diff --git a/Manifests-Win10-17134/Microsoft-Windows-Kernel-Audit-API-Calls.xml b/Manifests-Win10-17134/Microsoft-Windows-Kernel-Audit-API-Calls.xml
index f4601ff..65eecb4 100644
--- a/Manifests-Win10-17134/Microsoft-Windows-Kernel-Audit-API-Calls.xml
+++ b/Manifests-Win10-17134/Microsoft-Windows-Kernel-Audit-API-Calls.xml
@@ -8,45 +8,45 @@
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
diff --git a/Manifests-Win10-17134/Microsoft-Windows-Kernel-General.xml b/Manifests-Win10-17134/Microsoft-Windows-Kernel-General.xml
index 4d65ec9..9b24117 100644
--- a/Manifests-Win10-17134/Microsoft-Windows-Kernel-General.xml
+++ b/Manifests-Win10-17134/Microsoft-Windows-Kernel-General.xml
@@ -1,6 +1,7 @@
+
@@ -25,7 +26,7 @@
-
+
@@ -35,7 +36,9 @@
-
+
+
+
@@ -43,7 +46,7 @@
-
+
@@ -72,7 +75,7 @@
-
+
@@ -153,6 +156,140 @@
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/README.md b/README.md
index da7fdfa..c9086fa 100644
--- a/README.md
+++ b/README.md
@@ -1,13 +1,22 @@
# ETW Providers Docs
-Windows 7 - [/Manifests-Win7-7600](/Manifest-Win7-7600)
+Windows 7 - [/Manifests-Win7-7600](/Manifests-Win7-7600)
-Windows 10 - [/Manifests-Win10-1734](/Manifest-Win10-1734)
+Windows 10 - [/Manifests-Win10-17134](/Manifests-Win10-17134)
Windows provides the ETW framework for event tracing. The ETW framework comes with many built-in ETW providers, but
most of them are not documented very well.
Using tdh.h API provider information can be dumped. For manifest based providers, a manifest can be recreated using the same method perfview uses:
(https://github.com/Kae7in/perfview/blob/444fd391db9b8275846e2a5bbb8ec1d6e73a5dad/src/PerfView/Extensibility.cs#L2523)
-For non-manifest based providers, currently only keywords are dumped. But theoretically you can register to the provider and just cache
+(this is not the original manifest, because manifests are compiled) For non-manifest based providers, currently only keywords are dumped. But theoretically you can register to the provider and just cache
all the results from all the events (in this case the event must be raised for it to be documented)
+
+Moreover, in a quest to find more interesting ETW providers, I started reversing specific ETW providers and document the manifests.
+Some manifests were found in open source Microsoft repositories:
+- [https://github.com/microsoft/Tx/tree/master/Manifests](https://github.com/microsoft/Tx/tree/master/Manifests)
+
+Currently reverse engineered providers:
+
+- [/Manifests-Win10-17134/Microsoft-Windows-Kernel-Audit-API-Calls](/Manifests-Win10-17134/Microsoft-Windows-Kernel-Audit-API-Calls.xml) - reverse engineered from ntoskrnl symbols
+- [/Manifests-Win10-17134/Microsoft-Windows-Kernel-General](/Manifests-Win10-17134/Microsoft-Windows-Kernel-Audit-API-Calls.xml) - found in microsoft open source repo