| // Copyright © 2017 winapi-rs developers |
| // Licensed under the Apache License, Version 2.0 |
| // <LICENSE-APACHE or http://www.apache.org/licenses/LICENSE-2.0> or the MIT license |
| // <LICENSE-MIT or http://opensource.org/licenses/MIT>, at your option. |
| // All files in the project carrying such notice may not be copied, modified, or distributed |
| // except according to those terms. |
| use shared::basetsd::{SIZE_T, ULONG32, ULONG64}; |
| use shared::evntprov::PEVENT_FILTER_DESCRIPTOR; |
| use shared::guiddef::{GUID, LPCGUID, LPGUID}; |
| use shared::minwindef::{DWORD, LPFILETIME, PULONG, UCHAR, UINT, ULONG, USHORT}; |
| use shared::wmistr::{WMIDPREQUESTCODE, WNODE_HEADER}; |
| use um::evntcons::PEVENT_RECORD; |
| use um::handleapi::INVALID_HANDLE_VALUE; |
| use um::timezoneapi::TIME_ZONE_INFORMATION; |
| use um::winnt::{ |
| ANYSIZE_ARRAY, BOOLEAN, HANDLE, LARGE_INTEGER, LONG, LONGLONG, LPCSTR, LPCWSTR, LPSTR, LPWSTR, |
| PVOID, ULONGLONG, WCHAR |
| }; |
| use vc::vadefs::va_list; |
| DEFINE_GUID!{EventTraceGuid, |
| 0x68fdd900, 0x4a3e, 0x11d1, 0x84, 0xf4, 0x00, 0x00, 0xf8, 0x04, 0x64, 0xe3} |
| DEFINE_GUID!{SystemTraceControlGuid, |
| 0x9e814aad, 0x3204, 0x11d2, 0x9a, 0x82, 0x00, 0x60, 0x08, 0xa8, 0x69, 0x39} |
| DEFINE_GUID!{EventTraceConfigGuid, |
| 0x01853a65, 0x418f, 0x4f36, 0xae, 0xfc, 0xdc, 0x0f, 0x1d, 0x2f, 0xd2, 0x35} |
| DEFINE_GUID!{DefaultTraceSecurityGuid, |
| 0x0811c1af, 0x7a07, 0x4a06, 0x82, 0xed, 0x86, 0x94, 0x55, 0xcd, 0xf7, 0x13} |
| DEFINE_GUID!{PrivateLoggerNotificationGuid, |
| 0x3595ab5c, 0x042a, 0x4c8e, 0xb9, 0x42, 0x2d, 0x05, 0x9b, 0xfe, 0xb1, 0xb1} |
| pub const KERNEL_LOGGER_NAME: &'static str = "NT Kernel Logger"; |
| pub const GLOBAL_LOGGER_NAME: &'static str = "GlobalLogger"; |
| pub const EVENT_LOGGER_NAME: &'static str = "EventLog"; |
| pub const DIAG_LOGGER_NAME: &'static str = "DiagLog"; |
| pub const MAX_MOF_FIELDS: SIZE_T = 16; |
| DECLARE_HANDLE!{TRACEHANDLE, __TRACEHANDLE} |
| pub type PTRACEHANDLE = *mut TRACEHANDLE; |
| pub const EVENT_TRACE_TYPE_INFO: DWORD = 0x00; |
| pub const EVENT_TRACE_TYPE_START: DWORD = 0x01; |
| pub const EVENT_TRACE_TYPE_END: DWORD = 0x02; |
| pub const EVENT_TRACE_TYPE_STOP: DWORD = 0x02; |
| pub const EVENT_TRACE_TYPE_DC_START: DWORD = 0x03; |
| pub const EVENT_TRACE_TYPE_DC_END: DWORD = 0x04; |
| pub const EVENT_TRACE_TYPE_EXTENSION: DWORD = 0x05; |
| pub const EVENT_TRACE_TYPE_REPLY: DWORD = 0x06; |
| pub const EVENT_TRACE_TYPE_DEQUEUE: DWORD = 0x07; |
| pub const EVENT_TRACE_TYPE_RESUME: DWORD = 0x07; |
| pub const EVENT_TRACE_TYPE_CHECKPOINT: DWORD = 0x08; |
| pub const EVENT_TRACE_TYPE_SUSPEND: DWORD = 0x08; |
| pub const EVENT_TRACE_TYPE_WINEVT_SEND: DWORD = 0x09; |
| pub const EVENT_TRACE_TYPE_WINEVT_RECEIVE: DWORD = 0xF0; |
| pub const TRACE_LEVEL_CRITICAL: UCHAR = 1; |
| pub const TRACE_LEVEL_ERROR: UCHAR = 2; |
| pub const TRACE_LEVEL_WARNING: UCHAR = 3; |
| pub const TRACE_LEVEL_INFORMATION: UCHAR = 4; |
| pub const TRACE_LEVEL_VERBOSE: UCHAR = 5; |
| pub const TRACE_LEVEL_RESERVED6: UCHAR = 6; |
| pub const TRACE_LEVEL_RESERVED7: UCHAR = 7; |
| pub const TRACE_LEVEL_RESERVED8: UCHAR = 8; |
| pub const TRACE_LEVEL_RESERVED9: UCHAR = 9; |
| pub const EVENT_TRACE_TYPE_LOAD: DWORD = 0x0A; |
| pub const EVENT_TRACE_TYPE_TERMINATE: DWORD = 0x0B; |
| pub const EVENT_TRACE_TYPE_IO_READ: DWORD = 0x0A; |
| pub const EVENT_TRACE_TYPE_IO_WRITE: DWORD = 0x0B; |
| pub const EVENT_TRACE_TYPE_IO_READ_INIT: DWORD = 0x0C; |
| pub const EVENT_TRACE_TYPE_IO_WRITE_INIT: DWORD = 0x0D; |
| pub const EVENT_TRACE_TYPE_IO_FLUSH: DWORD = 0x0E; |
| pub const EVENT_TRACE_TYPE_IO_FLUSH_INIT: DWORD = 0x0F; |
| pub const EVENT_TRACE_TYPE_IO_REDIRECTED_INIT: DWORD = 0x10; |
| pub const EVENT_TRACE_TYPE_MM_TF: DWORD = 0x0A; |
| pub const EVENT_TRACE_TYPE_MM_DZF: DWORD = 0x0B; |
| pub const EVENT_TRACE_TYPE_MM_COW: DWORD = 0x0C; |
| pub const EVENT_TRACE_TYPE_MM_GPF: DWORD = 0x0D; |
| pub const EVENT_TRACE_TYPE_MM_HPF: DWORD = 0x0E; |
| pub const EVENT_TRACE_TYPE_MM_AV: DWORD = 0x0F; |
| pub const EVENT_TRACE_TYPE_SEND: DWORD = 0x0A; |
| pub const EVENT_TRACE_TYPE_RECEIVE: DWORD = 0x0B; |
| pub const EVENT_TRACE_TYPE_CONNECT: DWORD = 0x0C; |
| pub const EVENT_TRACE_TYPE_DISCONNECT: DWORD = 0x0D; |
| pub const EVENT_TRACE_TYPE_RETRANSMIT: DWORD = 0x0E; |
| pub const EVENT_TRACE_TYPE_ACCEPT: DWORD = 0x0F; |
| pub const EVENT_TRACE_TYPE_RECONNECT: DWORD = 0x10; |
| pub const EVENT_TRACE_TYPE_CONNFAIL: DWORD = 0x11; |
| pub const EVENT_TRACE_TYPE_COPY_TCP: DWORD = 0x12; |
| pub const EVENT_TRACE_TYPE_COPY_ARP: DWORD = 0x13; |
| pub const EVENT_TRACE_TYPE_ACKFULL: DWORD = 0x14; |
| pub const EVENT_TRACE_TYPE_ACKPART: DWORD = 0x15; |
| pub const EVENT_TRACE_TYPE_ACKDUP: DWORD = 0x16; |
| pub const EVENT_TRACE_TYPE_GUIDMAP: DWORD = 0x0A; |
| pub const EVENT_TRACE_TYPE_CONFIG: DWORD = 0x0B; |
| pub const EVENT_TRACE_TYPE_SIDINFO: DWORD = 0x0C; |
| pub const EVENT_TRACE_TYPE_SECURITY: DWORD = 0x0D; |
| pub const EVENT_TRACE_TYPE_DBGID_RSDS: DWORD = 0x40; |
| pub const EVENT_TRACE_TYPE_REGCREATE: DWORD = 0x0A; |
| pub const EVENT_TRACE_TYPE_REGOPEN: DWORD = 0x0B; |
| pub const EVENT_TRACE_TYPE_REGDELETE: DWORD = 0x0C; |
| pub const EVENT_TRACE_TYPE_REGQUERY: DWORD = 0x0D; |
| pub const EVENT_TRACE_TYPE_REGSETVALUE: DWORD = 0x0E; |
| pub const EVENT_TRACE_TYPE_REGDELETEVALUE: DWORD = 0x0F; |
| pub const EVENT_TRACE_TYPE_REGQUERYVALUE: DWORD = 0x10; |
| pub const EVENT_TRACE_TYPE_REGENUMERATEKEY: DWORD = 0x11; |
| pub const EVENT_TRACE_TYPE_REGENUMERATEVALUEKEY: DWORD = 0x12; |
| pub const EVENT_TRACE_TYPE_REGQUERYMULTIPLEVALUE: DWORD = 0x13; |
| pub const EVENT_TRACE_TYPE_REGSETINFORMATION: DWORD = 0x14; |
| pub const EVENT_TRACE_TYPE_REGFLUSH: DWORD = 0x15; |
| pub const EVENT_TRACE_TYPE_REGKCBCREATE: DWORD = 0x16; |
| pub const EVENT_TRACE_TYPE_REGKCBDELETE: DWORD = 0x17; |
| pub const EVENT_TRACE_TYPE_REGKCBRUNDOWNBEGIN: DWORD = 0x18; |
| pub const EVENT_TRACE_TYPE_REGKCBRUNDOWNEND: DWORD = 0x19; |
| pub const EVENT_TRACE_TYPE_REGVIRTUALIZE: DWORD = 0x1A; |
| pub const EVENT_TRACE_TYPE_REGCLOSE: DWORD = 0x1B; |
| pub const EVENT_TRACE_TYPE_REGSETSECURITY: DWORD = 0x1C; |
| pub const EVENT_TRACE_TYPE_REGQUERYSECURITY: DWORD = 0x1D; |
| pub const EVENT_TRACE_TYPE_REGCOMMIT: DWORD = 0x1E; |
| pub const EVENT_TRACE_TYPE_REGPREPARE: DWORD = 0x1F; |
| pub const EVENT_TRACE_TYPE_REGROLLBACK: DWORD = 0x20; |
| pub const EVENT_TRACE_TYPE_REGMOUNTHIVE: DWORD = 0x21; |
| pub const EVENT_TRACE_TYPE_CONFIG_CPU: DWORD = 0x0A; |
| pub const EVENT_TRACE_TYPE_CONFIG_PHYSICALDISK: DWORD = 0x0B; |
| pub const EVENT_TRACE_TYPE_CONFIG_LOGICALDISK: DWORD = 0x0C; |
| pub const EVENT_TRACE_TYPE_CONFIG_NIC: DWORD = 0x0D; |
| pub const EVENT_TRACE_TYPE_CONFIG_VIDEO: DWORD = 0x0E; |
| pub const EVENT_TRACE_TYPE_CONFIG_SERVICES: DWORD = 0x0F; |
| pub const EVENT_TRACE_TYPE_CONFIG_POWER: DWORD = 0x10; |
| pub const EVENT_TRACE_TYPE_CONFIG_NETINFO: DWORD = 0x11; |
| pub const EVENT_TRACE_TYPE_CONFIG_OPTICALMEDIA: DWORD = 0x12; |
| pub const EVENT_TRACE_TYPE_CONFIG_IRQ: DWORD = 0x15; |
| pub const EVENT_TRACE_TYPE_CONFIG_PNP: DWORD = 0x16; |
| pub const EVENT_TRACE_TYPE_CONFIG_IDECHANNEL: DWORD = 0x17; |
| pub const EVENT_TRACE_TYPE_CONFIG_NUMANODE: DWORD = 0x18; |
| pub const EVENT_TRACE_TYPE_CONFIG_PLATFORM: DWORD = 0x19; |
| pub const EVENT_TRACE_TYPE_CONFIG_PROCESSORGROUP: DWORD = 0x1A; |
| pub const EVENT_TRACE_TYPE_CONFIG_PROCESSORNUMBER: DWORD = 0x1B; |
| pub const EVENT_TRACE_TYPE_CONFIG_DPI: DWORD = 0x1C; |
| pub const EVENT_TRACE_TYPE_CONFIG_CI_INFO: DWORD = 0x1D; |
| pub const EVENT_TRACE_TYPE_CONFIG_MACHINEID: DWORD = 0x1E; |
| pub const EVENT_TRACE_TYPE_CONFIG_DEFRAG: DWORD = 0x1F; |
| pub const EVENT_TRACE_TYPE_CONFIG_MOBILEPLATFORM: DWORD = 0x20; |
| pub const EVENT_TRACE_TYPE_CONFIG_DEVICEFAMILY: DWORD = 0x21; |
| pub const EVENT_TRACE_TYPE_CONFIG_FLIGHTID: DWORD = 0x22; |
| pub const EVENT_TRACE_TYPE_CONFIG_PROCESSOR: DWORD = 0x23; |
| pub const EVENT_TRACE_TYPE_OPTICAL_IO_READ: DWORD = 0x37; |
| pub const EVENT_TRACE_TYPE_OPTICAL_IO_WRITE: DWORD = 0x38; |
| pub const EVENT_TRACE_TYPE_OPTICAL_IO_FLUSH: DWORD = 0x39; |
| pub const EVENT_TRACE_TYPE_OPTICAL_IO_READ_INIT: DWORD = 0x3a; |
| pub const EVENT_TRACE_TYPE_OPTICAL_IO_WRITE_INIT: DWORD = 0x3b; |
| pub const EVENT_TRACE_TYPE_OPTICAL_IO_FLUSH_INIT: DWORD = 0x3c; |
| pub const EVENT_TRACE_TYPE_FLT_PREOP_INIT: DWORD = 0x60; |
| pub const EVENT_TRACE_TYPE_FLT_POSTOP_INIT: DWORD = 0x61; |
| pub const EVENT_TRACE_TYPE_FLT_PREOP_COMPLETION: DWORD = 0x62; |
| pub const EVENT_TRACE_TYPE_FLT_POSTOP_COMPLETION: DWORD = 0x63; |
| pub const EVENT_TRACE_TYPE_FLT_PREOP_FAILURE: DWORD = 0x64; |
| pub const EVENT_TRACE_TYPE_FLT_POSTOP_FAILURE: DWORD = 0x65; |
| pub const EVENT_TRACE_FLAG_PROCESS: DWORD = 0x00000001; |
| pub const EVENT_TRACE_FLAG_THREAD: DWORD = 0x00000002; |
| pub const EVENT_TRACE_FLAG_IMAGE_LOAD: DWORD = 0x00000004; |
| pub const EVENT_TRACE_FLAG_DISK_IO: DWORD = 0x00000100; |
| pub const EVENT_TRACE_FLAG_DISK_FILE_IO: DWORD = 0x00000200; |
| pub const EVENT_TRACE_FLAG_MEMORY_PAGE_FAULTS: DWORD = 0x00001000; |
| pub const EVENT_TRACE_FLAG_MEMORY_HARD_FAULTS: DWORD = 0x00002000; |
| pub const EVENT_TRACE_FLAG_NETWORK_TCPIP: DWORD = 0x00010000; |
| pub const EVENT_TRACE_FLAG_REGISTRY: DWORD = 0x00020000; |
| pub const EVENT_TRACE_FLAG_DBGPRINT: DWORD = 0x00040000; |
| pub const EVENT_TRACE_FLAG_PROCESS_COUNTERS: DWORD = 0x00000008; |
| pub const EVENT_TRACE_FLAG_CSWITCH: DWORD = 0x00000010; |
| pub const EVENT_TRACE_FLAG_DPC: DWORD = 0x00000020; |
| pub const EVENT_TRACE_FLAG_INTERRUPT: DWORD = 0x00000040; |
| pub const EVENT_TRACE_FLAG_SYSTEMCALL: DWORD = 0x00000080; |
| pub const EVENT_TRACE_FLAG_DISK_IO_INIT: DWORD = 0x00000400; |
| pub const EVENT_TRACE_FLAG_ALPC: DWORD = 0x00100000; |
| pub const EVENT_TRACE_FLAG_SPLIT_IO: DWORD = 0x00200000; |
| pub const EVENT_TRACE_FLAG_DRIVER: DWORD = 0x00800000; |
| pub const EVENT_TRACE_FLAG_PROFILE: DWORD = 0x01000000; |
| pub const EVENT_TRACE_FLAG_FILE_IO: DWORD = 0x02000000; |
| pub const EVENT_TRACE_FLAG_FILE_IO_INIT: DWORD = 0x04000000; |
| pub const EVENT_TRACE_FLAG_DISPATCHER: DWORD = 0x00000800; |
| pub const EVENT_TRACE_FLAG_VIRTUAL_ALLOC: DWORD = 0x00004000; |
| pub const EVENT_TRACE_FLAG_VAMAP: DWORD = 0x00008000; |
| pub const EVENT_TRACE_FLAG_NO_SYSCONFIG: DWORD = 0x10000000; |
| pub const EVENT_TRACE_FLAG_JOB: DWORD = 0x00080000; |
| pub const EVENT_TRACE_FLAG_DEBUG_EVENTS: DWORD = 0x00400000; |
| pub const EVENT_TRACE_FLAG_EXTENSION: DWORD = 0x80000000; |
| pub const EVENT_TRACE_FLAG_FORWARD_WMI: DWORD = 0x40000000; |
| pub const EVENT_TRACE_FLAG_ENABLE_RESERVE: DWORD = 0x20000000; |
| pub const EVENT_TRACE_FILE_MODE_NONE: DWORD = 0x00000000; |
| pub const EVENT_TRACE_FILE_MODE_SEQUENTIAL: DWORD = 0x00000001; |
| pub const EVENT_TRACE_FILE_MODE_CIRCULAR: DWORD = 0x00000002; |
| pub const EVENT_TRACE_FILE_MODE_APPEND: DWORD = 0x00000004; |
| pub const EVENT_TRACE_REAL_TIME_MODE: DWORD = 0x00000100; |
| pub const EVENT_TRACE_DELAY_OPEN_FILE_MODE: DWORD = 0x00000200; |
| pub const EVENT_TRACE_BUFFERING_MODE: DWORD = 0x00000400; |
| pub const EVENT_TRACE_PRIVATE_LOGGER_MODE: DWORD = 0x00000800; |
| pub const EVENT_TRACE_ADD_HEADER_MODE: DWORD = 0x00001000; |
| pub const EVENT_TRACE_USE_GLOBAL_SEQUENCE: DWORD = 0x00004000; |
| pub const EVENT_TRACE_USE_LOCAL_SEQUENCE: DWORD = 0x00008000; |
| pub const EVENT_TRACE_RELOG_MODE: DWORD = 0x00010000; |
| pub const EVENT_TRACE_USE_PAGED_MEMORY: DWORD = 0x01000000; |
| pub const EVENT_TRACE_FILE_MODE_NEWFILE: DWORD = 0x00000008; |
| pub const EVENT_TRACE_FILE_MODE_PREALLOCATE: DWORD = 0x00000020; |
| pub const EVENT_TRACE_NONSTOPPABLE_MODE: DWORD = 0x00000040; |
| pub const EVENT_TRACE_SECURE_MODE: DWORD = 0x00000080; |
| pub const EVENT_TRACE_USE_KBYTES_FOR_SIZE: DWORD = 0x00002000; |
| pub const EVENT_TRACE_PRIVATE_IN_PROC: DWORD = 0x00020000; |
| pub const EVENT_TRACE_MODE_RESERVED: DWORD = 0x00100000; |
| pub const EVENT_TRACE_NO_PER_PROCESSOR_BUFFERING: DWORD = 0x10000000; |
| pub const EVENT_TRACE_SYSTEM_LOGGER_MODE: DWORD = 0x02000000; |
| pub const EVENT_TRACE_ADDTO_TRIAGE_DUMP: DWORD = 0x80000000; |
| pub const EVENT_TRACE_STOP_ON_HYBRID_SHUTDOWN: DWORD = 0x00400000; |
| pub const EVENT_TRACE_PERSIST_ON_HYBRID_SHUTDOWN: DWORD = 0x00800000; |
| pub const EVENT_TRACE_INDEPENDENT_SESSION_MODE: DWORD = 0x08000000; |
| pub const EVENT_TRACE_COMPRESSED_MODE: DWORD = 0x04000000; |
| pub const EVENT_TRACE_CONTROL_QUERY: DWORD = 0; |
| pub const EVENT_TRACE_CONTROL_STOP: DWORD = 1; |
| pub const EVENT_TRACE_CONTROL_UPDATE: DWORD = 2; |
| pub const EVENT_TRACE_CONTROL_FLUSH: DWORD = 3; |
| pub const TRACE_MESSAGE_SEQUENCE: DWORD = 1; |
| pub const TRACE_MESSAGE_GUID: DWORD = 2; |
| pub const TRACE_MESSAGE_COMPONENTID: DWORD = 4; |
| pub const TRACE_MESSAGE_TIMESTAMP: DWORD = 8; |
| pub const TRACE_MESSAGE_PERFORMANCE_TIMESTAMP: DWORD = 16; |
| pub const TRACE_MESSAGE_SYSTEMINFO: DWORD = 32; |
| pub const TRACE_MESSAGE_POINTER32: DWORD = 0x0040; |
| pub const TRACE_MESSAGE_POINTER64: DWORD = 0x0080; |
| pub const TRACE_MESSAGE_FLAG_MASK: DWORD = 0xFFFF; |
| pub const TRACE_MESSAGE_MAXIMUM_SIZE: SIZE_T = 64 * 1024; |
| pub const EVENT_TRACE_USE_PROCTIME: DWORD = 0x0001; |
| pub const EVENT_TRACE_USE_NOCPUTIME: DWORD = 0x0002; |
| pub const TRACE_HEADER_FLAG_USE_TIMESTAMP: DWORD = 0x00000200; |
| pub const TRACE_HEADER_FLAG_TRACED_GUID: DWORD = 0x00020000; |
| pub const TRACE_HEADER_FLAG_LOG_WNODE: DWORD = 0x00040000; |
| pub const TRACE_HEADER_FLAG_USE_GUID_PTR: DWORD = 0x00080000; |
| pub const TRACE_HEADER_FLAG_USE_MOF_PTR: DWORD = 0x00100000; |
| ENUM!{enum ETW_COMPRESSION_RESUMPTION_MODE { |
| EtwCompressionModeRestart = 0, |
| EtwCompressionModeNoDisable = 1, |
| EtwCompressionModeNoRestart = 2, |
| }} |
| STRUCT!{struct EVENT_TRACE_HEADER_u1_s { |
| HeaderType: UCHAR, |
| MarkerFlags: UCHAR, |
| }} |
| UNION!{union EVENT_TRACE_HEADER_u1 { |
| [u16; 1], |
| FieldTypeFlags FieldTypeFlags_mut: USHORT, |
| s s_mut: EVENT_TRACE_HEADER_u1_s, |
| }} |
| STRUCT!{struct EVENT_TRACE_HEADER_u2_CLASS { |
| Type: UCHAR, |
| Level: UCHAR, |
| Version: USHORT, |
| }} |
| UNION!{union EVENT_TRACE_HEADER_u2 { |
| [u32; 1], |
| Version Version_mut: ULONG, |
| Class Class_mut: EVENT_TRACE_HEADER_u2_CLASS, |
| }} |
| UNION!{union EVENT_TRACE_HEADER_u3 { |
| [u64; 2], |
| Guid Guid_mut: GUID, |
| GuidPtr GuidPtr_mut: ULONGLONG, |
| }} |
| STRUCT!{struct EVENT_TRACE_HEADER_u4_s1 { |
| ClientContext: ULONG, |
| Flags: ULONG, |
| }} |
| STRUCT!{struct EVENT_TRACE_HEADER_u4_s2 { |
| KernelTime: ULONG, |
| UserTime: ULONG, |
| }} |
| UNION!{union EVENT_TRACE_HEADER_u4 { |
| [u64; 1], |
| s1 s1_mut: EVENT_TRACE_HEADER_u4_s1, |
| s2 s2_mut: EVENT_TRACE_HEADER_u4_s2, |
| ProcessorTime ProcessorTime_mut: ULONG64, |
| }} |
| STRUCT!{struct EVENT_TRACE_HEADER { |
| Size: USHORT, |
| u1: EVENT_TRACE_HEADER_u1, |
| u2: EVENT_TRACE_HEADER_u2, |
| ThreadId: ULONG, |
| ProcessId: ULONG, |
| TimeStamp: LARGE_INTEGER, |
| u3: EVENT_TRACE_HEADER_u3, |
| u4: EVENT_TRACE_HEADER_u4, |
| }} |
| pub type PEVENT_TRACE_HEADER = *mut EVENT_TRACE_HEADER; |
| STRUCT!{struct EVENT_INSTANCE_HEADER_u1_s { |
| HeaderType: UCHAR, |
| MarkerFlags: UCHAR, |
| }} |
| UNION!{union EVENT_INSTANCE_HEADER_u1 { |
| [u16; 1], |
| FieldTypeFlags FieldTypeFlags_mut: USHORT, |
| s s_mut: EVENT_INSTANCE_HEADER_u1_s, |
| }} |
| STRUCT!{struct EVENT_INSTANCE_HEADER_u2_CLASS { |
| Type: UCHAR, |
| Level: UCHAR, |
| Version: USHORT, |
| }} |
| UNION!{union EVENT_INSTANCE_HEADER_u2 { |
| [u32; 1], |
| Version Version_mut: ULONG, |
| Class Class_mut: EVENT_INSTANCE_HEADER_u2_CLASS, |
| }} |
| STRUCT!{struct EVENT_INSTANCE_HEADER_u3_s1 { |
| KernelTime: ULONG, |
| UserTime: ULONG, |
| }} |
| STRUCT!{struct EVENT_INSTANCE_HEADER_u3_s2 { |
| EventId: ULONG, |
| Flags: ULONG, |
| }} |
| UNION!{union EVENT_INSTANCE_HEADER_u3 { |
| [u64; 1], |
| s1 s1_mut: EVENT_INSTANCE_HEADER_u3_s1, |
| ProcessorTime ProcessorTime_mut: ULONG64, |
| s2 s2_mut: EVENT_INSTANCE_HEADER_u3_s2, |
| }} |
| STRUCT!{struct EVENT_INSTANCE_HEADER { |
| Size: USHORT, |
| u1: EVENT_INSTANCE_HEADER_u1, |
| u2: EVENT_INSTANCE_HEADER_u2, |
| ThreadId: ULONG, |
| ProcessId: ULONG, |
| TimeStamp: LARGE_INTEGER, |
| RegHandle: ULONGLONG, |
| InstanceId: ULONG, |
| ParentInstanceId: ULONG, |
| u3: EVENT_INSTANCE_HEADER_u3, |
| ParentRegHandle: ULONGLONG, |
| }} |
| pub type PEVENT_INSTANCE_HEADER = *mut EVENT_INSTANCE_HEADER; |
| pub const ETW_NULL_TYPE_VALUE: ULONG = 0; |
| pub const ETW_OBJECT_TYPE_VALUE: ULONG = 1; |
| pub const ETW_STRING_TYPE_VALUE: ULONG = 2; |
| pub const ETW_SBYTE_TYPE_VALUE: ULONG = 3; |
| pub const ETW_BYTE_TYPE_VALUE: ULONG = 4; |
| pub const ETW_INT16_TYPE_VALUE: ULONG = 5; |
| pub const ETW_UINT16_TYPE_VALUE: ULONG = 6; |
| pub const ETW_INT32_TYPE_VALUE: ULONG = 7; |
| pub const ETW_UINT32_TYPE_VALUE: ULONG = 8; |
| pub const ETW_INT64_TYPE_VALUE: ULONG = 9; |
| pub const ETW_UINT64_TYPE_VALUE: ULONG = 10; |
| pub const ETW_CHAR_TYPE_VALUE: ULONG = 11; |
| pub const ETW_SINGLE_TYPE_VALUE: ULONG = 12; |
| pub const ETW_DOUBLE_TYPE_VALUE: ULONG = 13; |
| pub const ETW_BOOLEAN_TYPE_VALUE: ULONG = 14; |
| pub const ETW_DECIMAL_TYPE_VALUE: ULONG = 15; |
| pub const ETW_GUID_TYPE_VALUE: ULONG = 101; |
| pub const ETW_ASCIICHAR_TYPE_VALUE: ULONG = 102; |
| pub const ETW_ASCIISTRING_TYPE_VALUE: ULONG = 103; |
| pub const ETW_COUNTED_STRING_TYPE_VALUE: ULONG = 104; |
| pub const ETW_POINTER_TYPE_VALUE: ULONG = 105; |
| pub const ETW_SIZET_TYPE_VALUE: ULONG = 106; |
| pub const ETW_HIDDEN_TYPE_VALUE: ULONG = 107; |
| pub const ETW_BOOL_TYPE_VALUE: ULONG = 108; |
| pub const ETW_COUNTED_ANSISTRING_TYPE_VALUE: ULONG = 109; |
| pub const ETW_REVERSED_COUNTED_STRING_TYPE_VALUE: ULONG = 110; |
| pub const ETW_REVERSED_COUNTED_ANSISTRING_TYPE_VALUE: ULONG = 111; |
| pub const ETW_NON_NULL_TERMINATED_STRING_TYPE_VALUE: ULONG = 112; |
| pub const ETW_REDUCED_ANSISTRING_TYPE_VALUE: ULONG = 113; |
| pub const ETW_REDUCED_STRING_TYPE_VALUE: ULONG = 114; |
| pub const ETW_SID_TYPE_VALUE: ULONG = 115; |
| pub const ETW_VARIANT_TYPE_VALUE: ULONG = 116; |
| pub const ETW_PTVECTOR_TYPE_VALUE: ULONG = 117; |
| pub const ETW_WMITIME_TYPE_VALUE: ULONG = 118; |
| pub const ETW_DATETIME_TYPE_VALUE: ULONG = 119; |
| pub const ETW_REFRENCE_TYPE_VALUE: ULONG = 120; |
| // TODO: DEFINE_TRACE_MOF_FIELD |
| STRUCT!{struct MOF_FIELD{ |
| DataPtr: ULONG64, |
| Length: ULONG, |
| DataType: ULONG, |
| }} |
| pub type PMOF_FIELD = *mut MOF_FIELD; |
| STRUCT!{struct TRACE_LOGFILE_HEADER_u1_VERSIONDETAIL { |
| MajorVersion: UCHAR, |
| MinorVersion: UCHAR, |
| SubVersion: UCHAR, |
| SubMinorVersion: UCHAR, |
| }} |
| UNION!{union TRACE_LOGFILE_HEADER_u1 { |
| [u32; 1], |
| Version Version_mut: ULONG, |
| VersionDetail VersionDetail_mut: TRACE_LOGFILE_HEADER_u1_VERSIONDETAIL, |
| }} |
| STRUCT!{struct TRACE_LOGFILE_HEADER_u2_s { |
| StartBuffers: ULONG, |
| PointerSize: ULONG, |
| EventsLost: ULONG, |
| CpuSpeedInMHz: ULONG, |
| }} |
| UNION!{union TRACE_LOGFILE_HEADER_u2 { |
| [u32; 4], |
| LogInstanceGuid LogInstanceGuid_mut: GUID, |
| s s_mut: TRACE_LOGFILE_HEADER_u2_s, |
| }} |
| STRUCT!{struct TRACE_LOGFILE_HEADER { |
| BufferSize: ULONG, |
| u1: TRACE_LOGFILE_HEADER_u1, |
| ProviderVersion: ULONG, |
| NumberOfProcessors: ULONG, |
| EndTime: LARGE_INTEGER, |
| TimerResolution: ULONG, |
| MaximumFileSize: ULONG, |
| LogFileMode: ULONG, |
| BuffersWritten: ULONG, |
| u2: TRACE_LOGFILE_HEADER_u2, |
| LoggerName: LPWSTR, |
| LogFileName: LPWSTR, |
| TimeZone: TIME_ZONE_INFORMATION, |
| BootTime: LARGE_INTEGER, |
| PrefFreq: LARGE_INTEGER, |
| StartTime: LARGE_INTEGER, |
| ReservedFlags: ULONG, |
| BuffersLost: ULONG, |
| }} |
| pub type PTRACE_LOGFILE_HEADER = *mut TRACE_LOGFILE_HEADER; |
| STRUCT!{struct TRACE_LOGFILE_HEADER32 { |
| BufferSize: ULONG, |
| u1: TRACE_LOGFILE_HEADER_u1, |
| ProviderVersion: ULONG, |
| NumberOfProcessors: ULONG, |
| EndTime: LARGE_INTEGER, |
| TimerResolution: ULONG, |
| MaximumFileSize: ULONG, |
| LogFileMode: ULONG, |
| BuffersWritten: ULONG, |
| u2: TRACE_LOGFILE_HEADER_u2, |
| LoggerName: ULONG32, |
| LogFileName: ULONG32, |
| TimeZone: TIME_ZONE_INFORMATION, |
| BootTime: LARGE_INTEGER, |
| PrefFreq: LARGE_INTEGER, |
| StartTime: LARGE_INTEGER, |
| ReservedFlags: ULONG, |
| BuffersLost: ULONG, |
| }} |
| pub type PTRACE_LOGFILE_HEADER32 = *mut TRACE_LOGFILE_HEADER32; |
| STRUCT!{struct TRACE_LOGFILE_HEADER64 { |
| BufferSize: ULONG, |
| u1: TRACE_LOGFILE_HEADER_u1, |
| ProviderVersion: ULONG, |
| NumberOfProcessors: ULONG, |
| EndTime: LARGE_INTEGER, |
| TimerResolution: ULONG, |
| MaximumFileSize: ULONG, |
| LogFileMode: ULONG, |
| BuffersWritten: ULONG, |
| u2: TRACE_LOGFILE_HEADER_u2, |
| LoggerName: ULONG64, |
| LogFileName: ULONG64, |
| TimeZone: TIME_ZONE_INFORMATION, |
| BootTime: LARGE_INTEGER, |
| PrefFreq: LARGE_INTEGER, |
| StartTime: LARGE_INTEGER, |
| ReservedFlags: ULONG, |
| BuffersLost: ULONG, |
| }} |
| pub type PTRACE_LOGFILE_HEADER64 = *mut TRACE_LOGFILE_HEADER64; |
| STRUCT!{struct EVENT_INSTANCE_INFO { |
| RegHandle: HANDLE, |
| InstanceId: ULONG, |
| }} |
| pub type PEVENT_INSTANCE_INFO = *mut EVENT_INSTANCE_INFO; |
| UNION!{union EVENT_TRACE_PROPERTIES_u { |
| [u32; 1], |
| AgeLimit AgeLimit_mut: LONG, |
| FlushThreshold FlushThreshold_mut: LONG, |
| }} |
| STRUCT!{struct EVENT_TRACE_PROPERTIES { |
| Wnode: WNODE_HEADER, |
| BufferSize: ULONG, |
| MinimumBuffers: ULONG, |
| MaximumBuffers: ULONG, |
| MaximumFileSize: ULONG, |
| LogFileMode: ULONG, |
| FlushTimer: ULONG, |
| EnableFlags: ULONG, |
| u: EVENT_TRACE_PROPERTIES_u, |
| NumberOfBuffers: ULONG, |
| FreeBuffers: ULONG, |
| EventsLost: ULONG, |
| BuffersWritten: ULONG, |
| LogBuffersLost: ULONG, |
| RealTimeBuffersLost: ULONG, |
| LoggerThreadId: HANDLE, |
| LogFileNameOffset: ULONG, |
| LoggerNameOffset: ULONG, |
| }} |
| pub type PEVENT_TRACE_PROPERTIES = *mut EVENT_TRACE_PROPERTIES; |
| UNION!{union EVENT_TRACE_PROPERTIES_V2_u1 { |
| [u32; 1], |
| AgeLimit AgeLimit_mut: LONG, |
| FlushThreshold FlushThreshold_mut: LONG, |
| }} |
| STRUCT!{struct EVENT_TRACE_PROPERTIES_V2_u2_s { |
| bitfield: ULONG, |
| }} |
| BITFIELD!{EVENT_TRACE_PROPERTIES_V2_u2_s bitfield: ULONG [ |
| VersionNumber set_VersionNumber[0..8], |
| ]} |
| UNION!{union EVENT_TRACE_PROPERTIES_V2_u2 { |
| [u32; 1], |
| s s_mut: EVENT_TRACE_PROPERTIES_V2_u2_s, |
| V2Control V2Control_mut: ULONG, |
| }} |
| STRUCT!{struct EVENT_TRACE_PROPERTIES_V2_u3_s { |
| bitfield: ULONG, |
| }} |
| BITFIELD!{EVENT_TRACE_PROPERTIES_V2_u3_s bitfield: ULONG [ |
| Wow set_Wow[0..1], |
| ]} |
| UNION!{union EVENT_TRACE_PROPERTIES_V2_u3 { |
| [u64; 1], |
| s s_mut: EVENT_TRACE_PROPERTIES_V2_u3_s, |
| V2Options V2Options_mut: ULONG64, |
| }} |
| STRUCT!{struct EVENT_TRACE_PROPERTIES_V2 { |
| Wnode: WNODE_HEADER, |
| BufferSize: ULONG, |
| MinimumBuffers: ULONG, |
