Search code examples
c#.netvisual-studio.net-6.0etw

Could not load Krabsetw in C# .NET 6.0

I am using C# with the .NET 6.0 framework in Windows 10 and trying to use the NuGet Microsoft.O365.Security.Native.ETW package, corresponding to the Microsoft Krabsetw library, which allows the use of ETW. This is the repository on GitHub: https://github.com/microsoft/krabsetw. NuGet page: https://www.nuget.org/packages/Microsoft.O365.Security.Native.ETW/

Although all the dependencies are resolved and the library is installed correctly, at run it says that it cannot load the library. This is the exception:

System.IO.FileNotFoundException
  HResult=0x80070002
  Message=Could not load file or assembly 'Microsoft.O365.Security.Native.ETW, Version=1.0.8668.31639, Culture=neutral, PublicKeyToken=31bf3856ad364e35'. The system cannot find the file specified.
  Source=MyProject

Inspecting the library dependencies, in the folder where it has been compiled, I can see that ijwhost.dll is not found.

enter image description here

Although the dependency is located in the same directory, in the following path: runtimes\win-x64\native\Ijwhost.dll

This is the directory bin\Debug\net6.0-windows7.0 structure:

  • [My project files]
  • Microsoft.O365.Security.Native.ETW.dll
  • runtimes\win-x64\native
    • Ijwhost.dll

If I change the .NET framework version to 5.0, everything works fine. Above 6.0, it does not work with any version. Any ideas?

Solution

  • @swannman answered the issue in the repository on GitHub: https://github.com/microsoft/krabsetw/issues/238

    Including Ijwhost.dll in the root of the bin directory fixes this. It can be automated by adding the following to the project properties:

      <ItemGroup>
    <PackageReference Include="Microsoft.O365.Security.Native.ETW" Version="4.3.2">
      <GeneratePathProperty>true</GeneratePathProperty>
    </PackageReference>
  </ItemGroup>

  <Target Name="CopyFiles" AfterTargets="Build">
    <ItemGroup>
      <File Include="$(PkgMicrosoft_O365_Security_Native_ETW)\runtimes\win-x64\native\Ijwhost.dll"></File>
    </ItemGroup>
    <Copy SourceFiles="@(File)" DestinationFolder="$(OutDir)"></Copy>
  </Target>

    Maybe it is not the prettiest way, but in my case this has allowed me to solve the issue.