Headers diff for tdh.dll between 6.3.9600.17415-Windows 8.1 and 10.0.10586.0-Windows 10 1511 10586.494 versions



 tdh.h (6.3.9600.17415-Windows 8.1)   tdh.h (10.0.10586.0-Windows 10 1511 10586.494) 
skipping to change at line 19 skipping to change at line 19
Abstract: Abstract:
ETW Event payload parsing API && ETW trace providers browsing API. ETW Event payload parsing API && ETW trace providers browsing API.
--*/ --*/
#ifndef __TDH_H__ #ifndef __TDH_H__
#define __TDH_H__ #define __TDH_H__
#include <winapifamily.h> #include <winapifamily.h>
#pragma region Desktop Family #pragma region Desktop Family or OneCore Family
#if WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_DESKTOP) #if WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_DESKTOP | WINAPI_PARTITION_SYSTEM)
#ifdef __cplusplus #ifdef __cplusplus
extern "C" { extern "C" {
#endif #endif
#include <wmistr.h> #include <wmistr.h>
#include <evntrace.h> #include <evntrace.h>
#include <evntcons.h> #include <evntcons.h>
#pragma warning(push) #pragma warning(push)
skipping to change at line 163 skipping to change at line 163
#define TDH_OUTYTPE_ERRORCODE TDH_OUTTYPE_ERRORCODE #define TDH_OUTYTPE_ERRORCODE TDH_OUTTYPE_ERRORCODE
typedef enum _PROPERTY_FLAGS typedef enum _PROPERTY_FLAGS
{ {
PropertyStruct = 0x1, // Type is struct. PropertyStruct = 0x1, // Type is struct.
PropertyParamLength = 0x2, // Length field is index of param with leng th. PropertyParamLength = 0x2, // Length field is index of param with leng th.
PropertyParamCount = 0x4, // Count file is index of param with count. PropertyParamCount = 0x4, // Count file is index of param with count.
PropertyWBEMXmlFragment = 0x8, // WBEM extension flag for property. PropertyWBEMXmlFragment = 0x8, // WBEM extension flag for property.
PropertyParamFixedLength = 0x10, // Length of the parameter is fixed. PropertyParamFixedLength = 0x10, // Length of the parameter is fixed.
PropertyParamFixedCount = 0x20, // Count of the parameter is fixed. PropertyParamFixedCount = 0x20, // Count of the parameter is fixed.
PropertyHasTags = 0x40 // The Tags field has been initialized. PropertyHasTags = 0x40, // The Tags field has been initialized.
PropertyHasCustomSchema = 0x80, // Type is described with a custom schema.
} PROPERTY_FLAGS; } PROPERTY_FLAGS;
typedef struct _EVENT_PROPERTY_INFO { typedef struct _EVENT_PROPERTY_INFO {
PROPERTY_FLAGS Flags; PROPERTY_FLAGS Flags;
ULONG NameOffset; ULONG NameOffset;
union { union {
struct _nonStructType { struct _nonStructType {
USHORT InType; USHORT InType;
USHORT OutType; USHORT OutType;
ULONG MapNameOffset; ULONG MapNameOffset;
} nonStructType; } nonStructType;
struct _structType { struct _structType {
USHORT StructStartIndex; USHORT StructStartIndex;
USHORT NumOfStructMembers; USHORT NumOfStructMembers;
ULONG padding; ULONG padding;
} structType; } structType;
struct _customSchemaType {
USHORT padding2;
USHORT OutType;
ULONG CustomSchemaOffset;
} customSchemaType;
}; };
union { union {
USHORT count; USHORT count;
USHORT countPropertyIndex; USHORT countPropertyIndex;
}; };
union { union {
USHORT length; USHORT length;
USHORT lengthPropertyIndex; USHORT lengthPropertyIndex;
}; };
union { union {
skipping to change at line 231 skipping to change at line 237
ULONG KeywordsNameOffset; ULONG KeywordsNameOffset;
ULONG TaskNameOffset; ULONG TaskNameOffset;
ULONG OpcodeNameOffset; ULONG OpcodeNameOffset;
ULONG EventMessageOffset; ULONG EventMessageOffset;
ULONG ProviderMessageOffset; ULONG ProviderMessageOffset;
ULONG BinaryXMLOffset; ULONG BinaryXMLOffset;
ULONG BinaryXMLSize; ULONG BinaryXMLSize;
ULONG ActivityIDNameOffset; ULONG ActivityIDNameOffset;
ULONG RelatedActivityIDNameOffset; ULONG RelatedActivityIDNameOffset;
ULONG PropertyCount; ULONG PropertyCount;
ULONG TopLevelPropertyCount; _Field_range_(0, PropertyCount) ULONG TopLevelPropertyCount;
union { union {
TEMPLATE_FLAGS Flags; TEMPLATE_FLAGS Flags;
struct { struct {
ULONG Reserved : 4; // TEMPLATE_FLAGS values ULONG Reserved : 4; // TEMPLATE_FLAGS values
ULONG Tags : 28; ULONG Tags : 28;
}; };
}; };
_Field_size_(PropertyCount) EVENT_PROPERTY_INFO EventPropertyInfoArray[ANYSI ZE_ARRAY]; _Field_size_(PropertyCount) EVENT_PROPERTY_INFO EventPropertyInfoArray[ANYSI ZE_ARRAY];
} TRACE_EVENT_INFO; } TRACE_EVENT_INFO;
typedef TRACE_EVENT_INFO *PTRACE_EVENT_INFO; typedef TRACE_EVENT_INFO *PTRACE_EVENT_INFO;
typedef struct _PROPERTY_DATA_DESCRIPTOR { typedef struct _PROPERTY_DATA_DESCRIPTOR {
ULONGLONG PropertyName; // Pointer to property name. ULONGLONG PropertyName; // Pointer to property name.
ULONG ArrayIndex; // Array Index. ULONG ArrayIndex; // Array Index.
ULONG Reserved; ULONG Reserved;
} PROPERTY_DATA_DESCRIPTOR; } PROPERTY_DATA_DESCRIPTOR;
typedef PROPERTY_DATA_DESCRIPTOR *PPROPERTY_DATA_DESCRIPTOR; typedef PROPERTY_DATA_DESCRIPTOR *PPROPERTY_DATA_DESCRIPTOR;
#endif /* WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_DESKTOP | WINAPI_PARTITION_SY
STEM) */
#pragma endregion
#pragma region Desktop Family
#if WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_DESKTOP)
// //
// ETW Payload Filtering Tdh support // ETW Payload Filtering Tdh support
// //
// //
// Payload filtering definitions // Payload filtering definitions
// //
// //
// TDH_PAYLOADFIELD_OPERATORs are used to build Payload filters. // TDH_PAYLOADFIELD_OPERATORs are used to build Payload filters.
skipping to change at line 353 skipping to change at line 365
typedef struct _PROVIDER_FILTER_INFO { typedef struct _PROVIDER_FILTER_INFO {
UCHAR Id; UCHAR Id;
UCHAR Version; UCHAR Version;
ULONG MessageOffset; ULONG MessageOffset;
ULONG Reserved; ULONG Reserved;
ULONG PropertyCount; ULONG PropertyCount;
_Field_size_(PropertyCount) EVENT_PROPERTY_INFO EventPropertyInfoArray[ANYSI ZE_ARRAY]; _Field_size_(PropertyCount) EVENT_PROPERTY_INFO EventPropertyInfoArray[ANYSI ZE_ARRAY];
} PROVIDER_FILTER_INFO, *PPROVIDER_FILTER_INFO; } PROVIDER_FILTER_INFO, *PPROVIDER_FILTER_INFO;
#endif /* WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_DESKTOP) */
#pragma endregion
#pragma region Desktop Family or OneCore Family
#if WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_DESKTOP | WINAPI_PARTITION_SYSTEM)
// Provider Enumeration. // Provider Enumeration.
