public static object EvtGetPublisherMetadataProperty(EventLogHandle pmHandle, UnsafeNativeMethods.EvtPublisherMetadataPropertyId thePropertyId) { object obj2; IntPtr zero = IntPtr.Zero; EventLogPermissionHolder.GetEventLogPermission().Demand(); try { int num; bool flag = UnsafeNativeMethods.EvtGetPublisherMetadataProperty(pmHandle, thePropertyId, 0, 0, IntPtr.Zero, out num); int errorCode = Marshal.GetLastWin32Error(); if (!flag && (errorCode != 0x7a)) { EventLogException.Throw(errorCode); } zero = Marshal.AllocHGlobal(num); flag = UnsafeNativeMethods.EvtGetPublisherMetadataProperty(pmHandle, thePropertyId, 0, num, zero, out num); errorCode = Marshal.GetLastWin32Error(); if (!flag) { EventLogException.Throw(errorCode); } UnsafeNativeMethods.EvtVariant val = (UnsafeNativeMethods.EvtVariant)Marshal.PtrToStructure(zero, typeof(UnsafeNativeMethods.EvtVariant)); obj2 = ConvertToObject(val); } finally { if (zero != IntPtr.Zero) { Marshal.FreeHGlobal(zero); } } return obj2; }
public static object EvtGetQueryInfo(EventLogHandle handle, UnsafeNativeMethods.EvtQueryPropertyId enumType) { object obj2; IntPtr zero = IntPtr.Zero; int bufferRequired = 0; try { bool flag = UnsafeNativeMethods.EvtGetQueryInfo(handle, enumType, 0, IntPtr.Zero, ref bufferRequired); int errorCode = Marshal.GetLastWin32Error(); if (!flag && (errorCode != 0x7a)) { EventLogException.Throw(errorCode); } zero = Marshal.AllocHGlobal(bufferRequired); flag = UnsafeNativeMethods.EvtGetQueryInfo(handle, enumType, bufferRequired, zero, ref bufferRequired); errorCode = Marshal.GetLastWin32Error(); if (!flag) { EventLogException.Throw(errorCode); } UnsafeNativeMethods.EvtVariant val = (UnsafeNativeMethods.EvtVariant)Marshal.PtrToStructure(zero, typeof(UnsafeNativeMethods.EvtVariant)); obj2 = ConvertToObject(val); } finally { if (zero != IntPtr.Zero) { Marshal.FreeHGlobal(zero); } } return obj2; }
protected bool GetRenderValues(IntPtr hContext, IntPtr hEvent, UnsafeNativeMethods.EvtRenderFlags flags, ref int dwBufferSize, ref IntPtr pRenderedValues, ref int dwBufferUsed, ref int dwPropertyCount, ref int status) { try { if (!UnsafeNativeMethods.EvtRender(hContext, hEvent, flags, dwBufferSize, pRenderedValues, out dwBufferUsed, out dwPropertyCount)) { if (UnsafeNativeMethods.ERROR_INSUFFICIENT_BUFFER == (status = Marshal.GetLastWin32Error())) { dwBufferSize = dwBufferUsed; pRenderedValues = pRenderedValues == IntPtr.Zero ? Marshal.AllocHGlobal((IntPtr)dwBufferSize) : Marshal.ReAllocHGlobal(pRenderedValues, (IntPtr)dwBufferSize); if (pRenderedValues != IntPtr.Zero) { if (UnsafeNativeMethods.EvtRender(hContext, hEvent, flags, dwBufferSize, pRenderedValues, out dwBufferUsed, out dwPropertyCount)) { return true; } } } status = Marshal.GetLastWin32Error(); } else { return true; } } catch { status = (int)UnsafeNativeMethods.ERROR_UNHANDLED_EXCEPTION; } return false; }
public static DateTime ConvertFileTimeToDateTime(UnsafeNativeMethods.EvtVariant val) { if (val.Type != 0x11) { throw new EventLogInvalidDataException(); } return DateTime.FromFileTime((long)val.FileTime); }
public static void EvtSetChannelConfigProperty(EventLogHandle handle, UnsafeNativeMethods.EvtChannelConfigPropertyId enumType, object val) { EventLogPermissionHolder.GetEventLogPermission().Demand(); UnsafeNativeMethods.EvtVariant propertyValue = new UnsafeNativeMethods.EvtVariant(); CoTaskMemSafeHandle handle2 = new CoTaskMemSafeHandle(); using (handle2) { bool flag; if (val == null) { goto Label_017B; } switch (enumType) { case UnsafeNativeMethods.EvtChannelConfigPropertyId.EvtChannelConfigEnabled: propertyValue.Type = 13; if (!((bool)val)) { break; } propertyValue.Bool = 1; goto Label_0183; case UnsafeNativeMethods.EvtChannelConfigPropertyId.EvtChannelConfigAccess: propertyValue.Type = 1; handle2.SetMemory(Marshal.StringToCoTaskMemAuto((string)val)); propertyValue.StringVal = handle2.GetMemory(); goto Label_0183; case UnsafeNativeMethods.EvtChannelConfigPropertyId.EvtChannelLoggingConfigRetention: propertyValue.Type = 13; if (!((bool)val)) { goto Label_0146; } propertyValue.Bool = 1; goto Label_0183; case UnsafeNativeMethods.EvtChannelConfigPropertyId.EvtChannelLoggingConfigAutoBackup: propertyValue.Type = 13; if (!((bool)val)) { goto Label_016B; } propertyValue.Bool = 1; goto Label_0183; case UnsafeNativeMethods.EvtChannelConfigPropertyId.EvtChannelLoggingConfigMaxSize: propertyValue.Type = 10; propertyValue.ULong = (ulong)((long)val); goto Label_0183; case UnsafeNativeMethods.EvtChannelConfigPropertyId.EvtChannelLoggingConfigLogFilePath: propertyValue.Type = 1; handle2.SetMemory(Marshal.StringToCoTaskMemAuto((string)val)); propertyValue.StringVal = handle2.GetMemory(); goto Label_0183; case UnsafeNativeMethods.EvtChannelConfigPropertyId.EvtChannelPublishingConfigLevel: propertyValue.Type = 8; propertyValue.UInteger = (uint)((int)val); goto Label_0183; case UnsafeNativeMethods.EvtChannelConfigPropertyId.EvtChannelPublishingConfigKeywords: propertyValue.Type = 10; propertyValue.ULong = (ulong)((long)val); goto Label_0183; default: throw new InvalidOperationException(); } propertyValue.Bool = 0; goto Label_0183; Label_0146: propertyValue.Bool = 0; goto Label_0183; Label_016B: propertyValue.Bool = 0; goto Label_0183; Label_017B: propertyValue.Type = 0; Label_0183: flag = UnsafeNativeMethods.EvtSetChannelConfigProperty(handle, enumType, 0, ref propertyValue); int errorCode = Marshal.GetLastWin32Error(); if (!flag) { EventLogException.Throw(errorCode); } } }
private static object ConvertToObject(UnsafeNativeMethods.EvtVariant val) { switch (val.Type) { case 0: return null; case 1: return ConvertToString(val); case 2: return ConvertToAnsiString(val); case 3: return val.SByte; case 4: return val.UInt8; case 5: return val.SByte; case 6: return val.UShort; case 7: return val.Integer; case 8: return val.UInteger; case 9: return val.Long; case 10: return val.ULong; case 12: return val.Double; case 13: if (val.Bool == 0) { return false; } return true; case 14: return ConvertToBinaryArray(val); case 15: return ConvertToGuid(val); case 0x11: return ConvertFileTimeToDateTime(val); case 0x13: return ConvertToSid(val); case 20: return val.Integer; case 0x15: return val.ULong; case 0x20: return ConvertToSafeHandle(val); case 0x81: return ConvertToStringArray(val); case 0x88: return ConvertToIntArray(val); } throw new EventLogInvalidDataException(); }
public static SecurityIdentifier ConvertToSid(UnsafeNativeMethods.EvtVariant val) { if (val.Type != 0x13) { throw new EventLogInvalidDataException(); } if (val.SidVal == IntPtr.Zero) { return null; } return new SecurityIdentifier(val.SidVal); }
