/** * This file has no copyright assigned and is placed in the Public Domain. * This file is part of the w64 mingw-runtime package. * No warranty is given; refer to the file DISCLAIMER.PD within this package. */ #ifndef _EVNTRACE_ #define _EVNTRACE_ #if defined(_WINNT_) || defined(WINNT) #ifndef WMIAPI #ifndef MIDL_PASS #ifdef _WMI_SOURCE_ #define WMIAPI __stdcall #else #define WMIAPI DECLSPEC_IMPORT __stdcall #endif #endif /* MIDL_PASS */ #endif /* WMIAPI */ #include DEFINE_GUID (EventTraceGuid,0x68fdd900,0x4a3e,0x11d1,0x84,0xf4,0x00,0x00,0xf8,0x04,0x64,0xe3); DEFINE_GUID (SystemTraceControlGuid,0x9e814aad,0x3204,0x11d2,0x9a,0x82,0x00,0x60,0x08,0xa8,0x69,0x39); DEFINE_GUID (EventTraceConfigGuid,0x01853a65,0x418f,0x4f36,0xae,0xfc,0xdc,0x0f,0x1d,0x2f,0xd2,0x35); DEFINE_GUID (DefaultTraceSecurityGuid,0x0811c1af,0x7a07,0x4a06,0x82,0xed,0x86,0x94,0x55,0xcd,0xf7,0x13); #define KERNEL_LOGGER_NAMEW L"NT Kernel Logger" #define GLOBAL_LOGGER_NAMEW L"GlobalLogger" #define EVENT_LOGGER_NAMEW L"Event Log" #define DIAG_LOGGER_NAMEW L"DiagLog" #define KERNEL_LOGGER_NAMEA "NT Kernel Logger" #define GLOBAL_LOGGER_NAMEA "GlobalLogger" #define EVENT_LOGGER_NAMEA "Event Log" #define DIAG_LOGGER_NAMEA "DiagLog" #define MAX_MOF_FIELDS 16 #ifndef _TRACEHANDLE_DEFINED #define _TRACEHANDLE_DEFINED typedef ULONG64 TRACEHANDLE,*PTRACEHANDLE; #endif #define SYSTEM_EVENT_TYPE 1 #define EVENT_TRACE_TYPE_INFO 0x00 #define EVENT_TRACE_TYPE_START 0x01 #define EVENT_TRACE_TYPE_END 0x02 #define EVENT_TRACE_TYPE_STOP 0x02 #define EVENT_TRACE_TYPE_DC_START 0x03 #define EVENT_TRACE_TYPE_DC_END 0x04 #define EVENT_TRACE_TYPE_EXTENSION 0x05 #define EVENT_TRACE_TYPE_REPLY 0x06 #define EVENT_TRACE_TYPE_DEQUEUE 0x07 #define EVENT_TRACE_TYPE_RESUME 0x07 #define EVENT_TRACE_TYPE_CHECKPOINT 0x08 #define EVENT_TRACE_TYPE_SUSPEND 0x08 #define EVENT_TRACE_TYPE_WINEVT_SEND 0x09 #define EVENT_TRACE_TYPE_WINEVT_RECEIVE 0XF0 #define TRACE_LEVEL_NONE 0 #define TRACE_LEVEL_CRITICAL 1 #define TRACE_LEVEL_FATAL 1 #define TRACE_LEVEL_ERROR 2 #define TRACE_LEVEL_WARNING 3 #define TRACE_LEVEL_INFORMATION 4 #define TRACE_LEVEL_VERBOSE 5 #define TRACE_LEVEL_RESERVED6 6 #define TRACE_LEVEL_RESERVED7 7 #define TRACE_LEVEL_RESERVED8 8 #define TRACE_LEVEL_RESERVED9 9 #define EVENT_TRACE_TYPE_LOAD 0x0A #define EVENT_TRACE_TYPE_IO_READ 0x0A #define EVENT_TRACE_TYPE_IO_WRITE 0x0B #define EVENT_TRACE_TYPE_IO_READ_INIT 0x0C #define EVENT_TRACE_TYPE_IO_WRITE_INIT 0x0D #define EVENT_TRACE_TYPE_IO_FLUSH 0x0E #define EVENT_TRACE_TYPE_IO_FLUSH_INIT 0x0F #define EVENT_TRACE_TYPE_MM_TF 0x0A #define EVENT_TRACE_TYPE_MM_DZF 0x0B #define EVENT_TRACE_TYPE_MM_COW 0x0C #define EVENT_TRACE_TYPE_MM_GPF 0x0D #define EVENT_TRACE_TYPE_MM_HPF 0x0E #define EVENT_TRACE_TYPE_MM_AV 0x0F #define EVENT_TRACE_TYPE_SEND 0x0A #define EVENT_TRACE_TYPE_RECEIVE 0x0B #define EVENT_TRACE_TYPE_CONNECT 0x0C #define EVENT_TRACE_TYPE_DISCONNECT 0x0D #define EVENT_TRACE_TYPE_RETRANSMIT 0x0E #define EVENT_TRACE_TYPE_ACCEPT 0x0F #define EVENT_TRACE_TYPE_RECONNECT 0x10 #define EVENT_TRACE_TYPE_CONNFAIL 0x11 #define EVENT_TRACE_TYPE_COPY_TCP 0x12 #define EVENT_TRACE_TYPE_COPY_ARP 0x13 #define EVENT_TRACE_TYPE_ACKFULL 0x14 #define EVENT_TRACE_TYPE_ACKPART 0x15 #define EVENT_TRACE_TYPE_ACKDUP 0x16 #define EVENT_TRACE_TYPE_GUIDMAP 0x0A #define EVENT_TRACE_TYPE_CONFIG 0x0B #define EVENT_TRACE_TYPE_SIDINFO 0x0C #define EVENT_TRACE_TYPE_SECURITY 0x0D #define EVENT_TRACE_TYPE_REGCREATE 0x0A #define EVENT_TRACE_TYPE_REGOPEN 0x0B #define EVENT_TRACE_TYPE_REGDELETE 0x0C #define EVENT_TRACE_TYPE_REGQUERY 0x0D #define EVENT_TRACE_TYPE_REGSETVALUE 0x0E #define EVENT_TRACE_TYPE_REGDELETEVALUE 0x0F #define EVENT_TRACE_TYPE_REGQUERYVALUE 0x10 #define EVENT_TRACE_TYPE_REGENUMERATEKEY 0x11 #define EVENT_TRACE_TYPE_REGENUMERATEVALUEKEY 0x12 #define EVENT_TRACE_TYPE_REGQUERYMULTIPLEVALUE 0x13 #define EVENT_TRACE_TYPE_REGSETINFORMATION 0x14 #define EVENT_TRACE_TYPE_REGFLUSH 0x15 #define EVENT_TRACE_TYPE_REGKCBCREATE 0x16 #define EVENT_TRACE_TYPE_REGKCBDELETE 0x17 #define EVENT_TRACE_TYPE_REGKCBRUNDOWNBEGIN 0x18 #define EVENT_TRACE_TYPE_REGKCBRUNDOWNEND 0x19 #define EVENT_TRACE_TYPE_REGVIRTUALIZE 0x1A #define EVENT_TRACE_TYPE_REGCLOSE 0x1B #define EVENT_TRACE_TYPE_REGSETSECURITY 0x1C #define EVENT_TRACE_TYPE_REGQUERYSECURITY 0x1D #define EVENT_TRACE_TYPE_REGCOMMIT 0x1E #define EVENT_TRACE_TYPE_REGPREPARE 0x1F #define EVENT_TRACE_TYPE_REGROLLBACK 0x20 #define EVENT_TRACE_TYPE_REGMOUNTHIVE 0x21 #define EVENT_TRACE_TYPE_CONFIG_CPU 0x0A #define EVENT_TRACE_TYPE_CONFIG_PHYSICALDISK 0x0B #define EVENT_TRACE_TYPE_CONFIG_LOGICALDISK 0x0C #define EVENT_TRACE_TYPE_CONFIG_NIC 0x0D #define EVENT_TRACE_TYPE_CONFIG_VIDEO 0x0E #define EVENT_TRACE_TYPE_CONFIG_SERVICES 0x0F #define EVENT_TRACE_TYPE_CONFIG_POWER 0x10 #define EVENT_TRACE_TYPE_CONFIG_NETINFO 0x11 #define EVENT_TRACE_TYPE_CONFIG_IRQ 0x15 #define EVENT_TRACE_TYPE_CONFIG_PNP 0x16 #define EVENT_TRACE_TYPE_CONFIG_IDECHANNEL 0x17 #define EVENT_TRACE_TYPE_CONFIG_PLATFORM 0x19 #define EVENT_TRACE_FLAG_PROCESS 0x00000001 #define EVENT_TRACE_FLAG_THREAD 0x00000002 #define EVENT_TRACE_FLAG_IMAGE_LOAD 0x00000004 #define EVENT_TRACE_FLAG_DISK_IO 0x00000100 #define EVENT_TRACE_FLAG_DISK_FILE_IO 0x00000200 #define EVENT_TRACE_FLAG_MEMORY_PAGE_FAULTS 0x00001000 #define EVENT_TRACE_FLAG_MEMORY_HARD_FAULTS 0x00002000 #define EVENT_TRACE_FLAG_NETWORK_TCPIP 0x00010000 #define EVENT_TRACE_FLAG_REGISTRY 0x00020000 #define EVENT_TRACE_FLAG_DBGPRINT 0x00040000 #define EVENT_TRACE_FLAG_PROCESS_COUNTERS 0x00000008 #define EVENT_TRACE_FLAG_CSWITCH 0x00000010 #define EVENT_TRACE_FLAG_DPC 0x00000020 #define EVENT_TRACE_FLAG_INTERRUPT 0x00000040 #define EVENT_TRACE_FLAG_SYSTEMCALL 0x00000080 #define EVENT_TRACE_FLAG_DISK_IO_INIT 0x00000400 #define EVENT_TRACE_FLAG_ALPC 0x00100000 #define EVENT_TRACE_FLAG_SPLIT_IO 0x00200000 #define EVENT_TRACE_FLAG_DRIVER 0x00800000 #define EVENT_TRACE_FLAG_PROFILE 0x01000000 #define EVENT_TRACE_FLAG_FILE_IO 0x02000000 #define EVENT_TRACE_FLAG_FILE_IO_INIT 0x04000000 #define EVENT_TRACE_FLAG_DISPATCHER 0x00000800 #define EVENT_TRACE_FLAG_VIRTUAL_ALLOC 0x00004000 #define EVENT_TRACE_FLAG_EXTENSION 0x80000000 #define EVENT_TRACE_FLAG_FORWARD_WMI 0x40000000 #define EVENT_TRACE_FLAG_ENABLE_RESERVE 0x20000000 #define EVENT_TRACE_FILE_MODE_NONE 0x00000000 #define EVENT_TRACE_FILE_MODE_SEQUENTIAL 0x00000001 #define EVENT_TRACE_FILE_MODE_CIRCULAR 0x00000002 #define EVENT_TRACE_FILE_MODE_APPEND 0x00000004 #define EVENT_TRACE_FILE_MODE_NEWFILE 0x00000008 #define EVENT_TRACE_FILE_MODE_PREALLOCATE 0x00000020 #define EVENT_TRACE_NONSTOPPABLE_MODE 0x00000040 #define EVENT_TRACE_SECURE_MODE 0x00000080 #define EVENT_TRACE_USE_KBYTES_FOR_SIZE 0x00002000 #define EVENT_TRACE_PRIVATE_IN_PROC 0x00020000 #define EVENT_TRACE_MODE_RESERVED 0x00100000 #define EVENT_TRACE_NO_PER_PROCESSOR_BUFFERING 0x10000000 #define EVENT_TRACE_REAL_TIME_MODE 0x00000100 #define EVENT_TRACE_DELAY_OPEN_FILE_MODE 0x00000200 #define EVENT_TRACE_BUFFERING_MODE 0x00000400 #define EVENT_TRACE_PRIVATE_LOGGER_MODE 0x00000800 #define EVENT_TRACE_ADD_HEADER_MODE 0x00001000 #define EVENT_TRACE_USE_GLOBAL_SEQUENCE 0x00004000 #define EVENT_TRACE_USE_LOCAL_SEQUENCE 0x00008000 #define EVENT_TRACE_RELOG_MODE 0x00010000 #define EVENT_TRACE_USE_PAGED_MEMORY 0x01000000 #define EVENT_TRACE_CONTROL_QUERY 0 #define EVENT_TRACE_CONTROL_STOP 1 #define EVENT_TRACE_CONTROL_UPDATE 2 #define EVENT_TRACE_CONTROL_FLUSH 3 #define TRACE_MESSAGE_SEQUENCE 1 #define TRACE_MESSAGE_GUID 2 #define TRACE_MESSAGE_COMPONENTID 4 #define TRACE_MESSAGE_TIMESTAMP 8 #define TRACE_MESSAGE_PERFORMANCE_TIMESTAMP 16 #define TRACE_MESSAGE_SYSTEMINFO 32 #define TRACE_MESSAGE_POINTER32 0x0040 #define TRACE_MESSAGE_POINTER64 0x0080 #define TRACE_MESSAGE_FLAG_MASK 0xFFFF #define TRACE_HEADER_FLAG_USE_TIMESTAMP 0x00000200 #define TRACE_HEADER_FLAG_TRACED_GUID 0x00020000 #define TRACE_HEADER_FLAG_LOG_WNODE 0x00040000 #define TRACE_HEADER_FLAG_USE_GUID_PTR 0x00080000 #define TRACE_HEADER_FLAG_USE_MOF_PTR 0x00100000 #define TRACE_MESSAGE_MAXIMUM_SIZE 8*1024 #define ETW_NULL_TYPE_VALUE 0 #define ETW_OBJECT_TYPE_VALUE 1 #define ETW_STRING_TYPE_VALUE 2 #define ETW_SBYTE_TYPE_VALUE 3 #define ETW_BYTE_TYPE_VALUE 4 #define ETW_INT16_TYPE_VALUE 5 #define ETW_UINT16_TYPE_VALUE 6 #define ETW_INT32_TYPE_VALUE 7 #define ETW_UINT32_TYPE_VALUE 8 #define ETW_INT64_TYPE_VALUE 9 #define ETW_UINT64_TYPE_VALUE 10 #define ETW_CHAR_TYPE_VALUE 11 #define ETW_SINGLE_TYPE_VALUE 12 #define ETW_DOUBLE_TYPE_VALUE 13 #define ETW_BOOLEAN_TYPE_VALUE 14 #define ETW_DECIMAL_TYPE_VALUE 15 #define ETW_GUID_TYPE_VALUE 101 #define ETW_ASCIICHAR_TYPE_VALUE 102 #define ETW_ASCIISTRING_TYPE_VALUE 103 #define ETW_COUNTED_STRING_TYPE_VALUE 104 #define ETW_POINTER_TYPE_VALUE 105 #define ETW_SIZET_TYPE_VALUE 106 #define ETW_HIDDEN_TYPE_VALUE 107 #define ETW_BOOL_TYPE_VALUE 108 #define ETW_COUNTED_ANSISTRING_TYPE_VALUE 109 #define ETW_REVERSED_COUNTED_STRING_TYPE_VALUE 110 #define ETW_REVERSED_COUNTED_ANSISTRING_TYPE_VALUE 111 #define ETW_NON_NULL_TERMINATED_STRING_TYPE_VALUE 112 #define ETW_REDUCED_ANSISTRING_TYPE_VALUE 113 #define ETW_REDUCED_STRING_TYPE_VALUE 114 #define ETW_SID_TYPE_VALUE 115 #define ETW_VARIANT_TYPE_VALUE 116 #define ETW_PTVECTOR_TYPE_VALUE 117 #define ETW_WMITIME_TYPE_VALUE 118 #define ETW_DATETIME_TYPE_VALUE 119 #define ETW_REFRENCE_TYPE_VALUE 120 #define TRACE_PROVIDER_FLAG_LEGACY 0x00000001 #define TRACE_PROVIDER_FLAG_PRE_ENABLE 0x00000002 #define EVENT_CONTROL_CODE_DISABLE_PROVIDER 0 #define EVENT_CONTROL_CODE_ENABLE_PROVIDER 1 #define EVENT_CONTROL_CODE_CAPTURE_STATE 2 #define EVENT_TRACE_USE_PROCTIME 0x0001 #define EVENT_TRACE_USE_NOCPUTIME 0x0002 typedef struct _EVENT_TRACE_HEADER { USHORT Size; __MINGW_EXTENSION union { USHORT