windows-xp/Source/XPSP1/NT/sdktools/trace/traceprt/traceprt.c

/*++

Copyright (c) 1997-2000  Microsoft Corporation

Module Name:

    traceprt.c

Abstract:

    Trace formatting library. Converts binary trace file to CSV format,
    and other formattted string formats.

Author:

    Jee Fung Pang (jeepang) 03-Dec-1997

Revision History:

    GorN: 10/09/2000: ItemHRESULT added

--*/
#ifdef __cplusplus
extern "C"{
#endif
#define UNICODE
#define _UNICODE

#include <stdio.h>
#include <stdlib.h>
#include <nt.h>
#include <ntrtl.h>
#include <nturtl.h>
#include <windows.h>
#include <shellapi.h>
#include <tchar.h>
#include <wmistr.h>
#include <initguid.h>
#include <evntrace.h>
#include <ntwmi.h>
#include <netevent.h>
#include <netevent.dbg>
#include <winerror.dbg>
#pragma warning( disable : 4005)  // Disable warning message 4005
#include <ntstatus.h>
#include <ntstatus.dbg>
#pragma warning( default : 4005)  // Enable warning message 4005
#define TRACE_EXPORTS 1
#include "traceint.h"
#undef TRACE_API
#define TRACE_API
#include "traceprt.h"

#include <sddl.h> // for ConvertStringSidToSid //

// %1                   GUID Friendly Name                      string
// %2                   GUID SubType Name                       string
// %3                   Thread ID                               ULONG_PTR
// %4                   System Time                             String
// %5                   Kernel Time     or User Time            String
// %6                   User Time       or NULL                 String
// %7                   Sequence Number                         LONG
// %8                   Unused                                  String
// %9                   CPU Number                              LONG
// %128                 Indent                                  String

ULONG TimerResolution = 10;
__int64 ElapseTime;

ULONG UserMode = FALSE ; // TODO: Pick this up from the stream itself.

#define MAXBUFS    4096
#define MAXCHARS    MAXBUFS/sizeof(TCHAR)
#define MAXBUFS2    2 * MAXBUFS
#define MAXCHARS2   MAXBUFS2/sizeof(TCHAR)
#define MAXITEMS    256
#define MAXINDENT   256
#define MAXNAMEARG  256

TCHAR   ItemBuf[MAXBUFS];      // Temporary String Item buffer
TCHAR   ItemBBuf[MAXBUFS2];     // Item String Buffer
TCHAR * pItemBuf[MAXITEMS];    // Pointer to items in the String Item Buffer.
BYTE    ItemRBuf[MAXBUFS];     // Item Raw Byte Buffer
ULONG_PTR * pItemRBuf[MAXITEMS];   // Pointer to Raw Byte Items
SIZE_T  ItemRSize;             // Size of Item in Raw Buffer.
BOOL	bItemIsString = FALSE ;	// And type of item
int     iItemCount, i;
LONG    ItemsInBuf = 0;
LONG    ItemsInRBuf = 0;
ULONG PointerSize = sizeof(PVOID) ;
BYTE  Event[4096];
HANDLE hLibrary ;
TCHAR   StdPrefix[MAXSTR];
TCHAR   IndentBuf[MAXINDENT + 1];
INT     Indent;

#define TRACE_FORMAT_SEARCH_PATH L"TRACE_FORMAT_SEARCH_PATH"
#define TRACE_FORMAT_PREFIX      L"TRACE_FORMAT_PREFIX"
//#define STD_PREFIX               L"[%!CPU!]%!PID!.%!TID!::%!NOW! [%!FILE!] "
#define STD_PREFIX_NOSEQ         L"[%9!d!]%8!04X!.%3!04X!::%4!s! [%1!s!]"
#define STD_PREFIX_SEQ           L"[%9!d!]%8!04X!.%3!04X!::%4!s! %7!08x! [%1!s!]"

TCHAR *STD_PREFIX = STD_PREFIX_NOSEQ;
BOOL   bSequence = FALSE;
BOOL   bGmt = FALSE;
BOOL   bIndent = FALSE;

TCHAR *pNoValueString = _T("<NoValue>");

void ReplaceStringUnsafe(TCHAR* buf, TCHAR* find, TCHAR* replace)
{
    TCHAR source[MAXCHARS], *src, *dst;
    int nf = _tcslen(find);
    int nr = _tcslen(replace);

    src = source;
    dst = buf;

    _tcsncpy(source, buf, MAXCHARS );

    for(;;) {
        TCHAR* p = src;
        for(;;) {
            p = _tcsstr(p, find);
            if (!p) goto exit_outer_loop;
            // special kludge not to replace
            // %!Someting! when it is actually %%!Something!
            if (p == source || p[0] != '%' || p[-1] != '%') {
                break;
            }
            p += nf;
        }
        memcpy(dst, src, (p-src) * sizeof(TCHAR) );
        dst += p-src;
        src = p + nf;
        _tcsncpy(dst, replace,(MAXCHARS - (p-source)));
        dst += nr;
    }
exit_outer_loop:
    _tcscpy(dst, src);
}

TCHAR* FindValue(TCHAR* buf, TCHAR* ValueName) 
{
    static TCHAR valueBuf[256]; // largest identifier in PDB
    TCHAR *p = _tcsstr(buf, ValueName); 
    TCHAR *q = p;   
    if (p) {
         p += _tcslen(ValueName);
         q = p;
         while ( *p && !isspace(*p) ) ++p;
         memcpy(valueBuf, q, (p-q) * sizeof(TCHAR) );
    }
    valueBuf[p-q] = 0;
    return valueBuf;
}

int FindIntValue(TCHAR* buf, TCHAR* ValueName)
{
    TCHAR* v = FindValue(buf, ValueName), *end;
    int sgn = 1;
    
    if (v[0] == '+') {
       ++v;
    } else if (v[0] == '-') {
       sgn = -1;
       ++v;
    } 
    return sgn * _tcstol(v, &end, 10);
}


PMOF_INFO
GetMofInfoHead(
        OUT PLIST_ENTRY * EventListhead,
        IN  LPGUID        pGuid,
        IN  LPTSTR        strType,
        IN  LONG          TypeIndex,
        IN  ULONG         TypeOfType,
        IN  LPTSTR        TypeFormat,
        IN  BOOL          bBestMatch
    );

void   RemoveMofInfo(PLIST_ENTRY pMofInfo);
ULONG  ahextoi(TCHAR *s);
PTCHAR GuidToString(PTCHAR s, LPGUID piid);


ULONG
WINAPI
GetTraceGuidsW(
        TCHAR       * GuidFile,
        PLIST_ENTRY * HeadEventList
        );



static
void
reduce(
        PCHAR Src
        )
{
    char *Start = Src;
    if (!Src)
        return;
    while (*Src)
    {
        if ('\t' == *Src)
            *Src = ' ';
        else if (',' == *Src)
            *Src = ' ';
        else if ('\n' == *Src)
            *Src = ',';
        else if ('\r' == *Src)
            *Src = ' ';
        ++Src;
    }
    --Src;
    while ((Start < Src) && ((' ' == *Src) || (',' == *Src)))
    {
        *Src = 0x00;
        --Src;
    }
}

static void reduceW(WCHAR *Src)
{
    WCHAR *Start = Src;
    if (!Src)
        return;
    while (*Src)
    {
        if (L'\t' == *Src)
            *Src = L' ';
        else if (L',' == *Src)
            *Src = L' ';
        else if (L'\n' == *Src)
            *Src = L',';
        else if (L'\r' == *Src)
            *Src = L' ';
        ++Src;
    }
    --Src;
    while ((Start < Src) && ((L' ' == *Src) || (L',' == *Src)))
    {
        *Src = 0x00;
        --Src;
    }
}

#ifdef UNICODE
# define _stnprintf _snwprintf
#else
# define _stnprintf _snprintf
#endif

int FormatTimeDelta(TCHAR *buffer, size_t count, LONGLONG time)
{
	SYSTEMTIME st;
	int s = 0, result;
	ZeroMemory(&st, sizeof(st) );

	if (count == 0)
		return -1;

	if (time < 0) {
		*buffer++ = '-'; 
		--count;
		time = -time;
		s = 1;
	}

	// Get rid of the nano and micro seconds

	time /= 10000;

	st.wMilliseconds = (USHORT)(time % 1000);
	time /= 1000;

	if (time == 0) {
		result = _stnprintf(buffer,count,L"%dms",st.wMilliseconds); 
		goto end;
	}

	st.wSecond = (USHORT)(time % 60);

	time /= 60;

	st.wMinute = (USHORT)(time % 60);

	time /= 60;

	if (time == 0) {
		if (st.wMinute <= 10) {
			result = _stnprintf(buffer,count,L"%d.%03ds",st.wMinute * 60 + st.wSecond, st.wMilliseconds); 
		} else {
			result = _stnprintf(buffer,count,L"%d:%d.%03ds",st.wMinute, st.wSecond, st.wMilliseconds); 
		}
		goto end;
	}
	st.wHour = (USHORT)(time % 24);

	time /= 24;
	if (time == 0) {
		result = _stnprintf(buffer,count,L"%d:%d:%d.%03ds",st.wHour, st.wMinute, st.wSecond, st.wMilliseconds); 
		goto end;
	}
	st.wDay = (USHORT)time;

	result = _stnprintf(buffer,count,L"%d~%d:%d:%d.%03ds",st.wDay,st.wHour, st.wMinute, st.wSecond, st.wMilliseconds); 
end:
	if (result >= 0)
		result += s;
	return result;
}

typedef struct _ERROR_MAP{
    NTSTATUS MessageId;
    char *SymbolicName;
} ERROR_MAP;

SIZE_T
WINAPI
FormatTraceEventW(
        PLIST_ENTRY HeadEventList,
        PEVENT_TRACE pInEvent,
        TCHAR *EventBuf,
        ULONG SizeEventBuf,
        TCHAR * pszMask
    )
{
    PEVENT_TRACE_HEADER pHeader;
    PEVENT_TRACE        pEvent = NULL;
    ULONG               TraceMarker, TraceType;
    TCHAR               tstrName[MAXSTR];
    TCHAR               tstrType[MAXSTR];
    ULONG               tstrTypeOfType = 0;
    TCHAR             * tstrFormat;
    int                 iItemCount, i;
    SIZE_T              ItemsInBuf = 0;
    ULONG_PTR           MessageSequence = -1 ;
    USHORT              MessageNumber = 0 ;
    USHORT              MessageFlags = 0 ;
    char              * pMessageData ;
    ULONG               MessageLength ;


    if (pInEvent == NULL)
    {
        return (0);
    }

    pEvent = pInEvent ;
    // Make a copy of the PTR and length as we may adjust these depending
    // on the header
    pMessageData = pEvent->MofData ;
    MessageLength = pEvent->MofLength ;


    TraceMarker =  ((PSYSTEM_TRACE_HEADER)pInEvent)->Marker;

    if ((TraceMarker & TRACE_MESSAGE)== TRACE_MESSAGE ) {

        // This handles the TRACE_MESSAGE type.

