예제 #1
0
    public TemplateInstance(long recordPosition, BinaryReader dataStream, ChunkInfo chunk)
    {
        RecordPosition = recordPosition;
        Size           = 10; //default size until we know better

        SubstitutionEntries = new List <SubstitutionArrayEntry>();

        var version = dataStream.ReadByte();

        //TODO
        //can we not track these internally since they are just going to be in the Template itself anyways?
        dataStream.ReadInt32(); //TemplateId

        var templateOffset = dataStream.ReadInt32();

        dataStream.ReadInt32(); //NextTemplateOffset

        Template = chunk.GetTemplate(templateOffset);

        Size = Template.Size;
        if (templateOffset < recordPosition)
        {
            //the template has already been defined, so we need to back up before NextTemplateOffset
            dataStream.BaseStream.Seek(-4, SeekOrigin.Current);
        }
        else
        {
            //new template, so we have to slide forward a bit to get to beginning of template
            dataStream.BaseStream.Seek(0x14, SeekOrigin.Current);
            //we do not need to process the template bytes here since we did it once when the chunk was originally processed
            dataStream.BaseStream.Seek(Size, SeekOrigin.Current);
        }

        //Template contains the...TEMPLATE and it has a Nodes collection to use later. This, along with the substitution stuff coming next, are what is needed to build an event record.

        //substitution array starts here
        //first is 32 bit # with how many to expect
        //followed by that # of pairs of 16 bit numbers, first is length, second is type
        var substitutionArrayLen = dataStream.ReadInt32();

        Log.Verbose("      Substitution length: 0x{Length:X}", substitutionArrayLen);

        var totalSubstitutionSize = 0;

        for (var i = 0; i < substitutionArrayLen; i++)
        {
            var subSize = dataStream.ReadUInt16();
            var subType = dataStream.ReadUInt16();

            totalSubstitutionSize += subSize;

            Log.Verbose(
                "     Position: {I} Size: 0x{Size} Type: {Type}", i.ToString().PadRight(5), subSize.ToString("X").PadRight(5), (TagBuilder.ValueType)subType);

            SubstitutionEntries.Add(new SubstitutionArrayEntry(i, subSize, (TagBuilder.ValueType)subType));
        }

        Log.Verbose("Substitution data length: 0x{Size:X}", totalSubstitutionSize);
        //get the data into the substitution array entries
        foreach (var substitutionArrayEntry in SubstitutionEntries)
        {
            substitutionArrayEntry.DataBytes = dataStream.ReadBytes(substitutionArrayEntry.Size);
            Log.Verbose("       {Entry}", substitutionArrayEntry);
        }
    }