winstrument 1.0.0

A tiny Rust library to set undocumented Windows process instrumentation callback
docs.rs failed to build winstrument-1.0.0
Please check the build logs for more information.
See Builds for ideas on how to fix a failed build, or Metadata for how to configure docs.rs builds.
If you believe this is docs.rs' fault, open an issue.

Winstrument

A tiny Rust library to set undocumented Windows process instrumentation callback.

What

On Windows, process instrumentation callback is undocumented process-specific user-mode callback to system traps. It is triggered by various kernel->user mode transitions, such as:

  • System call
  • Exceptions
  • User APC

In practice, it is often used to hook return from system calls.

Usage

Usage is extremely simple. Just call winstrument::init with a callback function and you're done. Then call winstrument::free when you are done.

use ntapi::ntobapi::NtClose;
use winstrument::windows::CONTEXT;

fn instrumentation_callback(ctx: &mut CONTEXT) {
    // ...
}

fn main() -> Result<(), Box<dyn std::error::Error>> {
    winstrument::init(instrumentation_callback)?;

    // ...

    winstrument::free()?;
    Ok(())
}

Also see the examples directory.