Beispiel #1
0
        internal PropertyBag GetProperties(EventRecord eventRecord)
        {
            // We only support top level properties and simple types
            PropertyBag properties = new PropertyBag(_traceEventInfo.TopLevelPropertyCount);

            if (this._hasProperties)
            {
                int offset = 0;

                for (int i = 0; i < _traceEventInfo.TopLevelPropertyCount; i++)
                {
                    EventPropertyInfo info = _eventPropertyInfoArray[i];

                    // Read the current property name
                    string propertyName = Marshal.PtrToStringUni(new IntPtr(_address.ToInt64() + info.NameOffset));

                    object value;
                    string mapName;
                    int    length;
                    IntPtr dataPtr = new IntPtr(eventRecord.UserData.ToInt64() + offset);

                    value = ReadPropertyValue(info, dataPtr, out mapName, out length);

                    // If we have a map name, return both map name and map value as a pair.
                    if (!string.IsNullOrEmpty(mapName))
                    {
                        value = new KeyValuePair <string, object>(mapName, value);
                    }

                    offset += length;
                    properties.Add(propertyName, value);
                }

                if (offset < eventRecord.UserDataLength)
                {
                    //
                    // There is some extra information not mapped.
                    //
                    IntPtr dataPtr = new IntPtr(eventRecord.UserData.ToInt64() + offset);
                    int    length  = eventRecord.UserDataLength - offset;
                    byte[] array   = new byte[length];

                    for (int index = 0; index < length; index++)
                    {
                        array[index] = Marshal.ReadByte(dataPtr, index);
                    }

                    properties.Add("__ExtraPayload", array);
                }
            }
            else
            {
                // NOTE: It is just a guess that this is an Unicode string
                string str = Marshal.PtrToStringUni(eventRecord.UserData);

                properties.Add("EventData", str);
            }

            return(properties);
        }
Beispiel #2
0
        private void Initialize(EventRecord eventRecord)
        {
            int        size                = 0;
            const uint BufferTooSmall      = 122;
            const uint ErrorlementNotFound = 1168;

            int error = NativeMethods.TdhGetEventInformation(ref eventRecord, 0, IntPtr.Zero, IntPtr.Zero, ref size);

            if (error == ErrorlementNotFound)
            {
                // Nothing else to do here.
                this._hasProperties = false;
                return;
            }
            this._hasProperties = true;

            if (error != BufferTooSmall)
            {
                throw new Win32Exception(error);
            }

            // Get the event information (schema)
            this._address = Marshal.AllocHGlobal(size);
            error         = NativeMethods.TdhGetEventInformation(ref eventRecord, 0, IntPtr.Zero, _address, ref size);
            if (error != 0)
            {
                throw new System.ComponentModel.Win32Exception(error);
            }

            // Marshal the first part of the trace event information.
            _traceEventInfo = (TraceEventInfo)Marshal.PtrToStructure(this._address, typeof(TraceEventInfo));

            // Marshal the second part of the trace event information, the array of property info.
            int actualSize = Marshal.SizeOf(this._traceEventInfo);

            if (size != actualSize)
            {
                int structSize = Marshal.SizeOf(typeof(EventPropertyInfo));
                int itemsLeft  = (size - actualSize) / structSize;

                this._eventPropertyInfoArray = new EventPropertyInfo[itemsLeft];
                long baseAddress = _address.ToInt64() + actualSize;
                for (int i = 0; i < itemsLeft; i++)
                {
                    IntPtr            structPtr = new IntPtr(baseAddress + (i * structSize));
                    EventPropertyInfo info      = (EventPropertyInfo)Marshal.PtrToStructure(structPtr, typeof(EventPropertyInfo));
                    this._eventPropertyInfoArray[i] = info;
                }
            }

            // Get the opcode name
            if (_traceEventInfo.OpcodeNameOffset > 0)
            {
                this.EventName = Marshal.PtrToStringUni(new IntPtr(_address.ToInt64() + _traceEventInfo.OpcodeNameOffset));
            }
        }
Beispiel #3
0
        private object ReadPropertyValue(EventPropertyInfo info, IntPtr dataPtr, out string mapName, out int length)
        {
            length = info.LengthPropertyIndex;

            if (info.NonStructTypeValue.MapNameOffset != 0)
            {
                mapName = Marshal.PtrToStringUni(new IntPtr(this._address.ToInt64() + info.NonStructTypeValue.MapNameOffset));
            }
            else
            {
                mapName = string.Empty;
            }

            switch (info.NonStructTypeValue.InType)
            {
            case TdhInType.Null:
                break;

            case TdhInType.UnicodeString: {
                string str = Marshal.PtrToStringUni(dataPtr);
                length = (str.Length + 1) * sizeof(char);
                return(str);
            }

            case TdhInType.AnsiString: {
                string str = Marshal.PtrToStringAnsi(dataPtr);
                length = (str.Length + 1);
                return(str);
            }

            case TdhInType.Int8:
                return((sbyte)Marshal.ReadByte(dataPtr));

            case TdhInType.UInt8:
                return(Marshal.ReadByte(dataPtr));

            case TdhInType.Int16:
                return(Marshal.ReadInt16(dataPtr));

            case TdhInType.UInt16:
                return((uint)Marshal.ReadInt16(dataPtr));

            case TdhInType.Int32:
                return(Marshal.ReadInt32(dataPtr));

            case TdhInType.UInt32:
                return((uint)Marshal.ReadInt32(dataPtr));

            case TdhInType.Int64:
                return(Marshal.ReadInt64(dataPtr));

            case TdhInType.UInt64:
                return((ulong)Marshal.ReadInt64(dataPtr));

