SYMBOL INDEX (382 symbols across 44 files)

FILE: Hunt-Weird-Syscalls/Detectors.cpp
  type Detectors (line 3) | namespace Detectors {
    function VOID (line 14) | VOID DirectSyscall ( DWORD pid, HANDLE hProcess, std::vector<ULONG_PTR...
    function VOID (line 33) | VOID InDirectSyscall ( DWORD pid, HANDLE hProcess, std::vector<ULONG_P...

FILE: Hunt-Weird-Syscalls/Detectors.h
  function namespace (line 8) | namespace Detectors {

FILE: Hunt-Weird-Syscalls/Helpers.cpp
  type Helpers (line 3) | namespace Helpers {
    function BOOL (line 5) | BOOL ModuleNameFromAddress ( HANDLE hProcess, PVOID pAddr, std::string...
    function VOID (line 30) | VOID RemoveKernelAddrs ( std::vector<ULONG_PTR>& stack ) {
    function BOOL (line 48) | BOOL IsElevated ( VOID ) {

FILE: Hunt-Weird-Syscalls/Helpers.h
  function namespace (line 8) | namespace Helpers {

FILE: Hunt-Weird-Syscalls/Main.cpp
  function VOID (line 12) | VOID EnableAuditApiTracing ( krabs::user_trace& userTrace ) {
  function VOID (line 32) | VOID OnObservableSyscall ( const EVENT_RECORD& record, const krabs::trac...
  function VOID (line 70) | VOID Go ( krabs::user_trace* userTrace ) {
  function main (line 74) | int main ( int argc, char** argv ) {

FILE: Hunt-Weird-Syscalls/SetThreadContext_Direct/Main.c
  function main (line 4) | int main(int argc, char** argv) {

FILE: Hunt-Weird-Syscalls/SetThreadContext_Direct/threadcontext_embedded.c
  function EXTERN_C (line 10) | EXTERN_C PVOID internal_cleancall_wow64_gate(VOID) {
  function DWORD (line 42) | DWORD SW3_HashSyscall(PCSTR FunctionName)
  function PVOID (line 57) | PVOID SC_Address(PVOID NtApiAddress)
  function PVOID (line 62) | PVOID SC_Address(PVOID NtApiAddress)
  function BOOL (line 142) | BOOL SW3_PopulateSyscallList()
  function EXTERN_C (line 234) | EXTERN_C DWORD SW3_GetSyscallNumber(DWORD FunctionHash)
  function EXTERN_C (line 250) | EXTERN_C PVOID SW3_GetSyscallAddress(DWORD FunctionHash)
  function EXTERN_C (line 266) | EXTERN_C PVOID SW3_GetRandomSyscallAddress(DWORD FunctionHash)

FILE: Hunt-Weird-Syscalls/SetThreadContext_Direct/threadcontext_embedded.h
  type SW3_SYSCALL_ENTRY (line 20) | typedef struct _SW3_SYSCALL_ENTRY
  type SW3_SYSCALL_LIST (line 27) | typedef struct _SW3_SYSCALL_LIST
  type SW3_PEB_LDR_DATA (line 33) | typedef struct _SW3_PEB_LDR_DATA {
  type SW3_LDR_DATA_TABLE_ENTRY (line 39) | typedef struct _SW3_LDR_DATA_TABLE_ENTRY {
  type SW3_PEB (line 46) | typedef struct _SW3_PEB {

FILE: Hunt-Weird-Syscalls/SetThreadContext_Indirect/Main.c
  function main (line 4) | int main(int argc, char** argv) {

FILE: Hunt-Weird-Syscalls/SetThreadContext_Indirect/threadcontext_jumper_randomized.c
  function EXTERN_C (line 10) | EXTERN_C PVOID internal_cleancall_wow64_gate(VOID) {
  function DWORD (line 42) | DWORD SW3_HashSyscall(PCSTR FunctionName)
  function PVOID (line 57) | PVOID SC_Address(PVOID NtApiAddress)
  function PVOID (line 62) | PVOID SC_Address(PVOID NtApiAddress)
  function BOOL (line 142) | BOOL SW3_PopulateSyscallList()
  function EXTERN_C (line 234) | EXTERN_C DWORD SW3_GetSyscallNumber(DWORD FunctionHash)
  function EXTERN_C (line 250) | EXTERN_C PVOID SW3_GetSyscallAddress(DWORD FunctionHash)
  function EXTERN_C (line 266) | EXTERN_C PVOID SW3_GetRandomSyscallAddress(DWORD FunctionHash)

