private unsafe bool GetDataFromController(int etwSessionId, UnsafeNativeMethods.ManifestEtw.EVENT_FILTER_DESCRIPTOR *filterData, out ControllerCommand command, out byte[] data, out int dataStart) { data = (byte[])null; dataStart = 0; if ((IntPtr)filterData == IntPtr.Zero) { string str1 = "\\Microsoft\\Windows\\CurrentVersion\\Winevt\\Publishers\\{" + (object)this.m_providerId + "}"; string str2 = Marshal.SizeOf(typeof(IntPtr)) != 8 ? "HKEY_LOCAL_MACHINE\\Software" + str1 : "HKEY_LOCAL_MACHINE\\Software\\Wow6432Node" + str1; string valueName = "ControllerData_Session_" + etwSessionId.ToString((IFormatProvider)CultureInfo.InvariantCulture); new RegistryPermission(RegistryPermissionAccess.Read, str2).Assert(); data = Registry.GetValue(str2, valueName, (object)null) as byte[]; if (data != null) { command = ControllerCommand.Update; return(true); } command = ControllerCommand.Update; return(false); } if (filterData->Ptr != 0L && 0 < filterData->Size && filterData->Size <= 1024) { data = new byte[filterData->Size]; Marshal.Copy((IntPtr)filterData->Ptr, data, 0, data.Length); } command = (ControllerCommand)filterData->Type; return(true); }
private unsafe bool GetDataFromController(int etwSessionId, UnsafeNativeMethods.ManifestEtw.EVENT_FILTER_DESCRIPTOR *filterData, out ControllerCommand command, out byte[] data, out int dataStart) { data = null; dataStart = 0; if (filterData == null) { string regKey = @"\Microsoft\Windows\CurrentVersion\Winevt\Publishers\{" + m_providerId + "}"; if (System.Runtime.InteropServices.Marshal.SizeOf(typeof(IntPtr)) == 8) { regKey = @"HKEY_LOCAL_MACHINE\Software" + @"\Wow6432Node" + regKey; } else { regKey = @"HKEY_LOCAL_MACHINE\Software" + regKey; } string valueName = "ControllerData_Session_" + etwSessionId.ToString(CultureInfo.InvariantCulture); // we need to assert this permission for partial trust scenarios new RegistryPermission(RegistryPermissionAccess.Read, regKey).Assert(); data = Microsoft.Win32.Registry.GetValue(regKey, valueName, null) as byte[]; if (data != null) { // We only used the persisted data from the registry for updates. command = ControllerCommand.Update; return(true); } } else { if (filterData->Ptr != 0 && 0 < filterData->Size && filterData->Size <= 1024) { data = new byte[filterData->Size]; Marshal.Copy((IntPtr)filterData->Ptr, data, 0, data.Length); } command = (ControllerCommand)filterData->Type; return(true); } command = ControllerCommand.Update; return(false); }
unsafe void EtwEnableCallBack( [In] ref System.Guid sourceId, [In] int controlCode, [In] byte setLevel, [In] long anyKeyword, [In] long allKeyword, [In] UnsafeNativeMethods.ManifestEtw.EVENT_FILTER_DESCRIPTOR *filterData, [In] void *callbackContext ) { ControllerCommand command = ControllerCommand.Update; IDictionary <string, string> args = null; byte[] data; int keyIndex; bool skipFinalOnControllerCommand = false; EventSource.OutputDebugString(string.Format("EtwEnableCallBack(ctrl {0}, lvl {1}, any {2:x}, all {3:x})", controlCode, setLevel, anyKeyword, allKeyword)); if (controlCode == UnsafeNativeMethods.ManifestEtw.EVENT_CONTROL_CODE_ENABLE_PROVIDER) { m_enabled = true; m_level = setLevel; m_anyKeywordMask = anyKeyword; m_allKeywordMask = allKeyword; List <Tuple <SessionInfo, bool> > sessionsChanged = GetSessions(); foreach (var session in sessionsChanged) { int sessionChanged = session.Item1.sessionIdBit; int etwSessionId = session.Item1.etwSessionId; bool bEnabling = session.Item2; EventSource.OutputDebugString(string.Format(CultureInfo.InvariantCulture, "EtwEnableCallBack: session changed {0}:{1}:{2}", sessionChanged, etwSessionId, bEnabling)); skipFinalOnControllerCommand = true; args = null; // reinitialize args for every session... // if we get more than one session changed we have no way // of knowing which one "filterData" belongs to if (sessionsChanged.Count > 1) { filterData = null; } // read filter data only when a session is being *added* if (bEnabling && GetDataFromController(etwSessionId, filterData, out command, out data, out keyIndex)) { args = new Dictionary <string, string>(4); while (keyIndex < data.Length) { int keyEnd = FindNull(data, keyIndex); int valueIdx = keyEnd + 1; int valueEnd = FindNull(data, valueIdx); if (valueEnd < data.Length) { string key = System.Text.Encoding.UTF8.GetString(data, keyIndex, keyEnd - keyIndex); string value = System.Text.Encoding.UTF8.GetString(data, valueIdx, valueEnd - valueIdx); args[key] = value; } keyIndex = valueEnd + 1; } } // execute OnControllerCommand once for every session that has changed. try { OnControllerCommand(command, args, (bEnabling ? sessionChanged : -sessionChanged), etwSessionId); } catch (Exception) { // We want to ignore any failures that happen as a result of turning on this provider as to // not crash the app. } } } else if (controlCode == UnsafeNativeMethods.ManifestEtw.EVENT_CONTROL_CODE_DISABLE_PROVIDER) { m_enabled = false; m_level = 0; m_anyKeywordMask = 0; m_allKeywordMask = 0; m_liveSessions = null; } else if (controlCode == UnsafeNativeMethods.ManifestEtw.EVENT_CONTROL_CODE_CAPTURE_STATE) { command = ControllerCommand.SendManifest; } else { return; // per spec you ignore commands you don't recognise. } try { if (!skipFinalOnControllerCommand) { OnControllerCommand(command, args, 0, 0); } } catch (Exception) { // We want to ignore any failures that happen as a result of turning on this provider as to // not crash the app. } }
