| Windows 7 DLL File Information - tdh.dll |
The following DLL report was generated by automatic DLL script that scanned and loaded all DLL files in the system32 directory of Windows 7, extracted the information from them, and then saved it into HTML reports. If you want to view a report of another DLL, go to the main page of this Web site.
General Information
| File Description: | Event Trace Helper Library |
| File Version: | 6.1.7100.0 (winmain_win7rc.090421-1700) |
| Company: | Microsoft Corporation |
| Product Name: | Microsoft Windows Operating System |
| DLL popularity | Low - 7 other DLL files in system32 directory are statically linked to this file. |
| File Size: | 593 KB |
| Total Number of Exported Functions: | 16 |
| Total Number of Exported Functions With Names: | 16 |
Section Headers
| Name | Virtual Address | Raw Data Size | % of File | Characteristics | Section Contains... |
|---|---|---|---|---|---|
| .text | 0x00001000 | 502,784 Bytes | 82.8% | Read, Execute | Code |
| .data | 0x0007c000 | 75,776 Bytes | 12.5% | Write, Read | Initialized Data |
| .rsrc | 0x00090000 | 1,536 Bytes | 0.3% | Read | Initialized Data |
| .reloc | 0x00091000 | 25,600 Bytes | 4.2% | Read, Discardable | Initialized Data |
Static Linking
tdh.dll is statically linked to the following files:msvcrt.dll
ntdll.dll
API-MS-Win-Core-Debug-L1-1-0.dll
API-MS-Win-Core-ErrorHandling-L1-1-0.dll
API-MS-Win-Core-Heap-L1-1-0.dll
API-MS-Win-Core-Interlocked-L1-1-0.dll
API-MS-Win-Core-LibraryLoader-L1-1-0.dll
API-MS-Win-Core-LocalRegistry-L1-1-0.dll
API-MS-Win-Core-Memory-L1-1-0.dll
API-MS-Win-Core-Misc-L1-1-0.dll
API-MS-Win-Core-ProcessEnvironment-L1-1-0.dll
API-MS-Win-Core-ProcessThreads-L1-1-0.dll
API-MS-Win-Core-Profile-L1-1-0.dll
API-MS-Win-Core-Synch-L1-1-0.dll
API-MS-Win-Core-SysInfo-L1-1-0.dll
KERNEL32.dll
API-MS-Win-Security-Base-L1-1-0.dll
This means that when tdh.dll is loaded, the above files are automatically loaded too. If one of these files is corrupted or missing, tdh.dll won't be loaded.
List of files that are statically linked to tdh.dll
aepdu.dll
energy.dll
MsiCofire.dll
nettrace.dll
pla.dll
pots.dll
whealogr.dll
This means that when one of the above files is loaded, tdh.dll will be loaded too. (The opposite of the previous 'Static Linking' section)
General Resources Information
| Resource Type | Number of Items | Total Size | % of File |
|---|---|---|---|
| Icons | 0 | 0 Bytes | 0.0% |
| Animated Icons | 0 | 0 Bytes | 0.0% |
| Cursors | 0 | 0 Bytes | 0.0% |
| Animated Cursors | 0 | 0 Bytes | 0.0% |
| Bitmaps | 0 | 0 Bytes | 0.0% |
| AVI Files | 0 | 0 Bytes | 0.0% |
| Dialog-Boxes | 0 | 0 Bytes | 0.0% |
| HTML Related Files | 3 | 78,453 Bytes | 12.9% |
| Menus | 0 | 0 Bytes | 0.0% |
| Strings | 146 | 29,176 Bytes | 4.8% |
| Type Libraries | 0 | 0 Bytes | 0.0% |
| Manifest | 0 | 0 Bytes | 0.0% |
| All Others | 2 | 1,112 Bytes | 0.2% |
| Total | 151 | 108,741 Bytes | 17.9% |
Icons in this file
No icons found in this file
Cursors in this file
No cursors found in this file
Dialog-boxes list (up to 200 dialogs)
No dialog resources in this file.
