Reading Windows Event Payload Including Complex Data

Question

In my previous question here I posted the xml I am trying to serialize. Here is another XML example:

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"> 
    <System> 
        <Provider Name="XXXXXXXXXX" Guid="{YYYYYYYY}" />  
        <EventID>XYZ</EventID>  
        <Version>0</Version>  
        <Level>L</Level>  
        <Task>A</Task>  
        <Opcode>0</Opcode>  
        <Keywords>0x000xyzh</Keywords>  
        <TimeCreated SystemTime="2012-06-28T15:44:04.997837000Z" />  
        <EventRecordID>153</EventRecordID>  
        <Correlation ActivityID="{DDDDDDDDD}" />  
        <Execution ProcessID="199999" ThreadID="90990" />  
        <Channel>Microsoft-Windows-ABCDEFG/Admin</Channel>  
        <Computer>myPC</Computer>  
        <Security UserID="ABCABC" />  
    </System> 
    <EventData> 
        <Data Name="name1">data1</Data>  
        <Data Name="name2">data2</Data>  
        <Data Name="name3">data3</Data>  
        <ComplexData Name="XYZXYZ">0C004300310022002D004400460053005400450053002200310003004E0053003200230041002D00570041002D00320045004400000047006C002900620061006C0048006900670068005000720069006F007200240074006600120044006100730087000000000000000000000000000000</ComplexData> 
    </EventData> 
    <RenderingInfo Culture="en-US"> 
        <Message>some message </Message>  
        <Level>Information</Level>  
        <Task>XYZ</Task>  
        <Opcode>Info</Opcode>  
        <Channel />  
        <Provider />  
        <Keywords> 
            <Keyword>XYZ</Keyword>  
        </Keywords> 
    </RenderingInfo> 
</Event> 

One difference is that it has Complex Data which is a struct that defines an array of integer values (lengths of following strings ...etc) and string unicodes. I figured out a way to decode that string by byte by byte but I need a cleaner way to do that. If EventRecord.ToXml() is not the best way to get the event payload including complex data / structs/ arrays then what is the best way to get that. There are a lot of Windows Event related classes on msdn and I do not know which one to use.

Thanks

EDIT: Here is some sample of what I knwo about ComplexData:

              <data  
                  inType="win:UInt16"  
                  name="XYZLength"  
                  />  
              <data  
                  inType="win:UnicodeString"  
                  length="XYZLength"  
                  name="XYZ"  
                  />  

Which means that the first two bytes (lower endian format) are the length of the following unicode string and so on. And for the ones that have no length, I need to find the null termination which is 16 bits of zeros (2 bytes of zeros).

Yeld

Any Idea how to solve this will be really appreciated. Thanks – Yeld

Answer 1

public class Event
{
    [XmlArrayItem(typeof(Data))]
    [XmlArrayItem(typeof(ComplexData))]
    public object[] EventData;
}

public class Data
{
    [XmlAttribute]
    public string Name { get; set; }

    [XmlText]
    public string Value { get; set; }
}

public class ComplexData
{
    [XmlAttribute]
    public string Name { get; set; }

    [XmlText(DataType = "hexBinary")]
    public byte[] Encoded { get; set; }
}

Please read the documentation:

• Introducing XML Serialization
• Controlling XML Serialization Using Attributes
• Examples of XML Serialization

Judicious

Thank you Markus. This gets me the data from Xml but is there a way to get it without parsing the Hex to unicode ? – Yeld

I can get it to byte[], but I am unsure about the data-format. – Judicious

so If I know the data format (say the struct that forms the Event) will I be able to parse that easily? Thanks – Yeld

by just adding more objects/classes? – Yeld

If you are talking about writing your own classes, then yes. If you are talking about library classes, they have to be in a format supported by XmlSerializer. Probably annotated with attributes. – Judicious

Thank You. So is what I added in the Edit possible to decode with just simple class definitions? – Yeld

No. XmlSerializer only knows XML and some simple data-types. – Judicious

OK then. I have to do it the hard way – Yeld

You could use BinaryReader on the byte-array. – Judicious