etwdisk.c File Reference

#include "exttools.h"
#include "etwmon.h"

Go to the source code of this file.

Typedefs
typedef struct _ETP_DISK_PACKET	ETP_DISK_PACKET
typedef struct _ETP_DISK_PACKET *	PETP_DISK_PACKET

Functions
VOID NTAPI	EtpDiskItemDeleteProcedure (_In_ PVOID Object, _In_ ULONG Flags)
BOOLEAN NTAPI	EtpDiskHashtableCompareFunction (_In_ PVOID Entry1, _In_ PVOID Entry2)
ULONG NTAPI	EtpDiskHashtableHashFunction (_In_ PVOID Entry)
VOID NTAPI	ProcessesUpdatedCallback (_In_opt_ PVOID Parameter, _In_opt_ PVOID Context)
	PH_CALLBACK_DECLARE (EtDiskItemAddedEvent)
	PH_CALLBACK_DECLARE (EtDiskItemModifiedEvent)
	PH_CALLBACK_DECLARE (EtDiskItemRemovedEvent)
	PH_CALLBACK_DECLARE (EtDiskItemsUpdatedEvent)
VOID	EtInitializeDiskInformation (VOID)
PET_DISK_ITEM	EtCreateDiskItem (VOID)
PET_DISK_ITEM	EtReferenceDiskItem (_In_ HANDLE ProcessId, _In_ PPH_STRING FileName)
VOID	EtpRemoveDiskItem (_In_ PET_DISK_ITEM DiskItem)
VOID	EtDiskProcessDiskEvent (_In_ PET_ETW_DISK_EVENT Event)
VOID	EtDiskProcessFileEvent (_In_ PET_ETW_FILE_EVENT Event)
PPH_STRING	EtFileObjectToFileName (_In_ PVOID FileObject)
VOID	EtpProcessDiskPacket (_In_ PETP_DISK_PACKET Packet, _In_ ULONG RunId)
ULONG64	EtpCalculateAverage (_In_ PULONG64 Buffer, _In_ ULONG BufferSize, _In_ ULONG BufferPosition, _In_ ULONG BufferCount, _In_ ULONG NumberToConsider)

Variables
BOOLEAN	EtDiskEnabled = FALSE
PPH_OBJECT_TYPE	EtDiskItemType
PPH_HASHTABLE	EtDiskHashtable
PH_QUEUED_LOCK	EtDiskHashtableLock = PH_QUEUED_LOCK_INIT
LIST_ENTRY	EtDiskAgeListHead
PH_FREE_LIST	EtDiskPacketFreeList
SLIST_HEADER	EtDiskPacketListHead
PPH_HASHTABLE	EtFileNameHashtable
PH_QUEUED_LOCK	EtFileNameHashtableLock = PH_QUEUED_LOCK_INIT

Typedef Documentation

typedef struct _ETP_DISK_PACKET ETP_DISK_PACKET

typedef struct _ETP_DISK_PACKET * PETP_DISK_PACKET

Function Documentation

PET_DISK_ITEM EtCreateDiskItem

(

VOID

)

Definition at line 105 of file etwdisk.c.

VOID EtDiskProcessDiskEvent

(

_In_ PET_ETW_DISK_EVENT

Event

)

Definition at line 190 of file etwdisk.c.

VOID EtDiskProcessFileEvent

(

_In_ PET_ETW_FILE_EVENT

Event

)

Definition at line 205 of file etwdisk.c.

PPH_STRING EtFileObjectToFileName

(

_In_ PVOID

FileObject

)

Definition at line 245 of file etwdisk.c.

VOID EtInitializeDiskInformation

(

VOID

)

Definition at line 71 of file etwdisk.c.

ULONG64 EtpCalculateAverage	(	_In_ PULONG64	Buffer,
		_In_ ULONG	BufferSize,
		_In_ ULONG	BufferPosition,
		_In_ ULONG	BufferCount,
		_In_ ULONG	NumberToConsider
	)

Definition at line 364 of file etwdisk.c.

BOOLEAN NTAPI EtpDiskHashtableCompareFunction	(	_In_ PVOID	Entry1,
		_In_ PVOID	Entry2
	)

Definition at line 131 of file etwdisk.c.

ULONG NTAPI EtpDiskHashtableHashFunction

(

_In_ PVOID

Entry

)

Definition at line 142 of file etwdisk.c.

VOID NTAPI EtpDiskItemDeleteProcedure	(	_In_ PVOID	Object,
		_In_ ULONG	Flags
	)

Definition at line 117 of file etwdisk.c.

VOID EtpProcessDiskPacket	(	_In_ PETP_DISK_PACKET	Packet,
		_In_ ULONG	RunId
	)

Definition at line 268 of file etwdisk.c.

VOID EtpRemoveDiskItem

(

_In_ PET_DISK_ITEM

DiskItem

)

Definition at line 181 of file etwdisk.c.

PET_DISK_ITEM EtReferenceDiskItem	(	_In_ HANDLE	ProcessId,
		_In_ PPH_STRING	FileName
	)

Definition at line 151 of file etwdisk.c.

PH_CALLBACK_DECLARE

(

EtDiskItemAddedEvent

)

PH_CALLBACK_DECLARE

(

EtDiskItemModifiedEvent

)

PH_CALLBACK_DECLARE

(

EtDiskItemRemovedEvent

)

PH_CALLBACK_DECLARE

(

EtDiskItemsUpdatedEvent

)

VOID NTAPI ProcessesUpdatedCallback	(	_In_opt_ PVOID	Parameter,
		_In_opt_ PVOID	Context
	)

Definition at line 399 of file etwdisk.c.

Variable Documentation

LIST_ENTRY EtDiskAgeListHead

Definition at line 57 of file etwdisk.c.

BOOLEAN EtDiskEnabled = FALSE

Definition at line 52 of file etwdisk.c.

PPH_HASHTABLE EtDiskHashtable

Definition at line 55 of file etwdisk.c.

PH_QUEUED_LOCK EtDiskHashtableLock = PH_QUEUED_LOCK_INIT

Definition at line 56 of file etwdisk.c.

PPH_OBJECT_TYPE EtDiskItemType

Definition at line 54 of file etwdisk.c.

PH_FREE_LIST EtDiskPacketFreeList

Definition at line 63 of file etwdisk.c.

SLIST_HEADER EtDiskPacketListHead

Definition at line 64 of file etwdisk.c.

PPH_HASHTABLE EtFileNameHashtable

Definition at line 65 of file etwdisk.c.

PH_QUEUED_LOCK EtFileNameHashtableLock = PH_QUEUED_LOCK_INIT

Definition at line 66 of file etwdisk.c.