Ejemplo n.º 1
0
        public TraceEventInfoWrapper(LegacyJsonConverter.EventRecord eventRecord)
        {
            int BufferSize        = 0;
            int eventInformation1 = TdhGetEventInformation(ref eventRecord, 0U, IntPtr.Zero, IntPtr.Zero, ref BufferSize);

            if (eventInformation1 == 1168)
            {
                hasProperties = false;
            }
            else
            {
                hasProperties = true;
                if (eventInformation1 != 122)
                {
                    throw new Win32Exception(eventInformation1);
                }
                address = Marshal.AllocHGlobal(BufferSize);
                int eventInformation2 = TdhGetEventInformation(ref eventRecord, 0U, IntPtr.Zero, address, ref BufferSize);
                if (eventInformation2 != 0)
                {
                    throw new Win32Exception(eventInformation2);
                }
                traceEventInfo = (TraceEventInfo)Marshal.PtrToStructure(address, typeof(TraceEventInfo));
                int num1 = Marshal.SizeOf((object)traceEventInfo);
                if (BufferSize != num1)
                {
                    int num2   = Marshal.SizeOf(typeof(EventPropertyInfo));
                    int length = (BufferSize - num1) / num2;
                    eventPropertyInfoArray = new EventPropertyInfo[length];
                    long num3 = address.ToInt64() + num1;
                    for (int index = 0; index < length; ++index)
                    {
                        EventPropertyInfo structure = (EventPropertyInfo)Marshal.PtrToStructure(new IntPtr(num3 + index * num2), typeof(EventPropertyInfo));
                        eventPropertyInfoArray[index] = structure;
                    }
                }
                if (traceEventInfo.LevelNameOffset > 0U)
                {
                    LevelName = Marshal.PtrToStringUni(new IntPtr(address.ToInt64() + traceEventInfo.LevelNameOffset));
                }
                if (traceEventInfo.ChannelNameOffset > 0U)
                {
                    ChannelName = Marshal.PtrToStringUni(new IntPtr(address.ToInt64() + traceEventInfo.ChannelNameOffset));
                }
                if (traceEventInfo.TaskNameOffset > 0U)
                {
                    TaskName = Marshal.PtrToStringUni(new IntPtr(address.ToInt64() + traceEventInfo.TaskNameOffset));
                }
                if (traceEventInfo.EventMessageOffset > 0U)
                {
                    EventMessageName = Marshal.PtrToStringUni(new IntPtr(address.ToInt64() + traceEventInfo.EventMessageOffset));
                }
                if (traceEventInfo.OpcodeNameOffset <= 0U)
                {
                    return;
                }
                EventName = Marshal.PtrToStringUni(new IntPtr(address.ToInt64() + traceEventInfo.OpcodeNameOffset));
            }
        }
Ejemplo n.º 2
0
        public Dictionary <string, object> GetProperties(LegacyJsonConverter.EventRecord eventRecord)
        {
            Dictionary <string, object> dictionary = new Dictionary <string, object>(traceEventInfo.TopLevelPropertyCount);

            if (hasProperties)
            {
                int    num1 = 0;
                IntPtr num2;
                for (int index = 0; index < traceEventInfo.TopLevelPropertyCount; ++index)
                {
                    EventPropertyInfo eventPropertyInfo = eventPropertyInfoArray[index];
                    string            stringUni         = Marshal.PtrToStringUni(new IntPtr(address.ToInt64() + eventPropertyInfo.NameOffset));
                    num2 = new IntPtr(eventRecord.UserData.ToInt64() + num1);
                    int    length;
                    object obj = null;
                    length = eventPropertyInfo.LengthPropertyIndex;
                    switch (eventPropertyInfo.NonStructTypeValue.InType)
                    {
                    case EventPropertyInfo.TdhInType.UnicodeString:
                        string stringUni2 = Marshal.PtrToStringUni(num2);
                        if (stringUni != null)
                        {
                            length = (stringUni2.Length + 1) * 2;
                            obj    = stringUni2;
                        }

                        break;

                    case EventPropertyInfo.TdhInType.Int32:
                        obj = Marshal.ReadInt32(num2);
                        break;

                    case EventPropertyInfo.TdhInType.UInt32:
                        obj = (uint)Marshal.ReadInt32(num2);
                        break;

                    case EventPropertyInfo.TdhInType.Int64:
                        obj = Marshal.ReadInt64(num2);
                        break;

                    case EventPropertyInfo.TdhInType.UInt64:
                        obj = (ulong)Marshal.ReadInt64(num2);
                        break;

                    case EventPropertyInfo.TdhInType.Pointer:
                        obj = Marshal.ReadIntPtr(num2);
                        break;

                    case EventPropertyInfo.TdhInType.FileTime:
                        obj = DateTime.FromFileTime(Marshal.ReadInt64(num2));
                        break;

                    case EventPropertyInfo.TdhInType.SystemTime:
                        obj = new DateTime(Marshal.ReadInt16(num2),
                                           Marshal.ReadInt16(num2, 2), Marshal.ReadInt16(num2, 6),
                                           Marshal.ReadInt16(num2, 8), Marshal.ReadInt16(num2, 10),
                                           Marshal.ReadInt16(num2, 12), Marshal.ReadInt16(num2, 14));
                        break;
                    }

                    num1 += length;
                    if (stringUni != null)
                    {
                        dictionary.Add(stringUni, obj);
                    }
                }
                if (num1 < eventRecord.UserDataLength)
                {
                    num2 = new IntPtr(eventRecord.UserData.ToInt64() + num1);
                    int    length   = eventRecord.UserDataLength - num1;
                    byte[] numArray = new byte[length];
                    for (int ofs = 0; ofs < length; ++ofs)
                    {
                        numArray[ofs] = Marshal.ReadByte(num2, ofs);
                    }
                    dictionary.Add("__ExtraPayload", numArray);
                }
            }
            else
            {
                string stringUni = Marshal.PtrToStringUni(eventRecord.UserData);
                dictionary.Add("EventData", stringUni);
            }
            return(dictionary);
        }