/etl/parsers/etw/Microsoft_Windows_WebAuthN.py

https://github.com/airbus-cert/etl-parser · Python · 888 lines · 714 code · 169 blank · 5 comment · 0 complexity · 8a8729b2e4973f140402d110edabcd4a MD5 · raw file

  1. # -*- coding: utf-8 -*-
  2. """
  3. Microsoft-Windows-WebAuthN
  4. GUID : 3ae1ea61-c002-47fb-b06c-4022a8c98929
  5. """
  6. from construct import Int8sl, Int8ul, Int16ul, Int16sl, Int32sl, Int32ul, Int64sl, Int64ul, Bytes, Double, Float32l, Struct
  7. from etl.utils import WString, CString, SystemTime, Guid
  8. from etl.dtyp import Sid
  9. from etl.parsers.etw.core import Etw, declare, guid
  10. @declare(guid=guid("3ae1ea61-c002-47fb-b06c-4022a8c98929"), event_id=1000, version=0)
  11. class Microsoft_Windows_WebAuthN_1000_0(Etw):
  12. pattern = Struct(
  13. "TransactionId" / Guid
  14. )
  15. @declare(guid=guid("3ae1ea61-c002-47fb-b06c-4022a8c98929"), event_id=1001, version=0)
  16. class Microsoft_Windows_WebAuthN_1001_0(Etw):
  17. pattern = Struct(
  18. "TransactionId" / Guid
  19. )
  20. @declare(guid=guid("3ae1ea61-c002-47fb-b06c-4022a8c98929"), event_id=1002, version=0)
  21. class Microsoft_Windows_WebAuthN_1002_0(Etw):
  22. pattern = Struct(
  23. "TransactionId" / Guid,
  24. "Error" / Int32ul,
  25. "HResult" / Int32sl
  26. )
  27. @declare(guid=guid("3ae1ea61-c002-47fb-b06c-4022a8c98929"), event_id=1003, version=0)
  28. class Microsoft_Windows_WebAuthN_1003_0(Etw):
  29. pattern = Struct(
  30. "TransactionId" / Guid
  31. )
  32. @declare(guid=guid("3ae1ea61-c002-47fb-b06c-4022a8c98929"), event_id=1004, version=0)
  33. class Microsoft_Windows_WebAuthN_1004_0(Etw):
  34. pattern = Struct(
  35. "TransactionId" / Guid
  36. )
  37. @declare(guid=guid("3ae1ea61-c002-47fb-b06c-4022a8c98929"), event_id=1005, version=0)
  38. class Microsoft_Windows_WebAuthN_1005_0(Etw):
  39. pattern = Struct(
  40. "TransactionId" / Guid,
  41. "Error" / Int32ul,
  42. "HResult" / Int32sl
  43. )
  44. @declare(guid=guid("3ae1ea61-c002-47fb-b06c-4022a8c98929"), event_id=1006, version=0)
  45. class Microsoft_Windows_WebAuthN_1006_0(Etw):
  46. pattern = Struct(
  47. "TransactionId" / Guid,
  48. "TicketLength" / Int32ul,
  49. "Ticket" / Bytes(lambda this: this.TicketLength)
  50. )
  51. @declare(guid=guid("3ae1ea61-c002-47fb-b06c-4022a8c98929"), event_id=1007, version=0)
  52. class Microsoft_Windows_WebAuthN_1007_0(Etw):
  53. pattern = Struct(
  54. "TransactionId" / Guid
  55. )
  56. @declare(guid=guid("3ae1ea61-c002-47fb-b06c-4022a8c98929"), event_id=1008, version=0)
  57. class Microsoft_Windows_WebAuthN_1008_0(Etw):
  58. pattern = Struct(
  59. "TransactionId" / Guid,
  60. "Error" / Int32ul,
  61. "HResult" / Int32sl
  62. )
  63. @declare(guid=guid("3ae1ea61-c002-47fb-b06c-4022a8c98929"), event_id=1020, version=0)
  64. class Microsoft_Windows_WebAuthN_1020_0(Etw):
  65. pattern = Struct(
  66. "TransactionId" / Guid
  67. )
  68. @declare(guid=guid("3ae1ea61-c002-47fb-b06c-4022a8c98929"), event_id=1021, version=0)
  69. class Microsoft_Windows_WebAuthN_1021_0(Etw):
  70. pattern = Struct(
  71. "TransactionId" / Guid
  72. )
  73. @declare(guid=guid("3ae1ea61-c002-47fb-b06c-4022a8c98929"), event_id=1022, version=0)
  74. class Microsoft_Windows_WebAuthN_1022_0(Etw):
  75. pattern = Struct(
  76. "TransactionId" / Guid,
  77. "Error" / Int32ul,
  78. "HResult" / Int32sl
  79. )
  80. @declare(guid=guid("3ae1ea61-c002-47fb-b06c-4022a8c98929"), event_id=1023, version=0)
  81. class Microsoft_Windows_WebAuthN_1023_0(Etw):
  82. pattern = Struct(
