#ifndef _NTPFAPI_H

// rev
/**
 * The PF_RETRIEVE_TRACE structure describes the fixed header of a completed Prefetcher trace.
 */
typedef struct DECLSPEC_ALIGN(8) _PF_RETRIEVE_TRACE
{
    ULONG Version;                              // PF_RETRIEVE_TRACE_VERSION
    ULONG Magic;                                // PF_RETRIEVE_TRACE_MAGIC
    ULONG Size;                                 // Total buffer size, including the variable payload that follows this header.
    ULONG Spare0;                               // Opaque trace state copied from the completed trace.
    UCHAR OpaqueHeader[0x40];                   // Opaque fixed fields copied from the completed trace.
    ULONG PageEntriesOffset;                    // Offset from the start of this structure to PF_RETRIEVE_TRACE_PAGE_ENTRY[PageEntriesCount].
    ULONG PageEntriesCount;                     // Count of 16-byte PF_RETRIEVE_TRACE_PAGE_ENTRY records.
    ULONG TraceLimitsMaxNumPages;               // Page limit recorded for this trace.
    ULONG TraceLimitsMaxNumSections;            // Section limit recorded for this trace.
    ULONG SectionEntriesOffset;                 // Offset from the start of this structure to PF_RETRIEVE_TRACE_SECTION_ENTRY[SectionEntriesCount].
    ULONG SectionEntriesCount;                  // Count of 24-byte PF_RETRIEVE_TRACE_SECTION_ENTRY records.
    UCHAR OpaqueTail[0x68];                     // Fixed header size is 0xd0; page/section payloads follow at their offsets.
} PF_RETRIEVE_TRACE, *PPF_RETRIEVE_TRACE;

#endif
View code on GitHub