String resources in this dll (up to 200 strings)
| String ID | String Text |
|---|---|
| 61184 | Unrecognized attribute specified. |
| 61185 | Not found : '%1'. |
| 61186 | MessageId not found in string table : '%1'. |
| 61187 | Duplicate string Id specified : '%1'. |
| 61188 | For Provider '%1' attribute resourceFileName is required. |
| 61189 | For Provider '%1' attribute messageFileName is required. |
| 61190 | Provider '%1', parameter file name cannot be specified without a message file name. |
| 61191 | Duplicate provider name specified : '%1'. |
| 61192 | Duplicate provider GUID '%1' in provider : '%2'. |
| 61193 | Duplicate provider symbol specified : '%1'. |
| 61194 | Invalid value %1!u!(0x%1!x!) specified for level '%2'. Values 0 thru 15 are reserved. |
| 61195 | Duplicate level name used : '%1'. |
| 61196 | Duplicate level value %1!u!(0x%1!x!) used in level : '%2'. |
| 61197 | Duplicate level symbol used : '%1'. |
| 61198 | Invalid value %1!u!(0x%1!x!) specified for task '%2'. Value 0 is reserved.. |
| 61199 | Duplicate task name used : '%1'. |
| 61200 | Duplicate task value %1!u!(0x%1!x!) used in task : '%2'. |
| 61201 | Duplicate task symbol used : '%1'. |
| 61202 | Duplicate event guid '%1' used for task '%2'. |
| 61203 | Invalid value %1!u!(0x%1!x!) specified for opcode '%2'. Opcode values should be between 10 and 239. |
| 61204 | Duplicate opcode name used : '%1'. |
| 61205 | Duplicate opcode value %1!u!(0x%1!x!) used in opcode : '%2'. |
| 61206 | Duplicate opcode symbol used : '%1'. |
| 61207 | Invalid value %1!u!(0x%1!x!) specified for channel '%2'. Values for user-defined channels should be between 16 and 255. |
| 61209 | Channel '%1' is the 9th channel for this provider. On 8 channels allowed for one provider. |
| 61210 | Duplicate channel Id '%1' used in channel '%2'. |
| 61211 | Duplicate channel name used : '%1'. Channel names are case-insensitive. |
| 61212 | Duplicate channel value %1!u!(0x%1!x!) used in channel '%2'. |
| 61213 | Duplicate channel symbol '%1' used for channel '%2'. |
| 61216 | Duplicate property name : '%1' specified within template - '%2'. |
| 61217 | For property '%1', property '%2' referenced by attribute count was not found. |
| 61218 | For property '%1', property '%2' referenced by attribute length was not found.. |
| 61219 | For property '%1', property '%2' referenced by attribute count is a struct. |
| 61220 | For property '%1', property '%2' referenced by attribute length is a struct. |
| 61221 | For property '%1', with inType win:Binary, length must be specified. |
| 61222 | For property '%1', length is not allowed for the given inType. |
| 61224 | For event '%1', with Id %2!u!(0x%2!x!), too many keywords specified. Maximum keywords allowed is 48. |
| 61225 | For event '%1', Id %2!u!(0x%2!x!) was specified which is bigger than USHORT. |
| 61226 | Two events have the same Id %1!u!(0x%1!x!) and Version %2!u!(0x%2!x!). |
| 61227 | Duplicate event symbol used : '%1'. |
| 61228 | For event '%1', with Id %2!u!(0x%2!x!), win:EventlogClassic keyword is not allowed with any other keyword. |
| 61229 | For event '%1', with Id %2!u!(0x%2!x!), version attribute is not allowed. |
| 61231 | For event '%1', with Id %2!u!(0x%2!x!), channel attribute is not allowed. |
| 61233 | For event '%1', with Id %2!u!(0x%2!x!), opcode attribute is not allowed. |
| 61234 | For keyword '%1', 'mask' attribute is invalid. One and only one bit should be set. |
| 61235 | For keyword '%1', with mask 0x%2!I64x!, mask bit can only be one of the low 48 bits. |
| 61236 | Duplicate keyword name used: '%1'. |
| 61237 | Duplicate keyword mask 0x%1!I64x! used in keyword '%2'. |
| 61238 | Duplicate keyword symbol '%1' used in keyword '%2'. |
| 61239 | Duplicate template TId '%1' used. |