public static void EvtRenderBufferWithContextSystem(EventLogHandle contextHandle, EventLogHandle eventHandle, UnsafeNativeMethods.EvtRenderFlags flag, SystemProperties systemProperties, int SYSTEM_PROPERTY_COUNT) { IntPtr zero = IntPtr.Zero; IntPtr ptr = IntPtr.Zero; EventLogPermissionHolder.GetEventLogPermission().Demand(); try { int num; int num2; if (!UnsafeNativeMethods.EvtRender(contextHandle, eventHandle, flag, 0, IntPtr.Zero, out num, out num2)) { int num3 = Marshal.GetLastWin32Error(); if (num3 != 0x7a) { EventLogException.Throw(num3); } } zero = Marshal.AllocHGlobal(num); bool flag2 = UnsafeNativeMethods.EvtRender(contextHandle, eventHandle, flag, num, zero, out num, out num2); int errorCode = Marshal.GetLastWin32Error(); if (!flag2) { EventLogException.Throw(errorCode); } if (num2 != SYSTEM_PROPERTY_COUNT) { throw new InvalidOperationException("We do not have " + SYSTEM_PROPERTY_COUNT + " variants given for the UnsafeNativeMethods.EvtRenderFlags.EvtRenderEventValues flag. (System Properties)"); } ptr = zero; for (int i = 0; i < num2; i++) { UnsafeNativeMethods.EvtVariant val = (UnsafeNativeMethods.EvtVariant)Marshal.PtrToStructure(ptr, typeof(UnsafeNativeMethods.EvtVariant)); switch (i) { case 0: systemProperties.ProviderName = (string)ConvertToObject(val, UnsafeNativeMethods.EvtVariantType.EvtVarTypeString); break; case 1: systemProperties.ProviderId = (Guid?)ConvertToObject(val, UnsafeNativeMethods.EvtVariantType.EvtVarTypeGuid); break; case 2: systemProperties.Id = (ushort?)ConvertToObject(val, UnsafeNativeMethods.EvtVariantType.EvtVarTypeUInt16); break; case 3: systemProperties.Qualifiers = (ushort?)ConvertToObject(val, UnsafeNativeMethods.EvtVariantType.EvtVarTypeUInt16); break; case 4: systemProperties.Level = (byte?)ConvertToObject(val, UnsafeNativeMethods.EvtVariantType.EvtVarTypeByte); break; case 5: systemProperties.Task = (ushort?)ConvertToObject(val, UnsafeNativeMethods.EvtVariantType.EvtVarTypeUInt16); break; case 6: systemProperties.Opcode = (byte?)ConvertToObject(val, UnsafeNativeMethods.EvtVariantType.EvtVarTypeByte); break; case 7: systemProperties.Keywords = (ulong?)ConvertToObject(val, UnsafeNativeMethods.EvtVariantType.EvtVarTypeHexInt64); break; case 8: systemProperties.TimeCreated = (DateTime?)ConvertToObject(val, UnsafeNativeMethods.EvtVariantType.EvtVarTypeFileTime); break; case 9: systemProperties.RecordId = (ulong?)ConvertToObject(val, UnsafeNativeMethods.EvtVariantType.EvtVarTypeUInt64); break; case 10: systemProperties.ActivityId = (Guid?)ConvertToObject(val, UnsafeNativeMethods.EvtVariantType.EvtVarTypeGuid); break; case 11: systemProperties.RelatedActivityId = (Guid?)ConvertToObject(val, UnsafeNativeMethods.EvtVariantType.EvtVarTypeGuid); break; case 12: systemProperties.ProcessId = (uint?)ConvertToObject(val, UnsafeNativeMethods.EvtVariantType.EvtVarTypeUInt32); break; case 13: systemProperties.ThreadId = (uint?)ConvertToObject(val, UnsafeNativeMethods.EvtVariantType.EvtVarTypeUInt32); break; case 14: systemProperties.ChannelName = (string)ConvertToObject(val, UnsafeNativeMethods.EvtVariantType.EvtVarTypeString); break; case 15: systemProperties.ComputerName = (string)ConvertToObject(val, UnsafeNativeMethods.EvtVariantType.EvtVarTypeString); break; case 0x10: systemProperties.UserId = (SecurityIdentifier)ConvertToObject(val, UnsafeNativeMethods.EvtVariantType.EvtVarTypeSid); break; case 0x11: systemProperties.Version = (byte?)ConvertToObject(val, UnsafeNativeMethods.EvtVariantType.EvtVarTypeByte); break; } ptr = new IntPtr(((long)ptr) + Marshal.SizeOf(val)); } } finally { if (zero != IntPtr.Zero) { Marshal.FreeHGlobal(zero); } } }
public static object ConvertToObject(UnsafeNativeMethods.EvtVariant val, UnsafeNativeMethods.EvtVariantType desiredType) { if (val.Type == 0) { return null; } if (val.Type != ((long)desiredType)) { throw new EventLogInvalidDataException(); } return ConvertToObject(val); }
public static EventLogHandle ConvertToSafeHandle(UnsafeNativeMethods.EvtVariant val) { if (val.Type != 0x20) { throw new EventLogInvalidDataException(); } if (val.Handle == IntPtr.Zero) { return EventLogHandle.Zero; } return new EventLogHandle(val.Handle, true); }
