2: kd> !wmitrace.strdump
(WmiTrace) StrDump Generic
LoggerContext Array @ 0xFFFF890F32295398 [64 Elements]
Logger Id 0x02 @ 0xFFFF890F38BF0A80 Named 'Circular Kernel Context Logger'
Logger Id 0x03 @ 0xFFFF890F325B7B40 Named 'Eventlog-Security'
Logger Id 0x04 @ 0xFFFF890F324AAB40 Named 'AppModel'
Logger Id 0x05 @ 0xFFFF890F324A9300 Named 'Audio'
Logger Id 0x06 @ 0xFFFF890F37503340 Named 'ScreenOnPowerStudyTraceSession'
Logger Id 0x07 @ 0xFFFF890F32499480 Named 'DefenderApiLogger'
Logger Id 0x08 @ 0xFFFF890F325D1040 Named 'DefenderAuditLogger'
Logger Id 0x09 @ 0xFFFF890F325D0040 Named 'DiagLog'
Logger Id 0x0a @ 0xFFFF890F325CF040 Named 'EventLog-Application'
Logger Id 0x0b @ 0xFFFF890F325B6040 Named 'EventLog-System'
Logger Id 0x0c @ 0xFFFF890F32676980 Named 'FaceRecoTel'
Logger Id 0x0d @ 0xFFFF890F32675980 Named 'FaceUnlock'
Logger Id 0x0e @ 0xFFFF890F32674980 Named 'LwtNetLog'
Logger Id 0x0f @ 0xFFFF890F326724C0 Named 'NtfsLog'
Logger Id 0x10 @ 0xFFFF890F38C66040 Named '8696EAC4-1288-4288-A4EE-49EE431B0AD9'
Logger Id 0x11 @ 0xFFFF890F32668980 Named 'UBPM'
Logger Id 0x12 @ 0xFFFF890F32666B40 Named 'WdiContextLog'
Logger Id 0x13 @ 0xFFFF890F32664B40 Named 'WiFiSession'
Logger Id 0x14 @ 0xFFFF890F3640B740 Named 'SleepStudyTraceSession'
Logger Id 0x15 @ 0xFFFF890F36AE5040 Named 'UserNotPresentTraceSession'
Logger Id 0x16 @ 0xFFFF890F386334C0 Named 'WindowsUpdate_trace_log'
Logger Id 0x17 @ 0xFFFF890F370CB2C0 Named 'WFP-IPsec Diagnostics'
Logger Id 0x18 @ 0xFFFF890F37DA53C0 Named 'SHS-09292017-224320-3-1'
Logger Id 0x19 @ 0xFFFF890F37279740 Named 'Diagtrack-Listener'
Logger Id 0x1a @ 0xFFFF890F37318B00 Named 'MpWppTracing-09292017-224321-00000003-ffffffff'
2: kd> dt nt!_WMI_LOGGER_CONTEXT 0xFFFF890F38BF0A80
+0x000 LoggerId : 2
+0x004 BufferSize : 0x1000
+0x008 MaximumEventSize : 0xfb8
+0x00c LoggerMode : 0x2800480
+0x010 AcceptNewEvents : 0n0
+0x014 EventMarker : [2] 0xc0130000
+0x01c ErrorMarker : 0xc00d0000
+0x020 SizeMask : 0xffff
+0x028 GetCpuClock : 0xfffff803`065017e0 int64 nt!EtwpGetCycleCount+0
+0x030 LoggerThread : (null)
+0x038 LoggerStatus : 0n0
+0x03c FailureReason : 0
+0x040 BufferQueue : _ETW_BUFFER_QUEUE
+0x050 OverflowQueue : _ETW_BUFFER_QUEUE
+0x060 GlobalList : _LIST_ENTRY [ 0xffff890f`390b5038 - 0xffff890f`363cd038 ]
+0x070 ProviderBinaryList : _LIST_ENTRY [ 0xffff890f`38bf0af0 - 0xffff890f`38bf0af0 ]
+0x080 BatchedBufferList : (null)
+0x080 CurrentBuffer : _EX_FAST_REF
+0x088 LoggerName : _UNICODE_STRING "Circular Kernel Context Logger"
+0x098 LogFileName : _UNICODE_STRING ""
+0x0a8 LogFilePattern : _UNICODE_STRING ""
+0x0b8 NewLogFileName : _UNICODE_STRING ""
+0x0c8 ClockType : 3
+0x0cc LastFlushedBuffer : 0
+0x0d0 FlushTimer : 0
+0x0d4 FlushThreshold : 0
+0x0d8 ByteOffset : _LARGE_INTEGER 0x0
+0x0e0 MinimumBuffers : 8
+0x0e4 BuffersAvailable : 0n4
+0x0e8 NumberOfBuffers : 0n8
+0x0ec MaximumBuffers : 8
+0x0f0 EventsLost : 0
+0x0f4 PeakBuffersCount : 0n8
+0x0f8 BuffersWritten : 0
+0x0fc LogBuffersLost : 0
+0x100 RealTimeBuffersDelivered : 0
+0x104 RealTimeBuffersLost : 0
+0x108 SequencePtr : (null)
+0x110 LocalSequence : 0
+0x114 InstanceGuid : _GUID {54dea73a-ed1f-42a4-af71-3e63d056f174}
+0x124 MaximumFileSize : 0
+0x128 FileCounter : 0n0
+0x12c PoolType : 200 ( NonPagedPoolNx )
+0x130 ReferenceTime : _ETW_REF_CLOCK
+0x140 CollectionOn : 0n1
+0x144 ProviderInfoSize : 0
+0x148 Consumers : _LIST_ENTRY [ 0xffff890f`38bf0bc8 - 0xffff890f`38bf0bc8 ]
+0x158 NumConsumers : 0
+0x160 TransitionConsumer : (null)
+0x168 RealtimeLogfileHandle : (null)
+0x170 RealtimeLogfileName : _UNICODE_STRING ""
+0x180 RealtimeWriteOffset : _LARGE_INTEGER 0x0
+0x188 RealtimeReadOffset : _LARGE_INTEGER 0x0
+0x190 RealtimeLogfileSize : _LARGE_INTEGER 0x0
+0x198 RealtimeLogfileUsage : 0
+0x1a0 RealtimeMaximumFileSize : 0xa00000
+0x1a8 RealtimeBuffersSaved : 0
+0x1b0 RealtimeReferenceTime : _ETW_REF_CLOCK
+0x1c0 NewRTEventsLost : 0 ( EtwRtEventNoLoss )
+0x1c8 LoggerEvent : _KEVENT
+0x1e0 FlushEvent : _KEVENT
+0x1f8 FlushTimeOutTimer : _KTIMER
+0x238 LoggerDpc : _KDPC
+0x278 LoggerMutex : _KMUTANT
+0x2b0 LoggerLock : _EX_PUSH_LOCK
+0x2b8 BufferListSpinLock : 0
+0x2b8 BufferListPushLock : _EX_PUSH_LOCK
+0x2c0 ClientSecurityContext : _SECURITY_CLIENT_CONTEXT
+0x308 TokenAccessInformation : (null)
+0x310 SecurityDescriptor : _EX_FAST_REF
+0x318 StartTime : _LARGE_INTEGER 0x01d33939`f056739d
+0x320 LogFileHandle : (null)
+0x328 BufferSequenceNumber : 0n1490
+0x330 Flags : 0x10027
+0x330 Persistent : 0y1
+0x330 AutoLogger : 0y1
+0x330 FsReady : 0y1
+0x330 RealTime : 0y0
+0x330 Wow : 0y0
+0x330 KernelTrace : 0y1
+0x330 NoMoreEnable : 0y0
+0x330 StackTracing : 0y0
+0x330 ErrorLogged : 0y0
+0x330 RealtimeLoggerContextFreed : 0y0
+0x330 PebsTracing : 0y0
+0x330 PmcCounters : 0y0
+0x330 PageAlignBuffers : 0y0
+0x330 StackLookasideListAllocated : 0y0
+0x330 SecurityTrace : 0y0
+0x330 SpareFlags1 : 0y0
+0x330 SystemLoggerIndex : 0y00000001 (0x1)
+0x330 StackCaching : 0y0
+0x330 SpareFlags2 : 0y0000000 (0)
+0x334 RequestFlag : 0
+0x334 DbgRequestNewFile : 0y0
+0x334 DbgRequestUpdateFile : 0y0
+0x334 DbgRequestFlush : 0y0
+0x334 DbgRequestDisableRealtime : 0y0
+0x334 DbgRequestDisconnectConsumer : 0y0
+0x334 DbgRequestConnectConsumer : 0y0
+0x334 DbgRequestNotifyConsumer : 0y0
+0x334 DbgRequestUpdateHeader : 0y0
+0x334 DbgRequestDeferredFlush : 0y0
+0x334 DbgRequestDeferredFlushTimer : 0y0
+0x334 DbgRequestFlushTimer : 0y0
+0x334 DbgRequestUpdateDebugger : 0y0
+0x334 DbgSpareRequestFlags : 0y00000000000000000000 (0)
+0x338 HookIdMap : _RTL_BITMAP
+0x348 StackCache : (null)
+0x350 PmcData : (null)
+0x358 WinRtProviderBinaryList : _LIST_ENTRY [ 0xffff890f`38bf0dd8 - 0xffff890f`38bf0dd8 ]
+0x368 ScratchArray : (null)
+0x370 DisallowedGuids : _DISALLOWED_GUIDS
+0x380 RelativeTimerDueTime : 0n0
+0x388 PeriodicCaptureStateGuids : _PERIODIC_CAPTURE_STATE_GUIDS
+0x398 PeriodicCaptureStateTimer : (null)
+0x3a0 PeriodicCaptureStateTimerState : 0 ( EtwpPeriodicTimerUnset )
+0x3a8 SoftRestartContext : (null)
+0x3b0 SiloState : 0xffff890f`32295000 _ETW_SILODRIVERSTATE
+0x3b8 CompressionWorkItem : _WORK_QUEUE_ITEM
+0x3d8 CompressionWorkItemState : 0n0
+0x3e0 CompressionLock : _EX_PUSH_LOCK
+0x3e8 CompressionTarget : (null)
+0x3f0 CompressionWorkspace : (null)
+0x3f8 CompressionOn : 0n0
+0x3fc CompressionRatioGuess : 0
+0x400 PartialBufferCompressionLevel : 0
+0x404 CompressionResumptionMode : 0 ( EtwCompressionModeRestart )
+0x408 PlaceholderList : _SINGLE_LIST_ENTRY
+0x410 CompressionDpc : _KDPC
+0x450 LastBufferSwitchTime : _LARGE_INTEGER 0x0
+0x458 BufferWriteDuration : _LARGE_INTEGER 0x0
+0x460 BufferCompressDuration : _LARGE_INTEGER 0x0
2: kd> !wmitrace.logger 0x02
(WmiTrace) LogDump for Logger Id 0x02
Logger Id 0x02 @ 0xFFFF890F38BF0A80 Named 'Circular Kernel Context Logger'
CollectionOn = 1
LoggerMode = 0x02800480 ( secure buf system )
HybridShutdown = persist
BufferSize = 4 KB
BuffersAvailable = 4
MinimumBuffers = 8
NumberOfBuffers = 8
MaximumBuffers = 8
EventsLost = 0
LogBuffersLost = 0
RealTimeBuffersLost = 0
LastFlushedBuffer = 0
MaximumFileSize = 0
FlushTimer = 0 sec
PoolType = NonPaged
SequenceNumber = 1490
ClockType = CPU Cycle
EventsLogged = 0
Buffer Address Cpu RefCnt State
