WPP trace message capture about krabsetw

[pathtofile]

So FWIW I just tried to use the latest Krabs with the AMSI WPP trace in Matt Graeber's blog (https://posts.specterops.io/data-source-analysis-and-dynamic-windows-re-using-wpp-and-tracelogging-e465f8b653f7)

And it seemed to work ok? The event_names weren't parsed correctly, but I did recieve the events and could parse the data in them.

Tried some other WPP traces and the same thing - Event Names were wrong, but data still there

[zacbrown]

Hi Udo,

I haven't personally used WPP with krabsetw so I'm not surprised there's a subtle issue there. We'd happily accept a patch for that if you wanted to create one.

thanks,

Zac

[swannman]

Thanks @pathtofile! We are discussing the fix on your PR #131.

[swannman]

Resolved by #131