| tdh.h (6.3.9600.17415-Windows 8.1) | | tdh.h (10.0.10586.0-Windows 10 1511 10586.494) |
| | |
| skipping to change at line 19 | | skipping to change at line 19 |
| Abstract: | | Abstract: |
| | |
| ETW Event payload parsing API && ETW trace providers browsing API. | | ETW Event payload parsing API && ETW trace providers browsing API. |
| | |
| --*/ | | --*/ |
| | |
| #ifndef __TDH_H__ | | #ifndef __TDH_H__ |
| #define __TDH_H__ | | #define __TDH_H__ |
| #include <winapifamily.h> | | #include <winapifamily.h> |
| | |
|
| #pragma region Desktop Family | | #pragma region Desktop Family or OneCore Family |
| #if WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_DESKTOP) | | #if WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_DESKTOP | WINAPI_PARTITION_SYSTEM) |
| | |
| #ifdef __cplusplus | | #ifdef __cplusplus |
| extern "C" { | | extern "C" { |
| #endif | | #endif |
| | |
| #include <wmistr.h> | | #include <wmistr.h> |
| #include <evntrace.h> | | #include <evntrace.h> |
| #include <evntcons.h> | | #include <evntcons.h> |
| | |
| #pragma warning(push) | | #pragma warning(push) |
| | |
| skipping to change at line 163 | | skipping to change at line 163 |
| #define TDH_OUTYTPE_ERRORCODE TDH_OUTTYPE_ERRORCODE | | #define TDH_OUTYTPE_ERRORCODE TDH_OUTTYPE_ERRORCODE |
| | |
| typedef enum _PROPERTY_FLAGS | | typedef enum _PROPERTY_FLAGS |
| { | | { |
| PropertyStruct = 0x1, // Type is struct. | | PropertyStruct = 0x1, // Type is struct. |
| PropertyParamLength = 0x2, // Length field is index of param with leng
th. | | PropertyParamLength = 0x2, // Length field is index of param with leng
th. |
| PropertyParamCount = 0x4, // Count file is index of param with count. | | PropertyParamCount = 0x4, // Count file is index of param with count. |
| PropertyWBEMXmlFragment = 0x8, // WBEM extension flag for property. | | PropertyWBEMXmlFragment = 0x8, // WBEM extension flag for property. |
| PropertyParamFixedLength = 0x10, // Length of the parameter is fixed. | | PropertyParamFixedLength = 0x10, // Length of the parameter is fixed. |
| PropertyParamFixedCount = 0x20, // Count of the parameter is fixed. | | PropertyParamFixedCount = 0x20, // Count of the parameter is fixed. |
|
| PropertyHasTags = 0x40 // The Tags field has been initialized. | | PropertyHasTags = 0x40, // The Tags field has been initialized. |
| | PropertyHasCustomSchema = 0x80, // Type is described with a custom schema. |
| } PROPERTY_FLAGS; | | } PROPERTY_FLAGS; |
| | |
| typedef struct _EVENT_PROPERTY_INFO { | | typedef struct _EVENT_PROPERTY_INFO { |
| PROPERTY_FLAGS Flags; | | PROPERTY_FLAGS Flags; |
| ULONG NameOffset; | | ULONG NameOffset; |
| union { | | union { |
| struct _nonStructType { | | struct _nonStructType { |
| USHORT InType; | | USHORT InType; |
| USHORT OutType; | | USHORT OutType; |
| ULONG MapNameOffset; | | ULONG MapNameOffset; |
| } nonStructType; | | } nonStructType; |
| struct _structType { | | struct _structType { |
| USHORT StructStartIndex; | | USHORT StructStartIndex; |
| USHORT NumOfStructMembers; | | USHORT NumOfStructMembers; |
| ULONG padding; | | ULONG padding; |
| } structType; | | } structType; |
|
| | struct _customSchemaType { |
| | USHORT padding2; |
| | USHORT OutType; |
| | ULONG CustomSchemaOffset; |
| | } customSchemaType; |
| }; | | }; |
| union { | | union { |
| USHORT count; | | USHORT count; |
| USHORT countPropertyIndex; | | USHORT countPropertyIndex; |
| }; | | }; |
| union { | | union { |
| USHORT length; | | USHORT length; |
| USHORT lengthPropertyIndex; | | USHORT lengthPropertyIndex; |
| }; | | }; |
| union { | | union { |
| | |
| skipping to change at line 231 | | skipping to change at line 237 |
| ULONG KeywordsNameOffset; | | ULONG KeywordsNameOffset; |
| ULONG TaskNameOffset; | | ULONG TaskNameOffset; |
| ULONG OpcodeNameOffset; | | ULONG OpcodeNameOffset; |
| ULONG EventMessageOffset; | | ULONG EventMessageOffset; |
| ULONG ProviderMessageOffset; | | ULONG ProviderMessageOffset; |
| ULONG BinaryXMLOffset; | | ULONG BinaryXMLOffset; |
| ULONG BinaryXMLSize; | | ULONG BinaryXMLSize; |
| ULONG ActivityIDNameOffset; | | ULONG ActivityIDNameOffset; |
| ULONG RelatedActivityIDNameOffset; | | ULONG RelatedActivityIDNameOffset; |
| ULONG PropertyCount; | | ULONG PropertyCount; |
|
| ULONG TopLevelPropertyCount; | | _Field_range_(0, PropertyCount) ULONG TopLevelPropertyCount; |
| union { | | union { |
| TEMPLATE_FLAGS Flags; | | TEMPLATE_FLAGS Flags; |
| struct { | | struct { |
| ULONG Reserved : 4; // TEMPLATE_FLAGS values | | ULONG Reserved : 4; // TEMPLATE_FLAGS values |
| ULONG Tags : 28; | | ULONG Tags : 28; |
| }; | | }; |
| }; | | }; |
| _Field_size_(PropertyCount) EVENT_PROPERTY_INFO EventPropertyInfoArray[ANYSI
ZE_ARRAY]; | | _Field_size_(PropertyCount) EVENT_PROPERTY_INFO EventPropertyInfoArray[ANYSI
ZE_ARRAY]; |
| } TRACE_EVENT_INFO; | | } TRACE_EVENT_INFO; |
| typedef TRACE_EVENT_INFO *PTRACE_EVENT_INFO; | | typedef TRACE_EVENT_INFO *PTRACE_EVENT_INFO; |
| | |
| typedef struct _PROPERTY_DATA_DESCRIPTOR { | | typedef struct _PROPERTY_DATA_DESCRIPTOR { |
| ULONGLONG PropertyName; // Pointer to property name. | | ULONGLONG PropertyName; // Pointer to property name. |
| ULONG ArrayIndex; // Array Index. | | ULONG ArrayIndex; // Array Index. |
| ULONG Reserved; | | ULONG Reserved; |
| } PROPERTY_DATA_DESCRIPTOR; | | } PROPERTY_DATA_DESCRIPTOR; |
| typedef PROPERTY_DATA_DESCRIPTOR *PPROPERTY_DATA_DESCRIPTOR; | | typedef PROPERTY_DATA_DESCRIPTOR *PPROPERTY_DATA_DESCRIPTOR; |
| | |
|
| | #endif /* WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_DESKTOP | WINAPI_PARTITION_SY |
| | STEM) */ |
| | #pragma endregion |
| | |
| | #pragma region Desktop Family |
| | #if WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_DESKTOP) |
| | |
| // | | // |
| // ETW Payload Filtering Tdh support | | // ETW Payload Filtering Tdh support |
| // | | // |
| | |
| // | | // |
| // Payload filtering definitions | | // Payload filtering definitions |
| // | | // |
| | |
| // | | // |
| // TDH_PAYLOADFIELD_OPERATORs are used to build Payload filters. | | // TDH_PAYLOADFIELD_OPERATORs are used to build Payload filters. |
| | |
| skipping to change at line 353 | | skipping to change at line 365 |
| | |
| typedef struct _PROVIDER_FILTER_INFO { | | typedef struct _PROVIDER_FILTER_INFO { |
| UCHAR Id; | | UCHAR Id; |
| UCHAR Version; | | UCHAR Version; |
| ULONG MessageOffset; | | ULONG MessageOffset; |
| ULONG Reserved; | | ULONG Reserved; |
| ULONG PropertyCount; | | ULONG PropertyCount; |
| _Field_size_(PropertyCount) EVENT_PROPERTY_INFO EventPropertyInfoArray[ANYSI
ZE_ARRAY]; | | _Field_size_(PropertyCount) EVENT_PROPERTY_INFO EventPropertyInfoArray[ANYSI
ZE_ARRAY]; |
| } PROVIDER_FILTER_INFO, *PPROVIDER_FILTER_INFO; | | } PROVIDER_FILTER_INFO, *PPROVIDER_FILTER_INFO; |
| | |
|
| | #endif /* WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_DESKTOP) */ |
| | #pragma endregion |
| | |
| | #pragma region Desktop Family or OneCore Family |
| | #if WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_DESKTOP | WINAPI_PARTITION_SYSTEM) |
| | |
| // Provider Enumeration. | | // Provider Enumeration. |
| | |
| typedef enum _EVENT_FIELD_TYPE { | | typedef enum _EVENT_FIELD_TYPE { |
| EventKeywordInformation = 0, | | EventKeywordInformation = 0, |
| EventLevelInformation, | | EventLevelInformation, |
| EventChannelInformation, | | EventChannelInformation, |
| EventTaskInformation, | | EventTaskInformation, |
| EventOpcodeInformation, | | EventOpcodeInformation, |
| EventInformationMax | | EventInformationMax |
| } EVENT_FIELD_TYPE; | | } EVENT_FIELD_TYPE; |
| | |
| skipping to change at line 476 | | skipping to change at line 494 |
| ); | | ); |
| | |
| TDHAPI | | TDHAPI |
| TdhEnumerateProviderFieldInformation( | | TdhEnumerateProviderFieldInformation( |
| _In_ LPGUID pGuid, | | _In_ LPGUID pGuid, |
| _In_ EVENT_FIELD_TYPE EventFieldType, | | _In_ EVENT_FIELD_TYPE EventFieldType, |
| _Out_writes_bytes_opt_(*pBufferSize) PPROVIDER_FIELD_INFOARRAY pBuffer, | | _Out_writes_bytes_opt_(*pBufferSize) PPROVIDER_FIELD_INFOARRAY pBuffer, |
| _Inout_ ULONG *pBufferSize | | _Inout_ ULONG *pBufferSize |
| ); | | ); |
| | |
|
| | #endif /* WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_DESKTOP | WINAPI_PARTITION_SY |
| | STEM) */ |
| | #pragma endregion |
| | |
| | #pragma region Desktop Family |
| | #if WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_DESKTOP) |
| | |
| #if (WINVER >= _WIN32_WINNT_WIN7) | | #if (WINVER >= _WIN32_WINNT_WIN7) |
| TDHAPI | | TDHAPI |
| TdhEnumerateProviderFilters( | | TdhEnumerateProviderFilters( |
| _In_ LPGUID Guid, | | _In_ LPGUID Guid, |
| _In_ ULONG TdhContextCount, | | _In_ ULONG TdhContextCount, |
| _In_reads_opt_(TdhContextCount) PTDH_CONTEXT TdhContext, | | _In_reads_opt_(TdhContextCount) PTDH_CONTEXT TdhContext, |
| _Out_ ULONG *FilterCount, | | _Out_ ULONG *FilterCount, |
| _Out_writes_bytes_opt_(*BufferSize) PPROVIDER_FILTER_INFO *Buffer, | | _Out_writes_bytes_opt_(*BufferSize) PPROVIDER_FILTER_INFO *Buffer, |
| _Inout_ ULONG *BufferSize | | _Inout_ ULONG *BufferSize |
| ); | | ); |
| #endif | | #endif |
| | |
|
| | #endif /* WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_DESKTOP) */ |
| | |
| | #pragma region Desktop Family or OneCore Family |
| | #if WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_DESKTOP | WINAPI_PARTITION_SYSTEM) |
| | |
| #if (WINVER >= _WIN32_WINNT_WIN7) | | #if (WINVER >= _WIN32_WINNT_WIN7) |