private unsafe void EtwEnableCallBack([In] ref Guid sourceId, [In] int controlCode, [In] byte setLevel, [In] long anyKeyword, [In] long allKeyword, [In] UnsafeNativeMethods.ManifestEtw.EVENT_FILTER_DESCRIPTOR *filterData, [In] void *callbackContext) { try { ControllerCommand command = ControllerCommand.Update; IDictionary <string, string> arguments = (IDictionary <string, string>)null; bool flag1 = false; if (controlCode == 1) { this.m_enabled = true; this.m_level = setLevel; this.m_anyKeywordMask = anyKeyword; this.m_allKeywordMask = allKeyword; List <Tuple <EventProvider.SessionInfo, bool> > sessions = this.GetSessions(); foreach (Tuple <EventProvider.SessionInfo, bool> tuple in sessions) { int num1 = tuple.Item1.sessionIdBit; int etwSessionId = tuple.Item1.etwSessionId; bool flag2 = tuple.Item2; flag1 = true; arguments = (IDictionary <string, string>)null; if (sessions.Count > 1) { filterData = (UnsafeNativeMethods.ManifestEtw.EVENT_FILTER_DESCRIPTOR *)null; } byte[] data; int dataStart; if (flag2 && this.GetDataFromController(etwSessionId, filterData, out command, out data, out dataStart)) { arguments = (IDictionary <string, string>) new Dictionary <string, string>(4); int null1; for (; dataStart < data.Length; dataStart = null1 + 1) { int null2 = EventProvider.FindNull(data, dataStart); int num2 = null2 + 1; null1 = EventProvider.FindNull(data, num2); if (null1 < data.Length) { string string1 = Encoding.UTF8.GetString(data, dataStart, null2 - dataStart); string string2 = Encoding.UTF8.GetString(data, num2, null1 - num2); arguments[string1] = string2; } } } this.OnControllerCommand(command, arguments, flag2 ? num1 : -num1, etwSessionId); } } else if (controlCode == 0) { this.m_enabled = false; this.m_level = (byte)0; this.m_anyKeywordMask = 0L; this.m_allKeywordMask = 0L; this.m_liveSessions = (List <EventProvider.SessionInfo>)null; } else { if (controlCode != 2) { return; } command = ControllerCommand.SendManifest; } if (flag1) { return; } this.OnControllerCommand(command, arguments, 0, 0); } catch (Exception ex) { } }
private unsafe void EtwEnableCallBack([In] ref Guid sourceId, [In] int controlCode, [In] byte setLevel, [In] long anyKeyword, [In] long allKeyword, [In] UnsafeNativeMethods.ManifestEtw.EVENT_FILTER_DESCRIPTOR *filterData, [In] void *callbackContext) { try { ControllerCommand command = ControllerCommand.Update; IDictionary <string, string> dictionary = null; bool flag = false; if (controlCode == 1) { this.m_enabled = true; this.m_level = setLevel; this.m_anyKeywordMask = anyKeyword; this.m_allKeywordMask = allKeyword; List <Tuple <EventProvider.SessionInfo, bool> > sessions = this.GetSessions(); using (List <Tuple <EventProvider.SessionInfo, bool> > .Enumerator enumerator = sessions.GetEnumerator()) { while (enumerator.MoveNext()) { Tuple <EventProvider.SessionInfo, bool> tuple = enumerator.Current; int sessionIdBit = tuple.Item1.sessionIdBit; int etwSessionId = tuple.Item1.etwSessionId; bool item = tuple.Item2; flag = true; dictionary = null; if (sessions.Count > 1) { filterData = null; } byte[] array; int i; if (item && this.GetDataFromController(etwSessionId, filterData, out command, out array, out i)) { dictionary = new Dictionary <string, string>(4); while (i < array.Length) { int num = EventProvider.FindNull(array, i); int num2 = num + 1; int num3 = EventProvider.FindNull(array, num2); if (num3 < array.Length) { string @string = Encoding.UTF8.GetString(array, i, num - i); string string2 = Encoding.UTF8.GetString(array, num2, num3 - num2); dictionary[@string] = string2; } i = num3 + 1; } } this.OnControllerCommand(command, dictionary, item ? sessionIdBit : (-sessionIdBit), etwSessionId); } goto IL_162; } } if (controlCode == 0) { this.m_enabled = false; this.m_level = 0; this.m_anyKeywordMask = 0L; this.m_allKeywordMask = 0L; this.m_liveSessions = null; } else { if (controlCode != 2) { return; } command = ControllerCommand.SendManifest; } IL_162: if (!flag) { this.OnControllerCommand(command, dictionary, 0, 0); } } catch (Exception) { } }