MZ@ !L!This program cannot be run in DOS mode. $Rؕ3}3}3}H̴3}H̱3}Rich3}PEL!  l1@k.rsrcpl@@p0H  8Phx(@Xp 0@P`x6!r`%t* P6H; E8M XRxU5htfMUI COUNTERS.XSD EVENTS.XSD WINMETA.XMLYL<ގ]hΩR`a(PG MUIzh-CN ~b N0R: %1 0(WW[&{2Nh %1 -N~b N0R MessageId0c[N͑ YvW[&{2N ID: %1 0%V:NcO z^ %1 v^\'` resourceFileName /f_^\'`0$V:NcO z^ %1 v^\'` messageFileName /f_^\'`0l gmo`eN T elc[cO z^ %1 SpeeN T0c[N͑ YvcO z^ Ty: %1 0cO z^ %2 -Nv͑ YcO z^ GUID %1 0c[N͑ YvcO z^&{S: %1 0,:N~+R %2 c[NeHev

agv>f_c[W[&{2N ID0\c[N͑ Yvmo` ID - 0x%1!x!0S_ꁨRubv messageId NO(u <messageTable> b .mc eNfnxc[v messageId QzeOSudk0O(uN͑ Yv[{ hV&{S: %1 00$N*N[{ hVwQ gv Tv ID:%1!u!(0x%1!x!) THr,g:%2!u!(0x%2!x!)0*[N TId :N %1 v!jg NAQO(u UserData V:N[/fN*N[{ hV!jg0*[N TId :N %2 v!jgv^\'` %1 NAQO(u~g V:N[/fN*N[{ hV!jg0*[N TId :N %2 v!jgv^\'` %1 NAQO(u5R V:N[/fN*N[{ hV!jg0PA#[N TId :N %1 v!jg NAQO(u f\ V:N[/fN*N[{ hV!jg0,TId :N %2 v!jgv^\'` %1 ^\'` outType V:N[/fN*N[{ hV!jg0O(uN͑ Yv[{ hV Ty: %1 0 T:N %1 vSCQ }:\_^\'` "chid"0-[NS %1 ^\'` "access" v

CQ }_(uN NX[(Wv <string> agv: %1 0)$N*N <message> agvck(W_(uv Tv <string> agv: '%1 0$[N TId :N %1 v!jg SAQO(uN*N <binary> CQ }0$N*N <message> agvwQ gv Tv MId: %1 0:[N ID :N %2!u!(0x%2!x!) vNN %1 ^\'` message /f_v V:N[U_0R{tS0J[N ID :N %2!u!(0x%2!x!) vNN %1 _{c[~+Rv^N^/f sQ. 0  0 fJT b Oo` KNN V:N[U_0R{tS0$N*N <message> agvwQ gv Tv&{S: %1 0instrumentation p"N1YbMONv}T Tzz0)[N <data> CQ } %1  %2 vMR N(W winmeta }T Tzz-N0[[N ID :N %1!u!(0x%1!x!)v <counter> CQ }((W <counterSet> %2 N) NAQO(u^\'` "field" V:NcO z^/f userMode0PA[[N ID :N %1!u!(0x%1!x!)v <counter> CQ }((W <counterSet> %2 N) ^\'` "struct" V:NcO z^/f kernelMode0Z[N ID :N %1!u!(0x%1!x!)v <counter> CQ }((W <counterSet> %2 N) ^\'` "field" V:NcO z^/f kernelMode0M[N <counterSet> CQ } %1 ((W <provider> %2 N) P[CQ } <structs> V:NcO z^/f kernelMode0N[N <counterSet> CQ } %1 ((W <provider> %2 N) NAQO(uP[CQ } <structs> V:NcO z^/f userMode0-[N <provider> CQ } %1 ^\'`&{S V:NcO z^/f userMode02[N <provider> CQ } %1 NAQO(u^\'`&{S V:NcO z^/f kernelMode0Z[N ID :N %1!u!(0x%1!x!)v <counter> CQ }((W <counterSet> %2 N) "ID" N'YN 63 V:NcO z^/f kernelMode0f[N ID :N %1!u!(0x%1!x!)v <counter> CQ }((W <counterSet> %2 N) NAQO(u^\'` "aggregate" V:N6r counterSet gUS*NbY*N[O0[N <counterSet> %2 N ID :N %1!u!(0x%1!x!)v <counter> CQ } ^\'` "baseID"0 Nb/f baseID vpehV{|WSvQWpehVv_{|WvRh: perf_average_bulk perf_average_timer W{|W: perf_average_base perf_100nsec_multi_timer perf_100nsec_multi_timer_inv perf_counter_multi_timer perf_counter_multi_timer_inv W{|W: perf_counter_multi_base perf_raw_fraction W{|W: perf_raw_base perf_large_raw_fraction perf_precision_system_timer perf_precision_100ns_timer W{|W: perf_large_raw_base perf_sample_fraction W{|W: perf_sample_base  NAQW[&{2Nh_(u0L]eQW[&{2N %1 v p"N1YbMONv}T Tzz0<events> p_{X[(WN <instrumentation> p N v^^MONN N}T Tzz: "http://schemas.microsoft.com/win/2004/08/events"0>[N^\'` %1 inType _{/f UInt80UInt160UInt32 b HexInt32 KNN V:Nc[N f\0B[N^\'` %1 ^\'`pe_(uv^\'` %2 v inType _{:N UInt80UInt160UInt32 b HexInt320[N^\'` %1 ^\'`pe_(uv^\'` %2 N g^\'`pe0B[N^\'` %1 ^\'`^_(uv^\'` %2 v inType _{:N UInt80UInt160UInt32 b HexInt320[N^\'` %1 ^\'`^_(uv^\'` %2 N g^\'`^0K[N ID :N %2!u!(0x%2!x!) vNN %1 NNmo`-NvN*N^\'`ceQck(W_(uN*N NX[(Wv^\'`0NNN g %3!u! ^\'`: %4 05[N ID :N %2!u!(0x%2!x!) vNN %1 ^\'`ceQ-N NAQO(u"0"<"0"&"0"|"0"\"0"'"0":"0"*" T "?"0!cO z^ Tyv^_{NN 1 0R 256 *NW[&{KN: %1 0WeHevcO z^ Ty: %10cO z^ Ty-N NAQ gN NW[&{: <31 v ascii "0"<"0"&"0"|"0"\"0"'"0":"0"*" T "?"0 n b1Y%0 n b}T Tzz1Y%0\Ջ㉐geN %1 1Y% v^Nh"}EeSV1Y%0N msxml 6e0R*gw 0x%1!x!0dkCQ }1u %1!u! vQNCQ }_(u0(W RdCQ }MRHQ Rd_(u0c[ f\v Ty0[N <counterSet> %2 N ID :N %1!u!