ETWP_NOTIFICATION_HEADER

The ETWP_NOTIFICATION_HEADER structure appears to be the kernel’s private variant of the ETW_NOTIFICATION_HEADER. The latter is shared with callers of the NtTraceControl function. They send and receive more or less arbitrary data in packets that begin with the notification header. While the kernel holds a packet in an ETW_QUEUE_ENTRY, it uses some members of the notification header differently—enough differently, it seems, to have prompted a slight renaming. Some of these differences are also known to NTDLL but apparently no higher.

Documentation Status

The ETWP_NOTIFICATION_HEADER structure is not documented.

Layout

The ETWP_NOTIFICATION_HEADER is 0x48 bytes in both 32-bit and 64-bit Windows in versions 6.0 and higher. Whether it or something enough like it exists in versions before 6.0, i.e., before NtTraceControl, is left for another time. Offsets, types and names in the table below are from Microsoft’s symbol files for the kernel starting with Windows 8. No difference is yet known for earlier versions.

ETW_NOTIFICATION_TYPE NotificationType;

ULONG NotificationSize;

LONG RefCount;

BOOLEAN ReplyRequested;

union {
    ULONG ReplyIndex;
    ULONG Timeout;
};

union {
    ULONG ReplyCount;
    ULONG NotifyeeCount;
};

union {
    ULONGLONG ReplyHandle;
    PVOID ReplyObject;
    ULONG RegIndex;
};

ULONG TargetPID;

ULONG SourcePID;

GUID DestinationGuid;

GUID SourceGuid;