| 61241 | Failed to load msxml6.dll. Please ensure that MSXML 6.0 is installed on the system and try again. |
| 61242 | Failed to CoCreate Schema cache. |
| 61243 | Failed trying to add schema file to cache. |
| 61244 | Failed to add schema to schema collection. |
| 61245 | Failed to set async property on DOMDocument. |
| 61246 | Failed to query IXMLDOMDocument interface. |
| 61247 | Failed trying to parse file. %1(%2!d!): Error 0x%3!x!. At Line=%4!d!, Column=%5!d!, %6 |
| 61248 | OutType : '%1' is invalid for InType : '%2'. |
| 61249 | InType : '%1' not found. |
| 61251 | Duplicate map name used: '%1'. |
| 61252 | Only one bit may be set in bit map : '%1' 0x%2!x!. |
| 61256 | Only 16 providers allowed in one manifest. |
| 61257 | Duplicate message ID was specified - 0x%1!x!. This can happen when an auto-generated messageId conflicts with those explicitly specified using a <messageTable> or a .mc file. |
| 61258 | For provider '%1', ResourceBase value %2!u!(0x%2!x!) results in duplicate string Ids. Try different value. |
| 61259 | Duplicate Filter Symbol used : '%1'. |
| 61260 | Two Filters have the same Id:%1!u!(0x%1!x!) and Version:%2!u!(0x%2!x!). |
| 61261 | UserData not allowed for template with TId '%1', since it is a filter template. |
| 61262 | Struct not allowed for property '%1' of template with TId '%2', since it is a filter template. |
| 61263 | Array not allowed for property '%1' of template with TId '%2', since it is a filter template. |
| 61264 | Map not allowed for template with TId '%1', since it is a filter template. |
| 61265 | Attribute outType is required for property '%1' of template with TId '%2', since it is a filter template. |
| 61266 | Duplicate Filter Name used : '%1'. |
| 61267 | Required attribute 'chid' is missing for the channel element with name '%1'. |
| 61268 | For channel '%1', value of attribute 'access' is not a valid SDDL string: '%2'. |
| 61269 | A <message> element has reference to a non-existent <string> entry: '%1'. |
| 61270 | Two <message> entries have the same MId value: 0x%1!x!. |
| 61271 | For Template with TId '%1', only one <binary> element is allowed. |
| 61272 | Two <message> entries have the same MId: '%1'. |
| 61273 | For event '%1', with Id %2!u!(0x%2!x!), attribute 'message' is required, since it is an Admin event. |
| 61274 | For event '%1', with Id %2!u!(0x%2!x!), level must be specified and it should be one of Critical, Error, Warning, or Informational, since it is an Admin event. |
| 61275 | Two <message> entries have the same symbol: '%1'. |
| 61276 | The instrumentation node is either missing or in the wrong namespace. |
| 61278 | For <data> element '%1', the prefix of '%2' is not in the winmeta namespace. |
| 61279 | For <counter> element with Id %1!u!(0x%1!x!), under <counterSet> '%2', attribute 'field' is not allowed, since provider is userMode. |
| 61280 | For <counter> element with Id %1!u!(0x%1!x!), under <counterSet> '%2', attribute 'struct' is required, since provider is kernelMode. |
| 61281 | For <counter> element with Id %1!u!(0x%1!x!), under <counterSet> '%2', attribute 'field' is required, since provider is kernelMode. |
| 61282 | For <counterSet> element '%1', under <provider> '%2', child element <structs> is required, since provider is kernelMode. |
| 61283 | For <counterSet> element '%1', under <provider> '%2', child element <structs> is not allowed, since provider is userMode. |
| 61284 | For <provider> element '%1', attribute symbol is required, since provider is userMode. |
| 61285 | For <provider> element '%1', attribute symbol is not allowed, since provider is kernelMode. |
| 61286 | For <counter> element with Id %1!u!(0x%1!x!), under <counterSet> '%2', 'id' cannot be greater than 63 since provider is kernelMode. |