            case TdhInType.Float:
                break;

            case TdhInType.Double:
                break;

            case TdhInType.Boolean:
                return((bool)(Marshal.ReadInt32(dataPtr) != 0));

            case TdhInType.Binary:
                break;

            case TdhInType.Guid:
                return(new Guid(
                           Marshal.ReadInt32(dataPtr),
                           Marshal.ReadInt16(dataPtr, 4),
                           Marshal.ReadInt16(dataPtr, 6),
                           Marshal.ReadByte(dataPtr, 8),
                           Marshal.ReadByte(dataPtr, 9),
                           Marshal.ReadByte(dataPtr, 10),
                           Marshal.ReadByte(dataPtr, 11),
                           Marshal.ReadByte(dataPtr, 12),
                           Marshal.ReadByte(dataPtr, 13),
                           Marshal.ReadByte(dataPtr, 14),
                           Marshal.ReadByte(dataPtr, 15)
                           ));

            case TdhInType.Pointer:
                break;

            case TdhInType.FileTime:
                return(DateTime.FromFileTime(Marshal.ReadInt64(dataPtr)));

            case TdhInType.SystemTime:
                break;

            case TdhInType.SID:
                break;

            case TdhInType.HexInt32:
                break;

            case TdhInType.HexInt64:
                break;

            case TdhInType.CountedString:
                break;

            case TdhInType.CountedAnsiString:
                break;

            case TdhInType.ReversedCountedString:
                break;

            case TdhInType.ReversedCountedAnsiString:
                break;

            case TdhInType.NonNullTerminatedString:
                break;

            case TdhInType.NonNullTerminatedAnsiString:
                break;

            case TdhInType.UnicodeChar:
                break;

            case TdhInType.AnsiChar:
                break;

            case TdhInType.SizeT:
                break;

            case TdhInType.HexDump:
                break;

            case TdhInType.WbemSID:
                break;

            default:
                Debugger.Break();
                break;
            }

            throw new NotSupportedException();
        }
        private object ReadPropertyValue(EventPropertyInfo info, IntPtr dataPtr, out string mapName, out int length)
        {
            length = info.LengthPropertyIndex;

            if (info.NonStructTypeValue.MapNameOffset != 0) {
                mapName = Marshal.PtrToStringUni(new IntPtr(this._address.ToInt64() + info.NonStructTypeValue.MapNameOffset));
            }
            else {
                mapName = string.Empty;
            }

            switch (info.NonStructTypeValue.InType) {
                case TdhInType.Null:
                    break;
                case TdhInType.UnicodeString: {
                        string str = Marshal.PtrToStringUni(dataPtr);
                        length = (str.Length + 1) * sizeof(char);
                        return str;
                    }
                case TdhInType.AnsiString: {
                        string str = Marshal.PtrToStringAnsi(dataPtr);
                        length = (str.Length + 1);
                        return str;
                    }
                case TdhInType.Int8:
                    return (sbyte)Marshal.ReadByte(dataPtr);
                case TdhInType.UInt8:
                    return Marshal.ReadByte(dataPtr);
                case TdhInType.Int16:
                    return Marshal.ReadInt16(dataPtr);
                case TdhInType.UInt16:
                    return (uint)Marshal.ReadInt16(dataPtr);
                case TdhInType.Int32:
                    return Marshal.ReadInt32(dataPtr);
                case TdhInType.UInt32:
                    return (uint)Marshal.ReadInt32(dataPtr);
                case TdhInType.Int64:
                    return Marshal.ReadInt64(dataPtr);
                case TdhInType.UInt64:
                    return (ulong)Marshal.ReadInt64(dataPtr);
                case TdhInType.Float:
                    break;
                case TdhInType.Double:
                    break;
                case TdhInType.Boolean:
                    return (bool)(Marshal.ReadInt32(dataPtr) != 0);
                case TdhInType.Binary:
                    break;
                case TdhInType.Guid:
                    return new Guid(
                           Marshal.ReadInt32(dataPtr),
                           Marshal.ReadInt16(dataPtr, 4),
                           Marshal.ReadInt16(dataPtr, 6),
                           Marshal.ReadByte(dataPtr, 8),
                           Marshal.ReadByte(dataPtr, 9),
                           Marshal.ReadByte(dataPtr, 10),
                           Marshal.ReadByte(dataPtr, 11),
                           Marshal.ReadByte(dataPtr, 12),
                           Marshal.ReadByte(dataPtr, 13),
                           Marshal.ReadByte(dataPtr, 14),
                           Marshal.ReadByte(dataPtr, 15)
                           );
                case TdhInType.Pointer:
                    break;
                case TdhInType.FileTime:
                    return DateTime.FromFileTime(Marshal.ReadInt64(dataPtr));
                case TdhInType.SystemTime:
                    break;
                case TdhInType.SID:
                    break;
                case TdhInType.HexInt32:
                    break;
                case TdhInType.HexInt64:
                    break;
                case TdhInType.CountedString:
                    break;
                case TdhInType.CountedAnsiString:
                    break;
                case TdhInType.ReversedCountedString:
                    break;
                case TdhInType.ReversedCountedAnsiString:
                    break;
                case TdhInType.NonNullTerminatedString:
                    break;
                case TdhInType.NonNullTerminatedAnsiString:
                    break;
                case TdhInType.UnicodeChar:
                    break;
                case TdhInType.AnsiChar:
                    break;
                case TdhInType.SizeT:
                    break;
                case TdhInType.HexDump:
                    break;
                case TdhInType.WbemSID:
                    break;
                default:
                    Debugger.Break();
                    break;
            }

            throw new NotSupportedException();
        }