_WMI_LOGGER_CONTEXT

Metadatacopy
struct _WMI_LOGGER_CONTEXT {
    union _LARGE_INTEGER StartTime;/* 0x0  8 */
    void* LogFileHandle;/* 0x8  8 */
    struct _ETHREAD* LoggerThread;/* 0x10  8 */
    long LoggerStatus;/* 0x18  4 */
    unsigned long LoggerId;/* 0x1c  4 */
    void* NBQHead;/* 0x20  8 */
    void* OverflowNBQHead;/* 0x28  8 */
    union _SLIST_HEADER QueueBlockFreeList;/* 0x30  16 */
    /* ── cacheline 1 boundary (64 bytes) ── */
    union _SLIST_HEADER GlobalList;/* 0x40  16 */
    struct _WMI_BUFFER_HEADER* BatchedBufferList;/* 0x50  8 */
    struct _UNICODE_STRING LoggerName;/* 0x58  16 */
    struct _UNICODE_STRING LogFileName;/* 0x68  16 */
    struct _UNICODE_STRING LogFilePattern;/* 0x78  16 */
    /* ── cacheline 2 boundary (128 bytes) ── */
    struct _UNICODE_STRING NewLogFileName;/* 0x88  16 */
    unsigned long ClockType;/* 0x98  4 */
    long CollectionOn;/* 0x9c  4 */
    unsigned long MaximumFileSize;/* 0xa0  4 */
    unsigned long LoggerMode;/* 0xa4  4 */
    unsigned long LastFlushedBuffer;/* 0xa8  4 */
    unsigned long FlushTimer;/* 0xac  4 */
    unsigned long FlushThreshold;/* 0xb0  4 */
    /* 4 bytes padding */
    union _LARGE_INTEGER ByteOffset;/* 0xb8  8 */
    /* ── cacheline 3 boundary (192 bytes) ── */
    union _LARGE_INTEGER FlushTimeStamp;/* 0xc0  8 */
    unsigned long MinimumBuffers;/* 0xc8  4 */
    volatile long BuffersAvailable;/* 0xcc  4 */
    volatile long NumberOfBuffers;/* 0xd0  4 */
    unsigned long MaximumBuffers;/* 0xd4  4 */
    volatile unsigned long EventsLost;/* 0xd8  4 */
    unsigned long BuffersWritten;/* 0xdc  4 */
    unsigned long LogBuffersLost;/* 0xe0  4 */
    unsigned long RealTimeBuffersDelivered;/* 0xe4  4 */
    unsigned long RealTimeBuffersLost;/* 0xe8  4 */
    unsigned long BufferSize;/* 0xec  4 */
    unsigned long MaximumEventSize;/* 0xf0  4 */
    /* 4 bytes padding */
    long* SequencePtr;/* 0xf8  8 */
    /* ── cacheline 4 boundary (256 bytes) ── */
    unsigned long LocalSequence;/* 0x100  4 */
    struct _GUID InstanceGuid;/* 0x104  16 */
    /* 4 bytes padding */
    __int64 (*GetCpuClock)(void);/* 0x118  8 */
    long FileCounter;/* 0x120  4 */
    /* 4 bytes padding */
    void (*BufferCallback)(struct _WMI_BUFFER_HEADER*, void*);/* 0x128  8 */
    enum _POOL_TYPE PoolType;/* 0x130  4 */
    /* 4 bytes padding */
    struct _ETW_REF_CLOCK ReferenceTime;/* 0x138  16 */
    /* ── cacheline 5 boundary (320 bytes) ── */
    unsigned char RealtimeLoggerContextFreed;/* 0x148  1 */
    /* 7 bytes padding */
    struct _LIST_ENTRY Consumers;/* 0x150  16 */
    unsigned long NumConsumers;/* 0x160  4 */
    /* 4 bytes padding */
    struct _LIST_ENTRY Connecting;/* 0x168  16 */
    unsigned char NewConsumer;/* 0x178  1 */
    /* 7 bytes padding */
