EtwExplorer

https://github.com/zodiacon/etwexplorer
Admin
EtwExplorer is a GUI tool for viewing and exploring ETW (Event Tracing for Windows) provider...
Tokens:3,187
Snippets:15
Trust Score:10
License:MIT
Update:6 months ago
Show doc for...
Tokens:
Raw
### Parse Legacy MOF Provider with ManifestParser.ParseWmiEventTraceClass

Source: https://context7.com/zodiacon/etwexplorer/llms.txt

The ParseWmiEventTraceClass method queries the WMI repository for legacy ETW providers using a GUID. It converts the MOF schema into a normalized EtwManifest object.

```csharp
using EtwManifestParsing;
using System;

Guid kernelTraceGuid = new Guid("9e814aad-3204-11d2-9a82-006008a86939");

try {
    EtwManifest manifest = ManifestParser.ParseWmiEventTraceClass(kernelTraceGuid);

    Console.WriteLine($"Provider: {manifest.ProviderName}");
    Console.WriteLine($"GUID: {manifest.ProviderGuid}");
    Console.WriteLine($"Symbol: {manifest.ProviderSymbol}");

    Console.WriteLine("MOF Schema:");
    Console.WriteLine(manifest.Xml);

    Console.WriteLine($"Found {manifest.Events.Length} events");
    Console.WriteLine($"Found {manifest.Keywords.Length} keywords");
    Console.WriteLine($"Found {manifest.Templates.Length} templates");

    foreach (EtwEvent evt in manifest.Events) {
        Console.WriteLine($"Event {evt.Value}: {evt.Symbol} v{evt.Version} (Task: {evt.Task})");
    }
}
catch (ApplicationException ex) {
    Console.WriteLine($"Provider not found in WMI: {ex.Message}");
}
```

--------------------------------

### Manage ETW Event Filtering with Keywords

Source: https://context7.com/zodiacon/etwexplorer/llms.txt

Explains how to list available keywords, construct bitmasks for selective event tracing, and retrieve provider-specific keyword information.

```csharp
using EtwManifestParsing;
using Microsoft.Diagnostics.Tracing.Session;

EtwManifest manifest = ManifestParser.Parse(xmlManifest);

// Display all available keywords
Console.WriteLine("Available Keywords:");
foreach (EtwKeyword keyword in manifest.Keywords) {
    Console.WriteLine($"  {keyword.Name}");
    Console.WriteLine($"    Mask: 0x{keyword.Mask:X16}");
    Console.WriteLine($"    Description: {keyword.Message}");
}

// Build a keyword mask for selective tracing
ulong desiredKeywords = 0;
foreach (EtwKeyword keyword in manifest.Keywords) {
    if (keyword.Name.Contains("Process") || keyword.Name.Contains("Thread")) {
        desiredKeywords |= keyword.Mask;
    }
}
Console.WriteLine($"Combined mask for Process/Thread events: 0x{desiredKeywords:X16}");

// Keywords can also be retrieved directly via TraceEventProviders
var providerKeywords = TraceEventProviders.GetProviderKeywords(manifest.ProviderGuid);
foreach (var info in providerKeywords) {
    Console.WriteLine($"Keyword: {info.Name} = 0x{info.Value:X} ({info.Description})");
}
```

--------------------------------

### Parse and Inspect ETW Provider Metadata with EtwManifest

Source: https://context7.com/zodiacon/etwexplorer/llms.txt

Demonstrates how to parse an ETW manifest from XML and access provider identification, localized string tables, and task/opcode hierarchies.

```csharp
using EtwManifestParsing;
using Microsoft.Diagnostics.Tracing.Parsers;

// Get manifest for a registered system provider
string xml = RegisteredTraceEventParser.GetManifestForRegisteredProvider(
    new Guid("22fb2cd6-0e7b-422b-a0c7-2fad1fd0e716")); // Microsoft-Windows-Kernel-Process

EtwManifest manifest = ManifestParser.Parse(xml);

// Provider identification
Console.WriteLine($"Name: {manifest.ProviderName}");
Console.WriteLine($"GUID: {manifest.ProviderGuid}");
Console.WriteLine($"Symbol: {manifest.ProviderSymbol}");

// Access the raw XML manifest
string rawXml = manifest.Xml;

// Look up localized strings from the string table
string localizedMessage = manifest.GetString("keyword_Process");
Console.WriteLine($"Localized: {localizedMessage ?? "Not found"}");

// String table is also directly accessible
if (manifest.StringTable != null) {
    foreach (var kvp in manifest.StringTable) {
        Console.WriteLine($"  {kvp.Key} = {kvp.Value}");
    }
}

// Tasks contain opcodes specific to each task
foreach (EtwTask task in manifest.Tasks) {
    Console.WriteLine($"Task: {task.Name} (Value: {task.Value})");
    foreach (EtwOpcode opcode in task.Opcodes) {
        Console.WriteLine($"  Opcode: {opcode.Name} = {opcode.Value} ({opcode.Message})");
    }
}
```

--------------------------------

### Analyze ETW Event Descriptors and Templates

Source: https://context7.com/zodiacon/etwexplorer/llms.txt

Shows how to query specific events from a manifest, access their metadata, and inspect associated payload structures via templates.

```csharp
using EtwManifestParsing;
using System.Linq;

EtwManifest manifest = ManifestParser.Parse(xmlManifest);

// Find specific events
EtwEvent processStartEvent = manifest.Events
    .FirstOrDefault(e => e.Symbol == "ProcessStart");

if (processStartEvent != null) {
    Console.WriteLine($"Event ID: {processStartEvent.Value}");
    Console.WriteLine($"Symbol: {processStartEvent.Symbol}");
    Console.WriteLine($"Version: {processStartEvent.Version}");
    Console.WriteLine($"Level: {processStartEvent.Level}");
    Console.WriteLine($"Opcode: {processStartEvent.Opcode}");
    Console.WriteLine($"Keywords: {processStartEvent.Keyword}");
    Console.WriteLine($"Task: {processStartEvent.Task}");
    Console.WriteLine($"Template: {processStartEvent.Template}");

    // Look up the associated template for event payload structure
    EtwTemplate template = manifest.Templates
        .FirstOrDefault(t => t.Id == processStartEvent.Template);

    if (template != null) {
        Console.WriteLine("Event Payload Fields:");
        foreach (EtwTemplateData field in template.Items) {
            Console.WriteLine($"  {field.Name}: {field.Type}");
        }
    }
}

// Filter events by level
var infoEvents = manifest.Events.Where(e => e.Level == "Informational");
var errorEvents = manifest.Events.Where(e => e.Level == "Error");

// Group events by task
var eventsByTask = manifest.Events.GroupBy(e => e.Task);
foreach (var group in eventsByTask) {
    Console.WriteLine($"Task '{group.Key}': {group.Count()} events");
}
```

--------------------------------

### Parse ETW Manifests and List Event Templates (C#)

Source: https://context7.com/zodiacon/etwexplorer/llms.txt

Demonstrates how to parse an ETW manifest XML and iterate through its templates to list field names and types. It also shows how to find events associated with a specific template. Requires the EtwManifestParsing library.

```csharp
using EtwManifestParsing;
using System.Linq;

EtwManifest manifest = ManifestParser.Parse(xmlManifest);

// List all templates and their fields
foreach (EtwTemplate template in manifest.Templates) {
    Console.WriteLine($"Template: {template.Id}");
    Console.WriteLine($"  Fields ({template.Items.Length}):");

    foreach (EtwTemplateData field in template.Items) {
        Console.WriteLine($"    {field.Name}: {field.Type}");
    }
}

// Find events that use a specific template
string templateId = "ProcessStartArgs";
var eventsUsingTemplate = manifest.Events
    .Where(e => e.Template == templateId)
    .ToList();

Console.WriteLine($"Events using template '{templateId}':");
foreach (var evt in eventsUsingTemplate) {
    Console.WriteLine($"  {evt.Symbol} (ID: {evt.Value})");
}

// Common ETW data types in templates:
// UInt8, UInt16, UInt32, UInt64, Int8, Int16, Int32, Int64
// Boolean, Float, Double, GUID, Pointer, SizeT
// UnicodeString, AnsiString, Binary, SID, HexInt32, HexInt64
```

