCAL"; break;
        case 12: eventName = "WRITEVM_LOCAL"; break;
        case 13: eventName = "READVM_REMOTE"; break;
        case 14: eventName = "WRITEVM_REMOTE"; break;
        // 线程挂起/恢复事件
        case 15: eventName = "SUSPEND_THREAD"; break;
        case 16: eventName = "RESUME_THREAD"; break;
        // 进程挂起/恢复/冻结/解冻事件
        case 17: eventName = "SUSPEND_PROCESS"; break;
        case 18: eventName = "RESUME_PROCESS"; break;
        case 19: eventName = "FREEZE_PROCESS"; break;
        case 20: eventName = "THAW_PROCESS"; break;
        // KERNEL_CALLER 变体事件
        case 21: eventName = "ALLOCVM_REMOTE_KERNEL_CALLER"; break;
        case 22: eventName = "PROTECTVM_REMOTE_KERNEL_CALLER"; break;
        case 23: eventName = "MAPVIEW_REMOTE_KERNEL_CALLER"; break;
        case 24: eventName = "QUEUEUSERAPC_REMOTE_KERNEL_CALLER"; break;
        case 25: eventName = "SETTHREADCONTEXT_REMOTE_KERNEL_CALLER"; break;
        case 26: eventName = "ALLOCVM_LOCAL_KERNEL_CALLER"; break;
        case 27: eventName = "PROTECTVM_LOCAL_KERNEL_CALLER"; break;
        case 28: eventName = "MAPVIEW_LOCAL_KERNEL_CALLER"; break;
        // 驱动/设备事件
        case 29: eventName = "DRIVER_LOAD"; break;
        case 30: eventName = "DRIVER_UNLOAD"; break;
        case 31: eventName = "DEVICE_CREATE"; break;
        case 32: eventName = "DEVICE_CLOSE"; break;
        default: eventName = "UNKNOWN"; break;
    }
    return eventName + "(" + std::to_string(eventId) + ")";
}

void HandleAllocVmEvent(const EVENT_RECORD& record, const krabs::trace_context& trace_context) {
    try {
        krabs::schema schema(record, trace_context.schema_locator);
        krabs::parser parser(schema);

        auto CallingProcessId = parser.parse<DWORD>(L"CallingProcessId");
        auto TargetProcessId = parser.parse<DWORD>(L"TargetProcessId");
        auto BaseAddress = parser.parse<PVOID>(L"BaseAddress");
        auto RegionSize = parser.parse<SIZE_T>(L"RegionSize");
        auto AllocationType = parser.parse<DWORD>(L"AllocationType");
        auto ProtectionMask = parser.parse<DWORD>(L"ProtectionMask");

        g_totalEvents++;
        
        // 获取进程信息
        ProcessInfo callingProc = GetProcessInfo(CallingProcessId);
        ProcessInfo targetProc = GetProcessInfo(TargetProcessId);
        
        // 判断是否为跨进程操作
        bool isCrossProcess = IsCrossProcessOperation(CallingProcessId, TargetProcessId);

        // 新格式输出
        printf("[%s]\n", GetCurrentTimestamp().c_str());
        printf("PROCESS: %S | PID: %lu | PATH: %S | COMMANDLINE: %S | EVENT: %s\n",
            callingProc.name.empty() ? L"<unknown>" : callingProc.name.c_str(),
            CallingProcessId,
            callingProc.path.empty() ? L"<unknown>" : callingProc.path.c_str(),
            callingProc.commandLine.empty() ? L"<unknown>" : callingProc.commandLine.c_str(),
            GetEventString(record.EventHeader.EventDescriptor.Id).c_str());
        printf("INFO: TargetProcess=%S(%lu) BaseAddress=0x%p RegionSize=0x%llx AllocationType=0x%x Protection=%s\n",
            targetProc.name.empty() ? L"<unknown>" : targetProc.name.c_str(),
            TargetProcessId,
            BaseAddress, (unsigned long long)RegionSize, AllocationType, ProtectionString(ProtectionMask));
        
