ETW.h
/*
SPDX-License-Identifier: MIT
Copyright © 1991-2022 Amebis
Copyright © 2016 GÉANT
*/
#pragma once
#include "Common.h"
#include <assert.h>
#include <evntprov.h>
#include <evntcons.h>
#include <stdarg.h>
#include <tdh.h>
#include <memory>
#include <string>
#include <vector>
#pragma warning(push)
#pragma warning(disable: 4505) // Don't warn on unused code
template<class _Ty, class _Ax>
static _Success_(return == ERROR_SUCCESS) ULONG TdhGetProperty(_In_ PEVENT_RECORD pEvent, _In_ ULONG TdhContextCount, _In_reads_opt_(TdhContextCount) PTDH_CONTEXT pTdhContext, _In_ ULONG PropertyDataCount, _In_reads_(PropertyDataCount) PPROPERTY_DATA_DESCRIPTOR pPropertyData, _Inout_ std::vector<_Ty, _Ax> &aData)
{
ULONG ulSize, ulResult;
// Query property size.
ulResult = TdhGetPropertySize(pEvent, TdhContextCount, pTdhContext, PropertyDataCount, pPropertyData, &ulSize);
if (ulResult == ERROR_SUCCESS) {
if (ulSize) {
// Query property value.
aData.resize((ulSize + sizeof(_Ty) - 1) / sizeof(_Ty));
ulResult = TdhGetProperty(pEvent, TdhContextCount, pTdhContext, PropertyDataCount, pPropertyData, ulSize, reinterpret_cast<LPBYTE>(aData.data()));
} else {
// Property value size is zero.
aData.clear();
}
}
return ulResult;
}
static _Success_(return == ERROR_SUCCESS) ULONG TdhGetEventInformation(_In_ PEVENT_RECORD pEvent, _In_ ULONG TdhContextCount, _In_reads_opt_(TdhContextCount) PTDH_CONTEXT pTdhContext, _Out_ std::unique_ptr<TRACE_EVENT_INFO> &info)
{
BYTE szBuffer[WINSTD_STACK_BUFFER_BYTES];
ULONG ulSize = sizeof(szBuffer), ulResult;
// Try with stack buffer first.
ulResult = TdhGetEventInformation(pEvent, TdhContextCount, pTdhContext, (PTRACE_EVENT_INFO)szBuffer, &ulSize);
if (ulResult == ERROR_SUCCESS) {
// Copy from stack.
info.reset(reinterpret_cast<PTRACE_EVENT_INFO>(new char[ulSize]));
memcpy(info.get(), szBuffer, ulSize);
return ERROR_SUCCESS;
} else if (ulResult == ERROR_INSUFFICIENT_BUFFER) {
// Create buffer on heap and retry.
info.reset(reinterpret_cast<PTRACE_EVENT_INFO>(new char[ulSize]));
return TdhGetEventInformation(pEvent, TdhContextCount, pTdhContext, info.get(), &ulSize);
}
return ulResult;
}
static _Success_(return == ERROR_SUCCESS) ULONG TdhGetEventMapInformation(_In_ PEVENT_RECORD pEvent, _In_ LPWSTR pMapName, _Inout_ std::unique_ptr<EVENT_MAP_INFO> &info)
{
BYTE szBuffer[WINSTD_STACK_BUFFER_BYTES];
ULONG ulSize = sizeof(szBuffer), ulResult;
// Try with stack buffer first.
ulResult = TdhGetEventMapInformation(pEvent, pMapName, (PEVENT_MAP_INFO)szBuffer, &ulSize);
if (ulResult == ERROR_SUCCESS) {
// Copy from stack.
info.reset(reinterpret_cast<PEVENT_MAP_INFO>(new char[ulSize]));
memcpy(info.get(), szBuffer, ulSize);
return ERROR_SUCCESS;
} else if (ulResult == ERROR_INSUFFICIENT_BUFFER) {
// Create buffer on heap and retry.
info.reset(reinterpret_cast<PEVENT_MAP_INFO>(new char[ulSize]));
return TdhGetEventMapInformation(pEvent, pMapName, info.get(), &ulSize);
}
return ulResult;
}
#pragma warning(pop)
namespace winstd
{
class event_data : public EVENT_DATA_DESCRIPTOR
{
public:
event_data()
{
Ptr = 0;
Size = 0;
Reserved = (ULONG)-1; // Used for varadic argument terminator.
}
#pragma warning(suppress: 26495) // EventDataDescCreate() initializes all members of EVENT_DATA_DESCRIPTOR
event_data(_In_ const char &data)
{
EventDataDescCreate(this, &data, (ULONG)(sizeof(data)));
}
#pragma warning(suppress: 26495) // EventDataDescCreate() initializes all members of EVENT_DATA_DESCRIPTOR
event_data(_In_ const unsigned char &data)
{
EventDataDescCreate(this, &data, (ULONG)(sizeof(data)));
}
#pragma warning(suppress: 26495) // EventDataDescCreate() initializes all members of EVENT_DATA_DESCRIPTOR
event_data(_In_ const int &data)
{
EventDataDescCreate(this, &data, (ULONG)(sizeof(data)));
}
#pragma warning(suppress: 26495) // EventDataDescCreate() initializes all members of EVENT_DATA_DESCRIPTOR
event_data(_In_ const unsigned int &data)
{
EventDataDescCreate(this, &data, (ULONG)(sizeof(data)));
}
#pragma warning(suppress: 26495) // EventDataDescCreate() initializes all members of EVENT_DATA_DESCRIPTOR
event_data(_In_ const long &data)
{
EventDataDescCreate(this, &data, (ULONG)(sizeof(data)));
}
#pragma warning(suppress: 26495) // EventDataDescCreate() initializes all members of EVENT_DATA_DESCRIPTOR
event_data(_In_ const unsigned long &data)
{
EventDataDescCreate(this, &data, (ULONG)(sizeof(data)));
}
#pragma warning(suppress: 26495) // EventDataDescCreate() initializes all members of EVENT_DATA_DESCRIPTOR
event_data(_In_ const GUID &data)
{
EventDataDescCreate(this, &data, (ULONG)(sizeof(data)));
}
#pragma warning(suppress: 26495) // EventDataDescCreate() initializes all members of EVENT_DATA_DESCRIPTOR
event_data(_In_opt_z_ const char *data)
{
if (data)
EventDataDescCreate(this, data, (ULONG)((strlen(data) + 1) * sizeof(*data)));
else {
// Writing NULL pointer with 0B length causes trouble in Event Viewer: message template string is displayed only, parameters are not rendered.
static const char null[] = "(null)";
EventDataDescCreate(this, null, sizeof(null));
}
}
#pragma warning(suppress: 26495) // EventDataDescCreate() initializes all members of EVENT_DATA_DESCRIPTOR
event_data(_In_opt_z_ const wchar_t *data)
{
if (data)
EventDataDescCreate(this, data, (ULONG)((wcslen(data) + 1) * sizeof(*data)));
else {
// Writing NULL pointer with 0B length causes trouble in Event Viewer: message template string is displayed only, parameters are not rendered.
static const wchar_t null[] = L"(null)";
EventDataDescCreate(this, null, sizeof(null));
}
}
#pragma warning(suppress: 26495) // EventDataDescCreate() initializes all members of EVENT_DATA_DESCRIPTOR
template<class _Elem, class _Traits, class _Ax>
event_data(_In_ const std::basic_string<_Elem, _Traits, _Ax> &data)
{
EventDataDescCreate(this, data.c_str(), (ULONG)((data.length() + 1) * sizeof(_Elem)));
}
#pragma warning(suppress: 26495) // EventDataDescCreate() initializes all members of EVENT_DATA_DESCRIPTOR
event_data(_In_bytecount_(size) const void *data, _In_ ULONG size)
{
EventDataDescCreate(this, data, size);
}
};
static const event_data blank_event_data;
class event_rec : public EVENT_RECORD
{
public:
event_rec()
{
memset((EVENT_RECORD*)this, 0, sizeof(EVENT_RECORD));
}
event_rec(_In_ const event_rec &other) : EVENT_RECORD(other)
{
set_extended_data_internal(other.ExtendedDataCount, other.ExtendedData);
set_user_data_internal(other.UserDataLength, other.UserData);
}
event_rec(_In_ const EVENT_RECORD &other) : EVENT_RECORD(other)
{
set_extended_data_internal(other.ExtendedDataCount, other.ExtendedData);
set_user_data_internal(other.UserDataLength, other.UserData);
}
event_rec(_Inout_ event_rec&& other) noexcept : EVENT_RECORD(other)
{
memset((EVENT_RECORD*)&other, 0, sizeof(EVENT_RECORD));
}
~event_rec()
{
if (ExtendedData)
delete reinterpret_cast<unsigned char*>(ExtendedData);
if (UserData)
delete reinterpret_cast<unsigned char*>(UserData);
}
event_rec& operator=(_In_ const event_rec &other)
{
if (this != std::addressof(other)) {
(EVENT_RECORD&)*this = other;
set_extended_data_internal(other.ExtendedDataCount, other.ExtendedData);
set_user_data_internal(other.UserDataLength, other.UserData);
}
return *this;
}
event_rec& operator=(_In_ const EVENT_RECORD &other)
{
if (this != std::addressof(other)) {
(EVENT_RECORD&)*this = other;
set_extended_data_internal(other.ExtendedDataCount, other.ExtendedData);
set_user_data_internal(other.UserDataLength, other.UserData);
}
return *this;
}
event_rec& operator=(_Inout_ event_rec&& other) noexcept
{
if (this != std::addressof(other)) {
(EVENT_RECORD&)*this = other;
memset((EVENT_RECORD*)&other, 0, sizeof(EVENT_RECORD));
}
return *this;
}
void set_extended_data(_In_ USHORT count, _In_count_(count) const EVENT_HEADER_EXTENDED_DATA_ITEM *data)
{
if (ExtendedData)
delete reinterpret_cast<unsigned char*>(ExtendedData);
set_extended_data_internal(count, data);
}
void set_user_data(_In_ USHORT size, _In_bytecount_(size) LPCVOID data)
{
if (UserData)
delete reinterpret_cast<unsigned char*>(UserData);
set_user_data_internal(size, data);
}
protected:
void set_extended_data_internal(_In_ USHORT count, _In_count_(count) const EVENT_HEADER_EXTENDED_DATA_ITEM *data)
{
if (count) {
assert(data);
// Count the total required memory.
size_t data_size = 0;
for (size_t i = 0; i < count; i++)
data_size += data[i].DataSize;
// Allocate memory for extended data.
ExtendedData = reinterpret_cast<EVENT_HEADER_EXTENDED_DATA_ITEM*>(new unsigned char[sizeof(EVENT_HEADER_EXTENDED_DATA_ITEM)*count + data_size]);
// Bulk-copy extended data descriptors.
memcpy(ExtendedData, data, sizeof(EVENT_HEADER_EXTENDED_DATA_ITEM) * count);
// Copy the data.
unsigned char *ptr = reinterpret_cast<unsigned char*>(ExtendedData + count);
for (size_t i = 0; i < count; i++) {
if (data[i].DataSize) {
memcpy(ptr, (void*)(data[i].DataPtr), data[i].DataSize);
ExtendedData[i].DataPtr = (ULONGLONG)ptr;
ptr += data[i].DataSize;
} else
ExtendedData[i].DataPtr = NULL;
}
} else
ExtendedData = NULL;
ExtendedDataCount = count;
}
void set_user_data_internal(_In_ USHORT size, _In_bytecount_(size) LPCVOID data)
{
if (size) {
assert(data);
// Allocate memory for user data.
