public Tuple <DataTable, AsyncDataViewModelPreset> CreateTable(
IEventInfoSource eventInfoSource, EventSymbolSource symbolSource = null)
{
var formatterPool = new ObjectPool <IMessageFormatter>(() => new NativeTdhFormatter(), 10);
var info = new CrimsonEventsInfo(eventInfoSource, formatterPool, symbolSource);
var table = new DataTable("Generic Events");
var templatePreset = new AsyncDataViewModelPreset();
AddColumn(table, templatePreset, timePointGeneratorPreset, DataColumn.Create(info.ProjectTimePoint));
AddColumn(table, templatePreset, timeAbsoluteGeneratorPreset, DataColumn.Create(info.ProjectTimeAbsolute));
AddColumn(table, templatePreset, timeRelativeGeneratorPreset, DataColumn.Create(info.ProjectTimeRelative));
AddColumn(table, templatePreset, providerIdPreset, DataColumn.Create(info.ProjectProviderId));
AddColumn(table, templatePreset, providerNamePreset, DataColumn.Create(info.ProjectProviderName));
AddColumn(table, templatePreset, idPreset, DataColumn.Create(info.ProjectId));
AddColumn(table, templatePreset, versionPreset, DataColumn.Create(info.ProjectVersion));
AddColumn(table, templatePreset, symbolPreset, DataColumn.Create(info.ProjectSymbol));
AddColumn(table, templatePreset, channelPreset, DataColumn.Create(info.ProjectChannel));
AddColumn(table, templatePreset, channelNamePreset, DataColumn.Create(info.ProjectChannelName));
AddColumn(table, templatePreset, taskPreset, DataColumn.Create(info.ProjectTask));
AddColumn(table, templatePreset, taskNamePreset, DataColumn.Create(info.ProjectTaskName));
AddColumn(table, templatePreset, opcodeOrTypePreset, DataColumn.Create(info.ProjectOpCode));
AddColumn(table, templatePreset, opcodeNamePreset, DataColumn.Create(info.ProjectOpCodeName));
AddColumn(table, templatePreset, levelPreset, DataColumn.Create(info.ProjectLevel));
AddColumn(table, templatePreset, levelNamePreset, DataColumn.Create(info.ProjectLevelName));
AddColumn(table, templatePreset, keywordPreset, DataColumn.Create(info.ProjectKeyword));
AddColumn(table, templatePreset, keywordNamePreset, DataColumn.Create(info.ProjectKeywordName));
AddColumn(table, templatePreset, processIdPreset, DataColumn.Create(info.ProjectProcessId));
AddColumn(table, templatePreset, threadIdPreset, DataColumn.Create(info.ProjectThreadId));
AddColumn(table, templatePreset, messagePreset, DataColumn.Create(info.ProjectMessage));
AddColumn(table, templatePreset, eventNamePreset, DataColumn.Create(info.ProjectEventName));
AddColumn(table, templatePreset, eventTypePreset, DataColumn.Create(info.ProjectEventType));
AddColumn(table, templatePreset, cpuPreset, DataColumn.Create(info.ProjectCpu));
AddColumn(table, templatePreset, userDataPreset, DataColumn.Create(info.ProjectUserData));
AddColumn(table, templatePreset, userDataLengthPreset, DataColumn.Create(info.ProjectUserDataLength));
AddColumn(table, templatePreset, activityIdPreset, DataColumn.Create(info.ProjectActivityId));
AddColumn(table, templatePreset, relatedActivityIdPreset, DataColumn.Create(info.ProjectRelatedActivityId));
AddColumn(table, templatePreset, userSecurityIdentifierPreset, DataColumn.Create(info.ProjectUserSecurityIdentifier));
AddColumn(table, templatePreset, sessionIdPreset, DataColumn.Create(info.ProjectSessionId));
AddColumn(table, templatePreset, eventKeyPreset, DataColumn.Create(info.ProjectEventKey));
AddColumn(table, templatePreset, decodingSourcePreset, DataColumn.Create(info.ProjectDecodingSource));
//AddColumn(table, templatePreset, modernProcessDataPreset, DataColumn.Create<object>());
//AddColumn(table, templatePreset, processNamePreset, DataColumn.Create<string>());
//AddColumn(table, templatePreset, stackTopPreset, DataColumn.Create<object>());
//AddColumn(table, templatePreset, threadStartModulePreset, DataColumn.Create<string>());
//AddColumn(table, templatePreset, threadStartFunctionPreset, DataColumn.Create<string>());
return(Tuple.Create(table, templatePreset));
}
public CrimsonEventsInfo(
IEventInfoSource eventInfoSource,
ObjectPool <IMessageFormatter> messageFormatterPool,
IEventSymbolSource eventSymbolSource)
{
this.eventInfoSource = eventInfoSource;
this.messageFormatterPool = messageFormatterPool;
this.eventSymbolSource = eventSymbolSource;
// Standard Windows system opcodes taken from winmeta.xml in the
// Windows SDK
winmetaOpcodeNames = new Dictionary <int, SafeBstrHandle> {
{ 0, SafeBstrHandle.Create("win:Info") },
{ 1, SafeBstrHandle.Create("win:Start") },
{ 2, SafeBstrHandle.Create("win:Stop") },
{ 3, SafeBstrHandle.Create("win:DC_Start") },
{ 4, SafeBstrHandle.Create("win:DC_Stop") },
{ 5, SafeBstrHandle.Create("win:Extension") },
{ 6, SafeBstrHandle.Create("win:Reply") },
{ 7, SafeBstrHandle.Create("win:Resume") },
{ 8, SafeBstrHandle.Create("win:Suspend") },
{ 9, SafeBstrHandle.Create("win:Send") },
{ 240, SafeBstrHandle.Create("win:Receive") },
{ 241, SafeBstrHandle.Create("win:ReservedOpcode241") },
{ 242, SafeBstrHandle.Create("win:ReservedOpcode242") },
{ 243, SafeBstrHandle.Create("win:ReservedOpcode243") },
{ 244, SafeBstrHandle.Create("win:ReservedOpcode244") },
{ 245, SafeBstrHandle.Create("win:ReservedOpcode245") },
{ 246, SafeBstrHandle.Create("win:ReservedOpcode246") },
{ 247, SafeBstrHandle.Create("win:ReservedOpcode247") },
{ 248, SafeBstrHandle.Create("win:ReservedOpcode248") },
{ 249, SafeBstrHandle.Create("win:ReservedOpcode249") },
{ 250, SafeBstrHandle.Create("win:ReservedOpcode250") },
{ 251, SafeBstrHandle.Create("win:ReservedOpcode251") },
{ 252, SafeBstrHandle.Create("win:ReservedOpcode252") },
{ 253, SafeBstrHandle.Create("win:ReservedOpcode253") },
{ 254, SafeBstrHandle.Create("win:ReservedOpcode254") },
{ 255, SafeBstrHandle.Create("win:ReservedOpcode255") }
};
}