        TraceType = TRACE_HEADER_TYPE_MESSAGE ;             // This one has special processing

        //
        // Now Process the header options
        //

        MessageNumber =  ((PMESSAGE_TRACE_HEADER)pEvent)->Packet.MessageNumber ;    // Message Number
        MessageFlags =   ((PMESSAGE_TRACE_HEADER)pEvent)->Packet.OptionFlags ;

        // Note that the order in which these are added is critical New entries must
        // be added at the end!
        //
        // [First Entry] Sequence Number
        if (MessageFlags&TRACE_MESSAGE_SEQUENCE) {
            RtlCopyMemory(&MessageSequence, pMessageData, sizeof(ULONG)) ;
            pMessageData += sizeof(ULONG) ;
            MessageLength -= sizeof(ULONG);
        }

        // [Second Entry] GUID ? or CompnentID ?
        if (MessageFlags&TRACE_MESSAGE_COMPONENTID) {
            RtlCopyMemory(&pEvent->Header.Guid,pMessageData,sizeof(ULONG)) ;
            pMessageData += sizeof(ULONG) ;
            MessageLength -= sizeof(ULONG) ;
        } else if (MessageFlags&TRACE_MESSAGE_GUID) { // Can't have both
            RtlCopyMemory(&pEvent->Header.Guid,pMessageData, sizeof(GUID));
            pMessageData += sizeof(GUID) ;
            MessageLength -= sizeof(GUID);
        }

        // [Third Entry] Timestamp?
        if (MessageFlags&TRACE_MESSAGE_TIMESTAMP) {
            RtlCopyMemory(&pEvent->Header.TimeStamp,pMessageData,sizeof(LARGE_INTEGER));
            pMessageData += sizeof(LARGE_INTEGER);
            MessageLength -= sizeof(LARGE_INTEGER);
        }

        // [Fourth Entry] System Information?
        if (MessageFlags&TRACE_MESSAGE_SYSTEMINFO) {
            pHeader = (PEVENT_TRACE_HEADER) &pEvent->Header;
            RtlCopyMemory(&pHeader->ThreadId, pMessageData, sizeof(ULONG)) ;
            pMessageData += sizeof(ULONG);
            MessageLength -=sizeof(ULONG);
            RtlCopyMemory(&pHeader->ProcessId,pMessageData, sizeof(ULONG)) ;
            pMessageData += sizeof(ULONG);
            MessageLength -=sizeof(ULONG);
        }
        //
        // Add New Header Entries immediately before this comment!
        //
    }
    else
    {
        // Must be WNODE_HEADER
        //
        TraceType = 0;
        pEvent = pInEvent ;

        MessageNumber = pEvent->Header.Class.Type ;
        if (MessageNumber == 0xFF) {   // W2K Compatability escape code
            if (pEvent->MofLength >= sizeof(USHORT)) {
                // The real Message Number is in the first USHORT
                memcpy(&MessageNumber,pEvent->MofData,sizeof(USHORT)) ;
                pMessageData += sizeof(USHORT);
                MessageLength -= sizeof(USHORT);
            }
        }
    }
    // Reset the Pointer and length if they have been adjusted
    pEvent->MofData = pMessageData ;
    pEvent->MofLength = MessageLength ;


    pHeader = (PEVENT_TRACE_HEADER) &pEvent->Header;
    MapGuidToName(
            &HeadEventList,
            & pEvent->Header.Guid,
            MessageNumber,
            tstrName);

    if (   IsEqualGUID(&pEvent->Header.Guid, &EventTraceGuid)
        && pEvent->Header.Class.Type == EVENT_TRACE_TYPE_INFO)
    {
        PTRACE_LOGFILE_HEADER head = (PTRACE_LOGFILE_HEADER)pEvent->MofData;
        if (head->TimerResolution > 0)
        {
            TimerResolution = head->TimerResolution / 10000;
        }
        ElapseTime = head->EndTime.QuadPart -
                        pEvent->Header.TimeStamp.QuadPart;
        PointerSize =  head->PointerSize;
        if (PointerSize < 2 )       // minimum is 16 bits
            PointerSize = 4 ;       // defaults = 32 bits
    }

    if (pEvent != NULL)
    {
        PITEM_DESC  pItem;
        char        str[MAXSTR];
#ifdef    UNICODE
        TCHAR       wstr[MAXSTR];
#endif    /* #ifdef UNICODE */
        PCHAR       ptr     = NULL;
        PCHAR       iMofPtr = NULL;
        ULONG       ulongword;
        PMOF_INFO   pMofInfo = NULL;
        PLIST_ENTRY Head, Next;
        int         i;

        pMofInfo = GetMofInfoHead(
                (PLIST_ENTRY *) HeadEventList,
                &pEvent->Header.Guid,
                NULL,
                MessageNumber,
                0,
                NULL,
                TRUE);

        if((pMofInfo != NULL) && (pMofInfo->strType != NULL))
        {
         TCHAR* p ;
            _sntprintf(tstrType,MAXSTR,_T("%s"),pMofInfo->strType);
            tstrFormat     = pMofInfo->TypeFormat; //  Pointer to the format string
            tstrTypeOfType = pMofInfo->TypeOfType; // And the type of Format
            p = tstrFormat;
            if(p) {
                while (*p != 0) {
                    if(*p == 'Z' && p > tstrFormat && p[-1] == '!' && p[1] == '!') {
                        *p = 's';
                    }
                ++p;
                }
            }
        }
        else
        {
            _sntprintf(tstrType,MAXSTR,_T("%3d"),MessageNumber);
            tstrFormat = NULL ;
            tstrTypeOfType = 0 ;
        }
 
        // From here on we start processing the parameters, we actually do
        // two versions. One is built for original #type format statements,
        // and everything is converted to being an ASCII string.
        // The other is built for #type2 format statements and everything is
        // converted into a string of raw bytes aliggned on a 64-bit boundary.

        iItemCount = 0 ;                    // How many Items we process
        for (i = 0; i < MAXITEMS; i++)      // Clean up the pointers
        {
            pItemBuf[i]  = pNoValueString;
			pItemRBuf[i] = 0 ;
        }

        RtlZeroMemory(ItemBuf,  MAXBUFS      * sizeof(TCHAR));
        RtlZeroMemory(ItemBBuf, (2*MAXBUFS)      * sizeof(TCHAR));
        RtlZeroMemory(ItemRBuf, MAXBUFS      * sizeof(BYTE));
        RtlZeroMemory(EventBuf, SizeEventBuf * sizeof(TCHAR));

        pItemBuf[iItemCount] = ItemBBuf;       // Where they go (Strings)


        // Make Parameter %1 Type Name

        _sntprintf(pItemBuf[iItemCount],
                   MAXBUFS2-ItemsInBuf, 
                   _T("%s"), 
                   tstrName);
        pItemBuf[iItemCount + 1] =
                    pItemBuf[iItemCount] + _tcslen(tstrName) + 1;
        ItemsInBuf = ItemsInBuf + _tcslen(tstrName) + 1;
        pItemRBuf[iItemCount] = (ULONG_PTR *) pItemBuf[iItemCount]; // just use the same for Raw bytes
        iItemCount ++;

        // Make Parameter %2 Type sub Type

        _sntprintf(pItemBuf[iItemCount], 
                   MAXBUFS2-ItemsInBuf,
                   _T("%s"), 
                   tstrType);
        pItemBuf[iItemCount + 1] =
                    pItemBuf[iItemCount] + _tcslen(tstrType) + 1;
        ItemsInBuf = ItemsInBuf + _tcslen(tstrType) + 1;
        pItemRBuf[iItemCount] = (ULONG_PTR *)pItemBuf[iItemCount]; // just use the same for raw bytes
        iItemCount ++;

        // Make Parameter %3 ThreadId
        RtlCopyMemory(&pItemRBuf[iItemCount] , &pHeader->ThreadId, sizeof(ULONG)) ;
        _sntprintf(ItemBuf,
                   MAXBUFS,
                   _T("0x%04X"),
                   pItemRBuf[iItemCount]);
        _sntprintf(pItemBuf[iItemCount], 
                   MAXBUFS2-ItemsInBuf,
                   _T("0x%04X"), 
                   pHeader->ThreadId);
        pItemBuf[iItemCount + 1] =
                    pItemBuf[iItemCount] + _tcslen(ItemBuf) + 1;
        ItemsInBuf = ItemsInBuf + _tcslen(ItemBuf) + 1;
        iItemCount++;

        // Make Parameter %4 System Time
        if (tstrFormat != NULL)
        {

            FILETIME      stdTime, localTime;
            SYSTEMTIME    sysTime;
            
            stdTime.dwHighDateTime = pEvent->Header.TimeStamp.HighPart;
            stdTime.dwLowDateTime  = pEvent->Header.TimeStamp.LowPart;
            if (bGmt) {
                FileTimeToSystemTime(&stdTime, &sysTime);
            } else {
                FileTimeToLocalFileTime(&stdTime, &localTime);
                FileTimeToSystemTime(&localTime, &sysTime);
            }

            _sntprintf(ItemBuf, 
                       MAXBUFS,
                       _T("%02d/%02d/%04d-%02d:%02d:%02d.%03d"),
                       sysTime.wMonth,
                       sysTime.wDay,
                       sysTime.wYear,
                       sysTime.wHour,
                       sysTime.wMinute,
                       sysTime.wSecond,
                       sysTime.wMilliseconds);
        }
        else
        {
            _sntprintf(ItemBuf, MAXBUFS, _T("%20I64u"), pHeader->TimeStamp.QuadPart);
        }
        _sntprintf(pItemBuf[iItemCount], 
                   MAXBUFS2-ItemsInBuf,
                   _T("%s"), 
                   ItemBuf);
        pItemBuf[iItemCount + 1] =
                    pItemBuf[iItemCount] + _tcslen(ItemBuf) + 1;
        ItemsInBuf = ItemsInBuf + _tcslen(ItemBuf) + 1;
        pItemRBuf[iItemCount] = (ULONG_PTR *)pItemBuf[iItemCount]; // just use the same
        iItemCount ++;

        if (!UserMode)
        {
            // Make Parameter %5 Kernel Time
            _sntprintf(ItemBuf, 
                       MAXBUFS, 
                       _T("%8lu"),
                       pHeader->KernelTime * TimerResolution);
            _sntprintf(pItemBuf[iItemCount], 
                       MAXBUFS2-ItemsInBuf,
                       _T("%s"), 
                       ItemBuf);
            pItemBuf[iItemCount + 1] =
                        pItemBuf[iItemCount] + _tcslen(ItemBuf) + 1;
            ItemsInBuf = ItemsInBuf + _tcslen(ItemBuf) + 1;
            pItemRBuf[iItemCount] = (ULONG_PTR *) pItemBuf[iItemCount]; // just use the same
            iItemCount ++;

            // Make Parameter %6 User Time
            _sntprintf(ItemBuf, 
                       MAXBUFS,
                       _T("%8lu"),
                       pHeader->UserTime * TimerResolution);

            _sntprintf(pItemBuf[iItemCount], 
                       MAXBUFS2-ItemsInBuf,
                       _T("%s"), 
                       ItemBuf);
            pItemBuf[iItemCount + 1] =
                        pItemBuf[iItemCount] + _tcslen(ItemBuf) + 1;
            ItemsInBuf = ItemsInBuf + _tcslen(ItemBuf) + 1;
            pItemRBuf[iItemCount] = (ULONG_PTR *) pItemBuf[iItemCount]; // just use the same
            iItemCount ++;
        }
        else
        {
            // Make Parameter %5 processor Time
            _sntprintf(ItemBuf, MAXBUFS,_T("%I64u"), pHeader->ProcessorTime);
            _sntprintf(pItemBuf[iItemCount], MAXBUFS2-ItemsInBuf,_T("%s"), ItemBuf);
            pItemBuf[iItemCount + 1] =
                        pItemBuf[iItemCount] + _tcslen(ItemBuf) + 1;
            ItemsInBuf = ItemsInBuf + _tcslen(ItemBuf) + 1;
            pItemRBuf[iItemCount] = (ULONG_PTR *) pItemBuf[iItemCount]; // just use the same
            iItemCount ++;

            // Make Parameter %6 NULL
            _sntprintf(ItemBuf, MAXBUFS, _T("%s"), NULL);
            _sntprintf(pItemBuf[iItemCount], MAXBUFS2-ItemsInBuf,_T("%s"), ItemBuf);
            pItemBuf[iItemCount + 1] =
                        pItemBuf[iItemCount] + _tcslen(ItemBuf) + 1;
            ItemsInBuf = ItemsInBuf + _tcslen(ItemBuf) + 1;
            pItemRBuf[iItemCount] = (ULONG_PTR *) pItemBuf[iItemCount]; // just use the same
            iItemCount ++;
        }

        // Make Parameter %7  Sequence Number
        _sntprintf(ItemBuf, MAXBUFS, _T("%d"), MessageSequence);
        _sntprintf(pItemBuf[iItemCount], MAXBUFS2-ItemsInBuf, _T("%s"), ItemBuf);
        pItemBuf[iItemCount + 1] =
                    pItemBuf[iItemCount] + _tcslen(ItemBuf) + 1;
        ItemsInBuf = ItemsInBuf + _tcslen(ItemBuf) + 1;
        pItemRBuf[iItemCount] = (ULONG_PTR *) MessageSequence ; // Raw just point at the value
        iItemCount ++;

        // Make Parameter %8 ProcessId
        RtlCopyMemory(&pItemRBuf[iItemCount],&pHeader->ProcessId,sizeof(ULONG));
        _sntprintf(ItemBuf,MAXBUFS,_T("0x%04X"),pItemRBuf[iItemCount]);
        _sntprintf(pItemBuf[iItemCount], MAXBUFS2-ItemsInBuf, _T("%s"), ItemBuf);
        pItemBuf[iItemCount + 1] =
                    pItemBuf[iItemCount] + _tcslen(ItemBuf) + 1;
        ItemsInBuf = ItemsInBuf + _tcslen(ItemBuf) + 1;
        iItemCount ++;

        // Make Parameter %9 CPU Number
        _sntprintf(ItemBuf, 
                   MAXBUFS,
                   _T("%d"),
                   ((PWMI_CLIENT_CONTEXT)&(pEvent->ClientContext))->ProcessorNumber);
        _sntprintf(pItemBuf[iItemCount], MAXBUFS2-ItemsInBuf, _T("%s"), ItemBuf);
        pItemBuf[iItemCount + 1] =
                    pItemBuf[iItemCount] + _tcslen(ItemBuf) + 1;
        ItemsInBuf = ItemsInBuf + _tcslen(ItemBuf) + 1;
        pItemRBuf[iItemCount] = (ULONG_PTR *) (((PWMI_CLIENT_CONTEXT)&(pEvent->ClientContext))->ProcessorNumber) ;
        iItemCount ++;

        // Done processing Parameters

        if (pMofInfo != NULL) {
            Head = pMofInfo->ItemHeader;
            pMofInfo->EventCount ++;
            Next = Head->Flink;
        } else {
            Head = Next = NULL ;
        }

        __try {
            iMofPtr = (char *) malloc(pEvent->MofLength + sizeof(UNICODE_NULL));

			if(iMofPtr == NULL)
				return -1;

            RtlZeroMemory(iMofPtr, pEvent->MofLength + sizeof(UNICODE_NULL));
            RtlCopyMemory(iMofPtr, pEvent->MofData, pEvent->MofLength);
            ptr = iMofPtr;
			while (Head != Next)
			{
				ULONG     * ULongPtr     = (ULONG *)     & ItemRBuf[0];
				USHORT    * UShortPtr    = (USHORT *)    & ItemRBuf[0];
				LONGLONG  * LongLongPtr  = (LONGLONG *)  & ItemRBuf[0];
				ULONGLONG * ULongLongPtr = (ULONGLONG *) & ItemRBuf[0];
				double    * DoublePtr    = (double *)    & ItemRBuf[0];

                TCHAR * PtrFmt1, * PtrFmt2 ;

				pItem = CONTAINING_RECORD(Next, ITEM_DESC, Entry);

				if ((ULONG) (ptr - iMofPtr) >= pEvent->MofLength)
				{
					break;
				}

				RtlZeroMemory(ItemBuf,  MAXBUFS * sizeof(TCHAR));
				RtlZeroMemory(ItemRBuf, MAXBUFS * sizeof(BYTE));
				
				bItemIsString = FALSE ; // Assume its a RAW value
				ItemRSize = 0 ;			// Raw length of zero

				switch (pItem->ItemType)
				{
				case ItemChar:
				case ItemUChar:
					ItemRSize = sizeof(CHAR);
					RtlCopyMemory(ItemRBuf, ptr, ItemRSize);
					_sntprintf(ItemBuf, MAXBUFS, _T("%c"), ItemRBuf);
					ptr += ItemRSize;
					break;

				case ItemCharSign:
					ItemRSize = sizeof(CHAR) * 2;
					RtlCopyMemory(ItemRBuf, ptr, ItemRSize);
					ItemRBuf[2] = '\0';
					_sntprintf(ItemBuf, MAXBUFS,_T("\"%s\""), ItemRBuf);
					ptr += ItemRSize;
					break;

				case ItemCharShort:
					ItemRSize = sizeof(CHAR);
					RtlCopyMemory(ItemRBuf, ptr, ItemRSize);
					_sntprintf(ItemBuf, MAXBUFS, _T("%d"), * ItemRBuf);
					ptr += ItemRSize;
					break;

				case ItemShort:
					ItemRSize = sizeof(USHORT);
					RtlCopyMemory(ItemRBuf, ptr, ItemRSize);
					_sntprintf(ItemBuf,MAXBUFS, _T("%6d"), * UShortPtr);
					ptr += ItemRSize;
					break;

                case ItemDouble:
                    ItemRSize = sizeof(double);
					RtlCopyMemory(ItemRBuf, ptr, ItemRSize);
					_sntprintf(ItemBuf,MAXBUFS, _T("%g"), * DoublePtr);
					ptr += ItemRSize;
					ItemRSize = 0; // FormatMessage cannot print 8 byte stuff properly on x86
					break;

				case ItemUShort:
					ItemRSize = sizeof(USHORT);
					RtlCopyMemory(ItemRBuf, ptr, ItemRSize);
					_sntprintf(ItemBuf,MAXBUFS, _T("%6u"), * UShortPtr);
					ptr += ItemRSize;
					break;

				case ItemLong:
					ItemRSize = sizeof(LONG);
					RtlCopyMemory(ItemRBuf, ptr, ItemRSize);
					_sntprintf(ItemBuf,MAXBUFS, _T("%8l"), (LONG) * ULongPtr);
					ptr += ItemRSize;
					break;

				case ItemULong:
					ItemRSize = sizeof(ULONG);
					RtlCopyMemory(ItemRBuf, ptr, ItemRSize);
					_sntprintf(ItemBuf,MAXBUFS, _T("%8lu"), * ULongPtr);
					ptr += ItemRSize;
					break;

				case ItemULongX:
					ItemRSize = sizeof(ULONG);
					RtlCopyMemory(ItemRBuf, ptr, ItemRSize);
					_sntprintf(ItemBuf,MAXBUFS, _T("0x%08X"), * ULongPtr);
					ptr += ItemRSize;
					break;

                case ItemPtr :
                    PtrFmt2 = _T("%08X%08X") ;
                    PtrFmt1 = _T("%08X") ;
                    // goto ItemPtrCommon ;
                    //ItemPtrCommon:
                    {
                        ULONG ulongword2;
                        if (PointerSize == 8) {     // 64 bits 
                            RtlCopyMemory(&ulongword,ptr,4);
                            RtlCopyMemory(&ulongword2,ptr+4,4);
                            _sntprintf(ItemBuf,MAXBUFS, PtrFmt2 , ulongword2,ulongword);
                            }
					    else {      // assumes 32 bit otherwise
						    RtlCopyMemory(&ulongword,ptr,PointerSize);
						    _sntprintf(ItemBuf,MAXBUFS, PtrFmt1 , ulongword);                  
					    }               
                        ItemRSize = 0 ;             // Pointers are always co-erced to be strings
					    ptr += PointerSize;
                    }
					break;

				case ItemIPAddr:
					ItemRSize = 0; // Only String form exists
					memcpy(&ulongword, ptr, sizeof(ULONG));

					// Convert it to readable form
					//
					_sntprintf(
							ItemBuf, MAXBUFS,
							_T("%03d.%03d.%03d.%03d"),
							(ulongword >>  0) & 0xff,
							(ulongword >>  8) & 0xff,
							(ulongword >> 16) & 0xff,
							(ulongword >> 24) & 0xff);
					ptr += sizeof (ULONG);
					break;

				case ItemPort:
					ItemRSize = 0; // Only String form exists
					_sntprintf(ItemBuf,MAXBUFS, _T("%u"), (UCHAR)ptr[0] * 256 + (UCHAR)ptr[1] * 1);
					ptr += sizeof (USHORT);
					break;

				case ItemLongLong:
					ItemRSize = sizeof(LONGLONG);
					RtlCopyMemory(ItemRBuf, ptr, ItemRSize);
					_sntprintf(ItemBuf,MAXBUFS, _T("%16I64x"), *LongLongPtr);
					ptr += sizeof(LONGLONG);
					ItemRSize = 0; // FormatMessage cannot print 8 byte stuff properly on x86
					break;

				case ItemULongLong:
					ItemRSize = sizeof(ULONGLONG);
					RtlCopyMemory(ItemRBuf, ptr, ItemRSize);
					_sntprintf(ItemBuf,MAXBUFS, _T("%16I64x"), *ULongLongPtr);
					ptr += sizeof(ULONGLONG);
					ItemRSize = 0; // FormatMessage cannot print 8 byte stuff properly on x86
					break;

				case ItemString:
				case ItemRString:
				{
					SIZE_T pLen = strlen((CHAR *) ptr);
					if (pLen > 0)
					{
						strcpy(str, ptr);
						if (pItem->ItemType == ItemRString)
						{
							reduce(str);
						}
	#ifdef UNICODE
						MultiByteToWideChar(CP_ACP, 0, str, -1, wstr, MAXSTR);
						_sntprintf(ItemBuf,MAXBUFS, _T("\"%ws\""), wstr);
						_sntprintf((TCHAR *)ItemRBuf, MAXCHARS, _T("%ws"), wstr);
	#else
						_sntprintf(ItemBuf,MAXBUFS, _T("\"%s\""), str);
						_stprintf((TCHAR *)ItemRBuf, MAXCHARS,_T("%s"), str);
	#endif    /* #ifdef UNICODE */
					} else {
						_sntprintf(ItemBuf,MAXBUFS,_T("<NULL>"));
						_sntprintf((TCHAR *)ItemRBuf,MAXCHARS,_T("<NULL>"));
					}
					ItemRSize = _tcslen((TCHAR *)ItemRBuf) * sizeof(TCHAR);
					bItemIsString = TRUE;
					ptr += (pLen + 1);
					break;
				}
				case ItemRWString:
				case ItemWString:
				{
					size_t  pLen = 0;
					size_t     i;

					if (*(WCHAR *) ptr)
					{
						if (pItem->ItemType == ItemRWString)
						{
							reduceW((WCHAR *) ptr);
						}
						pLen = ((wcslen((WCHAR*)ptr) + 1) * sizeof(WCHAR));
						memcpy(wstr, ptr, pLen);
						for (i = 0; i < pLen / 2; i++)
						{
							if (((USHORT) wstr[i] == (USHORT) 0xFFFF))
							{
								wstr[i] = (USHORT) 0;
							}
						}

						wstr[pLen / 2] = wstr[(pLen / 2) + 1]= '\0';
						_sntprintf(ItemBuf,MAXBUFS, _T("\"%ws\""), wstr);
						_sntprintf((TCHAR *)ItemRBuf, MAXCHARS,_T("%ws"), wstr);
       					ItemRSize = _tcslen((TCHAR *)ItemRBuf) * sizeof(TCHAR);
						bItemIsString = TRUE;
					}
					ptr += pLen; // + sizeof(ULONG);

					break;
			}

				case ItemDSString:   // Counted String
				{
					USHORT pLen = 256 * ((USHORT) * ptr) + ((USHORT) * (ptr + 1));
					ptr += sizeof(USHORT);
					if (pLen > 0)
					{
						strcpy(str, ptr);
	#ifdef UNICODE
						MultiByteToWideChar(CP_ACP, 0, str, -1, wstr, MAXSTR);
						_sntprintf(ItemBuf,MAXBUFS, _T("\"%ws\""), wstr);
						_sntprintf((TCHAR *)ItemRBuf, MAXCHARS,_T("%ws"), wstr);
	#else
						_sntprintf(ItemBuf,MAXBUFS, _T("\"%s\""), str);
						_sntprintf((TCHAR *)ItemRBuf, MAXCHARS, _T("%s"), str);
	#endif
					}
					ItemRSize = _tcslen((TCHAR *)ItemRBuf) * sizeof(TCHAR);
					bItemIsString = TRUE;
					ptr += (pLen + 1);
					break;
				}

			case ItemPString:   // Counted String
				{
					USHORT pLen = 256 * ((USHORT) * ptr) + ((USHORT) * (ptr + 1));
					ptr += sizeof(USHORT);
					if (pLen > 0)
					{
						strcpy(str, ptr);
	#ifdef UNICODE
						MultiByteToWideChar(CP_ACP, 0, str, -1, wstr, MAXSTR);
						_sntprintf(ItemBuf,MAXBUFS, _T("\"%ws\""), wstr);
						_sntprintf((TCHAR *)ItemRBuf, MAXCHARS,_T("%ws"), wstr);
	#else
						_sntprintf(ItemBuf,MAXBUFS, _T("\"%s\""), str);
						_sntprintf((TCHAR *)ItemRBuf, MAXCHARS, _T("%s"), str);
	#endif    /* #ifdef UNICODE */
					} else {
						_sntprintf(ItemBuf,MAXBUFS, _T("<NULL>"));
						_sntprintf((TCHAR *)ItemRBuf, MAXCHARS, _T("<NULL>"));
					}
					ItemRSize = _tcslen((TCHAR *)ItemRBuf) * sizeof(TCHAR);
					bItemIsString = TRUE;
					ptr += (pLen + 1);
					break;
				}

			   case ItemDSWString:  // DS Counted Wide Strings
				case ItemPWString:  // Counted Wide Strings
				{
					USHORT pLen = ( pItem->ItemType == ItemDSWString)
								? (256 * ((USHORT) * ptr) + ((USHORT) * (ptr + 1)))
								: (* ((USHORT *) ptr));

					ptr += sizeof(USHORT);
					if (pLen > MAXSTR * sizeof(WCHAR))
					{
						pLen = MAXSTR * sizeof(WCHAR);
					}
					if (pLen > 0)
					{
						memcpy(wstr, ptr, pLen);
						wstr[pLen / sizeof(WCHAR)] = L'\0';
						_sntprintf(ItemBuf,MAXBUFS, _T("\"%ws\""), wstr);
						_sntprintf((TCHAR *)ItemRBuf, MAXCHARS, _T("%ws"), wstr);
					ItemRSize = _tcslen((TCHAR *)ItemRBuf) * sizeof(TCHAR) ;
					bItemIsString = TRUE;
					}
					ptr += pLen;
					break;
				}

				case ItemNWString:   // Non Null Terminated String
				{
				   USHORT Size;

				   Size = (USHORT) (pEvent->MofLength -
						   (ULONG) (ptr - iMofPtr));
				   if (Size > MAXSTR )
				   {
					   Size = MAXSTR;
				   }
				   if (Size > 0)
				   {
					   memcpy(wstr, ptr, Size);
					   wstr[Size / 2] = '\0';
					   _sntprintf(ItemBuf,MAXBUFS, _T("\"%ws\""), wstr);
					   _sntprintf((TCHAR *)ItemRBuf, MAXCHARS, _T("%ws"), wstr);
						ItemRSize = _tcslen((TCHAR *)ItemRBuf) * sizeof(TCHAR) ;
						bItemIsString = TRUE;
				   }
				   ptr += Size;
				   break;
				}

				case ItemMLString:  // Multi Line String
				{
					SIZE_T   pLen;
					char   * src, * dest;
					BOOL     inQ       = FALSE;
					BOOL     skip      = FALSE;
					UINT     lineCount = 0;

					ptr += sizeof(UCHAR) * 2;
					pLen = strlen(ptr);
					if (pLen > 0)
					{
						src  = ptr;
						dest = str;
						while (*src != '\0')
						{
							if (*src == '\n')
							{
								if (!lineCount)
								{
									* dest ++ = ' ';
								}
								lineCount ++;
							}
							else if (*src == '\"')
							{
								if (inQ)
								{
									char   strCount[32];
									char * cpy;

									sprintf(strCount, "{%dx}", lineCount);
									cpy = &strCount[0];
									while (*cpy != '\0')
									{
										* dest ++ = * cpy ++;
									}
								}
								inQ = !inQ;
							}
							else if (!skip)
							{
								*dest++ = *src;
							}
							skip = (lineCount > 1 && inQ);
							src++;
						}
						*dest = '\0';
	#ifdef UNICODE
						MultiByteToWideChar(CP_ACP, 0, str, -1, wstr, MAXSTR);
						_sntprintf(ItemBuf,MAXBUFS, _T("\"%ws\""), wstr);
						_sntprintf((TCHAR *)ItemRBuf, MAXCHARS, _T("%ws"), wstr);
	#else
						_sntprintf(ItemBuf,MAXBUFS, _T("\"%s\""), str);
						_sntprintf((TCHAR *)ItemRBuf, MAXCHARS, _T("%s"), str);
	#endif    /* #ifdef UNICODE */
						ItemRSize = _tcslen((TCHAR *)ItemRBuf) * sizeof(TCHAR) ;
						bItemIsString = TRUE;
					}
					ptr += (pLen);
					break;
				}

				case ItemSid:
				{
					TCHAR        UserName[64];
					TCHAR        Domain[64];
					TCHAR        FullName[256];
					ULONG        asize = 0;
					ULONG        bsize = 0;
					ULONG        Sid[64];
					PULONG       pSid = &Sid[0];
					SID_NAME_USE Se;
					ULONG        nSidLength;
					pSid = (PULONG) ptr;
					if (* pSid == 0)
					{
						ptr += 4;
						_sntprintf(ItemBuf,MAXBUFS, _T("<NULL>"));
						_sntprintf((TCHAR *)ItemRBuf, MAXCHARS, _T("<NULL>"));
						ItemRSize = _tcslen((TCHAR *)ItemRBuf) * sizeof(TCHAR) ;
						bItemIsString = TRUE ;
					}
					else
					{
						ptr       += 8;       // skip the TOKEN_USER structure
						nSidLength = 8 + (4 * ptr[1]);
						asize      = 64;
						bsize      = 64;

	// LookupAccountSid cannot accept asize, bsize as size_t
						if (LookupAccountSid(
								NULL,
								(PSID) ptr,
								(LPTSTR) & UserName[0],
								&asize,
								(LPTSTR) & Domain[0],
								& bsize,
								& Se))
						{
							LPTSTR pFullName = & FullName[0];

							_tcscpy(pFullName, _T("\\\\"));
							_tcscat(pFullName, Domain);
							_tcscat(pFullName, _T("\\"));
							_tcscat(pFullName, UserName);
							asize = (ULONG) _tcslen(pFullName); // Truncate here
							if (asize > 0)
							{
								_sntprintf(ItemBuf,MAXBUFS, _T("\"%s\""), pFullName);
								_sntprintf((TCHAR *)ItemRBuf, MAXCHARS, _T("%s"), pFullName);
							}
						}
						else
						{
						    LPTSTR sidStr;
						    if ( ConvertSidToStringSid(pSid, &sidStr) ) {
    							_sntprintf(ItemBuf,MAXBUFS, _T("\"%s\""), sidStr); // BUGBUG check size
    							_sntprintf((TCHAR *)ItemRBuf, MAXCHARS,_T("%s"), sidStr);
    				        } else {
    							_sntprintf(ItemBuf,MAXBUFS, _T("\"%s(%d)\""), _T("System"), GetLastError() );
    							_sntprintf((TCHAR *)ItemRBuf, MAXCHARS,_T("%s(%d)"), _T("System"), GetLastError() );
    					    }
						}
						SetLastError(ERROR_SUCCESS);
						ItemRSize = _tcslen((TCHAR *)ItemRBuf) * sizeof(TCHAR);
						bItemIsString = TRUE;
						ptr += nSidLength;
					}
					break;
				}

				case ItemChar4:
					ItemRSize = 4 * sizeof(TCHAR);
					_sntprintf(ItemBuf,MAXBUFS,
							  _T("%c%c%c%c"),
							  ptr[0], ptr[1], ptr[2], ptr[3]);
					ptr += ItemRSize ;
					_tcscpy((LPTSTR)ItemRBuf, ItemBuf);
    				bItemIsString = TRUE;
					break;

                case ItemCharHidden:
                    ItemRSize = 0 ;
                    _stscanf(pItem->ItemList,_T("%d"),&ItemRSize);
                    if (ItemRSize > MAXBUFS) {
                        ItemRSize = MAXBUFS ;
                    }
                    _tprintf(_T("size is %d\n"),ItemRSize);
                    RtlCopyMemory(ItemBuf,ptr,ItemRSize);
                    ptr += ItemRSize ;
                    bItemIsString = TRUE ;
                    break;

				case ItemSetByte:
					ItemRSize = sizeof(BYTE);
					goto ItemSetCommon;

				case ItemSetShort:
					ItemRSize = sizeof(USHORT);
					goto ItemSetCommon;

				case ItemSetLong:
					ItemRSize = sizeof(ULONG);
					// goto ItemSetCommon;
					
	ItemSetCommon:
					{
						TCHAR * name;
						ULONG   Countr    = 0;
						ULONG   ItemMask = 0;
						TCHAR   iList[MAXBUFS];
						BOOL first = TRUE;

						RtlCopyMemory(&ItemMask, ptr, ItemRSize);
						ptr += ItemRSize;

						_tcscpy(ItemBuf, _T("["));
						_sntprintf(iList, MAXBUFS,_T("%s"), pItem->ItemList);
						name = _tcstok(iList, _T(","));
						while( name != NULL )
						{
							// While there are tokens in "string"
							//
							if (ItemMask & (1 << Countr) )
							{
							    if (!first) _tcscat(ItemBuf, _T(","));
								_tcscat(ItemBuf, name); first = FALSE;
							}
							// Get next token:
							//
							name = _tcstok( NULL, _T(","));
							Countr++;
						}
						while (Countr < ItemRSize * 8) {
							if (ItemMask & (1 << Countr) )
							{
							    TCHAR smallBuf[20];
        						_sntprintf(smallBuf, 20, _T("%d"),Countr);
							    if (!first) _tcscat(ItemBuf, _T(","));
								_tcscat(ItemBuf, smallBuf); first = FALSE;
							}
							Countr++;
						}
						_tcscat(ItemBuf, _T("]") );
						ItemRSize = 0; // Strings will be the same Raw and otherwise
					}
					break;

				case ItemListByte:
					ItemRSize = sizeof(BYTE);
					goto ItemListCommon;

				case ItemListShort:
					ItemRSize = sizeof(USHORT);
					goto ItemListCommon;

				case ItemListLong:
					ItemRSize = sizeof(ULONG);
					// goto ItemListCommon;

	ItemListCommon:
					{
						TCHAR * name;
						ULONG   Countr    = 0;
						ULONG   ItemIndex = 0;
						TCHAR   iList[MAXBUFS];

						RtlCopyMemory(&ItemIndex, ptr, ItemRSize);
						ptr += ItemRSize;
						ItemRSize = 0; // Strings will be the same Raw and otherwise

						_sntprintf(ItemBuf,MAXBUFS, _T("!%X!"),ItemIndex);
						_sntprintf(iList, MAXBUFS, _T("%s"), pItem->ItemList);
						name = _tcstok(iList, _T(","));
						while( name != NULL )
						{
							// While there are tokens in "string"
							//
							if (ItemIndex == Countr ++)
							{
								_sntprintf(ItemBuf,MAXBUFS, _T("%s"), name);
								break;
							}
							// Get next token:
							//
							name = _tcstok( NULL, _T(","));
						}
					}
					break;

				case ItemNTerror:
					ItemRSize = 0; // Only string form exists
					RtlCopyMemory(ItemRBuf, ptr, sizeof(ULONG));
					ptr += sizeof(ULONG);
					// Translate the NT Error Message
					if ((FormatMessage(
						FORMAT_MESSAGE_FROM_SYSTEM |
						FORMAT_MESSAGE_IGNORE_INSERTS,
						NULL,
						*ULongPtr,
						MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT), // Default language
						ItemBuf,
						MAXBUFS,
						NULL )) == 0) {
						
						_sntprintf(ItemBuf,MAXBUFS,_T("!NT Error %d unrecognised!"),*ULongPtr);
					}
					break;

				case ItemMerror:
					ItemRSize = 0; // Only string form exists
					RtlCopyMemory(ItemRBuf, ptr, sizeof(ULONG));
					ptr += sizeof(ULONG);
					// Translate the Module Message
					if (pItem->ItemList == NULL) {
						_sntprintf(ItemBuf,MAXBUFS,_T("! Error %d No Module Name!"),*ULongPtr);
					} else {
						if ((hLibrary = LoadLibraryEx(
										pItem->ItemList,	// file name of module
										NULL,				// reserved, must be NULL
										LOAD_LIBRARY_AS_DATAFILE // entry-point execution flag
										)) == NULL) {
							_sntprintf(ItemBuf,MAXBUFS,_T("!ItemMerror %d : LoadLibrary of %s failed %d!"),
										*ULongPtr,
										pItem->ItemList,
										GetLastError());
						} else {
							if ((FormatMessage(
								FORMAT_MESSAGE_FROM_HMODULE |
								FORMAT_MESSAGE_FROM_SYSTEM |
								FORMAT_MESSAGE_IGNORE_INSERTS,
								hLibrary,
								*ULongPtr,
								MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT), // Default language
								ItemBuf,
								MAXBUFS,
								NULL )) == 0) {
								_sntprintf(ItemBuf,MAXBUFS,_T("!Module Error %d unrecognised!"),*ULongPtr);
							}
							if (!FreeLibrary(hLibrary)) {
								_sntprintf(ItemBuf,MAXBUFS,_T("Failed to free library (%s) handle, err = %d"),
									pItem->ItemList, GetLastError());
							}
						}
					}
					break;

			    case ItemHRESULT:
					{
						NTSTATUS TempNTSTATUS, Error ;
						ItemRSize = 0 ;
						RtlCopyMemory(&TempNTSTATUS, ptr, sizeof(NTSTATUS));
						ptr += sizeof(ULONG);
						Error = TempNTSTATUS;
                        if (TempNTSTATUS == 0) { // Special case STATUS_SUCCESS just like everyone else!
                            _sntprintf(ItemBuf,MAXBUFS,_T("S_OK"));
                        } else {
                            const ERROR_MAP* map = (ERROR_MAP*)winerrorSymbolicNames;