UserData = new unsigned char[size];
// Copy user data.
memcpy(UserData, data, size);
} else
UserData = NULL;
UserDataLength = size;
}
};
class event_provider : public handle<REGHANDLE, NULL>
{
WINSTD_HANDLE_IMPL(event_provider, NULL)
public:
virtual ~event_provider()
{
if (m_h != invalid)
free_internal();
}
ULONG create(_In_ LPCGUID ProviderId)
{
handle_type h;
ULONG ulRes = EventRegister(ProviderId, enable_callback, this, &h);
if (ulRes == ERROR_SUCCESS)
attach(h);
return ulRes;
}
ULONG write(_In_ PCEVENT_DESCRIPTOR EventDescriptor)
{
assert(m_h != invalid);
return EventWrite(m_h, EventDescriptor, 0, NULL);
}
ULONG write(_In_ PCEVENT_DESCRIPTOR EventDescriptor, _In_ ULONG UserDataCount = 0, _In_opt_count_(UserDataCount) PEVENT_DATA_DESCRIPTOR UserData = NULL)
{
assert(m_h != invalid);
return EventWrite(m_h, EventDescriptor, UserDataCount, UserData);
}
ULONG write(_In_ PCEVENT_DESCRIPTOR EventDescriptor, _In_ const EVENT_DATA_DESCRIPTOR param1, ...)
{
assert(m_h != invalid);
// The first argument (param1) is outside of varadic argument list.
if (param1.Ptr == winstd::blank_event_data.Ptr &&
param1.Size == winstd::blank_event_data.Size &&
param1.Reserved == winstd::blank_event_data.Reserved)
return EventWrite(m_h, EventDescriptor, 0, NULL);
va_list arg;
va_start(arg, param1);
va_list arg_start = arg;
std::vector<EVENT_DATA_DESCRIPTOR> params;
ULONG param_count;
// Preallocate array.
for (param_count = 1; param_count < MAX_EVENT_DATA_DESCRIPTORS; param_count++) {
const EVENT_DATA_DESCRIPTOR &p = va_arg(arg, const EVENT_DATA_DESCRIPTOR);
if (p.Ptr == winstd::blank_event_data.Ptr &&
p.Size == winstd::blank_event_data.Size &&
p.Reserved == winstd::blank_event_data.Reserved) break;
}
params.reserve(param_count);
// Copy parameters to array.
arg = arg_start;
params.push_back(param1);
for (;;) {
const EVENT_DATA_DESCRIPTOR &p = va_arg(arg, const EVENT_DATA_DESCRIPTOR);
if (p.Ptr == winstd::blank_event_data.Ptr &&
p.Size == winstd::blank_event_data.Size &&
p.Reserved == winstd::blank_event_data.Reserved) break;
params.push_back(p);
}
va_end(arg);
#pragma warning(push)
#pragma warning(disable: 28020)
return EventWrite(m_h, EventDescriptor, param_count, params.data());
#pragma warning(pop)
}
ULONG write(_In_ PCEVENT_DESCRIPTOR EventDescriptor, _In_ va_list arg)
{
assert(m_h != invalid);
va_list arg_start = arg;
std::vector<EVENT_DATA_DESCRIPTOR> params;
ULONG param_count;
// Preallocate array.
for (param_count = 0; param_count < MAX_EVENT_DATA_DESCRIPTORS; param_count++) {
const EVENT_DATA_DESCRIPTOR &p = va_arg(arg, const EVENT_DATA_DESCRIPTOR);
if (p.Ptr == winstd::blank_event_data.Ptr &&
p.Size == winstd::blank_event_data.Size &&
p.Reserved == winstd::blank_event_data.Reserved) break;
}
params.reserve(param_count);
// Copy parameters to array.
arg = arg_start;
for (;;) {
const EVENT_DATA_DESCRIPTOR &p = va_arg(arg, const EVENT_DATA_DESCRIPTOR);
if (p.Ptr == winstd::blank_event_data.Ptr &&
p.Size == winstd::blank_event_data.Size &&
p.Reserved == winstd::blank_event_data.Reserved) break;
params.push_back(p);
}
#pragma warning(push)
#pragma warning(disable: 28020)
return EventWrite(m_h, EventDescriptor, param_count, params.data());
#pragma warning(pop)
}
ULONG write(_In_ UCHAR Level, _In_ ULONGLONG Keyword, _In_z_ _Printf_format_string_ PCWSTR String, ...)
