support ThreadProfiling event and add tests (#59)

Author: eronnen

README.md

@@ -169,7 +169,7 @@ The PML format is very complex so there are some features (unchecked in the list
         - [ ] PlugAndPlay
         - [x] QueryNameInformationFile
     - [ ] Profiling Operations
-        - [ ] Thread Profiling
+        - [x] Thread Profiling
         - [x] Process Profiling
         - [ ] Debug Output Profiling
 

procmon_parser/logs.py

@@ -219,7 +219,7 @@ def _get_compatible_csv_detail_column(self, is_utc=True):
         if operation is ProcessOperation.Load_Image:
             details["Image Base"] = "0x{:x}".format(details["Image Base"])
             details["Image Size"] = "0x{:x}".format(details["Image Size"])
-        elif operation is ProcessOperation.Thread_Exit:
+        elif operation in [ProcessOperation.Thread_Exit, ProfilingOperation.Thread_Profiling]:
             details["User Time"] = Event._strftime_duration(details["User Time"])
             details["Kernel Time"] = Event._strftime_duration(details["Kernel Time"])
         elif operation in [

procmon_parser/stream_logs_detail_format.py

@@ -101,6 +101,11 @@ def get_profiling_event_details(io, metadata, event, extra_detail_io):
         private_bytes = read_u64(io)
         event.details["Private Bytes"] = private_bytes
         event.details["Working Set"] = working_set
+    elif event.operation is ProfilingOperation.Thread_Profiling:
+        event.details["User Time"] = read_u32(io)
+        event.details["Kernel Time"] = read_u32(io)
+        event.details["Context Switches"] = read_u32(io)
+        event.path = f"Thread {event.tid}"
 
 
 def get_network_event_details(io, metadata, event, extra_detail_io):

tests/conftest.py

@@ -75,6 +75,7 @@ def csv_reader_windows10_64bit(csv_logs_windows10_64bit):
                         ('CompressedLogFileUTC64FilesystemCSV', 'CompressedLogFileUTC64FilesystemPML'),
                         ('CompressedLogFileUTC64ProcessCSV', 'CompressedLogFileUTC64ProcessPML'),
                         ('CompressedLogFileUTC64RegistryCSV', 'CompressedLogFileUTC64RegistryPML'),
+                        ('CompressedLogfileUTC64ProfilingCSV', 'CompressedLogfileUTC64ProfilingPML'),
                         ('CompressedLogfileTests64bitUTCWindows1125H2CSV', 'CompressedLogfileTests64bitUTCWindows1125H2PML')])
 def specific_events_logs_readers(request):
     return get_csv_log_reader(decompress_resource(request.param[0])), \