ETW.h

Go to the documentation of this file.

/*
    SPDX-License-Identifier: MIT
    Copyright © 1991-2022 Amebis
    Copyright © 2016 GÉANT
*/
 
 
#pragma once
 
#include "Common.h"
#include <assert.h>
#include <evntprov.h>
#include <evntcons.h>
#include <stdarg.h>
#include <tdh.h>
#include <memory>
#include <string>
#include <vector>
 
#pragma warning(push)
#pragma warning(disable: 4505) // Don't warn on unused code
 
 
template<class _Ty, class _Ax>
static _Success_(return == ERROR_SUCCESS) ULONG TdhGetProperty(_In_ PEVENT_RECORD pEvent, _In_ ULONG TdhContextCount, _In_reads_opt_(TdhContextCount) PTDH_CONTEXT pTdhContext, _In_ ULONG PropertyDataCount, _In_reads_(PropertyDataCount) PPROPERTY_DATA_DESCRIPTOR pPropertyData, _Inout_ std::vector<_Ty, _Ax> &aData)
{
    ULONG ulSize, ulResult;
 
    // Query property size.
    ulResult = TdhGetPropertySize(pEvent, TdhContextCount, pTdhContext, PropertyDataCount, pPropertyData, &ulSize);
    if (ulResult == ERROR_SUCCESS) {
        if (ulSize) {
            // Query property value.
            aData.resize((ulSize + sizeof(_Ty) - 1) / sizeof(_Ty));
            ulResult = TdhGetProperty(pEvent, TdhContextCount, pTdhContext, PropertyDataCount, pPropertyData, ulSize, reinterpret_cast<LPBYTE>(aData.data()));
        } else {
            // Property value size is zero.
            aData.clear();
        }
    }
 
    return ulResult;
}
 
static _Success_(return == ERROR_SUCCESS) ULONG TdhGetEventInformation(_In_ PEVENT_RECORD pEvent, _In_ ULONG TdhContextCount, _In_reads_opt_(TdhContextCount) PTDH_CONTEXT pTdhContext, _Out_ std::unique_ptr<TRACE_EVENT_INFO> &info)
{
    BYTE szBuffer[WINSTD_STACK_BUFFER_BYTES];
    ULONG ulSize = sizeof(szBuffer), ulResult;
 
    // Try with stack buffer first.
    ulResult = TdhGetEventInformation(pEvent, TdhContextCount, pTdhContext, (PTRACE_EVENT_INFO)szBuffer, &ulSize);
    if (ulResult == ERROR_SUCCESS) {
        // Copy from stack.
        info.reset(reinterpret_cast<PTRACE_EVENT_INFO>(new char[ulSize]));
        memcpy(info.get(), szBuffer, ulSize);
        return ERROR_SUCCESS;
    } else if (ulResult == ERROR_INSUFFICIENT_BUFFER) {
        // Create buffer on heap and retry.
        info.reset(reinterpret_cast<PTRACE_EVENT_INFO>(new char[ulSize]));
        return TdhGetEventInformation(pEvent, TdhContextCount, pTdhContext, info.get(), &ulSize);
    }
 
    return ulResult;
}
 
static _Success_(return == ERROR_SUCCESS) ULONG TdhGetEventMapInformation(_In_ PEVENT_RECORD pEvent, _In_ LPWSTR pMapName, _Inout_ std::unique_ptr<EVENT_MAP_INFO> &info)
{
    BYTE szBuffer[WINSTD_STACK_BUFFER_BYTES];
    ULONG ulSize = sizeof(szBuffer), ulResult;
 
    // Try with stack buffer first.
    ulResult = TdhGetEventMapInformation(pEvent, pMapName, (PEVENT_MAP_INFO)szBuffer, &ulSize);
    if (ulResult == ERROR_SUCCESS) {
        // Copy from stack.
        info.reset(reinterpret_cast<PEVENT_MAP_INFO>(new char[ulSize]));
        memcpy(info.get(), szBuffer, ulSize);
        return ERROR_SUCCESS;
    } else if (ulResult == ERROR_INSUFFICIENT_BUFFER) {
        // Create buffer on heap and retry.
        info.reset(reinterpret_cast<PEVENT_MAP_INFO>(new char[ulSize]));
        return TdhGetEventMapInformation(pEvent, pMapName, info.get(), &ulSize);
    }
 
    return ulResult;
}
 
 
#pragma warning(pop)
 
namespace winstd
{
 
    class event_data : public EVENT_DATA_DESCRIPTOR
    {
    public:
        event_data()
        {
            Ptr      = 0;
            Size     = 0;
            Reserved = (ULONG)-1;   // Used for varadic argument terminator.
        }
 
        #pragma warning(suppress: 26495) // EventDataDescCreate() initializes all members of EVENT_DATA_DESCRIPTOR
        event_data(_In_ const char &data)
        {
            EventDataDescCreate(this, &data, (ULONG)(sizeof(data)));
        }
 
        #pragma warning(suppress: 26495) // EventDataDescCreate() initializes all members of EVENT_DATA_DESCRIPTOR
        event_data(_In_ const unsigned char &data)
        {
            EventDataDescCreate(this, &data, (ULONG)(sizeof(data)));
        }
 
        #pragma warning(suppress: 26495) // EventDataDescCreate() initializes all members of EVENT_DATA_DESCRIPTOR
        event_data(_In_ const int &data)
        {
            EventDataDescCreate(this, &data, (ULONG)(sizeof(data)));
        }
 
        #pragma warning(suppress: 26495) // EventDataDescCreate() initializes all members of EVENT_DATA_DESCRIPTOR
        event_data(_In_ const unsigned int &data)
        {
            EventDataDescCreate(this, &data, (ULONG)(sizeof(data)));
        }
 
        #pragma warning(suppress: 26495) // EventDataDescCreate() initializes all members of EVENT_DATA_DESCRIPTOR
        event_data(_In_ const long &data)
        {
            EventDataDescCreate(this, &data, (ULONG)(sizeof(data)));
        }
 
        #pragma warning(suppress: 26495) // EventDataDescCreate() initializes all members of EVENT_DATA_DESCRIPTOR
        event_data(_In_ const unsigned long &data)
        {
            EventDataDescCreate(this, &data, (ULONG)(sizeof(data)));
        }
 
        #pragma warning(suppress: 26495) // EventDataDescCreate() initializes all members of EVENT_DATA_DESCRIPTOR
        event_data(_In_ const GUID &data)
        {
            EventDataDescCreate(this, &data, (ULONG)(sizeof(data)));
        }
 
        #pragma warning(suppress: 26495) // EventDataDescCreate() initializes all members of EVENT_DATA_DESCRIPTOR
        event_data(_In_opt_z_ const char *data)
        {
            if (data)
                EventDataDescCreate(this, data, (ULONG)((strlen(data) + 1) * sizeof(*data)));
            else {
                // Writing NULL pointer with 0B length causes trouble in Event Viewer: message template string is displayed only, parameters are not rendered.
                static const char null[] = "(null)";
                EventDataDescCreate(this, null, sizeof(null));
            }
        }
 
        #pragma warning(suppress: 26495) // EventDataDescCreate() initializes all members of EVENT_DATA_DESCRIPTOR
        event_data(_In_opt_z_ const wchar_t *data)
        {
            if (data)
                EventDataDescCreate(this, data, (ULONG)((wcslen(data) + 1) * sizeof(*data)));
            else {
                // Writing NULL pointer with 0B length causes trouble in Event Viewer: message template string is displayed only, parameters are not rendered.
                static const wchar_t null[] = L"(null)";
                EventDataDescCreate(this, null, sizeof(null));
            }
        }
 
        #pragma warning(suppress: 26495) // EventDataDescCreate() initializes all members of EVENT_DATA_DESCRIPTOR
        template<class _Elem, class _Traits, class _Ax>
        event_data(_In_ const std::basic_string<_Elem, _Traits, _Ax> &data)
        {
            EventDataDescCreate(this, data.c_str(), (ULONG)((data.length() + 1) * sizeof(_Elem)));
        }
 
        #pragma warning(suppress: 26495) // EventDataDescCreate() initializes all members of EVENT_DATA_DESCRIPTOR
        event_data(_In_bytecount_(size) const void *data, _In_ ULONG size)
        {
            EventDataDescCreate(this, data, size);
        }
    };
 
    static const event_data blank_event_data;
 
    class event_rec : public EVENT_RECORD
    {
    public:
        event_rec()
        {
            memset((EVENT_RECORD*)this, 0, sizeof(EVENT_RECORD));
        }
 
        event_rec(_In_ const event_rec &other) : EVENT_RECORD(other)
        {
            set_extended_data_internal(other.ExtendedDataCount, other.ExtendedData);
            set_user_data_internal(other.UserDataLength, other.UserData);
        }
 
        event_rec(_In_ const EVENT_RECORD &other) : EVENT_RECORD(other)
        {
            set_extended_data_internal(other.ExtendedDataCount, other.ExtendedData);
            set_user_data_internal(other.UserDataLength, other.UserData);
        }
 
        event_rec(_Inout_ event_rec&& other) noexcept : EVENT_RECORD(other)
        {
            memset((EVENT_RECORD*)&other, 0, sizeof(EVENT_RECORD));
        }
 
        ~event_rec()
        {
            if (ExtendedData)
                delete reinterpret_cast<unsigned char*>(ExtendedData);
 
            if (UserData)
                delete reinterpret_cast<unsigned char*>(UserData);
        }
 
        event_rec& operator=(_In_ const event_rec &other)
        {
            if (this != std::addressof(other)) {
                (EVENT_RECORD&)*this = other;
                set_extended_data_internal(other.ExtendedDataCount, other.ExtendedData);
                set_user_data_internal(other.UserDataLength, other.UserData);
            }
 
            return *this;
        }
 
        event_rec& operator=(_In_ const EVENT_RECORD &other)
        {
            if (this != std::addressof(other)) {
                (EVENT_RECORD&)*this = other;
                set_extended_data_internal(other.ExtendedDataCount, other.ExtendedData);
                set_user_data_internal(other.UserDataLength, other.UserData);
            }
 
            return *this;
        }
 
        event_rec& operator=(_Inout_ event_rec&& other) noexcept
        {
            if (this != std::addressof(other)) {
                (EVENT_RECORD&)*this = other;
                memset((EVENT_RECORD*)&other, 0, sizeof(EVENT_RECORD));
            }
 
            return *this;
        }
 
        void set_extended_data(_In_ USHORT count, _In_count_(count) const EVENT_HEADER_EXTENDED_DATA_ITEM *data)
        {
            if (ExtendedData)
                delete reinterpret_cast<unsigned char*>(ExtendedData);
 
            set_extended_data_internal(count, data);
        }
 
        void set_user_data(_In_ USHORT size, _In_bytecount_(size) LPCVOID data)
        {
            if (UserData)
                delete reinterpret_cast<unsigned char*>(UserData);
 
            set_user_data_internal(size, data);
        }
 
    protected:
        void set_extended_data_internal(_In_ USHORT count, _In_count_(count) const EVENT_HEADER_EXTENDED_DATA_ITEM *data)
        {
            if (count) {
                assert(data);
 
                // Count the total required memory.
                size_t data_size = 0;
                for (size_t i = 0; i < count; i++)
                    data_size += data[i].DataSize;
 
                // Allocate memory for extended data.
                ExtendedData = reinterpret_cast<EVENT_HEADER_EXTENDED_DATA_ITEM*>(new unsigned char[sizeof(EVENT_HEADER_EXTENDED_DATA_ITEM)*count + data_size]);
 
                // Bulk-copy extended data descriptors.
                memcpy(ExtendedData, data, sizeof(EVENT_HEADER_EXTENDED_DATA_ITEM) * count);
 
