diff --git a/Cargo.lock b/Cargo.lock
index f35b9797..852f055c 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -4,11 +4,11 @@ version = 3
 
 [[package]]
 name = "addr2line"
-version = "0.22.0"
+version = "0.21.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6e4503c46a5c0c7844e948c9a4d6acd9f50cccb4de1c48eb9e291ea17470c678"
+checksum = "8a30b2e23b9e17a9f90641c7ab1549cd9b44f296d3ccbf309d2863cfe398a0cb"
 dependencies = [
- "gimli 0.29.0",
+ "gimli 0.28.1",
 ]
 
 [[package]]
@@ -95,9 +95,9 @@ dependencies = [
 
 [[package]]
 name = "anstyle-query"
-version = "1.1.0"
+version = "1.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ad186efb764318d35165f1758e7dcef3b10628e26d41a44bc5550652e6804391"
+checksum = "a64c907d4e79225ac72e2a354c9ce84d50ebb4586dee56c82b3ee73004f537f5"
 dependencies = [
  "windows-sys 0.52.0",
 ]
@@ -118,6 +118,12 @@ version = "1.0.86"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b3d1d046238990b9cf5bcde22a3fb3584ee5cf65fb2765f454ed428c7a0063da"
 
+[[package]]
+name = "array-init"
+version = "2.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3d62b7694a562cdf5a74227903507c56ab2cc8bdd1f781ed5cb4cf9c9f810bfc"
+
 [[package]]
 name = "arrayvec"
 version = "0.7.4"
@@ -136,9 +142,9 @@ dependencies = [
 
 [[package]]
 name = "async-compression"
-version = "0.4.11"
+version = "0.4.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cd066d0b4ef8ecb03a55319dc13aa6910616d0f44008a045bb1835af830abff5"
+checksum = "9c90a406b4495d129f00461241616194cb8a032c8d1c53c657f0961d5f8e0498"
 dependencies = [
  "brotli",
  "flate2",
@@ -149,12 +155,6 @@ dependencies = [
  "tokio",
 ]
 
-[[package]]
-name = "atomic-waker"
-version = "1.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1505bd5d3d116872e7271a6d4e16d81d0c8570876c8de68093a09ac269d8aac0"
-
 [[package]]
 name = "autocfg"
 version = "1.3.0"
@@ -163,16 +163,16 @@ checksum = "0c4b4d0bd25bd0b74681c0ad21497610ce1b7c91b1022cd21c80c6fbdd9476b0"
 
 [[package]]
 name = "backtrace"
-version = "0.3.73"
+version = "0.3.71"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5cc23269a4f8976d0a4d2e7109211a419fe30e8d88d677cd60b6bc79c5732e0a"
+checksum = "26b05800d2e817c8b3b4b54abd461726265fa9789ae34330622f2db9ee696f9d"
 dependencies = [
- "addr2line 0.22.0",
+ "addr2line 0.21.0",
  "cc",
  "cfg-if",
  "libc",
  "miniz_oxide",
- "object",
+ "object 0.32.2",
  "rustc-demangle",
 ]
 
@@ -204,6 +204,30 @@ version = "0.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "597bb81c80a54b6a4381b23faba8d7774b144c94cbd1d6fe3f1329bd776554ab"
 
+[[package]]
+name = "binrw"
+version = "0.13.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "173901312e9850391d4d7c1318c4e099fdc037d61870fca427429830efdb4e5f"
+dependencies = [
+ "array-init",
+ "binrw_derive",
+ "bytemuck",
+]
+
+[[package]]
+name = "binrw_derive"
+version = "0.13.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb515fdd6f8d3a357c8e19b8ec59ef53880807864329b1cb1cba5c53bf76557e"
+dependencies = [
+ "either",
+ "owo-colors",
+ "proc-macro2",
+ "quote",
+ "syn 1.0.109",
+]
+
 [[package]]
 name = "bitflags"
 version = "1.3.2"
@@ -212,9 +236,9 @@ checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
 
 [[package]]
 name = "bitflags"
-version = "2.6.0"
+version = "2.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b048fb63fd8b5923fc5aa7b340d8e156aec7ec02f0c78fa8a6ddc2613f6f71de"
+checksum = "cf4b9d6a944f767f8e5e0db018570623c85f3d925ac718db4e06d0187adb21c1"
 
 [[package]]
 name = "bitvec"
@@ -241,9 +265,9 @@ dependencies = [
 
 [[package]]
 name = "brotli-decompressor"
-version = "4.0.1"
+version = "4.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9a45bd2e4095a8b518033b128020dd4a55aab1c0a381ba4404a472630f4bc362"
+checksum = "e6221fe77a248b9117d431ad93761222e1cf8ff282d9d1d5d9f53d6299a1cf76"
 dependencies = [
  "alloc-no-stdlib",
  "alloc-stdlib",
@@ -266,6 +290,12 @@ version = "3.16.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "79296716171880943b8470b5f8d03aa55eb2e645a4874bdbb28adb49162e012c"
 
+[[package]]
+name = "bytemuck"
+version = "1.16.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "78834c15cb5d5efe3452d58b1e8ba890dd62d21907f867f383358198e56ebca5"
+
 [[package]]
 name = "byteorder"
 version = "1.5.0"
@@ -319,9 +349,9 @@ dependencies = [
 
 [[package]]
 name = "cc"
-version = "1.0.101"
+version = "1.0.97"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ac367972e516d45567c7eafc73d24e1c193dcf200a8d94e9db7b3d38b349572d"
+checksum = "099a5357d84c4c61eb35fc8eafa9a79a902c2f76911e5747ced4e032edd8d9b4"
 
 [[package]]
 name = "cfg-if"
@@ -372,14 +402,14 @@ dependencies = [
  "heck 0.5.0",
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.64",
 ]
 
 [[package]]
 name = "clap_lex"
-version = "0.7.1"
+version = "0.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4b82cf0babdbd58558212896d1a4272303a57bdb245c2bf1147185fb45640e70"
+checksum = "98cc8fbded0c607b7ba9dd60cd98df59af97e84d24e49c8557331cfc26d301ce"
 
 [[package]]
 name = "colorchoice"
@@ -403,6 +433,18 @@ version = "0.8.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "06ea2b9bc92be3c2baa9334a323ebca2d6f074ff852cd1d7b11064035cd3868f"
 
+[[package]]
+name = "coreclr-tracing"
+version = "0.1.0"
+dependencies = [
+ "binrw",
+ "bitflags 2.5.0",
+ "etw-reader",
+ "log",
+ "num-derive",
+ "num-traits",
+]
+
 [[package]]
 name = "cpp_demangle"
 version = "0.4.3"
@@ -429,9 +471,9 @@ checksum = "19d374276b40fb8bbdee95aef7c7fa6b5316ec764510eb64b8dd0e2ed0d7e7f5"
 
 [[package]]
 name = "crc32fast"
-version = "1.4.2"
+version = "1.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a97769d94ddab943e4510d138150169a2758b5ef3eb191a9ee688de3e23ef7b3"
+checksum = "b3855a8a784b474f333699ef2bbca9db2c4a1f6d9088a90a2d25b1eb53111eaa"
 dependencies = [
  "cfg-if",
 ]
@@ -447,9 +489,9 @@ dependencies = [
 
 [[package]]
 name = "crossbeam-utils"
-version = "0.8.20"
+version = "0.8.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "22ec99545bb0ed0ea7bb9b8e1e9122ea386ff8a48c0922e43f36d45ab09e0e80"
+checksum = "248e3bacc7dc6baa3b21e405ee045c3047101a49145e7e9eca583ab4c2ca5345"
 
 [[package]]
 name = "ctrlc"
@@ -534,9 +576,9 @@ dependencies = [
 
 [[package]]
 name = "either"
-version = "1.13.0"
+version = "1.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "60b1af1c220855b6ceac025d3f6ecdd2b7c4894bfe9cd9bda4fbb4bc7c0d4cf0"
+checksum = "a47c1c47d2f5964e29c61246e81db715514cd532db6b5116a25ea3c03d6780a2"
 
 [[package]]
 name = "elsa"
@@ -556,7 +598,7 @@ dependencies = [
  "heck 0.4.1",
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.64",
 ]
 
 [[package]]
@@ -602,7 +644,7 @@ dependencies = [
 name = "etw-reader"
 version = "0.1.0"
 dependencies = [
- "bitflags 2.6.0",
+ "bitflags 2.5.0",
  "fxhash",
  "memoffset",
  "num-derive",
@@ -676,9 +718,9 @@ dependencies = [
 
 [[package]]
 name = "fs4"
-version = "0.8.4"
+version = "0.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f7e180ac76c23b45e767bd7ae9579bc0bb458618c4bc71835926e098e61d15f8"
+checksum = "73969b81e8bc90a3828d913dd3973d80771bfb9d7fbe1a78a79122aad456af15"
 dependencies = [
  "rustix",
  "windows-sys 0.52.0",
@@ -746,7 +788,7 @@ checksum = "87750cf4b7a4c0625b1529e4c543c2182106e4dedc60a2a6455e00d212c489ac"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.64",
 ]
 
 [[package]]
@@ -793,7 +835,7 @@ name = "fxprof-processed-profile"
 version = "0.7.0"
 dependencies = [
  "assert-json-diff",
- "bitflags 2.6.0",
+ "bitflags 2.5.0",
  "debugid",
  "fxhash",
  "serde",
@@ -825,9 +867,9 @@ dependencies = [
 
 [[package]]
 name = "gimli"
-version = "0.29.0"
+version = "0.28.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "40ecd4077b5ae9fd2e9e169b102c6c330d0605168eb0e8bf79952b256dbefffd"
+checksum = "4271d37baee1b8c7e4b708028c57d816cf9d2434acb33a549475f78c181f6253"
 
 [[package]]
 name = "gimli"
@@ -841,15 +883,15 @@ dependencies = [
 
 [[package]]
 name = "h2"
-version = "0.4.5"
+version = "0.4.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fa82e28a107a8cc405f0839610bdc9b15f1e25ec7d696aa5cf173edbcb1486ab"
+checksum = "816ec7294445779408f36fe57bc5b7fc1cf59664059096c65f905c1c61f58069"
 dependencies = [
- "atomic-waker",
  "bytes",
  "fnv",
  "futures-core",
  "futures-sink",
+ "futures-util",
  "http",
  "indexmap",
  "slab",
@@ -917,12 +959,12 @@ dependencies = [
 
 [[package]]
 name = "http-body-util"
-version = "0.1.2"
+version = "0.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "793429d76616a256bcb62c2a2ec2bed781c8307e797e2598c50010f2bee2544f"
+checksum = "0475f8b2ac86659c21b64320d5d653f9efe42acd2a4e560073ec61a155a34f1d"
 dependencies = [
  "bytes",
- "futures-util",
+ "futures-core",
  "http",
  "http-body",
  "pin-project-lite",
@@ -930,9 +972,9 @@ dependencies = [
 
 [[package]]
 name = "httparse"
-version = "1.9.4"
+version = "1.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0fcc0b4a115bf80b728eb8ea024ad5bd707b615bfed49e0665b6e0f86fd082d9"
+checksum = "d897f394bad6a705d5f4104762e116a75639e470d80901eed05a860a95cb1904"
 
 [[package]]
 name = "httpdate"
@@ -969,9 +1011,9 @@ dependencies = [
 
 [[package]]
 name = "hyper-rustls"
-version = "0.27.2"
+version = "0.26.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5ee4be2c948921a1a5320b629c4193916ed787a7f7f293fd3f7f5a6c9de74155"
+checksum = "a0bea761b46ae2b24eb4aef630d8d1c398157b6fc29e6350ecf090a0b70c952c"
 dependencies = [
  "futures-util",
  "http",
@@ -982,7 +1024,6 @@ dependencies = [
  "tokio",
  "tokio-rustls",
  "tower-service",
- "webpki-roots",
 ]
 
 [[package]]
@@ -1088,7 +1129,7 @@ version = "0.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c0ff37bd590ca25063e35af745c343cb7a0271906fb7b37e4813e8f79f00268d"
 dependencies = [
- "bitflags 2.6.0",
+ "bitflags 2.5.0",
  "libc",
 ]
 
@@ -1100,9 +1141,9 @@ checksum = "bfae20f6b19ad527b550c223fddc3077a547fc70cda94b9b566575423fd303ee"
 
 [[package]]
 name = "linux-perf-data"
-version = "0.10.2"
+version = "0.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3cd34317b7ef6e67579faf5021099ff15faa873a082e8b2c46335acbd7147935"
+checksum = "ab6ca5ed6c97474bb07087546ab4201772868214e25d7dc15fe7a9900b70ad67"
 dependencies = [
  "byteorder",
  "linear-map",
@@ -1119,7 +1160,7 @@ version = "0.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "41064623ecf100db029bd29e4a1cdec25fc513d45c15619ecd03504e2ffb1687"
 dependencies = [
- "bitflags 2.6.0",
+ "bitflags 2.5.0",
  "byteorder",
  "memchr",
  "thiserror",
@@ -1127,9 +1168,9 @@ dependencies = [
 
 [[package]]
 name = "linux-raw-sys"
-version = "0.4.14"
+version = "0.4.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "78b3ae25bc7c8c38cec158d1f2757ee79e9b3740fbc7ccf0e59e4b08d793fa89"
+checksum = "01cda141df6706de531b6c46c3a33ecca755538219bd484262fa09410c13539c"
 
 [[package]]
 name = "lock_api"
@@ -1143,9 +1184,9 @@ dependencies = [
 
 [[package]]
 name = "log"
-version = "0.4.22"
+version = "0.4.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a7a70ba024b9dc04c27ea2f0c0548feb474ec5c54bba33a7f72f873a39d07b24"
+checksum = "90ed8c1e510134f979dbc4f070f87d4313098b704861a105fe34231c70a3901c"
 
 [[package]]
 name = "lzma-rs"
@@ -1191,9 +1232,9 @@ checksum = "4facc753ae494aeb6e3c22f839b158aebd4f9270f55cd3c79906c45476c47ab4"
 
 [[package]]
 name = "memchr"
-version = "2.7.4"
+version = "2.7.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "78ca9ab1a0babb1e7d5695e3530886289c18cf2f87ec19a575a0abdce112e3a3"
+checksum = "6c8640c5d730cb13ebd907d8d04b52f55ac9a2eec55b440c8892f40d56c76c1d"
 
 [[package]]
 name = "memmap2"
@@ -1227,9 +1268,9 @@ checksum = "68354c5c6bd36d73ff3feceb05efa59b6acb7626617f4962be322a825e61f79a"
 
 [[package]]
 name = "miniz_oxide"
-version = "0.7.4"
+version = "0.7.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b8a240ddb74feaf34a79a7add65a741f3167852fba007066dcac1ca548d89c08"
+checksum = "9d811f3e15f28568be3407c8e7fdb6514c1cda3cb30683f15b6a1a1dc4ea14a7"
 dependencies = [
  "adler",
 ]
@@ -1252,7 +1293,7 @@ version = "0.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c4c25a3bb7d880e8eceab4822f3141ad0700d20f025991c1f03bd3d00219a5fc"
 dependencies = [
- "bitflags 2.6.0",
+ "bitflags 2.5.0",
 ]
 
 [[package]]
@@ -1261,7 +1302,7 @@ version = "0.28.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ab2156c4fce2f8df6c499cc1c763e4394b7482525bf2a9701c9d79d215f519e4"
 dependencies = [
- "bitflags 2.6.0",
+ "bitflags 2.5.0",
  "cfg-if",
  "cfg_aliases 0.1.1",
  "libc",
@@ -1273,7 +1314,7 @@ version = "0.29.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "71e2746dc3a24dd78b3cfcb7be93368c6de9963d30f43a6a73998a9cf4b17b46"
 dependencies = [
- "bitflags 2.6.0",
+ "bitflags 2.5.0",
  "cfg-if",
  "cfg_aliases 0.2.1",
  "libc",
@@ -1318,7 +1359,7 @@ checksum = "ed3955f1a9c7c0c15e092f9c887db08b1fc683305fdf6eb6684f22555355e202"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.64",
 ]
 
 [[package]]
@@ -1340,6 +1381,15 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "object"
+version = "0.32.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a6a622008b6e321afc04970976f62ee297fdbaa6f95318ca343e3eebb9648441"
+dependencies = [
+ "memchr",
+]
+
 [[package]]
 name = "object"
 version = "0.36.1"
@@ -1386,11 +1436,17 @@ dependencies = [
  "lazy_static",
 ]
 
+[[package]]
+name = "owo-colors"
+version = "3.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c1b04fb49957986fdce4d6ee7a65027d55d4b6d2265e5848bbb507b58ccfdb6f"
+
 [[package]]
 name = "parking_lot"
-version = "0.12.3"
+version = "0.12.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f1bf18183cf54e8d6059647fc3063646a1801cf30896933ec2311622cc4b9a27"
+checksum = "7e4af0ca4f6caed20e900d564c242b8e5d4903fdacf31d3daf527b66fe6f42fb"
 dependencies = [
  "lock_api",
  "parking_lot_core",
@@ -1404,7 +1460,7 @@ checksum = "1e401f977ab385c9e4e3ab30627d6f26d00e2c73eef317493c4ec6d468726cf8"
 dependencies = [
  "cfg-if",
  "libc",
- "redox_syscall 0.5.2",
+ "redox_syscall 0.5.1",
  "smallvec",
  "windows-targets 0.52.6",
 ]
@@ -1415,7 +1471,7 @@ version = "0.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fb51ef7ed9998e108891711812822831daac0b17d67768c3bdc69aa909366123"
 dependencies = [
- "bitflags 2.6.0",
+ "bitflags 2.5.0",
  "elsa",
  "maybe-owned",
  "pdb2",
@@ -1439,7 +1495,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6ec3b43050c38ffb9de87e17d874e9956e3a9131b343c9b7b7002597727c3891"
 dependencies = [
  "arrayvec",
- "bitflags 2.6.0",
+ "bitflags 2.5.0",
  "thiserror",
  "zerocopy",
  "zerocopy-derive",
@@ -1468,7 +1524,7 @@ checksum = "2f38a4412a78282e09a2cf38d195ea5420d15ba0602cb375210efbc877243965"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.64",
 ]
 
 [[package]]
@@ -1525,33 +1581,33 @@ checksum = "5b40af805b3121feab8a3c29f04d8ad262fa8e0561883e7653e024ae4479e6de"
 
 [[package]]
 name = "proc-macro2"
-version = "1.0.86"
+version = "1.0.82"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5e719e8df665df0d1c8fbfd238015744736151d4445ec0836b8e628aae103b77"
+checksum = "8ad3d49ab951a01fbaafe34f2ec74122942fe18a3f9814c3268f1bb72042131b"
 dependencies = [
  "unicode-ident",
 ]
 
 [[package]]
 name = "prost"
-version = "0.12.6"
+version = "0.12.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "deb1435c188b76130da55f17a466d252ff7b1418b2ad3e037d127b94e3411f29"
+checksum = "d0f5d036824e4761737860779c906171497f6d55681139d8312388f8fe398922"
 dependencies = [
  "bytes",
 ]
 
 [[package]]
 name = "prost-derive"
-version = "0.12.6"
+version = "0.12.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "81bddcdb20abf9501610992b6759a4c888aef7d1a7247ef75e2404275ac24af1"
+checksum = "19de2de2a00075bf566bee3bd4db014b11587e84184d3f7a791bc17f1a8e9e48"
 dependencies = [
  "anyhow",
  "itertools",
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.64",
 ]
 
 [[package]]
@@ -1575,53 +1631,6 @@ dependencies = [
  "memchr",
 ]
 
-[[package]]
-name = "quinn"
-version = "0.11.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e4ceeeeabace7857413798eb1ffa1e9c905a9946a57d81fb69b4b71c4d8eb3ad"
-dependencies = [
- "bytes",
- "pin-project-lite",
- "quinn-proto",
- "quinn-udp",
- "rustc-hash 1.1.0",
- "rustls",
- "thiserror",
- "tokio",
- "tracing",
-]
-
-[[package]]
-name = "quinn-proto"
-version = "0.11.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fadfaed2cd7f389d0161bb73eeb07b7b78f8691047a6f3e73caaeae55310a4a6"
-dependencies = [
- "bytes",
- "rand",
- "ring",
- "rustc-hash 2.0.0",
- "rustls",
- "slab",
- "thiserror",
- "tinyvec",
- "tracing",
-]
-
-[[package]]
-name = "quinn-udp"
-version = "0.5.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9096629c45860fc7fb143e125eb826b5e721e10be3263160c7d60ca832cf8c46"
-dependencies = [
- "libc",
- "once_cell",
- "socket2",
- "tracing",
- "windows-sys 0.52.0",
-]
-
 [[package]]
 name = "quote"
 version = "1.0.36"
@@ -1696,11 +1705,11 @@ dependencies = [
 
 [[package]]
 name = "redox_syscall"
-version = "0.5.2"
+version = "0.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c82cf8cff14456045f55ec4241383baeff27af886adb72ffb2162f99911de0fd"
+checksum = "469052894dcb553421e483e4209ee581a45100d31b4018de03e5a7ad86374a7e"
 dependencies = [
- "bitflags 2.6.0",
+ "bitflags 2.5.0",
 ]
 
 [[package]]
@@ -1731,14 +1740,14 @@ checksum = "bcc303e793d3734489387d205e9b186fac9c6cfacedd98cbb2e8a5943595f3e6"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.64",
 ]
 
 [[package]]
 name = "regex"
-version = "1.10.5"
+version = "1.10.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b91213439dad192326a0d7c6ee3955910425f441d7038e0d6933b0aec5c4517f"
+checksum = "c117dbdfde9c8308975b6a18d71f3f385c89461f7b3fb054288ecf2a2058ba4c"
 dependencies = [
  "aho-corasick",
  "memchr",
@@ -1748,9 +1757,9 @@ dependencies = [
 
 [[package]]
 name = "regex-automata"
-version = "0.4.7"
+version = "0.4.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "38caf58cc5ef2fed281f89292ef23f6365465ed9a41b7a7754eb4e26496c92df"
+checksum = "86b83b8b9847f9bf95ef68afb0b8e6cdb80f498442f5179a29fad448fcc1eaea"
 dependencies = [
  "aho-corasick",
  "memchr",
@@ -1759,15 +1768,15 @@ dependencies = [
 
 [[package]]
 name = "regex-syntax"
-version = "0.8.4"
+version = "0.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7a66a03ae7c801facd77a29370b4faec201768915ac14a721ba36f20bc9c209b"
+checksum = "adad44e29e4c806119491a7f06f03de4d1af22c3a680dd47f1e6e179439d1f56"
 
 [[package]]
 name = "reqwest"
-version = "0.12.5"
+version = "0.12.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c7d6d2a27d57148378eb5e111173f4276ad26340ecc5c49a4a2152167a2d6a37"
+checksum = "566cafdd92868e0939d3fb961bd0dc25fcfaaed179291093b3d43e6b3150ea10"
 dependencies = [
  "async-compression",
  "base64",
@@ -1788,7 +1797,6 @@ dependencies = [
  "once_cell",
  "percent-encoding",
  "pin-project-lite",
- "quinn",
  "rustls",
  "rustls-pemfile",
  "rustls-pki-types",
@@ -1842,25 +1850,13 @@ version = "0.1.24"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "719b953e2095829ee67db738b3bfa9fa368c94900df327b3f07fe6e794d2fe1f"
 
-[[package]]
-name = "rustc-hash"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "08d43f7aa6b08d49f382cde6a7982047c3426db949b1424bc4b7ec9ae12c6ce2"
-
-[[package]]
-name = "rustc-hash"
-version = "2.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "583034fd73374156e66797ed8e5b0d5690409c9226b22d87cb7f19821c05d152"
-
 [[package]]
 name = "rustix"
 version = "0.38.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "70dc5ec042f7a43c4a73241207cecc9873a06d45debb38b329f8541d85c2730f"
 dependencies = [
- "bitflags 2.6.0",
+ "bitflags 2.5.0",
  "errno",
  "libc",
  "linux-raw-sys",
@@ -1869,11 +1865,11 @@ dependencies = [
 
 [[package]]
 name = "rustls"
-version = "0.23.10"
+version = "0.22.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "05cff451f60db80f490f3c182b77c35260baace73209e9cdbbe526bfe3a4d402"
+checksum = "bf4ef73721ac7bcd79b2b315da7779d8fc09718c6b3d2d1b2d94850eb8c18432"
 dependencies = [
- "once_cell",
+ "log",
  "ring",
  "rustls-pki-types",
  "rustls-webpki",
@@ -1957,7 +1953,7 @@ version = "0.23.0"
 dependencies = [
  "addr2line 0.23.0",
  "anyhow",
- "bitflags 2.6.0",
+ "bitflags 2.5.0",
  "bitvec",
  "bytesize",
  "cpp_demangle",
@@ -1973,7 +1969,7 @@ dependencies = [
  "memmap2",
  "msvc-demangler",
  "nom",
- "object",
+ "object 0.36.1",
  "pdb-addr2line",
  "rangemap",
  "rustc-demangle",
@@ -2032,7 +2028,7 @@ checksum = "e0cd7e117be63d3c3678776753929474f3b04a43a080c744d6b0ae2a8c28e222"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.64",
 ]
 
 [[package]]
@@ -2125,15 +2121,15 @@ checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f"
 
 [[package]]
 name = "subtle"
-version = "2.6.1"
+version = "2.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292"
+checksum = "81cdd64d312baedb58e21336b31bc043b77e01cc99033ce76ef539f78e965ebc"
 
 [[package]]
 name = "symsrv"
-version = "0.5.2"
+version = "0.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bc9eb3fb03ab32475d1107c2b3d2efcd48cb5e9278e7b39186598df7a049a1da"
+checksum = "098492916b4954d05c9f195d073714401a48ad9d0c1d4690a4074146c9924804"
 dependencies = [
  "async-compression",
  "cab",
@@ -2149,9 +2145,20 @@ dependencies = [
 
 [[package]]
 name = "syn"
-version = "2.0.68"
+version = "1.0.109"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "901fa70d88b9d6c98022e23b4136f9f3e54e4662c3bc1bd1d84a42a9a0f0c1e9"
+checksum = "72b64191b275b66ffe2469e8af2c1cfe3bafa67b529ead792a6d0160888b4237"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "syn"
+version = "2.0.64"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7ad3dee41f36859875573074334c200d1add8e4a87bb37113ebd31d926b7b11f"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -2160,9 +2167,9 @@ dependencies = [
 
 [[package]]
 name = "sync_wrapper"
-version = "1.0.1"
+version = "0.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a7065abeca94b6a8a577f9bd45aa0867a2238b74e8eb67cf10d492bc39351394"
+checksum = "2047c6ded9c721764247e62cd3b03c09ffc529b2ba5b10ec482ae507a4a70160"
 
 [[package]]
 name = "synstructure"
@@ -2172,7 +2179,7 @@ checksum = "c8af7666ab7b6390ab78131fb5b0fce11d6b7a6951602017c35fa82800708971"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.64",
 ]
 
 [[package]]
@@ -2181,7 +2188,7 @@ version = "0.5.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ec7dddc5f0fee506baf8b9fdb989e242f17e4b11c61dfbb0635b705217199eea"
 dependencies = [
- "bitflags 2.6.0",
+ "bitflags 2.5.0",
  "byteorder",
  "enum-as-inner",
  "libc",
@@ -2220,22 +2227,22 @@ dependencies = [
 
 [[package]]
 name = "thiserror"
-version = "1.0.62"
+version = "1.0.63"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f2675633b1499176c2dff06b0856a27976a8f9d436737b4cf4f312d4d91d8bbb"
+checksum = "c0342370b38b6a11b6cc11d6a805569958d54cfa061a29969c3b5ce2ea405724"
 dependencies = [
  "thiserror-impl",
 ]
 
 [[package]]
 name = "thiserror-impl"
-version = "1.0.62"
+version = "1.0.63"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d20468752b09f49e909e55a5d338caa8bedf615594e9d80bc4c565d30faf798c"
+checksum = "a4558b58466b9ad7ca0f102865eccc95938dca1a74a856f2b57b6629050da261"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.64",
 ]
 
 [[package]]
@@ -2271,9 +2278,9 @@ dependencies = [
 
 [[package]]
 name = "tinyvec"
-version = "1.6.1"
+version = "1.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c55115c6fbe2d2bef26eb09ad74bde02d8255476fc0c7b515ef09fbb35742d82"
+checksum = "87cc5ceb3875bb20c2890005a4e226a4651264a5c75edb2421b52861a0a0cb50"
 dependencies = [
  "tinyvec_macros",
 ]
@@ -2286,9 +2293,9 @@ checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
 
 [[package]]
 name = "tokio"
-version = "1.38.0"
+version = "1.38.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ba4f4a02a7a80d6f274636f0aa95c7e383b912d41fe721a31f29e29698585a4a"
+checksum = "eb2caba9f80616f438e09748d5acda951967e1ea58508ef53d9c6402485a46df"
 dependencies = [
  "backtrace",
  "bytes",
@@ -2309,14 +2316,14 @@ checksum = "5f5ae998a069d4b5aba8ee9dad856af7d520c3699e6159b185c2acd48155d39a"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.64",
 ]
 
 [[package]]
 name = "tokio-rustls"
-version = "0.26.0"
+version = "0.25.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0c7bc40d0e5a97695bb96e27995cd3a08538541b0a846f65bba7a359f36700d4"
+checksum = "775e0c0f0adb3a2f22a00c4745d728b479985fc15ee7ca6a2608388c5569860f"
 dependencies = [
  "rustls",
  "rustls-pki-types",
@@ -2370,21 +2377,9 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c3523ab5a71916ccf420eebdf5521fcef02141234bbc0b8a49f2fdc4544364ef"
 dependencies = [
  "pin-project-lite",
- "tracing-attributes",
  "tracing-core",
 ]
 
-[[package]]
-name = "tracing-attributes"
-version = "0.1.27"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "34704c8d6ebcbc939824180af020566b01a7c01f80641264eba0999f6c2b6be7"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
-]
-
 [[package]]
 name = "tracing-core"
 version = "0.1.32"
@@ -2448,9 +2443,9 @@ checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1"
 
 [[package]]
 name = "url"
-version = "2.5.2"
+version = "2.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "22784dbdf76fdde8af1aeda5622b546b422b6fc585325248a2bf9f5e41e94d6c"
+checksum = "31e6302e3bb753d46e83516cae55ae196fc0c309407cf11ab35cc51a4c2a4633"
 dependencies = [
  "form_urlencoded",
  "idna",
@@ -2459,12 +2454,13 @@ dependencies = [
 
 [[package]]
 name = "usamply"
-version = "0.12.9"
+version = "0.12.10-prerelease.5"
 dependencies = [
- "bitflags 2.6.0",
+ "bitflags 2.5.0",
  "byteorder",
  "cfg-if",
  "clap",
+ "coreclr-tracing",
  "crossbeam-channel",
  "ctrlc",
  "debugid",
@@ -2494,7 +2490,7 @@ dependencies = [
  "num-derive",
  "num-traits",
  "num_cpus",
- "object",
+ "object 0.36.1",
  "once_cell",
  "opener",
  "os-release",
@@ -2524,9 +2520,9 @@ dependencies = [
 
 [[package]]
 name = "utf8parse"
-version = "0.2.2"
+version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"
+checksum = "711b9620af191e0cdc7468a8d14e709c3dcdb115b36f838e601583af800a370a"
 
 [[package]]
 name = "uuid"
@@ -2589,7 +2585,7 @@ dependencies = [
  "once_cell",
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.64",
  "wasm-bindgen-shared",
 ]
 
@@ -2623,7 +2619,7 @@ checksum = "e94f17b526d0a461a191c78ea52bbce64071ed5c04c9ffe424dcb38f74171bb7"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.64",
  "wasm-bindgen-backend",
  "wasm-bindgen-shared",
 ]
@@ -2659,9 +2655,9 @@ dependencies = [
 
 [[package]]
 name = "webpki-roots"
-version = "0.26.3"
+version = "0.26.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bd7c23921eeb1713a4e851530e9b9756e4fb0e89978582942612524cf09f01cd"
+checksum = "b3de34ae270483955a94f4b21bdaaeb83d508bb84a01435f393818edb0012009"
 dependencies = [
  "rustls-pki-types",
 ]
@@ -2789,7 +2785,7 @@ checksum = "4698e52ed2d08f8658ab0c39512a7c00ee5fe2688c65f8c0a4f06750d729f2a6"
 dependencies = [
  "windows-implement 0.56.0",
  "windows-interface 0.56.0",
- "windows-result 0.1.2",
+ "windows-result 0.1.1",
  "windows-targets 0.52.6",
 ]
 
@@ -2814,7 +2810,7 @@ checksum = "f6fc35f58ecd95a9b71c4f2329b911016e6bec66b3f2e6a4aad86bd2e99e2f9b"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.64",
 ]
 
 [[package]]
@@ -2825,7 +2821,7 @@ checksum = "2bbd5b46c938e506ecbce286b6628a02171d56153ba733b6c741fc627ec9579b"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.64",
 ]
 
 [[package]]
@@ -2836,7 +2832,7 @@ checksum = "08990546bf4edef8f431fa6326e032865f27138718c587dc21bc0265bbcb57cc"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.64",
 ]
 
 [[package]]
@@ -2847,14 +2843,14 @@ checksum = "053c4c462dc91d3b1504c6fe5a726dd15e216ba718e84a0e46a88fbe5ded3515"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.64",
 ]
 
 [[package]]
 name = "windows-result"
-version = "0.1.2"
+version = "0.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5e383302e8ec8515204254685643de10811af0ed97ea37210dc26fb0032647f8"
+checksum = "749f0da9cc72d82e600d8d2e44cadd0b9eedb9038f71a1c58556ac1c5791813b"
 dependencies = [
  "windows-targets 0.52.6",
 ]
@@ -3094,9 +3090,9 @@ dependencies = [
 
 [[package]]
 name = "yoke"
-version = "0.7.4"
+version = "0.7.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6c5b1314b079b0930c31e3af543d8ee1757b1951ae1e1565ec704403a7240ca5"
+checksum = "65e71b2e4f287f467794c671e2b8f8a5f3716b3c829079a1c44740148eff07e4"
 dependencies = [
  "serde",
  "stable_deref_trait",
@@ -3105,21 +3101,21 @@ dependencies = [
 
 [[package]]
 name = "yoke-derive"
-version = "0.7.4"
+version = "0.7.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "28cc31741b18cb6f1d5ff12f5b7523e3d6eb0852bbbad19d73905511d9849b95"
+checksum = "9e6936f0cce458098a201c245a11bef556c6a0181129c7034d10d76d1ec3a2b8"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.64",
  "synstructure",
 ]
 
 [[package]]
 name = "zerocopy"
-version = "0.7.35"
+version = "0.7.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1b9b4fd18abc82b8136838da5d50bae7bdea537c574d8dc1a34ed098d6c166f0"
+checksum = "ae87e3fcd617500e5d106f0380cf7b77f3c6092aae37191433159dda23cfb087"
 dependencies = [
  "byteorder",
  "zerocopy-derive",
@@ -3127,23 +3123,23 @@ dependencies = [
 
 [[package]]
 name = "zerocopy-derive"
-version = "0.7.35"
+version = "0.7.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fa4f8080344d4671fb4e831a13ad1e68092748387dfc4f55e356242fae12ce3e"
+checksum = "15e934569e47891f7d9411f1a451d947a60e000ab3bd24fbb970f000387d1b3b"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.64",
 ]
 
 [[package]]
 name = "zerofrom"
-version = "0.1.4"
+version = "0.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "91ec111ce797d0e0784a1116d0ddcdbea84322cd79e5d5ad173daeba4f93ab55"
+checksum = "655b0814c5c0b19ade497851070c640773304939a6c0fd5f5fb43da0696d05b7"
 
 [[package]]
 name = "zeroize"
-version = "1.8.1"
+version = "1.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ced3678a2879b30306d323f4542626697a464a97c0a07c9aebf7ebca65cd4dde"
+checksum = "525b4ec142c6b68a2d10f01f7bbf6755599ca3f81ea53b8431b7dd348f5fdb2d"
diff --git a/Cargo.toml b/Cargo.toml
index 77d3cb00..0ac0c0b3 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -11,7 +11,8 @@ members = [
     "wholesym-addr2line",
     "tools/benchmarks",
     "tools/dump_table",
-    "tools/query_api"
+    "tools/query_api",
+    "coreclr-tracing"
 ]
 exclude = ["etw-reader"] # Should not be compiled on non-Windows
 
diff --git a/coreclr-tracing/Cargo.toml b/coreclr-tracing/Cargo.toml
new file mode 100644
index 00000000..5f739dcf
--- /dev/null
+++ b/coreclr-tracing/Cargo.toml
@@ -0,0 +1,18 @@
+[package]
+name = "coreclr-tracing"
+version = "0.1.0"
+edition = "2021"
+
+[dependencies]
+binrw = "0.13.3"
+bitflags = "2.4.2"
+num-traits = "0.2"
+num-derive = "0.4"
+log = "0.4.21"
+
+[target.'cfg(windows)'.dependencies]
+etw-reader = { path = "../etw-reader" }
+
+# linux-perf-data = "0.10.1"
+[[example]]
+name = "dump-nettrace"
\ No newline at end of file
diff --git a/coreclr-tracing/examples/dump-nettrace.rs b/coreclr-tracing/examples/dump-nettrace.rs
new file mode 100644
index 00000000..795b721d
--- /dev/null
+++ b/coreclr-tracing/examples/dump-nettrace.rs
@@ -0,0 +1,110 @@
+#![allow(unused)]
+use std::fs::File;
+
+use coreclr_tracing::*;
+use coreclr_tracing::nettrace::*;
+
+// https://github.com/microsoft/perfview/blob/main/src/TraceEvent/EventPipe/EventPipeFormat.md
+
+fn main() {
+    // open file as binary, argv[1]
+    let mut file = File::open(std::env::args().nth(1).unwrap()).unwrap();
+
+    let mut reader = EventPipeParser::new(file).expect("Failed to make EventPipeParser");
+
+    loop {
+        match reader.next_event() {
+            Ok(Some(event)) => {
+                //if event.provider_name == "Microsoft-DotNETCore-SampleProfiler" {
+                //    continue;
+                //}
+
+                match coreclr_tracing::nettrace::decode_event(&event) {
+                    DecodedEvent::CoreClrEvent((meta, coreclr_event)) => {
+                        match coreclr_event {
+                            CoreClrEvent::MethodLoad(event) => {
+                                println!(
+                                    "MethodLoad: 0x{:16x} -- {}.{}",
+                                    event.method_start_address,
+                                    event.method_namespace,
+                                    event.method_name
+                                );
+                            }
+                            CoreClrEvent::GcTriggered(event) => {
+                                println!("GcTriggered: {:?}", event.reason);
+                            }
+                            CoreClrEvent::GcAllocationTick(event) => {
+                                //println!("GcAllocationTick: {:?}", event);
+                            }
+                            CoreClrEvent::ModuleLoad(event) => {
+                                println!("ModuleLoad: {:?}", event);
+                            }
+                            CoreClrEvent::ModuleUnload(event) => {
+                                println!("ModuleUnload: {:?}", event);
+                            }
+                            CoreClrEvent::MethodUnload(event) => {
+                                println!("MethodUnload: {:?}", event);
+                            }
+                            CoreClrEvent::GcSampledObjectAllocation(event) => {
+                                println!("GcSampledObjectAllocation: {:?}", event);
+                            }
+                            CoreClrEvent::ReadyToRunGetEntryPoint(event) => {
+                                println!("ReadyToRunGetEntryPoint: {:?}", event);
+                            }
+                            CoreClrEvent::MethodDCEnd(event) => {
+                                println!("MethodDCEnd: {:?}", event);
+                            }
+                            CoreClrEvent::GcStart(event) => {
+                                println!("GcStart: {:?}", event);
+                            }
+                            CoreClrEvent::GcEnd(event) => {
+                                println!("GcEnd: {:?}", event);
+                            }
+                        }
+                    }
+                    DecodedEvent::UnknownEvent => {
+                        let mut handled = false;
+
+                        if event.provider_name == "Microsoft-Windows-DotNETRuntime" {
+                            handled = true;
+                            match event.event_id {
+                                145 => println!("MethodJittingStarted [Unhandled]"),
+                                146 => println!("MemoryAllocatedForJitCode [Unhandled]"),
+                                _ => handled = false,
+                            }
+                        } else if event.provider_name == "Microsoft-Windows-DotNETRuntimeRundown" {
+                            handled = true;
+                            match event.event_id {
+                                10 => println!("Rundown: GCSettingsRundown [Unhandled]"),
+                                146 => println!("Rundown: DCEndComplete [Unhandled] @ {}", event.timestamp),
+                                148 => println!("Rundown: DCEndInit [Unhandled] @ {}", event.timestamp),
+                                150 => println!("Rundown: MethodDCEndILToNativeMap_V1 [Unhandled]"),
+                                152 => println!("Rundown: DomainModuleDCEnd [Unhandled]"),
+                                154 => println!("Rundown: ModuleDCEnd [Unhandled] @ {}", event.timestamp),
+                                156 => println!("Rundown: AssemblyDCEnd [Unhandled]"),
+                                158 => println!("Rundown: AppDomainDCEnd [Unhandled]"),
+                                187 => println!("Rundown: RuntimeInformationDCStart [Unhandled]"),
+                                _ => handled = false,
+                            }
+                        }
+
+                        if !handled {
+                            println!("Unknown: {} / {}", event.provider_name, event.event_id);
+                        }
+                    }
+                }
+
+                //println!("{} -- ({} {}){:?}", name, event);
+                //println!("{} -- ({} {})", name, event.provider_name, event.event_id);
+            }
+            Ok(None) => {
+                println!("EOF");
+                break;
+            }
+            Err(e) => {
+                println!("Error: {:?}", e);
+                break;
+            }
+        }
+    }
+}
diff --git a/coreclr-tracing/src/coreclr/enums.rs b/coreclr-tracing/src/coreclr/enums.rs
new file mode 100644
index 00000000..7099fbc6
--- /dev/null
+++ b/coreclr-tracing/src/coreclr/enums.rs
@@ -0,0 +1,141 @@
+use bitflags::bitflags;
+
+use std::fmt::Display;
+
+use binrw::BinRead;
+use num_derive::FromPrimitive;
+
+#[derive(BinRead, Debug, FromPrimitive, Clone, Copy)]
+#[br(repr = u32)]
+pub enum GcReason {
+    AllocSmall = 0,
+    Induced = 1,
+    LowMemory = 2,
+    Empty = 3,
+    AllocLargeObjectHeap = 4,
+    OutOfSpaceSmallObjectHeap = 5,
+    OutOfSpaceLargeObjectHeap = 6,
+    InducedNotForced = 7,
+    Stress = 8,
+    InducedLowMemory = 9,
+}
+
+impl Display for GcReason {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        match self {
+            GcReason::AllocSmall => f.write_str("Small object heap allocation"),
+            GcReason::Induced => f.write_str("Induced"),
+            GcReason::LowMemory => f.write_str("Low memory"),
+            GcReason::Empty => f.write_str("Empty"),
+            GcReason::AllocLargeObjectHeap => f.write_str("Large object heap allocation"),
+            GcReason::OutOfSpaceSmallObjectHeap => {
+                f.write_str("Out of space (for small object heap)")
+            }
+            GcReason::OutOfSpaceLargeObjectHeap => {
+                f.write_str("Out of space (for large object heap)")
+            }
+            GcReason::InducedNotForced => f.write_str("Induced but not forced as blocking"),
+            GcReason::Stress => f.write_str("Stress"),
+            GcReason::InducedLowMemory => f.write_str("Induced low memory"),
+        }
+    }
+}
+
+#[derive(BinRead, Debug, FromPrimitive, Clone, Copy)]
+#[br(repr = u32)]
+pub enum GcAllocationKind {
+    Small = 0,
+    Large = 1,
+    Pinned = 2,
+}
+
+impl Display for GcAllocationKind {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        match self {
+            GcAllocationKind::Small => f.write_str("Small"),
+            GcAllocationKind::Large => f.write_str("Large"),
+            GcAllocationKind::Pinned => f.write_str("Pinned"),
+        }
+    }
+}
+
+#[derive(BinRead, Debug, FromPrimitive, Clone, Copy)]
+#[br(repr = u32)]
+pub enum GcType {
+    Blocking = 0,
+    Background = 1,
+    BlockingDuringBackground = 2,
+}
+
+impl Display for GcType {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        match self {
+            GcType::Blocking => f.write_str("Blocking GC"),
+            GcType::Background => f.write_str("Background GC"),
+            GcType::BlockingDuringBackground => f.write_str("Blocking GC during background GC"),
+        }
+    }
+}
+
+#[derive(BinRead, Debug, FromPrimitive, Clone, Copy)]
+#[br(repr = u32)]
+pub enum GcSuspendEeReason {
+    Other = 0,
+    GC = 1,
+    AppDomainShutdown = 2,
+    CodePitching = 3,
+    Shutdown = 4,
+    Debugger = 5,
+    GcPrep = 6,
+    DebuggerSweep = 7,
+}
+
+impl Display for GcSuspendEeReason {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        match self {
+            GcSuspendEeReason::Other => f.write_str("Other"),
+            GcSuspendEeReason::GC => f.write_str("GC"),
+            GcSuspendEeReason::AppDomainShutdown => f.write_str("AppDomain shutdown"),
+            GcSuspendEeReason::CodePitching => f.write_str("Code pitching"),
+            GcSuspendEeReason::Shutdown => f.write_str("Shutdown"),
+            GcSuspendEeReason::Debugger => f.write_str("Debugger"),
+            GcSuspendEeReason::GcPrep => f.write_str("GC prep"),
+            GcSuspendEeReason::DebuggerSweep => f.write_str("Debugger sweep"),
+        }
+    }
+}
+
+bitflags! {
+    #[derive(PartialEq, Eq)]
+    pub struct CoreClrMethodFlags: u32 {
+        const dynamic = 0x1;
+        const generic = 0x2;
+        const has_shared_generic_code = 0x4;
+        const jitted = 0x8;
+        const jit_helper = 0x10;
+        const profiler_rejected_precompiled_code = 0x20;
+        const ready_to_run_rejected_precompiled_code = 0x40;
+
+        // next three bits are the tiered compilation level
+        const opttier_bit0 = 0x80;
+        const opttier_bit1 = 0x100;
+        const opttier_bit2 = 0x200;
+
+        // extent flags/value (hot/cold)
+        const extent_bit_0 = 0x10000000; // 0x1 == cold, 0x0 = hot
+        const extent_bit_1 = 0x20000000; // always 0 for now looks like
+        const extent_bit_2 = 0x40000000;
+        const extent_bit_3 = 0x80000000;
+
+        const _ = !0;
+    }
+
+    #[derive(PartialEq, Eq)]
+    pub struct TieredCompilationSettings: u32 {
+        const none = 0x0;
+        const quick_jit = 0x1;
+        const quick_jit_for_loops = 0x2;
+        const tiered_pgo = 0x4;
+        const ready_to_run = 0x8;
+    }
+}
diff --git a/coreclr-tracing/src/coreclr/etw.rs b/coreclr-tracing/src/coreclr/etw.rs
new file mode 100644
index 00000000..20f0f4a0
--- /dev/null
+++ b/coreclr-tracing/src/coreclr/etw.rs
@@ -0,0 +1,358 @@
+use std::{collections::HashMap, convert::TryInto};
+
+use crate::EventMetadata;
+use super::*;
+use num_traits::FromPrimitive;
+
+use etw_reader::{self, schema::TypedEvent};
+use etw_reader::parser::{Parser, TryParse};
+
+pub struct CoreClrEtwConverter {
+    last_event_on_thread: HashMap<u32, (EventMetadata, CoreClrEvent)>,
+    //last_event: String,
+}
+
+impl CoreClrEtwConverter {
+    pub fn new() -> Self {
+        Self {
+            last_event_on_thread: HashMap::new(),
+            //last_event: String::default(),
+        }
+    }
+
+    pub fn remaining_clr_events_on_threads(
+        &mut self,
+    ) -> std::collections::hash_map::IntoIter<u32, (EventMetadata, CoreClrEvent)> {
+        std::mem::take(&mut self.last_event_on_thread).into_iter()
+    }
+
+    pub fn etw_event_to_coreclr_event(
+        &mut self,
+        s: &TypedEvent,
+        parser: &mut Parser,
+    ) -> Option<(EventMetadata, CoreClrEvent)> {
+        let timestamp_raw = s.timestamp() as u64;
+
+        let mut name_parts = s.name().splitn(3, '/');
+        let provider = name_parts.next().unwrap();
+        let mut task = name_parts.next().unwrap();
+        let mut opcode = name_parts.next().unwrap();
+
+        let is_rundown = match provider {
+            "Microsoft-Windows-DotNETRuntime" => false,
+            "Microsoft-Windows-DotNETRuntimeRundown" => true,
+            _ => {
+                panic!("Unexpected event {}", s.name())
+            }
+        };
+
+        //let xx = format!("{} {} {}", provider, task, opcode);
+        //if xx != self.last_event { eprintln!("{} @ {}", xx, s.thread_id()); self.last_event = xx; }
+
+        // When working with merged ETL files, the proper task and opcode names appear here, e.g. "CLRMethod/MethodLoadVerbose" or
+        // "CLRMethodRundown/MethodDCStartVerbose". When working with the unmerged user ETL, these show up as e.g. "Method /DCStartVerbose".
+        // Not clear where those names come from the Etw .man file in CoreCLR does have entries for e.g. RuntimePublisher.MethodDCStartVerboseOpcodeMessage
+        // as "DCStartVerbose", but I'm not sure how/why those are referenced here and not in the merged ETL. xperf -a dumper on the unmerged
+        // ETL shows the same (correct) names as the merged ETL.
+        //
+        // We try to hack around this by converting the unmerged name to the converted one here.
+        task = task.trim();
+        opcode = opcode.trim();
+
+        // Some of these are technically not correct; e.g. the task should be CLRMethodRundown if it's the
+        // rundown provider, but we handle them the same below.
+        match task {
+            "Method" => {
+                task = "CLRMethod";
+                opcode = match opcode {
+                    "LoadVerbose" => "MethodLoadVerbose",
+                    "UnloadVerbose" => "MethodUnloadVerbose",
+                    "DCStartVerbose" => "MethodDCStartVerbose",
+                    "DCEndVerbose" => "MethodDCEndVerbose",
+                    "JittingStarted" => "MethodJittingStarted",
+                    _ => opcode,
+                };
+            },
+            "Loader" => {
+                task = "CLRLoader";
+                opcode = match opcode {
+                    "ModuleDCStart" => "ModuleDCStart",
+                    _ => opcode,
+                };
+            },
+            "Runtime" => {
+                task = "CLRRuntimeInformation";
+                opcode = opcode.trim();
+            },
+            "GC" => {
+                task = "GarbageCollection";
+                opcode = match opcode {
+                    "PerHeapHisory" => opcode,
+                    "GCDynamicEvent" => opcode,
+                    "Start" => "win:Start",
+                    "Stop" => "win:Stop",
+                    "RestartEEStart" => "GCRestartEEBegin",
+                    "RestartEEStop" => "GCRestartEEEnd",
+                    "SuspendEEStart" => "GCSuspendEEBegin",
+                    "SuspendEEStop" => "GCSuspendEEEnd",
+                    _ => opcode,
+                };
+            },
+            "ClrStack" => {
+                task = "CLRStack";
+                opcode = match opcode {
+                    "Walk" => "CLRStackWalk",
+                    _ => opcode,
+                };
+            },
+            _ => {},
+        }
+
+        let pid = s.process_id();
+        let tid = s.thread_id();
+
+        // ETW CoreCLR stackwalk events are a separate event that comes after the event to which
+        // it should be attached. Our cross-platform CoreCLR events have the stack as an optional
+        // part of every event. So, if we're recording stacks from ETW, instead of returning
+        // non-stackwalk events directly, we store them as the last event for a given thread so
+        // that we can attach a stack.
+        //
+        // If we have a pending event and we get a stackwalk event, we'll attach the stack and
+        // return the pending event.
+        // If we get a non-stackwalk event, we'll store it, and still return this previous
+        // pending event.
+        let pending_event = self.last_event_on_thread.remove(&tid);
+
+        // Handle StackWalk events outside of the big match below for cleanliness
+        if (task, opcode) == ("CLRStack", "CLRStackWalk") {
+            // If the STACK keyword is enabled, we get a CLRStackWalk following each CLR event that supports stacks. Not every event
+            // does. The info about which does and doesn't is here: https://github.com/dotnet/runtime/blob/main/src/coreclr/vm/ClrEtwAllMeta.lst
+            // Current dotnet (8.0.x) seems to have a bug where `MethodJitMemoryAllocatedForCode` events will fire a stackwalk,
+            // but the event itself doesn't end up in the trace. (https://github.com/dotnet/runtime/issues/102004)
+
+            // if we don't have anything to attach this stack to, just skip it
+            if pending_event.is_none() {
+                //eprintln!("no pending event for stackwalk {}", tid);
+                return None;
+            }
+
+            let pending_event = pending_event.unwrap();
+
+            // "Stack" is explicitly declared as length 2 in the manifest, so the first two addresses are in here, rest
+            // are in user data buffer.
+            let first_addresses: Vec<u8> = parser.parse("Stack");
+            let address_iter = first_addresses
+                .chunks_exact(8)
+                .chain(parser.buffer.chunks_exact(8))
+                .map(|chunk| u64::from_le_bytes(chunk.try_into().unwrap()));
+
+            return Some((pending_event.0.with_stack(address_iter.collect()), pending_event.1));
+        }
+
+        let common = EventMetadata {
+            timestamp: timestamp_raw,
+            process_id: pid,
+            thread_id: tid,
+            stack: None,
+            is_rundown,
+        };
+
+        let new_event = match (task, opcode) {
+            ("CLRMethod" | "CLRMethodRundown", method_event) => match method_event {
+                "MethodLoadVerbose" | "MethodDCStartVerbose" | "MethodDCEndVerbose" => {
+                    let method_name: String = parser.parse("MethodName");
+                    let method_namespace: String = parser.parse("MethodNamespace");
+                    let method_signature: String = parser.parse("MethodSignature");
+                    let module_id: u64 = parser.parse("ModuleID");
+                    let method_id: u64 = parser.parse("MethodID");
+                    let method_flags: u32 = parser.parse("MethodFlags");
+                    let method_token: u32 = parser.parse("MethodToken");
+                    let clr_instance_id: Option<u16> = parser.try_parse("ClrInstanceID").ok();
+                    let re_jit_id: Option<u64> = parser.try_parse("ReJITID").ok();
+
+                    let method_start_address: u64 = parser.parse("MethodStartAddress");
+                    let method_size: u32 = parser.parse("MethodSize");
+
+                    //log::trace!("{}: @ {:x} {}::{} {}", opcode, method_start_address, method_namespace, method_basename, method_signature);
+
+                    Some(CoreClrEvent::MethodLoad(MethodLoadUnloadEvent {
+                        module_id,
+                        method_start_address,
+                        method_size,
+                        method_name,
+                        method_namespace,
+                        method_signature,
+                        method_id,
+                        method_token,
+                        method_flags,
+                        clr_instance_id,
+                        re_jit_id,
+                    }))
+                }
+                _ => None,
+            },
+            ("CLRLoader" | "CLRLoaderRundown", loader_event) => match loader_event {
+                // AppDomain, Assembly, Module Load/Unload
+                "ModuleDCStart" | _ => None,
+            },
+            ("GarbageCollection", gc_event) => {
+                match gc_event {
+                    "GCSampledObjectAllocation" => {
+                        // If High/Low flags are set, then we get one of these for every alloc. Otherwise only
+                        // when a threshold is hit. (100kb) The count and size are aggregates in that case.
+
+                        // There's a bug here in some windows processes, where TypeID is sent as a 32-bit value
+                        // even in a 64-bit process. This commonly occurs with powershell.exe. Just ignore
+                        // these events for now.
+                        if let Some(type_id) = parser.try_parse("TypeID").ok() {
+                            let address: u64 = parser.parse("Address");
+                            let object_count_for_type_sample: u32 = parser.parse("ObjectCountForTypeSample");
+                            let total_size_for_type_sample: u64 = parser.parse("TotalSizeForTypeSample");
+                            let clr_instance_id: u16 = parser.parse("ClrInstanceID");
+
+                            Some(CoreClrEvent::GcSampledObjectAllocation(
+                                GcSampledObjectAllocationEvent {
+                                    address,
+                                    type_id,
+                                    object_count_for_type_sample,
+                                    total_size_for_type_sample,
+                                    clr_instance_id,
+                                },
+                            ))
+                        } else {
+                            None
+                        }
+                    }
+                    "Triggered" => {
+                        let reason: u32 = parser.parse("Reason");
+                        let reason = GcReason::from_u32(reason).unwrap_or_else(|| {
+                            log::warn!("Unknown CLR GC Triggered reason: {}", reason);
+                            GcReason::Empty
+                        });
+
+                        Some(CoreClrEvent::GcTriggered(GcTriggeredEvent {
+                            reason,
+                            clr_instance_id: 0,
+                        }))
+                    }
+                    "GCSuspendEEBegin" => {
+                        // Reason, Count
+                        //let _count: u32 = parser.parse("Count");
+                        let reason: u32 = parser.parse("Reason");
+
+                        let _reason = GcSuspendEeReason::from_u32(reason).unwrap_or_else(|| {
+                            log::warn!("Unknown CLR GCSuspendEEBegin reason: {}", reason);
+                            GcSuspendEeReason::Other
+                        });
+
+                        //Some(CoreClrEvent::GcSuspendEeBegin(GcSuspendEeBeginEvent {
+                        //    common,
+                        //    reason,
+                        //}))
+                        // TODO
+                        None
+                    }
+                    "GCSuspendEEEnd" => {
+                        // TODO
+                        None
+                    }
+                    "GCRestartEEBegin" => {
+                        // TODO
+                        None
+                    }
+                    "GCRestartEEEnd" => {
+                        // TODO
+                        None
+                    }
+                    "win:Start" => {
+                        let count: u32 = parser.parse("Count");
+                        let depth: Option<u32> = parser.try_parse("Depth").ok();
+                        let reason: u32 = parser.parse("Reason");
+                        let gc_type = parser.try_parse("Type").ok().and_then(GcType::from_u32);
+                        let clr_instance_id: Option<u16> = parser.try_parse("ClrInstanceID").ok();
+                        let client_sequence_number: Option<u64> = parser.try_parse("ClientSequenceNumber").ok();
+
+                        let reason = GcReason::from_u32(reason).unwrap_or_else(|| {
+                            log::warn!("Unknown CLR GCStart reason: {}", reason);
+                            GcReason::Empty
+                        });
+
+                        Some(CoreClrEvent::GcStart(GcStartEvent {
+                            count,
+                            depth,
+                            reason,
+                            gc_type,
+                            clr_instance_id,
+                            client_sequence_number,
+                        }))
+                    }
+                    "win:Stop" => {
+                        let count: u32 = parser.parse("Count");
+                        let depth: u32 = parser.parse("Depth");
+                        let reason = parser.try_parse("Reason").ok().and_then(GcReason::from_u32);
+                        Some(CoreClrEvent::GcEnd(GcEndEvent {
+                            count,
+                            depth,
+                            reason,
+                        }))
+                    }
+                    "SetGCHandle" => {
+                        // TODO
+                        None
+                    }
+                    "DestroyGCHandle" => {
+                        // TODO
+                        None
+                    }
+                    "GCFinalizersBegin" | "GCFinalizersEnd" | "FinalizeObject" => {
+                        // TODO: create an interval
+                        None
+                    }
+                    "GCCreateSegment" | "GCFreeSegment" | "GCDynamicEvent" | "GCHeapStats" => {
+                        // don't care
+                        None
+                    }
+                    _ => {
+                        // don't care
+                        None
+                    }
+                }
+            }
+            ("CLRRuntimeInformation", _) => None,
+            ("Type", "BulkType") => {
+                //         <template tid="BulkType">
+                // <data name="Count" inType="win:UInt32"    />
+                // <data name="ClrInstanceID" inType="win:UInt16" />
+                // <struct name="Values" count="Count" >
+                // <data name="TypeID" inType="win:UInt64" outType="win:HexInt64" />
+                // <data name="ModuleID" inType="win:UInt64" outType="win:HexInt64" />
+                // <data name="TypeNameID" inType="win:UInt32" />
+                // <data name="Flags" inType="win:UInt32" map="TypeFlagsMap"/>
+                // <data name="CorElementType"  inType="win:UInt8" />
+                // <data name="Name" inType="win:UnicodeString" />
+                // <data name="TypeParameterCount" inType="win:UInt32" />
+                // <data name="TypeParameters"  count="TypeParameterCount"  inType="win:UInt64" outType="win:HexInt64" />
+                // </struct>
+                // <UserData>
+                // <Type xmlns="myNs">
+                // <Count> %1 </Count>
+                // <ClrInstanceID> %2 </ClrInstanceID>
+                // </Type>
+                // </UserData>
+                //let count: u32 = parser.parse("Count");
+
+                // uint32 + uint16 at the front (Count and ClrInstanceID), then struct of values. We don't need a Vec<u8> copy.
+                //let values: Vec<u8> = parser.parse("Values");
+                //let values = &s.user_buffer()[6..];
+                None
+            },
+            _ => None,
+        };
+
+        if new_event.is_some() {
+            self.last_event_on_thread.insert(tid, (common, new_event.unwrap()));
+        }
+
+        pending_event
+    }
+}
diff --git a/coreclr-tracing/src/coreclr/eventpipe.rs b/coreclr-tracing/src/coreclr/eventpipe.rs
new file mode 100644
index 00000000..ad269396
--- /dev/null
+++ b/coreclr-tracing/src/coreclr/eventpipe.rs
@@ -0,0 +1,196 @@
+use std::io::Cursor;
+use binrw::*;
+
+use super::*;
+use crate::{nettrace::*, EventMetadata};
+
+pub fn decode_coreclr_event(event: &NettraceEvent) -> Option<(EventMetadata, CoreClrEvent)> {
+    match event.provider_name.as_str() {
+        "Microsoft-Windows-DotNETRuntime" => decode_coreclr_regular_event(event),
+        "Microsoft-Windows-DotNETRuntimeRundown" => decode_coreclr_rundown_event(event),
+        _ => None,
+    }
+}
+
+fn to_event_metadata(event: &NettraceEvent, is_rundown: bool) -> EventMetadata {
+    EventMetadata {
+        timestamp: event.timestamp,
+        process_id: u32::MAX, // note: nettrace events don't include the process id, because they come from a single process
+        thread_id: event.thread_id as u32,
+        stack: None,
+        is_rundown,
+    }
+}
+
+fn decode_coreclr_regular_event(event: &NettraceEvent) -> Option<(EventMetadata, CoreClrEvent)> {
+    let mut payload = Cursor::new(&event.payload);
+    //eprintln!("Regular: {:?}", event.event_id);
+
+    let meta = to_event_metadata(event, false);
+
+    match event.event_id {
+        // 151: DomainModuleLoad
+        // 152: ModuleLoad
+        // 153: ModuleUnload
+        151 => {
+            // DomainModuleLoad
+            let ev = ModuleLoadUnloadEvent::read_le_args(
+                &mut payload,
+                binrw::args! { version: event.event_version, app_domain: true },
+            )
+            .unwrap();
+            Some((meta, CoreClrEvent::ModuleLoad(ev)))
+        }
+        152 => {
+            // ModuleLoad
+            let ev = ModuleLoadUnloadEvent::read_le_args(
+                &mut payload,
+                binrw::args! { version: event.event_version, app_domain: false },
+            )
+            .unwrap();
+            Some((meta, CoreClrEvent::ModuleLoad(ev)))
+        }
+        153 => {
+            // ModuleUnload
+            let ev = ModuleLoadUnloadEvent::read_le_args(
+                &mut payload,
+                binrw::args! { version: event.event_version, app_domain: false },
+            )
+            .unwrap();
+            Some((meta, CoreClrEvent::ModuleUnload(ev)))
+        }
+        159 => {
+            // R2RGetEntryPoint
+            let ev = ReadyToRunGetEntryPointEvent::read_le_args(
+                &mut payload,
+                binrw::args! { version: event.event_version },
+            )
+            .unwrap();
+            Some((meta, CoreClrEvent::ReadyToRunGetEntryPoint(ev)))
+        }
+        141 => {
+            // MethodLoad
+            let ev = MethodLoadUnloadEvent::read_le_args(
+                &mut payload,
+                binrw::args! { version: event.event_version, verbose: false },
+            )
+            .unwrap();
+            Some((meta, CoreClrEvent::MethodLoad(ev)))
+        }
+        142 => {
+            // MethodUnload
+            let ev = MethodLoadUnloadEvent::read_le_args(
+                &mut payload,
+                binrw::args! { version: event.event_version, verbose: false },
+            )
+            .unwrap();
+            Some((meta, CoreClrEvent::MethodUnload(ev)))
+        }
+        143 => {
+            // MethodLoadVerbose
+            let ev = MethodLoadUnloadEvent::read_le_args(
+                &mut payload,
+                binrw::args! { version: event.event_version, verbose: true },
+            )
+            .unwrap();
+            Some((meta, CoreClrEvent::MethodLoad(ev)))
+        }
+        144 => {
+            // MethodUnloadVerbose
+            let ev = MethodLoadUnloadEvent::read_le_args(
+                &mut payload,
+                binrw::args! { version: event.event_version, verbose: true },
+            )
+            .unwrap();
+            Some((meta, CoreClrEvent::MethodUnload(ev)))
+        }
+        35 => {
+            // GCTriggered
+            let ev = GcTriggeredEvent::read_le_args(
+                &mut payload,
+                binrw::args! { version: event.event_version },
+            )
+            .unwrap();
+            Some((meta, CoreClrEvent::GcTriggered(ev)))
+        }
+        1 => {
+            // GCStart
+            None
+        }
+        2 => {
+            // GCStop
+            None
+        }
+        3 => {
+            // GCRestartEEEnd
+            None
+        }
+        7 => {
+            // GCRestartEEBegin
+            None
+        }
+        8 => {
+            // GCSuspendEEEnd
+            None
+        }
+        9 => {
+            // GCSuspendEEBegin
+            None
+        }
+        10 => {
+            let ev = GcAllocationTickEvent::read_le_args(
+                &mut payload,
+                binrw::args! { version: event.event_version },
+            )
+            .unwrap();
+            Some((meta, CoreClrEvent::GcAllocationTick(ev)))
+        }
+        20 | 30 => {
+            // High | Low, do we really need both of them?
+            let ev = GcSampledObjectAllocationEvent::read_le_args(
+                &mut payload,
+                binrw::args! { version: event.event_version },
+            )
+            .unwrap();
+            Some((meta, CoreClrEvent::GcSampledObjectAllocation(ev)))
+        }
+        // 13: GCFinalizersEnd
+        // 14: GCFinalizersBegin
+        // 82: CLRStackWalk (we should never see this I don't think)
+        // 83: AppDomainMemAllocated
+        // 84: AppDomainMemSurvived
+        // 85: ThreadCreated
+        // 86: ThreadTerminated
+        // 87: ThreadDomainEnter
+        // 145: MethodJittingStarted