| MaximumBuffers: ULONG, |
| MaximumFileSize: ULONG, |
| LogFileMode: ULONG, |
| FlushTimer: ULONG, |
| EnableFlags: ULONG, |
| u1: EVENT_TRACE_PROPERTIES_u, |
| NumberOfBuffers: ULONG, |
| FreeBuffers: ULONG, |
| EventsLost: ULONG, |
| BuffersWritten: ULONG, |
| LogBuffersLost: ULONG, |
| RealTimeBuffersLost: ULONG, |
| LoggerThreadId: HANDLE, |
| LogFileNameOffset: ULONG, |
| LoggerNameOffset: ULONG, |
| u2: EVENT_TRACE_PROPERTIES_V2_u2, |
| FilterDescCount: ULONG, |
| FilterDesc: PEVENT_FILTER_DESCRIPTOR, |
| u3: EVENT_TRACE_PROPERTIES_V2_u3, |
| }} |
| pub type PEVENT_TRACE_PROPERTIES_V2 = *mut EVENT_TRACE_PROPERTIES_V2; |
| STRUCT!{struct TRACE_GUID_REGISTRATION { |
| Guid: LPCGUID, |
| RegHandle: HANDLE, |
| }} |
| pub type PTRACE_GUID_REGISTRATION = *mut TRACE_GUID_REGISTRATION; |
| STRUCT!{struct TRACE_GUID_PROPERTIES { |
| Guid: GUID, |
| GuidType: ULONG, |
| LoggerId: ULONG, |
| EnableLevel: ULONG, |
| EnableFlags: ULONG, |
| IsEnable: BOOLEAN, |
| }} |
| pub type PTRACE_GUID_PROPERTIES = *mut TRACE_GUID_PROPERTIES; |
| STRUCT!{struct ETW_BUFFER_CONTEXT_u_s { |
| ProcessorNumber: UCHAR, |
| Alignment: UCHAR, |
| }} |
| UNION!{union ETW_BUFFER_CONTEXT_u { |
| [u16; 1], |
| s s_mut: ETW_BUFFER_CONTEXT_u_s, |
| ProcessorIndex ProcessorIndex_mut: USHORT, |
| }} |
| STRUCT!{struct ETW_BUFFER_CONTEXT { |
| u: ETW_BUFFER_CONTEXT_u, |
| LoggerId: USHORT, |
| }} |
| pub type PETW_BUFFER_CONTEXT = *mut ETW_BUFFER_CONTEXT; |
| pub const TRACE_PROVIDER_FLAG_LEGACY: ULONG = 0x00000001; |
| pub const TRACE_PROVIDER_FLAG_PRE_ENABLE: ULONG = 0x00000002; |
| STRUCT!{struct TRACE_ENABLE_INFO { |
| IsEnabled: ULONG, |
| Level: UCHAR, |
| Reserved1: UCHAR, |
| LoggerId: USHORT, |
| EnabledProperty: ULONG, |
| Reserved2: ULONG, |
| MatchAnyKeyword: ULONGLONG, |
| MatchAllKeyword: ULONGLONG, |
| }} |
| pub type PTRACE_ENABLE_INFO = *mut TRACE_ENABLE_INFO; |
| STRUCT!{struct TRACE_PROVIDER_INSTANCE_INFO { |
| NameOffset: ULONG, |
| EnableCount: ULONG, |
| Pid: ULONG, |
| Flags: ULONG, |
| }} |
| pub type PTRACE_PROVIDER_INSTANCE_INFO = *mut TRACE_PROVIDER_INSTANCE_INFO; |
| STRUCT!{struct TRACE_GUID_INFO { |
| InstanceCount: ULONG, |
| Reserved: ULONG, |
| }} |
| pub type PTRACE_GUID_INFO = *mut TRACE_GUID_INFO; |
| STRUCT!{struct PROFILE_SOURCE_INFO { |
| NextEntryOffset: ULONG, |
| Source: ULONG, |
| MinInterval: ULONG, |
| MaxInterval: ULONG, |
| Reserved: ULONG64, |
| Description: [WCHAR; ANYSIZE_ARRAY], |
| }} |
| pub type PPROFILE_SOURCE_INFO = *mut PROFILE_SOURCE_INFO; |
| UNION!{union EVENT_TRACE_u { |
| [u32; 1], |
| ClientContext ClientContext_mut: ULONG, |
| BufferContext BufferContext_mut: ETW_BUFFER_CONTEXT, |
| }} |
| STRUCT!{struct EVENT_TRACE { |
| Header: EVENT_TRACE_HEADER, |
| InstanceId: ULONG, |
| ParentInstanceId: ULONG, |
| ParentGuid: GUID, |
| MofData: PVOID, |
| MofLength: ULONG, |
| u: EVENT_TRACE_u, |
| }} |
| pub type PEVENT_TRACE = *mut EVENT_TRACE; |
| pub const EVENT_CONTROL_CODE_DISABLE_PROVIDER: ULONG = 0; |
| pub const EVENT_CONTROL_CODE_ENABLE_PROVIDER: ULONG = 1; |
| pub const EVENT_CONTROL_CODE_CAPTURE_STATE: ULONG = 2; |
| FN!{stdcall PEVENT_TRACE_BUFFER_CALLBACKW( |
| PEVENT_TRACE_LOGFILEW, |
| ) -> ULONG} |
| FN!{stdcall PEVENT_TRACE_BUFFER_CALLBACKA( |
| PEVENT_TRACE_LOGFILEA, |
| ) -> ULONG} |
| FN!{stdcall PEVENT_CALLBACK( |
| pEvent: PEVENT_TRACE, |
| ) -> ()} |
| FN!{stdcall PEVENT_RECORD_CALLBACK( |
| EventRecord: PEVENT_RECORD, |
| ) -> ()} |
| FN!{stdcall WMIDPREQUEST( |
| RequestCode: WMIDPREQUESTCODE, |
| RequestContext: PVOID, |
| BufferSize: *mut ULONG, |
| Buffer: PVOID, |
| ) -> ULONG} |
| UNION!{union EVENT_TRACE_LOGFILE_u1 { |
| [u32; 1], |
| LogFileMode LogFileMode_mut: ULONG, |
| ProcessTraceMode ProcessTraceMode_mut: ULONG, |
| }} |
| UNION!{union EVENT_TRACE_LOGFILE_u2 { |
| [u32; 1] [u64; 1], |
| EventCallback EventCallback_mut: PEVENT_CALLBACK, |
| EventRecordCallback EventRecordCallback_mut: PEVENT_RECORD_CALLBACK, |
| }} |
| STRUCT!{struct EVENT_TRACE_LOGFILEW { |
| LogFileName: LPWSTR, |
| LoggerName: LPWSTR, |
| CurrentTime: LONGLONG, |
| BuffersRead: ULONG, |
| u1: EVENT_TRACE_LOGFILE_u1, |
| CurrentEvent: EVENT_TRACE, |
| LogfileHeader: TRACE_LOGFILE_HEADER, |
| BufferCallback: PEVENT_TRACE_BUFFER_CALLBACKW, |
| BufferSize: ULONG, |
| Filled: ULONG, |
| EventsLost: ULONG, |
| u2: EVENT_TRACE_LOGFILE_u2, |
| IsKernelTrace: ULONG, |
| Context: PVOID, |
| }} |
| pub type PEVENT_TRACE_LOGFILEW = *mut EVENT_TRACE_LOGFILEW; |
| STRUCT!{struct EVENT_TRACE_LOGFILEA { |
| LogFileName: LPSTR, |
| LoggerName: LPSTR, |
| CurrentTime: LONGLONG, |
| BuffersRead: ULONG, |
| u1: EVENT_TRACE_LOGFILE_u1, |
| CurrentEvent: EVENT_TRACE, |
| LogfileHeader: TRACE_LOGFILE_HEADER, |
| BufferCallback: PEVENT_TRACE_BUFFER_CALLBACKA, |
| BufferSize: ULONG, |
| Filled: ULONG, |
| EventsLost: ULONG, |
| u2: EVENT_TRACE_LOGFILE_u2, |
| IsKernelTrace: ULONG, |
| Context: PVOID, |
| }} |
| pub type PEVENT_TRACE_LOGFILEA = *mut EVENT_TRACE_LOGFILEA; |
| extern "system" { |
| pub fn StartTraceW( |
| SessionHandle: PTRACEHANDLE, |
| SessionName: LPCWSTR, |
| Properties: PEVENT_TRACE_PROPERTIES, |
| ) -> ULONG; |
| pub fn StartTraceA( |
| SessionHandle: PTRACEHANDLE, |
| SessionName: LPCSTR, |
| Properties: PEVENT_TRACE_PROPERTIES, |
| ) -> ULONG; |
| pub fn StopTraceW( |
| SessionHandle: TRACEHANDLE, |
| SessionName: LPCWSTR, |
| Properties: PEVENT_TRACE_PROPERTIES, |
| ) -> ULONG; |
| pub fn StopTraceA( |
| SessionHandle: TRACEHANDLE, |
| SessionName: LPCSTR, |
| Properties: PEVENT_TRACE_PROPERTIES, |
| ) -> ULONG; |
| pub fn QueryTraceW( |
| SessionHandle: TRACEHANDLE, |
| SessionName: LPCWSTR, |
| Properties: PEVENT_TRACE_PROPERTIES, |
| ) -> ULONG; |
| pub fn QueryTraceA( |
| SessionHandle: TRACEHANDLE, |
| SessionName: LPCSTR, |
| Properties: PEVENT_TRACE_PROPERTIES, |
| ) -> ULONG; |
| pub fn UpdateTraceW( |
| SessionHandle: TRACEHANDLE, |
| SessionName: LPCWSTR, |
| Properties: PEVENT_TRACE_PROPERTIES, |
| ) -> ULONG; |
| pub fn UpdateTraceA( |
| SessionHandle: TRACEHANDLE, |
| SessionName: LPCSTR, |
| Properties: PEVENT_TRACE_PROPERTIES, |
| ) -> ULONG; |
| pub fn FlushTraceW( |
| SessionHandle: TRACEHANDLE, |
| SessionName: LPCWSTR, |
| Properties: PEVENT_TRACE_PROPERTIES, |
| ) -> ULONG; |
| pub fn FlushTraceA( |
| SessionHandle: TRACEHANDLE, |
| SessionName: LPCSTR, |
| Properties: PEVENT_TRACE_PROPERTIES, |
| ) -> ULONG; |
| pub fn ControlTraceW( |
| SessionHandle: TRACEHANDLE, |
| SessionName: LPCWSTR, |
| Properties: PEVENT_TRACE_PROPERTIES, |
| ControlCode: ULONG, |
| ) -> ULONG; |
| pub fn ControlTraceA( |
| SessionHandle: TRACEHANDLE, |
| SessionName: LPCSTR, |
| Properties: PEVENT_TRACE_PROPERTIES, |
| ControlCode: ULONG, |
| ) -> ULONG; |
| pub fn QueryAllTracesW( |
| PropertyArray: *mut PEVENT_TRACE_PROPERTIES, |
| PropertyArrayCount: ULONG, |
| SessionCount: PULONG, |
| ) -> ULONG; |
| pub fn QueryAllTracesA( |
| PropertyArray: *mut PEVENT_TRACE_PROPERTIES, |
| PropertyArrayCount: ULONG, |
| SessionCount: PULONG, |
| ) -> ULONG; |
| pub fn EnableTrace( |
| Enable: ULONG, |
| EnableFlag: ULONG, |
| EnableLevel: ULONG, |
| ControlGuid: LPCGUID, |
| SessionHandle: TRACEHANDLE, |
| ) -> ULONG; |
| pub fn EnableTraceEx( |
| ProviderId: LPCGUID, |
| SourceId: LPCGUID, |
| TraceHandle: TRACEHANDLE, |
| IsEnabled: ULONG, |
| Level: UCHAR, |
| MatchAnyKeyword: ULONGLONG, |
| MatchAllKeyword: ULONGLONG, |
| EnableProperty: ULONG, |
| EnableFilterDesc: PEVENT_FILTER_DESCRIPTOR, |
| ) -> ULONG; |
| } |
| pub const ENABLE_TRACE_PARAMETERS_VERSION: ULONG = 1; |
| pub const ENABLE_TRACE_PARAMETERS_VERSION_2: ULONG = 2; |
| STRUCT!{struct ENABLE_TRACE_PARAMETERS_V1 { |
| Version: ULONG, |
| EnableProperty: ULONG, |
| ControlFlags: ULONG, |
| SourceId: GUID, |
| EnableFilterDesc: PEVENT_FILTER_DESCRIPTOR, |
| }} |
| pub type PENABLE_TRACE_PARAMETERS_V1 = *mut ENABLE_TRACE_PARAMETERS_V1; |
| STRUCT!{struct ENABLE_TRACE_PARAMETERS { |
| Version: ULONG, |
| EnableProperty: ULONG, |
| ControlFlags: ULONG, |
| SourceId: GUID, |
| EnableFilterDesc: PEVENT_FILTER_DESCRIPTOR, |
| FilterDescCount: ULONG, |
| }} |
| pub type PENABLE_TRACE_PARAMETERS = *mut ENABLE_TRACE_PARAMETERS; |
| extern "system" { |
| pub fn EnableTraceEx2( |
| TraceHandle: TRACEHANDLE, |
| ProviderId: LPCGUID, |
| ControlCode: ULONG, |
| Level: UCHAR, |
| MatchAnyKeyword: ULONGLONG, |
| MatchAllKeyword: ULONGLONG, |
| Timeout: ULONG, |
| EnableParameters: PENABLE_TRACE_PARAMETERS, |
| ) -> ULONG; |
| } |
| ENUM!{enum TRACE_QUERY_INFO_CLASS { |
| TraceGuidQueryList, |
| TraceGuidQueryInfo, |
| TraceGuidQueryProcess, |
| TraceStackTracingInfo, |
| TraceSystemTraceEnableFlagsInfo, |
| TraceSampledProfileIntervalInfo, |
| TraceProfileSourceConfigInfo, |
| TraceProfileSourceListInfo, |
| TracePmcEventListInfo, |
| TracePmcCounterListInfo, |
| TraceSetDisallowList, |
| TraceVersionInfo, |
| TraceGroupQueryList, |
| TraceGroupQueryInfo, |
| TraceDisallowListQuery, |
| TraceCompressionInfo, |
| TracePeriodicCaptureStateListInfo, |
| TracePeriodicCaptureStateInfo, |
| TraceProviderBinaryTracking, |
| TraceMaxLoggersQuery, |
| MaxTraceSetInfoClass, |
| }} |
