include winapifamily.inc

ifndef _EVNTRACE_
define _EVNTRACE_

if defined(_WINNT_) OR defined(WINNT)

if NOT defined(NO_ETW_APP_DEPRECATION_WARNINGS)

if WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_APP) AND NOT WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_DESKTOP)
ETW_APP_DECLSPEC_DEPRECATED equ <__declspec(deprecated("This API is not recommended for general usage in Windows Store Apps and may not be supported in future versions of Windows"))>
else
ETW_APP_DECLSPEC_DEPRECATED equ <>
endif
else
ETW_APP_DECLSPEC_DEPRECATED equ <>
endif

if WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_APP)

include guiddef.inc

if defined(_NTDDK_) OR defined(_NTIFS_) OR defined(_WMIKM_)
_EVNTRACE_KERNEL_MODE equ 1
endif

if NOT defined(_EVNTRACE_KERNEL_MODE)
include wmistr.inc
endif

DEFINE_GUID(EventTraceGuid, 0x68fdd900, 0x4a3e, 0x11d1, 0x84, 0xf4, 0x00, 0x00, 0xf8, 0x04, 0x64, 0xe3)
DEFINE_GUID(SystemTraceControlGuid, 0x9e814aad, 0x3204, 0x11d2, 0x9a, 0x82, 0x00, 0x60, 0x08, 0xa8, 0x69, 0x39)
DEFINE_GUID(EventTraceConfigGuid, 0x01853a65, 0x418f, 0x4f36, 0xae, 0xfc, 0xdc, 0x0f, 0x1d, 0x2f, 0xd2, 0x35)
DEFINE_GUID(DefaultTraceSecurityGuid, 0x0811c1af, 0x7a07, 0x4a06, 0x82, 0xed, 0x86, 0x94, 0x55, 0xcd, 0xf7, 0x13)

KERNEL_LOGGER_NAMEW	equ <L"NT Kernel Logger">
GLOBAL_LOGGER_NAMEW	equ <L"GlobalLogger">
EVENT_LOGGER_NAMEW	equ <L"EventLog">
DIAG_LOGGER_NAMEW	equ <L"DiagLog">

KERNEL_LOGGER_NAMEA	equ <"NT Kernel Logger">
GLOBAL_LOGGER_NAMEA	equ <"GlobalLogger">
EVENT_LOGGER_NAMEA	equ <"EventLog">
DIAG_LOGGER_NAMEA	equ <"DiagLog">

MAX_MOF_FIELDS		equ 16

ifndef _TRACEHANDLE_DEFINED
define _TRACEHANDLE_DEFINED
TRACEHANDLE  typedef ULONG64
PTRACEHANDLE typedef ptr TRACEHANDLE
endif

SYSTEM_EVENT_TYPE	equ 1

EVENT_TRACE_TYPE_INFO	equ 0x00
EVENT_TRACE_TYPE_START	equ 0x01
EVENT_TRACE_TYPE_END	equ 0x02
EVENT_TRACE_TYPE_STOP	equ 0x02
EVENT_TRACE_TYPE_DC_START equ 0x03
EVENT_TRACE_TYPE_DC_END equ 0x04
EVENT_TRACE_TYPE_EXTENSION equ 0x05
EVENT_TRACE_TYPE_REPLY	equ 0x06
EVENT_TRACE_TYPE_DEQUEUE equ 0x07
EVENT_TRACE_TYPE_RESUME equ 0x07
EVENT_TRACE_TYPE_CHECKPOINT equ 0x08
EVENT_TRACE_TYPE_SUSPEND equ 0x08
EVENT_TRACE_TYPE_WINEVT_SEND equ 0x09
EVENT_TRACE_TYPE_WINEVT_RECEIVE equ 0XF0

TRACE_LEVEL_NONE	equ 0
TRACE_LEVEL_CRITICAL	equ 1
TRACE_LEVEL_FATAL	equ 1
TRACE_LEVEL_ERROR	equ 2
TRACE_LEVEL_WARNING	equ 3
TRACE_LEVEL_INFORMATION equ 4
TRACE_LEVEL_VERBOSE	equ 5
TRACE_LEVEL_RESERVED6	equ 6
TRACE_LEVEL_RESERVED7	equ 7
TRACE_LEVEL_RESERVED8	equ 8
TRACE_LEVEL_RESERVED9	equ 9

EVENT_TRACE_TYPE_LOAD	equ 0x0A
EVENT_TRACE_TYPE_TERMINATE equ 0x0B

EVENT_TRACE_TYPE_IO_READ equ 0x0A
EVENT_TRACE_TYPE_IO_WRITE equ 0x0B
EVENT_TRACE_TYPE_IO_READ_INIT equ 0x0C
EVENT_TRACE_TYPE_IO_WRITE_INIT equ 0x0D
EVENT_TRACE_TYPE_IO_FLUSH equ 0x0E
EVENT_TRACE_TYPE_IO_FLUSH_INIT equ 0x0F
EVENT_TRACE_TYPE_IO_REDIRECTED_INIT equ 0x10

EVENT_TRACE_TYPE_MM_TF	equ 0x0A
EVENT_TRACE_TYPE_MM_DZF equ 0x0B
EVENT_TRACE_TYPE_MM_COW equ 0x0C
EVENT_TRACE_TYPE_MM_GPF equ 0x0D
EVENT_TRACE_TYPE_MM_HPF equ 0x0E
EVENT_TRACE_TYPE_MM_AV	equ 0x0F

EVENT_TRACE_TYPE_SEND	equ 0x0A
EVENT_TRACE_TYPE_RECEIVE equ 0x0B
EVENT_TRACE_TYPE_CONNECT equ 0x0C
EVENT_TRACE_TYPE_DISCONNECT equ 0x0D
EVENT_TRACE_TYPE_RETRANSMIT equ 0x0E
EVENT_TRACE_TYPE_ACCEPT equ 0x0F
EVENT_TRACE_TYPE_RECONNECT equ 0x10
EVENT_TRACE_TYPE_CONNFAIL equ 0x11
EVENT_TRACE_TYPE_COPY_TCP equ 0x12
EVENT_TRACE_TYPE_COPY_ARP equ 0x13
EVENT_TRACE_TYPE_ACKFULL equ 0x14
EVENT_TRACE_TYPE_ACKPART equ 0x15
EVENT_TRACE_TYPE_ACKDUP equ 0x16

EVENT_TRACE_TYPE_GUIDMAP equ 0x0A
EVENT_TRACE_TYPE_CONFIG equ 0x0B
EVENT_TRACE_TYPE_SIDINFO equ 0x0C
EVENT_TRACE_TYPE_SECURITY equ 0x0D
EVENT_TRACE_TYPE_DBGID_RSDS equ 0x40

EVENT_TRACE_TYPE_REGCREATE equ 0x0A
EVENT_TRACE_TYPE_REGOPEN equ 0x0B
EVENT_TRACE_TYPE_REGDELETE equ 0x0C
EVENT_TRACE_TYPE_REGQUERY equ 0x0D
EVENT_TRACE_TYPE_REGSETVALUE equ 0x0E
EVENT_TRACE_TYPE_REGDELETEVALUE equ 0x0F
EVENT_TRACE_TYPE_REGQUERYVALUE equ 0x10
EVENT_TRACE_TYPE_REGENUMERATEKEY equ 0x11
EVENT_TRACE_TYPE_REGENUMERATEVALUEKEY equ 0x12
EVENT_TRACE_TYPE_REGQUERYMULTIPLEVALUE equ 0x13
EVENT_TRACE_TYPE_REGSETINFORMATION equ 0x14
EVENT_TRACE_TYPE_REGFLUSH equ 0x15
EVENT_TRACE_TYPE_REGKCBCREATE equ 0x16
EVENT_TRACE_TYPE_REGKCBDELETE equ 0x17
EVENT_TRACE_TYPE_REGKCBRUNDOWNBEGIN equ 0x18
EVENT_TRACE_TYPE_REGKCBRUNDOWNEND equ 0x19
EVENT_TRACE_TYPE_REGVIRTUALIZE equ 0x1A
EVENT_TRACE_TYPE_REGCLOSE equ 0x1B
EVENT_TRACE_TYPE_REGSETSECURITY equ 0x1C
EVENT_TRACE_TYPE_REGQUERYSECURITY equ 0x1D
EVENT_TRACE_TYPE_REGCOMMIT equ 0x1E
EVENT_TRACE_TYPE_REGPREPARE equ 0x1F
EVENT_TRACE_TYPE_REGROLLBACK equ 0x20
EVENT_TRACE_TYPE_REGMOUNTHIVE equ 0x21

EVENT_TRACE_TYPE_CONFIG_CPU equ 0x0A
EVENT_TRACE_TYPE_CONFIG_PHYSICALDISK equ 0x0B
EVENT_TRACE_TYPE_CONFIG_LOGICALDISK equ 0x0C
EVENT_TRACE_TYPE_CONFIG_NIC equ 0x0D
EVENT_TRACE_TYPE_CONFIG_VIDEO equ 0x0E
EVENT_TRACE_TYPE_CONFIG_SERVICES equ 0x0F
EVENT_TRACE_TYPE_CONFIG_POWER equ 0x10
EVENT_TRACE_TYPE_CONFIG_NETINFO equ 0x11
EVENT_TRACE_TYPE_CONFIG_OPTICALMEDIA equ 0x12

EVENT_TRACE_TYPE_CONFIG_IRQ equ 0x15
EVENT_TRACE_TYPE_CONFIG_PNP equ 0x16
EVENT_TRACE_TYPE_CONFIG_IDECHANNEL equ 0x17
EVENT_TRACE_TYPE_CONFIG_NUMANODE equ 0x18
EVENT_TRACE_TYPE_CONFIG_PLATFORM equ 0x19
EVENT_TRACE_TYPE_CONFIG_PROCESSORGROUP equ 0x1A
EVENT_TRACE_TYPE_CONFIG_PROCESSORNUMBER equ 0x1B
EVENT_TRACE_TYPE_CONFIG_DPI equ 0x1C
EVENT_TRACE_TYPE_CONFIG_CI_INFO equ 0x1D

EVENT_TRACE_TYPE_OPTICAL_IO_READ equ 0x37
EVENT_TRACE_TYPE_OPTICAL_IO_WRITE equ 0x38
EVENT_TRACE_TYPE_OPTICAL_IO_FLUSH equ 0x39
EVENT_TRACE_TYPE_OPTICAL_IO_READ_INIT equ 0x3a
EVENT_TRACE_TYPE_OPTICAL_IO_WRITE_INIT equ 0x3b
EVENT_TRACE_TYPE_OPTICAL_IO_FLUSH_INIT equ 0x3c

EVENT_TRACE_TYPE_FLT_PREOP_INIT equ 0x60
EVENT_TRACE_TYPE_FLT_POSTOP_INIT equ 0x61
EVENT_TRACE_TYPE_FLT_PREOP_COMPLETION equ 0x62
EVENT_TRACE_TYPE_FLT_POSTOP_COMPLETION equ 0x63
EVENT_TRACE_TYPE_FLT_PREOP_FAILURE equ 0x64
EVENT_TRACE_TYPE_FLT_POSTOP_FAILURE equ 0x65

EVENT_TRACE_FLAG_PROCESS equ 0x00000001
EVENT_TRACE_FLAG_THREAD equ 0x00000002
EVENT_TRACE_FLAG_IMAGE_LOAD equ 0x00000004
EVENT_TRACE_FLAG_DISK_IO equ 0x00000100
EVENT_TRACE_FLAG_DISK_FILE_IO equ 0x00000200
EVENT_TRACE_FLAG_MEMORY_PAGE_FAULTS equ 0x00001000
EVENT_TRACE_FLAG_MEMORY_HARD_FAULTS equ 0x00002000
EVENT_TRACE_FLAG_NETWORK_TCPIP equ 0x00010000
EVENT_TRACE_FLAG_REGISTRY equ 0x00020000
EVENT_TRACE_FLAG_DBGPRINT equ 0x00040000

