Function EnumerateSystemEvents

Tools/etw_list/etw_list.cpp:285–359

};

void EnumerateSystemEvents(GUID const& providerGuid, std::vector<Event>* events, std::wstring* outProviderName)
{
    ULONG bufferSize = 0;
    auto status = TdhEnumerateManifestProviderEvents((LPGUID) &providerGuid, nullptr, &bufferSize);
    switch (status) {
    case ERROR_EMPTY:                   return;
    case ERROR_INSUFFICIENT_BUFFER:     break;
    default:
        fprintf(stderr, "error: could not enumerate events (");
        switch (status) {
        case ERROR_INVALID_DATA:            fprintf(stderr, "ERROR_INVALID_DATA"); break;
        case ERROR_FILE_NOT_FOUND:          fprintf(stderr, "provider meta data not found"); break;
        case ERROR_RESOURCE_TYPE_NOT_FOUND: fprintf(stderr, "ERROR_RESOURCE_TYPE_NOT_FOUND"); break;
        case ERROR_NOT_FOUND:               fprintf(stderr, "provider schema information not found"); break;
        default:                            fprintf(stderr, "error=%u", status);
        }
        fprintf(stderr, ").\n");
        exit(1);
    }

    auto enumInfo = (PROVIDER_EVENT_INFO*) malloc(bufferSize);
    if (enumInfo == nullptr) {
        fprintf(stderr, "error: could not allocate memory for events (%u bytes).\n", bufferSize);
        exit(1);
    }

    status = TdhEnumerateManifestProviderEvents((LPGUID) &providerGuid, enumInfo, &bufferSize);
    if (status != ERROR_SUCCESS) {
        fprintf(stderr, "error: could not enumerate events (error=%u).\n", status);
        free(enumInfo);
        exit(1);
    }

    auto eventCount = enumInfo->NumberOfEvents;
    events->reserve(events->size() + eventCount);
    for (ULONG eventIndex = 0; eventIndex < eventCount; ++eventIndex) {
        auto desc = &enumInfo->EventDescriptorsArray[eventIndex];

        bufferSize = 0;
        status = TdhGetManifestEventInformation((LPGUID) &providerGuid, desc, nullptr, &bufferSize);
        if (status != ERROR_INSUFFICIENT_BUFFER) {
            fprintf(stderr, "error: could not get manifest event information (error=%u).\n", status);
            exit(1);
        }

        auto eventInfo = (TRACE_EVENT_INFO*) malloc(bufferSize);
        if (eventInfo == nullptr) {
            fprintf(stderr, "error: could not allocate memory for event information (%u bytes).\n", bufferSize);
            exit(1);
        }

        status = TdhGetManifestEventInformation((LPGUID) &providerGuid, desc, eventInfo, &bufferSize);
        if (status != ERROR_SUCCESS) {
            fprintf(stderr, "error: could not get manifest event information (error=%u).\n", status);
            free(eventInfo);
            exit(1);
        }