ホーム › System.Diagnostics.Etw › EVENT_HEADER

EVENT_HEADER

構造体

サイズx64: 80 バイト / x86: 80 バイト

サイズ=各フィールドのバイト数(x64/x86 で異なる場合は x64/x86 と併記)。x64/x86 列=フィールドのバイトオフセット(HSPで dupptr / lpoke / wpoke 等に使用)。

フィールド

フィールド	型	サイズ	x64	x86	説明
Size	WORD	2	+0	+0	本イベントレコード全体のバイト数。
HeaderType	WORD	2	+2	+2	ヘッダの種類を示す予約フィールド。
Flags	WORD	2	+4	+4	イベントの特性を示すフラグ(EVENT_HEADER_FLAG_*)。
EventProperty	WORD	2	+6	+6	イベントのソース属性を示すフラグ(EVENT_HEADER_PROPERTY_*)。
ThreadId	DWORD	4	+8	+8	イベントを発生させたスレッドのID。
ProcessId	DWORD	4	+12	+12	イベントを発生させたプロセスのID。
TimeStamp	LONGLONG	8	+16	+16	イベント発生時刻のタイムスタンプ。
ProviderId	GUID	16	+24	+24	イベントを発行したプロバイダのGUID。
EventDescriptor	EVENT_DESCRIPTOR	16	+40	+40	イベントを記述するEVENT_DESCRIPTOR。
Anonymous	_Anonymous_e__Union	8	+56	+56	カーネル/ユーザー処理時間またはProcessorTimeを含む共用体。
ActivityId	GUID	16	+64	+64	イベントが属するアクティビティのGUID。

共用体: _Anonymous_e__Union x64 8B / x86 8B

フィールド	型	サイズ	x64	x86	説明
Anonymous	_Anonymous_e__Struct	8/4	+0	+0	カーネル/ユーザー処理時間またはProcessorTimeを含む共用体。
ProcessorTime	ULONGLONG	8	+0	+0

各言語での定義

#include <windows.h>

// EVENT_DESCRIPTOR  (x64 16 / x86 16 バイト)
typedef struct EVENT_DESCRIPTOR {
    WORD Id;
    BYTE Version;
    BYTE Channel;
    BYTE Level;
    BYTE Opcode;
    WORD Task;
    ULONGLONG Keyword;
} EVENT_DESCRIPTOR;

// EVENT_HEADER  (x64 80 / x86 80 バイト)
typedef struct EVENT_HEADER {
    WORD Size;
    WORD HeaderType;
    WORD Flags;
    WORD EventProperty;
    DWORD ThreadId;
    DWORD ProcessId;
    LONGLONG TimeStamp;
    GUID ProviderId;
    EVENT_DESCRIPTOR EventDescriptor;
    _Anonymous_e__Union Anonymous;
    GUID ActivityId;
} EVENT_HEADER;

using System;
using System.Runtime.InteropServices;

[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
public struct EVENT_DESCRIPTOR
{
    public ushort Id;
    public byte Version;
    public byte Channel;
    public byte Level;
    public byte Opcode;
    public ushort Task;
    public ulong Keyword;
}

[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
public struct EVENT_HEADER
{
    public ushort Size;
    public ushort HeaderType;
    public ushort Flags;
    public ushort EventProperty;
    public uint ThreadId;
    public uint ProcessId;
    public long TimeStamp;
    public Guid ProviderId;
    public EVENT_DESCRIPTOR EventDescriptor;
    public _Anonymous_e__Union Anonymous;
    public Guid ActivityId;
}

Imports System.Runtime.InteropServices

<StructLayout(LayoutKind.Sequential, CharSet:=CharSet.Unicode)>
Public Structure EVENT_DESCRIPTOR
    Public Id As UShort
    Public Version As Byte
    Public Channel As Byte
    Public Level As Byte
    Public Opcode As Byte
    Public Task As UShort
    Public Keyword As ULong
End Structure

<StructLayout(LayoutKind.Sequential, CharSet:=CharSet.Unicode)>
Public Structure EVENT_HEADER
    Public Size As UShort
    Public HeaderType As UShort
    Public Flags As UShort
    Public EventProperty As UShort
    Public ThreadId As UInteger
    Public ProcessId As UInteger
    Public TimeStamp As Long
    Public ProviderId As Guid
    Public EventDescriptor As EVENT_DESCRIPTOR
    Public Anonymous As _Anonymous_e__Union
    Public ActivityId As Guid
End Structure

import ctypes
from ctypes import wintypes

class EVENT_DESCRIPTOR(ctypes.Structure):
    _fields_ = [
        ("Id", ctypes.c_ushort),
        ("Version", ctypes.c_ubyte),
        ("Channel", ctypes.c_ubyte),
        ("Level", ctypes.c_ubyte),
        ("Opcode", ctypes.c_ubyte),
        ("Task", ctypes.c_ushort),
        ("Keyword", ctypes.c_ulonglong),
    ]

class EVENT_HEADER(ctypes.Structure):
    _fields_ = [
        ("Size", ctypes.c_ushort),
        ("HeaderType", ctypes.c_ushort),
        ("Flags", ctypes.c_ushort),
        ("EventProperty", ctypes.c_ushort),
        ("ThreadId", wintypes.DWORD),
        ("ProcessId", wintypes.DWORD),
        ("TimeStamp", ctypes.c_longlong),
        ("ProviderId", GUID),
        ("EventDescriptor", EVENT_DESCRIPTOR),
        ("Anonymous", _Anonymous_e__Union),
        ("ActivityId", GUID),
    ]

#[repr(C)]
pub struct EVENT_DESCRIPTOR {
    pub Id: u16,
    pub Version: u8,
    pub Channel: u8,
    pub Level: u8,
    pub Opcode: u8,
    pub Task: u16,
    pub Keyword: u64,
}

#[repr(C)]
pub struct EVENT_HEADER {
    pub Size: u16,
    pub HeaderType: u16,
    pub Flags: u16,
    pub EventProperty: u16,
    pub ThreadId: u32,
    pub ProcessId: u32,
    pub TimeStamp: i64,
    pub ProviderId: GUID,
    pub EventDescriptor: EVENT_DESCRIPTOR,
    pub Anonymous: _Anonymous_e__Union,
    pub ActivityId: GUID,
}

import "golang.org/x/sys/windows"

type EVENT_DESCRIPTOR struct {
	Id uint16
	Version byte
	Channel byte
	Level byte
	Opcode byte
	Task uint16
	Keyword uint64
}

type EVENT_HEADER struct {
	Size uint16
	HeaderType uint16
	Flags uint16
	EventProperty uint16
	ThreadId uint32
	ProcessId uint32
	TimeStamp int64
	ProviderId windows.GUID
	EventDescriptor EVENT_DESCRIPTOR
	Anonymous _Anonymous_e__Union
	ActivityId windows.GUID
}

type
  EVENT_DESCRIPTOR = record
    Id: Word;
    Version: Byte;
    Channel: Byte;
    Level: Byte;
    Opcode: Byte;
    Task: Word;
    Keyword: UInt64;
  end;

  EVENT_HEADER = record
    Size: Word;
    HeaderType: Word;
    Flags: Word;
    EventProperty: Word;
    ThreadId: DWORD;
    ProcessId: DWORD;
    TimeStamp: Int64;
    ProviderId: TGUID;
    EventDescriptor: EVENT_DESCRIPTOR;
    Anonymous: _Anonymous_e__Union;
    ActivityId: TGUID;
  end;

const EVENT_DESCRIPTOR = extern struct {
    Id: u16,
    Version: u8,
    Channel: u8,
    Level: u8,
    Opcode: u8,
    Task: u16,
    Keyword: u64,
};

const EVENT_HEADER = extern struct {
    Size: u16,
    HeaderType: u16,
    Flags: u16,
    EventProperty: u16,
    ThreadId: u32,
    ProcessId: u32,
    TimeStamp: i64,
    ProviderId: GUID,
    EventDescriptor: EVENT_DESCRIPTOR,
    Anonymous: _Anonymous_e__Union,
    ActivityId: GUID,
};

type
  EVENT_DESCRIPTOR {.bycopy.} = object
    Id: uint16
    Version: uint8
    Channel: uint8
    Level: uint8
    Opcode: uint8
    Task: uint16
    Keyword: uint64

