' ########################################################################################
' Microsoft Windows
' File: tdh.inc
' Contents: ETW Event payload parsing API && ETW trace providers browsing API
' Copyright (c) 2011 Jos? Roca
' Portions Copyright (c) Microsoft Corporation.
' All Rights Reserved.
' THIS CODE AND INFORMATION IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER
' EXPRESSED OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE IMPLIED WARRANTIES OF
' MERCHANTABILITY AND/OR FITNESS FOR A PARTICULAR PURPOSE.
' ########################################################################################
#IF NOT %DEF(PBX_tdh_PBI)
#DEFINE PBX_tdh_PBI
%EQUATE `TDH_INC = 1
#INCLUDE ONCE "Legacy/System/Evntrace.inc"
#INCLUDE ONCE "Legacy/System/evntcons.inc"
'typedef ULONG TDHSTATUS;
'#define TDHAPI TDHSTATUS __stdcall
%EQUATE `TDHCACHE_LINE = 8
'#define TDHCACHE_ALIGN __declspec(align(TDHCACHE_LINE))
'typedef TDHCACHE_ALIGN struct _EVENT_MAP_ENTRY {
' ULONG OutputOffset;
' union {
' ULONG Value; // For ULONG value (valuemap and bitmap)
' ULONG InputOffset; // For String value (patternmap or valuemap in WBEM)
' };
'} EVENT_MAP_ENTRY;
'typedef EVENT_MAP_ENTRY *PEVENT_MAP_ENTRY;
' // Size = 4 bytes
UNION EVENT_MAP_ENTRY_UNION DWORD
 Value AS DWORD ' ULONG // For ULONG value (valuemap and bitmap)
 InputOffset AS DWORD ' ULONG // For String value (patternmap or valuemap in WBEM)
END UNION
' // Size = 8 bytes
TYPE EVENT_MAP_ENTRY DWORD
 OutputOffset AS DWORD ' ULONG
 EVENT_MAP_ENTRY_UNION
END TYPE
' enum MAP_FLAGS
%EQUATE `EVENTMAP_INFO_FLAG_MANIFEST_VALUEMAP = &H1
%EQUATE `EVENTMAP_INFO_FLAG_MANIFEST_BITMAP = &H2
%EQUATE `EVENTMAP_INFO_FLAG_MANIFEST_PATTERNMAP = &H4
%EQUATE `EVENTMAP_INFO_FLAG_WBEM_VALUEMAP = &H8
%EQUATE `EVENTMAP_INFO_FLAG_WBEM_BITMAP = &H10
%EQUATE `EVENTMAP_INFO_FLAG_WBEM_FLAG = &H20
%EQUATE `EVENTMAP_INFO_FLAG_WBEM_NO_MAP = &H40
' enum MAP_VALUETYPE
%EQUATE `EVENTMAP_ENTRY_VALUETYPE_ULONG = 0
%EQUATE `EVENTMAP_ENTRY_VALUETYPE_STRING = 1
'typedef TDHCACHE_ALIGN struct _EVENT_MAP_INFO {
' ULONG NameOffset;
' MAP_FLAGS Flag;
' ULONG EntryCount;
' union {
' MAP_VALUETYPE MapEntryValueType;
' ULONG FormatStringOffset;
' };
'} EVENT_MAP_INFO;
'typedef EVENT_MAP_INFO *PEVENT_MAP_INFO;
' // Size = 4 bytes
UNION EVENT_MAP_INFO_UNION DWORD
 MapEntryValueType AS LONG ' MAP_VALUETYPE
 FormatStringOffset AS DWORD ' ULONG
END UNION
' // Size = 24 bytes
TYPE EVENT_MAP_INFO DWORD
 NameOffset AS DWORD ' ULONG
 Flag AS DWORD ' MAP_FLAGS
 EntryCount AS DWORD ' ULONG
 EVENT_MAP_INFO_UNION
 MapEntryArray(0) AS EVENT_MAP_ENTRY ' variable-length array
END TYPE
'// Intypes and outtypes are defined in winmeta.xml
' enum _TDH_IN_TYPE
%EQUATE `TDH_INTYPE_NULL = 0
%EQUATE `TDH_INTYPE_UNICODESTRING = 1
%EQUATE `TDH_INTYPE_ANSISTRING = 2
%EQUATE `TDH_INTYPE_INT8 = 3
%EQUATE `TDH_INTYPE_UINT8 = 4
%EQUATE `TDH_INTYPE_INT16 = 5
%EQUATE `TDH_INTYPE_UINT16 = 6
%EQUATE `TDH_INTYPE_INT32 = 7
%EQUATE `TDH_INTYPE_UINT32 = 8
%EQUATE `TDH_INTYPE_INT64 = 9
%EQUATE `TDH_INTYPE_UINT64 = 10
%EQUATE `TDH_INTYPE_FLOAT = 11
%EQUATE `TDH_INTYPE_DOUBLE = 12
%EQUATE `TDH_INTYPE_BOOLEAN = 13
%EQUATE `TDH_INTYPE_BINARY = 14
%EQUATE `TDH_INTYPE_GUID = 15
%EQUATE `TDH_INTYPE_POINTER = 16
%EQUATE `TDH_INTYPE_FILETIME = 17
%EQUATE `TDH_INTYPE_SYSTEMTIME = 18
%EQUATE `TDH_INTYPE_SID = 19
%EQUATE `TDH_INTYPE_HEXINT32 = 20
%EQUATE `TDH_INTYPE_HEXINT64 = 21 ' // end of winmeta intypes
%EQUATE `TDH_INTYPE_COUNTEDSTRING = 300 ' // start of TDH intypes for WBEM
%EQUATE `TDH_INTYPE_COUNTEDANSISTRING = 301
%EQUATE `TDH_INTYPE_REVERSEDCOUNTEDSTRING = 302
%EQUATE `TDH_INTYPE_REVERSEDCOUNTEDANSISTRING = 303
%EQUATE `TDH_INTYPE_NONNULLTERMINATEDSTRING = 304
%EQUATE `TDH_INTYPE_NONNULLTERMINATEDANSISTRING = 305
%EQUATE `TDH_INTYPE_UNICODECHAR = 306
%EQUATE `TDH_INTYPE_ANSICHAR = 307
%EQUATE `TDH_INTYPE_SIZET = 308
%EQUATE `TDH_INTYPE_HEXDUMP = 309
%EQUATE `TDH_INTYPE_WBEMSID = 310
' enum TDH_OUT_TYPE {
%EQUATE `TDH_OUTTYPE_NULL = 0
%EQUATE `TDH_OUTTYPE_STRING = 1
%EQUATE `TDH_OUTTYPE_DATETIME = 2
%EQUATE `TDH_OUTTYPE_BYTE = 3
%EQUATE `TDH_OUTTYPE_UNSIGNEDBYTE = 4
%EQUATE `TDH_OUTTYPE_SHORT = 5
%EQUATE `TDH_OUTTYPE_UNSIGNEDSHORT = 6
%EQUATE `TDH_OUTTYPE_INT = 7
%EQUATE `TDH_OUTTYPE_UNSIGNEDINT = 8
%EQUATE `TDH_OUTTYPE_LONG = 9
%EQUATE `TDH_OUTTYPE_UNSIGNEDLONG = 10
%EQUATE `TDH_OUTTYPE_FLOAT = 11
%EQUATE `TDH_OUTTYPE_DOUBLE = 12
%EQUATE `TDH_OUTTYPE_BOOLEAN = 13
%EQUATE `TDH_OUTTYPE_GUID = 14
%EQUATE `TDH_OUTTYPE_HEXBINARY = 15
%EQUATE `TDH_OUTTYPE_HEXINT8 = 16
%EQUATE `TDH_OUTTYPE_HEXINT16 = 17
%EQUATE `TDH_OUTTYPE_HEXINT32 = 18
%EQUATE `TDH_OUTTYPE_HEXINT64 = 19
%EQUATE `TDH_OUTTYPE_PID = 20
%EQUATE `TDH_OUTTYPE_TID = 21
%EQUATE `TDH_OUTTYPE_PORT = 22
%EQUATE `TDH_OUTTYPE_IPV4 = 23
%EQUATE `TDH_OUTTYPE_IPV6 = 24
%EQUATE `TDH_OUTTYPE_SOCKETADDRESS = 25
%EQUATE `TDH_OUTTYPE_CIMDATETIME = 26
%EQUATE `TDH_OUTTYPE_ETWTIME = 27
%EQUATE `TDH_OUTTYPE_XML = 28
%EQUATE `TDH_OUTYTPE_ERRORCODE = 29 ' // end of winmeta outtypes
%EQUATE `TDH_OUTTYPE_REDUCEDSTRING = 300 ' // start of TDH outtypes for WBEM
%EQUATE `TDH_OUTTYPE_NOPRINT = 301
' enum PROPERTY_FLAGS
%EQUATE `PropertyStruct = &H1 ' // type is struct.
