ETW SysCallAddress and ProcessorNumber

SysCallAddress.cs

using System;
using Microsoft.Diagnostics.Tracing.Session;
using Microsoft.Diagnostics.Tracing.Parsers.Kernel;
using Microsoft.Diagnostics.Tracing.Parsers;

namespace SysCallAddress
{
    class Program
    {
        static void Main(string[] args)
        {
            var session = new TraceEventSession("SysCallAddress");
            session.EnableKernelProvider(KernelTraceEventParser.Keywords.SystemCall);
            session.Source.Kernel.PerfInfoSysClEnter += delegate (SysCallEnterTraceData data)
            {
                Console.WriteLine("ProcessorNumber:{0} SysCallAddress:0x{1:X}", data.ProcessorNumber, data.SysCallAddress);
            };
            session.Source.Process();
        }
    }
}