private unsafe bool GetDataFromController(int etwSessionId, UnsafeNativeMethods.ManifestEtw.EVENT_FILTER_DESCRIPTOR *filterData, out ControllerCommand command, out byte[] data, out int dataStart)
{
data = (byte[])null;
dataStart = 0;
if ((IntPtr)filterData == IntPtr.Zero)
{
string str1 = "\\Microsoft\\Windows\\CurrentVersion\\Winevt\\Publishers\\{" + (object)this.m_providerId + "}";
string str2 = Marshal.SizeOf(typeof(IntPtr)) != 8 ? "HKEY_LOCAL_MACHINE\\Software" + str1 : "HKEY_LOCAL_MACHINE\\Software\\Wow6432Node" + str1;
string valueName = "ControllerData_Session_" + etwSessionId.ToString((IFormatProvider)CultureInfo.InvariantCulture);
new RegistryPermission(RegistryPermissionAccess.Read, str2).Assert();
data = Registry.GetValue(str2, valueName, (object)null) as byte[];
if (data != null)
{
command = ControllerCommand.Update;
return(true);
}
command = ControllerCommand.Update;
return(false);
}
if (filterData->Ptr != 0L && 0 < filterData->Size && filterData->Size <= 1024)
{
data = new byte[filterData->Size];
Marshal.Copy((IntPtr)filterData->Ptr, data, 0, data.Length);
}
command = (ControllerCommand)filterData->Type;
return(true);
}
private unsafe bool GetDataFromController(int etwSessionId,
UnsafeNativeMethods.ManifestEtw.EVENT_FILTER_DESCRIPTOR *filterData, out ControllerCommand command, out byte[] data, out int dataStart)
{
data = null;
dataStart = 0;
if (filterData == null)
{
string regKey = @"\Microsoft\Windows\CurrentVersion\Winevt\Publishers\{" + m_providerId + "}";
if (System.Runtime.InteropServices.Marshal.SizeOf(typeof(IntPtr)) == 8)
{
regKey = @"HKEY_LOCAL_MACHINE\Software" + @"\Wow6432Node" + regKey;
}
else
{
regKey = @"HKEY_LOCAL_MACHINE\Software" + regKey;
}
string valueName = "ControllerData_Session_" + etwSessionId.ToString(CultureInfo.InvariantCulture);
// we need to assert this permission for partial trust scenarios
new RegistryPermission(RegistryPermissionAccess.Read, regKey).Assert();
data = Microsoft.Win32.Registry.GetValue(regKey, valueName, null) as byte[];
if (data != null)
{
// We only used the persisted data from the registry for updates.
command = ControllerCommand.Update;
return(true);
}
}
else
{
if (filterData->Ptr != 0 && 0 < filterData->Size && filterData->Size <= 1024)
{
data = new byte[filterData->Size];
Marshal.Copy((IntPtr)filterData->Ptr, data, 0, data.Length);
}
command = (ControllerCommand)filterData->Type;
return(true);
}
command = ControllerCommand.Update;
return(false);
}
unsafe void EtwEnableCallBack(
[In] ref System.Guid sourceId,
[In] int controlCode,
[In] byte setLevel,
[In] long anyKeyword,
[In] long allKeyword,
[In] UnsafeNativeMethods.ManifestEtw.EVENT_FILTER_DESCRIPTOR *filterData,
[In] void *callbackContext
)
{
ControllerCommand command = ControllerCommand.Update;
IDictionary <string, string> args = null;
byte[] data;
int keyIndex;
bool skipFinalOnControllerCommand = false;
EventSource.OutputDebugString(string.Format("EtwEnableCallBack(ctrl {0}, lvl {1}, any {2:x}, all {3:x})",
controlCode, setLevel, anyKeyword, allKeyword));
if (controlCode == UnsafeNativeMethods.ManifestEtw.EVENT_CONTROL_CODE_ENABLE_PROVIDER)
{
m_enabled = true;
m_level = setLevel;
m_anyKeywordMask = anyKeyword;
m_allKeywordMask = allKeyword;
List <Tuple <SessionInfo, bool> > sessionsChanged = GetSessions();
foreach (var session in sessionsChanged)
{
int sessionChanged = session.Item1.sessionIdBit;
int etwSessionId = session.Item1.etwSessionId;
bool bEnabling = session.Item2;
EventSource.OutputDebugString(string.Format(CultureInfo.InvariantCulture, "EtwEnableCallBack: session changed {0}:{1}:{2}",
sessionChanged, etwSessionId, bEnabling));
skipFinalOnControllerCommand = true;
args = null; // reinitialize args for every session...
// if we get more than one session changed we have no way
// of knowing which one "filterData" belongs to
if (sessionsChanged.Count > 1)
{
filterData = null;
}
// read filter data only when a session is being *added*
if (bEnabling &&
GetDataFromController(etwSessionId, filterData, out command, out data, out keyIndex))
{
args = new Dictionary <string, string>(4);
while (keyIndex < data.Length)
{
int keyEnd = FindNull(data, keyIndex);
int valueIdx = keyEnd + 1;
int valueEnd = FindNull(data, valueIdx);
if (valueEnd < data.Length)
{
string key = System.Text.Encoding.UTF8.GetString(data, keyIndex, keyEnd - keyIndex);
string value = System.Text.Encoding.UTF8.GetString(data, valueIdx, valueEnd - valueIdx);
args[key] = value;
}
keyIndex = valueEnd + 1;
}
}
// execute OnControllerCommand once for every session that has changed.
try
{
OnControllerCommand(command, args, (bEnabling ? sessionChanged : -sessionChanged), etwSessionId);
}
catch (Exception)
{
// We want to ignore any failures that happen as a result of turning on this provider as to
// not crash the app.
}
}
}
else if (controlCode == UnsafeNativeMethods.ManifestEtw.EVENT_CONTROL_CODE_DISABLE_PROVIDER)
{
m_enabled = false;
m_level = 0;
m_anyKeywordMask = 0;
m_allKeywordMask = 0;
m_liveSessions = null;
}
else if (controlCode == UnsafeNativeMethods.ManifestEtw.EVENT_CONTROL_CODE_CAPTURE_STATE)
{
command = ControllerCommand.SendManifest;
}
else
{
return; // per spec you ignore commands you don't recognise.
}
try
{
if (!skipFinalOnControllerCommand)
{
OnControllerCommand(command, args, 0, 0);
}
}
catch (Exception)
{
// We want to ignore any failures that happen as a result of turning on this provider as to
// not crash the app.
}
}
private unsafe void EtwEnableCallBack([In] ref Guid sourceId, [In] int controlCode, [In] byte setLevel, [In] long anyKeyword, [In] long allKeyword, [In] UnsafeNativeMethods.ManifestEtw.EVENT_FILTER_DESCRIPTOR *filterData, [In] void *callbackContext)
{
try
{
ControllerCommand command = ControllerCommand.Update;
IDictionary <string, string> arguments = (IDictionary <string, string>)null;
bool flag1 = false;
if (controlCode == 1)
{
this.m_enabled = true;
this.m_level = setLevel;
this.m_anyKeywordMask = anyKeyword;
this.m_allKeywordMask = allKeyword;
List <Tuple <EventProvider.SessionInfo, bool> > sessions = this.GetSessions();
foreach (Tuple <EventProvider.SessionInfo, bool> tuple in sessions)
{
int num1 = tuple.Item1.sessionIdBit;
int etwSessionId = tuple.Item1.etwSessionId;
bool flag2 = tuple.Item2;
flag1 = true;
arguments = (IDictionary <string, string>)null;
if (sessions.Count > 1)
{
filterData = (UnsafeNativeMethods.ManifestEtw.EVENT_FILTER_DESCRIPTOR *)null;
}
byte[] data;
int dataStart;
if (flag2 && this.GetDataFromController(etwSessionId, filterData, out command, out data, out dataStart))
{
arguments = (IDictionary <string, string>) new Dictionary <string, string>(4);
