summaryrefslogtreecommitdiff
path: root/general/tracing
diff options
context:
space:
mode:
authorDave Wilson <[email protected]>2015-03-17 19:50:07 -0700
committerDave Wilson <[email protected]>2015-03-17 19:50:07 -0700
commit97cf5197cf5b882b2c689d8dc2b555f2edf8f418 (patch)
tree46f3701832d70b420eb0fc0eb93261f9da45db3f /general/tracing
parentef1905bf1e8825bb31120dfb27e0daf3154d859a (diff)
Initial publish
Diffstat (limited to 'general/tracing')
-rw-r--r--general/tracing/SystemTraceControl/ReadMe.md11
-rw-r--r--general/tracing/SystemTraceControl/ReadMe.txt36
-rw-r--r--general/tracing/SystemTraceControl/SystemTraceControl.cpp221
-rw-r--r--general/tracing/SystemTraceControl/SystemTraceControl.sln28
-rw-r--r--general/tracing/SystemTraceControl/SystemTraceControl.vcxproj179
-rw-r--r--general/tracing/SystemTraceControl/SystemTraceControl.vcxproj.Filters22
-rw-r--r--general/tracing/evntdrv/Eventdrv/Eventdrv.vcxproj195
-rw-r--r--general/tracing/evntdrv/Eventdrv/Eventdrv.vcxproj.Filters34
-rw-r--r--general/tracing/evntdrv/Eventdrv/drvioctl.h34
-rw-r--r--general/tracing/evntdrv/Eventdrv/evntdrv.c345
-rw-r--r--general/tracing/evntdrv/Eventdrv/evntdrv.xml99
-rw-r--r--general/tracing/evntdrv/Eventdrv/evntdrvevents.rc3
-rw-r--r--general/tracing/evntdrv/ReadMe.md62
-rw-r--r--general/tracing/evntdrv/eventdrv.sln46
-rw-r--r--general/tracing/evntdrv/evntctrl/evntctrl.vcxproj152
-rw-r--r--general/tracing/evntdrv/evntctrl/evntctrl.vcxproj.Filters25
-rw-r--r--general/tracing/evntdrv/evntctrl/install.c499
-rw-r--r--general/tracing/evntdrv/evntctrl/install.h37
-rw-r--r--general/tracing/evntdrv/evntctrl/tracectl.c243
-rw-r--r--general/tracing/tracedriver/ReadMe.md73
-rw-r--r--general/tracing/tracedriver/tracectl/install.c499
-rw-r--r--general/tracing/tracedriver/tracectl/install.h14
-rw-r--r--general/tracing/tracedriver/tracectl/tracectl.c244
-rw-r--r--general/tracing/tracedriver/tracectl/tracectl.vcxproj152
-rw-r--r--general/tracing/tracedriver/tracectl/tracectl.vcxproj.Filters25
-rw-r--r--general/tracing/tracedriver/tracedrv.sln46
-rw-r--r--general/tracing/tracedriver/tracedrv/drvioctl.h34
-rw-r--r--general/tracing/tracedriver/tracedrv/tracedrv.c379
-rw-r--r--general/tracing/tracedriver/tracedrv/tracedrv.ctl1
-rw-r--r--general/tracing/tracedriver/tracedrv/tracedrv.h113
-rw-r--r--general/tracing/tracedriver/tracedrv/tracedrv.rc28
-rw-r--r--general/tracing/tracedriver/tracedrv/tracedrv.vcxproj164
-rw-r--r--general/tracing/tracedriver/tracedrv/tracedrv.vcxproj.Filters31
33 files changed, 4074 insertions, 0 deletions
diff --git a/general/tracing/SystemTraceControl/ReadMe.md b/general/tracing/SystemTraceControl/ReadMe.md
new file mode 100644
index 00000000..f581e52e
--- /dev/null
+++ b/general/tracing/SystemTraceControl/ReadMe.md
@@ -0,0 +1,11 @@
+SystemTraceProvider
+===================
+
+This sample application demonstrates how to use event tracing control APIs to collect events from the system trace provider.
+
+The sample code provided shows how to start an [Event Tracing](http://msdn.microsoft.com/en-us/library/windows/hardware/bb968803) for Windows trace session and how to enable system events with stacks. When you build and run the application, it collects the trace data for 30 seconds and then stops. The sample application writes the results to a file, Systemtrace.etl. For more information, see [Tools for Software Tracing](http://msdn.microsoft.com/en-us/library/windows/hardware/ff552961).
+
+You can process the Systemtrace.etl file using Tracerpt.exe. Tracerpt.exe is a command-line trace tool that formats trace events. It also analyzes the events and generates summary reports. Tracerpt is included in Windows XP and later versions of Windows. For more information about how to use this tool, see [Tracerpt](http://go.microsoft.com/fwlink/p/?linkid=179389) topic on the TechNet website.
+
+You can also process the file using the [Windows Performance Toolkit](http://go.microsoft.com/fwlink/p/?linkid=250774) (WPT), which is available in the SDK.
+
diff --git a/general/tracing/SystemTraceControl/ReadMe.txt b/general/tracing/SystemTraceControl/ReadMe.txt
new file mode 100644
index 00000000..54609bd7
--- /dev/null
+++ b/general/tracing/SystemTraceControl/ReadMe.txt
@@ -0,0 +1,36 @@
+EventTracing SystemTraceProvider control sample
+====================================================================================
+This sample demonstrates how to use event tracing control API's to collect events
+from system trace provider. The code provided will start an ETW system trace and
+enable system events with stacks. After collecting the data for 30 seconds trace
+will be stopped. Resulting file (systemtrace.etl) can be processed with
+inbox tracerpt.exe, programmatically (OpenTrace/ProcessTrace/CloseTrace) or using
+WPT (Windows Performance Toolkit) available in the SDK.
+
+Sample Language Implementations
+===============================
+C++
+
+Files
+=================================================
+SystemTraceProvider.sln
+SystemTraceProvider.vcxproj
+SystemTraceProvider.cpp
+sources
+ReadMe.txt
+
+To build the sample using the command prompt:
+=============================================
+ 1. Open the Command Prompt window and navigate to the directory.
+ 2. Type msbuild SystemTraceControl.sln.
+
+To build the sample using Visual Studio (preferred method):
+================================================
+ 1. Open File Explorer and navigate to the SystemTraceControl directory.
+ 2. Double-click the icon for the .sln (solution) file to open the file in Visual Studio.
+ 3. In the Build menu, select Build Solution. The application will be built in the default \Debug or \Release directory.
+
+To run the sample:
+=================
+ 1. Navigate to the directory that contains the new executable, using the command prompt or File Explorer.
+ 2. Type SystemTraceControl.exe at the command line, or double-click the icon for SystemTraceControl.exe to launch it from File Explorer. \ No newline at end of file
diff --git a/general/tracing/SystemTraceControl/SystemTraceControl.cpp b/general/tracing/SystemTraceControl/SystemTraceControl.cpp
new file mode 100644
index 00000000..a8c55026
--- /dev/null
+++ b/general/tracing/SystemTraceControl/SystemTraceControl.cpp
@@ -0,0 +1,221 @@
+/*++
+
+Copyright (c) Microsoft Corporation. All rights reserved.
+
+ THIS CODE AND INFORMATION IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY
+ KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE
+ IMPLIED WARRANTIES OF MERCHANTABILITY AND/OR FITNESS FOR A PARTICULAR
+ PURPOSE.
+
+Module Name:
+
+ SystemTraceControl.cpp
+
+Abstract:
+
+ This sample demonstrates how to collect events from SystemTraceProvider
+ on Windows 8.
+
+Environment:
+
+ User mode only.
+
+--*/
+
+#define INITGUID
+#include <windows.h>
+#include <stdlib.h>
+#include <stdio.h>
+#include <strsafe.h>
+#include <evntrace.h>
+
+#define MAXIMUM_SESSION_NAME 1024
+
+//
+// Guid definitions from "NT Kernel Logger Constants" section on MSDN.
+//
+
+DEFINE_GUID ( /* 3d6fa8d0-fe05-11d0-9dda-00c04fd7ba7c */
+ ProcessGuid,
+ 0x3d6fa8d0,
+ 0xfe05,
+ 0x11d0,
+ 0x9d, 0xda, 0x00, 0xc0, 0x4f, 0xd7, 0xba, 0x7c
+ );
+
+DEFINE_GUID ( /* 2cb15d1d-5fc1-11d2-abe1-00a0c911f518 */
+ ImageLoadGuid,
+ 0x2cb15d1d,
+ 0x5fc1,
+ 0x11d2,
+ 0xab, 0xe1, 0x00, 0xa0, 0xc9, 0x11, 0xf5, 0x18
+ );
+
+PEVENT_TRACE_PROPERTIES
+AllocateTraceProperties (
+ _In_opt_ PWSTR LoggerName,
+ _In_opt_ PWSTR LogFileName
+ )
+{
+ PEVENT_TRACE_PROPERTIES TraceProperties = NULL;
+ ULONG BufferSize;
+
+ BufferSize = sizeof(EVENT_TRACE_PROPERTIES) +
+ (MAXIMUM_SESSION_NAME + MAX_PATH) * sizeof(WCHAR);
+
+ TraceProperties = (PEVENT_TRACE_PROPERTIES)malloc(BufferSize);
+ if (TraceProperties == NULL) {
+ wprintf(L"Unable to allocate %d bytes for properties structure.\n", BufferSize);
+ goto Exit;
+ }
+
+ //
+ // Set the session properties.
+ //
+
+ ZeroMemory(TraceProperties, BufferSize);
+ TraceProperties->Wnode.BufferSize = BufferSize;
+ TraceProperties->Wnode.Flags = WNODE_FLAG_TRACED_GUID;
+ TraceProperties->LoggerNameOffset = sizeof(EVENT_TRACE_PROPERTIES);
+ TraceProperties->LogFileNameOffset = sizeof(EVENT_TRACE_PROPERTIES) +
+ (MAXIMUM_SESSION_NAME * sizeof(WCHAR));
+
+ if (LoggerName != NULL) {
+ StringCchCopy((LPWSTR)((PCHAR)TraceProperties + TraceProperties->LoggerNameOffset),
+ MAXIMUM_SESSION_NAME,
+ LoggerName);
+ }
+
+ if (LogFileName != NULL) {
+ StringCchCopy((LPWSTR)((PCHAR)TraceProperties + TraceProperties->LogFileNameOffset),
+ MAX_PATH,
+ LogFileName);
+ }
+
+Exit:
+ return TraceProperties;
+}
+
+VOID
+FreeTraceProperties (
+ _In_ PEVENT_TRACE_PROPERTIES TraceProperties
+ )
+{
+ free(TraceProperties);
+ return;
+}
+
+int
+__cdecl
+wmain()
+{
+ CLASSIC_EVENT_ID EventId[2];
+ ULONG Status = ERROR_SUCCESS;
+ TRACEHANDLE SessionHandle = 0;
+ PEVENT_TRACE_PROPERTIES TraceProperties;
+ ULONG SystemTraceFlags[8];
+ PWSTR LoggerName = L"MyTrace";
+
+ HeapSetInformation(NULL, HeapEnableTerminationOnCorruption, NULL, 0);
+
+ //
+ // Allocate EVENT_TRACE_PROPERTIES structure and perform some
+ // basic initialization.
+ //
+ // N.B. LoggerName will be populated during StartTrace call.
+ //
+
+ TraceProperties = AllocateTraceProperties(NULL, L"SystemTrace.etl");
+ if (TraceProperties == NULL) {
+ Status = ERROR_OUTOFMEMORY;
+ goto Exit;
+ }
+
+ //
+ // Configure additinal trace settings.
+ //
+
+ TraceProperties->LogFileMode = EVENT_TRACE_FILE_MODE_SEQUENTIAL | EVENT_TRACE_SYSTEM_LOGGER_MODE;
+ TraceProperties->Wnode.ClientContext = 1; // Use QueryPerformanceCounter for time stamps
+ TraceProperties->MaximumFileSize = 100; // Limit file size to 100MB max
+ TraceProperties->BufferSize = 512; // Use 512KB trace buffers
+ TraceProperties->MinimumBuffers = 64;
+ TraceProperties->MaximumBuffers = 128;
+
+ //
+ // Start trace session which can receive events from SystemTraceProvider.
+ //
+
+ Status = StartTrace(&SessionHandle, LoggerName, TraceProperties);
+ if (Status != ERROR_SUCCESS) {
+ wprintf(L"StartTrace() failed with %lu\n", Status);
+ goto Exit;
+ }
+
+ //
+ // Configure stack walking. In this example stack traces will be collected on
+ // ImageLoad and ProcessCreate events.
+ //
+ // N.B. Stack tracing is configured before enabling event collection.
+ //
+
+ ZeroMemory(EventId, sizeof(EventId));
+ EventId[0].EventGuid = ImageLoadGuid;
+ EventId[0].Type = EVENT_TRACE_TYPE_LOAD;
+ EventId[1].EventGuid = ProcessGuid;
+ EventId[1].Type = EVENT_TRACE_TYPE_START;
+
+ Status = TraceSetInformation(SessionHandle,
+ TraceStackTracingInfo,
+ EventId,
+ sizeof(EventId));
+
+ if (Status != ERROR_SUCCESS) {
+ wprintf(L"TraceSetInformation(StackTracing) failed with %lu\n", Status);
+ goto Exit;
+ }
+
+ //
+ // Enable system events for Process, Thread and Loader groups.
+ //
+
+ ZeroMemory(SystemTraceFlags, sizeof(SystemTraceFlags));
+ SystemTraceFlags[0] = (EVENT_TRACE_FLAG_PROCESS |
+ EVENT_TRACE_FLAG_THREAD |
+ EVENT_TRACE_FLAG_IMAGE_LOAD);
+
+ Status = TraceSetInformation(SessionHandle,
+ TraceSystemTraceEnableFlagsInfo,
+ SystemTraceFlags,
+ sizeof(SystemTraceFlags));
+
+ if (Status != ERROR_SUCCESS) {
+ wprintf(L"TraceSetInformation(EnableFlags) failed with %lu\n", Status);
+ goto Exit;
+ }
+
+ //
+ // Collect trace for 30 seconds.
+ //
+
+ Sleep(30 * 1000);
+
+Exit:
+
+ //
+ // Stop tracing.
+ //
+
+ if (SessionHandle != 0) {
+ Status = ControlTrace(SessionHandle, NULL, TraceProperties, EVENT_TRACE_CONTROL_STOP);
+ if (Status != ERROR_SUCCESS) {
+ wprintf(L"StopTrace() failed with %lu\n", Status);
+ }
+ }
+
+ if (TraceProperties != NULL) {
+ FreeTraceProperties(TraceProperties);
+ }
+
+ return Status;
+}
diff --git a/general/tracing/SystemTraceControl/SystemTraceControl.sln b/general/tracing/SystemTraceControl/SystemTraceControl.sln
new file mode 100644
index 00000000..4e74108b
--- /dev/null
+++ b/general/tracing/SystemTraceControl/SystemTraceControl.sln
@@ -0,0 +1,28 @@
+
+Microsoft Visual Studio Solution File, Format Version 12.00
+# Visual Studio 2013
+VisualStudioVersion = 12.0
+MinimumVisualStudioVersion = 12.0
+Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "SystemTraceControl", "SystemTraceControl.vcxproj", "{BBB08463-9C86-4690-B95B-106B49DD46E2}"
+EndProject
+Global
+ GlobalSection(SolutionConfigurationPlatforms) = preSolution
+ Debug|Win32 = Debug|Win32
+ Release|Win32 = Release|Win32
+ Debug|x64 = Debug|x64
+ Release|x64 = Release|x64
+ EndGlobalSection
+ GlobalSection(ProjectConfigurationPlatforms) = postSolution
+ {BBB08463-9C86-4690-B95B-106B49DD46E2}.Debug|Win32.ActiveCfg = Debug|Win32
+ {BBB08463-9C86-4690-B95B-106B49DD46E2}.Debug|Win32.Build.0 = Debug|Win32
+ {BBB08463-9C86-4690-B95B-106B49DD46E2}.Release|Win32.ActiveCfg = Release|Win32
+ {BBB08463-9C86-4690-B95B-106B49DD46E2}.Release|Win32.Build.0 = Release|Win32
+ {BBB08463-9C86-4690-B95B-106B49DD46E2}.Debug|x64.ActiveCfg = Debug|x64
+ {BBB08463-9C86-4690-B95B-106B49DD46E2}.Debug|x64.Build.0 = Debug|x64
+ {BBB08463-9C86-4690-B95B-106B49DD46E2}.Release|x64.ActiveCfg = Release|x64
+ {BBB08463-9C86-4690-B95B-106B49DD46E2}.Release|x64.Build.0 = Release|x64
+ EndGlobalSection
+ GlobalSection(SolutionProperties) = preSolution
+ HideSolutionNode = FALSE
+ EndGlobalSection
+EndGlobal
diff --git a/general/tracing/SystemTraceControl/SystemTraceControl.vcxproj b/general/tracing/SystemTraceControl/SystemTraceControl.vcxproj
new file mode 100644
index 00000000..556e6d7d
--- /dev/null
+++ b/general/tracing/SystemTraceControl/SystemTraceControl.vcxproj
@@ -0,0 +1,179 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project DefaultTargets="Build" ToolsVersion="12.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+ <ItemGroup Label="ProjectConfigurations">
+ <ProjectConfiguration Include="Debug|Win32">
+ <Configuration>Debug</Configuration>
+ <Platform>Win32</Platform>
+ </ProjectConfiguration>
+ <ProjectConfiguration Include="Release|Win32">
+ <Configuration>Release</Configuration>
+ <Platform>Win32</Platform>
+ </ProjectConfiguration>
+ <ProjectConfiguration Include="Debug|x64">
+ <Configuration>Debug</Configuration>
+ <Platform>x64</Platform>
+ </ProjectConfiguration>
+ <ProjectConfiguration Include="Release|x64">
+ <Configuration>Release</Configuration>
+ <Platform>x64</Platform>
+ </ProjectConfiguration>
+ </ItemGroup>
+ <PropertyGroup Label="Globals">
+ <ProjectGuid>{BBB08463-9C86-4690-B95B-106B49DD46E2}</ProjectGuid>
+ <RootNamespace>$(MSBuildProjectName)</RootNamespace>
+ <Configuration Condition="'$(Configuration)' == ''">Debug</Configuration>
+ <Platform Condition="'$(Platform)' == ''">Win32</Platform>
+ <SampleGuid>{E8A8798D-133D-48CA-B07A-E8D8A7C82C30}</SampleGuid>
+ </PropertyGroup>
+ <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
+ <PropertyGroup Label="Configuration" Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+ <TargetVersion>Windows10</TargetVersion>
+ <UseDebugLibraries>False</UseDebugLibraries>
+ <DriverTargetPlatform>Desktop</DriverTargetPlatform>
+ <DriverType />
+ <PlatformToolset>WindowsApplicationForDrivers10.0</PlatformToolset>
+ <ConfigurationType>Application</ConfigurationType>
+ </PropertyGroup>
+ <PropertyGroup Label="Configuration" Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+ <TargetVersion>Windows10</TargetVersion>
+ <UseDebugLibraries>True</UseDebugLibraries>
+ <DriverTargetPlatform>Desktop</DriverTargetPlatform>
+ <DriverType />
+ <PlatformToolset>WindowsApplicationForDrivers10.0</PlatformToolset>
+ <ConfigurationType>Application</ConfigurationType>
+ </PropertyGroup>
+ <PropertyGroup Label="Configuration" Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+ <TargetVersion>Windows10</TargetVersion>
+ <UseDebugLibraries>False</UseDebugLibraries>
+ <DriverTargetPlatform>Desktop</DriverTargetPlatform>
+ <DriverType />
+ <PlatformToolset>WindowsApplicationForDrivers10.0</PlatformToolset>
+ <ConfigurationType>Application</ConfigurationType>
+ </PropertyGroup>
+ <PropertyGroup Label="Configuration" Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+ <TargetVersion>Windows10</TargetVersion>
+ <UseDebugLibraries>True</UseDebugLibraries>
+ <DriverTargetPlatform>Desktop</DriverTargetPlatform>
+ <DriverType />
+ <PlatformToolset>WindowsApplicationForDrivers10.0</PlatformToolset>
+ <ConfigurationType>Application</ConfigurationType>
+ </PropertyGroup>
+ <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
+ <PropertyGroup>
+ <OutDir>$(IntDir)</OutDir>
+ </PropertyGroup>
+ <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+ <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" />
+ </ImportGroup>
+ <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+ <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" />
+ </ImportGroup>
+ <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+ <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" />
+ </ImportGroup>
+ <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+ <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" />
+ </ImportGroup>
+ <ItemGroup Label="WrappedTaskItems" />
+ <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+ <TargetName>SystemTraceControl</TargetName>
+ </PropertyGroup>
+ <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+ <TargetName>SystemTraceControl</TargetName>
+ </PropertyGroup>
+ <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+ <TargetName>SystemTraceControl</TargetName>
+ </PropertyGroup>
+ <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+ <TargetName>SystemTraceControl</TargetName>
+ </PropertyGroup>
+ <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+ <ClCompile>
+ <PreprocessorDefinitions>%(PreprocessorDefinitions);UNICODE;_UNICODE</PreprocessorDefinitions>
+ <AdditionalIncludeDirectories>%(AdditionalIncludeDirectories);$(SDK_LIB_PATH)</AdditionalIncludeDirectories>
+ <TreatWarningAsError>true</TreatWarningAsError>
+ <WarningLevel>Level4</WarningLevel>
+ <ExceptionHandling>
+ </ExceptionHandling>
+ </ClCompile>
+ <Midl>
+ <PreprocessorDefinitions>%(PreprocessorDefinitions);UNICODE;_UNICODE</PreprocessorDefinitions>
+ <AdditionalIncludeDirectories>%(AdditionalIncludeDirectories);$(SDK_LIB_PATH)</AdditionalIncludeDirectories>
+ </Midl>
+ <ResourceCompile>
+ <PreprocessorDefinitions>%(PreprocessorDefinitions);UNICODE;_UNICODE</PreprocessorDefinitions>
+ <AdditionalIncludeDirectories>%(AdditionalIncludeDirectories);$(SDK_LIB_PATH)</AdditionalIncludeDirectories>
+ </ResourceCompile>
+ </ItemDefinitionGroup>
+ <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+ <ClCompile>
+ <PreprocessorDefinitions>%(PreprocessorDefinitions);UNICODE;_UNICODE</PreprocessorDefinitions>
+ <AdditionalIncludeDirectories>%(AdditionalIncludeDirectories);$(SDK_LIB_PATH)</AdditionalIncludeDirectories>
+ <TreatWarningAsError>true</TreatWarningAsError>
+ <WarningLevel>Level4</WarningLevel>
+ <ExceptionHandling>
+ </ExceptionHandling>
+ </ClCompile>
+ <Midl>
+ <PreprocessorDefinitions>%(PreprocessorDefinitions);UNICODE;_UNICODE</PreprocessorDefinitions>
+ <AdditionalIncludeDirectories>%(AdditionalIncludeDirectories);$(SDK_LIB_PATH)</AdditionalIncludeDirectories>
+ </Midl>
+ <ResourceCompile>
+ <PreprocessorDefinitions>%(PreprocessorDefinitions);UNICODE;_UNICODE</PreprocessorDefinitions>
+ <AdditionalIncludeDirectories>%(AdditionalIncludeDirectories);$(SDK_LIB_PATH)</AdditionalIncludeDirectories>
+ </ResourceCompile>
+ </ItemDefinitionGroup>
+ <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+ <ClCompile>
+ <PreprocessorDefinitions>%(PreprocessorDefinitions);UNICODE;_UNICODE</PreprocessorDefinitions>
+ <AdditionalIncludeDirectories>%(AdditionalIncludeDirectories);$(SDK_LIB_PATH)</AdditionalIncludeDirectories>
+ <TreatWarningAsError>true</TreatWarningAsError>
+ <WarningLevel>Level4</WarningLevel>
+ <ExceptionHandling>
+ </ExceptionHandling>
+ </ClCompile>
+ <Midl>
+ <PreprocessorDefinitions>%(PreprocessorDefinitions);UNICODE;_UNICODE</PreprocessorDefinitions>
+ <AdditionalIncludeDirectories>%(AdditionalIncludeDirectories);$(SDK_LIB_PATH)</AdditionalIncludeDirectories>
+ </Midl>
+ <ResourceCompile>
+ <PreprocessorDefinitions>%(PreprocessorDefinitions);UNICODE;_UNICODE</PreprocessorDefinitions>
+ <AdditionalIncludeDirectories>%(AdditionalIncludeDirectories);$(SDK_LIB_PATH)</AdditionalIncludeDirectories>
+ </ResourceCompile>
+ </ItemDefinitionGroup>
+ <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+ <ClCompile>
+ <PreprocessorDefinitions>%(PreprocessorDefinitions);UNICODE;_UNICODE</PreprocessorDefinitions>
+ <AdditionalIncludeDirectories>%(AdditionalIncludeDirectories);$(SDK_LIB_PATH)</AdditionalIncludeDirectories>
+ <TreatWarningAsError>true</TreatWarningAsError>
+ <WarningLevel>Level4</WarningLevel>
+ <ExceptionHandling>
+ </ExceptionHandling>
+ </ClCompile>
+ <Midl>
+ <PreprocessorDefinitions>%(PreprocessorDefinitions);UNICODE;_UNICODE</PreprocessorDefinitions>
+ <AdditionalIncludeDirectories>%(AdditionalIncludeDirectories);$(SDK_LIB_PATH)</AdditionalIncludeDirectories>
+ </Midl>
+ <ResourceCompile>
+ <PreprocessorDefinitions>%(PreprocessorDefinitions);UNICODE;_UNICODE</PreprocessorDefinitions>
+ <AdditionalIncludeDirectories>%(AdditionalIncludeDirectories);$(SDK_LIB_PATH)</AdditionalIncludeDirectories>
+ </ResourceCompile>
+ </ItemDefinitionGroup>
+ <ItemGroup>
+ <ClCompile Include="SystemTraceControl.cpp" />
+ </ItemGroup>
+ <ItemGroup>
+ <Inf Exclude="@(Inf)" Include="*.inf" />
+ <FilesToPackage Include="$(TargetPath)" Condition="'$(ConfigurationType)'=='Driver' or '$(ConfigurationType)'=='DynamicLibrary'" />
+ <FilesToPackage Include="@(Inf->'%(CopyOutput)')" Condition="'@(Inf)'!=''" />
+ </ItemGroup>
+ <ItemGroup>
+ <None Exclude="@(None)" Include="*.txt;*.htm;*.html" />
+ <None Exclude="@(None)" Include="*.ico;*.cur;*.bmp;*.dlg;*.rct;*.gif;*.jpg;*.jpeg;*.wav;*.jpe;*.tiff;*.tif;*.png;*.rc2" />
+ <None Exclude="@(None)" Include="*.def;*.bat;*.hpj;*.asmx" />
+ </ItemGroup>
+ <ItemGroup>
+ <ClInclude Exclude="@(ClInclude)" Include="*.h;*.hpp;*.hxx;*.hm;*.inl;*.xsd" />
+ </ItemGroup>
+ <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
+</Project> \ No newline at end of file
diff --git a/general/tracing/SystemTraceControl/SystemTraceControl.vcxproj.Filters b/general/tracing/SystemTraceControl/SystemTraceControl.vcxproj.Filters
new file mode 100644
index 00000000..bc043bf7
--- /dev/null
+++ b/general/tracing/SystemTraceControl/SystemTraceControl.vcxproj.Filters
@@ -0,0 +1,22 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+ <ItemGroup>
+ <Filter Include="Source Files">
+ <Extensions>cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx;*</Extensions>
+ <UniqueIdentifier>{C2A52F8F-D414-40D4-998E-62C57FFF543E}</UniqueIdentifier>
+ </Filter>
+ <Filter Include="Header Files">
+ <Extensions>h;hpp;hxx;hm;inl;inc;xsd</Extensions>
+ <UniqueIdentifier>{CF32093A-DFB7-4C18-B086-1F1DB68AA8F4}</UniqueIdentifier>
+ </Filter>
+ <Filter Include="Resource Files">
+ <Extensions>rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms;man;xml</Extensions>
+ <UniqueIdentifier>{C370B48B-D85C-4319-911D-CC6D213BB287}</UniqueIdentifier>
+ </Filter>
+ </ItemGroup>
+ <ItemGroup>
+ <ClCompile Include="SystemTraceControl.cpp">
+ <Filter>Source Files</Filter>
+ </ClCompile>
+ </ItemGroup>
+</Project> \ No newline at end of file
diff --git a/general/tracing/evntdrv/Eventdrv/Eventdrv.vcxproj b/general/tracing/evntdrv/Eventdrv/Eventdrv.vcxproj
new file mode 100644
index 00000000..38a37c6d
--- /dev/null
+++ b/general/tracing/evntdrv/Eventdrv/Eventdrv.vcxproj
@@ -0,0 +1,195 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project DefaultTargets="Build" ToolsVersion="12.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+ <ItemGroup Label="ProjectConfigurations">
+ <ProjectConfiguration Include="Debug|Win32">
+ <Configuration>Debug</Configuration>
+ <Platform>Win32</Platform>
+ </ProjectConfiguration>
+ <ProjectConfiguration Include="Release|Win32">
+ <Configuration>Release</Configuration>
+ <Platform>Win32</Platform>
+ </ProjectConfiguration>
+ <ProjectConfiguration Include="Debug|x64">
+ <Configuration>Debug</Configuration>
+ <Platform>x64</Platform>
+ </ProjectConfiguration>
+ <ProjectConfiguration Include="Release|x64">
+ <Configuration>Release</Configuration>
+ <Platform>x64</Platform>
+ </ProjectConfiguration>
+ </ItemGroup>
+ <PropertyGroup Label="Globals">
+ <ProjectGuid>{71F967BF-4410-49F0-A9D9-A0968791E7C3}</ProjectGuid>
+ <RootNamespace>$(MSBuildProjectName)</RootNamespace>
+ <Configuration Condition="'$(Configuration)' == ''">Debug</Configuration>
+ <Platform Condition="'$(Platform)' == ''">Win32</Platform>
+ <SampleGuid>{D1927512-3AD6-432A-B43A-993734933EA0}</SampleGuid>
+ </PropertyGroup>
+ <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
+ <PropertyGroup Label="Configuration" Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+ <TargetVersion>Windows10</TargetVersion>
+ <UseDebugLibraries>False</UseDebugLibraries>
+ <DriverTargetPlatform>Desktop</DriverTargetPlatform>
+ <DriverType>WDM</DriverType>
+ <PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
+ <ConfigurationType>Driver</ConfigurationType>
+ </PropertyGroup>
+ <PropertyGroup Label="Configuration" Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+ <TargetVersion>Windows10</TargetVersion>
+ <UseDebugLibraries>True</UseDebugLibraries>
+ <DriverTargetPlatform>Desktop</DriverTargetPlatform>
+ <DriverType>WDM</DriverType>
+ <PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
+ <ConfigurationType>Driver</ConfigurationType>
+ </PropertyGroup>
+ <PropertyGroup Label="Configuration" Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+ <TargetVersion>Windows10</TargetVersion>
+ <UseDebugLibraries>False</UseDebugLibraries>
+ <DriverTargetPlatform>Desktop</DriverTargetPlatform>
+ <DriverType>WDM</DriverType>
+ <PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
+ <ConfigurationType>Driver</ConfigurationType>
+ </PropertyGroup>
+ <PropertyGroup Label="Configuration" Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+ <TargetVersion>Windows10</TargetVersion>
+ <UseDebugLibraries>True</UseDebugLibraries>
+ <DriverTargetPlatform>Desktop</DriverTargetPlatform>
+ <DriverType>WDM</DriverType>
+ <PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
+ <ConfigurationType>Driver</ConfigurationType>
+ </PropertyGroup>
+ <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
+ <PropertyGroup>
+ <OutDir>$(IntDir)</OutDir>
+ </PropertyGroup>
+ <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+ <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" />
+ </ImportGroup>
+ <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+ <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" />
+ </ImportGroup>
+ <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+ <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" />
+ </ImportGroup>
+ <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+ <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" />
+ </ImportGroup>
+ <ItemGroup Label="WrappedTaskItems">
+ <MessageCompile Include="evntdrv.xml">
+ <GenerateKernelModeLoggingMacros>true</GenerateKernelModeLoggingMacros>
+ <HeaderFilePath>.\$(IntDir)</HeaderFilePath>
+ <GeneratedHeaderPath>true</GeneratedHeaderPath>
+ <WinmetaPath>"$(SDK_INC_PATH)\winmeta.xml"</WinmetaPath>
+ <RCFilePath>.\$(IntDir)</RCFilePath>
+ <GeneratedRCAndMessagesPath>true</GeneratedRCAndMessagesPath>
+ <GeneratedFilesBaseName>evntdrvEvents</GeneratedFilesBaseName>
+ <UseBaseNameOfInput>true</UseBaseNameOfInput>
+ </MessageCompile>
+ </ItemGroup>
+ <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+ <TargetName>Eventdrv</TargetName>
+ </PropertyGroup>
+ <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+ <TargetName>Eventdrv</TargetName>
+ </PropertyGroup>
+ <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+ <TargetName>Eventdrv</TargetName>
+ </PropertyGroup>
+ <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+ <TargetName>Eventdrv</TargetName>
+ </PropertyGroup>
+ <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+ <ResourceCompile>
+ <AdditionalIncludeDirectories>%(AdditionalIncludeDirectories);.</AdditionalIncludeDirectories>
+ </ResourceCompile>
+ <ClCompile>
+ <AdditionalIncludeDirectories>%(AdditionalIncludeDirectories);.</AdditionalIncludeDirectories>
+ <TreatWarningAsError>true</TreatWarningAsError>
+ <WarningLevel>Level4</WarningLevel>
+ </ClCompile>
+ <Midl>
+ <AdditionalIncludeDirectories>%(AdditionalIncludeDirectories);.</AdditionalIncludeDirectories>
+ </Midl>
+ </ItemDefinitionGroup>
+ <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+ <ResourceCompile>
+ <AdditionalIncludeDirectories>%(AdditionalIncludeDirectories);.</AdditionalIncludeDirectories>
+ </ResourceCompile>
+ <ClCompile>
+ <AdditionalIncludeDirectories>%(AdditionalIncludeDirectories);.</AdditionalIncludeDirectories>
+ <TreatWarningAsError>true</TreatWarningAsError>
+ <WarningLevel>Level4</WarningLevel>
+ </ClCompile>
+ <Midl>
+ <AdditionalIncludeDirectories>%(AdditionalIncludeDirectories);.</AdditionalIncludeDirectories>
+ </Midl>
+ </ItemDefinitionGroup>
+ <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+ <ResourceCompile>
+ <AdditionalIncludeDirectories>%(AdditionalIncludeDirectories);.</AdditionalIncludeDirectories>
+ </ResourceCompile>
+ <ClCompile>
+ <AdditionalIncludeDirectories>%(AdditionalIncludeDirectories);.</AdditionalIncludeDirectories>
+ <TreatWarningAsError>true</TreatWarningAsError>
+ <WarningLevel>Level4</WarningLevel>
+ </ClCompile>
+ <Midl>
+ <AdditionalIncludeDirectories>%(AdditionalIncludeDirectories);.</AdditionalIncludeDirectories>
+ </Midl>
+ </ItemDefinitionGroup>
+ <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+ <ResourceCompile>
+ <AdditionalIncludeDirectories>%(AdditionalIncludeDirectories);.</AdditionalIncludeDirectories>
+ </ResourceCompile>
+ <ClCompile>
+ <AdditionalIncludeDirectories>%(AdditionalIncludeDirectories);.</AdditionalIncludeDirectories>
+ <TreatWarningAsError>true</TreatWarningAsError>
+ <WarningLevel>Level4</WarningLevel>
+ </ClCompile>
+ <Midl>
+ <AdditionalIncludeDirectories>%(AdditionalIncludeDirectories);.</AdditionalIncludeDirectories>
+ </Midl>
+ </ItemDefinitionGroup>
+ <ItemGroup>
+ <ClCompile Include="Evntdrv.c" />
+ <ResourceCompile Include="evntdrvEvents.rc" />
+ </ItemGroup>
+ <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+ <ClCompile>
+ <ExceptionHandling>
+ </ExceptionHandling>
+ </ClCompile>
+ </ItemDefinitionGroup>
+ <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+ <ClCompile>
+ <ExceptionHandling>
+ </ExceptionHandling>
+ </ClCompile>
+ </ItemDefinitionGroup>
+ <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+ <ClCompile>
+ <ExceptionHandling>
+ </ExceptionHandling>
+ </ClCompile>
+ </ItemDefinitionGroup>
+ <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+ <ClCompile>
+ <ExceptionHandling>
+ </ExceptionHandling>
+ </ClCompile>
+ </ItemDefinitionGroup>
+ <ItemGroup>
+ <Inf Exclude="@(Inf)" Include="*.inf" />
+ <FilesToPackage Include="$(TargetPath)" Condition="'$(ConfigurationType)'=='Driver' or '$(ConfigurationType)'=='DynamicLibrary'" />
+ <FilesToPackage Include="@(Inf->'%(CopyOutput)')" Condition="'@(Inf)'!=''" />
+ </ItemGroup>
+ <ItemGroup>
+ <None Exclude="@(None)" Include="*.txt;*.htm;*.html" />
+ <None Exclude="@(None)" Include="*.ico;*.cur;*.bmp;*.dlg;*.rct;*.gif;*.jpg;*.jpeg;*.wav;*.jpe;*.tiff;*.tif;*.png;*.rc2" />
+ <None Exclude="@(None)" Include="*.def;*.bat;*.hpj;*.asmx" />
+ </ItemGroup>
+ <ItemGroup>
+ <ClInclude Exclude="@(ClInclude)" Include="*.h;*.hpp;*.hxx;*.hm;*.inl;*.xsd" />
+ </ItemGroup>
+ <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
+</Project> \ No newline at end of file
diff --git a/general/tracing/evntdrv/Eventdrv/Eventdrv.vcxproj.Filters b/general/tracing/evntdrv/Eventdrv/Eventdrv.vcxproj.Filters
new file mode 100644
index 00000000..b3a19f20
--- /dev/null
+++ b/general/tracing/evntdrv/Eventdrv/Eventdrv.vcxproj.Filters
@@ -0,0 +1,34 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+ <ItemGroup>
+ <Filter Include="Source Files">
+ <Extensions>cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx;*</Extensions>
+ <UniqueIdentifier>{FF39F92A-78D6-4DC4-8C57-61B8235F689E}</UniqueIdentifier>
+ </Filter>
+ <Filter Include="Header Files">
+ <Extensions>h;hpp;hxx;hm;inl;inc;xsd</Extensions>
+ <UniqueIdentifier>{7D82ACC1-5CB5-4731-9F63-C6ECF120023F}</UniqueIdentifier>
+ </Filter>
+ <Filter Include="Resource Files">
+ <Extensions>rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms;man;xml</Extensions>
+ <UniqueIdentifier>{C4F65E57-AD43-415D-A828-20341B0A35CA}</UniqueIdentifier>
+ </Filter>
+ <Filter Include="Driver Files">
+ <Extensions>inf;inv;inx;mof;mc;</Extensions>
+ <UniqueIdentifier>{42E3A915-3C68-4861-986D-5BECD364D878}</UniqueIdentifier>
+ </Filter>
+ </ItemGroup>
+ <ItemGroup>
+ <MessageCompile Include="evntdrv.xml">
+ <Filter>Resource Files</Filter>
+ </MessageCompile>
+ <ResourceCompile Include="evntdrvEvents.rc">
+ <Filter>Resource Files</Filter>
+ </ResourceCompile>
+ </ItemGroup>
+ <ItemGroup>
+ <ClCompile Include="Evntdrv.c">
+ <Filter>Source Files</Filter>
+ </ClCompile>
+ </ItemGroup>
+</Project> \ No newline at end of file
diff --git a/general/tracing/evntdrv/Eventdrv/drvioctl.h b/general/tracing/evntdrv/Eventdrv/drvioctl.h
new file mode 100644
index 00000000..2185e451
--- /dev/null
+++ b/general/tracing/evntdrv/Eventdrv/drvioctl.h
@@ -0,0 +1,34 @@
+/*++
+
+Copyright (c) Microsoft Corporation. All rights reserved.
+
+ THIS CODE AND INFORMATION IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY
+ KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE
+ IMPLIED WARRANTIES OF MERCHANTABILITY AND/OR FITNESS FOR A PARTICULAR
+ PURPOSE.
+
+
+Module Name:
+
+ drvioctl.h
+
+Abstract:
+
+ Definitions of IOCTL codes and data structures exported by TRACEDRV.
+
+
+--*/
+
+#ifndef __EVENTKMP_IOCTL__
+#define __EVENTKMP_IOCTL__
+
+//
+// IOCTL control codes
+//
+#define IOCTL_EVNTKMP_TRACE_EVENT_A \
+ CTL_CODE( FILE_DEVICE_UNKNOWN, 0x801, \
+ METHOD_BUFFERED, FILE_ANY_ACCESS )
+
+#endif // __EVENTKMP_IOCTL__
+
+
diff --git a/general/tracing/evntdrv/Eventdrv/evntdrv.c b/general/tracing/evntdrv/Eventdrv/evntdrv.c
new file mode 100644
index 00000000..ad8b091d
--- /dev/null
+++ b/general/tracing/evntdrv/Eventdrv/evntdrv.c
@@ -0,0 +1,345 @@
+/*++
+
+Copyright (c) Microsoft Corporation. All rights reserved.
+
+ THIS CODE AND INFORMATION IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY
+ KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE
+ IMPLIED WARRANTIES OF MERCHANTABILITY AND/OR FITNESS FOR A PARTICULAR
+ PURPOSE.
+
+
+Module Name:
+
+ evntdrv.c
+
+Abstract:
+
+ Sample kernel mode trace provider/driver.
+
+
+--*/
+#include <stdio.h>
+#include <ntddk.h>
+#include "drvioctl.h"
+
+
+//
+// evntdrvEvents.h is generated by MC.exe with the -km option,
+// using the manifest evntdrv.htm.
+// The file contains a macro per event, and the required code to raise the
+// event.
+#include "evntdrvEvents.h"
+
+
+DRIVER_UNLOAD EventDrvDriverUnload;
+
+_Dispatch_type_(IRP_MJ_CREATE)
+_Dispatch_type_(IRP_MJ_CLOSE)
+DRIVER_DISPATCH EventDrvDispatchOpenClose;
+
+_Dispatch_type_(IRP_MJ_DEVICE_CONTROL)
+DRIVER_DISPATCH EventDrvDispatchDeviceControl;
+
+#define EventDrv_NT_DEVICE_NAME L"\\Device\\EventEtw"
+#define EventDrv_WIN32_DEVICE_NAME L"\\DosDevices\\EVENTETW"
+
+DRIVER_INITIALIZE DriverEntry;
+
+NTSTATUS
+EventDrvDispatchOpenClose(
+ IN PDEVICE_OBJECT pDO,
+ IN PIRP Irp
+ );
+
+NTSTATUS
+EventDrvDispatchDeviceControl(
+ IN PDEVICE_OBJECT pDO,
+ IN PIRP Irp
+ );
+
+VOID
+EventDrvDriverUnload(
+ IN PDRIVER_OBJECT DriverObject
+ );
+
+
+#ifdef ALLOC_PRAGMA
+#pragma alloc_text( INIT, DriverEntry )
+#pragma alloc_text( PAGE, EventDrvDispatchOpenClose )
+#pragma alloc_text( PAGE, EventDrvDispatchDeviceControl )
+#pragma alloc_text( PAGE, EventDrvDriverUnload )
+#endif // ALLOC_PRAGMA
+
+
+NTSTATUS
+DriverEntry(
+ IN PDRIVER_OBJECT DriverObject,
+ IN PUNICODE_STRING RegistryPath
+ )
+/*++
+
+Routine Description:
+
+ Installable driver initialization entry point.
+ This entry point is called directly by the I/O system.
+
+Arguments:
+
+ DriverObject - pointer to the driver object
+
+ RegistryPath - pointer to a unicode string representing the path
+ to driver-specific key in the registry
+
+Return Value:
+
+ STATUS_SUCCESS if successful
+ STATUS_UNSUCCESSFUL otherwise
+
+--*/
+{
+ NTSTATUS Status = STATUS_SUCCESS;
+ UNICODE_STRING DeviceName;
+ UNICODE_STRING LinkName;
+ PDEVICE_OBJECT EventDrvDeviceObject;
+ WCHAR DeviceNameString[128];
+ ULONG LengthToCopy = 128 * sizeof(WCHAR);
+ UNREFERENCED_PARAMETER (RegistryPath);
+
+ KdPrint(("EventDrv: DriverEntry\n"));
+
+ //
+ // Create Dispatch Entry Points.
+ //
+ DriverObject->DriverUnload = EventDrvDriverUnload;
+ DriverObject->MajorFunction[ IRP_MJ_CREATE ] = EventDrvDispatchOpenClose;
+ DriverObject->MajorFunction[ IRP_MJ_CLOSE ] = EventDrvDispatchOpenClose;
+ DriverObject->MajorFunction[ IRP_MJ_DEVICE_CONTROL ] = EventDrvDispatchDeviceControl;
+
+ RtlInitUnicodeString( &DeviceName, EventDrv_NT_DEVICE_NAME );
+
+ //
+ // Create the Device object
+ //
+ Status = IoCreateDevice(
+ DriverObject,
+ 0,
+ &DeviceName,
+ FILE_DEVICE_UNKNOWN,
+ 0,
+ FALSE,
+ &EventDrvDeviceObject);
+
+ if (!NT_SUCCESS(Status)) {
+ return Status;
+ }
+
+ RtlInitUnicodeString( &LinkName, EventDrv_WIN32_DEVICE_NAME );
+ Status = IoCreateSymbolicLink( &LinkName, &DeviceName );
+
+ if ( !NT_SUCCESS( Status )) {
+ IoDeleteDevice( EventDrvDeviceObject );
+ return Status;
+ }
+
+
+ //
+ // Choose a buffering mechanism
+ //
+ EventDrvDeviceObject->Flags |= DO_BUFFERED_IO;
+
+
+ //
+ // Register with ETW
+ //
+ EventRegisterSample_Driver();
+
+ //
+ // Log an Event with : DeviceNameLength
+ // DeviceName
+ // Status
+ //
+
+ // Copy the device name into the WCHAR local buffer in order
+ // to place a NULL character at the end, since this field is
+ // defined in the manifest as a NULL-terminated string
+
+ if (DeviceName.Length <= 128 * sizeof(WCHAR)) {
+
+ LengthToCopy = DeviceName.Length;
+
+ }
+
+ RtlCopyMemory(DeviceNameString,
+ DeviceName.Buffer,
+ LengthToCopy);
+
+ DeviceNameString[LengthToCopy/sizeof(WCHAR)] = L'\0';
+
+ EventWriteStartEvent(NULL, DeviceName.Length, DeviceNameString, Status);
+
+
+ return STATUS_SUCCESS;
+}
+
+NTSTATUS
+EventDrvDispatchOpenClose(
+ IN PDEVICE_OBJECT pDO,
+ IN PIRP Irp
+ )
+/*++
+
+Routine Description:
+
+ Dispatch routine to handle Create/Close IRPs.
+
+Arguments:
+
+ DeviceObject - pointer to a device object.
+
+ Irp - pointer to an I/O Request Packet.
+
+Return Value:
+
+ NT status code
+
+--*/
+{
+ PAGED_CODE();
+
+ UNREFERENCED_PARAMETER (pDO);
+
+ Irp->IoStatus.Status = STATUS_SUCCESS;
+ Irp->IoStatus.Information = 0;
+
+ IoCompleteRequest( Irp, IO_NO_INCREMENT );
+ return STATUS_SUCCESS;
+}
+
+
+NTSTATUS
+EventDrvDispatchDeviceControl(
+ IN PDEVICE_OBJECT pDO,
+ IN PIRP Irp
+ )
+/*++
+
+Routine Description:
+
+ Dispatch routine to handle IOCTL IRPs.
+
+Arguments:
+
+ DeviceObject - pointer to a device object.
+
+ Irp - pointer to an I/O Request Packet.
+
+Return Value:
+
+ NT Status code
+
+--*/
+{
+ NTSTATUS Status = STATUS_SUCCESS;
+ PIO_STACK_LOCATION irpStack = IoGetCurrentIrpStackLocation( Irp );
+ ULONG ControlCode = irpStack->Parameters.DeviceIoControl.IoControlCode;
+
+ PAGED_CODE();
+
+ UNREFERENCED_PARAMETER (pDO);
+
+ Irp->IoStatus.Information =
+ irpStack->Parameters.DeviceIoControl.OutputBufferLength;
+
+ switch ( ControlCode ) {
+ case IOCTL_EVNTKMP_TRACE_EVENT_A:
+ {
+
+ EventWriteSampleEventA(NULL);
+
+ Irp->IoStatus.Status = STATUS_SUCCESS;
+ Irp->IoStatus.Information = 0;
+
+ break;
+ }
+
+ default:
+
+ //
+ // Not one we recognize. Error.
+ //
+
+ Irp->IoStatus.Status = STATUS_INVALID_PARAMETER;
+ Irp->IoStatus.Information = 0;
+
+ break;
+ }
+
+ //
+ // Get rid of this request
+ //
+ IoCompleteRequest( Irp, IO_NO_INCREMENT );
+
+ return Status;
+}
+
+
+VOID
+EventDrvDriverUnload(
+ IN PDRIVER_OBJECT DriverObject
+ )
+
+/*++
+
+Routine Description:
+
+ Free all the resources allocated in DriverEntry.
+
+Arguments:
+
+ DriverObject - pointer to a driver object.
+
+Return Value:
+
+ VOID.
+
+--*/
+{
+ PDEVICE_OBJECT DevObj;
+ UNICODE_STRING LinkName;
+
+ PAGED_CODE();
+
+ KdPrint(("EventDrv: Unloading \n"));
+
+ //
+ // Get pointer to Device object
+ //
+ DevObj = DriverObject->DeviceObject;
+
+ EventWriteUnloadEvent(NULL, DevObj);
+
+ //
+ // Unregister the driver as an ETW provider
+ //
+ EventUnregisterSample_Driver();
+
+
+ //
+ // Form the Win32 symbolic link name.
+ //
+ RtlInitUnicodeString( &LinkName, EventDrv_WIN32_DEVICE_NAME );
+
+ //
+ // Remove symbolic link from Object
+ // namespace...
+ //
+ IoDeleteSymbolicLink( &LinkName );
+
+ //
+ // Unload the callbacks from the kernel to this driver
+ //
+ IoDeleteDevice( DevObj );
+
+}
+
+
diff --git a/general/tracing/evntdrv/Eventdrv/evntdrv.xml b/general/tracing/evntdrv/Eventdrv/evntdrv.xml
new file mode 100644
index 00000000..23cff805
--- /dev/null
+++ b/general/tracing/evntdrv/Eventdrv/evntdrv.xml
@@ -0,0 +1,99 @@
+<?xml version='1.0' encoding='utf-8' standalone='yes'?>
+<instrumentationManifest
+ xmlns="http://schemas.microsoft.com/win/2004/08/events"
+ xmlns:win="http://manifests.microsoft.com/win/2004/08/windows/events"
+ xmlns:xs="http://www.w3.org/2001/XMLSchema"
+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xsi:schemaLocation="http://schemas.microsoft.com/win/2004/08/events eventman.xsd"
+ >
+ <instrumentation>
+ <events>
+ <provider
+ guid="{b5a0bda9-50fe-4d0e-a83d-bae3f58c94d6}"
+ messageFileName="%SystemDrive%\ETWDriverSample\Eventdrv.sys"
+ name="Sample Driver"
+ resourceFileName="%SystemDrive%\ETWDriverSample\Eventdrv.sys"
+ symbol="DriverControlGuid"
+ >
+ <channels>
+ <importChannel
+ chid="SYSTEM"
+ name="System"
+ />
+ </channels>
+ <templates>
+ <template tid="tid_load_template">
+ <data
+ inType="win:UInt16"
+ name="DeviceNameLength"
+ outType="xs:unsignedShort"
+ />
+ <data
+ inType="win:UnicodeString"
+ name="name"
+ outType="xs:string"
+ />
+ <data
+ inType="win:UInt32"
+ name="Status"
+ outType="xs:unsignedInt"
+ />
+ </template>
+ <template tid="tid_unload_template">
+ <data
+ inType="win:Pointer"
+ name="DeviceObjPtr"
+ outType="win:HexInt64"
+ />
+ </template>
+ </templates>
+ <events>
+ <event
+ channel="SYSTEM"
+ level="win:Informational"
+ message="$(string.StartEvent.EventMessage)"
+ opcode="win:Start"
+ symbol="StartEvent"
+ template="tid_load_template"
+ value="1"
+ />
+ <event
+ channel="SYSTEM"
+ level="win:Informational"
+ message="$(string.SampleEventA.EventMessage)"
+ opcode="win:Info"
+ symbol="SampleEventA"
+ value="2"
+ />
+ <event
+ channel="SYSTEM"
+ level="win:Informational"
+ message="$(string.UnloadEvent.EventMessage)"
+ opcode="win:Stop"
+ symbol="UnloadEvent"
+ template="tid_unload_template"
+ value="3"
+ />
+ </events>
+ </provider>
+ </events>
+ </instrumentation>
+ <localization xmlns="http://schemas.microsoft.com/win/2004/08/events">
+ <resources culture="en-US">
+ <stringTable>
+ <string
+ id="StartEvent.EventMessage"
+ value="Driver Loaded"
+ />
+ <string
+ id="SampleEventA.EventMessage"
+ value="IRP A Occurred"
+ />
+ <string
+ id="UnloadEvent.EventMessage"
+ value="Driver Unloaded"
+ />
+ </stringTable>
+ </resources>
+ </localization>
+</instrumentationManifest>
diff --git a/general/tracing/evntdrv/Eventdrv/evntdrvevents.rc b/general/tracing/evntdrv/Eventdrv/evntdrvevents.rc
new file mode 100644
index 00000000..1ee5105a
--- /dev/null
+++ b/general/tracing/evntdrv/Eventdrv/evntdrvevents.rc
@@ -0,0 +1,3 @@
+LANGUAGE 0x9,0x1
+1 11 "evntdrvEvents_MSG00001.bin"
+1 WEVT_TEMPLATE "evntdrvEventsTEMP.BIN"
diff --git a/general/tracing/evntdrv/ReadMe.md b/general/tracing/evntdrv/ReadMe.md
new file mode 100644
index 00000000..f5780ef6
--- /dev/null
+++ b/general/tracing/evntdrv/ReadMe.md
@@ -0,0 +1,62 @@
+Eventdrv
+========
+
+Eventdrv is a sample kernel-mode trace provider and driver. The driver does not control any hardware; it simply generates trace events. It is designed to demonstrate the use of the [Event Tracing for Windows (ETW)](http://msdn.microsoft.com/en-us/library/windows/hardware/ff545699) API in a driver.
+
+Evntdrv registers as a provider by calling the [**EtwRegister**](http://msdn.microsoft.com/en-us/library/windows/hardware/ff545603) API. If the registration is successful, it logs a StartEvent with the device's name, the length of the name, and the status code. Then, when the sample receives a DeviceIOControl call, it logs a SampleEventA event. Finally, when the driver gets unloaded, it logs an UnloadEvent event with a pointer to the device object
+
+**Note**  The Windows Pre-Processor (WPP) Tracing tools such as TraceView.exe cannot be used to start, stop, or view traces.
+
+
+Run the sample
+--------------
+
+1. Install the manifest (Evntdrv.xml), which is located in the Evntdrv\\Eventdrv folder. Open a Visual Studio Command window (Run as administrator) and use the following command:
+
+ ``` {.syntax xml:space="preserve"}
+ wevtutil im evntdrv.xml
+ ```
+
+ Installing the manifest creates registry keys that enable tools to find the resource and message files that contain event provider information. For further details about the WevtUtil.exe tool, see the MSDN Library.
+
+ **Note**  Using a Visual Studio Command windows sets up the environment variables you need to run the tracing tools for this sample.
+
+2. Make a folder in the system directory called ETWDriverSample (for example, C:\\ETWDriverSample).
+
+ Copy Eventdrv.sys and Evntctrl.exe to the ETWDriverSample folder.
+
+ The ETWDriverSample directory must be created because the path to the resource file that is specified in the evntdrv.xml manifest points to the %SystemRoot%\\ETWDriverSample folder. If this folder is not created and the Eventdrv.sys binary is not copied, decoding tools cannot find the event information to decode the trace file.
+
+3. Use Tracelog to start a trace session that is called "TestEventdrv." The following command starts the trace session and creates a trace log file, Eventdrv.etl, in the local directory.
+
+ ``` {.syntax xml:space="preserve"}
+ Tracelog -start TestEventdrv -guid #b5a0bda9-50fe-4d0e-a83d-bae3f58c94d6 -f Eventdrv.etl
+ ```
+
+4. To generate trace messages, run Evntctrl.exe. Each time you type a character other than **Q** or **q**, Evntctrl sends an IOCTL to the driver that signals it to generate trace messages. To stop Evntctrl, type **Q** or **q**.
+
+5. To stop the trace session, run the following command:
+
+ ``` {.syntax xml:space="preserve"}
+ tracelog -stop TestEventdrv
+ ```
+
+6. To display the traces collected in the Tracedrv.etl file, run the following command:
+
+ ``` {.syntax xml:space="preserve"}
+ tracerpt Eventdrv.etl
+ ```
+
+ This command creates two files: Summary.txt and Dumpfile.xml. Dumpfile.xml will contain the event information in an XML format.