{
assert(m_h != invalid);
std::wstring msg;
va_list arg;
// Format message.
va_start(arg, String);
vsprintf(msg, String, arg);
va_end(arg);
// Write string event.
return EventWriteString(m_h, Level, Keyword, msg.c_str());
}
protected:
void free_internal() noexcept override
{
EventUnregister(m_h);
}
virtual void enable_callback(_In_ LPCGUID SourceId, _In_ ULONG IsEnabled, _In_ UCHAR Level, _In_ ULONGLONG MatchAnyKeyword, _In_ ULONGLONG MatchAllKeyword, _In_opt_ PEVENT_FILTER_DESCRIPTOR FilterData)
{
UNREFERENCED_PARAMETER(SourceId);
UNREFERENCED_PARAMETER(IsEnabled);
UNREFERENCED_PARAMETER(Level);
UNREFERENCED_PARAMETER(MatchAnyKeyword);
UNREFERENCED_PARAMETER(MatchAllKeyword);
UNREFERENCED_PARAMETER(FilterData);
}
static VOID NTAPI enable_callback(_In_ LPCGUID SourceId, _In_ ULONG IsEnabled, _In_ UCHAR Level, _In_ ULONGLONG MatchAnyKeyword, _In_ ULONGLONG MatchAllKeyword, _In_opt_ PEVENT_FILTER_DESCRIPTOR FilterData, _Inout_opt_ PVOID CallbackContext)
{
if (CallbackContext)
static_cast< event_provider*>(CallbackContext)->enable_callback(SourceId, IsEnabled, Level, MatchAnyKeyword, MatchAllKeyword, FilterData);
else
assert(0); // Where did the "this" pointer get lost?
}
};
class event_session : public handle<TRACEHANDLE, 0>
{
WINSTD_NONCOPYABLE(event_session)
public:
event_session()
{
}
event_session(_In_opt_ handle_type h, _In_ const EVENT_TRACE_PROPERTIES *prop) :
m_prop(reinterpret_cast<EVENT_TRACE_PROPERTIES*>(new char[prop->Wnode.BufferSize])),
handle(h)
{
memcpy(m_prop.get(), prop, prop->Wnode.BufferSize);
}
event_session(_Inout_ event_session &&other) noexcept :
m_prop(std::move(other.m_prop)),
handle(std::move(other))
{
}
virtual ~event_session()
{
if (m_h != invalid)
free_internal();
}
event_session& operator=(_Inout_ event_session &&other) noexcept
{
if (this != std::addressof(other)) {
(handle<handle_type, 0>&&)*this = std::move(other);
m_prop = std::move(other.m_prop);
}
return *this;
}
operator const EVENT_TRACE_PROPERTIES*() const
{
return m_prop.get();
}
LPCTSTR name() const
{
const EVENT_TRACE_PROPERTIES *prop = m_prop.get();
return reinterpret_cast<LPCTSTR>(reinterpret_cast<const char*>(prop) + prop->LoggerNameOffset);
}
void attach(_In_opt_ handle_type h, _In_ EVENT_TRACE_PROPERTIES *prop)
{
handle<handle_type, 0>::attach(h);
m_prop.reset(prop);
}
ULONG create(_In_z_ LPCTSTR SessionName, _In_ const EVENT_TRACE_PROPERTIES *Properties)
{
handle_type h;
std::unique_ptr<EVENT_TRACE_PROPERTIES> prop(reinterpret_cast<EVENT_TRACE_PROPERTIES*>(new char[Properties->Wnode.BufferSize]));
memcpy(prop.get(), Properties, Properties->Wnode.BufferSize);
ULONG ulRes = StartTrace(&h, SessionName, prop.get());
if (ulRes == ERROR_SUCCESS)
attach(h, prop.release());
return ulRes;
}
ULONG enable_trace(_In_ LPCGUID ProviderId, _In_ UCHAR Level, _In_opt_ ULONGLONG MatchAnyKeyword = 0, _In_opt_ ULONGLONG MatchAllKeyword = 0, _In_opt_ ULONG EnableProperty = 0, _In_opt_ PEVENT_FILTER_DESCRIPTOR EnableFilterDesc = NULL)
{
assert(m_h != invalid);
return EnableTraceEx(
ProviderId,
&m_prop->Wnode.Guid,
m_h,
EVENT_CONTROL_CODE_ENABLE_PROVIDER,
Level,
MatchAnyKeyword,
MatchAllKeyword,
EnableProperty,
EnableFilterDesc);
}
ULONG disable_trace(_In_ LPCGUID ProviderId, _In_ UCHAR Level, _In_opt_ ULONGLONG MatchAnyKeyword = 0, _In_opt_ ULONGLONG MatchAllKeyword = 0, _In_opt_ ULONG EnableProperty = 0, _In_opt_ PEVENT_FILTER_DESCRIPTOR EnableFilterDesc = NULL)
{
assert(m_h != invalid);
return EnableTraceEx(
ProviderId,
&m_prop->Wnode.Guid,
m_h,
EVENT_CONTROL_CODE_DISABLE_PROVIDER,
Level,
MatchAnyKeyword,
MatchAllKeyword,
EnableProperty,
EnableFilterDesc);
}
protected:
void free_internal() noexcept override
{
ControlTrace(m_h, name(), m_prop.get(), EVENT_TRACE_CONTROL_STOP);
}
protected:
std::unique_ptr<EVENT_TRACE_PROPERTIES> m_prop;
};
class event_trace : public handle<TRACEHANDLE, INVALID_PROCESSTRACE_HANDLE>
{
WINSTD_HANDLE_IMPL(event_trace, INVALID_PROCESSTRACE_HANDLE)
public:
virtual ~event_trace()
{
if (m_h != invalid)
free_internal();
}
bool create(_Inout_ PEVENT_TRACE_LOGFILE Logfile)
{
handle_type h = OpenTrace(Logfile);
if (h != invalid) {
attach(h);
return true;
} else
return false;
}
protected:
void free_internal() noexcept override
{
CloseTrace(m_h);
}
};
class event_trace_enabler
{
public:
event_trace_enabler(
_In_opt_ LPCGUID SourceId,
_In_ TRACEHANDLE TraceHandle,
_In_ LPCGUID ProviderId,
_In_ UCHAR Level,
_In_opt_ ULONGLONG MatchAnyKeyword = 0,
_In_opt_ ULONGLONG MatchAllKeyword = 0,
_In_opt_ ULONG EnableProperty = 0,
_In_opt_ PEVENT_FILTER_DESCRIPTOR EnableFilterDesc = NULL) :
m_provider_id(ProviderId),
m_source_id(SourceId),
