public TraceEventInfoWrapper(LegacyJsonConverter.EventRecord eventRecord) { int BufferSize = 0; int eventInformation1 = TdhGetEventInformation(ref eventRecord, 0U, IntPtr.Zero, IntPtr.Zero, ref BufferSize); if (eventInformation1 == 1168) { hasProperties = false; } else { hasProperties = true; if (eventInformation1 != 122) { throw new Win32Exception(eventInformation1); } address = Marshal.AllocHGlobal(BufferSize); int eventInformation2 = TdhGetEventInformation(ref eventRecord, 0U, IntPtr.Zero, address, ref BufferSize); if (eventInformation2 != 0) { throw new Win32Exception(eventInformation2); } traceEventInfo = (TraceEventInfo)Marshal.PtrToStructure(address, typeof(TraceEventInfo)); int num1 = Marshal.SizeOf((object)traceEventInfo); if (BufferSize != num1) { int num2 = Marshal.SizeOf(typeof(EventPropertyInfo)); int length = (BufferSize - num1) / num2; eventPropertyInfoArray = new EventPropertyInfo[length]; long num3 = address.ToInt64() + num1; for (int index = 0; index < length; ++index) { EventPropertyInfo structure = (EventPropertyInfo)Marshal.PtrToStructure(new IntPtr(num3 + index * num2), typeof(EventPropertyInfo)); eventPropertyInfoArray[index] = structure; } } if (traceEventInfo.LevelNameOffset > 0U) { LevelName = Marshal.PtrToStringUni(new IntPtr(address.ToInt64() + traceEventInfo.LevelNameOffset)); } if (traceEventInfo.ChannelNameOffset > 0U) { ChannelName = Marshal.PtrToStringUni(new IntPtr(address.ToInt64() + traceEventInfo.ChannelNameOffset)); } if (traceEventInfo.TaskNameOffset > 0U) { TaskName = Marshal.PtrToStringUni(new IntPtr(address.ToInt64() + traceEventInfo.TaskNameOffset)); } if (traceEventInfo.EventMessageOffset > 0U) { EventMessageName = Marshal.PtrToStringUni(new IntPtr(address.ToInt64() + traceEventInfo.EventMessageOffset)); } if (traceEventInfo.OpcodeNameOffset <= 0U) { return; } EventName = Marshal.PtrToStringUni(new IntPtr(address.ToInt64() + traceEventInfo.OpcodeNameOffset)); } }
public Dictionary <string, object> GetProperties(LegacyJsonConverter.EventRecord eventRecord) { Dictionary <string, object> dictionary = new Dictionary <string, object>(traceEventInfo.TopLevelPropertyCount); if (hasProperties) { int num1 = 0; IntPtr num2; for (int index = 0; index < traceEventInfo.TopLevelPropertyCount; ++index) { EventPropertyInfo eventPropertyInfo = eventPropertyInfoArray[index]; string stringUni = Marshal.PtrToStringUni(new IntPtr(address.ToInt64() + eventPropertyInfo.NameOffset)); num2 = new IntPtr(eventRecord.UserData.ToInt64() + num1); int length; object obj = null; length = eventPropertyInfo.LengthPropertyIndex; switch (eventPropertyInfo.NonStructTypeValue.InType) { case EventPropertyInfo.TdhInType.UnicodeString: string stringUni2 = Marshal.PtrToStringUni(num2); if (stringUni != null) { length = (stringUni2.Length + 1) * 2; obj = stringUni2; } break; case EventPropertyInfo.TdhInType.Int32: obj = Marshal.ReadInt32(num2); break; case EventPropertyInfo.TdhInType.UInt32: obj = (uint)Marshal.ReadInt32(num2); break; case EventPropertyInfo.TdhInType.Int64: obj = Marshal.ReadInt64(num2); break; case EventPropertyInfo.TdhInType.UInt64: obj = (ulong)Marshal.ReadInt64(num2); break; case EventPropertyInfo.TdhInType.Pointer: obj = Marshal.ReadIntPtr(num2); break; case EventPropertyInfo.TdhInType.FileTime: obj = DateTime.FromFileTime(Marshal.ReadInt64(num2)); break; case EventPropertyInfo.TdhInType.SystemTime: obj = new DateTime(Marshal.ReadInt16(num2), Marshal.ReadInt16(num2, 2), Marshal.ReadInt16(num2, 6), Marshal.ReadInt16(num2, 8), Marshal.ReadInt16(num2, 10), Marshal.ReadInt16(num2, 12), Marshal.ReadInt16(num2, 14)); break; } num1 += length; if (stringUni != null) { dictionary.Add(stringUni, obj); } } if (num1 < eventRecord.UserDataLength) { num2 = new IntPtr(eventRecord.UserData.ToInt64() + num1); int length = eventRecord.UserDataLength - num1; byte[] numArray = new byte[length]; for (int ofs = 0; ofs < length; ++ofs) { numArray[ofs] = Marshal.ReadByte(num2, ofs); } dictionary.Add("__ExtraPayload", numArray); } } else { string stringUni = Marshal.PtrToStringUni(eventRecord.UserData); dictionary.Add("EventData", stringUni); } return(dictionary); }