public static object EvtGetPublisherMetadataProperty(EventLogHandle pmHandle, UnsafeNativeMethods.EvtPublisherMetadataPropertyId thePropertyId)
{
object obj2;
IntPtr zero = IntPtr.Zero;
EventLogPermissionHolder.GetEventLogPermission().Demand();
try
{
int num;
bool flag = UnsafeNativeMethods.EvtGetPublisherMetadataProperty(pmHandle, thePropertyId, 0, 0, IntPtr.Zero, out num);
int errorCode = Marshal.GetLastWin32Error();
if (!flag && (errorCode != 0x7a))
{
EventLogException.Throw(errorCode);
}
zero = Marshal.AllocHGlobal(num);
flag = UnsafeNativeMethods.EvtGetPublisherMetadataProperty(pmHandle, thePropertyId, 0, num, zero, out num);
errorCode = Marshal.GetLastWin32Error();
if (!flag)
{
EventLogException.Throw(errorCode);
}
UnsafeNativeMethods.EvtVariant val = (UnsafeNativeMethods.EvtVariant)Marshal.PtrToStructure(zero, typeof(UnsafeNativeMethods.EvtVariant));
obj2 = ConvertToObject(val);
}
finally
{
if (zero != IntPtr.Zero)
{
Marshal.FreeHGlobal(zero);
}
}
return obj2;
}
public static object EvtGetQueryInfo(EventLogHandle handle, UnsafeNativeMethods.EvtQueryPropertyId enumType)
{
object obj2;
IntPtr zero = IntPtr.Zero;
int bufferRequired = 0;
try
{
bool flag = UnsafeNativeMethods.EvtGetQueryInfo(handle, enumType, 0, IntPtr.Zero, ref bufferRequired);
int errorCode = Marshal.GetLastWin32Error();
if (!flag && (errorCode != 0x7a))
{
EventLogException.Throw(errorCode);
}
zero = Marshal.AllocHGlobal(bufferRequired);
flag = UnsafeNativeMethods.EvtGetQueryInfo(handle, enumType, bufferRequired, zero, ref bufferRequired);
errorCode = Marshal.GetLastWin32Error();
if (!flag)
{
EventLogException.Throw(errorCode);
}
UnsafeNativeMethods.EvtVariant val = (UnsafeNativeMethods.EvtVariant)Marshal.PtrToStructure(zero, typeof(UnsafeNativeMethods.EvtVariant));
obj2 = ConvertToObject(val);
}
finally
{
if (zero != IntPtr.Zero)
{
Marshal.FreeHGlobal(zero);
}
}
return obj2;
}
protected bool GetRenderValues(IntPtr hContext, IntPtr hEvent, UnsafeNativeMethods.EvtRenderFlags flags,
ref int dwBufferSize, ref IntPtr pRenderedValues, ref int dwBufferUsed, ref int dwPropertyCount, ref int status)
{
try
{
if (!UnsafeNativeMethods.EvtRender(hContext, hEvent, flags, dwBufferSize, pRenderedValues,
out dwBufferUsed,
out dwPropertyCount))
{
if (UnsafeNativeMethods.ERROR_INSUFFICIENT_BUFFER ==
(status = Marshal.GetLastWin32Error()))
{
dwBufferSize = dwBufferUsed;
pRenderedValues = pRenderedValues == IntPtr.Zero
? Marshal.AllocHGlobal((IntPtr)dwBufferSize)
: Marshal.ReAllocHGlobal(pRenderedValues,
(IntPtr)dwBufferSize);
if (pRenderedValues != IntPtr.Zero)
{
if (UnsafeNativeMethods.EvtRender(hContext, hEvent, flags, dwBufferSize, pRenderedValues,
out dwBufferUsed, out dwPropertyCount))
{
return true;
}
}
}
status = Marshal.GetLastWin32Error();
}
else
{
return true;
}
}
catch
{
status = (int)UnsafeNativeMethods.ERROR_UNHANDLED_EXCEPTION;
}
return false;
}
public static DateTime ConvertFileTimeToDateTime(UnsafeNativeMethods.EvtVariant val)
{
if (val.Type != 0x11)
{
throw new EventLogInvalidDataException();
}
return DateTime.FromFileTime((long)val.FileTime);
}
public static void EvtSetChannelConfigProperty(EventLogHandle handle, UnsafeNativeMethods.EvtChannelConfigPropertyId enumType, object val)
{
EventLogPermissionHolder.GetEventLogPermission().Demand();
UnsafeNativeMethods.EvtVariant propertyValue = new UnsafeNativeMethods.EvtVariant();
CoTaskMemSafeHandle handle2 = new CoTaskMemSafeHandle();
using (handle2)
{
bool flag;
if (val == null)
{
goto Label_017B;
}
switch (enumType)
{
case UnsafeNativeMethods.EvtChannelConfigPropertyId.EvtChannelConfigEnabled:
propertyValue.Type = 13;
if (!((bool)val))
{
break;
}
propertyValue.Bool = 1;
goto Label_0183;
case UnsafeNativeMethods.EvtChannelConfigPropertyId.EvtChannelConfigAccess:
propertyValue.Type = 1;
handle2.SetMemory(Marshal.StringToCoTaskMemAuto((string)val));
propertyValue.StringVal = handle2.GetMemory();
goto Label_0183;
case UnsafeNativeMethods.EvtChannelConfigPropertyId.EvtChannelLoggingConfigRetention:
propertyValue.Type = 13;
if (!((bool)val))
{
goto Label_0146;
}
propertyValue.Bool = 1;
goto Label_0183;
case UnsafeNativeMethods.EvtChannelConfigPropertyId.EvtChannelLoggingConfigAutoBackup:
propertyValue.Type = 13;
if (!((bool)val))
{
goto Label_016B;
}
propertyValue.Bool = 1;
goto Label_0183;
case UnsafeNativeMethods.EvtChannelConfigPropertyId.EvtChannelLoggingConfigMaxSize:
propertyValue.Type = 10;
propertyValue.ULong = (ulong)((long)val);
goto Label_0183;
case UnsafeNativeMethods.EvtChannelConfigPropertyId.EvtChannelLoggingConfigLogFilePath:
propertyValue.Type = 1;
handle2.SetMemory(Marshal.StringToCoTaskMemAuto((string)val));
propertyValue.StringVal = handle2.GetMemory();
goto Label_0183;
case UnsafeNativeMethods.EvtChannelConfigPropertyId.EvtChannelPublishingConfigLevel:
propertyValue.Type = 8;
propertyValue.UInteger = (uint)((int)val);
goto Label_0183;
case UnsafeNativeMethods.EvtChannelConfigPropertyId.EvtChannelPublishingConfigKeywords:
propertyValue.Type = 10;
propertyValue.ULong = (ulong)((long)val);
goto Label_0183;
default:
throw new InvalidOperationException();
}
propertyValue.Bool = 0;
goto Label_0183;
Label_0146:
propertyValue.Bool = 0;
goto Label_0183;
Label_016B:
propertyValue.Bool = 0;
goto Label_0183;
Label_017B:
propertyValue.Type = 0;
Label_0183:
flag = UnsafeNativeMethods.EvtSetChannelConfigProperty(handle, enumType, 0, ref propertyValue);
int errorCode = Marshal.GetLastWin32Error();
if (!flag)
{
EventLogException.Throw(errorCode);
}
}
}
private static object ConvertToObject(UnsafeNativeMethods.EvtVariant val)
{
switch (val.Type)
{
case 0:
return null;
case 1:
return ConvertToString(val);
case 2:
return ConvertToAnsiString(val);
case 3:
return val.SByte;
case 4:
return val.UInt8;
case 5:
return val.SByte;
case 6:
return val.UShort;
case 7:
return val.Integer;
case 8:
return val.UInteger;
case 9:
return val.Long;
case 10:
return val.ULong;
case 12:
return val.Double;
case 13:
if (val.Bool == 0)
{
return false;
}
return true;
case 14:
return ConvertToBinaryArray(val);
case 15:
return ConvertToGuid(val);
case 0x11:
return ConvertFileTimeToDateTime(val);
case 0x13:
return ConvertToSid(val);
case 20:
return val.Integer;
case 0x15:
return val.ULong;
case 0x20:
return ConvertToSafeHandle(val);
case 0x81:
return ConvertToStringArray(val);
case 0x88:
return ConvertToIntArray(val);
}
throw new EventLogInvalidDataException();
}
public static SecurityIdentifier ConvertToSid(UnsafeNativeMethods.EvtVariant val)
{
if (val.Type != 0x13)
{
throw new EventLogInvalidDataException();
}
if (val.SidVal == IntPtr.Zero)
{
return null;
}
return new SecurityIdentifier(val.SidVal);
}
public static void EvtRenderBufferWithContextSystem(EventLogHandle contextHandle, EventLogHandle eventHandle, UnsafeNativeMethods.EvtRenderFlags flag, SystemProperties systemProperties, int SYSTEM_PROPERTY_COUNT)
{
IntPtr zero = IntPtr.Zero;
IntPtr ptr = IntPtr.Zero;
EventLogPermissionHolder.GetEventLogPermission().Demand();
try
{
int num;
int num2;
if (!UnsafeNativeMethods.EvtRender(contextHandle, eventHandle, flag, 0, IntPtr.Zero, out num, out num2))
{
int num3 = Marshal.GetLastWin32Error();
