Version 0.3
Pre-release
Pre-release
I made it work. After this, i make it nice.
- More robust ETW events by switching to KrabsETW
- More robust ntdll.dll hooking by patching all the bugs
- Way less crashes
- The JSON format has somewhat stabilized
- Reliable callstack addresses memory info
- Basic ETW detections
- Tested with some C2