EVENT_TRACE_FLAG_PROCESS_COUNTERS equ 0x00000008
EVENT_TRACE_FLAG_CSWITCH equ 0x00000010
EVENT_TRACE_FLAG_DPC	equ 0x00000020
EVENT_TRACE_FLAG_INTERRUPT equ 0x00000040
EVENT_TRACE_FLAG_SYSTEMCALL equ 0x00000080

EVENT_TRACE_FLAG_DISK_IO_INIT equ 0x00000400
EVENT_TRACE_FLAG_ALPC	equ 0x00100000
EVENT_TRACE_FLAG_SPLIT_IO equ 0x00200000

EVENT_TRACE_FLAG_DRIVER equ 0x00800000
EVENT_TRACE_FLAG_PROFILE equ 0x01000000
EVENT_TRACE_FLAG_FILE_IO equ 0x02000000
EVENT_TRACE_FLAG_FILE_IO_INIT equ 0x04000000
EVENT_TRACE_FLAG_DISPATCHER equ 0x00000800
EVENT_TRACE_FLAG_VIRTUAL_ALLOC equ 0x00004000

EVENT_TRACE_FLAG_VAMAP	equ 0x00008000
EVENT_TRACE_FLAG_NO_SYSCONFIG equ 0x10000000

EVENT_TRACE_FLAG_EXTENSION equ 0x80000000
EVENT_TRACE_FLAG_FORWARD_WMI equ 0x40000000
EVENT_TRACE_FLAG_ENABLE_RESERVE equ 0x20000000

EVENT_TRACE_FILE_MODE_NONE equ 0x00000000
EVENT_TRACE_FILE_MODE_SEQUENTIAL equ 0x00000001
EVENT_TRACE_FILE_MODE_CIRCULAR equ 0x00000002
EVENT_TRACE_FILE_MODE_APPEND equ 0x00000004

EVENT_TRACE_REAL_TIME_MODE equ 0x00000100
EVENT_TRACE_DELAY_OPEN_FILE_MODE equ 0x00000200
EVENT_TRACE_BUFFERING_MODE equ 0x00000400
EVENT_TRACE_PRIVATE_LOGGER_MODE equ 0x00000800
EVENT_TRACE_ADD_HEADER_MODE equ 0x00001000

EVENT_TRACE_USE_GLOBAL_SEQUENCE equ 0x00004000
EVENT_TRACE_USE_LOCAL_SEQUENCE equ 0x00008000

EVENT_TRACE_RELOG_MODE	equ 0x00010000
EVENT_TRACE_USE_PAGED_MEMORY equ 0x01000000

EVENT_TRACE_FILE_MODE_NEWFILE equ 0x00000008
EVENT_TRACE_FILE_MODE_PREALLOCATE equ 0x00000020

EVENT_TRACE_NONSTOPPABLE_MODE equ 0x00000040
EVENT_TRACE_SECURE_MODE equ 0x00000080
EVENT_TRACE_USE_KBYTES_FOR_SIZE equ 0x00002000
EVENT_TRACE_PRIVATE_IN_PROC equ 0x00020000

EVENT_TRACE_MODE_RESERVED equ 0x00100000

EVENT_TRACE_NO_PER_PROCESSOR_BUFFERING equ 0x10000000

EVENT_TRACE_SYSTEM_LOGGER_MODE equ 0x02000000
EVENT_TRACE_ADDTO_TRIAGE_DUMP equ 0x80000000
EVENT_TRACE_STOP_ON_HYBRID_SHUTDOWN equ 0x00400000
EVENT_TRACE_PERSIST_ON_HYBRID_SHUTDOWN equ 0x00800000

EVENT_TRACE_INDEPENDENT_SESSION_MODE equ 0x08000000

EVENT_TRACE_CONTROL_QUERY equ 0
EVENT_TRACE_CONTROL_STOP equ 1
EVENT_TRACE_CONTROL_UPDATE equ 2

EVENT_TRACE_CONTROL_FLUSH equ 3

TRACE_MESSAGE_SEQUENCE	equ 1
TRACE_MESSAGE_GUID	equ 2
TRACE_MESSAGE_COMPONENTID equ 4
TRACE_MESSAGE_TIMESTAMP equ 8
TRACE_MESSAGE_PERFORMANCE_TIMESTAMP equ 16
TRACE_MESSAGE_SYSTEMINFO equ 32

TRACE_MESSAGE_POINTER32 equ 0x0040
TRACE_MESSAGE_POINTER64 equ 0x0080

TRACE_MESSAGE_FLAG_MASK equ 0xFFFF

TRACE_MESSAGE_MAXIMUM_SIZE equ (64 * 1024)

EVENT_TRACE_USE_PROCTIME equ 0x0001
EVENT_TRACE_USE_NOCPUTIME equ 0x0002

TRACE_HEADER_FLAG_USE_TIMESTAMP equ 0x00000200
TRACE_HEADER_FLAG_TRACED_GUID equ 0x00020000
TRACE_HEADER_FLAG_LOG_WNODE equ 0x00040000
TRACE_HEADER_FLAG_USE_GUID_PTR equ 0x00080000
TRACE_HEADER_FLAG_USE_MOF_PTR equ 0x00100000

EVENT_TRACE_HEADER	STRUC
Size			USHORT ?
UNION
 FieldTypeFlags		USHORT ?
 STRUC
  HeaderType		UCHAR ?
  MarkerFlags		UCHAR ?
 ENDS
ENDS
UNION
 Version		 ULONG ?
 STRUC Class
  Type			 UCHAR ?
  Level			 UCHAR ?
  Version		 USHORT ?
 ENDS
ENDS
ThreadId		ULONG ?
ProcessId		ULONG ?
TimeStamp		LARGE_INTEGER <>
UNION
 Guid			GUID <>
 GuidPtr		ULONGLONG ?
ENDS
UNION
 STRUC
  KernelTime		ULONG ?
  UserTime		ULONG ?
 ENDS
 ProcessorTime		ULONG64 ?
 STRUC
  ClientContext		ULONG ?
  Flags			ULONG ?
 ENDS
ENDS
EVENT_TRACE_HEADER	ENDS
PEVENT_TRACE_HEADER	typedef ptr EVENT_TRACE_HEADER

