### ETW Trace Setup and Configuration

Source: https://context7.com/jdu2600/etwti-fluctuationmonitor/llms.txt

This C++ code initializes an ETW user trace session for the Microsoft-Windows-Threat-Intelligence provider, specifically enabling the PROTECTVM_LOCAL keyword. It configures filters for VirtualProtect events and includes necessary steps for enabling and disabling PPL protection.

```cpp
#include "krabs.hpp"

// Create named ETW trace session
krabs::user_trace g_trace(L"EtwTi-FluctuationMonitor");

// Thread function to run the ETW trace
DWORD WINAPI EtwEventThread(LPVOID) {
    g_trace.start();
    return 0;
}

int wmain(int, wchar_t**) {
    printf("[*] Enabling Microsoft-Windows-Threat-Intelligence (KEYWORD_PROTECTVM_LOCAL)\n");

    // Configure Threat Intelligence provider
    krabs::provider<> ti_provider(L"Microsoft-Windows-Threat-Intelligence");
    ti_provider.any(0x10);  // KERNEL_THREATINT_KEYWORD_PROTECTVM_LOCAL

    // Filter for event ID 7 (VirtualProtect events)
    krabs::event_filter protectvm_filter(krabs::predicates::id_is(7));
    protectvm_filter.add_on_event_callback(protectvm_cb);
    ti_provider.add_filter(protectvm_filter);
    g_trace.enable(ti_provider);

    // Enable PPL to access protected ETW events
    InstallVulnerableDriver();
    EnablePPL();

    // Start ETW monitoring thread
    HANDLE hThread = CreateThread(NULL, 0, EtwEventThread, NULL, 0, NULL);
    Sleep(1000);  // Wait for ETW to initialize

    // Disable PPL after ETW is running
    DisablePPL();

    // Monitor for specified duration
    auto duration = 300;
    Sleep(duration * 1000);
    g_trace.stop();

    return 0;
}

```

--------------------------------

### Core Detection Logic for Immutable Code Pages

Source: https://context7.com/jdu2600/etwti-fluctuationmonitor/llms.txt

This C++ code defines global tracking for immutable code pages and provides functions to check memory protection flags. The detection callback monitors VirtualProtect events to identify fluctuations in these pages, triggering an alert if an immutable page is modified.

```cpp
// Global tracking of immutable code pages per process
std::unordered_map <DWORD, std::set<PVOID>> g_ImmutableCodePages;

// Memory protection state checking
constexpr auto PAGE_EXECUTE_ANY = PAGE_EXECUTE | PAGE_EXECUTE_READ | 
                                   PAGE_EXECUTE_READWRITE | PAGE_EXECUTE_WRITECOPY;
constexpr auto IsExecutable = [](DWORD Protection) {
    return 0 != (Protection & PAGE_EXECUTE_ANY);
};

constexpr auto PAGE_WRITE_ANY = PAGE_READWRITE | PAGE_WRITECOPY |
                                 PAGE_EXECUTE_READWRITE | PAGE_EXECUTE_WRITECOPY;
constexpr auto IsWritable = [](DWORD Protection) {
    return 0 != (Protection & PAGE_WRITE_ANY);
};

// Detection callback - fires on PROTECTVM_LOCAL events
auto protectvm_cb = [](const EVENT_RECORD& record, const krabs::trace_context& trace_context) {
    krabs::schema schema(record, trace_context.schema_locator);
    krabs::parser parser(schema);

    auto ProcessID          = parser.parse<DWORD>(L"CallingProcessId");
    auto BaseAddress        = parser.parse<PVOID>(L"BaseAddress");
    auto ProtectionMask     = parser.parse<DWORD>(L"ProtectionMask");
    auto LastProtectionMask = parser.parse<DWORD>(L"LastProtectionMask");

    // Detect transitions to immutable state
    if ((!IsExecutable(LastProtectionMask) && IsExecutable(ProtectionMask)) ||
        (IsWritable(LastProtectionMask) && !IsWritable(ProtectionMask)))
    {
        // Check if this page was already marked immutable
        auto immutable_iter = g_ImmutableCodePages.find(ProcessID);
        if (immutable_iter != g_ImmutableCodePages.cend() &&
            immutable_iter->second.find(BaseAddress) != immutable_iter->second.cend())
        {
            // ALERT: Immutable code page is fluctuating!
            printf("[!] %S %p is fluctuating\n", ProcessName(ProcessID).c_str(), BaseAddress);
        }
        else
        {
            // First time seeing this transition - mark as immutable
            g_ImmutableCodePages[ProcessID].insert(BaseAddress);
        }
    }
};

```

=== COMPLETE CONTENT === This response contains all available snippets from this library. No additional content exists. Do not make further requests.