| 147 | } |
| 148 | |
| 149 | std::wstring EventData::FormatProperty(const EventProperty& property) const { |
| 150 | ULONG size = 0; |
| 151 | PEVENT_MAP_INFO eventMap = nullptr; |
| 152 | std::unique_ptr<BYTE[]> mapBuffer; |
| 153 | auto& prop = property.Info; |
| 154 | WCHAR buffer[1024]; |
| 155 | auto info = reinterpret_cast<PTRACE_EVENT_INFO>(_buffer.get()); |
| 156 | if (prop.nonStructType.MapNameOffset) { |
| 157 | auto mapName = (PWSTR)((PBYTE)info + prop.nonStructType.MapNameOffset); |
| 158 | if (ERROR_INSUFFICIENT_BUFFER == ::TdhGetEventMapInformation(_record, mapName, nullptr, &size)) { |
| 159 | mapBuffer = std::make_unique<BYTE[]>(size); |
| 160 | eventMap = reinterpret_cast<PEVENT_MAP_INFO>(mapBuffer.get()); |
| 161 | if (ERROR_SUCCESS != ::TdhGetEventMapInformation(_record, mapName, eventMap, &size)) |
| 162 | eventMap = nullptr; |
| 163 | } |
| 164 | } |
| 165 | size = sizeof(buffer); |
| 166 | |
| 167 | // length special case for IPV6 |
| 168 | auto len = prop.length; |
| 169 | if (prop.nonStructType.InType == TDH_INTYPE_BINARY && prop.nonStructType.OutType == TDH_OUTTYPE_IPV6) |
| 170 | len = sizeof(IN6_ADDR); |
| 171 | |
| 172 | USHORT consumed; |
| 173 | auto status = ::TdhFormatProperty(info, eventMap, |
| 174 | (_headerFlags & EVENT_HEADER_FLAG_32_BIT_HEADER) ? 4 : 8, |
| 175 | prop.nonStructType.InType, prop.nonStructType.OutType, len, |
| 176 | (USHORT)property.GetLength(), (PBYTE)property.GetData(), |
| 177 | &size,buffer,&consumed); |
| 178 | if (status == STATUS_SUCCESS) |
| 179 | return std::wstring(buffer); |
| 180 | |
| 181 | return L""; |
| 182 | } |
| 183 | |
| 184 | uint64_t EventData::GetEventKey() const { |
| 185 | return _providerId.Data1 ^ _eventDescriptor.Opcode; |