stella-ops.org/git.stella-ops.org
1
0
Fork 0
Code Issues Pull Requests Actions 3 Releases Wiki Activity

semi implemented and features implemented save checkpoint

Browse Source
This commit is contained in:
master
2026-02-08 18:00:49 +02:00
parent 04360dff63
commit 1bf6bbf395
20895 changed files with 716795 additions and 64 deletions
Download Patch File Download Diff File Expand all files Collapse all files

29
docs/features/unchecked/scanner/etw-collector-for-runtime-traces.md Normal file
View File

@@ -0,0 +1,29 @@
# ETW (Event Tracing for Windows) Collector for Runtime Traces
## Module
Scanner
## Status
IMPLEMENTED
## Description
ETW-based function tracing collector for Windows using CLR runtime provider and stack walking for call chains, with container-aware process isolation and DbgHelp symbol resolution.
## Implementation Details
- **ETW Capture Adapter**:
- `src/Scanner/StellaOps.Scanner.Analyzers.Native/RuntimeCapture/WindowsEtwCaptureAdapter.cs` - Windows ETW capture adapter implementing `IRuntimeCaptureAdapter`
- `src/Scanner/StellaOps.Scanner.Analyzers.Native/RuntimeCapture/IRuntimeCaptureAdapter.cs` - Platform-agnostic capture interface
- **Runtime Evidence**:
- `src/Scanner/StellaOps.Scanner.Analyzers.Native/RuntimeCapture/RuntimeEvidence.cs` - Runtime evidence model
- `src/Scanner/StellaOps.Scanner.Analyzers.Native/RuntimeCapture/RuntimeEvidenceAggregator.cs` - Aggregates ETW events into runtime evidence
- `src/Scanner/StellaOps.Scanner.Analyzers.Native/RuntimeCapture/StackTraceCapture.cs` - Stack trace capture from ETW stack walking
- **Capture Configuration**:
- `src/Scanner/StellaOps.Scanner.Analyzers.Native/RuntimeCapture/RuntimeCaptureOptions.cs` - Configuration options
- `src/Scanner/StellaOps.Scanner.Analyzers.Native/RuntimeCapture/CaptureDurationTimer.cs` - Duration timer
## E2E Test Plan
- [ ] Configure ETW capture on a Windows host and verify `WindowsEtwCaptureAdapter` collects CLR runtime events
- [ ] Verify stack walking captures call chains with correct function names via DbgHelp symbol resolution
- [ ] Verify container-aware process isolation filters events to the target container only
- [ ] Verify runtime evidence aggregation produces structured evidence from ETW events
- [ ] Verify ETW-collected runtime evidence can be used to confirm static reachability claims