_WMI_LOGGER_CONTEXT

Metadatacopy
struct _WMI_LOGGER_CONTEXT {
    unsigned long LoggerId;/* 0x0  4 */
    unsigned long BufferSize;/* 0x4  4 */
    unsigned long MaximumEventSize;/* 0x8  4 */
    unsigned long LoggerMode;/* 0xc  4 */
    long AcceptNewEvents;/* 0x10  4 */
    unsigned long EventMarker[1];/* 0x14  4 */
    unsigned long ErrorMarker;/* 0x18  4 */
    unsigned long SizeMask;/* 0x1c  4 */
    unsigned long GetCpuClock;/* 0x20  4 */
    struct _ETHREAD* LoggerThread;/* 0x24  4 */
    long LoggerStatus;/* 0x28  4 */
    unsigned long FailureReason;/* 0x2c  4 */
    struct _ETW_BUFFER_QUEUE BufferQueue;/* 0x30  8 */
    struct _ETW_BUFFER_QUEUE OverflowQueue;/* 0x38  8 */
    /* ── cacheline 1 boundary (64 bytes) ── */
    struct _LIST_ENTRY GlobalList;/* 0x40  8 */
    struct _LIST_ENTRY DebugIdTrackingList;/* 0x48  8 */
    struct _ETW_DECODE_CONTROL_ENTRY* DecodeControlList;/* 0x50  4 */
    unsigned long DecodeControlCount;/* 0x54  4 */
    union {
        struct _WMI_BUFFER_HEADER* BatchedBufferList;/* 0x58  4 */
        struct _EX_FAST_REF CurrentBuffer;/* 0x58  4 */
    };/* 0x58  4 */
    struct _UNICODE_STRING LoggerName;/* 0x5c  8 */
    struct _UNICODE_STRING LogFileName;/* 0x64  8 */
    struct _UNICODE_STRING LogFilePattern;/* 0x6c  8 */
    struct _UNICODE_STRING NewLogFileName;/* 0x74  8 */
    unsigned long ClockType;/* 0x7c  4 */
    /* ── cacheline 2 boundary (128 bytes) ── */
    unsigned long LastFlushedBuffer;/* 0x80  4 */
    unsigned long FlushTimer;/* 0x84  4 */
    unsigned long FlushThreshold;/* 0x88  4 */
    /* 4 bytes padding */
    union _LARGE_INTEGER ByteOffset;/* 0x90  8 */
    unsigned long MinimumBuffers;/* 0x98  4 */
    volatile long BuffersAvailable;/* 0x9c  4 */
    volatile long NumberOfBuffers;/* 0xa0  4 */
    unsigned long MaximumBuffers;/* 0xa4  4 */
    volatile unsigned long EventsLost;/* 0xa8  4 */
    volatile long PeakBuffersCount;/* 0xac  4 */
    unsigned long BuffersWritten;/* 0xb0  4 */
    unsigned long LogBuffersLost;/* 0xb4  4 */
    unsigned long RealTimeBuffersDelivered;/* 0xb8  4 */
    unsigned long RealTimeBuffersLost;/* 0xbc  4 */
    /* ── cacheline 3 boundary (192 bytes) ── */
    long* SequencePtr;/* 0xc0  4 */
    unsigned long LocalSequence;/* 0xc4  4 */
    struct _GUID InstanceGuid;/* 0xc8  16 */
    unsigned long MaximumFileSize;/* 0xd8  4 */
    long FileCounter;/* 0xdc  4 */
    enum _POOL_TYPE PoolType;/* 0xe0  4 */
    /* 4 bytes padding */
    struct _ETW_REF_CLOCK ReferenceTime;/* 0xe8  16 */
    long CollectionOn;/* 0xf8  4 */
    unsigned long ProviderInfoSize;/* 0xfc  4 */
    /* ── cacheline 4 boundary (256 bytes) ── */
    struct _LIST_ENTRY Consumers;/* 0x100  8 */
    unsigned long NumConsumers;/* 0x108  4 */
    struct _ETW_REALTIME_CONSUMER* TransitionConsumer;/* 0x10c  4 */
    void* RealtimeLogfileHandle;/* 0x110  4 */
    struct _UNICODE_STRING RealtimeLogfileName;/* 0x114  8 */
    /* 4 bytes padding */
    union _LARGE_INTEGER RealtimeWriteOffset;/* 0x120  8 */
    union _LARGE_INTEGER RealtimeReadOffset;/* 0x128  8 */
    union _LARGE_INTEGER RealtimeLogfileSize;/* 0x130  8 */
