SilkETW
SilkETW copied to clipboard
Opcodes can be larger than 9
Hi there,
When filtering by opcode, e.g. -f Opcode -fv 2, you limit the possible opcode to filter on to be 0-9, in this code:
SilkUtility.FilterValueObject = byte.Parse(FilterValue);
if ((byte)SilkUtility.FilterValueObject > 9)
{
SilkUtility.ReturnStatusMessage("[!] Opcode outside valid range (0-9)", ConsoleColor.Red);
return;
}
However in the underlying ETW API, an Opcode is an UCHAR, so it can be 0-255
Gave a shot at fixing it: https://github.com/fireeye/SilkETW/pull/14