EtwCheckCoverage API

This is a relatively new API (EtwCheckCoverage) that may be of interest. It is being used by a couple of DLLs and executables in Windows 11 and here’s a list of known parameters it takes:

comdlg32.dll
Shell_Picker_Show
Shell_Picker_Finish
Shell_Picker_Cancel

dafBth.dll
Bluetooth_Pairing_Cancelled
Bluetooth_Pairing_Succeeded
Bluetooth_Pairing_Failed
Bluetooth_Pairing_Started
Bluetooth_Pairing_Deleted

diagtrack.dll
UTC_OsEvents_AbnormalShutdown

dwmcore.dll
Dwm_EnergyReporter_DataDropped_Queuing
Dwm_EnergyReporter_DataDropped_MaxEntries
Dwm_EnergyReporter_DataDropped_WorkerRunning

Faultrep.dll
WER_Report_AppCrash

localspl.dll
Printing_Job_Complete_3D
Printing_Job_Error_3D
Printing_Job_Complete
Printing_Job_Error
Printing_Job_Start_3D
Printing_Job_Start

ncsi.dll
NLA_Capability_Internet
NLA_Capability_Internet_ProxyAuth
NLA_Capability_Internet_BehindHotspot
NLA_Capability_Internet_Proxied
NLA_Capability_Internet_Corp

rasapi32.dll
VPN_Connection_Failed
VPN_Connection_Complete

Taskmgr.exe
Diag_TaskMgr_EndTask_FromSmallView
Diag_TaskMgr_EndTask_FromDetails
Diag_TaskMgr_EndTask
Diag_Taskmgr_Launch

tellib.dll
UTC_OsEvents_AbnormalShutdown

wersvc.dll
WER_Report_AppHang

windows.storage.dll
Copy_Engine_WCIFS_Delete_Attempt

wlansvc.dll
Wireless_Connection_Success
Wireless_Connection_Unsuccessful