#ifndef _NTPFAPI_H

/**
 * The PF_SYSTEM_SUPERFETCH_RETRIEVE_TRACE structure provides the input and output envelope for a completed Superfetch trace.
 * \remarks The x64 handler requires at least 24 bytes with 8-byte alignment and checks only the
 * low USHORT of RequestType for version 2. Additional bytes hold the trace dump. STATUS_BUFFER_TOO_SMALL
 * reports the required payload size through query ReturnLength; STATUS_NO_MORE_ENTRIES means no trace is available.
 */
typedef struct _PF_SYSTEM_SUPERFETCH_RETRIEVE_TRACE
{
    union
    {
        struct
        {
            ULONGLONG RequestType;              // Low USHORT is PF_SYSTEM_SUPERFETCH_RETRIEVE_TRACE_VERSION.
            ULONGLONG Reserved;                 // Ignored on input
            HANDLE PartitionHandle;             // Partition handle supplied on input and preserved on output.
        } Input;
        struct
        {
            ULONGLONG TypeFlags;                // 0x0000000000180002 on success
            ULONGLONG Timestamp;                // Scaled shared-user-data tick count.
            HANDLE PartitionHandle;             // Partition handle supplied on input and preserved on output.
        } Output;

        //
        // Raw view of the buffer for opaque access
        //
        UCHAR Buffer[ANYSIZE_ARRAY];            // Raw view of the envelope; additional storage is required for the trailing trace dump.
    };
} PF_SYSTEM_SUPERFETCH_RETRIEVE_TRACE, *PPF_SYSTEM_SUPERFETCH_RETRIEVE_TRACE;

#endif
View code on GitHub