The ETW Test Provider is a simple user mode application that implements four small useless ETW providers to test ETW provider activation, event creation and signalling.
The provider application registers as ETW provider component with ETW system. For this the two ETW provider classes Manifest-Test-Provider and MOF-Test-Provider (MOF_Test_Provider) will be used.
The provider classes should be installed before the application is used.
In the directories /man and /mof are Windows batch (.bat) files to compile and install the provider classes.
For compilation of provider classes you need to install Windows SDK and update command paths in the batch files to the apps from SDK.
For more information about the two test provider classes see their xml source code which specifies them and which is used as input of the provider class compilation process: /src/manifestprovider.man /src/mofprovider.man
Actually WMI based MOF provider classes are not specified by XML instrumantation manifest. They are specified by a MOF file which is the input of the MOF Compiler. But a trick was used here. Microsoft Message Compiler enables you to transpile a XML instrumentation manifest to a MOF file that will be used by the MOF Compiler.
The generated MOF file will placed here: /mof/moftestprovider.mof
I developed this tool during my research into the inner workings of Event Tracing for Windows (ETW), Virtual Machine Introspection (VMI), and how to monitor ETW events using VMI.
See:
- HypErSIS Project
- Schmitz, A. Decoding, enrichment and filtering of ETW event data outside of Windows environments. 2023. PDF download.
- Schmitz, A. Event‑based system monitoring of Windows PCs. 2022. PDF downlaod.
- Schmitz, A. Hardware-assisted Virtualization for Malware Analysis and Intrusion Detection. 2021. PDF download.