# Winstrument
A tiny Rust library to set undocumented Windows process instrumentation callback.
## What
On Windows, process instrumentation callback is undocumented process-specific user-mode callback to system traps.
It is triggered by various kernel->user mode transitions, such as:
- System call
- Exceptions
- User APC
In practice, it is often used to hook return from system calls.
## Usage
Usage is extremely simple. Just call `winstrument::init` with a callback function and you're done.
Then call `winstrument::free` when you are done.
```rust
use ntapi::ntobapi::NtClose;
use winstrument::windows::CONTEXT;
fn instrumentation_callback(ctx: &mut CONTEXT) {
// ...
}
fn main() -> Result<(), Box<dyn std::error::Error>> {
winstrument::init(instrumentation_callback)?;
// ...
winstrument::free()?;
Ok(())
}
```
Also see the [examples](./examples/) directory.