internal void CreateFileScanOperation(AMFilter_FileScanArgsTraceData data)
{
// If we can't get the process or thread index, bail.
ProcessIndex processIndex = data.Process().ProcessIndex;
if (processIndex == ProcessIndex.Invalid)
{
return;
}
ThreadIndex threadIndex = data.Thread().ThreadIndex;
if (threadIndex == ThreadIndex.Invalid)
{
return;
}
// Get the process container.
Dictionary <ThreadIndex, FileScanOperation> processContainer = GetOrCreateProcessContainer(processIndex);
// Create a new file scan operation.
// This happens when the scan is requested inside the user process.
FileScanOperation scan = new FileScanOperation()
{
File = data.FileName,
Reason = data.Reason,
RequestorStack = _stackSource.GetCallStack(data.CallStackIndex(), data)
};
processContainer[threadIndex] = scan;
}
protected internal override void EnumerateTemplates(Func <string, string, EventFilterResponse> eventsToObserve, Action <TraceEvent> callback)
{
if (s_templates == null)
{
var templates = new TraceEvent[4];
templates[0] = new AMFilter_CacheRemoveArgsTraceData(null, 2, 2, "AMFilter_CacheRemove", Guid.Empty, 0, "", ProviderGuid, ProviderName);
templates[1] = new AMFilter_TrustedProcessArgsTraceData(null, 7, 7, "AMFilter_TrustedProcess", Guid.Empty, 0, "", ProviderGuid, ProviderName);
templates[2] = new AMFilter_ProcessContextArgsTraceData(null, 8, 8, "AMFilter_ProcessContext", Guid.Empty, 0, "", ProviderGuid, ProviderName);
templates[3] = new AMFilter_FileScanArgsTraceData(null, 9, 9, "AMFilter_FileScan", Guid.Empty, 0, "", ProviderGuid, ProviderName);
s_templates = templates;
}
foreach (var template in s_templates)
{
if (eventsToObserve == null || eventsToObserve(template.ProviderName, template.EventName) == EventFilterResponse.AcceptEvent)
{
callback(template);
}
}
}