private void Parser_ALPCReceiveMessage(ALPCReceiveMessageTraceData obj) { if (!IsRunning) { return; } AddEvent(new AlpcEvent(obj) { Type = AlpcEventType.ReceiveMessage, MessageId = obj.MessageID, }); ALPCSendMessageTraceData source; lock (_sendMessages) { source = _sendMessages.FirstOrDefault(msg => msg.MessageID == obj.MessageID); } if (source == null) { //Console.WriteLine($"Receive without Send {obj.ProcessName} ({obj.ProcessID}) msg: {obj.MessageID}"); return; } var message = new AlpcMessage { SourceProcess = source.ProcessID, SourceProcessName = source.ProcessName, TargetProcess = obj.ProcessID, TargetProcessName = obj.ProcessName, MessageId = obj.MessageID, SourceThread = source.ThreadID, TargetThread = obj.ThreadID, SendTime = source.TimeStamp, ReceiveTime = obj.TimeStamp, }; lock (_messages) { _messages.Add(message); } _sendMessages.Remove(source); //Dump(message); }
private void Dump(AlpcMessage message) { Console.WriteLine($"{message.SourceProcessName} ({message.SourceProcess} TID={message.SourceThread}) -> {message.MessageId}" + $" -> {message.TargetProcessName} ({message.TargetProcess})"); }