701 lines
24 KiB
C++
701 lines
24 KiB
C++
|
|
/*++
|
|
|
|
Copyright (c) Microsoft Corporation. All rights reserved.
|
|
|
|
THIS CODE AND INFORMATION IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY
|
|
KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE
|
|
IMPLIED WARRANTIES OF MERCHANTABILITY AND/OR FITNESS FOR A PARTICULAR
|
|
PURPOSE.
|
|
|
|
Module Name:
|
|
|
|
AdvancedProvider.cpp.
|
|
|
|
Abstract:
|
|
|
|
Advanced ETW provider sample for Windows 7 SDK.
|
|
Demonstrates how to easily create a ETW provider using the macros generated by MC (Message Compiler).
|
|
|
|
|
|
Environment:
|
|
|
|
User mode only.
|
|
|
|
--*/
|
|
|
|
#include <stdlib.h>
|
|
#include <windows.h>
|
|
#include <tchar.h>
|
|
#include <strsafe.h>
|
|
#include <stdio.h>
|
|
|
|
//
|
|
// Include header file generated by MC (message compiler) containing support code for logging. The file is
|
|
// generated based on the event definitions in the instrumentation manifest. The file defines macros for each
|
|
// event defined in the manifest and hides calls to ETW Eventing APIs - making the developer's life way easier.
|
|
// Please refer to the ReadMe.txt to see the full script used for generating this file.
|
|
//
|
|
|
|
#include "AdvancedProviderEvents.h"
|
|
|
|
int
|
|
main()
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
Calls the macros defined in the generated code (AdvancedProviderEvents.h) to log different supported inType/outType data as defined in the templates section of AdvancedProvider.man.
|
|
|
|
Arguments:
|
|
None.
|
|
|
|
Return Value:
|
|
|
|
STATUS_SUCCESS if successful
|
|
STATUS_UNSUCCESSFUL otherwise
|
|
|
|
--*/
|
|
|
|
{
|
|
ULONG Status;
|
|
|
|
//
|
|
// Register the provider. If registration fails then each of the successive event logging calls will fail.
|
|
//
|
|
Status = ERROR_SUCCESS;
|
|
Status = EventRegisterMicrosoft_Windows_SDKSample_AdvancedProvider();
|
|
if (Status != ERROR_SUCCESS) {
|
|
wprintf(L"ERROR: EventRegisterMicrosoft_Instrumentation_SDKSample_SimpleProvider() Failed with Status code = %d\n with Status code = %d.\n", Status);
|
|
exit(Status);
|
|
}
|
|
|
|
//
|
|
// Write Integer data for Event ID 102 in AdvancedProvider.man.
|
|
//
|
|
|
|
EventWriteSampleEvt_INT8(1);
|
|
wprintf(L"Using Macro: EventWriteSampleEvt_INT8.\n");
|
|
|
|
//
|
|
// Write Integer data for Event ID 103 in AdvancedProvider.man.
|
|
//
|
|
|
|
EventWriteSampleEvt_UINT8(1);
|
|
wprintf(L"Using Macro: EventWriteSampleEvt_UINT8.\n");
|
|
|
|
//
|
|
// Write Integer data for Event ID 104 in AdvancedProvider.man.
|
|
//
|
|
|
|
EventWriteSampleEvt_UINT8_HEXINT8(1);
|
|
wprintf(L"Using Macro: EventWriteSampleEvt_UINT8_HEXINT8.\n");
|
|
|
|
//
|
|
// Write Integer data for Event ID 105 in AdvancedProvider.man.
|
|
//
|
|
|
|
EventWriteSampleEvt_INT16(1);
|
|
wprintf(L"Using Macro: EventWriteSampleEvt_INT16.\n");
|
|
|
|
//
|
|
// Write Integer data for Event ID 106 in AdvancedProvider.man.
|
|
//
|
|
EventWriteSampleEvt_UINT16(1);
|
|
wprintf(L"Using Macro: EventWriteSampleEvt_UINT16.\n");
|
|
|
|
//
|
|
// Write Integer data for Event ID 107 in AdvancedProvider.man.
|
|
//
|
|
|
|
EventWriteSampleEvt_UINT16_HexInt16(1);
|
|
wprintf(L"Using Macro: EventWriteSampleEvt_UINT16_HexInt16.\n");
|
|
|
|
//
|
|
// Write Integer data for Event ID 108 in AdvancedProvider.man.
|
|
//
|
|
|
|
EventWriteSampleEvt_INT32(1);
|
|
wprintf(L"Using Macro: EventWriteSampleEvt_INT32.\n");
|
|
|
|
//
|
|
// Write Integer data for Event ID 109 in AdvancedProvider.man.
