public void ProcessNotification(dm_NotifyHdr notificationHeader, BinaryReader paramsReader) { dm_NotifyCode notificationType = (dm_NotifyCode)notificationHeader.code; switch (notificationType) { case dm_NotifyCode.dm_NotifyCode_Write: case dm_NotifyCode.dm_NotifyCode_Read: case dm_NotifyCode.dm_NotifyCode_FastIoRead: case dm_NotifyCode.dm_NotifyCode_FastIoWrite: var writeParams = paramsReader.ReadStruct <dm_ReadWriteNotifyParams>(); long remainingParamSize = notificationHeader.paramSize - Marshal.SizeOf(typeof(dm_ReadWriteNotifyParams)); if (writeParams.dataSize > remainingParamSize) { // TODO: Remember this packet and expect its continued packet Console.WriteLine("[!] Truncated packet."); } int dataSize = (int)Math.Min(writeParams.dataSize, remainingParamSize); byte[] data = paramsReader.ReadBytes(dataSize); OnReadWritePacketReceived(notificationHeader, writeParams, data, notificationType == dm_NotifyCode.dm_NotifyCode_Write); break; case dm_NotifyCode.dm_NotifyCode_Create: case dm_NotifyCode.dm_NotifyCode_CreateNamedPipe: dm_CreateNotifyParams createParams = notificationType == dm_NotifyCode.dm_NotifyCode_CreateNamedPipe ? paramsReader.ReadStruct <dm_CreateNamedPipeNotifyParams>().createParams : paramsReader.ReadStruct <dm_CreateNotifyParams>(); int pipeFileNameLength = (int)createParams.fileNameLength * 2; string pipeName = Encoding.Unicode.GetString(paramsReader.ReadBytes(pipeFileNameLength)); paramsReader.ReadUInt16(); // read the NULL-terminate OnCreatePacketReceived(notificationHeader, createParams, pipeName); break; case dm_NotifyCode.dm_NotifyCode_Close: dm_CloseNotifyParams closeParams = paramsReader.ReadStruct <dm_CloseNotifyParams>(); OnClosePacketReceived(notificationHeader, closeParams); break; } if (useExtraStreamBuffering) { long catchUp = tdevBufferedStream.WritePosition - tdevBufferedStream.ReadPosition; //if (catchUp > 1000) // Console.WriteLine("Position catch-up: {0}", catchUp); } }
public void OnClosePacketReceived(dm_NotifyHdr notificationHeader, dm_CloseNotifyParams closeParams) { UInt64 fileID = closeParams.fileId; List <NamedPipeInfo> matchingPipes = namedPipeFiles.Values.Where((x) => x.FileObjects.Contains(fileID)).ToList(); if (matchingPipes.Count != 1 && recordingOnlyNewMojoPipes) { throw new Exception("I will not suffer inconcicentcies."); } if (matchingPipes.Count == 1) { matchingPipes[0].FileObjects.Remove(fileID); } }