Added patch to move implementation of EtwRegisterTraceGuidsW to ntdll.

2025-01-28 22:04:43 -08:00 · 2016-01-17 03:19:12 +01:00 · 2016-01-17 03:19:12 +01:00 · 49a0b474e4
commit 49a0b474e4
parent 3f2d26547d
9 changed files with 451 additions and 35 deletions
--- a/patches/ntdll-ApiSetQueryApiSetPresence/0001-ntdll-Add-stub-for-ApiSetQueryApiSetPresence.patch
+++ b/patches/ntdll-ApiSetQueryApiSetPresence/0001-ntdll-Add-stub-for-ApiSetQueryApiSetPresence.patch
@ -1,4 +1,4 @@
-From d9e27f6ee0746384ce7c39c384a2ce0fc394d0b7 Mon Sep 17 00:00:00 2001
+From 455be0d2473a895b51e83d4d8c882724fef6b118 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Michael=20M=C3=BCller?= <michael@fds-team.de>
 Date: Fri, 15 Jan 2016 13:17:31 +0100
 Subject: ntdll: Add stub for ApiSetQueryApiSetPresence.
@ -9,12 +9,12 @@ Subject: ntdll: Add stub for ApiSetQueryApiSetPresence.
 2 files changed, 12 insertions(+)

 diff --git a/dlls/ntdll/misc.c b/dlls/ntdll/misc.c
-index ffa9055..44afeb3 100644
+index 4517aec..5ad121d 100644
 --- a/dlls/ntdll/misc.c
 +++ b/dlls/ntdll/misc.c
-@@ -363,3 +363,14 @@ PVOID WINAPI WinSqmStartSession(PVOID unknown1, DWORD unknown2, DWORD unknown3)
-     FIXME("(%p, 0x%x, 0x%x) stub!\n", unknown1, unknown2, unknown3);
-     return NULL;
+@@ -444,3 +444,14 @@ ULONG WINAPI EtwRegisterTraceGuidsA( WMIDPREQUEST RequestAddress,
+           debugstr_a(MofResourceName), RegistrationHandle);
+     return ERROR_SUCCESS;
 }
 +
 +/*********************************************************************
@ -28,7 +28,7 @@ index ffa9055..44afeb3 100644
 +    return TRUE;
 +}
 diff --git a/dlls/ntdll/ntdll.spec b/dlls/ntdll/ntdll.spec
-index b1c349b..c62092a 100644
+index 0c23514..7cb46d3 100644
 --- a/dlls/ntdll/ntdll.spec
 +++ b/dlls/ntdll/ntdll.spec
@@ -3,6 +3,7 @@
--- a/patches/ntdll-ApiSetQueryApiSetPresence/definition
+++ b/patches/ntdll-ApiSetQueryApiSetPresence/definition
@ -1,2 +1,2 @@
 Fixes: Add stub for ntdll.ApiSetQueryApiSetPresence
-Depends: ntdll-WinSqm
+Depends: ntdll-EtwRegisterTraceGuids
--- a/patches/ntdll-EtwRegisterTraceGuids/0001-ntdll-Move-RegisterTraceGuids-from-advapi32-to-ntdll.patch
+++ b/patches/ntdll-EtwRegisterTraceGuids/0001-ntdll-Move-RegisterTraceGuids-from-advapi32-to-ntdll.patch
@ -0,0 +1,200 @@
+From da0ee9b66b05e52f3494181c74042e3c40d4f3a0 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Michael=20M=C3=BCller?= <michael@fds-team.de>
+Date: Sun, 17 Jan 2016 01:01:56 +0100
+Subject: ntdll: Move RegisterTraceGuids from advapi32 to ntdll.
+
+---
+ dlls/advapi32/advapi32.spec |  4 +--
+ dlls/advapi32/eventlog.c    | 64 -------------------------------------------
+ dlls/ntdll/misc.c           | 67 +++++++++++++++++++++++++++++++++++++++++++++
+ dlls/ntdll/ntdll.spec       |  2 ++
+ 4 files changed, 71 insertions(+), 66 deletions(-)
+
+diff --git a/dlls/advapi32/advapi32.spec b/dlls/advapi32/advapi32.spec
+index 36f176b..88f7fee 100644
+--- a/dlls/advapi32/advapi32.spec
+++ b/dlls/advapi32/advapi32.spec
+@@ -661,8 +661,8 @@
+ @ stdcall RegisterServiceCtrlHandlerExA(str ptr ptr)
+ @ stdcall RegisterServiceCtrlHandlerExW(wstr ptr ptr)
+ @ stdcall RegisterServiceCtrlHandlerW(wstr ptr)
+-@ stdcall RegisterTraceGuidsA(ptr ptr ptr long ptr str str ptr)
+-@ stdcall RegisterTraceGuidsW(ptr ptr ptr long ptr wstr wstr ptr)
+@ stdcall RegisterTraceGuidsA(ptr ptr ptr long ptr str str ptr) ntdll.EtwRegisterTraceGuidsA
+@ stdcall RegisterTraceGuidsW(ptr ptr ptr long ptr wstr wstr ptr) ntdll.EtwRegisterTraceGuidsW
+ # @ stub RemoveTraceCallback
+ # @ stub RemoveUsersFromEncryptedFile
+ @ stdcall ReportEventA(long long long long ptr long long ptr ptr)
+diff --git a/dlls/advapi32/eventlog.c b/dlls/advapi32/eventlog.c
+index 7839fc4..93c164d 100644
+--- a/dlls/advapi32/eventlog.c
+++ b/dlls/advapi32/eventlog.c
+@@ -742,70 +742,6 @@ BOOL WINAPI ReportEventW( HANDLE hEventLog, WORD wType, WORD wCategory, DWORD dw
+ }
+ 
+ /******************************************************************************
+- * RegisterTraceGuidsW [ADVAPI32.@]
+- *
+- * Register an event trace provider and the event trace classes that it uses
+- * to generate events.
+- *
+- * PARAMS
+- *  RequestAddress     [I]   ControlCallback function
+- *  RequestContext     [I]   Optional provider-defined context
+- *  ControlGuid        [I]   GUID of the registering provider
+- *  GuidCount          [I]   Number of elements in the TraceGuidReg array
+- *  TraceGuidReg       [I/O] Array of TRACE_GUID_REGISTRATION structures
+- *  MofImagePath       [I]   not supported, set to NULL
+- *  MofResourceName    [I]   not supported, set to NULL
+- *  RegistrationHandle [O]   Provider's registration handle
+- *
+- * RETURNS
+- *  Success: ERROR_SUCCESS
+- *  Failure: System error code
+- *
+- * FIXME
+- *  Stub.
+- */
+-ULONG WINAPI RegisterTraceGuidsW( WMIDPREQUEST RequestAddress,
+-                PVOID RequestContext, LPCGUID ControlGuid, ULONG GuidCount,
+-                PTRACE_GUID_REGISTRATION TraceGuidReg, LPCWSTR MofImagePath,
+-                LPCWSTR MofResourceName, PTRACEHANDLE RegistrationHandle )
+-{
+-    FIXME("(%p, %p, %s, %u, %p, %s, %s, %p): stub\n", RequestAddress, RequestContext,
+-          debugstr_guid(ControlGuid), GuidCount, TraceGuidReg, debugstr_w(MofImagePath),
+-          debugstr_w(MofResourceName), RegistrationHandle);
+-
+-    if (TraceGuidReg)
+-    {
+-        ULONG i;
+-        for (i = 0; i < GuidCount; i++)
+-        {
+-            FIXME("  register trace class %s\n", debugstr_guid(TraceGuidReg[i].Guid));
+-            TraceGuidReg[i].RegHandle = (HANDLE)0xdeadbeef;
+-        }
+-    }
+-    *RegistrationHandle = (TRACEHANDLE)0xdeadbeef;
+-    return ERROR_SUCCESS;
+-}
+-
+-/******************************************************************************
+- * RegisterTraceGuidsA [ADVAPI32.@]
+- *
+- * See RegisterTraceGuidsW.
+- *
+- * FIXME
+- *  Stub.
+- */
+-ULONG WINAPI RegisterTraceGuidsA( WMIDPREQUEST RequestAddress,
+-                PVOID RequestContext, LPCGUID ControlGuid, ULONG GuidCount,
+-                PTRACE_GUID_REGISTRATION TraceGuidReg, LPCSTR MofImagePath,
+-                LPCSTR MofResourceName, PTRACEHANDLE RegistrationHandle )
+-{
+-    FIXME("(%p, %p, %s, %u, %p, %s, %s, %p): stub\n", RequestAddress, RequestContext,
+-          debugstr_guid(ControlGuid), GuidCount, TraceGuidReg, debugstr_a(MofImagePath),
+-          debugstr_a(MofResourceName), RegistrationHandle);
+-    return ERROR_SUCCESS;
+-}
+-
+-/******************************************************************************
+  * StartTraceW [ADVAPI32.@]
+  *
+  * Register and start an event trace session
+diff --git a/dlls/ntdll/misc.c b/dlls/ntdll/misc.c
+index 2cfa900..6d49882 100644
+--- a/dlls/ntdll/misc.c
+++ b/dlls/ntdll/misc.c
+@@ -27,6 +27,9 @@
+ #include <sys/utsname.h>
+ #endif
+ 
+#include "windows.h"
+#include "wmistr.h"
+#include "evntrace.h"
+ #include "wine/library.h"
+ #include "wine/debug.h"
+ #include "ntdll_misc.h"
+@@ -335,3 +338,67 @@ BOOL WINAPI WinSqmIsOptedIn(void)
+     FIXME("() stub\n");
+     return FALSE;
+ }
+
+/*********************************************************************
+ *                  EtwRegisterTraceGuidsW   (NTDLL.@)
+ *
+ * Register an event trace provider and the event trace classes that it uses
+ * to generate events.
+ *
+ * PARAMS
+ *  RequestAddress     [I]   ControlCallback function
+ *  RequestContext     [I]   Optional provider-defined context
+ *  ControlGuid        [I]   GUID of the registering provider
+ *  GuidCount          [I]   Number of elements in the TraceGuidReg array
+ *  TraceGuidReg       [I/O] Array of TRACE_GUID_REGISTRATION structures
+ *  MofImagePath       [I]   not supported, set to NULL
+ *  MofResourceName    [I]   not supported, set to NULL
+ *  RegistrationHandle [O]   Provider's registration handle
+ *
+ * RETURNS
+ *  Success: ERROR_SUCCESS
+ *  Failure: System error code
+ *
+ * FIXME
+ *  Stub.
+ */
+ULONG WINAPI EtwRegisterTraceGuidsW( WMIDPREQUEST RequestAddress,
+                PVOID RequestContext, LPCGUID ControlGuid, ULONG GuidCount,
+                PTRACE_GUID_REGISTRATION TraceGuidReg, LPCWSTR MofImagePath,
+                LPCWSTR MofResourceName, PTRACEHANDLE RegistrationHandle )
+{
+    FIXME("(%p, %p, %s, %u, %p, %s, %s, %p): stub\n", RequestAddress, RequestContext,
+          debugstr_guid(ControlGuid), GuidCount, TraceGuidReg, debugstr_w(MofImagePath),
+          debugstr_w(MofResourceName), RegistrationHandle);
+
+    if (TraceGuidReg)
+    {
+        ULONG i;
+        for (i = 0; i < GuidCount; i++)
+        {
+            FIXME("  register trace class %s\n", debugstr_guid(TraceGuidReg[i].Guid));
+            TraceGuidReg[i].RegHandle = (HANDLE)0xdeadbeef;
+        }
+    }
+    *RegistrationHandle = (TRACEHANDLE)0xdeadbeef;
+    return ERROR_SUCCESS;
+}
+
+/*********************************************************************
+ *                  EtwRegisterTraceGuidsA   (NTDLL.@)
+ *
+ * See EtwRegisterTraceGuidsW.
+ *
+ * FIXME
+ *  Stub.
+ */
+ULONG WINAPI EtwRegisterTraceGuidsA( WMIDPREQUEST RequestAddress,
+                PVOID RequestContext, LPCGUID ControlGuid, ULONG GuidCount,
+                PTRACE_GUID_REGISTRATION TraceGuidReg, LPCSTR MofImagePath,
+                LPCSTR MofResourceName, PTRACEHANDLE RegistrationHandle )
+{
+    FIXME("(%p, %p, %s, %u, %p, %s, %s, %p): stub\n", RequestAddress, RequestContext,
+          debugstr_guid(ControlGuid), GuidCount, TraceGuidReg, debugstr_a(MofImagePath),
+          debugstr_a(MofResourceName), RegistrationHandle);
+    return ERROR_SUCCESS;
+}
+diff --git a/dlls/ntdll/ntdll.spec b/dlls/ntdll/ntdll.spec
+index 4e49709..2b5c6cf 100644
+--- a/dlls/ntdll/ntdll.spec
+++ b/dlls/ntdll/ntdll.spec
+@@ -41,6 +41,8 @@
+ # @ stub DbgUiStopDebugging
+ @ stub DbgUiWaitStateChange
+ @ stdcall DbgUserBreakPoint()
+@ stdcall EtwRegisterTraceGuidsA(ptr ptr ptr long ptr str str ptr)
+@ stdcall EtwRegisterTraceGuidsW(ptr ptr ptr long ptr wstr wstr ptr)
+ # @ stub KiFastSystemCall
+ # @ stub KiFastSystemCallRet
+ # @ stub KiIntSystemCall
+-- 
+2.6.4
+
--- a/patches/ntdll-EtwRegisterTraceGuids/0002-ntdll-Move-EventRegister-from-advapi32-to-ntdll.patch
+++ b/patches/ntdll-EtwRegisterTraceGuids/0002-ntdll-Move-EventRegister-from-advapi32-to-ntdll.patch
@ -0,0 +1,92 @@
+From 68e7778fafe734c25a8bb9e4499dbd3f87106751 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Michael=20M=C3=BCller?= <michael@fds-team.de>
+Date: Sun, 17 Jan 2016 03:02:57 +0100
+Subject: ntdll: Move EventRegister from advapi32 to ntdll.
+
+---
+ dlls/advapi32/advapi32.spec |  2 +-
+ dlls/advapi32/eventlog.c    | 11 -----------
+ dlls/ntdll/misc.c           | 12 ++++++++++++
+ dlls/ntdll/ntdll.spec       |  1 +
+ 4 files changed, 14 insertions(+), 12 deletions(-)
+
+diff --git a/dlls/advapi32/advapi32.spec b/dlls/advapi32/advapi32.spec
+index 88f7fee..6a015e4 100644
+--- a/dlls/advapi32/advapi32.spec
+++ b/dlls/advapi32/advapi32.spec
+@@ -272,7 +272,7 @@
+ @ stdcall EventActivityIdControl(long ptr)
+ @ stdcall EventEnabled(int64 ptr)
+ @ stdcall EventProviderEnabled(int64 long int64)
+-@ stdcall EventRegister(ptr ptr ptr ptr)
+@ stdcall EventRegister(ptr ptr ptr ptr) ntdll.EtwEventRegister
+ @ stdcall EventSetInformation(int64 long ptr long)
+ @ stdcall EventUnregister(int64)
+ @ stdcall EventWrite(int64 ptr long ptr)
+diff --git a/dlls/advapi32/eventlog.c b/dlls/advapi32/eventlog.c
+index 93c164d..4beda0f 100644
+--- a/dlls/advapi32/eventlog.c
+++ b/dlls/advapi32/eventlog.c
+@@ -815,17 +815,6 @@ ULONG WINAPI UnregisterTraceGuids( TRACEHANDLE RegistrationHandle )
+ }
+ 
+ /******************************************************************************
+- * EventRegister [ADVAPI32.@]
+- */
+-ULONG WINAPI EventRegister( LPCGUID provider, PENABLECALLBACK callback, PVOID context, PREGHANDLE handle )
+-{
+-    FIXME("%s, %p, %p, %p\n", debugstr_guid(provider), callback, context, handle);
+-
+-    *handle = 0xdeadbeef;
+-    return ERROR_SUCCESS;
+-}
+-
+-/******************************************************************************
+  * EventUnregister [ADVAPI32.@]
+  */
+ ULONG WINAPI EventUnregister( REGHANDLE handle )
+diff --git a/dlls/ntdll/misc.c b/dlls/ntdll/misc.c
+index 94fa72b..599822c 100644
+--- a/dlls/ntdll/misc.c
+++ b/dlls/ntdll/misc.c
+@@ -32,6 +32,7 @@
+ #include "windows.h"
+ #include "wmistr.h"
+ #include "evntrace.h"
+#include "evntprov.h"
+ #include "wine/library.h"
+ #include "wine/debug.h"
+ #include "ntdll_misc.h"
+@@ -379,6 +380,17 @@ BOOL WINAPI ApiSetQueryApiSetPresence(const UNICODE_STRING *namespace, BOOLEAN *
+ }
+ 
+ /*********************************************************************
+ *                  EtwEventRegister   (NTDLL.@)
+ */
+ULONG WINAPI EtwEventRegister( LPCGUID provider, PENABLECALLBACK callback, PVOID context, PREGHANDLE handle )
+{
+    FIXME("%s, %p, %p, %p\n", debugstr_guid(provider), callback, context, handle);
+
+    *handle = 0xdeadbeef;
+    return ERROR_SUCCESS;
+}
+
+/*********************************************************************
+  *                  EtwRegisterTraceGuidsW   (NTDLL.@)
+  *
+  * Register an event trace provider and the event trace classes that it uses
+diff --git a/dlls/ntdll/ntdll.spec b/dlls/ntdll/ntdll.spec
+index bbb2595..22d80be 100644
+--- a/dlls/ntdll/ntdll.spec
+++ b/dlls/ntdll/ntdll.spec
+@@ -42,6 +42,7 @@
+ # @ stub DbgUiStopDebugging
+ @ stub DbgUiWaitStateChange
+ @ stdcall DbgUserBreakPoint()
+@ stdcall EtwEventRegister(ptr ptr ptr ptr)
+ @ stdcall EtwRegisterTraceGuidsA(ptr ptr ptr long ptr str str ptr)
+ @ stdcall EtwRegisterTraceGuidsW(ptr ptr ptr long ptr wstr wstr ptr)
+ # @ stub KiFastSystemCall
+-- 
+2.6.4
+
