' ########################################################################################
' Microsoft Windows
' File: evntprov.inc
' Contents: Unified provider side user mode API.
' Copyright (c) 2011 Jos? Roca
' Portions Copyright (c) Microsoft Corporation.
' All Rights Reserved.
' THIS CODE AND INFORMATION IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER
' EXPRESSED OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE IMPLIED WARRANTIES OF
' MERCHANTABILITY AND/OR FITNESS FOR A PARTICULAR PURPOSE.
' ########################################################################################
#IF NOT %DEF(PBX_evntprov_PBI)
#DEFINE PBX_evntprov_PBI
%EQUATE `EVNTPROV_INC = 1
%EQUATE `EVENT_MIN_LEVEL = 0
%EQUATE `EVENT_MAX_LEVEL = &Hff
%EQUATE `EVENT_ACTIVITY_CTRL_GET_ID = 1
%EQUATE `EVENT_ACTIVITY_CTRL_SET_ID = 2
%EQUATE `EVENT_ACTIVITY_CTRL_CREATE_ID = 3
%EQUATE `EVENT_ACTIVITY_CTRL_GET_SET_ID = 4
%EQUATE `EVENT_ACTIVITY_CTRL_CREATE_SET_ID = 5
'typedef ULONGLONG REGHANDLE, *PREGHANDLE;
%EQUATE `MAX_EVENT_DATA_DESCRIPTORS = 128
%EQUATE `MAX_EVENT_FILTER_DATA_SIZE = 1024
%EQUATE `EVENT_FILTER_TYPE_SCHEMATIZED = &H80000000
'//
'// EVENT_DATA_DESCRIPTOR is used to pass in user data items
'// in events.
'//
' // Size = 16 bytes
TYPE EVENT_DATA_DESCRIPTOR DWORD
 Ptr AS QUAD ' ULONGLONG // Pointer to data
 Size AS DWORD ' ULONG // Size of data in bytes
 Reserved AS DWORD ' ULONG
END TYPE
'//
'// EVENT_DESCRIPTOR describes and categorizes an event.
'//
' // Size = 16 bytes
TYPE EVENT_DESCRIPTOR BYTE
 Id AS WORD ' USHORT
 Version AS BYTE ' UCHAR
 Channel AS BYTE ' UCHAR
 Level AS BYTE ' UCHAR
 Opcode AS BYTE ' UCHAR
 Task AS WORD ' USHORT
 Keyword AS QUAD ' ULONGLONG
END TYPE
'//
'// EVENT_FILTER_DESCRIPTOR is used to pass in enable filter
'// data item to a user callback function.
'//
' // Size = 16 bytes
TYPE EVENT_FILTER_DESCRIPTOR DWORD
 Ptr AS QUAD ' ULONGLONG
 Size AS DWORD ' ULONG
 Type AS DWORD ' ULONG
END TYPE
' // Size = 24 bytes
TYPE EVENT_FILTER_HEADER BYTE
 Id AS WORD ' USHORT
 Version AS BYTE ' UCHAR
 Reserved(4) AS BYTE ' UCHAR[5]
 InstanceId AS QUAD ' ULONGLONG
 Size AS DWORD ' ULONG
 NextOffset AS DWORD ' ULONG
END TYPE
'#ifndef _ETW_KM_
'//
'// Optional callback function that users provide
'//
'typedef
'(NTAPI *PENABLECALLBACK) (
' );
'SUB EnableCallback ( ' BYREF GUID
' , BYVAL DWORD
' , BYVAL BYTE
' , BYVAL QUAD
' , BYVAL QUAD
' , BYREF EVENT_FILTER_DESCRIPTOR
' , BYVAL DWORD
' )
'//
'// Registration APIs
'//
'#if (WINVER >= _WIN32_WINNT_VISTA)
DECLARE FUNCTION EventRegister LIB "advapi32.dll" ALIAS "EventRegister" ( BYREF ProviderId AS GUID , BYVAL EnableCallback AS QUAD , BYVAL CallbackContext AS QUAD , BYREF RegHandle AS QUAD ) AS QUAD ' ULONG
'#endif
'#if (WINVER >= _WIN32_WINNT_VISTA)
DECLARE FUNCTION EventUnregister LIB "advapi32.dll" ALIAS "EventUnregister" ( BYVAL RegHandle AS QUAD ) AS QUAD ' ULONG
'#endif
'//
'// Control (Is Enabled) APIs
'//
'#if (WINVER >= _WIN32_WINNT_VISTA)
DECLARE FUNCTION EventEnabled LIB "advapi32.dll" ALIAS "EventEnabled" ( BYVAL RegHandle AS QUAD , BYREF EventDescriptor AS EVENT_DESCRIPTOR ) AS BYTE ' BOOLEAN
'#endif
'#if (WINVER >= _WIN32_WINNT_VISTA)
DECLARE FUNCTION EventProviderEnabled LIB "advapi32.dll" ALIAS "EventProviderEnabled" ( BYVAL RegHandle AS QUAD , BYVAL Level AS BYTE , BYVAL Keyword AS QUAD ) AS BYTE ' BOOLEAN
'#endif
'//
'// Writing (Publishing/Logging) APIs
'//
'#if (WINVER >= _WIN32_WINNT_VISTA)
DECLARE FUNCTION EventWrite LIB "advapi32.dll" ALIAS "EventWrite" ( BYVAL RegHandle AS QUAD , BYREF EventDescriptor AS EVENT_DESCRIPTOR , BYVAL UserDataCount AS QUAD , BYREF UserData AS EVENT_DATA_DESCRIPTOR ) AS QUAD ' ULONG
'#endif
