GetDataFromController()

unsafe bool System.Diagnostics.Tracing.EventProvider.GetDataFromController ( int etwSessionId, Interop::Advapi32::EVENT_FILTER_DESCRIPTOR * filterData, out ControllerCommand command, out byte[] data, out int dataStart )

inlineprivateinherited

Definition at line 415 of file EventProvider.cs.

    {
        data = null;
        dataStart = 0;
        if (filterData == null)
        {
            string text = "\\Microsoft\\Windows\\CurrentVersion\\Winevt\\Publishers\\{" + m_providerId.ToString() + "}";
            _ = IntPtr.Size;
            text = "Software\\Wow6432Node" + text;
            string name = "ControllerData_Session_" + etwSessionId.ToString(CultureInfo.InvariantCulture);
            using (RegistryKey registryKey = Registry.LocalMachine.OpenSubKey(text))
            {
                data = registryKey?.GetValue(name, null) as byte[];
                if (data != null)
                {
                    command = ControllerCommand.Update;
                    return true;
                }
            }
            command = ControllerCommand.Update;
            return false;
        }
        if (filterData->Ptr != 0L && 0 < filterData->Size && filterData->Size <= 102400)
        {
            data = new byte[filterData->Size];
            Marshal.Copy((IntPtr)(void*)filterData->Ptr, data, 0, data.Length);
        }
        command = (ControllerCommand)filterData->Type;
        return true;
    }

References System.Runtime.InteropServices.Marshal.Copy(), System.Globalization.CultureInfo.InvariantCulture, System.L, Internal.Win32.Registry.LocalMachine, System.Diagnostics.Tracing.EventProvider.m_providerId, System.IntPtr.Size, System.text, and System.Guid.ToString().

Referenced by System.Diagnostics.Tracing.EventProvider.EtwEnableCallBack().