--- a/patches/ntdll-EtwRegisterTraceGuids/0003-ntdll-Move-EventSetInformation-from-advapi32-to-ntdl.patch
+++ b/patches/ntdll-EtwRegisterTraceGuids/0003-ntdll-Move-EventSetInformation-from-advapi32-to-ntdl.patch
@ -0,0 +1,82 @@
+From 26422de432cbbb693de72652cf3035395d23c1c7 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Michael=20M=C3=BCller?= <michael@fds-team.de>
+Date: Sun, 17 Jan 2016 03:08:07 +0100
+Subject: ntdll: Move EventSetInformation from advapi32 to ntdll.
+
+---
+ dlls/advapi32/advapi32.spec |  2 +-
+ dlls/advapi32/eventlog.c    | 10 ----------
+ dlls/ntdll/misc.c           | 10 ++++++++++
+ dlls/ntdll/ntdll.spec       |  1 +
+ 4 files changed, 12 insertions(+), 11 deletions(-)
+
+diff --git a/dlls/advapi32/advapi32.spec b/dlls/advapi32/advapi32.spec
+index 6a015e4..e38093e 100644
+--- a/dlls/advapi32/advapi32.spec
+++ b/dlls/advapi32/advapi32.spec
+@@ -273,7 +273,7 @@
+ @ stdcall EventEnabled(int64 ptr)
+ @ stdcall EventProviderEnabled(int64 long int64)
+ @ stdcall EventRegister(ptr ptr ptr ptr) ntdll.EtwEventRegister
+-@ stdcall EventSetInformation(int64 long ptr long)
+@ stdcall EventSetInformation(int64 long ptr long) ntdll.EtwEventSetInformation
+ @ stdcall EventUnregister(int64)
+ @ stdcall EventWrite(int64 ptr long ptr)
+ # @ stub EventWriteEndScenario
+diff --git a/dlls/advapi32/eventlog.c b/dlls/advapi32/eventlog.c
+index 4beda0f..a48e016 100644
+--- a/dlls/advapi32/eventlog.c
+++ b/dlls/advapi32/eventlog.c
+@@ -864,16 +864,6 @@ ULONG WINAPI EventWrite( REGHANDLE handle, PCEVENT_DESCRIPTOR descriptor, ULONG
+ }
+ 
+ /******************************************************************************
+- * EventSetInformation [ADVAPI32.@]
+- */
+-ULONG WINAPI EventSetInformation( REGHANDLE handle, EVENT_INFO_CLASS class, PVOID info,
+-                                  ULONG length )
+-{
+-    FIXME("%u, %p, %u\n", class, info, length);
+-    return ERROR_SUCCESS;
+-}
+-
+-/******************************************************************************
+  * QueryTraceW [ADVAPI32.@]
+  */
+ ULONG WINAPI QueryTraceW( TRACEHANDLE handle, LPCWSTR sessionname, PEVENT_TRACE_PROPERTIES properties )
+diff --git a/dlls/ntdll/misc.c b/dlls/ntdll/misc.c
+index 599822c..aa9aff3 100644
+--- a/dlls/ntdll/misc.c
+++ b/dlls/ntdll/misc.c
+@@ -391,6 +391,16 @@ ULONG WINAPI EtwEventRegister( LPCGUID provider, PENABLECALLBACK callback, PVOID
+ }
+ 
+ /*********************************************************************
+ *                  EtwEventSetInformation   (NTDLL.@)
+ */
+ULONG WINAPI EtwEventSetInformation( REGHANDLE handle, EVENT_INFO_CLASS class, PVOID info,
+                                     ULONG length )
+{
+    FIXME("%u, %p, %u\n", class, info, length);
+    return ERROR_SUCCESS;
+}
+
+/*********************************************************************
+  *                  EtwRegisterTraceGuidsW   (NTDLL.@)
+  *
+  * Register an event trace provider and the event trace classes that it uses
+diff --git a/dlls/ntdll/ntdll.spec b/dlls/ntdll/ntdll.spec
+index 22d80be..c1df843 100644
+--- a/dlls/ntdll/ntdll.spec
+++ b/dlls/ntdll/ntdll.spec
+@@ -43,6 +43,7 @@
+ @ stub DbgUiWaitStateChange
+ @ stdcall DbgUserBreakPoint()
+ @ stdcall EtwEventRegister(ptr ptr ptr ptr)
+@ stdcall EtwEventSetInformation(int64 long ptr long)
+ @ stdcall EtwRegisterTraceGuidsA(ptr ptr ptr long ptr str str ptr)
+ @ stdcall EtwRegisterTraceGuidsW(ptr ptr ptr long ptr wstr wstr ptr)
+ # @ stub KiFastSystemCall
+-- 
+2.6.4
+
--- a/patches/ntdll-EtwRegisterTraceGuids/definition
+++ b/patches/ntdll-EtwRegisterTraceGuids/definition
@ -0,0 +1 @@
+Fixes: [34318] Move implementation of EtwRegisterTraceGuidsW to ntdll
--- a/patches/ntdll-WinSqm/0001-ntdll-Add-stubs-for-WinSqmStartSession-WinSqmEndSess.patch
+++ b/patches/ntdll-WinSqm/0001-ntdll-Add-stubs-for-WinSqmStartSession-WinSqmEndSess.patch
@ -1,4 +1,4 @@
-From ff1be4d15b2114de6b785c164ddc27fd6993c6f8 Mon Sep 17 00:00:00 2001
+From d02606aaa6cbdbb1939cfe99b6d5f013af5c48a6 Mon Sep 17 00:00:00 2001
 From: "Erich E. Hoover" <erich.e.hoover@gmail.com>
 Date: Thu, 25 Dec 2014 12:36:28 -0700
 Subject: ntdll: Add stubs for WinSqmStartSession / WinSqmEndSession.
@ -11,7 +11,7 @@ Based on a patch by Detlef Riekenberg.
 3 files changed, 76 insertions(+)

