etw

package

Go to main page

Versions in this module

v1

v1.10.0

Mar 31, 2023

v1.8.0

Nov 30, 2022

Changes in this version

+ const AntimalwareEngineSession — windows/amd64

+ var AntimalwareEngineGUID = syscall.GUID — windows/amd64

v1.6.0

Aug 31, 2022

Changes in this version

type EventRecord — windows/amd64

+ Buffer uintptr

+ BufferLen uint16

v1.5.0

Apr 29, 2022

Changes in this version

+ const KernelAuditAPICallsSession — windows/amd64

+ var KernelAuditAPICallsGUID = syscall.GUID — windows/amd64

v1.4.2

Dec 25, 2021

v1.4.1

Sep 18, 2021

v1.4.0

Aug 24, 2021

v1.2.0

Apr 27, 2021

Changes in this version

+ const KernelLoggerRundownSession

+ const KernelLoggerSession

+ const ProcessTraceModeEventRecord

+ const ProcessTraceModeRealtime

+ const TraceSystemTraceEnableFlagsInfo

+ const WnodeTraceFlagGUID

+ var KernelRundownGUID = syscall.GUID

+ var KernelTraceControlGUID = syscall.GUID

+ func CloseTrace(handle TraceHandle) error

+ func ControlTrace(handle TraceHandle, name string, props *EventTraceProperties, ...) error

+ func EnableTrace(guid syscall.GUID, handle TraceHandle, keyword uint32) error

+ func ProcessTrace(handle TraceHandle) error

+ func SetTraceInformation(handle TraceHandle, infoClass uint8, traceFlags []EventTraceFlags) error

+ type BufferContext struct

+ LoggerID uint16

+ ProcessorIndex [2]byte

+ type EventDescriptor struct

+ Channel uint8

+ ID uint16

+ Keyword uint64

+ Level uint8

+ Opcode uint8

+ Task uint16

+ Version uint8

+ type EventHeader struct

+ ActivityID syscall.GUID

+ EventDescriptor EventDescriptor

+ EventProperty uint16

+ Flags uint16

+ HeaderType uint16

+ ProcessID uint32

+ ProcessorTime [8]byte

+ ProviderID syscall.GUID

+ Size uint16

+ ThreadID uint32

+ Timestamp uint64

+ type EventHeaderExtendedDataItem struct

+ DataPtr uint64

+ DataSize uint16

+ ExtType uint16

+ Reserved1 uint16

+ type EventRecord struct

+ BufferContext BufferContext

+ ExtendedData *EventHeaderExtendedDataItem

+ ExtendedDataCount uint16

+ Header EventHeader

+ UserContext uintptr

+ UserData uintptr

+ UserDataLength uint16

+ type EventTrace struct

+ Context [2]byte

+ Header EventTraceHeader

+ InstanceID uint32

+ MofData uintptr

+ MofLength uint32

+ ParentGUID syscall.GUID

+ ParentInstanceID uint32

+ type EventTraceFlags uint32

+ const ALPC

+ const Cswitch

+ const DPC

+ const DbgPrint

+ const DiskFileIO

+ const DiskIO

+ const DiskIOInit

+ const Dispatcher

+ const Driver

+ const FileIO

+ const FileIOInit

+ const Handle

+ const IRQ

+ const ImageLoad

+ const Job

+ const NetTCPIP

+ const Process

+ const Registry

+ const Syscall

+ const Thread

+ func (f EventTraceFlags) String() string

+ type EventTraceHeader struct

+ FieldTypeFlags [2]byte

+ GUID [16]byte

+ ProcessID uint32

+ ProcessorTime [8]byte

+ Size uint16

+ ThreadID uint32

+ Timestamp uint64

+ Version [4]byte

+ type EventTraceLogfile struct

+ BufferCallback uintptr

+ BufferSize uint32

+ BuffersRead uint32

+ Context uintptr

+ CurrentEvent EventTrace

+ CurrentTime int64

+ EventCallback [8]byte

+ EventsLost uint32

+ Filled uint32

+ IsKernelTrace uint32

+ LogFileMode [4]byte

+ LogFileName *uint16

+ LogfileHeader TraceLogfileHeader

+ LoggerName *uint16

+ type EventTraceProperties struct

+ AgeLimit int32

+ BufferSize uint32

+ BuffersWritten uint32

+ EnableFlags EventTraceFlags

+ EventsLost uint32

+ FlushTimer uint32

+ FreeBuffers uint32

+ LogBuffersLost uint32

+ LogFileMode uint32

+ LogFileNameOffset uint32

+ LoggerNameOffset uint32

+ LoggerThreadID uintptr

+ MaximumBuffers uint32

+ MaximumFileSize uint32

+ MinimumBuffers uint32

+ NumberOfBuffers uint32

+ RealTimeBuffersLost uint32

+ Wnode WnodeHeader

+ type Linkage struct

+ Linkage uint16

+ Resreved2 uint16

+ type TraceHandle uintptr

+ func OpenTrace(ktrace EventTraceLogfile) TraceHandle

+ func StartTrace(name string, props *EventTraceProperties) (TraceHandle, error)

+ func (handle TraceHandle) IsValid() bool

+ type TraceLogfileHeader struct

+ BootTime uint64

+ BufferSize uint32

+ BuffersLost uint32

+ BuffersWritten uint32

+ EndTime uint64

+ GUID [16]byte

+ LogfileMode uint32

+ LogfileName *uint16

+ LoggerName *uint16

+ MaximumFileSize uint32

+ NumberOfProcessors uint32

+ PerfFreq uint64

+ ProviderVersion uint32

+ ReservedFlags uint32

+ StartTime uint64

+ TimeZone syscall.Timezoneinformation

+ TimerResolution uint32

+ Version [4]byte

+ type TraceOperation uint32

+ const Flush

+ const Query

+ const Stop

+ const Update

+ type WnodeHeader struct

+ BufferSize uint32

+ ClientContext uint32

+ Flags uint32

+ GUID syscall.GUID

+ HistoricalContext [8]byte

+ KernelHandle [8]byte

+ ProviderID uint32

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL