SYSTEM_REF_TRACE_INFORMATION

The SYSTEM_REF_TRACE_INFORMATION structure is produced as output or expected as input by the functions

• ZwQuerySystemInformation or NtQuerySystemInformation;
• ZwSetSystemInformation or NtSetSystemInformation;

respectively, when given the information class SystemRefTraceInformation (0x56).

Documentation Status

The SYSTEM_REF_TRACE_INFORMATION structure is not documented.

Layout

The SYSTEM_REF_TRACE_INFORMATION is 0x14 or 0x28 bytes in 32-bit and 64-bit Windows, respectively.

BOOLEAN TraceEnable;

BOOLEAN TracePermanent;

UNICODE_STRING TraceProcessName;

UNICODE_STRING TracePoolTags;