typedef enum _EVENT_FIELD_TYPE { typedef enum _EVENT_FIELD_TYPE {
EventKeywordInformation = 0, EventKeywordInformation = 0,
EventLevelInformation, EventLevelInformation,
EventChannelInformation, EventChannelInformation,
EventTaskInformation, EventTaskInformation,
EventOpcodeInformation, EventOpcodeInformation,
EventInformationMax EventInformationMax
} EVENT_FIELD_TYPE; } EVENT_FIELD_TYPE;
skipping to change at line 476 skipping to change at line 494
); );
TDHAPI TDHAPI
TdhEnumerateProviderFieldInformation( TdhEnumerateProviderFieldInformation(
_In_ LPGUID pGuid, _In_ LPGUID pGuid,
_In_ EVENT_FIELD_TYPE EventFieldType, _In_ EVENT_FIELD_TYPE EventFieldType,
_Out_writes_bytes_opt_(*pBufferSize) PPROVIDER_FIELD_INFOARRAY pBuffer, _Out_writes_bytes_opt_(*pBufferSize) PPROVIDER_FIELD_INFOARRAY pBuffer,
_Inout_ ULONG *pBufferSize _Inout_ ULONG *pBufferSize
); );
#endif /* WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_DESKTOP | WINAPI_PARTITION_SY
STEM) */
#pragma endregion
#pragma region Desktop Family
#if WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_DESKTOP)
#if (WINVER >= _WIN32_WINNT_WIN7) #if (WINVER >= _WIN32_WINNT_WIN7)
TDHAPI TDHAPI
TdhEnumerateProviderFilters( TdhEnumerateProviderFilters(
_In_ LPGUID Guid, _In_ LPGUID Guid,
_In_ ULONG TdhContextCount, _In_ ULONG TdhContextCount,
_In_reads_opt_(TdhContextCount) PTDH_CONTEXT TdhContext, _In_reads_opt_(TdhContextCount) PTDH_CONTEXT TdhContext,
_Out_ ULONG *FilterCount, _Out_ ULONG *FilterCount,
_Out_writes_bytes_opt_(*BufferSize) PPROVIDER_FILTER_INFO *Buffer, _Out_writes_bytes_opt_(*BufferSize) PPROVIDER_FILTER_INFO *Buffer,
_Inout_ ULONG *BufferSize _Inout_ ULONG *BufferSize
); );
#endif #endif
#endif /* WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_DESKTOP) */
#pragma region Desktop Family or OneCore Family
#if WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_DESKTOP | WINAPI_PARTITION_SYSTEM)
#if (WINVER >= _WIN32_WINNT_WIN7) #if (WINVER >= _WIN32_WINNT_WIN7)
TDHAPI TDHAPI
TdhLoadManifest( TdhLoadManifest(
_In_ PWSTR Manifest _In_ PWSTR Manifest
); );
#endif #endif
#if (WINVER >= _WIN32_WINNT_WIN7) #if (WINVER >= _WIN32_WINNT_WIN7)
TDHAPI TDHAPI
TdhUnloadManifest( TdhUnloadManifest(
skipping to change at line 519 skipping to change at line 548
_In_ USHORT PropertyOutType, _In_ USHORT PropertyOutType,
_In_ USHORT PropertyLength, _In_ USHORT PropertyLength,
_In_ USHORT UserDataLength, _In_ USHORT UserDataLength,
_In_reads_bytes_(UserDataLength) PBYTE UserData, _In_reads_bytes_(UserDataLength) PBYTE UserData,
_Inout_ PULONG BufferSize, _Inout_ PULONG BufferSize,
_Out_writes_bytes_opt_(*BufferSize) PWCHAR Buffer, _Out_writes_bytes_opt_(*BufferSize) PWCHAR Buffer,
_Out_ PUSHORT UserDataConsumed _Out_ PUSHORT UserDataConsumed
); );
#endif #endif
#endif /* WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_DESKTOP | WINAPI_PARTITION_SY
STEM) */
#pragma endregion
#pragma region Desktop Family
#if WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_DESKTOP)
#if (WINVER >= _WIN32_WINNT_WIN8) #if (WINVER >= _WIN32_WINNT_WIN8)
TDHAPI TDHAPI
TdhOpenDecodingHandle( TdhOpenDecodingHandle(
_Out_ PTDH_HANDLE Handle _Out_ PTDH_HANDLE Handle
); );
#endif #endif
#if (WINVER >= _WIN32_WINNT_WIN8) #if (WINVER >= _WIN32_WINNT_WIN8)
TDHAPI TDHAPI
TdhSetDecodingParameter( TdhSetDecodingParameter(
skipping to change at line 577 skipping to change at line 612
); );
#endif #endif
#if (WINVER >= _WIN32_WINNT_WIN8) #if (WINVER >= _WIN32_WINNT_WIN8)
TDHAPI TDHAPI
TdhLoadManifestFromBinary( TdhLoadManifestFromBinary(
_In_ PWSTR BinaryPath _In_ PWSTR BinaryPath
); );
#endif #endif
#endif /* WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_DESKTOP) */
#pragma endregion
#pragma region Desktop Family or OneCore Family
#if WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_DESKTOP | WINAPI_PARTITION_SYSTEM)
#if (WINVER >= _WIN32_WINNT_WINBLUE) #if (WINVER >= _WIN32_WINNT_WINBLUE)
TDHAPI TDHAPI
TdhEnumerateManifestProviderEvents ( TdhEnumerateManifestProviderEvents (
_In_ LPGUID ProviderGuid, _In_ LPGUID ProviderGuid,
_Out_writes_bytes_opt_(*BufferSize) PPROVIDER_EVENT_INFO Buffer, _Out_writes_bytes_opt_(*BufferSize) PPROVIDER_EVENT_INFO Buffer,
_Inout_ ULONG *BufferSize _Inout_ ULONG *BufferSize
); );
#endif #endif
#if (WINVER >= _WIN32_WINNT_WINBLUE) #if (WINVER >= _WIN32_WINNT_WINBLUE)
skipping to change at line 786 skipping to change at line 827
PWSTR PWSTR
TEI_RELATEDACTIVITYID_NAME( TEI_RELATEDACTIVITYID_NAME(
_In_ PTRACE_EVENT_INFO EventInfo _In_ PTRACE_EVENT_INFO EventInfo
) )
{ {
return (EventInfo->RelatedActivityIDNameOffset == 0) ? return (EventInfo->RelatedActivityIDNameOffset == 0) ?
NULL : NULL :
(PWSTR)((PBYTE)EventInfo + EventInfo->RelatedActivityIDNameOffset); (PWSTR)((PBYTE)EventInfo + EventInfo->RelatedActivityIDNameOffset);
} }
#endif /* WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_DESKTOP | WINAPI_PARTITION_SY
STEM) */
#pragma endregion
#pragma region Desktop Family
#if WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_DESKTOP)
#if (WINVER >= _WIN32_WINNT_WIN7) #if (WINVER >= _WIN32_WINNT_WIN7)
FORCEINLINE FORCEINLINE
PWSTR PWSTR
PFI_FILTER_MESSAGE( PFI_FILTER_MESSAGE(
_In_ PPROVIDER_FILTER_INFO FilterInfo _In_ PPROVIDER_FILTER_INFO FilterInfo
) )
{ {
return (FilterInfo->MessageOffset == 0) ? return (FilterInfo->MessageOffset == 0) ?
NULL : NULL :
(PWSTR)((PBYTE)FilterInfo + FilterInfo->MessageOffset); (PWSTR)((PBYTE)FilterInfo + FilterInfo->MessageOffset);
skipping to change at line 813 skipping to change at line 860
_In_ PPROVIDER_FILTER_INFO FilterInfo, _In_ PPROVIDER_FILTER_INFO FilterInfo,
_In_ PEVENT_PROPERTY_INFO Property _In_ PEVENT_PROPERTY_INFO Property
) )
{ {
return (Property->NameOffset == 0) ? return (Property->NameOffset == 0) ?
NULL : NULL :
(PWSTR)((PBYTE)FilterInfo + Property->NameOffset); (PWSTR)((PBYTE)FilterInfo + Property->NameOffset);
} }
#endif #endif
#endif /* WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_DESKTOP) */
#pragma endregion
#pragma region Desktop Family or OneCore Family
#if WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_DESKTOP | WINAPI_PARTITION_SYSTEM)
FORCEINLINE FORCEINLINE
PWSTR PWSTR
PFI_FIELD_NAME( PFI_FIELD_NAME(
_In_ PPROVIDER_FIELD_INFOARRAY FieldInfoArray, _In_ PPROVIDER_FIELD_INFOARRAY FieldInfoArray,
_In_ PPROVIDER_FIELD_INFO FieldInfo _In_ PPROVIDER_FIELD_INFO FieldInfo
) )
{ {
return (FieldInfo->NameOffset == 0) ? return (FieldInfo->NameOffset == 0) ?
NULL : NULL :
(PWSTR)((PBYTE)FieldInfoArray + FieldInfo->NameOffset); (PWSTR)((PBYTE)FieldInfoArray + FieldInfo->NameOffset);
skipping to change at line 855 skipping to change at line 908
NULL : NULL :
(PWSTR)((PBYTE)ProviderEnum + ProviderInfo->ProviderNameOffset); (PWSTR)((PBYTE)ProviderEnum + ProviderInfo->ProviderNameOffset);
} }
#pragma warning(pop) #pragma warning(pop)
#ifdef __cplusplus #ifdef __cplusplus
} }
#endif #endif
#endif /* WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_DESKTOP) */ #endif /* WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_DESKTOP | WINAPI_PARTITION_SY STEM) */
#pragma endregion #pragma endregion
#endif // __TDH_H__ #endif // __TDH_H__
 End of changes. 13 change blocks. 
5 lines changed or deleted 62 lines changed or added

This html diff was produced by rfcdiff 1.41.