1 #pragma once 2 3 #define _EVNTRACE_ 4 5 #ifndef WMIAPI 6 #ifndef MIDL_PASS 7 #ifdef _WMI_SOURCE_ 8 #define WMIAPI __stdcall 9 #else 10 #define WMIAPI DECLSPEC_IMPORT __stdcall 11 #endif 12 #endif /* MIDL_PASS */ 13 #endif /* WMIAPI */ 14 15 #include <guiddef.h> 16 17 #ifdef __cplusplus 18 extern "C" { 19 #endif 20 21 DEFINE_GUID (EventTraceGuid, 0x68fdd900, 0x4a3e, 0x11d1, 0x84, 0xf4, 0x00, 0x00, 0xf8, 0x04, 0x64, 0xe3); 22 DEFINE_GUID (SystemTraceControlGuid, 0x9e814aad, 0x3204, 0x11d2, 0x9a, 0x82, 0x00, 0x60, 0x08, 0xa8, 0x69, 0x39); 23 DEFINE_GUID (EventTraceConfigGuid, 0x01853a65, 0x418f, 0x4f36, 0xae, 0xfc, 0xdc, 0x0f, 0x1d, 0x2f, 0xd2, 0x35); 24 DEFINE_GUID (DefaultTraceSecurityGuid, 0x0811c1af, 0x7a07, 0x4a06, 0x82, 0xed, 0x86, 0x94, 0x55, 0xcd, 0xf7, 0x13); 25 26 #define KERNEL_LOGGER_NAMEW L"NT Kernel Logger" 27 #define GLOBAL_LOGGER_NAMEW L"GlobalLogger" 28 #define EVENT_LOGGER_NAMEW L"EventLog" 29 #define DIAG_LOGGER_NAMEW L"DiagLog" 30 31 #define KERNEL_LOGGER_NAMEA "NT Kernel Logger" 32 #define GLOBAL_LOGGER_NAMEA "GlobalLogger" 33 #define EVENT_LOGGER_NAMEA "EventLog" 34 #define DIAG_LOGGER_NAMEA "DiagLog" 35 36 #define MAX_MOF_FIELDS 16 37 38 #ifndef _TRACEHANDLE_DEFINED 39 #define _TRACEHANDLE_DEFINED 40 typedef ULONG64 TRACEHANDLE, *PTRACEHANDLE; 41 #endif 42 43 #define SYSTEM_EVENT_TYPE 1 44 45 #define EVENT_TRACE_TYPE_INFO 0x00 46 #define EVENT_TRACE_TYPE_START 0x01 47 #define EVENT_TRACE_TYPE_END 0x02 48 #define EVENT_TRACE_TYPE_STOP 0x02 49 #define EVENT_TRACE_TYPE_DC_START 0x03 50 #define EVENT_TRACE_TYPE_DC_END 0x04 51 #define EVENT_TRACE_TYPE_EXTENSION 0x05 52 #define EVENT_TRACE_TYPE_REPLY 0x06 53 #define EVENT_TRACE_TYPE_DEQUEUE 0x07 54 #define EVENT_TRACE_TYPE_RESUME 0x07 55 #define EVENT_TRACE_TYPE_CHECKPOINT 0x08 56 #define EVENT_TRACE_TYPE_SUSPEND 0x08 57 #define EVENT_TRACE_TYPE_WINEVT_SEND 0x09 58 #define EVENT_TRACE_TYPE_WINEVT_RECEIVE 0XF0 59 60 #define TRACE_LEVEL_NONE 0 61 #define TRACE_LEVEL_CRITICAL 1 62 #define TRACE_LEVEL_FATAL 1 63 #define TRACE_LEVEL_ERROR 2 64 #define TRACE_LEVEL_WARNING 3 65 #define TRACE_LEVEL_INFORMATION 4 66 #define TRACE_LEVEL_VERBOSE 5 67 #define TRACE_LEVEL_RESERVED6 6 68 #define TRACE_LEVEL_RESERVED7 7 69 #define TRACE_LEVEL_RESERVED8 8 70 #define TRACE_LEVEL_RESERVED9 9 71 72 #define EVENT_TRACE_TYPE_LOAD 0x0A 73 74 #define EVENT_TRACE_TYPE_IO_READ 0x0A 75 #define EVENT_TRACE_TYPE_IO_WRITE 0x0B 76 #define EVENT_TRACE_TYPE_IO_READ_INIT 0x0C 77 #define EVENT_TRACE_TYPE_IO_WRITE_INIT 0x0D 78 #define EVENT_TRACE_TYPE_IO_FLUSH 0x0E 79 #define EVENT_TRACE_TYPE_IO_FLUSH_INIT 0x0F 80 81 #define EVENT_TRACE_TYPE_MM_TF 0x0A 82 #define EVENT_TRACE_TYPE_MM_DZF 0x0B 83 #define EVENT_TRACE_TYPE_MM_COW 0x0C 84 #define EVENT_TRACE_TYPE_MM_GPF 0x0D 85 #define EVENT_TRACE_TYPE_MM_HPF 0x0E 86 #define EVENT_TRACE_TYPE_MM_AV 0x0F 87 88 #define EVENT_TRACE_TYPE_SEND 0x0A 89 #define EVENT_TRACE_TYPE_RECEIVE 0x0B 90 #define EVENT_TRACE_TYPE_CONNECT 0x0C 91 #define EVENT_TRACE_TYPE_DISCONNECT 0x0D 92 #define EVENT_TRACE_TYPE_RETRANSMIT 0x0E 93 #define EVENT_TRACE_TYPE_ACCEPT 0x0F 94 #define EVENT_TRACE_TYPE_RECONNECT 0x10 95 #define EVENT_TRACE_TYPE_CONNFAIL 0x11 96 #define EVENT_TRACE_TYPE_COPY_TCP 0x12 97 #define EVENT_TRACE_TYPE_COPY_ARP 0x13 98 #define EVENT_TRACE_TYPE_ACKFULL 0x14 99 #define EVENT_TRACE_TYPE_ACKPART 0x15 100 #define EVENT_TRACE_TYPE_ACKDUP 0x16 101 102 #define EVENT_TRACE_TYPE_GUIDMAP 0x0A 103 #define EVENT_TRACE_TYPE_CONFIG 0x0B 104 #define EVENT_TRACE_TYPE_SIDINFO 0x0C 105 #define EVENT_TRACE_TYPE_SECURITY 0x0D 106 107 #define EVENT_TRACE_TYPE_REGCREATE 0x0A 108 #define EVENT_TRACE_TYPE_REGOPEN 0x0B 109 #define EVENT_TRACE_TYPE_REGDELETE 0x0C 110 #define EVENT_TRACE_TYPE_REGQUERY 0x0D 111 #define EVENT_TRACE_TYPE_REGSETVALUE 0x0E 112 #define EVENT_TRACE_TYPE_REGDELETEVALUE 0x0F 113 #define EVENT_TRACE_TYPE_REGQUERYVALUE 