### GET /api/recordings

Source: https://github.com/dobin/rededr/blob/master/RedEdr/index.html

Lists all available trace recordings.

```APIDOC
## GET /api/recordings

### Description
Lists all available trace recordings.

### Method
GET

### Endpoint
/api/recordings

### Response
#### Success Response (200)
- **recordings** (array) - List of recording names.

#### Response Example
["trace_01", "trace_02"]
```

--------------------------------

### POST /api/trace/start

Source: https://github.com/dobin/rededr/blob/master/RedEdr/index.html

Starts a new trace recording with the specified name.

```APIDOC
## POST /api/trace/start

### Description
Starts a new trace recording with the specified name.

### Method
POST

### Endpoint
/api/trace/start

### Request Body
- **trace** (string) - Required - The name of the trace to start.

### Request Example
{
  "trace": "my_trace_01"
}
```

--------------------------------

### GET /api/stats

Source: https://github.com/dobin/rededr/blob/master/RedEdr/index.html

Fetches real-time system statistics including event counts and kernel/ETW metrics.

```APIDOC
## GET /api/stats

### Description
Fetches real-time system statistics including event counts and kernel/ETW metrics.

### Method
GET

### Endpoint
/api/stats

### Response
#### Success Response (200)
- **events_count** (integer) - Total number of events.
- **num_kernel** (integer) - Kernel event count.
- **num_etw** (integer) - ETW event count.

#### Response Example
{
  "events_count": 150,
  "num_kernel": 50,
  "num_etw": 100
}
```

--------------------------------

### GET /api/logs/rededr

Source: https://github.com/dobin/rededr/blob/master/RedEdr/index.html

Retrieves the current list of logged events from the RedEdr system.

```APIDOC
## GET /api/logs/rededr

### Description
Retrieves the current list of logged events from the RedEdr system.

### Method
GET

### Endpoint
/api/logs/rededr

### Response
#### Success Response (200)
- **events** (array) - List of event objects.

#### Response Example
[
  { "id": 1, "type": "process_start", "timestamp": "2023-10-27T10:00:00Z" }
]
```

--------------------------------

### Control Trace and Collection Actions

Source: https://github.com/dobin/rededr/blob/master/RedEdr/index.html

Functions that trigger backend API endpoints to start, stop, reset, or save trace operations. These are typically mapped to button click events in the dashboard.

```javascript
async function sendTrace(name) {
	const response = await fetch('/api/trace/start', {
		method: 'POST',
		headers: { 'Content-Type': 'application/json' },
		body: JSON.stringify({ "trace": name })
	});
	if (!response.ok) throw new Error(`HTTP error! Status: ${response.status}`);
}

function BtnStart() {
	fetch('/api/start');
}

function BtnStop() {
	fetch('/api/stop');
}
```

--------------------------------

### Get Trace Target Executables (API)

Source: https://github.com/dobin/rededr/blob/master/Doc/api.md

Retrieves the current list of executable names that RedEdr is configured to trace. The response is a JSON object containing an array of target strings.

```json
{
    "trace": ["target1", "target2"]
}
```

--------------------------------

### Get System Statistics (API)

Source: https://github.com/dobin/rededr/blob/master/Doc/api.md

Retrieves system statistics and counters from the RedEdr system. The response is a JSON object containing various event counts and statistics.

```json
{
    "events_count": 12345,
    "num_kernel": 5000,
    "num_etw": 6000,
    "num_etwti": 500,
    "num_dll": 800,
    "num_process_cache": 45
}
```

--------------------------------

### Get Lock Status (API)

Source: https://github.com/dobin/rededr/blob/master/Doc/api.md

Checks the current lock status of the RedEdr resource. This endpoint returns a JSON object indicating whether the resource is currently in use.

```json
{
    "in_use": true
}
```

--------------------------------

### RedEdr Execution Commands

Source: https://github.com/dobin/rededr/blob/master/README.md

Various command-line configurations for running RedEdr, including tracing specific processes and enabling different telemetry consumers like ETW, kernel callbacks, or DLL injection monitoring.

```powershell
.\RedEdr.exe --all --trace otepad
.\RedEdr.exe --all --web --hide --trace notepad.exe
.\RedEdr.exe --kernel --inject --trace notepad.exe
.\RedEdr.exe --etw --etwti --trace notepad.exe
```