FieldTypeFlags; __MINGW_EXTENSION struct { UCHAR HeaderType; UCHAR MarkerFlags; } DUMMYSTRUCTNAME; } DUMMYUNIONNAME; __MINGW_EXTENSION union { ULONG Version; struct { UCHAR Type; UCHAR Level; USHORT Version; } Class; } DUMMYUNIONNAME2; ULONG ThreadId; ULONG ProcessId; LARGE_INTEGER TimeStamp; __MINGW_EXTENSION union { GUID Guid; ULONGLONG GuidPtr; } DUMMYUNIONNAME3; __MINGW_EXTENSION union { __MINGW_EXTENSION struct { ULONG KernelTime; ULONG UserTime; } DUMMYSTRUCTNAME; ULONG64 ProcessorTime; __MINGW_EXTENSION struct { ULONG ClientContext; ULONG Flags; } DUMMYSTRUCTNAME2; } DUMMYUNIONNAME4; } EVENT_TRACE_HEADER,*PEVENT_TRACE_HEADER; typedef struct _EVENT_INSTANCE_HEADER { USHORT Size; __MINGW_EXTENSION union { USHORT FieldTypeFlags; __MINGW_EXTENSION struct { UCHAR HeaderType; UCHAR MarkerFlags; } DUMMYSTRUCTNAME; } DUMMYUNIONNAME; __MINGW_EXTENSION union { ULONG Version; struct { UCHAR Type; UCHAR Level; USHORT Version; } Class; } DUMMYUNIONNAME2; ULONG ThreadId; ULONG ProcessId; LARGE_INTEGER TimeStamp; ULONGLONG RegHandle; ULONG InstanceId; ULONG ParentInstanceId; __MINGW_EXTENSION union { __MINGW_EXTENSION struct { ULONG KernelTime; ULONG UserTime; } DUMMYSTRUCTNAME; ULONG64 ProcessorTime; __MINGW_EXTENSION struct { ULONG EventId; ULONG Flags; } DUMMYSTRUCTNAME2; } DUMMYUNIONNAME3; ULONGLONG ParentRegHandle; } EVENT_INSTANCE_HEADER,*PEVENT_INSTANCE_HEADER; #define DEFINE_TRACE_MOF_FIELD(MOF,ptr,length,type) \ (MOF)->DataPtr = (ULONG64) (ULONG_PTR) ptr; \ (MOF)->Length = (ULONG) length; \ (MOF)->DataType = (ULONG) type; typedef struct _MOF_FIELD { ULONG64 DataPtr; ULONG Length; ULONG DataType; } MOF_FIELD,*PMOF_FIELD; #if !(defined(_NTDDK_) || defined(_NTIFS_)) || defined(_WMIKM_) typedef struct _TRACE_LOGFILE_HEADER { ULONG BufferSize; __MINGW_EXTENSION union { ULONG Version; struct { UCHAR MajorVersion; UCHAR MinorVersion; UCHAR SubVersion; UCHAR SubMinorVersion; } VersionDetail; } DUMMYUNIONNAME; ULONG ProviderVersion; ULONG NumberOfProcessors; LARGE_INTEGER EndTime; ULONG TimerResolution; ULONG MaximumFileSize; ULONG LogFileMode; ULONG BuffersWritten; __MINGW_EXTENSION union { GUID LogInstanceGuid; __MINGW_EXTENSION struct { ULONG StartBuffers; ULONG PointerSize; ULONG EventsLost; ULONG CpuSpeedInMHz; } DUMMYSTRUCTNAME; } DUMMYUNIONNAME2; #if defined(_WMIKM_) PWCHAR LoggerName; PWCHAR LogFileName; RTL_TIME_ZONE_INFORMATION TimeZone; #else LPWSTR LoggerName; LPWSTR LogFileName; TIME_ZONE_INFORMATION TimeZone; #endif LARGE_INTEGER BootTime; LARGE_INTEGER PerfFreq; LARGE_INTEGER StartTime; ULONG ReservedFlags; ULONG BuffersLost; } TRACE_LOGFILE_HEADER,*PTRACE_LOGFILE_HEADER; typedef struct _TRACE_LOGFILE_HEADER32 { ULONG BufferSize; __MINGW_EXTENSION union { ULONG Version; struct { UCHAR MajorVersion; UCHAR MinorVersion; UCHAR SubVersion; UCHAR SubMinorVersion; } VersionDetail; }; ULONG ProviderVersion; ULONG NumberOfProcessors; LARGE_INTEGER EndTime; ULONG TimerResolution; ULONG MaximumFileSize; ULONG LogFileMode; ULONG BuffersWritten; __MINGW_EXTENSION union { GUID LogInstanceGuid; __MINGW_EXTENSION struct { ULONG StartBuffers; ULONG PointerSize; ULONG EventsLost; ULONG CpuSpeedInMHz; }; }; #if defined(_WMIKM_) ULONG32 LoggerName; ULONG32 LogFileName; RTL_TIME_ZONE_INFORMATION TimeZone; #else ULONG32 LoggerName; ULONG32 LogFileName; TIME_ZONE_INFORMATION TimeZone; #endif LARGE_INTEGER BootTime; LARGE_INTEGER PerfFreq; LARGE_INTEGER StartTime; ULONG ReservedFlags; ULONG BuffersLost; } TRACE_LOGFILE_HEADER32, *PTRACE_LOGFILE_HEADER32; typedef struct _TRACE_LOGFILE_HEADER64 { ULONG BufferSize; __MINGW_EXTENSION union { ULONG Version; struct { UCHAR MajorVersion; UCHAR MinorVersion; UCHAR SubVersion; UCHAR SubMinorVersion; } VersionDetail; }; ULONG ProviderVersion; ULONG NumberOfProcessors; LARGE_INTEGER EndTime; ULONG TimerResolution; ULONG MaximumFileSize; ULONG LogFileMode; ULONG BuffersWritten; __MINGW_EXTENSION union { GUID LogInstanceGuid; __MINGW_EXTENSION struct { ULONG StartBuffers; ULONG PointerSize; ULONG EventsLost; ULONG CpuSpeedInMHz; }; }; #if defined(_WMIKM_) ULONG64 LoggerName; ULONG64 LogFileName; RTL_TIME_ZONE_INFORMATION TimeZone; #else ULONG64 LoggerName; ULONG64 LogFileName; TIME_ZONE_INFORMATION TimeZone; #endif LARGE_INTEGER BootTime; LARGE_INTEGER PerfFreq; LARGE_INTEGER StartTime; ULONG ReservedFlags; ULONG BuffersLost; } TRACE_LOGFILE_HEADER64, *PTRACE_LOGFILE_HEADER64; #endif /* !_NTDDK_ || _WMIKM_ */ typedef struct _EVENT_INSTANCE_INFO { HANDLE RegHandle; ULONG InstanceId; } EVENT_INSTANCE_INFO,*PEVENT_INSTANCE_INFO; #if !defined(_WMIKM_) && !defined(_NTDDK_) && !defined(_NTIFS_) typedef struct _EVENT_TRACE_PROPERTIES { WNODE_HEADER Wnode; ULONG BufferSize; ULONG MinimumBuffers; ULONG MaximumBuffers; ULONG MaximumFileSize; ULONG LogFileMode; ULONG FlushTimer; ULONG EnableFlags; LONG AgeLimit; ULONG NumberOfBuffers; ULONG FreeBuffers; ULONG EventsLost; ULONG BuffersWritten; ULONG LogBuffersLost; ULONG RealTimeBuffersLost; HANDLE LoggerThreadId; ULONG LogFileNameOffset; ULONG LoggerNameOffset; } EVENT_TRACE_PROPERTIES,*PEVENT_TRACE_PROPERTIES; typedef struct _TRACE_GUID_REGISTRATION { LPCGUID Guid; HANDLE RegHandle; } TRACE_GUID_REGISTRATION,*PTRACE_GUID_REGISTRATION; #endif /* !_NTDDK_ || _WMIKM_ */ typedef struct _TRACE_GUID_PROPERTIES { GUID Guid; ULONG GuidType; ULONG LoggerId; ULONG EnableLevel; ULONG EnableFlags; BOOLEAN IsEnable; } TRACE_GUID_PROPERTIES,*PTRACE_GUID_PROPERTIES; typedef struct _ETW_BUFFER_CONTEXT { UCHAR ProcessorNumber; UCHAR Alignment; USHORT LoggerId; } ETW_BUFFER_CONTEXT, *PETW_BUFFER_CONTEXT; typedef struct _TRACE_ENABLE_INFO { ULONG IsEnabled; UCHAR Level; UCHAR Reserved1; USHORT LoggerId; ULONG EnableProperty; ULONG Reserved2; ULONGLONG MatchAnyKeyword; ULONGLONG MatchAllKeyword; } TRACE_ENABLE_INFO, *PTRACE_ENABLE_INFO; typedef struct _TRACE_PROVIDER_INSTANCE_INFO { ULONG NextOffset; ULONG EnableCount; ULONG Pid; ULONG Flags; } TRACE_PROVIDER_INSTANCE_INFO, *PTRACE_PROVIDER_INSTANCE_INFO; typedef struct _TRACE_GUID_INFO { ULONG InstanceCount; ULONG Reserved; } TRACE_GUID_INFO, *PTRACE_GUID_INFO; typedef struct _EVENT_TRACE { EVENT_TRACE_HEADER Header; ULONG InstanceId; ULONG ParentInstanceId; GUID ParentGuid; PVOID MofData; ULONG MofLength; __MINGW_EXTENSION union { ULONG ClientContext; ETW_BUFFER_CONTEXT BufferContext; /* MSDN says ULONG, for XP and older? */ } DUMMYUNIONNAME; } EVENT_TRACE,*PEVENT_TRACE; #if !defined(_WMIKM_) && !defined(_NTDDK_) && !defined(_NTIFS_) #ifndef DEFINED_PEVENT_RECORD typedef struct _EVENT_RECORD