 diff --git a/dlls/ntdll/misc.c b/dlls/ntdll/misc.c
-index 2cfa900..7832d37 100644
+index 5469116..4517aec 100644
 --- a/dlls/ntdll/misc.c
 +++ b/dlls/ntdll/misc.c
@@ -27,6 +27,8 @@
@ -20,10 +20,10 @@ index 2cfa900..7832d37 100644
 
 +#include "ntstatus.h"
 +#define WIN32_NO_STATUS
- #include "wine/library.h"
- #include "wine/debug.h"
- #include "ntdll_misc.h"
-@@ -328,6 +330,15 @@ void * __cdecl _lfind( const void *key, const void *base, unsigned int *nmemb,
+ #include "windows.h"
+ #include "wmistr.h"
+ #include "evntrace.h"
+@@ -332,6 +334,15 @@ void * __cdecl _lfind( const void *key, const void *base, unsigned int *nmemb,
 }
 
 /*********************************************************************
@ -39,12 +39,10 @@ index 2cfa900..7832d37 100644
  *                  WinSqmIsOptedIn   (NTDLL.@)
  */
 BOOL WINAPI WinSqmIsOptedIn(void)
-@@ -335,3 +346,12 @@ BOOL WINAPI WinSqmIsOptedIn(void)
-     FIXME("() stub\n");
-     return FALSE;
+@@ -341,6 +352,15 @@ BOOL WINAPI WinSqmIsOptedIn(void)
 }
-+
-+/*********************************************************************
+ 
+ /*********************************************************************
 + *                  WinSqmStartSession   (NTDLL.@)
 + */
 +PVOID WINAPI WinSqmStartSession(PVOID unknown1, DWORD unknown2, DWORD unknown3)
@ -52,18 +50,27 @@ index 2cfa900..7832d37 100644
 +    FIXME("(%p, 0x%x, 0x%x) stub!\n", unknown1, unknown2, unknown3);
 +    return NULL;
 +}
+
+/*********************************************************************
+  *                  EtwEventRegister   (NTDLL.@)
+  */
+ ULONG WINAPI EtwEventRegister( LPCGUID provider, PENABLECALLBACK callback, PVOID context, PREGHANDLE handle )
 diff --git a/dlls/ntdll/ntdll.spec b/dlls/ntdll/ntdll.spec
-index 28165ef..9225898 100644
+index d6ded19..0c23514 100644
 --- a/dlls/ntdll/ntdll.spec
 +++ b/dlls/ntdll/ntdll.spec
-@@ -971,3 +971,5 @@
+@@ -1011,7 +1011,9 @@
+ @ stdcall TpWaitForWait(ptr long)
+ @ stdcall TpWaitForWork(ptr long)
 @ stdcall -ret64 VerSetConditionMask(int64 long long)
 +@ stdcall WinSqmEndSession(ptr)
 @ stdcall WinSqmIsOptedIn()
 +@ stdcall WinSqmStartSession(ptr long long)
 @ stdcall ZwAcceptConnectPort(ptr long ptr long long ptr) NtAcceptConnectPort
+ @ stdcall ZwAccessCheck(ptr long long ptr ptr ptr ptr ptr) NtAccessCheck
+ @ stdcall ZwAccessCheckAndAuditAlarm(ptr long ptr ptr ptr long ptr long ptr ptr ptr) NtAccessCheckAndAuditAlarm
 diff --git a/dlls/ntdll/tests/rtl.c b/dlls/ntdll/tests/rtl.c
-index e8eb04a..7b5f07d 100644
+index 94a22ac..d382691 100644
 --- a/dlls/ntdll/tests/rtl.c
 +++ b/dlls/ntdll/tests/rtl.c
@@ -62,6 +62,9 @@ static inline USHORT __my_ushort_swap(USHORT s)
@ -76,7 +83,7 @@ index e8eb04a..7b5f07d 100644
 static SIZE_T    (WINAPI  *pRtlCompareMemory)(LPCVOID,LPCVOID,SIZE_T);
 static SIZE_T    (WINAPI  *pRtlCompareMemoryUlong)(PULONG, SIZE_T, ULONG);
 static NTSTATUS  (WINAPI  *pRtlDeleteTimer)(HANDLE, HANDLE, HANDLE);
-@@ -109,6 +112,9 @@ static void InitFunctionPtrs(void)
+@@ -115,6 +118,9 @@ static void InitFunctionPtrs(void)
     hntdll = LoadLibraryA("ntdll.dll");
     ok(hntdll != 0, "LoadLibrary failed\n");
     if (hntdll) {
@ -86,7 +93,7 @@ index e8eb04a..7b5f07d 100644
 	pRtlCompareMemory = (void *)GetProcAddress(hntdll, "RtlCompareMemory");
 	pRtlCompareMemoryUlong = (void *)GetProcAddress(hntdll, "RtlCompareMemoryUlong");
         pRtlDeleteTimer = (void *)GetProcAddress(hntdll, "RtlDeleteTimer");
-@@ -149,6 +155,48 @@ static void InitFunctionPtrs(void)
+@@ -161,6 +167,48 @@ static void InitFunctionPtrs(void)
     ok(strlen(src) == 15, "Source must be 16 bytes long!\n");
 }
 