%EQUATE `PropertyParamLength = &H2 ' // length field is index of param with length
%EQUATE `PropertyParamCount = &H4 ' // count file is index of param with count
%EQUATE `PropertyWBEMXmlFragment = &H8 ' // WBEM extension flag for property
%EQUATE `PropertyParamFixedLength = &H10 ' // length of the parameter is fixed.
'typedef TDHCACHE_ALIGN struct _EVENT_PROPERTY_INFO {
' PROPERTY_FLAGS Flags;
' ULONG NameOffset;
' union {
' struct _nonStructType {
' USHORT InType;
' USHORT OutType;
' ULONG MapNameOffset;
' } nonStructType;
' struct _structType {
' USHORT StructStartIndex;
' USHORT NumOfStructMembers;
' ULONG padding;
' } structType;
' };
' union {
' USHORT count;
' USHORT countPropertyIndex;
' };
' union {
' USHORT length;
' USHORT lengthPropertyIndex;
' };
' ULONG Reserved;
'} EVENT_PROPERTY_INFO;
'typedef EVENT_PROPERTY_INFO *PEVENT_PROPERTY_INFO;
' // Size = 8 bytes
TYPE EVENT_PROPERTY_INFO_UNION_1_STRUCT_1 DWORD FILL
 InType AS WORD ' USHORT
 OutType AS WORD ' USHORT
 MapNameOffset AS DWORD ' ULONG
END TYPE
' // Size = 8 bytes
TYPE EVENT_PROPERTY_INFO_UNION_1_STRUCT_2 DWORD FILL
 StructStartIndex AS WORD ' USHORT
 NumOfStructMembers AS WORD ' USHORT
 padding AS DWORD ' ULONG
END TYPE
' // Size = 8 bytes
UNION EVENT_PROPERTY_INFO_UNION_1 DWORD
 EVENT_PROPERTY_INFO_UNION_1_STRUCT_1
 EVENT_PROPERTY_INFO_UNION_1_STRUCT_2
END UNION
' // Size = 2 bytes
UNION EVENT_PROPERTY_INFO_UNION_2 WORD
 count AS WORD ' USHORT
 countPropertyIndex AS WORD ' USHORT
END UNION
' // Size = 2 bytes
UNION EVENT_PROPERTY_INFO_UNION_3 WORD
 length AS WORD ' USHORT
 lengthPropertyIndex AS WORD ' USHORT
END UNION
' // Size = 24 bytes
TYPE EVENT_PROPERTY_INFO DWORD FILL
 Flags AS DWORD ' PROPERTY_FLAGS
 NameOffset AS DWORD ' ULONG
 EVENT_PROPERTY_INFO_UNION_1
 EVENT_PROPERTY_INFO_UNION_2
 EVENT_PROPERTY_INFO_UNION_3
 Reserved AS DWORD ' ULONG
END TYPE
' enum DECODING_SOURCE
%EQUATE `DecodingSourceXMLFile = 0
%EQUATE `DecodingSourceWbem = 1
%EQUATE `DecodingSourceWPP = 2
'// Copy from Binres.h
' enum TEMPLATE_FLAGS
%EQUATE `TEMPLATE_EVENT_DATA = 1 ' // used when custom xml is not specified
%EQUATE `TEMPLATE_USER_DATA = 2 ' // used when custom xml is specified
'typedef TDHCACHE_ALIGN struct _TRACE_EVENT_INFO {
' GUID ProviderGuid;
' GUID EventGuid;
' EVENT_DESCRIPTOR EventDescriptor; // Loghorn 128 bits event description
' DECODING_SOURCE DecodingSource;
' ULONG ProviderNameOffset;
' ULONG LevelNameOffset;
' ULONG ChannelNameOffset;
' ULONG KeywordsNameOffset;
' ULONG TaskNameOffset;
' ULONG OpcodeNameOffset;
' ULONG EventMessageOffset;
' ULONG ProviderMessageOffset;
' ULONG BinaryXMLOffset;
' ULONG BinaryXMLSize;
' ULONG ActivityIDNameOffset;
' ULONG RelatedActivityIDNameOffset;
' ULONG PropertyCount;
' ULONG TopLevelPropertyCount;
' TEMPLATE_FLAGS Flags;
'} TRACE_EVENT_INFO;
'typedef TRACE_EVENT_INFO *PTRACE_EVENT_INFO;
' // Size = 136 bytes
TYPE TRACE_EVENT_INFO DWORD
 ProviderGuid AS GUID ' GUID
 EventGuid AS GUID ' GUID
 EventDescriptor AS EVENT_DESCRIPTOR ' // Loghorn 128 bits event description
 DecodingSource AS LONG ' DECODING_SOURCE
 ProviderNameOffset AS DWORD ' ULONG
 LevelNameOffset AS DWORD ' ULONG
 ChannelNameOffset AS DWORD ' ULONG
 KeywordsNameOffset AS DWORD ' ULONG
 TaskNameOffset AS DWORD ' ULONG
 OpcodeNameOffset AS DWORD ' ULONG
 EventMessageOffset AS DWORD ' ULONG
 ProviderMessageOffset AS DWORD ' ULONG
 BinaryXMLOffset AS DWORD ' ULONG
 BinaryXMLSize AS DWORD ' ULONG
 ActivityIDNameOffset AS DWORD ' ULONG
 RelatedActivityIDNameOffset AS DWORD ' ULONG
 PropertyCount AS DWORD ' ULONG
 TopLevelPropertyCount AS DWORD ' ULONG
 Flags AS DWORD ' TEMPLATE_FLAGS
 EventPropertyInfoArray(0) AS EVENT_PROPERTY_INFO ' variable-length array
END TYPE
'typedef TDHCACHE_ALIGN struct _PROPERTY_DATA_DESCRIPTOR {
' ULONGLONG PropertyName; // Pointer to property name
' ULONG ArrayIndex; // Array Index
' ULONG Reserved;
'} PROPERTY_DATA_DESCRIPTOR;
'typedef PROPERTY_DATA_DESCRIPTOR *PPROPERTY_DATA_DESCRIPTOR;
' // Size = 16 bytes
TYPE PROPERTY_DATA_DESCRIPTOR ' Must be 8 byte aligned
 PropertyName AS QUAD ' ULONGLONG // Pointer to property name
 ArrayIndex AS DWORD ' ULONG // Array Index
 Reserved AS DWORD ' ULONG
END TYPE
'// Provider Enumeration
' enum EVENT_FIELD_TYPE
%EQUATE `EventKeywordInformation = 0
%EQUATE `EventLevelInformation = 1
%EQUATE `EventChannelInformation = 2
%EQUATE `EventTaskInformation = 3
%EQUATE `EventOpcodeInformation = 4
%EQUATE `EventInformationMax = 5
'typedef TDHCACHE_ALIGN struct _PROVIDER_FIELD_INFO {
' ULONG NameOffset; // English only
' ULONG DescriptionOffset; // Localization String
' ULONGLONG Value;
'} PROVIDER_FIELD_INFO;
'typedef PROVIDER_FIELD_INFO *PPROVIDER_FIELD_INFO;
' // Size = 16 bytes
TYPE PROVIDER_FIELD_INFO ' Must be 8 byte aligned
 NameOffset AS DWORD ' ULONG // English only
 DescriptionOffset AS DWORD ' ULONG // Localization String
 Value AS QUAD ' ULONGLONG
END TYPE
'typedef TDHCACHE_ALIGN struct _PROVIDER_FIELD_INFOARRAY {
' ULONG NumberOfElements;
' EVENT_FIELD_TYPE FieldType;
' PROVIDER_FIELD_INFO FieldInfoArray[ANYSIZE_ARRAY];
'} PROVIDER_FIELD_INFOARRAY;
'typedef PROVIDER_FIELD_INFOARRAY *PPROVIDER_FIELD_INFOARRAY;
' // Size = 24 bytes
TYPE PROVIDER_FIELD_INFOARRAY DWORD
 NumberOfElements AS DWORD ' ULONG
 FieldType AS LONG ' EVENT_FIELD_TYPE
 FieldInfoArray(0) AS PROVIDER_FIELD_INFO ' variable-length array
END TYPE
'typedef TDHCACHE_ALIGN struct _TRACE_PROVIDER_INFO {
' GUID ProviderGuid;
' ULONG SchemaSource;
' ULONG ProviderNameOffset;
'} TRACE_PROVIDER_INFO;
'typedef TRACE_PROVIDER_INFO *PTRACE_PROVIDER_INFO;
' // Size = 24 bytes
TYPE TRACE_PROVIDER_INFO DWORD
 ProviderGuid AS GUID ' GUID
 SchemaSource AS DWORD ' ULONG
 ProviderNameOffset AS DWORD ' ULONG
END TYPE