+        // 146: MethodJitMemoryAllocatedForCode
+        // 154: AssemblyLoad
+        // 155: AssemblyUnload
+        // 156: AppDomainLoad
+        // 157: AppDomainUnload
+        // 160: R2RGetEntryPointStart
+        // 187: RuntimeInformationStart
+        // 190: MethodILToNativeMap
+        _ => None,
+    }
+}
+
+fn decode_coreclr_rundown_event(event: &NettraceEvent) -> Option<(EventMetadata, CoreClrEvent)> {
+    let mut payload = Cursor::new(&event.payload);
+
+    let meta = to_event_metadata(event, true);
+
+    //eprintln!("RUNDOWN: {:?}", event.event_id);
+    match event.event_id {
+        144 => {
+            // MethodDCStartVerbose | MethodDCEndVerbose
+            let ev = MethodLoadUnloadEvent::read_le_args(
+                &mut payload,
+                binrw::args! { version: event.event_version, verbose: true },
+            )
+            .unwrap();
+            Some((meta, CoreClrEvent::MethodDCEnd(ev)))
+        }
+        _ => None,
+    }
+}
\ No newline at end of file
diff --git a/coreclr-tracing/src/coreclr/events.rs b/coreclr-tracing/src/coreclr/events.rs
new file mode 100644
index 00000000..6f5d8bda
--- /dev/null
+++ b/coreclr-tracing/src/coreclr/events.rs
@@ -0,0 +1,200 @@
+// CoreCLR needs from ETW:
+//
+// DOTNetProvider:
+//
+// CLRMethod | CLRMethodRundown
+//   - MethodLoad_V1 (136), MethodUnLoad_V1 (137), MethodDCStart_V1 (137 -- Rundown), MethodDCEnd_V1 (138 -- Rundown)
+//   - MethodLoadVerbose_V1 (143) | MethodDCStartVerbose_V1 (141)
+//   - MethodDCEndVerbose (144)
+//   - ModuleLoad_V2 (152) | ModuleUnload_V2 (153) | ModuleDCStart_V2 (153) | ModuleDCEnd_V2 (154)
+//   - DomainModuleLoad_V1 (151) | DomainModuleDCStart_V1 (151 - rundown) | DomainModuleDCEnd_V1 (152 - rundown)
+// Type
+//   - BulkType
+// CLRStack  (doesn't exist)
+//   - CLRStackWalk
+// GarbageCollection
+//   - GCAllocationTick_V2 (10)
+//   - GCSampledObjectAllocation
+//   - Triggered
+//   - GCSuspendEE (9)
+//   - GCSuspendEEEnd (8)
+//   - GCRestartEEBegin (7)
+//   - GCRestartEEEnd (3)
+//   - "win:Start" - GCStart_V1 - 1
+//   - "win:Stop" - GCEnd_V1 - 2
+//   - SetGCHandle
+//   - DestroyGCHandle
+//   - GCFinalizersBegin (14) | GCFinalizersEnd (13) | FinalizeObject
+//   - GCCreateSegment (5) | GCFreeSegment (6) | GCDynamicEvent | GCHeapStats (4)
+// XXX AppDomains
+//   - AppDomainLoad_V1 (156) | AppDomainUnLoad_V1 (157)
+//   - AppDomainDCStart_V1 (157 -- rundown) | AppDomainDCEnd_V1 (158 -- rundown)
+//
+// don't need:
+//
+// CLRRuntimeInformation
+// CLRLoader
+
+// This is only here because there's a macro definition of "version" below that is unused, but is
+// present so that the parsing code can pass consistent variables to everything.  I don't know how to
+// mark it as unused in just that definition.
+#![allow(unused_variables)] 
+
+use binrw::{BinRead, BinResult, NullWideString};
+use super::*;
+
+#[binrw::parser(reader, endian)]
+fn parse_null_wide_string_to_string() -> BinResult<String> {
+    let result = NullWideString::read_options(reader, endian, ())?;
+    if result.0.is_empty() {
+        Ok(String::new())
+    } else {
+        Ok(result.to_string())
+    }
+}
+
+#[derive(BinRead, Debug, Clone)]
+#[br(little, import { version: u32, app_domain: bool })]
+pub struct ModuleLoadUnloadEvent {
+    pub module_id: u64,
+    pub assembly_id: u64,
+    #[br(if(app_domain))]
+    pub app_domain_id: Option<u64>,
+    pub module_flags: u32,
+    pub _reserved1: u32,
+    #[br(parse_with = parse_null_wide_string_to_string)]
+    pub module_il_path: String,
+    #[br(parse_with = parse_null_wide_string_to_string)]
+    pub module_native_path: String,
+    #[br(if(version >= 1))]
+    pub clr_instance_id: Option<u16>,
+    #[br(if(version >= 2))]
+    pub managed_pdb_signature: [u8; 16],
+    #[br(if(version >= 2))]
+    pub managed_pdb_age: u32,
+    #[br(if(version >= 2), parse_with = parse_null_wide_string_to_string)]
+    pub managed_pdb_build_path: String,
+    #[br(if(version >= 2))]
+    pub native_pdb_signature: [u8; 16],
+    #[br(if(version >= 2))]
+    pub native_pdb_age: u32,
+    #[br(if(version >= 2), parse_with = parse_null_wide_string_to_string)]
+    pub native_pdb_build_path: String,
+}
+
+#[derive(BinRead, Debug, Clone)]
+#[br(little, import { version: u32, verbose: bool })]
+pub struct MethodLoadUnloadEvent {
+    pub method_id: u64,
+    pub module_id: u64,
+    pub method_start_address: u64,
+    pub method_size: u32,
+    pub method_token: u32,
+    pub method_flags: u32,
+
+    #[br(if(verbose), parse_with = parse_null_wide_string_to_string)]
+    pub method_namespace: String,
+
+    #[br(if(verbose), parse_with = parse_null_wide_string_to_string)]
+    pub method_name: String,
+
+    #[br(if(verbose), parse_with = parse_null_wide_string_to_string)]
+    pub method_signature: String,
+
+    #[br(if(version >= 1, None))]
+    pub clr_instance_id: Option<u16>,
+
+    #[br(if(version >= 2, None))]
+    pub re_jit_id: Option<u64>,
+}
+
+#[derive(BinRead, Debug, Clone)]
+#[br(little, import { version: u32 })]
+pub struct GcTriggeredEvent {
+    pub reason: GcReason,
+    pub clr_instance_id: u16,
+}
+
+#[derive(BinRead, Debug, Clone)]
+#[br(little, import { version: u32 })]
+pub struct GcStartEvent {
+    pub count: u32,
+    #[br(if(version >= 1, None))]
+    pub depth: Option<u32>,
+    pub reason: GcReason,
+    #[br(if(version >= 1, None))]
+    pub gc_type: Option<GcType>,
+    #[br(if(version >= 1, None))]
+    pub clr_instance_id: Option<u16>,
+    #[br(if(version >= 2, None))]
+    pub client_sequence_number: Option<u64>,
+}
+
+#[derive(BinRead, Debug, Clone)]
+#[br(little, import { version: u32 })]
+pub struct GcEndEvent {
+    pub count: u32,
+    pub depth: u32,
+    #[br(if(version >= 1, None))]
+    pub reason: Option<GcReason>,
+}
+
+#[derive(BinRead, Debug, Clone)]
+#[br(little, import { version: u32 })]
+pub struct GcAllocationTickEvent {
+    pub allocation_amount: u32,
+    pub allocation_kind: GcAllocationKind,
+    pub clr_instance_id: u16,
+    #[br(if(version >= 2))]
+    pub allocation_amount64: u64,
+    #[br(if(version >= 2))]
+    pub type_id: u64, // pointer
+    #[br(if(version >= 2), parse_with = parse_null_wide_string_to_string)]
+    pub type_name: String,
+    #[br(if(version >= 2))]
+    pub heap_index: u32,
+    #[br(if(version >= 3))]
+    pub address: Option<u64>, // pointer
+    #[br(if(version >= 4))]
+    pub object_size: Option<u64>,
+}
+
+#[derive(BinRead, Debug, Clone)]
+#[br(little, import { version: u32 })]
+pub struct GcSampledObjectAllocationEvent {
+    pub address: u64, // pointer
+    pub type_id: u64, // pointer
+    pub object_count_for_type_sample: u32,
+    pub total_size_for_type_sample: u64,
+    pub clr_instance_id: u16,
+}
+
+#[derive(BinRead, Debug, Clone)]
+#[br(little, import { version: u32 })]
+pub struct ReadyToRunGetEntryPointEvent {
+    pub method_id: u64,
+    #[br(parse_with = parse_null_wide_string_to_string)]
+    pub method_namespace: String,
+    #[br(parse_with = parse_null_wide_string_to_string)]
+    pub method_name: String,
+    #[br(parse_with = parse_null_wide_string_to_string)]
+    pub method_signature: String,
+    pub entry_point: u64,
+    pub clr_instance_id: u16,
+}
+
+#[derive(Debug, Clone)]
+pub enum CoreClrEvent {
+    ModuleLoad(ModuleLoadUnloadEvent),
+    ModuleUnload(ModuleLoadUnloadEvent),
+    MethodLoad(MethodLoadUnloadEvent),
+    MethodUnload(MethodLoadUnloadEvent),
+    GcTriggered(GcTriggeredEvent),
+    GcStart(GcStartEvent),
+    GcEnd(GcEndEvent),
+    GcAllocationTick(GcAllocationTickEvent),
+    GcSampledObjectAllocation(GcSampledObjectAllocationEvent),
+    ReadyToRunGetEntryPoint(ReadyToRunGetEntryPointEvent),
+    MethodDCEnd(MethodLoadUnloadEvent),
+}
+
diff --git a/coreclr-tracing/src/coreclr/mod.rs b/coreclr-tracing/src/coreclr/mod.rs
new file mode 100644
index 00000000..b6ef9b8c
--- /dev/null
+++ b/coreclr-tracing/src/coreclr/mod.rs
@@ -0,0 +1,8 @@
+mod enums;
+mod events;
+pub mod eventpipe;
+#[cfg(windows)]
+pub mod etw;
+
+pub use enums::*;
+pub use events::*;
diff --git a/coreclr-tracing/src/lib.rs b/coreclr-tracing/src/lib.rs
new file mode 100644
index 00000000..685399bb
--- /dev/null
+++ b/coreclr-tracing/src/lib.rs
@@ -0,0 +1,31 @@
+// The coreclr module contains the various coreclr event types, as well
+// as the tools to convert ETW and eventpipe events into the generic event
+// corelcr types.
+mod coreclr;
+pub use coreclr::*;
+
+// The nettrace module handles parsing of nettrace files.
+pub mod nettrace;
+
+#[derive(Debug, Clone)]
+pub struct EventMetadata {
+    pub timestamp: u64,
+    pub process_id: u32,
+    pub thread_id: u32,
+    pub stack: Option<Vec<u64>>,
+    pub is_rundown: bool,
+}
+
+impl EventMetadata {
+    #[allow(unused)]
+    fn with_stack(mut self, stack: Vec<u64>) -> Self {
+        self.stack = Some(stack);
+        self
+    }
+
+    #[allow(unused)]
+    pub fn with_pid(mut self, pid: u32) -> Self {
+        self.process_id = pid;
+        self
+    }
+}
diff --git a/coreclr-tracing/src/nettrace/helpers.rs b/coreclr-tracing/src/nettrace/helpers.rs
new file mode 100644
index 00000000..e59170d5
--- /dev/null
+++ b/coreclr-tracing/src/nettrace/helpers.rs
@@ -0,0 +1,29 @@
+use std::io::{Read, Seek};
+
+use binrw::{BinReaderExt, BinResult};
+
+pub fn parse_varint_u64<R: BinReaderExt + Read + Seek>(reader: &mut R) -> BinResult<u64> {
+    let mut result = 0;
+    let mut shift = 0;
+    loop {
+        let byte: u8 = reader.read_le()?;
+        result |= ((byte & 0x7f) as u64) << shift;
+        if byte & 0x80 == 0 {
+            break;
+        }
+        shift += 7;
+    }
+    Ok(result)
+}
+
+pub fn parse_varint_u32<R: BinReaderExt + Read + Seek>(reader: &mut R) -> BinResult<u32> {
+    parse_varint_u64(reader).map(|x| x as u32)
+}
+
+pub fn parse_varint_i64<R: BinReaderExt + Read + Seek>(reader: &mut R) -> BinResult<i64> {
+    parse_varint_u64(reader).map(|x| unsafe { std::mem::transmute(x) })
+}
+
+pub fn parse_varint_i32<R: BinReaderExt + Read + Seek>(reader: &mut R) -> BinResult<i32> {
+    parse_varint_u64(reader).map(|x| unsafe { std::mem::transmute(x as u32) })
+}
diff --git a/coreclr-tracing/src/nettrace/mod.rs b/coreclr-tracing/src/nettrace/mod.rs
new file mode 100644
index 00000000..ee6efa12
--- /dev/null
+++ b/coreclr-tracing/src/nettrace/mod.rs
@@ -0,0 +1,321 @@
+#![allow(unused)]
+use binrw::{binrw, BinRead, BinReaderExt, BinResult, NullWideString};
+use std::fmt::Display;
+use std::io::{BufRead, Cursor, Read, Seek, SeekFrom};
+
+use crate::{coreclr, EventMetadata};
+
+mod helpers;
+
+pub mod parser;
+pub use parser::*;
+
+// https://github.com/microsoft/perfview/blob/main/src/TraceEvent/EventPipe/EventPipeFormat.md
+
+#[derive(BinRead)]
+#[br(little)]
+pub struct NettraceString {
+    length: u32,
+
+    #[br(count = length)]
+    bytes: Vec<u8>,
+}
+
+impl NettraceString {
+    fn as_str(&self) -> &str {
+        std::str::from_utf8(&self.bytes).unwrap()
+    }
+}
+
+impl std::fmt::Debug for NettraceString {
+    fn fmt(&self, f: &mut std::fmt::Formatter) -> std::fmt::Result {
+        write!(f, "\"{}\"", self.as_str())
+    }
+}
+
+impl std::fmt::Display for NettraceString {
+    fn fmt(&self, f: &mut std::fmt::Formatter) -> std::fmt::Result {
+        write!(f, "\"{}\"", self.as_str())
+    }
+}
+
+#[derive(BinRead, Debug)]
+#[br(little, magic = b"Nettrace")]
+pub struct NettraceHeader {
+    ident: NettraceString,
+}
+
+#[derive(BinRead, Debug, Eq, PartialEq)]
+#[br(repr(u8))]
+pub enum NettraceTag {
+    Invalid = 0,
+    NullReference = 1,
+    BeginPrivateObject = 5,
+    EndObject = 6,
+}
+
+// Type objects have a NullReference tag as their type; every object will start with a type object,
+// so pull it out into a separate struct instead of as part of the enum
+#[derive(BinRead, Debug)]
+#[br(little, magic = b"\x05\x01")]
+pub struct NettraceTypeObject {
+    version: u32,
+    minimum_reader_version: u32,
+    type_name: NettraceString,
+    end_object: NettraceTag,
+}
+
+#[derive(BinRead, Debug, Clone, Copy)]
+#[br(little)]
+pub struct NettraceTime {
+    year: u16,
+    month: u16,
+    day_of_week: u16,
+    day: u16,
+    hour: u16,
+    minute: u16,
+    second: u16,
+    millisecond: u16,
+}
+
+#[derive(BinRead, Debug, Clone, Copy)]
+#[br(little)]
+pub struct NettraceTraceObject {
+    sync_time_utc: NettraceTime,
+    sync_time_qpc: u64,
+    qpc_frequency: u64,
+    pointer_size: u32,
+    process_id: u32,
+    number_of_processors: u32,
+    expected_cpu_sampling_rate: u32,
+}
+
+#[derive(BinRead, Debug)]
+#[br(little)]
+pub struct NettraceEventBlockHeader {
+    size: u16,
+    flags: u16,
+    min_timestamp: u64,
+    #[br(pad_after = size - 20)]
+    max_timestamp: u64,
+}
+
+#[derive(BinRead, Debug)]
+#[br(little)]
+pub struct NettraceEventBlock {
+    #[br(align_after = 4)]
+    size: u32,
+
+    header: NettraceEventBlockHeader,
+}
+
+// This header can be either compressed or uncompressed.
+// The uncompressed header can be parsed directly; the compressed
+// header needs manual parsing (see parse_compressed_header below).
+#[derive(BinRead, Debug, Default, Clone)]
+#[br(little)]
+pub struct EventBlobHeader {
+    size: u32,
+    raw_metadata_id: u32, // high bit is "IsSorted" flag
+    sequence_number: u32,
+    thread_id: u64,
+    capture_thread_id: u64,
+    processor_number: u32,
+    stack_id: u32,
+    timestamp: u64,
+    activity_id: [u8; 16],
+    related_activity_id: [u8; 16],
+    payload_size: u32,
+
+    // at the end to not screw up alignment
+    #[br(calc = raw_metadata_id & 0x7fffffff)]
+    metadata_id: u32,
+    #[br(calc = raw_metadata_id & 0x80000000 != 0)]
+    is_sorted: bool,
+}
+
+impl Display for EventBlobHeader {
+    fn fmt(&self, f: &mut std::fmt::Formatter) -> std::fmt::Result {
+        write!(f, "EventBlobHeader {{ metadata_id: {}, stack: {}, payload_size: {}, seqno: {:?}, thread_id: {} ({}), proc: {:?}, timestamp: {} }}",
+            self.metadata_id, self.stack_id, self.payload_size,
+            if self.sequence_number == u32::MAX { None } else { Some(self.sequence_number) },
+            self.thread_id, self.capture_thread_id,
+            if self.processor_number == u32::MAX { None } else { Some(self.processor_number) },
+            self.timestamp)
+    }
+}
+
+#[derive(BinRead, Debug, PartialEq, Default)]
+#[br(little, repr=u32)]
+pub enum MetadataTypeCode {
+    #[default]
+    Empty = 0,
+    Object = 1,
+    DBNull = 2,
+    Boolean = 3,
+    Char = 4,
+    SByte = 5,
+    Byte = 6,
+    Int16 = 7,
+    UInt16 = 8,
+    Int32 = 9,
+    UInt32 = 10,
+    Int64 = 11,
+    UInt64 = 12,
+    Single = 13,
+    Double = 14,
+    Decimal = 15,
+    DateTime = 16,
+    String = 18,
+    Array = 19,
+}
+
+#[derive(BinRead, Debug)]
+#[br(little)]
+pub struct MetadataFieldDefinition {
+    type_code: MetadataTypeCode,
+
+    #[br(if(type_code == MetadataTypeCode::Array))]
+    array_type_code: MetadataTypeCode,
+
+    #[br(if(type_code == MetadataTypeCode::Object || array_type_code == MetadataTypeCode::Object))]
+    definition: Option<MetadataPayloadDefinition>,
+
+    field_name: NullWideString,
+}
+
+#[derive(BinRead, Debug, Default)]
+#[br(little)]
+pub struct MetadataPayloadDefinition {
+    field_count: u32,
+    #[br(count = field_count)]
+    fields: Vec<MetadataFieldDefinition>,
+}
+
+#[derive(BinRead, Debug)]
+#[br(little)]
+pub struct MetadataDefinition {
+    id: u32,
+    provider_name: NullWideString,
+    event_id: u32,
+    event_name: NullWideString,
+    keywords: u64,
+    version: u32,
+    level: u32,
+
+    // either v1, or replaced with v2 data from tag
+    fields: MetadataPayloadDefinition,
+
+    // filled in based on opcode from tag
+    #[br(ignore)]
+    opcode: Option<u8>,
+    // following this, there may be additional tag fields -- based on the size specified
+    // in the header. We can't access that in binrw, so it'll have to get handled
+    // manually
+}
+
+#[derive(BinRead, Debug, PartialEq, Default)]
+#[br(little, repr=u8)]
+pub enum MetadataTag {
+    #[default]
+    Invalid = 0,
+    OpCode = 1,
+    V2Params = 2,
+}
+
+#[derive(BinRead, Debug)]
+#[br(little)]
+pub struct MetadataTaggedData {
+    size: u32, // this actually seems to be junk?
+
+    tag: MetadataTag,
+
+    #[br(if(tag == MetadataTag::OpCode))]
+    opcode: u8,
+
+    #[br(if(tag == MetadataTag::V2Params))]
+    fields_v2: MetadataPayloadDefinition,
+}
+
+#[derive(BinRead, Debug)]
+#[br(little)]
+pub struct StackStack {
+    size: u32,
+
+    // TODO -- support 32-bit here
+    #[br(count = size / 8)]
+    stack: Vec<u64>,
+}
+
+#[derive(BinRead, Debug)]
+#[br(little)]
+pub struct StackBlock {
+    #[br(align_after = 4)]
+    size: u32,
+
+    first_id: u32,
+    count: u32,
+
+    #[br(count = count)]
+    stacks: Vec<StackStack>,
+}
+
+#[derive(BinRead, Debug)]
+#[br(little)]
+pub struct ThreadSequenceNumber {
+    thread_id: u64,
+    sequence_number: u32,
+}
+
+#[derive(BinRead, Debug)]
+#[br(little)]
+pub struct SequencePointBlock {
+    #[br(align_after = 4)]
+    size: u32,
+
+    timestamp: u64,
+    thread_count: u32,
+
+    #[br(count = thread_count)]
+    thread_sequence_numbers: Vec<ThreadSequenceNumber>,
+}
+
+#[derive(Debug)]
+pub struct NettraceEvent {
+    pub provider_name: String,
+    pub event_id: u32,
+    pub event_name: Option<String>,
+    pub event_keywords: u64,
+    pub event_version: u32,
+    pub event_level: u32,
+    pub event_opcode: Option<u8>,
+
+    pub sequence_number: u32,
+    pub thread_id: u64,
+    pub capture_thread_id: u64,
+    pub processor_number: Option<u32>,
+    pub stack: Vec<u64>,
+    pub timestamp: u64,
+    pub activity_id: [u8; 16],
+    pub related_activity_id: [u8; 16],
+
+    pub payload: Vec<u8>,
+}
+
+pub trait ReaderTrait: Read + Seek + BinReaderExt {}
+
+pub enum DecodedEvent {
+    CoreClrEvent((EventMetadata, coreclr::CoreClrEvent)),
+    UnknownEvent,
+}
+
+pub fn decode_event(event: &NettraceEvent) -> DecodedEvent {
+    match event.provider_name.as_str() {
+        "Microsoft-Windows-DotNETRuntime" | "Microsoft-Windows-DotNETRuntimeRundown" => {
+            coreclr::eventpipe::decode_coreclr_event(event)
+                .map(DecodedEvent::CoreClrEvent)
+                .unwrap_or_else(|| DecodedEvent::UnknownEvent)
+        }
+        _ => DecodedEvent::UnknownEvent,
+    }
+}
\ No newline at end of file
diff --git a/coreclr-tracing/src/nettrace/parser.rs b/coreclr-tracing/src/nettrace/parser.rs
new file mode 100644
index 00000000..5f6afdcc
--- /dev/null
+++ b/coreclr-tracing/src/nettrace/parser.rs
@@ -0,0 +1,404 @@
+use binrw::io::TakeSeekExt;
+use binrw::{binrw, BinRead, BinReaderExt, BinResult, NullWideString};
+use std::collections::HashMap;
+use std::fmt::Display;
+use std::fs::File;
+use std::io::{BufRead, Cursor, Read, Seek, SeekFrom};
+use std::mem;
+
+use super::*;
+use super::helpers::*;
+use crate::*;
+
+trait ReadExactlyExt {
+    fn read_exactly(&mut self, len: u64) -> Vec<u8>;
+}
+
+impl<T: Read + Seek> ReadExactlyExt for T {
+    fn read_exactly(&mut self, len: u64) -> Vec<u8> {
+        let mut buf = vec![0; len as usize];
+        self.read_exact(&mut buf)
+            .expect("Failed to read exact bytes");
+        buf
+    }
+}
+
+pub type EventPipeError = binrw::Error;
+
+struct EventBlobIter {
+    data: Cursor<Vec<u8>>,
+    header: NettraceEventBlockHeader,
+    compressed_headers: bool,
+    blob_size: u64,
+    prev_header: EventBlobHeader,
+}
+
+impl EventBlobIter {
+    pub fn new(block: NettraceEventBlock, mut data: Vec<u8>) -> Result<Self, EventPipeError> {
+        //eprintln!("EventBlobIter::new: {:?}", block);
+        let compressed_headers = (block.header.flags & 1) != 0;
+        let blob_size = (block.size - block.header.size as u32) as u64;
+        Ok(EventBlobIter {
+            data: Cursor::new(data),
+            header: block.header,
+            compressed_headers,
+            blob_size,
+            prev_header: Default::default(),
+        })
+    }
+
+    fn parse_compressed_header<R: BinReaderExt + Read + Seek>(
+        reader: &mut R,
+        prev_header: &mut EventBlobHeader,
+    ) -> BinResult<EventBlobHeader> {
+        //eprintln!("\nPREV {:?}", prev_header);
+        let flags: u8 = reader.read_le()?;
+        fn is_set(flags: u8, bit: u8) -> bool {
+            (flags & (1 << bit)) != 0
+        }
+
+        //eprintln!("flags: 0b{:b}", flags);
+
+        let mut header = EventBlobHeader::default();
+        header.metadata_id = if is_set(flags, 0) {
+            parse_varint_u32(reader)?
+        } else {
+            prev_header.metadata_id
+        };
+        if is_set(flags, 1) {
+            header.sequence_number = prev_header
+                .sequence_number
+                .wrapping_add_signed(parse_varint_i32(reader)?);
+            header.capture_thread_id = parse_varint_u64(reader)?;
+            header.processor_number = parse_varint_u32(reader)?;
+        } else {
+            header.sequence_number = prev_header.sequence_number;
+            header.capture_thread_id = prev_header.capture_thread_id;
+            header.processor_number = prev_header.processor_number;
+        }
+
+        if header.metadata_id != 0 {
+            header.sequence_number = header.sequence_number.wrapping_add(1);
+        }
+
+        header.thread_id = if is_set(flags, 2) {
+            parse_varint_u64(reader)?
+        } else {
+            prev_header.thread_id
+        };
+        header.stack_id = if is_set(flags, 3) {
+            parse_varint_u32(reader)?
+        } else {
+            prev_header.stack_id
+        };
+        header.timestamp = prev_header
+            .timestamp
+            .wrapping_add_signed(parse_varint_i64(reader)?);
+        header.activity_id = if is_set(flags, 4) {
+            reader.read_le()?
+        } else {
+            prev_header.activity_id
+        };
+        header.related_activity_id = if is_set(flags, 5) {
+            reader.read_le()?
+        } else {
+            prev_header.related_activity_id
+        };
+        header.is_sorted = is_set(flags, 6);
+        header.payload_size = if is_set(flags, 7) {
+            parse_varint_u32(reader)?
+        } else {
+            prev_header.payload_size
+        };
+
+        header.raw_metadata_id = if header.is_sorted { (1 << 31) } else { 0 } | header.metadata_id; // set is_sorted bit
+
+        //eprintln!("{} [flags 0b{:b}]", header, flags);
+
+        *prev_header = header.clone();
+
+        Ok(header)
+    }
+
+    fn parse_header<R: BinReaderExt + Read + Seek>(
+        reader: &mut R,
+        prev_header: &mut EventBlobHeader,
+        is_compressed: bool,
+    ) -> BinResult<EventBlobHeader> {
+        if is_compressed {
+            Self::parse_compressed_header(reader, prev_header)
+        } else {
+            eprintln!("parsing uncompressed header");
+            reader.read_le()
+        }
+    }
+}
+
+// Assuming block is a
+impl Iterator for EventBlobIter {
+    type Item = (EventBlobHeader, Vec<u8>);
+
+    fn next(&mut self) -> Option<Self::Item> {
+        if self.data.position() >= self.blob_size {
+            return None;
+        }
+
+        let header = EventBlobIter::parse_header(
+            &mut self.data,
+            &mut self.prev_header,
+            self.compressed_headers,
+        )
+        .expect("Failed to read EventBlobHeader");
+        let payload = self.data.read_exactly(header.payload_size as u64);
+
+        if !self.compressed_headers && header.payload_size & 3 != 0 {
+            let alignment_skip = 4 - (header.payload_size & 3);
+            self.data
+                .seek(SeekFrom::Current(alignment_skip as i64))
+                .expect("Seek failed");
+        }
+
+        Some((header, payload))
+    }
+}
+
+pub struct EventPipeParser<R> {
+    stream: R,
+    metadata_map: HashMap<u32, MetadataDefinition>,
+    stack_map: HashMap<u32, Vec<u64>>,
+    trace_info: Option<NettraceTraceObject>,
+    cur_event_blob_iter: Option<EventBlobIter>,
+}
+
+impl<R> EventPipeParser<R>
+where
+    R: Read + Seek,
+{
+    pub fn new(mut stream: R) -> Result<Self, EventPipeError> {
+        let file_header = NettraceHeader::read(&mut stream)?;
+        if file_header.ident.bytes != b"!FastSerialization.1" {
+            return Err(EventPipeError::BadMagic {
+                found: Box::new(file_header.ident.bytes),
+                pos: stream.stream_position().unwrap(),
+            });
+        }
+
+        Ok(EventPipeParser {
+            stream,
+            metadata_map: HashMap::new(),
+            stack_map: HashMap::new(),
+            trace_info: None,
+            cur_event_blob_iter: None,
+        })
+    }
+
+    fn make_err(&mut self, message: &str) -> EventPipeError {
+        EventPipeError::AssertFail {
+            pos: self.stream.stream_position().unwrap(),
+            message: message.to_string(),
+        }
+    }
+
+    // Return the NettraceTraceObject for this stream, parsing until it's available if necessary.
+    // It will be the first thing in the stream, so we won't miss it
+    pub fn trace_info(&mut self) -> Result<NettraceTraceObject, EventPipeError> {
+        if let Some(trace_info) = self.trace_info {
+            return Ok(trace_info);
+        }
+
+        // If we don't have it, we're going to assume that it's going to be the first object
+        let Some(type_object) = self.advance_to_next_object()? else {
+            return Err(self.make_err("Expected NettraceTraceObject"));
+        };
+
+        if type_object.type_name.as_str() != "TraceObject" {
+            return Err(self.make_err("Expected TraceObject"));
+        }
+
+        let trace_info = NettraceTraceObject::read(&mut self.stream)?;
+        self.trace_info = Some(trace_info);
+
+        self.read_object_end()?;
+
+        Ok(trace_info)
+    }
+
+    fn read_object_end(&mut self) -> Result<(), EventPipeError> {
+        let end_tag = NettraceTag::read(&mut self.stream)?;
+        if end_tag != NettraceTag::EndObject {
+            return Err(self.make_err("Expected EndObject tag"));
+        }
+
+        Ok(())
+    }
+
+    fn advance_to_next_object(&mut self) -> Result<Option<NettraceTypeObject>, EventPipeError> {
+        let start_tag = NettraceTag::read(&mut self.stream)?;
+        if start_tag == NettraceTag::NullReference {
+            // stream done
+            return Ok(None);
+        }
+
+        if start_tag != NettraceTag::BeginPrivateObject {
+            return Err(self.make_err("Expected BeginPrivateObject tag"));
+        }
+
+        // so much effort spent in NettraceTypeObject, when it's just one of 4 things
+        let obj_type = NettraceTypeObject::read(&mut self.stream)?;
+        Ok(Some(obj_type))
+    }
+
+    fn parse_event(
+        &mut self,
+        header: EventBlobHeader,
+        payload: Vec<u8>,
+    ) -> Result<Option<NettraceEvent>, EventPipeError> {
+        let metadata_id = header.metadata_id;
+        let metadata_def =
+            self.metadata_map
+                .get(&metadata_id)
+                .ok_or_else(|| EventPipeError::AssertFail {
+                    pos: 0,
+                    message: format!("Metadata definition {} not found", metadata_id),
+                })?;
+
+        let mut event = NettraceEvent {
+            provider_name: metadata_def.provider_name.to_string(),
+            event_id: metadata_def.event_id,
+            event_name: if metadata_def.event_name.len() > 0 {
+                Some(metadata_def.event_name.to_string())
+            } else {
+                None
+            },
+            event_keywords: metadata_def.keywords,
+            event_version: metadata_def.version,
+            event_level: metadata_def.level,
+            event_opcode: metadata_def.opcode,
+
+            sequence_number: header.sequence_number,
+            thread_id: header.thread_id,
+            capture_thread_id: header.capture_thread_id,
+            processor_number: if header.processor_number != u32::MAX {
+                Some(header.processor_number)
+            } else {
+                None
+            },
+            stack: self
+                .stack_map
+                .get(&header.stack_id)
+                .cloned()
+                .unwrap_or_default(),
+            timestamp: header.timestamp,
+            activity_id: header.activity_id,
+            related_activity_id: header.related_activity_id,
+
+            payload: payload,
+        };
+
+        Ok(Some(event))
+    }
+
+    pub fn next_event(&mut self) -> Result<Option<NettraceEvent>, EventPipeError> {
+        // If we're inside an event block already, keep iterating through it
+        if let Some(cur_event_iter) = self.cur_event_blob_iter.as_mut() {
+            if let Some((header, payload)) = cur_event_iter.next() {
+                return self.parse_event(header, payload);
+            }
+
+            self.cur_event_blob_iter = None;
+
+            // we don't read this when we read the event blob; we could, but we don't
+            self.read_object_end()?;
+        }
+
+        loop {
+            // Keep reading from the data until we get to an EventBlock, in which case we'll
+            // jump back out into the above iterator.
+            //
+            // Anything that's not an EventBlock, we need to parse into internal data structures so we can
+            // expose proper events from the EventBlock.
+
+            let obj_type = self.advance_to_next_object()?;
+            let Some(obj_type) = obj_type else {
+                return Ok(None);
+            };
+
+            let obj_type_name = obj_type.type_name.as_str();
+
+            match obj_type_name {
+                "Trace" => {
+                    let trace_object = NettraceTraceObject::read(&mut self.stream)?;
+                    log::trace!("Trace: {:?}", trace_object);
+                    self.trace_info = Some(trace_object.clone());
+                }
+                "MetadataBlock" => {
+                    //eprintln!("MetadataBlock");
+                    let metadata_block = NettraceEventBlock::read(&mut self.stream)?;
+                    let metadata_block_data = self.stream.read_exactly(
+                        metadata_block.size as u64 - metadata_block.header.size as u64,
+                    );
+                    self.handle_metadata_block(EventBlobIter::new(
+                        metadata_block,
+                        metadata_block_data,
+                    )?)?;
+                }
+                "StackBlock" => {
+                    //eprintln!("StackBlock");
+                    let stack_block = StackBlock::read(&mut self.stream)?;
+                    let mut stack_id = stack_block.first_id;
+                    for stack in stack_block.stacks {
+                        self.stack_map.insert(stack_id, stack.stack);
+                        stack_id += 1;
+                    }
+                }
+                "SPBlock" => {
+                    //eprintln!("SPBlock");
+                    let sp_block = SequencePointBlock::read(&mut self.stream)?;
+                }
+                "EventBlock" => {
+                    //eprintln!("EventBlock");
+                    let event_block = NettraceEventBlock::read(&mut self.stream)?;
+                    let event_block_data = self
+                        .stream
+                        .read_exactly(event_block.size as u64 - event_block.header.size as u64);
+                    self.cur_event_blob_iter =
+                        Some(EventBlobIter::new(event_block, event_block_data)?);
+
+                    // jump into the iterator at the start of this
+                    return self.next_event();
+                }
+                unknown => {
+                    eprintln!("Unknown object type: {}", unknown);
+                    return Err(self.make_err("Unknown object type"));
+                }
+            }
+
+            self.read_object_end()?;
+        }
+    }
+
+    fn handle_metadata_block(&mut self, mut iter: EventBlobIter) -> Result<(), EventPipeError> {
+        while let Some((header, mut data)) = iter.next() {
+            let mut payload = Cursor::new(&data);
+            let payload_size = header.payload_size as u64;
+            let mut metadata_def = MetadataDefinition::read(&mut payload)?;
+
+            while payload.position() < payload_size {
+                let tag_data = MetadataTaggedData::read(&mut payload)?;
+                if tag_data.tag == MetadataTag::OpCode {
+                    metadata_def.opcode = Some(tag_data.opcode);
+                } else if tag_data.tag == MetadataTag::V2Params {
+                    assert_eq!(
+                        metadata_def.fields.field_count, 0,
+                        "Found v2 fields, but v1 fields were not empty"
+                    );
+                    metadata_def.fields = tag_data.fields_v2;
+                }
+            }
+
+            self.metadata_map.insert(metadata_def.id, metadata_def);
+        }
+
+        Ok(())
+    }
+}
diff --git a/fxprof-processed-profile/src/timestamp.rs b/fxprof-processed-profile/src/timestamp.rs
index a1705cd5..19b9f512 100644
--- a/fxprof-processed-profile/src/timestamp.rs
+++ b/fxprof-processed-profile/src/timestamp.rs
@@ -18,6 +18,10 @@ impl Timestamp {
             nanos: (millis * 1_000_000.0) as u64,
         }
     }
+
+    pub fn as_nanos_since_reference(&self) -> u64 {
+        self.nanos
+    }
 }
 
 impl Serialize for Timestamp {
diff --git a/samply-api/src/lib.rs b/samply-api/src/lib.rs
index 13936f11..b00588b1 100644
--- a/samply-api/src/lib.rs
+++ b/samply-api/src/lib.rs
@@ -204,6 +204,12 @@ impl<'a, H: FileAndPathHelper> Api<'a, H> {
         } else if request_url == "/asm/v1" {
             let asm_api = AsmApi::new(self.symbol_manager);
             asm_api.query_api_json(request_json_data).await
+        } else if request_url == "/auto-upload-reply/v1" {
+            use std::io::Write;
+
+            println!("SAMPLY_AUTO_UPLOAD_REPLY: {}", request_json_data);
+            let _ = std::io::stdout().flush();
+            std::process::exit(0);
         } else {
             json!({ "error": format!("Unrecognized URL {request_url}") }).to_string()
         }
diff --git a/samply-mac-preload/binaries/libsamply_mac_preload.dylib b/samply-mac-preload/binaries/libsamply_mac_preload.dylib
index 7a881520..3b8b0553 100755
Binary files a/samply-mac-preload/binaries/libsamply_mac_preload.dylib and b/samply-mac-preload/binaries/libsamply_mac_preload.dylib differ
diff --git a/samply-mac-preload/binaries/libsamply_mac_preload_arm64.dylib b/samply-mac-preload/binaries/libsamply_mac_preload_arm64.dylib
index 75e1f326..cbd22175 100755
Binary files a/samply-mac-preload/binaries/libsamply_mac_preload_arm64.dylib and b/samply-mac-preload/binaries/libsamply_mac_preload_arm64.dylib differ
diff --git a/samply-mac-preload/src/lib.rs b/samply-mac-preload/src/lib.rs
index 894dbe9f..9a2e50a6 100644
--- a/samply-mac-preload/src/lib.rs
+++ b/samply-mac-preload/src/lib.rs
@@ -80,6 +80,7 @@ extern "C" fn samply_hooked_open(path: *const c_char, flags: c_int, mode: mode_t
     if let Ok(path) = unsafe { CStr::from_ptr(path) }.to_str() {
         detect_and_send_jitdump_path(path);
         detect_and_send_marker_file_path(path);
+        detect_and_send_nettrace_file_path(path);
     }
 