@ -135,7 +142,7 @@ index e8eb04a..7b5f07d 100644
 #define COMP(str1,str2,cmplen,len) size = pRtlCompareMemory(str1, str2, cmplen); \
   ok(size == len, "Expected %ld, got %ld\n", size, (SIZE_T)len)
 
-@@ -1603,6 +1651,12 @@ START_TEST(rtl)
+@@ -2060,6 +2108,12 @@ START_TEST(rtl)
 {
     InitFunctionPtrs();
 
@ -149,5 +156,5 @@ index e8eb04a..7b5f07d 100644
     test_RtlCompareMemoryUlong();
     test_RtlMoveMemory();
 -- 
-2.3.5
+2.6.4

--- a/patches/ntdll-WinSqm/definition
+++ b/patches/ntdll-WinSqm/definition
@ -1 +1,2 @@
 Fixes: [31971] ntdll is missing WinSqm[Start|End]Session implementation
+Depends: ntdll-EtwRegisterTraceGuids
--- a/patches/patchinstall.sh
+++ b/patches/patchinstall.sh
@ -192,6 +192,7 @@ patch_enable_all ()
 	enable_ntdll_DeviceType_Systemroot="$1"
 	enable_ntdll_DllOverrides_WOW64="$1"
 	enable_ntdll_DllRedirects="$1"
+	enable_ntdll_EtwRegisterTraceGuids="$1"
 	enable_ntdll_Exception="$1"
 	enable_ntdll_FileDispositionInformation="$1"
 	enable_ntdll_FileFsFullSizeInformation="$1"
@ -705,6 +706,9 @@ patch_enable ()
 		ntdll-DllRedirects)
 			enable_ntdll_DllRedirects="$2"
 			;;
+		ntdll-EtwRegisterTraceGuids)
+			enable_ntdll_EtwRegisterTraceGuids="$2"
+			;;
 		ntdll-Exception)
 			enable_ntdll_Exception="$2"
 			;;
@ -1969,6 +1973,13 @@ if test "$enable_ntdll_WriteWatches" -eq 1; then
 	enable_ws2_32_WriteWatches=1
 fi

+if test "$enable_ntdll_WinSqm" -eq 1; then
+	if test "$enable_ntdll_EtwRegisterTraceGuids" -gt 1; then
+		abort "Patchset ntdll-EtwRegisterTraceGuids disabled, but ntdll-WinSqm depends on that."
+	fi
+	enable_ntdll_EtwRegisterTraceGuids=1
+fi
+
 if test "$enable_ntdll_SystemRoot_Symlink" -eq 1; then
 	if test "$enable_ntdll_Exception" -gt 1; then
 		abort "Patchset ntdll-Exception disabled, but ntdll-SystemRoot_Symlink depends on that."
@ -2038,10 +2049,10 @@ if test "$enable_ntdll_CLI_Images" -eq 1; then
 fi