if (num3 != 0x7a)
{
EventLogException.Throw(num3);
}
}
zero = Marshal.AllocHGlobal(num);
bool flag2 = UnsafeNativeMethods.EvtRender(contextHandle, eventHandle, flag, num, zero, out num, out num2);
int errorCode = Marshal.GetLastWin32Error();
if (!flag2)
{
EventLogException.Throw(errorCode);
}
if (num2 != SYSTEM_PROPERTY_COUNT)
{
throw new InvalidOperationException("We do not have " + SYSTEM_PROPERTY_COUNT + " variants given for the UnsafeNativeMethods.EvtRenderFlags.EvtRenderEventValues flag. (System Properties)");
}
ptr = zero;
for (int i = 0; i < num2; i++)
{
UnsafeNativeMethods.EvtVariant val = (UnsafeNativeMethods.EvtVariant)Marshal.PtrToStructure(ptr, typeof(UnsafeNativeMethods.EvtVariant));
switch (i)
{
case 0:
systemProperties.ProviderName = (string)ConvertToObject(val, UnsafeNativeMethods.EvtVariantType.EvtVarTypeString);
break;
case 1:
systemProperties.ProviderId = (Guid?)ConvertToObject(val, UnsafeNativeMethods.EvtVariantType.EvtVarTypeGuid);
break;
case 2:
systemProperties.Id = (ushort?)ConvertToObject(val, UnsafeNativeMethods.EvtVariantType.EvtVarTypeUInt16);
break;
case 3:
systemProperties.Qualifiers = (ushort?)ConvertToObject(val, UnsafeNativeMethods.EvtVariantType.EvtVarTypeUInt16);
break;
case 4:
systemProperties.Level = (byte?)ConvertToObject(val, UnsafeNativeMethods.EvtVariantType.EvtVarTypeByte);
break;
case 5:
systemProperties.Task = (ushort?)ConvertToObject(val, UnsafeNativeMethods.EvtVariantType.EvtVarTypeUInt16);
break;
case 6:
systemProperties.Opcode = (byte?)ConvertToObject(val, UnsafeNativeMethods.EvtVariantType.EvtVarTypeByte);
break;
case 7:
systemProperties.Keywords = (ulong?)ConvertToObject(val, UnsafeNativeMethods.EvtVariantType.EvtVarTypeHexInt64);
break;
case 8:
systemProperties.TimeCreated = (DateTime?)ConvertToObject(val, UnsafeNativeMethods.EvtVariantType.EvtVarTypeFileTime);
break;
case 9:
systemProperties.RecordId = (ulong?)ConvertToObject(val, UnsafeNativeMethods.EvtVariantType.EvtVarTypeUInt64);
break;
case 10:
systemProperties.ActivityId = (Guid?)ConvertToObject(val, UnsafeNativeMethods.EvtVariantType.EvtVarTypeGuid);
break;
case 11:
systemProperties.RelatedActivityId = (Guid?)ConvertToObject(val, UnsafeNativeMethods.EvtVariantType.EvtVarTypeGuid);
break;
case 12:
systemProperties.ProcessId = (uint?)ConvertToObject(val, UnsafeNativeMethods.EvtVariantType.EvtVarTypeUInt32);
break;
case 13:
systemProperties.ThreadId = (uint?)ConvertToObject(val, UnsafeNativeMethods.EvtVariantType.EvtVarTypeUInt32);
break;
case 14:
systemProperties.ChannelName = (string)ConvertToObject(val, UnsafeNativeMethods.EvtVariantType.EvtVarTypeString);
break;
case 15:
systemProperties.ComputerName = (string)ConvertToObject(val, UnsafeNativeMethods.EvtVariantType.EvtVarTypeString);
break;
case 0x10:
systemProperties.UserId = (SecurityIdentifier)ConvertToObject(val, UnsafeNativeMethods.EvtVariantType.EvtVarTypeSid);
break;
case 0x11:
systemProperties.Version = (byte?)ConvertToObject(val, UnsafeNativeMethods.EvtVariantType.EvtVarTypeByte);
break;
}
ptr = new IntPtr(((long)ptr) + Marshal.SizeOf(val));
}
}
finally
{
if (zero != IntPtr.Zero)
{
Marshal.FreeHGlobal(zero);
}
}
}
public static object ConvertToObject(UnsafeNativeMethods.EvtVariant val, UnsafeNativeMethods.EvtVariantType desiredType)
{
if (val.Type == 0)
{
return null;
}
if (val.Type != ((long)desiredType))
{
throw new EventLogInvalidDataException();
}
return ConvertToObject(val);
}
public static EventLogHandle ConvertToSafeHandle(UnsafeNativeMethods.EvtVariant val)
{
if (val.Type != 0x20)
{
throw new EventLogInvalidDataException();
}
if (val.Handle == IntPtr.Zero)
{
return EventLogHandle.Zero;
}
return new EventLogHandle(val.Handle, true);
}
public static int[] ConvertToIntArray(UnsafeNativeMethods.EvtVariant val)
{
if (val.Type != 0x88)
{
throw new EventLogInvalidDataException();
}
if (val.Reference == IntPtr.Zero)
{
return new int[0];
}
IntPtr reference = val.Reference;
int[] destination = new int[val.Count];
Marshal.Copy(reference, destination, 0, (int)val.Count);
return destination;
}
public static Guid ConvertToGuid(UnsafeNativeMethods.EvtVariant val)
{
if (val.Type != 15)
{
throw new EventLogInvalidDataException();
}
if (val.GuidReference == IntPtr.Zero)
{
return Guid.Empty;
}
return (Guid)Marshal.PtrToStructure(val.GuidReference, typeof(Guid));
}
public static byte[] ConvertToBinaryArray(UnsafeNativeMethods.EvtVariant val)
{
if (val.Type != 14)
{
throw new EventLogInvalidDataException();
}
if (val.Binary == IntPtr.Zero)
{
return new byte[0];
}
IntPtr binary = val.Binary;
byte[] destination = new byte[val.Count];
Marshal.Copy(binary, destination, 0, (int)val.Count);
return destination;
}
public static EventLogHandle EvtOpenSession(UnsafeNativeMethods.EvtLoginClass loginClass, ref UnsafeNativeMethods.EvtRpcLogin login, int timeout, int flags)
{
if (s_platformNotSupported)
{
throw new PlatformNotSupportedException();
}
EventLogHandle handle = UnsafeNativeMethods.EvtOpenSession(loginClass, ref login, timeout, flags);
int errorCode = Marshal.GetLastWin32Error();
if (handle.IsInvalid)
{
EventLogException.Throw(errorCode);
}
return handle;
}
public static string ConvertToString(UnsafeNativeMethods.EvtVariant val)
{
if (val.Type != 1)
{
throw new EventLogInvalidDataException();
}
if (val.StringVal == IntPtr.Zero)
{
return string.Empty;
}
return Marshal.PtrToStringAuto(val.StringVal);
}
public static void EvtRender(EventLogHandle context, EventLogHandle eventHandle, UnsafeNativeMethods.EvtRenderFlags flags, StringBuilder buffer)
{
int num;
int num2;
if (s_platformNotSupported)
{
throw new PlatformNotSupportedException();
}
bool flag = UnsafeNativeMethods.EvtRender(context, eventHandle, flags, buffer.Capacity, buffer, out num, out num2);
int errorCode = Marshal.GetLastWin32Error();
if (!flag)
{
if (errorCode == 0x7a)
{
buffer.Capacity = num;
flag = UnsafeNativeMethods.EvtRender(context, eventHandle, flags, buffer.Capacity, buffer, out num, out num2);
errorCode = Marshal.GetLastWin32Error();
}
if (!flag)
{
EventLogException.Throw(errorCode);
}
}
}
public static string[] ConvertToStringArray(UnsafeNativeMethods.EvtVariant val)
{
if (val.Type != 0x81)
{
throw new EventLogInvalidDataException();
}
if (val.Reference == IntPtr.Zero)
{
return new string[0];
}
IntPtr reference = val.Reference;
IntPtr[] destination = new IntPtr[val.Count];
Marshal.Copy(reference, destination, 0, (int)val.Count);
string[] strArray = new string[val.Count];
for (int i = 0; i < val.Count; i++)
{
strArray[i] = Marshal.PtrToStringAuto(destination[i]);
}
return strArray;
}
public static void EvtSeek(EventLogHandle resultSet, long position, EventLogHandle bookmark, int timeout, UnsafeNativeMethods.EvtSeekFlags flags)
{
bool flag = UnsafeNativeMethods.EvtSeek(resultSet, position, bookmark, timeout, flags);
int errorCode = Marshal.GetLastWin32Error();
if (!flag)
{
EventLogException.Throw(errorCode);
}
}
public static EventLogHandle EvtCreateRenderContext(int valuePathsCount, string[] valuePaths, UnsafeNativeMethods.EvtRenderContextFlags flags)
{
if (s_platformNotSupported)
{
throw new PlatformNotSupportedException();
}
EventLogHandle handle = UnsafeNativeMethods.EvtCreateRenderContext(valuePathsCount, valuePaths, flags);
int errorCode = Marshal.GetLastWin32Error();
if (handle.IsInvalid)
{
EventLogException.Throw(errorCode);
}
return handle;
}
internal static EventLogHandle EvtGetPublisherMetadataPropertyHandle(EventLogHandle pmHandle, UnsafeNativeMethods.EvtPublisherMetadataPropertyId thePropertyId)
{
EventLogHandle handle;
IntPtr zero = IntPtr.Zero;
try
{
int num;
bool flag = UnsafeNativeMethods.EvtGetPublisherMetadataProperty(pmHandle, thePropertyId, 0, 0, IntPtr.Zero, out num);
int errorCode = Marshal.GetLastWin32Error();
if (!flag && (errorCode != 0x7a))
{
EventLogException.Throw(errorCode);
}
zero = Marshal.AllocHGlobal(num);
flag = UnsafeNativeMethods.EvtGetPublisherMetadataProperty(pmHandle, thePropertyId, 0, num, zero, out num);
errorCode = Marshal.GetLastWin32Error();
if (!flag)
{
EventLogException.Throw(errorCode);
}
UnsafeNativeMethods.EvtVariant val = (UnsafeNativeMethods.EvtVariant)Marshal.PtrToStructure(zero, typeof(UnsafeNativeMethods.EvtVariant));
handle = ConvertToSafeHandle(val);
}
finally
{
if (zero != IntPtr.Zero)
{
Marshal.FreeHGlobal(zero);
}
}
return handle;
}
public static IEnumerable<string> EvtFormatMessageRenderKeywords(EventLogHandle pmHandle, EventLogHandle eventHandle, UnsafeNativeMethods.EvtFormatMessageFlags flag)
{
IEnumerable<string> enumerable;
EventLogPermissionHolder.GetEventLogPermission().Demand();
IntPtr zero = IntPtr.Zero;
try
{
int num;
List<string> list = new List<string>();
bool flag2 = UnsafeNativeMethods.EvtFormatMessageBuffer(pmHandle, eventHandle, 0, 0, IntPtr.Zero, flag, 0, IntPtr.Zero, out num);
int errorCode = Marshal.GetLastWin32Error();
if (!flag2)
{
switch (errorCode)
{
case 0x3ab9:
case 0x3afc:
case 0x3ab3:
case 0x3ab4:
case 0x717:
return list.AsReadOnly();
}
if (errorCode != 0x7a)
{
EventLogException.Throw(errorCode);
}
}
zero = Marshal.AllocHGlobal((int)(num * 2));
flag2 = UnsafeNativeMethods.EvtFormatMessageBuffer(pmHandle, eventHandle, 0, 0, IntPtr.Zero, flag, num, zero, out num);
errorCode = Marshal.GetLastWin32Error();
if (!flag2)
{
switch (errorCode)
{
case 0x3ab9:
case 0x3afc:
return list;
case 0x3ab3:
case 0x3ab4:
return list;
case 0x717:
return list;
}
EventLogException.Throw(errorCode);
}
IntPtr ptr = zero;
while (true)
{
string str = Marshal.PtrToStringAuto(ptr);
if (string.IsNullOrEmpty(str))
{
break;
}
list.Add(str);
ptr = new IntPtr((((long)ptr) + (str.Length * 2)) + 2L);
}
enumerable = list.AsReadOnly();
}
finally
{
if (zero != IntPtr.Zero)
{
Marshal.FreeHGlobal(zero);
}
}
return enumerable;
}
protected bool GetMessageString(IntPtr hMetadata, IntPtr hEvent,
UnsafeNativeMethods.EvtFormatMessageFlags FormatId, ref StringBuilder pBuffer, out int dwBufferUsed, ref int status)
{
pBuffer.Remove(0, pBuffer.Length);
if (
!UnsafeNativeMethods.EvtFormatMessage(hMetadata, hEvent, 0, 0, null, FormatId, pBuffer.Capacity, pBuffer,
out dwBufferUsed))
{
status = Marshal.GetLastWin32Error();
if (UnsafeNativeMethods.ERROR_INSUFFICIENT_BUFFER == status)
{
pBuffer.EnsureCapacity(dwBufferUsed * 4);
UnsafeNativeMethods.EvtFormatMessage(hMetadata, hEvent, 0, 0, null, FormatId, pBuffer.Capacity,
pBuffer,
out dwBufferUsed);
if (UnsafeNativeMethods.EvtFormatMessageFlags.EvtFormatMessageKeyword == FormatId)
{
pBuffer.Append('\0');
}
return true;
}
}
else
{
if (UnsafeNativeMethods.EvtFormatMessageFlags.EvtFormatMessageKeyword == FormatId)
{
pBuffer.Append('\0');
}
return true;
}
return false;
}
public static string EvtFormatMessageRenderName(EventLogHandle pmHandle, EventLogHandle eventHandle, UnsafeNativeMethods.EvtFormatMessageFlags flag)
{
int num;
EventLogPermissionHolder.GetEventLogPermission().Demand();
StringBuilder buffer = new StringBuilder(null);
bool flag2 = UnsafeNativeMethods.EvtFormatMessage(pmHandle, eventHandle, 0, 0, null, flag, 0, buffer, out num);
int errorCode = Marshal.GetLastWin32Error();
if (!flag2 && (errorCode != 0x3ab5))
{
switch (errorCode)
{
case 0x3ab9:
case 0x3afc:
case 0x3ab3:
case 0x3ab4:
case 0x717:
return null;
}
if (errorCode != 0x7a)
{
EventLogException.Throw(errorCode);
}
}
buffer.EnsureCapacity(num);
flag2 = UnsafeNativeMethods.EvtFormatMessage(pmHandle, eventHandle, 0, 0, null, flag, num, buffer, out num);
errorCode = Marshal.GetLastWin32Error();
if (!flag2 && (errorCode != 0x3ab5))
{
switch (errorCode)
{
case 0x3ab9:
case 0x3afc:
case 0x3ab3:
case 0x3ab4:
case 0x717:
return null;
}
EventLogException.Throw(errorCode);
}
return buffer.ToString();
}
internal object GetProviderListProperty(EventLogHandle providerHandle, UnsafeNativeMethods.EvtPublisherMetadataPropertyId metadataProperty)
{
EventLogHandle elHandle = EventLogHandle.Zero;
try
{
UnsafeNativeMethods.EvtPublisherMetadataPropertyId propName;
UnsafeNativeMethods.EvtPublisherMetadataPropertyId propValue;
UnsafeNativeMethods.EvtPublisherMetadataPropertyId propMessageId;
ObjectTypeName objectTypeName;
List<EventLevel> levelList = null;
List<EventOpcode> opcodeList = null;
List<EventKeyword> keywordList = null;
List<EventTask> taskList = null;
elHandle = NativeWrapper.EvtGetPublisherMetadataPropertyHandle(providerHandle, metadataProperty);
int arraySize = NativeWrapper.EvtGetObjectArraySize(elHandle);
switch (metadataProperty)
{
case UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataLevels:
propName = UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataLevelName;
propValue = UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataLevelValue;
propMessageId = UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataLevelMessageID;
objectTypeName = ObjectTypeName.Level;
levelList = new List<EventLevel>(arraySize);
break;
case UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataOpcodes:
propName = UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataOpcodeName;
propValue = UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataOpcodeValue;
propMessageId = UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataOpcodeMessageID;
objectTypeName = ObjectTypeName.Opcode;
opcodeList = new List<EventOpcode>(arraySize);
break;
case UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataKeywords:
propName = UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataKeywordName;
propValue = UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataKeywordValue;
propMessageId = UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataKeywordMessageID;
objectTypeName = ObjectTypeName.Keyword;
keywordList = new List<EventKeyword>(arraySize);
break;
case UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataTasks:
propName = UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataTaskName;
propValue = UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataTaskValue;
propMessageId = UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataTaskMessageID;
objectTypeName = ObjectTypeName.Task;
taskList = new List<EventTask>(arraySize);
break;
default:
return null;
}
for (int index = 0; index < arraySize; index++)
{
string generalName = (string)NativeWrapper.EvtGetObjectArrayProperty(elHandle, index, (int)propName);
uint generalValue = 0;
long generalValueKeyword = 0;
if (objectTypeName != ObjectTypeName.Keyword)