     // Call the original. Do this at the end, so that this is compiled as a tail call.
@@ -103,6 +104,7 @@ extern "C" fn samply_hooked_fopen(path: *const c_char, mode: *const c_char) -> *
     if let Ok(path) = unsafe { CStr::from_ptr(path) }.to_str() {
         detect_and_send_jitdump_path(path);
         detect_and_send_marker_file_path(path);
+        detect_and_send_nettrace_file_path(path);
     }
 
     // Call the original.
@@ -153,6 +155,24 @@ fn detect_and_send_marker_file_path(path: &str) {
     let _ = sender.send(&message_bytes, []);
 }
 
+fn detect_and_send_nettrace_file_path(path: &str) {
+    if path.len() > 256 - 12 || !path.ends_with(".nettrace") || !filename_starts_with(path, "samply-dotnet-") {
+        return;
+    }
+
+    let channel_sender = CHANNEL_SENDER.lock();
+    let Some(sender) = channel_sender.as_ref() else {
+        return;
+    };
+    let pid = unsafe { libc::getpid() };
+    let mut message_bytes = [0; 256];
+    message_bytes[0..7].copy_from_slice(b"NetTrac");
+    message_bytes[7..11].copy_from_slice(&pid.to_le_bytes());
+    message_bytes[11] = path.len() as u8;
+    message_bytes[12..][..path.len()].copy_from_slice(path.as_bytes());
+    let _ = sender.send(&message_bytes, []);
+}
+
 #[allow(non_camel_case_types)]
 pub struct InterposeEntry {
     _new: *const (),
diff --git a/samply/Cargo.toml b/samply/Cargo.toml
index c9905ad1..b757ac7e 100644
--- a/samply/Cargo.toml
+++ b/samply/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "usamply"
-version = "0.12.9"
+version = "0.12.10-prerelease.5"
 authors = ["Markus Stange <mstange@themasta.com>", "Vladimir Vukicevic <vladimir@pobox.com>"]
 edition = "2021"
 rust-version = "1.75" # needed by wholesym -> fs4
@@ -52,6 +52,7 @@ cfg-if = "1.0.0"
 fs4 = "0.8.3"
 humantime = "2.1.0"
 shlex = "1.3.0"
+coreclr-tracing = { version = "0.1", path = "../coreclr-tracing" }
 
 [target.'cfg(any(target_os = "android", target_os = "macos", target_os = "linux"))'.dependencies]
 
diff --git a/samply/resources/libsamply_mac_preload.dylib.gz b/samply/resources/libsamply_mac_preload.dylib.gz
index 0032c3f1..fbc0cd5b 100644
Binary files a/samply/resources/libsamply_mac_preload.dylib.gz and b/samply/resources/libsamply_mac_preload.dylib.gz differ
diff --git a/samply/src/mac/codesign_setup.rs b/samply/src/mac/codesign_setup.rs
index 418116d5..6af3b09b 100644
--- a/samply/src/mac/codesign_setup.rs
+++ b/samply/src/mac/codesign_setup.rs
@@ -10,9 +10,10 @@ const ENTITLEMENTS_XML: &str = r#"<?xml version="1.0" encoding="UTF-8"?>
 </plist>
 "#;
 
-pub fn codesign_setup() {
-    print!(
-        r#"
+pub fn codesign_setup(skip_prompt: bool) {
+    if !skip_prompt {
+        print!(
+            r#"
 On macOS, attaching to an existing process is only allowed to binaries with
 the com.apple.security.cs.debugger entitlement. The samply binary will be
 signed with this entitlement for your local machine only. The following command
@@ -27,14 +28,15 @@ entitlements.xml contains:
 
 Press any key to continue, or Ctrl-C to cancel.
 "#,
-        env::current_exe().unwrap().display(),
-        ENTITLEMENTS_XML
-    );
+            env::current_exe().unwrap().display(),
+            ENTITLEMENTS_XML
+        );
 
-    let mut input = String::new();
-    std::io::stdin()
-        .read_line(&mut input)
-        .expect("Failed to read input?");
+        let mut input = String::new();
+        std::io::stdin()
+            .read_line(&mut input)
+            .expect("Failed to read input?");
+    }
 
     let mut entitlements_file = tempfile::Builder::new()
         .prefix("samply_entitlements")
diff --git a/samply/src/mac/process_launcher.rs b/samply/src/mac/process_launcher.rs
index 0a65bb9a..234690de 100644
--- a/samply/src/mac/process_launcher.rs
+++ b/samply/src/mac/process_launcher.rs
@@ -19,7 +19,7 @@ pub use super::mach_ipc::{mach_port_t, MachError, OsIpcSender};
 use super::mach_ipc::{mach_task_self, BlockingMode, OsIpcMultiShotServer, MACH_PORT_NULL};
 
 pub trait RootTaskRunner {
-    fn run_root_task(&self) -> Result<ExitStatus, MachError>;
+    fn run_root_task(&mut self) -> Result<ExitStatus, MachError>;
 }
 
 pub struct TaskLauncher {
@@ -30,7 +30,7 @@ pub struct TaskLauncher {
 }
 
 impl RootTaskRunner for TaskLauncher {
-    fn run_root_task(&self) -> Result<ExitStatus, MachError> {
+    fn run_root_task(&mut self) -> Result<ExitStatus, MachError> {
         // Ignore Ctrl+C while the subcommand is running. The signal still reaches the process
         // under observation while we continue to record it. (ctrl+c will send the SIGINT signal
         // to all processes in the foreground process group).
@@ -217,6 +217,14 @@ impl TaskAccepter {
                 let path = &marker_file_info[5..][..len];
                 ReceivedStuff::MarkerFilePath(pid, OsStr::from_bytes(path).into())
             }
+            (b"NetTrac", dotnet_trace_file_info) => {
+                let pid_bytes = &dotnet_trace_file_info[0..4];
+                let pid =
+                    u32::from_le_bytes([pid_bytes[0], pid_bytes[1], pid_bytes[2], pid_bytes[3]]);
+                let len = dotnet_trace_file_info[4] as usize;
+                let path = &dotnet_trace_file_info[5..][..len];
+                ReceivedStuff::DotnetTracePath(pid, OsStr::from_bytes(path).into())
+            }
             (other, _) => {
                 panic!("Unexpected message: {:?}", other);
             }
@@ -229,6 +237,7 @@ pub enum ReceivedStuff {
     AcceptedTask(AcceptedTask),
     JitdumpPath(u32, PathBuf),
     MarkerFilePath(u32, PathBuf),
+    DotnetTracePath(u32, PathBuf),
 }
 
 pub struct AcceptedTask {
@@ -257,10 +266,11 @@ impl AcceptedTask {
 
 pub struct ExistingProcessRunner {
     pid: u32,
+    aux_child: Option<Child>,
 }
 
 impl RootTaskRunner for ExistingProcessRunner {
-    fn run_root_task(&self) -> Result<ExitStatus, MachError> {
+    fn run_root_task(&mut self) -> Result<ExitStatus, MachError> {
         let ctrl_c_receiver = CtrlC::observe_oneshot();
 
         eprintln!("Profiling {}, press Ctrl-C to stop...", self.pid);
@@ -269,6 +279,14 @@ impl RootTaskRunner for ExistingProcessRunner {
             .blocking_recv()
             .expect("Ctrl+C receiver failed");
 
+        if let Some(aux_child) = self.aux_child.as_mut() {
+            let aux_pid = aux_child.id();
+            unsafe {
+                libc::kill(aux_pid as i32, libc::SIGINT);
+            }
+            aux_child.wait().expect("Failed to wait on aux child process");
+        }
+
         eprintln!("Done.");
 
         Ok(ExitStatus::default())
@@ -309,6 +327,15 @@ impl ExistingProcessRunner {
 
         // TODO: find all its children
 
-        ExistingProcessRunner { pid }
+        ExistingProcessRunner { pid, aux_child: None }
+    }
+
+    pub fn new_with_aux_child(pid: u32, task_accepter: &mut TaskAccepter, aux_child: Child) -> ExistingProcessRunner {
+        let runner = Self::new(pid, task_accepter);
+
+        ExistingProcessRunner {
+            aux_child: Some(aux_child),
+            ..runner
+        }
     }
 }
diff --git a/samply/src/mac/profiler.rs b/samply/src/mac/profiler.rs
index d6406128..99d651ea 100644
--- a/samply/src/mac/profiler.rs
+++ b/samply/src/mac/profiler.rs
@@ -1,7 +1,8 @@
 use std::collections::hash_map::Entry;
 use std::collections::HashMap;
 use std::fs::File;
-use std::process::ExitStatus;
+use std::path::PathBuf;
+use std::process::{ExitStatus, Stdio};
 use std::thread;
 use std::time::Duration;
 
@@ -11,9 +12,10 @@ use super::error::SamplingError;
 use super::process_launcher::{
     ExistingProcessRunner, MachError, ReceivedStuff, RootTaskRunner, TaskAccepter, TaskLauncher,
 };
-use super::sampler::{JitdumpOrMarkerPath, Sampler, TaskInit, TaskInitOrShutdown};
+use super::sampler::{ProcessSpecificPath, Sampler, TaskInit, TaskInitOrShutdown};
 use super::time::get_monotonic_timestamp;
 use crate::server::{start_server_main, ServerProps};
+use crate::shared::coreclr::CoreClrProviderProps;
 use crate::shared::recording_props::{
     ProcessLaunchProps, ProfileCreationProps, RecordingMode, RecordingProps,
 };
@@ -23,21 +25,51 @@ use crate::shared::symbol_props::SymbolProps;
 pub fn start_recording(
     recording_mode: RecordingMode,
     recording_props: RecordingProps,
-    mut profile_creation_props: ProfileCreationProps,
+    profile_creation_props: ProfileCreationProps,
     symbol_props: SymbolProps,
     server_props: Option<ServerProps>,
 ) -> Result<ExitStatus, MachError> {
     let output_file = recording_props.output_file.clone();
 
     let mut task_accepter = TaskAccepter::new()?;
+    let mut should_look_for_nettrace = 0;
 
-    let root_task_runner: Box<dyn RootTaskRunner> = match recording_mode {
+    let nettrace_path = format!("samply-coreclr-{}.dottrace", uuid::Uuid::new_v4());
+
+    let mut root_task_runner: Box<dyn RootTaskRunner> = match recording_mode {
         RecordingMode::All => {
             eprintln!("Error: Profiling all processes is not supported on macOS.");
             eprintln!("You can only profile processes which you launch via samply, or attach to via --pid.");
             std::process::exit(1)
         }
-        RecordingMode::Pid(pid) => Box::new(ExistingProcessRunner::new(pid, &mut task_accepter)),
+        RecordingMode::Pid(pid) => {
+            if profile_creation_props.coreclr.any_enabled() {
+                let coreclr_props = CoreClrProviderProps {
+                    is_attach: true,
+                    ..profile_creation_props.coreclr.to_provider_props()
+                };
+
+                let provider_args = crate::shared::coreclr::coreclr_provider_args(coreclr_props);
+
+                let child = std::process::Command::new("dotnet-trace")
+                    .arg("collect")
+                    .arg("-p")
+                    .arg(pid.to_string())
+                    .arg("-o")
+                    .arg(nettrace_path.clone())
+                    .arg("--providers")
+                    .arg(&provider_args.join(","))
+                    .stdout(Stdio::null())
+                    .spawn()
+                    .expect("Failed to spawn dotnet-trace");
+
+                task_accepter.queue_received_stuff(ReceivedStuff::DotnetTracePath(pid, PathBuf::from(nettrace_path.clone())));
+
+                Box::new(ExistingProcessRunner::new_with_aux_child(pid, &mut task_accepter, child))
+            } else {
+                Box::new(ExistingProcessRunner::new(pid, &mut task_accepter))
+            }
+        }
         RecordingMode::Launch(process_launch_props) => {
             let ProcessLaunchProps {
                 mut env_vars,
@@ -46,24 +78,76 @@ pub fn start_recording(
                 iteration_count,
             } = process_launch_props;
 
-            if profile_creation_props.coreclr.any_enabled() {
+            let task_launcher = if profile_creation_props.coreclr.any_enabled() {
                 // We need to set DOTNET_PerfMapEnabled=3 in the environment if it's not already set.
                 // If we set it, we'll also set unlink_aux_files=true to avoid leaving files
                 // behind in the temp directory. But if it's set manually, assume the user
                 // knows what they're doing and will specify the arg as needed.
-                if !env_vars.iter().any(|p| p.0 == "DOTNET_PerfMapEnabled") {
-                    env_vars.push(("DOTNET_PerfMapEnabled".into(), "3".into()));
-                    profile_creation_props.unlink_aux_files = true;
-                }
-            }
+                //if !env_vars.iter().any(|p| p.0 == "DOTNET_PerfMapEnabled") {
+                //    env_vars.push(("DOTNET_PerfMapEnabled".into(), "3".into()));
+                //    profile_creation_props.unlink_aux_files = true;
+                //}
 
-            let task_launcher = TaskLauncher::new(
-                &command_name,
-                &args,
-                iteration_count,
-                &env_vars,
-                task_accepter.extra_env_vars(),
-            )?;
+                let coreclr_props = CoreClrProviderProps {
+                    is_attach: false,
+                    ..profile_creation_props.coreclr.to_provider_props()
+                };
+                let provider_args = crate::shared::coreclr::coreclr_provider_args(coreclr_props);
+
+                if true {
+                    let mut add_env_var = |key: &str, value: &str| {
+                        eprintln!("{key}={value}");
+                        env_vars.push((key.into(), value.into()));
+                    };
+
+                    add_env_var("DOTNET_EnableEventPipe", "1");
+                    add_env_var(
+                        "DOTNET_EventPipeOutputPath",
+                        "/tmp/samply-dotnet-{pid}.nettrace",
+                    );
+                    //add_env_var("DOTNET_EventPipeConfig", &provider_args.join(","));
+                    add_env_var("DOTNET_EventPipeConfig", &provider_args[0]);
+                    if profile_creation_props.coreclr.event_stacks {
+                        add_env_var("DOTNET_EventPipeEnableStackwalk", "1");
+                    }
+
+                    TaskLauncher::new(
+                        &command_name,
+                        &args,
+                        iteration_count,
+                        &env_vars,
+                        task_accepter.extra_env_vars(),
+                    )?
+                } else {
+                    let mut trace_args: Vec<std::ffi::OsString> = Vec::new();
+
+                    trace_args.push("trace".into());
+                    trace_args.push("collect".into());
+                    trace_args.push("-o".into());
+                    trace_args.push(nettrace_path.clone().into());
+                    trace_args.push("--providers".into());
+                    trace_args.push(provider_args.join(",").into());
+                    trace_args.push("--".into());
+                    trace_args.push(command_name);
+                    trace_args.extend(args);
+
+                    TaskLauncher::new(
+                        &"dotnet".into(),
+                        &trace_args,
+                        iteration_count,
+                        &env_vars,
+                        task_accepter.extra_env_vars(),
+                    )?
+                }
+            } else {
+                TaskLauncher::new(
+                    &command_name,
+                    &args,
+                    iteration_count,
+                    &env_vars,
+                    task_accepter.extra_env_vars(),
+                )?
+            };
 
             Box::new(task_launcher)
         }
@@ -95,6 +179,12 @@ pub fn start_recording(
             let timeout = Duration::from_secs_f64(1.0);
             match task_accepter.next_message(timeout) {
                 Ok(ReceivedStuff::AcceptedTask(accepted_task)) => {
+                    if should_look_for_nettrace == 2 {
+                        should_look_for_nettrace = 1;
+                        accepted_task.start_execution();
+                        continue;
+                    }
+
                     let pid = accepted_task.get_id();
                     let (path_sender, path_receiver) = unbounded();
                     let send_result = task_sender.send(TaskInitOrShutdown::TaskInit(TaskInit {
@@ -103,6 +193,11 @@ pub fn start_recording(
                         pid,
                         path_receiver,
                     }));
+
+                    if path_senders_per_pid.is_empty() && should_look_for_nettrace == 1 {
+                        task_accepter.queue_received_stuff(ReceivedStuff::DotnetTracePath(pid, PathBuf::from(nettrace_path.clone())));
+                    }
+                    eprintln!("New task: {}", pid);
                     path_senders_per_pid.insert(pid, path_sender);
                     if send_result.is_err() {
                         // The sampler has already shut down. This task arrived too late.
@@ -113,7 +208,7 @@ pub fn start_recording(
                     match path_senders_per_pid.entry(pid) {
                         Entry::Occupied(mut entry) => {
                             let send_result =
-                                entry.get_mut().send(JitdumpOrMarkerPath::JitdumpPath(path));
+                                entry.get_mut().send(ProcessSpecificPath::JitdumpPath(path));
                             if send_result.is_err() {
                                 // The task is probably already dead. The path arrived too late.
                                 entry.remove();
@@ -131,7 +226,25 @@ pub fn start_recording(
                         Entry::Occupied(mut entry) => {
                             let send_result = entry
                                 .get_mut()
-                                .send(JitdumpOrMarkerPath::MarkerFilePath(path));
+                                .send(ProcessSpecificPath::MarkerFilePath(path));
+                            if send_result.is_err() {
+                                // The task is probably already dead. The path arrived too late.
+                                entry.remove();
+                            }
+                        }
+                        Entry::Vacant(_entry) => {
+                            eprintln!(
+                                "Received a marker file path for pid {pid} which I don't have a task for."
+                            );
+                        }
+                    }
+                }
+                Ok(ReceivedStuff::DotnetTracePath(pid, path)) => {
+                    match path_senders_per_pid.entry(pid) {
+                        Entry::Occupied(mut entry) => {
+                            let send_result = entry
+                                .get_mut()
+                                .send(ProcessSpecificPath::DotnetTracePath(path));
                             if send_result.is_err() {
                                 // The task is probably already dead. The path arrived too late.
                                 entry.remove();
diff --git a/samply/src/mac/sampler.rs b/samply/src/mac/sampler.rs
index ae42fe6b..cfc83613 100644
--- a/samply/src/mac/sampler.rs
+++ b/samply/src/mac/sampler.rs
@@ -15,9 +15,10 @@ use crate::shared::recycling::ProcessRecycler;
 use crate::shared::timestamp_converter::TimestampConverter;
 use crate::shared::unresolved_samples::UnresolvedStacks;
 
-pub enum JitdumpOrMarkerPath {
+pub enum ProcessSpecificPath {
     JitdumpPath(PathBuf),
     MarkerFilePath(PathBuf),
+    DotnetTracePath(PathBuf),
 }
 
 #[derive(Debug, Clone)]
@@ -31,7 +32,7 @@ pub struct TaskInit {
     pub start_time_mono: u64,
     pub task: mach_port_t,
     pub pid: u32,
-    pub path_receiver: Receiver<JitdumpOrMarkerPath>,
+    pub path_receiver: Receiver<ProcessSpecificPath>,
 }
 
 pub struct Sampler {
diff --git a/samply/src/mac/task_profiler.rs b/samply/src/mac/task_profiler.rs
index 1b19c781..bf4d7036 100644
--- a/samply/src/mac/task_profiler.rs
+++ b/samply/src/mac/task_profiler.rs
@@ -32,8 +32,9 @@ use super::proc_maps::{
     proc_cmdline, DyldInfo, DyldInfoManager, Modification, ModuleSvmaInfo, StackwalkerRef,
     VmSubData,
 };
-use super::sampler::{JitdumpOrMarkerPath, TaskInit};
+use super::sampler::{ProcessSpecificPath, TaskInit};
 use super::thread_profiler::{get_thread_id, get_thread_name, ThreadProfiler};
+use crate::shared::coreclr::EventpipeTraceManager;
 use crate::shared::jit_category_manager::JitCategoryManager;
 use crate::shared::jit_function_recycler::JitFunctionRecycler;
 use crate::shared::jitdump_manager::JitDumpManager;
@@ -108,8 +109,9 @@ pub struct TaskProfiler {
     main_thread_label_frame: FrameInfo,
     ignored_errors: Vec<SamplingError>,
     unwinder: UnwinderNative<UnwindSectionBytes, MayAllocateDuringUnwind>,
-    path_receiver: Receiver<JitdumpOrMarkerPath>,
+    path_receiver: Receiver<ProcessSpecificPath>,
     jitdump_manager: JitDumpManager,
+    dotnet_trace_manager: EventpipeTraceManager,
     marker_file_paths: Vec<(ThreadHandle, PathBuf)>,
     unresolved_samples: UnresolvedSamples,
     lib_mapping_ops: LibMappingOpQueue,
@@ -304,6 +306,7 @@ impl TaskProfiler {
             unwinder: UnwinderNative::new(),
             path_receiver,
             jitdump_manager: JitDumpManager::new(profile_creation_props.unlink_aux_files),
+            dotnet_trace_manager: EventpipeTraceManager::new(profile_creation_props.unlink_aux_files),
             marker_file_paths: Vec::new(),
             lib_mapping_ops: Default::default(),
             unresolved_samples: Default::default(),
@@ -585,9 +588,9 @@ impl TaskProfiler {
     }
 
     pub fn check_received_paths(&mut self) {
-        while let Ok(jitdump_or_marker_file_path) = self.path_receiver.try_recv() {
-            match jitdump_or_marker_file_path {
-                JitdumpOrMarkerPath::JitdumpPath(jitdump_path) => {
+        while let Ok(process_specific_path) = self.path_receiver.try_recv() {
+            match process_specific_path {
+                ProcessSpecificPath::JitdumpPath(jitdump_path) => {
                     // TODO: Detect which thread the jitdump file is opened on, and use that thread's
                     // thread handle so that the JitFunctionAdd markers are put on that thread in the profile.
                     self.jitdump_manager.add_jitdump_path(
@@ -596,7 +599,7 @@ impl TaskProfiler {
                         Vec::new(),
                     );
                 }
-                JitdumpOrMarkerPath::MarkerFilePath(marker_file_path) => {
+                ProcessSpecificPath::MarkerFilePath(marker_file_path) => {
                     // count the number of - characters in marker_file_path
                     let marker_info = marker_file::parse_marker_file_path(&marker_file_path);
                     let thread_handle = if marker_info.tid.is_some() {
@@ -611,6 +614,9 @@ impl TaskProfiler {
                     self.marker_file_paths
                         .push((thread_handle, marker_file_path));
                 }
+                ProcessSpecificPath::DotnetTracePath(dotnet_trace_path) => {
+                    self.dotnet_trace_manager.add_dotnet_trace_path(dotnet_trace_path, self.pid);
+                }
             }
         }
     }
@@ -656,12 +662,21 @@ impl TaskProfiler {
         } else {
             None
         };
-        let jitdump_lib_ops = self.jitdump_manager.finish(
+        let mut jitdump_lib_ops = self.jitdump_manager.finish(
             jit_category_manager,
             profile,
             self.jit_function_recycler.as_mut(),
             &self.timestamp_converter,
         );
+
+        let dotnet_lib_ops = self.dotnet_trace_manager.finish(
+            jit_category_manager,
+            profile,
+            &self.timestamp_converter,
+        );
+
+        jitdump_lib_ops.extend(dotnet_lib_ops);
+
         let mut marker_spans = Vec::new();
         for (thread_handle, marker_file_path) in self.marker_file_paths {
             if let Ok(marker_spans_from_this_file) =
diff --git a/samply/src/main.rs b/samply/src/main.rs
index f285b1e5..64b8ff79 100644
--- a/samply/src/main.rs
+++ b/samply/src/main.rs
@@ -95,7 +95,7 @@ enum Action {
 
     /// Codesign the samply binary on macOS to allow attaching to processes.
     #[cfg(target_os = "macos")]
-    Setup,
+    Setup(SetupArgs),
 }
 
 #[derive(Debug, Args)]
@@ -263,13 +263,9 @@ struct RecordArgs {
 #[derive(ValueEnum, Copy, Clone, Debug, PartialEq, Eq)]
 enum CoreClrArgs {
     Enabled,
-    #[cfg(target_os = "windows")]
     GcMarkers,
-    #[cfg(target_os = "windows")]
     GcSuspendedThreads,
-    #[cfg(target_os = "windows")]
     GcDetailedAllocs,
-    #[cfg(target_os = "windows")]
     EventStacks,
 }
 
@@ -299,6 +295,11 @@ struct ServerArgs {
     /// Print debugging output.
     #[arg(short, long)]
     verbose: bool,
+
+    /// Auto-upload the profile and print the result URL as JSON prefixed
+    /// with SAMPLY_AUTO_UPLOAD_REPLY. The samply process will exit after the upload.
+    #[arg(long)]
+    auto_upload_profile: bool,
 }
 
 /// Arguments describing where to obtain symbol files.
@@ -333,6 +334,13 @@ struct SymbolArgs {
     simpleperf_binary_cache: Option<PathBuf>,
 }
 
+#[derive(Debug, Args, Clone)]
+pub struct SetupArgs {
+    /// Don't wait for confirmation to codesign.
+    #[arg(short = 'y', long)]
+    yes: bool,
+}
+
 #[derive(Debug, Args, Clone)]
 pub struct ProfileCreationArgs {
     /// Set a custom name for the recorded profile.
@@ -491,8 +499,8 @@ fn main() {
         }
 
         #[cfg(target_os = "macos")]
-        Action::Setup => {
-            mac::codesign_setup::codesign_setup();
+        Action::Setup(SetupArgs { yes }) => {
+            mac::codesign_setup::codesign_setup(yes);
         }
     }
 }
@@ -698,6 +706,7 @@ impl ServerArgs {
             port_selection,
             verbose: self.verbose,
             open_in_browser,
+            auto_upload_profile: self.auto_upload_profile,
         }
     }
 }
@@ -721,13 +730,9 @@ fn to_coreclr_profile_props(coreclr_args: &[CoreClrArgs]) -> CoreClrProfileProps
     #[allow(clippy::needless_update)]
     CoreClrProfileProps {
         enabled: coreclr_args.contains(&CoreClrArgs::Enabled),
-        #[cfg(target_os = "windows")]
         gc_markers: coreclr_args.contains(&CoreClrArgs::GcMarkers),
-        #[cfg(target_os = "windows")]
         gc_suspensions: coreclr_args.contains(&CoreClrArgs::GcSuspendedThreads),
-        #[cfg(target_os = "windows")]
         gc_detailed_allocs: coreclr_args.contains(&CoreClrArgs::GcDetailedAllocs),
-        #[cfg(target_os = "windows")]
         event_stacks: coreclr_args.contains(&CoreClrArgs::EventStacks),
         ..Default::default()
     }
diff --git a/samply/src/server.rs b/samply/src/server.rs
index 1114d889..63943a45 100644
--- a/samply/src/server.rs
+++ b/samply/src/server.rs
@@ -33,6 +33,7 @@ pub struct ServerProps {
     pub port_selection: PortSelection,
     pub verbose: bool,
     pub open_in_browser: bool,
+    pub auto_upload_profile: bool,
 }
 
 #[tokio::main]
@@ -136,6 +137,7 @@ async fn start_server(
     let path_prefix = format!("/{token}");
     let server_origin = format!("http://{addr}");
     let symbol_server_url = format!("{server_origin}{path_prefix}");
+    let and_auto_upload_reply_url = if server_props.auto_upload_profile { format!("&autoUploadReplyUrl={symbol_server_url}/auto-upload-reply/v1") } else { "".to_owned() };
     let mut template_values: HashMap<&'static str, String> = HashMap::new();
     template_values.insert("SERVER_URL", server_origin.clone());
     template_values.insert("PATH_PREFIX", path_prefix.clone());
@@ -148,14 +150,14 @@ async fn start_server(
             Some(s) => s.trim_end_matches('/'),
             //None => "https://profiler.firefox.com",
             // At some point a real URL
-            None => "https://profiler-dot-unity-eng-arch-dev.uw.r.appspot.com/",
+            None => "https://profiler.cds.internal.unity3d.com",
         };
 