FILE: Hunt-Weird-Syscalls/SetThreadContext_Indirect/threadcontext_jumper_randomized.h
  type SW3_SYSCALL_ENTRY (line 20) | typedef struct _SW3_SYSCALL_ENTRY
  type SW3_SYSCALL_LIST (line 27) | typedef struct _SW3_SYSCALL_LIST
  type SW3_PEB_LDR_DATA (line 33) | typedef struct _SW3_PEB_LDR_DATA {
  type SW3_LDR_DATA_TABLE_ENTRY (line 39) | typedef struct _SW3_LDR_DATA_TABLE_ENTRY {
  type SW3_PEB (line 46) | typedef struct _SW3_PEB {

FILE: libs/krabs/krabs/client.hpp
  type krabs (line 11) | namespace krabs {

FILE: libs/krabs/krabs/collection_view.hpp
  type krabs (line 10) | namespace krabs {
    type collection_view (line 19) | struct collection_view
      method collection_view (line 30) | collection_view(const T begin, const T end)
      method T (line 38) | const T begin() const
      method T (line 46) | const T end() const
    function view (line 56) | inline collection_view<T> view(const T& begin, const T& end)
    function view (line 65) | inline collection_view<typename std::basic_string<T>::const_iterator> ...
    function view (line 74) | inline collection_view<const T*> view(const T* begin, size_t length)
    function view (line 83) | inline collection_view<const T*> view(const T(&arr)[n])

FILE: libs/krabs/krabs/errors.hpp
  type krabs (line 10) | namespace krabs {
    class trace_already_registered (line 12) | class trace_already_registered : public std::runtime_error {
      method trace_already_registered (line 14) | trace_already_registered()
    class invalid_parameter (line 19) | class invalid_parameter : public std::logic_error {
      method invalid_parameter (line 21) | invalid_parameter()
    class open_trace_failure (line 26) | class open_trace_failure : public std::runtime_error {
      method open_trace_failure (line 28) | open_trace_failure()
    class need_to_be_admin_failure (line 33) | class need_to_be_admin_failure : public std::runtime_error {
      method need_to_be_admin_failure (line 35) | need_to_be_admin_failure()
    class could_not_find_schema (line 40) | class could_not_find_schema : public std::runtime_error {
      method could_not_find_schema (line 42) | could_not_find_schema()
      method could_not_find_schema (line 46) | could_not_find_schema(const std::string& context)
    class type_mismatch_assert (line 51) | class type_mismatch_assert : public std::runtime_error {
      method type_mismatch_assert (line 53) | type_mismatch_assert(
    class no_trace_sessions_remaining (line 62) | class no_trace_sessions_remaining : public std::runtime_error {
      method no_trace_sessions_remaining (line 64) | no_trace_sessions_remaining()
    class function_not_supported (line 69) | class function_not_supported : public std::runtime_error {
      method function_not_supported (line 71) | function_not_supported()
    class unexpected_error (line 76) | class unexpected_error : public std::runtime_error {
      method unexpected_error (line 78) | unexpected_error(ULONG status)
      method unexpected_error (line 83) | unexpected_error(const std::string &context)
    function get_status_and_record_context (line 88) | inline std::string get_status_and_record_context(ULONG status, const E...
    function error_check_common_conditions (line 104) | inline void error_check_common_conditions(ULONG status)
    function error_check_common_conditions (line 131) | inline void error_check_common_conditions(ULONG status, const EVENT_RE...

FILE: libs/krabs/krabs/etw.hpp
  type krabs (line 20) | namespace krabs { namespace details {
    type details (line 20) | namespace details {
      class trace_info (line 27) | class trace_info {
      class trace_manager (line 40) | class trace_manager {
      function trace_callback_thunk (line 135) | static void __stdcall trace_callback_thunk(EVENT_RECORD *pRecord)
      function ULONG (line 155) | static ULONG __stdcall trace_buffer_callback(EVENT_TRACE_LOGFILE *pL...
      function EVENT_TRACE_LOGFILE (line 180) | EVENT_TRACE_LOGFILE trace_manager<T>::open()
      function EVENT_TRACE_PROPERTIES (line 194) | EVENT_TRACE_PROPERTIES trace_manager<T>::query()
      function trace_info (line 234) | trace_info trace_manager<T>::fill_trace_info()
      function EVENT_TRACE_LOGFILE (line 262) | EVENT_TRACE_LOGFILE trace_manager<T>::fill_logfile()
      function EVENT_TRACE_PROPERTIES (line 299) | EVENT_TRACE_PROPERTIES trace_manager<T>::query_trace()
      function EVENT_TRACE_LOGFILE (line 358) | EVENT_TRACE_LOGFILE trace_manager<T>::open_trace()