|
|
//
|
|
|
|
EventWriteSampleEvt_UINT32(1);
|
|
wprintf(L"Using Macro: EventWriteSampleEvt_UINT32.\n");
|
|
|
|
//
|
|
// Write Integer data for Event ID 110 in AdvancedProvider.man.
|
|
//
|
|
|
|
EventWriteSampleEvt_UINT32_PID(1);
|
|
wprintf(L"Using Macro: EventWriteSampleEvt_UINT32_PID.\n");
|
|
|
|
//
|
|
// Write Integer data for Event ID 111 in AdvancedProvider.man.
|
|
//
|
|
|
|
EventWriteSampleEvt_UINT32_TID(1);
|
|
wprintf(L"Using Macro: EventWriteSampleEvt_UINT32_TID.\n");
|
|
|
|
//
|
|
// Write Integer data for Event ID 112 in AdvancedProvider.man.
|
|
//
|
|
|
|
EventWriteSampleEvt_UINT32_IPV4(1);
|
|
wprintf(L"Using Macro: EventWriteSampleEvt_UINT32_IPV4.\n");
|
|
|
|
//
|
|
// Write Integer data for Event ID 114 in AdvancedProvider.man.
|
|
//
|
|
|
|
EventWriteSampleEvt_UINT32_ERRORCODE(1);
|
|
wprintf(L"Using Macro: EventWriteSampleEvt_UINT32_ERRORCODE.\n");
|
|
|
|
//
|
|
// Write Integer data for Event ID 115 in AdvancedProvider.man.
|
|
//
|
|
|
|
EventWriteSampleEvt_UINT32_HEXINT32(1);
|
|
wprintf(L"Using Macro: EventWriteSampleEvt_UINT32_HEXINT32.\n");
|
|
|
|
//
|
|
// Write Integer data for Event ID 116 in AdvancedProvider.man.
|
|
//
|
|
|
|
EventWriteSampleEvt_INT64(1);
|
|
wprintf(L"Using Macro: EventWriteSampleEvt_INT64.\n");
|
|
|
|
//
|
|
// Write Integer data for Event ID 117 in AdvancedProvider.man.
|
|
//
|
|
|
|
EventWriteSampleEvt_UINT64(1);
|
|
wprintf(L"Using Macro: EventWriteSampleEvt_UINT64.\n");
|
|
|
|
//
|
|
// Write Integer data for Event ID 118 in AdvancedProvider.man.
|
|
//
|
|
|
|
EventWriteSampleEvt_UINT64_HEXInt64(1);
|
|
wprintf(L"Using Macro: EventWriteSampleEvt_UINT64_HEXInt64.\n");
|
|
|
|
//
|
|
// Write Float data for Event ID 119 in AdvancedProvider.man.
|
|
//
|
|
|
|
EventWriteSampleEvt_FLOAT(1);
|
|
wprintf(L"Using Macro: EventWriteSampleEvt_FLOAT.\n");
|
|
|
|
//
|
|
// Write Double data for Event ID 120 in AdvancedProvider.man.
|
|
//
|
|
|
|
EventWriteSampleEvt_DOUBLE(1);
|
|
wprintf(L"Using Macro: EventWriteSampleEvt_DOUBLE.\n");
|
|
|
|
//
|
|
// Write Boolean for Event ID 121 in AdvancedProvider.man.
|
|
//
|
|
|
|
EventWriteSampleEvt_BOOL(1);
|
|
wprintf(L"Using Macro: EventWriteSampleEvt_BOOL.\n");
|
|
|
|
//
|
|
// Write GUID data for Event ID 125 in AdvancedProvider.man.
|
|
//
|
|
|
|
EventWriteSampleEvt_GUID(&MICROSOFT_WINDOWS_SDKSAMPLE_ADVANCEDPROVIDER);
|
|
wprintf(L"Using Macro: EventWriteSampleEvt_GUID.\n");
|
|
|
|
//
|
|
// Write Pointer data for Event ID 126 in AdvancedProvider.man.
|
|
//
|
|
|
|
PWCHAR Prop_Pointer =NULL;
|
|
EventWriteSampleEvt_POINTER(Prop_Pointer);
|
|
wprintf(L"Using Macro: EventWriteSampleEvt_POINTER.\n");
|
|
|
|
//
|
|
// Write DateTime data for Event ID 127 in AdvancedProvider.man.
|
|
//
|
|
|
|
FILETIME Prop_FileTime = {0};
|
|
SYSTEMTIME st = {0};
|
|
GetSystemTime(&st);
|
|
SystemTimeToFileTime(&st, &Prop_FileTime);
|
|
EventWriteSampleEvt_FILETIME(&Prop_FileTime);
|
|
wprintf(L"Using Macro: EventWriteSampleEvt_FILETIME.\n");
|
|
|
|
//
|
|
// Write SystemTime data for Event ID 128 in AdvancedProvider.man.