EVENT_INSTANCE_HEADER	STRUC
Size			USHORT ?
UNION
 FieldTypeFlags		USHORT ?
 STRUC
  HeaderType		UCHAR ?
  MarkerFlags		UCHAR ?
 ENDS
ENDS
UNION
 Version		ULONG ?
 STRUC Class
  Type			UCHAR ?
  Level			UCHAR ?
  Version		USHORT ?
 ENDS
ENDS
ThreadId		ULONG ?
ProcessId		ULONG ?
TimeStamp		LARGE_INTEGER <>
RegHandle		ULONGLONG ?
InstanceId		ULONG ?
ParentInstanceId	ULONG ?
UNION
 STRUC
  KernelTime		ULONG ?
  UserTime		ULONG ?
 ENDS
 ProcessorTime		ULONG64 ?
 STRUC
  EventId		ULONG ?
  Flags			ULONG ?
 ENDS
ENDS
ParentRegHandle		ULONGLONG ?
EVENT_INSTANCE_HEADER	ENDS
PEVENT_INSTANCE_HEADER	typedef ptr EVENT_INSTANCE_HEADER

ETW_NULL_TYPE_VALUE	equ 0
ETW_OBJECT_TYPE_VALUE	equ 1
ETW_STRING_TYPE_VALUE	equ 2
ETW_SBYTE_TYPE_VALUE	equ 3
ETW_BYTE_TYPE_VALUE	equ 4
ETW_INT16_TYPE_VALUE	equ 5
ETW_UINT16_TYPE_VALUE	equ 6
ETW_INT32_TYPE_VALUE	equ 7
ETW_UINT32_TYPE_VALUE	equ 8
ETW_INT64_TYPE_VALUE	equ 9
ETW_UINT64_TYPE_VALUE	equ 10
ETW_CHAR_TYPE_VALUE	equ 11
ETW_SINGLE_TYPE_VALUE	equ 12
ETW_DOUBLE_TYPE_VALUE	equ 13
ETW_BOOLEAN_TYPE_VALUE	equ 14
ETW_DECIMAL_TYPE_VALUE	equ 15

ETW_GUID_TYPE_VALUE	equ 101
ETW_ASCIICHAR_TYPE_VALUE equ 102
ETW_ASCIISTRING_TYPE_VALUE equ 103
ETW_COUNTED_STRING_TYPE_VALUE equ 104
ETW_POINTER_TYPE_VALUE	equ 105
ETW_SIZET_TYPE_VALUE	equ 106
ETW_HIDDEN_TYPE_VALUE	equ 107
ETW_BOOL_TYPE_VALUE	equ 108
ETW_COUNTED_ANSISTRING_TYPE_VALUE equ 109
ETW_REVERSED_COUNTED_STRING_TYPE_VALUE equ 110
ETW_REVERSED_COUNTED_ANSISTRING_TYPE_VALUE equ 111
ETW_NON_NULL_TERMINATED_STRING_TYPE_VALUE equ 112
ETW_REDUCED_ANSISTRING_TYPE_VALUE equ 113
ETW_REDUCED_STRING_TYPE_VALUE equ 114
ETW_SID_TYPE_VALUE	equ 115
ETW_VARIANT_TYPE_VALUE	equ 116
ETW_PTVECTOR_TYPE_VALUE equ 117
ETW_WMITIME_TYPE_VALUE	equ 118
ETW_DATETIME_TYPE_VALUE equ 119
ETW_REFRENCE_TYPE_VALUE equ 120


DEFINE_TRACE_MOF_FIELD macro MOF, p, length, type
    mov MOF.DataPtr,p
    mov MOF.Length,length
    mov MOF.DataType,type
    exitm<>
    endm

MOF_FIELD		STRUC
DataPtr			ULONG64 ?
Length			ULONG ?
DataType		ULONG ?
MOF_FIELD		ENDS
PMOF_FIELD		typedef ptr MOF_FIELD

if NOT defined(_EVNTRACE_KERNEL_MODE) OR defined(_WMIKM_)

TRACE_LOGFILE_HEADER	STRUC
BufferSize		ULONG ?
UNION
 Version		ULONG ?
 STRUC
  MajorVersion		UCHAR ?
  MinorVersion		UCHAR ?
  SubVersion		UCHAR ?
  SubMinorVersion	UCHAR ?
 ENDS
ENDS
ProviderVersion		ULONG ?
NumberOfProcessors	ULONG ?
EndTime			LARGE_INTEGER <>
TimerResolution		ULONG ?
MaximumFileSize		ULONG ?
LogFileMode		ULONG ?
BuffersWritten		ULONG ?
UNION
 LogInstanceGuid	GUID <>
 STRUC
  StartBuffers		ULONG ?
  PointerSize		ULONG ?
  EventsLost		ULONG ?
  CpuSpeedInMHz		ULONG ?
 ENDS
ENDS
if defined(_WMIKM_)
LoggerName		PWCHAR ?
LogFileName		PWCHAR ?
TimeZone		RTL_TIME_ZONE_INFORMATION ?
else
LoggerName		LPWSTR ?
LogFileName		LPWSTR ?
TimeZone		TIME_ZONE_INFORMATION <>
endif
BootTime		LARGE_INTEGER <>
PerfFreq		LARGE_INTEGER <>
StartTime		LARGE_INTEGER <>
ReservedFlags		ULONG ?
BuffersLost		ULONG ?
TRACE_LOGFILE_HEADER	ENDS
PTRACE_LOGFILE_HEADER	typedef ptr TRACE_LOGFILE_HEADER

