[Audit] handle-lifecycle XELOGKERNEL probes (cvar-gated)
New cvar `audit_handle_lifecycle` (Auditing group, default false). When enabled, emits one-line XELOGKERNEL traces tagged AUDIT-HLC at: NtCreateEvent return, NtSetEvent entry, KeSetEvent entry, NtWaitForSingleObjectEx entry + completion, EmulateCPInterruptDPC entry. Observation-only: zero-overhead when cvar off (single branch + flag read). Intended for handle disambiguation between xenia-rs and canary under the Wine cross-build oracle. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
@@ -13,5 +13,6 @@
|
||||
|
||||
DECLARE_bool(headless);
|
||||
DECLARE_bool(log_high_frequency_kernel_calls);
|
||||
DECLARE_bool(audit_handle_lifecycle);
|
||||
|
||||
#endif // XENIA_KERNEL_KERNEL_FLAGS_H_
|
||||
|
||||
Reference in New Issue
Block a user