m_trace_handle(TraceHandle),
m_level(Level),
m_match_any_keyword(MatchAnyKeyword),
m_match_all_keyword(MatchAllKeyword),
m_enable_property(EnableProperty),
m_enable_filter_desc(EnableFilterDesc)
{
m_status = EnableTraceEx(
m_provider_id,
m_source_id,
m_trace_handle,
EVENT_CONTROL_CODE_ENABLE_PROVIDER,
m_level,
m_match_any_keyword,
m_match_all_keyword,
m_enable_property,
m_enable_filter_desc);
}
event_trace_enabler(
_In_ const event_session &session,
_In_ LPCGUID ProviderId,
_In_ UCHAR Level,
_In_opt_ ULONGLONG MatchAnyKeyword = 0,
_In_opt_ ULONGLONG MatchAllKeyword = 0,
_In_opt_ ULONG EnableProperty = 0,
_In_opt_ PEVENT_FILTER_DESCRIPTOR EnableFilterDesc = NULL) :
m_provider_id(ProviderId),
m_source_id(&((const EVENT_TRACE_PROPERTIES*)session)->Wnode.Guid),
m_trace_handle(session),
m_level(Level),
m_match_any_keyword(MatchAnyKeyword),
m_match_all_keyword(MatchAllKeyword),
m_enable_property(EnableProperty),
m_enable_filter_desc(EnableFilterDesc)
{
m_status = EnableTraceEx(
m_provider_id,
m_source_id,
m_trace_handle,
EVENT_CONTROL_CODE_ENABLE_PROVIDER,
m_level,
m_match_any_keyword,
m_match_all_keyword,
m_enable_property,
m_enable_filter_desc);
}
ULONG status() const
{
return m_status;
}
virtual ~event_trace_enabler()
{
if (m_status == ERROR_SUCCESS)
EnableTraceEx(
m_provider_id,
m_source_id,
m_trace_handle,
EVENT_CONTROL_CODE_DISABLE_PROVIDER,
m_level,
m_match_any_keyword,
m_match_all_keyword,
m_enable_property,
m_enable_filter_desc);
}
protected:
ULONG m_status;
LPCGUID m_provider_id;
LPCGUID m_source_id;
TRACEHANDLE m_trace_handle;
UCHAR m_level;
ULONGLONG m_match_any_keyword;
ULONGLONG m_match_all_keyword;
ULONG m_enable_property;
PEVENT_FILTER_DESCRIPTOR m_enable_filter_desc;
};
class event_fn_auto
{
public:
event_fn_auto(_In_ event_provider &ep, _In_ const EVENT_DESCRIPTOR *event_cons, _In_ const EVENT_DESCRIPTOR *event_dest, _In_z_ LPCSTR pszFnName) :
m_ep(ep),
m_event_dest(event_dest)
{
EventDataDescCreate(&m_fn_name, pszFnName, (ULONG)(strlen(pszFnName) + 1)*sizeof(*pszFnName));
m_ep.write(event_cons, 1, &m_fn_name);
}
event_fn_auto(_In_ const event_fn_auto &other) :
m_ep(other.m_ep),
m_event_dest(other.m_event_dest),
m_fn_name(other.m_fn_name)
{
}
event_fn_auto(_Inout_ event_fn_auto &&other) noexcept :
m_ep(other.m_ep),
m_event_dest(other.m_event_dest),
m_fn_name(std::move(other.m_fn_name))
{
other.m_event_dest = NULL;
}
~event_fn_auto()
{
if (m_event_dest)
m_ep.write(m_event_dest, 1, &m_fn_name);
}
event_fn_auto& operator=(_In_ const event_fn_auto &other)
{
if (this != &other) {
assert(&m_ep == &other.m_ep);
m_event_dest = other.m_event_dest;
m_fn_name = other.m_fn_name;
}
return *this;
}
event_fn_auto& operator=(_Inout_ event_fn_auto &&other) noexcept
{
if (this != &other) {
assert(&m_ep == &other.m_ep);
m_event_dest = other.m_event_dest;
m_fn_name = std::move(other.m_fn_name);
other.m_event_dest = NULL;
}
return *this;
}
protected:
event_provider &m_ep;
const EVENT_DESCRIPTOR *m_event_dest;
EVENT_DATA_DESCRIPTOR m_fn_name;
};
template<class T>
class event_fn_auto_ret
{
public:
event_fn_auto_ret(_In_ event_provider &ep, _In_ const EVENT_DESCRIPTOR *event_cons, _In_ const EVENT_DESCRIPTOR *event_dest, _In_z_ LPCSTR pszFnName, T &result) :
m_ep(ep),
m_event_dest(event_dest),
m_result(result)
{
EventDataDescCreate(m_desc + 0, pszFnName, (ULONG)(strlen(pszFnName) + 1)*sizeof(*pszFnName));
m_ep.write(event_cons, 1, m_desc);
}
event_fn_auto_ret(_In_ const event_fn_auto_ret<T> &other) :
m_ep(other.m_ep),
m_event_dest(other.m_event_dest),
m_result(other.m_result)
{
m_desc[0] = other.m_desc[0];
}
event_fn_auto_ret(_Inout_ event_fn_auto_ret<T> &&other) :
m_ep(other.m_ep),
m_event_dest(other.m_event_dest),
m_result(other.m_result)
{
m_desc[0] = std::move(other.m_desc[0]);
other.m_event_dest = NULL;
}
~event_fn_auto_ret()
{
if (m_event_dest) {
EventDataDescCreate(m_desc + 1, &m_result, sizeof(T));
m_ep.write(m_event_dest, 2, m_desc);
}
}
event_fn_auto_ret& operator=(_In_ const event_fn_auto_ret<T> &other)
{
if (this != &other) {
assert(&m_ep == &other.m_ep);
m_event_dest = other.m_event_dest;
m_desc[0] = other.m_desc[0];
assert(&m_result == &other.m_result);
}
return *this;
}
event_fn_auto_ret& operator=(_Inout_ event_fn_auto_ret<T> &&other)
{
if (this != &other) {
assert(&m_ep == &other.m_ep);
m_event_dest = other.m_event_dest;
m_desc[0] = std::move(other.m_desc[0]);
assert(&m_result == &other.m_result);
other.m_event_dest = NULL;
}
return *this;
}
protected:
event_provider &m_ep;
const EVENT_DESCRIPTOR *m_event_dest;
EVENT_DATA_DESCRIPTOR m_desc[2];
T &m_result;
};
}
winstd::event_data
EVENT_DATA_DESCRIPTOR wrapper.