  EVENT_HEADER {.bycopy.} = object
    Size: uint16
    HeaderType: uint16
    Flags: uint16
    EventProperty: uint16
    ThreadId: uint32
    ProcessId: uint32
    TimeStamp: int64
    ProviderId: GUID
    EventDescriptor: EVENT_DESCRIPTOR
    Anonymous: _Anonymous_e__Union
    ActivityId: GUID

struct EVENT_DESCRIPTOR
{
    ushort Id;
    ubyte Version;
    ubyte Channel;
    ubyte Level;
    ubyte Opcode;
    ushort Task;
    ulong Keyword;
}

struct EVENT_HEADER
{
    ushort Size;
    ushort HeaderType;
    ushort Flags;
    ushort EventProperty;
    uint ThreadId;
    uint ProcessId;
    long TimeStamp;
    GUID ProviderId;
    EVENT_DESCRIPTOR EventDescriptor;
    _Anonymous_e__Union Anonymous;
    GUID ActivityId;
}

HSP用定義

HSP3.7/3.8 は構造体機能が無いため4byte整数配列(dim)+peek/poke で操作(32/64bitでサイズ・位置が異なる場合はタブで分割)。IronHSP は NSTRUCT(#defstruct/stdim/->)で32/64bit共通。

; HSP3.7/3.8 は構造体機能が無いため、4byte整数の配列変数で操作します。(x64 レイアウト)
; EVENT_HEADER サイズ: 80 バイト(x64)
dim st, 20    ; 4byte整数×20(構造体サイズ 80 / 4 切り上げ)
; Size : WORD (+0, 2byte)  wpoke st,0,値  /  値 = wpeek(st,0)
; HeaderType : WORD (+2, 2byte)  wpoke st,2,値  /  値 = wpeek(st,2)
; Flags : WORD (+4, 2byte)  wpoke st,4,値  /  値 = wpeek(st,4)
; EventProperty : WORD (+6, 2byte)  wpoke st,6,値  /  値 = wpeek(st,6)
; ThreadId : DWORD (+8, 4byte)  st.2 = 値  /  値 = st.2   (lpoke/lpeek も可)
; ProcessId : DWORD (+12, 4byte)  st.3 = 値  /  値 = st.3   (lpoke/lpeek も可)
; TimeStamp : LONGLONG (+16, 8byte)  qpoke st,16,値 / qpeek(st,16)  ※IronHSPのみ。3.7/3.8は lpoke st,16,下位 : lpoke st,20,上位
; ProviderId : GUID (+24, 16byte)  varptr(st)+24 を基点に操作(16byte:入れ子/配列)
; EventDescriptor : EVENT_DESCRIPTOR (+40, 16byte)  varptr(st)+40 を基点に操作(16byte:入れ子/配列)
; Anonymous : _Anonymous_e__Union (+56, 8byte)  varptr(st)+56 を基点に操作(8byte:入れ子/配列)
; ActivityId : GUID (+64, 16byte)  varptr(st)+64 を基点に操作(16byte:入れ子/配列)
; ※4byte境界の整数は添字 st.N(N=オフセット/4)で読み書き可。それ以外は peek/poke 系を使用。

; IronHSP は NSTRUCT(構造体)をサポート。32bit/64bit どちらでも同じコードで動作します。
; ※GUID・入れ子構造体はデフォルト型でないため、依存する #defstruct を先に定義(下記に同梱)。
#defstruct global GUID, pack=1
    #field int Data1
    #field short Data2
    #field short Data3
    #field byte Data4 8
#endstruct

#defstruct global EVENT_DESCRIPTOR
    #field short Id
    #field byte Version
    #field byte Channel
    #field byte Level
    #field byte Opcode
    #field short Task
    #field int64 Keyword
#endstruct

#defstruct global EVENT_HEADER
    #field short Size
    #field short HeaderType
    #field short Flags
    #field short EventProperty
    #field int ThreadId
    #field int ProcessId
    #field int64 TimeStamp
    #field GUID ProviderId
    #field EVENT_DESCRIPTOR EventDescriptor
    #field byte Anonymous 8
    #field GUID ActivityId
#endstruct

stdim st, EVENT_HEADER        ; NSTRUCT 変数を確保
st->Size = 100
mes "Size=" + st->Size
; ※union フィールドは byte 列で確保(NSTRUCT は union 非対応)。必要に応じ手動でアクセス。

EVENT_HEADER

フィールド

共用体: _Anonymous_e__Union x64 8B / x86 8B

各言語での定義

HSP用 定義

HSP用定義