0x10 114 #define EVENT_TRACE_TYPE_REGENUMERATEKEY 0x11 115 #define EVENT_TRACE_TYPE_REGENUMERATEVALUEKEY 0x12 116 #define EVENT_TRACE_TYPE_REGQUERYMULTIPLEVALUE 0x13 117 #define EVENT_TRACE_TYPE_REGSETINFORMATION 0x14 118 #define EVENT_TRACE_TYPE_REGFLUSH 0x15 119 #define EVENT_TRACE_TYPE_REGKCBCREATE 0x16 120 #define EVENT_TRACE_TYPE_REGKCBDELETE 0x17 121 #define EVENT_TRACE_TYPE_REGKCBRUNDOWNBEGIN 0x18 122 #define EVENT_TRACE_TYPE_REGKCBRUNDOWNEND 0x19 123 #define EVENT_TRACE_TYPE_REGVIRTUALIZE 0x1A 124 #define EVENT_TRACE_TYPE_REGCLOSE 0x1B 125 #define EVENT_TRACE_TYPE_REGSETSECURITY 0x1C 126 #define EVENT_TRACE_TYPE_REGQUERYSECURITY 0x1D 127 #define EVENT_TRACE_TYPE_REGCOMMIT 0x1E 128 #define EVENT_TRACE_TYPE_REGPREPARE 0x1F 129 #define EVENT_TRACE_TYPE_REGROLLBACK 0x20 130 #define EVENT_TRACE_TYPE_REGMOUNTHIVE 0x21 131 132 #define EVENT_TRACE_TYPE_CONFIG_CPU 0x0A 133 #define EVENT_TRACE_TYPE_CONFIG_PHYSICALDISK 0x0B 134 #define EVENT_TRACE_TYPE_CONFIG_LOGICALDISK 0x0C 135 #define EVENT_TRACE_TYPE_CONFIG_NIC 0x0D 136 #define EVENT_TRACE_TYPE_CONFIG_VIDEO 0x0E 137 #define EVENT_TRACE_TYPE_CONFIG_SERVICES 0x0F 138 #define EVENT_TRACE_TYPE_CONFIG_POWER 0x10 139 #define EVENT_TRACE_TYPE_CONFIG_NETINFO 0x11 140 141 #define EVENT_TRACE_TYPE_CONFIG_IRQ 0x15 142 #define EVENT_TRACE_TYPE_CONFIG_PNP 0x16 143 #define EVENT_TRACE_TYPE_CONFIG_IDECHANNEL 0x17 144 #define EVENT_TRACE_TYPE_CONFIG_PLATFORM 0x19 145 146 #define EVENT_TRACE_FLAG_PROCESS 0x00000001 147 #define EVENT_TRACE_FLAG_THREAD 0x00000002 148 #define EVENT_TRACE_FLAG_IMAGE_LOAD 0x00000004 149 150 #define EVENT_TRACE_FLAG_DISK_IO 0x00000100 151 #define EVENT_TRACE_FLAG_DISK_FILE_IO 0x00000200 152 153 #define EVENT_TRACE_FLAG_MEMORY_PAGE_FAULTS 0x00001000 154 #define EVENT_TRACE_FLAG_MEMORY_HARD_FAULTS 0x00002000 155 156 #define EVENT_TRACE_FLAG_NETWORK_TCPIP 0x00010000 157 158 #define EVENT_TRACE_FLAG_REGISTRY 0x00020000 159 #define EVENT_TRACE_FLAG_DBGPRINT 0x00040000 160 161 #define EVENT_TRACE_FLAG_PROCESS_COUNTERS 0x00000008 162 #define EVENT_TRACE_FLAG_CSWITCH 0x00000010 163 #define EVENT_TRACE_FLAG_DPC 0x00000020 164 #define EVENT_TRACE_FLAG_INTERRUPT 0x00000040 165 #define EVENT_TRACE_FLAG_SYSTEMCALL 0x00000080 166 167 #define EVENT_TRACE_FLAG_DISK_IO_INIT 0x00000400 168 169 #define EVENT_TRACE_FLAG_ALPC 0x00100000 170 #define EVENT_TRACE_FLAG_SPLIT_IO 0x00200000 171 172 #define EVENT_TRACE_FLAG_DRIVER 0x00800000 173 #define EVENT_TRACE_FLAG_PROFILE 0x01000000 174 #define EVENT_TRACE_FLAG_FILE_IO 0x02000000 175 #define EVENT_TRACE_FLAG_FILE_IO_INIT 0x04000000 176 177 #define EVENT_TRACE_FLAG_DISPATCHER 0x00000800 178 #define EVENT_TRACE_FLAG_VIRTUAL_ALLOC 0x00004000 179 180 #define EVENT_TRACE_FLAG_EXTENSION 0x80000000 181 #define EVENT_TRACE_FLAG_FORWARD_WMI 0x40000000 182 #define EVENT_TRACE_FLAG_ENABLE_RESERVE 0x20000000 183 184 #define EVENT_TRACE_FILE_MODE_NONE 0x00000000 185 #define EVENT_TRACE_FILE_MODE_SEQUENTIAL 0x00000001 186 #define EVENT_TRACE_FILE_MODE_CIRCULAR 0x00000002 187 #define EVENT_TRACE_FILE_MODE_APPEND 0x00000004 188 189 #define EVENT_TRACE_REAL_TIME_MODE 0x00000100 190 #define EVENT_TRACE_DELAY_OPEN_FILE_MODE 0x00000200 191 #define EVENT_TRACE_BUFFERING_MODE 0x00000400 192 #define EVENT_TRACE_PRIVATE_LOGGER_MODE 0x00000800 193 #define EVENT_TRACE_ADD_HEADER_MODE 0x00001000 194 195 #define EVENT_TRACE_USE_GLOBAL_SEQUENCE 0x00004000 196 #define EVENT_TRACE_USE_LOCAL_SEQUENCE 0x00008000 197 198 #define EVENT_TRACE_RELOG_MODE 0x00010000 199 200 #define EVENT_TRACE_USE_PAGED_MEMORY 0x01000000 201 202 #define EVENT_TRACE_FILE_MODE_NEWFILE 0x00000008 203 #define EVENT_TRACE_FILE_MODE_PREALLOCATE 0x00000020 204 205 #define EVENT_TRACE_NONSTOPPABLE_MODE 0x00000040 206 #define EVENT_TRACE_SECURE_MODE 0x00000080 207 #define EVENT_TRACE_USE_KBYTES_FOR_SIZE 0x00002000 208 #define EVENT_TRACE_PRIVATE_IN_PROC 0x00020000 209 #define EVENT_TRACE_MODE_RESERVED 0x00100000 210 211 #define EVENT_TRACE_NO_PER_PROCESSOR_BUFFERING 0x10000000 212 213 #define EVENT_TRACE_CONTROL_QUERY 0 214 #define EVENT_TRACE_CONTROL_STOP 1 215 #define EVENT_TRACE_CONTROL_UPDATE 2 216 217 #define EVENT_TRACE_CONTROL_FLUSH 3 218 219 #define TRACE_MESSAGE_SEQUENCE 1 220 #define TRACE_MESSAGE_GUID 2 221 #define TRACE_MESSAGE_COMPONENTID 4 222 #define TRACE_MESSAGE_TIMESTAMP 8 223 #define TRACE_MESSAGE_PERFORMANCE_TIMESTAMP 16 224 #define TRACE_MESSAGE_SYSTEMINFO 32 225 226 #define TRACE_MESSAGE_POINTER32 0x0040 227 #define TRACE_MESSAGE_POINTER64 0x0080 228 229 #define TRACE_MESSAGE_FLAG_MASK 0xFFFF 230 231 #define TRACE_MESSAGE_MAXIMUM_SIZE 8*1024 232 233 #define EVENT_TRACE_USE_PROCTIME 0x0001 234 #define EVENT_TRACE_USE_NOCPUTIME 0x0002 235 236 #define TRACE_HEADER_FLAG_USE_TIMESTAMP 0x00000200 237 #define TRACE_HEADER_FLAG_TRACED_GUID 0x00020000 238 #define TRACE_HEADER_FLAG_LOG_WNODE 0x00040000 239 #define TRACE_HEADER_FLAG_USE_GUID_PTR 0x00080000 240 #define TRACE_HEADER_FLAG_USE_MOF_PTR 0x00100000 241 242 #define ETW_NULL_TYPE_VALUE 0 243 #define ETW_OBJECT_TYPE_VALUE 1 244 #define ETW_STRING_TYPE_VALUE 2 245 #define ETW_SBYTE_TYPE_VALUE 3 246 #define ETW_BYTE_TYPE_VALUE 4 247 #define ETW_INT16_TYPE_VALUE 5 248 #define ETW_UINT16_TYPE_VALUE 6 249 #define ETW_INT32_TYPE_VALUE 7 250 #define ETW_UINT32_TYPE_VALUE 8 251 #define ETW_INT64_TYPE_VALUE 9 252 #define ETW_UINT64_TYPE_VALUE 10 253 #define ETW_CHAR_TYPE_VALUE 11 254 #define ETW_SINGLE_TYPE_VALUE 12 255 #define ETW_DOUBLE_TYPE_VALUE 13 256 #define ETW_BOOLEAN_TYPE_VALUE 14 257 #define ETW_DECIMAL_TYPE_VALUE 15 258 259 #define ETW_GUID_TYPE_VALUE 101 260 #define ETW_ASCIICHAR_TYPE_VALUE 102 261 #define ETW_ASCIISTRING_TYPE_VALUE 103 262 #define ETW_COUNTED_STRING_TYPE_VALUE 104 263 #define ETW_POINTER_TYPE_VALUE 105 264 #define ETW_SIZET_TYPE_VALUE 106 265 #define ETW_HIDDEN_TYPE_VALUE 107 266 #define ETW_BOOL_TYPE_VALUE 108 267 #define ETW_COUNTED_ANSISTRING_TYPE_VALUE 109 268 #define ETW_REVERSED_COUNTED_STRING_TYPE_VALUE 110 269 #define ETW_REVERSED_COUNTED_ANSISTRING_TYPE_VALUE 111 270 #define ETW_NON_NULL_TERMINATED_STRING_TYPE_VALUE 112 271 #define ETW_REDUCED_ANSISTRING_TYPE_VALUE 113 272 #define ETW_REDUCED_STRING_TYPE_VALUE 114 273 #define ETW_SID_TYPE_VALUE 115 274 #define ETW_VARIANT_TYPE_VALUE 116 275 #define ETW_PTVECTOR_TYPE_VALUE 117 276 #define ETW_WMITIME_TYPE_VALUE 118 277 #define ETW_DATETIME_TYPE_VALUE 119 278 #define ETW_REFRENCE_TYPE_VALUE 120 279 280 #define TRACE_PROVIDER_FLAG_LEGACY 0x00000001 281 #define TRACE_PROVIDER_FLAG_PRE_ENABLE 0x00000002 282 283 #define EVENT_CONTROL_CODE_DISABLE_PROVIDER 0 284 #define EVENT_CONTROL_CODE_ENABLE_PROVIDER 1 285 #define EVENT_CONTROL_CODE_CAPTURE_STATE 2 286 287 #define DEFINE_TRACE_MOF_FIELD(MOF, ptr, length, type) \ 288 (MOF)->DataPtr = (ULONG64)(ULONG_PTR) ptr; \ 289 (MOF)->Length = (ULONG) length; \ 290 (MOF)->DataType = (ULONG) type; 291 292 typedef struct _EVENT_TRACE_HEADER { 293 USHORT Size; 294 _ANONYMOUS_UNION union { 295 USHORT FieldTypeFlags; 296 _ANONYMOUS_STRUCT struct { 297 UCHAR HeaderType; 298 UCHAR MarkerFlags; 299 } DUMMYSTRUCTNAME; 300 } DUMMYUNIONNAME; 301 _ANONYMOUS_UNION union { 302 ULONG Version; 303 struct { 304 UCHAR Type; 305 UCHAR Level; 306 USHORT Version; 307 } Class; 308 } DUMMYUNIONNAME2; 309 ULONG ThreadId; 310 ULONG ProcessId; 311 LARGE_INTEGER TimeStamp; 312 _ANONYMOUS_UNION union { 313 GUID Guid; 314 ULONGLONG GuidPtr; 315 } DUMMYUNIONNAME3; 316 _ANONYMOUS_UNION union { 317 _ANONYMOUS_STRUCT struct { 318 ULONG KernelTime; 319 ULONG UserTime; 320 } DUMMYSTRUCTNAME; 321 ULONG64 ProcessorTime; 322 _ANONYMOUS_STRUCT struct { 323 ULONG ClientContext; 324 ULONG Flags; 325 } DUMMYSTRUCTNAME2; 326 } DUMMYUNIONNAME4; 327 } EVENT_TRACE_HEADER; 328 329 #ifndef PEVENT_TRACE_HEADER_DEFINED 