in Source/Tx.Windows/EtwTdh/EtwTdhEventInfo.cs [193:234]
Dictionary<uint, string> ReadTdhMap(string mapName, ref EtwNativeEvent e)
{
IntPtr pMapName = Marshal.StringToBSTR(mapName);
int bufferSize = 0;
int status = EtwNativeMethods.TdhGetEventMapInformation(
ref *e.record,
pMapName,
IntPtr.Zero, ref bufferSize);
if (122 != status) // ERROR_INSUFFICIENT_BUFFER
{
throw new Exception("Unexpected TDH status " + status);
}
var mybuffer = Marshal.AllocHGlobal(bufferSize);
status = EtwNativeMethods.TdhGetEventMapInformation(
ref *e.record,
pMapName,
mybuffer, ref bufferSize);
if (status != 0)
{
throw new Exception("TDH status " + status);
}
EVENT_MAP_INFO* mapInfo = (EVENT_MAP_INFO*)mybuffer;
byte* startMap = (byte*)mapInfo;
var name1 = CopyString(startMap, mapInfo->NameOffset);
byte* endMap = startMap + sizeof(EVENT_MAP_INFO);
var map = new Dictionary<uint, string>();
for (int i = 0; i < mapInfo->EntryCount; i++)
{
EVENT_MAP_ENTRY* mapEntry = (EVENT_MAP_ENTRY*)endMap + i;
uint value = mapEntry->Value;
string name = CopyString(startMap, mapEntry->OutputOffset);
map.Add(value, name);
}
return map;
}