waitForSignal waits for anything on @done no longer than @deadline. Fails test run if deadline exceeds.

NewSession creates a Windows event tracing session instance. Session with no options provided is a usable session, but it could be a bit noisy. It's r

Close stops trace session and frees associated resources.

Process starts processing of ETW events. Events will be passed to @cb synchronously and sequentially. Take a look to EventCallback documentation for m

trySignal tries to send a signal to @done if it's ready to receive. @done expected to be a buffered channel.

We have no easy way to ensure that etw session is started and ready to process events, so it seems easier to just flood an events and catch some of th

EventProperties returns a map that represents events-specific data provided by event producer. Returned data depends on the provider, event type and e

WithLevel specifies a maximum level consumer is interested in. Higher levels imply that you get lower levels as well. For example, with TRACE_LEVEL_ER

WithName specifies a provided @name for the creating session. Further that session could be controlled from other processed by it's name, so it should

Returns ULONGLONG instead of string pointer cos event data descriptor expects exactly that type.

Creates UTF16 string from raw parts. Actually in go we have no way to make a slice from raw parts, ref: - https://github.com/golang/go/issues/13656 -

free frees associated PTRACE_EVENT_INFO if any assigned.

getPropertyName returns a name of the @i-th event property.

getPropertyValue retrieves a value of @i-th property. N.B. getPropertyValue HIGHLY depends not only on @i but also on memory offsets, so check twice

subscribeToProvider wraps EnableTraceEx2 with EVENT_CONTROL_CODE_ENABLE_PROVIDER.

ExtendedInfo extracts ExtendedEventInfo structure from native buffers of received event record. If no ExtendedEventInfo is available inside an event

KillSession forces the session with a given @name to stop. Don't having a session handle we can't shutdown it gracefully unsubscribing from all the pr

UpdateOptions changes subscription parameters in runtime. The only option that can't be updated is session name. To change session name -- stop and re

createETWSession wraps StartTraceW.

getEventInformation wraps TdhGetEventInformation. It extracts some kind of simplified event information used by Tdh* family of function. Returned inf

getMapInfo retrieve the mapping between the @i-th field and the structure it represents. If that mapping exists, function extracts it and returns a po

handleEvent is exported to guarantee C calling convention (cdecl). The function should be defined here but would be linked and used inside C code in

newCallbackKey stores a @ptr inside a global storage returning its' key. After use the key should be freed using `freeCallbackKey`.

parseSimpleType wraps TdhFormatProperty to get rendered to string value of @i-th event property.

parseStruct tries to extract fields of embedded structure at property @i.

processEvents subscribes to the actual provider events and starts its processing.

stampToTime translates FileTime to a golang time. Same as in standard packages.

stopSession wraps ControlTraceW with EVENT_TRACE_CONTROL_STOP.

unsubscribeFromProvider wraps EnableTraceEx2 with EVENT_CONTROL_CODE_DISABLE_PROVIDER.

https://docs.microsoft.com/ru-ru/windows/win32/etw/using-tdhformatproperty-to-consume-event-data

GetPropertyLength returns an associated length of the @j-th property of @pInfo. If the length is available, retrieve it here. In some cases, the lengt

HasCPUTime returns true if the event has separate UserTime and KernelTime measurements. Otherwise the value of UserTime and KernelTime is meaningless

OpenTraceHelper helps to access EVENT_TRACE_LOGFILEW union fields and pass pointer to C not warning CGO checker.

Determine whether the property is an array. The property is an array if the EVENT_PROPERTY_INFO.Flags member is set to PropertyParamCount or the EVENT

TestEventOutsideCallback ensures *etw.Event can't be used outside EventCallback.

TestKillSession ensures that we are able to force kill the lost session using only its name.

TestParsing ensures that etw.Session is able to parse events with all common field types.

TestSmoke ensures that etw.Session is working as expected: it could start, process incoming events and stop properly.

TestUpdating ensures that etw.Session is able to update its properties in runtime.

WithMatchKeywords allows to specify keywords of receiving events. Each event has a set of keywords associated with it. That keywords are encoded as bi

WithProperty enables additional provider feature toggled by @p. Subsequent WithProperty options will enable all provided options. For more info about