330 #define PEVENT_TRACE_HEADER_DEFINED 331 typedef struct _EVENT_TRACE_HEADER *PEVENT_TRACE_HEADER; 332 #endif 333 334 typedef struct _EVENT_INSTANCE_HEADER { 335 USHORT Size; 336 _ANONYMOUS_UNION union { 337 USHORT FieldTypeFlags; 338 _ANONYMOUS_STRUCT struct { 339 UCHAR HeaderType; 340 UCHAR MarkerFlags; 341 } DUMMYSTRUCTNAME; 342 } DUMMYUNIONNAME; 343 _ANONYMOUS_UNION union { 344 ULONG Version; 345 struct { 346 UCHAR Type; 347 UCHAR Level; 348 USHORT Version; 349 } Class; 350 } DUMMYUNIONNAME2; 351 ULONG ThreadId; 352 ULONG ProcessId; 353 LARGE_INTEGER TimeStamp; 354 ULONGLONG RegHandle; 355 ULONG InstanceId; 356 ULONG ParentInstanceId; 357 _ANONYMOUS_UNION union { 358 _ANONYMOUS_STRUCT struct { 359 ULONG KernelTime; 360 ULONG UserTime; 361 } DUMMYSTRUCTNAME; 362 ULONG64 ProcessorTime; 363 _ANONYMOUS_STRUCT struct { 364 ULONG EventId; 365 ULONG Flags; 366 } DUMMYSTRUCTNAME2; 367 } DUMMYUNIONNAME3; 368 ULONGLONG ParentRegHandle; 369 } EVENT_INSTANCE_HEADER, *PEVENT_INSTANCE_HEADER; 370 371 typedef struct _MOF_FIELD { 372 ULONG64 DataPtr; 373 ULONG Length; 374 ULONG DataType; 375 } MOF_FIELD, *PMOF_FIELD; 376 377 typedef struct _EVENT_INSTANCE_INFO { 378 HANDLE RegHandle; 379 ULONG InstanceId; 380 } EVENT_INSTANCE_INFO, *PEVENT_INSTANCE_INFO; 381 382 typedef struct _TRACE_GUID_PROPERTIES { 383 GUID Guid; 384 ULONG GuidType; 385 ULONG LoggerId; 386 ULONG EnableLevel; 387 ULONG EnableFlags; 388 BOOLEAN IsEnable; 389 } TRACE_GUID_PROPERTIES, *PTRACE_GUID_PROPERTIES; 390 391 typedef struct _ETW_BUFFER_CONTEXT { 392 UCHAR ProcessorNumber; 393 UCHAR Alignment; 394 USHORT LoggerId; 395 } ETW_BUFFER_CONTEXT, *PETW_BUFFER_CONTEXT; 396 397 typedef struct _TRACE_ENABLE_INFO { 398 ULONG IsEnabled; 399 UCHAR Level; 400 UCHAR Reserved1; 401 USHORT LoggerId; 402 ULONG EnableProperty; 403 ULONG Reserved2; 404 ULONGLONG MatchAnyKeyword; 405 ULONGLONG MatchAllKeyword; 406 } TRACE_ENABLE_INFO, *PTRACE_ENABLE_INFO; 407 408 typedef struct _TRACE_PROVIDER_INSTANCE_INFO { 409 ULONG NextOffset; 410 ULONG EnableCount; 411 ULONG Pid; 412 ULONG Flags; 413 } TRACE_PROVIDER_INSTANCE_INFO, *PTRACE_PROVIDER_INSTANCE_INFO; 414 415 typedef struct _TRACE_GUID_INFO { 416 ULONG InstanceCount; 417 ULONG Reserved; 418 } TRACE_GUID_INFO, *PTRACE_GUID_INFO; 419 420 typedef struct _EVENT_TRACE { 421 EVENT_TRACE_HEADER Header; 422 ULONG InstanceId; 423 ULONG ParentInstanceId; 424 GUID ParentGuid; 425 PVOID MofData; 426 ULONG MofLength; 427 _ANONYMOUS_UNION union { 428 ULONG ClientContext; 429 ETW_BUFFER_CONTEXT BufferContext; 430 } DUMMYUNIONNAME; 431 } EVENT_TRACE, *PEVENT_TRACE; 432 433 #if !(defined(_NTDDK_) || defined(_NTIFS_)) || defined(_WMIKM_) 434 435 typedef struct _TRACE_LOGFILE_HEADER { 436 ULONG BufferSize; 437 _ANONYMOUS_UNION union { 438 ULONG Version; 439 struct { 440 UCHAR MajorVersion; 441 UCHAR MinorVersion; 442 UCHAR SubVersion; 443 UCHAR SubMinorVersion; 444 } VersionDetail; 445 } DUMMYUNIONNAME; 446 ULONG ProviderVersion; 447 ULONG NumberOfProcessors; 448 LARGE_INTEGER EndTime; 449 ULONG TimerResolution; 450 ULONG MaximumFileSize; 451 ULONG LogFileMode; 452 ULONG BuffersWritten; 453 _ANONYMOUS_UNION union { 454 GUID LogInstanceGuid; 455 _ANONYMOUS_STRUCT struct { 456 ULONG StartBuffers; 457 ULONG PointerSize; 458 ULONG EventsLost; 459 ULONG CpuSpeedInMHz; 460 } DUMMYSTRUCTNAME; 461 } DUMMYUNIONNAME2; 462 #if defined(_WMIKM_) 463 PWCHAR LoggerName; 464 PWCHAR LogFileName; 465 RTL_TIME_ZONE_INFORMATION TimeZone; 466 #else 467 LPWSTR LoggerName; 468 LPWSTR LogFileName; 469 TIME_ZONE_INFORMATION TimeZone; 470 #endif 471 LARGE_INTEGER BootTime; 472 LARGE_INTEGER PerfFreq; 473 LARGE_INTEGER StartTime; 474 ULONG ReservedFlags; 475 ULONG BuffersLost; 476 } TRACE_LOGFILE_HEADER, *PTRACE_LOGFILE_HEADER; 477 478 typedef struct _TRACE_LOGFILE_HEADER32 { 479 ULONG BufferSize; 480 _ANONYMOUS_UNION union { 481 ULONG Version; 482 struct { 483 UCHAR MajorVersion; 484 UCHAR MinorVersion; 485 UCHAR SubVersion; 486 UCHAR SubMinorVersion; 487 } VersionDetail; 488 } DUMMYUNIONNAME; 489 ULONG ProviderVersion; 490 ULONG NumberOfProcessors; 491 LARGE_INTEGER EndTime; 492 ULONG TimerResolution; 493 ULONG MaximumFileSize; 494 ULONG LogFileMode; 495 ULONG BuffersWritten; 496 _ANONYMOUS_UNION union { 497 GUID LogInstanceGuid; 498 _ANONYMOUS_STRUCT struct { 499 ULONG StartBuffers; 500 ULONG PointerSize; 501 ULONG EventsLost; 502 ULONG CpuSpeedInMHz; 503 } DUMMYSTRUCTNAME; 504 } DUMMYUNIONNAME2; 505 #if defined(_WMIKM_) 506 ULONG32 LoggerName; 507 ULONG32 LogFileName; 508 RTL_TIME_ZONE_INFORMATION TimeZone; 509 #else 510 ULONG32 LoggerName; 511 ULONG32 LogFileName; 512 TIME_ZONE_INFORMATION TimeZone; 513 #endif 514 LARGE_INTEGER BootTime; 515 LARGE_INTEGER PerfFreq; 516 LARGE_INTEGER StartTime; 517 ULONG ReservedFlags; 518 ULONG BuffersLost; 519 } TRACE_LOGFILE_HEADER32, *PTRACE_LOGFILE_HEADER32; 520 521 typedef struct _TRACE_LOGFILE_HEADER64 { 522 ULONG BufferSize; 523 _ANONYMOUS_UNION union { 524 ULONG Version; 525 struct { 526 UCHAR MajorVersion; 527 UCHAR MinorVersion; 528 UCHAR SubVersion; 529 UCHAR SubMinorVersion; 530 } VersionDetail; 531 } DUMMYUNIONNAME; 532 ULONG ProviderVersion; 533 ULONG NumberOfProcessors; 534 LARGE_INTEGER EndTime; 535 ULONG TimerResolution; 536 ULONG MaximumFileSize; 537 ULONG LogFileMode; 538 ULONG BuffersWritten; 539 _ANONYMOUS_UNION union { 540 GUID LogInstanceGuid; 541 _ANONYMOUS_STRUCT struct { 542 ULONG StartBuffers; 543 ULONG PointerSize; 544 ULONG EventsLost; 545 ULONG CpuSpeedInMHz; 546 } DUMMYSTRUCTNAME; 547 } DUMMYUNIONNAME2; 548 #if defined(_WMIKM_) 549 ULONG64 LoggerName; 550 ULONG64 LogFileName; 551 RTL_TIME_ZONE_INFORMATION TimeZone; 552 #else 553 ULONG64 LoggerName; 554 ULONG64 LogFileName; 555 TIME_ZONE_INFORMATION TimeZone; 556 #endif 557 LARGE_INTEGER BootTime; 558 LARGE_INTEGER PerfFreq; 559 LARGE_INTEGER StartTime; 560 ULONG ReservedFlags; 561 ULONG BuffersLost; 562 } TRACE_LOGFILE_HEADER64, *PTRACE_LOGFILE_HEADER64; 563 564 #endif /* !_NTDDK_ || _WMIKM_ */ 565 566 #if !defined(_WMIKM_) && !defined(_NTDDK_) && !defined(_NTIFS_) 567 568 #define ENABLE_TRACE_PARAMETERS_VERSION 1 569 570 typedef struct _EVENT_TRACE_PROPERTIES { 571 WNODE_HEADER Wnode; 572 ULONG BufferSize; 573 ULONG MinimumBuffers; 574 ULONG MaximumBuffers; 575 ULONG MaximumFileSize; 576 ULONG LogFileMode; 577 ULONG FlushTimer; 578 ULONG EnableFlags; 579 LONG AgeLimit; 580 ULONG NumberOfBuffers; 581 ULONG FreeBuffers; 582 ULONG EventsLost; 583 ULONG BuffersWritten; 584 ULONG LogBuffersLost; 585 ULONG RealTimeBuffersLost; 586 HANDLE LoggerThreadId; 587 ULONG LogFileNameOffset; 588 ULONG LoggerNameOffset; 589 } EVENT_TRACE_PROPERTIES, *PEVENT_TRACE_PROPERTIES; 590 591 typedef struct _TRACE_GUID_REGISTRATION { 592 LPCGUID Guid; 593 HANDLE RegHandle; 594 } TRACE_GUID_REGISTRATION, *PTRACE_GUID_REGISTRATION; 595 596 typedef struct _EVENT_RECORD EVENT_RECORD, *PEVENT_RECORD; 597 typedef struct _EVENT_TRACE_LOGFILEW EVENT_TRACE_LOGFILEW, *PEVENT_TRACE_LOGFILEW; 598 typedef struct _EVENT_TRACE_LOGFILEA EVENT_TRACE_LOGFILEA, *PEVENT_TRACE_LOGFILEA; 599 #ifndef _EVNTPROV_ 600 typedef struct _EVENT_FILTER_DESCRIPTOR EVENT_FILTER_DESCRIPTOR, *PEVENT_FILTER_DESCRIPTOR; 601 #endif 602 603 typedef ULONG 604 (WINAPI *PEVENT_TRACE_BUFFER_CALLBACKW)( 605 PEVENT_TRACE_LOGFILEW Logfile); 606 607 typedef ULONG 608 (WINAPI *PEVENT_TRACE_BUFFER_CALLBACKA)( 609 PEVENT_TRACE_LOGFILEA Logfile); 610 611 typedef VOID 612 (WINAPI *PEVENT_CALLBACK)( 613 PEVENT_TRACE pEvent ); 614 615 typedef VOID 616 (WINAPI *PEVENT_RECORD_CALLBACK)( 617 PEVENT_RECORD EventRecord); 618 619 typedef ULONG 620 (WINAPI *WMIDPREQUEST)( 621 IN WMIDPREQUESTCODE RequestCode, 622 IN PVOID RequestContext, 623 IN OUT ULONG *BufferSize, 624 IN OUT PVOID Buffer); 