PF_SYSTEM_SUPERFETCH_RETRIEVE_TRACE - NtDoc

Native API online documentation, based on the System Informer (formerly Process Hacker) phnt headers
#ifndef _NTPFAPI_H

/**
 * The PF_SYSTEM_SUPERFETCH_RETRIEVE_TRACE structure provides the input and output envelope for a completed Superfetch trace.
 */
typedef struct _PF_SYSTEM_SUPERFETCH_RETRIEVE_TRACE
{
    union
    {
        struct
        {
            ULONGLONG RequestType;              // Low USHORT is PF_SYSTEM_SUPERFETCH_RETRIEVE_TRACE_VERSION.
            ULONGLONG Reserved;                 // Ignored on input
            HANDLE PartitionHandle;             // Partition handle supplied on input and preserved on output.
        } Input;
        struct
        {
            ULONGLONG TypeFlags;                // 0x0000000000180002 on success
            ULONGLONG Timestamp;                // Scaled shared-user-data tick count.
            HANDLE PartitionHandle;             // Partition handle supplied on input and preserved on output.
        } Output;

        //
        // Raw view of the buffer for opaque access
        //
        UCHAR Buffer[ANYSIZE_ARRAY];            // Raw view of the envelope; additional storage is required for the trailing trace dump.
    };
} PF_SYSTEM_SUPERFETCH_RETRIEVE_TRACE, *PPF_SYSTEM_SUPERFETCH_RETRIEVE_TRACE;

#endif

View code on GitHub

NtDoc

No description available.