Add ELF Symbol Resolution for Linux .nettrace Traces

src/TraceEvent/EventPipe/EventPipeEventSource.cs

@@ -240,6 +240,10 @@ internal void ReadTraceBlockV6OrGreater(Block block)
                 {
                     _expectedCPUSamplingRate = intVal3;
                 }
+                else if (key == "SystemPageSize" && ulong.TryParse(value, out ulong ulongVal) && ulongVal > 0)
+                {
+                    _systemPageSize = ulongVal;
+                }
             }
         }
 
@@ -656,6 +660,7 @@ private DynamicTraceEventData CreateTemplate(EventPipeMetadata metadata)
         private int _lastLabelListId;
         internal int _processId;
         internal int _expectedCPUSamplingRate;
+        internal ulong _systemPageSize;
         private RewindableStream _stream;
         private bool _isStreaming;
         private ThreadCache _threadCache;

src/TraceEvent/Parsers/UniversalSystemTraceEventParser.cs

@@ -481,8 +481,10 @@ internal sealed class ELFProcessMappingSymbolMetadata : ProcessMappingSymbolMeta
         [JsonPropertyName("build_id")]
         public string BuildId { get; set; }
         [JsonPropertyName("p_vaddr")]
+        [JsonConverter(typeof(HexUInt64Converter))]
         public ulong VirtualAddress { get; set; }
         [JsonPropertyName("p_offset")]
+        [JsonConverter(typeof(HexUInt64Converter))]
         public ulong FileOffset { get; set; }
     }
 
@@ -535,4 +537,43 @@ public override void Write(Utf8JsonWriter writer, ProcessMappingSymbolMetadata v
             JsonSerializer.Serialize(writer, value, value.GetType(), options);
         }
     }
+
+    internal class HexUInt64Converter : JsonConverter<ulong>
+    {
+        public override ulong Read(ref Utf8JsonReader reader, Type typeToConvert, JsonSerializerOptions options)
+        {
+            if (reader.TokenType == JsonTokenType.Number)
+            {
+                return reader.GetUInt64();
+            }
+
+            if (reader.TokenType != JsonTokenType.String)
+            {
+                throw new JsonException($"Cannot convert token of type {reader.TokenType} to ulong.");
+            }
+
+            string text = reader.GetString();
+            if (text != null && text.StartsWith("0x", StringComparison.OrdinalIgnoreCase) && text.Length > 2)
+            {
+                if (ulong.TryParse(text.Substring(2), System.Globalization.NumberStyles.HexNumber,
+                    System.Globalization.CultureInfo.InvariantCulture, out ulong hexValue))
+                {
+                    return hexValue;
+                }
+            }
+
+            if (ulong.TryParse(text, System.Globalization.NumberStyles.Integer,
+                System.Globalization.CultureInfo.InvariantCulture, out ulong value))
+            {
+                return value;
+            }
+
+            throw new JsonException($"Cannot convert \"{text}\" to ulong.");
+        }
+
+        public override void Write(Utf8JsonWriter writer, ulong value, JsonSerializerOptions options)
+        {
+            writer.WriteStringValue("0x" + value.ToString("X"));
+        }
+    }
 }

src/TraceEvent/SourceConverters/NettraceUniversalConverter.cs

@@ -27,6 +27,15 @@ public static void RegisterParsers(TraceLog traceLog)
 
         public void BeforeProcess(TraceLog traceLog, TraceEventDispatcher source)
         {
+            // Extract system page size for ELF RVA calculations.
+            if (source is EventPipeEventSource eventPipeSource)
+            {
+                eventPipeSource.HeadersDeserialized += delegate ()
+                {
+                    traceLog.systemPageSize = eventPipeSource._systemPageSize;
+                };
+            }
+
             UniversalSystemTraceEventParser universalSystemParser = new UniversalSystemTraceEventParser(source);
             universalSystemParser.ExistingProcess += delegate (ProcessCreateTraceData data)
             {