Definition: ETW.h:119
winstd::event_data::event_data
event_data(const char &data)
Construct class pointing to an char.
Definition: ETW.h:139
winstd::event_data::event_data
event_data(const wchar_t *data)
Construct class pointing to a wide string.
Definition: ETW.h:249
winstd::event_data::event_data
event_data(const int &data)
Construct class pointing to an int.
Definition: ETW.h:165
winstd::event_data::event_data
event_data(const void *data, ULONG size)
Construct class pointing to binary data.
Definition: ETW.h:283
winstd::event_data::event_data
event_data(const GUID &data)
Construct class pointing to a GUID.
Definition: ETW.h:217
winstd::event_data::event_data
event_data(const unsigned int &data)
Construct class pointing to an unsigned int.
Definition: ETW.h:178
winstd::event_data::event_data
event_data(const char *data)
Construct class pointing to a string.
Definition: ETW.h:230
winstd::event_data::event_data
event_data(const unsigned char &data)
Construct class pointing to an unsigned char.
Definition: ETW.h:152
winstd::event_data::event_data
event_data(const std::basic_string< _Elem, _Traits, _Ax > &data)
Template to construct pointing to a std::basic_string<>.
Definition: ETW.h:269
winstd::event_data::event_data
event_data(const unsigned long &data)
Construct class pointing to an unsigned long.
Definition: ETW.h:204
winstd::event_data::event_data
event_data()
Construct empty class.
Definition: ETW.h:124
winstd::event_data::event_data
event_data(const long &data)
Construct class pointing to a long.
Definition: ETW.h:191
winstd::event_fn_auto_ret
Helper template to write an event on entry/exit of scope with one parameter (typically result).
Definition: ETW.h:1159
winstd::event_fn_auto_ret::event_fn_auto_ret
event_fn_auto_ret(const event_fn_auto_ret< T > &other)
Copies the object.
Definition: ETW.h:1176
winstd::event_fn_auto_ret::~event_fn_auto_ret
~event_fn_auto_ret()
Writes the event_dest event.
Definition: ETW.h:1199
winstd::event_fn_auto_ret::m_desc
EVENT_DATA_DESCRIPTOR m_desc[2]
Function name and return value.
Definition: ETW.h:1241
winstd::event_fn_auto_ret::m_ep
event_provider & m_ep
Reference to event provider in use.
Definition: ETW.h:1239
winstd::event_fn_auto_ret::event_fn_auto_ret
event_fn_auto_ret(event_provider &ep, const EVENT_DESCRIPTOR *event_cons, const EVENT_DESCRIPTOR *event_dest, LPCSTR pszFnName, T &result)
Writes the event_cons event.
Definition: ETW.h:1164
winstd::event_fn_auto_ret::m_result
T & m_result
Function result.
Definition: ETW.h:1242
winstd::event_fn_auto_ret::operator=
event_fn_auto_ret & operator=(const event_fn_auto_ret< T > &other)
Copies the object.
Definition: ETW.h:1210
winstd::event_fn_auto_ret::m_event_dest
const EVENT_DESCRIPTOR * m_event_dest
Event descriptor at destruction.
Definition: ETW.h:1240
winstd::event_fn_auto_ret::event_fn_auto_ret
event_fn_auto_ret(event_fn_auto_ret< T > &&other)
Moves the object.
Definition: ETW.h:1187
winstd::event_fn_auto_ret::operator=
event_fn_auto_ret & operator=(event_fn_auto_ret< T > &&other)
Moves the object.
Definition: ETW.h:1225
winstd::event_fn_auto
Helper class to write an event on entry/exit of scope.
Definition: ETW.h:1074
winstd::event_fn_auto::m_event_dest
const EVENT_DESCRIPTOR * m_event_dest
Event descriptor at destruction.
Definition: ETW.h:1148
winstd::event_fn_auto::event_fn_auto
event_fn_auto(event_fn_auto &&other) noexcept
Moves the object.
Definition: ETW.h:1100
winstd::event_fn_auto::event_fn_auto
event_fn_auto(event_provider &ep, const EVENT_DESCRIPTOR *event_cons, const EVENT_DESCRIPTOR *event_dest, LPCSTR pszFnName)
Writes the event_cons event.
Definition: ETW.h:1079
winstd::event_fn_auto::~event_fn_auto
~event_fn_auto()
Writes the event_dest event.
Definition: ETW.h:1111
winstd::event_fn_auto::operator=
event_fn_auto & operator=(event_fn_auto &&other) noexcept
Moves the object.
Definition: ETW.h:1134
winstd::event_fn_auto::operator=
event_fn_auto & operator=(const event_fn_auto &other)
Copies the object.
Definition: ETW.h:1120
winstd::event_fn_auto::m_ep
event_provider & m_ep
Reference to event provider in use.
Definition: ETW.h:1147
winstd::event_fn_auto::m_fn_name
EVENT_DATA_DESCRIPTOR m_fn_name
Function name.
Definition: ETW.h:1149
winstd::event_fn_auto::event_fn_auto
event_fn_auto(const event_fn_auto &other)
Copies the object.
Definition: ETW.h:1090
winstd::event_provider
ETW event provider.
Definition: ETW.h:493
winstd::event_provider::write
ULONG write(PCEVENT_DESCRIPTOR EventDescriptor)
Writes an event with no parameters.
Definition: ETW.h:535
winstd::event_provider::write
ULONG write(PCEVENT_DESCRIPTOR EventDescriptor, ULONG UserDataCount=0, PEVENT_DATA_DESCRIPTOR UserData=NULL)
Writes an event with parameters stored in array.
Definition: ETW.h:550
winstd::event_provider::write
ULONG write(UCHAR Level, ULONGLONG Keyword, PCWSTR String,...)
Writes a string event.
Definition: ETW.h:663
winstd::event_provider::write
ULONG write(PCEVENT_DESCRIPTOR EventDescriptor, va_list arg)
Writes an event with variable number of parameters.
Definition: ETW.h:621
winstd::event_provider::~event_provider
virtual ~event_provider()
Closes the event provider.
Definition: ETW.h:502
winstd::event_provider::enable_callback
virtual void enable_callback(LPCGUID SourceId, ULONG IsEnabled, UCHAR Level, ULONGLONG MatchAnyKeyword, ULONGLONG MatchAllKeyword, PEVENT_FILTER_DESCRIPTOR FilterData)
Receive enable or disable notification requests.
Definition: ETW.h:695
winstd::event_provider::free_internal
void free_internal() noexcept override
Releases the event provider.
Definition: ETW.h:685
winstd::event_provider::write
ULONG write(PCEVENT_DESCRIPTOR EventDescriptor, const EVENT_DATA_DESCRIPTOR param1,...)
Writes an event with one or more parameter.
Definition: ETW.h:567
winstd::event_provider::enable_callback
static VOID NTAPI enable_callback(LPCGUID SourceId, ULONG IsEnabled, UCHAR Level, ULONGLONG MatchAnyKeyword, ULONGLONG MatchAllKeyword, PEVENT_FILTER_DESCRIPTOR FilterData, PVOID CallbackContext)
Receive enable or disable notification requests.
Definition: ETW.h:710
winstd::event_provider::create
ULONG create(LPCGUID ProviderId)
Registers the event provider.
Definition: ETW.h:517
winstd::event_rec
EVENT_RECORD wrapper.
Definition: ETW.h:298
winstd::event_rec::set_extended_data_internal
void set_extended_data_internal(USHORT count, const EVENT_HEADER_EXTENDED_DATA_ITEM *data)
Sets event record extended data.
Definition: ETW.h:434
winstd::event_rec::set_user_data
void set_user_data(USHORT size, LPCVOID data)
Sets event record user data.
Definition: ETW.h:419
winstd::event_rec::operator=
event_rec & operator=(event_rec &&other) noexcept
Moves the event record.
Definition: ETW.h:389
winstd::event_rec::~event_rec
~event_rec()
Destroys event record data and frees the allocated memory.
Definition: ETW.h:343
winstd::event_rec::operator=
event_rec & operator=(const EVENT_RECORD &other)
Copies an existing event record.
Definition: ETW.h:373
winstd::event_rec::event_rec
event_rec(const EVENT_RECORD &other)
Copies an existing event record.
Definition: ETW.h:324
winstd::event_rec::operator=
event_rec & operator=(const event_rec &other)
Copies an existing event record.
Definition: ETW.h:357
winstd::event_rec::set_extended_data
void set_extended_data(USHORT count, const EVENT_HEADER_EXTENDED_DATA_ITEM *data)
Sets event record extended data.
Definition: ETW.h:405
winstd::event_rec::event_rec
event_rec(event_rec &&other) noexcept
Moves the event record.
Definition: ETW.h:335
winstd::event_rec::event_rec
event_rec()
Constructs a blank event record.
Definition: ETW.h:303
winstd::event_rec::set_user_data_internal
void set_user_data_internal(USHORT size, LPCVOID data)
Sets event record user data.
Definition: ETW.h:472
winstd::event_rec::event_rec
event_rec(const event_rec &other)
Copies an existing event record.
Definition: ETW.h:313
winstd::event_session
ETW session.
Definition: ETW.h:723
winstd::event_session::name
LPCTSTR name() const
Auto-typecasting operator.
Definition: ETW.h:798
winstd::event_session::event_session
event_session(event_session &&other) noexcept
Move constructor.
Definition: ETW.h:752
winstd::event_session::event_session
event_session(handle_type h, const EVENT_TRACE_PROPERTIES *prop)
Initializes a new session with an already available object handle.
Definition: ETW.h:740
winstd::event_session::event_session
event_session()
Initializes a new empty session.
Definition: ETW.h:730
winstd::event_session::~event_session
virtual ~event_session()
Closes the session.
Definition: ETW.h:763
winstd::event_session::free_internal
void free_internal() noexcept override
Releases the session.
Definition: ETW.h:892
winstd::event_session::operator=
event_session & operator=(event_session &&other) noexcept
Move assignment.