--------------------------------

### Access Registered ETW System Providers (C#)

Source: https://context7.com/zodiacon/etwexplorer/llms.txt

Shows how to enumerate registered ETW providers on a system using Microsoft.Diagnostics.Tracing.TraceEvent. It attempts to retrieve and parse their manifests, handling both XML and MOF-based providers. Requires EtwManifestParsing and Microsoft.Diagnostics.Tracing.TraceEvent libraries.

```csharp
using EtwManifestParsing;
using Microsoft.Diagnostics.Tracing.Parsers;
using Microsoft.Diagnostics.Tracing.Session;
using System;
using System.Collections.Generic;
using System.Linq;

// Get all registered ETW providers on the system
IEnumerable<Guid> publishedProviders = TraceEventProviders.GetPublishedProviders();

Console.WriteLine($"Found {publishedProviders.Count()} registered providers");

foreach (Guid providerGuid in publishedProviders.Take(10)) {
    string providerName = TraceEventProviders.GetProviderName(providerGuid);
    Console.WriteLine($"{providerName}: {providerGuid}");

    try {
        // Attempt to get the full manifest
        string xml = RegisteredTraceEventParser.GetManifestForRegisteredProvider(providerGuid);
        EtwManifest manifest = ManifestParser.Parse(xml);

        Console.WriteLine($"  Events: {manifest.Events.Length}");
        Console.WriteLine($"  Keywords: {manifest.Keywords.Length}");
        Console.WriteLine($"  Templates: {manifest.Templates.Length}");
    }
    catch (ApplicationException) {
        // Provider may be MOF-based or have no manifest
        try {
            EtwManifest manifest = ManifestParser.ParseWmiEventTraceClass(providerGuid);
            Console.WriteLine($"  (MOF Provider) Events: {manifest.Events.Length}");
        }
        catch {
            // Get at least the keywords
            var keywords = TraceEventProviders.GetProviderKeywords(providerGuid);
            Console.WriteLine($"  (Keywords only) Count: {keywords.Count()}");
        }
    }
}
```

--------------------------------

### Parse XML Manifest with ManifestParser.Parse

Source: https://context7.com/zodiacon/etwexplorer/llms.txt

The ManifestParser.Parse method processes XML instrumentation manifests to extract provider metadata. It returns an EtwManifest object containing events, keywords, templates, and localized strings.

```csharp
using EtwManifestParsing;
using System.Xml.Linq;

string manifestXml = @"<?xml version='1.0' encoding='utf-8'?>
<instrumentationManifest xmlns='http://schemas.microsoft.com/win/2004/08/events'>
  <instrumentation>
    <events>
      <provider name='Microsoft-Windows-Kernel-Process'
                guid='{22fb2cd6-0e7b-422b-a0c7-2fad1fd0e716}'
                symbol='KERNEL_PROCESS_PROVIDER'>
        <keywords>
          <keyword name='WINEVENT_KEYWORD_PROCESS' mask='0x10' message='$(string.keyword_Process)'/>
        </keywords>
        <events>
          <event value='1' symbol='ProcessStart' version='0' level='win:Informational'
                 keywords='WINEVENT_KEYWORD_PROCESS' template='ProcessStartArgs'/>
        </events>
        <templates>
          <template tid='ProcessStartArgs'>
            <data name='ProcessID' inType='win:UInt32'/>
            <data name='ImageFileName' inType='win:AnsiString'/>
          </template>
        </templates>
      </provider>
    </events>
  </instrumentation>
  <localization>
    <resources culture='en-US'>
      <stringTable>
        <string id='keyword_Process' value='Process'/>
      </stringTable>
    </resources>
  </localization>
</instrumentationManifest>";

EtwManifest manifest = ManifestParser.Parse(manifestXml);

Console.WriteLine($"Provider: {manifest.ProviderName}");
Console.WriteLine($"GUID: {manifest.ProviderGuid}");
Console.WriteLine($"Symbol: {manifest.ProviderSymbol}");

foreach (EtwEvent evt in manifest.Events) {
    Console.WriteLine($"Event {evt.Value}: {evt.Symbol} (Level: {evt.Level}, Opcode: {evt.Opcode})");
}

foreach (EtwKeyword keyword in manifest.Keywords) {
    Console.WriteLine($"Keyword: {keyword.Name}, Mask: 0x{keyword.Mask:X}, Message: {keyword.Message}");
}

foreach (EtwTemplate template in manifest.Templates) {
    Console.WriteLine($"Template: {template.Id}");
    foreach (EtwTemplateData item in template.Items) {
        Console.WriteLine($"  - {item.Name}: {item.Type}");
    }
}
```
Tokens:
Raw