EVENT_INSTANCE_GUID_HEADER

The EVENT_INSTANCE_GUID_HEADER is one of several types of fixed-size header that introduce variable-size data for events that are logged through Event Tracing for Windows (ETW). As with other types of event, those that begin with an EVENT_INSTANCE_GUID_HEADER accumulate first in trace buffers. To have these events persist in this raw form for ready inspection, configure the event tracing session to flush the trace buffers to an Event Trace Log (ETL) file.

Documentation Status

The EVENT_INSTANCE_GUID_HEADER structure is not documented. A C-language definition is published in the NTWMI.H header from some editions of the Windows Driver Kit (WDK) for Windows 10.

Were it not for this relatively recent and possibly unintended disclosure, much but certainly not all would anyway be known from type information in symbol files. Curiously though, type information for this structure has never appeared in any public symbol files for the kernel or for the obvious low-level user-mode DLLs. In the whole of Microsoft’s packages of public symbol files, relevant type information is unknown before Windows 8 and appears in symbol files only for appxdeploymentclient.dll, certenroll.dll (before Windows 10) and windows.storage.applicationdata.dll.

Layout

The EVENT_INSTANCE_GUID_HEADER is 0x48 bytes in both 32-bit and 64-bit Windows in all known versions.

Offset Definition
0x00
USHORT Size;
0x02
union {
    USHORT FieldTypeFlags;
    struct {
        UCHAR HeaderType;
        UCHAR MarkerFlags;
    };
};
0x04
union {
    ULONG Version;
    struct {
        UCHAR Type;
        UCHAR Level;
        USHORT Version;
    } Class;
};
0x08
ULONG ThreadId;
0x0C
ULONG ProcessId;
0x10
LARGE_INTEGER TimeStamp;
0x18
union {
    GUID Guid;
    ULONGLONG GuidPtr;
};
0x28
union {
    struct {
        ULONG ClientContext;
        ULONG Flags;
    };
    struct {
        ULONG KernelTime;
        ULONG UserTime;
    };
    ULONG64 ProcessorTime;
};
0x30
ULONG InstanceId;
0x34
ULONG ParentInstanceId;
0x38
GUID ParentGuid;

The first 4 bytes have common elements in all the various Trace Headers. All have the high two bits set in the MarkerFlags. What distinguishes a header as continuing specifically as an EVENT_INSTANCE_GUID_HEADER is the HeaderType:

Value Name Implied Layout
0x0B TRACE_HEADER_TYPE_INSTANCE32 0x48 bytes of header followed by 32-bit event data
0x15 TRACE_HEADER_TYPE_INSTANCE64 0x48 bytes of header followed by 64-bit event data