Definition: ETW.h:774
winstd::event_session::disable_trace
ULONG disable_trace(LPCGUID ProviderId, UCHAR Level, ULONGLONG MatchAnyKeyword=0, ULONGLONG MatchAllKeyword=0, ULONG EnableProperty=0, PEVENT_FILTER_DESCRIPTOR EnableFilterDesc=NULL)
Disables the specified event trace provider.
Definition: ETW.h:871
winstd::event_session::enable_trace
ULONG enable_trace(LPCGUID ProviderId, UCHAR Level, ULONGLONG MatchAnyKeyword=0, ULONGLONG MatchAllKeyword=0, ULONG EnableProperty=0, PEVENT_FILTER_DESCRIPTOR EnableFilterDesc=NULL)
Enables the specified event trace provider.
Definition: ETW.h:847
winstd::event_session::m_prop
std::unique_ptr< EVENT_TRACE_PROPERTIES > m_prop
Session properties.
Definition: ETW.h:898
winstd::event_session::create
ULONG create(LPCTSTR SessionName, const EVENT_TRACE_PROPERTIES *Properties)
Registers and starts an event tracing session.
Definition: ETW.h:827
winstd::event_session::attach
void attach(handle_type h, EVENT_TRACE_PROPERTIES *prop)
Sets a new session handle for the class.
Definition: ETW.h:812
winstd::event_trace_enabler
Helper class to enable event provider in constructor and disables it in destructor.
Definition: ETW.h:955
winstd::event_trace_enabler::m_level
UCHAR m_level
Logging level.
Definition: ETW.h:1061
winstd::event_trace_enabler::m_enable_filter_desc
PEVENT_FILTER_DESCRIPTOR m_enable_filter_desc
Event filter descriptor.
Definition: ETW.h:1065
winstd::event_trace_enabler::m_match_any_keyword
ULONGLONG m_match_any_keyword
Keyword match mask (any)
Definition: ETW.h:1062
winstd::event_trace_enabler::event_trace_enabler
event_trace_enabler(LPCGUID SourceId, TRACEHANDLE TraceHandle, LPCGUID ProviderId, UCHAR Level, ULONGLONG MatchAnyKeyword=0, ULONGLONG MatchAllKeyword=0, ULONG EnableProperty=0, PEVENT_FILTER_DESCRIPTOR EnableFilterDesc=NULL)
Enables event trace.
Definition: ETW.h:962
winstd::event_trace_enabler::m_status
ULONG m_status
Result of EnableTraceEx call.
Definition: ETW.h:1057
winstd::event_trace_enabler::m_trace_handle
TRACEHANDLE m_trace_handle
Trace handle.
Definition: ETW.h:1060
winstd::event_trace_enabler::~event_trace_enabler
virtual ~event_trace_enabler()
Disables event trace.
Definition: ETW.h:1041
winstd::event_trace_enabler::status
ULONG status() const
Return result of EnableTraceEx() call.
Definition: ETW.h:1031
winstd::event_trace_enabler::event_trace_enabler
event_trace_enabler(const event_session &session, LPCGUID ProviderId, UCHAR Level, ULONGLONG MatchAnyKeyword=0, ULONGLONG MatchAllKeyword=0, ULONG EnableProperty=0, PEVENT_FILTER_DESCRIPTOR EnableFilterDesc=NULL)
Enables event trace.
Definition: ETW.h:997
winstd::event_trace_enabler::m_match_all_keyword
ULONGLONG m_match_all_keyword
Keyword match mask (all)
Definition: ETW.h:1063
winstd::event_trace_enabler::m_provider_id
LPCGUID m_provider_id
Provider ID.
Definition: ETW.h:1058
winstd::event_trace_enabler::m_source_id
LPCGUID m_source_id
Session ID.
Definition: ETW.h:1059
winstd::event_trace_enabler::m_enable_property
ULONG m_enable_property
Enable property.
Definition: ETW.h:1064
winstd::event_trace
ETW trace.
Definition: ETW.h:905
winstd::event_trace::create
bool create(PEVENT_TRACE_LOGFILE Logfile)
Opens a real-time trace session or log file for consuming.
Definition: ETW.h:929
winstd::event_trace::~event_trace
virtual ~event_trace()
Closes the trace.
Definition: ETW.h:914
winstd::event_trace::free_internal
void free_internal() noexcept override
Closes the trace.
Definition: ETW.h:945
winstd::handle
Base abstract template class to support generic object handle keeping.
Definition: Common.h:604
winstd::handle< TRACEHANDLE, 0 >::handle
handle() noexcept
Initializes a new class instance with the object handle set to INVAL.
Definition: Common.h:619
winstd::handle< REGHANDLE, NULL >::handle_type
REGHANDLE handle_type
Datatype of the object handle this template class handles.
Definition: Common.h:609
winstd::handle< REGHANDLE, NULL >::m_h
handle_type m_h
Object handle.
Definition: Common.h:855
winstd::handle< REGHANDLE, NULL >::attach
void attach(handle_type h) noexcept
Sets a new object handle for the class.
Definition: Common.h:818
WINSTD_NONCOPYABLE
#define WINSTD_NONCOPYABLE(C)
Declares a class as non-copyable.
Definition: Common.h:53
WINSTD_STACK_BUFFER_BYTES
#define WINSTD_STACK_BUFFER_BYTES
Size of the stack buffer in bytes used for initial system function call.
Definition: Common.h:80
WINSTD_HANDLE_IMPL
#define WINSTD_HANDLE_IMPL(C, INVAL)
Implements default constructors and operators to prevent their auto-generation by compiler.
Definition: Common.h:162
winstd::handle< REGHANDLE, NULL >::invalid
static const REGHANDLE invalid
Invalid handle value.
Definition: Common.h:614