Only allocate one EventRecordMetadata^ and reuse it for RawProvider e…

…vents
microsoft · Nov 12, 2024 · 2c19173 · 2c19173
1 parent 4b1456c
commit 2c19173
Show file tree

Hide file tree

Showing 2 changed files with 12 additions and 5 deletions.
diff --git a/Microsoft.O365.Security.Native.ETW/EventRecordMetadata.hpp b/Microsoft.O365.Security.Native.ETW/EventRecordMetadata.hpp
@@ -17,15 +17,16 @@ namespace Microsoft { namespace O365 { namespace Security { namespace ETW {
     /// </summary>
     public ref class EventRecordMetadata : public IEventRecordMetadata
     {
-    protected:
-        const EVENT_RECORD* record_;
-        const EVENT_HEADER* header_;
-
     internal:
         EventRecordMetadata(const EVENT_RECORD& record)
             : record_(&record)
             , header_(&record.EventHeader) { }
 
+        EventRecordMetadata() { }
+
+        const EVENT_RECORD* record_;
+        const EVENT_HEADER* header_;
+
     public:
         // For container ID's, we are expecting format "00000000-0000-0000-0000-0000000000000", 
         // 32 hex digits with 4 hyphens, no braces.

diff --git a/Microsoft.O365.Security.Native.ETW/RawProvider.hpp b/Microsoft.O365.Security.Native.ETW/RawProvider.hpp
@@ -122,6 +122,7 @@ namespace Microsoft { namespace O365 { namespace Security { namespace ETW {
         NativePtr<krabs::provider<>> provider_;
         GCHandle delegateHookHandle_;
         GCHandle delegateHandle_;
+        EventRecordMetadata^ data_;
         void SetUpProvider();
     };
 
@@ -148,6 +149,8 @@ namespace Microsoft { namespace O365 { namespace Security { namespace ETW {
         delegateHookHandle_ = GCHandle::Alloc(bridged);
 
         provider_->add_on_event_callback((krabs::c_provider_callback)bridged.ToPointer());
+
+        data_ = gcnew EventRecordMetadata();
     }
 
     inline RawProvider::~RawProvider()
@@ -165,6 +168,9 @@ namespace Microsoft { namespace O365 { namespace Security { namespace ETW {
 
     inline void RawProvider::EventNotification(const EVENT_RECORD &record)
     {
-        OnEvent(gcnew EventRecordMetadata(record));
+        data_->record_ = &record;
+        data_->header_ = &record.EventHeader;
+
+        OnEvent(data_);
     }
 } } } }