| 61287 | For <counter> element with Id %1!u!(0x%1!x!), under <counterSet> '%2', attribute 'aggregate' is not allowed since the parent counterSet has either single or multiple instances. |
| 61288 | For <counter> element with Id %1!u!(0x%1!x!), under <counterSet> '%2', attribute 'baseID' is required. Here is the list of counter types that require a baseID and the required types of their base counters: perf_average_bulk perf_average_timer Base: perf_average_base perf_100nsec_multi_timer perf_100nsec_multi_timer_inv perf_counter_multi_timer perf_counter_multi_timer_inv Base: perf_counter_multi_base perf_raw_fraction Base: perf_raw_base perf_large_raw_fraction Base: perf_large_raw_base perf_sample_fraction Base: perf_sample_base |
| 61289 | String table references not allowed. Please inline the value of the string: '%1'. |
| 61290 | For Map '%1', duplicate value %2!u!(0x%2!x!) specified. |
| 61291 | For Pattern Map '%1', duplicate value '%2' specified. |
| 61292 | For template '%1', invalid Custom Xml specified. Custom Xml must have a top-level element and it should be in its own namespace. Also, the value of property inserts should not be greater than the number of top-level properties in the template : %2. |
| 61293 | The <events> node is either missing or in the wrong namespace. The <events> node must be present under <instrumentation> node and should be in the following namespace: 'http://schemas.microsoft.com/win/2004/08/events'. |
| 61295 | For property '%1', inType must be one of UInt8, UInt16, UInt32, or HexInt32, since map is specified. |
| 61296 | For property '%1', property '%2' referenced by attribute count must have inType UInt8, UInt16, UInt32, or HexInt32. |
| 61297 | For property '%1', property '%2' referenced by attribute count cannot have attribute count. |
| 61298 | For property '%1', property '%2' referenced by attribute length must have inType UInt8, UInt16, UInt32, or HexInt32. |
| 61299 | For property '%1', property '%2' referenced by attribute length cannot have attribute length. |
| 61300 | For event '%1', with Id %2!u!(0x%2!x!), a property insert in the event message is referencing a non-existent property. Event only has %3!u! properties: '%4'. |
| 61301 | For event '%1', with Id %2!u!(0x%2!x!), format specification fields are not allowed in property inserts: '%3'. |
| 61302 | Length of Channel Name must be between 1 and 256 characters: '%1'. |
| 61303 | Invalid Channel Name: %1. Following characters are not allowed in a channel name: ascii value <31, double quote, '>','<','&','|','\',''',':','*', and '?'. |
| 61304 | Length of Provider Name must be between 1 and 256 characters: '%1'. |
| 61305 | Invalid Provider Name: %1. Following characters are not allowed in a Provider name: ascii value <31, double quote, '>','<','&','|','\',''',':','*', and '?'. |
| 61306 | Failed to set selection language. |
| 61307 | Failed to set selection namespace. |
| 61308 | Failed trying to parse file %1, and failed to retrieve reason for failure. |
| 61309 | Unknown error 0x%1!x! received from msxml. |
| 61310 | This element is referenced by %1!u! other element(s). Please remove references before deleting. |
| 61311 | Specify a name for the map. |
| 61312 | For <counter> element with Id %1!u!(0x%1!x!), under <counterSet> '%2', attributes 'perfTimeID' and 'perfFreqID' are required, and the counters referenced by those attributes should be of type perf_counter_large_rawcount. This rule applies to counters of following types: perf_counter_obj_time_queuelen_type perf_obj_time_timer perf_elapsed_time perf_precision_object_timer |
| 61313 | For <counter> element with Id %1!u!(0x%1!x!), under <counterSet> '%2', attribute 'multiCounterID' is required, and the counter referenced by that attribute should be of type perf_counter_rawcount. This rule applies to following counter types: perf_counter_multi_timer perf_counter_multi_timer_inv perf_100nsec_multi_timer perf_100nsec_multi_timer_inv |
| 61314 | Two providers have defined a channel with duplicate name : '%1'. A given channel name can only be defined by one provider, other providers should use <importChannel> element to refer an existing channel. |
| 61315 | Two or more events logging to legacy 'System', 'Security' or 'Application' channels are referencing the same message string '%1'. Give each such event a unique message string. |
| 61316 | String '%1' is given Id %2!u!(0x%2!x!) in a .mc file. Change the Id of this string to be the same as that of the event referencing this string, since the event is logging to 'System', 'Security' or 'Application' channel. |
| 61317 | String '%1' is explicitly assigned Id %2!u!(0x%2!x!) using a <message> element. Change the Id of this string to be the same as that of the event referencing this string, since the event is logging to 'System', 'Security' or 'Application' channel. |
| 61318 | For event '%1', with Id %2!u!(0x%2!x!), since Opcode '%3' is local to Task '%4', event must reference the Task '%4'. |
| 61319 | For event '%1', with Id %2!u!(0x%2!x!), Opcode '%3' is local to Task '%4', but event is referencing Task '%5'. |
| 61320 | For event '%1', with Id %2!u!(0x%2!x!), Opcode '%3' is global, and its value collides with that of local Opcode '%4' of the Task '%5' that the event is referencing. |
| 61321 | Duplicate Id %1!u!(0x%1!x!) used in Counter : '%2'. |
| 61322 | Duplicate Uri '%1' used in Counter : '%2'. |
| 61323 | Duplicate Name used : '%1'. |
| 61324 | Duplicate Symbol '%1' used in Counter : '%2'. |
| 61325 | Duplicate Guid '%1' used in CounterSet : '%2'. |
| 61326 | Duplicate Uri '%1' used in CounterSet : '%2'. |
| 61327 | Duplicate CounterSet Name used : '%1'. |
| 61328 | Duplicate Symbol '%1' used in CounterSet : '%2'. |
| 61329 | Duplicate Guid '%1' used in Provider : '%2'. |
| 61330 | Duplicate Provider Name used : '%1'. |
| 61331 | Map '%1' cannot be empty. |
| 61332 | Missing Attribute 'id' on one of the <string> elements. |
| 61333 | For String with Id '%1', attribute 'value' is missing. |
| 61334 | Duplicate Counter Struct Name used : '%1'. |
| 61335 | For <counter> element with Id %1!u!(0x%1!x!), under <counterSet> '%2', BaseId value refers to a non-existent counter. |
| 61336 | For <counter> element with Id %1!u!(0x%1!x!), under <counterSet> '%2', PerfTimeId value refers to a non-existent counter. |
| 61337 | For <counter> element with Id %1!u!(0x%1!x!), under <counterSet> '%2', PerfFreqId value refers to a non-existent counter. |
| 61338 | For <counter> element with Id %1!u!(0x%1!x!), under <counterSet> '%2', MultiCounterId value refers to a non-existent counter. |
| 61339 | For <counter> element with Id %1!u!(0x%1!x!), under <counterSet> '%2', BaseId is not allowed for this counter type. |
| 61340 | For <counter> element with Id %1!u!(0x%1!x!), under <counterSet> '%2', PerfTimeId is not allowed for this counter type. |
| 61341 | For <counter> element with Id %1!u!(0x%1!x!), under <counterSet> '%2', PerfFreqId is not allowed for this counter type. |
| 61342 | For <counter> element with Id %1!u!(0x%1!x!), under <counterSet> '%2', MultiCounterId is not allowed for this counter type. |
COM Classes/Interfaces
There is no type library in this file with COM classes/interfaces information
Exported Functions List
The following functions are exported by this dll:| TdhEnumerateProviderFieldInformation | TdhEnumerateProviderFilters |
| TdhEnumerateProviders | TdhEnumerateRemoteWBEMProviderFieldInformation |
| TdhEnumerateRemoteWBEMProviders | TdhFormatProperty |