{
generalValue = (uint)NativeWrapper.EvtGetObjectArrayProperty(elHandle, index, (int)propValue);
}
else
{
generalValueKeyword = unchecked((long)((ulong)NativeWrapper.EvtGetObjectArrayProperty(elHandle, index, (int)propValue)));
}
int generalMessageId = unchecked((int)((uint)NativeWrapper.EvtGetObjectArrayProperty(elHandle, index, (int)propMessageId)));
string generalDisplayName = null;
if (generalMessageId == -1)
{
if (providerHandle != _defaultProviderHandle)
{
if (_defaultProviderHandle.IsInvalid)
{
_defaultProviderHandle = NativeWrapper.EvtOpenProviderMetadata(_session.Handle, null, null, 0, 0);
}
switch (objectTypeName)
{
case ObjectTypeName.Level:
generalDisplayName = FindStandardLevelDisplayName(generalName, generalValue);
break;
case ObjectTypeName.Opcode:
generalDisplayName = FindStandardOpcodeDisplayName(generalName, generalValue >> 16);
break;
case ObjectTypeName.Keyword:
generalDisplayName = FindStandardKeywordDisplayName(generalName, generalValueKeyword);
break;
case ObjectTypeName.Task:
generalDisplayName = FindStandardTaskDisplayName(generalName, generalValue);
break;
default:
generalDisplayName = null;
break;
}
}
}
else
{
generalDisplayName = NativeWrapper.EvtFormatMessage(providerHandle, unchecked((uint)generalMessageId));
}
switch (objectTypeName)
{
case ObjectTypeName.Level:
levelList.Add(new EventLevel(generalName, (int)generalValue, generalDisplayName));
break;
case ObjectTypeName.Opcode:
opcodeList.Add(new EventOpcode(generalName, (int)(generalValue >> 16), generalDisplayName));
break;
case ObjectTypeName.Keyword:
keywordList.Add(new EventKeyword(generalName, (long)generalValueKeyword, generalDisplayName));
break;
case ObjectTypeName.Task:
Guid taskGuid = (Guid)NativeWrapper.EvtGetObjectArrayProperty(elHandle, index, (int)UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataTaskEventGuid);
taskList.Add(new EventTask(generalName, (int)generalValue, generalDisplayName, taskGuid));
break;
default:
return null;
}
}
switch (objectTypeName)
{
case ObjectTypeName.Level:
return levelList;
case ObjectTypeName.Opcode:
return opcodeList;
case ObjectTypeName.Keyword:
return keywordList;
case ObjectTypeName.Task:
return taskList;
}
return null;
}
finally
{
elHandle.Dispose();
}
}
internal object GetProviderListProperty(EventLogHandle providerHandle, UnsafeNativeMethods.EvtPublisherMetadataPropertyId metadataProperty)
{
object obj2;
EventLogHandle zero = EventLogHandle.Zero;
EventLogPermissionHolder.GetEventLogPermission().Demand();
try
{
UnsafeNativeMethods.EvtPublisherMetadataPropertyId evtPublisherMetadataOpcodeName;
UnsafeNativeMethods.EvtPublisherMetadataPropertyId evtPublisherMetadataOpcodeValue;
UnsafeNativeMethods.EvtPublisherMetadataPropertyId evtPublisherMetadataOpcodeMessageID;
ObjectTypeName opcode;
List<EventLevel> list = null;
List<EventOpcode> list2 = null;
List<EventKeyword> list3 = null;
List<EventTask> list4 = null;
zero = NativeWrapper.EvtGetPublisherMetadataPropertyHandle(providerHandle, metadataProperty);
int capacity = NativeWrapper.EvtGetObjectArraySize(zero);
switch (metadataProperty)
{
case UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataOpcodes:
evtPublisherMetadataOpcodeName = UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataOpcodeName;
evtPublisherMetadataOpcodeValue = UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataOpcodeValue;
evtPublisherMetadataOpcodeMessageID = UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataOpcodeMessageID;
opcode = ObjectTypeName.Opcode;
list2 = new List<EventOpcode>(capacity);
