detection.wiki

Intel-iaLPSS-I2C

EventTitleChannelSampleRule
1001Created WDFDEVICE FxDevice.AnalyticNN
1002WDFDEVICE FxDevice mapped to vAddr VAddr (MMIO Addr PAddr).AnalyticNN
1003FailReason.SystemNN
1004Resource for FxDevice Released.AnalyticNN
1005D0 Entrty Start for WDFDEVICE FxDevice (MMIO PAddr).AnalyticNN
1006D0 Entry End for WDFDEVICE FxDevice (MMIO PAddr).AnalyticNN
1007D0 Exit Start for WDFDEVICE FxDevice (MMIO PAddr).AnalyticNN
1008D0 Exit End for WDFDEVICE FxDevice (MMIO PAddr).AnalyticNN
1009SpbRequest pRequest (Type IOCTL) received.AnalyticNN
1010SpbRequest Request Completed Status Status .AnalyticNN
1011ISR For WDFDEVICE WDFDEVICE (MMIO MMIO) Begin.AnalyticNN
1012ISR For WDFDEVICE WDFDEVICE (MMIO MMIO) End Interrupt Status Stat.AnalyticNN
1013DPC for WDFDEVICE WDFDEVICE (MMIO MMIO) Start.AnalyticNN
1014DPC for WDFDEVICE WDFDEVICE (MMIO MMIO) End.AnalyticNN
1015DriverEntry StartAnalyticNN
1016DriverEntry EndAnalyticNN
1017DeviceAdd StartAnalyticNN
1018DeviceAdd EndAnalyticNN
1019OnPrepareHardware StartAnalyticNN
1020OnPrepareHardware EndAnalyticNN
1021DMA Configurations Status for WDFDEVICE WDFDevice (MMIO MMIO).AnalyticNN
1022Monitor State MonitorState.AnalyticNN
1023Cancel SpbRequest pRequest received.AnalyticNN
1024Cancel StartAnalyticNN
1025Cancel EndAnalyticNN
1026DMA Txn Start.AnalyticNN
1027DMA Txn End.AnalyticNN
1029Cancel Timer Expired WDFDEVICE WDFDEVICE (MMIO MMIO).AnalyticNN
1030DriverUnloadedAnalyticNN

Event ID 1001: Created WDFDEVICE FxDevice.

#
Channel
Analytic
Task
EnumerationofSPBCxdriver

Message #

Created WDFDEVICE %1

Fields #

NameDescription
FxDevice Pointer

Event ID 1002: WDFDEVICE FxDevice mapped to vAddr VAddr (MMIO Addr PAddr).

#
Channel
Analytic
Task
EnumerationofSPBCxdriver

Message #

WDFDEVICE %1 mapped to vAddr %2 (MMIO Addr %3)

Fields #

NameDescription
FxDevice Pointer
VAddr Pointer
PAddr HexInt64

Event ID 1003: FailReason.

#
Channel
System
Task
EnumerationofSPBCxdriver

Description

FailReason. WDFDEVICE WDFDEVICE.

Message #

%1. WDFDEVICE %3

Fields #

NameDescription
FailReason UnicodeString
Status UInt32NTSTATUS reference
WDFDEVICE Pointer

Event ID 1004: Resource for FxDevice Released.

#
Channel
Analytic
Task
EnumerationofSPBCxdriver

Message #

Resource for %1 Released

Fields #

NameDescription
FxDevice Pointer
VAddr Pointer
PAddr HexInt64

Event ID 1005: D0 Entrty Start for WDFDEVICE FxDevice (MMIO PAddr).

#
Channel
Analytic
Task
DevicePowerFlow
Opcode
Start

Message #

D0 Entrty Start for WDFDEVICE %1 (MMIO %3)

Fields #

NameDescription
FxDevice Pointer
VAddr Pointer
PAddr HexInt64

Event ID 1006: D0 Entry End for WDFDEVICE FxDevice (MMIO PAddr).

#
Channel
Analytic
Task
DevicePowerFlow
Opcode
Stop

Message #

D0 Entry End for WDFDEVICE %1 (MMIO %3)

Fields #

NameDescription
FxDevice Pointer
VAddr Pointer
PAddr HexInt64

Event ID 1007: D0 Exit Start for WDFDEVICE FxDevice (MMIO PAddr).

#
Channel
Analytic
Task
DevicePowerFlow
Opcode
Start

Message #

D0 Exit Start for WDFDEVICE %1 (MMIO %3)

Fields #

NameDescription
FxDevice Pointer
VAddr Pointer
PAddr HexInt64

Event ID 1008: D0 Exit End for WDFDEVICE FxDevice (MMIO PAddr).

#
Channel
Analytic
Task
DevicePowerFlow
Opcode
Stop

Message #

D0 Exit End for WDFDEVICE %1 (MMIO %3)

Fields #

NameDescription
FxDevice Pointer
VAddr Pointer
PAddr HexInt64

Event ID 1009: SpbRequest pRequest (Type IOCTL) received.

#
Channel
Analytic
Task
IOFlowsThroughSPBCxdriver
Opcode
Start

Description

SpbRequest pRequest (Type IOCTL) received. WDFDEVICE pDevice (MMIO MMIO). Target pTarget (Address Target I2C Address).

Message #

SpbRequest %1 (Type %4) received. WDFDEVICE %2 (MMIO %6). Target %3 (Address %5)

Fields #

NameDescription
pRequest Pointer
pDevice Pointer
pTarget Pointer
IOCTL UnicodeString
TargetI2CAddress HexInt64
MMIO HexInt64

Event ID 1010: SpbRequest Request Completed Status Status .

#
Channel
Analytic
Task
IOFlowsThroughSPBCxdriver
Opcode
Stop

Message #

SpbRequest %1 Completed Status %2

Fields #

NameDescription
Request Pointer
Status UInt32NTSTATUS reference

Event ID 1011: ISR For WDFDEVICE WDFDEVICE (MMIO MMIO) Begin.

#
Channel
Analytic
Task
TasktoTrackInterruptRoutine
Opcode
Start

Message #

ISR For WDFDEVICE %1 (MMIO %2) Begin

Fields #

NameDescription
WDFDEVICE Pointer
MMIO HexInt64

Event ID 1012: ISR For WDFDEVICE WDFDEVICE (MMIO MMIO) End Interrupt Status Stat.

#
Channel
Analytic
Task
TasktoTrackInterruptRoutine
Opcode
Stop

Message #

ISR For WDFDEVICE %1 (MMIO %2) End Interrupt Status %3

Fields #

NameDescription
WDFDEVICE Pointer
MMIO HexInt64
Stat HexInt64

Event ID 1013: DPC for WDFDEVICE WDFDEVICE (MMIO MMIO) Start.

#
Channel
Analytic
Task
TasktotrackDPC
Opcode
Start

Message #

DPC for WDFDEVICE %1 (MMIO %2) Start

Fields #

NameDescription
WDFDEVICE Pointer
MMIO HexInt64

Event ID 1014: DPC for WDFDEVICE WDFDEVICE (MMIO MMIO) End.

#
Channel
Analytic
Task
TasktotrackDPC
Opcode
Stop

Message #

DPC for WDFDEVICE %1 (MMIO %2) End

Fields #

NameDescription
WDFDEVICE Pointer
MMIO HexInt64

Event ID 1015: DriverEntry Start

#
Channel
Analytic
Opcode
Start

Event ID 1016: DriverEntry End

#
Channel
Analytic
Opcode
Stop

Event ID 1017: DeviceAdd Start

#
Channel
Analytic
Task
EnumerationofSPBCxdriver
Opcode
Start

Event ID 1018: DeviceAdd End

#
Channel
Analytic
Task
EnumerationofSPBCxdriver
Opcode
Stop

Event ID 1019: OnPrepareHardware Start

#
Channel
Analytic
Task
EnumerationofSPBCxdriver
Opcode
Start

Event ID 1020: OnPrepareHardware End

#
Channel
Analytic
Task
EnumerationofSPBCxdriver
Opcode
Stop

Event ID 1021: DMA Configurations Status for WDFDEVICE WDFDevice (MMIO MMIO).