  83. "TransactionId" / Guid
  84. )
  85. @declare(guid=guid("3ae1ea61-c002-47fb-b06c-4022a8c98929"), event_id=1024, version=0)
  86. class Microsoft_Windows_WebAuthN_1024_0(Etw):
  87. pattern = Struct(
  88. "TransactionId" / Guid
  89. )
  90. @declare(guid=guid("3ae1ea61-c002-47fb-b06c-4022a8c98929"), event_id=1025, version=0)
  91. class Microsoft_Windows_WebAuthN_1025_0(Etw):
  92. pattern = Struct(
  93. "TransactionId" / Guid,
  94. "Error" / Int32ul,
  95. "HResult" / Int32sl
  96. )
  97. @declare(guid=guid("3ae1ea61-c002-47fb-b06c-4022a8c98929"), event_id=1040, version=0)
  98. class Microsoft_Windows_WebAuthN_1040_0(Etw):
  99. pattern = Struct(
  100. "TransactionId" / Guid,
  101. "RpId" / WString,
  102. "AccountId" / WString,
  103. "ClientDataHashAlgId" / WString,
  104. "ClientDataLength" / Int32ul,
  105. "ClientDataHashLength" / Int32ul,
  106. "ClientDataHash" / Bytes(lambda this: this.ClientDataHashLength),
  107. "CredentialCount" / Int32ul,
  108. "CredentialParameterCount" / Int32ul
  109. )
  110. @declare(guid=guid("3ae1ea61-c002-47fb-b06c-4022a8c98929"), event_id=1041, version=0)
  111. class Microsoft_Windows_WebAuthN_1041_0(Etw):
  112. pattern = Struct(
  113. "TransactionId" / Guid,
  114. "AttestationFormatType" / WString,
  115. "RpIdHashLength" / Int32ul,
  116. "RpIdHash" / Bytes(lambda this: this.RpIdHashLength),
  117. "Flags" / Int32ul,
  118. "SignCount" / Int32ul,
  119. "AAGuid" / Guid,
  120. "CredentialIdLength" / Int32ul,
  121. "CredentialId" / Bytes(lambda this: this.CredentialIdLength),
  122. "U2fPublicKey" / Int8ul,
  123. "PublicKeyLength" / Int32ul,
  124. "PublicKey" / Bytes(lambda this: this.PublicKeyLength),
  125. "ResponseLength" / Int32ul,
  126. "Response" / Bytes(lambda this: this.ResponseLength)
  127. )
  128. @declare(guid=guid("3ae1ea61-c002-47fb-b06c-4022a8c98929"), event_id=1042, version=0)
  129. class Microsoft_Windows_WebAuthN_1042_0(Etw):
  130. pattern = Struct(
  131. "TransactionId" / Guid,
  132. "RpId" / WString,
  133. "ClientDataHashAlgId" / WString,
  134. "ClientDataLength" / Int32ul,
  135. "ClientDataHashLength" / Int32ul,
  136. "ClientDataHash" / Bytes(lambda this: this.ClientDataHashLength),
  137. "CredentialCount" / Int32ul
  138. )
  139. @declare(guid=guid("3ae1ea61-c002-47fb-b06c-4022a8c98929"), event_id=1043, version=0)
  140. class Microsoft_Windows_WebAuthN_1043_0(Etw):
  141. pattern = Struct(
  142. "TransactionId" / Guid,
  143. "RpIdHashLength" / Int32ul,
  144. "RpIdHash" / Bytes(lambda this: this.RpIdHashLength),
  145. "Flags" / Int32ul,
  146. "SignCount" / Int32ul,
  147. "CredentialIdLength" / Int32ul,
  148. "CredentialId" / Bytes(lambda this: this.CredentialIdLength)
  149. )
  150. @declare(guid=guid("3ae1ea61-c002-47fb-b06c-4022a8c98929"), event_id=1060, version=0)
  151. class Microsoft_Windows_WebAuthN_1060_0(Etw):
  152. pattern = Struct(
  153. "TransactionId" / Guid,
  154. "Action" / CString,
  155. "Error" / Int32ul,
  156. "HResult" / Int32sl
  157. )
  158. @declare(guid=guid("3ae1ea61-c002-47fb-b06c-4022a8c98929"), event_id=1100, version=0)
  159. class Microsoft_Windows_WebAuthN_1100_0(Etw):
  160. pattern = Struct(
  161. "TransactionId" / Guid,
  162. "Function" / CString,
  163. "CborError" / Int32sl,
  164. "CborErrorString" / CString,
  165. "ErrorOffset" / Int32ul,
  166. "LineNumber" / Int32ul,
  167. "EncodedLength" / Int32ul,
  168. "Encoded" / Bytes(lambda this: this.EncodedLength)
  169. )