break;
case UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataKeywords:
evtPublisherMetadataOpcodeName = UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataKeywordName;
evtPublisherMetadataOpcodeValue = UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataKeywordValue;
evtPublisherMetadataOpcodeMessageID = UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataKeywordMessageID;
opcode = ObjectTypeName.Keyword;
list3 = new List<EventKeyword>(capacity);
break;
case UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataLevels:
evtPublisherMetadataOpcodeName = UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataLevelName;
evtPublisherMetadataOpcodeValue = UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataLevelValue;
evtPublisherMetadataOpcodeMessageID = UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataLevelMessageID;
opcode = ObjectTypeName.Level;
list = new List<EventLevel>(capacity);
break;
case UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataTasks:
evtPublisherMetadataOpcodeName = UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataTaskName;
evtPublisherMetadataOpcodeValue = UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataTaskValue;
evtPublisherMetadataOpcodeMessageID = UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataTaskMessageID;
opcode = ObjectTypeName.Task;
list4 = new List<EventTask>(capacity);
break;
default:
return null;
}
for (int i = 0; i < capacity; i++)
{
string name = (string)NativeWrapper.EvtGetObjectArrayProperty(zero, i, (int)evtPublisherMetadataOpcodeName);
uint num3 = 0;
long num4 = 0L;
if (opcode != ObjectTypeName.Keyword)
{
num3 = (uint)NativeWrapper.EvtGetObjectArrayProperty(zero, i, (int)evtPublisherMetadataOpcodeValue);
}
else
{
num4 = (long)((ulong)NativeWrapper.EvtGetObjectArrayProperty(zero, i, (int)evtPublisherMetadataOpcodeValue));
}
int num5 = (int)((uint)NativeWrapper.EvtGetObjectArrayProperty(zero, i, (int)evtPublisherMetadataOpcodeMessageID));
string displayName = null;
if (num5 == -1)
{
if (providerHandle != this.defaultProviderHandle)
{
if (this.defaultProviderHandle.IsInvalid)
{
this.defaultProviderHandle = NativeWrapper.EvtOpenProviderMetadata(this.session.Handle, null, null, this.cultureInfo.LCID, 0);
}
switch (opcode)
{
case ObjectTypeName.Level:
displayName = this.FindStandardLevelDisplayName(name, num3);
goto Label_01BA;
case ObjectTypeName.Opcode:
displayName = this.FindStandardOpcodeDisplayName(name, num3 >> 0x10);
goto Label_01BA;
case ObjectTypeName.Task:
displayName = this.FindStandardTaskDisplayName(name, num3);
goto Label_01BA;
case ObjectTypeName.Keyword:
displayName = this.FindStandardKeywordDisplayName(name, num4);
goto Label_01BA;
}
displayName = null;
}
}
else
{
displayName = NativeWrapper.EvtFormatMessage(providerHandle, (uint)num5);
}
Label_01BA:
switch (opcode)
{
case ObjectTypeName.Level:
list.Add(new EventLevel(name, (int)num3, displayName));
break;
case ObjectTypeName.Opcode:
list2.Add(new EventOpcode(name, (int)(num3 >> 0x10), displayName));
break;
case ObjectTypeName.Task:
{
Guid guid = (Guid)NativeWrapper.EvtGetObjectArrayProperty(zero, i, 0x12);
list4.Add(new EventTask(name, (int)num3, displayName, guid));
break;
}
case ObjectTypeName.Keyword:
list3.Add(new EventKeyword(name, num4, displayName));
break;
default:
return null;
}
}
switch (opcode)
{
case ObjectTypeName.Level:
return list;
case ObjectTypeName.Opcode:
return list2;
case ObjectTypeName.Task:
return list4;
case ObjectTypeName.Keyword:
return list3;
}
obj2 = null;
}
finally
{
zero.Close();
}
return obj2;
}
