PerfView is a comprehensive performance analysis and diagnostics toolkit primarily for Windows, with growing Linux support. It collects, parses, and visualizes Event Tracing for Windows (ETW), .NET EventPipe, Linux perf, and CTF traces. The repository contains a WPF desktop application (PerfView.exe) for interactive stack, memory, and heap analysis, along with command-line tools (HeapDump, TraceParserGen, perfcollect) and a reusable library (Microsoft.Diagnostics.Tracing.TraceEvent) for programmatic trace processing. The architecture is modular, with core libraries for fast serialization, stack analysis, symbol resolution, and automated analysis. While the codebase is well-maintained and extensively tested, it contains some legacy components (custom compression, duplicated utilities) and conditional compilation that indicate moderate technical drift. The library components are the most reusable assets, offering patterns for binary serialization, caching, recursion safety, and event filtering.
RedEdr is a Windows telemetry recorder designed for red teams and malware developers to assess detection surface before hitting a real EDR. It captures events from multiple Windows security layers: ETW (Event Tracing for Windows), ETW-TI (Threat Intelligence), kernel callbacks, and user-mode API hooks via Detours. The system comprises a main orchestrator (RedEdr.exe) that starts all reader subsystems, a kernel driver (RedEdrDriver.sys) for process/thread/image callbacks and KAPC injection, a DLL (RedEdrDll.dll) injected into target processes for ntdll.dll hooking, and a PPL service (RedEdrPplService.exe) that consumes ETW-TI events. An embedded web server (port 8081) serves a REST API and a client-side log viewer for filtering and analyzing captured events. The architecture follows a producer-consumer pattern: events from all sources (ETW, kernel pipe, DLL pipe, PPL pipe) are aggregated into a central EventAggregator, augmented with process and memory context, and then stored for retrieval via the web API. Inter-component communication relies on named pipes with simple ASCII command protocols. The kernel driver also includes an ELAM driver to allow the PPL service to run as a protected process. While the project demonstrates deep Windows internals knowledge and provides a comprehensive telemetry capture system, it has significant maintenance risks: hardcoded paths (C:\RedEdr\), fragile driver build dependencies, minimal unit test coverage, and several commented-out hooks in the injected DLL. The codebase is functional for its intended red-team use case but is not production-grade without substantial hardening.