diff --git a/windows/winobject/event_trace.py b/windows/winobject/event_trace.py index a130d59..e427460 100644 --- a/windows/winobject/event_trace.py +++ b/windows/winobject/event_trace.py @@ -48,6 +48,10 @@ class EventRecord(gdef.EVENT_RECORD): def level(self): return self.EventHeader.EventDescriptor.Level + @property + def context(self): + return ctypes.py_object.from_address(self.UserContext).value + @property def user_data(self): """Event specific data @@ -217,7 +221,7 @@ class EtwTrace(object): return windows.winproxy.EnableTraceEx2(self.handle, guid, EVENT_CONTROL_CODE_ENABLE_PROVIDER, level , any_keyword, all_keyword, 0, None) - def process(self, callback, begin=None, end=None): + def process(self, callback, begin=None, end=None, context = None): if end == "now": end = gdef.FILETIME() windows.winproxy.GetSystemTimeAsFileTime(end) @@ -233,6 +237,10 @@ class EtwTrace(object): # logfile.ProcessTraceMode |= gdef.PROCESS_TRACE_MODE_REAL_TIME logfile.LogFileName = self.logfile + if context: + context_ptr = ctypes.pointer(ctypes.py_object(context)) + logfile.Context = ctypes.cast(context_ptr, ctypes.c_void_p) + @ctypes.WINFUNCTYPE(gdef.PVOID, PEventRecord) def real_callback(record_ptr): try: