winstrument 1.0.0

A tiny Rust library to set undocumented Windows process instrumentation callback
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24

pub use windows::{
    Win32::System::Diagnostics::Debug::{CONTEXT, CONTEXT_FLAGS, EXCEPTION_POINTERS},
    core::Error,
};

use std::ffi::c_void;
use windows::Win32::Foundation::{HANDLE, NTSTATUS};

pub(crate) type NtSetInformationProcessFn = unsafe extern "system" fn(
    HANDLE,                 // ProcessHandle
    u32,                    // ProcessInformationClass
    *mut core::ffi::c_void, // ProcessInformation
    u32,                    // ProcessInformationLength
) -> NTSTATUS;

pub(crate) const PROCESS_INSTRUMENTATION_CALLBACK: u32 = 40;

#[repr(C)]
#[derive(Default, Clone, Copy)]
pub(crate) struct ProcessInstrumentationCallbackInfo {
    pub version: u32,
    pub reserved: u32,
    pub callback: *const c_void,
}