jdu2600

{
  "Providers": [
    {
      "ProviderGUID": "0f51c5a7-0e76-47a5-bede-7cf62c5822f6",
      "ProviderName": "Microsoft.Windows.Kernel.HAL",
      "ProviderGroupGUID": "4f50731a-89cf-4782-b3e0-dce8c90476ba"
    },
    {
      "ProviderGUID": "74093e1d-dbe3-4019-b97d-54edcb02cfed",
      "ProviderName": "Microsoft.Windows.FileSystem.Cache",

jdu2600

<instrumentationManifest xmlns="http://schemas.microsoft.com/win/2004/08/events">
  <instrumentation xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:win="http://manifests.microsoft.com/win/2004/08/windows/events">
    <events>
      <provider name="Microsoft-Windows-DNSServer" guid="{eb79061a-a566-4698-9119-3ed2807060e7}" resourceFileName="Microsoft-Windows-DNSServer" messageFileName="Microsoft-Windows-DNSServer" symbol="MicrosoftWindowsDNSServer" source="Xml">
        <keywords>
          <keyword name="QUERY_RECEIVED" message="$(string.keyword_QUERY_RECEIVED)" mask="0x1" />
          <keyword name="RESPONSE_SUCCESS" message="$(string.keyword_RESPONSE_SUCCESS)" mask="0x2" />
          <keyword name="RESPONSE_FAILURE" message="$(string.keyword_RESPONSE_FAILURE)" mask="0x4" />
          <keyword name="IGNORED_QUERY" message="$(string.keyword_IGNORED_QUERY)" mask="0x8" />
          <keyword name="RECURSE_QUERY_OUT" message="$(string.keyword_RECURSE_QUERY_O

jdu2600

<instrumentationManifest xmlns="http://schemas.microsoft.com/win/2004/08/events">
  <instrumentation xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:win="http://manifests.microsoft.com/win/2004/08/windows/events">
    <events>
      <provider name="Microsoft-Windows-DotNETRuntime" guid="{e13c0d23-ccbc-4e12-931b-d9cc2eee27e4}" resourceFileName="Microsoft-Windows-DotNETRuntime" messageFileName="Microsoft-Windows-DotNETRuntime" symbol="MicrosoftWindowsDotNETRuntime" source="Xml">
        <keywords>
          <keyword name="GCKeyword" message="$(string.keyword_GCKeyword)" mask="0x1" />
          <keyword name="GCHandleKeyword" message="$(string.keyword_GCHandleKeyword)" mask="0x2" />
          <keyword name="FusionKeyword" message="$(string.keyword_FusionKeyword)" mask="0x4" />
          <keyword name="LoaderKeyword" message="$(string.keyword_LoaderKeyword)" mask="0x8" />
          <keyword name="JitKeyword" message="$(string.keyword_JitKeyword)" mask="0x10"

jdu2600

[dynamic: ToInstance, Description(".NET Common Language Runtime"), Guid("{e13c0d23-ccbc-4e12-931b-d9cc2eee27e4}"), locale("MS\0x409")]
class CLRTrace : EventTrace
{
};

[dynamic: ToInstance, Description("CLR StrongNameVerification"), Guid("{15447A14-B523-46ae-B75B-023F900B4393}"), DisplayName("CLR StrongNameVerification"), locale("MS\0x409")]
class CLRStrongNameVerification : CLRTrace
{
};

jdu2600

[dynamic: ToInstance, Description("Windows Kernel Trace"), Guid("{9e814aad-3204-11d2-9a82-006008a86939}"), LOCALE("ms_409")]
class MSNT_SystemTrace : EventTrace
{
	[Description("Enable Flags"),
	 ValueDescriptions{"Process creations/deletions", "Thread creations/deletions", "Image load", "Process counters", "Context switches", "Deferred procedure calls", "Interrupts", "System calls", "Disk IO", "File details", "Disk IO entry", "Dispatcher operations", "Page faults", "Hard page faults", "Virtual memory allocations", "Network TCP/IP", "Registry details", "ALPC", "Split IO", "Driver delays", "Sample based profiling", "File IO completion", "File IO"},
	 DefineValues{"EVENT_TRACE_FLAG_PROCESS", "EVENT_TRACE_FLAG_THREAD", "EVENT_TRACE_FLAG_IMAGE_LOAD", "EVENT_TRACE_FLAG_PROCESS_COUNTERS", "EVENT_TRACE_FLAG_CSWITCH", "EVENT_TRACE_FLAG_DPC", "EVENT_TRACE_FLAG_INTERRUPT", "EVENT_TRACE_FLAG_SYSTEMCALL", "EVENT_TRACE_FLAG_DISK_IO", "EVENT_TRACE_FLAG_DISK_FILE_IO", "EVENT_TRACE_FLAG_DISK_IO_INIT", "EVENT_TRACE_FLAG_DISPA

jdu2600

using System;
using Microsoft.Diagnostics.Tracing.Session;
using Microsoft.Diagnostics.Tracing.Parsers.Kernel;
using Microsoft.Diagnostics.Tracing.Parsers;

namespace SysCallAddress
{
    class Program
    {
        static void Main(string[] args)