TRACE_LOGFILE_HEADER32	STRUC
BufferSize		ULONG ?
UNION
 Version		ULONG ?
 STRUC
  MajorVersion		UCHAR ?
  MinorVersion		UCHAR ?
  SubVersion		UCHAR ?
  SubMinorVersion	UCHAR ?
 ENDS
ENDS
ProviderVersion		ULONG ?
NumberOfProcessors	ULONG ?
EndTime			LARGE_INTEGER <>
TimerResolution		ULONG ?
MaximumFileSize		ULONG ?
LogFileMode		ULONG ?
BuffersWritten		ULONG ?
UNION
 LogInstanceGuid	GUID <>
 STRUC
  StartBuffers		ULONG ?
  PointerSize		ULONG ?
  EventsLost		ULONG ?
  CpuSpeedInMHz		ULONG ?
 ENDS
ENDS
if defined(_WMIKM_)
LoggerName		ULONG32 ?
LogFileName		ULONG32 ?
TimeZone		RTL_TIME_ZONE_INFORMATION ?
else
LoggerName		ULONG32 ?
LogFileName		ULONG32 ?
TimeZone		TIME_ZONE_INFORMATION <>
endif
BootTime		LARGE_INTEGER <>
PerfFreq		LARGE_INTEGER <>
StartTime		LARGE_INTEGER <>
ReservedFlags		ULONG ?
BuffersLost		ULONG ?
TRACE_LOGFILE_HEADER32	ENDS
PTRACE_LOGFILE_HEADER32 typedef ptr TRACE_LOGFILE_HEADER32

TRACE_LOGFILE_HEADER64	STRUC
BufferSize		ULONG ?
UNION
 Version		 ULONG ?
 STRUC
  MajorVersion		 UCHAR ?
  MinorVersion		 UCHAR ?
  SubVersion		 UCHAR ?
  SubMinorVersion	 UCHAR ?
 ENDS
ENDS
ProviderVersion		ULONG ?
NumberOfProcessors	ULONG ?
EndTime			LARGE_INTEGER <>
TimerResolution		ULONG ?
MaximumFileSize		ULONG ?
LogFileMode		ULONG ?
BuffersWritten		ULONG ?
UNION
 LogInstanceGuid	GUID <>
 STRUC
  StartBuffers		ULONG ?
  PointerSize		ULONG ?
  EventsLost		ULONG ?
  CpuSpeedInMHz		ULONG ?
 ENDS
ENDS
if defined(_WMIKM_)
LoggerName		ULONG64 ?
LogFileName		ULONG64 ?
TimeZone		RTL_TIME_ZONE_INFORMATION ?
else
LoggerName		ULONG64 ?
LogFileName		ULONG64 ?
TimeZone		TIME_ZONE_INFORMATION <>
endif
BootTime		LARGE_INTEGER <>
PerfFreq		LARGE_INTEGER <>
StartTime		LARGE_INTEGER <>
ReservedFlags		ULONG ?
BuffersLost		ULONG ?
TRACE_LOGFILE_HEADER64	ENDS
PTRACE_LOGFILE_HEADER64 typedef ptr TRACE_LOGFILE_HEADER64

endif ;; NOT _EVNTRACE_KERNEL_MODE OR _WMIKM_

EVENT_INSTANCE_INFO	STRUC
RegHandle		HANDLE ?
InstanceId		ULONG ?
EVENT_INSTANCE_INFO	ENDS
PEVENT_INSTANCE_INFO	typedef ptr EVENT_INSTANCE_INFO

if NOT defined(_EVNTRACE_KERNEL_MODE)

EVENT_TRACE_PROPERTIES	STRUC
Wnode			WNODE_HEADER <>
BufferSize		ULONG ?
MinimumBuffers		ULONG ?
MaximumBuffers		ULONG ?
MaximumFileSize		ULONG ?
LogFileMode		ULONG ?
FlushTimer		ULONG ?
EnableFlags		ULONG ?
UNION
 AgeLimit		LONG ?
 FlushThreshold		LONG ?
ENDS
NumberOfBuffers		ULONG ?
FreeBuffers		ULONG ?
EventsLost		ULONG ?
BuffersWritten		ULONG ?
LogBuffersLost		ULONG ?
RealTimeBuffersLost	ULONG ?
LoggerThreadId		HANDLE ?
LogFileNameOffset	ULONG ?
LoggerNameOffset	ULONG ?
EVENT_TRACE_PROPERTIES	ENDS
PEVENT_TRACE_PROPERTIES typedef ptr EVENT_TRACE_PROPERTIES

TRACE_GUID_REGISTRATION	 STRUC
Guid			LPCGUID ?
RegHandle		HANDLE ?
TRACE_GUID_REGISTRATION ENDS
PTRACE_GUID_REGISTRATION typedef ptr TRACE_GUID_REGISTRATION

endif ;; NOT _EVNTRACE_KERNEL_MODE

TRACE_GUID_PROPERTIES	STRUC
Guid			GUID <>
GuidType		ULONG ?
LoggerId		ULONG ?
EnableLevel		ULONG ?
EnableFlags		ULONG ?
IsEnable		BOOLEAN ?
TRACE_GUID_PROPERTIES	ENDS
PTRACE_GUID_PROPERTIES	typedef ptr TRACE_GUID_PROPERTIES

ifndef ETW_BUFFER_CONTEXT_DEF
define ETW_BUFFER_CONTEXT_DEF
ETW_BUFFER_CONTEXT	STRUC
UNION
 STRUC
  ProcessorNumber	UCHAR ?
  Alignment		UCHAR ?
 ENDS
 ProcessorIndex		USHORT ?
ENDS
LoggerId		USHORT ?
ETW_BUFFER_CONTEXT	ENDS
PETW_BUFFER_CONTEXT	typedef ptr ETW_BUFFER_CONTEXT
endif

TRACE_PROVIDER_FLAG_LEGACY equ (0x00000001)
TRACE_PROVIDER_FLAG_PRE_ENABLE equ (0x00000002)

TRACE_ENABLE_INFO	STRUC
IsEnabled		ULONG ?
Level			UCHAR ?
Reserved1		UCHAR ?
LoggerId		USHORT ?
EnableProperty		ULONG ?
Reserved2		ULONG ?
MatchAnyKeyword		ULONGLONG ?
MatchAllKeyword		ULONGLONG ?
TRACE_ENABLE_INFO	ENDS
PTRACE_ENABLE_INFO	typedef ptr TRACE_ENABLE_INFO

TRACE_PROVIDER_INSTANCE_INFO STRUC
NextOffset		ULONG ?
EnableCount		ULONG ?
Pid			ULONG ?
Flags			ULONG ?
TRACE_PROVIDER_INSTANCE_INFO ENDS
PTRACE_PROVIDER_INSTANCE_INFO typedef ptr TRACE_PROVIDER_INSTANCE_INFO

TRACE_GUID_INFO		STRUC
InstanceCount		ULONG ?
Reserved		ULONG ?
TRACE_GUID_INFO		ENDS
PTRACE_GUID_INFO	typedef ptr TRACE_GUID_INFO

PROFILE_SOURCE_INFO	STRUC
NextEntryOffset		ULONG ?
Source			ULONG ?
MinInterval		ULONG ?
MaxInterval		ULONG ?
Reserved		ULONG64 ?
Description		WCHAR ANYSIZE_ARRAY dup(?)
PROFILE_SOURCE_INFO	ENDS
PPROFILE_SOURCE_INFO	typedef ptr PROFILE_SOURCE_INFO

EVENT_TRACE		STRUC
Header			EVENT_TRACE_HEADER <>
InstanceId		ULONG ?
ParentInstanceId	ULONG ?
ParentGuid		GUID <>
MofData			PVOID ?
MofLength		ULONG ?
UNION
 ClientContext		ULONG ?
 BufferContext		ETW_BUFFER_CONTEXT <>
ENDS
EVENT_TRACE		ENDS
PEVENT_TRACE		typedef ptr EVENT_TRACE

EVENT_CONTROL_CODE_DISABLE_PROVIDER equ 0
EVENT_CONTROL_CODE_ENABLE_PROVIDER equ 1
EVENT_CONTROL_CODE_CAPTURE_STATE equ 2

endif ;; WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_APP)

if NOT defined(_EVNTRACE_KERNEL_MODE)

if WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_APP)


PEVENT_RECORD		typedef ptr EVENT_RECORD
PEVENT_TRACE_LOGFILEW	typedef ptr EVENT_TRACE_LOGFILEW

PEVENT_TRACE_LOGFILEA	typedef ptr EVENT_TRACE_LOGFILEA

CALLBACK(PEVENT_TRACE_BUFFER_CALLBACKW, :PEVENT_TRACE_LOGFILEW)
CALLBACK(PEVENT_TRACE_BUFFER_CALLBACKA, :PEVENT_TRACE_LOGFILEA)
CALLBACK(PEVENT_CALLBACK, :PEVENT_TRACE)
CALLBACK(PEVENT_RECORD_CALLBACK, :PEVENT_RECORD)
CALLBACK(WMIDPREQUEST, :WMIDPREQUESTCODE, :PVOID, :ptr ULONG, :PVOID)

EVENT_TRACE_LOGFILEW	STRUC
LogFileName		LPWSTR ?
LoggerName		LPWSTR ?
CurrentTime		LONGLONG ?
BuffersRead		ULONG ?
UNION
 LogFileMode		ULONG ?
 ProcessTraceMode	ULONG ?
ENDS
CurrentEvent		EVENT_TRACE <>
LogfileHeader		TRACE_LOGFILE_HEADER <>
BufferCallback		PEVENT_TRACE_BUFFER_CALLBACKW ?
BufferSize		ULONG ?
Filled			ULONG ?
EventsLost		ULONG ?
UNION
 EventCallback		PEVENT_CALLBACK ?
 EventRecordCallback	PEVENT_RECORD_CALLBACK ?
ENDS
IsKernelTrace		ULONG ?
Context			PVOID ?
EVENT_TRACE_LOGFILEW	ENDS

EVENT_TRACE_LOGFILEA	STRUC
LogFileName		LPSTR ?
LoggerName		LPSTR ?
CurrentTime		LONGLONG ?
BuffersRead		ULONG ?
UNION
LogFileMode		ULONG ?
ProcessTraceMode	ULONG ?
ENDS
CurrentEvent		EVENT_TRACE <>
LogfileHeader		TRACE_LOGFILE_HEADER <>
BufferCallback		PEVENT_TRACE_BUFFER_CALLBACKA ?
BufferSize		ULONG ?
Filled			ULONG ?
EventsLost		ULONG ?
UNION ; {
 EventCallback		PEVENT_CALLBACK ?
 EventRecordCallback	PEVENT_RECORD_CALLBACK ?
ENDS
IsKernelTrace		ULONG ?
Context			PVOID ?
EVENT_TRACE_LOGFILEA	ENDS

if defined(_UNICODE) OR defined(UNICODE)
PEVENT_TRACE_BUFFER_CALLBACK equ <PEVENT_TRACE_BUFFER_CALLBACKW>
EVENT_TRACE_LOGFILE	equ <EVENT_TRACE_LOGFILEW>
PEVENT_TRACE_LOGFILE	equ <PEVENT_TRACE_LOGFILEW>
KERNEL_LOGGER_NAME	equ <KERNEL_LOGGER_NAMEW>
GLOBAL_LOGGER_NAME	equ <GLOBAL_LOGGER_NAMEW>
EVENT_LOGGER_NAME	equ <EVENT_LOGGER_NAMEW>
else
PEVENT_TRACE_BUFFER_CALLBACK equ <PEVENT_TRACE_BUFFER_CALLBACKA>
EVENT_TRACE_LOGFILE	equ <EVENT_TRACE_LOGFILEA>
PEVENT_TRACE_LOGFILE	equ <PEVENT_TRACE_LOGFILEA>
KERNEL_LOGGER_NAME	equ <KERNEL_LOGGER_NAMEA>
GLOBAL_LOGGER_NAME	equ <GLOBAL_LOGGER_NAMEA>
EVENT_LOGGER_NAME	equ <EVENT_LOGGER_NAMEA>
endif

endif

ifndef _APISET_EVENTING

if WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_APP)
StartTraceW proto __cdecl :PTRACEHANDLE, :LPCWSTR, :PEVENT_TRACE_PROPERTIES
endif
if WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_DESKTOP)
StartTraceA proto __cdecl :PTRACEHANDLE, :LPCSTR, :PEVENT_TRACE_PROPERTIES
endif
if WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_APP)
StopTraceW proto __cdecl :TRACEHANDLE, :LPCWSTR, :PEVENT_TRACE_PROPERTIES
endif

if WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_DESKTOP)
StopTraceA proto __cdecl :TRACEHANDLE, :LPCSTR, :PEVENT_TRACE_PROPERTIES
endif

if WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_APP)
QueryTraceW proto __cdecl :TRACEHANDLE, :LPCWSTR, :PEVENT_TRACE_PROPERTIES
endif

if WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_DESKTOP)
QueryTraceA proto __cdecl :TRACEHANDLE, :LPCSTR, :PEVENT_TRACE_PROPERTIES
UpdateTraceW proto __cdecl :TRACEHANDLE, :LPCWSTR, :PEVENT_TRACE_PROPERTIES
UpdateTraceA proto __cdecl :TRACEHANDLE, :LPCSTR, :PEVENT_TRACE_PROPERTIES
endif

if WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_APP)
if (WINVER GE _WIN32_WINNT_WINXP)
FlushTraceW proto __cdecl :TRACEHANDLE, :LPCWSTR, :PEVENT_TRACE_PROPERTIES
endif
endif

if WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_DESKTOP)
if (WINVER GE _WIN32_WINNT_WINXP)
FlushTraceA proto __cdecl :TRACEHANDLE, :LPCSTR, :PEVENT_TRACE_PROPERTIES
endif
endif

if WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_APP)
ControlTraceW proto __cdecl :TRACEHANDLE, :LPCWSTR, :PEVENT_TRACE_PROPERTIES, :ULONG
endif

if WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_DESKTOP)
ControlTraceA proto __cdecl :TRACEHANDLE, :LPCSTR, :PEVENT_TRACE_PROPERTIES, :ULONG
QueryAllTracesW proto __cdecl :ptr, :ULONG, :PULONG
QueryAllTracesA proto __cdecl :ptr, :ULONG, :PULONG
endif

if WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_APP)
EnableTrace proto __cdecl :ULONG, :ULONG, :ULONG, :LPCGUID, :TRACEHANDLE
endif
endif

PEVENT_FILTER_DESCRIPTOR typedef ptr EVENT_FILTER_DESCRIPTOR

ifndef _APISET_EVENTING
if WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_DESKTOP)
if (WINVER GE _WIN32_WINNT_VISTA)
EnableTraceEx proto __cdecl :LPCGUID, :LPCGUID, :TRACEHANDLE, :ULONG, :UCHAR, :ULONGLONG, :ULONGLONG, :ULONG, :PEVENT_FILTER_DESCRIPTOR
endif
endif
endif

ENABLE_TRACE_PARAMETERS_VERSION equ 1
ENABLE_TRACE_PARAMETERS_VERSION_2 equ 2

ENABLE_TRACE_PARAMETERS_V1  STRUC
Version			ULONG ?
EnableProperty		ULONG ?
ControlFlags		ULONG ?
SourceId		GUID <>
EnableFilterDesc	PEVENT_FILTER_DESCRIPTOR ?
ENABLE_TRACE_PARAMETERS_V1 ENDS
PENABLE_TRACE_PARAMETERS_V1 typedef ptr ENABLE_TRACE_PARAMETERS_V1

ENABLE_TRACE_PARAMETERS	 STRUC
Version			ULONG ?
EnableProperty		ULONG ?
ControlFlags		ULONG ?
SourceId		GUID <>
EnableFilterDesc	PEVENT_FILTER_DESCRIPTOR ?
FilterDescCount		ULONG ?
ENABLE_TRACE_PARAMETERS ENDS
PENABLE_TRACE_PARAMETERS typedef ptr ENABLE_TRACE_PARAMETERS

ifndef _APISET_EVENTING
if WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_DESKTOP)
if (WINVER GE _WIN32_WINNT_WIN7)
EnableTraceEx2 proto __cdecl :TRACEHANDLE, :LPCGUID, :ULONG, :UCHAR, :ULONGLONG, :ULONGLONG, :ULONG, :PENABLE_TRACE_PARAMETERS
endif
endif
endif

.enum TRACE_QUERY_INFO_CLASS {
    TraceGuidQueryList,
    TraceGuidQueryInfo,
    TraceGuidQueryProcess,
    TraceStackTracingInfo,
    TraceSystemTraceEnableFlagsInfo,
    TraceSampledProfileIntervalInfo,
    TraceProfileSourceConfigInfo,
    TraceProfileSourceListInfo,
    TracePmcEventListInfo,
    TracePmcCounterListInfo,
    TraceSetDisallowList,
    MaxTraceSetInfoClass
    }

TRACE_INFO_CLASS typedef TRACE_QUERY_INFO_CLASS

ifndef _APISET_EVENTING
if WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_DESKTOP)
if (WINVER GE _WIN32_WINNT_VISTA)
EnumerateTraceGuidsEx proto __cdecl :TRACE_QUERY_INFO_CLASS, :ptr, :ULONG, :ptr, :ULONG, :PULONG
endif
endif
endif

CLASSIC_EVENT_ID	STRUC
EventGuid		GUID <>
Type			UCHAR ?
Reserved		UCHAR 7 dup(?)
CLASSIC_EVENT_ID	ENDS
PCLASSIC_EVENT_ID	typedef ptr CLASSIC_EVENT_ID

TRACE_PROFILE_INTERVAL	STRUC
Source			ULONG ?
Interval		ULONG ?
TRACE_PROFILE_INTERVAL	ENDS
PTRACE_PROFILE_INTERVAL typedef ptr TRACE_PROFILE_INTERVAL

ifndef _APISET_EVENTING

if WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_DESKTOP)
if (WINVER GE _WIN32_WINNT_WIN7)
TraceSetInformation proto __cdecl :TRACEHANDLE, :TRACE_INFO_CLASS, :ptr, :ULONG
endif
if (WINVER GE _WIN32_WINNT_WIN8)
TraceQueryInformation proto __cdecl :TRACEHANDLE, :TRACE_INFO_CLASS, :ptr, :ULONG, :PULONG
endif
CreateTraceInstanceId proto __cdecl :HANDLE, :PEVENT_INSTANCE_INFO
TraceEvent proto __cdecl :TRACEHANDLE, :PEVENT_TRACE_HEADER
TraceEventInstance proto __cdecl :TRACEHANDLE, :PEVENT_INSTANCE_HEADER, :PEVENT_INSTANCE_INFO, :PEVENT_INSTANCE_INFO
endif
if WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_APP)
RegisterTraceGuidsW proto __cdecl :WMIDPREQUEST, :ptr, :LPCGUID, :ULONG, :PTRACE_GUID_REGISTRATION, :LPCWSTR, :LPCWSTR, :PTRACEHANDLE
endif

if WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_DESKTOP)
RegisterTraceGuidsA proto __cdecl :WMIDPREQUEST, :ptr, :LPCGUID, :ULONG, :PTRACE_GUID_REGISTRATION, :LPCSTR, :LPCSTR, :PTRACEHANDLE
if (WINVER GE _WIN32_WINNT_WINXP)
EnumerateTraceGuids proto __cdecl :ptr, :ULONG, :PULONG
endif
endif

if WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_APP)
UnregisterTraceGuids proto __cdecl :TRACEHANDLE
GetTraceLoggerHandle proto __cdecl :ptr
GetTraceEnableLevel proto __cdecl :TRACEHANDLE
GetTraceEnableFlags proto __cdecl :TRACEHANDLE
OpenTraceW proto __cdecl :PEVENT_TRACE_LOGFILEW
ProcessTrace proto __cdecl :PTRACEHANDLE, :ULONG, :LPFILETIME, :LPFILETIME
CloseTrace proto __cdecl :TRACEHANDLE
endif

if WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_DESKTOP)
OpenTraceA proto __cdecl :PEVENT_TRACE_LOGFILEA
SetTraceCallback proto __cdecl :LPCGUID, :PEVENT_CALLBACK
RemoveTraceCallback proto __cdecl :LPCGUID
endif

if WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_APP)
TraceMessage proto __Cdecl :TRACEHANDLE, :ULONG, :LPCGUID, :USHORT, :vararg
endif

if WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_DESKTOP)
TraceMessageVa proto __cdecl :TRACEHANDLE, :ULONG, :LPCGUID, :USHORT, :va_list
endif
endif

if WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_APP)
INVALID_PROCESSTRACE_HANDLE equ INVALID_HANDLE_VALUE
endif

ifndef _APISET_EVENTING

if defined(UNICODE) OR defined(_UNICODE)

if WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_APP)

RegisterTraceGuids	equ <RegisterTraceGuidsW>
StartTrace		equ <StartTraceW>
ControlTrace		equ <ControlTraceW>
if defined(__TRACE_W2K_COMPATIBLE)
StopTrace macro a,b,c
	exitm<ControlTraceW((a),(b),(c), EVENT_TRACE_CONTROL_STOP)>
	endm
QueryTrace macro a,b,c
	exitm<ControlTraceW((a),(b),(c), EVENT_TRACE_CONTROL_QUERY)>
	endm
UpdateTrace macro a,b,c
	exitm<ControlTraceW((a),(b),(c), EVENT_TRACE_CONTROL_UPDATE)>
	endm
else
StopTrace		equ <StopTraceW>
QueryTrace		equ <QueryTraceW>
UpdateTrace		equ <UpdateTraceW>
endif
if (NTDDI_VERSION GE NTDDI_WINXP)
FlushTrace		equ <FlushTraceW>
endif ;; NTDDI_VERSION GE NTDDI_WINXP
QueryAllTraces		equ <QueryAllTracesW>
OpenTrace		equ <OpenTraceW>

endif

else

if WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_DESKTOP)

RegisterTraceGuids	equ <RegisterTraceGuidsA>
StartTrace		equ <StartTraceA>
ControlTrace		equ <ControlTraceA>
if defined(__TRACE_W2K_COMPATIBLE)
StopTrace macro a,b,c
	exitm<ControlTraceA((a),(b),(c), EVENT_TRACE_CONTROL_STOP)>
	endm
QueryTrace macro a,b,c
	exitm<ControlTraceA((a),(b),(c), EVENT_TRACE_CONTROL_QUERY)>
	endm
UpdateTrace macro a,b,c
	exitm<ControlTraceA((a),(b),(c), EVENT_TRACE_CONTROL_UPDATE)>
	endm
else
StopTrace		equ <StopTraceA>
QueryTrace		equ <QueryTraceA>
UpdateTrace		equ <UpdateTraceA>
endif
if (NTDDI_VERSION GE NTDDI_WINXP)
FlushTrace		equ <FlushTraceA>
endif
QueryAllTraces		equ <QueryAllTracesA>
OpenTrace		equ <OpenTraceA>

endif
endif ;; UNICODE
endif ;; _APISET_EVENTING

endif ;; NOT _EVNTRACE_KERNEL_MODE

endif ;; WINNT
endif ;; _EVNTRACE_