EVENT_RECORD, *PEVENT_RECORD; #define DEFINED_PEVENT_RECORD 1 #endif /* for evntcons.h */ #ifndef DEFINED_PEVENT_FILTER_DESC typedef struct _EVENT_FILTER_DESCRIPTOR EVENT_FILTER_DESCRIPTOR, *PEVENT_FILTER_DESCRIPTOR; #define DEFINED_PEVENT_FILTER_DESC 1 #endif /* for evntprov.h */ typedef struct _EVENT_TRACE_LOGFILEW EVENT_TRACE_LOGFILEW,*PEVENT_TRACE_LOGFILEW; typedef struct _EVENT_TRACE_LOGFILEA EVENT_TRACE_LOGFILEA,*PEVENT_TRACE_LOGFILEA; typedef ULONG (WINAPI *PEVENT_TRACE_BUFFER_CALLBACKW)(PEVENT_TRACE_LOGFILEW Logfile); typedef ULONG (WINAPI *PEVENT_TRACE_BUFFER_CALLBACKA)(PEVENT_TRACE_LOGFILEA Logfile); typedef VOID (WINAPI *PEVENT_CALLBACK)(PEVENT_TRACE pEvent); typedef VOID (WINAPI *PEVENT_RECORD_CALLBACK)(PEVENT_RECORD EventRecord); typedef ULONG (WINAPI *WMIDPREQUEST)(WMIDPREQUESTCODE RequestCode,PVOID RequestContext,ULONG *BufferSize,PVOID Buffer); struct _EVENT_TRACE_LOGFILEW { LPWSTR LogFileName; LPWSTR LoggerName; LONGLONG CurrentTime; ULONG BuffersRead; __MINGW_EXTENSION union { ULONG LogFileMode; ULONG ProcessTraceMode; } DUMMYUNIONNAME; EVENT_TRACE CurrentEvent; TRACE_LOGFILE_HEADER LogfileHeader; PEVENT_TRACE_BUFFER_CALLBACKW BufferCallback; ULONG BufferSize; ULONG Filled; ULONG EventsLost; __MINGW_EXTENSION union { PEVENT_CALLBACK EventCallback; PEVENT_RECORD_CALLBACK EventRecordCallback; } DUMMYUNIONNAME2; ULONG IsKernelTrace; PVOID Context; }; struct _EVENT_TRACE_LOGFILEA { LPSTR LogFileName; LPSTR LoggerName; LONGLONG CurrentTime; ULONG BuffersRead; __MINGW_EXTENSION union { ULONG LogFileMode; ULONG ProcessTraceMode; } DUMMYUNIONNAME; EVENT_TRACE CurrentEvent; TRACE_LOGFILE_HEADER LogfileHeader; PEVENT_TRACE_BUFFER_CALLBACKA BufferCallback; ULONG BufferSize; ULONG Filled; ULONG EventsLost; __MINGW_EXTENSION union { PEVENT_CALLBACK EventCallback; PEVENT_RECORD_CALLBACK EventRecordCallback; } DUMMYUNIONNAME2; ULONG IsKernelTrace; PVOID Context; }; #if defined(_UNICODE) || defined(UNICODE) #define PEVENT_TRACE_BUFFER_CALLBACK PEVENT_TRACE_BUFFER_CALLBACKW #define EVENT_TRACE_LOGFILE EVENT_TRACE_LOGFILEW #define PEVENT_TRACE_LOGFILE PEVENT_TRACE_LOGFILEW #define KERNEL_LOGGER_NAME KERNEL_LOGGER_NAMEW #define GLOBAL_LOGGER_NAME GLOBAL_LOGGER_NAMEW #define EVENT_LOGGER_NAME EVENT_LOGGER_NAMEW #else #define PEVENT_TRACE_BUFFER_CALLBACK PEVENT_TRACE_BUFFER_CALLBACKA #define EVENT_TRACE_LOGFILE EVENT_TRACE_LOGFILEA #define PEVENT_TRACE_LOGFILE PEVENT_TRACE_LOGFILEA #define KERNEL_LOGGER_NAME KERNEL_LOGGER_NAMEA #define GLOBAL_LOGGER_NAME GLOBAL_LOGGER_NAMEA #define EVENT_LOGGER_NAME EVENT_LOGGER_NAMEA #endif /* defined(_UNICODE) || defined(UNICODE) */ #ifdef __cplusplus extern "C" { #endif EXTERN_C ULONG WMIAPI StartTraceW(PTRACEHANDLE TraceHandle,LPCWSTR InstanceName,PEVENT_TRACE_PROPERTIES Properties); EXTERN_C ULONG WMIAPI StartTraceA(PTRACEHANDLE TraceHandle,LPCSTR InstanceName,PEVENT_TRACE_PROPERTIES Properties); EXTERN_C ULONG WMIAPI StopTraceW(TRACEHANDLE TraceHandle,LPCWSTR InstanceName,PEVENT_TRACE_PROPERTIES Properties); EXTERN_C ULONG WMIAPI StopTraceA(TRACEHANDLE TraceHandle,LPCSTR InstanceName,PEVENT_TRACE_PROPERTIES Properties); EXTERN_C ULONG WMIAPI QueryTraceW(TRACEHANDLE TraceHandle,LPCWSTR InstanceName,PEVENT_TRACE_PROPERTIES Properties); EXTERN_C