        // 打印调用栈（仅跨进程分配事件）
        if (isCrossProcess) {
            auto stack = schema.stack_trace();
            if (!stack.empty()) {
                printf("CALLSTACK: ");
                for (size_t i = 0; i < stack.size(); i++) {
                    if (i > 0) printf(" | ");
                    printf("0x%p", (void*)stack[i]);
                }
                printf("\n");
            }
        }
    }
    catch (const std::exception& e) {
        printf("[ERROR] ALLOCVM parse failed: %s\n", e.what());
        g_errorEvents++;
    }
}

void HandleProtectVmEvent(const EVENT_RECORD& record, const krabs::trace_context& trace_context) {
    try {
        krabs::schema schema(record, trace_context.schema_locator);
        krabs::parser parser(schema);

        auto CallingProcessId = parser.parse<DWORD>(L"CallingProcessId");
        auto TargetProcessId = parser.parse<DWORD>(L"TargetProcessId");
        auto BaseAddress = parser.parse<PVOID>(L"BaseAddress");
        auto RegionSize = parser.parse<SIZE_T>(L"RegionSize");
        auto ProtectionMask = parser.parse<DWORD>(L"ProtectionMask");
        auto LastProtectionMask = parser.parse<DWORD>(L"LastProtectionMask");

        g_totalEvents++;
        
        // 获取进程信息
        ProcessInfo callingProc = GetProcessInfo(CallingProcessId);
        ProcessInfo targetProc = GetProcessInfo(TargetProcessId);

        // 新格式输出
        printf("[%s]\n", GetCurrentTimestamp().c_str());
        printf("PROCESS: %S | PID: %lu | PATH: %S | COMMANDLINE: %S | EVENT: %s\n",
            callingProc.name.empty() ? L"<unknown>" : callingProc.name.c_str(),
            CallingProcessId,
            callingProc.path.empty() ? L"<unknown>" : callingProc.path.c_str(),
            callingProc.commandLine.empty() ? L"<unknown>" : callingProc.commandLine.c_str(),
            GetEventString(record.EventHeader.EventDescriptor.Id).c_str());
        printf("INFO: TargetProcess=%S(%lu) BaseAddress=0x%p RegionSize=0x%llx Protection: %s => %s\n",
            targetProc.name.empty() ? L"<unknown>" : targetProc.name.c_str(),
            TargetProcessId,
            BaseAddress, (unsigned long long)RegionSize,
            ProtectionString(LastProtectionMask), ProtectionString(ProtectionMask));
    }
    catch (const std::exception& e) {
        printf("[ERROR] PROTECTVM parse failed: %s\n", e.what());
        g_errorEvents++;
    }
}

void HandleMapViewEvent(const EVENT_RECORD& record, const krabs::trace_context& trace_context) {
    try {
        krabs::schema schema(record, trace_context.schema_locator);
        krabs::parser parser(schema);

        auto CallingProcessId = parser.parse<DWORD>(L"CallingProcessId");
        auto TargetProcessId = parser.parse<DWORD>(L"TargetProcessId");
        auto BaseAddress = parser.parse<PVOID>(L"BaseAddress");
        auto ViewSize = parser.parse<SIZE_T>(L"ViewSize");
        auto AllocationType = parser.parse<DWORD>(L"AllocationType");
        auto ProtectionMask = parser.parse<DWORD>(L"ProtectionMask");

        g_totalEvents++;
        
        // 获取进程信息
        ProcessInfo callingProc = GetProcessInfo(CallingProcessId);
        ProcessInfo targetProc = GetProcessInfo(TargetProcessId);

