title: How to turn on ETW/WPP for particular driver?
body: <p>Like in topic I would like to know how to "turn on" ETW or WPP for particular windows driver.
  Lets for an example take a vdrvroot.sys. When we disassemble this driver we see at the beginning of DriverEntry couple function calls:</p>
  
  <pre><code>McGenEventRegister();
  WppLoadTracingSupport()
  WppInitKm()
  </code></pre>
  
  <p>which turns on tracing functionality.
  For ETW in McGenEventRegister I see the following provider registration:</p>
  
  <pre><code>result = EtwRegister(
     &amp;VDRVROOT_PROVIDER_ID,
     McGenControlCallbackV2,
     &amp;VDRVROOT_PROVIDER_ID_Context,
     &amp;Microsoft_Windows_VDRVROOTHandle);
  </code></pre>
  
  <p>where VDRVROOT_PROVIDER_ID equals 900448e4-b685-dd11-ad8b-0800200c9a66.
  I tried to log eventual logs doing:</p>
  
  <pre><code>tracelog.exe -start MyTrace -guid #900448e4-b685-dd11-ad8b-0800200c9a66
  (...) //some actions here
  tracelog.exe -start MyTrace
  </code></pre>
  
  <p>and view the log file via TraceView. Nothing caught but in this driver EtwWrite is called only in one place which I probably did not trigger with my actions.
  Question is whether I can turn on mentioned tracing mechanisms without reversing driver ;) ?</p>