  170. @declare(guid=guid("3ae1ea61-c002-47fb-b06c-4022a8c98929"), event_id=1101, version=0)
  171. class Microsoft_Windows_WebAuthN_1101_0(Etw):
  172. pattern = Struct(
  173. "TransactionId" / Guid,
  174. "RpId" / WString,
  175. "UserIdLength" / Int32ul,
  176. "UserId" / Bytes(lambda this: this.UserIdLength),
  177. "ClientDataHashAlgId" / WString,
  178. "ClientDataLength" / Int32ul,
  179. "ClientDataHashLength" / Int32ul,
  180. "ClientDataHash" / Bytes(lambda this: this.ClientDataHashLength),
  181. "RequireResidentKey" / Int8ul,
  182. "CredentialCount" / Int32ul,
  183. "CredentialParameterCount" / Int32ul,
  184. "RequestLength" / Int32ul,
  185. "Request" / Bytes(lambda this: this.RequestLength)
  186. )
  187. @declare(guid=guid("3ae1ea61-c002-47fb-b06c-4022a8c98929"), event_id=1102, version=0)
  188. class Microsoft_Windows_WebAuthN_1102_0(Etw):
  189. pattern = Struct(
  190. "TransactionId" / Guid,
  191. "AttestationFormatType" / WString,
  192. "RpIdHashLength" / Int32ul,
  193. "RpIdHash" / Bytes(lambda this: this.RpIdHashLength),
  194. "Flags" / Int32ul,
  195. "SignCount" / Int32ul,
  196. "AAGuid" / Guid,
  197. "CredentialIdLength" / Int32ul,
  198. "CredentialId" / Bytes(lambda this: this.CredentialIdLength),
  199. "U2fPublicKey" / Int8ul,
  200. "PublicKeyLength" / Int32ul,
  201. "PublicKey" / Bytes(lambda this: this.PublicKeyLength),
  202. "ResponseLength" / Int32ul,
  203. "Response" / Bytes(lambda this: this.ResponseLength)
  204. )
  205. @declare(guid=guid("3ae1ea61-c002-47fb-b06c-4022a8c98929"), event_id=1103, version=0)
  206. class Microsoft_Windows_WebAuthN_1103_0(Etw):
  207. pattern = Struct(
  208. "TransactionId" / Guid,
  209. "RpId" / WString,
  210. "ClientDataHashAlgId" / WString,
  211. "ClientDataLength" / Int32ul,
  212. "ClientDataHashLength" / Int32ul,
  213. "ClientDataHash" / Bytes(lambda this: this.ClientDataHashLength),
  214. "CredentialCount" / Int32ul,
  215. "RequestLength" / Int32ul,
  216. "Request" / Bytes(lambda this: this.RequestLength)
  217. )
  218. @declare(guid=guid("3ae1ea61-c002-47fb-b06c-4022a8c98929"), event_id=1104, version=0)
  219. class Microsoft_Windows_WebAuthN_1104_0(Etw):
  220. pattern = Struct(
  221. "TransactionId" / Guid,
  222. "RpIdHashLength" / Int32ul,
  223. "RpIdHash" / Bytes(lambda this: this.RpIdHashLength),
  224. "Flags" / Int32ul,
  225. "SignCount" / Int32ul,
  226. "CredentialIdLength" / Int32ul,
  227. "CredentialId" / Bytes(lambda this: this.CredentialIdLength),
  228. "ResponseLength" / Int32ul,
  229. "Response" / Bytes(lambda this: this.ResponseLength)
  230. )
  231. @declare(guid=guid("3ae1ea61-c002-47fb-b06c-4022a8c98929"), event_id=2100, version=0)
  232. class Microsoft_Windows_WebAuthN_2100_0(Etw):
  233. pattern = Struct(
  234. "Command" / WString,
  235. "TransactionId" / Guid,
  236. "Flags" / Int32ul,
  237. "TimeoutMilliseconds" / Int32ul,
  238. "TicketLength" / Int32ul,
  239. "Ticket" / Bytes(lambda this: this.TicketLength),
  240. "RequestLength" / Int32ul,
  241. "Request" / Bytes(lambda this: this.RequestLength)
  242. )
  243. @declare(guid=guid("3ae1ea61-c002-47fb-b06c-4022a8c98929"), event_id=2101, version=0)
  244. class Microsoft_Windows_WebAuthN_2101_0(Etw):
  245. pattern = Struct(
  246. "RequestLength" / Int32ul,
  247. "Request" / Bytes(lambda this: this.RequestLength)
  248. )
  249. @declare(guid=guid("3ae1ea61-c002-47fb-b06c-4022a8c98929"), event_id=2102, version=0)
  250. class Microsoft_Windows_WebAuthN_2102_0(Etw):
  251. pattern = Struct(
  252. "Command" / WString,
  253. "TransactionId" / Guid,
  254. "ResponseLength" / Int32ul,
  255. "Response" / Bytes(lambda this: this.ResponseLength)
  256. )
  257. @declare(guid=guid("3ae1ea61-c002-47fb-b06c-4022a8c98929"), event_id=2103, version=0)
  258. class Microsoft_Windows_WebAuthN_2103_0(Etw):
  259. pattern = Struct(
  260. "Command" / WString,
  261. "TransactionId" / Guid,
  262. "Error" / Int32ul,
  263. "Win32Error" / Int32ul
  264. )
  265. @declare(guid=guid("3ae1ea61-c002-47fb-b06c-4022a8c98929"), event_id=2104, version=0)
  266. class Microsoft_Windows_WebAuthN_2104_0(Etw):
  267. pattern = Struct(
  268. "TransactionId" / Guid,
  269. "ProviderName" / WString,
  270. "DevicePath" / WString,
  271. "Manufacturer" / WString,
  272. "Product" / WString,
  273. "AAGuid" / Guid,
  274. "U2fProtocol" / Int8ul
  275. )
  276. @declare(guid=guid("3ae1ea61-c002-47fb-b06c-4022a8c98929"), event_id=2105, version=0)
  277. class Microsoft_Windows_WebAuthN_2105_0(Etw):
  278. pattern = Struct(
  279. "Function" / CString,
  280. "Location" / CString,
  281. "Error" / Int32ul,
  282. "Win32Error" / Int32ul
  283. )
  284. @declare(guid=guid("3ae1ea61-c002-47fb-b06c-4022a8c98929"), event_id=2106, version=0)
  285. class Microsoft_Windows_WebAuthN_2106_0(Etw):
  286. pattern = Struct(
  287. "Name" / WString,
  288. "Value" / WString
  289. )
  290. @declare(guid=guid("3ae1ea61-c002-47fb-b06c-4022a8c98929"), event_id=2110, version=0)
  291. class Microsoft_Windows_WebAuthN_2110_0(Etw):
  292. pattern = Struct(
  293. "Transport" / Int32ul,
  294. "WnfState" / Int32ul,
  295. "Error" / Int32ul,
  296. "Win32Error" / Int32ul
  297. )
  298. @declare(guid=guid("3ae1ea61-c002-47fb-b06c-4022a8c98929"), event_id=2111, version=0)
  299. class Microsoft_Windows_WebAuthN_2111_0(Etw):
  300. pattern = Struct(
  301. "Transport" / Int32ul
  302. )
  303. @declare(guid=guid("3ae1ea61-c002-47fb-b06c-4022a8c98929"), event_id=2200, version=0)
  304. class Microsoft_Windows_WebAuthN_2200_0(Etw):
  305. pattern = Struct(
  306. "TransactionId" / Guid
  307. )
  308. @declare(guid=guid("3ae1ea61-c002-47fb-b06c-4022a8c98929"), event_id=2201, version=0)
  309. class Microsoft_Windows_WebAuthN_2201_0(Etw):
  310. pattern = Struct(
  311. "TransactionId" / Guid
  312. )
  313. @declare(guid=guid("3ae1ea61-c002-47fb-b06c-4022a8c98929"), event_id=2202, version=0)
  314. class Microsoft_Windows_WebAuthN_2202_0(Etw):
  315. pattern = Struct(
  316. "TransactionId" / Guid,
  317. "Error" / Int32ul,
  318. "Win32Error" / Int32ul
  319. )
  320. @declare(guid=guid("3ae1ea61-c002-47fb-b06c-4022a8c98929"), event_id=2203, version=0)
  321. class Microsoft_Windows_WebAuthN_2203_0(Etw):
  322. pattern = Struct(
  323. "TransactionId" / Guid,
  324. "Error" / Int32ul,
  325. "Win32Error" / Int32ul
  326. )
  327. @declare(guid=guid("3ae1ea61-c002-47fb-b06c-4022a8c98929"), event_id=2210, version=0)
  328. class Microsoft_Windows_WebAuthN_2210_0(Etw):
  329. pattern = Struct(
  330. "TransactionId" / Guid,
  331. "DevicePath" / WString,
  332. "Manufacturer" / WString,
  333. "Product" / WString
  334. )
  335. @declare(guid=guid("3ae1ea61-c002-47fb-b06c-4022a8c98929"), event_id=2211, version=0)
  336. class Microsoft_Windows_WebAuthN_2211_0(Etw):
  337. pattern = Struct(
  338. "TransactionId" / Guid,
  339. "DevicePath" / WString,
  340. "Manufacturer" / WString,
  341. "Product" / WString,
  342. "AAGuid" / Guid,
  343. "U2fProtocol" / Int8ul
  344. )
  345. @declare(guid=guid("3ae1ea61-c002-47fb-b06c-4022a8c98929"), event_id=2212, version=0)