|
|
//
|
|
|
|
SYSTEMTIME Prop_SystemTime = {0};
|
|
GetSystemTime(&Prop_SystemTime);
|
|
EventWriteSampleEvt_SYSTEMTIME(&Prop_SystemTime);
|
|
wprintf(L"Using Macro: EventWriteSampleEvt_SYSTEMTIME.\n");
|
|
|
|
//
|
|
// Write SID data for Event ID 129 in AdvancedProvider.man.
|
|
//
|
|
|
|
SID Prop_SID = {0};
|
|
BOOL retval=FALSE;
|
|
DWORD SidSize=SECURITY_MAX_SID_SIZE;
|
|
|
|
//
|
|
// disable prefast error temporarily.
|
|
//
|
|
|
|
#pragma prefast(disable:26000)
|
|
retval=CreateWellKnownSid(WinWorldSid, NULL, &Prop_SID,&SidSize);
|
|
#pragma prefast(disable:26000)
|
|
|
|
if (FALSE!=retval)
|
|
{
|
|
EventWriteSampleEvt_SID(&Prop_SID);
|
|
wprintf(L"Using Macro: EventWriteSampleEvt_SID.\n");
|
|
}
|
|
|
|
//
|
|
// Write NULL terminated unicode string for Event ID 200 in AdvancedProvider.man.
|
|
//
|
|
|
|
EventWriteSampleEvt_UnicodeString(L"Sample UnicodeString");
|
|
wprintf(L"Using Macro: EventWriteSampleEvt_UnicodeString.\n");
|
|
|
|
|
|
//
|
|
// Write NULL terminated ansi string for Event ID 201 in AdvancedProvider.man.
|
|
//
|
|
|
|
EventWriteSampleEvt_AnsiString("Sample ANSIString");
|
|
wprintf(L"Using Macro: EventWriteSampleEvt_AnsiString.\n");
|
|
|
|
//
|
|
// Write Fixed length unicode string for Event ID 202 in AdvancedProvider.man.
|
|
//
|
|
|
|
WCHAR Prop_FixedLength_Unicode_String[27] = {0};
|
|
StringCchCopyW(Prop_FixedLength_Unicode_String, 27, L"abcdefghijklmnopqrstuvwxyz");
|
|
EventWriteSampleEvt_FixedLength_UnicodeString(Prop_FixedLength_Unicode_String);
|
|
wprintf(L"Using Macro: EventWriteSampleEvt_FixedLength_UnicodeString.\n");
|
|
|
|
//
|
|
// Write Fixed length Ansi string for Event ID 203 in AdvancedProvider.man.
|
|
//
|
|
|
|
CHAR Prop_FixedLength_Ansi_String[27] = {0};
|
|
StringCchCopyA(Prop_FixedLength_Ansi_String, 27, "ABCDEFGHIJKLMNOPQRSTUVWXYZ");
|
|
EventWriteSampleEvt_FixedLength_AnsiString(Prop_FixedLength_Ansi_String);
|
|
wprintf(L"Using Macro: EventWriteSampleEvt_FixedLength_AnsiString.\n");
|
|
|
|
//
|
|
// Write Fixed length binary data for Event ID 204 in AdvancedProvider.man.
|
|
//
|
|
|
|
BYTE Prop_FixedLength_Binary[16];
|
|
if (Prop_FixedLength_Binary!=NULL){
|
|
for (int i =0; i<16; i++){
|
|
Prop_FixedLength_Binary[i]= i%16;
|
|
}
|
|
}
|
|
|
|
EventWriteSampleEvt_FixedLength_Binary(Prop_FixedLength_Binary);
|
|
wprintf(L"Using Macro: EventWriteSampleEvt_FixedLength_Binary.\n");
|
|
|
|
//
|
|
// Write parametrized length Unicode string for Event ID 205 in AdvancedProvider.man.
|
|
//
|
|
|
|
LPWSTR Prop_ParamLength_UnicodeString = L"Unicode Param Length.";
|
|
ULONG Prop_ParamLength_UnicodString_Length = (ULONG)wcslen(Prop_ParamLength_UnicodeString);
|
|
EventWriteSampleEvt_ParamLength_UnicodeString(Prop_ParamLength_UnicodString_Length, Prop_ParamLength_UnicodeString);
|
|
wprintf(L"Using Macro: EventWriteSampleEvt_ParamLength_UnicodeString.\n");
|
|
|
|
//
|
|
// Write Parametrized length Ansi string for Event ID 206 in AdvancedProvider.man.
|
|
//
|
|
|
|
LPCSTR Prop_ParamLength_AnsiString = "AnsiString Param Length.";
|
|
ULONG Prop_ParamLength_AnsiString_Length = (ULONG)strlen(Prop_ParamLength_AnsiString);
|
|
EventWriteSampleEvt_ParamLength_AniString(Prop_ParamLength_AnsiString_Length, Prop_ParamLength_AnsiString);
|
|
wprintf(L"Using Macro: EventWriteSampleEvt_ParamLength_AniString.\n");
|
|
|
|
//
|
|
// Write Parametrized binary data for Event ID 207 in AdvancedProvider.man.
|
|
//
|
|
|
|
BYTE Prop_ParamLength_Binary[] = {0, 1,2,3,4,5,6,7,8,9};
|
|
EventWriteSampleEvt_ParamLength_Binary(10, Prop_ParamLength_Binary);
|
|
wprintf(L"Using Macro: EventWriteSampleEvt_ParamLength_Binary.\n");
|
|
|
|
//
|
|
// Write 0 length binary data for Event ID 207 in AdvancedProvider.man.
|
|
//
|
|
|
|
EventWriteSampleEvt_ParamLength_Binary(0, NULL);
|
|
wprintf(L"Using Macro: EventWriteSampleEvt_ParamLength_Binary - Zero length binary data.\n");
|
|
|
|
//
|
|
// Write binary data for Event ID 208 in AdvancedProvider.man.
|
|
//
|
|
|
|
BYTE Prop_Binary_HexBinary[16]={0};
|
|
for (int i =0; i<16; i++) {
|
|
Prop_Binary_HexBinary[i]= 0xAB;
|
|
}
|
|
|
|
EventWriteSampleEvt_Binary_HexBinary(16,Prop_Binary_HexBinary);
|
|
wprintf(L"Using Macro: EventWriteSampleEvt_Binary_HexBinary.\n");
|
|
|
|
//
|
|
// Write IPV6 binary data for Event ID 209 in AdvancedProvider.man.
|
|
//
|
|
|
|
BYTE Prop_Binary_IPv6[16];
|
|
for(int i =0; i<16; i++) {
|
|
Prop_Binary_IPv6[i]= 0xCD;
|
|
}
|
|
|
|
EventWriteSampleEvt_BINARY_IPv6(16, Prop_Binary_IPv6);
|
|
wprintf(L"Using Macro: EventWriteSampleEvt_BINARY_IPv6.\n");
|
|
|
|
//
|
|
// Write Socket address binary data for Event ID 210 in AdvancedProvider.man.
|
|
//
|
|
|
|
BYTE Prop_Binary_SocketAddress[16];
|
|
for(int i =0; i<16; i++) {
|
|
Prop_Binary_SocketAddress[i]= 0xEF;
|
|
}
|
|
|
|
EventWriteSampleEvt_BINARY_SOCKETADDRRESS(16, Prop_Binary_SocketAddress);
|
|
wprintf(L"Using Macro: EventWriteSampleEvt_BINARY_SOCKETADDRRESS.\n");
|
|
|
|
//
|
|
// Write Fixed count Integer array for Event ID 300 in AdvancedProvider.man.
|
|
//
|
|
|
|
INT8 Prop_FixedCount_Int8_Array[16];
|
|
for(int i =0; i<16; i++) {
|
|
Prop_FixedCount_Int8_Array[i]= (INT8) i;
|
|
}
|
|
|
|
EventWriteSampleEvt_FixedCount_Int8((CHAR*)Prop_FixedCount_Int8_Array);
|
|
wprintf(L"Using Macro: EventWriteSampleEvt_FixedCount_Int8.\n");
|
|
|
|
//
|
|
// Write Fixed count NULL terminated Unicode string array for Event ID 301 in AdvancedProvider.man.
|
|
//
|
|
|
|
WCHAR Prop_FixedCount_Unicode_String[15][15] = {0};
|
|
for(int i=0; i<15;i++) {
|
|
StringCchCopyW(Prop_FixedCount_Unicode_String[i], 15,L"Unicode Str ");
|
|
WCHAR str[3] = {0};
|
|
(i>=9)? StringCchPrintfW(str,3, L"%d",i+1):StringCchPrintfW(str,3, L"%d ",i+1) ;
|
|
StringCchCatW(Prop_FixedCount_Unicode_String[i],15,str);
|
|
}
|
|
|
|
EventWriteSampleEvt_FixedCount_UnicodeString(15*15, (PCWSTR)Prop_FixedCount_Unicode_String);
|
|
wprintf(L"Using Macro: EventWriteSampleEvt_FixedCount_UnicodeString.\n");
|
|
|
|
//
|
|
// Write Fixed count NULL terminated Ansi string array for Event ID 302 in AdvancedProvider.man.