    unsigned __int64 RealtimeLogfileUsage;/* 0x138  8 */
    /* ── cacheline 5 boundary (320 bytes) ── */
    unsigned __int64 RealtimeMaximumFileSize;/* 0x140  8 */
    unsigned long RealtimeBuffersSaved;/* 0x148  4 */
    /* 4 bytes padding */
    struct _ETW_REF_CLOCK RealtimeReferenceTime;/* 0x150  16 */
    enum _ETW_RT_EVENT_LOSS NewRTEventsLost;/* 0x160  4 */
    struct _KEVENT LoggerEvent;/* 0x164  16 */
    struct _KEVENT FlushEvent;/* 0x174  16 */
    /* 4 bytes padding */
    /* ── cacheline 6 boundary (384 bytes) ── */
    struct _KTIMER FlushTimeOutTimer;/* 0x188  40 */
    struct _KDPC LoggerDpc;/* 0x1b0  32 */
    /* ── cacheline 7 boundary (448 bytes) ── */
    struct _KMUTANT LoggerMutex;/* 0x1d0  32 */
    struct _EX_PUSH_LOCK LoggerLock;/* 0x1f0  4 */
    union {
        unsigned long BufferListSpinLock;/* 0x1f4  4 */
        struct _EX_PUSH_LOCK BufferListPushLock;/* 0x1f4  4 */
    };/* 0x1f4  4 */
    struct _SECURITY_CLIENT_CONTEXT ClientSecurityContext;/* 0x1f8  60 */
    /* ── cacheline 8 boundary (512 bytes) ── */
    struct _TOKEN_ACCESS_INFORMATION* TokenAccessInformation;/* 0x234  4 */
    struct _EX_FAST_REF SecurityDescriptor;/* 0x238  4 */
    /* 4 bytes padding */
    /* ── cacheline 9 boundary (576 bytes) ── */
    union _LARGE_INTEGER StartTime;/* 0x240  8 */
    void* LogFileHandle;/* 0x248  4 */
    /* 4 bytes padding */
    __int64 BufferSequenceNumber;/* 0x250  8 */
    union {
        unsigned long Flags;/* 0x258  4 */
        struct {
            unsigned long Persistent : 1;/* 0x258:0  4 */
            unsigned long AutoLogger : 1;/* 0x258:1  4 */
            unsigned long FsReady : 1;/* 0x258:2  4 */
            unsigned long RealTime : 1;/* 0x258:3  4 */
            unsigned long Wow : 1;/* 0x258:4  4 */
            unsigned long KernelTrace : 1;/* 0x258:5  4 */
            unsigned long NoMoreEnable : 1;/* 0x258:6  4 */
            unsigned long StackTracing : 1;/* 0x258:7  4 */
            unsigned long ErrorLogged : 1;/* 0x258:8  4 */
            unsigned long RealtimeLoggerContextFreed : 1;/* 0x258:9  4 */
            unsigned long PebsTracing : 1;/* 0x258:10  4 */
            unsigned long PmcCounters : 1;/* 0x258:11  4 */
            unsigned long PageAlignBuffers : 1;/* 0x258:12  4 */
            unsigned long StackLookasideListAllocated : 1;/* 0x258:13  4 */
            unsigned long SecurityTrace : 1;/* 0x258:14  4 */
            unsigned long LastBranchTracing : 1;/* 0x258:15  4 */
            unsigned long SystemLoggerIndex : 8;/* 0x258:16  4 */
            unsigned long StackCaching : 1;/* 0x258:24  4 */
            unsigned long ProviderTracking : 1;/* 0x258:25  4 */
            unsigned long ProcessorTrace : 1;/* 0x258:26  4 */
            unsigned long QpcDeltaTracking : 1;/* 0x258:27  4 */
            unsigned long MarkerBufferSaved : 1;/* 0x258:28  4 */
            unsigned long LargeMdlPages : 1;/* 0x258:29  4 */
            unsigned long ExcludeKernelStack : 1;/* 0x258:30  4 */
            unsigned long SpareFlags2 : 1;/* 0x258:31  4 */
        };/* 0x258  4 */
    };/* 0x258  4 */
    union {
        volatile unsigned long RequestFlag;/* 0x25c  4 */
