etw

type Component interface {
	NewSession(sessionName string) (Session, error)
	NewWellKnownSession(sessionName string) (Session, error)
}

type DDEtwBufferContext struct {
	/*
			the actual struct is defined as
			 union {
		    struct {
		      UCHAR ProcessorNumber;
		      UCHAR Alignment;
		    } DUMMYSTRUCTNAME;
		    USHORT ProcessorIndex;
		  } DUMMYUNIONNAME;
		  USHORT LoggerId;
		  but go doesn't really do unions.  So for now, just put in ProcessorIndex
	*/
	ProcessorIndex uint16
	LoggerID       uint16
}

type DDEventDescriptor struct {
	ID      uint16
	Version uint8
	Channel uint8
	Level   uint8
	Opcode  uint8
	Task    uint16
	Keyword uint64
}

type DDEventHeader struct {
	Size            uint16
	HeaderType      uint16
	Flags           uint16
	EventProperty   uint16
	ThreadID        uint32
	ProcessID       uint32
	TimeStamp       uint64
	ProviderID      DDGUID
	EventDescriptor DDEventDescriptor
	Pad             [8]uint8
	ActivityID      DDGUID
}

type DDEventHeaderExtendedDataItem struct {
	Reserved1 uint16
	ExtType   uint16
	Reserved2 uint16 // is actually 1 bit of linkage and 15 bits of reserved
	DataSize  uint16
	DataPtr   *uint8
}

type DDEventRecord struct {
	EventHeader       DDEventHeader
	BufferContext     DDEtwBufferContext
	ExtendedDataCount uint16
	UserDataLength    uint16
	ExtendedData      *DDEventHeaderExtendedDataItem // this is actually a pointer to the extended data.
	UserData          *uint8
	UserContext       *uint8
}

type DDGUID struct {
	Data1 uint32
	Data2 uint16
	Data3 uint16
	Data4 [8]uint8
}

type EventCallback func(e *DDEventRecord)

type ProviderConfiguration struct {
	// TraceLevel is a value that indicates the maximum level of events that you want the provider to write.
	// The provider typically writes an event if the event's level is less than or equal to this value.
	// See https://learn.microsoft.com/en-us/windows/win32/api/evntrace/nf-evntrace-enabletraceex2
	TraceLevel TraceLevel

	// MatchAnyKeyword is a 64-bit bitmask of keywords that determine the categories of events that you want the
	// provider to write.
	// See https://learn.microsoft.com/en-us/windows/win32/api/evntrace/nf-evntrace-enabletraceex2
	MatchAnyKeyword uint64

	// MatchAllKeyword is a 64-bit bitmask of keywords that restricts the events that you want the provider to write.
	// See https://learn.microsoft.com/en-us/windows/win32/api/evntrace/nf-evntrace-enabletraceex2
	MatchAllKeyword uint64

	// PIDs allow filtering by PIDs if non-empty
	PIDs []uint32
}

type ProviderConfigurationFunc func(cfg *ProviderConfiguration)

type Session interface {
	// ConfigureProvider configures a particular ETW provider identified by its GUID for this session.
	// After calling this function, call EnableProvider to apply the configuration.
	ConfigureProvider(providerGUID windows.GUID, configurations ...ProviderConfigurationFunc)

	// EnableProvider enables the given provider. If ConfigureProvider was not called prior to calling this
	// function, then a default provider configuration is applied.
	EnableProvider(providerGUID windows.GUID) error

	// DisableProvider disables the given provider.
	DisableProvider(providerGUID windows.GUID) error

	// StartTracing starts tracing with the given callback.
	// This function blocks until StopTracing is called.
	StartTracing(callback EventCallback) error

	// StopTracing stops all tracing activities.
	// It's not possible to use the session anymore after a call to StopTracing.
	StopTracing() error
}

type TraceLevel uint8

type UserData interface {
	// ParseUnicodeString reads from the userdata field, and returns the string
	// the next offset in the buffer of the next field, whether the value was found,
	// and if a terminating null was found, the index of that
	ParseUnicodeString(offset int) (string, int, bool, int)

	// GetUint64 reads a uint64 from the userdata field
	GetUint64(offset int) uint64

	// GetUint32 reads a uint32 from the userdata field
	GetUint32(offset int) uint32

	// GetUint16 reads a uint16 from the userdata field
	GetUint16(offset int) uint16

	// Bytes returns the selected slice of bytes
	Bytes(offset int, length int) []byte
	// Length returns the length of the userdata field
	Length() int
}