'typedef TDHCACHE_ALIGN struct _PROVIDER_ENUMERATION_INFO {
' ULONG NumberOfProviders;
' ULONG Padding; // for 8 bytes alignment
'} PROVIDER_ENUMERATION_INFO;
'typedef PROVIDER_ENUMERATION_INFO *PPROVIDER_ENUMERATION_INFO;
' // Size = 32 bytes
TYPE PROVIDER_ENUMERATION_INFO DWORD
 NumberOfProviders AS DWORD ' ULONG
 Padding AS DWORD ' ULONG // for 8 bytes alignment
 TraceProviderInfoArray(0) AS TRACE_PROVIDER_INFO ' variable-length array
END TYPE
' enum TDH_CONTEXT_TYPE
%EQUATE `TDH_CONTEXT_WPP_TMFFILE = 0
%EQUATE `TDH_CONTEXT_WPP_TMFSEARCHPATH = 1
%EQUATE `TDH_CONTEXT_WPP_GMT = 2
%EQUATE `TDH_CONTEXT_POINTERSIZE = 3
%EQUATE `TDH_CONTEXT_MAXIMUM = 4
'typedef TDHCACHE_ALIGN struct _TDH_CONTEXT {
' ULONGLONG ParameterValue; // Pointer to Data
' TDH_CONTEXT_TYPE ParameterType;
' ULONG ParameterSize;
'} TDH_CONTEXT;
'typedef TDH_CONTEXT *PTDH_CONTEXT;
' // Size = 16 bytes
TYPE TDH_CONTEXT ' Must be 8 byte aligned
 ParameterValue AS QUAD ' ULONGLONG // Pointer to Data
 ParameterType AS LONG ' TDH_CONTEXT_TYPE
 ParameterSize AS DWORD ' ULONG
END TYPE
DECLARE FUNCTION TdhGetEventInformation LIB "tdh.dll" ALIAS "TdhGetEventInformation" ( BYREF pEvent AS EVENT_RECORD , BYVAL TdhContextCount AS QUAD , BYREF pTdhContext AS TDH_CONTEXT , BYREF pBuffer AS ANY , BYREF pBufferSize AS QUAD ) AS QUAD ' ULONG
DECLARE FUNCTION TdhGetEventMapInformation LIB "tdh.dll" ALIAS "TdhGetEventMapInformation" ( BYREF pEvent AS EVENT_RECORD , BYREF pMapName AS WSTRINGZ , BYREF pBuffer AS EVENT_MAP_INFO , BYREF pBufferSize AS QUAD ) AS QUAD ' ULONG
DECLARE FUNCTION TdhGetPropertySize LIB "tdh.dll" ALIAS "TdhGetPropertySize" ( BYREF pEvent AS EVENT_RECORD , BYVAL TdhContextCount AS QUAD , BYVAL pTdhContext AS LONG , BYVAL PropertyDataCount AS QUAD , BYREF pPropertyData AS PROPERTY_DATA_DESCRIPTOR , BYREF pPropertySize AS QUAD ) AS QUAD ' ULONG
DECLARE FUNCTION TdhGetProperty LIB "tdh.dll" ALIAS "TdhGetProperty" ( BYREF pEvent AS EVENT_RECORD , BYVAL TdhContextCount AS QUAD , BYVAL pTdhContext AS LONG , BYVAL PropertyDataCount AS QUAD , BYREF pPropertyData AS PROPERTY_DATA_DESCRIPTOR , BYVAL BufferSize AS QUAD , BYREF pBuffer AS ANY ) AS QUAD ' ULONG
DECLARE FUNCTION TdhEnumerateProviders LIB "tdh.dll" ALIAS "TdhEnumerateProviders" ( BYREF pBuffer AS PROVIDER_ENUMERATION_INFO , BYREF pBufferSize AS QUAD ) AS QUAD ' ULONG
DECLARE FUNCTION TdhQueryProviderFieldInformation LIB "tdh.dll" ALIAS "TdhQueryProviderFieldInformation" ( BYREF pGuid AS GUID , BYVAL EventFieldValue AS QUAD , BYVAL EventFieldType AS LONG , BYREF pBuffer AS PROVIDER_FIELD_INFOARRAY , BYREF pBufferSize AS QUAD ) AS QUAD ' ULONG
DECLARE FUNCTION TdhEnumerateProviderFieldInformation LIB "tdh.dll" ALIAS "TdhEnumerateProviderFieldInformation" ( BYREF pGuid AS GUID , BYVAL EventFieldType AS LONG , BYREF pBuffer AS PROVIDER_FIELD_INFOARRAY , BYREF pBufferSize AS QUAD ) AS QUAD ' ULONG
#ENDIF
