//******************************************
// Guid Definitions
// 10/23/98
//******************************************

// The #type statement and the #typev statement may be used to convert
// messages into user readable forms.
// With #type all parameters are processed as strings and the default string
// processing of FormTMessage is used
// With #typev wherever possible parameters are processed as their native format
// and the %x!x! style of FormatMessage should be used.
//
// Note Parameter %1 through %9 are predefined
// Parameter		is					#typev
// %1			GUID Friendly Name			string
// %2			GUID SubType Name			string
// %3			Thread ID				ULONG_PTR
// %4			System Time				String
// %5			Kernel Time	or User Time		String
// %6			User Time	or NULL			String
// %7			Sequence Number				LONG
// %8			Unused          			String
// %9			CPU Number				LONG
// %10 and above are the user parameters
// %255 		Is reserved
//
// Note these parameters are always present, but may not be valid 
// depending on the source.
//
// User defined messages always start at message number 10
// Messages 0 through 9 are reserved for system use.
// Message number 255 is reserved.
//
// Available formats for user arguments are -
//
//Name		Description				#typev Format
//ItemChar						CHAR
//ItemUChar						UCHAR
//ItemCharShort						USHORT
//ItemCharSign						SHORT
//ItemShort	Signed Short				SHORT
//ItemUShort	Unsigned Short				USHORT
//ItemLong	Signed Long, decoded as decimal		LONG
//ItemULong	Unsigned Long, decoded as decimal	ULONG
//ItemULongX	Unsigned Long, seen as hexadecimal	ULONG
//ItemLongLong	Signed 64 Bit value			LONGLONG
//ItemULongLong	Unsigned 64 Bit value			ULONGLONG
//ItemRString	Reduced Ascii String			String
//	(\t, \n, \r, \,, converted to space, trailing sp removed)
//ItemWString	Unicode String, null terminated		String
//ItemPString	Counted Ascii String			String
//ItemPWString	Counted Unicode String			String
//ItemMLString	Multi-Line Ascii String			String
//ItemSid	Security identifier			String
//ItemChar4						CHAR4
//ItemIPAddr	IP Address				String		(If needed raw, use ItemUlong)
//		(string of form xxx.xxx.xxx.xxx)
//ItemPort						String		(If needed raw use ItemUshort)
//ItemNWString      Non-null terminated Wide Char String	String
//ItemListByte (element1,element2,....)			String
//			byte index into a list of strings
//ItemListShort(element1,element2,....)			String
//			short index into a list of strings
//ItemListLong (element1,element2,....)			String
//			Long index into a list of strings
//ItemGUID	Normal GUID format			String
//ItemNTerror   Translates a ULONG error code to the    String
//              NT Error Text
//ItemNTSTATUS  Converts NTSTATUS to symbolic name 	String
//ItemWINERROR Converts WINERROR to symbolic name	String
//ItemNETEVENT Converts NETEVENT to symbolic name	String
//ItemMerror module.ext					String
//              Translates a ULONG error code using the 
//              module specified.
//ItemTimeStamp Treats a LONGLONG as a timestamp        String
//ItemUnknown						String


ce5b1020-8ea9-11d0-a4ec-00a0c9062910 TraceDp
#type	Start	1	"TraceDp TID=0x%3 Start"
#type	End	2	"TraceDp TID=0x%3End"
{
}

68fdd900-4a3e-11d1-84f4-0000f80464e3 EventTrace
#typev Header    0      "EventTrace Header"
{
    BufferSize,     ItemULong                   //10
    Version,        ItemULong                   //11
    BuildNumber,    ItemULong                   //12
    NumProc,        ItemULong                   //13
    EndTime,        ItemULongLong               //14
    TimerResolution,ItemULong                   //15
    MaxFileSize,    ItemULong                   //16
    LogFileMode,    ItemULongX                  //17
    BuffersWritten, ItemULong                   //18
    StartBuffers,   ItemULong                   //19
    PointerSize,    ItemULong                   //20
    EventsLost,     ItemULong                   //21
    CPUSpeed,       ItemULong                   //22
    LoggerName,     ItemPtr                     //23
    LogFileName,    ItemPtr                     //24
    TimeZone,       ItemCharHidden[176]         //25
    BootTime,       ItemULongLong               //26
    PerfFrequency,  ItemULongLong               //27
    StartTime,      ItemULongLong               //28
    ReservedFlags,  ItemULongX                  //29
    BuffersLost,    ItemULong                   //30
}

01853a65-418f-4f36-aefc-dc0f1d2fd235 HWConfig
#typev CPU 10           "%15!s! :: CPU # %11!d!, Speed %10!d!Mhz, Memory %12!d!K, PageSize %13!d!K, AllocationGranularity %14!d!"
{
    MHz, ItemULong                      // 10
    NumberOfProcessors, ItemULong       // 11
    MemSize, ItemULong                  // 12
    PageSize, ItemULong                 // 13
    AllocationGranularity, ItemULong    // 14
    ComputerName, ItemWString           // 15
}
#typev PhyDisk 11 "Phsical Disk %10!d!(%19!s!), SectorSize: %11!d!, SectorsperTrack: %12!d!, TracksPerCylinder %13!d! Cylinders %14!d!, SCSI (Port=%15!d!, Path %16!d!, Target=%17!d!, Lun=%18!d!)" 
{
    DiskNumber, ItemULong               // 10
    BytesPerSector, ItemULong           // 11
    SectorsPerTrack, ItemULong          // 12
    TracksPerCylinder, ItemULong        // 13
    Cylinders, ItemULongLong            // 14
    SCSIPort, ItemULong                 // 15
    SCSIPath, ItemULong                 // 16
    SCSITarget, ItemULong               // 17
    SCSILun, ItemULong                  // 18
    Manufacturer, ItemWString           // 19
}
#typev LogDisk 12   "Logical Disk %10!d! StartOffset: %11!d!, Size: %12!d!"
{
    DiskNumber, ItemULong               // 10
    Pad, ItemULong                      // 11
    StartOffset, ItemULongLong          // 12
    PartitionSize, ItemULongLong        // 13
}
#typev NIC 13   "NIC %10!s!"
{
    NICName, ItemWString                // 10
}

2cb15d1d-5fc1-11d2-abe1-00a0c911f518 Image
#typev Load	10 "00000000.%3!08X!::%4!s! [%1!s!] <%9!d!>ImageLoad of %13!s! (Process= %12!d!, Base=0x%10!X!,size=0x%11!X!)"
{
    Base Address,   ItemPtr
    Module Size,    ItemPtr
    ProcessId,      ItemUlong
    Image Filename, ItemWString
}

