Where is the list of device driver images stored in ETW?

Happy to hear you enjoy using the TraceProcessor library!

Device drivers are logged against the "Idle (0)" process by ETW, here is an example:

  using var tp = TraceProcessor.Create(@"trace.etl");

  var processes = tp.UseProcesses();

  tp.Process();

  var idleProcess = processes.Result.Processes.FirstOrDefault(x => x.Id == 0);

  foreach (var image in idleProcess?.Images)
  {
        Console.WriteLine(image.Path);
  }

Where is the list of device driver images stored in ETW?

Related

Recent Posts