private bool ApplyFilterCategoryEventToEventItem(EventItem ei)
        {
            bool washidden = ei.IsHidden;

            switch (ei.Event)
            {
            case "CreateProcess":
            case "CreateProcessAsUser":
                if ((bool)cbCatProcess.IsChecked)
                {
                    ei.IsEventCatHidden = false;
                }
                else
                {
                    ei.IsEventCatHidden = true;
                }
                break;

            case "CreateFile":
            case "CreateFile2":
            case "CopyFile":
            case "CopyFile2":
            case "CopyFileEx":
            case "CreateHardLink":
            case "CreateSymbolicLink":
            case "DeleteFile":
            case "MoveFile":
            case "MoveFileEx":
            case "ReplaceFile":
            case "FindFirstFile":
            case "FindFirstFileEx":
            case "FindNextFile":
            case "FindClose":
            case "CreateDirectory":
            case "CreateDirectoryEx":
            case "RemoveDirectory":
            case "SetCurrentDirectory":
            case "GetCurrentDirectory":
            case "GetFileAttributes":
            case "SetFileAttributes":
            case "GetFileAttributesEx":
                if ((bool)cbCatFile.IsChecked)
                {
                    ei.IsEventCatHidden = false;
                }
                else
                {
                    ei.IsEventCatHidden = true;
                }
                break;

            case "RegCreateKey":
            case "RegCreateKeyEx":
            case "RegOpenKey":
            case "RegOpenKeyEx":
            case "RegGetValue":
            case "RegQueryValue":
            case "RegQueryValueEx":
            case "RegSetKeyValue":
            case "RegSetValue":
            case "RegSetValueEx":
            case "RegDeleteKey":
            case "RegDeleteKeyEx":
            case "RegDeleteKeyValue":
            case "RegDeleteValue":
            case "RegDeleteTree":
            case "RegCopyTree":
            case "RegEnumKey":
            case "RegEnumKeyEx":
            case "RegEnumValue":
                if ((bool)cbCatReg.IsChecked)
                {
                    ei.IsEventCatHidden = false;
                }
                else
                {
                    ei.IsEventCatHidden = true;
                }
                break;

            // NT Level
            case "NtCreateFile":
            case "NtOpenFile":
            case "NtCreateDirectoryObject":
            case "NtOpenDirectoryObject":
            case "NtQueryDirectoryObject":
            case "NtOpenSymbolicLinkObject":
            case "NtQuerySymbolicLinkObject":
                if ((bool)cbCatNTFile.IsChecked)
                {
                    ei.IsEventCatHidden = false;
                }
                else
                {
                    ei.IsEventCatHidden = true;
                }
                break;

            case "NtCreateKey":
            case "NtOpenKey":
            case "NtOpenKeyEx":
            case "NtSetValueKey":
            case "NtQueryValueKey":
                if ((bool)cbCatNTReg.IsChecked)
                {
                    ei.IsEventCatHidden = false;
                }
                else
                {
                    ei.IsEventCatHidden = true;
                }
                break;

            case "AddDllDirectory":
            case "LoadLibrary":
            case "LoadLibraryEx":
            case "LoadModule":
            case "LoadPackagedLibrary":
            case "RemoveDllDirectory":
            case "SetDefaultDllDirectories":
            case "SetDllDirectory":
                if ((bool)cbCatDll.IsChecked)
                {
                    ei.IsEventCatHidden = false;
                }
                else
                {
                    ei.IsEventCatHidden = true;
                }
                break;

            // Kernel traces
            case "Process/Start":
            case "Process/Stop":
                if ((bool)cbCatKernelProcess.IsChecked)
                {
                    ei.IsEventCatHidden = false;
                }
                else
                {
                    ei.IsEventCatHidden = true;
                }
                break;

            case "Image/Load":
                if ((bool)cbCatKernelImageLoad.IsChecked)
                {
                    ei.IsEventCatHidden = false;
                }
                else
                {
                    ei.IsEventCatHidden = true;
                }
                break;

            case "FileIO/Query":
            case "FileIO/QueryInfo":
            case "FileIO/Create":
            case "FileIO/FileCreate":
            case "FileIO/Read":
            case "FileIO/Write":
            case "FileIO/Close":
            case "FileIO/Cleanup":
            case "FileIO/OperationEnd":
            case "FileIO/DirEnum":
            case "FileIO/SetInfo":
            case "FileIO/Rename":
            case "FileIO/Delete":
            case "FileIO/FileDelete":
            case "FileIO/Flush":
                if ((bool)cbCatKernelFile.IsChecked)
                {
                    ei.IsEventCatHidden = false;
                }
                else
                {
                    ei.IsEventCatHidden = true;
                }
                break;

            case "DiskIO/Read":
            case "DiskIO/Write":
                if ((bool)cbCatKernelDisk.IsChecked)
                {
                    ei.IsEventCatHidden = false;
                }
                else
                {
                    ei.IsEventCatHidden = true;
                }
                break;