    /* ── cacheline 6 boundary (384 bytes) ── */
    void* RealtimeLogfileHandle;/* 0x180  8 */
    struct _UNICODE_STRING RealtimeLogfileName;/* 0x188  16 */
    union _LARGE_INTEGER RealtimeWriteOffset;/* 0x198  8 */
    union _LARGE_INTEGER RealtimeReadOffset;/* 0x1a0  8 */
    union _LARGE_INTEGER RealtimeLogfileSize;/* 0x1a8  8 */
    unsigned __int64 RealtimeLogfileUsage;/* 0x1b0  8 */
    unsigned __int64 RealtimeMaximumFileSize;/* 0x1b8  8 */
    /* ── cacheline 7 boundary (448 bytes) ── */
    unsigned long RealtimeBuffersSaved;/* 0x1c0  4 */
    /* 4 bytes padding */
    struct _ETW_REF_CLOCK RealtimeReferenceTime;/* 0x1c8  16 */
    unsigned long RealtimeDisconnectProcessId;/* 0x1d8  4 */
    unsigned long RealtimeDisconnectConsumerId;/* 0x1dc  4 */
    enum _ETW_RT_EVENT_LOSS NewRTEventsLost;/* 0x1e0  4 */
    /* 4 bytes padding */
    struct _KEVENT LoggerEvent;/* 0x1e8  24 */
    /* ── cacheline 8 boundary (512 bytes) ── */
    struct _KEVENT FlushEvent;/* 0x200  24 */
    struct _KDPC FlushDpc;/* 0x218  64 */
    /* ── cacheline 9 boundary (576 bytes) ── */
    struct _KMUTANT LoggerMutex;/* 0x258  56 */
    /* ── cacheline 10 boundary (640 bytes) ── */
    struct _EX_PUSH_LOCK LoggerLock;/* 0x290  8 */
    struct _SECURITY_CLIENT_CONTEXT ClientSecurityContext;/* 0x298  72 */
    /* ── cacheline 11 boundary (704 bytes) ── */
    struct _EX_FAST_REF SecurityDescriptor;/* 0x2e0  8 */
    struct _WMI_BUFFER_HEADER DummyBufferForMarker;/* 0x2e8  72 */
    /* ── cacheline 12 boundary (768 bytes) ── */
    __int64 BufferSequenceNumber;/* 0x330  8 */
    long AcceptNewEvents;/* 0x338  4 */
    union {
        unsigned long Flags;/* 0x33c  4 */
        struct {
            unsigned long Persistent : 1;/* 0x33c:0  4 */
            unsigned long AutoLogger : 1;/* 0x33c:1  4 */
            unsigned long FsReady : 1;/* 0x33c:2  4 */
            unsigned long RealTime : 1;/* 0x33c:3  4 */
            unsigned long Wow : 1;/* 0x33c:4  4 */
            unsigned long KernelTrace : 1;/* 0x33c:5  4 */
            unsigned long NoMoreEnable : 1;/* 0x33c:6  4 */
        };/* 0x33c  4 */
    };/* 0x33c  4 */
    /* ── cacheline 13 boundary (832 bytes) ── */
    union {
        unsigned long RequestFlag;/* 0x340  4 */
        struct {
            unsigned long RequestNewFie : 1;/* 0x340:0  4 */
            unsigned long RequestUpdateFile : 1;/* 0x340:1  4 */
            unsigned long RequestFlush : 1;/* 0x340:2  4 */
            unsigned long RequestDisableRealtime : 1;/* 0x340:3  4 */
            unsigned long RequestDisconnectConsumer : 1;/* 0x340:4  4 */
        };/* 0x340  4 */
    };/* 0x340  4 */
    unsigned short StackTraceFilterHookCount;/* 0x344  2 */
    unsigned short StackTraceFilter[16];/* 0x346  32 */
};