public static int[] ConvertToIntArray(UnsafeNativeMethods.EvtVariant val) { if (val.Type != 0x88) { throw new EventLogInvalidDataException(); } if (val.Reference == IntPtr.Zero) { return new int[0]; } IntPtr reference = val.Reference; int[] destination = new int[val.Count]; Marshal.Copy(reference, destination, 0, (int)val.Count); return destination; }
public static Guid ConvertToGuid(UnsafeNativeMethods.EvtVariant val) { if (val.Type != 15) { throw new EventLogInvalidDataException(); } if (val.GuidReference == IntPtr.Zero) { return Guid.Empty; } return (Guid)Marshal.PtrToStructure(val.GuidReference, typeof(Guid)); }
public static byte[] ConvertToBinaryArray(UnsafeNativeMethods.EvtVariant val) { if (val.Type != 14) { throw new EventLogInvalidDataException(); } if (val.Binary == IntPtr.Zero) { return new byte[0]; } IntPtr binary = val.Binary; byte[] destination = new byte[val.Count]; Marshal.Copy(binary, destination, 0, (int)val.Count); return destination; }
public static EventLogHandle EvtOpenSession(UnsafeNativeMethods.EvtLoginClass loginClass, ref UnsafeNativeMethods.EvtRpcLogin login, int timeout, int flags) { if (s_platformNotSupported) { throw new PlatformNotSupportedException(); } EventLogHandle handle = UnsafeNativeMethods.EvtOpenSession(loginClass, ref login, timeout, flags); int errorCode = Marshal.GetLastWin32Error(); if (handle.IsInvalid) { EventLogException.Throw(errorCode); } return handle; }
public static string ConvertToString(UnsafeNativeMethods.EvtVariant val) { if (val.Type != 1) { throw new EventLogInvalidDataException(); } if (val.StringVal == IntPtr.Zero) { return string.Empty; } return Marshal.PtrToStringAuto(val.StringVal); }
public static void EvtRender(EventLogHandle context, EventLogHandle eventHandle, UnsafeNativeMethods.EvtRenderFlags flags, StringBuilder buffer) { int num; int num2; if (s_platformNotSupported) { throw new PlatformNotSupportedException(); } bool flag = UnsafeNativeMethods.EvtRender(context, eventHandle, flags, buffer.Capacity, buffer, out num, out num2); int errorCode = Marshal.GetLastWin32Error(); if (!flag) { if (errorCode == 0x7a) { buffer.Capacity = num; flag = UnsafeNativeMethods.EvtRender(context, eventHandle, flags, buffer.Capacity, buffer, out num, out num2); errorCode = Marshal.GetLastWin32Error(); } if (!flag) { EventLogException.Throw(errorCode); } } }
public static string[] ConvertToStringArray(UnsafeNativeMethods.EvtVariant val) { if (val.Type != 0x81) { throw new EventLogInvalidDataException(); } if (val.Reference == IntPtr.Zero) { return new string[0]; } IntPtr reference = val.Reference; IntPtr[] destination = new IntPtr[val.Count]; Marshal.Copy(reference, destination, 0, (int)val.Count); string[] strArray = new string[val.Count]; for (int i = 0; i < val.Count; i++) { strArray[i] = Marshal.PtrToStringAuto(destination[i]); } return strArray; }
public static void EvtSeek(EventLogHandle resultSet, long position, EventLogHandle bookmark, int timeout, UnsafeNativeMethods.EvtSeekFlags flags) { bool flag = UnsafeNativeMethods.EvtSeek(resultSet, position, bookmark, timeout, flags); int errorCode = Marshal.GetLastWin32Error(); if (!flag) { EventLogException.Throw(errorCode); } }
public static EventLogHandle EvtCreateRenderContext(int valuePathsCount, string[] valuePaths, UnsafeNativeMethods.EvtRenderContextFlags flags) { if (s_platformNotSupported) { throw new PlatformNotSupportedException(); } EventLogHandle handle = UnsafeNativeMethods.EvtCreateRenderContext(valuePathsCount, valuePaths, flags); int errorCode = Marshal.GetLastWin32Error(); if (handle.IsInvalid) { EventLogException.Throw(errorCode); } return handle; }
