Win32 API 日本語リファレンス
ホーム › System.Diagnostics.Etw › PROVIDER_FILTER_INFO

PROVIDER_FILTER_INFO

構造体
📘 Microsoft Learn (日本語) · English
サイズx64: 48 バイト / x86: 36 バイト

サイズ=各フィールドのバイト数(x64/x86 で異なる場合は x64/x86 と併記)。x64/x86 列=フィールドのバイトオフセット(HSPで dupptr / lpoke / wpoke 等に使用)。

フィールド

フィールド型サイズx64x86説明
IdBYTE1+0+0フィルタを識別する数値ID。
VersionBYTE1+1+1フィルタ定義のバージョン。
MessageOffsetDWORD4+4+4フィルタメッセージ文字列へのバイトオフセット。
ReservedDWORD4+8+8予約フィールド。0であること。
PropertyCountDWORD4+12+12EventPropertyInfoArrayのプロパティ数。
EventPropertyInfoArrayEVENT_PROPERTY_INFO32/20+16+16フィルタの各プロパティを記述するEVENT_PROPERTY_INFO配列の先頭。

各言語での定義

#include <windows.h>

// EVENT_PROPERTY_INFO  (x64 32 / x86 20 バイト)
typedef struct EVENT_PROPERTY_INFO {
    PROPERTY_FLAGS Flags;
    DWORD NameOffset;
    _Anonymous1_e__Union Anonymous1;
    _Anonymous2_e__Union Anonymous2;
    _Anonymous3_e__Union Anonymous3;
    _Anonymous4_e__Union Anonymous4;
} EVENT_PROPERTY_INFO;

// PROVIDER_FILTER_INFO  (x64 48 / x86 36 バイト)
typedef struct PROVIDER_FILTER_INFO {
    BYTE Id;
    BYTE Version;
    DWORD MessageOffset;
    DWORD Reserved;
    DWORD PropertyCount;
    EVENT_PROPERTY_INFO EventPropertyInfoArray[1];
} PROVIDER_FILTER_INFO;
using System;
using System.Runtime.InteropServices;

[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
public struct EVENT_PROPERTY_INFO
{
    public int Flags;
    public uint NameOffset;
    public _Anonymous1_e__Union Anonymous1;
    public _Anonymous2_e__Union Anonymous2;
    public _Anonymous3_e__Union Anonymous3;
    public _Anonymous4_e__Union Anonymous4;
}

[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
public struct PROVIDER_FILTER_INFO
{
    public byte Id;
    public byte Version;
    public uint MessageOffset;
    public uint Reserved;
    public uint PropertyCount;
    [MarshalAs(UnmanagedType.ByValArray, SizeConst = 1)] public EVENT_PROPERTY_INFO[] EventPropertyInfoArray;
}
Imports System.Runtime.InteropServices

<StructLayout(LayoutKind.Sequential, CharSet:=CharSet.Unicode)>
Public Structure EVENT_PROPERTY_INFO
    Public Flags As Integer
    Public NameOffset As UInteger
    Public Anonymous1 As _Anonymous1_e__Union
    Public Anonymous2 As _Anonymous2_e__Union
    Public Anonymous3 As _Anonymous3_e__Union
    Public Anonymous4 As _Anonymous4_e__Union
End Structure

<StructLayout(LayoutKind.Sequential, CharSet:=CharSet.Unicode)>
Public Structure PROVIDER_FILTER_INFO
    Public Id As Byte
    Public Version As Byte
    Public MessageOffset As UInteger
    Public Reserved As UInteger
    Public PropertyCount As UInteger
    <MarshalAs(UnmanagedType.ByValArray, SizeConst:=1)> Public EventPropertyInfoArray() As EVENT_PROPERTY_INFO
End Structure
import ctypes
from ctypes import wintypes

class EVENT_PROPERTY_INFO(ctypes.Structure):
    _fields_ = [
        ("Flags", ctypes.c_int),
        ("NameOffset", wintypes.DWORD),
        ("Anonymous1", _Anonymous1_e__Union),
        ("Anonymous2", _Anonymous2_e__Union),
        ("Anonymous3", _Anonymous3_e__Union),
        ("Anonymous4", _Anonymous4_e__Union),
    ]

class PROVIDER_FILTER_INFO(ctypes.Structure):
    _fields_ = [
        ("Id", ctypes.c_ubyte),
        ("Version", ctypes.c_ubyte),
        ("MessageOffset", wintypes.DWORD),
        ("Reserved", wintypes.DWORD),
        ("PropertyCount", wintypes.DWORD),
        ("EventPropertyInfoArray", EVENT_PROPERTY_INFO * 1),
    ]
#[repr(C)]
pub struct EVENT_PROPERTY_INFO {
    pub Flags: i32,
    pub NameOffset: u32,
    pub Anonymous1: _Anonymous1_e__Union,
    pub Anonymous2: _Anonymous2_e__Union,
    pub Anonymous3: _Anonymous3_e__Union,
    pub Anonymous4: _Anonymous4_e__Union,
}

#[repr(C)]
pub struct PROVIDER_FILTER_INFO {
    pub Id: u8,
    pub Version: u8,
    pub MessageOffset: u32,
    pub Reserved: u32,
    pub PropertyCount: u32,
    pub EventPropertyInfoArray: [EVENT_PROPERTY_INFO; 1],
}
import "golang.org/x/sys/windows"

type EVENT_PROPERTY_INFO struct {
	Flags int32
	NameOffset uint32
	Anonymous1 _Anonymous1_e__Union
	Anonymous2 _Anonymous2_e__Union
	Anonymous3 _Anonymous3_e__Union
	Anonymous4 _Anonymous4_e__Union
}

type PROVIDER_FILTER_INFO struct {
	Id byte
	Version byte
	MessageOffset uint32
	Reserved uint32
	PropertyCount uint32
	EventPropertyInfoArray [1]EVENT_PROPERTY_INFO
}
type
  EVENT_PROPERTY_INFO = record
    Flags: Integer;
    NameOffset: DWORD;
    Anonymous1: _Anonymous1_e__Union;
    Anonymous2: _Anonymous2_e__Union;
    Anonymous3: _Anonymous3_e__Union;
    Anonymous4: _Anonymous4_e__Union;
  end;

  PROVIDER_FILTER_INFO = record
    Id: Byte;
    Version: Byte;
    MessageOffset: DWORD;
    Reserved: DWORD;
    PropertyCount: DWORD;
    EventPropertyInfoArray: array[0..0] of EVENT_PROPERTY_INFO;
  end;
const EVENT_PROPERTY_INFO = extern struct {
    Flags: i32,
    NameOffset: u32,
    Anonymous1: _Anonymous1_e__Union,
    Anonymous2: _Anonymous2_e__Union,
    Anonymous3: _Anonymous3_e__Union,
    Anonymous4: _Anonymous4_e__Union,
};

const PROVIDER_FILTER_INFO = extern struct {
    Id: u8,
    Version: u8,
    MessageOffset: u32,
    Reserved: u32,
    PropertyCount: u32,
    EventPropertyInfoArray: [1]EVENT_PROPERTY_INFO,
};
type
  EVENT_PROPERTY_INFO {.bycopy.} = object
    Flags: int32
    NameOffset: uint32
    Anonymous1: _Anonymous1_e__Union
    Anonymous2: _Anonymous2_e__Union
    Anonymous3: _Anonymous3_e__Union
    Anonymous4: _Anonymous4_e__Union

  PROVIDER_FILTER_INFO {.bycopy.} = object
    Id: uint8
    Version: uint8
    MessageOffset: uint32
    Reserved: uint32
    PropertyCount: uint32
    EventPropertyInfoArray: array[1, EVENT_PROPERTY_INFO]
struct EVENT_PROPERTY_INFO
{
    int Flags;
    uint NameOffset;
    _Anonymous1_e__Union Anonymous1;
    _Anonymous2_e__Union Anonymous2;
    _Anonymous3_e__Union Anonymous3;
    _Anonymous4_e__Union Anonymous4;
}

struct PROVIDER_FILTER_INFO
{
    ubyte Id;
    ubyte Version;
    uint MessageOffset;
    uint Reserved;
    uint PropertyCount;
    EVENT_PROPERTY_INFO[1] EventPropertyInfoArray;
}

HSP用 定義

HSP3.7/3.8 は構造体機能が無いため4byte整数配列(dim)+peek/poke で操作(32/64bitでサイズ・位置が異なる場合はタブで分割)。IronHSP は NSTRUCT(#defstruct/stdim/->)で32/64bit共通。

; HSP3.7/3.8 は構造体機能が無いため、4byte整数の配列変数で操作します。(x86 レイアウト)
; PROVIDER_FILTER_INFO サイズ: 36 バイト(x86)
dim st, 9    ; 4byte整数×9(構造体サイズ 36 / 4 切り上げ)
; Id : BYTE (+0, 1byte)  poke st,0,値  /  値 = peek(st,0)
; Version : BYTE (+1, 1byte)  poke st,1,値  /  値 = peek(st,1)
; MessageOffset : DWORD (+4, 4byte)  st.1 = 値  /  値 = st.1   (lpoke/lpeek も可)
; Reserved : DWORD (+8, 4byte)  st.2 = 値  /  値 = st.2   (lpoke/lpeek も可)
; PropertyCount : DWORD (+12, 4byte)  st.3 = 値  /  値 = st.3   (lpoke/lpeek も可)
; EventPropertyInfoArray : EVENT_PROPERTY_INFO (+16, 20byte)  varptr(st)+16 を基点に操作(20byte:入れ子/配列)
; ※4byte境界の整数は添字 st.N(N=オフセット/4)で読み書き可。それ以外は peek/poke 系を使用。
; HSP3.7/3.8 は構造体機能が無いため、4byte整数の配列変数で操作します。(x64 レイアウト)
; PROVIDER_FILTER_INFO サイズ: 48 バイト(x64)
dim st, 12    ; 4byte整数×12(構造体サイズ 48 / 4 切り上げ)
; Id : BYTE (+0, 1byte)  poke st,0,値  /  値 = peek(st,0)
; Version : BYTE (+1, 1byte)  poke st,1,値  /  値 = peek(st,1)
; MessageOffset : DWORD (+4, 4byte)  st.1 = 値  /  値 = st.1   (lpoke/lpeek も可)
; Reserved : DWORD (+8, 4byte)  st.2 = 値  /  値 = st.2   (lpoke/lpeek も可)
; PropertyCount : DWORD (+12, 4byte)  st.3 = 値  /  値 = st.3   (lpoke/lpeek も可)
; EventPropertyInfoArray : EVENT_PROPERTY_INFO (+16, 32byte)  varptr(st)+16 を基点に操作(32byte:入れ子/配列)
; ※4byte境界の整数は添字 st.N(N=オフセット/4)で読み書き可。それ以外は peek/poke 系を使用。
; IronHSP は NSTRUCT(構造体)をサポート。32bit/64bit どちらでも同じコードで動作します。
; ※GUID・入れ子構造体はデフォルト型でないため、依存する #defstruct を先に定義(下記に同梱)。
#defstruct global EVENT_PROPERTY_INFO
    #field int Flags
    #field int NameOffset
    #field byte Anonymous1 8
    #field byte Anonymous2 2
    #field byte Anonymous3 2
    #field byte Anonymous4 8
#endstruct

#defstruct global PROVIDER_FILTER_INFO
    #field byte Id
    #field byte Version
    #field int MessageOffset
    #field int Reserved
    #field int PropertyCount
    #field EVENT_PROPERTY_INFO EventPropertyInfoArray 1
#endstruct

stdim st, PROVIDER_FILTER_INFO        ; NSTRUCT 変数を確保
st->Id = 100
mes "Id=" + st->Id