Intel-iaLPSS-GPIO
| Event | Title | Channel | Sample | Rule |
|---|---|---|---|---|
| 1001 | Created WDFDEVICE WDFDEVICE. | Analytic | N | N |
| 1002 | WDFDEVICE FxDevice IO Addr IOAddr. | Analytic | N | N |
| 1003 | FailReason. | System | N | N |
| 1004 | Resource for WDFDEVICE Released. | Analytic | N | N |
| 1005 | StartController Start | Analytic | N | N |
| 1006 | StartController End | Analytic | N | N |
| 1007 | StopController Start | Analytic | N | N |
| 1008 | StopController End | Analytic | N | N |
| 1015 | DriverEntry Start | Analytic | N | N |
| 1016 | DriverEntry End | Analytic | N | N |
| 1017 | DeviceAdd Start | Analytic | N | N |
| 1018 | DeviceAdd End | Analytic | N | N |
| 1019 | OnPrepareHardware Start | Analytic | N | N |
| 1020 | OnPrepareHardware End | Analytic | N | N |
| 1030 | DriverUnloaded | Analytic | N | N |
| 1040 | Query Stop WDFDEVICE. | Analytic | N | N |
| 1041 | Surprise Removal WDFDEVICE. | Analytic | N | N |
| 1042 | QueryBasicInformation | Analytic | N | N |
| 1045 | ConnectIO BankId = BankId, PinCount = PinCount, ConnectMode = ConnectMode, … | Analytic | N | N |
| 1046 | DisconnectIO BankId = BankId, PinCount = PinCount, DisconnectMode = … | Analytic | N | N |
| 1048 | ReadIoPins BankID:ReadIoPins_BankID PinValues:PinValues. | Analytic | N | N |
| 1049 | WriteIoPins BankID:WriteIoPins_BankID SetValue:SetValue ClearValue:ClearValue. | Analytic | N | N |
Event ID 1002: WDFDEVICE FxDevice IO Addr IOAddr.
#Event ID 1003: FailReason.
#Description
FailReason. WDFDEVICE WDFDEVICE.
Message #
Fields #
| Name | Description |
|---|---|
FailReason UnicodeString | |
Status UInt32 | NTSTATUS reference |
WDFDEVICE Pointer |
Event ID 1005: StartController Start
#Event ID 1006: StartController End
#Event ID 1007: StopController Start
#Event ID 1008: StopController End
#Event ID 1015: DriverEntry Start
#Event ID 1016: DriverEntry End
#Event ID 1017: DeviceAdd Start
#Event ID 1018: DeviceAdd End
#Event ID 1019: OnPrepareHardware Start
#Event ID 1020: OnPrepareHardware End
#Event ID 1030: DriverUnloaded
#Event ID 1042: QueryBasicInformation
#Event ID 1045: ConnectIO BankId = BankId, PinCount = PinCount, ConnectMode = ConnectMode, PullConfiguration = PullConfig.
#Event ID 1046: DisconnectIO BankId = BankId, PinCount = PinCount, DisconnectMode = DisconnectMode.
#Event ID 1048: ReadIoPins BankID:ReadIoPins_BankID PinValues:PinValues.
#Provenance
ETW provider GUID d386cc7a-620a-41c1-abf5-55018c6c699a
Defined in iaLPSSi_GPIO.sys, the binary that emits these events.
- WS2022-20348.4893, schema read from the registered manifest, binary version 1.1.250.0, captured 2026-06-02 — Manifest XML pack, 1.9 MB
- Win11-26200.6584, schema read from the registered manifest, binary version 1.1.250.0, captured 2026-06-02 — Manifest XML pack, 2.0 MB