|
|
//
|
|
|
|
CHAR Prop_FixedCount_Ansi_String[15][15] ={0};
|
|
for(int i=0; i<15;i++) {
|
|
StringCchCopyA(Prop_FixedCount_Ansi_String[i], 15,"Ansi String ");
|
|
CHAR str[3] = {0};
|
|
(i>=9)? StringCchPrintfA(str,3, "%d",i+1):StringCchPrintfA(str,3, "%d ",i+1) ;
|
|
StringCchCatA(Prop_FixedCount_Ansi_String[i],15,str);
|
|
}
|
|
|
|
EventWriteSampleEvt_FixedCount_AnsiString(15*15,(LPCSTR)Prop_FixedCount_Ansi_String);
|
|
wprintf(L"Using Macro: EventWriteSampleEvt_FixedCount_AnsiString.\n");
|
|
|
|
//
|
|
// Write Fixed count Fixed length Unicode string array for Event ID 303 in AdvancedProvider.man.
|
|
//
|
|
|
|
EventWriteSampleEvt_FixedCount_FixedLength_UnicodeString((PCWSTR)Prop_FixedCount_Unicode_String);
|
|
wprintf(L"Using Macro: EventWriteSampleEvt_FixedCount_FixedLength_UnicodeString.\n");
|
|
|
|
//
|
|
// Write Fixed count Fixed length Ansi string array for Event ID 304 in AdvancedProvider.man.
|
|
//
|
|
|
|
EventWriteSampleEvt_FixedCount_FixedLength_AnsiString((LPCSTR)Prop_FixedCount_Ansi_String);
|
|
wprintf(L"Using Macro: EventWriteSampleEvt_FixedCount_FixedLength_AnsiString.\n");
|
|
|
|
|
|
//
|
|
// Write Fixed count Fixed length binary data array for Event ID 305 in AdvancedProvider.man.
|
|
//
|
|
|
|
BYTE Prop_FixedCount_FixedLength_Binary[15][15];
|
|
|
|
for(INT8 i=0; i<15; i++) {
|
|
for(INT8 j=0; j<15; j++)
|
|
{
|
|
Prop_FixedCount_FixedLength_Binary[i][j] = j;
|
|
}
|
|
}
|
|
|
|
EventWriteSampleEvt_FixedCount_FixedLength_Binary((PBYTE)Prop_FixedCount_FixedLength_Binary);
|
|
wprintf(L"Using Macro: EventWriteSampleEvt_FixedCount_FixedLength_Binary.\n");
|
|
|
|
//
|
|
// Write Fixed count Parametrized length Unicode string array for Event ID 306 in AdvancedProvider.man.
|
|
//
|
|
|
|
LPWSTR Prop_FixedCount_ParamLength_UnicodeString = L"Fixed count param length unicode string 12...";
|
|
UINT8 Prop_FixedCount_ParamLength_UnicodeString_Length = (UINT8) wcslen(Prop_FixedCount_ParamLength_UnicodeString)/15;
|
|
EventWriteSampleEvt_FixedCount_ParamLength_UnicodeString(Prop_FixedCount_ParamLength_UnicodeString_Length, Prop_FixedCount_ParamLength_UnicodeString);
|
|
wprintf(L"Using Macro: EventWriteSampleEvt_FixedCount_ParamLength_UnicodeString.\n");
|
|
|
|
//
|
|
// Write Fixed count Parametrized length Unicode string array for Event ID 307 in AdvancedProvider.man.
|
|
//
|
|
|
|
LPCSTR Prop_FixedCount_ParamLength_AnsiString = "Fixed Count Param Length Ansi String 12345...";
|
|
UINT8 Prop_FixedCount_ParamLength_AnsiString_Length = (UINT8) strlen(Prop_FixedCount_ParamLength_AnsiString) / 15;
|
|
EventWriteSampleEvt_FixedCount_ParamLength_AnsiString(Prop_FixedCount_ParamLength_AnsiString_Length, Prop_FixedCount_ParamLength_AnsiString);
|
|
wprintf(L"Using Macro: EventWriteSampleEvt_FixedCount_ParamLength_AnsiString.\n");
|
|
|
|
//
|
|
// Write Fixed count Parametrized length binary data array for Event ID 308 in AdvancedProvider.man.
|
|
//
|
|
|
|
BYTE Prop_FixedCount_ParamLength_Binary[3][15];
|
|
UINT8 Prop_FixedCount_ParamLength_Binary_Length = 3;
|
|
for(int i =0 ; i<15; i++) {
|
|
Prop_FixedCount_ParamLength_Binary[0][i]=(BYTE)i;
|
|
Prop_FixedCount_ParamLength_Binary[1][i]=(BYTE)i;
|
|
Prop_FixedCount_ParamLength_Binary[2][i]=(BYTE)i;
|
|
}
|
|
|
|
EventWriteSampleEvt_FixedCount_ParamLength_Binary(Prop_FixedCount_ParamLength_Binary_Length, (PBYTE)Prop_FixedCount_ParamLength_Binary);
|
|
wprintf(L"Using Macro: EventWriteSampleEvt_FixedCount_ParamLength_Binary.\n");
|
|
|
|
//
|
|
// Write Parametrized count Integer data array for Event ID 309 in AdvancedProvider.man.
|
|
//
|
|
|
|
INT8 Prop_ParamCount_Int8[4] = {'a', 'b', 'c', 'd'};
|
|
EventWriteSampleEvt_ParamCount_Int8(4, (CHAR*)Prop_ParamCount_Int8);
|
|
wprintf(L"Using Macro: EventWriteSampleEvt_ParamCount_Int8.\n");
|
|
|
|
//
|
|
// Write Parametrized count NULL terminated Unicode string for Event ID 310 in AdvancedProvider.man.
|
|
//
|
|
|
|
LPWSTR Prop_ParamCount_UnicodeString = L"Param Count UnicodeString...";
|
|
UINT8 Prop_ParamCount_UnicodeString_Len = (UINT8)wcslen(Prop_ParamCount_UnicodeString);
|
|
EventWriteSampleEvt_ParamCount_UnicodeString(1, Prop_ParamCount_UnicodeString_Len, Prop_ParamCount_UnicodeString);
|
|
wprintf(L"Using Macro: EventWriteSampleEvt_ParamCount_UnicodeString.\n");
|
|
|
|
//
|
|
// Write Parametrized count NULL terminated Ansi string for Event ID 311 in AdvancedProvider.man.
|
|
//
|
|
|
|
LPCSTR Prop_ParamCount_AnsiString = "Param count Ansi string ...";
|
|
UINT8 Prop_ParamCount_AnsiString_Len = (INT8) strlen(Prop_ParamCount_AnsiString);
|
|
EventWriteSampleEvt_ParamCount_AnsiString(1, Prop_ParamCount_AnsiString_Len, Prop_ParamCount_AnsiString);
|
|
wprintf(L"Using Macro: EventWriteSampleEvt_ParamCount_AnsiString.\n");
|
|
|
|
//
|
|
// Write Parametrized count Fixed length Unicode string for Event ID 312 in AdvancedProvider.man.
|
|
//
|
|
|
|
UINT8 Prop_ParamCount_FixedLength_UnicodeString_Count =(UINT8)wcslen(Prop_FixedCount_ParamLength_UnicodeString)/15 ;// , Prop_ParamCount_FixedLength_UnicodeString
|
|
EventWriteSampleEvt_ParamCount_FixedLength_UnicodeString(Prop_ParamCount_FixedLength_UnicodeString_Count, Prop_FixedCount_ParamLength_UnicodeString);
|
|
wprintf(L"Using Macro: EventWriteSampleEvt_ParamCount_FixedLength_UnicodeString.\n");
|
|
|
|
//
|
|
// Write Parametrized count Fixed length Ansi string for Event ID 313 in AdvancedProvider.man.
|
|
//
|
|
|
|
UINT8 Prop_ParamCount_FixedLength_AnsiString_Count = (UINT8)strlen(Prop_FixedCount_ParamLength_AnsiString)/15;
|
|
EventWriteSampleEvt_ParamCount_FixedLength_AnsiString(Prop_ParamCount_FixedLength_AnsiString_Count, Prop_FixedCount_ParamLength_AnsiString);
|
|
wprintf(L"Using Macro: EventWriteSampleEvt_ParamCount_FixedLength_AnsiString.\n");
|
|
|
|
//
|
|
// Write Parametrized count Fixed length Binary data array string for Event ID 314 in AdvancedProvider.man.
|
|
//
|
|
EventWriteSampleEvt_ParamCount_FixedLength_Binary(3, (PBYTE)Prop_FixedCount_ParamLength_Binary);
|
|
wprintf(L"Using Macro: EventWriteSampleEvt_ParamCount_FixedLength_Binary.\n");
|
|
|
|
//
|
|
// Write Parametrized count parametrized length Unicode string for Event ID 315 in AdvancedProvider.man.