(0x%1!x!)v <counter> CQ } ^\'` "perfTimeID" T "perfFreqID" v^NُN^\'`@b_(upehVv{|W^^\N perf_counter_large_rawcount0dkĉR(uN NRpehV{|W: perf_counter_obj_time_queuelen_type perf_obj_time_timer perf_elapsed_time perf_precision_object_timer [N <counterSet> %2 N ID :N %1!u!(0x%1!x!)v <counter> CQ } ^\'` "multiCounterID" v^N^\'`@b_(upehVv{|W^^\N perf_counter_rawcount0dkĉR(uN NRpehV{|W: perf_counter_multi_timer perf_counter_multi_timer_inv perf_100nsec_multi_timer perf_100nsec_multi_timer_inv O$N*NcO z^[INNwQ gv T Ty %1 vS0N*N~[S TyS1uN*NcO z^eg[IN vQNcO z^^O(u <importChannel> CQ }_(us gS0D$N*NbY*NU_0Re |~ 0 [hQ b ^(u z^ SvNNck(WS TN*Nmo`W[&{2N %1 0:Nk*Ndk{|NNRMN*N/UNvmo`W[&{2N0_(W .mc eN-N:NW[&{2N %1 RM ID %2!u!(0x%2!x!)0\dkW[&{2Nv ID f9e:NSdkW[&{2NvNNv ID V:Nck(W\dkNNU_0R |~ 0 [hQ b ^(u z^ S0gO(u <message> CQ }:NW[&{2N %1 >f_RM ID %2!u!(0x%2!x!)0\dkW[&{2Nv ID f9e:NSdkW[&{2NvNNv ID V:Nck(W\dkNNU_0R |~ 0 [hQ b ^(u z^ S0B[N ID :N %2!u!(0x%2!x!) vNN %1 1uNd\ONx %3 (WNR %4 ,g0W VdkNN_{SNR %4 0A[N ID :N %2!u!(0x%2!x!) vNN %1 =\{d\ONx %3 (WNR %4 ,g0W FONNck(WSNR %5 0O[N ID :N %2!u!(0x%2!x!) vNN %1 d\ONx %3 :NhQ@\Nx NvQ CQ } N:\^\'` ID 0[N ID :N %1 vW[&{2N :\^\'` value 0O(uN͑ YpehV~g Ty: %1 0K[N <counterSet> %2 N ID :N %1!u!(0x%1!x!) v <counter> CQ } BaseId

 %2 N ID :N %1!u!(0x%1!x!) v <counter> CQ } PerfTimeId

 %2 N ID :N %1!u!(0x%1!x!) v <counter> CQ } PerfFreqId

 %2 N ID :N %1!u!(0x%1!x!) v <counter> CQ } MultiCounterId

 %2 N ID :N %1!u!(0x%1!x!) v <counter> CQ } NAQ[勡pehV{|WO(u BaseId0P[N <counterSet> %2 N ID :N %1!u!(0x%1!x!) v <counter> CQ } NAQ[勡pehV{|WO(u PerfTimeId0P[N <counterSet> %2 N ID :N %1!u!(0x%1!x!) v <counter> CQ } NAQ[勡pehV{|WO(u PerfFreqId0T[N <counterSet> %2 N ID :N %1!u!(0x%1!x!) v <counter> CQ } NAQ[勡pehV{|WO(u MultiCounterId0elSggHr,g0ُS/f1uN NRSVKNN: 1. <counters> p"N1Yb@b(Wv}T Tzz Ncknx0 2. <counters> pl g schemaVersion ^\'`0 3. schemaVersion ^\'` CQ } N NAQ resourceBase ^\'`0a[N CounterSet %1 c[Nv nameID %2!u!(0x%2!x!)0 nameID ^\'` N_{/fhQ@\/UNv^\'`0SY eN-NvDn ID _{hQ/fGYpebhQ/fvPpe0o[N CounterSet %1 c[Nv descriptionID %2!u!(0x%2!x!)0 descriptionID ^\'` N_{/fhQ@\/UNv^\'`0SY eN-NvDn ID _{hQ/fGYpebhQ/fvPpe0^[N Counter %1 c[Nv nameID %2!u!(0x%2!x!)0 nameID ^\'` N_{/fhQ@\/UNv^\'`0SY eN-NvDn ID _{hQ/fGYpebhQ/fvPpe0l[N Counter %1 c[Nv descriptionID %2!u!(0x%2!x!)0 descriptionID ^\'` N_{/fhQ@\/UNv^\'`0SY eN-NvDn ID _{hQ/fGYpebhQ/fvPpe0NR %1 vNRmo`eHe0NRmo`-N NAQO(uceQW[&{2N0 NR %1 vd\Oxmo`eHe0d\Oxmo`-N NAQO(uceQW[&{2N0NR %1 vSmo`eHe0Smo`-N NAQO(uceQW[&{2N0 NR %1 vsQ.W[mo`eHe0sQ.W[mo`-N NAQO(uceQW[&{2N0x4VS_VERSION_INFO@%@%?StringFileInfo080404B0LCompanyNameMicrosoft Corporation< FileDescriptionNNߍ*.^R z^^r)FileVersion6.3.9600.16384 (winblue_rtm.130821-1623)0InternalNametdh.dll.LegalCopyright Microsoft Corporation. All rights reserved.@ OriginalFilenametdh.dll.muij%ProductNameMicrosoft Windows Operating SystemBProductVersion6.3.9600.16384DVarFileInfo$Translation Hex 1-8 digits in size Hex 1-8 digits in size or unsignedInt A Valid C Symbol or an empty string Only five counterAttribute elements allowed, they should all be unique. schemaVersion >= 2.0 时需要此属性。 名称字符串的资源 ID。schemaVersion >= 2.0 时需要此属性,但较旧的版本不允许此属性。 schemaVersion >= 2.0 时需要此属性。 描述字符串的资源 ID。schemaVersion >= 2.0 时需要此属性,但较旧的版本不允许此属性。 If providerType=userMode, required. If providerType=kernelMode, not allowed. If providerType=userMode, required. If providerType=kernelMode, not allowed. If providerType=userMode, required. If providerType=kernelMode, not allowed. 名称字符串的资源 ID。schemaVersion >= 2.0 时需要此属性,但较旧的版本不允许此属性。 