private static void ProcessEventHandler(IEventRecord record)
{
var pid = record.GetUInt32("ProcessID");
var imageName = record.GetUnicodeString("ImageName");
Console.WriteLine($"{record.TaskName} pid={pid} ImageName={imageName}");
}
private object ParseBasicProperty(Property prop, IEventRecord record)
{
object propertyValue = null;
switch (prop.Type)
{
case (int)TDH_IN_TYPE.TDH_INTYPE_ANSISTRING:
propertyValue = record.GetAnsiString(prop.Name);
break;
case (int)TDH_IN_TYPE.TDH_INTYPE_BINARY:
propertyValue = record.GetBinary(prop.Name);
break;
case (int)TDH_IN_TYPE.TDH_INTYPE_COUNTEDSTRING:
propertyValue = record.GetCountedString(prop.Name);
break;
case (int)TDH_IN_TYPE.TDH_INTYPE_INT8:
propertyValue = record.GetInt8(prop.Name);
break;
case (int)TDH_IN_TYPE.TDH_INTYPE_INT16:
propertyValue = record.GetInt16(prop.Name);
break;
case (int)TDH_IN_TYPE.TDH_INTYPE_INT32:
propertyValue = record.GetInt32(prop.Name);
break;
case (int)TDH_IN_TYPE.TDH_INTYPE_INT64:
propertyValue = record.GetInt64(prop.Name);
break;
case (int)TDH_IN_TYPE.TDH_INTYPE_UINT8:
propertyValue = record.GetUInt8(prop.Name);
break;
case (int)TDH_IN_TYPE.TDH_INTYPE_UINT16:
propertyValue = record.GetUInt16(prop.Name);
break;
case (int)TDH_IN_TYPE.TDH_INTYPE_UINT32:
propertyValue = record.GetUInt32(prop.Name);
break;
case (int)TDH_IN_TYPE.TDH_INTYPE_UINT64:
propertyValue = record.GetUInt64(prop.Name);
break;
case (int)TDH_IN_TYPE.TDH_INTYPE_UNICODESTRING:
propertyValue = record.GetUnicodeString(prop.Name);
break;
case (int)TDH_IN_TYPE.TDH_INTYPE_FILETIME:
propertyValue = record.GetDateTime(prop.Name);
break;
case (int)TDH_IN_TYPE.TDH_INTYPE_POINTER:
propertyValue = record.GetUInt64(prop.Name);
break;
default:
propertyValue = "<Unknown type>";
break;
}
return(propertyValue);
}
/// <summary>
/// Parse an event log base on tracelogging
/// </summary>
/// <param name="record">ETW event record</param>
/// <param name="eventData">dict will be filled with event data</param>
public void Parse(IEventRecord record, Dictionary <String, dynamic> eventData)
{
foreach (var property in record.Properties)
{
try
{
switch (property.Type)
{
case 1:
eventData[property.Name] = record.GetUnicodeString(property.Name);
break;
case 2:
eventData[property.Name] = record.GetAnsiString(property.Name);
break;
case 3:
eventData[property.Name] = record.GetInt8(property.Name);
break;
case 4:
eventData[property.Name] = record.GetUInt8(property.Name);
break;
case 5:
eventData[property.Name] = record.GetInt16(property.Name);
break;
case 6:
eventData[property.Name] = record.GetUInt16(property.Name);
break;
case 7:
eventData[property.Name] = record.GetInt32(property.Name);
break;
case 8:
eventData[property.Name] = record.GetUInt32(property.Name);
break;
case 9:
eventData[property.Name] = record.GetInt64(property.Name);
break;
case 10:
eventData[property.Name] = record.GetUInt64(property.Name);
break;
case 13:
eventData[property.Name] = record.GetUInt32(property.Name);
break;
case 14:
eventData[property.Name] = record.GetBinary(property.Name);
break;
case 15:
eventData[property.Name] = record.GetBinary(property.Name);
break;
case 20:
eventData[property.Name] = record.GetUInt32(property.Name);
break;
case 21:
eventData[property.Name] = record.GetUInt64(property.Name);
break;
}
}
catch (Exception)
{
eventData[property.Name] = ERROR_PARSING_FIELD;
}
}
}
/// <summary>
/// Try to parse an event record base on the manifest
/// </summary>
/// <param name="record">ETW event record</param>
/// <param name="eventData">eventdata that will be filled by the parser</param>
public void Parse(IEventRecord record, Dictionary <String, dynamic> eventData)
{
foreach (var eventDefinition in this.Scheme.instrumentation.events.provider.events)
{
if (Int16.Parse(eventDefinition.value) != record.Id)
{
continue;
}
var template = this.Scheme.instrumentation.events.provider.templates.Where(x => x.tid == eventDefinition.template).Single();
foreach (var data in template.datas)
{
try
{
switch (data.inType)
{
case Manifest.Data.InType.UnicodeString:
eventData[data.name] = record.GetUnicodeString(data.name);
break;
case Manifest.Data.InType.AnsiString:
eventData[data.name] = record.GetAnsiString(data.name);
break;
case Manifest.Data.InType.GUID:
eventData[data.name] = record.GetBinary(data.name);
break;
case Manifest.Data.InType.UInt32:
eventData[data.name] = record.GetUInt32(data.name);
break;
case Manifest.Data.InType.HexInt32:
eventData[data.name] = record.GetInt32(data.name);
break;
case Manifest.Data.InType.HexInt64:
eventData[data.name] = record.GetInt64(data.name);
break;
case Manifest.Data.InType.Boolean:
eventData[data.name] = record.GetUInt32(data.name);
break;
case Manifest.Data.InType.UInt16:
eventData[data.name] = record.GetUInt16(data.name);
break;
case Manifest.Data.InType.Binary:
eventData[data.name] = record.GetBinary(data.name);
break;
case Manifest.Data.InType.UInt64:
eventData[data.name] = record.GetUInt64(data.name);
break;
case Manifest.Data.InType.Double:
eventData[data.name] = record.GetUInt64(data.name);
break;
case Manifest.Data.InType.UInt8:
eventData[data.name] = record.GetUInt8(data.name);
break;
case Manifest.Data.InType.Int8:
eventData[data.name] = record.GetInt64(data.name);
break;
case Manifest.Data.InType.Int16:
eventData[data.name] = record.GetInt16(data.name);
break;
case Manifest.Data.InType.Int32:
eventData[data.name] = record.GetInt32(data.name);
break;
case Manifest.Data.InType.Int64:
eventData[data.name] = record.GetInt64(data.name);
break;
case Manifest.Data.InType.FILETIME:
eventData[data.name] = record.GetBinary(data.name);
break;
case Manifest.Data.InType.Pointer:
eventData[data.name] = record.GetBinary(data.name);
break;
case Manifest.Data.InType.SYSTEMTIME:
eventData[data.name] = record.GetDateTime(data.name);
break;
case Manifest.Data.InType.SID:
eventData[data.name] = record.GetBinary(data.name);
break;
case Manifest.Data.InType.Float:
eventData[data.name] = record.GetUInt32(data.name);
break;
}
}
catch (Exception)
{
eventData[data.name] = ERROR_PARSING_FIELD;
}
}
break;
}
}