                // Copy the data.
                unsigned char *ptr = reinterpret_cast<unsigned char*>(ExtendedData + count);
                for (size_t i = 0; i < count; i++) {
                    if (data[i].DataSize) {
                        memcpy(ptr, (void*)(data[i].DataPtr), data[i].DataSize);
                        ExtendedData[i].DataPtr = (ULONGLONG)ptr;
                        ptr += data[i].DataSize;
                    } else
                        ExtendedData[i].DataPtr = NULL;
                }
            } else
                ExtendedData = NULL;
 
            ExtendedDataCount = count;
        }
 
        void set_user_data_internal(_In_ USHORT size, _In_bytecount_(size) LPCVOID data)
        {
            if (size) {
                assert(data);
 
                // Allocate memory for user data.
                UserData = new unsigned char[size];
 
                // Copy user data.
                memcpy(UserData, data, size);
            } else
                UserData = NULL;
 
            UserDataLength = size;
        }
    };
 
    class event_provider : public handle<REGHANDLE, NULL>
    {
        WINSTD_HANDLE_IMPL(event_provider, NULL)
 
    public:
        virtual ~event_provider()
        {
            if (m_h != invalid)
                free_internal();
        }
 
        ULONG create(_In_ LPCGUID ProviderId)
        {
            handle_type h;
            ULONG ulRes = EventRegister(ProviderId, enable_callback, this, &h);
            if (ulRes == ERROR_SUCCESS)
                attach(h);
            return ulRes;
        }
 
        ULONG write(_In_ PCEVENT_DESCRIPTOR EventDescriptor)
        {
            assert(m_h != invalid);
            return EventWrite(m_h, EventDescriptor, 0, NULL);
        }
 
        ULONG write(_In_ PCEVENT_DESCRIPTOR EventDescriptor, _In_ ULONG UserDataCount = 0, _In_opt_count_(UserDataCount) PEVENT_DATA_DESCRIPTOR UserData = NULL)
        {
            assert(m_h != invalid);
            return EventWrite(m_h, EventDescriptor, UserDataCount, UserData);
        }
 
        ULONG write(_In_ PCEVENT_DESCRIPTOR EventDescriptor, _In_ const EVENT_DATA_DESCRIPTOR param1, ...)
        {
            assert(m_h != invalid);
 
            // The first argument (param1) is outside of varadic argument list.
            if (param1.Ptr      == winstd::blank_event_data.Ptr      &&
                param1.Size     == winstd::blank_event_data.Size     &&
                param1.Reserved == winstd::blank_event_data.Reserved)
                return EventWrite(m_h, EventDescriptor, 0, NULL);
 
            va_list arg;
            va_start(arg, param1);
            va_list arg_start = arg;
            std::vector<EVENT_DATA_DESCRIPTOR> params;
            ULONG param_count;
 
            // Preallocate array.
            for (param_count = 1; param_count < MAX_EVENT_DATA_DESCRIPTORS; param_count++) {
                const EVENT_DATA_DESCRIPTOR &p = va_arg(arg, const EVENT_DATA_DESCRIPTOR);
                if (p.Ptr      == winstd::blank_event_data.Ptr      &&
                    p.Size     == winstd::blank_event_data.Size     &&
                    p.Reserved == winstd::blank_event_data.Reserved) break;
            }
            params.reserve(param_count);
 
            // Copy parameters to array.
            arg = arg_start;
            params.push_back(param1);
            for (;;) {
                const EVENT_DATA_DESCRIPTOR &p = va_arg(arg, const EVENT_DATA_DESCRIPTOR);
                if (p.Ptr      == winstd::blank_event_data.Ptr      &&
                    p.Size     == winstd::blank_event_data.Size     &&
                    p.Reserved == winstd::blank_event_data.Reserved) break;
                params.push_back(p);
            }
 
            va_end(arg);
#pragma warning(push)
#pragma warning(disable: 28020)
            return EventWrite(m_h, EventDescriptor, param_count, params.data());
#pragma warning(pop)
        }
 
        ULONG write(_In_ PCEVENT_DESCRIPTOR EventDescriptor, _In_ va_list arg)
        {
            assert(m_h != invalid);
 
            va_list arg_start = arg;
            std::vector<EVENT_DATA_DESCRIPTOR> params;
            ULONG param_count;
 
            // Preallocate array.
            for (param_count = 0; param_count < MAX_EVENT_DATA_DESCRIPTORS; param_count++) {
                const EVENT_DATA_DESCRIPTOR &p = va_arg(arg, const EVENT_DATA_DESCRIPTOR);
                if (p.Ptr      == winstd::blank_event_data.Ptr      &&
                    p.Size     == winstd::blank_event_data.Size     &&
                    p.Reserved == winstd::blank_event_data.Reserved) break;
            }
            params.reserve(param_count);
 
            // Copy parameters to array.
            arg = arg_start;
            for (;;) {
                const EVENT_DATA_DESCRIPTOR &p = va_arg(arg, const EVENT_DATA_DESCRIPTOR);
                if (p.Ptr      == winstd::blank_event_data.Ptr      &&
                    p.Size     == winstd::blank_event_data.Size     &&
                    p.Reserved == winstd::blank_event_data.Reserved) break;
                params.push_back(p);
            }
 
#pragma warning(push)
#pragma warning(disable: 28020)
            return EventWrite(m_h, EventDescriptor, param_count, params.data());
#pragma warning(pop)
        }
 
        ULONG write(_In_ UCHAR Level, _In_ ULONGLONG Keyword, _In_z_ _Printf_format_string_ PCWSTR String, ...)
        {
            assert(m_h != invalid);
 
            std::wstring msg;
            va_list arg;
 
            // Format message.
            va_start(arg, String);
            vsprintf(msg, String, arg);
            va_end(arg);
 
            // Write string event.
            return EventWriteString(m_h, Level, Keyword, msg.c_str());
        }
 
    protected:
        void free_internal() noexcept override
        {
            EventUnregister(m_h);
        }
 
        virtual void enable_callback(_In_ LPCGUID SourceId, _In_ ULONG IsEnabled, _In_ UCHAR Level, _In_ ULONGLONG MatchAnyKeyword, _In_ ULONGLONG MatchAllKeyword, _In_opt_ PEVENT_FILTER_DESCRIPTOR FilterData)
        {
            UNREFERENCED_PARAMETER(SourceId);
            UNREFERENCED_PARAMETER(IsEnabled);
            UNREFERENCED_PARAMETER(Level);
            UNREFERENCED_PARAMETER(MatchAnyKeyword);
            UNREFERENCED_PARAMETER(MatchAllKeyword);
            UNREFERENCED_PARAMETER(FilterData);
        }
 
        static VOID NTAPI enable_callback(_In_ LPCGUID SourceId, _In_ ULONG IsEnabled, _In_ UCHAR Level, _In_ ULONGLONG MatchAnyKeyword, _In_ ULONGLONG MatchAllKeyword, _In_opt_ PEVENT_FILTER_DESCRIPTOR FilterData, _Inout_opt_ PVOID CallbackContext)
        {
            if (CallbackContext)
                static_cast<event_provider*>(CallbackContext)->enable_callback(SourceId, IsEnabled, Level, MatchAnyKeyword, MatchAllKeyword, FilterData);
            else
                assert(0); // Where did the "this" pointer get lost?
        }
    };
 
    class event_session : public handle<TRACEHANDLE, 0>
    {
        WINSTD_NONCOPYABLE(event_session)
 
    public:
        event_session()
        {
        }
 
        event_session(_In_opt_ handle_type h, _In_ const EVENT_TRACE_PROPERTIES *prop) :
            m_prop(reinterpret_cast<EVENT_TRACE_PROPERTIES*>(new char[prop->Wnode.BufferSize])),
            handle(h)
        {
            memcpy(m_prop.get(), prop, prop->Wnode.BufferSize);
        }
 
        event_session(_Inout_ event_session &&other) noexcept :
            m_prop(std::move(other.m_prop)),
            handle(std::move(other))
        {
        }
 
        virtual ~event_session()
        {
            if (m_h != invalid)
                free_internal();
        }
 
        event_session& operator=(_Inout_ event_session &&other) noexcept
        {
            if (this != std::addressof(other)) {
                (handle<handle_type, 0>&&)*this = std::move(other);
                m_prop                          = std::move(other.m_prop);
            }
            return *this;
        }
 
        operator const EVENT_TRACE_PROPERTIES*() const
        {
            return m_prop.get();
        }
 
        LPCTSTR name() const
        {
            const EVENT_TRACE_PROPERTIES *prop = m_prop.get();
            return reinterpret_cast<LPCTSTR>(reinterpret_cast<const char*>(prop) + prop->LoggerNameOffset);
        }
 
        void attach(_In_opt_ handle_type h, _In_ EVENT_TRACE_PROPERTIES *prop)
        {
            handle<handle_type, 0>::attach(h);
            m_prop.reset(prop);
        }
 
        ULONG create(_In_z_ LPCTSTR SessionName, _In_ const EVENT_TRACE_PROPERTIES *Properties)
        {
            handle_type h;
            std::unique_ptr<EVENT_TRACE_PROPERTIES> prop(reinterpret_cast<EVENT_TRACE_PROPERTIES*>(new char[Properties->Wnode.BufferSize]));
            memcpy(prop.get(), Properties, Properties->Wnode.BufferSize);
            ULONG ulRes = StartTrace(&h, SessionName, prop.get());
            if (ulRes == ERROR_SUCCESS)
                attach(h, prop.release());
            return ulRes;
        }
 
        ULONG enable_trace(_In_ LPCGUID ProviderId, _In_ UCHAR Level, _In_opt_ ULONGLONG MatchAnyKeyword = 0, _In_opt_ ULONGLONG MatchAllKeyword = 0, _In_opt_ ULONG EnableProperty = 0, _In_opt_ PEVENT_FILTER_DESCRIPTOR EnableFilterDesc = NULL)
        {
            assert(m_h != invalid);
            return EnableTraceEx(
                ProviderId,
                &m_prop->Wnode.Guid,
                m_h,
                EVENT_CONTROL_CODE_ENABLE_PROVIDER,
                Level,
                MatchAnyKeyword,
                MatchAllKeyword,
                EnableProperty,
                EnableFilterDesc);
        }
 
        ULONG disable_trace(_In_ LPCGUID ProviderId, _In_ UCHAR Level, _In_opt_ ULONGLONG MatchAnyKeyword = 0, _In_opt_ ULONGLONG MatchAllKeyword = 0, _In_opt_ ULONG EnableProperty = 0, _In_opt_ PEVENT_FILTER_DESCRIPTOR EnableFilterDesc = NULL)
        {
            assert(m_h != invalid);
            return EnableTraceEx(
                ProviderId,
                &m_prop->Wnode.Guid,
                m_h,
                EVENT_CONTROL_CODE_DISABLE_PROVIDER,
                Level,
                MatchAnyKeyword,
                MatchAllKeyword,
                EnableProperty,
                EnableFilterDesc);
        }
 
    protected:
        void free_internal() noexcept override
        {
            ControlTrace(m_h, name(), m_prop.get(), EVENT_TRACE_CONTROL_STOP);
        }
 
    protected:
        std::unique_ptr<EVENT_TRACE_PROPERTIES> m_prop; 
    };
 
    class event_trace : public handle<TRACEHANDLE, INVALID_PROCESSTRACE_HANDLE>
    {
        WINSTD_HANDLE_IMPL(event_trace, INVALID_PROCESSTRACE_HANDLE)
 
    public:
        virtual ~event_trace()
        {
            if (m_h != invalid)
                free_internal();
        }
 
    protected:
        void free_internal() noexcept override
        {
            CloseTrace(m_h);
        }
    };
 