3d6fa8d0-fe05-11d0-9dda-00c04fd7ba7c Process
#typev Start   1  "%10!08X!.%3!08X!::%4!s! [%1!s!] <%9!d!>Process Started %16!s! :: %15!s! (Pid=%11!d!,PPid=%12!d!, Session=%13!d!) "
#typev End     2  "%10!08X!.%3!08X!::%4!s! [%1!s!] <%9!d!>Process Ended   %16!s! :: %15!s! (Pid=%11!d!,PPid=%12!d!, Session=%13!d!) Exit Status %14!X!"	
#typev DCStart 3  "%10!08X!.%3!08X!::%4!s! [%1!s!DC] <*>Process Data Collection Started of %16!s!  :: %15!s! (Pid=%11!d!,PPid=%12!d!, Session=%13!d!)"
#typev DCEnd   4  "%10!08X!.%3!08X!::%4!s! [%1!s!DC] <*>Process Data Colection Ended for %16!s! :: %15!s! (Pid=%11!d!,PPid=%12!d!, Session=%13!d!)"
#typev Load    5  "%10!08X!.%3!08X!::%4!s! [%1!s!] <%9!d!>5Load of %16!s! :: %15!s!  (Pid=%11!d!,PPid=%12!d!, Session=%13!d!)"
{
    PageDirectoryBase, ItemPtr
    Process Id, ItemULong
    Parent Id, ItemULong
    Session Id, ItemULong
    Exit Status, ItemUlong
    User SID, ItemSid
    Image FileName, ItemString
}

3d6fa8d1-fe05-11d0-9dda-00c04fd7ba7c Thread
#typev Start	1 "%11!08X!.%10!08X!::%4!s! [%1!s!] <%9!d!>Started"
#typev DCStart	3 "%11!08X!.%10!08X!::%4!s! [%1!s!DC] <%9!d!>Data Collection Started "
#type Start 1
#type DCStart   3
{
    Process Id, ItemULong
    Thread Id, ItemULong
    StackBase, ItemPtr
    StackLimit, ItemPtr
    UserStackBase, ItemPtr
    UserStackLimit, ItemPtr
    StartAddr, ItemPtr
    Win32StartAddr, ItemPtr
    WaitMode, ItemChar
}
#typev End	2 "%11!08X!.%10!08X!::%4!s! [%1!s!] <%9!d!>Ended"
#typev DCEnd	4 "%11!08X!.%10!08X!::%4!s! [%1!s!DC] <%9!d!>Data Collection Ended"
{
    Process Id, ItemULong
    Thread Id, ItemULong
}


3d6fa8d3-fe05-11d0-9dda-00c04fd7ba7c PageFault
#typev TransitionFault 10	"00000000.%3!08X!::%4!s! [%1!s!] <%9!d!>Pagefault Transition VA=0x%10!08X!, PC=0x%11!08X!"
#typev DemandZeroFault 11	"00000000.%3!08X!::%4!s! [%1!s!] <%9!d!>Pagefault DemandZero VA=0x%10!08X!, PC=0x%11!08X!"
#typev CopyOnWrite     12	"00000000.%3!08X!::%4!s! [%1!s!] <%9!d!>Pagefault CopyOnWrite VA=0x%10!08X!, PC=0x%11!08X!"
#typev GlobalPageFault 13	"00000000.%3!08X!::%4!s! [%1!s!] <%9!d!>Pagefault GuardPageFault VA=0x%10!08X!, PC=0x%11!08X!"
#typev Hard            14	"00000000.%3!08X!::%4!s! [%1!s!] <%9!d!>Pagefault Hard VA=0x%10!08X!, PC=0x%11!08X!, in %12!016X!"
#typev Notification    15	"00000000.%3!08X!::%4!s! [%1!s!] <%9!d!>Pagefault Notification VA=0x%10!08X!, PC=0x%11!08X!, in %12!016X!"
{
	Virtual Address,ItemULongX
	Program Counter,ItemUlongX
	Byte Offset,	ItemLongLong
        File Object,	ItemUlongX
	Byte Count,	ItemUlong	 
	HotFile Name,   ItemNWString
}

01853a65-418f-4f36-aefc-dc0f1d2fd235 HWConfig
#typev CPU 10           "%15!s! :: CPU # %11!d!, Speed %10!d!Mhz, Memory %12!d!K, PageSize %13!d!K, AllocationGranularity %14!d!"
{
    MHz, ItemULong
    NumberOfProcessors, ItemULong
    MemSize, ItemULong
    PageSize, ItemULong
    AllocationGranularity, ItemULong
    ComputerName, ItemWString
}
#typev PhyDisk 11 "Phsical Disk %10!d!(%19!s!), SectorSize: %11!d!, SectorsperTrack: %12!d!, TracksPerCylinder %13!d! Cylinders %14!d!, SCSI (Port=%15!d!, Path %16!d!, Target=%17!d!, Lun=%18!d!)" 
{
    DiskNumber, ItemULong
    BytesPerSector, ItemULong
    SectorsPerTrack, ItemULong
    TracksPerCylinder, ItemULong
    Cylinders, ItemULongLong
    SCSIPort, ItemULong
    SCSIPath, ItemULong
    SCSITarget, ItemULong
    SCSILun, ItemULong
    Manufacturer, ItemWString
}
#typev LogDisk 12   "Logical Disk %10!d! StartOffset: %11!d!, Size: %12!d!"
{
    DiskNumber, ItemULong
    Pad, ItemULong
    StartOffset, ItemULongLong
    PartitionSize, ItemULongLong
}
#typev NIC 13   "NIC %10!s!"
{
    NICName, ItemWString
}


3d6fa8d4-fe05-11d0-9dda-00c04fd7ba7c DiskIo
#typev Read  10 "00000000.%3!08X!::%4!s! [%1!s!] <%9!d!>Disk %10!2d! Read  of %12!5d! bytes (FileObj=0x%15!08X!)"
#typev Write 11 "00000000.%3!08X!::%4!s! [%1!s!] <%9!d!>Disk %10!2d! Write of %12!5d! bytes (FileObj=0x%15!08X!)"
{
	Disk Number, ItemULong
	Irp Flags, ItemULongX
	Transfer Size, ItemULong
	QueueDepth, ItemULong
	Byte Offset, ItemLongLong
	File Object, ItemULongX
}
AE53722E-C863-11d2-8659-00C04FA321A1 Registry
#typev Create		 10 "00000000.%3!08X!::%4!s! [%1!s!] <%9!d!>Create  of %14!s! Handle = 0x%11!08X! Status = %10!0X!"
#typev Open		 11 "00000000.%3!08X!::%4!s! [%1!s!] <%9!d!>Open  of %14!s! Handle = 0x%11!08X! Status = %10!0X!"
#typev Delete		 12 "00000000.%3!08X!::%4!s! [%1!s!] <%9!d!>Delete of Handle = 0x%11!08X!(%14!s!) Status = %10!0X!"
#typev Query		 13 "00000000.%3!08X!::%4!s! [%1!s!] <%9!d!>Query of (%14!s!) Handle = 0x%11!08X! Status = %10!0X!"
#typev SetValue		 14 "00000000.%3!08X!::%4!s! [%1!s!] <%9!d!>SetValue  of %14!s! Handle = 0x%11!08X!(%14!s!)8X! Status = %10!0X! (TID =%3!0X!)"
#typev QueryValue	 16 "00000000.%3!08X!::%4!s! [%1!s!] <%9!d!>QueryValue of (%14!s!) Handle = 0x%11!08X! Status = %10!0X!"
#typev EnumerateKey	 17 "00000000.%3!08X!::%4!s! [%1!s!] <%9!d!>EnumerateKey  of %14!s! Handle = 0x%11!08X! Status = %10!0X!"
#typev EnumerateValueKey 18 "00000000.%3!08X!::%4!s! [%1!s!] <%9!d!>EnumerateValueKey  of %14!s! Handle = 0x%11!08X! Status = %10!0X!"
#typev QueryMultipleValue 19 "00000000.%3!08X!::%4!s! [%1!s!] <%9!d!>QueryMultiple  of %14!s! Handle = 0x%11!08X! Status = %10!0X!"
#typev SetInformation	 20 "00000000.%3!08X!::%4!s! [%1!s!] <%9!d!>SetInformation  of %14!s! Handle = 0x%11!08X! Status = %10!0X!"
#typev Flush		 21 "00000000.%3!08X!::%4!s! [%1!s!] <%9!d!>Flush  of %14!s! Handle = 0x%11!08X! Status = %10!0X!"
#type RunDown            22 "00000000.%3!08X!::%4!s! [%1!s!] <%9!d!>Rundown"
{
	Status,ItemUlongX
	Key Handle, ItemULongX
	Elapsed Time, ItemLongLong
        Index, ItemULong
	KeyName, ItemWString
}
90cbdc39-4a3e-11d1-84f4-0000f80464e3 FileIo
#typev	Name   0 "00000000.%3!08X!::%4!s! [%1!s!] <%9!d!>Filio for %11 (FileObj=0x%10!X!)"
{
	File Object, ItemPtr
	File Name, ItemWString
}

9a280ac0-c8e0-11d1-84e2-00c04fb998a2 TcpIp
#typev Send 10 "%15!08X!.%3!08X!::%4!s! [%1!s!] <%9!d!>TCPIP Send    to   %10!13s!:%12!05d! from %11!13s!:%13!05d! of %14!5d! bytes" 
{
	saddr, ItemIPAddr
	daddr, ItemIPAddr
	sport, ItemUShort
	dport, ItemUShort
	size,  ItemULong
	PID, ItemULongX
}
#typev Recv 11 "%15!08X!.%3!08X!::%4!s! [%1!s!] <%9!d!>TCPIP Receive from %10!13s!:%12!05d! to   %11!13s!:%13!05d! of %14!5d! bytes" 
{
	saddr, ItemIPAddr
	daddr, ItemIPAddr
	sport, ItemUShort
	dport, ItemUShort
	size,  ItemULong
	PID,   ItemULongX
}
#typev Connect    12  "%15!08X!.%3!08X!::%4!s! [%1!s!] <%9!d!>TCPIP Connect to   %10:%12!05D! from %11:%13!05D!" 
#typev Disconnect 13  "%15!08X!.%3!08X!::%4!s! [%1!s!] <%9!d!>TCPIP Discon  From %10:%12!05D! to   %11:%13!05D!" 
{
	saddr, ItemIPAddr
	daddr, ItemIPAddr
	sport, ItemUShort
	dport, ItemUShort
	size,  ItemULong
	PID,   ItemULongX
}
#typev Retransmit 14   "%15!08X!.%3!08X!::%4!s! [%1!s!] <%9!d!>TCPIP Retransmit to   %10:%12!05D!" 
#typev Accept     15   "%15!08X!.%3!08X!::%4!s! [%1!s!] <%9!d!>TCPIP Accept  From %10:%12!05D!"
{
	saddr, ItemIPAddr
	daddr, ItemIPAddr
	sport, ItemUShort
	dport, ItemUShort
	size,  ItemULong
	PID,   ItemULongX
}

bf3a50c5-a9c9-4988-a005-2df0b7c80f80 UdpIp
#typev Send   10 "%15!08X!.%3!08X!::%4!s! [%1!s!] <%9!d!>UDP Send    to   %11!13s!:%12!05d! from %14!13s!:%15!05d! of %13!5d! bytes (Context= %10!08X!)" 
#typev Recv   11 "%15!08X!.%3!08X!::%4!s! [%1!s!] <%9!d!>UDP Receive from %11!13s!:%12!05d! to   %14!13s!:%15!05d! of %13!5d! bytes (Context= %10!08X!)" 
{
    context, ItemULongX     /10
    destaddr, ItemIPAddr    /11
    destport, ItemUShort    /12	
    Bufrsize,  ItemUShort   /13
    srcdaddr, ItemIPAddr    /14
    srcport, ItemUShort     /15
    sentsize, ItemUShort    /16
}

//******************************************
// Test Events
// d58c126f-b309-11d1-969e-0000f875a5bc
//******************************************
ce5b1020-8ea9-11d0-a4ec-00a0c9062910 TraceDp
#type Start 1
#type End   2
{
    UserData, ItemULong
}
//******************************************
// Test Events
// 1bd67283-57cc-11d2-9a03-00c04f72c722
//******************************************
1bd67283-57cc-11d2-9a03-00c04f72c722 TranProv
#type Start 1
#type End   2
{
    UserData, ItemULong
}

//******************************************
// DS Events 
// 1c83b2fc-c04f-11d1-8afc-00c04fc21914
//******************************************

5b7eb15d-7441-11d2-b711-00c04fb998a2 DsKccGuid
#type Start	1
#type End	2
{
	Signature, ItemCharSign
	Version, ItemCharShort
	Inserts, ItemCharShort
	messageId, ItemULong
	BindId,ItemULong
	Null1, ItemDSString
	Null2, ItemDSString
	Null3, ItemDSString
	Null4, ItemDSString
	Null5, ItemDSString
	Null6, ItemDSString
	Null7, ItemDSString
	Null8, ItemDSString
}

05acd000-daeb-11d1-be80-00c04fadfff5 DsDirSearch
#type Start	1
{
	Signature, ItemCharSign
	Version, ItemCharShort
	Inserts, ItemCharShort
	messageId, ItemULong
	BindId, ItemULong
	Caller, ItemDSString
	Choice, ItemDSString
	ObjDN, ItemDSString
	Null4, ItemDSString
	Null5, ItemDSString
	Null6, ItemDSString
	Null7, ItemDSString
	Null8, ItemDSString
}
#type End	2
{
	Signature, ItemCharSign
	Version, ItemCharShort
	Inserts, ItemCharShort
	messageId, ItemULong
	BindId, ItemULong
	ErrCode, ItemDSString
	Null2, ItemDSString
	Null3, ItemDSString
	Null4, ItemDSString
	Null5, ItemDSString
	Null6, ItemDSString
	Null7, ItemDSString
	Null8, ItemDSString
}