+
+7. To uninstall the manifest, run the following command:
+
+ ``` {.syntax xml:space="preserve"}
+ wevtutil um evntdrv.xml
+ ```
+
+Notes
+-----
+
+If you are building the Eventdrv sample to test on a 64-bit version of Windows, you need to sign the driver. Starting with Windows Vista, all 64-bit versions of Windows require driver code to have a digital signature for the driver to load. See [Signing a Driver](http://msdn.microsoft.com/en-us/library/windows/hardware/ff554809) and [Signing a Driver During Development and Testing](http://msdn.microsoft.com/en-us/library/windows/hardware/hh967733). You might also need to configure the test computer so that it can load test-signed kernel mode code, see [The TESTSIGNING Boot Configuration Option](http://msdn.microsoft.com/en-us/library/windows/hardware/ff553484) and [**BCDEdit /set**](http://msdn.microsoft.com/en-us/library/windows/hardware/ff542202).
+
diff --git a/general/tracing/evntdrv/eventdrv.sln b/general/tracing/evntdrv/eventdrv.sln
new file mode 100644
index 00000000..f7556ef7
--- /dev/null
+++ b/general/tracing/evntdrv/eventdrv.sln
@@ -0,0 +1,46 @@
+
+Microsoft Visual Studio Solution File, Format Version 12.00
+# Visual Studio 2013
+VisualStudioVersion = 12.0
+MinimumVisualStudioVersion = 12.0
+Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "Eventdrv", "Eventdrv", "{622DAC05-C30E-4BEE-B268-690B1B0DA989}"
+EndProject
+Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "Evntctrl", "Evntctrl", "{90152226-E1D1-482C-9AB8-701B24BA34A1}"
+EndProject
+Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "Eventdrv", "Eventdrv\Eventdrv.vcxproj", "{71F967BF-4410-49F0-A9D9-A0968791E7C3}"
+EndProject
+Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "evntctrl", "evntctrl\evntctrl.vcxproj", "{09705E95-23AF-44BE-AD49-703F2A469DB0}"
+EndProject
+Global
+ GlobalSection(SolutionConfigurationPlatforms) = preSolution
+ Debug|Win32 = Debug|Win32
+ Release|Win32 = Release|Win32
+ Debug|x64 = Debug|x64
+ Release|x64 = Release|x64
+ EndGlobalSection
+ GlobalSection(ProjectConfigurationPlatforms) = postSolution
+ {71F967BF-4410-49F0-A9D9-A0968791E7C3}.Debug|Win32.ActiveCfg = Debug|Win32
+ {71F967BF-4410-49F0-A9D9-A0968791E7C3}.Debug|Win32.Build.0 = Debug|Win32
+ {71F967BF-4410-49F0-A9D9-A0968791E7C3}.Release|Win32.ActiveCfg = Release|Win32
+ {71F967BF-4410-49F0-A9D9-A0968791E7C3}.Release|Win32.Build.0 = Release|Win32
+ {71F967BF-4410-49F0-A9D9-A0968791E7C3}.Debug|x64.ActiveCfg = Debug|x64
+ {71F967BF-4410-49F0-A9D9-A0968791E7C3}.Debug|x64.Build.0 = Debug|x64
+ {71F967BF-4410-49F0-A9D9-A0968791E7C3}.Release|x64.ActiveCfg = Release|x64
+ {71F967BF-4410-49F0-A9D9-A0968791E7C3}.Release|x64.Build.0 = Release|x64
+ {09705E95-23AF-44BE-AD49-703F2A469DB0}.Debug|Win32.ActiveCfg = Debug|Win32
+ {09705E95-23AF-44BE-AD49-703F2A469DB0}.Debug|Win32.Build.0 = Debug|Win32
+ {09705E95-23AF-44BE-AD49-703F2A469DB0}.Release|Win32.ActiveCfg = Release|Win32
+ {09705E95-23AF-44BE-AD49-703F2A469DB0}.Release|Win32.Build.0 = Release|Win32
+ {09705E95-23AF-44BE-AD49-703F2A469DB0}.Debug|x64.ActiveCfg = Debug|x64
+ {09705E95-23AF-44BE-AD49-703F2A469DB0}.Debug|x64.Build.0 = Debug|x64
+ {09705E95-23AF-44BE-AD49-703F2A469DB0}.Release|x64.ActiveCfg = Release|x64
+ {09705E95-23AF-44BE-AD49-703F2A469DB0}.Release|x64.Build.0 = Release|x64
+ EndGlobalSection
+ GlobalSection(SolutionProperties) = preSolution
+ HideSolutionNode = FALSE
+ EndGlobalSection
+ GlobalSection(NestedProjects) = preSolution
+ {71F967BF-4410-49F0-A9D9-A0968791E7C3} = {622DAC05-C30E-4BEE-B268-690B1B0DA989}
+ {09705E95-23AF-44BE-AD49-703F2A469DB0} = {90152226-E1D1-482C-9AB8-701B24BA34A1}
+ EndGlobalSection
+EndGlobal
diff --git a/general/tracing/evntdrv/evntctrl/evntctrl.vcxproj b/general/tracing/evntdrv/evntctrl/evntctrl.vcxproj
new file mode 100644
index 00000000..91610949
--- /dev/null
+++ b/general/tracing/evntdrv/evntctrl/evntctrl.vcxproj
@@ -0,0 +1,152 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project DefaultTargets="Build" ToolsVersion="12.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+ <ItemGroup Label="ProjectConfigurations">
+ <ProjectConfiguration Include="Debug|Win32">
+ <Configuration>Debug</Configuration>
+ <Platform>Win32</Platform>
+ </ProjectConfiguration>
+ <ProjectConfiguration Include="Release|Win32">
+ <Configuration>Release</Configuration>
+ <Platform>Win32</Platform>
+ </ProjectConfiguration>
+ <ProjectConfiguration Include="Debug|x64">
+ <Configuration>Debug</Configuration>
+ <Platform>x64</Platform>
+ </ProjectConfiguration>
+ <ProjectConfiguration Include="Release|x64">
+ <Configuration>Release</Configuration>
+ <Platform>x64</Platform>
+ </ProjectConfiguration>
+ </ItemGroup>
+ <PropertyGroup Label="Globals">
+ <ProjectGuid>{09705E95-23AF-44BE-AD49-703F2A469DB0}</ProjectGuid>
+ <RootNamespace>$(MSBuildProjectName)</RootNamespace>
+ <Configuration Condition="'$(Configuration)' == ''">Debug</Configuration>
+ <Platform Condition="'$(Platform)' == ''">Win32</Platform>
+ <SampleGuid>{4CB0AEF6-22DB-46DE-B86C-BA8FA83720FF}</SampleGuid>
+ </PropertyGroup>
+ <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
+ <PropertyGroup Label="Configuration" Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+ <TargetVersion>Windows10</TargetVersion>
+ <UseDebugLibraries>False</UseDebugLibraries>
+ <DriverTargetPlatform>Desktop</DriverTargetPlatform>
+ <DriverType />
+ <PlatformToolset>WindowsApplicationForDrivers10.0</PlatformToolset>
+ <ConfigurationType>Application</ConfigurationType>
+ </PropertyGroup>
+ <PropertyGroup Label="Configuration" Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+ <TargetVersion>Windows10</TargetVersion>
+ <UseDebugLibraries>True</UseDebugLibraries>
+ <DriverTargetPlatform>Desktop</DriverTargetPlatform>
+ <DriverType />
+ <PlatformToolset>WindowsApplicationForDrivers10.0</PlatformToolset>
+ <ConfigurationType>Application</ConfigurationType>
+ </PropertyGroup>
+ <PropertyGroup Label="Configuration" Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+ <TargetVersion>Windows10</TargetVersion>
+ <UseDebugLibraries>False</UseDebugLibraries>
+ <DriverTargetPlatform>Desktop</DriverTargetPlatform>
+ <DriverType />
+ <PlatformToolset>WindowsApplicationForDrivers10.0</PlatformToolset>
+ <ConfigurationType>Application</ConfigurationType>
+ </PropertyGroup>
+ <PropertyGroup Label="Configuration" Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+ <TargetVersion>Windows10</TargetVersion>
+ <UseDebugLibraries>True</UseDebugLibraries>
+ <DriverTargetPlatform>Desktop</DriverTargetPlatform>
+ <DriverType />
+ <PlatformToolset>WindowsApplicationForDrivers10.0</PlatformToolset>
+ <ConfigurationType>Application</ConfigurationType>
+ </PropertyGroup>
+ <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
+ <PropertyGroup>
+ <OutDir>$(IntDir)</OutDir>
+ </PropertyGroup>
+ <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+ <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" />
+ </ImportGroup>
+ <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+ <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" />
+ </ImportGroup>
+ <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+ <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" />
+ </ImportGroup>
+ <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+ <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" />
+ </ImportGroup>
+ <ItemGroup Label="WrappedTaskItems" />
+ <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+ <TargetName>evntctrl</TargetName>
+ </PropertyGroup>
+ <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+ <TargetName>evntctrl</TargetName>
+ </PropertyGroup>
+ <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+ <TargetName>evntctrl</TargetName>
+ </PropertyGroup>
+ <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+ <TargetName>evntctrl</TargetName>
+ </PropertyGroup>
+ <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+ <ResourceCompile>
+ <AdditionalIncludeDirectories>%(AdditionalIncludeDirectories);.;..\Eventdrv</AdditionalIncludeDirectories>
+ </ResourceCompile>
+ <ClCompile>
+ <AdditionalIncludeDirectories>%(AdditionalIncludeDirectories);.;..\Eventdrv</AdditionalIncludeDirectories>
+ </ClCompile>
+ <Midl>
+ <AdditionalIncludeDirectories>%(AdditionalIncludeDirectories);.;..\Eventdrv</AdditionalIncludeDirectories>
+ </Midl>
+ </ItemDefinitionGroup>
+ <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+ <ResourceCompile>
+ <AdditionalIncludeDirectories>%(AdditionalIncludeDirectories);.;..\Eventdrv</AdditionalIncludeDirectories>
+ </ResourceCompile>
+ <ClCompile>
+ <AdditionalIncludeDirectories>%(AdditionalIncludeDirectories);.;..\Eventdrv</AdditionalIncludeDirectories>
+ </ClCompile>
+ <Midl>
+ <AdditionalIncludeDirectories>%(AdditionalIncludeDirectories);.;..\Eventdrv</AdditionalIncludeDirectories>
+ </Midl>
+ </ItemDefinitionGroup>
+ <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+ <ResourceCompile>
+ <AdditionalIncludeDirectories>%(AdditionalIncludeDirectories);.;..\Eventdrv</AdditionalIncludeDirectories>
+ </ResourceCompile>
+ <ClCompile>
+ <AdditionalIncludeDirectories>%(AdditionalIncludeDirectories);.;..\Eventdrv</AdditionalIncludeDirectories>
+ </ClCompile>
+ <Midl>
+ <AdditionalIncludeDirectories>%(AdditionalIncludeDirectories);.;..\Eventdrv</AdditionalIncludeDirectories>
+ </Midl>
+ </ItemDefinitionGroup>
+ <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+ <ResourceCompile>
+ <AdditionalIncludeDirectories>%(AdditionalIncludeDirectories);.;..\Eventdrv</AdditionalIncludeDirectories>
+ </ResourceCompile>
+ <ClCompile>
+ <AdditionalIncludeDirectories>%(AdditionalIncludeDirectories);.;..\Eventdrv</AdditionalIncludeDirectories>
+ </ClCompile>
+ <Midl>
+ <AdditionalIncludeDirectories>%(AdditionalIncludeDirectories);.;..\Eventdrv</AdditionalIncludeDirectories>
+ </Midl>
+ </ItemDefinitionGroup>
+ <ItemGroup>
+ <ClCompile Include="install.c" />
+ <ClCompile Include="tracectl.c" />
+ </ItemGroup>
+ <ItemGroup>
+ <Inf Exclude="@(Inf)" Include="*.inf" />
+ <FilesToPackage Include="$(TargetPath)" Condition="'$(ConfigurationType)'=='Driver' or '$(ConfigurationType)'=='DynamicLibrary'" />
+ <FilesToPackage Include="@(Inf->'%(CopyOutput)')" Condition="'@(Inf)'!=''" />
+ </ItemGroup>
+ <ItemGroup>
+ <None Exclude="@(None)" Include="*.txt;*.htm;*.html" />
+ <None Exclude="@(None)" Include="*.ico;*.cur;*.bmp;*.dlg;*.rct;*.gif;*.jpg;*.jpeg;*.wav;*.jpe;*.tiff;*.tif;*.png;*.rc2" />
+ <None Exclude="@(None)" Include="*.def;*.bat;*.hpj;*.asmx" />
+ </ItemGroup>
+ <ItemGroup>
+ <ClInclude Exclude="@(ClInclude)" Include="*.h;*.hpp;*.hxx;*.hm;*.inl;*.xsd" />
+ </ItemGroup>
+ <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
+</Project> \ No newline at end of file
diff --git a/general/tracing/evntdrv/evntctrl/evntctrl.vcxproj.Filters b/general/tracing/evntdrv/evntctrl/evntctrl.vcxproj.Filters
new file mode 100644
index 00000000..fc9905ff
--- /dev/null
+++ b/general/tracing/evntdrv/evntctrl/evntctrl.vcxproj.Filters
@@ -0,0 +1,25 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+ <ItemGroup>
+ <Filter Include="Source Files">
+ <Extensions>cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx;*</Extensions>
+ <UniqueIdentifier>{CBA4CFF0-1A7A-4894-AC68-18D38BD5EABB}</UniqueIdentifier>
+ </Filter>
+ <Filter Include="Header Files">
+ <Extensions>h;hpp;hxx;hm;inl;inc;xsd</Extensions>
+ <UniqueIdentifier>{6EB53DDD-D4F4-4C46-9218-63E8B1F46F74}</UniqueIdentifier>
+ </Filter>
+ <Filter Include="Resource Files">
+ <Extensions>rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms;man;xml</Extensions>
+ <UniqueIdentifier>{479AEB6E-676D-4829-891B-3C82EADD4F94}</UniqueIdentifier>
+ </Filter>
+ </ItemGroup>
+ <ItemGroup>
+ <ClCompile Include="install.c">
+ <Filter>Source Files</Filter>
+ </ClCompile>
+ <ClCompile Include="tracectl.c">
+ <Filter>Source Files</Filter>
+ </ClCompile>
+ </ItemGroup>
+</Project> \ No newline at end of file
diff --git a/general/tracing/evntdrv/evntctrl/install.c b/general/tracing/evntdrv/evntctrl/install.c
new file mode 100644
index 00000000..9f44073b
--- /dev/null
+++ b/general/tracing/evntdrv/evntctrl/install.c
@@ -0,0 +1,499 @@
+/*++
+Copyright (c) Microsoft Corporation. All rights reserved.
+
+ THIS CODE AND INFORMATION IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY
+ KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE
+ IMPLIED WARRANTIES OF MERCHANTABILITY AND/OR FITNESS FOR A PARTICULAR
+ PURPOSE.
+
+Module Name:
+
+ install.c
+
+Abstract:
+
+ Win32 routines to dynamically load and unload a Windows NT kernel-mode
+ driver using the Service Control Manager APIs.
+
+Environment:
+
+ User mode only
+
+
+--*/
+#define UNICODE
+#define _UNICODE
+#include <windows.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <tchar.h>
+
+#include "install.h"
+
+
+BOOLEAN
+InstallDriver(
+ IN SC_HANDLE SchSCManager,
+ IN LPCTSTR DriverName,
+ IN LPCTSTR ServiceExe
+ );
+
+
+BOOLEAN
+RemoveDriver(
+ IN SC_HANDLE SchSCManager,
+ IN LPCTSTR DriverName
+ );
+
+BOOLEAN
+StartDriver(
+ IN SC_HANDLE SchSCManager,
+ IN LPCTSTR DriverName
+ );
+
+BOOLEAN
+StopDriver(
+ IN SC_HANDLE SchSCManager,
+ IN LPCTSTR DriverName
+ );
+
+BOOLEAN
+InstallDriver(
+ IN SC_HANDLE SchSCManager,
+ IN LPCTSTR DriverName,
+ IN LPCTSTR ServiceExe
+ )
+/*++
+
+Routine Description:
+
+Arguments:
+
+Return Value:
+
+--*/
+{
+ SC_HANDLE schService;
+ DWORD err;
+
+ //
+ // NOTE: This creates an entry for a standalone driver. If this
+ // is modified for use with a driver that requires a Tag,
+ // Group, and/or Dependencies, it may be necessary to
+ // query the registry for existing driver information
+ // (in order to determine a unique Tag, etc.).
+ //
+
+ //
+ // Create a new a service object.
+ //
+
+ schService = CreateService(SchSCManager, // handle of service control manager database
+ DriverName, // address of name of service to start
+ DriverName, // address of display name
+ SERVICE_ALL_ACCESS, // type of access to service
+ SERVICE_KERNEL_DRIVER, // type of service
+ SERVICE_DEMAND_START, // when to start service
+ SERVICE_ERROR_NORMAL, // severity if service fails to start
+ ServiceExe, // address of name of binary file
+ NULL, // service does not belong to a group
+ NULL, // no tag requested
+ NULL, // no dependency names
+ NULL, // use LocalSystem account
+ NULL // no password for service account
+ );
+
+ if (schService == NULL) {
+
+ err = GetLastError();
+
+ if (err == ERROR_SERVICE_EXISTS) {
+
+ //
+ // Ignore this error.
+ //
+
+ return TRUE;
+
+ } else {
+
+ _tprintf(_T("CreateService failed! Error = %d \n"), err );
+
+ //
+ // Indicate an error.
+ //
+
+ return FALSE;
+ }
+ }
+
+ //
+ // Close the service object.
+ //
+
+ if (schService) {
+
+ CloseServiceHandle(schService);
+ }
+
+ //
+ // Indicate success.
+ //
+
+ return TRUE;
+
+} // InstallDriver
+
+BOOLEAN
+ManageDriver(
+ IN LPCTSTR DriverName,
+ IN LPCTSTR ServiceName,
+ IN USHORT Function
+ )
+{
+
+ SC_HANDLE schSCManager;
+
+ BOOLEAN rCode = TRUE;
+
+ //
+ // Insure (somewhat) that the driver and service names are valid.
+ //
+
+ if (!DriverName || !ServiceName) {
+
+ _tprintf(_T("Invalid Driver or Service provided to ManageDriver() \n"));
+
+ return FALSE;
+ }
+
+ //
+ // Connect to the Service Control Manager and open the Services database.
+ //
+
+ schSCManager = OpenSCManager(NULL, // local machine
+ NULL, // local database
+ SC_MANAGER_ALL_ACCESS // access required
+ );
+
+ if (!schSCManager) {
+
+ _tprintf(_T("Open SC Manager failed! Error = %d \n"), GetLastError());
+
+ return FALSE;
+ }
+
+ //
+ // Do the requested function.
+ //
+
+ switch( Function ) {
+
+ case DRIVER_FUNC_INSTALL:
+
+ //
+ // Install the driver service.
+ //
+
+ if (InstallDriver(schSCManager,
+ DriverName,
+ ServiceName
+ )) {
+
+ //
+ // Start the driver service (i.e. start the driver).
+ //
+
+ rCode = StartDriver(schSCManager,
+ DriverName
+ );
+
+ } else {
+
+ //
+ // Indicate an error.
+ //
+
+ rCode = FALSE;
+ }
+
+ break;
+
+ case DRIVER_FUNC_REMOVE:
+
+ //
+ // Stop the driver.
+ //
+
+ StopDriver(schSCManager,
+ DriverName
+ );
+
+ //
+ // Remove the driver service.
+ //
+
+ RemoveDriver(schSCManager,
+ DriverName
+ );
+
+ //
+ // Ignore all errors.
+ //
+
+ rCode = TRUE;
+
+ break;
+
+ case DRIVER_FUNC_STOP:
+
+ //
+ // Stop the driver.
+ //
+
+ StopDriver(schSCManager,
+ DriverName
+ );
+
+ //
+ // Ignore all errors.
+ //
+
+ rCode = TRUE;
+
+ break;
+
+ default:
+
+ _tprintf(_T("Unknown ManageDriver() function. \n"));
+
+ rCode = FALSE;
+
+ break;
+ }
+
+ //
+ // Close handle to service control manager.
+ //
+
+ if (schSCManager) {
+
+ CloseServiceHandle(schSCManager);
+ }
+
+ return rCode;
+
+} // ManageDriver
+
+
+BOOLEAN
+RemoveDriver(
+ IN SC_HANDLE SchSCManager,
+ IN LPCTSTR DriverName
+ )
+{
+ SC_HANDLE schService;
+ BOOLEAN rCode;
+
+ //
+ // Open the handle to the existing service.
+ //
+
+ schService = OpenService(SchSCManager,
+ DriverName,
+ SERVICE_ALL_ACCESS
+ );
+
+ if (schService == NULL) {
+
+ _tprintf(_T("OpenService failed! Error = %d \n"), GetLastError());
+
+ //
+ // Indicate error.
+ //
+
+ return FALSE;
+ }
+
+ //
+ // Mark the service for deletion from the service control manager database.
+ //
+
+ if (DeleteService(schService)) {
+
+ //
+ // Indicate success.
+ //
+
+ rCode = TRUE;
+
+ } else {
+
+ _tprintf(_T("DeleteService failed! Error = %d \n"), GetLastError());
+
+ //
+ // Indicate failure. Fall through to properly close the service handle.
+ //
+
+ rCode = FALSE;
+ }
+
+ //
+ // Close the service object.
+ //
+
+ if (schService) {
+
+ CloseServiceHandle(schService);
+ }
+
+ return rCode;
+
+} // RemoveDriver
+
+
+
+BOOLEAN
+StartDriver(
+ IN SC_HANDLE SchSCManager,
+ IN LPCTSTR DriverName
+ )
+{
+ SC_HANDLE schService;
+ DWORD err;
+
+ //
+ // Open the handle to the existing service.
+ //
+
+ schService = OpenService(SchSCManager,
+ DriverName,
+ SERVICE_ALL_ACCESS
+ );
+
+ if (schService == NULL) {
+
+ _tprintf(_T("OpenService failed! Error = %d \n"), GetLastError());
+
+ //
+ // Indicate failure.
+ //
+
+ return FALSE;
+ }
+
+ //
+ // Start the execution of the service (i.e. start the driver).
+ //
+
+ if (!StartService(schService, // service identifier
+ 0, // number of arguments
+ NULL // pointer to arguments
+ )) {
+
+ err = GetLastError();
+
+ if (err == ERROR_SERVICE_ALREADY_RUNNING) {
+
+ //
+ // Ignore this error.
+ //
+
+ return TRUE;
+
+ } else {
+
+ _tprintf(_T("StartService failure! Error = %d \n"), err );
+
+ //
+ // Indicate failure. Fall through to properly close the service handle.
+ //
+
+ return FALSE;
+ }
+
+ }
+
+ //
+ // Close the service object.
+ //
+
+ if (schService) {
+
+ CloseServiceHandle(schService);
+ }
+
+ return TRUE;
+
+} // StartDriver
+
+
+
+BOOLEAN
+StopDriver(
+ IN SC_HANDLE SchSCManager,
+ IN LPCTSTR DriverName
+ )
+{
+ BOOLEAN rCode = TRUE;
+ SC_HANDLE schService;
+ SERVICE_STATUS serviceStatus;
+
+ //
+ // Open the handle to the existing service.
+ //
+
+ schService = OpenService(SchSCManager,
+ DriverName,
+ SERVICE_ALL_ACCESS
+ );
+
+ if (schService == NULL) {
+
+ _tprintf(_T("OpenService failed! Error = %d \n"), GetLastError());
+
+ return FALSE;
+ }
+
+ //
+ // Request that the service stop.
+ //
+
+ if (ControlService(schService,
+ SERVICE_CONTROL_STOP,
+ &serviceStatus
+ )) {
+
+ //
+ // Indicate success.
+ //
+
+ rCode = TRUE;
+
+ } else {
+
+ _tprintf(_T("ControlService failed! Error = %d \n"), GetLastError() );
+
+ //
+ // Indicate failure. Fall through to properly close the service handle.
+ //
+
+ rCode = FALSE;
+ }
+
+ //
+ // Close the service object.
+ //
+
+ if (schService) {
+
+ CloseServiceHandle (schService);
+ }
+
+ return rCode;
+
+} // StopDriver
+
+
+
+
diff --git a/general/tracing/evntdrv/evntctrl/install.h b/general/tracing/evntdrv/evntctrl/install.h
new file mode 100644
index 00000000..879bc693
--- /dev/null
+++ b/general/tracing/evntdrv/evntctrl/install.h
@@ -0,0 +1,37 @@
+/*++
+Copyright (c) Microsoft Corporation. All rights reserved.
+
+ THIS CODE AND INFORMATION IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY
+ KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE
+ IMPLIED WARRANTIES OF MERCHANTABILITY AND/OR FITNESS FOR A PARTICULAR
+ PURPOSE.
+
+Module Name:
+
+ install.h
+
+Abstract:
+
+ Win32 routines to dynamically load and unload a Windows NT kernel-mode
+ driver using the Service Control Manager APIs.
+
+Environment:
+
+ User mode only
+
+
+--*/
+
+#define DRIVER_FUNC_INSTALL 0x01
+#define DRIVER_FUNC_REMOVE 0x02
+#define DRIVER_FUNC_STOP 0x03
+
+#define DRIVER_NAME _T("Eventdrv")
+
+BOOLEAN
+ManageDriver(
+ IN LPCTSTR DriverName,
+ IN LPCTSTR ServiceName,
+ IN USHORT Function
+ );
+
diff --git a/general/tracing/evntdrv/evntctrl/tracectl.c b/general/tracing/evntdrv/evntctrl/tracectl.c
new file mode 100644
index 00000000..2b9a0b78
--- /dev/null
+++ b/general/tracing/evntdrv/evntctrl/tracectl.c
@@ -0,0 +1,243 @@
+/*++
+
+Copyright (c) Microsoft Corporation. All rights reserved.
+
+ THIS CODE AND INFORMATION IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY
+ KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE
+ IMPLIED WARRANTIES OF MERCHANTABILITY AND/OR FITNESS FOR A PARTICULAR
+ PURPOSE.
+
+Module Name:
+
+ tracectl.c
+
+Environment:
+
+ User mode Win32 console application
+
+Revision History:
+
+
+--*/
+#define UNICODE
+#define _UNICODE
+#include <windows.h>
+#include <winioctl.h>
+#include <tchar.h>
+#include <stdio.h>
+#include "drvioctl.h"
+#include "install.h"
+#include <conio.h>
+#include <strsafe.h>
+
+#define WAIT_TIME 10
+
+BOOLEAN
+SetupDriverName(
+ _Out_writes_(MAX_PATH)LPTSTR DriverLocation
+ );
+
+int _cdecl main(int argc, LPCTSTR argv[])
+{
+ HANDLE hDevice; // handle to a device, file, or directory
+ DWORD dwError = ERROR_SUCCESS;
+ LPVOID lpFileName = _T("\\\\.\\EventEtw") ;
+ TCHAR driverLocation[MAX_PATH];
+ DWORD dwOutBuffer[2048];
+ DWORD dwOutBufferCount ;
+ int ch;
+
+ UNREFERENCED_PARAMETER(argc);
+ UNREFERENCED_PARAMETER(argv);
+
+ if ((hDevice = CreateFile(
+ lpFileName, // pointer to name of the file
+ 0, // access (read-write) mode
+ 0, // share mode
+ NULL, // pointer to security attributes
+ OPEN_EXISTING, // how to create
+ FILE_ATTRIBUTE_NORMAL, // file attributes
+ NULL // handle to file with attributes to
+ // copy
+ )) == INVALID_HANDLE_VALUE) {
+ dwError = GetLastError();
+
+ if ( dwError != ERROR_FILE_NOT_FOUND ) {
+ _tprintf(_T("CreateFile failed ! error: %d\n"), dwError);
+ return 1;
+ }
+
+ //
+ // Setup full path to driver name
+ //
+
+ if (!SetupDriverName(driverLocation)) {
+
+ return 2;
+
+ }
+
+ //
+ // Install driver
+ //
+
+ if (!ManageDriver(DRIVER_NAME,
+ driverLocation,
+ DRIVER_FUNC_INSTALL
+ )) {
+
+ _tprintf(_T("Unable to install driver. \n"));
+
+ //
+ // Error - remove driver.
+ //
+
+ ManageDriver(DRIVER_NAME,
+ driverLocation,
+ DRIVER_FUNC_REMOVE
+ );
+
+ return 3;
+ }
+
+ if ((hDevice = CreateFile(
+ lpFileName, // pointer to name of the file
+ 0, // access (read-write) mode
+ 0, // share mode
+ NULL, // pointer to security attributes
+ OPEN_EXISTING, // how to create
+ FILE_ATTRIBUTE_NORMAL, // file attributes
+ NULL // handle to file with attributes to
+ // copy
+ )) == INVALID_HANDLE_VALUE) {
+
+ _tprintf(_T("Error: CreateFile failed\n"));
+ return 4;
+ }
+ }
+
+
+
+ _tprintf(_T("\nPress 'q' to exit, any other key to send ioctl...\n"));
+ fflush(stdin);
+ ch = _getche();
+
+ while(tolower(ch) != 'q' )
+ {
+
+ _tprintf(_T("Making IOCTL_EVNTKMP_TRACE_EVENT_A ioctl to log events\n"));
+ if (DeviceIoControl(
+ hDevice, // handle to a device, file, or directory
+ IOCTL_EVNTKMP_TRACE_EVENT_A, // control code of operation to perform
+ NULL, // pointer to buffer to supply input data
+ 0, // size, in bytes, of input buffer
+ dwOutBuffer, // pointer to buffer to receive output data
+ 2048, // size, in bytes, of output buffer
+ &dwOutBufferCount, // pointer to variable to receive byte count
+ NULL // pointer to structure for asynchronous operation
+ ) == 0) {
+
+ _tprintf(_T("DeviceIOControl Failed %d\n"),GetLastError());
+ return 5;
+
+ }
+ ch = _getche();
+ }
+
+ if (CloseHandle(hDevice) == 0) {
+
+ _tprintf(_T("CloseHandle Failed %d\n"),GetLastError());
+ return 6;
+
+ }
+
+ //
+ // stop the driver
+ //
+
+ ManageDriver(DRIVER_NAME,
+ driverLocation,
+ DRIVER_FUNC_REMOVE
+ );
+
+ _tprintf(_T("Driver '%s' is removed\n"), DRIVER_NAME);
+
+ return 0;
+}
+
+BOOLEAN
+SetupDriverName(
+ _Out_writes_(MAX_PATH) LPTSTR DriverLocation
+ )
+{
+ HANDLE fileHandle;
+
+ DWORD driverLocLen = 0;
+
+ //
+ // Get the current directory.
+ //
+
+ driverLocLen = GetCurrentDirectory(MAX_PATH,
+ DriverLocation
+ );
+
+ if (!driverLocLen) {
+
+ _tprintf(_T("GetCurrentDirectory failed! Error = %d \n"), GetLastError());
+
+ return FALSE;
+ }
+
+ //
+ // Setup path name to driver file.
+ //
+
+ if (StringCchPrintf(&DriverLocation[_tcslen(DriverLocation)],
+ (MAX_PATH - _tcslen(DriverLocation)),
+ _T("\\%s.sys"),
+ DRIVER_NAME) != S_OK){
+ _tprintf(_T("Failed to generate DriverLocation!, StringCchPrintf Error = %d \n"), GetLastError());
+ return FALSE;
+ }
+
+ //
+ // Insure driver file is in the specified directory.
+ //
+
+ if ((fileHandle = CreateFile(DriverLocation,
+ GENERIC_READ,
+ 0,
+ NULL,
+ OPEN_EXISTING,
+ FILE_ATTRIBUTE_NORMAL,
+ NULL
+ )) == INVALID_HANDLE_VALUE) {
+
+
+ _tprintf(_T("Driver: '%s' is not in the current directory. \n"), DRIVER_NAME);
+
+ //
+ // Indicate failure.
+ //
+
+ return FALSE;
+ }
+
+ //
+ // Close open file handle.
+ //
+
+ if (fileHandle) {
+
+ CloseHandle(fileHandle);
+ }
+
+ //
+ // Indicate success.
+ //
+
+ return TRUE;
+
+
+} // SetupDriverName
diff --git a/general/tracing/tracedriver/ReadMe.md b/general/tracing/tracedriver/ReadMe.md
new file mode 100644
index 00000000..99c46dd5
--- /dev/null
+++ b/general/tracing/tracedriver/ReadMe.md
@@ -0,0 +1,73 @@
+Tracedrv
+========
+
+Tracedrv is a sample driver instrumented for software tracing. The driver does not control any hardware; it simply generates trace messages. It is designed to show how to use WPP software tracing macros in a driver.
+
+Tracedrv initializes tracing (by using WPP\_INIT\_TRACING) and, when it receives a DeviceIOControl call, it starts a thread that logs 100 trace messages. The WPP software tracing directives, calls, and macros in the code are accompanied by comments that explain their purpose
+
+While examining Tracedrv, read the [WPP Software Tracing](http://msdn.microsoft.com/en-us/library/windows/hardware/ff556204) in the Windows Driver Kit (WDK). This section includes a reference section that describes the directives, macros, and calls required for WPP software tracing.
+
+Run the sample
+--------------
+
+To test the Tracedrv event tracing provider, use the following procedure.
+
+1. Copy the Tracectl.exe file that was created when you built the Tracedrv solution from the Tracectl directory (for example, \\Documents\\Visual Studio 2013\\Projects\\tracedrv\\tracectl\\*platform*) to the Tracedrv directory (for example, \\Documents\\Visual Studio 2013\\Projects\\tracedrv\\tracedrv\\*platform*).
+2. Use Tracepdb to create a trace message format (TMF) file and a trace message control (TMC) file from the Tracedrv.pdb file. Tracepdb is located in the C:\\Program Files (x86)\\Windows Kits\\8.1\\bin\\*platform* directory. The PDB file that is used in this command is created when you the build the solution. Open a Visual Studio Command prompt window and navigate to the target build platform and configuration directory. Type the following command:
+
+ **tracepdb -f tracedrv.pdb**
+
+3. In the same Tracedrv target build directory, create a control GUID file for Tracedrv by opening a text file, adding the following content, and saving the file as Tracedrv.ctl.
+
+ <table>
+ <colgroup>
+ <col width="100%" />
+ </colgroup>
+ <thead>
+ <tr class="header">
+ <th align="left">Text</th>
+ </tr>
+ </thead>
+ <tbody>
+ <tr class="odd">
+ <td align="left"><pre><code>d58c126f-b309-11d1-969e-0000f875a5bc </code></pre></td>
+ </tr>
+ </tbody>
+ </table>
+
+4. Use Tracelog to start a trace session that is called *TestTracedrv*. Tracelog is located in the C:\\Program Files (x86)\\Windows Kits\\8.1\\bin\\*platform* directory. The Tracedrv.ctl file that is used in this command was created in the previous step. The following command starts a trace session and creates a trace log file, tracedrv.etl, in the local directory.
+
+ ``` {.syntax xml:space="preserve"}
+ tracelog -start TestTracedrv -guid tracedrv.ctl -f tracedrv.etl -flag 1
+ ```
+
+ **Note**  Note: Without the -flag parameter, Tracedrv will not generate any trace messages.
+
+5. To generate trace messages, run Tracectl.exe. This executable file is built when you build the solution. Each time you type a character, other than **Q** or **q**, Tracectl sends an IOCTL to the driver that signals it to generate trace messages. To stop Tracectl, type **Q** or **q**.
+6. To stop the trace session, use the following Tracelog command.
+
+ ``` {.syntax xml:space="preserve"}
+ tracelog -stop TestTracedrv
+ ```
+
+7. To display the trace messages in the Tracedrv.etl file, use Tracefmt.exe. Tracefmt.exe is located in the C:\\Program Files (x86)\\Windows Kits\\8.1\\bin\\*platform*. The TMF file used in this command was created by Tracepdb.exe in step 2. The **-p** option specifies the directory of the TMF file. In this case, the TMF file is in the current directory. Type the following command:
+
+ ``` {.syntax xml:space="preserve"}
+ tracefmt tracedrv.etl -p . -o Tracedrv.out
+ ```
+
+The resulting Tracedrv.out file is a human-readable text file of the Tracedrv trace messages. To interpret the trace messages, in the Tracedrv.c file, search for the [**DoTraceMessage**](http://msdn.microsoft.com/en-us/library/windows/hardware/ff544918) macros.
+
+Notes
+-----
+
+This sample driver should not be used in a production environment.
+
+Tracedrv is designed for Windows XP and later versions of Windows. It does not demonstrate how to add WPP software tracing to a Windows 2000 driver. (For information about adding WPP software tracing to a Windows 2000 driver, see the [Software Tracing FAQ](http://msdn.microsoft.com/en-us/library/windows/hardware/ff551795) topic in the Windows DDK documentation.)
+
+Also, because it is not a Plug and Play driver, Tracedrv does not demonstrate tracing in a Plug and Play environment.
+
+Tracedrv demonstrates the basic elements required for software tracing. It does not demonstrate more advanced tracing techniques, such as writing customized tracing calls (variations of [**DoTraceMessage**](http://msdn.microsoft.com/en-us/library/windows/hardware/ff544918)), or the use of WMI calls for software tracing.
+
+If you are building the Tracedrv sample to test on a 64-bit version of Windows, you need to sign the driver. Starting with Windows Vista, all 64-bit versions of Windows require driver code to have a digital signature for the driver to load. See [Signing a Driver](http://msdn.microsoft.com/en-us/library/windows/hardware/ff554809) and [Signing a Driver During Development and Testing](http://msdn.microsoft.com/en-us/library/windows/hardware/hh967733). You might also need to configure the test computer so that it can load test-signed kernel mode code, see [The TESTSIGNING Boot Configuration Option](http://msdn.microsoft.com/en-us/library/windows/hardware/ff553484) and [**BCDEdit /set**](http://msdn.microsoft.com/en-us/library/windows/hardware/ff542202).
+
diff --git a/general/tracing/tracedriver/tracectl/install.c b/general/tracing/tracedriver/tracectl/install.c
new file mode 100644
index 00000000..9f44073b
--- /dev/null
+++ b/general/tracing/tracedriver/tracectl/install.c
@@ -0,0 +1,499 @@
+/*++
+Copyright (c) Microsoft Corporation. All rights reserved.
+
+ THIS CODE AND INFORMATION IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY
+ KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE
+ IMPLIED WARRANTIES OF MERCHANTABILITY AND/OR FITNESS FOR A PARTICULAR
+ PURPOSE.
+
+Module Name:
+
+ install.c
+
+Abstract:
+
+ Win32 routines to dynamically load and unload a Windows NT kernel-mode
+ driver using the Service Control Manager APIs.