625 626 struct _EVENT_TRACE_LOGFILEW { 627 LPWSTR LogFileName; 628 LPWSTR LoggerName; 629 LONGLONG CurrentTime; 630 ULONG BuffersRead; 631 _ANONYMOUS_UNION union { 632 ULONG LogFileMode; 633 ULONG ProcessTraceMode; 634 } DUMMYUNIONNAME; 635 EVENT_TRACE CurrentEvent; 636 TRACE_LOGFILE_HEADER LogfileHeader; 637 PEVENT_TRACE_BUFFER_CALLBACKW BufferCallback; 638 ULONG BufferSize; 639 ULONG Filled; 640 ULONG EventsLost; 641 _ANONYMOUS_UNION union { 642 PEVENT_CALLBACK EventCallback; 643 PEVENT_RECORD_CALLBACK EventRecordCallback; 644 } DUMMYUNIONNAME2; 645 ULONG IsKernelTrace; 646 PVOID Context; 647 }; 648 649 struct _EVENT_TRACE_LOGFILEA { 650 LPSTR LogFileName; 651 LPSTR LoggerName; 652 LONGLONG CurrentTime; 653 ULONG BuffersRead; 654 _ANONYMOUS_UNION union { 655 ULONG LogFileMode; 656 ULONG ProcessTraceMode; 657 } DUMMYUNIONNAME; 658 EVENT_TRACE CurrentEvent; 659 TRACE_LOGFILE_HEADER LogfileHeader; 660 PEVENT_TRACE_BUFFER_CALLBACKA BufferCallback; 661 ULONG BufferSize; 662 ULONG Filled; 663 ULONG EventsLost; 664 _ANONYMOUS_UNION union { 665 PEVENT_CALLBACK EventCallback; 666 PEVENT_RECORD_CALLBACK EventRecordCallback; 667 } DUMMYUNIONNAME2; 668 ULONG IsKernelTrace; 669 PVOID Context; 670 }; 671 672 #if defined(_UNICODE) || defined(UNICODE) 673 674 #define PEVENT_TRACE_BUFFER_CALLBACK PEVENT_TRACE_BUFFER_CALLBACKW 675 #define EVENT_TRACE_LOGFILE EVENT_TRACE_LOGFILEW 676 #define PEVENT_TRACE_LOGFILE PEVENT_TRACE_LOGFILEW 677 #define KERNEL_LOGGER_NAME KERNEL_LOGGER_NAMEW 678 #define GLOBAL_LOGGER_NAME GLOBAL_LOGGER_NAMEW 679 #define EVENT_LOGGER_NAME EVENT_LOGGER_NAMEW 680 681 #else 682 683 #define PEVENT_TRACE_BUFFER_CALLBACK PEVENT_TRACE_BUFFER_CALLBACKA 684 #define EVENT_TRACE_LOGFILE EVENT_TRACE_LOGFILEA 685 #define PEVENT_TRACE_LOGFILE PEVENT_TRACE_LOGFILEA 686 #define KERNEL_LOGGER_NAME KERNEL_LOGGER_NAMEA 687 #define GLOBAL_LOGGER_NAME GLOBAL_LOGGER_NAMEA 688 #define EVENT_LOGGER_NAME EVENT_LOGGER_NAMEA 689 690 #endif /* defined(_UNICODE) || defined(UNICODE) */ 691 692 typedef enum _TRACE_QUERY_INFO_CLASS { 693 TraceGuidQueryList, 694 TraceGuidQueryInfo, 695 TraceGuidQueryProcess, 696 TraceStackTracingInfo, 697 MaxTraceSetInfoClass 698 } TRACE_QUERY_INFO_CLASS, TRACE_INFO_CLASS; 699 700 typedef struct _CLASSIC_EVENT_ID { 701 GUID EventGuid; 702 UCHAR Type; 703 UCHAR Reserved[7]; 704 } CLASSIC_EVENT_ID, *PCLASSIC_EVENT_ID; 705 706 typedef struct _ENABLE_TRACE_PARAMETERS { 707 ULONG Version; 708 ULONG EnableProperty; 709 ULONG ControlFlags; 710 GUID SourceId; 711 PEVENT_FILTER_DESCRIPTOR EnableFilterDesc; 712 } ENABLE_TRACE_PARAMETERS, *PENABLE_TRACE_PARAMETERS; 713 714 #define INVALID_PROCESSTRACE_HANDLE ((TRACEHANDLE)(ULONG_PTR)INVALID_HANDLE_VALUE) 715 716 #if defined(UNICODE) || defined(_UNICODE) 717 718 #define RegisterTraceGuids RegisterTraceGuidsW 719 #define StartTrace StartTraceW 720 #define ControlTrace ControlTraceW 721 722 #if defined(__TRACE_W2K_COMPATIBLE) 723 724 #define StopTrace(a,b,c) ControlTraceW((a),(b),(c), EVENT_TRACE_CONTROL_STOP) 725 #define QueryTrace(a,b,c) ControlTraceW((a),(b),(c), EVENT_TRACE_CONTROL_QUERY) 726 #define UpdateTrace(a,b,c) ControlTraceW((a),(b),(c), EVENT_TRACE_CONTROL_UPDATE) 727 728 #else 729 730 #define StopTrace StopTraceW 731 #define QueryTrace QueryTraceW 732 #define UpdateTrace UpdateTraceW 733 734 #endif /* defined(__TRACE_W2K_COMPATIBLE) */ 735 736 #if (NTDDI_VERSION >= NTDDI_WINXP) 737 #define FlushTrace FlushTraceW 738 #endif 739 740 #define QueryAllTraces QueryAllTracesW 741 #define OpenTrace OpenTraceW 742 743 #else /* defined(UNICODE) || defined(_UNICODE) */ 744 745 #define RegisterTraceGuids RegisterTraceGuidsA 746 #define StartTrace StartTraceA 747 #define ControlTrace ControlTraceA 748 749 #if defined(__TRACE_W2K_COMPATIBLE) 750 751 #define StopTrace(a,b,c) ControlTraceA((a),(b),(c), EVENT_TRACE_CONTROL_STOP) 752 #define QueryTrace(a,b,c) ControlTraceA((a),(b),(c), EVENT_TRACE_CONTROL_QUERY) 753 #define UpdateTrace(a,b,c) ControlTraceA((a),(b),(c), EVENT_TRACE_CONTROL_UPDATE) 754 755 #else 756 757 #define StopTrace StopTraceA 758 #define QueryTrace QueryTraceA 759 #define UpdateTrace UpdateTraceA 760 761 #endif /* defined(__TRACE_W2K_COMPATIBLE) */ 762 763 #if (NTDDI_VERSION >= NTDDI_WINXP) 764 #define FlushTrace FlushTraceA 765 #endif 766 767 #define QueryAllTraces QueryAllTracesA 768 #define OpenTrace OpenTraceA 769 770 #endif /* defined(UNICODE) || defined(_UNICODE) */ 771 772 EXTERN_C 773 ULONG 774 WMIAPI 775 StartTraceW( 776 OUT PTRACEHANDLE TraceHandle, 777 IN LPCWSTR InstanceName, 778 IN OUT PEVENT_TRACE_PROPERTIES Properties); 779 780 EXTERN_C 781 ULONG 782 WMIAPI 783 StartTraceA( 784 OUT PTRACEHANDLE TraceHandle, 785 IN LPCSTR InstanceName, 786 IN OUT PEVENT_TRACE_PROPERTIES Properties); 787 788 EXTERN_C 789 ULONG 790 WMIAPI 791 StopTraceW( 792 IN TRACEHANDLE TraceHandle, 793 IN LPCWSTR InstanceName OPTIONAL, 794 IN OUT PEVENT_TRACE_PROPERTIES Properties); 795 796 EXTERN_C 797 ULONG 798 WMIAPI 799 StopTraceA( 800 IN TRACEHANDLE TraceHandle, 801 IN LPCSTR InstanceName OPTIONAL, 802 IN OUT PEVENT_TRACE_PROPERTIES Properties); 803 804 EXTERN_C 805 ULONG 806 WMIAPI 807 QueryTraceW( 808 IN TRACEHANDLE TraceHandle, 809 IN LPCWSTR InstanceName OPTIONAL, 810 IN OUT PEVENT_TRACE_PROPERTIES Properties); 811 812 EXTERN_C 813 ULONG 814 WMIAPI 815 QueryTraceA( 816 IN TRACEHANDLE TraceHandle, 817 IN LPCSTR InstanceName OPTIONAL, 818 IN OUT PEVENT_TRACE_PROPERTIES Properties); 819 820 EXTERN_C 821 ULONG 822 WMIAPI 823 UpdateTraceW( 824 IN TRACEHANDLE TraceHandle, 825 IN LPCWSTR InstanceName OPTIONAL, 826 IN OUT PEVENT_TRACE_PROPERTIES Properties); 827 828 EXTERN_C 829 ULONG 830 WMIAPI 831 UpdateTraceA( 832 IN TRACEHANDLE TraceHandle, 833 IN LPCSTR InstanceName OPTIONAL, 834 IN OUT PEVENT_TRACE_PROPERTIES Properties); 835 836 EXTERN_C 837 ULONG 838 WMIAPI 839 ControlTraceW( 840 IN TRACEHANDLE TraceHandle, 841 IN LPCWSTR InstanceName OPTIONAL, 842 IN OUT PEVENT_TRACE_PROPERTIES Properties, 843 IN ULONG ControlCode); 844 845 EXTERN_C 846 ULONG 847 WMIAPI 848 ControlTraceA( 849 IN TRACEHANDLE TraceHandle, 850 IN LPCSTR InstanceName OPTIONAL, 851 IN OUT PEVENT_TRACE_PROPERTIES Properties, 852 IN ULONG ControlCode); 853 854 EXTERN_C 855 ULONG 856 WMIAPI 857 QueryAllTracesW( 858 OUT PEVENT_TRACE_PROPERTIES *PropertyArray, 859 IN ULONG PropertyArrayCount, 860 OUT PULONG LoggerCount); 861 862 EXTERN_C 863 ULONG 864 WMIAPI 865 QueryAllTracesA( 866 OUT PEVENT_TRACE_PROPERTIES *PropertyArray, 867 IN ULONG PropertyArrayCount, 868 OUT PULONG LoggerCount); 869 870 EXTERN_C 871 ULONG 872 WMIAPI 873 EnableTrace( 874 IN ULONG Enable, 875 IN ULONG EnableFlag, 876 IN ULONG EnableLevel, 877 IN LPCGUID ControlGuid, 878 IN TRACEHANDLE TraceHandle); 879 880 EXTERN_C 881 ULONG 882 WMIAPI 883 CreateTraceInstanceId( 884 IN HANDLE RegHandle, 885 IN OUT PEVENT_INSTANCE_INFO InstInfo); 886 887 EXTERN_C 888 ULONG 889 WMIAPI 890 TraceEvent( 891 IN TRACEHANDLE TraceHandle, 892 IN PEVENT_TRACE_HEADER EventTrace); 893 894 EXTERN_C 895 ULONG 896 WMIAPI 897 TraceEventInstance( 898 IN TRACEHANDLE TraceHandle, 899 IN PEVENT_INSTANCE_HEADER EventTrace, 900 IN PEVENT_INSTANCE_INFO InstInfo, 901 IN PEVENT_INSTANCE_INFO ParentInstInfo OPTIONAL); 902 903 EXTERN_C 904 ULONG 905 WMIAPI 906 RegisterTraceGuidsW( 907 IN WMIDPREQUEST RequestAddress, 908 IN PVOID RequestContext OPTIONAL, 909 IN LPCGUID ControlGuid, 910 IN ULONG GuidCount, 911 IN PTRACE_GUID_REGISTRATION TraceGuidReg OPTIONAL, 912 IN LPCWSTR MofImagePath OPTIONAL, 913 IN LPCWSTR MofResourceName OPTIONAL, 914 OUT PTRACEHANDLE RegistrationHandle); 915 916 EXTERN_C 917 ULONG 918 WMIAPI 919 RegisterTraceGuidsA( 920 IN WMIDPREQUEST RequestAddress, 921 IN PVOID RequestContext OPTIONAL, 922 IN LPCGUID ControlGuid, 