#ifndef _NTWMI_H

// rev
typedef struct _ETW_ENABLE_NOTIFICATION_PACKET
{
    ETW_NOTIFICATION_HEADER NotificationHeader;
    ULONG EnableNotificationType;
    UCHAR Level;
    UCHAR Reserved1;
    USHORT LoggerId;
    ULONG EnableProperty;
    ULONG Reserved2;
    ULONGLONG MatchAnyKeyword;
    ULONGLONG MatchAllKeyword;
    USHORT ReplyLoggerId;
    UCHAR ReplyLevel;
    UCHAR ReplySource;
    ULONG ReplyEnableProperty;
    ULONG FilterDescCount;
    //EVENT_FILTER_DESCRIPTOR FilterDescriptors[ANYSIZE_ARRAY]; // optional
} ETW_ENABLE_NOTIFICATION_PACKET, *PETW_ENABLE_NOTIFICATION_PACKET;

#endif
View code on GitHub