+
+Environment:
+
+ User mode only
+
+
+--*/
+#define UNICODE
+#define _UNICODE
+#include <windows.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <tchar.h>
+
+#include "install.h"
+
+
+BOOLEAN
+InstallDriver(
+ IN SC_HANDLE SchSCManager,
+ IN LPCTSTR DriverName,
+ IN LPCTSTR ServiceExe
+ );
+
+
+BOOLEAN
+RemoveDriver(
+ IN SC_HANDLE SchSCManager,
+ IN LPCTSTR DriverName
+ );
+
+BOOLEAN
+StartDriver(
+ IN SC_HANDLE SchSCManager,
+ IN LPCTSTR DriverName
+ );
+
+BOOLEAN
+StopDriver(
+ IN SC_HANDLE SchSCManager,
+ IN LPCTSTR DriverName
+ );
+
+BOOLEAN
+InstallDriver(
+ IN SC_HANDLE SchSCManager,
+ IN LPCTSTR DriverName,
+ IN LPCTSTR ServiceExe
+ )
+/*++
+
+Routine Description:
+
+Arguments:
+
+Return Value:
+
+--*/
+{
+ SC_HANDLE schService;
+ DWORD err;
+
+ //
+ // NOTE: This creates an entry for a standalone driver. If this
+ // is modified for use with a driver that requires a Tag,
+ // Group, and/or Dependencies, it may be necessary to
+ // query the registry for existing driver information
+ // (in order to determine a unique Tag, etc.).
+ //
+
+ //
+ // Create a new a service object.
+ //
+
+ schService = CreateService(SchSCManager, // handle of service control manager database
+ DriverName, // address of name of service to start
+ DriverName, // address of display name
+ SERVICE_ALL_ACCESS, // type of access to service
+ SERVICE_KERNEL_DRIVER, // type of service
+ SERVICE_DEMAND_START, // when to start service
+ SERVICE_ERROR_NORMAL, // severity if service fails to start
+ ServiceExe, // address of name of binary file
+ NULL, // service does not belong to a group
+ NULL, // no tag requested
+ NULL, // no dependency names
+ NULL, // use LocalSystem account
+ NULL // no password for service account
+ );
+
+ if (schService == NULL) {
+
+ err = GetLastError();
+
+ if (err == ERROR_SERVICE_EXISTS) {
+
+ //
+ // Ignore this error.
+ //
+
+ return TRUE;
+
+ } else {
+
+ _tprintf(_T("CreateService failed! Error = %d \n"), err );
+
+ //
+ // Indicate an error.
+ //
+
+ return FALSE;
+ }
+ }
+
+ //
+ // Close the service object.
+ //
+
+ if (schService) {
+
+ CloseServiceHandle(schService);
+ }
+
+ //
+ // Indicate success.
+ //
+
+ return TRUE;
+
+} // InstallDriver
+
+BOOLEAN
+ManageDriver(
+ IN LPCTSTR DriverName,
+ IN LPCTSTR ServiceName,
+ IN USHORT Function
+ )
+{
+
+ SC_HANDLE schSCManager;
+
+ BOOLEAN rCode = TRUE;
+
+ //
+ // Insure (somewhat) that the driver and service names are valid.
+ //
+
+ if (!DriverName || !ServiceName) {
+
+ _tprintf(_T("Invalid Driver or Service provided to ManageDriver() \n"));
+
+ return FALSE;
+ }
+
+ //
+ // Connect to the Service Control Manager and open the Services database.
+ //
+
+ schSCManager = OpenSCManager(NULL, // local machine
+ NULL, // local database
+ SC_MANAGER_ALL_ACCESS // access required
+ );
+
+ if (!schSCManager) {
+
+ _tprintf(_T("Open SC Manager failed! Error = %d \n"), GetLastError());
+
+ return FALSE;
+ }
+
+ //
+ // Do the requested function.
+ //
+
+ switch( Function ) {
+
+ case DRIVER_FUNC_INSTALL:
+
+ //
+ // Install the driver service.
+ //
+
+ if (InstallDriver(schSCManager,
+ DriverName,
+ ServiceName
+ )) {
+
+ //
+ // Start the driver service (i.e. start the driver).
+ //
+
+ rCode = StartDriver(schSCManager,
+ DriverName
+ );
+
+ } else {
+
+ //
+ // Indicate an error.
+ //
+
+ rCode = FALSE;
+ }
+
+ break;
+
+ case DRIVER_FUNC_REMOVE:
+
+ //
+ // Stop the driver.
+ //
+
+ StopDriver(schSCManager,
+ DriverName
+ );
+
+ //
+ // Remove the driver service.
+ //
+
+ RemoveDriver(schSCManager,
+ DriverName
+ );
+
+ //
+ // Ignore all errors.
+ //
+
+ rCode = TRUE;
+
+ break;
+
+ case DRIVER_FUNC_STOP:
+
+ //
+ // Stop the driver.
+ //
+
+ StopDriver(schSCManager,
+ DriverName
+ );
+
+ //
+ // Ignore all errors.
+ //
+
+ rCode = TRUE;
+
+ break;
+
+ default:
+
+ _tprintf(_T("Unknown ManageDriver() function. \n"));
+
+ rCode = FALSE;
+
+ break;
+ }
+
+ //
+ // Close handle to service control manager.
+ //
+
+ if (schSCManager) {
+
+ CloseServiceHandle(schSCManager);
+ }
+
+ return rCode;
+
+} // ManageDriver
+
+
+BOOLEAN
+RemoveDriver(
+ IN SC_HANDLE SchSCManager,
+ IN LPCTSTR DriverName
+ )
+{
+ SC_HANDLE schService;
+ BOOLEAN rCode;
+
+ //
+ // Open the handle to the existing service.
+ //
+
+ schService = OpenService(SchSCManager,
+ DriverName,
+ SERVICE_ALL_ACCESS
+ );
+
+ if (schService == NULL) {
+
+ _tprintf(_T("OpenService failed! Error = %d \n"), GetLastError());
+
+ //
+ // Indicate error.
+ //
+
+ return FALSE;
+ }
+
+ //
+ // Mark the service for deletion from the service control manager database.
+ //
+
+ if (DeleteService(schService)) {
+
+ //
+ // Indicate success.
+ //
+
+ rCode = TRUE;
+
+ } else {
+
+ _tprintf(_T("DeleteService failed! Error = %d \n"), GetLastError());
+
+ //
+ // Indicate failure. Fall through to properly close the service handle.
+ //
+
+ rCode = FALSE;
+ }
+
+ //
+ // Close the service object.
+ //
+
+ if (schService) {
+
+ CloseServiceHandle(schService);
+ }
+
+ return rCode;
+
+} // RemoveDriver
+
+
+
+BOOLEAN
+StartDriver(
+ IN SC_HANDLE SchSCManager,
+ IN LPCTSTR DriverName
+ )
+{
+ SC_HANDLE schService;
+ DWORD err;
+
+ //
+ // Open the handle to the existing service.
+ //
+
+ schService = OpenService(SchSCManager,
+ DriverName,
+ SERVICE_ALL_ACCESS
+ );
+
+ if (schService == NULL) {
+
+ _tprintf(_T("OpenService failed! Error = %d \n"), GetLastError());
+
+ //
+ // Indicate failure.
+ //
+
+ return FALSE;
+ }
+
+ //
+ // Start the execution of the service (i.e. start the driver).
+ //
+
+ if (!StartService(schService, // service identifier
+ 0, // number of arguments
+ NULL // pointer to arguments
+ )) {
+
+ err = GetLastError();
+
+ if (err == ERROR_SERVICE_ALREADY_RUNNING) {
+
+ //
+ // Ignore this error.
+ //
+
+ return TRUE;
+
+ } else {
+
+ _tprintf(_T("StartService failure! Error = %d \n"), err );
+
+ //
+ // Indicate failure. Fall through to properly close the service handle.
+ //
+
+ return FALSE;
+ }
+
+ }
+
+ //
+ // Close the service object.
+ //
+
+ if (schService) {
+
+ CloseServiceHandle(schService);
+ }
+
+ return TRUE;
+
+} // StartDriver
+
+
+
+BOOLEAN
+StopDriver(
+ IN SC_HANDLE SchSCManager,
+ IN LPCTSTR DriverName
+ )
+{
+ BOOLEAN rCode = TRUE;
+ SC_HANDLE schService;
+ SERVICE_STATUS serviceStatus;
+
+ //
+ // Open the handle to the existing service.
+ //
+
+ schService = OpenService(SchSCManager,
+ DriverName,
+ SERVICE_ALL_ACCESS
+ );
+
+ if (schService == NULL) {
+
+ _tprintf(_T("OpenService failed! Error = %d \n"), GetLastError());
+
+ return FALSE;
+ }
+
+ //
+ // Request that the service stop.
+ //
+
+ if (ControlService(schService,
+ SERVICE_CONTROL_STOP,
+ &serviceStatus
+ )) {
+
+ //
+ // Indicate success.
+ //
+
+ rCode = TRUE;
+
+ } else {
+
+ _tprintf(_T("ControlService failed! Error = %d \n"), GetLastError() );
+
+ //
+ // Indicate failure. Fall through to properly close the service handle.
+ //
+
+ rCode = FALSE;
+ }
+
+ //
+ // Close the service object.
+ //
+
+ if (schService) {
+
+ CloseServiceHandle (schService);
+ }
+
+ return rCode;
+
+} // StopDriver
+
+
+
+
diff --git a/general/tracing/tracedriver/tracectl/install.h b/general/tracing/tracedriver/tracectl/install.h
new file mode 100644
index 00000000..843a8387
--- /dev/null
+++ b/general/tracing/tracedriver/tracectl/install.h
@@ -0,0 +1,14 @@
+
+#define DRIVER_FUNC_INSTALL 0x01
+#define DRIVER_FUNC_REMOVE 0x02
+#define DRIVER_FUNC_STOP 0x03
+
+#define DRIVER_NAME _T("tracedrv")
+
+BOOLEAN
+ManageDriver(
+ IN LPCTSTR DriverName,
+ IN LPCTSTR ServiceName,
+ IN USHORT Function
+ );
+
diff --git a/general/tracing/tracedriver/tracectl/tracectl.c b/general/tracing/tracedriver/tracectl/tracectl.c
new file mode 100644
index 00000000..f4476946
--- /dev/null
+++ b/general/tracing/tracedriver/tracectl/tracectl.c
@@ -0,0 +1,244 @@
+/*++
+
+Copyright (c) Microsoft Corporation. All rights reserved.
+
+ THIS CODE AND INFORMATION IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY
+ KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE
+ IMPLIED WARRANTIES OF MERCHANTABILITY AND/OR FITNESS FOR A PARTICULAR
+ PURPOSE.
+
+Module Name:
+
+ tracectl.c
+
+Environment:
+
+ User mode Win32 console application
+
+Revision History:
+
+
+--*/
+#define UNICODE
+#define _UNICODE
+#include <windows.h>
+#include <winioctl.h>
+#include <tchar.h>
+#include <stdio.h>
+#include "drvioctl.h"
+#include "install.h"
+#include <conio.h>
+#include <strsafe.h>
+
+#define WAIT_TIME 10
+
+BOOLEAN
+SetupDriverName(
+ _Out_writes_(MAX_PATH)LPTSTR DriverLocation
+ );
+
+int _cdecl main(int argc, LPCTSTR argv[])
+{
+ HANDLE hDevice; // handle to a device, file, or directory
+ DWORD dwError = ERROR_SUCCESS;
+ LPVOID lpFileName = _T("\\\\.\\TraceKmp") ;
+ TCHAR driverLocation[MAX_PATH];
+ DWORD dwOutBuffer[2048];
+ DWORD dwOutBufferCount ;
+ int ch;
+
+ UNREFERENCED_PARAMETER(argc);
+ UNREFERENCED_PARAMETER(argv);
+
+
+ if ((hDevice = CreateFile(
+ lpFileName, // pointer to name of the file
+ 0, // access (read-write) mode
+ 0, // share mode
+ NULL, // pointer to security attributes
+ OPEN_EXISTING, // how to create
+ FILE_ATTRIBUTE_NORMAL, // file attributes
+ NULL // handle to file with attributes to
+ // copy
+ )) == INVALID_HANDLE_VALUE) {
+ dwError = GetLastError();
+
+ if ( dwError != ERROR_FILE_NOT_FOUND ) {
+ _tprintf(_T("CreateFile failed ! error: %d\n"), dwError);
+ return 1;
+ }
+
+ //
+ // Setup full path to driver name
+ //
+
+ if (!SetupDriverName(driverLocation)) {
+
+ return 2;
+
+ }
+
+ //
+ // Install driver
+ //
+
+ if (!ManageDriver(DRIVER_NAME,
+ driverLocation,
+ DRIVER_FUNC_INSTALL
+ )) {
+
+ _tprintf(_T("Unable to install driver. \n"));
+
+ //
+ // Error - remove driver.
+ //
+
+ ManageDriver(DRIVER_NAME,
+ driverLocation,
+ DRIVER_FUNC_REMOVE
+ );
+
+ return 3;
+ }
+
+ if ((hDevice = CreateFile(
+ lpFileName, // pointer to name of the file
+ 0, // access (read-write) mode
+ 0, // share mode
+ NULL, // pointer to security attributes
+ OPEN_EXISTING, // how to create
+ FILE_ATTRIBUTE_NORMAL, // file attributes
+ NULL // handle to file with attributes to
+ // copy
+ )) == INVALID_HANDLE_VALUE) {
+
+ _tprintf(_T("Error: CreateFile failed\n"));
+ return 4;
+ }
+ }
+
+
+
+ _tprintf(_T("\nPress 'q' to exit, any other key to send ioctl...\n"));
+ fflush(stdin);
+ ch = _getche();
+
+ while(tolower(ch) != 'q' )
+ {
+
+ _tprintf(_T("Making TRACEKMP_TRACE_EVENT ioctl to log events\n"));
+ if (DeviceIoControl(
+ hDevice, // handle to a device, file, or directory
+ IOCTL_TRACEKMP_TRACE_EVENT, // control code of operation to perform
+ NULL, // pointer to buffer to supply input data
+ 0, // size, in bytes, of input buffer
+ dwOutBuffer, // pointer to buffer to receive output data
+ 2048, // size, in bytes, of output buffer
+ &dwOutBufferCount, // pointer to variable to receive byte count
+ NULL // pointer to structure for asynchronous operation
+ ) == 0) {
+
+ _tprintf(_T("DeviceIOControl Failed %d\n"),GetLastError());
+ return 5;
+
+ }
+ ch = _getche();
+ }
+
+ if (CloseHandle(hDevice) == 0) {
+
+ _tprintf(_T("CloseHandle Failed %d\n"),GetLastError());
+ return 6;
+
+ }
+
+ //
+ // stop the driver
+ //
+
+ ManageDriver(DRIVER_NAME,
+ driverLocation,
+ DRIVER_FUNC_REMOVE
+ );
+
+ _tprintf(_T("Driver '%s' is removed\n"), DRIVER_NAME);
+
+ return 0;
+}
+
+BOOLEAN
+SetupDriverName(
+ _Out_writes_(MAX_PATH) LPTSTR DriverLocation
+ )
+{
+ HANDLE fileHandle;
+
+ DWORD driverLocLen = 0;
+
+ //
+ // Get the current directory.
+ //
+
+ driverLocLen = GetCurrentDirectory(MAX_PATH,
+ DriverLocation
+ );
+
+ if (!driverLocLen) {
+
+ _tprintf(_T("GetCurrentDirectory failed! Error = %d \n"), GetLastError());
+
+ return FALSE;
+ }
+
+ //
+ // Setup path name to driver file.
+ //
+
+ if (StringCchPrintf(&DriverLocation[_tcslen(DriverLocation)],
+ (MAX_PATH - _tcslen(DriverLocation)),
+ _T("\\%s.sys"),
+ DRIVER_NAME) != S_OK){
+ _tprintf(_T("Failed to generate DriverLocation!, StringCchPrintf Error = %d \n"), GetLastError());
+ return FALSE;
+ }
+
+ //
+ // Insure driver file is in the specified directory.
+ //
+
+ if ((fileHandle = CreateFile(DriverLocation,
+ GENERIC_READ,
+ 0,
+ NULL,
+ OPEN_EXISTING,
+ FILE_ATTRIBUTE_NORMAL,
+ NULL
+ )) == INVALID_HANDLE_VALUE) {
+
+
+ _tprintf(_T("Driver: '%s' is not in the current directory. \n"), DRIVER_NAME);
+
+ //
+ // Indicate failure.
+ //
+
+ return FALSE;
+ }
+
+ //
+ // Close open file handle.
+ //
+
+ if (fileHandle) {
+
+ CloseHandle(fileHandle);
+ }
+
+ //
+ // Indicate success.
+ //
+
+ return TRUE;
+
+
+} // SetupDriverName
diff --git a/general/tracing/tracedriver/tracectl/tracectl.vcxproj b/general/tracing/tracedriver/tracectl/tracectl.vcxproj
new file mode 100644
index 00000000..e1e21430
--- /dev/null
+++ b/general/tracing/tracedriver/tracectl/tracectl.vcxproj
@@ -0,0 +1,152 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project DefaultTargets="Build" ToolsVersion="12.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+ <ItemGroup Label="ProjectConfigurations">
+ <ProjectConfiguration Include="Debug|Win32">
+ <Configuration>Debug</Configuration>
+ <Platform>Win32</Platform>
+ </ProjectConfiguration>
+ <ProjectConfiguration Include="Release|Win32">
+ <Configuration>Release</Configuration>
+ <Platform>Win32</Platform>
+ </ProjectConfiguration>
+ <ProjectConfiguration Include="Debug|x64">
+ <Configuration>Debug</Configuration>
+ <Platform>x64</Platform>
+ </ProjectConfiguration>
+ <ProjectConfiguration Include="Release|x64">
+ <Configuration>Release</Configuration>
+ <Platform>x64</Platform>
+ </ProjectConfiguration>
+ </ItemGroup>
+ <PropertyGroup Label="Globals">
+ <ProjectGuid>{72739B3A-9B9B-41EE-9B0E-E73482470A03}</ProjectGuid>
+ <RootNamespace>$(MSBuildProjectName)</RootNamespace>
+ <Configuration Condition="'$(Configuration)' == ''">Debug</Configuration>
+ <Platform Condition="'$(Platform)' == ''">Win32</Platform>
+ <SampleGuid>{707AFE5D-65EB-4AED-967A-114E753D1037}</SampleGuid>
+ </PropertyGroup>
+ <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
+ <PropertyGroup Label="Configuration" Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+ <TargetVersion>Windows10</TargetVersion>
+ <UseDebugLibraries>False</UseDebugLibraries>
+ <DriverTargetPlatform>Desktop</DriverTargetPlatform>
+ <DriverType />
+ <PlatformToolset>WindowsApplicationForDrivers10.0</PlatformToolset>
+ <ConfigurationType>Application</ConfigurationType>
+ </PropertyGroup>
+ <PropertyGroup Label="Configuration" Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+ <TargetVersion>Windows10</TargetVersion>
+ <UseDebugLibraries>True</UseDebugLibraries>
+ <DriverTargetPlatform>Desktop</DriverTargetPlatform>
+ <DriverType />
+ <PlatformToolset>WindowsApplicationForDrivers10.0</PlatformToolset>
+ <ConfigurationType>Application</ConfigurationType>
+ </PropertyGroup>
+ <PropertyGroup Label="Configuration" Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+ <TargetVersion>Windows10</TargetVersion>
+ <UseDebugLibraries>False</UseDebugLibraries>
+ <DriverTargetPlatform>Desktop</DriverTargetPlatform>
+ <DriverType />
+ <PlatformToolset>WindowsApplicationForDrivers10.0</PlatformToolset>
+ <ConfigurationType>Application</ConfigurationType>
+ </PropertyGroup>
+ <PropertyGroup Label="Configuration" Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+ <TargetVersion>Windows10</TargetVersion>
+ <UseDebugLibraries>True</UseDebugLibraries>
+ <DriverTargetPlatform>Desktop</DriverTargetPlatform>
+ <DriverType />
+ <PlatformToolset>WindowsApplicationForDrivers10.0</PlatformToolset>
+ <ConfigurationType>Application</ConfigurationType>
+ </PropertyGroup>
+ <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
+ <PropertyGroup>
+ <OutDir>$(IntDir)</OutDir>
+ </PropertyGroup>
+ <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+ <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" />
+ </ImportGroup>
+ <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+ <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" />
+ </ImportGroup>
+ <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+ <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" />
+ </ImportGroup>
+ <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+ <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" />
+ </ImportGroup>
+ <ItemGroup Label="WrappedTaskItems" />
+ <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+ <TargetName>tracectl</TargetName>
+ </PropertyGroup>
+ <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+ <TargetName>tracectl</TargetName>
+ </PropertyGroup>
+ <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+ <TargetName>tracectl</TargetName>
+ </PropertyGroup>
+ <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+ <TargetName>tracectl</TargetName>
+ </PropertyGroup>
+ <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+ <ResourceCompile>
+ <AdditionalIncludeDirectories>%(AdditionalIncludeDirectories);.;..\tracedrv</AdditionalIncludeDirectories>
+ </ResourceCompile>
+ <ClCompile>
+ <AdditionalIncludeDirectories>%(AdditionalIncludeDirectories);.;..\tracedrv</AdditionalIncludeDirectories>
+ </ClCompile>
+ <Midl>
+ <AdditionalIncludeDirectories>%(AdditionalIncludeDirectories);.;..\tracedrv</AdditionalIncludeDirectories>
+ </Midl>
+ </ItemDefinitionGroup>
+ <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+ <ResourceCompile>
+ <AdditionalIncludeDirectories>%(AdditionalIncludeDirectories);.;..\tracedrv</AdditionalIncludeDirectories>
+ </ResourceCompile>
+ <ClCompile>
+ <AdditionalIncludeDirectories>%(AdditionalIncludeDirectories);.;..\tracedrv</AdditionalIncludeDirectories>
+ </ClCompile>
+ <Midl>
+ <AdditionalIncludeDirectories>%(AdditionalIncludeDirectories);.;..\tracedrv</AdditionalIncludeDirectories>
+ </Midl>
+ </ItemDefinitionGroup>
+ <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+ <ResourceCompile>
+ <AdditionalIncludeDirectories>%(AdditionalIncludeDirectories);.;..\tracedrv</AdditionalIncludeDirectories>
+ </ResourceCompile>
+ <ClCompile>
+ <AdditionalIncludeDirectories>%(AdditionalIncludeDirectories);.;..\tracedrv</AdditionalIncludeDirectories>
+ </ClCompile>
+ <Midl>
+ <AdditionalIncludeDirectories>%(AdditionalIncludeDirectories);.;..\tracedrv</AdditionalIncludeDirectories>
+ </Midl>
+ </ItemDefinitionGroup>
+ <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+ <ResourceCompile>
+ <AdditionalIncludeDirectories>%(AdditionalIncludeDirectories);.;..\tracedrv</AdditionalIncludeDirectories>
+ </ResourceCompile>
+ <ClCompile>
+ <AdditionalIncludeDirectories>%(AdditionalIncludeDirectories);.;..\tracedrv</AdditionalIncludeDirectories>
+ </ClCompile>
+ <Midl>
+ <AdditionalIncludeDirectories>%(AdditionalIncludeDirectories);.;..\tracedrv</AdditionalIncludeDirectories>
+ </Midl>
+ </ItemDefinitionGroup>
+ <ItemGroup>
+ <ClCompile Include="install.c" />
+ <ClCompile Include="tracectl.c" />
+ </ItemGroup>
+ <ItemGroup>
+ <Inf Exclude="@(Inf)" Include="*.inf" />
+ <FilesToPackage Include="$(TargetPath)" Condition="'$(ConfigurationType)'=='Driver' or '$(ConfigurationType)'=='DynamicLibrary'" />
+ <FilesToPackage Include="@(Inf->'%(CopyOutput)')" Condition="'@(Inf)'!=''" />
+ </ItemGroup>
+ <ItemGroup>
+ <None Exclude="@(None)" Include="*.txt;*.htm;*.html" />
+ <None Exclude="@(None)" Include="*.ico;*.cur;*.bmp;*.dlg;*.rct;*.gif;*.jpg;*.jpeg;*.wav;*.jpe;*.tiff;*.tif;*.png;*.rc2" />
+ <None Exclude="@(None)" Include="*.def;*.bat;*.hpj;*.asmx" />
+ </ItemGroup>
+ <ItemGroup>
+ <ClInclude Exclude="@(ClInclude)" Include="*.h;*.hpp;*.hxx;*.hm;*.inl;*.xsd" />
+ </ItemGroup>
+ <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
+</Project> \ No newline at end of file
diff --git a/general/tracing/tracedriver/tracectl/tracectl.vcxproj.Filters b/general/tracing/tracedriver/tracectl/tracectl.vcxproj.Filters
new file mode 100644
index 00000000..49a76abb
--- /dev/null
+++ b/general/tracing/tracedriver/tracectl/tracectl.vcxproj.Filters
@@ -0,0 +1,25 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+ <ItemGroup>
+ <Filter Include="Source Files">
+ <Extensions>cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx;*</Extensions>
+ <UniqueIdentifier>{162117FB-9571-483E-8BDC-60E6A31AD53D}</UniqueIdentifier>
+ </Filter>
+ <Filter Include="Header Files">
+ <Extensions>h;hpp;hxx;hm;inl;inc;xsd</Extensions>
+ <UniqueIdentifier>{ECB2DAEF-8542-46F3-84A4-AB8FC5EDC817}</UniqueIdentifier>
+ </Filter>
+ <Filter Include="Resource Files">
+ <Extensions>rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms;man;xml</Extensions>
+ <UniqueIdentifier>{CD34668D-32E2-4A6E-8DC5-7CCC09E3FC35}</UniqueIdentifier>
+ </Filter>
+ </ItemGroup>
+ <ItemGroup>
+ <ClCompile Include="install.c">
+ <Filter>Source Files</Filter>
+ </ClCompile>
+ <ClCompile Include="tracectl.c">
+ <Filter>Source Files</Filter>
+ </ClCompile>
+ </ItemGroup>
+</Project> \ No newline at end of file
diff --git a/general/tracing/tracedriver/tracedrv.sln b/general/tracing/tracedriver/tracedrv.sln
new file mode 100644
index 00000000..b75b8638
--- /dev/null
+++ b/general/tracing/tracedriver/tracedrv.sln
@@ -0,0 +1,46 @@
+
+Microsoft Visual Studio Solution File, Format Version 12.00
+# Visual Studio 2013
+VisualStudioVersion = 12.0
+MinimumVisualStudioVersion = 12.0
+Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "Tracectl", "Tracectl", "{F3C08B55-33D7-458F-BE79-6878512FF1B1}"
+EndProject
+Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "Tracedrv", "Tracedrv", "{93C02447-AFF7-40E8-AED1-849588063150}"
+EndProject
+Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "tracectl", "tracectl\tracectl.vcxproj", "{72739B3A-9B9B-41EE-9B0E-E73482470A03}"
+EndProject
+Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "tracedrv", "tracedrv\tracedrv.vcxproj", "{959FDB65-EF62-4ED3-8856-326B5AD4BB41}"
+EndProject
+Global
+ GlobalSection(SolutionConfigurationPlatforms) = preSolution
+ Debug|Win32 = Debug|Win32
+ Release|Win32 = Release|Win32
+ Debug|x64 = Debug|x64
+ Release|x64 = Release|x64
+ EndGlobalSection
+ GlobalSection(ProjectConfigurationPlatforms) = postSolution
+ {72739B3A-9B9B-41EE-9B0E-E73482470A03}.Debug|Win32.ActiveCfg = Debug|Win32
+ {72739B3A-9B9B-41EE-9B0E-E73482470A03}.Debug|Win32.Build.0 = Debug|Win32
+ {72739B3A-9B9B-41EE-9B0E-E73482470A03}.Release|Win32.ActiveCfg = Release|Win32
+ {72739B3A-9B9B-41EE-9B0E-E73482470A03}.Release|Win32.Build.0 = Release|Win32
+ {72739B3A-9B9B-41EE-9B0E-E73482470A03}.Debug|x64.ActiveCfg = Debug|x64
+ {72739B3A-9B9B-41EE-9B0E-E73482470A03}.Debug|x64.Build.0 = Debug|x64
+ {72739B3A-9B9B-41EE-9B0E-E73482470A03}.Release|x64.ActiveCfg = Release|x64
+ {72739B3A-9B9B-41EE-9B0E-E73482470A03}.Release|x64.Build.0 = Release|x64
+ {959FDB65-EF62-4ED3-8856-326B5AD4BB41}.Debug|Win32.ActiveCfg = Debug|Win32
+ {959FDB65-EF62-4ED3-8856-326B5AD4BB41}.Debug|Win32.Build.0 = Debug|Win32
+ {959FDB65-EF62-4ED3-8856-326B5AD4BB41}.Release|Win32.ActiveCfg = Release|Win32
+ {959FDB65-EF62-4ED3-8856-326B5AD4BB41}.Release|Win32.Build.0 = Release|Win32
+ {959FDB65-EF62-4ED3-8856-326B5AD4BB41}.Debug|x64.ActiveCfg = Debug|x64
+ {959FDB65-EF62-4ED3-8856-326B5AD4BB41}.Debug|x64.Build.0 = Debug|x64
+ {959FDB65-EF62-4ED3-8856-326B5AD4BB41}.Release|x64.ActiveCfg = Release|x64
+ {959FDB65-EF62-4ED3-8856-326B5AD4BB41}.Release|x64.Build.0 = Release|x64
+ EndGlobalSection
+ GlobalSection(SolutionProperties) = preSolution
+ HideSolutionNode = FALSE
+ EndGlobalSection
+ GlobalSection(NestedProjects) = preSolution
+ {72739B3A-9B9B-41EE-9B0E-E73482470A03} = {F3C08B55-33D7-458F-BE79-6878512FF1B1}
+ {959FDB65-EF62-4ED3-8856-326B5AD4BB41} = {93C02447-AFF7-40E8-AED1-849588063150}
+ EndGlobalSection
+EndGlobal
diff --git a/general/tracing/tracedriver/tracedrv/drvioctl.h b/general/tracing/tracedriver/tracedrv/drvioctl.h
new file mode 100644
index 00000000..d4b84cdf
--- /dev/null
+++ b/general/tracing/tracedriver/tracedrv/drvioctl.h
@@ -0,0 +1,34 @@
+/*++
+
+Copyright (c) Microsoft Corporation. All rights reserved.
+
+ THIS CODE AND INFORMATION IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY
+ KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE
+ IMPLIED WARRANTIES OF MERCHANTABILITY AND/OR FITNESS FOR A PARTICULAR
+ PURPOSE.
+
+
+Module Name:
+
+ drvioctl.h
+
+Abstract:
+
+ Definitions of IOCTL codes and data structures exported by TRACEDRV.
+
+
+--*/
+
+#ifndef __TRACEKMP_IOCTL__
+#define __TRACEKMP_IOCTL__
+
+//
+// IOCTL control codes
+//
+#define IOCTL_TRACEKMP_TRACE_EVENT \
+ CTL_CODE( FILE_DEVICE_UNKNOWN, 0x801, \
+ METHOD_BUFFERED, FILE_ANY_ACCESS )
+
+#endif // __TRACEKMP_IOCTL__
+
+
diff --git a/general/tracing/tracedriver/tracedrv/tracedrv.c b/general/tracing/tracedriver/tracedrv/tracedrv.c
new file mode 100644
index 00000000..a1606f7b
--- /dev/null
+++ b/general/tracing/tracedriver/tracedrv/tracedrv.c
@@ -0,0 +1,379 @@
+/*++
+
+Copyright (c) Microsoft Corporation. All rights reserved.
+
+ THIS CODE AND INFORMATION IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY
+ KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE
+ IMPLIED WARRANTIES OF MERCHANTABILITY AND/OR FITNESS FOR A PARTICULAR
+ PURPOSE.
+
+
+Module Name:
+
+ tracedrv.c
+
+Abstract:
+
+ Sample kernel mode trace provider/driver.
+
+--*/
+#include <stdio.h>
+#include <ntddk.h>
+#include "drvioctl.h"
+#include "tracedrv.h"
+#include "tracedrv.tmh" // this is the file that will be auto generated
+
+
+DRIVER_UNLOAD TracedrvDriverUnload;
+
+_Dispatch_type_(IRP_MJ_CREATE)
+_Dispatch_type_(IRP_MJ_CLOSE)
+DRIVER_DISPATCH TracedrvDispatchOpenClose;
+
+_Dispatch_type_(IRP_MJ_DEVICE_CONTROL)
+DRIVER_DISPATCH TracedrvDispatchDeviceControl;
+
+VOID
+TraceEventLogger(
+ IN PTRACEHANDLE pLoggerHandle
+ );
+
+
+DRIVER_INITIALIZE DriverEntry;
+NTSTATUS
+DriverEntry(
+ IN PDRIVER_OBJECT DriverObject,
+ IN PUNICODE_STRING RegistryPath
+ );
+
+NTSTATUS
+TracedrvDispatchOpenClose(
+ IN PDEVICE_OBJECT pDO,
+ IN PIRP Irp
+ );
+
+NTSTATUS
+TracedrvDispatchDeviceControl(
+ IN PDEVICE_OBJECT pDO,
+ IN PIRP Irp
+ );
+
+VOID
+TracedrvDriverUnload(
+ IN PDRIVER_OBJECT DriverObject
+ );
+
+
+#ifdef ALLOC_PRAGMA
+ #pragma alloc_text( INIT, DriverEntry )
+ #pragma alloc_text( PAGE, TracedrvDispatchOpenClose )
+ #pragma alloc_text( PAGE, TracedrvDispatchDeviceControl )
+ #pragma alloc_text( PAGE, TracedrvDriverUnload )
+#endif // ALLOC_PRAGMA
+
+
+#define MAXEVENTS 3
+
+
+NTSTATUS
+DriverEntry(
+ IN PDRIVER_OBJECT DriverObject,
+ IN PUNICODE_STRING RegistryPath
+ )
+/*++
+
+Routine Description:
+
+ Installable driver initialization entry point.
+ This entry point is called directly by the I/O system.
+
+Arguments:
+ DriverObject - pointer to the driver object
+ RegistryPath - pointer to a unicode string representing the path
+ to driver-specific key in the registry
+
+Return Value:
+
+ STATUS_SUCCESS if successful
+ STATUS_UNSUCCESSFUL otherwise
+
+--*/
+{
+ NTSTATUS status = STATUS_SUCCESS;
+ UNICODE_STRING deviceName;
+ UNICODE_STRING linkName;
+ PDEVICE_OBJECT pTracedrvDeviceObject;
+
+
+ KdPrint(("TraceDrv: DriverEntry\n"));
+
+ //
+ // Create Dispatch Entry Points.
+ //
+ DriverObject->DriverUnload = TracedrvDriverUnload;
+ DriverObject->MajorFunction[ IRP_MJ_CREATE ] = TracedrvDispatchOpenClose;
+ DriverObject->MajorFunction[ IRP_MJ_CLOSE ] = TracedrvDispatchOpenClose;
+ DriverObject->MajorFunction[ IRP_MJ_DEVICE_CONTROL ] = TracedrvDispatchDeviceControl;
+
+ //
+ // include this macro to support Win2K.
+ //
+ WPP_SYSTEMCONTROL(DriverObject);
+
+
+
+ RtlInitUnicodeString( &deviceName, TRACEDRV_NT_DEVICE_NAME );
+
+ //
+ // Create the Device object
+ //
+ status = IoCreateDevice(
+ DriverObject,
+ 0,
+ &deviceName,
+ FILE_DEVICE_UNKNOWN,
+ 0,
+ FALSE,
+ &pTracedrvDeviceObject);
+
+ if ( !NT_SUCCESS( status )) {
+ return status;
+ }
+
+ RtlInitUnicodeString( &linkName, TRACEDRV_WIN32_DEVICE_NAME );
+ status = IoCreateSymbolicLink( &linkName, &deviceName );
+
+ if ( !NT_SUCCESS( status )) {
+ IoDeleteDevice( pTracedrvDeviceObject );
+ return status;
+ }
+
+
+ //
+ // Choose a buffering mechanism
+ //
+ pTracedrvDeviceObject->Flags |= DO_BUFFERED_IO;
+
+
+ //
+ // This macro is required to initialize software tracing.
+ //
+ // Win2K use the deviceobject as the first argument.
+ //
+ // XP and beyond does not require device object. First argument
+ // is ignored.
+ //
+ WPP_INIT_TRACING(pTracedrvDeviceObject,RegistryPath);
+
+
+ return STATUS_SUCCESS;
+}
+
+NTSTATUS
+TracedrvDispatchOpenClose(
+ IN PDEVICE_OBJECT pDO,
+ IN PIRP Irp
+ )
+/*++
+
+Routine Description:
+
+ Dispatch routine to handle Create/Close IRPs.
+
+Arguments:
+
+ DeviceObject - pointer to a device object.
+
+ Irp - pointer to an I/O Request Packet.
+
+Return Value:
+
+ NT status code
+
+--*/
+{
+
+ UNREFERENCED_PARAMETER(pDO);
+
+ Irp->IoStatus.Status = STATUS_SUCCESS;
+ Irp->IoStatus.Information = 0;
+
+ PAGED_CODE();
+
+ IoCompleteRequest( Irp, IO_NO_INCREMENT );
+ return STATUS_SUCCESS;
+}
+
+
+NTSTATUS
+TracedrvDispatchDeviceControl(
+ IN PDEVICE_OBJECT pDO,
+ IN PIRP Irp
+ )
+/*++
+
+Routine Description:
+
+ Dispatch routine to handle IOCTL IRPs.
+
+Arguments:
+
+ DeviceObject - pointer to a device object.
+
+ Irp - pointer to an I/O Request Packet.
+
+Return Value:
+
+ NT status code
+
+--*/
+{
+ NTSTATUS status = STATUS_SUCCESS;
+ PIO_STACK_LOCATION irpStack = IoGetCurrentIrpStackLocation( Irp );
+ ULONG ControlCode = irpStack->Parameters.DeviceIoControl.IoControlCode;
+ ULONG i=0;
+ static ULONG ioctlCount = 0;
+ MachineState CurrentState = Offline;
+
+
+ PAGED_CODE();
+ UNREFERENCED_PARAMETER(pDO);
+
+ Irp->IoStatus.Information =
+ irpStack->Parameters.DeviceIoControl.OutputBufferLength;
+
+ switch ( ControlCode ) {
+ case IOCTL_TRACEKMP_TRACE_EVENT:
+ //
+ // Every time we get this IOCTL, we also log a trace Message if
+ // Trace flag one is enabled. This is used
+ // to illustrate that the event can be caused by user-mode.
+ //
+
+ ioctlCount++;
+
+ //
+ // Log a simple Message
+ //
+
+ DoTraceMessage(FLAG_ONE, "IOCTL = %d", ioctlCount);
+
+ while (i++ < MAXEVENTS) {
+ //
+ // Trace events in a loop.