ULONG WMIAPI QueryTraceA(TRACEHANDLE TraceHandle,LPCSTR InstanceName,PEVENT_TRACE_PROPERTIES Properties); EXTERN_C ULONG WMIAPI UpdateTraceW(TRACEHANDLE TraceHandle,LPCWSTR InstanceName,PEVENT_TRACE_PROPERTIES Properties); EXTERN_C ULONG WMIAPI UpdateTraceA(TRACEHANDLE TraceHandle,LPCSTR InstanceName,PEVENT_TRACE_PROPERTIES Properties); EXTERN_C ULONG WMIAPI FlushTraceW(TRACEHANDLE TraceHandle,LPCWSTR InstanceName,PEVENT_TRACE_PROPERTIES Properties); EXTERN_C ULONG WMIAPI FlushTraceA(TRACEHANDLE TraceHandle,LPCSTR InstanceName,PEVENT_TRACE_PROPERTIES Properties); EXTERN_C ULONG WMIAPI ControlTraceW(TRACEHANDLE TraceHandle,LPCWSTR InstanceName,PEVENT_TRACE_PROPERTIES Properties,ULONG ControlCode); EXTERN_C ULONG WMIAPI ControlTraceA(TRACEHANDLE TraceHandle,LPCSTR InstanceName,PEVENT_TRACE_PROPERTIES Properties,ULONG ControlCode); EXTERN_C ULONG WMIAPI QueryAllTracesW(PEVENT_TRACE_PROPERTIES *PropertyArray,ULONG PropertyArrayCount,PULONG LoggerCount); EXTERN_C ULONG WMIAPI QueryAllTracesA(PEVENT_TRACE_PROPERTIES *PropertyArray,ULONG PropertyArrayCount,PULONG LoggerCount); EXTERN_C ULONG WMIAPI EnableTrace(ULONG Enable,ULONG EnableFlag,ULONG EnableLevel,LPCGUID ControlGuid,TRACEHANDLE TraceHandle); #if (_WIN32_WINNT >= 0x0600) EXTERN_C ULONG WMIAPI EnableTraceEx( LPCGUID ProviderId, LPCGUID SourceId, TRACEHANDLE TraceHandle, ULONG IsEnabled, UCHAR Level, ULONGLONG MatchAnyKeyword, ULONGLONG MatchAllKeyword, ULONG EnableProperty, PEVENT_FILTER_DESCRIPTOR EnableFilterDesc ); #endif /* _WIN32_WINNT >= 0x0600 */ #define ENABLE_TRACE_PARAMETERS_VERSION 1 typedef struct _ENABLE_TRACE_PARAMETERS { ULONG Version; ULONG EnableProperty; ULONG ControlFlags; GUID SourceId; PEVENT_FILTER_DESCRIPTOR EnableFilterDesc; } ENABLE_TRACE_PARAMETERS, *PENABLE_TRACE_PARAMETERS; #if (_WIN32_WINNT >= 0x0601) EXTERN_C ULONG WMIAPI EnableTraceEx2( TRACEHANDLE TraceHandle, LPCGUID ProviderId, ULONG ControlCode, UCHAR Level, ULONGLONG MatchAnyKeyword, ULONGLONG MatchAllKeyword, ULONG Timeout, PENABLE_TRACE_PARAMETERS EnableParameters ); #endif /* _WIN32_WINNT >= 0x0601 */ typedef enum _TRACE_QUERY_INFO_CLASS { TraceGuidQueryList, TraceGuidQueryInfo, TraceGuidQueryProcess, TraceStackTracingInfo, MaxTraceSetInfoClass } TRACE_QUERY_INFO_CLASS, TRACE_INFO_CLASS; #if (_WIN32_WINNT >= 0x0600) EXTERN_C ULONG WMIAPI EnumerateTraceGuidsEx( TRACE_QUERY_INFO_CLASS TraceQueryInfoClass, PVOID InBuffer, ULONG InBufferSize, PVOID OutBuffer, ULONG OutBufferSize, PULONG ReturnLength ); #endif /* _WIN32_WINNT >= 0x0600 */ typedef struct _CLASSIC_EVENT_ID { GUID EventGuid; UCHAR Type; UCHAR Reserved[7]; } CLASSIC_EVENT_ID, *PCLASSIC_EVENT_ID; #if (_WIN32_WINNT >= 0x0601) EXTERN_C ULONG WMIAPI TraceSetInformation( TRACEHANDLE SessionHandle, TRACE_INFO_CLASS InformationClass, PVOID TraceInformation, ULONG InformationLength ); #endif /* _WIN32_WINNT >= 0x0601 */ EXTERN_C ULONG WMIAPI CreateTraceInstanceId(HANDLE RegHandle,PEVENT_INSTANCE_INFO pInstInfo); EXTERN_C ULONG WMIAPI TraceEvent(TRACEHANDLE TraceHandle,PEVENT_TRACE_HEADER EventTrace); EXTERN_C ULONG WMIAPI TraceEventInstance(TRACEHANDLE TraceHandle,PEVENT_INSTANCE_HEADER EventTrace,PEVENT_INSTANCE_INFO pInstInfo,PEVENT_INSTANCE_INFO pParentInstInfo); EXTERN_C ULONG WMIAPI