Where is the list of device driver images stored in ETW?

  .net-traceprocessing, etw, windows

I am trying to programatically get the list of device drives from an ETW with the great TraceProcessing Library which is used by WPA.

enter image description here

  using ITraceProcessor processor = TraceProcessor.Create(myEtlFile, new 
            TraceProcessorSettings
            {
                AllowLostEvents = true,
                AllowTimeInversion = true,
            });
  myProcesses = processor.UseProcesses();
  foreach (var process in myProcesses.Result.Processes)
  {
    foreach (var dll in process.Images)
    {
       // get dll.Path, dll.FileVersion, dll.ProductVersion, dll.ProductName, dll.FileVersionNumber, dll.FileDescription
    }
  }

This works for every process except the Kernel (System(4)). Why do I have only 3 dlls in the System process? I would expect the driver files in the System process there as well. In CPU sampling the image is there so it looks like everything is right there.
This would be very useful to check for driver versions if the data is present. But so far I was not able to find it. Am I missing something here?

Source: Windows Questions

LEAVE A COMMENT