        // 新格式输出
        printf("[%s]\n", GetCurrentTimestamp().c_str());
        printf("PROCESS: %S | PID: %lu | PATH: %S | COMMANDLINE: %S | EVENT: %s\n",
            callingProc.name.empty() ? L"<unknown>" : callingProc.name.c_str(),
            CallingProcessId,
            callingProc.path.empty() ? L"<unknown>" : callingProc.path.c_str(),
            callingProc.commandLine.empty() ? L"<unknown>" : callingProc.commandLine.c_str(),
            GetEventString(record.EventHeader.EventDescriptor.Id).c_str());
        printf("INFO: TargetProcess=%S(%lu) BaseAddress=0x%p ViewSize=0x%llx AllocationType=0x%x Protection=%s\n",
            targetProc.name.empty() ? L"<unknown>" : targetProc.name.c_str(),
            TargetProcessId,
            BaseAddress, (unsigned long long)ViewSize, AllocationType, ProtectionString(ProtectionMask));
    }
    catch (const std::exception& e) {
        printf("[ERROR] MAPVIEW parse failed: %s\n", e.what());
        g_errorEvents++;
    }
}

void HandleQueueUserApcEvent(const EVENT_RECORD& record, const krabs::trace_context& trace_context) {
    try {
        krabs::schema schema(record, trace_context.schema_locator);
        krabs::parser parser(schema);

        auto CallingProcessId = parser.parse<DWORD>(L"CallingProcessId");
        auto TargetProcessId = parser.parse<DWORD>(L"TargetProcessId");
        auto TargetThreadId = parser.parse<DWORD>(L"TargetThreadId");
        auto ApcRoutine = parser.parse<PVOID>(L"ApcRoutine");
        auto ApcArgument1 = parser.parse<PVOID>(L"ApcArgument1");
        auto ApcArgument2 = parser.parse<PVOID>(L"ApcArgument2");
        auto ApcArgument3 = parser.parse<PVOID>(L"ApcArgument3");

        g_totalEvents++;
        
        // 获取进程信息
        ProcessInfo callingProc = GetProcessInfo(CallingProcessId);
        ProcessInfo targetProc = GetProcessInfo(TargetProcessId);

        // 新格式输出
        printf("[%s]\n", GetCurrentTimestamp().c_str());
        printf("PROCESS: %S | PID: %lu | PATH: %S | COMMANDLINE: %S | EVENT: %s\n",
            callingProc.name.empty() ? L"<unknown>" : callingProc.name.c_str(),
            CallingProcessId,
            callingProc.path.empty() ? L"<unknown>" : callingProc.path.c_str(),
            callingProc.commandLine.empty() ? L"<unknown>" : callingProc.commandLine.c_str(),
            GetEventString(record.EventHeader.EventDescriptor.Id).c_str());
        printf("INFO: TargetProcess=%S(%lu) TargetThreadId=%lu ApcRoutine=0x%p Args=[0x%p, 0x%p, 0x%p]\n",
            targetProc.name.empty() ? L"<unknown>" : targetProc.name.c_str(),
            TargetProcessId,
            TargetThreadId, ApcRoutine, ApcArgument1, ApcArgument2, ApcArgument3);
    }
    catch (const std::exception& e) {
        printf("[ERROR] QUEUEUSERAPC parse failed: %s\n", e.what());
        g_errorEvents++;
    }
}

void HandleSetThreadContextEvent(const EVENT_RECORD& record, const krabs::trace_context& trace_context) {
    try {
        krabs::schema schema(record, trace_context.schema_locator);
        krabs::parser parser(schema);

        auto CallingProcessId = parser.parse<DWORD>(L"CallingProcessId");
        auto TargetProcessId = parser.parse<DWORD>(L"TargetProcessId");
        auto TargetThreadId = parser.parse<DWORD>(L"TargetThreadId");
        auto ContextFlags = parser.parse<DWORD>(L"ContextFlags");
        auto Pc = parser.parse<PVOID>(L"Pc");
        auto Sp = parser.parse<PVOID>(L"Sp");

        g_totalEvents++;
        
        // 获取进程信息
        ProcessInfo callingProc = GetProcessInfo(CallingProcessId);
        ProcessInfo targetProc = GetProcessInfo(TargetProcessId);
        
        // 判断是否为跨进程操作
        bool isCrossProcess = IsCrossProcessOperation(CallingProcessId, TargetProcessId);

        // 新格式输出
        printf("[%s]\n", GetCurrentTimestamp().c_str());
        printf("PROCESS: %S | PID: %lu | PATH: %S | COMMANDLINE: %S | EVENT: %s\n",
            callingProc.name.empty() ? L"<unknown>" : callingProc.name.c_str(),
            CallingProcessId,
            callingProc.path.empty() ? L"<unknown>" : callingProc.path.c_str(),
            callingProc.commandLine.empty() ? L"<unknown>" : callingProc.commandLine.c_str(),
            GetEventString(record.EventHeader.EventDescriptor.Id).c_str());
        printf("INFO: TargetProcess=%S(%lu) TargetThreadId=%lu ContextFlags=0x%x PC=0x%p SP=0x%p\n",
            targetProc.name.empty() ? L"<unknown>" : targetProc.name.c_str(),
            TargetProcessId,
            TargetThreadId, ContextFlags, Pc, Sp);
        
        // 打印调用栈（SETTHREADCONTEXT_REMOTE 事件）
        if (isCrossProcess) {
            auto stack = schema.stack_trace();
            if (!stack.empty()) {
                printf("CALLSTACK: ");
                for (size_t i = 0; i < stack.size(); i++) {
                    if (i > 0) printf(" | ");
                    printf("0x%p", (void*)stack[i]);
                }
                printf("\n");
            }
        }
    }
    catch (const std::exception& e) {
        printf("[ERROR] SETTHREADCONTEXT parse failed: %s\n", e.what());
        g_errorEvents++;
    }
}

void HandleReadWriteVmEvent(const EVENT_RECORD& record, const krabs::trace_context& trace_context) {
    try {
        krabs::schema schema(record, trace_context.schema_locator);
        krabs::parser parser(schema);

        auto OperationStatus = parser.parse<DWORD>(L"OperationStatus");
        auto CallingProcessId = parser.parse<DWORD>(L"CallingProcessId");
        auto TargetProcessId = parser.parse<DWORD>(L"TargetProcessId");
        auto BaseAddress = parser.parse<PVOID>(L"BaseAddress");
        auto BytesCopied = parser.parse<SIZE_T>(L"BytesCopied");

        g_totalEvents++;
        
        // 获取进程信息
        ProcessInfo callingProc = GetProcessInfo(CallingProcessId);
        ProcessInfo targetProc = GetProcessInfo(TargetProcessId);
        
        // 判断是否为跨进程操作
        bool isCrossProcess = IsCrossProcessOperation(CallingProcessId, TargetProcessId);

        // 新格式输出
        printf("[%s]\n", GetCurrentTimestamp().c_str());
        printf("PROCESS: %S | PID: %lu | PATH: %S | COMMANDLINE: %S | EVENT: %s\n",
            callingProc.name.empty() ? L"<unknown>" : callingProc.name.c_str(),
            CallingProcessId,
            callingProc.path.empty() ? L"<unknown>" : callingProc.path.c_str(),
            callingProc.commandLine.empty() ? L"<unknown>" : callingProc.commandLine.c_str(),
            GetEventString(record.EventHeader.EventDescriptor.Id).c_str());
        printf("INFO: TargetProcess=%S(%lu) BaseAddress=0x%p BytesCopied=0x%llx Status=0x%x\n",
            targetProc.name.empty() ? L"<unknown>" : targetProc.name.c_str(),
            TargetProcessId,
            BaseAddress, (unsigned long long)BytesCopied, OperationStatus);
        
        // 打印调用栈（仅跨进程读写事件）
        if (isCrossProcess) {
            auto stack = schema.stack_trace();
            if (!stack.empty()) {
                printf("CALLSTACK: ");
                for (size_t i = 0; i < stack.size(); i++) {
                    if (i > 0) printf(" | ");
                    printf("0x%p", (void*)stack[i]);
                }
                printf("\n");
            }
        }
    }
    catch (const std::exception& e) {
        printf("[ERROR] READVM/WRITEVM parse failed: %s\n", e.what());
        g_errorEvents++;
    }
}

void HandleSuspendResumeThreadEvent(const EVENT_RECORD& record, const krabs::trace_context& trace_context) {
    try {
        krabs::schema schema(record, trace_context.schema_locator);
        krabs::parser parser(schema);

        auto OperationStatus = parser.parse<DWORD>(L"OperationStatus");
        auto CallingProcessId = parser.parse<DWORD>(L"CallingProcessId");
        auto TargetProcessId = parser.parse<DWORD>(L"TargetProcessId");
        auto TargetThreadId = parser.parse<DWORD>(L"TargetThreadId");

        g_totalEvents++;
        
        // 获取进程信息
        ProcessInfo callingProc = GetProcessInfo(CallingProcessId);
        ProcessInfo targetProc = GetProcessInfo(TargetProcessId);

        // 新格式输出
        printf("[%s]\n", GetCurrentTimestamp().c_str());
        printf("PROCESS: %S | PID: %lu | PATH: %S | COMMANDLINE: %S | EVENT: %s\n",
            callingProc.name.empty() ? L"<unknown>" : callingProc.name.c_str(),
            CallingProcessId,
            callingProc.path.empty() ? L"<unknown>" : callingProc.path.c_str(),
            callingProc.commandLine.empty() ? L"<unknown>" : callingProc.commandLine.c_str(),
            GetEventString(record.EventHeader.EventDescriptor.Id).c_str());
        printf("INFO: TargetProcess=%S(%lu) TargetThreadId=%lu Status=0x%x\n",
            targetProc.name.empty() ? L"<unknown>" : targetProc.name.c_str(),
            TargetProcessId,
            TargetThreadId, OperationStatus);
    }
    catch (const std::exception& e) {
        printf("[ERROR] SUSPEND/RESUME THREAD parse failed: %s\n", e.what());
        g_errorEvents++;
    }
}

void HandleSuspendResumeProcessEvent(const EVENT_RECORD& record, const krabs::trace_context& trace_context) {
    try {
        krabs::schema schema(record, trace_context.schema_locator);
        krabs::parser parser(schema);

        auto OperationStatus = parser.parse<DWORD>(L"OperationStatus");
        auto CallingProcessId = parser.parse<DWORD>(L"CallingProcessId");
        auto TargetProcessId = parser.parse<DWORD>(L"TargetProcessId");

        g_totalEvents++;
        
        // 获取进程信息
        ProcessInfo callingProc = GetProcessInfo(CallingProcessId);
        ProcessInfo targetProc = GetProcessInfo(TargetProcessId);

        // 新格式输出
        printf("[%s]\n", GetCurrentTimestamp().c_str());
        printf("PROCESS: %S | PID: %lu | PATH: %S | COMMANDLINE: %S | EVENT: %s\n",
            callingProc.name.empty() ? L"<unknown>" : callingProc.name.c_str(),
            CallingProcessId,
            callingProc.path.empty() ? L"<unknown>" : callingProc.path.c_str(),
            callingProc.commandLine.empty() ? L"<unknown>" : callingProc.commandLine.c_str(),
            GetEventString(record.EventHeader.EventDescriptor.Id).c_str());
        printf("INFO: TargetProcess=%S(%lu) Status=0x%x\n",
            targetProc.name.empty() ? L"<unknown>" : targetProc.name.c_str(),
            TargetProcessId,
            OperationStatus);
    }
    catch (const std::exception& e) {
        printf("[ERROR] SUSPEND/RESUME PROCESS parse failed: %s\n", e.what());
        g_errorEvents++;
    }
}

void HandleDriverDeviceEvent(const EVENT_RECORD& record, const krabs::trace_context& trace_context) {
    try {
        krabs::schema schema(record, trace_context.schema_locator);
        krabs::parser parser(schema);

        g_totalEvents++;