internal static EventLogHandle EvtGetPublisherMetadataPropertyHandle(EventLogHandle pmHandle, UnsafeNativeMethods.EvtPublisherMetadataPropertyId thePropertyId) { EventLogHandle handle; IntPtr zero = IntPtr.Zero; try { int num; bool flag = UnsafeNativeMethods.EvtGetPublisherMetadataProperty(pmHandle, thePropertyId, 0, 0, IntPtr.Zero, out num); int errorCode = Marshal.GetLastWin32Error(); if (!flag && (errorCode != 0x7a)) { EventLogException.Throw(errorCode); } zero = Marshal.AllocHGlobal(num); flag = UnsafeNativeMethods.EvtGetPublisherMetadataProperty(pmHandle, thePropertyId, 0, num, zero, out num); errorCode = Marshal.GetLastWin32Error(); if (!flag) { EventLogException.Throw(errorCode); } UnsafeNativeMethods.EvtVariant val = (UnsafeNativeMethods.EvtVariant)Marshal.PtrToStructure(zero, typeof(UnsafeNativeMethods.EvtVariant)); handle = ConvertToSafeHandle(val); } finally { if (zero != IntPtr.Zero) { Marshal.FreeHGlobal(zero); } } return handle; }
public static IEnumerable<string> EvtFormatMessageRenderKeywords(EventLogHandle pmHandle, EventLogHandle eventHandle, UnsafeNativeMethods.EvtFormatMessageFlags flag) { IEnumerable<string> enumerable; EventLogPermissionHolder.GetEventLogPermission().Demand(); IntPtr zero = IntPtr.Zero; try { int num; List<string> list = new List<string>(); bool flag2 = UnsafeNativeMethods.EvtFormatMessageBuffer(pmHandle, eventHandle, 0, 0, IntPtr.Zero, flag, 0, IntPtr.Zero, out num); int errorCode = Marshal.GetLastWin32Error(); if (!flag2) { switch (errorCode) { case 0x3ab9: case 0x3afc: case 0x3ab3: case 0x3ab4: case 0x717: return list.AsReadOnly(); } if (errorCode != 0x7a) { EventLogException.Throw(errorCode); } } zero = Marshal.AllocHGlobal((int)(num * 2)); flag2 = UnsafeNativeMethods.EvtFormatMessageBuffer(pmHandle, eventHandle, 0, 0, IntPtr.Zero, flag, num, zero, out num); errorCode = Marshal.GetLastWin32Error(); if (!flag2) { switch (errorCode) { case 0x3ab9: case 0x3afc: return list; case 0x3ab3: case 0x3ab4: return list; case 0x717: return list; } EventLogException.Throw(errorCode); } IntPtr ptr = zero; while (true) { string str = Marshal.PtrToStringAuto(ptr); if (string.IsNullOrEmpty(str)) { break; } list.Add(str); ptr = new IntPtr((((long)ptr) + (str.Length * 2)) + 2L); } enumerable = list.AsReadOnly(); } finally { if (zero != IntPtr.Zero) { Marshal.FreeHGlobal(zero); } } return enumerable; }
protected bool GetMessageString(IntPtr hMetadata, IntPtr hEvent, UnsafeNativeMethods.EvtFormatMessageFlags FormatId, ref StringBuilder pBuffer, out int dwBufferUsed, ref int status) { pBuffer.Remove(0, pBuffer.Length); if ( !UnsafeNativeMethods.EvtFormatMessage(hMetadata, hEvent, 0, 0, null, FormatId, pBuffer.Capacity, pBuffer, out dwBufferUsed)) { status = Marshal.GetLastWin32Error(); if (UnsafeNativeMethods.ERROR_INSUFFICIENT_BUFFER == status) { pBuffer.EnsureCapacity(dwBufferUsed * 4); UnsafeNativeMethods.EvtFormatMessage(hMetadata, hEvent, 0, 0, null, FormatId, pBuffer.Capacity, pBuffer, out dwBufferUsed); if (UnsafeNativeMethods.EvtFormatMessageFlags.EvtFormatMessageKeyword == FormatId) { pBuffer.Append('\0'); } return true; } } else { if (UnsafeNativeMethods.EvtFormatMessageFlags.EvtFormatMessageKeyword == FormatId) { pBuffer.Append('\0'); } return true; } return false; }
