ETW - 事件提供者（Event Provider）

<?xml version="1.0" encoding="utf-8"?>
<instrumentationManifest
   xmlns="http://schemas.microsoft.com/win/2004/08/events"
   xmlns:win="http://manifests.microsoft.com/win/2004/08/windows/events"
   xmlns:xs="http://www.w3.org/2001/XMLSchema">
   <instrumentation>
	   <events>
		   <provider name="MyProvider"
					 guid="{xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx}"
					 resourceFileName="MyProvider.dll"
					 messageFileName="MyProvider.dll">
			   <events>
				   <event value="1" version="1" level="win:Informational"
						  channel="win:Application" task="0" opcode="0">
					   <template>
						   <data name="Message" inType="win:UnicodeString" />
					   </template>
				   </event>
			   </events>
		   </provider>
	   </events>
   </instrumentation>
   <localization>
	   <resources culture="en-US">
		   <stringTable>
			   <string id="1" value="MyProvider: %1" />
		   </stringTable>
	   </resources>
   </localization>
</instrumentationManifest>

wpaexporter.exe -i trace.etl -o report.csv -profile CPU

// etwprof.h
PLATFORM_INTERFACE void __cdecl ETWMarkPrintf(_Printf_format_string_ _In_z_ PCSTR pMessage, ...);

PLATFORM_INTERFACE void __cdecl ETWRenderFrameMark();

// Typedefs for use with GetProcAddress
typedef ULONG (__stdcall *tEventRegister)( _In_ LPCGUID ProviderId, _In_opt_ PENABLECALLBACK EnableCallback, _In_opt_ PVOID CallbackContext, _Out_ PREGHANDLE RegHandle);
typedef ULONG (__stdcall *tEventWrite)( _In_ REGHANDLE RegHandle, _In_ PCEVENT_DESCRIPTOR EventDescriptor, _In_ ULONG UserDataCount, _In_reads_opt_(UserDataCount) PEVENT_DATA_DESCRIPTOR UserData);
typedef ULONG (__stdcall *tEventUnregister)( _In_ REGHANDLE RegHandle );

ULONG EVNTAPI EventRegister( _In_ LPCGUID ProviderId, _In_opt_ PENABLECALLBACK EnableCallback, _In_opt_ PVOID CallbackContext, _Out_ PREGHANDLE RegHandle )
{
       if ( g_ETWRegister.m_pEventRegister )
              return g_ETWRegister.m_pEventRegister( ProviderId, EnableCallback, CallbackContext, RegHandle );

       *RegHandle = 0;
       return ERROR_INVALID_FUNCTION;
}

ULONG EVNTAPI EventWrite( _In_ REGHANDLE RegHandle, _In_ PCEVENT_DESCRIPTOR EventDescriptor, _In_ ULONG UserDataCount, _In_reads_opt_(UserDataCount) PEVENT_DATA_DESCRIPTOR UserData )
{
       if ( g_ETWRegister.m_pEventWrite )
              return g_ETWRegister.m_pEventWrite( RegHandle, EventDescriptor, UserDataCount, UserData );
       return ERROR_INVALID_FUNCTION;
}

ULONG EVNTAPI EventUnregister( _In_ REGHANDLE RegHandle )
{
       if ( g_ETWRegister.m_pEventUnregister )
              return g_ETWRegister.m_pEventUnregister( RegHandle );
       return ERROR_INVALID_FUNCTION;
}

class CETWRegister
{
public:
       CETWRegister()
       {

          QueryPerformanceFrequency(&m_frequency);

          // 查找 Advapi32.dll，这应该总是成功的。
          HMODULE pAdvapiDLL = LoadLibraryW(L"Advapi32.dll");
          if (pAdvapiDLL) {
              // 尝试查找 ETW 函数。这在 Windows XP 上会失败。
              m_pEventRegister = (tEventRegister)GetProcAddress(pAdvapiDLL, "EventRegister");
              m_pEventWrite = (tEventWrite)GetProcAddress(pAdvapiDLL, "EventWrite");
              m_pEventUnregister = (tEventUnregister)GetProcAddress(pAdvapiDLL, "EventUnregister");

              // 注册我们的 ETW 提供程序。如果注册失败，则事件日志调用将失败。
              // 在 Windows XP 上，这些调用将不起作用。
              // 在 Vista 及更高版本中，如果这些提供程序已由 xperf 或 logman 启用，
              // 则 *Context 全局变量将被修改如下：
              //     MatchAnyKeyword: 0xffffffffffffffff
              //     IsEnabled: 1
              //     Level: 255
              // 换句话说，完全启用。

              EventRegisterMulti_FrameRate();
              EventRegisterMulti_Main();
              EventRegisterMulti_Worker();
              EventRegisterMulti_Input();

              // 发出主线程的线程 ID。这也表示主提供程序已初始化。
              EventWriteThread_ID(GetCurrentThreadId(), "Main thread");
          }
       }
         ~CETWRegister()
       {
              // Unregister our providers.
              EventUnregisterMulti_Input();
              EventUnregisterMulti_Worker();
              EventUnregisterMulti_Main();
              EventUnregisterMulti_FrameRate();
       }

       tEventRegister m_pEventRegister;
       tEventWrite m_pEventWrite;
       tEventUnregister m_pEventUnregister;

       // QPC frequency
       LARGE_INTEGER m_frequency;

} g_ETWRegister;

#include "stdafx.h"
#include <Windows.h>
#include "ETWProviders\etwprof.h"
#include <future>
#include <string>

__declspec(noinline) void IdleDelay()
{
       Sleep(10);
}

__declspec(noinline) void BusyDelay()
{
       DWORD startTick = GetTickCount();

       for (;;)
       {
              DWORD elapsed = GetTickCount() - startTick;
              if (elapsed > 10)
                      break;
       }
}

int _tmain(int argc, _TCHAR* argv[])
{
  printf("Emitting custom ETW events that can be recorded with etwrecord.bat\n");
	CETWScope timer("main");
	for (int i = 0; i < 40; ++i) {
		ETWMarkPrintf("This is loop %d", i);
		ETWRenderFrameMark();
		// Simulating code that does something.

		IdleDelay();
		BusyDelay();
	}
	return 0;
}