        // 新格式输出
        printf("[%s]\n", GetCurrentTimestamp().c_str());
        printf("PROCESS: <kernel> | PID: 0 | PATH: <kernel> | COMMANDLINE: <kernel> | EVENT: %s\n",
            GetEventString(record.EventHeader.EventDescriptor.Id).c_str());

        EventType eventType = GetEventType(record.EventHeader.EventDescriptor.Id);
        if (eventType == EventType::DRIVER_LOAD || eventType == EventType::DRIVER_UNLOAD) {
            auto DriverName = parser.parse<std::wstring>(L"DriverName");
            printf("INFO: DriverName=%S\n", DriverName.c_str());
        }
        else if (eventType == EventType::DEVICE_CREATE || eventType == EventType::DEVICE_CLOSE) {
            auto DriverName = parser.parse<std::wstring>(L"DriverName");
            auto DeviceName = parser.parse<std::wstring>(L"DeviceName");
            printf("INFO: DriverName=%S DeviceName=%S\n", DriverName.c_str(), DeviceName.c_str());
        }
    }
    catch (const std::exception& e) {
        printf("[ERROR] DRIVER/DEVICE parse failed: %s\n", e.what());
        g_errorEvents++;
    }
}

void EventCallback(const EVENT_RECORD& record, const krabs::trace_context& trace_context) {
    USHORT eventId = record.EventHeader.EventDescriptor.Id;
    EventType eventType = GetEventType(eventId);

    try {
        switch (eventType) {
        case EventType::ALLOCVM:
            HandleAllocVmEvent(record, trace_context);
            break;

        case EventType::PROTECTVM:
            HandleProtectVmEvent(record, trace_context);
            break;

        case EventType::MAPVIEW:
            HandleMapViewEvent(record, trace_context);
            break;

        case EventType::QUEUEUSERAPC:
            HandleQueueUserApcEvent(record, trace_context);
            break;

        case EventType::SETTHREADCONTEXT:
            HandleSetThreadContextEvent(record, trace_context);
            break;

        case EventType::READVM:
        case EventType::WRITEVM:
            HandleReadWriteVmEvent(record, trace_context);
            break;

        case EventType::SUSPEND_THREAD:
        case EventType::RESUME_THREAD:
            HandleSuspendResumeThreadEvent(record, trace_context);
            break;

        case EventType::SUSPEND_PROCESS:
        case EventType::RESUME_PROCESS:
        case EventType::FREEZE_PROCESS:
        case EventType::THAW_PROCESS:
            HandleSuspendResumeProcessEvent(record, trace_context);
            break;

        case EventType::DRIVER_LOAD:
        case EventType::DRIVER_UNLOAD:
            // DEVICE_CREATE 和 DEVICE_CLOSE 事件已禁用，需要时取消注释
            // case EventType::DEVICE_CREATE:
            // case EventType::DEVICE_CLOSE:
            HandleDriverDeviceEvent(record, trace_context);
            break;
        
        // 忽略 DEVICE_CREATE 和 DEVICE_CLOSE 事件
        case EventType::DEVICE_CREATE:
        case EventType::DEVICE_CLOSE:
            // 不处理这些事件
            break;

        default:
            g_totalEvents++;
            printf("[%s] [UNKNOWN] EventID=%d\n", GetCurrentTimestamp().c_str(), eventId);
            break;
        }
    }
    catch (const std::exception& e) {
        printf("[ERROR] EventID=%d dispatch failed: %s\n", eventId, e.what());
        g_errorEvents++;
    }
}

// ============================================
// 使用说明
// ============================================

void PrintUsage(const wchar_t* programName) {
    printf("Usage: %S [options]\n\n", programName);
    printf("Options:\n");
    printf("  --no-driver    Do not load kernel driver (ETW-TI only)\n");
    printf("  --help         Show this help message\n\n");
    printf("Note: DriversMon driver (drivers_mon.sys) should be in the same directory.\n");
}