05acd001-daeb-11d1-be80-00c04fadfff5 DsDirAddEntry
#type Start	1
{
	Signature, ItemCharSign
	Version, ItemCharShort
	Inserts, ItemCharShort
	messageId, ItemULong
	BindId, ItemULong
	Caller, ItemDSString
	ObjDn, ItemDSString
	Null3, ItemDSString
	Null4, ItemDSString
	Null5, ItemDSString
	Null6, ItemDSString
	Null7, ItemDSString
	Null8, ItemDSString
}
#type End	2
{
	Signature, ItemCharSign
	Version, ItemCharShort
	Inserts, ItemCharShort
	messageId, ItemULong
	BindId, ItemULong
	ErrCode, ItemDSString
	Null2, ItemDSString
	Null3, ItemDSString
	Null4, ItemDSString
	Null5, ItemDSString
	Null6, ItemDSString
	Null7, ItemDSString
	Null8, ItemDSString
}

05acd002-daeb-11d1-be80-00c04fadfff5 DsDirMod
#type Start	1
{
	Signature, ItemCharSign
	Version, ItemCharShort
	Inserts, ItemCharShort
	messageId, ItemULong
	BindId, ItemULong
	Caller, ItemDSString
	ObjDn, ItemDSString
	Null3, ItemDSString
	Null4, ItemMLString
	Null5, ItemDSString
	Null6, ItemDSString
	Null7, ItemDSString
	Null8, ItemDSString
}
#type End	2
{
	Signature, ItemCharSign
	Version, ItemCharShort
	Inserts, ItemCharShort
	messageId, ItemULong
	BindId, ItemULong
	ErrCode, ItemDSString
	Null2, ItemDSString
	Null3, ItemDSString
	Null4, ItemMLString
	Null5, ItemDSString
	Null6, ItemDSString
	Null7, ItemDSString
	Null8, ItemDSString
}

05acd005-daeb-11d1-be80-00c04fadfff5 DsDirModDN
#type Start	1
{
	Signature, ItemCharSign
	Version, ItemCharShort
	Inserts, ItemCharShort
	messageId, ItemULong
	BindId,ItemULong
	Caller, ItemDSString
	ObjDn, ItemDSString
	NewParentDn, ItemDSString
	NewName, ItemDSString
	Null5, ItemDSString
	Null6, ItemDSString
	Null7, ItemDSString
	Null8, ItemDSString
}
#type End	2
{
	Signature, ItemCharSign
	Version, ItemCharShort
	Inserts, ItemCharShort
	messageId, ItemULong
	BindId,ItemULong
	ErrCode, ItemDSString
	Null2, ItemDSString
	Null3, ItemDSString
	Null4, ItemDSString
	Null5, ItemDSString
	Null6, ItemDSString
	Null7, ItemDSString
	Null8, ItemDSString
}

05acd003-daeb-11d1-be80-00c04fadfff5 DsDirDel
#type Start	1
{
	Signature, ItemCharSign
	Version, ItemCharShort
	Inserts, ItemCharShort
	messageId, ItemULong
	BindId, ItemULong
	Caller, ItemDSString
	ObjDn, ItemDSString
	Null3, ItemDSString
	Null4, ItemMLString
	Null5, ItemDSString
	Null6, ItemDSString
	Null7, ItemDSString
	Null8, ItemDSString
}
#type End	2
{
	Signature, ItemCharSign
	Version, ItemCharShort
	Inserts, ItemCharShort
	messageId, ItemULong
	BindId, ItemULong
	ErrCode, ItemDSString
	Null2, ItemDSString
	Null3, ItemDSString
	Null4, ItemMLString
	Null5, ItemDSString
	Null6, ItemDSString
	Null7, ItemDSString
	Null8, ItemDSString
}

05acd004-daeb-11d1-be80-00c04fadfff5 DsDirCompare
#type Start	1
{
	Signature, ItemCharSign
	Version, ItemCharShort
	Inserts, ItemCharShort
	messageId, ItemULong
	BindId, ItemULong
	Caller, ItemDSString
	AssertType, ItemDSString
	ObjDn, ItemDSString
	Null4, ItemDSString
	Null5, ItemDSString
	Null6, ItemDSString
	Null7, ItemDSString
	Null8, ItemDSString
}
#type End	2
{
	Signature, ItemCharSign
	Version, ItemCharShort
	Inserts, ItemCharShort
	messageId, ItemULong
	BindId, ItemULong
	ErrCode, ItemDSString
	Null2, ItemDSString
	Null3, ItemDSString
	Null4, ItemDSString
	Null5, ItemDSString
	Null6, ItemDSString
	Null7, ItemDSString
	Null8, ItemDSString
}

05acd006-daeb-11d1-be80-00c04fadfff5 DsDirGtNcChg
#type Start	1
{
	Signature, ItemCharSign
	Version, ItemCharShort
	Inserts, ItemCharShort
	messageId, ItemULong
	BindId,ItemULong
	UuidDest, ItemDSString
	NcDn, ItemDSString
	UsnVecFrom, ItemDSString
	flags, ItemDSString
	RetCrit, ItemDSString
	ExtOp, ItemDSString
	Null7, ItemDSString
	Null8, ItemDSString
}
#type End	2
{
	Signature, ItemCharSign
	Version, ItemCharShort
	Inserts, ItemCharShort
	messageId, ItemULong
	BindId,ItemULong
	NumObj, ItemDSString
	NumBytes, ItemDSString
	UsnVecTo, ItemDSString
	ExtRet, ItemDSString
	Null5, ItemDSString
	Null6, ItemDSString
	Null7, ItemDSString
	Null8, ItemDSString
}

05acd007-daeb-11d1-be80-00c04fadfff5 DsDirReplSync
#type Start	1
{
	Signature, ItemCharSign
	Version, ItemCharShort
	Inserts, ItemCharShort
	messageId, ItemULong
	BindId, ItemULong
	NcDn, ItemDSString
	DsaOrUuid, ItemDSString
	Options, ItemDSString
	Null4, ItemDSString
	Null5, ItemDSString
	Null6, ItemDSString
	Null7, ItemDSString
	Null8, ItemDSString
}
#type End	2
{
	Signature, ItemCharSign
	Version, ItemCharShort
	Inserts, ItemCharShort
	messageId, ItemULong
	BindId, ItemULong
	ErrCode, ItemDSString
	Null2, ItemDSString
	Null3, ItemDSString
	Null4, ItemDSString
	Null5, ItemDSString
	Null6, ItemDSString
	Null7, ItemDSString
	Null8, ItemDSString
}

