struct _WMI_LOGGER_CONTEXT { unsigned long LoggerId;/* 0x0 4 */ unsigned long BufferSize;/* 0x4 4 */ unsigned long MaximumEventSize;/* 0x8 4 */ unsigned long LoggerMode;/* 0xc 4 */ long AcceptNewEvents;/* 0x10 4 */ /* 4 bytes padding */ unsigned __int64 GetCpuClock;/* 0x18 8 */ struct _ETHREAD* LoggerThread;/* 0x20 8 */ long LoggerStatus;/* 0x28 4 */ unsigned long FailureReason;/* 0x2c 4 */ struct _ETW_BUFFER_QUEUE BufferQueue;/* 0x30 16 */ /* ── cacheline 1 boundary (64 bytes) ── */ struct _ETW_BUFFER_QUEUE OverflowQueue;/* 0x40 16 */ struct _LIST_ENTRY GlobalList;/* 0x50 16 */ struct _LIST_ENTRY DebugIdTrackingList;/* 0x60 16 */ struct _ETW_DECODE_CONTROL_ENTRY* DecodeControlList;/* 0x70 8 */ unsigned long DecodeControlCount;/* 0x78 4 */ /* 4 bytes padding */ /* ── cacheline 2 boundary (128 bytes) ── */ union { struct _WMI_BUFFER_HEADER* BatchedBufferList;/* 0x80 8 */ struct _EX_FAST_REF CurrentBuffer;/* 0x80 8 */ };/* 0x80 8 */ struct _UNICODE_STRING LoggerName;/* 0x88 16 */ struct _UNICODE_STRING LogFileName;/* 0x98 16 */ struct _UNICODE_STRING LogFilePattern;/* 0xa8 16 */ struct _UNICODE_STRING NewLogFileName;/* 0xb8 16 */ /* ── cacheline 3 boundary (192 bytes) ── */ unsigned long ClockType;/* 0xc8 4 */ unsigned long LastFlushedBuffer;/* 0xcc 4 */ unsigned long FlushTimer;/* 0xd0 4 */ unsigned long FlushThreshold;/* 0xd4 4 */ union _LARGE_INTEGER ByteOffset;/* 0xd8 8 */ unsigned long MinimumBuffers;/* 0xe0 4 */ volatile long BuffersAvailable;/* 0xe4 4 */ volatile long NumberOfBuffers;/* 0xe8 4 */ unsigned long MaximumBuffers;/* 0xec 4 */ volatile unsigned long EventsLost;/* 0xf0 4 */ volatile long PeakBuffersCount;/* 0xf4 4 */ unsigned long BuffersWritten;/* 0xf8 4 */ unsigned long LogBuffersLost;/* 0xfc 4 */ /* ── cacheline 4 boundary (256 bytes) ── */ unsigned long RealTimeBuffersDelivered;/* 0x100 4 */ unsigned long RealTimeBuffersLost;/* 0x104 4 */ long* SequencePtr;/* 0x108 8 */ unsigned long LocalSequence;/* 0x110 4 */ struct _GUID InstanceGuid;/* 0x114 16 */ unsigned long MaximumFileSize;/* 0x124 4 */ long FileCounter;/* 0x128 4 */ enum _POOL_TYPE PoolType;/* 0x12c 4 */ struct _ETW_REF_CLOCK ReferenceTime;/* 0x130 16 */ /* ── cacheline 5 boundary (320 bytes) ── */ long CollectionOn;/* 0x140 4 */ unsigned long ProviderInfoSize;/* 0x144 4 */ struct _LIST_ENTRY Consumers;/* 0x148 16 */ unsigned long NumConsumers;/* 0x158 4 */ /* 4 bytes padding */ struct _ETW_REALTIME_CONSUMER* TransitionConsumer;/* 0x160 8 */ void* RealtimeLogfileHandle;/* 0x168 8 */ struct _UNICODE_STRING RealtimeLogfileName;/* 0x170 16 */ /* ── cacheline 6 boundary (384 bytes) ── */ union _LARGE_INTEGER RealtimeWriteOffset;/* 0x180 8 */ union _LARGE_INTEGER RealtimeReadOffset;/* 0x188 8 */ union _LARGE_INTEGER RealtimeLogfileSize;/* 0x190 8 */ unsigned __int64 RealtimeLogfileUsage;/* 0x198 8 */ unsigned __int64 RealtimeMaximumFileSize;/* 0x1a0 8 */ unsigned long RealtimeBuffersSaved;/* 0x1a8 4 */ /* 4 bytes padding */ struct _ETW_REF_CLOCK