keywords2.md

December 19, 2023 ยท View on GitHub

Continued from keywords.md
Sctipt to get the full list of keywords in keywords3.md -- CSV output file

Event log 'Keywords' p2

Apparently, each event log uses new 'keywords' created from a combination of the main 'keywords' found in the previous page.

  • Example:

    • The keyword 0x80000000a1878800:

      0x80000000a1878800

      • is created from the combination of:

        keywords (in Decimal):Name:Display Name:
        -9223372036854775808-Microsoft-Windows-Shell-Core/Diagnostic*
        4611686018427387904wpndev_NotificationE2EDeveloper Support: End-to-End trace for new notification Developer
        2147483648wpndebug_localtile_isolateDebug: Isolate Failures in Local Tile Notification Delivery Developer
        536870912wpndebug_cloudtile_isolateDebug: Isolate Failures in Cloud Tile Notification Delivery
        16777216wpntroubleshootWNP Transport Layer Performance
        8388608wpnperf_NewCloudNotificationArrivalWithCloudImageScenario: New cloud notification refering cloud images arrives Performance
        262144wpnperf_NewCloudNotificationArrivalScenario: New cloud notification arrives Performance
        31072wpnperf_FirstCloudNotificationWithCloudImageScenario: First cloud notification with cloud image download Performance
        65536wpnperf_FirstCloudNotificationScenario: First cloud notification Presentation Layer API
        32768wpnuiRouting Services*
        2048-StationId*

        (* Name taken from the previous page)

    Adding all these Decimal values, and converting the total to HEX: (powershell terminal command)
    "0x"+'{0:x16}'-f (-9223372036854775808 + 2147483648 + 536870912 + 16777216 + 8388608 + 262144 + 131072 + 65536 + 32768 + 2048)
    gives (powershell terminal output): 0x80000000a1878800

  • Powershell Script to list all keywords for each event ID from an eventlog List provider, and get the unique keywords

    # List all event Log providers:
# (Get-WinEvent -ListLog * ).ProviderNames|sort|get-unique

# Change 'Listprovider' name to get the keyword names & descriptions for that provider
$listprovider = @((Get-WinEvent -Listprovider Microsoft-Windows-PushNotifications-Platform).events|select-object -property id, keywords)

$kw = foreach($i in $listprovider){
    $kn=$vd=$vdn=$null
    #Get all possible keyword values (decimal) and add them together        
    $kvv=0;(0..20)|foreach{$kvv += $i.keywords.value[$_]}

    foreach($n in $i.keywords.name.count)        {if($n -ge 1)  {$kn  += "$($i.keywords.name[0..$n]) "}} 
    foreach($v in $i.keywords.value.count)       {if($v -ge 1) {$vd  += "$($i.keywords.value[0..$v]) "}}
    foreach($d in $i.keywords.displayname.count) {if($d -ge 1) {$vdn += "$($i.keywords.displayname[0..$d]) "}}

    [PSCustomObject]@{
        id = $i.id
        '#' = $i.keywords.value.count
        ValueHEX = "0x"+'{0:x16}'-f $kvv
        ValueDEC= $vd
        Name = $kn
        Displayname = $vdn
    }
}

$kw |sort -property ValueHEX -Unique|sort -property '#' |format-table -AutoSize

  • Result:

    New HEX KeywordKeywords CountKeywords (values in DEC)Name(s)
    0x80000000000000001
    0x200000000040000022305843009213693952 4194304wnptrans
    0x80000000000001002-9223372036854775808 256wpnconn
    0x80000000004000002-9223372036854775808 4194304wnptrans
    0x80000000000008002-9223372036854775808 2048wpnui
    0x400000000040000024611686018427387904 4194304wnptrans
    0x80000000000020002-9223372036854775808 8192wpndbg
    0x400000000000010024611686018427387904 256wpnconn
    0x400000000000020024611686018427387904 512wpnend
    0x400000000000080024611686018427387904 2048wpnui
    0x400000000000200024611686018427387904 8192wpndbg
    0x400000000000100024611686018427387904 4096wpnplat
    0x400000000000400024611686018427387904 16384wpnprv
    0x80000000008002003-9223372036854775808 8388608 512wpntroubleshoot wpnend
    0x400100000000400034611686018427387904 281474976710656 16384win:ResponseTime wpnprv
    0x80000000006000003-9223372036854775808 4194304 2097152wnptrans wpnperf_Shutdown
    0x80000000008001003-9223372036854775808 8388608 256wpntroubleshoot wpnconn
    0x400000008000080034611686018427387904 2147483648 2048wpndev_NotificationE2E wpnui
    0x400000008000020034611686018427387904 2147483648 512wpndev_NotificationE2E wpnend
    0x400000000080100034611686018427387904 8388608 4096wpntroubleshoot wpnplat
    0x400000000080080034611686018427387904 8388608 2048wpntroubleshoot wpnui
    0x400000000080020034611686018427387904 8388608 512wpntroubleshoot wpnend
    0x400000000020100034611686018427387904 2097152 4096wpnperf_Shutdown wpnplat
    0x80000000064000004-9223372036854775808 67108864 33554432 4194304wpndebug_connectivity_isConnected wpndebug_connectivity wnptrans
    0x80000000008001044-9223372036854775808 8388608 256 4wpntroubleshoot wpnconn wpndebug_raw_dropped
    0x800000000a0040004-9223372036854775808 134217728 33554432 16384wpndebug_connectivity_error wpndebug_connectivity wpnprv
    0x80000000004180004-9223372036854775808 4194304 65536 32768wnptrans wpnperf_FirstCloudNotificationWithCloudImage wpnperf_FirstCloudNotification
    0x800000000001c0004-9223372036854775808 65536 32768 16384wpnperf_FirstCloudNotificationWithCloudImage wpnperf_FirstCloudNotification wpnprv
    0x800000000a4000004-9223372036854775808 134217728 33554432 4194304wpndebug_connectivity_error wpndebug_connectivity wnptrans
    0x80000000108002004-9223372036854775808 268435456 8388608 512wpndebug_platform_setting wpntroubleshoot wpnend
    0x80000000408002004-9223372036854775808 1073741824 8388608 512wpndebug_polling_error wpntroubleshoot wpnend
    0x80000000028010004-9223372036854775808 33554432 8388608 4096wpndebug_connectivity wpntroubleshoot wpnplat
    0x80000000800002084-9223372036854775808 2147483648 512 8wpndev_NotificationE2E wpnend wpndebug_raw_isolate
    0x80002000008001004-9223372036854775808 35184372088832 8388608 256ms:Telemetry wpntroubleshoot wpnconn
    0x400000008000020844611686018427387904 2147483648 512 8wpndev_NotificationE2E wpnend wpndebug_raw_isolate
    0x400000004080020044611686018427387904 1073741824 8388608 512wpndebug_polling_error wpntroubleshoot wpnend
    0x400000001080020044611686018427387904 268435456 8388608 512wpndebug_platform_setting wpntroubleshoot wpnend
    0x400000000a00400044611686018427387904 134217728 33554432 16384wpndebug_connectivity_error wpndebug_connectivity wpnprv
    0x400000000001900044611686018427387904 65536 32768 4096wpnperf_FirstCloudNotificationWithCloudImage wpnperf_FirstCloudNotification wpnplat
    0x400000000041800044611686018427387904 4194304 65536 32768wnptrans wpnperf_FirstCloudNotificationWithCloudImage wpnperf_FirstCloudNotification
    0x400000000018080044611686018427387904 1048576 524288 2048wpnperf_MoGoPanningWithCloudImage wpnperf_MoGoPanning wpnui
    0x400000000001c00044611686018427387904 65536 32768 16384wpnperf_FirstCloudNotificationWithCloudImage wpnperf_FirstCloudNotification wpnprv
    0x80000000068001005-9223372036854775808 67108864 33554432 8388608 256wpndebug_connectivity_isConnected wpndebug_connectivity wpntroubleshoot wpnconn
    0x400000000015080054611686018427387904 1048576 262144 65536 2048wpnperf_MoGoPanningWithCloudImage wpnperf_NewCloudNotificationArrivalWithCloudImage wpnperf_FirstCloudNotificationWithCloudImage wpnui
    0x40000000a080020264611686018427387904 2147483648 536870912 8388608 512 2wpndev_NotificationE2E wpndebug_localtile_isolate wpntroubleshoot wpnend wpndebug_localtoast_isolate
    0x400000008080080364611686018427387904 2147483648 8388608 2048 2 1wpndev_NotificationE2E wpntroubleshoot wpnui wpndebug_localtoast_isolate wpndebug_cloudtoast_isolate
    0x400000008015080064611686018427387904 2147483648 1048576 262144 65536 2048wpndev_NotificationE2E wpnperf_MoGoPanningWithCloudImage wpnperf_NewCloudNotificationArrivalWithCloudImage wpnperf_FirstCloudNotificationWithCloudImage wpnui
    0x80000000808008036-9223372036854775808 2147483648 8388608 2048 2 1wpndev_NotificationE2E wpntroubleshoot wpnui wpndebug_localtoast_isolate wpndebug_cloudtoast_isolate
    0x80000000068181007-9223372036854775808 67108864 33554432 8388608 65536 32768 256wpndebug_connectivity_isConnected wpndebug_connectivity wpntroubleshoot wpnperf_FirstCloudNotificationWithCloudImage wpnperf_FirstCloudNotification wpnconn
    0x400000008007880074611686018427387904 2147483648 262144 131072 65536 32768 2048wpndev_NotificationE2E wpnperf_NewCloudNotificationArrivalWithCloudImage wpnperf_NewCloudNotificationArrival wpnperf_FirstCloudNotificationWithCloudImage wpnperf_FirstCloudNotification wpnui
    0x800000000a81c0007-9223372036854775808 134217728 33554432 8388608 65536 32768 16384wpndebug_connectivity_error wpndebug_connectivity wpntroubleshoot wpnperf_FirstCloudNotificationWithCloudImage wpnperf_FirstCloudNotification wpnprv
    0x40000000a1878800104611686018427387904 2147483648 536870912 16777216 8388608 262144 131072 65536 32768 2048wpndev_NotificationE2E wpndebug_localtile_isolate wpndebug_cloudtile_isolate wpntroubleshoot wpnperf_NewCloudNotificationArrivalWithCloudImage wpnperf_NewCloudNotificationArrival wpnperf_FirstCloudNotificationWithCloudImage wpnperf_FirstCloudNotification wpnui
    0x80000000a187880010-9223372036854775808 2147483648 536870912 16777216 8388608 262144 131072 65536 32768 2048wpndev_NotificationE2E wpndebug_localtile_isolate wpndebug_cloudtile_isolate wpntroubleshoot wpnperf_NewCloudNotificationArrivalWithCloudImage wpnperf_NewCloudNotificationArrival wpnperf_FirstCloudNotificationWithCloudImage wpnperf_FirstCloudNotification wpnui
    0x800000008187810911-9223372036854775808 2147483648 16777216 8388608 262144 131072 65536 32768 256 8 1wpndev_NotificationE2E wpndebug_cloudtile_isolate wpntroubleshoot wpnperf_NewCloudNotificationArrivalWithCloudImage wpnperf_NewCloudNotificationArrival wpnperf_FirstCloudNotificationWithCloudImage wpnperf_FirstCloudNotification wpnconn wpndebug_raw_isolate wpndebug_cloudtoast_isolate