Method WriteEventData

WinArk/BinaryEventDataSerializer.cpp:41–78

}

void BinaryEventDataSerializer::WriteEventData(StructuredDirectory* dir, const EventData* data) {
	auto file = dir->CreateStructuredFile(L"Basic");
	CompoundFileReaderWriter writer(*file);
	writer.Write(data->GetEventDescriptor());
	writer.Write(data->GetEventName());
	writer.Write(data->GetTimeStamp());
	writer.Write(data->GetIndex());
	writer.Write(data->GetProcessId());
	writer.Write(data->GetThreadId());
	writer.Write(data->GetProviderId());

	//WriteSimpleData(dir, L"EventDescriptor", &data->GetEventDescriptor(), sizeof(EVENT_DESCRIPTOR));
	//WriteSimpleData(dir, L"EventName", data->GetEventName());
	//WriteSimpleData(dir, L"Index", data->GetIndex());
	//WriteSimpleData(dir, L"ProcessId", data->GetProcessId());
	//WriteSimpleData(dir, L"ThreadId", data->GetThreadId());
	//WriteSimpleData(dir, L"ProcessName", data->GetProcessName());
	//WriteSimpleData(dir, L"ProviderId", data->GetProviderId());
	//WriteSimpleData(dir, L"TimeStamp", data->GetTimeStamp());
	auto props = data->GetProperties();
	if (!props.empty()) {
		auto file = dir->CreateStructuredFile(L"Properties");
		CompoundFileReaderWriter writer(*file);

		for (auto& prop : props) {
			writer.Write(prop.Name);
			writer.Write(prop.GetLength());
			file->Write(prop.GetData(), prop.GetLength());

			//WriteSimpleData(propDir.get(), prop.Name.c_str(), prop.GetData(), prop.GetLength());
		}
	}
	auto stackData = data->GetStackEventData();
	if (stackData) {
		auto stackDir = dir->CreateStructuredDirectory(L"Stack");
		WriteEventData(stackDir.get(), stackData);
	}
}

void BinaryEventDataSerializer::WriteSimpleData(StructuredDirectory* dir, PCWSTR streamName, const void* data, int size) {
	auto file = dir->CreateStructuredFile(streamName);