// ============================================
// 主程序入口
// ============================================

int wmain(int argc, wchar_t* argv[]) {
    // 设置stdout为无缓冲模式，确保实时输出
    setvbuf(stdout, NULL, _IONBF, 0);

    printf("EtwTi-FluctuationMonitor v3.0\n");
    printf("========================================\n\n");

    // 解析命令行参数
    for (int i = 1; i < argc; i++) {
        if (wcscmp(argv[i], L"--no-driver") == 0) {
            g_UseDriver = false;
            printf("[*] Driver loading disabled by command line\n");
        }
        else if (wcscmp(argv[i], L"--help") == 0 || wcscmp(argv[i], L"-h") == 0) {
            PrintUsage(argv[0]);
            return 0;
        }
    }

    // 检查驱动是否可用
    printf("[*] Checking if RTCore64 driver is available...\n");
    if (!IsDriverAvailable()) {
        printf("[!] RTCore64 driver is not available.\n");
        printf("[!] Please manually create and start the driver service first.\n");
        printf("[!] Example:\n");
        printf("[!]   sc create RTCore64 type= kernel binPath= C:\\path\\to\\RTCore64.sys\n");
        printf("[!]   sc start RTCore64\n");
        return 1;
    }
    printf("[+] RTCore64 driver is available.\n\n");

    // 打开驱动设备
    printf("[*] Opening RTCore64 driver device...\n");
    HANDLE hDevice = OpenDriverDevice();
    if (hDevice == INVALID_HANDLE_VALUE) {
        printf("[!] Failed to open driver device.\n");
        return 1;
    }
    printf("[+] RTCore64 driver device opened successfully.\n\n");

    // 启用PPL保护
    printf("[*] Enabling PPL protection...\n");
    if (!EnablePPL(hDevice)) {
        printf("[!] Failed to enable PPL protection.\n");
        CloseDriverDevice(hDevice);
        return 1;
    }
    printf("[+] PPL protection enabled.\n\n");

    // 配置ETW提供者
    printf("[*] Configuring ETW-TI provider...\n");
    
    // 设置ETW缓冲区参数以减少延迟
    // 使用较小的缓冲区大小和更频繁的刷新间隔以实现实时监控
    EVENT_TRACE_PROPERTIES traceProps = { 0 };
    traceProps.BufferSize = 64;                // 64KB 缓冲区
    traceProps.MinimumBuffers = 2;             // 最小缓冲区数量
    traceProps.MaximumBuffers = 4;             // 最大缓冲区数量
    traceProps.FlushTimer = 1;                 // 刷新间隔1秒
    traceProps.LogFileMode = EVENT_TRACE_REAL_TIME_MODE;  // 实时模式
    
    printf("[*] ETW buffer settings: Size=%luKB, MinBuffers=%lu, MaxBuffers=%lu, FlushTimer=%lus\n",
        traceProps.BufferSize, traceProps.MinimumBuffers, traceProps.MaximumBuffers, traceProps.FlushTimer);
    
    // 设置追踪属性（必须在 enable/start 之前）
    g_trace.set_trace_properties(&traceProps);
    
    krabs::provider<> ti_provider(L"Microsoft-Windows-Threat-Intelligence");
    
    // 启用调用栈追踪（用于跨进程写和跨进程分配事件）
    ti_provider.trace_flags(EVENT_ENABLE_PROPERTY_STACK_TRACE);