    class event_trace_enabler
    {
    public:
        event_trace_enabler(
            _In_opt_ LPCGUID                  SourceId,
            _In_     TRACEHANDLE              TraceHandle,
            _In_     LPCGUID                  ProviderId,
            _In_     UCHAR                    Level,
            _In_opt_ ULONGLONG                MatchAnyKeyword  = 0,
            _In_opt_ ULONGLONG                MatchAllKeyword  = 0,
            _In_opt_ ULONG                    EnableProperty   = 0,
            _In_opt_ PEVENT_FILTER_DESCRIPTOR EnableFilterDesc = NULL) :
            m_provider_id(ProviderId),
            m_source_id(SourceId),
            m_trace_handle(TraceHandle),
            m_level(Level),
            m_match_any_keyword(MatchAnyKeyword),
            m_match_all_keyword(MatchAllKeyword),
            m_enable_property(EnableProperty),
            m_enable_filter_desc(EnableFilterDesc)
        {
            m_status = EnableTraceEx(
                m_provider_id,
                m_source_id,
                m_trace_handle,
                EVENT_CONTROL_CODE_ENABLE_PROVIDER,
                m_level,
                m_match_any_keyword,
                m_match_all_keyword,
                m_enable_property,
                m_enable_filter_desc);
        }
 
        event_trace_enabler(
            _In_     const event_session            &session,
            _In_           LPCGUID                  ProviderId,
            _In_           UCHAR                    Level,
            _In_opt_       ULONGLONG                MatchAnyKeyword  = 0,
            _In_opt_       ULONGLONG                MatchAllKeyword  = 0,
            _In_opt_       ULONG                    EnableProperty   = 0,
            _In_opt_       PEVENT_FILTER_DESCRIPTOR EnableFilterDesc = NULL) :
            m_provider_id(ProviderId),
            m_source_id(&((const EVENT_TRACE_PROPERTIES*)session)->Wnode.Guid),
            m_trace_handle(session),
            m_level(Level),
            m_match_any_keyword(MatchAnyKeyword),
            m_match_all_keyword(MatchAllKeyword),
            m_enable_property(EnableProperty),
            m_enable_filter_desc(EnableFilterDesc)
        {
            m_status = EnableTraceEx(
                m_provider_id,
                m_source_id,
                m_trace_handle,
                EVENT_CONTROL_CODE_ENABLE_PROVIDER,
                m_level,
                m_match_any_keyword,
                m_match_all_keyword,
                m_enable_property,
                m_enable_filter_desc);
        }
 
        ULONG status() const
        {
            return m_status;
        }
 
        virtual ~event_trace_enabler()
        {
            if (m_status == ERROR_SUCCESS)
                EnableTraceEx(
                    m_provider_id,
                    m_source_id,
                    m_trace_handle,
                    EVENT_CONTROL_CODE_DISABLE_PROVIDER,
                    m_level,
                    m_match_any_keyword,
                    m_match_all_keyword,
                    m_enable_property,
                    m_enable_filter_desc);
        }
 
    protected:
        ULONG m_status;                                 
        LPCGUID m_provider_id;                          
        LPCGUID m_source_id;                            
        TRACEHANDLE m_trace_handle;                     
        UCHAR m_level;                                  
        ULONGLONG m_match_any_keyword;                  
        ULONGLONG m_match_all_keyword;                  
        ULONG m_enable_property;                        
        PEVENT_FILTER_DESCRIPTOR m_enable_filter_desc;  
    };
 
    class event_fn_auto
    {
    public:
        event_fn_auto(_In_ event_provider &ep, _In_ const EVENT_DESCRIPTOR *event_cons, _In_ const EVENT_DESCRIPTOR *event_dest, _In_z_ LPCSTR pszFnName) :
            m_ep(ep),
            m_event_dest(event_dest)
        {
            EventDataDescCreate(&m_fn_name, pszFnName, (ULONG)(strlen(pszFnName) + 1)*sizeof(*pszFnName));
            m_ep.write(event_cons, 1, &m_fn_name);
        }
 
        event_fn_auto(_In_ const event_fn_auto &other) :
            m_ep(other.m_ep),
            m_event_dest(other.m_event_dest),
            m_fn_name(other.m_fn_name)
        {
        }
 
        event_fn_auto(_Inout_ event_fn_auto &&other) noexcept :
            m_ep(other.m_ep),
            m_event_dest(other.m_event_dest),
            m_fn_name(std::move(other.m_fn_name))
        {
            other.m_event_dest = NULL;
        }
 
        ~event_fn_auto()
        {
            if (m_event_dest)
                m_ep.write(m_event_dest, 1, &m_fn_name);
        }
 
        event_fn_auto& operator=(_In_ const event_fn_auto &other)
        {
            if (this != &other) {
                assert(&m_ep == &other.m_ep);
                m_event_dest = other.m_event_dest;
                m_fn_name    = other.m_fn_name;
            }
 
            return *this;
        }
 
        event_fn_auto& operator=(_Inout_ event_fn_auto &&other) noexcept
        {
            if (this != &other) {
                assert(&m_ep == &other.m_ep);
                m_event_dest = other.m_event_dest;
                m_fn_name    = std::move(other.m_fn_name);
                other.m_event_dest = NULL;
            }
 
            return *this;
        }
 
    protected:
        event_provider &m_ep;                   
        const EVENT_DESCRIPTOR *m_event_dest;   
        EVENT_DATA_DESCRIPTOR m_fn_name;        
    };
 
    template<class T>
    class event_fn_auto_ret
    {
    public:
        event_fn_auto_ret(_In_ event_provider &ep, _In_ const EVENT_DESCRIPTOR *event_cons, _In_ const EVENT_DESCRIPTOR *event_dest, _In_z_ LPCSTR pszFnName, T &result) :
            m_ep(ep),
            m_event_dest(event_dest),
            m_result(result)
        {
            EventDataDescCreate(m_desc + 0, pszFnName, (ULONG)(strlen(pszFnName) + 1)*sizeof(*pszFnName));
            m_ep.write(event_cons, 1, m_desc);
        }
 
        event_fn_auto_ret(_In_ const event_fn_auto_ret<T> &other) :
            m_ep(other.m_ep),
            m_event_dest(other.m_event_dest),
            m_result(other.m_result)
        {
            m_desc[0] = other.m_desc[0];
        }
 
        event_fn_auto_ret(_Inout_ event_fn_auto_ret<T> &&other) :
            m_ep(other.m_ep),
            m_event_dest(other.m_event_dest),
            m_result(other.m_result)
        {
            m_desc[0] = std::move(other.m_desc[0]);
            other.m_event_dest = NULL;
        }
 
        ~event_fn_auto_ret()
        {
            if (m_event_dest) {
                EventDataDescCreate(m_desc + 1, &m_result, sizeof(T));
                m_ep.write(m_event_dest, 2, m_desc);
            }
        }
 
        event_fn_auto_ret& operator=(_In_ const event_fn_auto_ret<T> &other)
        {
            if (this != &other) {
                assert(&m_ep == &other.m_ep);
                m_event_dest = other.m_event_dest;
                m_desc[0] = other.m_desc[0];
                assert(&m_result == &other.m_result);
            }
 
            return *this;
        }
 
        event_fn_auto_ret& operator=(_Inout_ event_fn_auto_ret<T> &&other)
        {
            if (this != &other) {
                assert(&m_ep == &other.m_ep);
                m_event_dest = other.m_event_dest;
                m_desc[0] = std::move(other.m_desc[0]);
                assert(&m_result == &other.m_result);
                other.m_event_dest = NULL;
            }
 
            return *this;
        }
 
    protected:
        event_provider &m_ep;                   
        const EVENT_DESCRIPTOR *m_event_dest;   
        EVENT_DATA_DESCRIPTOR m_desc[2];        
        T &m_result;                            
    };
 
}