+ //
+ DoTraceMessage(FLAG_ONE, "Hello, %d %s", i, "Hi" );
+
+ if ( !(i%MAXEVENTS)){
+ //
+ // Trace if level >=2 and 2 bit set by -level 2 -flags 2 in tracelog
+ // Uses the format string for the defined enum MachineState in the
+ // scanned header file
+ //
+ DoTraceLevelMessage(
+ TRACE_LEVEL_ERROR, // ETW Level defined in evntrace.h
+ FLAG_TWO, // Flag defined in WPP_CONTROL_GUIDS
+ "Machine State :: %!state!",
+ CurrentState // enum parameter
+ );
+ }
+ }
+
+ //
+ // Set a fake error status to fire the TRACE_RETURN macro below
+ //
+ status = STATUS_DEVICE_POWERED_OFF;
+
+ Irp->IoStatus.Information = 0;
+ break;
+
+ //
+ // Not one we recognize. Error.
+ //
+ default:
+ status = STATUS_INVALID_PARAMETER;
+ Irp->IoStatus.Information = 0;
+ break;
+ }
+
+ //
+ // Trace the return status using the TRACE_RETURN macro wich includes PRE/POST
+ // macros. The value could be either the fake error or invalid parameter
+ //
+ TRACE_RETURN(status);
+
+ if (status != STATUS_INVALID_PARAMETER) {
+ //
+ // Set the status back to success
+ //
+ status = STATUS_SUCCESS;
+ }
+
+ //
+ // Get rid of this request
+ //
+ Irp->IoStatus.Status = status;
+ IoCompleteRequest( Irp, IO_NO_INCREMENT );
+
+ return status;
+}
+
+
+VOID
+TracedrvDriverUnload(
+ IN PDRIVER_OBJECT DriverObject
+ )
+/*++
+
+Routine Description:
+
+ Free all the resources allocated in DriverEntry.
+
+Arguments:
+
+ DriverObject - pointer to a driver object.
+
+Return Value:
+
+ VOID.
+
+--*/
+{
+ PDEVICE_OBJECT pDevObj;
+ UNICODE_STRING linkName;
+
+
+ PAGED_CODE();
+
+ KdPrint(("TraceDrv: Unloading \n"));
+
+ //
+ // Get pointer to Device object
+ //
+ pDevObj = DriverObject->DeviceObject;
+
+ //
+ // Cleanup using DeviceObject on Win2K. Make sure
+ // this is same deviceobject that used for initializing.
+ // On XP the Parameter is ignored
+ WPP_CLEANUP(pDevObj);
+
+ //
+ // Form the Win32 symbolic link name.
+ //
+ RtlInitUnicodeString( &linkName, TRACEDRV_WIN32_DEVICE_NAME );
+
+ //
+ // Remove symbolic link from Object
+ // namespace...
+ //
+ IoDeleteSymbolicLink( &linkName );
+
+ //
+ // Unload the callbacks from the kernel to this driver
+ //
+ IoDeleteDevice( pDevObj );
+
+}
+
+
diff --git a/general/tracing/tracedriver/tracedrv/tracedrv.ctl b/general/tracing/tracedriver/tracedrv/tracedrv.ctl
new file mode 100644
index 00000000..c5ff6bef
--- /dev/null
+++ b/general/tracing/tracedriver/tracedrv/tracedrv.ctl
@@ -0,0 +1 @@
+d58c126f-b309-11d1-969e-0000f875a5bc CtlGuid \ No newline at end of file
diff --git a/general/tracing/tracedriver/tracedrv/tracedrv.h b/general/tracing/tracedriver/tracedrv/tracedrv.h
new file mode 100644
index 00000000..1b86834a
--- /dev/null
+++ b/general/tracing/tracedriver/tracedrv/tracedrv.h
@@ -0,0 +1,113 @@
+/*++
+
+Copyright (c) Microsoft Corporation. All rights reserved.
+
+ THIS CODE AND INFORMATION IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY
+ KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE
+ IMPLIED WARRANTIES OF MERCHANTABILITY AND/OR FITNESS FOR A PARTICULAR
+ PURPOSE.
+
+Module Name:
+
+ tracedrv.h
+
+Abstract:
+
+ tracedrv.h defines:
+ - The provider GUID for the driver.
+ - Macros for tracing with levels and flags
+ - Tracing enumerations using custom type
+ - Trace macro that incorporates PRE/POST macros
+
+Environment:
+
+ Kernel mode
+
+--*/
+
+
+#define TRACEDRV_NT_DEVICE_NAME L"\\Device\\TraceKmp"
+#define TRACEDRV_WIN32_DEVICE_NAME L"\\DosDevices\\TRACEKMP"
+
+//
+// Software Tracing Definitions
+//
+
+#define WPP_CONTROL_GUIDS \
+ WPP_DEFINE_CONTROL_GUID(CtlGuid,(d58c126f, b309, 11d1, 969e, 0000f875a5bc), \
+ WPP_DEFINE_BIT(FLAG_ONE) \
+ WPP_DEFINE_BIT(FLAG_TWO) )
+
+//
+// DoTraceLevelMessage is a custom macro that adds support for levels to the
+// default DoTraceMessage, which supports only flags. In this version, both
+// flags and level are conditions for generating the trace message.
+// The preprocessor is told to recognize the function by using the -func argument
+// in the RUN_WPP line on the source file. In the source file you will find
+// -func:DoTraceLevelMessage(LEVEL,FLAGS,MSG,...). The conditions for triggering
+// this event in the macro are the Levels defined in evntrace.h and the flags
+// defined above and are evaluated by the macro WPP_LEVEL_FLAGS_ENABLED below.
+//
+#define WPP_LEVEL_FLAGS_LOGGER(level,flags) WPP_LEVEL_LOGGER(flags)
+#define WPP_LEVEL_FLAGS_ENABLED(level, flags) (WPP_LEVEL_ENABLED(flags) && WPP_CONTROL(WPP_BIT_ ## flags).Level >= level)
+
+typedef enum _MachineState {
+ Offline = 2,
+ Online = 1,
+ Failed = 0xFF000001,
+ Stalled = 0xFF000002
+} MachineState;
+//
+// Configuration block to scan the enumeration definition MachineState. Used when
+// viewing the trace to display names instead of the integer values that users must decode
+//
+// begin_wpp config
+// CUSTOM_TYPE(state, ItemEnum(_MachineState));
+// end_wpp
+
+
+// MACRO: TRACE_RETURN
+// Configuration block that defines trace macro. It uses the PRE/POST macros to include
+// code as part of the trace macro expansion. TRACE_MACRO is equivalent to the code below:
+//
+// {if (Status != STATUS_SUCCESS){ // This is the code in the PRE macro
+// DoTraceMessage(FLAG_ONE, "Function Return = %!STATUS!", Status)
+// ;}} // This is the code in the POST macro
+//
+//
+// USEPREFIX statement: Defines a format string prefix to be used when logging the event,
+// below the STDPREFIX is used. The first value is the trace function name with out parenthesis
+// and the second value is the format string to be used.
+//
+// USESUFFIX statement: Defines a suffix format string that gets logged with the event.
+//
+// FUNC statement: Defines the name and signature of the trace function. The function defined
+// below takes one argument, no format string, and predefines the flag equal to FLAG_ONE.
+//
+//
+//begin_wpp config
+//USEPREFIX (TRACE_RETURN, "%!STDPREFIX!");
+//FUNC TRACE_RETURN{FLAG=FLAG_ONE}(EXP);
+//USESUFFIX (TRACE_RETURN, "Function Return=%!STATUS!",EXP);
+//end_wpp
+
+//
+// PRE macro: The name of the macro includes the condition arguments FLAGS and EXP
+// define in FUNC above
+//
+#define WPP_FLAG_EXP_PRE(FLAGS, HR) {if (HR != STATUS_SUCCESS) {
+
+//
+// POST macro
+// The name of the macro includes the condition arguments FLAGS and EXP
+// define in FUNC above
+#define WPP_FLAG_EXP_POST(FLAGS, HR) ;}}
+
+//
+// The two macros below are for checking if the event should be logged and for
+// choosing the logger handle to use when calling the ETW trace API
+//
+#define WPP_FLAG_EXP_ENABLED(FLAGS, HR) WPP_FLAG_ENABLED(FLAGS)
+#define WPP_FLAG_EXP_LOGGER(FLAGS, HR) WPP_FLAG_LOGGER(FLAGS)
+
+
diff --git a/general/tracing/tracedriver/tracedrv/tracedrv.rc b/general/tracing/tracedriver/tracedrv/tracedrv.rc
new file mode 100644
index 00000000..88c83ddc
--- /dev/null
+++ b/general/tracing/tracedriver/tracedrv/tracedrv.rc
@@ -0,0 +1,28 @@
+/*++
+
+Copyright (c) Microsoft Corporation. All rights reserved.
+
+ THIS CODE AND INFORMATION IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY
+ KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE
+ IMPLIED WARRANTIES OF MERCHANTABILITY AND/OR FITNESS FOR A PARTICULAR
+ PURPOSE.
+
+
+Module Name:
+
+ tracedrv.rc
+
+--*/
+
+#include <windows.h>
+#include <ntverp.h>
+#define VER_FILETYPE VFT_DRV
+#define VER_FILESUBTYPE VFT2_DRV_SYSTEM
+#define VER_FILEDESCRIPTION_STR "Trace Kernel Mode Driver"
+#define VER_INTERNALNAME_STR "tracedrv.sys"
+#define VER_ORIGINALFILENAME_STR "tracedrv.sys"
+
+#include "common.ver"
+
+LANGUAGE LANG_ENGLISH, SUBLANG_NEUTRAL
+
diff --git a/general/tracing/tracedriver/tracedrv/tracedrv.vcxproj b/general/tracing/tracedriver/tracedrv/tracedrv.vcxproj
new file mode 100644
index 00000000..febcbdd7
--- /dev/null
+++ b/general/tracing/tracedriver/tracedrv/tracedrv.vcxproj
@@ -0,0 +1,164 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project DefaultTargets="Build" ToolsVersion="12.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+ <ItemGroup Label="ProjectConfigurations">
+ <ProjectConfiguration Include="Debug|Win32">
+ <Configuration>Debug</Configuration>
+ <Platform>Win32</Platform>
+ </ProjectConfiguration>
+ <ProjectConfiguration Include="Release|Win32">
+ <Configuration>Release</Configuration>
+ <Platform>Win32</Platform>
+ </ProjectConfiguration>
+ <ProjectConfiguration Include="Debug|x64">
+ <Configuration>Debug</Configuration>
+ <Platform>x64</Platform>
+ </ProjectConfiguration>
+ <ProjectConfiguration Include="Release|x64">
+ <Configuration>Release</Configuration>
+ <Platform>x64</Platform>
+ </ProjectConfiguration>
+ </ItemGroup>
+ <PropertyGroup Label="Globals">
+ <ProjectGuid>{959FDB65-EF62-4ED3-8856-326B5AD4BB41}</ProjectGuid>
+ <RootNamespace>$(MSBuildProjectName)</RootNamespace>
+ <Configuration Condition="'$(Configuration)' == ''">Debug</Configuration>
+ <Platform Condition="'$(Platform)' == ''">Win32</Platform>
+ <SampleGuid>{01308CF4-AB44-4626-BACF-D0555BC457DF}</SampleGuid>
+ </PropertyGroup>
+ <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
+ <PropertyGroup Label="Configuration" Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+ <TargetVersion>Windows10</TargetVersion>
+ <UseDebugLibraries>False</UseDebugLibraries>
+ <DriverTargetPlatform>Desktop</DriverTargetPlatform>
+ <DriverType>WDM</DriverType>
+ <PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
+ <ConfigurationType>Driver</ConfigurationType>
+ </PropertyGroup>
+ <PropertyGroup Label="Configuration" Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+ <TargetVersion>Windows10</TargetVersion>
+ <UseDebugLibraries>True</UseDebugLibraries>
+ <DriverTargetPlatform>Desktop</DriverTargetPlatform>
+ <DriverType>WDM</DriverType>
+ <PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
+ <ConfigurationType>Driver</ConfigurationType>
+ </PropertyGroup>
+ <PropertyGroup Label="Configuration" Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+ <TargetVersion>Windows10</TargetVersion>
+ <UseDebugLibraries>False</UseDebugLibraries>
+ <DriverTargetPlatform>Desktop</DriverTargetPlatform>
+ <DriverType>WDM</DriverType>
+ <PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
+ <ConfigurationType>Driver</ConfigurationType>
+ </PropertyGroup>
+ <PropertyGroup Label="Configuration" Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+ <TargetVersion>Windows10</TargetVersion>
+ <UseDebugLibraries>True</UseDebugLibraries>
+ <DriverTargetPlatform>Desktop</DriverTargetPlatform>
+ <DriverType>WDM</DriverType>
+ <PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
+ <ConfigurationType>Driver</ConfigurationType>
+ </PropertyGroup>
+ <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
+ <PropertyGroup>
+ <OutDir>$(IntDir)</OutDir>
+ </PropertyGroup>
+ <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+ <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" />
+ </ImportGroup>
+ <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+ <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" />
+ </ImportGroup>
+ <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+ <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" />
+ </ImportGroup>
+ <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+ <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" />
+ </ImportGroup>
+ <ItemGroup Label="WrappedTaskItems">
+ <ClCompile Include="tracedrv.c">
+ <WppEnabled>true</WppEnabled>
+ <WppKernelMode>true</WppKernelMode>
+ <WppTraceFunction>DoTraceLevelMessage(LEVEL,FLAGS,MSG,...)</WppTraceFunction>
+ <WppScanConfigurationData>tracedrv.h</WppScanConfigurationData>
+ </ClCompile>
+ <OtherWpp Include="tracedrv.rc">
+ <WppEnabled>true</WppEnabled>
+ <WppKernelMode>true</WppKernelMode>
+ <WppTraceFunction>DoTraceLevelMessage(LEVEL,FLAGS,MSG,...)</WppTraceFunction>
+ <WppScanConfigurationData>tracedrv.h</WppScanConfigurationData>
+ </OtherWpp>
+ </ItemGroup>
+ <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+ <TargetName>tracedrv</TargetName>
+ </PropertyGroup>
+ <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+ <TargetName>tracedrv</TargetName>
+ </PropertyGroup>
+ <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+ <TargetName>tracedrv</TargetName>
+ </PropertyGroup>
+ <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+ <TargetName>tracedrv</TargetName>
+ </PropertyGroup>
+ <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+ <ResourceCompile>
+ <AdditionalIncludeDirectories>%(AdditionalIncludeDirectories);.</AdditionalIncludeDirectories>
+ </ResourceCompile>
+ <ClCompile>
+ <AdditionalIncludeDirectories>%(AdditionalIncludeDirectories);.</AdditionalIncludeDirectories>
+ </ClCompile>
+ <Midl>
+ <AdditionalIncludeDirectories>%(AdditionalIncludeDirectories);.</AdditionalIncludeDirectories>
+ </Midl>
+ </ItemDefinitionGroup>
+ <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+ <ResourceCompile>
+ <AdditionalIncludeDirectories>%(AdditionalIncludeDirectories);.</AdditionalIncludeDirectories>
+ </ResourceCompile>
+ <ClCompile>
+ <AdditionalIncludeDirectories>%(AdditionalIncludeDirectories);.</AdditionalIncludeDirectories>
+ </ClCompile>
+ <Midl>
+ <AdditionalIncludeDirectories>%(AdditionalIncludeDirectories);.</AdditionalIncludeDirectories>
+ </Midl>
+ </ItemDefinitionGroup>
+ <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+ <ResourceCompile>
+ <AdditionalIncludeDirectories>%(AdditionalIncludeDirectories);.</AdditionalIncludeDirectories>
+ </ResourceCompile>
+ <ClCompile>
+ <AdditionalIncludeDirectories>%(AdditionalIncludeDirectories);.</AdditionalIncludeDirectories>
+ </ClCompile>
+ <Midl>
+ <AdditionalIncludeDirectories>%(AdditionalIncludeDirectories);.</AdditionalIncludeDirectories>
+ </Midl>
+ </ItemDefinitionGroup>
+ <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+ <ResourceCompile>
+ <AdditionalIncludeDirectories>%(AdditionalIncludeDirectories);.</AdditionalIncludeDirectories>
+ </ResourceCompile>
+ <ClCompile>
+ <AdditionalIncludeDirectories>%(AdditionalIncludeDirectories);.</AdditionalIncludeDirectories>
+ </ClCompile>
+ <Midl>
+ <AdditionalIncludeDirectories>%(AdditionalIncludeDirectories);.</AdditionalIncludeDirectories>
+ </Midl>
+ </ItemDefinitionGroup>
+ <ItemGroup>
+ <ResourceCompile Include="tracedrv.rc" />
+ </ItemGroup>
+ <ItemGroup>
+ <Inf Exclude="@(Inf)" Include="*.inf" />
+ <FilesToPackage Include="$(TargetPath)" Condition="'$(ConfigurationType)'=='Driver' or '$(ConfigurationType)'=='DynamicLibrary'" />
+ <FilesToPackage Include="@(Inf->'%(CopyOutput)')" Condition="'@(Inf)'!=''" />
+ </ItemGroup>
+ <ItemGroup>
+ <None Exclude="@(None)" Include="*.txt;*.htm;*.html" />
+ <None Exclude="@(None)" Include="*.ico;*.cur;*.bmp;*.dlg;*.rct;*.gif;*.jpg;*.jpeg;*.wav;*.jpe;*.tiff;*.tif;*.png;*.rc2" />
+ <None Exclude="@(None)" Include="*.def;*.bat;*.hpj;*.asmx" />
+ </ItemGroup>
+ <ItemGroup>
+ <ClInclude Exclude="@(ClInclude)" Include="*.h;*.hpp;*.hxx;*.hm;*.inl;*.xsd" />
+ </ItemGroup>
+ <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
+</Project> \ No newline at end of file
diff --git a/general/tracing/tracedriver/tracedrv/tracedrv.vcxproj.Filters b/general/tracing/tracedriver/tracedrv/tracedrv.vcxproj.Filters
new file mode 100644
index 00000000..029e408d
--- /dev/null
+++ b/general/tracing/tracedriver/tracedrv/tracedrv.vcxproj.Filters
@@ -0,0 +1,31 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+ <ItemGroup>
+ <Filter Include="Source Files">
+ <Extensions>cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx;*</Extensions>
+ <UniqueIdentifier>{91F6D41E-6246-46E8-99D5-002ACC23AA49}</UniqueIdentifier>
+ </Filter>
+ <Filter Include="Header Files">
+ <Extensions>h;hpp;hxx;hm;inl;inc;xsd</Extensions>
+ <UniqueIdentifier>{DF6424D7-7A22-42ED-B11F-508DD7CA41CD}</UniqueIdentifier>
+ </Filter>
+ <Filter Include="Resource Files">
+ <Extensions>rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms;man;xml</Extensions>
+ <UniqueIdentifier>{A42F3913-01F8-47A1-B888-182B29B1B137}</UniqueIdentifier>
+ </Filter>
+ <Filter Include="Driver Files">
+ <Extensions>inf;inv;inx;mof;mc;</Extensions>
+ <UniqueIdentifier>{EC7A4F43-C45A-4AAA-97BC-DFDF6C41C75C}</UniqueIdentifier>
+ </Filter>
+ </ItemGroup>
+ <ItemGroup>
+ <ClCompile Include="tracedrv.c">
+ <Filter>Source Files</Filter>
+ </ClCompile>
+ </ItemGroup>
+ <ItemGroup>
+ <ResourceCompile Include="tracedrv.rc">
+ <Filter>Resource Files</Filter>
+ </ResourceCompile>
+ </ItemGroup>
+</Project> \ No newline at end of file
generated by cgit v1.3.1 (git 2.54.0) at 2026-08-30 10:58:22 +0000