Geoff Chappell, Software Analyst
The EVENT_TRACE_VERSION_INFORMATION structure is one of many that the ZwQuerySystemInformation (or NtQuerySystemInformation) function expects in its information buffer when given the information class SystemPerformanceTraceInformation (0x1F). This particular structure is selected when the first dword in the information buffer on input is EventTraceKernelVersionInformation (0x00).
The EVENT_TRACE_VERSION_INFORMATION structure is not documented. Its only known public disclosure by Microsoft is a C-language definition in a header file named NTETW.H from the Enterprise edition of the Windows Driver Kit (WDK) for Windows 10 version 1511.
The EVENT_TRACE_VERSION_INFORMATION is 0x08 bytes in both 32-bit and 64-bit Windows.
The EVENT_TRACE_VERSION_INFORMATION structure is meaningful only as input to and output from one case of the ZwQuerySystemInformation function. The behaviour is as well picked up here. This review takes as understood all the general points and shorthands that are noted in the separate attempt at documenting the function, and takes as granted that the information class is SystemPerformanceTraceInformation and that the information buffer is exactly the size of an EVENT_TRACE_VERSION_INFORMATION in which the EventTraceInformationClass is EventTraceKernelVersionInformation.
The implementation is simply to set the EventTraceKernelversion in the given structure. The function then returns STATUS_SUCCESS.
Known values for EventTraceKernelVersion on output are:
Beware that my holdings of Kernel Versions are limited at best to the formally released service packs and updates, notably the ones that Microsoft considers significant enough for a corresponding release of downloadable packages of symbol files. Comments in NTETW.H, introduced by talk of “The Kernel Event Version”, describe in welcome detail what behaviour is indicated by each advance in the number, though not reliably which increments came with which builds.