FILE: libs/krabs/krabs/filtering/comparers.hpp
  type krabs (line 10) | namespace krabs { namespace predicates {
    type predicates (line 10) | namespace predicates {
      type comparers (line 12) | namespace comparers {
        type equals (line 21) | struct equals
        type contains (line 34) | struct contains
        type starts_with (line 49) | struct starts_with
        type ends_with (line 63) | struct ends_with
        type iequal_to (line 83) | struct iequal_to
        type iequal_to<wchar_t> (line 99) | struct iequal_to<wchar_t>
        type iequal_to<char> (line 114) | struct iequal_to<char>

FILE: libs/krabs/krabs/filtering/event_filter.hpp
  type krabs (line 14) | namespace krabs { namespace testing {
    type testing (line 14) | namespace testing {
      class event_filter_proxy (line 15) | class event_filter_proxy
    type details (line 18) | namespace details {
      class base_provider (line 19) | class base_provider
    class provider (line 31) | class provider
    class event_filter (line 45) | class event_filter {
  type krabs (line 18) | namespace krabs { namespace details {
    type testing (line 14) | namespace testing {
      class event_filter_proxy (line 15) | class event_filter_proxy
    type details (line 18) | namespace details {
      class base_provider (line 19) | class base_provider
    class provider (line 31) | class provider
    class event_filter (line 45) | class event_filter {
  type krabs (line 23) | namespace krabs {
    type testing (line 14) | namespace testing {
      class event_filter_proxy (line 15) | class event_filter_proxy
    type details (line 18) | namespace details {
      class base_provider (line 19) | class base_provider
    class provider (line 31) | class provider
    class event_filter (line 45) | class event_filter {

FILE: libs/krabs/krabs/filtering/predicates.hpp
  type krabs (line 19) | namespace krabs { namespace predicates {
    type predicates (line 19) | namespace predicates {
      type details (line 21) | namespace details {
        type predicate_base (line 29) | struct predicate_base
        type any_event (line 39) | struct any_event : predicate_base {
        type no_event (line 51) | struct no_event : predicate_base {
        type and_filter (line 64) | struct and_filter : predicate_base {
          method and_filter (line 65) | and_filter(const T1 &t1, const T2 &t2)
        type or_filter (line 86) | struct or_filter : predicate_base {
          method or_filter (line 87) | or_filter(const T1 &t1, const T2 &t2)
        type not_filter (line 108) | struct not_filter : predicate_base {
          method not_filter (line 109) | not_filter(const T1 &t1)
        type property_is (line 128) | struct property_is : predicate_base {
          method property_is (line 129) | property_is(const std::wstring &property, const T &expected)
        type property_view_predicate (line 161) | struct property_view_predicate : details::predicate_base
          method property_view_predicate (line 163) | property_view_predicate(
      type id_is (line 219) | struct id_is : details::predicate_base {
        method id_is (line 220) | id_is(size_t expected)
      type opcode_is (line 238) | struct opcode_is : details::predicate_base {
        method opcode_is (line 239) | opcode_is(size_t expected)
      type any_of (line 257) | struct any_of : details::predicate_base {
        method any_of (line 258) | any_of(std::vector<details::predicate_base*> list)
      type all_of (line 280) | struct all_of : details::predicate_base {
        method all_of (line 281) | all_of(std::vector<details::predicate_base*> list)
      type none_of (line 306) | struct none_of : details::predicate_base {
        method none_of (line 307) | none_of(std::vector<details::predicate_base*> list)
      type version_is (line 329) | struct version_is : details::predicate_base {
        method version_is (line 330) | version_is(size_t expected)
      type process_id_is (line 348) | struct process_id_is : details::predicate_base {
        method process_id_is (line 349) | process_id_is(size_t expected)
      function property_is (line 368) | details::property_is<T> property_is(
      function property_is (line 380) | inline details::property_is<std::wstring> property_is(
      function property_is (line 387) | inline details::property_is<std::string> property_is(
      function property_equals (line 414) | details::property_view_predicate<T, Adapter, Comparer> property_equals(
      function property_iequals (line 428) | details::property_view_predicate<T, Adapter, Comparer> property_iequ...
      function property_contains (line 442) | details::property_view_predicate<T, Adapter, Comparer> property_cont...
      function property_icontains (line 456) | details::property_view_predicate<T, Adapter, Comparer> property_icon...
      function property_starts_with (line 470) | details::property_view_predicate<T, Adapter, Comparer> property_star...
      function property_istarts_with (line 484) | details::property_view_predicate<T, Adapter, Comparer> property_ista...
      function property_ends_with (line 498) | details::property_view_predicate<T, Adapter, Comparer> property_ends...
      function property_iends_with (line 512) | details::property_view_predicate<T, Adapter, Comparer> property_iend...
      function and_filter (line 525) | details::and_filter<T1, T2> and_filter(const T1 &t1, const T2 &t2)
      function or_filter (line 536) | details::or_filter<T1, T2> or_filter(const T1 &t1, const T2 &t2)
      function not_filter (line 547) | details::not_filter<T1> not_filter(const T1 &t1)