RealtimeReferenceTime;/* 0x1b0 16 */ /* ── cacheline 7 boundary (448 bytes) ── */ enum _ETW_RT_EVENT_LOSS NewRTEventsLost;/* 0x1c0 4 */ /* 4 bytes padding */ struct _KEVENT LoggerEvent;/* 0x1c8 24 */ struct _KEVENT FlushEvent;/* 0x1e0 24 */ struct _KTIMER FlushTimeOutTimer;/* 0x1f8 64 */ /* ── cacheline 8 boundary (512 bytes) ── */ struct _KDPC LoggerDpc;/* 0x238 64 */ /* ── cacheline 9 boundary (576 bytes) ── */ struct _KMUTANT LoggerMutex;/* 0x278 56 */ /* ── cacheline 10 boundary (640 bytes) ── */ struct _EX_PUSH_LOCK LoggerLock;/* 0x2b0 8 */ union { unsigned __int64 BufferListSpinLock;/* 0x2b8 8 */ struct _EX_PUSH_LOCK BufferListPushLock;/* 0x2b8 8 */ };/* 0x2b8 8 */ /* ── cacheline 11 boundary (704 bytes) ── */ struct _SECURITY_CLIENT_CONTEXT ClientSecurityContext;/* 0x2c0 72 */ /* ── cacheline 12 boundary (768 bytes) ── */ struct _TOKEN_ACCESS_INFORMATION* TokenAccessInformation;/* 0x308 8 */ struct _EX_FAST_REF SecurityDescriptor;/* 0x310 8 */ union _LARGE_INTEGER StartTime;/* 0x318 8 */ void* LogFileHandle;/* 0x320 8 */ __int64 BufferSequenceNumber;/* 0x328 8 */ union { unsigned long Flags;/* 0x330 4 */ struct { unsigned long Persistent : 1;/* 0x330:0 4 */ unsigned long AutoLogger : 1;/* 0x330:1 4 */ unsigned long FsReady : 1;/* 0x330:2 4 */ unsigned long RealTime : 1;/* 0x330:3 4 */ unsigned long Wow : 1;/* 0x330:4 4 */ unsigned long KernelTrace : 1;/* 0x330:5 4 */ unsigned long NoMoreEnable : 1;/* 0x330:6 4 */ unsigned long StackTracing : 1;/* 0x330:7 4 */ unsigned long ErrorLogged : 1;/* 0x330:8 4 */ unsigned long RealtimeLoggerContextFreed : 1;/* 0x330:9 4 */ unsigned long PebsTracing : 1;/* 0x330:10 4 */ unsigned long PmcCounters : 1;/* 0x330:11 4 */ unsigned long PageAlignBuffers : 1;/* 0x330:12 4 */ unsigned long StackLookasideListAllocated : 1;/* 0x330:13 4 */ unsigned long SecurityTrace : 1;/* 0x330:14 4 */ unsigned long LastBranchTracing : 1;/* 0x330:15 4 */ unsigned long SystemLoggerIndex : 8;/* 0x330:16 4 */ unsigned long StackCaching : 1;/* 0x330:24 4 */ unsigned long ProviderTracking : 1;/* 0x330:25 4 */ unsigned long ProcessorTrace : 1;/* 0x330:26 4 */ unsigned long QpcDeltaTracking : 1;/* 0x330:27 4 */ unsigned long MarkerBufferSaved : 1;/* 0x330:28 4 */ unsigned long LargeMdlPages : 1;/* 0x330:29 4 */ unsigned long ExcludeKernelStack : 1;/* 0x330:30 4 */ unsigned long BootLogger : 1;/* 0x330:31 4 */ };/* 0x330 4 */ };/* 0x330 4 */ union { unsigned long Flags2;/* 0x334 4 */ unsigned long UnifiedStackCaching : 1;/* 0x334:0 4 */ };/* 0x334 4 */ union { volatile unsigned long RequestFlag;/* 0x338 4 */ struct { unsigned long DbgRequestNewFile : 1;/* 0x338:0 4 */ unsigned long DbgRequestUpdateFile : 1;/* 0x338:1 4 */ unsigned long DbgRequestFlush : 1;/* 0x338:2 4 */ unsigned long DbgRequestDisableRealtime : 1;/* 0x338:3 4 */ unsigned long DbgRequestDisconnectConsumer : 1;/* 0x338:4 4 */ unsigned long DbgRequestConnectConsumer : 1;/* 0x338:5 4 */ unsigned long DbgRequestNotifyConsumer : 1;/* 0x338:6 4 */ unsigned long DbgRequestUpdateHeader : 1;/* 0x338:7 4 */ unsigned long DbgRequestDeferredFlush : 1;/* 0x338:8 4 */ unsigned long DbgRequestDeferredFlushTimer : 1;/* 0x338:9 4 */ unsigned long DbgRequestFlushTimer : 1;/* 0x338:10 4 */ unsigned long DbgRequestUpdateDebugger : 1;/* 0x338:11 4 */ unsigned long DbgSpareRequestFlags : 20;/* 0x338:12 4 */ };/* 0x338 4 */ };/* 0x338 4 */ /* 4 bytes padding */ /* ── cacheline 13 boundary (832 bytes) ── */ struct _ETW_STACK_TRACE_BLOCK StackTraceBlock;/* 0x340 208 */ /* ── cacheline 16 boundary (1024 bytes) ── */ struct _RTL_BITMAP StackHookIdMap;/* 0x410 16 */ struct _ETW_STACK_CACHE* StackCache;/* 0x420 8 */ struct _ETW_PMC_SUPPORT* PmcData;/* 0x428 8 */ struct _ETW_LBR_SUPPORT* LbrData;/* 0x430 8 */ struct _ETW_IPT_SUPPORT* IptData;/* 0x438 8 */ /* ── cacheline 17 boundary (1088 bytes) ── */ struct _ETW_APC_POOL ContextRegisterLoggingApcPool;/* 0x440 192 */ /* ── cacheline 20 boundary (1280 bytes) ── */ volatile unsigned long ContextRegisterTypes;/* 0x500 4 */ volatile unsigned long ContextRegisterHookCount;/* 0x504 4 */ unsigned short ContextRegisterHookIdMap[8];/* 0x508 16 */ struct _LIST_ENTRY BinaryTrackingList;/* 0x518 16 */ struct _WMI_BUFFER_HEADER** ScratchArray;/* 0x528 8 */ struct _DISALLOWED_GUIDS DisallowedGuids;/* 0x530 16 */ /* ── cacheline 21 boundary (1344 bytes) ── */ struct PERIODIC_CAPTURE_STATE_CONTEXT* PeriodicCaptureStateContext;/* 0x540 8 */ struct _ETW_SOFT_RESTART_CONTEXT* SoftRestartContext;/* 0x548 8 */ struct _ETW_SILODRIVERSTATE* SiloState;/* 0x550 8 */ struct _WORK_QUEUE_ITEM CompressionWorkItem;/* 0x558 32 */ long CompressionWorkItemState;/* 0x578 4 */ /* 4 bytes padding */ /* ── cacheline 22 boundary (1408 bytes) ── */ struct _EX_PUSH_LOCK CompressionLock;/* 0x580 8 */ struct _WMI_BUFFER_HEADER* CompressionTarget;/* 0x588 8 */ void* CompressionWorkspace;/* 0x590 8 */ long CompressionOn;/* 0x598 4 */ unsigned long CompressionRatioGuess;/* 0x59c 4 */ unsigned long PartialBufferCompressionLevel;/* 0x5a0 4 */ enum ETW_COMPRESSION_RESUMPTION_MODE CompressionResumptionMode;/* 0x5a4 4 */ struct _SINGLE_LIST_ENTRY PlaceholderList;/* 0x5a8 8 */ struct _KDPC CompressionDpc;/* 0x5b0 64 */ /* ── cacheline 23 boundary (1472 bytes) ── */ union _LARGE_INTEGER LastBufferSwitchTime;/* 0x5f0 8 */ union _LARGE_INTEGER BufferWriteDuration;/* 0x5f8 8 */ /* ── cacheline 24 boundary (1536 bytes) ── */ union _LARGE_INTEGER BufferCompressDuration;/* 0x600 8 */ __int64 ReferenceQpcDelta;/* 0x608 8 */ struct _ETW_EVENT_CALLBACK_CONTEXT* CallbackContext;/* 0x610 8 */ union _LARGE_INTEGER* LastDroppedTime;/* 0x618 8 */ union _LARGE_INTEGER* FlushingLastDroppedTime;/* 0x620 8 */ __int64 FlushingSequenceNumber;/* 0x628 8 */ struct _ETW_PARTITION_CONTEXT PartitionContext;/* 0x630 8 */ struct _MDL* BufferMdl;/* 0x638 8 */ /* ── cacheline 25 boundary (1600 bytes) ── */ unsigned __int64* PfnArray;/* 0x640 8 */};size 1616 (0x650)152 members7 holes (28 bytes)padding 826 cachelines
Used in (2)