'#if (WINVER >= _WIN32_WINNT_VISTA)
DECLARE FUNCTION EventWriteTransfer LIB "advapi32.dll" ALIAS "EventWriteTransfer" ( BYVAL RegHandle AS QUAD , BYREF EventDescriptor AS EVENT_DESCRIPTOR , BYREF ActivityId AS GUID , BYREF RelatedActivityId AS GUID , BYVAL UserDataCount AS QUAD , BYREF UserData AS EVENT_DATA_DESCRIPTOR ) AS QUAD ' ULONG
'#endif
'#if (WINVER >= _WIN32_WINNT_WIN7)
DECLARE FUNCTION EventWriteEx LIB "advapi32.dll" ALIAS "EventWriteEx" ( BYVAL RegHandle AS QUAD , BYREF EventDescriptor AS EVENT_DESCRIPTOR , BYVAL Filter AS QUAD , BYVAL Flags AS QUAD , BYREF ActivityId AS GUID , BYREF RelatedActivityId AS GUID , BYVAL UserDataCount AS QUAD , BYREF UserData AS EVENT_DATA_DESCRIPTOR ) AS QUAD ' ULONG
'#endif
'#if (WINVER >= _WIN32_WINNT_VISTA)
DECLARE FUNCTION EventWriteString LIB "advapi32.dll" ALIAS "EventWriteString" ( BYVAL RegHandle AS QUAD , BYVAL Level AS BYTE , BYVAL Keyword AS QUAD , BYREF String AS WSTRINGZ ) AS QUAD ' ULONG
'#endif
'//
'// ActivityId Control APIs
'//
'#if (WINVER >= _WIN32_WINNT_VISTA)
DECLARE FUNCTION EventActivityIdControl LIB "advapi32.dll" ALIAS "EventActivityIdControl" ( BYVAL ControlCode AS QUAD , BYREF ActivityId AS GUID ) AS QUAD ' ULONG
'#endif
'#endif // _ETW_KM_
' Note: I haven't translated the following macros because they're silly.
'//
'// Macros to create Event and Event Data Descriptors
'//
'FORCEINLINE
'EventDataDescCreate(
' )
'{
' EventDataDescriptor->Ptr = (ULONGLONG)(ULONG_PTR)DataPtr;
' EventDataDescriptor->Size = DataSize;
' EventDataDescriptor->Reserved = 0;
' return;
'}
'FORCEINLINE
'EventDescCreate(
' )
'{
' EventDescriptor->Id = Id;
' EventDescriptor->Version = Version;
' EventDescriptor->Channel = Channel;
' EventDescriptor->Level = Level;
' EventDescriptor->Task = Task;
' EventDescriptor->Opcode = Opcode;
' EventDescriptor->Keyword = Keyword;
' return;
'}
'FORCEINLINE
'EventDescZero(
' )
'{
' memset(EventDescriptor, 0, sizeof(EVENT_DESCRIPTOR));
' return;
'}
'//
'// Macros to extract info from an Event Descriptor
'//
'FORCEINLINE
'USHORT
'EventDescGetId(
' )
'{
' return (EventDescriptor->Id);
'}
'FORCEINLINE
'UCHAR
'EventDescGetVersion(
' )
'{
' return (EventDescriptor->Version);
'}
'FORCEINLINE
'USHORT
'EventDescGetTask(
' )
'{
' return (EventDescriptor->Task);
'}
'FORCEINLINE
'UCHAR
'EventDescGetOpcode(
' )
'{
' return (EventDescriptor->Opcode);
'}
'FORCEINLINE
'UCHAR
'EventDescGetChannel(
' )
'{
' return (EventDescriptor->Channel);
'}
'FORCEINLINE
'UCHAR
'EventDescGetLevel(
' )
'{
' return (EventDescriptor->Level);
'}
'FORCEINLINE
'ULONGLONG
'EventDescGetKeyword(
' )
'{
' return (EventDescriptor->Keyword);
'}
'//
'// Macros to set info into an Event Descriptor
'//
'FORCEINLINE
'PEVENT_DESCRIPTOR
'EventDescSetId(
' )
'{
' EventDescriptor->Id = Id;
' return (EventDescriptor);
'}
'FORCEINLINE
'PEVENT_DESCRIPTOR
'EventDescSetVersion(
' )
'{
' EventDescriptor->Version = Version;
' return (EventDescriptor);
'}
'FORCEINLINE
'PEVENT_DESCRIPTOR
'EventDescSetTask(
' )
'{
' EventDescriptor->Task = Task;
' return (EventDescriptor);
'}
'FORCEINLINE
'PEVENT_DESCRIPTOR
'EventDescSetOpcode(
' )
'{
' EventDescriptor->Opcode = Opcode;
' return (EventDescriptor);
'}
'FORCEINLINE
'PEVENT_DESCRIPTOR
'EventDescSetLevel(
' )
'{
' EventDescriptor->Level = Level;
' return (EventDescriptor);
'}
'FORCEINLINE
'PEVENT_DESCRIPTOR
'EventDescSetChannel(
' )
'{
' EventDescriptor->Channel = Channel;
' return (EventDescriptor);
'}
'FORCEINLINE
'PEVENT_DESCRIPTOR
'EventDescSetKeyword(
' )
'{
' EventDescriptor->Keyword = Keyword;
' return (EventDescriptor);
'}
'FORCEINLINE
'PEVENT_DESCRIPTOR
'EventDescOrKeyword(
' )
'{
' EventDescriptor->Keyword |= Keyword;
' return (EventDescriptor);
'}
#ENDIF