| TdhGetAllEventsInformation | TdhGetEventInformation |
| TdhGetEventMapInformation | TdhGetProperty |
| TdhGetPropertyOffsetAndSize | TdhGetPropertySize |
| TdhLoadManifest | TdhQueryProviderFieldInformation |
| TdhQueryRemoteWBEMProviderFieldInformation | TdhUnloadManifest |
Imported Functions List
The following functions are imported by this dll:- msvcrt.dll:
_CxxThrowException _XcptFilter __CxxFrameHandler __RTDynamicCast __RTtypeid __dllonexit _amsg_exit _callnewh _errno _except_handler4_common _initterm _lock _onexit _purecall _unlock _vsnprintf _vsnwprintf _wcsicmp _wcsnicmp _wcstoui64 _wfopen _wtoi fclose fgetws free iswspace malloc memcpy memcpy_s memmove memmove_s memset public: __thiscall exception::exception(char const * const &) public: __thiscall exception::exception(class exception const &) public: __thiscall exception::exception(void) public: int __thiscall type_info::operator==(class type_info const &)const public: virtual __thiscall exception::~exception(void) public: virtual __thiscall type_info::~type_info(void) public: virtual char const * __thiscall exception::what(void)const strncmp swscanf tolower wcschr wcsncmp wcsrchr wcsstr wcstok wcstok_s wcstol wcstoul - ntdll.dll:
EtwGetTraceEnableFlags EtwGetTraceEnableLevel EtwGetTraceLoggerHandle EtwRegisterTraceGuidsW EtwTraceMessage EtwUnregisterTraceGuids RtlEthernetAddressToStringW RtlInitializeConditionVariable RtlIpv4AddressToStringExW RtlIpv6AddressToStringExW RtlIpv6AddressToStringW - API-MS-Win-Core-Debug-L1-1-0.dll:
KernelBase!OutputDebugStringA - API-MS-Win-Core-ErrorHandling-L1-1-0.dll:
kernel32!GetLastError kernel32!SetUnhandledExceptionFilter kernel32!UnhandledExceptionFilter - API-MS-Win-Core-Heap-L1-1-0.dll:
KernelBase!GetProcessHeap ntdll!RtlAllocateHeap ntdll!RtlFreeHeap - API-MS-Win-Core-Interlocked-L1-1-0.dll:
KernelBase!InterlockedCompareExchange KernelBase!InterlockedExchange - API-MS-Win-Core-LibraryLoader-L1-1-0.dll:
KernelBase!FreeLibrary KernelBase!GetProcAddress KernelBase!LoadLibraryExA KernelBase!LoadLibraryExW KernelBase!LoadStringW - API-MS-Win-Core-LocalRegistry-L1-1-0.dll:
kernel32!RegCloseKey kernel32!RegEnumKeyExW kernel32!RegOpenKeyExW kernel32!RegQueryInfoKeyW kernel32!RegQueryValueExW - API-MS-Win-Core-Memory-L1-1-0.dll:
KernelBase!VirtualAllocEx KernelBase!VirtualFreeEx - API-MS-Win-Core-Misc-L1-1-0.dll:
KernelBase!FormatMessageW KernelBase!GlobalFree KernelBase!IsWow64Process KernelBase!LocalAlloc KernelBase!Sleep KernelBase!Wow64DisableWow64FsRedirection KernelBase!Wow64RevertWow64FsRedirection - API-MS-Win-Core-ProcessEnvironment-L1-1-0.dll:
KernelBase!ExpandEnvironmentStringsW - API-MS-Win-Core-ProcessThreads-L1-1-0.dll:
kernel32!GetCurrentProcess kernel32!GetCurrentProcessId kernel32!GetCurrentThreadId kernel32!TerminateProcess - API-MS-Win-Core-Profile-L1-1-0.dll:
ntdll!RtlQueryPerformanceCounter - API-MS-Win-Core-Synch-L1-1-0.dll:
ntdll!RtlAcquireSRWLockExclusive ntdll!RtlAcquireSRWLockShared ntdll!RtlReleaseSRWLockExclusive ntdll!RtlReleaseSRWLockShared - API-MS-Win-Core-SysInfo-L1-1-0.dll:
KernelBase!GetSystemTimeAsFileTime KernelBase!GetTickCount - KERNEL32.dll:
CloseHandle CreateFileMappingW CreateFileW DelayLoadFailureHook FileTimeToLocalFileTime FileTimeToSystemTime FindResourceW FreeResource GetCurrentDirectoryW GetDateFormatW GetEnvironmentVariableW GetFileSize GetTempFileNameW GetTempPathW GetTimeFormatW GetVersionExW InterlockedDecrement InterlockedIncrement LoadLibraryW LoadResource LockResource MapViewOfFile MultiByteToWideChar SearchPathW SetLastError SizeofResource UnmapViewOfFile WriteFile ntdll!RtlDeleteCriticalSection ntdll!RtlEnterCriticalSection ntdll!RtlInitializeCriticalSection ntdll!RtlLeaveCriticalSection - API-MS-Win-Security-Base-L1-1-0.dll:
KernelBase!GetLengthSid