描述字符串的资源 ID。schemaVersion >= 2.0 时需要此属性,但较旧的版本不允许此属性。 Provider Symbol is required for User Mode providers. schemaVersion >= 2.0 时不允许此属性。 Counter Set GUID should be unique across the entire document. The counter set registration fails if the GUID is already registered. To update a counter set that is registered, you must first uninstall the counter set and register it again. PA A globally unique identifier in Registry format. e.g. {12345678-4321-ABCD-1234-9ABCDEF012345678}. Use GUIDGen.exe or UUIDGen.exe to create a GUID. Symbol is used for code-generation. It should be a valid C Symbol or an empty string. 用于在命名空间上生成的代码应该是有效的 C++ 符号。 即: Namespace1._Namespace2.Namespace2 Hex 1-2 digits in size Hex 1-4 digits in size Hex 1-8 digits in size Hex 1-16 digits in size. Hex 1-2 digits in size or unsignedByte Hex 1-4 digits in size or unsignedShort UnsignedInt or Hex 1-8 digits in size. Hex 1-16 digits in size or unsignedLong Length property name string or unsignedShort Count property name string or unsignedShort Value of this attribute should be of the form $(string.stringTableId), where stringTableId is the 'id' attribute of a <string> element defined in the <stringTable> section. Or it could be of the form $(mc.mcSymbolId), where mcSymbolId is the symbol of a message string defined in a .mc file. A fully-qualified path to a file. Standard Windows environment variables are allowed. Typically, the file is of type .exe, .dll, or .sys. Each keyword must have a unique name, which is used to reference the keyword from the events section of the manifest. Mask is a 64-bit value, in which, only one bit is set. Mask value cannot be zero. Leftmost 16 bits of the mask are reserved for use by winmeta.xml. Use keywords to group events together. At run-time, it is possible to enable events belonging to only certain groups (i.e. keywords). This is one way to filter out unwanted events at the time of logging. Use opcodes, in conjunction with a task, to describe different milestones within an activity. Use levels to control the verbosity of events during logging. At run-time, a provider can be enabled with a certain level value, and only events with a level value less than or equal to the specified value will get logged. Use tasks to describe an activity. Use opcodes to describe each unit of work within an activity. Channel logging config Channel publishing config Amount of memory allocated for the session buffers (KB) Number of etl files to create across enablement Minimum number of session buffers Maximum number of session buffers Buffer flush interval (sec) Clock resolution Default publishing session/security if not specified explicitly by the channel access attribute. Use channels to describe the destinations for your events. Each channel you define here will show up in the Windows Event Viewer. Represents binary data in classic eventlog API Use templates to describe the payload logged by an event. Different events can share a template. Also referred to as the Event-Id. An ETW event is uniquely identified by the {Provider-Guid,Event-Id,Event-Version} tuple. Reference to a <level> element defined in the <levels> section. Refer to a level by its attribute 'name'. It is advisable to increment the version of an event if its template is modified between releases. Use this to indicate that this event has been removed and will not be logged by this version of the provider. The description of the event should be retained in this manifest so that if an etl file collected from an older version of the provider on a different machine is brought to this machine, it can be correctly decoded on this machine. 使用此属性可指示与此事件相关的模板是否包含 有效的 WinRT 类型,即,该事件负载字段可以来自投影 的 WinRT 方法的参数。如果承载该提供程序的该组件 不是使用 WinRT 投影 API 记录该事件,则忽略此属性。 List all events logged by the provider in this section. Name of the executable file to which the provider's metadata resource is linked, usually the same as the provider's binary. Name of the executable file to which the provider's localizable message resource is linked, usually the same as the provider's binary. Events for Classic ETW tracing. Events for all installed system services. This channel is secured to applications running under system service accounts or user applications running under local adminstrator privileges. Events for all user-level applications. This channel is not secured and open to any applications. Applications which log extensive information should define an application-specific channel. The Windows Audit Log. For exclusive use of the Windows Local Security Authority. User events may appear as audits if supported by the underlying application. Log Always Only critical errors All errors, includes win:Critical All warnings, includes win:Error All informational content, including win:Warning All tracing, including previous levels undefined task An informational event An activity start event An activity end event A trace collection start event A trace collection end event An extensional event A reply event An event representing the activity resuming from the suspension An event representing the activity is suspended, pending another activity's completion An event representing the activity is transferred to another component, and can continue to work An event representing receiving an activity transfer from another component Wild card value Attached to all events providing response time information Attached to all WDI context events Attached to all WDI diag events Attached to all SQM events Attached to all failed security audits Attached to all successful security audits Attached to transfer events where the related Activity ID is a computed value and not a GUID Attached to events raised using classic eventlog API A NULL-terminated UNICODE string. A NULL-terminated ANSI string. A signed 8-bit integer. An unsigned 8-bit integer. An integer in hex format A signed 16-bit integer. An unsigned 16-bit integer An integer in hex format A signed 32-bit integer. A message string corresponding to system HResult error code. An unsigned 32-bit integer. Deprecated, same as win:HexInt32. A message string corresponding to system win32 error code. A message string corresponding to system NTSTATUS error code. An integer in hex format A signed 64-bit integer. An unsigned 64-bit integer. An integer in hex format An IEEE 4-byte floating-point value An IEEE 8-byte floating-point value A 32-bit value where 0 is false, 1 is true. Variable size binary data. A DCE-compliant 128-bit UUID. XML spec: {12345678-1234-4667-1234-123456789abc} A pointer; sized to the current platform (32-bit or 64-bit). XML spec: hex representation of a pointer A Windows FILETIME struct. DateTime string without any marker related with culture. Ex) Left-To-Right A Windows SYSTEMTIME struct. DateTime string without any marker related with culture. Ex) Left-To-Right A self-relative Windows SID structure. XML spec: S-1-0-0. A hexidecimal representation of an unsigned 32-bit integer. Deprecated, same as win:HexInt32. A message string corresponding to system win32 error code. A message string corresponding to system NTSTATUS error code. A hexidecimal representation of an unsigned 64-bit integer. PAPADDINGXXPADDING