Process Hacker
clretw.h
Go to the documentation of this file.
1 #ifndef CLRETW_H
2 #define CLRETW_H
3 
4 // Keywords
5 
6 #define CLR_LOADER_KEYWORD 0x8
7 #define CLR_STARTENUMERATION_KEYWORD 0x40
8 
9 // Event IDs
10 
11 #define DCStartComplete_V1 145
12 #define ModuleDCStart_V1 153
13 #define AssemblyDCStart_V1 155
14 #define AppDomainDCStart_V1 157
15 #define RuntimeInformationDCStart 187
16 
17 // Opcodes
18 
19 #define CLR_METHODDC_DCSTARTCOMPLETE_OPCODE 14
20 #define CLR_MODULEDCSTART_OPCODE 35
21 
22 // Bit maps
23 
24 // AppDomainFlags
25 #define AppDomainFlags_Default 0x1
26 #define AppDomainFlags_Executable 0x2
27 #define AppDomainFlags_Shared 0x4
28 
29 // AssemblyFlags
30 #define AssemblyFlags_DomainNeutral 0x1
31 #define AssemblyFlags_Dynamic 0x2
32 #define AssemblyFlags_Native 0x4
33 #define AssemblyFlags_Collectible 0x8
34 
35 // ModuleFlags
36 #define ModuleFlags_DomainNeutral 0x1
37 #define ModuleFlags_Native 0x2
38 #define ModuleFlags_Dynamic 0x4
39 #define ModuleFlags_Manifest 0x8
40 
41 // StartupMode
42 #define StartupMode_ManagedExe 0x1
43 #define StartupMode_HostedCLR 0x2
44 #define StartupMode_IjwDll 0x4
45 #define StartupMode_ComActivated 0x8
46 #define StartupMode_Other 0x10
47 
48 // StartupFlags
49 #define StartupFlags_CONCURRENT_GC 0x1
50 #define StartupFlags_LOADER_OPTIMIZATION_SINGLE_DOMAIN 0x2
51 #define StartupFlags_LOADER_OPTIMIZATION_MULTI_DOMAIN 0x4
52 #define StartupFlags_LOADER_SAFEMODE 0x10
53 #define StartupFlags_LOADER_SETPREFERENCE 0x100
54 #define StartupFlags_SERVER_GC 0x1000
55 #define StartupFlags_HOARD_GC_VM 0x2000
56 #define StartupFlags_SINGLE_VERSION_HOSTING_INTERFACE 0x4000
57 #define StartupFlags_LEGACY_IMPERSONATION 0x10000
58 #define StartupFlags_DISABLE_COMMITTHREADSTACK 0x20000
59 #define StartupFlags_ALWAYSFLOW_IMPERSONATION 0x40000
60 #define StartupFlags_TRIM_GC_COMMIT 0x80000
61 #define StartupFlags_ETW 0x100000
62 #define StartupFlags_SERVER_BUILD 0x200000
63 #define StartupFlags_ARM 0x400000
64 
65 // Templates
66 
67 #include <pshpack1.h>
68 
69 typedef struct _DCStartEnd
70 {
71  USHORT ClrInstanceID;
72 } DCStartEnd, *PDCStartEnd;
73 
74 typedef struct _ModuleLoadUnloadRundown_V1
75 {
76  ULONG64 ModuleID;
77  ULONG64 AssemblyID;
78  ULONG ModuleFlags; // ModuleFlags
79  ULONG Reserved1;
80  WCHAR ModuleILPath[1];
81  // WCHAR ModuleNativePath[1];
82  // USHORT ClrInstanceID;
83 } ModuleLoadUnloadRundown_V1, *PModuleLoadUnloadRundown_V1;
84 
85 typedef struct _AssemblyLoadUnloadRundown_V1
86 {
87  ULONG64 AssemblyID;
88  ULONG64 AppDomainID;
89  ULONG64 BindingID;
90  ULONG AssemblyFlags; // AssemblyFlags
91  WCHAR FullyQualifiedAssemblyName[1];
92  // USHORT ClrInstanceID;
93 } AssemblyLoadUnloadRundown_V1, *PAssemblyLoadUnloadRundown_V1;
94 
95 typedef struct _AppDomainLoadUnloadRundown_V1
96 {
97  ULONG64 AppDomainID;
98  ULONG AppDomainFlags; // AppDomainFlags
99  WCHAR AppDomainName[1];
100  // ULONG AppDomainIndex;
101  // USHORT ClrInstanceID;
102 } AppDomainLoadUnloadRundown_V1, *PAppDomainLoadUnloadRundown_V1;
103 
104 typedef struct _RuntimeInformationRundown
105 {
106  USHORT ClrInstanceID;
107  USHORT Sku;
108  USHORT BclMajorVersion;
109  USHORT BclMinorVersion;
110  USHORT BclBuildNumber;
111  USHORT BclQfeNumber;
112  USHORT VMMajorVersion;
113  USHORT VMMinorVersion;
114  USHORT VMBuildNumber;
115  USHORT VMQfeNumber;
116  ULONG StartupFlags; // StartupFlags
117  UCHAR StartupMode; // StartupMode
118  WCHAR CommandLine[1];
119  // GUID ComObjectGuid;
120  // WCHAR RuntimeDllPath[1];
121 } RuntimeInformationRundown, *PRuntimeInformationRundown;
122 
123 #include <poppack.h>
124 
125 #endif