| pub type TRACE_INFO_CLASS = TRACE_QUERY_INFO_CLASS; |
| extern "system" { |
| pub fn EnumerateTraceGuidsEx( |
| TraceQueryInfoClass: TRACE_QUERY_INFO_CLASS, |
| InBuffer: PVOID, |
| InBufferSize: ULONG, |
| OutBuffer: PVOID, |
| OutBufferSize: ULONG, |
| ReturnLength: PULONG, |
| ) -> ULONG; |
| } |
| STRUCT!{struct CLASSIC_EVENT_ID { |
| EventGuid: GUID, |
| Type: UCHAR, |
| Reserved: [UCHAR; 7], |
| }} |
| pub type PCLASSIC_EVENT_ID = *mut CLASSIC_EVENT_ID; |
| STRUCT!{struct TRACE_PROFILE_INTERVAL { |
| Source: ULONG, |
| Interval: ULONG, |
| }} |
| pub type PTRACE_PROFILE_INTERVAL = *mut TRACE_PROFILE_INTERVAL; |
| STRUCT!{struct TRACE_VERSION_INFO { |
| EtwTraceProcessingVersion: UINT, |
| Reserved: UINT, |
| }} |
| pub type PTRACE_VERSION_INFO = *mut TRACE_VERSION_INFO; |
| STRUCT!{struct TRACE_PERIODIC_CAPTURE_STATE_INFO { |
| CaptureStateFrequencyInSeconds: ULONG, |
| ProviderCount: USHORT, |
| Reserved: USHORT, |
| }} |
| pub type PTRACE_PERIODIC_CAPTURE_STATE_INFO = *mut TRACE_PERIODIC_CAPTURE_STATE_INFO; |
| extern "system" { |
| pub fn TraceSetInformation( |
| SessionHandle: TRACEHANDLE, |
| InformationClass: TRACE_INFO_CLASS, |
| TraceInformation: PVOID, |
| InformationLength: ULONG, |
| ) -> ULONG; |
| pub fn TraceQueryInformation( |
| SessionHandle: TRACEHANDLE, |
| InformationClass: TRACE_QUERY_INFO_CLASS, |
| TraceInformation: PVOID, |
| InformationLength: ULONG, |
| ReturnLength: PULONG, |
| ) -> ULONG; |
| pub fn CreateTraceInstanceId( |
| RegHandle: HANDLE, |
| pInstInfo: PEVENT_INSTANCE_INFO, |
| ) -> ULONG; |
| pub fn TraceEvent( |
| SessionHandle: TRACEHANDLE, |
| EventTrace: PEVENT_TRACE_HEADER, |
| ) -> ULONG; |
| pub fn TraceEventInstance( |
| SessionHandle: TRACEHANDLE, |
| EventTrace: PEVENT_TRACE_HEADER, |
| pInstInfo: PEVENT_INSTANCE_INFO, |
| pParentInstInfo: PEVENT_INSTANCE_INFO, |
| ) -> ULONG; |
| pub fn RegisterTraceGuidsW( |
| RequestAddress: WMIDPREQUEST, |
| RequestContext: PVOID, |
| ControlGuid: LPCGUID, |
| GuidCount: ULONG, |
| TraceGuidReg: PTRACE_GUID_REGISTRATION, |
| MofImagePath: LPCWSTR, |
| MofResourceName: LPCWSTR, |
| RegistrationHandle: PTRACEHANDLE, |
| ) -> ULONG; |
| pub fn RegisterTraceGuidsA( |
| RequestAddress: WMIDPREQUEST, |
| RequestContext: PVOID, |
| ControlGuid: LPCGUID, |
| GuidCount: ULONG, |
| TraceGuidReg: PTRACE_GUID_REGISTRATION, |
| MofImagePath: LPCSTR, |
| MofResourceName: LPCSTR, |
| RegistrationHandle: PTRACEHANDLE, |
| ) -> ULONG; |
| pub fn EnumerateTraceGuids( |
| GuidPropertiesArray: *mut PTRACE_GUID_PROPERTIES, |
| PropertyArrayCount: ULONG, |
| GuidCount: PULONG, |
| ) -> ULONG; |
| pub fn UnregisterTraceGuids( |
| RegistrationHandle: TRACEHANDLE, |
| ) -> ULONG; |
| pub fn GetTraceLoggerHandle( |
| Buffer: PVOID, |
| ) -> TRACEHANDLE; |
| pub fn GetTraceEnableLevel( |
| SessionHandle: TRACEHANDLE, |
| ) -> UCHAR; |
| pub fn GetTraceEnableFlags( |
| SessionHandle: TRACEHANDLE, |
| ) -> ULONG; |
| pub fn OpenTraceW( |
| Logfile: PEVENT_TRACE_LOGFILEW, |
| ) -> TRACEHANDLE; |
| pub fn ProcessTrace( |
| HandleArray: PTRACEHANDLE, |
| HandleCount: ULONG, |
| StartTime: LPFILETIME, |
| EndTime: LPFILETIME, |
| ) -> ULONG; |
| pub fn CloseTrace( |
| TraceHandle: TRACEHANDLE, |
| ) -> ULONG; |
| } |
| ENUM!{enum ETW_PROCESS_HANDLE_INFO_TYPE { |
| EtwQueryPartitionInformation = 1, |
| EtwQueryProcessHandleInfoMax, |
| }} |
| STRUCT!{struct ETW_TRACE_PARTITION_INFORMATION { |
| PartitionId: GUID, |
| ParentId: GUID, |
| Reserved: ULONG64, |
| PartitionType: ULONG, |
| }} |
| pub type PETW_TRACE_PARTITION_INFORMATION = *mut ETW_TRACE_PARTITION_INFORMATION; |
| extern "system" { |
| pub fn QueryTraceProcessingHandle( |
| ProcessingHandle: TRACEHANDLE, |
| InformationClass: ETW_PROCESS_HANDLE_INFO_TYPE, |
| InBuffer: PVOID, |
| InBufferSize: ULONG, |
| OutBuffer: PVOID, |
| OutBufferSize: ULONG, |
| ReturnLength: PULONG, |
| ) -> ULONG; |
| pub fn OpenTraceA( |
| Logfile: PEVENT_TRACE_LOGFILEA, |
| ) -> TRACEHANDLE; |
| pub fn SetTraceCallback( |
| pGuid: LPCGUID, |
| EventCallback: PEVENT_CALLBACK, |
| ) -> ULONG; |
| pub fn RemoveTraceCallback( |
| pGuid: LPCGUID, |
| ) -> ULONG; |
| } |
| extern "C" { |
| pub fn TraceMessage( |
| SessionHandle: TRACEHANDLE, |
| MessageFlags: ULONG, |
| MessageGuid: LPGUID, |
| MessageNumber: USHORT, |
| ... |
| ) -> ULONG; |
| pub fn TraceMessageVa( |
| SessionHandle: TRACEHANDLE, |
| MessageFlags: ULONG, |
| MessageGuid: LPGUID, |
| MessageNumber: USHORT, |
| MessageArgList: va_list, |
| ); |
| } |
| pub const INVALID_PROCESSTRACE_HANDLE: TRACEHANDLE = INVALID_HANDLE_VALUE as TRACEHANDLE; |