  346. class Microsoft_Windows_WebAuthN_2212_0(Etw):
  347. pattern = Struct(
  348. "TransactionId" / Guid,
  349. "DevicePath" / WString,
  350. "Manufacturer" / WString,
  351. "Product" / WString,
  352. "AAGuid" / Guid,
  353. "U2fProtocol" / Int8ul,
  354. "State" / Int32ul,
  355. "Status" / Int32ul,
  356. "Error" / Int32ul,
  357. "Win32Error" / Int32ul
  358. )
  359. @declare(guid=guid("3ae1ea61-c002-47fb-b06c-4022a8c98929"), event_id=2213, version=0)
  360. class Microsoft_Windows_WebAuthN_2213_0(Etw):
  361. pattern = Struct(
  362. "TransactionId" / Guid,
  363. "DevicePath" / WString,
  364. "Manufacturer" / WString,
  365. "Product" / WString,
  366. "AAGuid" / Guid,
  367. "U2fProtocol" / Int8ul,
  368. "State" / Int32ul,
  369. "Status" / Int32ul,
  370. "Error" / Int32ul,
  371. "Win32Error" / Int32ul
  372. )
  373. @declare(guid=guid("3ae1ea61-c002-47fb-b06c-4022a8c98929"), event_id=2220, version=0)
  374. class Microsoft_Windows_WebAuthN_2220_0(Etw):
  375. pattern = Struct(
  376. "TransactionId" / Guid,
  377. "DevicePath" / WString,
  378. "Manufacturer" / WString,
  379. "Product" / WString
  380. )
  381. @declare(guid=guid("3ae1ea61-c002-47fb-b06c-4022a8c98929"), event_id=2221, version=0)
  382. class Microsoft_Windows_WebAuthN_2221_0(Etw):
  383. pattern = Struct(
  384. "TransactionId" / Guid,
  385. "DevicePath" / WString,
  386. "Manufacturer" / WString,
  387. "Product" / WString
  388. )
  389. @declare(guid=guid("3ae1ea61-c002-47fb-b06c-4022a8c98929"), event_id=2222, version=0)
  390. class Microsoft_Windows_WebAuthN_2222_0(Etw):
  391. pattern = Struct(
  392. "TransactionId" / Guid
  393. )
  394. @declare(guid=guid("3ae1ea61-c002-47fb-b06c-4022a8c98929"), event_id=2223, version=0)
  395. class Microsoft_Windows_WebAuthN_2223_0(Etw):
  396. pattern = Struct(
  397. "TransactionId" / Guid,
  398. "DevicePath" / WString,
  399. "Manufacturer" / WString,
  400. "Product" / WString
  401. )
  402. @declare(guid=guid("3ae1ea61-c002-47fb-b06c-4022a8c98929"), event_id=2224, version=0)
  403. class Microsoft_Windows_WebAuthN_2224_0(Etw):
  404. pattern = Struct(
  405. "TransactionId" / Guid,
  406. "DevicePath" / WString,
  407. "Manufacturer" / WString,
  408. "Product" / WString,
  409. "DeviceErr" / Int32ul,
  410. "Status" / Int32ul,
  411. "Error" / Int32ul,
  412. "Win32Error" / Int32ul
  413. )
  414. @declare(guid=guid("3ae1ea61-c002-47fb-b06c-4022a8c98929"), event_id=2225, version=0)
  415. class Microsoft_Windows_WebAuthN_2225_0(Etw):
  416. pattern = Struct(
  417. "TransactionId" / Guid,
  418. "RequestCommand" / Int8ul,
  419. "RequestLength" / Int32ul,
  420. "Request" / Bytes(lambda this: this.RequestLength),
  421. "ResponseCommand" / Int8ul,
  422. "ResponseLength" / Int32ul,
  423. "Response" / Bytes(lambda this: this.ResponseLength)
  424. )
  425. @declare(guid=guid("3ae1ea61-c002-47fb-b06c-4022a8c98929"), event_id=2226, version=0)
  426. class Microsoft_Windows_WebAuthN_2226_0(Etw):
  427. pattern = Struct(
  428. "TransactionId" / Guid,
  429. "RequestCommand" / Int8ul,
  430. "RequestLength" / Int32ul,
  431. "Request" / Bytes(lambda this: this.RequestLength),
  432. "ResponseCommand" / Int8ul,
  433. "ResponseLength" / Int32ul,
  434. "Response" / Bytes(lambda this: this.ResponseLength),
  435. "Error" / Int32ul,
  436. "Win32Error" / Int32ul
  437. )
  438. @declare(guid=guid("3ae1ea61-c002-47fb-b06c-4022a8c98929"), event_id=2250, version=0)
  439. class Microsoft_Windows_WebAuthN_2250_0(Etw):
  440. pattern = Struct(
  441. "TransactionId" / Guid
  442. )
  443. @declare(guid=guid("3ae1ea61-c002-47fb-b06c-4022a8c98929"), event_id=2251, version=0)
  444. class Microsoft_Windows_WebAuthN_2251_0(Etw):
  445. pattern = Struct(
  446. "TransactionId" / Guid
  447. )
  448. @declare(guid=guid("3ae1ea61-c002-47fb-b06c-4022a8c98929"), event_id=2252, version=0)
  449. class Microsoft_Windows_WebAuthN_2252_0(Etw):
  450. pattern = Struct(
  451. "TransactionId" / Guid,
  452. "Error" / Int32ul,
  453. "Win32Error" / Int32ul
  454. )
  455. @declare(guid=guid("3ae1ea61-c002-47fb-b06c-4022a8c98929"), event_id=2253, version=0)
  456. class Microsoft_Windows_WebAuthN_2253_0(Etw):
  457. pattern = Struct(
  458. "TransactionId" / Guid,
  459. "Error" / Int32ul,
  460. "Win32Error" / Int32ul
  461. )
  462. @declare(guid=guid("3ae1ea61-c002-47fb-b06c-4022a8c98929"), event_id=2260, version=0)
  463. class Microsoft_Windows_WebAuthN_2260_0(Etw):
  464. pattern = Struct(
  465. "TransactionId" / Guid,
  466. "DevicePath" / WString,
  467. "PairedName" / WString
  468. )
  469. @declare(guid=guid("3ae1ea61-c002-47fb-b06c-4022a8c98929"), event_id=2261, version=0)
  470. class Microsoft_Windows_WebAuthN_2261_0(Etw):
  471. pattern = Struct(
  472. "TransactionId" / Guid,
  473. "DevicePath" / WString,
  474. "PairedName" / WString,
  475. "AAGuid" / Guid,
  476. "U2fProtocol" / Int8ul
  477. )
  478. @declare(guid=guid("3ae1ea61-c002-47fb-b06c-4022a8c98929"), event_id=2262, version=0)
  479. class Microsoft_Windows_WebAuthN_2262_0(Etw):
  480. pattern = Struct(
  481. "TransactionId" / Guid,
  482. "DevicePath" / WString,
  483. "PairedName" / WString,
  484. "AAGuid" / Guid,
  485. "U2fProtocol" / Int8ul,
  486. "State" / Int32ul,
  487. "Status" / Int32ul,
  488. "Error" / Int32ul,
  489. "Win32Error" / Int32ul
  490. )
  491. @declare(guid=guid("3ae1ea61-c002-47fb-b06c-4022a8c98929"), event_id=2263, version=0)
  492. class Microsoft_Windows_WebAuthN_2263_0(Etw):
  493. pattern = Struct(
  494. "TransactionId" / Guid,
  495. "DevicePath" / WString,
  496. "PairedName" / WString,
  497. "AAGuid" / Guid,
  498. "U2fProtocol" / Int8ul,
  499. "State" / Int32ul,
  500. "Status" / Int32ul,
  501. "Error" / Int32ul,
  502. "Win32Error" / Int32ul
  503. )
  504. @declare(guid=guid("3ae1ea61-c002-47fb-b06c-4022a8c98929"), event_id=2270, version=0)
  505. class Microsoft_Windows_WebAuthN_2270_0(Etw):
  506. pattern = Struct(
  507. "Function" / CString,
  508. "Location" / CString,
  509. "Error" / Int32ul,
  510. "Win32Error" / Int32ul
  511. )
  512. @declare(guid=guid("3ae1ea61-c002-47fb-b06c-4022a8c98929"), event_id=2271, version=0)
  513. class Microsoft_Windows_WebAuthN_2271_0(Etw):
  514. pattern = Struct(
  515. "TransactionId" / Guid,
  516. "DevicePath" / WString,
  517. "PairedName" / WString
  518. )
  519. @declare(guid=guid("3ae1ea61-c002-47fb-b06c-4022a8c98929"), event_id=2272, version=0)
  520. class Microsoft_Windows_WebAuthN_2272_0(Etw):
  521. pattern = Struct(
  522. "TransactionId" / Guid,
  523. "RequestCommand" / Int8ul,
  524. "RequestLength" / Int32ul,
  525. "Request" / Bytes(lambda this: this.RequestLength),
  526. "ResponseCommand" / Int8ul,
  527. "ResponseLength" / Int32ul,
  528. "Response" / Bytes(lambda this: this.ResponseLength)
  529. )
  530. @declare(guid=guid("3ae1ea61-c002-47fb-b06c-4022a8c98929"), event_id=2273, version=0)
  531. class Microsoft_Windows_WebAuthN_2273_0(Etw):
  532. pattern = Struct(
  533. "TransactionId" / Guid,
  534. "RequestCommand" / Int8ul,
