In the evntprov.h header we see the APIs using the REGHANDLE type:
ULONG
EVNTAPI
EventRegister(
_In_ LPCGUID ProviderId,
_In_opt_ PENABLECALLBACK EnableCallback,
_In_opt_ PVOID CallbackContext,
_Out_ PREGHANDLE RegHandle
);
#endif
#if (WINVER >= _WIN32_WINNT_VISTA)
/*
Closes the RegHandle that was opened by EventRegister.
*/
ULONG
EVNTAPI
EventUnregister(
_In_ REGHANDLE RegHandle
);
#endif
#if (WINVER >= _WIN32_WINNT_WIN8)
/*
Used to provide the ETW runtime with additional information about your provider
or to configure how the ETW runtime handles your provider's events.
Refer to the documentation of the EVENT_INFO_CLASS for more information.
*/
ULONG
EVNTAPI
EventSetInformation(
_In_ REGHANDLE RegHandle,
_In_ EVENT_INFO_CLASS InformationClass,
_In_reads_bytes_(InformationLength) PVOID EventInformation,
_In_ ULONG InformationLength
);
#endif
Most of these functions in the Win32 metadata also use the REGHANDLE type except the EventRegister which returns a ulong* instead of a REGHANDLE* as the trailing parameter:
In the
evntprov.h
header we see the APIs using theREGHANDLE
type:Most of these functions in the Win32 metadata also use the
REGHANDLE
type except theEventRegister
which returns aulong*
instead of aREGHANDLE*
as the trailing parameter: