private unsafe bool GetDataFromController(int etwSessionId, ManifestEtw.EVENT_FILTER_DESCRIPTOR* filterData, out ControllerCommand command, out byte[] data, out int dataStart) { data = null; dataStart = 0; if (filterData == null) { #if (!ES_BUILD_PCL && !PROJECTN) string regKey = @"\Microsoft\Windows\CurrentVersion\Winevt\Publishers\{" + m_providerId + "}"; if (System.Runtime.InteropServices.Marshal.SizeOf(typeof(IntPtr)) == 8) regKey = @"HKEY_LOCAL_MACHINE\Software" + @"\Wow6432Node" + regKey; else regKey = @"HKEY_LOCAL_MACHINE\Software" + regKey; string valueName = "ControllerData_Session_" + etwSessionId.ToString(CultureInfo.InvariantCulture); // we need to assert this permission for partial trust scenarios (new RegistryPermission(RegistryPermissionAccess.Read, regKey)).Assert(); data = Microsoft.Win32.Registry.GetValue(regKey, valueName, null) as byte[]; if (data != null) { // We only used the persisted data from the registry for updates. command = ControllerCommand.Update; return true; } #endif } else { if (filterData->Ptr != 0 && 0 < filterData->Size && filterData->Size <= 1024) { data = new byte[filterData->Size]; Marshal.Copy((IntPtr)filterData->Ptr, data, 0, data.Length); } command = (ControllerCommand)filterData->Type; return true; } command = ControllerCommand.Update; return false; }
internal unsafe int SetInformation( ManifestEtw.EVENT_INFO_CLASS eventInfoClass, IntPtr data, uint dataSize) { int status = ManifestEtw.ERROR_NOT_SUPPORTED; if (!m_setInformationMissing) { try { ManifestEtw.EventSetInformation( m_regHandle, eventInfoClass, data, dataSize); } catch (TypeLoadException) { m_setInformationMissing = true; } } return status; }
unsafe void EtwEnableCallBack( ref System.Guid sourceId, int controlCode, byte setLevel, ulong anyKeyword, ulong allKeyword, ManifestEtw.EVENT_FILTER_DESCRIPTOR* filterData, IntPtr callbackContext )
private unsafe uint EventRegister(ref Guid providerId, ManifestEtw.EtwEnableCallback enableCallback) { m_providerId = providerId; m_etwCallback = enableCallback; return ManifestEtw.EventRegister(ref providerId, enableCallback, #if PROJECTN IntPtr.Zero, out m_regHandle); #else null, ref m_regHandle); #endif }