EtwScope/run_experiments.bat at main · d3vobed/EtwScope · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
@echo off
REM ==============================================================================
REM ETWScope - Live Capture with All 4 Invocation Paths
REM Run this as Administrator!
REM ==============================================================================

set SILKETW=C:\Users\zerolapsintelli\Downloads\SilkETW_SilkService_v8\v8\SilkETW\SilkETW.exe
set BINDIR=C:\Users\zerolapsintelli\Desktop\final\binaries\src

echo [*] Starting ETWScope Active Measurement Framework...
echo [*] Make sure you are running this as Administrator!
echo.

python .\main.py capture ^
  --silketw "%SILKETW%" ^
  --provider "Microsoft-Windows-Kernel-Process" ^
  --payload-i1 "%BINDIR%\pocinjector.exe" ^
  --payload-i2 "%BINDIR%\tb_inject_directsyscall.exe" ^
  --payload-i3 "%BINDIR%\tb_inject_indirectsyscall.exe" ^
  --payload-i4 "%BINDIR%\tb_inject_hwbp.exe"

pause