// using System; using System.Diagnostics; using System.Diagnostics.Tracing; using System.Text; using Microsoft.Diagnostics.Tracing; using Address = System.UInt64; #pragma warning disable 1591 // disable warnings on XML comments not being present // This code was automatically generated by the TraceParserGen tool, which converts // an ETW event manifest into strongly typed C# classes. namespace Microsoft.Diagnostics.Tracing.Parsers { using Microsoft.Diagnostics.Tracing.Parsers.MicrosoftWindowsRPC; [System.CodeDom.Compiler.GeneratedCode("traceparsergen", "2.0")] public sealed class MicrosoftWindowsRPCTraceEventParser : TraceEventParser { public static string ProviderName = "Microsoft-Windows-RPC"; public static Guid ProviderGuid = new Guid(unchecked((int) 0x6ad52b32), unchecked((short) 0xd609), unchecked((short) 0x4be9), 0xae, 0x07, 0xce, 0x8d, 0xae, 0x93, 0x7e, 0x39); public enum Keywords : long { }; public MicrosoftWindowsRPCTraceEventParser(TraceEventSource source) : base(source) {} public event Action Debug { add { RegisterTemplate(new DebugArgs_V1TraceData(value, 4, 3, "Debug", DebugTaskGuid, 0, "", ProviderGuid, ProviderName)); } remove { source.UnregisterEventTemplate(value, 4, DebugTaskGuid); } } public event Action Debug10 { add { RegisterTemplate(new Debug10Args_V1TraceData(value, 10, 3, "Debug", DebugTaskGuid, 0, "", ProviderGuid, ProviderName)); } remove { source.UnregisterEventTemplate(value, 10, DebugTaskGuid); } } public event Action Debug11 { add { RegisterTemplate(new Debug10Args_V1TraceData(value, 11, 3, "Debug", DebugTaskGuid, 0, "", ProviderGuid, ProviderName)); } remove { source.UnregisterEventTemplate(value, 11, DebugTaskGuid); } } public event Action DebugStart { add { RegisterTemplate(new DebugStartArgs_V1TraceData(value, 12, 3, "Debug", DebugTaskGuid, 1, "Start", ProviderGuid, ProviderName)); } remove { source.UnregisterEventTemplate(value, 12, DebugTaskGuid); } } public event Action DebugStop { add { RegisterTemplate(new DebugStopArgs_V1TraceData(value, 13, 3, "Debug", DebugTaskGuid, 2, "Stop", ProviderGuid, ProviderName)); } remove { source.UnregisterEventTemplate(value, 13, DebugTaskGuid); } } public event Action FunctionTraceStart { add { RegisterTemplate(new FunctionTraceStartArgs_V1TraceData(value, 14, 4, "FunctionTrace", FunctionTraceTaskGuid, 1, "Start", ProviderGuid, ProviderName)); } remove { source.UnregisterEventTemplate(value, 14, FunctionTraceTaskGuid); } } public event Action FunctionTraceStart16 { add { RegisterTemplate(new FunctionTraceStart16Args_V1TraceData(value, 16, 4, "FunctionTrace", FunctionTraceTaskGuid, 1, "Start", ProviderGuid, ProviderName)); } remove { source.UnregisterEventTemplate(value, 16, FunctionTraceTaskGuid); } } public event Action FunctionTraceStop { add { RegisterTemplate(new FunctionTraceStopArgs_V1TraceData(value, 15, 4, "FunctionTrace", FunctionTraceTaskGuid, 2, "Stop", ProviderGuid, ProviderName)); } remove { source.UnregisterEventTemplate(value, 15, FunctionTraceTaskGuid); } } public event Action RpcClientCallStart { add { RegisterTemplate(new RpcClientCallStartArgs_V1TraceData(value, 5, 1, "RpcClientCall", RpcClientCallTaskGuid, 1, "Start", ProviderGuid, ProviderName)); } remove { source.UnregisterEventTemplate(value, 5, RpcClientCallTaskGuid); } } public event Action RpcClientCallStop { add { RegisterTemplate(new RpcClientCallStopArgs_V1TraceData(value, 1, 1, "RpcClientCall", RpcClientCallTaskGuid, 2, "Stop", ProviderGuid, ProviderName)); } remove { source.UnregisterEventTemplate(value, 1, RpcClientCallTaskGuid); } } public event Action RpcClientCallStop7 { add { RegisterTemplate(new RpcClientCallStop7Args_V1TraceData(value, 7, 1, "RpcClientCall", RpcClientCallTaskGuid, 2, "Stop", ProviderGuid, ProviderName)); } remove { source.UnregisterEventTemplate(value, 7, RpcClientCallTaskGuid); } } public event Action RpcServerCall { add { RegisterTemplate(new RpcServerCallArgs_V1TraceData(value, 2, 2, "RpcServerCall", RpcServerCallTaskGuid, 0, "", ProviderGuid, ProviderName)); } remove { source.UnregisterEventTemplate(value, 2, RpcServerCallTaskGuid); } } public event Action RpcServerCallStart { add { RegisterTemplate(new RpcServerCallStartArgs_V1TraceData(value, 6, 2, "RpcServerCall", RpcServerCallTaskGuid, 1, "Start", ProviderGuid, ProviderName)); } remove { source.UnregisterEventTemplate(value, 6, RpcServerCallTaskGuid); } } public event Action RpcServerCallStop { add { RegisterTemplate(new RpcClientCallStop7Args_V1TraceData(value, 8, 2, "RpcServerCall", RpcServerCallTaskGuid, 2, "Stop", ProviderGuid, ProviderName)); } remove { source.UnregisterEventTemplate(value, 8, RpcServerCallTaskGuid); } } public event Action task_0 { add { RegisterTemplate(new task_0Args_V1TraceData(value, 3, 0, "task_0", task_0TaskGuid, 0, "", ProviderGuid, ProviderName)); } remove { source.UnregisterEventTemplate(value, 3, task_0TaskGuid); } } public event Action task_09 { add { RegisterTemplate(new RpcClientCallStop7Args_V1TraceData(value, 9, 0, "task_0", task_0TaskGuid, 0, "", ProviderGuid, ProviderName)); } remove { source.UnregisterEventTemplate(value, 9, task_0TaskGuid); } } #region private protected override string GetProviderName() { return ProviderName; } static private DebugArgs_V1TraceData DebugTemplate(Action action) { // action, eventid, taskid, taskName, taskGuid, opcode, opcodeName, providerGuid, providerName