 if test "$enable_ntdll_ApiSetQueryApiSetPresence" -eq 1; then
-	if test "$enable_ntdll_WinSqm" -gt 1; then
-		abort "Patchset ntdll-WinSqm disabled, but ntdll-ApiSetQueryApiSetPresence depends on that."
+	if test "$enable_ntdll_EtwRegisterTraceGuids" -gt 1; then
+		abort "Patchset ntdll-EtwRegisterTraceGuids disabled, but ntdll-ApiSetQueryApiSetPresence depends on that."
 	fi
-	enable_ntdll_WinSqm=1
+	enable_ntdll_EtwRegisterTraceGuids=1
 fi

 if test "$enable_kernel32_Named_Pipe" -eq 1; then
@ -4158,25 +4169,29 @@ if test "$enable_ntdll_Activation_Context" -eq 1; then
 	) >> "$patchlist"
 fi

-# Patchset ntdll-WinSqm
+# Patchset ntdll-EtwRegisterTraceGuids
 # |
 # | This patchset fixes the following Wine bugs:
-# |   *	[#31971] ntdll is missing WinSqm[Start|End]Session implementation
+# |   *	[#34318] Move implementation of EtwRegisterTraceGuidsW to ntdll
 # |
 # | Modified files:
-# |   *	dlls/ntdll/misc.c, dlls/ntdll/ntdll.spec, dlls/ntdll/tests/rtl.c
+# |   *	dlls/advapi32/advapi32.spec, dlls/advapi32/eventlog.c, dlls/ntdll/misc.c, dlls/ntdll/ntdll.spec
 # |
-if test "$enable_ntdll_WinSqm" -eq 1; then
-	patch_apply ntdll-WinSqm/0001-ntdll-Add-stubs-for-WinSqmStartSession-WinSqmEndSess.patch
+if test "$enable_ntdll_EtwRegisterTraceGuids" -eq 1; then
+	patch_apply ntdll-EtwRegisterTraceGuids/0001-ntdll-Move-RegisterTraceGuids-from-advapi32-to-ntdll.patch
+	patch_apply ntdll-EtwRegisterTraceGuids/0002-ntdll-Move-EventRegister-from-advapi32-to-ntdll.patch
+	patch_apply ntdll-EtwRegisterTraceGuids/0003-ntdll-Move-EventSetInformation-from-advapi32-to-ntdl.patch
 	(
-		echo '+    { "Erich E. Hoover", "ntdll: Add stubs for WinSqmStartSession / WinSqmEndSession.", 1 },';
+		echo '+    { "Michael Müller", "ntdll: Move RegisterTraceGuids from advapi32 to ntdll.", 1 },';
+		echo '+    { "Michael Müller", "ntdll: Move EventRegister from advapi32 to ntdll.", 1 },';
+		echo '+    { "Michael Müller", "ntdll: Move EventSetInformation from advapi32 to ntdll.", 1 },';
 	) >> "$patchlist"
 fi

 # Patchset ntdll-ApiSetQueryApiSetPresence
 # |
 # | This patchset has the following (direct or indirect) dependencies:
-# |   *	ntdll-WinSqm
+# |   *	ntdll-EtwRegisterTraceGuids
 # |
 # | Modified files:
 # |   *	dlls/ntdll/misc.c, dlls/ntdll/ntdll.spec
@ -4750,6 +4765,24 @@ if test "$enable_ntdll_Wait_User_APC" -eq 1; then
 	) >> "$patchlist"
 fi

+# Patchset ntdll-WinSqm
+# |
+# | This patchset has the following (direct or indirect) dependencies:
+# |   *	ntdll-EtwRegisterTraceGuids
+# |
+# | This patchset fixes the following Wine bugs:
+# |   *	[#31971] ntdll is missing WinSqm[Start|End]Session implementation
+# |
+# | Modified files:
+# |   *	dlls/ntdll/misc.c, dlls/ntdll/ntdll.spec, dlls/ntdll/tests/rtl.c
+# |
+if test "$enable_ntdll_WinSqm" -eq 1; then
+	patch_apply ntdll-WinSqm/0001-ntdll-Add-stubs-for-WinSqmStartSession-WinSqmEndSess.patch
+	(
+		echo '+    { "Erich E. Hoover", "ntdll: Add stubs for WinSqmStartSession / WinSqmEndSession.", 1 },';
+	) >> "$patchlist"
+fi
+
 # Patchset ntdll-WriteWatches
 # |
 # | This patchset has the following (direct or indirect) dependencies:
				`@ -0,0 +1 @@`
				`Fixes: [34318] Move implementation of EtwRegisterTraceGuidsW to ntdll`