FILE: libs/krabs/krabs/filtering/view_adapters.hpp
  type krabs (line 11) | namespace krabs { namespace predicates {
    type predicates (line 11) | namespace predicates {
      type adapters (line 13) | namespace adapters {
        type counted_string (line 18) | struct counted_string
        type generic_string (line 34) | struct generic_string

FILE: libs/krabs/krabs/guid.hpp
  type krabs (line 21) | namespace krabs {
    class guid (line 28) | class guid {
    class guid_parser (line 58) | class guid_parser {
    function GUID (line 146) | inline guid::operator GUID() const
    function guid (line 156) | inline guid guid::random_guid()
    type CoTaskMemDeleter (line 163) | struct CoTaskMemDeleter {
    function GUID (line 261) | inline GUID guid_parser::parse_guid(const char* str, unsigned int length)
  type std (line 301) | namespace std
    function to_wstring (line 306) | inline std::wstring to_wstring(const krabs::guid& guid)
    function to_string (line 321) | inline std::string to_string(const GUID& guid)
    type std::hash<krabs::guid> (line 335) | struct std::hash<krabs::guid>

FILE: libs/krabs/krabs/kernel_guids.hpp
  type krabs (line 10) | namespace krabs { namespace guids {
    type guids (line 10) | namespace guids {

FILE: libs/krabs/krabs/kernel_providers.hpp
  type krabs (line 14) | namespace krabs { namespace kernel {
    type kernel (line 14) | namespace kernel {

FILE: libs/krabs/krabs/kt.hpp
  type krabs (line 16) | namespace krabs { namespace details {
    type details (line 16) | namespace details {
      type kt (line 25) | struct kt {

FILE: libs/krabs/krabs/parse_types.hpp
  type krabs (line 20) | namespace krabs {
    function T (line 36) | T id(T n)
    function T (line 55) | T version(T n)
    function T (line 74) | T opcode(T n)
    type hexint32 (line 93) | struct hexint32 {
      method hexint32 (line 94) | hexint32(int v)
    type hexint64 (line 101) | struct hexint64 {
      method hexint64 (line 102) | hexint64(long long v)
    type binary (line 114) | struct binary {
      method binary (line 116) | binary() : bytes_() { }
      method binary (line 118) | binary(const BYTE* start, size_t n)
    function binary (line 132) | binary make_binary(const T& value, size_t n)
      method binary (line 116) | binary() : bytes_() { }
      method binary (line 118) | binary(const BYTE* start, size_t n)
    type ip_address (line 144) | struct ip_address {
      method ip_address (line 151) | static ip_address from_ipv6(const BYTE* bytes)
      method ip_address (line 159) | static ip_address from_ipv4(DWORD val)
      method ip_address (line 167) | ip_address() {}
    type socket_address (line 178) | struct socket_address {
      type sockaddr (line 180) | struct sockaddr
      type sockaddr_in (line 181) | struct sockaddr_in
      type sockaddr_in6 (line 182) | struct sockaddr_in6
      type sockaddr_storage (line 183) | struct sockaddr_storage
      method socket_address (line 187) | static socket_address from_bytes(const BYTE* bytes, size_t size_in_b...
    type property_info (line 201) | struct property_info {
      method property_info (line 206) | property_info(
      method property_info (line 215) | property_info()
      method found (line 221) | inline bool found() const
    type sid (line 233) | struct sid {
      method sid (line 240) | static sid from_bytes(const BYTE* bytes, size_t size_in_bytes)
    type pointer (line 263) | struct pointer {
      method pointer (line 270) | static pointer from_bytes(const BYTE* bytes, size_t size_in_bytes)
    type counted_string (line 301) | struct counted_string {
      method const_pointer (line 316) | const_pointer string() const
      method length (line 321) | size_t length() const

FILE: libs/krabs/krabs/parser.hpp
  type krabs (line 20) | namespace krabs {
    class schema (line 22) | class schema
    class parser (line 34) | class parser {
    function property_iterator (line 117) | inline property_iterator parser::properties() const
    function property_info (line 122) | inline property_info parser::find_property(const std::wstring &name)
    function throw_if_property_not_found (line 204) | inline void throw_if_property_not_found(const property_info &propInfo)
    function get_string_content_length (line 212) | size_t get_string_content_length(const T* string, size_t lengthBytes)
    function catch (line 241) | catch (const krabs::type_mismatch_assert&) {
    function catch (line 246) | catch (...) {
    function T (line 255) | T parser::parse(const std::wstring &name)
    function counted_string (line 311) | inline const counted_string* parser::parse<const counted_string*>(cons...
    function binary (line 322) | inline binary parser::parse<binary>(const std::wstring &name)
    function ip_address (line 333) | inline ip_address parser::parse<ip_address>(
    function socket_address (line 356) | inline socket_address parser::parse<socket_address>(
    function sid (line 368) | inline sid parser::parse<sid>(
    function pointer (line 407) | inline pointer parser::parse<pointer>(const std::wstring& name)

FILE: libs/krabs/krabs/perfinfo_groupmask.hpp
  type _PERFINFO_GROUPMASK (line 17) | struct _PERFINFO_GROUPMASK {
  type _EVENT_TRACE_INFORMATION_CLASS (line 158) | enum _EVENT_TRACE_INFORMATION_CLASS {
  type _EVENT_TRACE_GROUPMASK_INFORMATION (line 180) | struct _EVENT_TRACE_GROUPMASK_INFORMATION {
  type _SYSTEM_INFORMATION_CLASS (line 188) | enum _SYSTEM_INFORMATION_CLASS {

FILE: libs/krabs/krabs/property.hpp
  type krabs (line 25) | namespace krabs {
    class property (line 39) | class property {
    class property_iterator (line 78) | class property_iterator {
    function _TDH_IN_TYPE (line 151) | inline _TDH_IN_TYPE property::type() const
    function property (line 177) | inline property property_iterator::get_property(size_t index) const

FILE: libs/krabs/krabs/provider.hpp
  type krabs (line 28) | namespace krabs { namespace details {
    type details (line 28) | namespace details {
      class trace_manager (line 29) | class trace_manager
      type kt (line 31) | struct kt
      type ut (line 32) | struct ut
      class base_provider (line 55) | class base_provider {
    class trace (line 39) | class trace
    type details (line 46) | namespace details {
      class trace_manager (line 29) | class trace_manager
      type kt (line 31) | struct kt
      type ut (line 32) | struct ut
      class base_provider (line 55) | class base_provider {
    class provider (line 156) | class provider : public details::base_provider<T> {
    class kernel_provider (line 317) | class kernel_provider : public details::base_provider<ULONGLONG> {
      method kernel_provider (line 326) | kernel_provider(unsigned long flags, const GUID &id)
      method kernel_provider (line 343) | kernel_provider(const GUID& id, PERFINFO_MASK group_mask)
      method set_rundown_flags (line 366) | void set_rundown_flags(unsigned long rundown_flags) {
      method flags (line 378) | unsigned long flags() const { return p_; }
      method PERFINFO_MASK (line 385) | PERFINFO_MASK group_mask() const { return gm_; }
      method rundown_flags (line 392) | unsigned long rundown_flags() const { return r_; }
      method rundown_enabled (line 399) | bool rundown_enabled() const { return rundown_enabled_; }
    type details (line 416) | namespace details {
      class trace_manager (line 29) | class trace_manager
      type kt (line 31) | struct kt
      type ut (line 32) | struct ut
      class base_provider (line 55) | class base_provider {
    function check_com_hr (line 521) | inline void check_com_hr(HRESULT hr) {
    function check_provider_hr (line 531) | inline void check_provider_hr(HRESULT hr, const std::wstring &provider...
    function T (line 637) | T provider<T>::trace_flags() const
  type krabs (line 36) | namespace krabs {
    type details (line 28) | namespace details {
      class trace_manager (line 29) | class trace_manager
      type kt (line 31) | struct kt
      type ut (line 32) | struct ut
      class base_provider (line 55) | class base_provider {
    class trace (line 39) | class trace
    type details (line 46) | namespace details {
      class trace_manager (line 29) | class trace_manager
      type kt (line 31) | struct kt
      type ut (line 32) | struct ut
      class base_provider (line 55) | class base_provider {
    class provider (line 156) | class provider : public details::base_provider<T> {
    class kernel_provider (line 317) | class kernel_provider : public details::base_provider<ULONGLONG> {
      method kernel_provider (line 326) | kernel_provider(unsigned long flags, const GUID &id)
      method kernel_provider (line 343) | kernel_provider(const GUID& id, PERFINFO_MASK group_mask)
      method set_rundown_flags (line 366) | void set_rundown_flags(unsigned long rundown_flags) {
      method flags (line 378) | unsigned long flags() const { return p_; }
      method PERFINFO_MASK (line 385) | PERFINFO_MASK group_mask() const { return gm_; }
      method rundown_flags (line 392) | unsigned long rundown_flags() const { return r_; }
      method rundown_enabled (line 399) | bool rundown_enabled() const { return rundown_enabled_; }
    type details (line 416) | namespace details {
      class trace_manager (line 29) | class trace_manager
      type kt (line 31) | struct kt
      type ut (line 32) | struct ut
      class base_provider (line 55) | class base_provider {
    function check_com_hr (line 521) | inline void check_com_hr(HRESULT hr) {
    function check_provider_hr (line 531) | inline void check_provider_hr(HRESULT hr, const std::wstring &provider...
    function T (line 637) | T provider<T>::trace_flags() const

FILE: libs/krabs/krabs/schema.hpp
  type krabs (line 24) | namespace krabs { namespace testing {
    type testing (line 24) | namespace testing {
      class record_builder (line 25) | class record_builder
    class schema (line 31) | class schema
    class parser (line 32) | class parser
    class schema (line 40) | class schema {
    function wchar_t (line 295) | inline const wchar_t *schema::event_name() const
    function wchar_t (line 313) | inline const wchar_t* schema::opcode_name() const
    function wchar_t (line 328) | inline const wchar_t *schema::task_name() const
    function DECODING_SOURCE (line 340) | inline DECODING_SOURCE schema::decoding_source() const
    function wchar_t (line 365) | inline const wchar_t *schema::provider_name() const
    function LARGE_INTEGER (line 382) | inline LARGE_INTEGER schema::timestamp() const
    function GUID (line 387) | inline GUID schema::activity_id() const
  type krabs (line 29) | namespace krabs {
    type testing (line 24) | namespace testing {
      class record_builder (line 25) | class record_builder
    class schema (line 31) | class schema
    class parser (line 32) | class parser
    class schema (line 40) | class schema {
    function wchar_t (line 295) | inline const wchar_t *schema::event_name() const
    function wchar_t (line 313) | inline const wchar_t* schema::opcode_name() const
    function wchar_t (line 328) | inline const wchar_t *schema::task_name() const
    function DECODING_SOURCE (line 340) | inline DECODING_SOURCE schema::decoding_source() const
    function wchar_t (line 365) | inline const wchar_t *schema::provider_name() const
    function LARGE_INTEGER (line 382) | inline LARGE_INTEGER schema::timestamp() const
    function GUID (line 387) | inline GUID schema::activity_id() const

FILE: libs/krabs/krabs/schema_locator.hpp
  type krabs (line 25) | namespace krabs {
    type schema_key (line 32) | struct schema_key
      method schema_key (line 40) | schema_key(const EVENT_RECORD &record)
    class schema_locator (line 102) | class schema_locator {
    function PTRACE_EVENT_INFO (line 120) | inline const PTRACE_EVENT_INFO schema_locator::get_event_schema(const ...
    function get_event_schema_from_tdh (line 134) | inline std::unique_ptr<char[]> get_event_schema_from_tdh(const EVENT_R...
  type std (line 60) | namespace std {
    type std::hash<krabs::schema_key> (line 68) | struct std::hash<krabs::schema_key>
  type krabs (line 86) | namespace krabs {
    type schema_key (line 32) | struct schema_key
      method schema_key (line 40) | schema_key(const EVENT_RECORD &record)
    class schema_locator (line 102) | class schema_locator {
    function PTRACE_EVENT_INFO (line 120) | inline const PTRACE_EVENT_INFO schema_locator::get_event_schema(const ...
    function get_event_schema_from_tdh (line 134) | inline std::unique_ptr<char[]> get_event_schema_from_tdh(const EVENT_R...

FILE: libs/krabs/krabs/size_provider.hpp
  type krabs (line 16) | namespace krabs {
    class size_provider (line 22) | class size_provider {
    function ULONG (line 53) | inline ULONG size_provider::get_property_size(
    function ULONG (line 105) | inline ULONG size_provider::get_heuristic_size(
    function ULONG (line 155) | inline ULONG size_provider::get_tdh_size(

FILE: libs/krabs/krabs/tdh_helpers.hpp
  type krabs (line 15) | namespace krabs {
    type debug (line 62) | namespace debug {
      function missing_assert_specialization_for (line 67) | inline void missing_assert_specialization_for()
      function assert_valid_assignment (line 77) | inline void assert_valid_assignment(const std::wstring&, const prope...
      function throw_if_invalid (line 95) | inline void throw_if_invalid(

FILE: libs/krabs/krabs/testing/event_filter_proxy.hpp
  type krabs (line 13) | namespace krabs { namespace testing {
    type testing (line 13) | namespace testing {
      class event_filter_proxy (line 22) | class event_filter_proxy {

