ETW Researches

What's about ETW ?

Many ETW' functions seem to use EtwpEventWriteFull, that is not exported in any DLLs. If you look at pictures, even in EtwpEventWriteFull, the last call will be done through 'NtTraceEvent', 'NtTraceControl', 'ZwTraceEvent' or 'ZwTraceControl'. Those functions are the real syscalls behind all ETW' functions so we have to hook the four functions above (NT & ZW), not all 'ETW' prefixed.