public static string EvtFormatMessageRenderName(EventLogHandle pmHandle, EventLogHandle eventHandle, UnsafeNativeMethods.EvtFormatMessageFlags flag) { int num; EventLogPermissionHolder.GetEventLogPermission().Demand(); StringBuilder buffer = new StringBuilder(null); bool flag2 = UnsafeNativeMethods.EvtFormatMessage(pmHandle, eventHandle, 0, 0, null, flag, 0, buffer, out num); int errorCode = Marshal.GetLastWin32Error(); if (!flag2 && (errorCode != 0x3ab5)) { switch (errorCode) { case 0x3ab9: case 0x3afc: case 0x3ab3: case 0x3ab4: case 0x717: return null; } if (errorCode != 0x7a) { EventLogException.Throw(errorCode); } } buffer.EnsureCapacity(num); flag2 = UnsafeNativeMethods.EvtFormatMessage(pmHandle, eventHandle, 0, 0, null, flag, num, buffer, out num); errorCode = Marshal.GetLastWin32Error(); if (!flag2 && (errorCode != 0x3ab5)) { switch (errorCode) { case 0x3ab9: case 0x3afc: case 0x3ab3: case 0x3ab4: case 0x717: return null; } EventLogException.Throw(errorCode); } return buffer.ToString(); }
internal object GetProviderListProperty(EventLogHandle providerHandle, UnsafeNativeMethods.EvtPublisherMetadataPropertyId metadataProperty) { EventLogHandle elHandle = EventLogHandle.Zero; try { UnsafeNativeMethods.EvtPublisherMetadataPropertyId propName; UnsafeNativeMethods.EvtPublisherMetadataPropertyId propValue; UnsafeNativeMethods.EvtPublisherMetadataPropertyId propMessageId; ObjectTypeName objectTypeName; List<EventLevel> levelList = null; List<EventOpcode> opcodeList = null; List<EventKeyword> keywordList = null; List<EventTask> taskList = null; elHandle = NativeWrapper.EvtGetPublisherMetadataPropertyHandle(providerHandle, metadataProperty); int arraySize = NativeWrapper.EvtGetObjectArraySize(elHandle); switch (metadataProperty) { case UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataLevels: propName = UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataLevelName; propValue = UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataLevelValue; propMessageId = UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataLevelMessageID; objectTypeName = ObjectTypeName.Level; levelList = new List<EventLevel>(arraySize); break; case UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataOpcodes: propName = UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataOpcodeName; propValue = UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataOpcodeValue; propMessageId = UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataOpcodeMessageID; objectTypeName = ObjectTypeName.Opcode; opcodeList = new List<EventOpcode>(arraySize); break; case UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataKeywords: propName = UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataKeywordName; propValue = UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataKeywordValue; propMessageId = UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataKeywordMessageID; objectTypeName = ObjectTypeName.Keyword; keywordList = new List<EventKeyword>(arraySize); break; case UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataTasks: propName = UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataTaskName; propValue = UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataTaskValue; propMessageId = UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataTaskMessageID; objectTypeName = ObjectTypeName.Task; taskList = new List<EventTask>(arraySize); break; default: return null; } for (int index = 0; index < arraySize; index++) { string generalName = (string)NativeWrapper.EvtGetObjectArrayProperty(elHandle, index, (int)propName); uint generalValue = 0; long generalValueKeyword = 0; if (objectTypeName != ObjectTypeName.Keyword) { generalValue = (uint)NativeWrapper.EvtGetObjectArrayProperty(elHandle, index, (int)propValue); } else { generalValueKeyword = unchecked((long)((ulong)NativeWrapper.EvtGetObjectArrayProperty(elHandle, index, (int)propValue))); } int generalMessageId = unchecked((int)((uint)NativeWrapper.EvtGetObjectArrayProperty(elHandle, index, (int)propMessageId))); string generalDisplayName = null; if (generalMessageId == -1) { if (providerHandle != _defaultProviderHandle) { if (_defaultProviderHandle.IsInvalid) { _defaultProviderHandle = NativeWrapper.EvtOpenProviderMetadata(_session.Handle, null, null, 0, 0); } switch (objectTypeName) { case ObjectTypeName.Level: generalDisplayName = FindStandardLevelDisplayName(generalName, generalValue); break; case ObjectTypeName.Opcode: generalDisplayName = FindStandardOpcodeDisplayName(generalName, generalValue >> 16); break; case ObjectTypeName.Keyword: generalDisplayName = FindStandardKeywordDisplayName(generalName, generalValueKeyword); break; case ObjectTypeName.Task: generalDisplayName = FindStandardTaskDisplayName(generalName, generalValue); break; default: generalDisplayName = null; break; } } } else { generalDisplayName = NativeWrapper.EvtFormatMessage(providerHandle, unchecked((uint)generalMessageId)); } switch (objectTypeName) { case ObjectTypeName.Level: levelList.Add(new EventLevel(generalName, (int)generalValue, generalDisplayName)); break; case ObjectTypeName.Opcode: opcodeList.Add(new EventOpcode(generalName, (int)(generalValue >> 16), generalDisplayName)); break; case ObjectTypeName.Keyword: keywordList.Add(new EventKeyword(generalName, (long)generalValueKeyword, generalDisplayName)); break; case ObjectTypeName.Task: Guid taskGuid = (Guid)NativeWrapper.EvtGetObjectArrayProperty(elHandle, index, (int)UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataTaskEventGuid); taskList.Add(new EventTask(generalName, (int)generalValue, generalDisplayName, taskGuid)); break; default: return null; } } switch (objectTypeName) { case ObjectTypeName.Level: return levelList; case ObjectTypeName.Opcode: return opcodeList; case ObjectTypeName.Keyword: return keywordList; case ObjectTypeName.Task: return taskList; } return null; } finally { elHandle.Dispose(); } }
internal object GetProviderListProperty(EventLogHandle providerHandle, UnsafeNativeMethods.EvtPublisherMetadataPropertyId metadataProperty) { object obj2; EventLogHandle zero = EventLogHandle.Zero; EventLogPermissionHolder.GetEventLogPermission().Demand(); try { UnsafeNativeMethods.EvtPublisherMetadataPropertyId evtPublisherMetadataOpcodeName; UnsafeNativeMethods.EvtPublisherMetadataPropertyId evtPublisherMetadataOpcodeValue; UnsafeNativeMethods.EvtPublisherMetadataPropertyId evtPublisherMetadataOpcodeMessageID; ObjectTypeName opcode; List<EventLevel> list = null; List<EventOpcode> list2 = null; List<EventKeyword> list3 = null; List<EventTask> list4 = null; zero = NativeWrapper.EvtGetPublisherMetadataPropertyHandle(providerHandle, metadataProperty); int capacity = NativeWrapper.EvtGetObjectArraySize(zero); switch (metadataProperty) { case UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataOpcodes: evtPublisherMetadataOpcodeName = UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataOpcodeName; evtPublisherMetadataOpcodeValue = UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataOpcodeValue; evtPublisherMetadataOpcodeMessageID = UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataOpcodeMessageID; opcode = ObjectTypeName.Opcode; list2 = new List<EventOpcode>(capacity); break; case UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataKeywords: evtPublisherMetadataOpcodeName = UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataKeywordName; evtPublisherMetadataOpcodeValue = UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataKeywordValue; evtPublisherMetadataOpcodeMessageID = UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataKeywordMessageID; opcode = ObjectTypeName.Keyword; list3 = new List<EventKeyword>(capacity); break; case UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataLevels: evtPublisherMetadataOpcodeName = UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataLevelName; evtPublisherMetadataOpcodeValue = UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataLevelValue; evtPublisherMetadataOpcodeMessageID = UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataLevelMessageID; opcode = ObjectTypeName.Level; list = new List<EventLevel>(capacity); break; case UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataTasks: evtPublisherMetadataOpcodeName = UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataTaskName; evtPublisherMetadataOpcodeValue = UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataTaskValue; evtPublisherMetadataOpcodeMessageID = UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataTaskMessageID; opcode = ObjectTypeName.Task; list4 = new List<EventTask>(capacity); break; default: return null; } for (int i = 0; i < capacity; i++) { string name = (string)NativeWrapper.EvtGetObjectArrayProperty(zero, i, (int)evtPublisherMetadataOpcodeName); uint num3 = 0; long num4 = 0L; if (opcode != ObjectTypeName.Keyword) { num3 = (uint)NativeWrapper.EvtGetObjectArrayProperty(zero, i, (int)evtPublisherMetadataOpcodeValue); } else { num4 = (long)((ulong)NativeWrapper.EvtGetObjectArrayProperty(zero, i, (int)evtPublisherMetadataOpcodeValue)); } int num5 = (int)((uint)NativeWrapper.EvtGetObjectArrayProperty(zero, i, (int)evtPublisherMetadataOpcodeMessageID)); string displayName = null; if (num5 == -1) { if (providerHandle != this.defaultProviderHandle) { if (this.defaultProviderHandle.IsInvalid) { this.defaultProviderHandle = NativeWrapper.EvtOpenProviderMetadata(this.session.Handle, null, null, this.cultureInfo.LCID, 0); } switch (opcode) { case ObjectTypeName.Level: displayName = this.FindStandardLevelDisplayName(name, num3); goto Label_01BA; case ObjectTypeName.Opcode: displayName = this.FindStandardOpcodeDisplayName(name, num3 >> 0x10); goto Label_01BA; case ObjectTypeName.Task: displayName = this.FindStandardTaskDisplayName(name, num3); goto Label_01BA; case ObjectTypeName.Keyword: displayName = this.FindStandardKeywordDisplayName(name, num4); goto Label_01BA; } displayName = null; } } else { displayName = NativeWrapper.EvtFormatMessage(providerHandle, (uint)num5); } Label_01BA: switch (opcode) { case ObjectTypeName.Level: list.Add(new EventLevel(name, (int)num3, displayName)); break; case ObjectTypeName.Opcode: list2.Add(new EventOpcode(name, (int)(num3 >> 0x10), displayName)); break; case ObjectTypeName.Task: { Guid guid = (Guid)NativeWrapper.EvtGetObjectArrayProperty(zero, i, 0x12); list4.Add(new EventTask(name, (int)num3, displayName, guid)); break; } case ObjectTypeName.Keyword: list3.Add(new EventKeyword(name, num4, displayName)); break; default: return null; } } switch (opcode) { case ObjectTypeName.Level: return list; case ObjectTypeName.Opcode: return list2; case ObjectTypeName.Task: return list4; case ObjectTypeName.Keyword: return list3; } obj2 = null; } finally { zero.Close(); } return obj2; }