int null1;
for (; dataStart < data.Length; dataStart = null1 + 1)
{
int null2 = EventProvider.FindNull(data, dataStart);
int num2 = null2 + 1;
null1 = EventProvider.FindNull(data, num2);
if (null1 < data.Length)
{
string string1 = Encoding.UTF8.GetString(data, dataStart, null2 - dataStart);
string string2 = Encoding.UTF8.GetString(data, num2, null1 - num2);
arguments[string1] = string2;
}
}
}
this.OnControllerCommand(command, arguments, flag2 ? num1 : -num1, etwSessionId);
}
}
else if (controlCode == 0)
{
this.m_enabled = false;
this.m_level = (byte)0;
this.m_anyKeywordMask = 0L;
this.m_allKeywordMask = 0L;
this.m_liveSessions = (List <EventProvider.SessionInfo>)null;
}
else
{
if (controlCode != 2)
{
return;
}
command = ControllerCommand.SendManifest;
}
if (flag1)
{
return;
}
this.OnControllerCommand(command, arguments, 0, 0);
}
catch (Exception ex)
{
}
}
private unsafe void EtwEnableCallBack([In] ref Guid sourceId, [In] int controlCode, [In] byte setLevel, [In] long anyKeyword, [In] long allKeyword, [In] UnsafeNativeMethods.ManifestEtw.EVENT_FILTER_DESCRIPTOR *filterData, [In] void *callbackContext)
{
try
{
ControllerCommand command = ControllerCommand.Update;
IDictionary <string, string> dictionary = null;
bool flag = false;
if (controlCode == 1)
{
this.m_enabled = true;
this.m_level = setLevel;
this.m_anyKeywordMask = anyKeyword;
this.m_allKeywordMask = allKeyword;
List <Tuple <EventProvider.SessionInfo, bool> > sessions = this.GetSessions();
using (List <Tuple <EventProvider.SessionInfo, bool> > .Enumerator enumerator = sessions.GetEnumerator())
{
while (enumerator.MoveNext())
{
Tuple <EventProvider.SessionInfo, bool> tuple = enumerator.Current;
int sessionIdBit = tuple.Item1.sessionIdBit;
int etwSessionId = tuple.Item1.etwSessionId;
bool item = tuple.Item2;
flag = true;
dictionary = null;
if (sessions.Count > 1)
{
filterData = null;
}
byte[] array;
int i;
if (item && this.GetDataFromController(etwSessionId, filterData, out command, out array, out i))
{
dictionary = new Dictionary <string, string>(4);
while (i < array.Length)
{
int num = EventProvider.FindNull(array, i);
int num2 = num + 1;
int num3 = EventProvider.FindNull(array, num2);
if (num3 < array.Length)
{
string @string = Encoding.UTF8.GetString(array, i, num - i);
string string2 = Encoding.UTF8.GetString(array, num2, num3 - num2);
dictionary[@string] = string2;
}
i = num3 + 1;
}
}
this.OnControllerCommand(command, dictionary, item ? sessionIdBit : (-sessionIdBit), etwSessionId);
}
goto IL_162;
}
}
if (controlCode == 0)
{
this.m_enabled = false;
this.m_level = 0;
this.m_anyKeywordMask = 0L;
this.m_allKeywordMask = 0L;
this.m_liveSessions = null;
}
else
{
if (controlCode != 2)
{
return;
}
command = ControllerCommand.SendManifest;
}
IL_162:
if (!flag)
{
this.OnControllerCommand(command, dictionary, 0, 0);
}
}
catch (Exception)
{
}
}
