Obj ref

ETWAnalyzer/Commands/ExtractCommand.cs

@@ -25,6 +25,7 @@
 using ETWAnalyzer.Extractors.TCP;
 using ETWAnalyzer.Extractors.Memory;
 using ETWAnalyzer.Extractors.Power;
+using ETWAnalyzer.Extractors.Handle;
 
 namespace ETWAnalyzer.Commands
 {
@@ -63,6 +64,7 @@ class ExtractCommand : ArgParser
          "  Power     : Extract Power profile data when present from Microsoft-Windows-Kernel-Power provider (capture state is needed to get power profile data)." + Environment.NewLine +
          "  DNS       : Extract DNS Queries. You need to enable ETW provider Microsoft-Windows-DNS-Client." + Environment.NewLine +
          "  TCP       : Extract TCP statistic per connection. You need to enable the provider Microsoft-Windows-TCPIP." + Environment.NewLine +
+         "  ObjectRef : Extract all Handle (Create/Duplicate/Close) with kernel provider OB_HANDLE, Object (AddRef/ReleaseRef) with kernel provider OB_OBJECT and File map/unmap events with provider VAMAP." + Environment.NewLine +
          "The following filters work only if the adhere to a specific file naming convention." + Environment.NewLine + 
          "Select files from a testrun (all tests which have a time gap < 1h) to e.g. select only the first, or skip the warmump run or to extract just a sample of test cases." + Environment.NewLine +
          "         TestCaseName_ddddmsMachineName.yyyymmdd-hhmmss.7z/.zip/.etl  e.g. Build_166375msfv-az192-659.20230127-093520"  + Environment.NewLine + 
@@ -174,6 +176,7 @@ public enum ExtractionOptions
             TCP,
             Frequency,
           //  VirtualAlloc,
+            ObjectRef,
             Power,
         }
 
@@ -202,7 +205,8 @@ public enum ExtractionOptions
             { ExtractionOptions.Dns,         () => new DnsClientExtractor()    },
             { ExtractionOptions.TCP,         () => new TCPExtractor()          },
             { ExtractionOptions.Frequency,   () => new CpuFrequencyExtractor() },
-       //    { ExtractionOptions.VirtualAlloc,() => new VirtualAllocExtractor() },
+            //    { ExtractionOptions.VirtualAlloc,() => new VirtualAllocExtractor() },
+            { ExtractionOptions.ObjectRef,   () => new ObjectRefExtractor() },
             { ExtractionOptions.Power       ,() => new PowerExtractor() },
         };
 
@@ -554,6 +558,7 @@ public void ConfigureExtractors(List<ExtractorBase> extractors, List<string> str
                         extractors.Add(myExtractorFactory[ExtractionOptions.Dns]());
                         extractors.Add(myExtractorFactory[ExtractionOptions.TCP]());
                         extractors.Add(myExtractorFactory[ExtractionOptions.Power]());
+                        extractors.Add(myExtractorFactory[ExtractionOptions.ObjectRef]());
                  //       extractors.Add(myExtractorFactory[ExtractionOptions.VirtualAlloc]());
                     }
                     else

ETWAnalyzer/ETWAnalyzer.csproj

@@ -22,7 +22,7 @@
     <PackageRequireLicenseAcceptance>True</PackageRequireLicenseAcceptance>
     <PackageProjectUrl>https://github.com/Siemens-Healthineers/ETWAnalyzer</PackageProjectUrl>
     <PackageReadmeFile>ProgramaticAccess.md</PackageReadmeFile>
-    <Version>3.0.0.3</Version>
+    <Version>3.0.0.4</Version>
     <Platforms>x64</Platforms>
     <ServerGarbageCollection>true</ServerGarbageCollection>
     <GarbageCollectionAdaptationMode>1</GarbageCollectionAdaptationMode>

ETWAnalyzer/EventDump/DumpBase.cs

@@ -172,8 +172,9 @@ protected virtual string GetAbbreviatedName(TimeFormats format)
         /// <param name="time">Local time</param>
         /// <param name="sessionStart">Trace sessions start time</param>
         /// <param name="fmt">Controls how time is formatted.</param>
+        /// <param name="precision">decimal numbers after second. Default is 3.</param>
         /// <returns>Formatted time locale independent.</returns>
-        protected string GetTimeString(DateTimeOffset ?time, DateTimeOffset sessionStart, TimeFormats fmt)
+        protected string GetTimeString(DateTimeOffset ?time, DateTimeOffset sessionStart, TimeFormats fmt, int precision=3)
         {
             string lret = "";
 
@@ -182,20 +183,25 @@ protected string GetTimeString(DateTimeOffset ?time, DateTimeOffset sessionStart
                 Tuple<double?,DateTime?>  newTime = ConvertTime(time.Value, sessionStart, fmt);
                 if (newTime.Item1.HasValue) // interpret as timespan 
                 {
-                    lret = FormatAsSeconds(newTime.Item1.Value);
+                    lret = FormatAsSeconds(newTime.Item1.Value, precision);
                 }
                 else
                 {
-                    lret = newTime.Item2.Value.ToString(TimeFormat, CultureInfo.InvariantCulture);
+                    string preciseFormat = TimeFormat;
+                    if( precision > 3)
+                    {
+                        preciseFormat += new string('f', precision - 3);
+                    }
+                    lret = newTime.Item2.Value.ToString(preciseFormat, CultureInfo.InvariantCulture);
                 }
             }
 
             return lret;
         }
 
-        private static string FormatAsSeconds(double timeInS)
+        private static string FormatAsSeconds(double timeInS, int precision)
         {
-            string seconds = timeInS.ToString("F3", CultureInfo.InvariantCulture);
+            string seconds = timeInS.ToString($"F{precision}", CultureInfo.InvariantCulture);
             return seconds;
         }
 
@@ -317,7 +323,7 @@ protected string GetDateTimeString(Tuple<double?,DateTime?> time)
             string lret = "";
             if( time.Item1.HasValue) // interpret as timespan
             {
-                lret = FormatAsSeconds(time.Item1.Value);
+                lret = FormatAsSeconds(time.Item1.Value,3);
             }
             else
             {

ETWAnalyzer/EventDump/DumpCommands.cs

@@ -103,5 +103,10 @@ public enum DumpCommands
         /// Dump TCP data
         /// </summary>
         TCP,
+
+        /// <summary>
+        /// Dump Handle Object Reference Data
+        /// </summary>
+        ObjectRef,
     }
 }