923 IN ULONG GuidCount, 924 IN PTRACE_GUID_REGISTRATION TraceGuidReg OPTIONAL, 925 IN LPCSTR MofImagePath OPTIONAL, 926 IN LPCSTR MofResourceName OPTIONAL, 927 OUT PTRACEHANDLE RegistrationHandle); 928 929 EXTERN_C 930 ULONG 931 WMIAPI 932 UnregisterTraceGuids( 933 IN TRACEHANDLE RegistrationHandle); 934 935 EXTERN_C 936 TRACEHANDLE 937 WMIAPI 938 GetTraceLoggerHandle( 939 IN PVOID Buffer); 940 941 EXTERN_C 942 UCHAR 943 WMIAPI 944 GetTraceEnableLevel( 945 IN TRACEHANDLE TraceHandle); 946 947 EXTERN_C 948 ULONG 949 WMIAPI 950 GetTraceEnableFlags( 951 IN TRACEHANDLE TraceHandle); 952 953 EXTERN_C 954 TRACEHANDLE 955 WMIAPI 956 OpenTraceA( 957 IN OUT PEVENT_TRACE_LOGFILEA Logfile); 958 959 EXTERN_C 960 TRACEHANDLE 961 WMIAPI 962 OpenTraceW( 963 IN OUT PEVENT_TRACE_LOGFILEW Logfile); 964 965 EXTERN_C 966 ULONG 967 WMIAPI 968 ProcessTrace( 969 IN PTRACEHANDLE HandleArray, 970 IN ULONG HandleCount, 971 IN LPFILETIME StartTime OPTIONAL, 972 IN LPFILETIME EndTime OPTIONAL); 973 974 EXTERN_C 975 ULONG 976 WMIAPI 977 CloseTrace( 978 IN TRACEHANDLE TraceHandle); 979 980 EXTERN_C 981 ULONG 982 WMIAPI 983 SetTraceCallback( 984 IN LPCGUID pGuid, 985 IN PEVENT_CALLBACK EventCallback); 986 987 EXTERN_C 988 ULONG 989 WMIAPI 990 RemoveTraceCallback( 991 IN LPCGUID pGuid); 992 993 EXTERN_C 994 ULONG 995 __cdecl 996 TraceMessage( 997 IN TRACEHANDLE LoggerHandle, 998 IN ULONG MessageFlags, 999 IN LPCGUID MessageGuid, 1000 IN USHORT MessageNumber, 1001 ...); 1002 1003 EXTERN_C 1004 ULONG 1005 WMIAPI 1006 TraceMessageVa( 1007 IN TRACEHANDLE LoggerHandle, 1008 IN ULONG MessageFlags, 1009 IN LPCGUID MessageGuid, 1010 IN USHORT MessageNumber, 1011 IN va_list MessageArgList); 1012 1013 #if (WINVER >= _WIN32_WINNT_WINXP) 1014 1015 EXTERN_C 1016 ULONG 1017 WMIAPI 1018 EnumerateTraceGuids( 1019 IN OUT PTRACE_GUID_PROPERTIES *GuidPropertiesArray, 1020 IN ULONG PropertyArrayCount, 1021 OUT PULONG GuidCount); 1022 1023 EXTERN_C 1024 ULONG 1025 WMIAPI 1026 FlushTraceW( 1027 IN TRACEHANDLE TraceHandle, 1028 IN LPCWSTR InstanceName OPTIONAL, 1029 IN OUT PEVENT_TRACE_PROPERTIES Properties); 1030 1031 EXTERN_C 1032 ULONG 1033 WMIAPI 1034 FlushTraceA( 1035 IN TRACEHANDLE TraceHandle, 1036 IN LPCSTR InstanceName OPTIONAL, 1037 IN OUT PEVENT_TRACE_PROPERTIES Properties); 1038 1039 #endif /* (WINVER >= _WIN32_WINNT_WINXP) */ 1040 1041 #if (WINVER >= _WIN32_WINNT_VISTA) 1042 1043 EXTERN_C 1044 ULONG 1045 WMIAPI 1046 EnableTraceEx( 1047 IN LPCGUID ProviderId, 1048 IN LPCGUID SourceId OPTIONAL, 1049 IN TRACEHANDLE TraceHandle, 1050 IN ULONG IsEnabled, 1051 IN UCHAR Level, 1052 IN ULONGLONG MatchAnyKeyword, 1053 IN ULONGLONG MatchAllKeyword, 1054 IN ULONG EnableProperty, 1055 IN PEVENT_FILTER_DESCRIPTOR EnableFilterDesc OPTIONAL); 1056 1057 EXTERN_C 1058 ULONG 1059 WMIAPI 1060 EnumerateTraceGuidsEx( 1061 IN TRACE_QUERY_INFO_CLASS TraceQueryInfoClass, 1062 IN PVOID InBuffer OPTIONAL, 1063 IN ULONG InBufferSize, 1064 OUT PVOID OutBuffer OPTIONAL, 1065 IN ULONG OutBufferSize, 1066 OUT PULONG ReturnLength); 1067 1068 #endif /* (WINVER >= _WIN32_WINNT_VISTA) */ 1069 1070 #if (WINVER >= _WIN32_WINNT_WIN7) 1071 1072 EXTERN_C 1073 ULONG 1074 WMIAPI 1075 EnableTraceEx2( 1076 IN TRACEHANDLE TraceHandle, 1077 IN LPCGUID ProviderId, 1078 IN ULONG ControlCode, 1079 IN UCHAR Level, 1080 IN ULONGLONG MatchAnyKeyword, 1081 IN ULONGLONG MatchAllKeyword, 1082 IN ULONG Timeout, 1083 IN PENABLE_TRACE_PARAMETERS EnableParameters OPTIONAL); 1084 1085 EXTERN_C 1086 ULONG 1087 WMIAPI 1088 TraceSetInformation( 1089 IN TRACEHANDLE SessionHandle, 1090 IN TRACE_INFO_CLASS InformationClass, 1091 IN PVOID TraceInformation, 1092 IN ULONG InformationLength); 1093 1094 #endif /* (WINVER >= _WIN32_WINNT_WIN7) */ 1095 1096 #endif /* !defined(_WMIKM_) && !defined(_NTDDK_) && !defined(_NTIFS_) */ 1097 1098 #ifdef __cplusplus 1099 } /* extern "C" */ 1100 #endif 1101