private double ComputeElapsedTimeMSec(TraceEvent ev)
{
ev.EventData(bufferForInitialTimeValue, 0, 0, bufferForInitialTimeValue.Length);
var initialTime = BitConverter.ToInt64(bufferForInitialTimeValue, 0);
return(ev.TimeStampRelativeMSec - QPCTimeToRelMSec(initialTime));
}
private static void WritePayload(JsonTextWriter writer, TraceEvent traceEvent)
{
writer.WritePropertyName("payload");
writer.WriteValue(traceEvent.EventData());
}
internal unsafe ProviderManifest AddChunk(TraceEvent data)
{
if (provider != null)
{
return(null);
}
if (data.EventDataLength <= sizeof(ManifestEnvelope) || data.GetByteAt(3) != 0x5B) // magic number
{
return(null);
}
ushort totalChunks = (ushort)data.GetInt16At(4);
ushort chunkNum = (ushort)data.GetInt16At(6);
if (chunkNum >= totalChunks || totalChunks == 0)
{
return(null);
}
if (Chunks == null)
{
format = (ManifestEnvelope.ManifestFormats)data.GetByteAt(0);
majorVersion = (byte)data.GetByteAt(1);
minorVersion = (byte)data.GetByteAt(2);
ChunksLeft = totalChunks;
Chunks = new byte[ChunksLeft][];
}
else
{
// Chunks have to agree with the format and version information.
if (format != (ManifestEnvelope.ManifestFormats)data.GetByteAt(0) ||
majorVersion != data.GetByteAt(1) || minorVersion == data.GetByteAt(2))
{
return(null);
}
}
if (Chunks[chunkNum] != null)
{
return(null);
}
byte[] chunk = new byte[data.EventDataLength - 8];
Chunks[chunkNum] = data.EventData(chunk, 0, 8, chunk.Length);
--ChunksLeft;
if (ChunksLeft > 0)
{
return(null);
}
// OK we have a complete set of chunks
byte[] serializedData = Chunks[0];
if (Chunks.Length > 1)
{
int totalLength = 0;
for (int i = 0; i < Chunks.Length; i++)
{
totalLength += Chunks[i].Length;
}
// Concatinate all the arrays.
serializedData = new byte[totalLength];
int pos = 0;
for (int i = 0; i < Chunks.Length; i++)
{
Array.Copy(Chunks[i], 0, serializedData, pos, Chunks[i].Length);
pos += Chunks[i].Length;
}
}
Chunks = null;
// string str = Encoding.UTF8.GetString(serializedData);
provider = new ProviderManifest(serializedData, format, majorVersion, minorVersion);
return(provider);
}
private void EventCallback(TraceEvent data)
{
if (data.Version != 1)
{
return;
}
if ((int)data.ID == 0xfffe)
{
return;
}
var e = (Marker.Event)data.ID;
if (e == Marker.Event.Manifest)
{
return;
}
var bytes = data.EventData();
var level = (int)bytes[1];
var category = (int)bytes[2];
var span = (int)0;
var textFieldOffset = 0;
switch (e)
{
case Marker.Event.EnterSpan:
case Marker.Event.LeaveSpan:
span = BitConverter.ToInt32(bytes, 3);
textFieldOffset = 4 + 3;
break;
default:
textFieldOffset = 3 + 3;
break;
}
var series = Encoding.Unicode.GetString(bytes, textFieldOffset, RawData.getUnicodeBytes(bytes, textFieldOffset));
textFieldOffset += (series.Length + 1) * 2;
var name = Encoding.Unicode.GetString(bytes, textFieldOffset, RawData.getUnicodeBytes(bytes, textFieldOffset));
if (string.IsNullOrEmpty(name))
{
textFieldOffset += (name.Length + 1) * 2;
name = Encoding.UTF8.GetString(bytes, textFieldOffset, RawData.getMulticharBytes(bytes, textFieldOffset));
if (name.Length >= 8)
{
name = name.Remove(0, 8); // コードページ削除
}
}
spanRecord.Add(new Marker()
{
e = e,
id = span,
name = name,
thread = data.ThreadID,
timestamp = data.TimeStamp
});
if (spanRecord.Count > RecordCountMax)
{
spanRecord.RemoveRange(0, RecordCountMax / 2);
}
}
public static async void EventOccured(TraceEvent eventData)
{
try
{
if (time != null)
{
if (DateTime.Now.Subtract(time) <= TimeSpan.FromSeconds(10))
{
return;
}
}
time = DateTime.Now;
var packetDroppedEvent = new PacketDroppedEvent();
packetDroppedEvent.Time = DateTimeOffset.Now;
var data = eventData.EventData();
ulong fid = 0;
uint direction = 0;
ushort layerId = 0;
int fidStart = 0;
int appIdEnd = FindEndOfAppNameString(data);
if (appIdEnd > 0)
{
fidStart = appIdEnd + 32;
fid = BitConverter.ToUInt64(data, fidStart);
layerId = BitConverter.ToUInt16(data, fidStart + 8);
}
packetDroppedEvent.FilterName = GetFilterName(fid);
if (packetDroppedEvent.FilterName.Contains("0x80320003"))
{
appIdEnd = FindEndOfAppNameString(data);
if (appIdEnd > 0)
{
fidStart = appIdEnd + 48;
fid = BitConverter.ToUInt64(data, fidStart);
layerId = BitConverter.ToUInt16(data, fidStart + 8);
packetDroppedEvent.FilterName = GetFilterName(fid);