|
|
//
|
|
|
|
UINT8 Prop_ParamCount_ParamLength_UnicodeString_Count = (UINT8)wcslen(Prop_FixedCount_ParamLength_UnicodeString)/9;
|
|
UINT8 Prop_ParamCount_ParamLength_UnicodeString_Length = (UINT8)wcslen(Prop_FixedCount_ParamLength_UnicodeString)/5;
|
|
EventWriteSampleEvt_ParamCount_ParamLength_UnicodeString(Prop_ParamCount_ParamLength_UnicodeString_Count, Prop_ParamCount_ParamLength_UnicodeString_Length, Prop_FixedCount_ParamLength_UnicodeString);
|
|
wprintf(L"Using Macro: EventWriteSampleEvt_ParamCount_ParamLength_UnicodeString.\n");
|
|
|
|
//
|
|
// Write Parametrized count Parametrized length Ansi string for Event ID 316 in AdvancedProvider.man.
|
|
//
|
|
|
|
UINT8 Prop_ParamCount_ParamLength_AnsiString_Count = (UINT8)strlen(Prop_FixedCount_ParamLength_AnsiString)/9;
|
|
UINT8 Prop_ParamCount_ParamLength_AnsiString_Length = (UINT8)strlen(Prop_FixedCount_ParamLength_AnsiString)/5;
|
|
EventWriteSampleEvt_ParamCount_ParamLength_AnsiString(Prop_ParamCount_ParamLength_AnsiString_Count, Prop_ParamCount_ParamLength_AnsiString_Length, Prop_FixedCount_ParamLength_AnsiString);
|
|
wprintf(L"Using Macro: EventWriteSampleEvt_ParamCount_ParamLength_AnsiString.\n");
|
|
|
|
//
|
|
// Write Parametrized count Parametrized length Binary data array for Event ID 317 in AdvancedProvider.man.
|
|
//
|
|
|
|
EventWriteSampleEvt_ParamCount_ParamLength_Binary(5, 9, (PBYTE)Prop_FixedCount_ParamLength_Binary );
|
|
wprintf(L"Using Macro: EventWriteSampleEvt_ParamCount_ParamLength_Binary.\n");
|
|
|
|
//
|
|
// Write NULL terminated unicode string under User defined channels for Event ID 600.
|
|
//
|
|
|
|
EventWriteSampleEvt_UserChannel_UnicodeString(L"UnicodeString");
|
|
wprintf(L"Using Macro: EventWriteSampleEvt_UserChannel_UnicodeString.\n");
|
|
|
|
//
|
|
// Write Integer data under User defined channel for Event ID 601 in AdvancedProvider.man.
|
|
//
|
|
|
|
EventWriteSampleEvt_UserChannel_UINT8(1);
|
|
wprintf(L"Using Macro: EventWriteSampleEvt_UserChannel_UINT8.\n");
|
|
|
|
//
|
|
// Write Integer data with User defined keyword for Event ID 602 in AdvancedProvider.man.
|
|
//
|
|
|
|
EventWriteSampleEvt_UserKeyword_UINT8(1);
|
|
wprintf(L"Using Macro: EventWriteSampleEvt_UserKeyword_UINT8.\n");
|
|
|
|
//
|
|
// UnAligned template data.
|
|
//
|
|
|
|
UINT8 Prop_Alignment_UInt8_UnicodeString_1 = 97;
|
|
LPWSTR Prop_Alignment_UInt8_UnicodeString_2 = L"UnAligned UnicodeString...";
|
|
EventWriteSampleEvt_Alignment_UInt8_UnicodeString(Prop_Alignment_UInt8_UnicodeString_1, Prop_Alignment_UInt8_UnicodeString_2);
|
|
wprintf(L"Using Macro: EventWriteSampleEvt_Alignment_UInt8_UnicodeString.\n");
|
|
|
|
//
|
|
// Value Map for Event ID 605 in AdvancedProvider.man.
|
|
//
|
|
|
|
EventWriteSampleEvt_ValueMap_UInt8(VMapSymbolVMapValue_1);
|
|
wprintf(L"Using Macro: EventWriteSampleEvt_ValueMap_UInt8.\n");
|
|
|
|
//
|
|
// Value Map for Event ID 605 in AdvancedProvider.man.
|
|
//
|
|
|
|
EventWriteSampleEvt_ValueMap_UInt8(VMapSymbolVMapValue_2);
|
|
wprintf(L"Using Macro: EventWriteSampleEvt_ValueMap_UInt8.\n");
|
|
|
|
//
|
|
// Value Map for Event ID 605 in AdvancedProvider.man.
|
|
//
|
|
|
|
EventWriteSampleEvt_ValueMap_UInt8(VMapSymbolVMapValue_3);
|
|
wprintf(L"Using Macro: EventWriteSampleEvt_ValueMap_UInt8.\n");
|
|
|
|
//
|
|
// Value map for Event ID 605 but value not defined in the manifiset.
|
|
//
|
|
|
|
EventWriteSampleEvt_ValueMap_UInt8(5);
|
|
wprintf(L"Using Macro: EventWriteSampleEvt_ValueMap_UInt8.\n");
|
|
|
|
//
|
|
// Bit Map for Event ID 606 in AdvancedProvider.man.
|
|
//
|
|
|
|
EventWriteSampleEvt_BitMap_UInt8(BMapSymbolBMapValue_1);
|
|
wprintf(L"Using Macro: EventWriteSampleEvt_BitMap_UInt8.\n");
|
|
|
|
//
|
|
// Bit Map for Event ID 606 in AdvancedProvider.man.
|
|
//
|
|
EventWriteSampleEvt_BitMap_UInt8(BMapSymbolBMapValue_2);
|
|
wprintf(L"Using Macro: EventWriteSampleEvt_BitMap_UInt8.\n");
|
|
|
|
//
|
|
// Bit Map for Event ID 606 in AdvancedProvider.man.
|
|
//
|
|
EventWriteSampleEvt_BitMap_UInt8(BMapSymbolBMapValue_3);
|
|
wprintf(L"Using Macro: EventWriteSampleEvt_BitMap_UInt8.\n");
|
|
|
|
//
|
|
// Bit Map for Event ID 606 but value not in the manifest.
|
|
//
|
|
EventWriteSampleEvt_BitMap_UInt8(8);
|
|
wprintf(L"Using Macro: EventWriteSampleEvt_BitMap_UInt8.\n");
|
|
|
|
//
|
|
// Win32Error values.
|
|
//
|
|
EventWriteSampleEvt_UInt32_Win32Error(122);
|
|
wprintf(L"Using Macro: EventWriteSampleEvt_UInt32_Win32Error.\n");
|
|
|
|
//
|
|
// NTSTATUS Error values.
|
|
//
|
|
EventWriteSampleEvt_UInt32_NTSTATUS(0);
|
|
wprintf(L"Using Macro: EventWriteSampleEvt_UInt32_NTSTATUS.\n");
|
|
|
|
//
|
|
// HResult Error Values.
|
|
//
|
|
EventWriteSampleEvt_Int32_HResult(-1);
|
|
wprintf(L"Using Macro: EventWriteSampleEvt_Int32_HResult.\n");
|
|
|
|
//
|
|
// duplicate event IDs, different version.
|
|
//
|
|
EventWriteSampleEvt_INT8_V1(1);
|
|
wprintf(L"Using Macro: EventWriteSampleEvt_INT8_V1.\n");
|
|
|
|
//
|
|
// Write Integer data for Event ID 102, Version 1 in AdvancedProvider.man.
|
|
//
|
|
EventWriteSampleEvt_INT8_V2(1);
|
|
wprintf(L"Using Macro: EventWriteSampleEvt_INT8_V2.\n");
|
|
|
|
//
|
|
// Write NULL terminated Unicdoe string for Event ID 200, Version 1 in AdvancedProvider.man.
|
|
//
|
|
EventWriteSampleEvt_UnicodeString_V1(L"Unicode String");
|
|
wprintf(L"Using Macro: EventWriteSampleEvt_UnicodeString_V1.\n");
|
|
|
|
//
|
|
// Write Fixed count Integer for Event ID 300, Version 1 in AdvancedProvider.man.
|
|
//
|
|
EventWriteSampleEvt_FixedCount_Int8_V1((CHAR*)Prop_FixedCount_Int8_Array);
|
|
wprintf(L"Using Macro: EventWriteSampleEvt_FixedCount_Int8_V1.\n");
|
|
|
|
//
|
|
// Write Fixed count Integer for Event ID 300, Version 2 in AdvancedProvider.man.
|
|
//
|
|
EventWriteSampleEvt_FixedCount_Int8_V3((CHAR*)Prop_FixedCount_Int8_Array);
|
|
wprintf(L"Using Macro: EventWriteSampleEvt_FixedCount_Int8_V3.\n");
|
|
|
|
//
|
|
// Write Fixed count Integer for Event ID 702, Version 2 in AdvancedProvider.man.
|
|
//
|
|
EventWriteSampleEvt_Int32_HResult_V2(-1);
|
|
wprintf(L"Using Macro: EventWriteSampleEvt_Int32_HResult_V2.\n");
|
|
|
|
//
|
|
// Unregister provider if it was registered.
|
|
//
|
|
EventUnregisterMicrosoft_Windows_SDKSample_AdvancedProvider();
|
|
wprintf(L"Using Macro: EventUnregisterMicrosoft_Windows_SDKSample_AdvancedProvider.\n");
|
|
|
|
return Status;
|
|
} |