681varVal.Type = (uint)UnsafeNativeMethods.EvtVariantType.EvtVarTypeBoolean; 687varVal.Type = (uint)UnsafeNativeMethods.EvtVariantType.EvtVarTypeString; 693varVal.Type = (uint)UnsafeNativeMethods.EvtVariantType.EvtVarTypeString; 699varVal.Type = (uint)UnsafeNativeMethods.EvtVariantType.EvtVarTypeUInt64; 704varVal.Type = (uint)UnsafeNativeMethods.EvtVariantType.EvtVarTypeUInt32; 709varVal.Type = (uint)UnsafeNativeMethods.EvtVariantType.EvtVarTypeUInt64; 714varVal.Type = (uint)UnsafeNativeMethods.EvtVariantType.EvtVarTypeBoolean; 720varVal.Type = (uint)UnsafeNativeMethods.EvtVariantType.EvtVarTypeBoolean; 730varVal.Type = (uint)UnsafeNativeMethods.EvtVariantType.EvtVarTypeNull; 850systemProperties.ProviderName = (string)ConvertToObject(varVal, UnsafeNativeMethods.EvtVariantType.EvtVarTypeString); 853systemProperties.ProviderId = (Guid?)ConvertToObject(varVal, UnsafeNativeMethods.EvtVariantType.EvtVarTypeGuid); 856systemProperties.Id = (ushort?)ConvertToObject(varVal, UnsafeNativeMethods.EvtVariantType.EvtVarTypeUInt16); 859systemProperties.Qualifiers = (ushort?)ConvertToObject(varVal, UnsafeNativeMethods.EvtVariantType.EvtVarTypeUInt16); 862systemProperties.Level = (byte?)ConvertToObject(varVal, UnsafeNativeMethods.EvtVariantType.EvtVarTypeByte); 865systemProperties.Task = (ushort?)ConvertToObject(varVal, UnsafeNativeMethods.EvtVariantType.EvtVarTypeUInt16); 868systemProperties.Opcode = (byte?)ConvertToObject(varVal, UnsafeNativeMethods.EvtVariantType.EvtVarTypeByte); 871systemProperties.Keywords = (ulong?)ConvertToObject(varVal, UnsafeNativeMethods.EvtVariantType.EvtVarTypeHexInt64); 874systemProperties.TimeCreated = (DateTime?)ConvertToObject(varVal, UnsafeNativeMethods.EvtVariantType.EvtVarTypeFileTime); 877systemProperties.RecordId = (ulong?)ConvertToObject(varVal, UnsafeNativeMethods.EvtVariantType.EvtVarTypeUInt64); 880systemProperties.ActivityId = (Guid?)ConvertToObject(varVal, UnsafeNativeMethods.EvtVariantType.EvtVarTypeGuid); 883systemProperties.RelatedActivityId = (Guid?)ConvertToObject(varVal, UnsafeNativeMethods.EvtVariantType.EvtVarTypeGuid); 886systemProperties.ProcessId = (uint?)ConvertToObject(varVal, UnsafeNativeMethods.EvtVariantType.EvtVarTypeUInt32); 889systemProperties.ThreadId = (uint?)ConvertToObject(varVal, UnsafeNativeMethods.EvtVariantType.EvtVarTypeUInt32); 892systemProperties.ChannelName = (string)ConvertToObject(varVal, UnsafeNativeMethods.EvtVariantType.EvtVarTypeString); 895systemProperties.ComputerName = (string)ConvertToObject(varVal, UnsafeNativeMethods.EvtVariantType.EvtVarTypeString); 898systemProperties.UserId = (SecurityIdentifier)ConvertToObject(varVal, UnsafeNativeMethods.EvtVariantType.EvtVarTypeSid); 901systemProperties.Version = (byte?)ConvertToObject(varVal, UnsafeNativeMethods.EvtVariantType.EvtVarTypeByte); 1110stringVariants[i].Type = (uint)UnsafeNativeMethods.EvtVariantType.EvtVarTypeString; 1162case (int)UnsafeNativeMethods.EvtVariantType.EvtVarTypeUInt32: 1164case (int)UnsafeNativeMethods.EvtVariantType.EvtVarTypeInt32: 1166case (int)UnsafeNativeMethods.EvtVariantType.EvtVarTypeUInt16: 1168case (int)UnsafeNativeMethods.EvtVariantType.EvtVarTypeInt16: 1170case (int)UnsafeNativeMethods.EvtVariantType.EvtVarTypeByte: 1172case (int)UnsafeNativeMethods.EvtVariantType.EvtVarTypeSByte: 1174case (int)UnsafeNativeMethods.EvtVariantType.EvtVarTypeUInt64: 1176case (int)UnsafeNativeMethods.EvtVariantType.EvtVarTypeInt64: 1178case (int)UnsafeNativeMethods.EvtVariantType.EvtVarTypeHexInt64: 1180case (int)UnsafeNativeMethods.EvtVariantType.EvtVarTypeHexInt32: 1182case (int)UnsafeNativeMethods.EvtVariantType.EvtVarTypeSingle: 1184case (int)UnsafeNativeMethods.EvtVariantType.EvtVarTypeDouble: 1186case (int)UnsafeNativeMethods.EvtVariantType.EvtVarTypeNull: 1188case (int)UnsafeNativeMethods.EvtVariantType.EvtVarTypeString: 1190case (int)UnsafeNativeMethods.EvtVariantType.EvtVarTypeAnsiString: 1192case (int)UnsafeNativeMethods.EvtVariantType.EvtVarTypeSid: 1194case (int)UnsafeNativeMethods.EvtVariantType.EvtVarTypeGuid: 1196case (int)UnsafeNativeMethods.EvtVariantType.EvtVarTypeEvtHandle: 1198case (int)(int)UnsafeNativeMethods.EvtVariantType.EvtVarTypeFileTime: 1200case (int)(int)UnsafeNativeMethods.EvtVariantType.EvtVarTypeSysTime: 1203case (int)(int)UnsafeNativeMethods.EvtVariantType.EvtVarTypeSizeT: 1205case (int)UnsafeNativeMethods.EvtVariantType.EvtVarTypeBoolean: 1208case (int)UnsafeNativeMethods.EvtVariantType.EvtVarTypeBinary: 1209case ((int) UnsafeNativeMethods.EvtMasks.EVT_VARIANT_TYPE_ARRAY | (int)UnsafeNativeMethods.EvtVariantType.EvtVarTypeByte): 1214case ((int) UnsafeNativeMethods.EvtMasks.EVT_VARIANT_TYPE_ARRAY | (int)UnsafeNativeMethods.EvtVariantType.EvtVarTypeInt16): 1219case ((int) UnsafeNativeMethods.EvtMasks.EVT_VARIANT_TYPE_ARRAY | (int)UnsafeNativeMethods.EvtVariantType.EvtVarTypeInt32): 1224case ((int) UnsafeNativeMethods.EvtMasks.EVT_VARIANT_TYPE_ARRAY | (int)UnsafeNativeMethods.EvtVariantType.EvtVarTypeInt64): 1229case ((int) UnsafeNativeMethods.EvtMasks.EVT_VARIANT_TYPE_ARRAY | (int)UnsafeNativeMethods.EvtVariantType.EvtVarTypeSingle): 1234case ((int) UnsafeNativeMethods.EvtMasks.EVT_VARIANT_TYPE_ARRAY | (int)UnsafeNativeMethods.EvtVariantType.EvtVarTypeDouble): 1239case ((int) UnsafeNativeMethods.EvtMasks.EVT_VARIANT_TYPE_ARRAY | (int)UnsafeNativeMethods.EvtVariantType.EvtVarTypeSByte): 1241case ((int) UnsafeNativeMethods.EvtMasks.EVT_VARIANT_TYPE_ARRAY | (int)UnsafeNativeMethods.EvtVariantType.EvtVarTypeUInt16): 1243case ((int) UnsafeNativeMethods.EvtMasks.EVT_VARIANT_TYPE_ARRAY | (int)UnsafeNativeMethods.EvtVariantType.EvtVarTypeUInt64): 1244case ((int) UnsafeNativeMethods.EvtMasks.EVT_VARIANT_TYPE_ARRAY | (int)UnsafeNativeMethods.EvtVariantType.EvtVarTypeHexInt64): 1246case ((int) UnsafeNativeMethods.EvtMasks.EVT_VARIANT_TYPE_ARRAY | (int)UnsafeNativeMethods.EvtVariantType.EvtVarTypeUInt32): 1247case ((int) UnsafeNativeMethods.EvtMasks.EVT_VARIANT_TYPE_ARRAY | (int)UnsafeNativeMethods.EvtVariantType.EvtVarTypeHexInt32): 1249case ((int) UnsafeNativeMethods.EvtMasks.EVT_VARIANT_TYPE_ARRAY | (int)UnsafeNativeMethods.EvtVariantType.EvtVarTypeString): 1251case ((int) UnsafeNativeMethods.EvtMasks.EVT_VARIANT_TYPE_ARRAY | (int)UnsafeNativeMethods.EvtVariantType.EvtVarTypeAnsiString): 1253case ((int) UnsafeNativeMethods.EvtMasks.EVT_VARIANT_TYPE_ARRAY | (int)UnsafeNativeMethods.EvtVariantType.EvtVarTypeBoolean): 1255case ((int) UnsafeNativeMethods.EvtMasks.EVT_VARIANT_TYPE_ARRAY | (int)UnsafeNativeMethods.EvtVariantType.EvtVarTypeGuid): 1257case ((int) UnsafeNativeMethods.EvtMasks.EVT_VARIANT_TYPE_ARRAY | (int)UnsafeNativeMethods.EvtVariantType.EvtVarTypeFileTime): 1259case ((int) UnsafeNativeMethods.EvtMasks.EVT_VARIANT_TYPE_ARRAY | (int)UnsafeNativeMethods.EvtVariantType.EvtVarTypeSysTime): 1261case ((int) UnsafeNativeMethods.EvtMasks.EVT_VARIANT_TYPE_ARRAY | (int)UnsafeNativeMethods.EvtVariantType.EvtVarTypeBinary): //both length and count in the manifest: tracrpt supports, Crimson APIs don't 1262case ((int) UnsafeNativeMethods.EvtMasks.EVT_VARIANT_TYPE_ARRAY | (int)UnsafeNativeMethods.EvtVariantType.EvtVarTypeSizeT): //unused: array of win:pointer is returned as HexIntXX 1263case ((int) UnsafeNativeMethods.EvtMasks.EVT_VARIANT_TYPE_ARRAY | (int)UnsafeNativeMethods.EvtVariantType.EvtVarTypeSid): //unsupported by native APIs 1270public static object ConvertToObject(UnsafeNativeMethods.EvtVariant val, UnsafeNativeMethods.EvtVariantType desiredType) { 1271if (val.Type == (int)UnsafeNativeMethods.EvtVariantType.EvtVarTypeNull) return null;