public TraceEventInfoWrapper(LegacyJsonConverter.EventRecord eventRecord)
{
int BufferSize = 0;
int eventInformation1 = TdhGetEventInformation(ref eventRecord, 0U, IntPtr.Zero, IntPtr.Zero, ref BufferSize);
if (eventInformation1 == 1168)
{
hasProperties = false;
}
else
{
hasProperties = true;
if (eventInformation1 != 122)
{
throw new Win32Exception(eventInformation1);
}
address = Marshal.AllocHGlobal(BufferSize);
int eventInformation2 = TdhGetEventInformation(ref eventRecord, 0U, IntPtr.Zero, address, ref BufferSize);
if (eventInformation2 != 0)
{
throw new Win32Exception(eventInformation2);
}
traceEventInfo = (TraceEventInfo)Marshal.PtrToStructure(address, typeof(TraceEventInfo));
int num1 = Marshal.SizeOf((object)traceEventInfo);
if (BufferSize != num1)
{
int num2 = Marshal.SizeOf(typeof(EventPropertyInfo));
int length = (BufferSize - num1) / num2;
eventPropertyInfoArray = new EventPropertyInfo[length];
long num3 = address.ToInt64() + num1;
for (int index = 0; index < length; ++index)
{
EventPropertyInfo structure = (EventPropertyInfo)Marshal.PtrToStructure(new IntPtr(num3 + index * num2), typeof(EventPropertyInfo));
eventPropertyInfoArray[index] = structure;
}
}
if (traceEventInfo.LevelNameOffset > 0U)
{
LevelName = Marshal.PtrToStringUni(new IntPtr(address.ToInt64() + traceEventInfo.LevelNameOffset));
}
if (traceEventInfo.ChannelNameOffset > 0U)
{
ChannelName = Marshal.PtrToStringUni(new IntPtr(address.ToInt64() + traceEventInfo.ChannelNameOffset));
}
if (traceEventInfo.TaskNameOffset > 0U)
{
TaskName = Marshal.PtrToStringUni(new IntPtr(address.ToInt64() + traceEventInfo.TaskNameOffset));
}
if (traceEventInfo.EventMessageOffset > 0U)
{
EventMessageName = Marshal.PtrToStringUni(new IntPtr(address.ToInt64() + traceEventInfo.EventMessageOffset));
}
if (traceEventInfo.OpcodeNameOffset <= 0U)
{
return;
}
EventName = Marshal.PtrToStringUni(new IntPtr(address.ToInt64() + traceEventInfo.OpcodeNameOffset));
}
}
public Dictionary <string, object> GetProperties(LegacyJsonConverter.EventRecord eventRecord)
{
Dictionary <string, object> dictionary = new Dictionary <string, object>(traceEventInfo.TopLevelPropertyCount);
if (hasProperties)
{
int num1 = 0;
IntPtr num2;
for (int index = 0; index < traceEventInfo.TopLevelPropertyCount; ++index)
{
EventPropertyInfo eventPropertyInfo = eventPropertyInfoArray[index];
string stringUni = Marshal.PtrToStringUni(new IntPtr(address.ToInt64() + eventPropertyInfo.NameOffset));
num2 = new IntPtr(eventRecord.UserData.ToInt64() + num1);
int length;
object obj = null;
length = eventPropertyInfo.LengthPropertyIndex;
switch (eventPropertyInfo.NonStructTypeValue.InType)
{
case EventPropertyInfo.TdhInType.UnicodeString:
string stringUni2 = Marshal.PtrToStringUni(num2);
if (stringUni != null)
{
length = (stringUni2.Length + 1) * 2;
obj = stringUni2;
}
break;
case EventPropertyInfo.TdhInType.Int32:
obj = Marshal.ReadInt32(num2);
break;
case EventPropertyInfo.TdhInType.UInt32:
obj = (uint)Marshal.ReadInt32(num2);
break;
case EventPropertyInfo.TdhInType.Int64:
obj = Marshal.ReadInt64(num2);
break;
case EventPropertyInfo.TdhInType.UInt64:
obj = (ulong)Marshal.ReadInt64(num2);
break;
case EventPropertyInfo.TdhInType.Pointer:
obj = Marshal.ReadIntPtr(num2);
break;
case EventPropertyInfo.TdhInType.FileTime:
obj = DateTime.FromFileTime(Marshal.ReadInt64(num2));
break;
case EventPropertyInfo.TdhInType.SystemTime:
obj = new DateTime(Marshal.ReadInt16(num2),
Marshal.ReadInt16(num2, 2), Marshal.ReadInt16(num2, 6),
Marshal.ReadInt16(num2, 8), Marshal.ReadInt16(num2, 10),
Marshal.ReadInt16(num2, 12), Marshal.ReadInt16(num2, 14));
break;
}
num1 += length;
if (stringUni != null)
{
dictionary.Add(stringUni, obj);
}
}
if (num1 < eventRecord.UserDataLength)
{
num2 = new IntPtr(eventRecord.UserData.ToInt64() + num1);
int length = eventRecord.UserDataLength - num1;
byte[] numArray = new byte[length];
for (int ofs = 0; ofs < length; ++ofs)
{
numArray[ofs] = Marshal.ReadByte(num2, ofs);
}
dictionary.Add("__ExtraPayload", numArray);
}
}
else
{
string stringUni = Marshal.PtrToStringUni(eventRecord.UserData);
dictionary.Add("EventData", stringUni);
}
return(dictionary);
}