Summary

This tool catches failures to open a process for handle duplication (and only that, though it should be fairly easy to adapt it for catching other ETW events). This tool outputs call stacks, but these call stacks are not symbolicated at the moment.