05acd008-daeb-11d1-be80-00c04fadfff5 DsDirFind
#type Start	1
{
	Signature, ItemCharSign
	Version, ItemCharShort
	Inserts, ItemCharShort
	messageId, ItemULong
	BindId,ItemULong
	Caller, ItemDSString
	AttId, ItemDSString
	Null3, ItemDSString
	Null4, ItemDSString
	Null5, ItemDSString
	Null6, ItemDSString
	Null7, ItemDSString
	Null8, ItemDSString
}
#type End	2
{
	Signature, ItemCharSign
	Version, ItemCharShort
	Inserts, ItemCharShort
	messageId, ItemULong
	BindId,ItemULong
	ErrCode, ItemDSString
	Null2, ItemDSString
	Null3, ItemDSString
	Null4, ItemDSString
	Null5, ItemDSString
	Null6, ItemDSString
	Null7, ItemDSString
	Null8, ItemDSString
}

05acd009-daeb-11d1-be80-00c04fadfff5 DsLdapBind
#type Start	1
{
	Signature, ItemCharSign
	Version, ItemCharShort
	Inserts, ItemCharShort
	messageId, ItemULong
	BindId,ItemULong
	Null1, ItemDSString
	Null2, ItemDSString
	Null3, ItemDSString
	Null4, ItemDSString
	Null5, ItemDSString
	Null6, ItemDSString
	Null7, ItemDSString
	Null8, ItemDSString
}
#type End       2
{
	Signature, ItemCharSign
	Version, ItemCharShort
	Inserts, ItemCharShort
	messageId, ItemULong
	BindId,ItemULong
	ErrCode, ItemDSString
	Null2, ItemDSString
	Null3, ItemDSString
	Null4, ItemDSString
	Null5, ItemDSString
	Null6, ItemDSString
	Null7, ItemDSString
	Null8, ItemDSString
}

14f8aa22-7f4b-11d2-b389-0000f87a46c8 DsKccTask
#type Start     1
#type End       2
{
	Signature, ItemCharSign
	Version, ItemCharShort
	Inserts, ItemCharShort
	messageId, ItemULong
	BindId,ItemULong
	Null1, ItemDSString
	Null2, ItemDSString
	Null3, ItemDSString
	Null4, ItemDSString
	Null5, ItemDSString
	Null6, ItemDSString
	Null7, ItemDSString
	Null8, ItemDSString
}

14f8aa23-7f4b-11d2-b389-0000f87a46c8 DsDrsReplSync
#type Start     1
	Signature, ItemCharSign
	Version, ItemCharShort
	Inserts, ItemCharShort
	messageId, ItemULong
	BindId,ItemULong
	ObjDN, ItemDSString
	DraSrc, ItemDSString
	UuidSrc, ItemDSString
	Options, ItemDSString
	Null5, ItemDSString
	Null6, ItemDSString
	Null7, ItemDSString
	Null8, ItemDSString
}
#type End       2
{
	Signature, ItemCharSign
	Version, ItemCharShort
	Inserts, ItemCharShort
	messageId, ItemULong
	BindId,ItemULong
	ErrCode, ItemDSString
	Null2, ItemDSString
	Null3, ItemDSString
	Null4, ItemDSString
	Null5, ItemDSString
	Null6, ItemDSString
	Null7, ItemDSString
	Null8, ItemDSString
}

14f8aa24-7f4b-11d2-b389-0000f87a46c8 DsDrsReplGtChg
#type Start     1
{
	Signature, ItemCharSign
	Version, ItemCharShort
	Inserts, ItemCharShort
	messageId, ItemULong
	BindId,ItemULong
	UuidDest, ItemDSString
	NcDn, ItemDSString
	UsnFromHighObj, ItemDSString
	UsnFromHighProp, ItemDSString
	Flags, ItemDSString
	MaxObj, ItemDSString
	MaxBytes, ItemDSString
	ExtOp, ItemDSString
}
#type End       2
{
	Signature, ItemCharSign
	Version, ItemCharShort
	Inserts, ItemCharShort
	messageId, ItemULong
	BindId,ItemULong
	UsnToHighObj, ItemDSString
	UsnToHighProp, ItemDSString
	NumObj, ItemDSString
	NumByte, ItemDSString
	ExtRet, ItemDSString
	ErrCode, ItemDSString
	Null7, ItemDSString
	Null8, ItemDSString
}

14f8aa25-7f4b-11d2-b389-0000f87a46c8 DsDrsUpdtRefs
#type Start     1
{
	Signature, ItemCharSign
	Version, ItemCharShort
	Inserts, ItemCharShort
	messageId, ItemULong
	BindId,ItemULong
	NcDn, ItemDSString
	DsaDest, ItemDSString
	UuidDest, ItemDSString
	Options, ItemDSString
	Null5, ItemDSString
	Null6, ItemDSString
	Null7, ItemDSString
	Null8, ItemDSString
}
#type End       2
{
	Signature, ItemCharSign
	Version, ItemCharShort
	Inserts, ItemCharShort
	messageId, ItemULong
	BindId,ItemULong
	ErrCode, ItemDSString
	Null2, ItemDSString
	Null3, ItemDSString
	Null4, ItemDSString
	Null5, ItemDSString
	Null6, ItemDSString
	Null7, ItemDSString
	Null8, ItemDSString
}

14f8aa26-7f4b-11d2-b389-0000f87a46c8 DsDrsReplAdd
#type Start     1
{
	Signature, ItemCharSign
	Version, ItemCharShort
	Inserts, ItemCharShort
	messageId, ItemULong
	BindId,ItemULong
	NcDn, ItemDSString
	SrcDsaDn, ItemDSString
	TransDn, ItemDSString
	DsaSrc, ItemDSString
	Options, ItemDSString
	Null6, ItemDSString
	Null7, ItemDSString
	Null8, ItemDSString
}
#type End       2
{
	Signature, ItemCharSign
	Version, ItemCharShort
	Inserts, ItemCharShort
	messageId, ItemULong
	BindId,ItemULong
	ErrCode, ItemDSString
	Null2, ItemDSString
	Null3, ItemDSString
	Null4, ItemDSString
	Null5, ItemDSString
	Null6, ItemDSString
	Null7, ItemDSString
	Null8, ItemDSString
}

14f8aa27-7f4b-11d2-b389-0000f87a46c8 DsDrsReplMod
#type Start     1
{
	Signature, ItemCharSign
	Version, ItemCharShort
	Inserts, ItemCharShort
	messageId, ItemULong
	BindId,ItemULong
	NcDn, ItemDSString
	UuidSrc, ItemDSString
	SrcDra, ItemDSString
	RepFlags, ItemDSString
	ModFields, ItemDSString
	Options, ItemDSString
	Null7, ItemDSString
	Null8, ItemDSString
}
#type End       2
{
	Signature, ItemCharSign
	Version, ItemCharShort
	Inserts, ItemCharShort
	messageId, ItemULong
	BindId,ItemULong
	ErrCode, ItemDSString
	Null2, ItemDSString
	Null3, ItemDSString
	Null4, ItemDSString
	Null5, ItemDSString
	Null6, ItemDSString
	Null7, ItemDSString
	Null8, ItemDSString
}