}
}
// Local address
byte[] local = (byte[])eventData.PayloadByName("LocalAddress");
packetDroppedEvent.LocalAddress = GetAddress(local);
packetDroppedEvent.LocalPort = GetPort(local);
// Remote address
byte[] remote = (byte[])eventData.PayloadByName("RemoteAddress");
packetDroppedEvent.RemoteAddress = GetAddress(remote);
packetDroppedEvent.RemotePort = GetPort(remote);
ToastHelper.PopToast($"Event occured. Port: {packetDroppedEvent.LocalPort}. Address: {packetDroppedEvent.RemoteAddress}. FID: {packetDroppedEvent.FilterName}. LayerID: {layerId}. Direction: {direction}");
await SellyService.ApiClient.SendEvent(packetDroppedEvent);
}
catch (Exception ex)
{
ExceptionHelper.WriteFile(ex, "ETW callback");
}
}
//Parses usb event data
private static UsbData GetData(TraceEvent eventData)
{
ulong hndl;
object field;
uint vid = 0, pid = 0;
byte usbver = 0;
//try to determine device handle and IDs
field = GetItem(eventData, "fid_USBPORT_Device");
if (field != null)
{
Dictionary <string, string> deviceInfo = _expose(field);
if (!ulong.TryParse(deviceInfo["DeviceHandle"], out hndl) && hndl <= 0)
{
return(null);
}
vid = UInt32.Parse(deviceInfo["idVendor"]);
pid = UInt32.Parse(deviceInfo["idProduct"]);
}
else
{
hndl = (ulong)GetItem(eventData, "fid_PipeHandle");
if (hndl <= 0)
{
return(null);
}
}
//try to get event parameters
field = GetItem(eventData, "fid_USBPORT_URB_BULK_OR_INTERRUPT_TRANSFER"); //2.0
usbver = 2;
if (field == null)
{
field = GetItem(eventData, "fid_UCX_URB_BULK_OR_INTERRUPT_TRANSFER"); //3.0
usbver = 3;
}
Dictionary <string, string> urb = _expose(field);//transform parameter string to dictionary
//determine transferred data length
int xferDataSize = 0;
if (!int.TryParse(urb["fid_URB_TransferBufferLength"], out xferDataSize))
{
return(null);
}
if ((xferDataSize > 8) && (usbver == 2))
{
xferDataSize = 8; //USB 2.0 sometimes gives wrong size
}
if (xferDataSize > 8)
{
return(null); //data is too large for mouse / keyboard
}
byte[] data2 = eventData.EventData();
byte[] xferData = new byte[xferDataSize];
Array.Copy(data2, eventData.EventDataLength - xferDataSize, xferData, 0, xferDataSize);
bool HasNonZero = false;
for (int i = 0; i < xferDataSize; i++)
{
if (xferData[i] != 0)
{
HasNonZero = true; break;
}
}
if (HasNonZero == false)
{
return(null); //data is empty
}
/* Construct UsbData object*/
UsbData data = new UsbData(eventData.TimeStamp, hndl, xferData);
data.usbver = usbver;
data.datalen = (uint)xferDataSize;
data.vid = vid;
data.pid = pid;
return(data);
}
// EventCallback - performs the following filtering of trace event data
// 1: check if there are any traceevent data
// --- filter for usb2 or usb3 device (different urb fields)
// 2: check for usb bulk/interrupt transfers
// 3: check for designated non-zero handle for usb device
// 4: check for successful retrieval of urb data
// --- parse urb data structure
// 5: check for successful parse of urb xfer buffer length
// 6: check xfer buffer length matches keyboard size
// 7: check that reserved byte is unused
// 8: check for non-empty keyboard data
// 9: check for out of order data
// 10: check for key rollover error
private static void EventCallback(TraceEvent eventData)
{
ulong hndl = 0;
if (eventData.EventDataLength <= 0)
{
return;
}
if (eventData.PayloadNames.Contains("fid_USBPORT_URB_BULK_OR_INTERRUPT_TRANSFER"))
{
hndl = FilterUsb2(eventData);
}
else if (eventData.PayloadNames.Contains("fid_UCX_URB_BULK_OR_INTERRUPT_TRANSFER"))
{
hndl = FilterUsb3(eventData);
}
else
{
return;
}
if (hndl == 0)
{
return;
}
byte[] xferData = new byte[8];
Array.Copy(eventData.EventData(), eventData.EventDataLength - 8, xferData, 0, 8);
// ignore reserved fields for keyboards
// byte[1] must always be 0
if (xferData[1] != 0)
{
return;
}
// byte[2] to byte[8] contains standard keystrokes
if (xferData.Skip(2).SequenceEqual(new byte[6] {
0, 0, 0, 0, 0, 0
}))
{
return;
}
// if any byte[i] has 0, then following bytes must be 0
for (int i = 2; i < 8; i++)
{
if (xferData[i] == 0)
{
for (int j = i; j < 6; j++)
{
if (xferData[j] != 0)
{
return;
}
}
}
}
// keyboard rollover error
if (xferData.Skip(2).SequenceEqual(new byte[6] {
1, 1, 1, 1, 1, 1
}))
{
return;
}
datastore.Enqueue(new UsbData(eventData.TimeStamp, hndl, xferData));
}