Merge pull request #250 from microsoft/users/mijeong/remove_raw_provi…

…der_allocation Only allocate one EventRecordMetadata^ and reuse it for RawProvider events
microsoft · Nov 12, 2024 · af17f4c · af17f4c
2 parents 4b1456c + 3a7b787
commit af17f4c
Show file tree

Hide file tree

Showing 6 changed files with 27 additions and 11 deletions.
diff --git a/Microsoft.O365.Security.Native.ETW/AssemblyInfo.cpp b/Microsoft.O365.Security.Native.ETW/AssemblyInfo.cpp
@@ -32,7 +32,7 @@ using namespace System::Security::Permissions;
 // You can specify all the value or you can default the Revision and Build Numbers
 // by using the '*' as shown below:
 
-[assembly:AssemblyVersionAttribute("4.4.2.0")];
+[assembly:AssemblyVersionAttribute("4.4.3.0")];
 
 [assembly:ComVisible(false)];
 

diff --git a/Microsoft.O365.Security.Native.ETW/EventRecordMetadata.hpp b/Microsoft.O365.Security.Native.ETW/EventRecordMetadata.hpp
@@ -26,6 +26,17 @@ namespace Microsoft { namespace O365 { namespace Security { namespace ETW {
             : record_(&record)
             , header_(&record.EventHeader) { }
 
+        EventRecordMetadata() { }
+
+        /// <summary>
+        /// Updates this instance to point to the specified event record.
+        /// </summary>
+        virtual void Update(const EVENT_RECORD& record)
+        {
+            record_ = &record;
+            header_ = &record.EventHeader;
+        }
+
     public:
         // For container ID's, we are expecting format "00000000-0000-0000-0000-0000000000000", 
         // 32 hex digits with 4 hyphens, no braces.

diff --git a/Microsoft.O365.Security.Native.ETW/RawProvider.hpp b/Microsoft.O365.Security.Native.ETW/RawProvider.hpp
@@ -122,6 +122,7 @@ namespace Microsoft { namespace O365 { namespace Security { namespace ETW {
         NativePtr<krabs::provider<>> provider_;
         GCHandle delegateHookHandle_;
         GCHandle delegateHandle_;
+        EventRecordMetadata^ data_;
         void SetUpProvider();
     };
 
@@ -148,6 +149,8 @@ namespace Microsoft { namespace O365 { namespace Security { namespace ETW {
         delegateHookHandle_ = GCHandle::Alloc(bridged);
 
         provider_->add_on_event_callback((krabs::c_provider_callback)bridged.ToPointer());
+
+        data_ = gcnew EventRecordMetadata();
     }
 
     inline RawProvider::~RawProvider()
@@ -165,6 +168,8 @@ namespace Microsoft { namespace O365 { namespace Security { namespace ETW {
 
     inline void RawProvider::EventNotification(const EVENT_RECORD &record)
     {
-        OnEvent(gcnew EventRecordMetadata(record));
+        data_->Update(record);
+
+        OnEvent(data_);
     }
 } } } }
diff --git a/O365.Security.Native.ETW.Debug.nuspec b/O365.Security.Native.ETW.Debug.nuspec
@@ -2,7 +2,7 @@
 <package xmlns="http://schemas.microsoft.com/packaging/2011/08/nuspec.xsd">
     <metadata>
         <id>Microsoft.O365.Security.Native.ETW.Debug</id>
-        <version>4.4.2</version>
+        <version>4.4.3</version>
         <title>Microsoft.O365.Security.Native.ETW Debug - managed wrappers for krabsetw</title>
         <authors>Microsoft</authors>
         <owners>Microsoft</owners>
@@ -12,8 +12,8 @@
         <description>Microsoft.O365.Security.Native.ETW Debug is a managed wrapper around the krabsetw ETW library. This is the Debug build.</description>
         <summary>Microsoft.O365.Security.Native.ETW Debug is a managed wrapper around the krabsetw ETW library. This is the Debug build.</summary>
         <releaseNotes>
-            Version 4.4.2:
-              - Support reading TraceLogging events.
+            Version 4.4.3:
+              - RawProvider only allocates EventRecordMetadata once per instance.
         </releaseNotes>
         <copyright>© Microsoft Corporation. All rights reserved.</copyright>
         <language />

diff --git a/O365.Security.Native.ETW.nuspec b/O365.Security.Native.ETW.nuspec
@@ -2,7 +2,7 @@
 <package xmlns="http://schemas.microsoft.com/packaging/2011/08/nuspec.xsd">
     <metadata>
         <id>Microsoft.O365.Security.Native.ETW</id>
-        <version>4.4.2</version>
+        <version>4.4.3</version>
         <title>Microsoft.O365.Security.Native.ETW - managed wrappers for krabsetw</title>
         <authors>Microsoft</authors>
         <owners>Microsoft</owners>
@@ -12,8 +12,8 @@
         <description>Microsoft.O365.Security.Native.ETW is a managed wrapper around the krabsetw ETW library.</description>
         <summary>Microsoft.O365.Security.Native.ETW is a managed wrapper around the krabsetw ETW library.</summary>
         <releaseNotes>
-            Version 4.4.2:
-              - Support reading TraceLogging events.
+            Version 4.4.3:
+              - RawProvider only allocates EventRecordMetadata once per instance.
         </releaseNotes>
         <copyright>© Microsoft Corporation. All rights reserved.</copyright>
         <language />

diff --git a/krabsetw.nuspec b/krabsetw.nuspec
@@ -2,7 +2,7 @@
 <package xmlns="http://schemas.microsoft.com/packaging/2011/08/nuspec.xsd">
     <metadata>
         <id>Microsoft.O365.Security.Krabsetw</id>
-        <version>4.4.2</version>
+        <version>4.4.3</version>
         <title>Krabs ETW Wrappers</title>
         <authors>Microsoft</authors>
         <owners>Microsoft</owners>
@@ -12,8 +12,8 @@
         <description>Krabs ETW provides a modern C++ wrapper around the low-level ETW trace consumption functions</description>
         <summary>Krabs ETW provides a modern C++ wrapper around the low-level ETW trace consumption functions</summary>
         <releaseNotes>
-            Version 4.4.2:
-              - Support reading TraceLogging events.
+            Version 4.4.3:
+              - RawProvider only allocates EventRecordMetadata once per instance.
         </releaseNotes>
         <copyright>© Microsoft Corporation. All rights reserved.</copyright>
         <language />