| TDHAPI | | TDHAPI |
| TdhLoadManifest( | | TdhLoadManifest( |
| _In_ PWSTR Manifest | | _In_ PWSTR Manifest |
| ); | | ); |
| #endif | | #endif |
| | |
| #if (WINVER >= _WIN32_WINNT_WIN7) | | #if (WINVER >= _WIN32_WINNT_WIN7) |
| TDHAPI | | TDHAPI |
| TdhUnloadManifest( | | TdhUnloadManifest( |
| | |
| skipping to change at line 519 | | skipping to change at line 548 |
| _In_ USHORT PropertyOutType, | | _In_ USHORT PropertyOutType, |
| _In_ USHORT PropertyLength, | | _In_ USHORT PropertyLength, |
| _In_ USHORT UserDataLength, | | _In_ USHORT UserDataLength, |
| _In_reads_bytes_(UserDataLength) PBYTE UserData, | | _In_reads_bytes_(UserDataLength) PBYTE UserData, |
| _Inout_ PULONG BufferSize, | | _Inout_ PULONG BufferSize, |
| _Out_writes_bytes_opt_(*BufferSize) PWCHAR Buffer, | | _Out_writes_bytes_opt_(*BufferSize) PWCHAR Buffer, |
| _Out_ PUSHORT UserDataConsumed | | _Out_ PUSHORT UserDataConsumed |
| ); | | ); |
| #endif | | #endif |
| | |
|
| | #endif /* WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_DESKTOP | WINAPI_PARTITION_SY |
| | STEM) */ |
| | #pragma endregion |
| | |
| | #pragma region Desktop Family |
| | #if WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_DESKTOP) |
| | |
| #if (WINVER >= _WIN32_WINNT_WIN8) | | #if (WINVER >= _WIN32_WINNT_WIN8) |
| TDHAPI | | TDHAPI |
| TdhOpenDecodingHandle( | | TdhOpenDecodingHandle( |
| _Out_ PTDH_HANDLE Handle | | _Out_ PTDH_HANDLE Handle |
| ); | | ); |
| #endif | | #endif |
| | |
| #if (WINVER >= _WIN32_WINNT_WIN8) | | #if (WINVER >= _WIN32_WINNT_WIN8) |
| TDHAPI | | TDHAPI |
| TdhSetDecodingParameter( | | TdhSetDecodingParameter( |
| | |
| skipping to change at line 577 | | skipping to change at line 612 |
| ); | | ); |
| #endif | | #endif |
| | |
| #if (WINVER >= _WIN32_WINNT_WIN8) | | #if (WINVER >= _WIN32_WINNT_WIN8) |
| TDHAPI | | TDHAPI |
| TdhLoadManifestFromBinary( | | TdhLoadManifestFromBinary( |
| _In_ PWSTR BinaryPath | | _In_ PWSTR BinaryPath |
| ); | | ); |
| #endif | | #endif |
| | |
|
| | #endif /* WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_DESKTOP) */ |
| | #pragma endregion |
| | |
| | #pragma region Desktop Family or OneCore Family |
| | #if WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_DESKTOP | WINAPI_PARTITION_SYSTEM) |
| | |
| #if (WINVER >= _WIN32_WINNT_WINBLUE) | | #if (WINVER >= _WIN32_WINNT_WINBLUE) |
| TDHAPI | | TDHAPI |
| TdhEnumerateManifestProviderEvents ( | | TdhEnumerateManifestProviderEvents ( |
| _In_ LPGUID ProviderGuid, | | _In_ LPGUID ProviderGuid, |
| _Out_writes_bytes_opt_(*BufferSize) PPROVIDER_EVENT_INFO Buffer, | | _Out_writes_bytes_opt_(*BufferSize) PPROVIDER_EVENT_INFO Buffer, |
| _Inout_ ULONG *BufferSize | | _Inout_ ULONG *BufferSize |
| ); | | ); |
| #endif | | #endif |
| | |
| #if (WINVER >= _WIN32_WINNT_WINBLUE) | | #if (WINVER >= _WIN32_WINNT_WINBLUE) |
| | |
| skipping to change at line 786 | | skipping to change at line 827 |
| PWSTR | | PWSTR |
| TEI_RELATEDACTIVITYID_NAME( | | TEI_RELATEDACTIVITYID_NAME( |
| _In_ PTRACE_EVENT_INFO EventInfo | | _In_ PTRACE_EVENT_INFO EventInfo |
| ) | | ) |
| { | | { |
| return (EventInfo->RelatedActivityIDNameOffset == 0) ? | | return (EventInfo->RelatedActivityIDNameOffset == 0) ? |
| NULL : | | NULL : |
| (PWSTR)((PBYTE)EventInfo + EventInfo->RelatedActivityIDNameOffset); | | (PWSTR)((PBYTE)EventInfo + EventInfo->RelatedActivityIDNameOffset); |
| } | | } |
| | |
|
| | #endif /* WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_DESKTOP | WINAPI_PARTITION_SY |
| | STEM) */ |
| | #pragma endregion |
| | |
| | #pragma region Desktop Family |
| | #if WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_DESKTOP) |
| | |
| #if (WINVER >= _WIN32_WINNT_WIN7) | | #if (WINVER >= _WIN32_WINNT_WIN7) |
| FORCEINLINE | | FORCEINLINE |
| PWSTR | | PWSTR |
| PFI_FILTER_MESSAGE( | | PFI_FILTER_MESSAGE( |
| _In_ PPROVIDER_FILTER_INFO FilterInfo | | _In_ PPROVIDER_FILTER_INFO FilterInfo |
| ) | | ) |
| { | | { |
| return (FilterInfo->MessageOffset == 0) ? | | return (FilterInfo->MessageOffset == 0) ? |
| NULL : | | NULL : |
| (PWSTR)((PBYTE)FilterInfo + FilterInfo->MessageOffset); | | (PWSTR)((PBYTE)FilterInfo + FilterInfo->MessageOffset); |
| | |
| skipping to change at line 813 | | skipping to change at line 860 |
| _In_ PPROVIDER_FILTER_INFO FilterInfo, | | _In_ PPROVIDER_FILTER_INFO FilterInfo, |
| _In_ PEVENT_PROPERTY_INFO Property | | _In_ PEVENT_PROPERTY_INFO Property |
| ) | | ) |
| { | | { |
| return (Property->NameOffset == 0) ? | | return (Property->NameOffset == 0) ? |
| NULL : | | NULL : |
| (PWSTR)((PBYTE)FilterInfo + Property->NameOffset); | | (PWSTR)((PBYTE)FilterInfo + Property->NameOffset); |
| } | | } |
| #endif | | #endif |
| | |
|
| | #endif /* WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_DESKTOP) */ |
| | #pragma endregion |
| | |
| | #pragma region Desktop Family or OneCore Family |
| | #if WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_DESKTOP | WINAPI_PARTITION_SYSTEM) |
| | |
| FORCEINLINE | | FORCEINLINE |
| PWSTR | | PWSTR |
| PFI_FIELD_NAME( | | PFI_FIELD_NAME( |
| _In_ PPROVIDER_FIELD_INFOARRAY FieldInfoArray, | | _In_ PPROVIDER_FIELD_INFOARRAY FieldInfoArray, |
| _In_ PPROVIDER_FIELD_INFO FieldInfo | | _In_ PPROVIDER_FIELD_INFO FieldInfo |
| ) | | ) |
| { | | { |
| return (FieldInfo->NameOffset == 0) ? | | return (FieldInfo->NameOffset == 0) ? |
| NULL : | | NULL : |
| (PWSTR)((PBYTE)FieldInfoArray + FieldInfo->NameOffset); | | (PWSTR)((PBYTE)FieldInfoArray + FieldInfo->NameOffset); |
| | |
| skipping to change at line 855 | | skipping to change at line 908 |
| NULL : | | NULL : |
| (PWSTR)((PBYTE)ProviderEnum + ProviderInfo->ProviderNameOffset); | | (PWSTR)((PBYTE)ProviderEnum + ProviderInfo->ProviderNameOffset); |
| } | | } |
| | |
| #pragma warning(pop) | | #pragma warning(pop) |
| | |
| #ifdef __cplusplus | | #ifdef __cplusplus |
| } | | } |
| #endif | | #endif |
| | |
|
| #endif /* WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_DESKTOP) */ | | #endif /* WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_DESKTOP | WINAPI_PARTITION_SY
STEM) */ |
| #pragma endregion | | #pragma endregion |
| | |
| #endif // __TDH_H__ | | #endif // __TDH_H__ |
| | |
| End of changes. 13 change blocks. |
| 5 lines changed or deleted | | 62 lines changed or added |
|