EVENT_MAP_INFO structure (tdh.h)

Defines the metadata about the event map.

Syntax

typedef struct _EVENT_MAP_INFO {
  ULONG           NameOffset;
  MAP_FLAGS       Flag;
  ULONG           EntryCount;
  union {
    MAP_VALUETYPE MapEntryValueType;
    ULONG         FormatStringOffset;
  };
  EVENT_MAP_ENTRY MapEntryArray[ANYSIZE_ARRAY];
} EVENT_MAP_INFO;

Members

NameOffset

Offset from the beginning of this structure to a null-terminated Unicode string that contains the name of the event map.

Flag

Indicates if the map is a value map, bitmap, or pattern map. This member can contain one or more flag values. For possible values, see the MAP_FLAGS enumeration.

EntryCount

Number of map entries in MapEntryArray.

MapEntryValueType

Determines if you use the Value member or InputOffset member of EVENT_MAP_ENTRY to access the map value. For possible values, see the MAP_VALUETYPE enumeration.

FormatStringOffset

If the value of Flag is EVENTMAP_INFO_FLAG_MANIFEST_PATTERNMAP, use this offset to access the null-terminated Unicode string that contains the value of the format attribute of the patternMap element. The offset is from the beginning of this structure.

The EVENTMAP_INFO_FLAG_MANIFEST_PATTERNMAP also indicates that you use the InputOffset member of EVENT_MAP_ENTRY to access the map value.

MapEntryArray[ANYSIZE_ARRAY]

Array of map entries. For details, see the EVENT_MAP_ENTRY structure.

Requirements

See also

TdhGetEventMapInformation