        struct {
            unsigned long DbgRequestNewFile : 1;/* 0x25c:0  4 */
            unsigned long DbgRequestUpdateFile : 1;/* 0x25c:1  4 */
            unsigned long DbgRequestFlush : 1;/* 0x25c:2  4 */
            unsigned long DbgRequestDisableRealtime : 1;/* 0x25c:3  4 */
            unsigned long DbgRequestDisconnectConsumer : 1;/* 0x25c:4  4 */
            unsigned long DbgRequestConnectConsumer : 1;/* 0x25c:5  4 */
            unsigned long DbgRequestNotifyConsumer : 1;/* 0x25c:6  4 */
            unsigned long DbgRequestUpdateHeader : 1;/* 0x25c:7  4 */
            unsigned long DbgRequestDeferredFlush : 1;/* 0x25c:8  4 */
            unsigned long DbgRequestDeferredFlushTimer : 1;/* 0x25c:9  4 */
            unsigned long DbgRequestFlushTimer : 1;/* 0x25c:10  4 */
            unsigned long DbgRequestUpdateDebugger : 1;/* 0x25c:11  4 */
            unsigned long DbgSpareRequestFlags : 20;/* 0x25c:12  4 */
        };/* 0x25c  4 */
    };/* 0x25c  4 */
    struct _ETW_STACK_TRACE_BLOCK StackTraceBlock;/* 0x260  80 */
    /* ── cacheline 10 boundary (640 bytes) ── */
    struct _RTL_BITMAP HookIdMap;/* 0x2b0  8 */
    struct _ETW_STACK_CACHE* StackCache;/* 0x2b8  4 */
    struct _ETW_PMC_SUPPORT* PmcData;/* 0x2bc  4 */
    /* ── cacheline 11 boundary (704 bytes) ── */
    struct _ETW_LBR_SUPPORT* LbrData;/* 0x2c0  4 */
    struct _ETW_IPT_SUPPORT* IptData;/* 0x2c4  4 */
    struct _LIST_ENTRY BinaryTrackingList;/* 0x2c8  8 */
    struct _WMI_BUFFER_HEADER** ScratchArray;/* 0x2d0  4 */
    struct _DISALLOWED_GUIDS DisallowedGuids;/* 0x2d4  8 */
    struct PERIODIC_CAPTURE_STATE_CONTEXT* PeriodicCaptureStateContext;/* 0x2dc  4 */
    struct _ETW_SOFT_RESTART_CONTEXT* SoftRestartContext;/* 0x2e0  4 */
    struct _ETW_SILODRIVERSTATE* SiloState;/* 0x2e4  4 */
    struct _WORK_QUEUE_ITEM CompressionWorkItem;/* 0x2e8  16 */
    long CompressionWorkItemState;/* 0x2f8  4 */
    struct _EX_PUSH_LOCK CompressionLock;/* 0x2fc  4 */
    /* ── cacheline 12 boundary (768 bytes) ── */
    struct _WMI_BUFFER_HEADER* CompressionTarget;/* 0x300  4 */
    void* CompressionWorkspace;/* 0x304  4 */
    long CompressionOn;/* 0x308  4 */
    unsigned long CompressionRatioGuess;/* 0x30c  4 */
    unsigned long PartialBufferCompressionLevel;/* 0x310  4 */
    enum ETW_COMPRESSION_RESUMPTION_MODE CompressionResumptionMode;/* 0x314  4 */
    struct _SINGLE_LIST_ENTRY PlaceholderList;/* 0x318  4 */
    struct _KDPC CompressionDpc;/* 0x31c  32 */
    /* 4 bytes padding */
    /* ── cacheline 13 boundary (832 bytes) ── */
    union _LARGE_INTEGER LastBufferSwitchTime;/* 0x340  8 */
    union _LARGE_INTEGER BufferWriteDuration;/* 0x348  8 */
    union _LARGE_INTEGER BufferCompressDuration;/* 0x350  8 */
    __int64 ReferenceQpcDelta;/* 0x358  8 */
    struct _ETW_EVENT_CALLBACK_CONTEXT* CallbackContext;/* 0x360  4 */
    union _LARGE_INTEGER* LastDroppedTime;/* 0x364  4 */
    union _LARGE_INTEGER* FlushingLastDroppedTime;/* 0x368  4 */
    /* 4 bytes padding */
    __int64 FlushingSequenceNumber;/* 0x370  8 */
    struct _ETW_PARTITION_CONTEXT PartitionContext;/* 0x378  4 */
    struct _MDL* BufferMdl;/* 0x37c  4 */
};