private void DumpCrimBlock(BinaryReader r) { var header = r.ReadStruct <FileHeader>(); VerifyMagic(0, header.Magic, CrimsonTags.CRIM); writer.PushDictScope("CRIM"); writer.WriteHex("Magic", header.Magic); writer.WriteNumber("Length", header.Length); writer.WriteNumber("Major", header.Major); writer.WriteNumber("Minor", header.Minor); writer.WriteNumber("NumProviders", header.NumProviders); var providerEntries = new List <ProviderEntry>(); for (uint i = 0; i < header.NumProviders; ++i) { var provider = r.ReadStruct <ProviderEntry>(); providerEntries.Add(provider); writer.WriteLine("Provider(Guid={0}, Offset=0x{1:X})", provider.Guid, provider.Offset); } foreach (var entry in providerEntries) { r.BaseStream.Position = entry.Offset; DumpWevtBlock(r, entry.Guid); } writer.PopScope(); }
private void DumpCrimBlock(byte *r) { var header = (FileHeader *)r; VerifyMagic(0, header->Magic, CrimsonTags.CRIM); writer.PushDictScope("CRIM"); writer.WriteHex("Magic", header->Magic); writer.WriteNumber("Length", header->Length); writer.WriteNumber("Major", header->Major); writer.WriteNumber("Minor", header->Minor); writer.WriteNumber("NumProviders", header->NumProviders); var providerEntries = new List <ProviderEntry>(); for (uint i = 0; i < header->NumProviders; ++i) { var provider = ((ProviderEntry *)&header[1]) + i; providerEntries.Add(*provider); writer.WriteLine("Guid={0}, Offset=0x{1:X}", provider->Guid, provider->Offset); } foreach (var entry in providerEntries) { DumpWevtBlock(begin + entry.Offset, entry.Guid); } writer.PopScope(); }