# dtFabric format specification.
---
name: pe_resources
type: format
description: Portable Executable (PE) resources formats
---
name: byte
type: integer
attributes:
  format: unsigned
  size: 1
  units: bytes
---
name: uint8
type: integer
attributes:
  format: unsigned
  size: 1
  units: bytes
---
name: uint16
type: integer
attributes:
  format: unsigned
  size: 2
  units: bytes
---
name: uint32
type: integer
attributes:
  format: unsigned
  size: 4
  units: bytes
---
name: message_table_header
type: structure
attributes:
  byte_order: little-endian
members:
- name: number_of_entries
  data_type: uint32
---
name: message_table_entry
type: structure
attributes:
  byte_order: little-endian
members:
- name: first_message_identifier
  data_type: uint32
- name: last_message_identifier
  data_type: uint32
- name: first_string_offset
  data_type: uint32
---
name: message_table_string
type: structure
attributes:
  byte_order: little-endian
members:
- name: data_size
  data_type: uint16
- name: flags
  data_type: uint16
- name: data
  type: stream
  element_data_type: byte
  elements_data_size: message_table_string.data_size - 4
---
name: wevt_event_provider_descriptor
type: structure
attributes:
  byte_order: little-endian
members:
- name: provider_identifier
  type: uuid
- name: data_offset
  data_type: uint32
---
name: wevt_instrumentation_manifest
type: structure
attributes:
  byte_order: little-endian
members:
- name: signature
  type: stream
  element_data_type: byte
  elements_data_size: 4
  value: "CRIM"
- name: data_size
  data_type: uint32
- name: major_version
  data_type: uint16
- name: minor_version
  data_type: uint16
- name: number_of_event_providers
  data_type: uint32
- name: event_provider_descriptors
  type: sequence
  element_data_type: wevt_event_provider_descriptor
  number_of_elements: wevt_instrumentation_manifest.number_of_event_providers
---
name: wevt_provider_element_descriptor
type: structure
attributes:
  byte_order: little-endian
members:
- name: data_offset
  data_type: uint32
- name: unknown1
  data_type: uint32
---
name: wevt_event_provider
type: structure
attributes:
  byte_order: little-endian
members:
- name: signature
  type: stream
  element_data_type: byte
  elements_data_size: 4
  value: "WEVT"
- name: data_size
  data_type: uint32
- name: message_table_identifier
  data_type: uint32
- name: number_of_provider_element_descriptors
  data_type: uint32
- name: unknown1
  data_type: uint32
- name: provider_element_descriptors
  type: sequence
  element_data_type: wevt_provider_element_descriptor
  number_of_elements: wevt_event_provider.number_of_provider_element_descriptors
---
name: wevt_event_definition
type: structure
attributes:
  byte_order: little-endian
members:
- name: identifier
  data_type: uint16
- name: version
  data_type: uint8
- name: channel
  data_type: uint8
- name: level
  data_type: uint8
- name: opcode
  data_type: uint8
- name: task
  data_type: uint16
- name: keywords
  type: stream
  element_data_type: byte
  elements_data_size: 8
- name: message_identifier
  data_type: uint32
- name: template_offset
  data_type: uint32
- name: opcode_offset
  data_type: uint32
- name: level_offset
  data_type: uint32
- name: task_offset
  data_type: uint32
- name: unknown1
  type: stream
  element_data_type: byte
  elements_data_size: 8
- name: flags
  data_type: uint32
---
name: wevt_event_definitions
type: structure
attributes:
  byte_order: little-endian
members:
- name: signature
  type: stream
  element_data_type: byte
  elements_data_size: 4
  value: "EVNT"
- name: data_size
  data_type: uint32
- name: number_of_definitions
  data_type: uint32
- name: unknown1
  data_type: uint32
- name: definitions
  type: sequence
  element_data_type: wevt_event_definition
  number_of_elements: wevt_event_definitions.number_of_definitions
