EtwWrite
NTSTATUS __stdcall EtwWrite(
UINT64 RegHandle,
EVENT_DESCRIPTOR *EventDescriptor,
GUID *ActivityId,
UINT64 UserDataCount,
EVENT_DATA_DESCRIPTOR *UserData){
UINT64 UserDataCounta;
LODWORD(UserDataCounta) = UserDataCount;
return EtwWriteEx(RegHandle, EventDescriptor, 0i64, 0i64, ActivityId, 0i64, UserDataCounta, UserData);
}Referenced by:
BapdRecordFirmwareBootStats
CmpCompleteUnloadKey
CmpFlushHive
CmpLogClearAccessBitsEvent
CmpLogEvent
CmpLogReorganizeEvent
CmpLogTxrInitEvent
CmpPublishEventForPcaResolver
CmpTraceHiveFlushStop
CmpTraceHiveFlushWroteLogFile
CmpTraceHiveFlushWrotePrimaryFile
CmpTraceHiveLoadStart
CmpTraceHiveLoadStop
CmpTraceHiveMountBaseFileMounted
CmpTraceHiveMountLogEntryApplied
CmpTraceHiveMountStart
CmpTraceHiveMountStop
CmpTraceHiveRestoreStart
CmpTraceHiveRestoreStop
CmpTraceHiveSaveFileCopied
CmpTraceHiveSaveStart
CmpTraceHiveSaveStop
CmpTraceHiveSaveTreeCopied
CmpTraceShutdownFlushStart
CmpTraceShutdownFlushStop
CmpTraceShutdownRundownComplete
CmpTraceShutdownStart
CmpTraceShutdownStop
CmpWaitOnHiveWriteQueue
DbgkpStartSystemErrorHandler
EtwTiLogAllocExecVm
EtwTiLogDeviceObjectLoadUnload
EtwTiLogDriverObjectLoad
EtwTiLogDriverObjectUnLoad
EtwTiLogMapExecView
EtwTiLogProtectExecVm
EtwTiLogReadWriteVm
EtwTiLogSuspendResumeProcess
EtwTiLogSuspendResumeThread
EtwTimLogBlockNonCetBinaries
EtwTimLogControlProtectionUserModeReturnMismatch
EtwTimLogProhibitChildProcessCreation
EtwTimLogProhibitLowILImageMap
EtwTimLogProhibitNonMicrosoftBinaries
EtwTimLogRedirectionTrustPolicy
EtwTimLogUserCetSetContextIpValidationFailure
EtwTraceAdminlessAccessFailure
EtwTraceFreezeThawProcess
EtwTraceJobServerSiloStateChange
EtwTraceLeapSecondDataParseFailure
EtwTraceLeapSecondDataUpdate
EtwTraceLpacAccessFailure
EtwTraceSystemTimeChange
EtwTraceTimeZoneBiasChange
EtwTraceTimeZoneInformationRefresh
EtwTraceWorkingSetInSwapStoreFail
EtwTraceWorkingSetSwap
EtwWriteEndScenario
EtwWriteStartScenario
EtwpAddRegEntryToGroup
EtwpEventWriteEnableInfo
EtwpEventWriteGuidEntry
EtwpEventWriteProviderEnabled
EtwpEventWriteRegEntry
EtwpEventWriteRegistrationStatus
EtwpEventWriteTemplateAdmin
EtwpEventWriteTemplateBackingFile
EtwpEventWriteTemplateMaxFileSize
EtwpEventWriteTemplateSessAndProv
EtwpEventWriteTemplateSession
EtwpEventWriteTemplateSessionEnd
EtwpLogMemInfoWsHelper
EtwpLogSessionWorkingSetInfo
EtwpPsProvTraceJob
EtwpPsProvTraceProcess
EtwpPsProvTraceThread
EtwpRegTraceCallback
EtwpSavePersistedLogger
EtwpTimLogMitigationForProcess
EtwpTraceSavePersistedLoggerStop
EtwpTraceSystemShutdown
HalpAcpiPostSleep
HalpTimerWatchdogLogReset
IoCaptureLiveDump
IoRegisterFsRegistrationChangeMountAware
IopLiveDumpCallRemovePagesCallbacks
IopLogAuditIoRegisterNotificationEvent
NtCreateSymbolicLinkObject
NtSetContextThread
PfSnEndTrace
PfSnLogAsyncWorker
PfSnLogGetReadListsStart
PfSnLogGetReadListsStop
PfSnLogOpenVolumesForPrefetch
PfSnLogPrefetchMetadata
PfSnLogScenarioDecision
PfSnPrefetchSections
PnpDiagRundownForEachDevice
PnpDiagRundownParentDevNodeForEachDevice
PnpDiagRundownParentPdoForEachDevice
PnprLogFailureEvent
PnprLogStartEvent
PnprLogSuccessEvent
PoDiagTraceDeviceRundown
PoRundownSystemTimer
PoTraceSystemTimerResolution
PopBatteryTracePercentageRemaining
PopCallPowerSettingCallback
PopDiagTraceAcDcStateChange
PopDiagTraceActiveCooling
PopDiagTraceAppPowerMessage
PopDiagTraceAppPowerMessageEnd
PopDiagTraceBatteryCountChange
PopDiagTraceBatteryTriggerMet
PopDiagTraceConsoleDisplayState
PopDiagTraceControlCallback
PopDiagTraceCoolingExtension
PopDiagTraceCoolingExtensionActiveUpdate
PopDiagTraceCoolingExtensionPassiveUpdate
PopDiagTraceCsConsumption
PopDiagTraceCsEnterReason
PopDiagTraceCsExitReason
PopDiagTraceDeviceVerboseRundown
PopDiagTraceDevicesLevel
PopDiagTraceDevicesSuspend
PopDiagTraceDirectedDripsInitialization
PopDiagTraceDirectedDripsNotifyAppsAndServices
PopDiagTraceDisplayTimeout
PopDiagTraceDynamicTickStatusRundown
PopDiagTraceFxComponentAccounting
PopDiagTraceFxComponentRegistration
PopDiagTraceFxDevicePreparation
PopDiagTraceFxDeviceRegistration
PopDiagTraceFxDeviceStartPowerManagement
PopDiagTraceFxPerfRegistration
PopDiagTraceFxPerfSetRegistration
PopDiagTraceFxPluginRegistration
PopDiagTraceHiberStats
PopDiagTraceHibernateErrorStatus
PopDiagTraceInputTimeout
PopDiagTraceIoCoalescingOn
PopDiagTraceKernelQueriesAllowed
PopDiagTraceMtrrError
PopDiagTracePassiveCooling
PopDiagTracePerfTrackData
PopDiagTracePlatformRoleRundown
PopDiagTracePolicyChange
PopDiagTracePolicyInitiatePowerActionApiCall
PopDiagTracePostSleepNotification
PopDiagTracePowerRequestClose
PopDiagTracePowerRequestCreate
PopDiagTracePowerSetting
PopDiagTracePowerStateEvent
PopDiagTracePowerTransitionTime
PopDiagTracePreSleepNotification
PopDiagTraceServiceNotification
PopDiagTraceSessionStateCounted
PopDiagTraceSessionStates
PopDiagTraceSetThreadExecutionState
PopDiagTraceSkipTick
PopDiagTraceSleepStudyStart
PopDiagTraceSleepStudyStop
PopDiagTraceSystemIdleAction
PopDiagTraceSystemIdleAssessment
PopDiagTraceSystemIdleContextUpdate
PopDiagTraceSystemIdleEventAssessment
PopDiagTraceThermalCoolingMode
PopDiagTraceThermalRequestActiveUpdate
PopDiagTraceThermalRequestPassiveUpdate
PopDiagTraceThermalStateChange
PopDiagTraceThermalZoneEnumeration
PopDiagTraceThermalZoneThrottleDurationPerfTrack
PopDiagTraceThermalZoneThrottlePerfTrack
PopDiagTraceTripPointExceeded
PopDiagTraceUsermodeThermalEvent
PopDirectedDripsDiagRundownBroadcastTrees
PopDirectedDripsDiagRundownDevices
PopDirectedDripsDiagTraceBroadcastVisit
PopDirectedDripsDiagTraceMarkDevice
PopDirectedDripsDiagTraceProblemDevice
PopDirectedDripsWorkerRoutine
PopExecutePowerAction
PopFxLogSocSubsystemMetadata
PopFxUnregisterDevice
PopIdleWakeTraceWakeSourceDiagnostic
PopInitializeHeteroProcessors
PopNetWnfLowPowerEpochCallback
PopPowerAggregatorDiagTraceEvent
PopScanIdleList
PopTraceEsBgActivityPolicyUpdate
PopTraceNetRefreshTimerArmed
PopTraceStandbyConnectivityUpdate
PopTraceSystemIdleS0LowPowerDoze
PopTraceSystemIdleS0LowPowerDozeTimerArmed
PopTraceSystemIdleS0LowPowerDozeTimerCancelled
PopTraceSystemIdleTimeoutInitialization
PopTraceSystemIdleUpdate
PpmEventHeteroPolicy
PpmEventHiddenProcessorPerformance
PpmEventQosSupport
PpmEventStaticPolicyRundown
PpmEventTraceAccountingBucketIntervalsRundown
PpmEventTraceCoordinatedIdleStates
PpmEventTraceDripsAccountingSnapshot
PpmEventTraceParkNodeRundown
PpmEventTracePlatformIdleAccounting
PpmEventTracePpmProfileStatusRundown
PpmEventTraceProcessorIdle
PpmEventTraceProcessorPerformance
PpmEventTraceProcessorPerformanceDomainRundown
PpmEventTraceProcessorPerformanceRundownHv
PpmEventTraceProfileChange
PpmEventTraceProfileEnable
PpmEventTraceProfileSetting
PpmEventTraceProfiles
PpmEventVetoReasonRundown
PsOpenProcess
PsOpenThread
PsSetLoadImageNotifyRoutineEx
PspLogAuditTerminateRemoteProcessEvent
PspSetJobIoAttribution
PspSetJobIoRateControl
SepLogTokenSidManagement
WdipSemWriteEvent
WheapGenerateETWEvents
WheapLogInitEvent
ntoskrnl_24