  535. "RequestLength" / Int32ul,
  536. "Request" / Bytes(lambda this: this.RequestLength),
  537. "ResponseCommand" / Int8ul,
  538. "ResponseLength" / Int32ul,
  539. "Response" / Bytes(lambda this: this.ResponseLength),
  540. "Location" / CString,
  541. "Error" / Int32ul,
  542. "Win32Error" / Int32ul
  543. )
  544. @declare(guid=guid("3ae1ea61-c002-47fb-b06c-4022a8c98929"), event_id=2300, version=0)
  545. class Microsoft_Windows_WebAuthN_2300_0(Etw):
  546. pattern = Struct(
  547. "TransactionId" / Guid
  548. )
  549. @declare(guid=guid("3ae1ea61-c002-47fb-b06c-4022a8c98929"), event_id=2301, version=0)
  550. class Microsoft_Windows_WebAuthN_2301_0(Etw):
  551. pattern = Struct(
  552. "TransactionId" / Guid
  553. )
  554. @declare(guid=guid("3ae1ea61-c002-47fb-b06c-4022a8c98929"), event_id=2302, version=0)
  555. class Microsoft_Windows_WebAuthN_2302_0(Etw):
  556. pattern = Struct(
  557. "TransactionId" / Guid,
  558. "Error" / Int32ul,
  559. "Win32Error" / Int32ul
  560. )
  561. @declare(guid=guid("3ae1ea61-c002-47fb-b06c-4022a8c98929"), event_id=2303, version=0)
  562. class Microsoft_Windows_WebAuthN_2303_0(Etw):
  563. pattern = Struct(
  564. "TransactionId" / Guid,
  565. "Error" / Int32ul,
  566. "Win32Error" / Int32ul
  567. )
  568. @declare(guid=guid("3ae1ea61-c002-47fb-b06c-4022a8c98929"), event_id=2310, version=0)
  569. class Microsoft_Windows_WebAuthN_2310_0(Etw):
  570. pattern = Struct(
  571. "TransactionId" / Guid,
  572. "Reader" / WString
  573. )
  574. @declare(guid=guid("3ae1ea61-c002-47fb-b06c-4022a8c98929"), event_id=2311, version=0)
  575. class Microsoft_Windows_WebAuthN_2311_0(Etw):
  576. pattern = Struct(
  577. "TransactionId" / Guid,
  578. "Reader" / WString,
  579. "AAGuid" / Guid,
  580. "U2fProtocol" / Int8ul
  581. )
  582. @declare(guid=guid("3ae1ea61-c002-47fb-b06c-4022a8c98929"), event_id=2312, version=0)
  583. class Microsoft_Windows_WebAuthN_2312_0(Etw):
  584. pattern = Struct(
  585. "TransactionId" / Guid,
  586. "Reader" / WString,
  587. "AAGuid" / Guid,
  588. "U2fProtocol" / Int8ul,
  589. "State" / Int32ul,
  590. "Status" / Int32ul,
  591. "Error" / Int32ul,
  592. "Win32Error" / Int32ul
  593. )
  594. @declare(guid=guid("3ae1ea61-c002-47fb-b06c-4022a8c98929"), event_id=2313, version=0)
  595. class Microsoft_Windows_WebAuthN_2313_0(Etw):
  596. pattern = Struct(
  597. "TransactionId" / Guid,
  598. "Reader" / WString,
  599. "AAGuid" / Guid,
  600. "U2fProtocol" / Int8ul,
  601. "State" / Int32ul,
  602. "Status" / Int32ul,
  603. "Error" / Int32ul,
  604. "Win32Error" / Int32ul
  605. )
  606. @declare(guid=guid("3ae1ea61-c002-47fb-b06c-4022a8c98929"), event_id=2314, version=0)
  607. class Microsoft_Windows_WebAuthN_2314_0(Etw):
  608. pattern = Struct(
  609. "TransactionId" / Guid
  610. )
  611. @declare(guid=guid("3ae1ea61-c002-47fb-b06c-4022a8c98929"), event_id=2315, version=0)
  612. class Microsoft_Windows_WebAuthN_2315_0(Etw):
  613. pattern = Struct(
  614. "TransactionId" / Guid,
  615. "NumberOfTimesScardCancelCommandsSent" / Int32ul
  616. )
  617. @declare(guid=guid("3ae1ea61-c002-47fb-b06c-4022a8c98929"), event_id=2316, version=0)
  618. class Microsoft_Windows_WebAuthN_2316_0(Etw):
  619. pattern = Struct(
  620. "TransactionId" / Guid,
  621. "CallCancelled" / Int8ul
  622. )
  623. @declare(guid=guid("3ae1ea61-c002-47fb-b06c-4022a8c98929"), event_id=2320, version=0)
  624. class Microsoft_Windows_WebAuthN_2320_0(Etw):
  625. pattern = Struct(
  626. "TransactionId" / Guid,