                            _sntprintf(ItemBuf,MAXBUFS,_T("HRESULT=%8X"),TempNTSTATUS);
                            if( FACILITY_NT_BIT & TempNTSTATUS ) {
                                map =  (ERROR_MAP*)ntstatusSymbolicNames;
                                Error &= ~FACILITY_NT_BIT;
                            } else if (HRESULT_FACILITY(Error) == FACILITY_WIN32) {
                                Error &= 0xFFFF;
                            }
						    while (map->MessageId != 0xFFFFFFFF) {
							    if (map->MessageId == Error) {
							        _sntprintf(ItemBuf,MAXBUFS,_T("0x%08x(%S)"), TempNTSTATUS, map->SymbolicName);
								    break;
							    }
							    ++map;
						    }
                        }
					}
					break;

				case ItemNTSTATUS:
					{
						int i = 0 ;
						NTSTATUS TempNTSTATUS ;
						ItemRSize = 0 ;
						RtlCopyMemory(&TempNTSTATUS, ptr, sizeof(NTSTATUS));
						ptr += sizeof(ULONG);
                        if (TempNTSTATUS == 0) { // Special case STATUS_SUCCESS just like everyone else!
                            _sntprintf(ItemBuf,MAXBUFS,_T("STATUS_SUCCESS"));
                        } else {
                            _sntprintf(ItemBuf,MAXBUFS,_T("NTSTATUS=%8X"),TempNTSTATUS);
						    while (ntstatusSymbolicNames[i].MessageId != 0xFFFFFFFF) {
							    if (ntstatusSymbolicNames[i].MessageId == TempNTSTATUS) {
								    _sntprintf(ItemBuf,MAXBUFS,_T("0x%08x(%S)"), TempNTSTATUS, ntstatusSymbolicNames[i].SymbolicName);
								    break;
							    }
							    i++ ;
						    }
                        }
					}
					break;

				case ItemWINERROR:
					{
						int i = 0 ;
						DWORD TempWINERROR ;
						ItemRSize = 0 ;
						RtlCopyMemory(&TempWINERROR, ptr, sizeof(DWORD));
						ptr += sizeof(ULONG);
						_sntprintf(ItemBuf,MAXBUFS,_T("WINERROR=%8X"),TempWINERROR);
						while (winerrorSymbolicNames[i].MessageId != 0xFFFFFFFF) {
							if (winerrorSymbolicNames[i].MessageId == TempWINERROR) {
								_sntprintf(ItemBuf,MAXBUFS,_T("%d(%S)"), TempWINERROR, winerrorSymbolicNames[i].SymbolicName);
								break;
							}
							i++ ;
						}
					}
					break;

								
				case ItemNETEVENT:
					{
						int i = 0 ;
						DWORD TempNETEVENT ;
						ItemRSize = 0 ;
						RtlCopyMemory(&TempNETEVENT, ptr, sizeof(DWORD));
						ptr += sizeof(ULONG);
						_sntprintf(ItemBuf,MAXBUFS,_T("NETEVENT=%8X"),TempNETEVENT);
						while (neteventSymbolicNames[i].MessageId != 0xFFFFFFFF) {
							if (neteventSymbolicNames[i].MessageId == TempNETEVENT) {
								_sntprintf(ItemBuf,MAXBUFS,_T("%S"), neteventSymbolicNames[i].SymbolicName);
								break;
							}
							i++ ;
						}
					}
					break;

				case ItemGuid:
					GuidToString(ItemBuf, (LPGUID) ptr);
					ItemRSize = 0; // Only string form exists
					ptr += sizeof(GUID);
					break;

                case ItemTimeDelta:
                    {
    					LONGLONG time;
    					RtlCopyMemory(&time, ptr, sizeof(time));
    					
    					FormatTimeDelta(ItemBuf, MAXBUFS, time);

    					ItemRSize = 0; // Only string form exists
    					ptr += sizeof(LONGLONG);
                    }
					break;

                case ItemWaitTime:
					{
    					LONGLONG time;
    					RtlCopyMemory(&time, ptr, sizeof(time));

    					if (time <= 0) {
    						time = -time;
    						ItemBuf[0]='+';
    						FormatTimeDelta(ItemBuf+1, MAXBUFS-1, time);
    						ItemRSize = 0; // Only string form exists
    						ptr += sizeof(LONGLONG);
    						break;
    					}
    					// Fall thru
					}
				case ItemTimestamp:
					{
					LARGE_INTEGER LargeTmp;
					FILETIME      stdTime, localTime;
					SYSTEMTIME    sysTime;

						RtlCopyMemory(&LargeTmp, ptr, sizeof(ULONGLONG));
						stdTime.dwHighDateTime = LargeTmp.HighPart;
						stdTime.dwLowDateTime  = LargeTmp.LowPart;
						if (!FileTimeToLocalFileTime(&stdTime, &localTime)) {
							_sntprintf(ItemBuf,MAXBUFS,_T("FileTimeToLocalFileTime error 0x%8X\n"),GetLastError());
							break;
						}
						if (!FileTimeToSystemTime(&localTime, &sysTime)){
							_sntprintf(ItemBuf,MAXBUFS,_T("FileTimeToSystemTime error 0x%8X\n"),GetLastError());
							break;
						}

						_sntprintf(ItemBuf,MAXBUFS, _T("%02d/%02d/%04d-%02d:%02d:%02d.%03d"),
								sysTime.wMonth,
								sysTime.wDay,
								sysTime.wYear,
								sysTime.wHour,
								sysTime.wMinute,
								sysTime.wSecond,
								sysTime.wMilliseconds);
					}
					ItemRSize = 0; // Only string form exists
					ptr += sizeof(ULONGLONG);

					break;

				default:
					ptr += sizeof (int);
				}

    			_sntprintf(pItemBuf[iItemCount], 
                           MAXBUFS2-ItemsInBuf,
                           _T("%s"), 
                           ItemBuf);
	    		pItemBuf[iItemCount + 1] =
							pItemBuf[iItemCount] + _tcslen(ItemBuf) + sizeof(TCHAR);
		    	ItemsInBuf = ItemsInBuf + _tcslen(ItemBuf) + sizeof(TCHAR);

			    if (ItemRSize == 0) {
				   // Raw and String are the same
                   pItemRBuf[iItemCount] = (ULONG_PTR *) pItemBuf[iItemCount];
				}
				  else
				{
                   if (ItemRSize > MAXBUFS) {
                     ItemRSize = MAXBUFS ;
                   }
				   pItemRBuf[iItemCount] =pItemRBuf[iItemCount+1] = 0 ;
			       if (!bItemIsString) {
                        RtlCopyMemory(&pItemRBuf[iItemCount],ItemRBuf,ItemRSize);
			       } else {
				        // Share scratch buffer
                        if ((LONG)(ItemsInBuf+ItemRSize+sizeof(TCHAR)) < (LONG)sizeof(ItemBBuf)) {
                            (TCHAR *)pItemRBuf[iItemCount] = pItemBuf[iItemCount+1] ;
				            RtlCopyMemory(pItemRBuf[iItemCount],ItemRBuf,ItemRSize);
				            pItemBuf[iItemCount+1] =(TCHAR *)pItemRBuf[iItemCount] + ItemRSize + sizeof(TCHAR) ;
				            ItemsInBuf = ItemsInBuf + ItemRSize + sizeof(TCHAR) ;
				        } else {
				            pItemRBuf[iItemCount] = (ULONG_PTR *) pItemBuf[iItemCount];
				        }
					}
				}
                iItemCount ++;
				Next = Next->Flink;

			}
			// Ok we are finished with the MofData
			//
			free(iMofPtr);
		}
        __except(EXCEPTION_EXECUTE_HANDLER)
		{
			_sntprintf(EventBuf, 
                      SizeEventBuf,
                      _T("\n*****FormatMessage %s of %s, parameter %d raised an exception*****\n"),
				      tstrName,
				      tstrFormat,
				      iItemCount);
			return( (SIZE_T)_tcslen(EventBuf));
		}
	}

    // All argument processing is complete
    // No prepare the final formatting.

    if ((tstrFormat == NULL) || (tstrFormat[0] == 0))
    {
        TCHAR GuidString[32] ;
        // Build a helpful format

        RtlZeroMemory(EventBuf, SizeEventBuf);

        if (!IsEqualGUID(&pEvent->Header.Guid, &EventTraceGuid) ) {
            GuidToString(GuidString, (LPGUID) &pEvent->Header.Guid);
            _sntprintf(EventBuf, 
                      SizeEventBuf,
                      _T("%s(%s): GUID=%s (No Format Information found)."),
                      pItemBuf[0],      // name if any 
                      pItemBuf[1],      // sub name or number
                      GuidString       // GUID
                     );
        } else {
            // Display nothing for a header for now
            // Might be a good place to display some general info ?
        }
    }
    else
    {
        DWORD dwResult;

        if (tstrTypeOfType == 1)
        {
            __try
            {
                dwResult = FormatMessage(
                    FORMAT_MESSAGE_FROM_STRING + FORMAT_MESSAGE_ARGUMENT_ARRAY,
                                          // source and processing options
                    (LPCVOID) tstrFormat, // pointer to  message source
                    0,                    // requested message identifier
                    0,                    // language identifier
                    (LPTSTR) EventBuf,    // pointer to message buffer
                    SizeEventBuf,         // maximum size of message buffer
                    (va_list *) pItemBuf);  // pointer to array of message inserts
                if (dwResult == 0)
                {
                    _sntprintf(
                           EventBuf, SizeEventBuf,
                           _T("FormatMessage (Type 1) Failed 0x%X (%s/%s) (\n"),
                           GetLastError(),
                           pItemBuf[0],
                           pItemBuf[1]);
                    return(GetLastError());
                }
            }
            __except(EXCEPTION_EXECUTE_HANDLER)
            {
                _sntprintf(EventBuf, 
                           SizeEventBuf,
                           _T("\n*****FormatMessage (#Type) of %s, raised an exception*****\n"), 
                           tstrFormat);
                return( (SIZE_T)_tcslen(EventBuf));
            }
        }
        else if (tstrTypeOfType == 2)
        {
            __try
            {
#if !defined(STRINGFIXUP)
                dwResult = FormatMessage(
                    FORMAT_MESSAGE_FROM_STRING + FORMAT_MESSAGE_ARGUMENT_ARRAY,
                                          // source and processing options
                    (LPCVOID) tstrFormat, // pointer to  message source
                    0,                    // requested message identifier
                    0,                    // language identifier
                    (LPTSTR) EventBuf,    // pointer to message buffer
                    SizeEventBuf,         // maximum size of message buffer
                    (va_list *) pItemRBuf); // pointer to array of message inserts
                if (dwResult == 0)
                {
                    _sntprintf(
                                EventBuf,
                                SizeEventBuf,
                                _T("FormatMessage (#Typev) Failed 0x%X (%s/%s) (\n"),
                                GetLastError(),
                                pItemBuf[0],
                                pItemBuf[1]);
                    return(GetLastError());
                }

#else  // if !defined(STRINGFIXUP)
                ULONG ReturnLength ;
                dwResult = (DWORD)TraceFormatMessage(
                    tstrFormat,             // message format
                    0,
                    FALSE,                   // Don't ignore inserts,
#if defined(UNICODE)
                    FALSE,                   // Arguments Are not Ansi,
#else // #if defined(UNICODE)
                    TRUE,                    // Arguments are Ansi
#endif // #if defined(UNICODE)
                    TRUE,                    // Arguments Are An Array,
                    (va_list *) pItemRBuf,   // Arguments,
                    EventBuf,                // Buffer,
                    SizeEventBuf,           // maximum size of message buffer
                    &ReturnLength            // Coutnof Data Returned
                    );
                if (ReturnLength == 0)
                {
                    _sntprintf(
                           EventBuf,
                           SizeEventBuf,
                           _T("FormatMessage (#Typev) Failed 0x%X (%s/%s) (\n"),
                           dwResult,
                           pItemBuf[0],
                           pItemBuf[1]);
                    return(dwResult);
                }

#endif // if !defined(STRINGFIXUP)
            }
            __except(EXCEPTION_EXECUTE_HANDLER)
            {
                _sntprintf( EventBuf, 
                            SizeEventBuf,
                            _T("\n*****FormatMessage (#Typev) raised an exception (Format = %s) ****\n**** [Check for missing \"!\" Formats]*****\n"), tstrFormat);
                return((SIZE_T)_tcslen(EventBuf));
            }
        }
        else
        {
            return (-12);
        }
    }

    if (pszMask != NULL)
    {
        // Has he imposed a Filter?
        //
        if (_tcsstr(_tcslwr(pszMask), _tcslwr(tstrName)) !=0)
        {
            return( (SIZE_T)_tcslen(EventBuf));
        }
        else
        {
            return(0);
        }
    }

    return ( (SIZE_T)_tcslen(EventBuf));
}

PMOF_INFO
GetMofInfoHead(
        PLIST_ENTRY * HeadEventList,
        LPGUID        pGuid,
        LPTSTR        strType,
        LONG          TypeIndex,
        ULONG         TypeOfType,
        LPTSTR        TypeFormat,
        BOOL          bBestMatch
        )
{
    PLIST_ENTRY Head, Next;
    PMOF_INFO   pMofInfo;

    // Search the eventList for this Guid and find the head
    //
    if (HeadEventList == NULL) {
        return NULL ;
    } 
    if (*HeadEventList == NULL)
    {
        if( (*HeadEventList = (PLIST_ENTRY) malloc(sizeof(LIST_ENTRY))) == NULL) 
			return NULL;
		
        RtlZeroMemory(*HeadEventList, sizeof(LIST_ENTRY));
        InitializeListHead(*HeadEventList);
    }

    // Traverse the list and look for the Mof info head for this Guid.
    //
    Head = *HeadEventList;
    Next = Head->Flink;
    if (bBestMatch)
    {
        PMOF_INFO pBestMatch = NULL;

        while (Head != Next)
        {
            pMofInfo = CONTAINING_RECORD(Next, MOF_INFO, Entry);
            if (IsEqualGUID(&pMofInfo->Guid, pGuid))
            {
                if (pMofInfo->TypeIndex == TypeIndex)
                {
                    return  pMofInfo;
                }
                else if (pMofInfo->strType == NULL)
                {
                    pBestMatch = pMofInfo;
                }
            }
            Next = Next->Flink;
        }
        if(pBestMatch != NULL)
        {
            return pBestMatch;
        }
    }
    else
    {
        while (Head != Next)
        {
            pMofInfo = CONTAINING_RECORD(Next, MOF_INFO, Entry);

            if (   (strType != NULL)
                && (pMofInfo->strType != NULL)
                && (IsEqualGUID(&pMofInfo->Guid, pGuid))
                && (!(_tcscmp(strType, pMofInfo->strType))))
            {
                return  pMofInfo;
            }
            else if (   (strType == NULL)
                     && (pMofInfo->strType == NULL)
                     && (IsEqualGUID(&pMofInfo->Guid, pGuid)))
            {
                return  pMofInfo;
            }
            Next = Next->Flink;
        }
    }

    // If One does not exist, create one.
    //
    if( (pMofInfo = (PMOF_INFO) malloc(sizeof(MOF_INFO))) == NULL)
		return NULL;
	RtlZeroMemory(pMofInfo, sizeof(MOF_INFO));
    memcpy(&pMofInfo->Guid, pGuid, sizeof(GUID));
    pMofInfo->ItemHeader = (PLIST_ENTRY) malloc(sizeof(LIST_ENTRY));
	if( pMofInfo->ItemHeader == NULL){
	   	free(pMofInfo);
		return NULL;
	}
    RtlZeroMemory(pMofInfo->ItemHeader, sizeof(LIST_ENTRY));
    if (strType != NULL)
    {
        if ((pMofInfo->strType = (LPTSTR) malloc((_tcslen(strType) + 1) * sizeof(TCHAR))) == NULL ) {
            free(pMofInfo);
            return NULL ;
        }
        _tcscpy(pMofInfo->strType,strType);
    }
    if (TypeOfType != 0)
    {
           pMofInfo->TypeOfType = TypeOfType;
    }
    if (TypeFormat != NULL)
    {
        if ((pMofInfo->TypeFormat =
                (LPTSTR) malloc((_tcslen(TypeFormat) + 1) * sizeof(TCHAR)))== NULL) {
            free(pMofInfo->strType);
            free(pMofInfo);
            return NULL ;
        }
        _tcscpy(pMofInfo->TypeFormat,TypeFormat);

    }
    pMofInfo->TypeIndex = bBestMatch ? -1 : TypeIndex;
    InitializeListHead(pMofInfo->ItemHeader);
    InsertTailList(*HeadEventList, &pMofInfo->Entry);
    return pMofInfo;
}

void
MapGuidToName(
        OUT PLIST_ENTRY *HeadEventList,
        IN  LPGUID      pGuid,
        IN  ULONG       nType,
        OUT LPTSTR      wstr
        )
{
    if (IsEqualGUID(pGuid, &EventTraceGuid))
    {
        _tcscpy(wstr, GUID_TYPE_HEADER);
    }
    else if (!UserDefinedGuid(*HeadEventList,pGuid, wstr))
    {
        TCHAR filename[MAX_PATH], filepath[MAX_PATH];
        LPTSTR lpFilePart ;
        LPTSTR lppath = NULL;           // Path for finding TMF files
        INT len, waslen = 0 ;
            
        while (((len = GetEnvironmentVariable(TRACE_FORMAT_SEARCH_PATH, lppath, waslen )) - waslen) > 0) {
            if (len - waslen > 0 ) {
                if (lppath != NULL) {
                    free(lppath);
                }
                lppath = malloc((len+1) * sizeof(TCHAR)) ;
                waslen = len ;
            }
        }
        if (lppath != NULL) {
            // Try to find it on the path //
            swprintf(filename,L"%08x-%04x-%04x-%02x%02x-%02x%02x%02x%02x%02x%02x.tmf",
            pGuid->Data1,pGuid->Data2,pGuid->Data3,
            pGuid->Data4[0],pGuid->Data4[1],pGuid->Data4[2],pGuid->Data4[3],
            pGuid->Data4[4],pGuid->Data4[5],pGuid->Data4[6],pGuid->Data4[7] );

            if ((len = SearchPath(
                             lppath,        // search path semi-colon seperated
                             filename,      // file name with extension
                             NULL,          // file extension (not reqd.)
                             MAX_PATH,      // size of buffer
                             filepath,      // found file name buffer
                             &lpFilePart    // file component
                          ) !=0) && (len <= MAX_PATH)) {
                //_tprintf(_T("Opening file %s\n"),filepath);

                if(GetTraceGuidsW(filepath, HeadEventList)) 
                { 
        
                    if (UserDefinedGuid(*HeadEventList,pGuid, wstr)) {
                        free(lppath);
                        return;
                    }
                }
            }
            free(lppath);
        }

        _tcscpy(wstr, GUID_TYPE_UNKNOWN);
    }
}

ULONG
UserDefinedGuid(
        OUT PLIST_ENTRY HeadEventList,
        IN  LPGUID      pGuid,
        OUT LPTSTR      wstr
        )
{
    PLIST_ENTRY Head, Next;
    PMOF_INFO   pMofInfo;

    // Search the eventList for this Guid and find the head
    //
    if (HeadEventList == NULL)
    {  
        /*
       HeadEventList = (PLIST_ENTRY) malloc(sizeof(LIST_ENTRY));
       if(HeadEventList == NULL)
           return FALSE; 

       InitializeListHead(HeadEventList); */
        return FALSE; 
    }

    // Traverse the list and look for the Mof info head for this Guid.
    //
    Head = HeadEventList;
    Next = Head->Flink;
    while(Head  != Next && Next != NULL){
    
        pMofInfo = CONTAINING_RECORD(Next, MOF_INFO, Entry);
        if (pMofInfo != NULL && IsEqualGUID(&pMofInfo->Guid, pGuid))
        {
            if ( pMofInfo->strDescription == NULL)
            {
                return FALSE;
            }
            else
            {
                _tcscpy(wstr, pMofInfo->strDescription);
                return TRUE;
            }
        }
        Next = Next->Flink;
	}
    return FALSE;
}

ULONG
WINAPI
GetTraceGuidsW(
        TCHAR       * GuidFile,
        PLIST_ENTRY * HeadEventList                                                                       )
{
    FILE     * f;
    TCHAR      line[MAXSTR],
               nextline[MAXSTR],
               arg[MAXSTR],
               strGuid[MAXSTR];
    PMOF_TYPE  types;
    LPGUID     Guid;
    UINT       i,
               n;
    TCHAR    * name,
             * s,
             * guidName;
    PMOF_INFO  pMofInfo;
    SIZE_T     len       = 0;
    UINT       typeCount = 0;
    BOOL inInfo = FALSE;
    BOOL eof = FALSE ;
    BOOL nextlineF = FALSE ;

    if (HeadEventList == NULL) {
        return 0 ;
    } 
    if (*HeadEventList == NULL)
    {
        if( (*HeadEventList = (PLIST_ENTRY) malloc(sizeof(LIST_ENTRY))) == NULL) 
			return 0 ;
		
        RtlZeroMemory(*HeadEventList, sizeof(LIST_ENTRY));
        InitializeListHead(*HeadEventList);
    }

    Guid = (LPGUID) malloc(sizeof(GUID));
    if (Guid == NULL)
    {
        return 0;
    }

    types = (PMOF_TYPE) malloc(MAXTYPE * sizeof(MOF_TYPE));
    if (types == NULL)
    {
        free(Guid);
        return 0;
    }

    RtlZeroMemory(types,   MAXTYPE * sizeof(MOF_TYPE));
    RtlZeroMemory(line,    MAXSTR  * sizeof(TCHAR));
    RtlZeroMemory(strGuid, MAXSTR  * sizeof(TCHAR));

    f = _tfopen( GuidFile, _T("r"));
    if (f == NULL)
    {
        free(Guid);
        free(types);
        return 0;
    }
    n = 0;

    while (!eof )
    {
       if (nextlineF) { // Sometimes we read ahead a bit
          _tcscpy(line, nextline);
          nextlineF = FALSE ;
       } else {
         if (_fgetts(line, MAXSTR, f) == NULL) {
            eof = TRUE ;
            break;
         }
       }
//    jump_inside:;
        if (line[0] == '/')
        {
            continue;
        }
        else if (line[0] == '{')
        {
            inInfo = TRUE;
        }
        else if ( line[0] == '}')
        {
            typeCount = 0;
            inInfo = FALSE;
        }
        else if (inInfo)
        {
            ITEM_TYPE   type;
            PTCHAR      ItemListValue = NULL;

            name = _tcstok(line, _T("\n\t,"));
            s    = _tcstok(NULL, _T(" \n\t,("));
            if (s != NULL && name != NULL )
            {
                if (!_tcsicmp(s,STR_ItemChar))           type = ItemChar;
                else if (!_tcsicmp(s,STR_ItemUChar))     type = ItemUChar;
                else if (!_tcsicmp(s,STR_ItemCharShort)) type = ItemCharShort;
                else if (!_tcsicmp(s,STR_ItemCharSign))  type = ItemCharSign;
                else if (!_tcsicmp(s,STR_ItemShort))     type = ItemShort;
                else if (!_tcsicmp(s,STR_ItemHRESULT))   type = ItemHRESULT;
                else if (!_tcsicmp(s,STR_ItemDouble))    type = ItemDouble;
                else if (!_tcsicmp(s,STR_ItemUShort))    type = ItemUShort;
                else if (!_tcsicmp(s,STR_ItemLong))      type = ItemLong;
                else if (!_tcsicmp(s,STR_ItemULong))     type = ItemULong;
                else if (!_tcsicmp(s,STR_ItemULongX))    type = ItemULongX;
                else if (!_tcsicmp(s,STR_ItemLongLong))  type = ItemLongLong;
                else if (!_tcsicmp(s,STR_ItemULongLong)) type = ItemULongLong;
                else if (!_tcsicmp(s,STR_ItemString))    type = ItemString;
                else if (!_tcsicmp(s,STR_ItemWString))   type = ItemWString;
                else if (!_tcsicmp(s,STR_ItemRString))   type = ItemRString;
                else if (!_tcsicmp(s,STR_ItemRWString))  type = ItemRWString;
                else if (!_tcsicmp(s,STR_ItemPString))   type = ItemPString;
                else if (!_tcsicmp(s,STR_ItemMLString))  type = ItemMLString;
                else if (!_tcsicmp(s,STR_ItemNWString))  type = ItemNWString;
                else if (!_tcsicmp(s,STR_ItemPWString))  type = ItemPWString;
				else if (!_tcsicmp(s,STR_ItemDSString))  type = ItemDSString;
				else if (!_tcsicmp(s,STR_ItemDSWString)) type = ItemDSWString;
                else if (!_tcsicmp(s,STR_ItemPtr))       type = ItemPtr;
                else if (!_tcsicmp(s,STR_ItemSid))       type = ItemSid;
                else if (!_tcsicmp(s,STR_ItemChar4))     type = ItemChar4;
                else if (!_tcsicmp(s,STR_ItemIPAddr))    type = ItemIPAddr;
                else if (!_tcsicmp(s,STR_ItemPort))      type = ItemPort;
                else if (!_tcsicmp(s,STR_ItemListLong))  type = ItemListLong;
                else if (!_tcsicmp(s,STR_ItemListShort)) type = ItemListShort;
                else if (!_tcsicmp(s,STR_ItemListByte))  type = ItemListByte;
                else if (!_tcsicmp(s,STR_ItemSetLong))  type = ItemSetLong;
                else if (!_tcsicmp(s,STR_ItemSetShort)) type = ItemSetShort;
                else if (!_tcsicmp(s,STR_ItemSetByte))  type = ItemSetByte;
				else if (!_tcsicmp(s,STR_ItemNTerror))   type = ItemNTerror;
				else if (!_tcsicmp(s,STR_ItemMerror))	 type = ItemMerror;
				else if (!_tcsicmp(s,STR_ItemTimestamp)) type = ItemTimestamp;
                else if (!_tcsicmp(s,STR_ItemGuid))      type = ItemGuid;
				else if (!_tcsicmp(s,STR_ItemWaitTime)) type = ItemWaitTime;
                else if (!_tcsicmp(s,STR_ItemTimeDelta))      type = ItemTimeDelta;
				else if (!_tcsicmp(s,STR_ItemNTSTATUS))  type = ItemNTSTATUS;
				else if (!_tcsicmp(s,STR_ItemWINERROR))  type = ItemWINERROR;
				else if (!_tcsicmp(s,STR_ItemNETEVENT))  type = ItemNETEVENT;
                else if (!_tcsicmp(s,STR_ItemCharHidden))  type = ItemCharHidden;
                else                                     type = ItemUnknown;

				// Get List elements
				if ((type == ItemListLong) || (type == ItemListShort) || (type == ItemListByte)
				  ||(type == ItemSetLong)  || (type == ItemSetShort)  || (type == ItemSetByte) )
                {
                    s = _tcstok(NULL, _T("()"));
					ItemListValue =
						    (TCHAR *) malloc((_tcslen(s) + 1) * sizeof(TCHAR));
                    if (ItemListValue == NULL) {
                        return 1 ;
                    }
					RtlCopyMemory(
						    ItemListValue,
							s,
							(_tcslen(s) + 1) * sizeof(TCHAR));
				}
				// Get Module specification for ItemMerror
				if ((type == ItemMerror)) {
					TCHAR * ppos ;
                    s = _tcstok(NULL, _T(" \t"));
					ppos = _tcsrchr(s,'\n');
					if (ppos != NULL) {
						*ppos  = UNICODE_NULL ;
						ItemListValue =
								(TCHAR *) malloc((_tcslen(s) + 1) * sizeof(TCHAR));
                        if (ItemListValue == NULL) {
                            return 1 ;
                        }
						RtlCopyMemory(
								ItemListValue,
								s,
								(_tcslen(s) + 1) * sizeof(TCHAR));
					}
                }
                // Get size for ItemCharHidden
                if (type == ItemCharHidden) {
					TCHAR * ppos ;
                    s = _tcstok(NULL, _T("["));
					ppos = _tcsrchr(s,']');
					if (ppos != NULL) {
						*ppos  = UNICODE_NULL ;
						ItemListValue =
								(TCHAR *) malloc((_tcslen(s) + 1) * sizeof(TCHAR));
                        if (ItemListValue == NULL) {
                            return 1 ;
                        }
						RtlCopyMemory(
								ItemListValue,
								s,
								(_tcslen(s) + 1) * sizeof(TCHAR));
					}
                }

                if (typeCount == 0)
                {
                    AddMofInfo(
                            * HeadEventList,
                            Guid,
                            NULL,
                            -1,
                            name,
                            type,
                            NULL,
                            0,
                            NULL);
                }
                else
                {
                    for (i = 0; i < typeCount; i ++)
                    {
                        AddMofInfo(
                                * HeadEventList,
                                Guid,
                                types[i].strType,
                                types[i].TypeIndex,
                                name,
                                type,
                                ItemListValue,
                                types[i].TypeType,
                                types[i].TypeFormat);
                    }
                }
            }
        }
        else if (line[0] == '#')
        {
            TCHAR * token, * etoken;
            int Indent ;                    // Special parameter values(numeric) from comments
            TCHAR FuncName[MAXNAMEARG],     // Special parameter values from comment
                  LevelName[MAXNAMEARG],
                  CompIDName[MAXNAMEARG],
                  *v ;
           
            //This is a workaround to defend against newlines in TMF files.
            while (!nextlineF && !eof) {
               if (_fgetts(nextline,MAXSTR,f) != NULL) {
                    if ((nextline[0] != '{') && nextline[0] != '#') {
                        TCHAR * eol ;
                        if ((eol = _tcsrchr(line,'\n')) != NULL) {
                            *eol = 0 ;
                        }
                        _tcsncat(line,nextline,MAXSTR-_tcslen(line)) ;
                    } else {
                        nextlineF = TRUE ;
                    }
                } else {
                    eof = TRUE ;
                }
            }

            // Find any special names in the comments
            // As this gets longer we should make it generic
            Indent = FindIntValue(line,_T("INDENT="));  // Indentaion Level 
            v = FindValue(line,_T("FUNC="));            // Function Name
            _tcsncpy(FuncName, v,  MAXNAMEARG);
            v = FindValue(line,_T("LEVEL="));           // Tracing level or Flags
            _tcsncpy(LevelName, v, MAXNAMEARG);
            v = FindValue(line,_T("COMPNAME="));          // Component ID
            _tcsncpy(CompIDName, v, MAXNAMEARG);

            token = _tcstok(line,_T(" \t"));
            if (_tcsicmp(token,_T("#type")) == 0)
            {
                types[typeCount].TypeType = 1 ;
            }
            else if (_tcsicmp(token,_T("#typev")) == 0)
            {
                types[typeCount].TypeType = 2 ;
            }
            else
            {
                fclose(f);
                free(Guid);
                free(types);
                return(-10);
            }
            token = _tcstok( NULL, _T(" \t\n"));		// Get Type Name
            _tcscpy(types[typeCount].strType,token);
            token =_tcstok( NULL, _T("\"\n,"));			// Look for a Format String
            if (token != NULL) {
                types[typeCount].TypeIndex = _ttoi(token);	// Get the type Index
                token =_tcstok( NULL, _T("\n"));
            }
            etoken = NULL;
            if (token != NULL)
            {
                etoken = _tcsrchr(token,_T('\"'));  // Find the closing quote
            }

            if (etoken !=NULL)
            {
                etoken[0] = 0;
            }
            else
            {
                token = NULL;
            }

            if (token != NULL)
            {
                if (token[0] == '%' && token[1] == '0') {
                    // add standard prefix
                    if (StdPrefix[0] == 0) {
                        // need to initialize it.
                        LPTSTR Prefix = NULL ; int len, waslen = 0 ;        
                        while (((len = GetEnvironmentVariable(TRACE_FORMAT_PREFIX, Prefix, waslen )) - waslen) > 0) {
                            if (len - waslen > 0 ) {
                                if (Prefix != NULL) {
                                    free(Prefix);
                                }
                        Prefix = malloc((len+1) * sizeof(TCHAR)) ;
                        if (Prefix == NULL) {
                            return -11 ;
                        }
                        waslen = len ;
                        }
                    }

                        if (Prefix) {
                            _tcsncpy(StdPrefix, Prefix, MAXSTR);
                        } else {
                            _tcscpy(StdPrefix, STD_PREFIX);
                        }
                        free(Prefix) ;
                    }
                    _tcscpy(types[typeCount].TypeFormat,StdPrefix);
                    _tcscat(types[typeCount].TypeFormat,token + 2);
                } else {                
                    _tcscpy(types[typeCount].TypeFormat,token);
                }
                // process the special variable names
                // Make generic in future
                ReplaceStringUnsafe(types[typeCount].TypeFormat, _T("%!FUNC!"), FuncName);
                ReplaceStringUnsafe(types[typeCount].TypeFormat, _T("%!LEVEL!"), LevelName);
                ReplaceStringUnsafe(types[typeCount].TypeFormat, _T("%!COMPNAME!"), CompIDName);

            }
            else
            {
                types[typeCount].TypeFormat[0] = types[typeCount].TypeFormat[1]
                                               = 0;
            }

            if (   types[typeCount].TypeFormat[0] == 0
                && types[typeCount].TypeFormat[1] == 0)
            {
                pMofInfo = GetMofInfoHead(
                        HeadEventList,
                        Guid,
                        types[typeCount].strType,
                        types[typeCount].TypeIndex,
                        types[typeCount].TypeType,
                        NULL,
                        FALSE);
            }
            else
            {
                pMofInfo = GetMofInfoHead(
                        HeadEventList,
                        Guid,
                        types[typeCount].strType,
                        types[typeCount].TypeIndex,
                        types[typeCount].TypeType,
                        types[typeCount].TypeFormat,
                        FALSE);
            }

			if(pMofInfo == NULL){
				fclose(f);
				free(Guid);
				free(types);
				return 0;

			}
            if (_tcslen(strGuid) > 0)
            {
                pMofInfo->strDescription =
                      (PTCHAR) malloc((_tcslen(strGuid) + 1) * sizeof(TCHAR));
                if (pMofInfo->strDescription == NULL) {
				    fclose(f);
				    free(Guid);
				    free(types);
				    return 0;
                }
                _tcscpy(pMofInfo->strDescription, strGuid);
            }

            typeCount++;
            if(typeCount >= MAXTYPE)
            {
                fclose(f);
                free(Guid);
                free(types);
                return(-11);
            }
        }
        else if (   (line[0] >= '0' && line[0] <= '9')
                 || (line[0] >= 'a' && line[0] <= 'f')
                 || (line[0] >= 'A' && line[0] <= 'F'))
        {
            typeCount = 0;

            _tcsncpy(arg, line, 8);
            arg[8]      = 0;
            Guid->Data1 = ahextoi(arg);

            _tcsncpy(arg, &line[9], 4);
            arg[4]      = 0;
            Guid->Data2 = (USHORT) ahextoi(arg);

            _tcsncpy(arg, &line[14], 4);
            arg[4]      = 0;
            Guid->Data3 = (USHORT) ahextoi(arg);

            for (i = 0; i < 2; i ++)
            {
                _tcsncpy(arg, &line[19 + (i * 2)], 2);
                arg[2]         = 0;
                Guid->Data4[i] = (UCHAR) ahextoi(arg);
            }

            for (i = 2; i < 8; i ++)
            {
                _tcsncpy(arg, &line[20 + (i * 2)], 2);
                arg[2]         = 0;
                Guid->Data4[i] = (UCHAR) ahextoi(arg);
            }

            // Find the next non whitespace character
            //
            guidName = &line[36];

            while (*guidName == ' '|| *guidName == '\t')
            {
                guidName++;
            }

            // cut comment out (if present)
            {
                TCHAR* comment = _tcsstr(guidName, TEXT("//"));
                if (comment) {
                    // remove whitespace
                    --comment;
                    while (comment >= guidName && isspace(*comment)) --comment;
                    *++comment = 0;
                }
            }

            len = _tcslen(guidName);
            s   = guidName;

            while (len > 0)
            {
                len -= 1;
                if (*s == '\n' || *s == '\0' || *s == '\t')
                {
                    *s = '\0';
                    break;
                }
                s++;
            }

            pMofInfo = GetMofInfoHead(
                    HeadEventList, Guid, NULL, -1, 0, NULL, FALSE);

			if(pMofInfo == NULL){
				fclose(f);
				free(Guid);
				free(types);
				return (ULONG) 0;
			}

            if (pMofInfo->strDescription != NULL)
            {
                free(pMofInfo->strDescription);
                pMofInfo->strDescription = NULL;
            }
            _tcscpy(strGuid, guidName);
            pMofInfo->strDescription =
                    (PTCHAR) malloc((_tcslen(guidName) + 1) * sizeof(TCHAR));
            if (pMofInfo->strDescription == NULL ) {
                // We really have problems
                fclose(f);
                free(Guid);
                free(types);
                return (ULONG) 0 ;
            }
            _tcscpy(pMofInfo->strDescription, strGuid);
            n++ ;                                      // Thats one more GUID
        }
        RtlZeroMemory(line, MAXSTR * sizeof(TCHAR));
    }

    fclose(f);
    free(Guid);
    free(types);
    return (ULONG) n;
}

ULONG
ahextoi(
        TCHAR *s
        )
{
    SSIZE_T   len;
    ULONG num, base, hex;

    len  = _tcslen(s);
    hex  = 0;
    base = 1;
    num  = 0;
    while (--len >= 0)
    {
        if ((s[len] == 'x' || s[len] == 'X') && (s[len-1] == '0'))
        {
            break;
        }

        if (s[len] >= '0' && s[len] <= '9')
        {
            num = s[len] - '0';
        }
        else if (s[len] >= 'a' && s[len] <= 'f')
        {
            num = (s[len] - 'a') + 10;
        }
        else if (s[len] >= 'A' && s[len] <= 'F')
        {
            num = (s[len] - 'A') + 10;
        }
        else
        {
            continue;
        }

        hex += num * base;
        base = base * 16;
    }
    return hex;
}

void
WINAPI
SummaryTraceEventListW(
        TCHAR       * SummaryBlock,
        ULONG         SizeSummaryBlock,
        PLIST_ENTRY   EventListHead
        )
{
    PLIST_ENTRY Head, Next;
    PMOF_INFO   pMofInfo;
    TCHAR       strGuid[MAXSTR];
    TCHAR       strName[MAXSTR];
    TCHAR       strBuffer[MAXSTR];

    if (EventListHead == NULL)
    {
        return;
    }
    if (SummaryBlock == NULL)
    {
        return;
    }
    RtlZeroMemory(SummaryBlock, sizeof(TCHAR) * SizeSummaryBlock);

    Head = EventListHead;
    Next = Head->Flink;
    while (Head != Next)
    {
        RtlZeroMemory(strName, 256);
        RtlZeroMemory(strBuffer, 256);
        pMofInfo = CONTAINING_RECORD(Next, MOF_INFO, Entry);
        if (pMofInfo->EventCount > 0)
        {
            GuidToString((PTCHAR) strGuid, &pMofInfo->Guid);
            MapGuidToName(&EventListHead, &pMofInfo->Guid, 0, strName);
            _sntprintf(strBuffer,
                       MAXSTR,
                      _T("|%10d    %-20s %-10s  %36s|\n"),
                      pMofInfo->EventCount,
                      strName,
                      pMofInfo->strType ? pMofInfo->strType : _T("General"),
                      strGuid);

            _tcscat(SummaryBlock, strBuffer);
            if (_tcslen(SummaryBlock) >= SizeSummaryBlock)
            {
                return;
            }
        }

        Next = Next->Flink;
    }
}

PTCHAR
GuidToString(
        PTCHAR s,
        LPGUID piid
        )
{
    _stprintf(s, _T("%08x-%04x-%04x-%02x%02x-%02x%02x%02x%02x%02x%02x"),
               piid->Data1,
               piid->Data2,
               piid->Data3,
               piid->Data4[0],
               piid->Data4[1],
               piid->Data4[2],
               piid->Data4[3],
               piid->Data4[4],
               piid->Data4[5],
               piid->Data4[6],
               piid->Data4[7]);
    return(s);
}

// This routine is called by the WBEM interface routine for each property
// found for this Guid. The ITEM_DESC structure is allocted for each Property.
//
VOID
AddMofInfo(
              PLIST_ENTRY   HeadEventList,
              const GUID        * Guid,
              LPTSTR        strType,
              ULONG         typeIndex,
              LPTSTR        strDesc,
              ITEM_TYPE     ItemType,
              TCHAR       * ItemList,
              ULONG         typeOfType,
              LPTSTR        typeFormat
        )
{
    PITEM_DESC  pItem;
    PLIST_ENTRY pListHead;
    PMOF_INFO   pMofInfo;

    if (strDesc == NULL)
    {
        return;
    }

    pItem = (PITEM_DESC) malloc(sizeof(ITEM_DESC));
	if(pItem == NULL)return;	//silent error 

    RtlZeroMemory(pItem, sizeof(ITEM_DESC));
    pItem->strDescription =
            (LPTSTR) malloc((_tcslen(strDesc) + 1) * sizeof(TCHAR));

	if( pItem->strDescription == NULL ){
		free(pItem);
		return;
	}

    _tcscpy(pItem->strDescription, strDesc);
    pItem->ItemType = ItemType;
    pItem->ItemList = ItemList ;
    pMofInfo = GetMofInfoHead(
            (PLIST_ENTRY *) HeadEventList,
            (LPGUID) Guid,
            strType,
            typeIndex,
            typeOfType,
            typeFormat,
            FALSE);
    if (pMofInfo != NULL)
    {
        pListHead = pMofInfo->ItemHeader;
        InsertTailList(pListHead, &pItem->Entry);
    }
	else{
	
		free(pItem->strDescription); 
		free(pItem);
	}

}

void
WINAPI
CleanupTraceEventList(
        PLIST_ENTRY HeadEventList
        )
{

    PLIST_ENTRY Head, Next;
    PMOF_INFO   pMofInfo;

    if (HeadEventList == NULL)
    {
        return;
    }

    Head = HeadEventList;
    Next = Head->Flink;
    while (Head != Next)
    {
        pMofInfo = CONTAINING_RECORD(Next, MOF_INFO, Entry);
        RemoveEntryList(&pMofInfo->Entry);
        RemoveMofInfo(pMofInfo->ItemHeader);
        free(pMofInfo->ItemHeader);
        free(pMofInfo->strDescription);
        free(pMofInfo->TypeFormat);
        free(pMofInfo->strType);
        Next = Next->Flink;
        free(pMofInfo);
    }

    free(HeadEventList);
}

void
RemoveMofInfo(
        PLIST_ENTRY pMofInfo
        )
{
    PLIST_ENTRY Head, Next;
    PITEM_DESC  pItem;

    Head = pMofInfo;
    Next = Head->Flink;
    while (Head != Next)
    {
        pItem = CONTAINING_RECORD(Next, ITEM_DESC, Entry);
        Next = Next->Flink;
        RemoveEntryList(&pItem->Entry);

        if (pItem->strDescription != NULL)
            free(pItem->strDescription);
        if (pItem->ItemList != NULL)
            free(pItem->ItemList);
        free(pItem);
    }

}

// Now for some of the ASCII Stuff
//
SIZE_T
WINAPI
FormatTraceEventA(
        PLIST_ENTRY   HeadEventList,
        PEVENT_TRACE  pInEvent,
        CHAR        * EventBuf,
        ULONG         SizeEventBuf,
        CHAR        * pszMask
        )
{
    SIZE_T  Status;
    ULONG   uSizeEventBuf;
    TCHAR * EventBufW;
    TCHAR * pszMaskW;

    EventBufW = (TCHAR *) malloc(SizeEventBuf * sizeof(TCHAR) + 2);
    if (EventBufW == (TCHAR *) NULL)
    {
        return -1;
    }

    pszMaskW = (TCHAR *) NULL;

    if (pszMask != NULL && strlen(pszMask) != 0)
    {
        pszMaskW = (TCHAR *) malloc(strlen(pszMask) * sizeof(TCHAR));
        if (pszMaskW == (TCHAR *) NULL)
        {
            free(EventBufW);
            return -1;
        }
		RtlZeroMemory(pszMaskW, strlen(pszMask) * sizeof(TCHAR));
    }



    uSizeEventBuf = SizeEventBuf;

    Status = FormatTraceEventW(
                    HeadEventList,
                    pInEvent,
                    EventBufW,
                    SizeEventBuf,
                    pszMaskW);
    if (Status == 0)
    {
        free(EventBufW);
        free(pszMaskW);
        return -1;
    }

    RtlZeroMemory(EventBuf,uSizeEventBuf);

    WideCharToMultiByte(
            CP_ACP,
            0,
            EventBufW,
            (int) _tcslen(EventBufW),   // Truncate in Sundown!!
            EventBuf,
            uSizeEventBuf,
            NULL,
            NULL);

    free(EventBufW);
    free(pszMaskW);

    return Status;
}

ULONG
WINAPI
GetTraceGuidsA(
        CHAR        * GuidFile,
        PLIST_ENTRY * HeadEventList
        )
{
    INT     Status;
    TCHAR * GuidFileW;
    SIZE_T len;

    if ((len = strlen(GuidFile)) == 0)
    {
        return 0;
    }

    GuidFileW = malloc(sizeof(TCHAR) * strlen(GuidFile) + 2);
    if (GuidFileW == NULL)
    {
        return 0;
    }

    if ((MultiByteToWideChar(
                    CP_ACP,
                    0,
                    GuidFile,
                    -1,
                    GuidFileW,
                    (int) strlen(GuidFile) * sizeof(TCHAR))) // Truncate in Sundown!!
        == 0)
    {
		free(GuidFileW);
        return 0;
    }

    Status = GetTraceGuidsW(GuidFileW, HeadEventList);

    free (GuidFileW);
    return Status;
}

void
WINAPI
SummaryTraceEventListA(
        CHAR       * SummaryBlock,
        ULONG        SizeSummaryBlock,
        PLIST_ENTRY  EventListhead
        )
{
    TCHAR * SummaryBlockW;

	if(SizeSummaryBlock <= 0 || SizeSummaryBlock * sizeof(TCHAR) <= 0 )return;

    SummaryBlockW = (TCHAR *) malloc(SizeSummaryBlock * sizeof(TCHAR));
    if (SummaryBlockW == (TCHAR *)NULL)
		return;
	
	//RtlZeroMemory(SummaryBlock, SizeSummaryBlock);
    RtlZeroMemory(SummaryBlockW, SizeSummaryBlock*sizeof(TCHAR));
    SummaryTraceEventListW(
            SummaryBlockW,
            SizeSummaryBlock * ((ULONG)sizeof(TCHAR)),
            EventListhead);

    WideCharToMultiByte(
            CP_ACP,
            0,
            SummaryBlockW,
            (int)_tcslen(SummaryBlockW), // Truncate in Sundown!!
            SummaryBlock,
            SizeSummaryBlock,
            NULL,
            NULL);
    free(SummaryBlockW);
}

void
WINAPI
GetTraceElapseTime(
        __int64 * pElapseTime
        )
{
    * pElapseTime = ElapseTime;
}

ULONG
WINAPI
SetTraceFormatParameter(
        PARAMETER_TYPE  Parameter ,
        PVOID           ParameterValue 
        )
{
    switch (Parameter) {
        case ParameterINDENT: 
            bIndent = PtrToUlong(ParameterValue);
            break;

        case ParameterSEQUENCE: 
            bSequence = PtrToUlong(ParameterValue);
            if (bSequence) {
                STD_PREFIX = STD_PREFIX_SEQ;
            } else {
                STD_PREFIX = STD_PREFIX_NOSEQ;
            }
            break;

        case ParameterGMT: 
            bGmt = PtrToUlong(ParameterValue);
            break;

    case ParameterTraceFormatSearchPath:
            
            break;
    }

    return 0 ;
}

ULONG
WINAPI
GetTraceFormatParameter(
        PARAMETER_TYPE  Parameter ,
        PVOID           ParameterValue 
        )
{
    switch (Parameter) {
        case ParameterINDENT: return bIndent;
        case ParameterSEQUENCE: return bSequence; 
        case ParameterGMT: return bGmt;
    }

    return 0 ;

}

#ifdef __cplusplus
}
#endif