--------------------------------

### Windows Boot Configuration for Kernel Drivers

Source: https://github.com/dobin/rededr/blob/master/README.md

Commands required to enable the testing of self-signed kernel drivers, which is a prerequisite for using RedEdr's advanced kernel-level telemetry features.

```powershell
bcdedit /set testsigning on
bcdedit -debug on
```

--------------------------------

### Tracing and Execution API

Source: https://github.com/dobin/rededr/blob/master/Doc/api.md

Endpoints to configure process tracing targets and manage the observation state of the RedEdr system.

```APIDOC
## POST /api/trace/start

### Description
Sets the process name(s) to be observed by the EDR system.

### Method
POST

### Endpoint
/api/trace/start

### Request Body
- **trace** (array) - Required - List of executable names to trace

### Request Example
{
  "trace": ["notepad.exe", "calc.exe"]
}

### Response
#### Success Response (200)
- **result** (string) - Status message ("ok")

#### Response Example
{
  "result": "ok"
}
```

--------------------------------

### Fetch and Display System Data

Source: https://github.com/dobin/rededr/blob/master/RedEdr/index.html

A collection of asynchronous functions that retrieve logs, statistics, and recordings from the backend API. These functions update the UI elements such as counters and lists upon successful data retrieval.

```javascript
async function fetchStats() {
	const response = await fetch('/api/stats');
	if (!response.ok) throw new Error(`HTTP error! Status: ${response.status}`);
	const data = await response.json();
	if (data.events_count > MyData.stats.events_count) {
		fetchEvents();
		MyData.stats = data;
		document.getElementById('stats-counter').textContent = `Events: ${data.events_count}`;
	}
}

async function fetchRecordings() {
	const response = await fetch('/api/recordings');
	if (!response.ok) throw new Error(`HTTP error! Status: ${response.status}`);
	const data = await response.json();
	showRecordings(data);
}
```

--------------------------------

### Manage UI Tab Navigation

Source: https://github.com/dobin/rededr/blob/master/RedEdr/index.html

Handles switching between different dashboard views by toggling CSS display properties and active class states. It accepts a target tab ID and the DOM element to highlight.

```javascript
function showContent(tabId, tabElement) {
	const contents = document.querySelectorAll('.tab-content');
	contents.forEach(content => content.style.display = 'none');
	const tabs = document.querySelectorAll('.tab');
	tabs.forEach(tab => tab.classList.remove('active'));
	document.getElementById(tabId).style.display = 'block';
	if (tabElement) {
		tabElement.classList.add('active');
	}
}
```

--------------------------------

### Set Trace Target Executables (API)

Source: https://github.com/dobin/rededr/blob/master/Doc/api.md

Configures the process names that RedEdr will observe. This endpoint accepts a JSON payload specifying one or more executable names to trace. A successful request returns a JSON object with a 'result' field set to 'ok'.

```json
{
    "trace": ["executable1", "executable2"]
}
```

--------------------------------

### System Statistics API

Source: https://github.com/dobin/rededr/blob/master/Doc/api.md

Endpoints for retrieving system-wide event statistics and performing data persistence operations.

```APIDOC
## GET /api/stats

### Description
Returns system statistics and counters for various event types.

### Method
GET

### Endpoint
/api/stats

### Response
#### Success Response (200)
- **events_count** (integer) - Total number of events
- **num_kernel** (integer) - Number of kernel events
- **num_etw** (integer) - Number of ETW events
- **num_etwti** (integer) - Number of ETW TI events
- **num_dll** (integer) - Number of DLL events
- **num_process_cache** (integer) - Number of cached processes

#### Response Example
{
  "events_count": 150,
  "num_kernel": 50,
  "num_etw": 50,
  "num_etwti": 20,
  "num_dll": 20,
  "num_process_cache": 10
}
```

--------------------------------

### Define PPL Service Named Pipes

Source: https://github.com/dobin/rededr/blob/master/RedEdrPplService/README.md

Defines the constant strings used for inter-process communication between the RedEdr PPL service and the main application. The control pipe handles command signals, while the data pipe is used for streaming telemetry events.

```cpp
#define PPL_SERVICE_PIPE_NAME L"\\\\.\\pipe\\RedEdrPplService"
#define PPL_DATA_PIPE_NAME L"\\\\.\\pipe\\RedEdrPplData"
```

--------------------------------

### RedEdrPplService Communication API

Source: https://github.com/dobin/rededr/blob/master/RedEdrPplService/README.md

This section details the communication protocol used to interact with the RedEdrPplService via a named pipe.

```APIDOC
## RedEdrPplService Communication

### Description
Provides a named pipe for sending ASCII commands to the RedEdrPplService and receiving events.

### Method
Pipe Communication (ASCII Commands)

### Endpoint
`\\.\pipe\RedEdrPplService`

### Parameters
#### Commands
- **start:<processname>** (string) - Starts observing the specified process.
- **stop** (string) - Indicates that RedEdr.exe is shutting down. This will disconnect the `PPL_DATA_PIPE_NAME`.
- **shutdown** (string) - Shuts down the RedEdrPplService, allowing for executable updates.

### Request Example
```
start:notepad.exe
```

### Response
#### Data Pipe Connection
If RedEdr connects to the `PPL_SERVICE_PIPE_NAME`, the RedEdrPplService will automatically attempt to connect back to RedEdr's pipe.

### Data Pipe
#### Endpoint
`\\.\pipe\RedEdrPplData`

### Description
This pipe is used by RedEdrPplService to send matching events back to RedEdr.

### Response Example
(Events are sent over this pipe, format depends on the event type)
```

--------------------------------

### Lock Management API

Source: https://github.com/dobin/rededr/blob/master/Doc/api.md

Endpoints to manage resource locks for concurrent access control.

```APIDOC
## POST /api/lock/acquire

### Description
Acquires a resource lock to prevent concurrent access by multiple users.

### Method
POST

### Endpoint
/api/lock/acquire

### Response
#### Success Response (200)
- **status** (string) - Success confirmation

#### Error Response (409)
- **status** (string) - "error"
- **message** (string) - "Resource is already in use"
```

--------------------------------

### Retrieve All Captured Events (API)

Source: https://github.com/dobin/rededr/blob/master/Doc/api.md

Fetches all events recorded by RedEdr during the current session. This includes ETW events, DLL hooking events, and other recorded activities. The response is a JSON array of event objects.

```json
[
    {
        "date":"2025-07-20-10-36-24",
        "do_etw":false,
        "do_etwti":false,
        "do_hook":false,
        "do_hook_callstack": true,
        "func":"init",
        "target":"otepad",
        "trace_id":41,
        "type":"meta",
        "version":"0.4"
    }
]
```

--------------------------------

### Log Retrieval API

Source: https://github.com/dobin/rededr/blob/master/Doc/api.md

Endpoints for retrieving captured event logs and internal agent diagnostic logs.

```APIDOC
## GET /api/logs/rededr

### Description
Retrieves all captured events from the current session, including ETW and hooking events.

### Method
GET

### Endpoint
/api/logs/rededr

### Response
#### Success Response (200)
- **events** (array) - List of event objects

#### Response Example
[
  {
    "date": "2025-07-20-10-36-24",
    "func": "init",
    "target": "otepad",
    "type": "meta"
  }
]
```

--------------------------------

### Retrieve Agent Logs (API)

Source: https://github.com/dobin/rededr/blob/master/Doc/api.md

Retrieves the logging output from the RedEdr agent itself, including the main RedEdr process and the RedEdrPplService. The response is a JSON array of log strings.

```json
[
    "RedEdr 0.4",
    "Config: tracing otepad",
    "Permissions: Enabled PRIVILEGED & DEBUG"
]
```

--------------------------------

### Shellcode Execution Pattern

Source: https://github.com/dobin/rededr/blob/master/README.md

A common shellcode execution pattern involving memory allocation, copying, permission modification, and thread creation. This sequence is a primary target for EDR detection mechanisms.

```c
PVOID shellcodeAddr = VirtualAlloc(NULL, payloadSize, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
memcpy(shellcodeAddr, payload, payloadSize);
VirtualProtect(shellcodeAddr, payloadSize, PAGE_EXECUTE_READWRITE, &dwOldProtection));
HANDLE hThread = CreateThread(NULL, 0, shellcodeAddr, shellcodeAddr, 0, &threadId);
```

=== COMPLETE CONTENT === This response contains all available snippets from this library. No additional content exists. Do not make further requests.