#
Channel
Analytic
Task
EnumerationofSPBCxdriver

Message #

DMA Configurations %5 for WDFDEVICE %3 (MMIO %4)

Fields #

NameDescription
TxDmaEnabler Pointer
RxDmaEnabler Pointer
WDFDevice Pointer
MMIO HexInt64
Status UnicodeStringNTSTATUS reference

Event ID 1022: Monitor State MonitorState.

#
Channel
Analytic
Task
DevicePowerFlow

Description

Monitor State MonitorState. Idle Timeout IdleTimeout. WDFDEVICE WDFDevice (MMIO MMIO).

Message #

Monitor State %1. Idle Timeout %2. WDFDEVICE %3 (MMIO %4)

Fields #

NameDescription
MonitorState UnicodeString
IdleTimeout UInt64
WDFDevice Pointer
MMIO HexInt64

Event ID 1023: Cancel SpbRequest pRequest received.

#
Channel
Analytic
Task
IOFlowsThroughSPBCxdriver

Description

Cancel SpbRequest pRequest received. WDFDEVICE pDevice (MMIO MMIO). Target pTarget pTarget (Address Target I2C Address).

Message #

Cancel SpbRequest %1 received. WDFDEVICE %2 (MMIO %6). Target %3 %3 (Address %5)

Fields #

NameDescription
pRequest Pointer
pDevice Pointer
pTarget Pointer
IOCTL UnicodeString
TargetI2CAddress HexInt64
MMIO HexInt64

Event ID 1024: Cancel Start

#
Channel
Analytic
Task
IOFlowsThroughSPBCxdriver
Opcode
Start

Event ID 1025: Cancel End

#
Channel
Analytic
Task
IOFlowsThroughSPBCxdriver
Opcode
Stop

Event ID 1026: DMA Txn Start.

#
Channel
Analytic
Task
TasktotrackDMATransactions
Opcode
Start

Description

DMA Txn Start. Direction Direction # of MDL NumMdls #bytes NumBytes WDFDEVICE WDFDEVICE (MMIO MMIO).

Message #

DMA Txn Start. Direction %1 # of MDL %2 #bytes %3 WDFDEVICE %4 (MMIO %5)

Fields #

NameDescription
Direction UnicodeString
Known values
%%14592
Inbound
%%14593
Outbound
%%14594
Forward
%%14595
Bidirectional
NumMdls UInt64
NumBytes UInt64
WDFDEVICE Pointer
MMIO HexInt64

Event ID 1027: DMA Txn End.

#
Channel
Analytic
Task
TasktotrackDMATransactions
Opcode
Stop

Description

DMA Txn End. Direction Direction DmaStatus DMA Status #bytes NumBytes WDFDEVICE WDFDEVICE (MMIO MMIO).

Message #

DMA Txn End. Direction %1 DmaStatus %4 #bytes %5 WDFDEVICE %2 (MMIO %3)

Fields #

NameDescription
Direction UnicodeString
Known values
%%14592
Inbound
%%14593
Outbound
%%14594
Forward
%%14595
Bidirectional
WDFDEVICE Pointer
MMIO HexInt64
DMAStatus UInt32
NumBytes UInt64

Event ID 1029: Cancel Timer Expired WDFDEVICE WDFDEVICE (MMIO MMIO).

#
Channel
Analytic
Task
IOFlowsThroughSPBCxdriver

Message #

Cancel Timer Expired WDFDEVICE %1 (MMIO %2)

Fields #

NameDescription
WDFDEVICE Pointer
MMIO HexInt64

Event ID 1030: DriverUnloaded

#
Channel
Analytic
Opcode
Info

Provenance

ETW provider GUID d4aeac44-ad44-456e-9c90-33f8cdced6af

Defined in iaLPSSi_I2C.sys, the binary that emits these events.

  • WS2022-20348.4893, schema read from the registered manifest, binary version 1.1.253.0, captured 2026-06-02 — Manifest XML pack, 1.9 MB
  • Win11-26200.6584, schema read from the registered manifest, binary version 1.1.253.0, captured 2026-06-02 — Manifest XML pack, 2.0 MB