return new DebugArgs_V1TraceData(action, 4, 3, "Debug", Guid.Empty, 0, "", ProviderGuid, ProviderName ); } static private Debug10Args_V1TraceData Debug10Template(Action action) { // action, eventid, taskid, taskName, taskGuid, opcode, opcodeName, providerGuid, providerName return new Debug10Args_V1TraceData(action, 10, 3, "Debug", Guid.Empty, 0, "", ProviderGuid, ProviderName ); } static private Debug10Args_V1TraceData Debug11Template(Action action) { // action, eventid, taskid, taskName, taskGuid, opcode, opcodeName, providerGuid, providerName return new Debug10Args_V1TraceData(action, 11, 3, "Debug", Guid.Empty, 0, "", ProviderGuid, ProviderName ); } static private DebugStartArgs_V1TraceData DebugStartTemplate(Action action) { // action, eventid, taskid, taskName, taskGuid, opcode, opcodeName, providerGuid, providerName return new DebugStartArgs_V1TraceData(action, 12, 3, "Debug", Guid.Empty, 1, "Start", ProviderGuid, ProviderName ); } static private DebugStopArgs_V1TraceData DebugStopTemplate(Action action) { // action, eventid, taskid, taskName, taskGuid, opcode, opcodeName, providerGuid, providerName return new DebugStopArgs_V1TraceData(action, 13, 3, "Debug", Guid.Empty, 2, "Stop", ProviderGuid, ProviderName ); } static private FunctionTraceStartArgs_V1TraceData FunctionTraceStartTemplate(Action action) { // action, eventid, taskid, taskName, taskGuid, opcode, opcodeName, providerGuid, providerName return new FunctionTraceStartArgs_V1TraceData(action, 14, 4, "FunctionTrace", Guid.Empty, 1, "Start", ProviderGuid, ProviderName ); } static private FunctionTraceStart16Args_V1TraceData FunctionTraceStart16Template(Action action) { // action, eventid, taskid, taskName, taskGuid, opcode, opcodeName, providerGuid, providerName return new FunctionTraceStart16Args_V1TraceData(action, 16, 4, "FunctionTrace", Guid.Empty, 1, "Start", ProviderGuid, ProviderName ); } static private FunctionTraceStopArgs_V1TraceData FunctionTraceStopTemplate(Action action) { // action, eventid, taskid, taskName, taskGuid, opcode, opcodeName, providerGuid, providerName return new FunctionTraceStopArgs_V1TraceData(action, 15, 4, "FunctionTrace", Guid.Empty, 2, "Stop", ProviderGuid, ProviderName ); } static private RpcClientCallStartArgs_V1TraceData RpcClientCallStartTemplate(Action action) { // action, eventid, taskid, taskName, taskGuid, opcode, opcodeName, providerGuid, providerName return new RpcClientCallStartArgs_V1TraceData(action, 5, 1, "RpcClientCall", Guid.Empty, 1, "Start", ProviderGuid, ProviderName ); } static private RpcClientCallStopArgs_V1TraceData RpcClientCallStopTemplate(Action action) { // action, eventid, taskid, taskName, taskGuid, opcode, opcodeName, providerGuid, providerName return new RpcClientCallStopArgs_V1TraceData(action, 1, 1, "RpcClientCall", Guid.Empty, 2, "Stop", ProviderGuid, ProviderName ); } static private RpcClientCallStop7Args_V1TraceData RpcClientCallStop7Template(Action action) { // action, eventid, taskid, taskName, taskGuid, opcode, opcodeName, providerGuid, providerName return new RpcClientCallStop7Args_V1TraceData(action, 7, 1, "RpcClientCall", Guid.Empty, 2, "Stop", ProviderGuid, ProviderName ); } static private RpcServerCallArgs_V1TraceData RpcServerCallTemplate(Action action) { // action, eventid, taskid, taskName, taskGuid, opcode, opcodeName, providerGuid, providerName return new RpcServerCallArgs_V1TraceData(action, 2, 2, "RpcServerCall", Guid.Empty, 0, "", ProviderGuid, ProviderName ); } static private RpcServerCallStartArgs_V1TraceData RpcServerCallStartTemplate(Action action) { // action, eventid, taskid, taskName, taskGuid, opcode, opcodeName, providerGuid, providerName return new RpcServerCallStartArgs_V1TraceData(action, 6, 2, "RpcServerCall", Guid.Empty, 1, "Start", ProviderGuid, ProviderName ); } static private RpcClientCallStop7Args_V1TraceData RpcServerCallStopTemplate(Action action) { // action, eventid, taskid, taskName, taskGuid, opcode, opcodeName, providerGuid, providerName return new RpcClientCallStop7Args_V1TraceData(action, 8, 2, "RpcServerCall", Guid.Empty, 2, "Stop", ProviderGuid, ProviderName ); } static private task_0Args_V1TraceData task_0Template(Action action) { // action, eventid, taskid, taskName, taskGuid, opcode, opcodeName, providerGuid, providerName return new task_0Args_V1TraceData(action, 3, 0, "task_0", Guid.Empty, 0, "", ProviderGuid, ProviderName ); } static private RpcClientCallStop7Args_V1TraceData task_09Template(Action action) { // action, eventid, taskid, taskName, taskGuid, opcode, opcodeName, providerGuid, providerName return new RpcClientCallStop7Args_V1TraceData(action, 9, 0, "task_0", Guid.Empty, 0, "", ProviderGuid, ProviderName ); } static private volatile TraceEvent[] s_templates; protected override void EnumerateTemplates(Func eventsToObserve, Action callback) { if (s_templates == null) { var templates = new TraceEvent[16]; templates[0] = new RpcClientCallStopTraceData(null, 1, 1, "RpcClientCall", RpcClientCallTaskGuid, 2, "Stop", ProviderGuid, ProviderName); templates[1] = new RpcServerCallTraceData(null, 2, 2, "RpcServerCall", RpcServerCallTaskGuid, 0, "", ProviderGuid, ProviderName); templates[2] = new task_0TraceData(null, 3, 0, "task_0", task_0TaskGuid, 0, "", ProviderGuid, ProviderName); templates[3] = new DebugTraceData(null, 4, 3, "Debug", DebugTaskGuid, 0, "", ProviderGuid, ProviderName); templates[4] = new RpcClientCallStartTraceData(null, 5, 1, "RpcClientCall", RpcClientCallTaskGuid, 1, "Start", ProviderGuid, ProviderName); templates[5] = new RpcServerCallStartTraceData(null, 6, 2, "RpcServerCall", RpcServerCallTaskGuid, 1, "Start", ProviderGuid, ProviderName); templates[6] = new RpcClientCallStopTraceData(null, 7, 1, "RpcClientCall", RpcClientCallTaskGuid, 2, "Stop", ProviderGuid, ProviderName); templates[7] = new RpcServerCallStopTraceData(null, 8, 2, "RpcServerCall", RpcServerCallTaskGuid, 2, "Stop", ProviderGuid, ProviderName); templates[8] = new task_0TraceData(null, 9, 0, "task_0", task_0TaskGuid, 0, "", ProviderGuid, ProviderName); templates[9] = new DebugTraceData(null, 10, 3, "Debug", DebugTaskGuid, 0, "", ProviderGuid, ProviderName); templates[10] = new DebugTraceData(null, 11, 3, "Debug", DebugTaskGuid, 0, "", ProviderGuid, ProviderName); templates[11] = new DebugStartTraceData(null, 12, 3, "Debug", DebugTaskGuid, 1, "Start", ProviderGuid, ProviderName); templates[12] = new DebugStopTraceData(null, 13, 3, "Debug", DebugTaskGuid, 2, "Stop", ProviderGuid, ProviderName); templates[13] = new FunctionTraceStartTraceData(null, 14, 4, "FunctionTrace", FunctionTraceTaskGuid, 1, "Start", ProviderGuid, ProviderName); templates[14] = new FunctionTraceStopTraceData(null, 15, 4, "FunctionTrace", FunctionTraceTaskGuid, 2, "Stop", ProviderGuid, ProviderName); templates[15] = new FunctionTraceStartTraceData(null, 16, 4, "FunctionTrace", FunctionTraceTaskGuid, 1, "Start", ProviderGuid, ProviderName); s_templates = templates; } foreach (var template in s_templates) if (eventsToObserve == null || eventsToObserve(template.ProviderName, template.EventName) == EventFilterResponse.AcceptEvent) callback(template); } #endregion } } namespace Microsoft.Diagnostics.Tracing.Parsers.MicrosoftWindowsRPC { public sealed class DebugArgs_V1TraceData : TraceEvent { public SubjectTypes Subject { get { return (SubjectTypes)GetByteAt(0); } } public int Verb { get { return GetByteAt(1); } } public long SubjectPointer { get { return GetInt64At(2); } } public long ObjectPointer { get { return GetInt64At(10); } } public long DataPointer { get { return GetInt64At(18); } } #region Private internal DebugArgs_V1TraceData(Action action, int eventID, int task, string taskName, Guid taskGuid, int opcode, string opcodeName, Guid providerGuid, string providerName) : base(eventID, task, taskName, taskGuid, opcode, opcodeName, providerGuid, providerName) { Action = action; } protected override void Dispatch() { Action(this); } protected override void Validate() { Debug.Assert(!(Version == 1 && EventDataLength != 26)); Debug.Assert(!(Version > 1 && EventDataLength < 26)); } protected override Delegate Target { get { return Action; } set { Action = (Action) value; } } public override StringBuilder ToXml(StringBuilder sb) { Prefix(sb); XmlAttrib(sb, "Subject", Subject); XmlAttrib(sb, "Verb", Verb); XmlAttrib(sb, "SubjectPointer", SubjectPointer); XmlAttrib(sb, "ObjectPointer", ObjectPointer); XmlAttrib(sb, "DataPointer", DataPointer); sb.Append("/>"); return sb; } public override string[] PayloadNames { get { if (payloadNames == null) payloadNames = new string[] { "Subject", "Verb", "SubjectPointer", "ObjectPointer", "DataPointer"}; return payloadNames; } } public override object PayloadValue(int index) { switch (index) { case 0: return Subject; case 1: return Verb; case 2: return SubjectPointer; case 3: return ObjectPointer; case 4: return DataPointer; default: Debug.Assert(false, "Bad field index"); return null; } } public static ulong GetKeywords() { return 0; } public static string GetProviderName() { return "Microsoft-Windows-RPC"; } public static Guid GetProviderGuid() { return new Guid("6ad52b32-d609-4be9-ae07-ce8dae937e39"); } private event Action Action; #endregion } public sealed class Debug10Args_V1TraceData : TraceEvent { public long SubjectPointer { get { return GetInt64At(0); } } public int FragmentSize { get { return GetInt32At(8); } } public byte[] Fragment { get { return GetByteArrayAt(12, FragmentSize); } } #region Private internal Debug10Args_V1TraceData(Action action, int eventID, int task, string taskName, Guid taskGuid, int opcode, string opcodeName, Guid providerGuid, string providerName) : base(eventID, task, taskName, taskGuid, opcode, opcodeName, providerGuid, providerName) { Action = action; } protected override void Dispatch() { Action(this); } protected override void Validate() { Debug.Assert(!(Version == 1 && EventDataLength != 0+ (FragmentSize*1)+12)); Debug.Assert(!