FILE: libs/krabs/krabs/testing/extended_data_builder.hpp
  type krabs (line 20) | namespace krabs { namespace testing {
    type testing (line 20) | namespace testing {
      class extended_data_builder (line 21) | class extended_data_builder
        method extended_data_builder (line 61) | extended_data_builder()
        method count (line 75) | inline size_t count() const { return items_.size(); }
      class extended_data_thunk (line 29) | class extended_data_thunk
      class extended_data_builder (line 54) | class extended_data_builder
        method extended_data_builder (line 61) | extended_data_builder()
        method count (line 75) | inline size_t count() const { return items_.size(); }

FILE: libs/krabs/krabs/testing/filler.hpp
  type krabs (line 11) | namespace krabs { namespace testing { namespace details {
    type testing (line 11) | namespace testing { namespace details {
      type details (line 11) | namespace details {
        function how_many_bytes_to_fill (line 19) | inline size_t how_many_bytes_to_fill(_TDH_IN_TYPE type)
        type tdh_morphism (line 60) | struct tdh_morphism {
        type tdh_morphism<T*> (line 66) | struct tdh_morphism<T*> {
        type tdh_morphism<std::wstring> (line 71) | struct tdh_morphism<std::wstring> {
        type tdh_morphism<std::string> (line 76) | struct tdh_morphism<std::string> {
        type tdh_morphism<char> (line 81) | struct tdh_morphism<char> {
        type tdh_morphism<unsigned char> (line 86) | struct tdh_morphism<unsigned char> {
        type tdh_morphism<short> (line 91) | struct tdh_morphism<short> {
        type tdh_morphism<unsigned short> (line 96) | struct tdh_morphism<unsigned short> {
        type tdh_morphism<int> (line 101) | struct tdh_morphism<int> {
        type tdh_morphism<unsigned int> (line 106) | struct tdh_morphism<unsigned int> {
        type tdh_morphism<long long> (line 111) | struct tdh_morphism<long long> {
        type tdh_morphism<unsigned long long> (line 116) | struct tdh_morphism<unsigned long long> {
        type tdh_morphism<float> (line 121) | struct tdh_morphism<float> {
        type tdh_morphism<double> (line 126) | struct tdh_morphism<double> {
        type tdh_morphism<bool> (line 131) | struct tdh_morphism<bool> {
        type tdh_morphism<GUID> (line 136) | struct tdh_morphism<GUID> {
        type tdh_morphism<krabs::guid> (line 141) | struct tdh_morphism<krabs::guid> {
        type tdh_morphism<FILETIME> (line 146) | struct tdh_morphism<FILETIME> {
        type tdh_morphism<SYSTEMTIME> (line 151) | struct tdh_morphism<SYSTEMTIME> {
        type tdh_morphism<krabs::hexint32> (line 156) | struct tdh_morphism<krabs::hexint32> {
        type tdh_morphism<krabs::hexint64> (line 161) | struct tdh_morphism<krabs::hexint64> {
        type tdh_morphism<SID> (line 166) | struct tdh_morphism<SID> {
        type tdh_morphism<krabs::binary> (line 171) | struct tdh_morphism<krabs::binary> {

FILE: libs/krabs/krabs/testing/proxy.hpp
  type krabs (line 13) | namespace krabs { namespace testing {
    type testing (line 13) | namespace testing {
      class trace_proxy (line 23) | class trace_proxy {

FILE: libs/krabs/krabs/testing/record_builder.hpp
  type krabs (line 24) | namespace krabs { namespace testing {
    type testing (line 24) | namespace testing {
      class record_builder (line 26) | class record_builder
      type details (line 28) | namespace details {
        type property_adder (line 41) | struct property_adder {
      class record_builder (line 77) | class record_builder {
      function EVENT_HEADER (line 233) | inline EVENT_HEADER &record_builder::header()
      function synth_record (line 243) | inline synth_record record_builder::pack() const
      function synth_record (line 270) | inline synth_record record_builder::pack_incomplete() const
      function EVENT_RECORD (line 284) | inline EVENT_RECORD record_builder::create_stub_record() const

FILE: libs/krabs/krabs/testing/record_property_thunk.hpp
  type krabs (line 9) | namespace krabs { namespace testing {
    type testing (line 9) | namespace testing {
      class record_builder (line 11) | class record_builder
      class record_property_thunk (line 26) | class record_property_thunk {
      function _TDH_IN_TYPE (line 158) | inline const _TDH_IN_TYPE record_property_thunk::type() const

FILE: libs/krabs/krabs/testing/synth_record.hpp
  type krabs (line 20) | namespace krabs { namespace testing {
    type testing (line 20) | namespace testing {
      class synth_record (line 28) | class synth_record {
        method swap (line 95) | void swap(synth_record& left, synth_record& right)
        method synth_record (line 105) | synth_record()
      function synth_record (line 159) | inline synth_record& synth_record::operator=(synth_record other)
        method swap (line 95) | void swap(synth_record& left, synth_record& right)
        method synth_record (line 105) | synth_record()

FILE: libs/krabs/krabs/trace.hpp
  type krabs (line 15) | namespace krabs { namespace details {
    type details (line 15) | namespace details {
      class trace_manager (line 16) | class trace_manager
    type testing (line 19) | namespace testing {
      class trace_proxy (line 20) | class trace_proxy
    class provider (line 27) | class provider
    class trace_stats (line 34) | class trace_stats
      method trace_stats (line 45) | trace_stats(uint64_t eventsHandled, const EVENT_TRACE_PROPERTIES& pr...
    class trace (line 64) | class trace {
    function EVENT_TRACE_LOGFILE (line 410) | EVENT_TRACE_LOGFILE trace<T>::open()
    function trace_stats (line 428) | trace_stats trace<T>::query_stats()
      method trace_stats (line 45) | trace_stats(uint64_t eventsHandled, const EVENT_TRACE_PROPERTIES& pr...
  type krabs (line 19) | namespace krabs { namespace testing {
    type details (line 15) | namespace details {
      class trace_manager (line 16) | class trace_manager
    type testing (line 19) | namespace testing {
      class trace_proxy (line 20) | class trace_proxy
    class provider (line 27) | class provider
    class trace_stats (line 34) | class trace_stats
      method trace_stats (line 45) | trace_stats(uint64_t eventsHandled, const EVENT_TRACE_PROPERTIES& pr...
    class trace (line 64) | class trace {
    function EVENT_TRACE_LOGFILE (line 410) | EVENT_TRACE_LOGFILE trace<T>::open()
    function trace_stats (line 428) | trace_stats trace<T>::query_stats()
      method trace_stats (line 45) | trace_stats(uint64_t eventsHandled, const EVENT_TRACE_PROPERTIES& pr...
  type krabs (line 24) | namespace krabs {
    type details (line 15) | namespace details {
      class trace_manager (line 16) | class trace_manager
    type testing (line 19) | namespace testing {
      class trace_proxy (line 20) | class trace_proxy
    class provider (line 27) | class provider
    class trace_stats (line 34) | class trace_stats
      method trace_stats (line 45) | trace_stats(uint64_t eventsHandled, const EVENT_TRACE_PROPERTIES& pr...
    class trace (line 64) | class trace {
    function EVENT_TRACE_LOGFILE (line 410) | EVENT_TRACE_LOGFILE trace<T>::open()
    function trace_stats (line 428) | trace_stats trace<T>::query_stats()
      method trace_stats (line 45) | trace_stats(uint64_t eventsHandled, const EVENT_TRACE_PROPERTIES& pr...

FILE: libs/krabs/krabs/trace_context.hpp
  type krabs (line 8) | namespace krabs {
    type trace_context (line 16) | struct trace_context

FILE: libs/krabs/krabs/ut.hpp
  type krabs (line 12) | namespace krabs { namespace details {
    type details (line 12) | namespace details {
      type ut (line 21) | struct ut {
        type filter_flags (line 25) | struct filter_flags {
        type filter_settings (line 32) | struct filter_settings{

FILE: libs/krabs/krabs/version_helpers.hpp
  function VERSIONHELPERAPI (line 42) | VERSIONHELPERAPI
  function VERSIONHELPERAPI (line 60) | VERSIONHELPERAPI
  function VERSIONHELPERAPI (line 66) | VERSIONHELPERAPI
  function VERSIONHELPERAPI (line 72) | VERSIONHELPERAPI
  function VERSIONHELPERAPI (line 78) | VERSIONHELPERAPI
  function VERSIONHELPERAPI (line 84) | VERSIONHELPERAPI
  function VERSIONHELPERAPI (line 90) | VERSIONHELPERAPI
  function VERSIONHELPERAPI (line 96) | VERSIONHELPERAPI
  function VERSIONHELPERAPI (line 102) | VERSIONHELPERAPI
  function VERSIONHELPERAPI (line 108) | VERSIONHELPERAPI
  function VERSIONHELPERAPI (line 114) | VERSIONHELPERAPI
  function VERSIONHELPERAPI (line 120) | VERSIONHELPERAPI
  function VERSIONHELPERAPI (line 126) | VERSIONHELPERAPI

FILE: libs/krabs/krabs/wstring_convert.hpp
  type krabs (line 6) | namespace krabs {
    function from_wstring (line 13) | inline std::string from_wstring(const std::wstring& wstr, UINT codePag...