Method ProcessSpecialEvent

WinArk/EtwView.cpp:195–247

}

std::wstring CEtwView::ProcessSpecialEvent(EventData* data) const {
	std::wstring details;
	CString text;
	auto& name = data->GetEventName();
	if (name == L"Process/Start") {
		text.Format(L"PID: %u; Image: %s; Command Line: %s",
			data->GetProperty(L"ProcessId")->GetValue<DWORD>(),
			CString(data->GetProperty(L"ImageFileName")->GetAnsiString()),
			data->GetProperty(L"CommandLine")->GetUnicodeString());
		details = std::move(text);
	}
	if (name == L"PerfInfo/SysClEnter") {
		DWORD64 address;
		auto prop = data->GetProperty(L"SysCallAddress");
		if (prop->GetLength() == 4)
			address = prop->GetValue<DWORD>();
		else
			address = prop->GetValue<DWORD64>();
		DWORD64 offset = 0;
		auto symbol = SymbolHelper::GetSymbolFromAddress(address, &offset);
		if (symbol) {
			auto sym = symbol->GetSymbolInfo();
			CStringA text;
			text.Format("%s", sym->Name);
			details = Helpers::StringToWstring(std::string(text));
		}
	}
	if (name == L"Thread/CSwitch") {
		UCHAR processorNumber = data->GetProcessorNumber();
		DWORD tid = data->GetProperty(L"NewThreadId")->GetValue<DWORD>();
		if (tid != -1) {
			_threadById[processorNumber] = tid;
		}
		if (_processById.count(tid) == 0) {
			DWORD pid = AddNewProcess(tid);
			if (pid != -1 && pid != 0) {
				data->SetProcessId(pid);
			}
		}
		tid = data->GetProperty(L"OldThreadId")->GetValue<DWORD>();
		if (_processById.count(tid) == 0) {
			AddNewProcess(tid);
		}
		auto state = data->GetProperty(L"OldThreadState")->GetValue<uint8_t>();
		if (_processById.count(tid) != 0 && state == (uint8_t)WinSys::ThreadState::Terminated) {
			if (_processNameById.count(_processById[tid]) != 0) {
				_processNameById.erase(_processById[tid]);
			}
			_processById.erase(tid);
		}
	}
	return details;
}

std::wstring CEtwView::GetEventDetails(EventData* data) const {
	auto details = ProcessSpecialEvent(data);