Consume ETW events with C++ (Part 2)

Raw ETW events give you a timestamp and a process ID. That's not enough. This video shows you how to get to the actual data inside the event. In Part 2 of consuming ETW events with C++, Pavel Yosifovich walks through decoding ETW events with the TDH API: Use TdhGetEventInformation to read event structure at runtime Extract event name, keywords, opcode, task, and level from TRACE_EVENT_INFO Enumerate event properties using TopLevelPropertyCount and EVENT_PROPERTY_INFO Format property values to readable strings with TdhFormatProperty Handle the 32-bit vs 64-bit pointer size flag correctly Full write-up with code on the TrainSec free knowledge library: https://trainsec.net/library/windows-...