    ULONG64 allKeywords =
        KEYWORD_ALLOCVM_LOCAL | KEYWORD_ALLOCVM_LOCAL_KERNEL_CALLER |
        KEYWORD_ALLOCVM_REMOTE | KEYWORD_ALLOCVM_REMOTE_KERNEL_CALLER |
        KEYWORD_PROTECTVM_LOCAL | KEYWORD_PROTECTVM_LOCAL_KERNEL_CALLER |
        KEYWORD_PROTECTVM_REMOTE | KEYWORD_PROTECTVM_REMOTE_KERNEL_CALLER |
        KEYWORD_MAPVIEW_LOCAL | KEYWORD_MAPVIEW_LOCAL_KERNEL_CALLER |
        KEYWORD_MAPVIEW_REMOTE | KEYWORD_MAPVIEW_REMOTE_KERNEL_CALLER |
        KEYWORD_QUEUEUSERAPC_REMOTE | KEYWORD_QUEUEUSERAPC_REMOTE_KERNEL_CALLER |
        KEYWORD_SETTHREADCONTEXT_REMOTE | KEYWORD_SETTHREADCONTEXT_REMOTE_KERNEL_CALLER |
        KEYWORD_READVM_LOCAL | KEYWORD_READVM_REMOTE |
        KEYWORD_WRITEVM_LOCAL | KEYWORD_WRITEVM_REMOTE |
        KEYWORD_SUSPEND_THREAD | KEYWORD_RESUME_THREAD |
        KEYWORD_SUSPEND_PROCESS | KEYWORD_RESUME_PROCESS |
        KEYWORD_FREEZE_PROCESS | KEYWORD_THAW_PROCESS |
        KEYWORD_DRIVER_EVENTS | KEYWORD_DEVICE_EVENTS;

    ti_provider.any(allKeywords);
    ti_provider.add_on_event_callback(EventCallback);
    g_trace.enable(ti_provider);

    printf("[+] ETW-TI provider configured with keywords: 0x%llx\n\n", allKeywords);

    // 加载DriversMon驱动
    HANDLE hDriverThread = NULL;
    if (g_UseDriver) {
        printf("[*] Checking DriversMon kernel driver...\n");
        
        if (IsDriversMonServiceExists()) {
            printf("[+] DriversMon service already exists, skipping driver load\n");
        }
        else {
            printf("[*] Loading DriversMon kernel driver...\n");
            if (!LoadDriversMonDriver(NULL)) {
                printf("[!] Failed to load DriversMon driver, continuing without kernel callbacks\n");
                g_UseDriver = false;
            }
        }
        
        if (g_UseDriver) {
            // 打开驱动设备
            g_DriverDevice = OpenDriversMonDevice();
            if (g_DriverDevice == INVALID_HANDLE_VALUE) {
                printf("[!] Failed to open DriversMon device, continuing without kernel callbacks\n");
                g_UseDriver = false;
            }
            else {
                printf("[+] DriversMon device opened successfully\n");
                
                // 设置过滤器
                SetDriverFilter(g_DriverDevice, FILTER_ALL);
                
                // 创建驱动事件读取线程
                hDriverThread = CreateThread(NULL, 0, DriverEventThread, NULL, 0, NULL);
                if (hDriverThread == NULL) {
                    printf("[!] Failed to create driver event thread\n");
                }
                else {
                    printf("[+] Driver event thread started\n");
                }
            }
        }
    }
    
    printf("\n");

    // 开始监控
    printf("========================================\n");
    printf("[*] Starting monitoring...\n");
    printf("[*] ETW-TI: Enabled\n");
    printf("[*] Kernel Callbacks: %s\n", g_UseDriver ? "Enabled" : "Disabled");
    printf("[*] Press Ctrl+C to stop.\n");
    printf("========================================\n\n");

    // 启动ETW追踪
    g_trace.start();

    // 程序退出时清理
    printf("\n[*] Monitoring stopped.\n");
    printf("[*] Total events: %llu, Errors: %llu\n",
        (unsigned long long)g_totalEvents.load(),
        (unsigned long long)g_errorEvents.load());

    // 停止驱动事件线程
    g_Running = false;
    if (hDriverThread != NULL) {
        WaitForSingleObject(hDriverThread, 1000);
        CloseHandle(hDriverThread);
    }

    // 关闭驱动设备
    if (g_DriverDevice != INVALID_HANDLE_VALUE) {
        CloseDriversMonDevice(g_DriverDevice);
    }

    // 卸载驱动（可选）
    // UnloadDriversMonDriver();

    printf("[*] Disabling PPL protection...\n");
    DisablePPL(hDevice);
    CloseDriverDevice(hDevice);
    printf("[*] Cleanup done.\n");
    return 0;
}