2.17. ETW – Event Tracing for Windows

The EtwManager instance is accessible via windows.system.etw

Note

This code is the result of my research on ETW that lead to this presentation ETW for the lazy reverser (FR)

Note

See sample ETW (Event Tracing for Windows)

2.17.1. EtwManager

class windows.winobject.event_trace.EtwManager

An object to query ETW session/providers and open new trace

open_trace(name=None, logfile=None, guid=None)

Open a new ETW Trace

Returns:EtwTrace

providers

The list of currently existing ETW providers.

Type:[TraceProvider] – A list of ETW providers

sessions

The list of currently active ETW session.

Type:[EventTraceProperties] – A list of EventTraceProperties

2.17.2. Tracing Events

2.17.2.1. EtwTrace

class windows.winobject.event_trace.EtwTrace(name, logfile=None, guid=None)

Represent an ETW Trace for tracing/processing events

enable(guid, flags=255, level=255)

Enable the specified event trace provider.

enable_ex(guid, flags=255, level=255, any_keyword=4294967295L, all_keyword=0)

Enable the specified event trace provider.

exists()

Return True if the trace already exist (based on its name)

flush()

Flush the trace

guid = None

The guid of the trace

logfile = None

The logging file of the trace (None means real time trace)

name = None

The name of the trace

process(callback, begin=None, end=None, context=None)

Process the event retrieved by the trace. This function will call callback with any EventRecord in the trace. begin/end allow to filter and only process events in a given timeframe.

Warning

If the trace if REALTIME (no logfile) this function will hang/process new event until the trace is stopped.

Using logman -ets stop TRACE_NAME for exemple.

start(flags=0, mode=0)

Start the tracing

stop(soft=False)

stop the tracing.

soft will allow to stop a non-existing trace that do not exists/run. This allow for simpler script that stop/start some EtwTrace.

2.17.2.2. EventTraceProperties

class windows.winobject.event_trace.EventTraceProperties

Represent an Event Trace session that may exist or now. (https://docs.microsoft.com/en-us/windows/win32/api/evntrace/ns-evntrace-event_trace_properties)

This class is widly used by EtwTrace

classmethod create()

Initialize a new EventTraceProperties

guid

The GUID of the Event Trace session (see Wnode.Guid)

id

The LoggerId if the session (see Wnode.HistoricalContext)

logfile

The logfile associated with the session

name

The name of the session

2.17.2.3. EventRecord

class windows.winobject.event_trace.EventRecord

guid

Guid of the Event

id

ID of the Event

pid

Process ID that provided the event

tid

Thread ID that provided the event

user_data

Event specific data

Type:str