ホーム › System.Diagnostics.Etw › EVENT_RECORD

EVENT_RECORD

構造体

サイズx64: 128 バイト / x86: 104 バイト

サイズ=各フィールドのバイト数(x64/x86 で異なる場合は x64/x86 と併記)。x64/x86 列=フィールドのバイトオフセット(HSPで dupptr / lpoke / wpoke 等に使用)。

フィールド

フィールド	型	サイズ	x64	x86	説明
EventHeader	EVENT_HEADER	80	+0	+0	イベントのメタデータを保持するEVENT_HEADER。
BufferContext	ETW_BUFFER_CONTEXT	16/8	+80	+80	イベントを記録したバッファのコンテキスト(ETW_BUFFER_CONTEXT)。
ExtendedDataCount	WORD	2	+96	+88	ExtendedData配列の拡張データ項目数。
UserDataLength	WORD	2	+98	+90	UserDataが指すイベントデータのバイト数。
ExtendedData	EVENT_HEADER_EXTENDED_DATA_ITEM*	8/4	+104	+92	EVENT_HEADER_EXTENDED_DATA_ITEM配列へのポインタ。
UserData	void*	8/4	+112	+96	イベント固有データ本体へのポインタ。
UserContext	void*	8/4	+120	+100	コールバック登録時に渡したユーザーコンテキスト。NULL可。

各言語での定義

#include <windows.h>

// EVENT_DESCRIPTOR  (x64 16 / x86 16 バイト)
typedef struct EVENT_DESCRIPTOR {
    WORD Id;
    BYTE Version;
    BYTE Channel;
    BYTE Level;
    BYTE Opcode;
    WORD Task;
    ULONGLONG Keyword;
} EVENT_DESCRIPTOR;

// EVENT_HEADER  (x64 80 / x86 80 バイト)
typedef struct EVENT_HEADER {
    WORD Size;
    WORD HeaderType;
    WORD Flags;
    WORD EventProperty;
    DWORD ThreadId;
    DWORD ProcessId;
    LONGLONG TimeStamp;
    GUID ProviderId;
    EVENT_DESCRIPTOR EventDescriptor;
    _Anonymous_e__Union Anonymous;
    GUID ActivityId;
} EVENT_HEADER;

// ETW_BUFFER_CONTEXT  (x64 16 / x86 8 バイト)
typedef struct ETW_BUFFER_CONTEXT {
    _Anonymous_e__Union Anonymous;
    WORD LoggerId;
} ETW_BUFFER_CONTEXT;

// EVENT_RECORD  (x64 128 / x86 104 バイト)
typedef struct EVENT_RECORD {
    EVENT_HEADER EventHeader;
    ETW_BUFFER_CONTEXT BufferContext;
    WORD ExtendedDataCount;
    WORD UserDataLength;
    EVENT_HEADER_EXTENDED_DATA_ITEM* ExtendedData;
    void* UserData;
    void* UserContext;
} EVENT_RECORD;

using System;
using System.Runtime.InteropServices;

[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
public struct EVENT_DESCRIPTOR
{
    public ushort Id;
    public byte Version;
    public byte Channel;
    public byte Level;
    public byte Opcode;
    public ushort Task;
    public ulong Keyword;
}

[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
public struct EVENT_HEADER
{
    public ushort Size;
    public ushort HeaderType;
    public ushort Flags;
    public ushort EventProperty;
    public uint ThreadId;
    public uint ProcessId;
    public long TimeStamp;
    public Guid ProviderId;
    public EVENT_DESCRIPTOR EventDescriptor;
    public _Anonymous_e__Union Anonymous;
    public Guid ActivityId;
}

[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
public struct ETW_BUFFER_CONTEXT
{
    public _Anonymous_e__Union Anonymous;
    public ushort LoggerId;
}

[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
public struct EVENT_RECORD
{
    public EVENT_HEADER EventHeader;
    public ETW_BUFFER_CONTEXT BufferContext;
    public ushort ExtendedDataCount;
    public ushort UserDataLength;
    public IntPtr ExtendedData;
    public IntPtr UserData;
    public IntPtr UserContext;
}

Imports System.Runtime.InteropServices

<StructLayout(LayoutKind.Sequential, CharSet:=CharSet.Unicode)>
Public Structure EVENT_DESCRIPTOR
    Public Id As UShort
    Public Version As Byte
    Public Channel As Byte
    Public Level As Byte
    Public Opcode As Byte
    Public Task As UShort
    Public Keyword As ULong
End Structure

<StructLayout(LayoutKind.Sequential, CharSet:=CharSet.Unicode)>
Public Structure EVENT_HEADER
    Public Size As UShort
    Public HeaderType As UShort
    Public Flags As UShort
    Public EventProperty As UShort
    Public ThreadId As UInteger
    Public ProcessId As UInteger
    Public TimeStamp As Long
    Public ProviderId As Guid
    Public EventDescriptor As EVENT_DESCRIPTOR
    Public Anonymous As _Anonymous_e__Union
    Public ActivityId As Guid
End Structure

<StructLayout(LayoutKind.Sequential, CharSet:=CharSet.Unicode)>
Public Structure ETW_BUFFER_CONTEXT
    Public Anonymous As _Anonymous_e__Union
    Public LoggerId As UShort
End Structure

<StructLayout(LayoutKind.Sequential, CharSet:=CharSet.Unicode)>
Public Structure EVENT_RECORD
    Public EventHeader As EVENT_HEADER
    Public BufferContext As ETW_BUFFER_CONTEXT
    Public ExtendedDataCount As UShort
    Public UserDataLength As UShort
    Public ExtendedData As IntPtr
    Public UserData As IntPtr
    Public UserContext As IntPtr
End Structure

import ctypes
from ctypes import wintypes

class EVENT_DESCRIPTOR(ctypes.Structure):
    _fields_ = [
        ("Id", ctypes.c_ushort),
        ("Version", ctypes.c_ubyte),
        ("Channel", ctypes.c_ubyte),
        ("Level", ctypes.c_ubyte),
        ("Opcode", ctypes.c_ubyte),
        ("Task", ctypes.c_ushort),
        ("Keyword", ctypes.c_ulonglong),
    ]

class EVENT_HEADER(ctypes.Structure):
    _fields_ = [
        ("Size", ctypes.c_ushort),
        ("HeaderType", ctypes.c_ushort),
        ("Flags", ctypes.c_ushort),
        ("EventProperty", ctypes.c_ushort),
        ("ThreadId", wintypes.DWORD),
        ("ProcessId", wintypes.DWORD),
        ("TimeStamp", ctypes.c_longlong),
        ("ProviderId", GUID),
        ("EventDescriptor", EVENT_DESCRIPTOR),
        ("Anonymous", _Anonymous_e__Union),
        ("ActivityId", GUID),
    ]

class ETW_BUFFER_CONTEXT(ctypes.Structure):
    _fields_ = [
        ("Anonymous", _Anonymous_e__Union),
        ("LoggerId", ctypes.c_ushort),
    ]

class EVENT_RECORD(ctypes.Structure):
    _fields_ = [
        ("EventHeader", EVENT_HEADER),
        ("BufferContext", ETW_BUFFER_CONTEXT),
        ("ExtendedDataCount", ctypes.c_ushort),
        ("UserDataLength", ctypes.c_ushort),
        ("ExtendedData", ctypes.c_void_p),
        ("UserData", ctypes.c_void_p),
        ("UserContext", ctypes.c_void_p),
    ]

#[repr(C)]
pub struct EVENT_DESCRIPTOR {
    pub Id: u16,
    pub Version: u8,
    pub Channel: u8,
    pub Level: u8,
    pub Opcode: u8,
    pub Task: u16,
    pub Keyword: u64,
}

#[repr(C)]
pub struct EVENT_HEADER {
    pub Size: u16,
    pub HeaderType: u16,
    pub Flags: u16,
    pub EventProperty: u16,
    pub ThreadId: u32,
    pub ProcessId: u32,
    pub TimeStamp: i64,
    pub ProviderId: GUID,
    pub EventDescriptor: EVENT_DESCRIPTOR,
    pub Anonymous: _Anonymous_e__Union,
    pub ActivityId: GUID,
}

#[repr(C)]
pub struct ETW_BUFFER_CONTEXT {
    pub Anonymous: _Anonymous_e__Union,
    pub LoggerId: u16,
}

#[repr(C)]
pub struct EVENT_RECORD {
    pub EventHeader: EVENT_HEADER,
    pub BufferContext: ETW_BUFFER_CONTEXT,
    pub ExtendedDataCount: u16,
    pub UserDataLength: u16,
    pub ExtendedData: *mut core::ffi::c_void,
    pub UserData: *mut core::ffi::c_void,
    pub UserContext: *mut core::ffi::c_void,
}

import "golang.org/x/sys/windows"

type EVENT_DESCRIPTOR struct {
	Id uint16
	Version byte
	Channel byte
	Level byte
	Opcode byte
	Task uint16
	Keyword uint64
}

type EVENT_HEADER struct {
	Size uint16
	HeaderType uint16
	Flags uint16
	EventProperty uint16
	ThreadId uint32
	ProcessId uint32
	TimeStamp int64
	ProviderId windows.GUID
	EventDescriptor EVENT_DESCRIPTOR
	Anonymous _Anonymous_e__Union
	ActivityId windows.GUID
}

type ETW_BUFFER_CONTEXT struct {
	Anonymous _Anonymous_e__Union
	LoggerId uint16
}

type EVENT_RECORD struct {
	EventHeader EVENT_HEADER
	BufferContext ETW_BUFFER_CONTEXT
	ExtendedDataCount uint16
	UserDataLength uint16
	ExtendedData uintptr
	UserData uintptr
	UserContext uintptr
}

type
  EVENT_DESCRIPTOR = record
    Id: Word;
    Version: Byte;
    Channel: Byte;
    Level: Byte;
    Opcode: Byte;
    Task: Word;
    Keyword: UInt64;
  end;

  EVENT_HEADER = record
    Size: Word;
    HeaderType: Word;
    Flags: Word;
    EventProperty: Word;
    ThreadId: DWORD;
    ProcessId: DWORD;
    TimeStamp: Int64;
    ProviderId: TGUID;
    EventDescriptor: EVENT_DESCRIPTOR;
    Anonymous: _Anonymous_e__Union;
    ActivityId: TGUID;
  end;

  ETW_BUFFER_CONTEXT = record
    Anonymous: _Anonymous_e__Union;
    LoggerId: Word;
  end;

  EVENT_RECORD = record
    EventHeader: EVENT_HEADER;
    BufferContext: ETW_BUFFER_CONTEXT;
    ExtendedDataCount: Word;
    UserDataLength: Word;
    ExtendedData: Pointer;
    UserData: Pointer;
    UserContext: Pointer;
  end;

const EVENT_DESCRIPTOR = extern struct {
    Id: u16,
    Version: u8,
    Channel: u8,
    Level: u8,
    Opcode: u8,
    Task: u16,
    Keyword: u64,
};

const EVENT_HEADER = extern struct {
    Size: u16,
    HeaderType: u16,
    Flags: u16,
    EventProperty: u16,
    ThreadId: u32,
    ProcessId: u32,
    TimeStamp: i64,
    ProviderId: GUID,
    EventDescriptor: EVENT_DESCRIPTOR,
    Anonymous: _Anonymous_e__Union,
    ActivityId: GUID,
};

const ETW_BUFFER_CONTEXT = extern struct {
    Anonymous: _Anonymous_e__Union,
    LoggerId: u16,
};

const EVENT_RECORD = extern struct {
    EventHeader: EVENT_HEADER,
    BufferContext: ETW_BUFFER_CONTEXT,
    ExtendedDataCount: u16,
    UserDataLength: u16,
    ExtendedData: ?*anyopaque,
    UserData: ?*anyopaque,
    UserContext: ?*anyopaque,
};

type
  EVENT_DESCRIPTOR {.bycopy.} = object
    Id: uint16
    Version: uint8
    Channel: uint8
    Level: uint8
    Opcode: uint8
    Task: uint16
    Keyword: uint64

  EVENT_HEADER {.bycopy.} = object
    Size: uint16
    HeaderType: uint16
    Flags: uint16
    EventProperty: uint16
    ThreadId: uint32
    ProcessId: uint32
    TimeStamp: int64
    ProviderId: GUID
    EventDescriptor: EVENT_DESCRIPTOR
    Anonymous: _Anonymous_e__Union
    ActivityId: GUID

  ETW_BUFFER_CONTEXT {.bycopy.} = object
    Anonymous: _Anonymous_e__Union
    LoggerId: uint16

  EVENT_RECORD {.bycopy.} = object
    EventHeader: EVENT_HEADER
    BufferContext: ETW_BUFFER_CONTEXT
    ExtendedDataCount: uint16
    UserDataLength: uint16
    ExtendedData: pointer
    UserData: pointer
    UserContext: pointer

struct EVENT_DESCRIPTOR
{
    ushort Id;
    ubyte Version;
    ubyte Channel;
    ubyte Level;
    ubyte Opcode;
    ushort Task;
    ulong Keyword;
}

struct EVENT_HEADER
{
    ushort Size;
    ushort HeaderType;
    ushort Flags;
    ushort EventProperty;
    uint ThreadId;
    uint ProcessId;
    long TimeStamp;
    GUID ProviderId;
    EVENT_DESCRIPTOR EventDescriptor;
    _Anonymous_e__Union Anonymous;
    GUID ActivityId;
}

struct ETW_BUFFER_CONTEXT
{
    _Anonymous_e__Union Anonymous;
    ushort LoggerId;
}

struct EVENT_RECORD
{
    EVENT_HEADER EventHeader;
    ETW_BUFFER_CONTEXT BufferContext;
    ushort ExtendedDataCount;
    ushort UserDataLength;
    void* ExtendedData;
    void* UserData;
    void* UserContext;
}

HSP用定義

HSP3.7/3.8 は構造体機能が無いため4byte整数配列(dim)+peek/poke で操作(32/64bitでサイズ・位置が異なる場合はタブで分割)。IronHSP は NSTRUCT(#defstruct/stdim/->)で32/64bit共通。

; HSP3.7/3.8 は構造体機能が無いため、4byte整数の配列変数で操作します。(x86 レイアウト)
; EVENT_RECORD サイズ: 104 バイト(x86)
dim st, 26    ; 4byte整数×26(構造体サイズ 104 / 4 切り上げ)
; EventHeader : EVENT_HEADER (+0, 80byte)  varptr(st)+0 を基点に操作(80byte:入れ子/配列)
; BufferContext : ETW_BUFFER_CONTEXT (+80, 8byte)  varptr(st)+80 を基点に操作(8byte:入れ子/配列)
; ExtendedDataCount : WORD (+88, 2byte)  wpoke st,88,値  /  値 = wpeek(st,88)
; UserDataLength : WORD (+90, 2byte)  wpoke st,90,値  /  値 = wpeek(st,90)
; ExtendedData : EVENT_HEADER_EXTENDED_DATA_ITEM* (+92, 4byte)  varptr(st)+92 を基点に操作(4byte:入れ子/配列)
; UserData : void* (+96, 4byte)  st.24 = 値  /  値 = st.24   (lpoke/lpeek も可)
; UserContext : void* (+100, 4byte)  st.25 = 値  /  値 = st.25   (lpoke/lpeek も可)
; ※4byte境界の整数は添字 st.N(N=オフセット/4)で読み書き可。それ以外は peek/poke 系を使用。

; HSP3.7/3.8 は構造体機能が無いため、4byte整数の配列変数で操作します。(x64 レイアウト)
; EVENT_RECORD サイズ: 128 バイト(x64)
dim st, 32    ; 4byte整数×32(構造体サイズ 128 / 4 切り上げ)
; EventHeader : EVENT_HEADER (+0, 80byte)  varptr(st)+0 を基点に操作(80byte:入れ子/配列)
; BufferContext : ETW_BUFFER_CONTEXT (+80, 16byte)  varptr(st)+80 を基点に操作(16byte:入れ子/配列)
; ExtendedDataCount : WORD (+96, 2byte)  wpoke st,96,値  /  値 = wpeek(st,96)
; UserDataLength : WORD (+98, 2byte)  wpoke st,98,値  /  値 = wpeek(st,98)
; ExtendedData : EVENT_HEADER_EXTENDED_DATA_ITEM* (+104, 8byte)  varptr(st)+104 を基点に操作(8byte:入れ子/配列)
; UserData : void* (+112, 8byte)  qpoke st,112,値 / qpeek(st,112)  ※IronHSPのみ。3.7/3.8は lpoke st,112,下位 : lpoke st,116,上位
; UserContext : void* (+120, 8byte)  qpoke st,120,値 / qpeek(st,120)  ※IronHSPのみ。3.7/3.8は lpoke st,120,下位 : lpoke st,124,上位
; ※4byte境界の整数は添字 st.N(N=オフセット/4)で読み書き可。それ以外は peek/poke 系を使用。

; IronHSP は NSTRUCT(構造体)をサポート。32bit/64bit どちらでも同じコードで動作します。
; ※GUID・入れ子構造体はデフォルト型でないため、依存する #defstruct を先に定義(下記に同梱)。
#defstruct global GUID, pack=1
    #field int Data1
    #field short Data2
    #field short Data3
    #field byte Data4 8
#endstruct

#defstruct global EVENT_DESCRIPTOR
    #field short Id
    #field byte Version
    #field byte Channel
    #field byte Level
    #field byte Opcode
    #field short Task
    #field int64 Keyword
#endstruct

#defstruct global EVENT_HEADER
    #field short Size
    #field short HeaderType
    #field short Flags
    #field short EventProperty
    #field int ThreadId
    #field int ProcessId
    #field int64 TimeStamp
    #field GUID ProviderId
    #field EVENT_DESCRIPTOR EventDescriptor
    #field byte Anonymous 8
    #field GUID ActivityId
#endstruct

#defstruct global ETW_BUFFER_CONTEXT
    #field byte Anonymous 8
    #field short LoggerId
#endstruct

#defstruct global EVENT_RECORD
    #field EVENT_HEADER EventHeader
    #field ETW_BUFFER_CONTEXT BufferContext
    #field short ExtendedDataCount
    #field short UserDataLength
    #field intptr ExtendedData
    #field intptr UserData
    #field intptr UserContext
#endstruct

stdim st, EVENT_RECORD        ; NSTRUCT 変数を確保
st->ExtendedDataCount = 100
mes "ExtendedDataCount=" + st->ExtendedDataCount

EVENT_RECORD

フィールド

各言語での定義

HSP用 定義

HSP用定義