=======================================================================================
Buffer 1: ffff890f390b5000 , 2: 0 Free List , Offset: 4024 , 98% Used
Buffer 2: ffff890f390b4000 , 2: 15 General Logging, Offset: 2352 , 57% Used
Buffer 3: ffff890f38bc7000 , 0: 15 General Logging, Offset: 4040 , 98% Used
Buffer 4: ffff890f390c9000 , 2: 0 Free List , Offset: 4056 , 99% Used
Buffer 5: ffff890f3633c000 , 1: 15 General Logging, Offset: 960 , 23% Used
Buffer 6: ffff890f368e3000 , 3: 15 General Logging, Offset: 2912 , 71% Used
Buffer 7: ffff890f390ad000 , 2: 0 Free List , Offset: 4024 , 98% Used
Buffer 8: ffff890f363cd000 , 2: 0 Free List , Offset: 4040 , 98% Used
2: kd> !wmitrace.buffer ffff890f390b5000
Buffer @ ffff890f390b5000 -- 0x1000 (4 K)
RefCount = 0
Logger = 'Circular Kernel Context Logger' (2)
Processor = 2
State = 0x0
SavedOffset = 4024
CurrentOffset = 4224
Offset = 72
TimeStamp = 0
Seq = 1489
BufferFlag = 0x0
BufferType = 0
System64 @ +00048 ( 200) 723586735260 (1848.0ce8) ImageLoad
System64 @ +00110 ( 200) 723586756000 (1848.0ce8) ImageLoad
System64 @ +001d8 ( 200) 723586778380 (1848.0ce8) ImageLoad
System64 @ +002a0 ( 192) 723586800300 (1848.0ce8) ImageLoad
System64 @ +00360 ( 192) 723586822520 (1848.0ce8) ImageLoad
System64 @ +00420 ( 200) 723586843760 (1848.0ce8) ImageLoad
System64 @ +004e8 ( 192) 723586864180 (1848.0ce8) ImageLoad
System64 @ +005a8 ( 200) 723586884260 (1848.0ce8) ImageLoad
System64 @ +00670 ( 200) 723586906380 (1848.0ce8) ImageLoad
System64 @ +00738 ( 200) 723586927640 (1848.0ce8) ImageLoad
System64 @ +00800 ( 192) 723586948800 (1848.0ce8) ImageLoad
System64 @ +008c0 ( 192) 723586970380 (1848.0ce8) ImageLoad
System64 @ +00980 ( 192) 723586991520 (1848.0ce8) ImageLoad
System64 @ +00a40 ( 200) 723587013840 (1848.0ce8) ImageLoad
System64 @ +00b08 ( 200) 723587035760 (1848.0ce8) ImageLoad
System64 @ +00bd0 ( 192) 723587057140 (1848.0ce8) ImageLoad
System64 @ +00c90 ( 208) 723587078800 (1848.0ce8) ImageLoad
System64 @ +00d60 ( 200) 723587100400 (1848.0ce8) ImageLoad
System64 @ +00e28 ( 200) 723587120900 (1848.0ce8) ImageLoad
System64 @ +00ef0 ( 200) 723587141060 (1848.0ce8) ImageLoad
============== ===== ========== ========== ============
Header Count EventSize HeaderSize AvgEvntSize
============== ===== ========== ========== ============
System64 20 3952 640 197
============== ===== ========== ========== ============
Total 20 3952 640 197
// Don't wrap the path into quotes!