14f8aa28-7f4b-11d2-b389-0000f87a46c8 DsDrsReplDel
#type Start     1
{
	Signature, ItemCharSign
	Version, ItemCharShort
	Inserts, ItemCharShort
	messageId, ItemULong
	BindId,ItemULong
	NcDn, ItemDSString
	DsaSrc, ItemDSString
	Options, ItemDSString
	Null4, ItemDSString
	Null5, ItemDSString
	Null6, ItemDSString
	Null7, ItemDSString
	Null8, ItemDSString
}
#type End       2
{
	Signature, ItemCharSign
	Version, ItemCharShort
	Inserts, ItemCharShort
	messageId, ItemULong
	BindId,ItemULong
	ErrCode, ItemDSString
	Null2, ItemDSString
	Null3, ItemDSString
	Null4, ItemDSString
	Null5, ItemDSString
	Null6, ItemDSString
	Null7, ItemDSString
	Null8, ItemDSString
}

14f8aa29-7f4b-11d2-b389-0000f87a46c8 DsDrsVrfyNames
#type Start     1
{
	Signature, ItemCharSign
	Version, ItemCharShort
	Inserts, ItemCharShort
	messageId, ItemULong
	BindId,ItemULong
	cNames, ItemDSString
	Flags, ItemDSString
	Null3, ItemDSString
	Null4, ItemDSString
	Null5, ItemDSString
	Null6, ItemDSString
	Null7, ItemDSString
	Null8, ItemDSString
}
#type End       2
{
	Signature, ItemCharSign
	Version, ItemCharShort
	Inserts, ItemCharShort
	messageId, ItemULong
	BindId,ItemULong
	ErrCode, ItemDSString
	Null2, ItemDSString
	Null3, ItemDSString
	Null4, ItemDSString
	Null5, ItemDSString
	Null6, ItemDSString
	Null7, ItemDSString
	Null8, ItemDSString
}

14f8aa2a-7f4b-11d2-b389-0000f87a46c8 DsDrsIntDmMv
#type Start     1
{
	Signature, ItemCharSign
	Version, ItemCharShort
	Inserts, ItemCharShort
	messageId, ItemULong
	BindId,ItemULong
	SrcDsaDn, ItemDSString
	SrcObjDn, ItemDSString
	DstNameDn, ItemDSString
	TargetNcDn, ItemDSString
	Null5, ItemDSString
	Null6, ItemDSString
	Null7, ItemDSString
	Null8, ItemDSString
}
#type End       2
{
	Signature, ItemCharSign
	Version, ItemCharShort
	Inserts, ItemCharShort
	messageId, ItemULong
	BindId,ItemULong
	ErrCode, ItemDSString
	Null2, ItemDSString
	Null3, ItemDSString
	Null4, ItemDSString
	Null5, ItemDSString
	Null6, ItemDSString
	Null7, ItemDSString
	Null8, ItemDSString
}

14f8aa2b-7f4b-11d2-b389-0000f87a46c8 DsDrsAddEntry
#type Start     1
{
	Signature, ItemCharSign
	Version, ItemCharShort
	Inserts, ItemCharShort
	messageId, ItemULong
	BindId,ItemULong
	cObj, ItemDSString
	NameDn, ItemDSString
	NextNameDn, ItemDSString
	Null4, ItemDSString
	Null5, ItemDSString
	Null6, ItemDSString
	Null7, ItemDSString
	Null8, ItemDSString
}
#type End       2
{
	Signature, ItemCharSign
	Version, ItemCharShort
	Inserts, ItemCharShort
	messageId, ItemULong
	BindId,ItemULong
	cObjAdded, ItemDSString
	ErrCode, ItemDSString
	Null3, ItemDSString
	Null4, ItemDSString
	Null5, ItemDSString
	Null6, ItemDSString
	Null7, ItemDSString
	Null8, ItemDSString
}

14f8aa2c-7f4b-11d2-b389-0000f87a46c8 DsDrsExecKcc
#type Start     1
{
	Signature, ItemCharSign
	Version, ItemCharShort
	Inserts, ItemCharShort
	messageId, ItemULong
	BindId,ItemULong
	TaskId, ItemDSString
	Flags, ItemDSString
	Null3, ItemDSString
	Null4, ItemDSString
	Null5, ItemDSString
	Null6, ItemDSString
	Null7, ItemDSString
	Null8, ItemDSString
}
#type End       2
{
	Signature, ItemCharSign
	Version, ItemCharShort
	Inserts, ItemCharShort
	messageId, ItemULong
	BindId,ItemULong
	ErrCode, ItemDSString
	Null2, ItemDSString
	Null3, ItemDSString
	Null4, ItemDSString
	Null5, ItemDSString
	Null6, ItemDSString
	Null7, ItemDSString
	Null8, ItemDSString
}

14f8aa2d-7f4b-11d2-b389-0000f87a46c8 DsDrsGtReplInfo
#type Start     1
{
	Signature, ItemCharSign
	Version, ItemCharShort
	Inserts, ItemCharShort
	messageId, ItemULong
	BindId,ItemULong
	InfoType, ItemDSString
	ObjDn, ItemDSString
	UuidSrc, ItemDSString
	Null4, ItemDSString
	Null5, ItemDSString
	Null6, ItemDSString
	Null7, ItemDSString
	Null8, ItemDSString
}
#type End       2
{
	Signature, ItemCharSign
	Version, ItemCharShort
	Inserts, ItemCharShort
	messageId, ItemULong
	BindId,ItemULong
	ErrCode, ItemDSString
	Null2, ItemDSString
	Null3, ItemDSString
	Null4, ItemDSString
	Null5, ItemDSString
	Null6, ItemDSString
	Null7, ItemDSString
	Null8, ItemDSString
}

14f8aa2e-7f4b-11d2-b389-0000f87a46c8 DsDrsGtNT4ChgLg
#type Start     1
{
	Signature, ItemCharSign
	Version, ItemCharShort
	Inserts, ItemCharShort
	messageId, ItemULong
	BindId,ItemULong
	flags, ItemDSString
	maxLen, ItemDSString
	Null3, ItemDSString
	Null4, ItemDSString
	Null5, ItemDSString
	Null6, ItemDSString
	Null7, ItemDSString
	Null8, ItemDSString
}
#type End       2
{
	Signature, ItemCharSign
	Version, ItemCharShort
	Inserts, ItemCharShort
	messageId, ItemULong
	BindId,ItemULong
	NtStatus, ItemDSString
	Null2, ItemDSString
	Null3, ItemDSString
	Null4, ItemDSString
	Null5, ItemDSString
	Null6, ItemDSString
	Null7, ItemDSString
	Null8, ItemDSString
}

14f8aa2f-7f4b-11d2-b389-0000f87a46c8 DsDrsCrackNames
#type Start     1
{
	Signature, ItemCharSign
	Version, ItemCharShort
	Inserts, ItemCharShort
	messageId, ItemULong
	BindId,ItemULong
	cNames, ItemDSString
	CodePage, ItemDSString
	LocaleId, ItemDSString
	FmtOffered, ItemDSString
	FmtDesired, ItemDSString
	Flags, ItemDSString
	Null7, ItemDSString
	Null8, ItemDSString
}
#type End       2
{
	Signature, ItemCharSign
	Version, ItemCharShort
	Inserts, ItemCharShort
	messageId, ItemULong
	BindId,ItemULong
	ErrCode, ItemDSString
	Null2, ItemDSString
	Null3, ItemDSString
	Null4, ItemDSString
	Null5, ItemDSString
	Null6, ItemDSString
	Null7, ItemDSString
	Null8, ItemDSString
}

14f8aa30-7f4b-11d2-b389-0000f87a46c8 DsDrsWrtSPN
#type Start     1
{
	Signature, ItemCharSign
	Version, ItemCharShort
	Inserts, ItemCharShort
	messageId, ItemULong
	BindId,ItemULong
	Account, ItemDSString
	Op, ItemDSString
	cSpn, ItemDSString
	Flags, ItemDSString
	Null5, ItemDSString
	Null6, ItemDSString
	Null7, ItemDSString
	Null8, ItemDSString
}
#type End       2
{
	Signature, ItemCharSign
	Version, ItemCharShort
	Inserts, ItemCharShort
	messageId, ItemULong
	BindId,ItemULong
	ErrCode, ItemDSString
	Null2, ItemDSString
	Null3, ItemDSString
	Null4, ItemDSString
	Null5, ItemDSString
	Null6, ItemDSString
	Null7, ItemDSString
	Null8, ItemDSString
}

14f8aa31-7f4b-11d2-b389-0000f87a46c8 DsDrsDCInfo
#type Start     1
{
	Signature, ItemCharSign
	Version, ItemCharShort
	Inserts, ItemCharShort
	messageId, ItemULong
	BindId,ItemULong
	Domain, ItemDSString
	InfoLevel, ItemDSString
	Null3, ItemDSString
	Null4, ItemDSString
	Null5, ItemDSString
	Null6, ItemDSString
	Null7, ItemDSString
	Null8, ItemDSString
}
#type End       2
{
	Signature, ItemCharSign
	Version, ItemCharShort
	Inserts, ItemCharShort
	messageId, ItemULong
	BindId,ItemULong
	ErrCode, ItemDSString
	Null2, ItemDSString
	Null3, ItemDSString
	Null4, ItemDSString
	Null5, ItemDSString
	Null6, ItemDSString
	Null7, ItemDSString
	Null8, ItemDSString
}

14f8aa32-7f4b-11d2-b389-0000f87a46c8 DsDrsGtMbrshps
#type Start     1
{
	Signature, ItemCharSign
	Version, ItemCharShort
	Inserts, ItemCharShort
	messageId, ItemULong
	BindId,ItemULong
	cDsNames, ItemDSString
	OpType, ItemDSString
	LimitDomDn, ItemDSString
	Flags, ItemDSString
	Null5, ItemDSString
	Null6, ItemDSString
	Null7, ItemDSString
	Null8, ItemDSString
}
#type End       2
{
	Signature, ItemCharSign
	Version, ItemCharShort
	Inserts, ItemCharShort
	messageId, ItemULong
	BindId,ItemULong
	ErrCode, ItemDSString
	Null2, ItemDSString
	Null3, ItemDSString
	Null4, ItemDSString
	Null5, ItemDSString
	Null6, ItemDSString
	Null7, ItemDSString
	Null8, ItemDSString
}

5b7eb154-7441-11d2-b711-00c04fb998a2 LdapAtqGuid
#type Start	1
#type End	2
{
	Signature, ItemCharSign
	Version, ItemCharShort
	Inserts, ItemCharShort
	messageId, ItemULong
	BindId,ItemULong
}

b9d4702a-6a98-11d2-b710-00c04fb998a2 LdapRequest
#type Start	1
{
	Signature, ItemCharSign
	Version, ItemCharShort
	Inserts, ItemCharShort
	messageId, ItemULong
	BindId,ItemULong
	Choice, ItemDSString
	Null2, ItemDSString
	Null3, ItemDSString
	Null4, ItemDSString
	Null5, ItemDSString
	Null6, ItemDSString
	Null7, ItemDSString
	Null8, ItemDSString
}
#type End	2
{
	Signature, ItemCharSign
	Version, ItemCharShort
	Inserts, ItemCharShort
	messageId, ItemULong
	BindId,ItemULong
	Id, ItemDSString
	ErrCode, ItemDSString
	Null3, ItemDSString
	Null4, ItemDSString
	Null5, ItemDSString
	Null6, ItemDSString
	Null7, ItemDSString
	Null8, ItemDSString
}

//******************************************
// KDC Events 
// 24db8964-e6bc-11d1-916a-0000f8045b04
//******************************************

50af5304-e6bc-11d1-916a-0000f8045b04 GetASTicket
#type Start	1
{
	KdcOption, ItemULongX
}
#type End	2
{
	KerbErr, ItemULongX
	Client, ItemPWString
	Server, ItemPWString
	RequestRealm, ItemPWString
}

c11cf384-e6bd-11d1-916a-0000f8045b04 TGSRequest
#type Start	1
{
	KdcOption, ItemULongX
}
#type End	2
{
	KerbErr, ItemULongX
	Client, ItemPWString
	ServerAcct, ItemPWString
	ClientRealm, ItemPWString
}

//******************************************
// SAM Events 
// 8e598056-8993-11d2-819e-0000f875a064
//******************************************

39511dbe-899b-11d2-819e-0000f875a064 SamUserCreate
#type Start	1
#type End	2

abb14b68-899b-11d2-819e-0000f875a064 SamCompCreate
#type Start	1
#type End	2

c8eb5e5c-899c-11d2-819e-0000f875a064 SamGrpCreate
#type Start	1
#type End	2

f9d2ba6a-899c-11d2-819e-0000f875a064 SamAddMemGrp
#type Start	1
#type End	2

250959aa-899d-11d2-819e-0000f875a064 SamDelMemGrp
#type Start	1
#type End	2

45fc997e-899d-11d2-819e-0000f875a064 SamPwdChng
#type Start	1
#type End	2

62bef71e-899d-11d2-819e-0000f875a064 SamUserPwdSet
#type Start	1
#type End	2

880217b8-899d-11d2-819e-0000f875a064 SamCompPwdSet
#type Start	1
#type End	2

1f228de8-8a6c-11d2-819e-0000f875a064 SamPwdPushPdc
#type Start	1
#type End	2

a41d90bc-899d-11d2-819e-0000f875a064 SamIdByName
#type Start	1
#type End	2

25059476-899f-11d2-819e-0000f875a064 SamNameById
#type Start	1
#type End	2

//******************************************
// LSA Events
// cc85922f-db41-11d2-9244-006008269001 MSLSATrace
//******************************************

cc85922e-db41-11d2-9244-006008269001 QuerySecret
#type Start	1
#type End	2

2306fe3b-dbf6-11d2-9244-006008269001 Close
#type Start	1
#type End	2

2306fe3a-dbf6-11d2-9244-006008269001 OpenPolicy
#type Start	1
#type End	2

2306fe39-dbf6-11d2-9244-006008269001 QueryInformationPolicy
#type Start	1
#type End	2

2306fe38-dbf6-11d2-9244-006008269001 SetInformationPolicy
#type Start	1
#type End	2

2306fe37-dbf6-11d2-9244-006008269001 EnumerateTrustedDomains
#type Start	1
#type End	2

2306fe36-dbf6-11d2-9244-006008269001 LookupNames
#type Start	1
#type End	2

2306fe35-dbf6-11d2-9244-006008269001 LookupSids
#type Start	1
#type End	2

2306fe34-dbf6-11d2-9244-006008269001 OpenTrustedDomain
#type Start	1
#type End	2

2306fe33-dbf6-11d2-9244-006008269001 QueryInfoTrustedDomain
#type Start	1
#type End	2

2306fe32-dbf6-11d2-9244-006008269001 SetInformationTrustedDomain
#type Start	1
#type End	2

2306fe31-dbf6-11d2-9244-006008269001 QueryInformationPolicy2
#type Start	1
#type End	2

2306fe30-dbf6-11d2-9244-006008269001 SetInformationPolicy2
#type Start	1
#type End	2

2306fe2f-dbf6-11d2-9244-006008269001 QueryTrustedDomainInfoByName
#type Start	1
#type End	2

2306fe2e-dbf6-11d2-9244-006008269001 SetTrustedDomainInfoByName
#type Start	1
#type End	2

2306fe2d-dbf6-11d2-9244-006008269001 EnumerateTrustedDomainsEx
#type Start	1
#type End	2

2306fe2c-dbf6-11d2-9244-006008269001 CreateTrustedDomainEx
#type Start	1
#type End	2

2306fe2b-dbf6-11d2-9244-006008269001 QueryDomainInformationPolicy
#type Start	1
#type End	2

2306fe2a-dbf6-11d2-9244-006008269001 SetDomainInformationPolicy
#type Start	1
#type End	2

2306fe29-dbf6-11d2-9244-006008269001 OpenTrustedDomainByName
#type Start	1
#type End	2

// Netdevice
f404cdf8-6926-11d2-a059-00a0c95b7f08 NetDevice
#typev Normal 10 "%11!2d!, %4: %12!s!"
{
 Ordinal, ItemULongX    // 10
 CPU Num, ItemUShort    // 11
 Message, ItemString    // 12
}
#type BytesIndicated 11 "%11, %4: NDBothHandleReceiveIndication (%15): Conn[%12], Indicated %13, Available %14"
{
 Ordinal, ItemULongX    // 10
 CPU Num, ItemUShort    // 11
 ConnIdx, ItemUShort    // 12
 Indicated, ItemULong   // 13
 Available, ItemULong   // 14
 Message, ItemString    // 15
}
#type BuildReceiveIrpEnter 20 "%11, %4: NDBothBuildReceiveIrp: Entry"
{
 Ordinal, ItemULongX    // 10
 CPU Num, ItemUShort    // 11
}
#type BuildReceiveIrpInfo  23 "%11, %4: NDBothBuildReceiveIrp as %13: Conn[%12], Phase = %14"
{
 Ordinal, ItemULongX    // 10
 CPU Num, ItemUShort    // 11
 ConnIdx, ItemUShort    // 12
 DriverType,ItemString  // 13
 ConnPhase, ItemString  // 14
}
#type BuildReceiveIrpCounts 26 "%11, %4: NDBothBuildReceiveIrp as %17: Bytes for Sec %12, Buf %13, Hdr %14, Rcb In = %15, Out = %16"
{
 Ordinal, ItemULongX    // 10
 CPU Num, ItemUShort    // 11
 SecBytes,ItemULong     // 12
 BufBytes,ItemULong     // 13
 HdrBytes,ItemULong     // 14
 RcbInIdx,ItemUShort    // 15
 RcbOutIdx,ItemUShort   // 16
 DriverType,ItemString  // 17
}
#type BuildReceiveIrpExit  29 "%11, %4: NDBothBuildReceiveIrp: Exit"
{
 Ordinal, ItemULongX    // 10
 CPU Num, ItemUShort    // 11
}
#type ProcessIncomingBufferEntry  120 "%11, %4: NDBothProcessIncomingBuffer: Entry"
{
 Ordinal, ItemULongX    // 10
 CPU Num, ItemUShort    // 11
}
#type ProcessIncomingBufferIgnore 126 "%11, %4: NDBothProcessIncomingBuffer: Ignoring Message"
{
 Ordinal, ItemULongX    // 10
 CPU Num, ItemUShort    // 11
}
#type ProcessIncomingBufferExit   129 "%11, %4: NDBothProcessIncomingBuffer: Exit"
{
 Ordinal, ItemULongX    // 10
 CPU Num, ItemUShort    // 11
}
#type ProcessNewHeaderEnter    130 "%11, %4: NDBothProcessNewHeader: Entry"
{
 Ordinal, ItemULongX    // 10
 CPU Num, ItemUShort    // 11
}
#type ProcessNewHeaderAnnounce 132 "%11, %4: NDBothProcessNewHeader as %16 for RCB[%12] on Conn[%15] is Rqst Id 0x%13_%14"
{
 Ordinal, ItemULongX    // 10
 CPU Num, ItemUShort    // 11
 RCB Idx, ItemUShort    // 12
 Rqst IdH,ItemULongX	// 13
 Rqst IdL,ItemULongX	// 14
 Conn Idx,ItemUShort	// 15
 DriverType,ItemString	// 16
}
#type ProcessNewHeaderExit     148 "%11, %4: NDBothProcessNewHeader: Exit"
{
 Ordinal, ItemULongX    // 10
 CPU Num, ItemUShort    // 11
}


5eb2d7d2-c2af-11d2-afc3-00c04f8ef2f7 Sample
#typev  Ascii 10  "00000000.%3!08X!::%4!s! [%1!s!] <%9!d!> Type: %2, Seq: %10!d! Str1: %11!s!"
//#typev  Ascii 0  "0,%3!08X!,%4!s!,%1!s!,%9!d!,%2,%10!d!,%11!s!"
{
    Sequence, ItemUlong	     // 10
    AsciiStr, ItemString     // 11
}
//#typev Wchar 11 "00000000.%3!08X!::%4!s! [%1!s!] <%9!d!> Type: %2!s!, Seq: %10!d! Str1: %11!s!"
//#typev Wchar 11  "0,%3!08X!,%4!s!,%1!s!,%9!d!,%2,%10!d!,%11!s!"
//{
//    Sequence,ItemUlong		// 10
//    UnicodeStr, ItemWString     // 11
//}