winstrument 1.0.0

A tiny Rust library to set undocumented Windows process instrumentation callback
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36

use ntapi::ntobapi::NtClose;
use winstrument::windows::CONTEXT;

fn instrumentation_callback(ctx: &mut CONTEXT) {
    let ssn = unsafe { (ctx.Rip as *mut u32).byte_sub(0x10).read_unaligned() };
    println!("Hello, world!");
    println!("SSN: {:x}", ssn);
    println!("RAX: {:x}", ctx.Rax);
    println!("RBX: {:x}", ctx.Rbx);
    println!("RCX: {:x}", ctx.Rcx);
    println!("RDX: {:x}", ctx.Rdx);
    println!("RSP: {:x}", ctx.Rsp);
    println!("RBP: {:x}", ctx.Rbp);
    println!("RSI: {:x}", ctx.Rsi);
    println!("RDI: {:x}", ctx.Rdi);
    println!("R8:  {:x}", ctx.R8);
    println!("R9:  {:x}", ctx.R9);
    println!("R10: {:x}", ctx.R10);
    println!("R11: {:x}", ctx.R11);
    println!("R12: {:x}", ctx.R12);
    println!("R13: {:x}", ctx.R13);
    println!("R14: {:x}", ctx.R14);
    println!("R15: {:x}", ctx.R15);
    println!("RIP: {:x}", ctx.Rip);
}

fn main() -> Result<(), Box<dyn std::error::Error>> {
    winstrument::init(instrumentation_callback)?;

    unsafe {
        _ = NtClose(0x1337 as _);
    }

    winstrument::free()?;
    Ok(())
}