2: kd> !wmitrace.logsave 0x02 "G:\Kernel Dumps\log.etl"
WMI Trace Save: Debugger Extension. LoggerId = 2, Save File = '"G:\Kernel'
Failed to Open Save File '"G:\Kernel'
2: kd> !wmitrace.logsave 0x02 "G:\log.etl"
WMI Trace Save: Debugger Extension. LoggerId = 2, Save File = '"G:\log.etl"'
Failed to Open Save File '"G:\log.etl"'
// Don't use spaces in the path, I got a file called 'kernel' when running this in G:\
2: kd> !wmitrace.logsave 0x02 G:\Kernel Dumps\log.etl
WMI Trace Save: Debugger Extension. LoggerId = 2, Save File = 'G:\Kernel'
Logger Id 0x02 @ 0xFFFF890F38BF0A80 Named 'Circular Kernel Context Logger'
CollectionOn = 1
LoggerMode = 0x02800480 ( secure buf system )
HybridShutdown = persist
BufferSize = 4 KB
BuffersAvailable = 4
MinimumBuffers = 8
NumberOfBuffers = 8
MaximumBuffers = 8
EventsLost = 0
LogBuffersLost = 0
RealTimeBuffersLost = 0
LastFlushedBuffer = 0
MaximumFileSize = 0
FlushTimer = 0 sec
PoolType = NonPaged
SequenceNumber = 1490
ClockType = CPU Cycle
EventsLogged = 0
Buffer Address Cpu RefCnt State
=======================================================================================
Buffer 1: ffff890f390b5000 , 2: 0 Free List , Offset: 4024 , 98% Used
Buffer 2: ffff890f390b4000 , 2: 15 General Logging, Offset: 2352 , 57% Used
Buffer 3: ffff890f38bc7000 , 0: 15 General Logging, Offset: 4040 , 98% Used
Buffer 4: ffff890f390c9000 , 2: 0 Free List , Offset: 4056 , 99% Used
Buffer 5: ffff890f3633c000 , 1: 15 General Logging, Offset: 960 , 23% Used
Buffer 6: ffff890f368e3000 , 3: 15 General Logging, Offset: 2912 , 71% Used
Buffer 7: ffff890f390ad000 , 2: 0 Free List , Offset: 4024 , 98% Used
Buffer 8: ffff890f363cd000 , 2: 0 Free List , Offset: 4040 , 98% Used
Saved 8 Buffers
// This isn't working either
2: kd> !wmitrace.logsave 0x02 %userprofile%\desktop\log.etl
WMI Trace Save: Debugger Extension. LoggerId = 2, Save File = '%userprofile%\desktop\log.etl'
Failed to Open Save File '%userprofile%\desktop\log.etl'
// This works
2: kd> !wmitrace.logsave 0x02 C:\Users\martijn\Desktop\log.etl
WMI Trace Save: Debugger Extension. LoggerId = 2, Save File = 'C:\Users\marti\Desktop\log.etl'
Logger Id 0x02 @ 0xFFFF890F38BF0A80 Named 'Circular Kernel Context Logger'
CollectionOn = 1
LoggerMode = 0x02800480 ( secure buf system )
HybridShutdown = persist
BufferSize = 4 KB
BuffersAvailable = 4
MinimumBuffers = 8
NumberOfBuffers = 8
MaximumBuffers = 8
EventsLost = 0
LogBuffersLost = 0
RealTimeBuffersLost = 0
LastFlushedBuffer = 0
MaximumFileSize = 0
FlushTimer = 0 sec
PoolType = NonPaged
SequenceNumber = 1490
ClockType = CPU Cycle
EventsLogged = 0
Buffer Address Cpu RefCnt State
=======================================================================================
Buffer 1: ffff890f390b5000 , 2: 0 Free List , Offset: 4024 , 98% Used
Buffer 2: ffff890f390b4000 , 2: 15 General Logging, Offset: 2352 , 57% Used
Buffer 3: ffff890f38bc7000 , 0: 15 General Logging, Offset: 4040 , 98% Used
Buffer 4: ffff890f390c9000 , 2: 0 Free List , Offset: 4056 , 99% Used
Buffer 5: ffff890f3633c000 , 1: 15 General Logging, Offset: 960 , 23% Used
Buffer 6: ffff890f368e3000 , 3: 15 General Logging, Offset: 2912 , 71% Used
Buffer 7: ffff890f390ad000 , 2: 0 Free List , Offset: 4024 , 98% Used
Buffer 8: ffff890f363cd000 , 2: 0 Free List , Offset: 4040 , 98% Used
Saved 8 Buffers