RegisterTraceGuidsW(WMIDPREQUEST RequestAddress,PVOID RequestContext,LPCGUID ControlGuid,ULONG GuidCount,PTRACE_GUID_REGISTRATION TraceGuidReg,LPCWSTR MofImagePath,LPCWSTR MofResourceName,PTRACEHANDLE RegistrationHandle); EXTERN_C ULONG WMIAPI RegisterTraceGuidsA(WMIDPREQUEST RequestAddress,PVOID RequestContext,LPCGUID ControlGuid,ULONG GuidCount,PTRACE_GUID_REGISTRATION TraceGuidReg,LPCSTR MofImagePath,LPCSTR MofResourceName,PTRACEHANDLE RegistrationHandle); EXTERN_C ULONG WMIAPI EnumerateTraceGuids(PTRACE_GUID_PROPERTIES *GuidPropertiesArray,ULONG PropertyArrayCount,PULONG GuidCount); EXTERN_C ULONG WMIAPI UnregisterTraceGuids(TRACEHANDLE RegistrationHandle); EXTERN_C TRACEHANDLE WMIAPI GetTraceLoggerHandle(PVOID Buffer); EXTERN_C UCHAR WMIAPI GetTraceEnableLevel(TRACEHANDLE TraceHandle); EXTERN_C ULONG WMIAPI GetTraceEnableFlags(TRACEHANDLE TraceHandle); EXTERN_C TRACEHANDLE WMIAPI OpenTraceA(PEVENT_TRACE_LOGFILEA Logfile); EXTERN_C TRACEHANDLE WMIAPI OpenTraceW(PEVENT_TRACE_LOGFILEW Logfile); EXTERN_C ULONG WMIAPI ProcessTrace(PTRACEHANDLE HandleArray,ULONG HandleCount,LPFILETIME StartTime,LPFILETIME EndTime); EXTERN_C ULONG WMIAPI CloseTrace(TRACEHANDLE TraceHandle); EXTERN_C ULONG WMIAPI SetTraceCallback(LPCGUID pGuid,PEVENT_CALLBACK EventCallback); EXTERN_C ULONG WMIAPI RemoveTraceCallback (LPCGUID pGuid); EXTERN_C ULONG __cdecl TraceMessage(TRACEHANDLE LoggerHandle,ULONG MessageFlags,LPCGUID MessageGuid,USHORT MessageNumber,...); EXTERN_C ULONG WMIAPI TraceMessageVa(TRACEHANDLE LoggerHandle,ULONG MessageFlags,LPCGUID MessageGuid,USHORT MessageNumber,va_list MessageArgList); #ifdef __cplusplus } #endif #define INVALID_PROCESSTRACE_HANDLE ((TRACEHANDLE)INVALID_HANDLE_VALUE) #if defined(UNICODE) || defined(_UNICODE) #define RegisterTraceGuids RegisterTraceGuidsW #define StartTrace StartTraceW #define ControlTrace ControlTraceW #if defined(__TRACE_W2K_COMPATIBLE) #define StopTrace(a,b,c) ControlTraceW((a),(b),(c),EVENT_TRACE_CONTROL_STOP) #define QueryTrace(a,b,c) ControlTraceW((a),(b),(c),EVENT_TRACE_CONTROL_QUERY) #define UpdateTrace(a,b,c) ControlTraceW((a),(b),(c),EVENT_TRACE_CONTROL_UPDATE) #else #define StopTrace StopTraceW #define QueryTrace QueryTraceW #define UpdateTrace UpdateTraceW #endif /* defined(__TRACE_W2K_COMPATIBLE) */ #define FlushTrace FlushTraceW #define QueryAllTraces QueryAllTracesW #define OpenTrace OpenTraceW #else /* defined(UNICODE) || defined(_UNICODE) */ #define RegisterTraceGuids RegisterTraceGuidsA #define StartTrace StartTraceA #define ControlTrace ControlTraceA #if defined(__TRACE_W2K_COMPATIBLE) #define StopTrace(a,b,c) ControlTraceA((a),(b),(c),EVENT_TRACE_CONTROL_STOP) #define QueryTrace(a,b,c) ControlTraceA((a),(b),(c),EVENT_TRACE_CONTROL_QUERY) #define UpdateTrace(a,b,c) ControlTraceA((a),(b),(c),EVENT_TRACE_CONTROL_UPDATE) #else #define StopTrace StopTraceA #define QueryTrace QueryTraceA #define UpdateTrace UpdateTraceA #endif /* defined(__TRACE_W2K_COMPATIBLE) */ #define FlushTrace FlushTraceA #define QueryAllTraces QueryAllTracesA #define OpenTrace OpenTraceA #endif /* defined(UNICODE) || defined(_UNICODE) */ #endif /* !defined(_WMIKM_) && !defined(_NTDDK_) && !defined(_NTIFS_) */ #endif /* defined(_WINNT_) || defined(WINNT) */ #endif /* _EVNTRACE_ */