1:12:21sssmcgrath Your article didn't even touch on the horrors of ETW. I had to manually fill out several GUIDs that msft decided not to include in their headers for some reason by pulling them off three different, very obscure MSDN pages that were auto generated for C# markup. I had to reverse engineer several void * pointers by using partial data on MSDN and inspecting the memory and guessing sizes, offsets and types. There was a variable listed on MSDN as "object UserSID"... Yes, the type was "object", and guess what! It's not a SID, it's 2 unknown / undocumented pointers then a SID! What are those pointers? Who knows. They also intermixed ASCII and UTF16 strings, one after the other with no documentation... Yay!
🗪
1:12:21sssmcgrath Your article didn't even touch on the horrors of ETW. I had to manually fill out several GUIDs that msft decided not to include in their headers for some reason by pulling them off three different, very obscure MSDN pages that were auto generated for C# markup. I had to reverse engineer several void * pointers by using partial data on MSDN and inspecting the memory and guessing sizes, offsets and types. There was a variable listed on MSDN as "object UserSID"... Yes, the type was "object", and guess what! It's not a SID, it's 2 unknown / undocumented pointers then a SID! What are those pointers? Who knows. They also intermixed ASCII and UTF16 strings, one after the other with no documentation... Yay!
🗪
1:12:21sssmcgrath Your article didn't even touch on the horrors of ETW. I had to manually fill out several GUIDs that msft decided not to include in their headers for some reason by pulling them off three different, very obscure MSDN pages that were auto generated for C# markup. I had to reverse engineer several void * pointers by using partial data on MSDN and inspecting the memory and guessing sizes, offsets and types. There was a variable listed on MSDN as "object UserSID"... Yes, the type was "object", and guess what! It's not a SID, it's 2 unknown / undocumented pointers then a SID! What are those pointers? Who knows. They also intermixed ASCII and UTF16 strings, one after the other with no documentation... Yay!
🗪