(Version > 1 && EventDataLength < 0+ (FragmentSize*1)+12)); } protected override Delegate Target { get { return Action; } set { Action = (Action) value; } } public override StringBuilder ToXml(StringBuilder sb) { Prefix(sb); XmlAttrib(sb, "SubjectPointer", SubjectPointer); XmlAttrib(sb, "FragmentSize", FragmentSize); sb.Append("/>"); return sb; } public override string[] PayloadNames { get { if (payloadNames == null) payloadNames = new string[] { "SubjectPointer", "FragmentSize", "Fragment"}; return payloadNames; } } public override object PayloadValue(int index) { switch (index) { case 0: return SubjectPointer; case 1: return FragmentSize; default: Debug.Assert(false, "Bad field index"); return null; } } public static ulong GetKeywords() { return 0; } public static string GetProviderName() { return "Microsoft-Windows-RPC"; } public static Guid GetProviderGuid() { return new Guid("6ad52b32-d609-4be9-ae07-ce8dae937e39"); } private event Action Action; #endregion } public sealed class DebugStartArgs_V1TraceData : TraceEvent { public int ObjectType { get { return GetInt32At(0); } } public int Operation { get { return GetInt32At(4); } } public long Address { get { return GetInt64At(8); } } public long Data { get { return GetInt64At(16); } } #region Private internal DebugStartArgs_V1TraceData(Action action, int eventID, int task, string taskName, Guid taskGuid, int opcode, string opcodeName, Guid providerGuid, string providerName) : base(eventID, task, taskName, taskGuid, opcode, opcodeName, providerGuid, providerName) { Action = action; } protected override void Dispatch() { Action(this); } protected override void Validate() { Debug.Assert(!(Version == 1 && EventDataLength != 24)); Debug.Assert(!(Version > 1 && EventDataLength < 24)); } protected override Delegate Target { get { return Action; } set { Action = (Action) value; } } public override StringBuilder ToXml(StringBuilder sb) { Prefix(sb); XmlAttrib(sb, "ObjectType", ObjectType); XmlAttrib(sb, "Operation", Operation); XmlAttrib(sb, "Address", Address); XmlAttrib(sb, "Data", Data); sb.Append("/>"); return sb; } public override string[] PayloadNames { get { if (payloadNames == null) payloadNames = new string[] { "ObjectType", "Operation", "Address", "Data"}; return payloadNames; } } public override object PayloadValue(int index) { switch (index) { case 0: return ObjectType; case 1: return Operation; case 2: return Address; case 3: return Data; default: Debug.Assert(false, "Bad field index"); return null; } } public static ulong GetKeywords() { return 0; } public static string GetProviderName() { return "Microsoft-Windows-RPC"; } public static Guid GetProviderGuid() { return new Guid("6ad52b32-d609-4be9-ae07-ce8dae937e39"); } private event Action Action; #endregion } public sealed class DebugStopArgs_V1TraceData : TraceEvent { public RpcHttp2ObjectTypes ObjectType { get { return (RpcHttp2ObjectTypes)GetInt32At(0); } } public int Operation { get { return GetInt32At(4); } } public long Address { get { return GetInt64At(8); } } public long Data { get { return GetInt64At(16); } } #region Private internal DebugStopArgs_V1TraceData(Action action, int eventID, int task, string taskName, Guid taskGuid, int opcode, string opcodeName, Guid providerGuid, string providerName) : base(eventID, task, taskName, taskGuid, opcode, opcodeName, providerGuid, providerName) { Action = action; } protected override void Dispatch() { Action(this); } protected override void Validate() { Debug.Assert(!(Version == 1 && EventDataLength != 24)); Debug.Assert(!(Version > 1 && EventDataLength < 24)); } protected override Delegate Target { get { return Action; } set { Action = (Action) value; } } public override StringBuilder ToXml(StringBuilder sb) { Prefix(sb); XmlAttrib(sb, "ObjectType", ObjectType); XmlAttrib(sb, "Operation", Operation); XmlAttrib(sb, "Address", Address); XmlAttrib(sb, "Data", Data); sb.Append("/>"); return sb; } public override string[] PayloadNames { get { if (payloadNames == null) payloadNames = new string[] { "ObjectType", "Operation", "Address", "Data"}; return payloadNames; } } public override object PayloadValue(int index) { switch (index) { case 0: return ObjectType; case 1: return Operation; case 2: return Address; case 3: return Data; default: Debug.Assert(false, "Bad field index"); return null; } } public static ulong GetKeywords() { return 0; } public static string GetProviderName() { return "Microsoft-Windows-RPC"; } public static Guid GetProviderGuid() { return new Guid("6ad52b32-d609-4be9-ae07-ce8dae937e39"); } private event Action Action; #endregion } public sealed class FunctionTraceStartArgs_V1TraceData : TraceEvent { public Guid InterfaceUuid { get { return GetGuidAt(0); } } public Guid TypeMgrUuid { get { return GetGuidAt(16); } } public int Flags { get { return GetInt32At(32); } } public int MaxCalls { get { return GetInt32At(36); } } public int SDSize { get { return GetInt32At(40); } } public byte[] SD { get { return GetByteArrayAt(44, SDSize); } } #region Private internal FunctionTraceStartArgs_V1TraceData(Action action, int eventID, int task, string taskName, Guid taskGuid, int opcode, string opcodeName, Guid providerGuid, string providerName) : base(eventID, task, taskName, taskGuid, opcode, opcodeName, providerGuid, providerName) { Action = action; } protected override void Dispatch() { Action(this); } protected override void Validate() { Debug.Assert(!(Version == 1 && EventDataLength != 0+ (SDSize*1)+44)); Debug.Assert(!(Version > 1 && EventDataLength < 0+ (SDSize*1)+44)); } protected override Delegate Target { get { return Action; } set { Action = (Action) value; } } public override StringBuilder ToXml(StringBuilder sb) { Prefix(sb); XmlAttrib(sb, "InterfaceUuid", InterfaceUuid); XmlAttrib(sb, "TypeMgrUuid", TypeMgrUuid); XmlAttrib(sb, "Flags", Flags); XmlAttrib(sb, "MaxCalls", MaxCalls); XmlAttrib(sb, "SDSize", SDSize); sb.Append("/>"); return sb; } public override string[] PayloadNames { get { if (payloadNames == null) payloadNames = new string[] { "InterfaceUuid", "TypeMgrUuid", "Flags", "MaxCalls", "SDSize", "SD"}; return payloadNames; } } public override object PayloadValue(int index) { switch (index) { case 0: return InterfaceUuid; case 1: return TypeMgrUuid; case 2: return Flags; case 3: return MaxCalls; case 4: return SDSize; default: Debug.Assert(false, "Bad field index"); return null; } } public static ulong GetKeywords() { return 0; } public static string GetProviderName() { return "Microsoft-Windows-RPC"; } public static Guid GetProviderGuid() { return new Guid("6ad52b32-d609-4be9-ae07-ce8dae937e39"); } private event Action Action; #endregion } public sealed class FunctionTraceStart16Args_V1TraceData : TraceEvent { public string Protocol { get { return GetUnicodeStringAt(0); } } public string Endpoint { get { return GetUnicodeStringAt(SkipUnicodeString(0)); } } public string NetworkAddress { get { return GetUnicodeStringAt(SkipUnicodeString(SkipUnicodeString(0))); } } public int PendingQueueSize { get { return GetInt32At(SkipUnicodeString(SkipUnicodeString(SkipUnicodeString(0)))); } } public int EndpointFlags { get { return GetInt32At(SkipUnicodeString(SkipUnicodeString(SkipUnicodeString(0)))+4); } } public int NicFlags { get { return GetInt32At(SkipUnicodeString(SkipUnicodeString(SkipUnicodeString(0)))+8); } } #region Private internal FunctionTraceStart16Args_V1TraceData(Action action, int eventID, int task, string taskName, Guid taskGuid, int opcode, string opcodeName, Guid providerGuid, string providerName) : base(eventID, task, taskName, taskGuid, opcode, opcodeName, providerGuid, providerName) { Action = action; } protected override void Dispatch() { Action(this); } protected override void Validate() { Debug.Assert(!(Version == 1 && EventDataLength != SkipUnicodeString(SkipUnicodeString(SkipUnicodeString(0)))+12)); Debug.Assert(!(Version > 1 && EventDataLength < SkipUnicodeString(SkipUnicodeString(SkipUnicodeString(0)))+12)); } protected override Delegate Target { get { return Action; } set { Action = (Action) value; } } public override StringBuilder ToXml(StringBuilder sb) { Prefix(sb); XmlAttrib(sb, "Protocol", Protocol); XmlAttrib(sb, "Endpoint", Endpoint); XmlAttrib(sb, "NetworkAddress", NetworkAddress); XmlAttrib(sb, "PendingQueueSize", PendingQueueSize); XmlAttrib(sb, "EndpointFlags", EndpointFlags); XmlAttrib(sb, "NicFlags", NicFlags); sb.Append("/>"); return sb; } public override string[] PayloadNames { get { if (payloadNames == null) payloadNames = new string[] { "Protocol", "Endpoint", "NetworkAddress", "PendingQueueSize", "EndpointFlags", "NicFlags"}; return payloadNames; } } public override object PayloadValue(int index) { switch (index) { case 0: return Protocol; case 1: return Endpoint; case 2: return NetworkAddress; case 3: return PendingQueueSize; case 4: return EndpointFlags; case 5: return NicFlags; default: Debug.Assert(false, "Bad field index"); return null; } } public static ulong GetKeywords() { return 0; } public static string GetProviderName() { return "Microsoft-Windows-RPC"; } public static Guid GetProviderGuid() { return new Guid("6ad52b32-d609-4be9-ae07-ce8dae937e39"); } private event Action Action; #endregion } public sealed class FunctionTraceStopArgs_V1TraceData : TraceEvent { public Guid InterfaceUuid { get { return GetGuidAt(0); } } public Guid TypeMgrUuid { get { return GetGuidAt(16); } } public int Flags { get { return GetInt32At(32); } } public int MaxCalls { get { return GetInt32At(36); } } #region Private internal FunctionTraceStopArgs_V1TraceData(Action action, int eventID, int task, string taskName, Guid taskGuid, int opcode, string opcodeName, Guid providerGuid, string providerName) : base(eventID, task, taskName, taskGuid, opcode, opcodeName, providerGuid, providerName) { Action = action; } protected override void Dispatch() { Action(this); } protected override void Validate() { Debug.Assert(!(Version == 1 && EventDataLength != 40)); Debug.Assert(!(Version > 1 && EventDataLength < 40)); } protected override Delegate Target { get { return Action; } set { Action = (Action) value; } } public override StringBuilder ToXml(StringBuilder sb) { Prefix(sb); XmlAttrib(sb, "InterfaceUuid", InterfaceUuid); XmlAttrib(sb, "TypeMgrUuid", TypeMgrUuid); XmlAttrib(sb, "Flags", Flags); XmlAttrib(sb, "MaxCalls", MaxCalls); sb.Append("/>"); return sb; } public override string[] PayloadNames { get { if (payloadNames == null) payloadNames = new string[] { "InterfaceUuid", "TypeMgrUuid", "Flags", "MaxCalls"}; return payloadNames; } } public override object PayloadValue(int index) { switch (index) { case 0: return InterfaceUuid; case 1: return TypeMgrUuid; case 2: return Flags; case 3: return MaxCalls; default: Debug.Assert(false, "Bad field index"); return null; } } public static ulong GetKeywords() { return 0; } public static string GetProviderName() { return "Microsoft-Windows-RPC"; } public static Guid GetProviderGuid() { return new Guid("6ad52b32-d609-4be9-ae07-ce8dae937e39"); } private event Action Action; #endregion } public sealed class RpcClientCallStartArgs_V1TraceData : TraceEvent { public Guid InterfaceUuid { get { return GetGuidAt(0); } } public int ProcNum { get { return GetInt32At(16); } } public ProtocolSequences Protocol { get { return (ProtocolSequences)GetInt32At(20); } } public string NetworkAddress { get { return GetUnicodeStringAt(24); } } public string Endpoint { get { return GetUnicodeStringAt(SkipUnicodeString(24)); } } public string Options { get { return GetUnicodeStringAt(SkipUnicodeString(SkipUnicodeString(24))); } } public int AuthenticationLevel { get { return GetInt32At(SkipUnicodeString(SkipUnicodeString(SkipUnicodeString(24)))); } } public AuthenticationServices AuthenticationService { get { return (AuthenticationServices)GetInt32At(SkipUnicodeString(SkipUnicodeString(SkipUnicodeString(24)))+4); } } public int ImpersonationLevel { get { return GetInt32At(SkipUnicodeString(SkipUnicodeString(SkipUnicodeString(24)))+8); } } #region Private internal RpcClientCallStartArgs_V1TraceData(Action action, int eventID, int task, string taskName, Guid taskGuid, int opcode, string opcodeName, Guid providerGuid, string providerName) : base(eventID, task, taskName, taskGuid, opcode, opcodeName, providerGuid, providerName) { Action = action; } protected override void Dispatch() { Action(this); } protected override void Validate() { Debug.Assert(!(Version == 1 && EventDataLength != SkipUnicodeString(SkipUnicodeString(SkipUnicodeString(24)))+12)); Debug.Assert(!(Version > 1 && EventDataLength < SkipUnicodeString(SkipUnicodeString(SkipUnicodeString(24)))+12)); } protected override Delegate Target { get { return Action; } set { Action = (Action) value; } } public override StringBuilder ToXml(StringBuilder sb) { Prefix(sb); XmlAttrib(sb, "InterfaceUuid", InterfaceUuid); XmlAttrib(sb, "ProcNum", ProcNum); XmlAttrib(sb, "Protocol", Protocol); XmlAttrib(sb, "NetworkAddress", NetworkAddress); XmlAttrib(sb, "Endpoint", Endpoint); XmlAttrib(sb, "Options", Options); XmlAttrib(sb, "AuthenticationLevel", AuthenticationLevel); XmlAttrib(sb, "AuthenticationService", AuthenticationService); XmlAttrib(sb, "ImpersonationLevel", ImpersonationLevel); sb.Append("/>"); return sb; } public override string[] PayloadNames { get { if (payloadNames == null) payloadNames = new string[] { "InterfaceUuid", "ProcNum", "Protocol", "NetworkAddress", "Endpoint", "Options", "AuthenticationLevel", "AuthenticationService", "ImpersonationLevel"}; return payloadNames; } } public override object PayloadValue(int index) { switch (index) { case 0: return InterfaceUuid; case 1: return ProcNum; case 2: return Protocol; case 3: return NetworkAddress; case 4: return Endpoint; case 5: return Options; case 6: return AuthenticationLevel; case 7: return AuthenticationService; case 8: return ImpersonationLevel; default: Debug.Assert(false, "Bad field index"); return null; } } public static ulong GetKeywords() { return 0; } public static string GetProviderName() { return "Microsoft-Windows-RPC"; } public static Guid GetProviderGuid() { return new Guid("6ad52b32-d609-4be9-ae07-ce8dae937e39"); } private event Action Action; #endregion } public sealed class RpcClientCallStopArgs_V1TraceData : TraceEvent { public string ImageName { get { return GetUnicodeStringAt(0); } } public string ComputerName { get { return GetUnicodeStringAt(SkipUnicodeString(0)); } } public int ProcessID { get { return GetInt32At(SkipUnicodeString(SkipUnicodeString(0))); } } // Skipping TimeStamp public int GeneratingComponent { get { return GetInt32At(SkipUnicodeString(SkipUnicodeString(0))+4); } } public int Status { get { return GetInt32At(SkipUnicodeString(SkipUnicodeString(0))+8); } } public int DetectionLocation { get { return GetInt16At(SkipUnicodeString(SkipUnicodeString(0))+12); } } public int Flags { get { return GetInt16At(SkipUnicodeString(SkipUnicodeString(0))+14); } } public int NumberOfParameters { get { return GetInt16At(SkipUnicodeString(SkipUnicodeString(0))+16); } } public long Params(int arrayIndex) { return GetInt64At(SkipUnicodeString(SkipUnicodeString(0))+18 + (arrayIndex * HostOffset(8, 0))); } #region Private internal RpcClientCallStopArgs_V1TraceData(Action action, int eventID, int task, string taskName, Guid taskGuid, int opcode, string opcodeName, Guid providerGuid, string providerName) : base(eventID, task, taskName, taskGuid, opcode, opcodeName, providerGuid, providerName) { Action = action; } protected override void Dispatch() { Action(this); } protected override void Validate() { Debug.Assert(!(Version == 1 && EventDataLength != SkipUnicodeString(SkipUnicodeString(0))+18)); Debug.Assert(!(Version > 1 && EventDataLength < SkipUnicodeString(SkipUnicodeString(0))+18)); } protected override Delegate Target { get { return Action; } set { Action = (Action) value; } } public override StringBuilder ToXml(StringBuilder sb) { Prefix(sb); XmlAttrib(sb, "ImageName", ImageName); XmlAttrib(sb, "ComputerName", ComputerName); XmlAttrib(sb, "ProcessID", ProcessID); XmlAttrib(sb, "GeneratingComponent", GeneratingComponent); XmlAttrib(sb, "Status", Status); XmlAttrib(sb, "DetectionLocation", DetectionLocation); XmlAttrib(sb, "Flags", Flags); XmlAttrib(sb, "NumberOfParameters", NumberOfParameters); sb.Append("/>"); return sb; } public override string[] PayloadNames { get { if (payloadNames == null) payloadNames = new string[] { "ImageName", "ComputerName", "ProcessID", "GeneratingComponent", "Status", "DetectionLocation", "Flags", "NumberOfParameters", "Params"}; return payloadNames; } } public override object PayloadValue(int index) { switch (index) { case 0: return ImageName; case 1: return ComputerName; case 2: return ProcessID; case 3: return GeneratingComponent; case 4: return Status; case 5: return DetectionLocation; case 6: return Flags; case 7: return NumberOfParameters; default: Debug.Assert(false, "Bad field index"); return null; } } public static ulong GetKeywords() { return 0; } public static string GetProviderName() { return "Microsoft-Windows-RPC"; } public static Guid GetProviderGuid() { return new Guid("6ad52b32-d609-4be9-ae07-ce8dae937e39"); } private event Action Action; #endregion } public sealed class RpcClientCallStop7Args_V1TraceData : TraceEvent { public int Status { get { return GetInt32At(0); } } #region Private internal RpcClientCallStop7Args_V1TraceData(Action action, int eventID, int task, string taskName, Guid taskGuid, int opcode, string opcodeName, Guid providerGuid, string providerName) : base(eventID, task, taskName, taskGuid, opcode, opcodeName, providerGuid, providerName) { Action = action; } protected override void Dispatch() { Action(this); } protected override void Validate() { Debug.Assert(!(Version == 1 && EventDataLength != 4)); Debug.Assert(!(Version > 1 && EventDataLength < 4)); } protected override Delegate Target { get { return Action; } set { Action = (Action) value; } } public override StringBuilder ToXml(StringBuilder sb) { Prefix(sb); XmlAttrib(sb, "Status", Status); sb.Append("/>"); return sb; } public override string[] PayloadNames { get { if (payloadNames == null) payloadNames = new string[] { "Status"}; return payloadNames; } } public override object PayloadValue(int index) { switch (index) { case 0: return Status; default: Debug.Assert(false, "Bad field index"); return null; } } public static ulong GetKeywords() { return 0; } public static string GetProviderName() { return "Microsoft-Windows-RPC"; } public static Guid GetProviderGuid() { return new Guid("6ad52b32-d609-4be9-ae07-ce8dae937e39"); } private event Action Action; #endregion } public sealed class RpcServerCallArgs_V1TraceData : TraceEvent { public string ImangeName { get { return GetUnicodeStringAt(0); } } public Guid InterfaceUuid { get { return GetGuidAt(SkipUnicodeString(0)); } } public Guid FilterKey { get { return GetGuidAt(SkipUnicodeString(0)+16); } } #region Private internal RpcServerCallArgs_V1TraceData(Action action, int eventID, int task, string taskName, Guid taskGuid, int opcode, string opcodeName, Guid providerGuid, string providerName) : base(eventID, task, taskName, taskGuid, opcode, opcodeName, providerGuid, providerName) { Action = action; } protected override void Dispatch() { Action(this); } protected override void Validate() { Debug.Assert(!(Version == 1 && EventDataLength != SkipUnicodeString(0)+32)); Debug.Assert(!(Version > 1 && EventDataLength < SkipUnicodeString(0)+32)); } protected override Delegate Target { get { return Action; } set { Action = (Action) value; } } public override StringBuilder ToXml(StringBuilder sb) { Prefix(sb); XmlAttrib(sb, "ImangeName", ImangeName); XmlAttrib(sb, "InterfaceUuid", InterfaceUuid); XmlAttrib(sb, "FilterKey", FilterKey); sb.Append("/>"); return sb; } public override string[] PayloadNames { get { if (payloadNames == null) payloadNames = new string[] { "ImangeName", "InterfaceUuid", "FilterKey"}; return payloadNames; } } public override object PayloadValue(int index) { switch (index) { case 0: return ImangeName; case 1: return InterfaceUuid; case 2: return FilterKey; default: Debug.Assert(false, "Bad field index"); return null; } } public static ulong GetKeywords() { return 0; } public static string GetProviderName() { return "Microsoft-Windows-RPC"; } public static Guid GetProviderGuid() { return new Guid("6ad52b32-d609-4be9-ae07-ce8dae937e39"); } private event Action Action; #endregion } public sealed class RpcServerCallStartArgs_V1TraceData : TraceEvent { public Guid InterfaceUuid { get { return GetGuidAt(0); } } public int ProcNum { get { return GetInt32At(16); } } public int Protocol { get { return GetInt32At(20); } } public string NetworkAddress { get { return GetUnicodeStringAt(24); } } public string Endpoint { get { return GetUnicodeStringAt(SkipUnicodeString(24)); } } public string Options { get { return GetUnicodeStringAt(SkipUnicodeString(SkipUnicodeString(24))); } } public int AuthenticationLevel { get { return GetInt32At(SkipUnicodeString(SkipUnicodeString(SkipUnicodeString(24)))); } } public int AuthenticationService { get { return GetInt32At(SkipUnicodeString(SkipUnicodeString(SkipUnicodeString(24)))+4); } } public ImpersonationLevels ImpersonationLevel { get { return (ImpersonationLevels)GetInt32At(SkipUnicodeString(SkipUnicodeString(SkipUnicodeString(24)))+8); } } #region Private internal RpcServerCallStartArgs_V1TraceData(Action action, int eventID, int task, string taskName, Guid taskGuid, int opcode, string opcodeName, Guid providerGuid, string providerName) : base(eventID, task, taskName, taskGuid, opcode, opcodeName, providerGuid, providerName) { Action = action; } protected override void Dispatch() { Action(this); } protected override void Validate() { Debug.Assert(!(Version == 1 && EventDataLength != SkipUnicodeString(SkipUnicodeString(SkipUnicodeString(24)))+12)); Debug.Assert(!(Version > 1 && EventDataLength < SkipUnicodeString(SkipUnicodeString(SkipUnicodeString(24)))+12)); } protected override Delegate Target { get { return Action; } set { Action = (Action) value; } } public override StringBuilder ToXml(StringBuilder sb) { Prefix(sb); XmlAttrib(sb, "InterfaceUuid", InterfaceUuid); XmlAttrib(sb, "ProcNum", ProcNum); XmlAttrib(sb, "Protocol", Protocol); XmlAttrib(sb, "NetworkAddress", NetworkAddress); XmlAttrib(sb, "Endpoint", Endpoint); XmlAttrib(sb, "Options", Options); XmlAttrib(sb, "AuthenticationLevel", AuthenticationLevel); XmlAttrib(sb, "AuthenticationService", AuthenticationService); XmlAttrib(sb, "ImpersonationLevel", ImpersonationLevel); sb.Append("/>"); return sb; } public override string[] PayloadNames { get { if (payloadNames == null) payloadNames = new string[] { "InterfaceUuid", "ProcNum", "Protocol", "NetworkAddress", "Endpoint", "Options", "AuthenticationLevel", "AuthenticationService", "ImpersonationLevel"}; return payloadNames; } } public override object PayloadValue(int index) { switch (index) { case 0: return InterfaceUuid; case 1: return ProcNum; case 2: return Protocol; case 3: return NetworkAddress; case 4: return Endpoint; case 5: return Options; case 6: return AuthenticationLevel; case 7: return AuthenticationService; case 8: return ImpersonationLevel; default: Debug.Assert(false, "Bad field index"); return null; } } public static ulong GetKeywords() { return 0; } public static string GetProviderName() { return "Microsoft-Windows-RPC"; } public static Guid GetProviderGuid() { return new Guid("6ad52b32-d609-4be9-ae07-ce8dae937e39"); } private event Action Action; #endregion } public sealed class task_0Args_V1TraceData : TraceEvent { public string ImageName { get { return GetUnicodeStringAt(0); } } public int DetectionLocation { get { return GetInt16At(SkipUnicodeString(0)); } } public int Status { get { return GetInt32At(SkipUnicodeString(0)+2); } } public int AdditionalData1 { get { return GetInt32At(SkipUnicodeString(0)+6); } } public int AdditionalData2 { get { return GetInt32At(SkipUnicodeString(0)+10); } } #region Private internal task_0Args_V1TraceData(Action action, int eventID, int task, string taskName, Guid taskGuid, int opcode, string opcodeName, Guid providerGuid, string providerName) : base(eventID, task, taskName, taskGuid, opcode, opcodeName, providerGuid, providerName) { Action = action; } protected override void Dispatch() { Action(this); } protected override void Validate() { Debug.Assert(!(Version == 1 && EventDataLength != SkipUnicodeString(0)+14)); Debug.Assert(!(Version > 1 && EventDataLength < SkipUnicodeString(0)+14)); } protected override Delegate Target { get { return Action; } set { Action = (Action) value; } } public override StringBuilder ToXml(StringBuilder sb) { Prefix(sb); XmlAttrib(sb, "ImageName", ImageName); XmlAttrib(sb, "DetectionLocation", DetectionLocation); XmlAttrib(sb, "Status", Status); XmlAttrib(sb, "AdditionalData1", AdditionalData1); XmlAttrib(sb, "AdditionalData2", AdditionalData2); sb.Append("/>"); return sb; } public override string[] PayloadNames { get { if (payloadNames == null) payloadNames = new string[] { "ImageName", "DetectionLocation", "Status", "AdditionalData1", "AdditionalData2"}; return payloadNames; } } public override object PayloadValue(int index) { switch (index) { case 0: return ImageName; case 1: return DetectionLocation; case 2: return Status; case 3: return AdditionalData1; case 4: return AdditionalData2; default: Debug.Assert(false, "Bad field index"); return null; } } public static ulong GetKeywords() { return 0; } public static string GetProviderName() { return "Microsoft-Windows-RPC"; } public static Guid GetProviderGuid() { return new Guid("6ad52b32-d609-4be9-ae07-ce8dae937e39"); } private event Action Action; #endregion } public enum AuthenticationServices { Negotiate = 0x9, NTLM = 0xa, SChannel = 0xe, Kerberos = 0x10, Kernel = 0x14, } public enum ImpersonationLevels { Default = 0x0, Anonymous = 0x1, Identify = 0x2, Impersonate = 0x3, Delegate = 0x4, } public enum ProtocolSequences { TCP = 0x1, NamedPipes = 0x2, LRPC = 0x3, RPCHTTP = 0x4, } public enum RpcHttp2ObjectTypes { SOCKET_CHANNEL = 0x1, PROXY_SOCKET_CHANNEL = 0x2, CHANNEL = 0x3, BOTTOM_CHANNEL = 0x4, IIS_CHANNEL = 0x5, RAW_CONNECTION = 0x6, INITIAL_RAW_CONNECTION = 0x7, IIS_SENDER_CHANNEL = 0x8, ENDPOINT_RECEIVER = 0x9, PLUG_CHANNEL = 0xa, CLIENT_VC = 0xb, SERVER_VC = 0xc, INPROXY_VC = 0xd, OUTPROXY_VC = 0xe, PROXY_VC = 0xf, CDATA_ORIGINATOR = 0x10, CLIENT_CHANNEL = 0x11, CALLBACK = 0x12, FLOW_CONTROL_SENDER = 0x13, WINHTTP_CALLBACK = 0x14, WINHTTP_CHANNEL = 0x15, WINHTTP_RAW = 0x16, PROXY_RECEIVER = 0x17, SERVER_CHANNEL = 0x18, FRAGMENT_RECEIVER = 0x19, } public enum SubjectTypes { ASSOC = 0x2e, HTTPv2 = 0x32, SASSOC = 0x41, BCACHE2 = 0x42, SCALL = 0x43, ADDRESS = 0x44, ENGINE = 0x45, CAUSAL_F = 0x46, GC = 0x47, HEAP = 0x48, EEINFO = 0x49, ALPC = 0x4c, RESERVED_MEM = 0x4d, SCONN = 0x4e, CORRUPT = 0x4f, PROVIDER = 0x50, SECCRED = 0x53, STABLE = 0x54, PROTOCOL = 0x57, CASSOC = 0x61, BCACHE = 0x62, CCALL = 0x63, TP_ALPC = 0x64, CENDPOINT = 0x65, TP_CALLBACK = 0x66, HANDLE = 0x68, IF = 0x69, TP_IO = 0x6a, TP_WORK = 0x6b, CTXHANDLE = 0x6c, MUTEX = 0x6d, CCONN = 0x6e, TRANS_CONN = 0x6f, PACKET = 0x70, REFOBJ = 0x72, SSECCTX = 0x73, THREAD = 0x74, TP_TIMER = 0x75, EVENT = 0x76, TP_WAIT = 0x77, EXCEPT = 0x78, } }