Implement ETW trace control notifications

litebox_common_windows/src/nt_status.rs

@@ -221,6 +221,9 @@ impl NtStatus {
             0xC0000286 => "STATUS_MAGAZINE_NOT_PRESENT: Magazine not present",
             0xC0000287 => "STATUS_REINITIALIZATION_NEEDED: Reinitialization needed",
             0xC0000302 => "STATUS_WMI_ALREADY_DISABLED: WMI collection or events already disabled",
+            0xC0000354 => {
+                "STATUS_DEBUGGER_INACTIVE: An attempt to do an operation on a debug object failed because the object is in the process of being deleted"
+            }
             0xC0000718 => {
                 "STATUS_WNF_EVENT_ALREADY_SUBSCRIBED: The WNF event is already subscribed"
             }
@@ -637,6 +640,9 @@ impl NtStatus {
     /// STATUS_WMI_ALREADY_DISABLED
     pub const WMI_ALREADY_DISABLED: Self = Self::from_raw(0xC0000302);
 
+    /// STATUS_DEBUGGER_INACTIVE
+    pub const DEBUGGER_INACTIVE: Self = Self::from_raw(0xC0000354);
+
     /// STATUS_WNF_EVENT_ALREADY_SUBSCRIBED
     pub const WNF_EVENT_ALREADY_SUBSCRIBED: Self = Self::from_raw(0xC0000718);
 }

litebox_shim_windows/src/lib.rs

@@ -598,6 +598,7 @@ pub struct Process<Platform: ShimPlatform> {
     default_hard_error_mode: AtomicU32,
     wnf_notification_event: Mutex<Platform, Option<Arc<syscalls::event::EventObject<Platform>>>>,
     wnf_subscriptions: Mutex<Platform, syscalls::wnf::WnfProcessSubscriptions>,
+    trace_notifications: Mutex<Platform, syscalls::trace::TraceNotifications<Platform>>,
     cookie: u32,
     exit_code: AtomicI32,
     next_thread_id: AtomicUsize,
@@ -693,6 +694,7 @@ impl<Platform: ShimPlatform> Process<Platform> {
             default_hard_error_mode: AtomicU32::new(0),
             wnf_notification_event: Mutex::new(None),
             wnf_subscriptions: Mutex::new(syscalls::wnf::WnfProcessSubscriptions::default()),
+            trace_notifications: Mutex::new(syscalls::trace::TraceNotifications::default()),
             cookie: syscalls::process::default_process_cookie(),
             exit_code: AtomicI32::new(DEFAULT_PROCESS_EXIT_CODE),
             next_thread_id: AtomicUsize::new(syscalls::process::INITIAL_THREAD_ID + 1),
@@ -1394,6 +1396,17 @@ impl<Platform: ShimPlatform, FS: ShimFS> Task<Platform, FS> {
                 byte_offset,
                 key,
             ),
+            SyscallRequest::NtQueryDebugFilterState {
+                component_id,
+                level,
+            } => {
+                litebox_util_log::debug!(
+                    component_id,
+                    level;
+                    "NtQueryDebugFilterState reports no attached debugger"
+                );
+                NtStatus::DEBUGGER_INACTIVE
+            }
             SyscallRequest::NtQueryVolumeInformationFile {
                 file_handle,
                 io_status_block,
@@ -2069,6 +2082,21 @@ impl<Platform: ShimPlatform, FS: ShimFS> Task<Platform, FS> {
                 field_size,
                 fields,
             } => self.sys_nt_trace_event(trace_handle, flags, field_size, fields),
+            SyscallRequest::NtTraceControl {
+                function_code,
+                input_buffer,
+                input_buffer_length,
+                output_buffer,
+                output_buffer_length,
+                return_length,
+            } => self.sys_nt_trace_control(
+                function_code,
+                input_buffer,
+                input_buffer_length,
+                output_buffer,
+                output_buffer_length,
+                return_length,
+            ),
             SyscallRequest::NtTerminateProcess {
                 process_handle,
                 exit_status,

litebox_shim_windows/src/nt_types.rs

@@ -503,7 +503,7 @@ pub struct ListEntry {
 }
 
 #[repr(C)]
-#[derive(Clone, Copy, Debug, FromBytes, IntoBytes, Immutable)]
+#[derive(Clone, Copy, Debug, Default, FromBytes, IntoBytes, Immutable)]
 pub struct Guid {
     pub data: [u8; 16],
 }

litebox_shim_windows/src/syscalls/mod.rs

@@ -374,6 +374,10 @@ pub(crate) enum SyscallRequest<Platform: RawPointerProvider> {
         byte_offset: Option<Platform::RawConstPointer<i64>>,
         key: Option<Platform::RawConstPointer<u32>>,
     },
+    NtQueryDebugFilterState {
+        component_id: u32,
+        level: u32,
+    },
     NtQueryVolumeInformationFile {
         file_handle: Handle,
         io_status_block: Platform::RawMutPointer<nt_types::IoStatusBlock>,
@@ -689,6 +693,14 @@ pub(crate) enum SyscallRequest<Platform: RawPointerProvider> {
         field_size: u32,
         fields: Platform::RawConstPointer<trace::EventHeader>,
     },
+    NtTraceControl {
+        function_code: u32,
+        input_buffer: Platform::RawConstPointer<u32>,
+        input_buffer_length: u32,
+        output_buffer: Option<Platform::RawMutPointer<u8>>,
+        output_buffer_length: u32,
+        return_length: Platform::RawMutPointer<u32>,
+    },
     NtAllocateVirtualMemory {
         process_handle: ProcessHandle,
         base_address: Platform::RawMutPointer<usize>,
@@ -1047,6 +1059,10 @@ impl<Platform: RawPointerProvider> SyscallRequest<Platform> {
                 byte_offset:*,
                 key:*,
             })),
+            NtSysno::NtQueryDebugFilterState => Some(sys_req!(NtQueryDebugFilterState {
+                component_id,
+                level,
+            })),
             NtSysno::NtQueryVolumeInformationFile => Some(sys_req!(NtQueryVolumeInformationFile {
                 file_handle:{Handle::from_raw},
                 io_status_block:*,
@@ -1372,6 +1388,14 @@ impl<Platform: RawPointerProvider> SyscallRequest<Platform> {
                 field_size,
                 fields:*,
             })),
+            NtSysno::NtTraceControl => Some(sys_req!(NtTraceControl {
+                function_code,
+                input_buffer:*,
+                input_buffer_length,
+                output_buffer:*,
+                output_buffer_length,
+                return_length:*,
+            })),
             NtSysno::NtAllocateVirtualMemory => Some(sys_req!(NtAllocateVirtualMemory {
                 process_handle: { ProcessHandle::from_raw },
                 base_address:*,