            case "Registry/Open":
            case "Registry/Query":
            case "Registry/QueryValue":
            case "Registry/SetInformation":
            case "Registry/Close":
            case "Registry/Create":
            case "Registry/SetValue":
            case "Registry/EnumerateKey":
            case "Registry/Delete":
            case "Registry/DeleteValue":
            case "Registry/EnumerateValueKey":
                if ((bool)cbCatKernelRegistry.IsChecked)
                {
                    ei.IsEventCatHidden = false;
                }
                else
                {
                    ei.IsEventCatHidden = true;
                }
                break;

            case "Application":
                if ((bool)cbCatApplicationLog.IsChecked)
                {
                    ei.IsEventCatHidden = false;
                }
                else
                {
                    ei.IsEventCatHidden = true;
                }
                break;

            case "System":
                if ((bool)cbCatSystemLog.IsChecked)
                {
                    ei.IsEventCatHidden = false;
                }
                else
                {
                    ei.IsEventCatHidden = true;
                }
                break;

            default:
                if ((bool)cbCatOther.IsChecked)
                {
                    ei.IsEventCatHidden = false;
                }
                else
                {
                    ei.IsEventCatHidden = true;
                }
                break;
            }
            if (ei.IsHidden != washidden)
            {
                return(true);
            }
            else
            {
                return(false);
            }
        }
        private bool ApplyFilterResultToEventItem(EventItem ei)
        {
            bool washidden = ei.IsHidden;

            if (ei.Result.StartsWith("Success"))
            {
                if ((bool)cbSuccesss.IsChecked)
                {
                    ei.IsResultHidden = false;
                }
                else
                {
                    ei.IsResultHidden = true;
                }
                ei.EventIsResultClass = "Normal";
            }
            else if (ei.Result.StartsWith("Unknown") ||
                     ei.Result.StartsWith("Indeterminate"))
            {
                if ((bool)cbIntermediate.IsChecked)
                {
                    ei.IsResultHidden = false;
                }
                else
                {
                    ei.IsResultHidden = true;
                }
                ei.EventIsResultClass = "Warning";
            }
            else if (ei.Result.StartsWith("Expected Failure"))
            {
                if ((bool)cbExpectedFailure.IsChecked)
                {
                    ei.IsResultHidden = false;
                }
                else
                {
                    ei.IsResultHidden = true;
                }
                ei.EventIsResultClass = "Warning";
            }
            else if (ei.Result.StartsWith("Failure"))
            {
                if ((bool)cbFailure.IsChecked)
                {
                    ei.IsResultHidden = false;
                }
                else
                {
                    ei.IsResultHidden = true;
                }
                ei.EventIsResultClass = "Failure";
            }
            else
            {
                ei.EventIsResultClass = "Normal"; // TODO: Reults starting with other stuff
            }

            if (ei.IsHidden != washidden)
            {
                return(true);
            }
            else
            {
                return(false);
            }
        }
        } // ETWTraceInBackground_Start()

        private void Eventbgw_DoWork(object sender, DoWorkEventArgs e)
        {
            // This is the background thread
            Provider         etwp   = e.Argument as Provider;
            BackgroundWorker worker = sender as BackgroundWorker;

            Thread.CurrentThread.Name = "ETWReader";

            using (myTraceEventSession = new TraceEventSession(etwp.name, TraceEventSessionOptions.Create))
            {
                myTraceEventSession.StopOnDispose       = true;
                myTraceEventSession.Source.Dynamic.All += delegate(TraceEvent data)  // Set Source (stream of events) from session.
                {                                                                    // Get dynamic parser (knows about EventSources)
                                                                                     // Subscribe to all EventSource events
                    string operation = "";
                    string inputs    = "";
                    string result    = "";
                    string outputs   = "";
                    string caller    = "";
                    Int64  start     = 0;
                    Int64  end       = 0;

                    try
                    {
                        operation = (string)data.PayloadByName("Operation");
                    }
                    catch
                    {
                        // expected possible condition
                    }
                    try
                    {
                        inputs = (string)data.PayloadByName("Inputs");
                    }
                    catch
                    {
                        // expected possible condition
                    }
                    try
                    {
                        result = (string)data.PayloadByName("Result");
                    }
                    catch
                    {
                        // expected possible condition
                    }
                    try
                    {
                        outputs = (string)data.PayloadByName("Outputs");
                    }
                    catch
                    {
                        // expected possible condition
                    }
                    try
                    {
                        caller = (string)data.PayloadByName("Caller");
                    }
                    catch
                    {
                        // expected possible condition
                    }
                    if (inputs == null && result == null && outputs == null)
                    {
                        try
                        {
                            outputs = (string)data.PayloadByName("Message");
                        }
                        catch
                        {
                            // expected possible condition
                        }
                    }
                    try
                    {
                        start = (Int64)data.PayloadByName("Start");
                    }
                    catch
                    {
                        // expected possible condition
                    }
                    try
                    {
                        end = (Int64)data.PayloadByName("End");
                    }
                    catch
                    {
                        // expected possible condition
                    }
                    EventItem ei = new EventItem((int)data.EventIndex,
                                                 start,
                                                 end,
                                                 data.TimeStamp,
                                                 data.ProcessName,
                                                 data.ProcessID,
                                                 data.ThreadID,
                                                 data.ProviderName,
                                                 operation,
                                                 inputs,
                                                 result,
                                                 outputs,
                                                 caller
                                                 );

                    lock (_TEventListsLock)
                    {
                        _TEventListItems.Add(ei);
                        AddToProcIDsList(data.ProcessID);
                    }
                    worker.ReportProgress((int)data.EventIndex);
                };

                EventTraceProviderEnablementResultCode = myTraceEventSession.EnableProvider(etwp.guid);
                if (!EventTraceProviderEnablementResultCode)
                {
                    // Attempt resetting for second run...
                    myTraceEventSession.DisableProvider(etwp.guid);
                    EventTraceProviderEnablementResultCode = myTraceEventSession.EnableProvider(etwp.guid);
                }
                EventTraceProviderSourceResultCode = myTraceEventSession.Source.Process();
            }
        } // Eventbgw_DoWork()
        } // Eventbgw_RunWorkerCompleted()

        #region UIFilter
        private void AppplyFilterToEventItem(EventItem ei)
        {
            ApplyFilterResultToEventItem(ei);
            ApplyFilterCategoryEventToEventItem(ei);
            ApplyFilterProcessIdToEventItem(ei);
        }
예제 #5
0
        }  //ETWTraceInBackground_Start_APPS()

        private void ETWTraceInBackground_DoWork_APPS(object sender, DoWorkEventArgs e)
        {
            // This is the background thread
            int              count    = 0;
            string           etwclass = e.Argument as string;
            BackgroundWorker worker   = sender as BackgroundWorker;

            Thread.CurrentThread.Name = "ETWReaderAPPS";
            //Thread.CurrentThread.Priority = ThreadPriority.BelowNormal;

            try
            {
                string         sQuery                 = "*[System/Level>0]";
                EventLogQuery  Q_Operational          = new EventLogQuery(etwclass, PathType.LogName, sQuery);
                EventBookmark  Ev_OperationalBookmark = null;
                EventLogReader R_Operational;
                R_Operational = new EventLogReader(Q_Operational); // Walk through existing list to create a bookmark
                R_Operational.Seek(System.IO.SeekOrigin.End, 0);
                for (EventRecord eventInstance = R_Operational.ReadEvent();
                     null != eventInstance;
                     eventInstance = R_Operational.ReadEvent())
                {
                    Ev_OperationalBookmark = eventInstance.Bookmark;
                }
                R_Operational.Dispose();
                WaitingForEventStart_APPS = false;

                worker.ReportProgress(count++);

                while (!worker.CancellationPending && !PleaseStopCollecting)
                {
                    Thread.Sleep(1000);
                    R_Operational = new EventLogReader(Q_Operational, Ev_OperationalBookmark);
                    for (EventRecord eventInstance = R_Operational.ReadEvent();
                         null != eventInstance;
                         eventInstance = R_Operational.ReadEvent())
                    {
                        Ev_OperationalBookmark = eventInstance.Bookmark;
                        try
                        {
                            DateTime  et    = eventInstance.TimeCreated.GetValueOrDefault();
                            EventItem eItem = new EventItem((int)et.Ticks, et.Ticks, et.Ticks, et, eventInstance.ProcessId.ToString(), (int)eventInstance.ProcessId, (int)eventInstance.ThreadId,
                                                            eventInstance.LogName, "Application", eventInstance.Id.ToString(), eventInstance.LevelDisplayName, eventInstance.FormatDescription(), "");
                            worker.ReportProgress(count++, eItem);
                        }
                        catch
                        {
                            // app provider might be virtual or missing
                            string leveldisplayname = "";
                            string stuff            = "Formatter not available. Details:";
                            int    ProcessId        = -1;
                            int    ThreadId         = -1;
                            switch (eventInstance.Level)
                            {
                            case 1:
                                leveldisplayname = "Critical";
                                break;

                            case 2:
                                leveldisplayname = "Error";
                                break;

                            case 3:
                                leveldisplayname = "Warning";
                                break;

                            case 4:
                                leveldisplayname = "Information";
                                break;

                            default:
                                break;
                            }
                            foreach (EventProperty p in eventInstance.Properties)
                            {
                                stuff += p.Value.ToString() + "  ";
                            }
                            if (eventInstance.ProcessId != null)
                            {
                                ProcessId = (int)eventInstance.ProcessId;
                            }
                            if (eventInstance.ThreadId != null)
                            {
                                ThreadId = (int)eventInstance.ThreadId;
                            }
                            DateTime  et    = eventInstance.TimeCreated.GetValueOrDefault();
                            EventItem eItem = new EventItem((int)et.Ticks, et.Ticks, et.Ticks, et, eventInstance.ProcessId.ToString(), (int)eventInstance.ProcessId, (int)eventInstance.ThreadId,
                                                            eventInstance.LogName, "Application", eventInstance.Id.ToString(), leveldisplayname, stuff, "");
                            worker.ReportProgress(count++, eItem);
                        }
                    }
                    R_Operational.Dispose();
                }
            }
            catch
            {
                WaitingForEventStart_APPS = false;
            }
        } // ETWTraceInBackground_DoWork_APPS()