[Example] Send all Win32 API calls to an ElasticSearch instance - #11
Draft
calladoum-elastic wants to merge 25 commits into
Draft
calladoum-elastic wants to merge 25 commits into
calladoum-elastic wants to merge 25 commits into
Conversation
hugsy
changed the title
…nto hugsy/ttd-to-es
There was a problem hiding this comment.
Pull request overview
This PR adds a new example workspace binary that replays a TTD trace and ships Win32 API entrypoint hits to Elasticsearch, while also updating the ttd_sys build script and switching the auto_unpack disassembler backend.
Changes:
- Add
ttd_to_esworkspace crate to stream watched Win32 API calls into an Elasticsearch index via Bulk API. - Refactor
ttd_sys/build.rsto removeconst_formatusage and move several paths/versions to runtimePathBuf/env-driven helpers. - Replace
zydiswithiced-x86inauto_unpack, and update CI workflow action versions and caching paths.
Reviewed changes
Copilot reviewed 8 out of 9 changed files in this pull request and generated 9 comments.
Show a summary per file
| File | Description |
|---|---|
ttd_to_es/src/main.rs |
New example binary: index module exports, arm execute watchpoints, bulk-send API-call docs to Elasticsearch. |
ttd_to_es/Cargo.toml |
New crate manifest + dependencies for the Elasticsearch streaming example. |
ttd_sys/Cargo.toml |
Remove const_format build-dependency and minor cleanup. |
ttd_sys/build.rs |
Refactor build-script paths/versioning; update CMake invocation and binding generation. |
Cargo.toml |
Add ttd_to_es to workspace members. |
Cargo.lock |
Lockfile updates for new crate + dependency changes (elasticsearch, iced-x86, etc.). |
auto_unpack/src/main.rs |
Swap disassembly implementation from zydis to iced-x86. |
auto_unpack/Cargo.toml |
Replace zydis dependency with iced-x86. |
.github/workflows/build.yml |
Update actions versions, caching paths, and matrix behavior. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
112
to
116
| fn get_ttd_sdk_path() -> std::path::PathBuf { | ||
| let mut ttd_sdk_path = std::path::PathBuf::from(std::env::var("USERPROFILE").unwrap().as_str()); | ||
| ttd_sdk_path.push(format!(".nuget/packages/{}/{}", TTD_SDK_PACKAGE_NAME, TTD_SDK_PACKAGE_VERSION).as_str()); | ||
| ttd_sdk_path | ||
| } |
Comment on lines
286
to
290
| fn install_winget_ttd() { | ||
| let install_dir = get_winget_ttd_install_path(); | ||
| std::process::Command::new("winget") | ||
| .args([ | ||
| "install", |
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Description
Checklist
cargo build --all-targets)cargo testcargo doccargo clippy