  627. "Reader" / WString
  628. )
  629. @declare(guid=guid("3ae1ea61-c002-47fb-b06c-4022a8c98929"), event_id=2321, version=0)
  630. class Microsoft_Windows_WebAuthN_2321_0(Etw):
  631. pattern = Struct(
  632. "TransactionId" / Guid,
  633. "Action" / CString,
  634. "Reader" / WString,
  635. "DeviceInstanceId" / WString
  636. )
  637. @declare(guid=guid("3ae1ea61-c002-47fb-b06c-4022a8c98929"), event_id=2322, version=0)
  638. class Microsoft_Windows_WebAuthN_2322_0(Etw):
  639. pattern = Struct(
  640. "TransactionId" / Guid,
  641. "Action" / CString,
  642. "Reader" / WString
  643. )
  644. @declare(guid=guid("3ae1ea61-c002-47fb-b06c-4022a8c98929"), event_id=2323, version=0)
  645. class Microsoft_Windows_WebAuthN_2323_0(Etw):
  646. pattern = Struct(
  647. "TransactionId" / Guid,
  648. "Action" / CString,
  649. "Reader" / WString,
  650. "ApduStatus" / Int16ul,
  651. "DeviceStatus" / Int32ul,
  652. "Error" / Int32ul,
  653. "Win32Error" / Int32ul
  654. )
  655. @declare(guid=guid("3ae1ea61-c002-47fb-b06c-4022a8c98929"), event_id=2324, version=0)
  656. class Microsoft_Windows_WebAuthN_2324_0(Etw):
  657. pattern = Struct(
  658. "TransactionId" / Guid,
  659. "Action" / CString,
  660. "Reader" / WString,
  661. "ApduStatus" / Int16ul,
  662. "DeviceStatus" / Int32ul,
  663. "Error" / Int32ul,
  664. "Win32Error" / Int32ul
  665. )
  666. @declare(guid=guid("3ae1ea61-c002-47fb-b06c-4022a8c98929"), event_id=2325, version=0)
  667. class Microsoft_Windows_WebAuthN_2325_0(Etw):
  668. pattern = Struct(
  669. "TransactionId" / Guid,
  670. "Reader" / WString
  671. )
  672. @declare(guid=guid("3ae1ea61-c002-47fb-b06c-4022a8c98929"), event_id=2326, version=0)
  673. class Microsoft_Windows_WebAuthN_2326_0(Etw):
  674. pattern = Struct(
  675. "TransactionId" / Guid,
  676. "Action" / CString,
  677. "Reader" / WString
  678. )
  679. @declare(guid=guid("3ae1ea61-c002-47fb-b06c-4022a8c98929"), event_id=2327, version=0)
  680. class Microsoft_Windows_WebAuthN_2327_0(Etw):
  681. pattern = Struct(
  682. "TransactionId" / Guid,
  683. "Reader" / WString,
  684. "RequestLength" / Int32ul,
  685. "Request" / Bytes(lambda this: this.RequestLength),
  686. "ResponseLength" / Int32ul,
  687. "Response" / Bytes(lambda this: this.ResponseLength),
  688. "ApduStatus" / Int16ul
  689. )
  690. @declare(guid=guid("3ae1ea61-c002-47fb-b06c-4022a8c98929"), event_id=2328, version=0)
  691. class Microsoft_Windows_WebAuthN_2328_0(Etw):
  692. pattern = Struct(
  693. "TransactionId" / Guid,
  694. "Reader" / WString,
  695. "RequestLength" / Int32ul,
  696. "Request" / Bytes(lambda this: this.RequestLength),
  697. "ResponseLength" / Int32ul,
  698. "Response" / Bytes(lambda this: this.ResponseLength),
  699. "ApduStatus" / Int16ul,
  700. "Error" / Int32ul,
  701. "Win32Error" / Int32ul
  702. )
  703. @declare(guid=guid("3ae1ea61-c002-47fb-b06c-4022a8c98929"), event_id=2400, version=0)
  704. class Microsoft_Windows_WebAuthN_2400_0(Etw):
  705. pattern = Struct(
  706. "TransactionId" / Guid
  707. )
  708. @declare(guid=guid("3ae1ea61-c002-47fb-b06c-4022a8c98929"), event_id=2401, version=0)
  709. class Microsoft_Windows_WebAuthN_2401_0(Etw):
  710. pattern = Struct(
  711. "TransactionId" / Guid
  712. )
  713. @declare(guid=guid("3ae1ea61-c002-47fb-b06c-4022a8c98929"), event_id=2402, version=0)
  714. class Microsoft_Windows_WebAuthN_2402_0(Etw):
  715. pattern = Struct(
  716. "TransactionId" / Guid,
  717. "Error" / Int32ul,
  718. "Win32Error" / Int32ul
  719. )