{"id":10407,"date":"2026-10-02T23:32:48","date_gmt":"2026-10-02T23:32:48","guid":{"rendered":"https:\/\/www.hexacorn.com\/blog\/?p=10407"},"modified":"2026-10-02T23:32:48","modified_gmt":"2026-10-02T23:32:48","slug":"etwcheckcoverage-api","status":"publish","type":"post","link":"https:\/\/www.hexacorn.com\/blog\/2026\/10\/02\/etwcheckcoverage-api\/","title":{"rendered":"EtwCheckCoverage API"},"content":{"rendered":"\n<p>This is a relatively new API (<a href=\"https:\/\/ntdoc.m417z.com\/etwcheckcoverage\">EtwCheckCoverage<\/a>) that may be of interest. It is being used by a couple of DLLs and executables in Windows 11 and here&#8217;s a list of known parameters it takes:<\/p>\n\n\n\n<p><strong>comdlg32.dll<\/strong><br>Shell_Picker_Show<br>Shell_Picker_Finish<br>Shell_Picker_Cancel<\/p>\n\n\n\n<p><strong>dafBth.dll<\/strong><br>Bluetooth_Pairing_Cancelled<br>Bluetooth_Pairing_Succeeded<br>Bluetooth_Pairing_Failed<br>Bluetooth_Pairing_Started<br>Bluetooth_Pairing_Deleted<\/p>\n\n\n\n<p><strong>diagtrack.dll<\/strong><br>UTC_OsEvents_AbnormalShutdown<\/p>\n\n\n\n<p><strong>dwmcore.dll<\/strong><br>Dwm_EnergyReporter_DataDropped_Queuing<br>Dwm_EnergyReporter_DataDropped_MaxEntries<br>Dwm_EnergyReporter_DataDropped_WorkerRunning<\/p>\n\n\n\n<p><strong>Faultrep.dll<\/strong><br>WER_Report_AppCrash<\/p>\n\n\n\n<p><strong>localspl.dll<\/strong><br>Printing_Job_Complete_3D<br>Printing_Job_Error_3D<br>Printing_Job_Complete<br>Printing_Job_Error<br>Printing_Job_Start_3D<br>Printing_Job_Start<\/p>\n\n\n\n<p><strong>ncsi.dll<\/strong><br>NLA_Capability_Internet<br>NLA_Capability_Internet_ProxyAuth<br>NLA_Capability_Internet_BehindHotspot<br>NLA_Capability_Internet_Proxied<br>NLA_Capability_Internet_Corp<\/p>\n\n\n\n<p><strong>rasapi32.dll<\/strong><br>VPN_Connection_Failed<br>VPN_Connection_Complete<\/p>\n\n\n\n<p><strong>Taskmgr.exe<\/strong><br>Diag_TaskMgr_EndTask_FromSmallView<br>Diag_TaskMgr_EndTask_FromDetails<br>Diag_TaskMgr_EndTask<br>Diag_Taskmgr_Launch<\/p>\n\n\n\n<p><strong>tellib.dll<\/strong><br>UTC_OsEvents_AbnormalShutdown<\/p>\n\n\n\n<p><strong>wersvc.dll<\/strong><br>WER_Report_AppHang<\/p>\n\n\n\n<p><strong>windows.storage.dll<\/strong><br>Copy_Engine_WCIFS_Delete_Attempt<\/p>\n\n\n\n<p>wlansvc.dll<br>Wireless_Connection_Success<br>Wireless_Connection_Unsuccessful<\/p>\n","protected":false},"excerpt":{"rendered":"<p>This is a relatively new API (EtwCheckCoverage) that may be of interest. It is being used by a couple of DLLs and executables in Windows 11 and here&#8217;s a list of known parameters it takes: comdlg32.dllShell_Picker_ShowShell_Picker_FinishShell_Picker_Cancel dafBth.dllBluetooth_Pairing_CancelledBluetooth_Pairing_SucceededBluetooth_Pairing_FailedBluetooth_Pairing_StartedBluetooth_Pairing_Deleted diagtrack.dllUTC_OsEvents_AbnormalShutdown dwmcore.dllDwm_EnergyReporter_DataDropped_QueuingDwm_EnergyReporter_DataDropped_MaxEntriesDwm_EnergyReporter_DataDropped_WorkerRunning Faultrep.dllWER_Report_AppCrash &hellip; <a href=\"https:\/\/www.hexacorn.com\/blog\/2026\/10\/02\/etwcheckcoverage-api\/\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[53,99],"tags":[],"_links":{"self":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/10407"}],"collection":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/comments?post=10407"}],"version-history":[{"count":1,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/10407\/revisions"}],"predecessor-version":[{"id":10408,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/10407\/revisions\/10408"}],"wp:attachment":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/media?parent=10407"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/categories?post=10407"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/tags?post=10407"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}