$ show dobin/RedEdr
RedEdr is a Windows telemetry recorder designed for red teams and malware developers to assess detection surface before hitting a real EDR. It captures events from multiple Windows security layers: ETW (Event Tracing for Windows), ETW-TI (Threat Intelligence), kernel callbacks, and user-mode API hooks via Detours. The system comprises a main orchestrator (RedEdr.exe) that starts all reader subsystems, a kernel driver (RedEdrDriver.sys) for process/thread/image callbacks and KAPC injection, a DLL (RedEdrDll.dll) injected into target processes for ntdll.dll hooking, and a PPL service (RedEdrPplService.exe) that consumes ETW-TI events. An embedded web server (port 8081) serves a REST API and a client-side log viewer for filtering and analyzing captured events. The architecture follows a producer-consumer pattern: events from all sources (ETW, kernel pipe, DLL pipe, PPL pipe) are aggregated into a central EventAggregator, augmented with process and memory context, and then stored for retrieval via the web API. Inter-component communication relies on named pipes with simple ASCII command protocols. The kernel driver also includes an ELAM driver to allow the PPL service to run as a protected process. While the project demonstrates deep Windows internals knowledge and provides a comprehensive telemetry capture system, it has significant maintenance risks: hardcoded paths (C:\RedEdr\), fragile driver build dependencies, minimal unit test coverage, and several commented-out hooks in the injected DLL. The codebase is functional for its intended red-team use case but is not production-grade without substantial hardening.
The LLM identified 5 files worth highlighting for reuse:
Generic named pipe server and client classes (PipeServer, PipeClient) with mutex protection and simple ASCII message passing. Used by all components for inter-process communication. Reusable in any Windows project that needs IPC via named pipes.
Thread-safe event aggregation buffer using a mutex and condition variable. Events from multiple sources are pushed by producers and consumed by a single processing thread. Demonstrates a clean producer-consumer pattern that can be extracted for any multi-threaded event collection system.
Singleton cache of Process objects keyed by PID, with lazy creation, periodic cleanup, and thread-safe access. Provides methods to retrieve process information (name, path, session, integrity level) by PID. Can be reused in any Windows monitoring tool that needs a centralized process info cache.
Function KrabsEtwEventToJsonStr that converts any ETW event (from the krabs library) to a JSON string. Handles event properties of various types (string, uint, int64, etc.) and formats timestamps. Reusable for any project that needs to serialize ETW events to JSON.
Standalone HTML log viewer (SemiDataSieve) with filtering, sorting, color-coding by provider/process, and local storage of filter configurations. Consumes JSON logs via REST API. Can be reused as a generic log visualization frontend by pointing it at a different JSON endpoint.