[event_trace] Add a way to pass a Python object to an ETW trace's

context

It may be useful to pass a python object (e.g. class) to the ETW
processing callback. The ETW tracing API allows the user to fill out a
"Context" field with a pointer value that will be passed to the event
being sent, the rest is ctypes magic for wrapping the python object
into a native pointer value.
This commit is contained in:
1orenz0
2019-10-01 09:02:21 +01:00
committed by hakril
parent bfeb2e6dec
commit 6125a1fb15
+9 -1
View File
@@ -48,6 +48,10 @@ class EventRecord(gdef.EVENT_RECORD):
def level(self):
return self.EventHeader.EventDescriptor.Level
@property
def context(self):
return ctypes.py_object.from_address(self.UserContext).value
@property
def user_data(self):
"""Event specific data
@@ -217,7 +221,7 @@ class EtwTrace(object):
return windows.winproxy.EnableTraceEx2(self.handle, guid, EVENT_CONTROL_CODE_ENABLE_PROVIDER, level , any_keyword, all_keyword, 0, None)
def process(self, callback, begin=None, end=None):
def process(self, callback, begin=None, end=None, context = None):
if end == "now":
end = gdef.FILETIME()
windows.winproxy.GetSystemTimeAsFileTime(end)
@@ -233,6 +237,10 @@ class EtwTrace(object):
# logfile.ProcessTraceMode |= gdef.PROCESS_TRACE_MODE_REAL_TIME
logfile.LogFileName = self.logfile
if context:
context_ptr = ctypes.pointer(ctypes.py_object(context))
logfile.Context = ctypes.cast(context_ptr, ctypes.c_void_p)
@ctypes.WINFUNCTYPE(gdef.PVOID, PEventRecord)
def real_callback(record_ptr):
try: