eventsevents [e|d|c all|EventNumber (hex)]
allto apply your action to all active/disabled events.
1and then we see the list of all events.
IOCTL = IOCTL_DEBUGGER_MODIFY_EVENTS, you have to send it in the following structure.
Tagis the tag of the event that you want to modify, you should leave
KernelStatusas it will be filled by the kernel and shows whether the request was successful or not.
TypeOfActionshows what type of action you want the kernel to perform (enable, disable, or clear). It can be one of the following values.
Tagwith the following constant.