The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.
Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/
i want to generate etl trace log file programmatically (rather than starting and stopping the trace using tools like tracelog) in my kernel mode driver application. For this i tried using WPP trace macros WP_INIT_TRACING, WPP_CLEANUP and DoTraceMessage. To control the start/stop of trace session programmatically, i wanted to use StartTrace, ControlTrace, EnableTraceEx2 APIs. They use EVENT_TRACE_PROPERTIES structure. When i try to use EVENT_TRACE_PROPERTIES structure in my driver code, it is somehow disabled. i included the header file <evntrace.h>. when i check this header file there is a define
The structure is guarded by this macro.
and this structure is disabled(greyed out), and the reason is probably _EVNTRACE_KERNEL_MODE is defined in driver application i believe.
are the APIs StartTrace, EnableTraceEx2, ControlTrace not meant to be used in kernel mode driver ?
|Upcoming OSR Seminars|
|OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!|
|Kernel Debugging||13-17 May 2024||Live, Online|
|Developing Minifilters||1-5 Apr 2024||Live, Online|
|Internals & Software Drivers||11-15 Mar 2024||Live, Online|
|Writing WDF Drivers||26 Feb - 1 Mar 2024||Live, Online|