Method HandleNoProcessId

WinSysCore/TraceManager.cpp:334–365

}

void TraceManager::HandleNoProcessId(EventData* data) {
	DWORD tid = 0;
	if (data->GetThreadId() == 0 || data->GetThreadId() == (DWORD)-1) {
		auto prop = data->GetProperty(L"ThreadId");
		if (!prop)
			prop = data->GetProperty(L"TThreadId");
		if (prop) {
			tid = prop->GetValue<DWORD>();
			data->_threadId = tid;
		}

		prop = data->GetProperty(L"PID");
		if (prop == nullptr)
			prop = data->GetProperty(L"ProcessId");
		if (prop) {
			auto pid = prop->GetValue<DWORD>();
			data->_processId = pid;
			data->SetProcessName(GetProcessImageById(pid));
		}
		else if (tid) {
			wil::unique_handle hThread(::OpenThread(THREAD_QUERY_LIMITED_INFORMATION,FALSE, tid));
			if (hThread) {
				auto pid = ::GetProcessIdOfThread(hThread.get());
				if (pid) {
					data->_processId = pid;
					data->SetProcessName(GetProcessImageById(pid));
				}
			}
		}
	}

}

const std::wstring& TraceManager::GetKernelEventName(EVENT_RECORD* rec) const {
	static const std::wstring empty;