         let encoded_profile_url = utf8_percent_encode(&profile_url, BAD_CHARS).to_string();
         let encoded_symbol_server_url =
             utf8_percent_encode(&symbol_server_url, BAD_CHARS).to_string();
         let profiler_url = format!(
-            "{profiler_origin}/from-url/{encoded_profile_url}/?symbolServer={encoded_symbol_server_url}"
+            "{profiler_origin}/from-url/{encoded_profile_url}/?symbolServer={encoded_symbol_server_url}{and_auto_upload_reply_url}"
         );
         template_values.insert("PROFILER_URL", profiler_url.clone());
         template_values.insert("PROFILE_URL", profile_url);
diff --git a/samply/src/shared/coreclr/eventpipe_trace_manager.rs b/samply/src/shared/coreclr/eventpipe_trace_manager.rs
new file mode 100644
index 00000000..ccf2697e
--- /dev/null
+++ b/samply/src/shared/coreclr/eventpipe_trace_manager.rs
@@ -0,0 +1,314 @@
+use std::collections::{HashMap, HashSet};
+use std::path::{Path, PathBuf};
+use std::sync::Arc;
+
+use crate::shared::coreclr::CoreClrMethodName;
+use crate::shared::jit_category_manager::JitCategoryManager;
+use crate::shared::lib_mappings::{LibMappingAdd, LibMappingInfo, LibMappingOp, LibMappingOpQueue};
+use crate::shared::timestamp_converter::TimestampConverter;
+use coreclr_tracing::{CoreClrEvent, EventMetadata, ModuleLoadUnloadEvent};
+use debugid::CodeId;
+use coreclr_tracing::nettrace::EventPipeParser;
+use fxprof_processed_profile::{
+    LibraryHandle, LibraryInfo, Profile, Symbol, SymbolTable,
+};
+use wholesym::samply_symbols::debug_id_and_code_id_for_jitdump;
+
+pub struct EventpipeTraceManager {
+    pending_trace_paths: Vec<(u32, PathBuf)>,
+    processors: Vec<SingleDotnetTraceProcessor>,
+    unlink_after_open: bool,
+}
+
+impl EventpipeTraceManager {
+    pub fn new(unlink_after_open: bool) -> Self {
+        EventpipeTraceManager {
+            pending_trace_paths: Vec::new(),
+            processors: Vec::new(),
+            unlink_after_open,
+        }
+    }
+
+    pub fn add_dotnet_trace_path(
+        &mut self,
+        path: impl Into<PathBuf>,
+        process_id: u32,
+    ) {
+        let path: PathBuf = path.into();
+        log::info!("Adding dotnet trace path: {:?} for pid {}", path, process_id);
+        self.pending_trace_paths.push((process_id, path));
+    }
+
+    pub fn process_pending_records(
+        &mut self,
+        jit_category_manager: &mut JitCategoryManager,
+        profile: &mut Profile,
+        timestamp_converter: &TimestampConverter,
+    ) {
+        self.pending_trace_paths.retain_mut(|(process_id, path)| {
+            fn trace_reader_for_path(
+                path: &Path,
+                unlink_after_open: bool,
+            ) -> Option<(EventPipeParser<std::fs::File>, PathBuf)> {
+                let file = std::fs::File::open(path).ok()?;
+                let reader = EventPipeParser::new(file).ok()?;
+                if unlink_after_open {
+                    std::fs::remove_file(path).ok()?;
+                }
+                Some((reader, path.into()))
+            }
+            let Some((reader, _actual_path)) = trace_reader_for_path(path, self.unlink_after_open)
+            else {
+                return true;
+            };
+
+            let (debug_id, code_id_bytes) = debug_id_and_code_id_for_jitdump(123, 234, 0);
+            let code_id = CodeId::from_binary(&code_id_bytes);
+            let name = path
+                .file_name()
+                .unwrap_or(path.as_os_str())
+                .to_string_lossy()
+                .into_owned();
+            let path = path.to_string_lossy().into_owned();
+
+            let lib_handle = profile.add_lib(LibraryInfo {
+                debug_name: name.clone(),
+                debug_path: path.clone(),
+                name,
+                path: path.clone(),
+                debug_id,
+                code_id: Some(code_id.to_string()),
+                arch: None,
+                symbol_table: None,
+            });
+
+            self.processors
+                .push(SingleDotnetTraceProcessor::new(reader, lib_handle, *process_id));
+
+            let _ = std::fs::remove_file(&path).is_err_and(|e| { log::warn!("Failed to remove {}: {}", path, e); true } );
+
+            false // "Do not retain", i.e. remove from pending_jitdump_paths
+        });
+
+        for nettrace in &mut self.processors {
+            nettrace.process_pending_records(
+                jit_category_manager,
+                profile,
+                timestamp_converter,
+            );
+        }
+    }
+
+    pub fn finish(
+        mut self,
+        jit_category_manager: &mut JitCategoryManager,
+        profile: &mut Profile,
+        timestamp_converter: &TimestampConverter,
+    ) -> Vec<LibMappingOpQueue> {
+        self.process_pending_records(jit_category_manager, profile, timestamp_converter);
+        self.processors
+            .into_iter()
+            .map(|processor| processor.finish(profile))
+            .collect()
+    }
+}
+
+struct SingleDotnetTraceProcessor {
+    /// Some() until end
+    reader: Option<EventPipeParser<std::fs::File>>,
+    lib_handle: LibraryHandle,
+    lib_mapping_ops: LibMappingOpQueue,
+    symbols: Vec<Symbol>,
+
+    modules: HashMap<u64, (EventMetadata, ModuleLoadUnloadEvent)>,
+    seen_method_loads: HashSet<(u64, String)>,
+
+    /// The relative_address of the next JIT function.
+    ///
+    /// We define the relative address space for Jitdump files as follows:
+    /// Pretend that all JIT code is located in sequence, without gaps, in
+    /// the order of JIT_CODE_LOAD entries in the file. A given JIT function's
+    /// relative address is the sum of the `code_size`s of all the `JIT_CODE_LOAD`
+    /// entries that came before it in the file.
+    cumulative_address: u32,
+
+    // The process ID of this process
+    process_id: u32,
+}
+
+impl SingleDotnetTraceProcessor {
+    pub fn new(reader: EventPipeParser<std::fs::File>, lib_handle: LibraryHandle, process_id: u32) -> Self {
+        Self {
+            reader: Some(reader),
+            lib_handle,
+            lib_mapping_ops: Default::default(),
+            symbols: Default::default(),
+            modules: Default::default(),
+            seen_method_loads: Default::default(),
+            cumulative_address: 0,
+            process_id,
+        }
+    }
+
+    pub fn process_pending_records(
+        &mut self,
+        jit_category_manager: &mut JitCategoryManager,
+        profile: &mut Profile,
+        timestamp_converter: &TimestampConverter,
+    ) {
+        if self.reader.is_none() {
+            return;
+        }
+
+        let mut last_timestamp = 0;
+
+        loop {
+            let event = self.reader.as_mut().unwrap().next_event();
+            match event {
+                Ok(Some(ne)) => {
+                    last_timestamp = ne.timestamp;
+                    if let Some((event_meta, coreclr_event)) = coreclr_tracing::eventpipe::decode_coreclr_event(&ne) {
+                        self.process_coreclr_event(
+                            &event_meta.with_pid(self.process_id),
+                            &coreclr_event,
+                            jit_category_manager,
+                            profile,
+                            timestamp_converter,
+                        );
+                    }
+                }
+                Ok(None) => {
+                    // last_timestamp is wrong here, but there's no explicit "close" (I don't think?)
+                    // assume that the last event that we get has a timestamp that's roughly OK for
+                    // end of process
+                    self.lib_mapping_ops
+                        .push(last_timestamp, LibMappingOp::Clear);
+                    self.close_and_commit_symbol_table(profile);
+                    return;
+                }
+                Err(err) => {
+                    log::trace!("dotnet trace manager got error, ignoring: {:?}", err);
+                    self.lib_mapping_ops
+                        .push(last_timestamp, LibMappingOp::Clear);
+                    self.close_and_commit_symbol_table(profile);
+                    return;
+                }
+            }
+        }
+    }
+
+    fn process_coreclr_event(
+        &mut self,
+        event_meta: &EventMetadata,
+        event_coreclr: &CoreClrEvent,
+        jit_category_manager: &mut JitCategoryManager,
+        profile: &mut Profile,
+        _timestamp_converter: &TimestampConverter,
+    ) {
+        match event_coreclr {
+            CoreClrEvent::ModuleLoad(event) => {
+                let module_id = event.module_id;
+                //log::trace!("Loading module {} {} at {}", module_id, event.module_il_path, event.common.timestamp);
+                self.modules.insert(module_id, (event_meta.clone(), event.clone()));
+            }
+            CoreClrEvent::ModuleUnload(event) => {
+                let module_id = event.module_id;
+                self.modules.remove(&module_id);
+            }
+            CoreClrEvent::MethodLoad(event) |
+            CoreClrEvent::MethodDCEnd(event) => {
+                // eventpipe traces on Mac/Linux only include R2R method loads as DCEnd events
+                // during end rundown. This is broken; they should be at worst DCStart events
+                // in a start rundown, and ideally regular MethodLoad events as long as the r2r
+                // shared library is loaded dynamically. We still have to deal with this, though:
+                // the one thing we don't get is an accurate time range for the r2r methods. We
+                // assume they start at 0 time, which is not correct for later-loaded assemblies.
+                let dc_end = match event_coreclr {
+                    CoreClrEvent::MethodDCEnd(_) => true,
+                    _ => false,
+                };
+
+                let start_avma = event.method_start_address;
+                let end_avma = event.method_start_address + event.method_size as u64;
+
+                let msig = (event.method_start_address, event.method_name.clone());
+                if !dc_end {
+                    self.seen_method_loads.insert(msig);
+                } else if self.seen_method_loads.contains(&msig) {
+                    // we already saw a normal MethodLoad for this; skip it, so that
+                    // we don't flag this method as being valid from 0 time
+                    return;
+                }
+
+                let relative_address_at_start = self.cumulative_address;
+                self.cumulative_address += event.method_size;
+
+                let symbol_name = CoreClrMethodName::format(
+                    &event.method_name,
+                    &event.method_namespace,
+                    &event.method_signature,
+                );
+                self.symbols.push(Symbol {
+                    address: relative_address_at_start,
+                    size: if event.method_size == 0 {
+                        None
+                    } else {
+                        Some(event.method_size)
+                    },
+                    name: symbol_name.clone(),
+                });
+
+                let lib_handle = self.lib_handle;
+
+                log::trace!(
+                    "MethodLoad: addr = 0x{:x} symbol_name = {:?} size = {} {}",
+                    start_avma, symbol_name, event.method_size, if dc_end { "(DCEnd)" } else { "" }
+                );
+
+                let (category, js_frame) =
+                    jit_category_manager.classify_jit_symbol(&symbol_name, profile);
+                // If this is a method we haven't seen before but we see it in the DCEnd
+                // rundown, assume that it's valid for the entire range of the trace.
+                // This isn't necessarily correct, but it's the best we can do given
+                // the information we get.
+                let start_ts = if dc_end { 0 } else { event_meta.timestamp };
+
+                self.lib_mapping_ops.push_unsorted(
+                    start_ts,
+                    LibMappingOp::Add(LibMappingAdd {
+                        start_avma,
+                        end_avma,
+                        relative_address_at_start,
+                        info: LibMappingInfo::new_jit_function(lib_handle, category, js_frame),
+                    }),
+                );
+            }
+            CoreClrEvent::ReadyToRunGetEntryPoint(_event) => {
+                // Can't actually do anything with this, as we don't have a size. These methods just
+                // won't be seen in the profile when we're using tracing only (like when attaching).
+            }
+            CoreClrEvent::GcAllocationTick(_event) => {}
+            CoreClrEvent::MethodUnload(_event) => {}
+            CoreClrEvent::GcTriggered(_event) => {}
+            CoreClrEvent::GcSampledObjectAllocation(_event) => {}
+            CoreClrEvent::GcStart(_event) => {}
+            CoreClrEvent::GcEnd(_event) => {}
+        }
+    }
+
+    fn close_and_commit_symbol_table(&mut self, profile: &mut Profile) {
+        if self.reader.is_none() {
+            // We're already closed.
+            return;
+        }
+
+        let symbol_table = SymbolTable::new(std::mem::take(&mut self.symbols));
+        profile.set_lib_symbol_table(self.lib_handle, Arc::new(symbol_table));
+        self.reader = None;
+    }
+
+    pub fn finish(mut self, profile: &mut Profile) -> LibMappingOpQueue {
+        self.close_and_commit_symbol_table(profile);
+        self.lib_mapping_ops
+    }
+}
diff --git a/samply/src/shared/coreclr/markers.rs b/samply/src/shared/coreclr/markers.rs
new file mode 100644
index 00000000..0e22423c
--- /dev/null
+++ b/samply/src/shared/coreclr/markers.rs
@@ -0,0 +1,211 @@
+use fxprof_processed_profile::{
+    MarkerFieldFormat, MarkerFieldSchema, MarkerLocation, MarkerSchema, MarkerStaticField, StaticSchemaMarker,
+    StringHandle, CategoryHandle, Profile
+};
+
+// String is type name
+#[derive(Debug, Clone)]
+pub struct CoreClrGcAllocTickMarker(pub StringHandle, pub usize, pub CategoryHandle);
+
+impl StaticSchemaMarker for CoreClrGcAllocTickMarker {
+    const UNIQUE_MARKER_TYPE_NAME: &'static str = "GC Alloc Tick";
+
+    fn schema() -> MarkerSchema {
+        MarkerSchema {
+            type_name: Self::UNIQUE_MARKER_TYPE_NAME.into(),
+            locations: vec![
+                MarkerLocation::MarkerChart,
+                MarkerLocation::MarkerTable,
+                MarkerLocation::TimelineMemory,
+            ],
+            chart_label: Some("GC Alloc".into()),
+            tooltip_label: Some("GC Alloc: {marker.data.clrtype} ({marker.data.size} bytes)".into()),
+            table_label: Some("GC Alloc".into()),
+            fields: vec![
+                MarkerFieldSchema {
+                    key: "clrtype".into(),
+                    label: "CLR Type".into(),
+                    format: MarkerFieldFormat::String,
+                    searchable: true,
+                },
+                MarkerFieldSchema {
+                    key: "amount".into(),
+                    label: "Size".into(),
+                    format: MarkerFieldFormat::Bytes,
+                    searchable: false,
+                },
+            ],
+            static_fields: vec![MarkerStaticField {
+                    label: "Description".into(),
+                    value: "CoreCLR GC Allocation Tick".into(),
+                },
+            ],
+        }
+    }
+
+    fn name(&self, profile: &mut Profile) -> StringHandle {
+        profile.intern_string(Self::UNIQUE_MARKER_TYPE_NAME)
+    }
+
+    fn category(&self, _profile: &mut Profile) -> CategoryHandle {
+        self.2
+    }
+
+    fn string_field_value(&self, _field_index: u32) -> StringHandle {
+        self.0
+    }
+
+    fn number_field_value(&self, field_index: u32) -> f64 {
+        if field_index == 1 {
+            self.1 as f64
+        } else {
+            panic!("Unexpected field_index");
+        }
+    }
+}
+
+#[derive(Debug, Clone)]
+pub struct CoreClrGcAllocMarker(pub StringHandle, pub usize, pub CategoryHandle);
+
+impl StaticSchemaMarker for CoreClrGcAllocMarker {
+    const UNIQUE_MARKER_TYPE_NAME: &'static str = "GC Alloc";
+
+    fn schema() -> MarkerSchema {
+        MarkerSchema {
+            type_name: Self::UNIQUE_MARKER_TYPE_NAME.into(),
+            locations: vec![
+                MarkerLocation::MarkerChart,
+                MarkerLocation::MarkerTable,
+                MarkerLocation::TimelineMemory,
+            ],
+            chart_label: Some("GC Alloc".into()),
+            tooltip_label: Some(
+                "GC Alloc: {marker.data.clrtype} ({marker.data.size} bytes)".into(),
+            ),
+            table_label: Some("GC Alloc".into()),
+            fields: vec![
+                MarkerFieldSchema {
+                    key: "clrtype".into(),
+                    label: "CLR Type".into(),
+                    format: MarkerFieldFormat::String,
+                    searchable: true,
+                },
+                MarkerFieldSchema {
+                    key: "size".into(),
+                    label: "Size".into(),
+                    format: MarkerFieldFormat::Bytes,
+                    searchable: false,
+                },
+            ],
+            static_fields: vec![MarkerStaticField {
+                label: "Description".into(),
+                value: "GC Allocation".into(),
+            }],
+        }
+    }
+
+    fn name(&self, profile: &mut Profile) -> StringHandle {
+        profile.intern_string("GC Alloc")
+    }
+
+    fn category(&self, _profile: &mut Profile) -> CategoryHandle {
+        self.2
+    }
+
+    fn string_field_value(&self, _field_index: u32) -> StringHandle {
+        self.0
+    }
+
+    fn number_field_value(&self, _field_index: u32) -> f64 {
+        self.1 as f64
+    }
+}
+
+#[derive(Debug, Clone)]
+pub struct CoreClrGcEventMarker(pub StringHandle, pub StringHandle, pub CategoryHandle);
+
+impl StaticSchemaMarker for CoreClrGcEventMarker {
+    const UNIQUE_MARKER_TYPE_NAME: &'static str = "GC Event";
+
+    fn schema() -> MarkerSchema {
+        MarkerSchema {
+            type_name: Self::UNIQUE_MARKER_TYPE_NAME.into(),
+            locations: vec![
+                MarkerLocation::MarkerChart,
+                MarkerLocation::MarkerTable,
+                MarkerLocation::TimelineMemory,
+            ],
+            chart_label: Some("{marker.data.event}".into()),
+            tooltip_label: Some("{marker.data.event}".into()),
+            table_label: Some("{marker.data.event}".into()),
+            fields: vec![MarkerFieldSchema {
+                key: "event".into(),
+                label: "Event".into(),
+                format: MarkerFieldFormat::String,
+                searchable: true,
+            }],
+            static_fields: vec![MarkerStaticField {
+                label: "Description".into(),
+                value: "CoreCLR GC Event".into(),
+            }],
+        }
+    }
+
+    fn name(&self, _profile: &mut Profile) -> StringHandle {
+        self.0
+    }
+
+    fn category(&self, _profile: &mut Profile) -> CategoryHandle {
+        self.2
+    }
+
+    fn string_field_value(&self, _field_index: u32) -> StringHandle {
+        self.1
+    }
+
+    fn number_field_value(&self, _field_index: u32) -> f64 {
+        unreachable!()
+    }
+}
+
+#[derive(Debug, Clone)]
+pub struct CoreClrGcMarker(pub CategoryHandle);
+
+impl StaticSchemaMarker for CoreClrGcMarker {
+    const UNIQUE_MARKER_TYPE_NAME: &'static str = "GC";
+
+    fn schema() -> MarkerSchema {
+        MarkerSchema {
+            type_name: Self::UNIQUE_MARKER_TYPE_NAME.into(),
+            locations: vec![
+                MarkerLocation::MarkerChart,
+                MarkerLocation::MarkerTable,
+                MarkerLocation::TimelineMemory,
+            ],
+            chart_label: Some("GC".into()),
+            tooltip_label: Some("GC".into()),
+            table_label: Some("GC".into()),
+            fields: vec![],
+            static_fields: vec![MarkerStaticField {
+                label: "Description".into(),
+                value: "CoreCLR GC".into(),
+            }],
+        }
+    }
+
+    fn name(&self, profile: &mut Profile) -> StringHandle {
+        profile.intern_string(Self::UNIQUE_MARKER_TYPE_NAME)
+    }
+
+    fn category(&self, _profile: &mut Profile) -> CategoryHandle {
+        self.0
+    }
+
+    fn string_field_value(&self, _field_index: u32) -> StringHandle {
+        unreachable!()
+    }
+
+    fn number_field_value(&self, _field_index: u32) -> f64 {
+        unreachable!()
+    }
+}
diff --git a/samply/src/shared/coreclr/mod.rs b/samply/src/shared/coreclr/mod.rs
new file mode 100644
index 00000000..49db0074
--- /dev/null
+++ b/samply/src/shared/coreclr/mod.rs
@@ -0,0 +1,50 @@
+mod eventpipe_trace_manager;
+mod markers;
+mod provider;
+
+use std::fmt::Display;
+
+pub use provider::*;
+pub use markers::*;
+pub(crate) use eventpipe_trace_manager::*;
+
+#[derive(Debug, Clone)]
+pub struct CoreClrProviderProps {
+    pub is_attach: bool,
+    pub gc_markers: bool,
+    pub gc_suspensions: bool,
+    pub gc_detailed_allocs: bool,
+    pub event_stacks: bool,
+}
+
+#[allow(dead_code)]
+pub(crate) struct SavedMarkerInfo {
+    pub start_timestamp_raw: u64,
+    pub name: String,
+    pub description: String,
+}
+
+#[derive(Debug, Clone)]
+pub struct CoreClrMethodName {
+    pub name: String,
+    pub namespace: String,
+    pub signature: String,
+}
+
+impl CoreClrMethodName {
+    pub fn format(name: &str, namespace: &str, signature: &str) -> String {
+        // \u{2329} \u{232a} are fancy angle brackets
+        format!(
+            "{name} [{namespace}] \u{2329}{signature}\u{232a}",
+            name = name,
+            namespace = namespace,
+            signature = signature
+        )
+    }
+}
+
+impl Display for CoreClrMethodName {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.write_str(&CoreClrMethodName::format(&self.name, &self.namespace, &self.signature))
+    }
+}
diff --git a/samply/src/shared/coreclr/provider.rs b/samply/src/shared/coreclr/provider.rs
new file mode 100644
index 00000000..1a38fd44
--- /dev/null
+++ b/samply/src/shared/coreclr/provider.rs
@@ -0,0 +1,95 @@
+use super::CoreClrProviderProps;
+
+#[allow(unused)]
+mod constants {
+    pub const CORECLR_GC_KEYWORD: u64 = 0x1; // https://learn.microsoft.com/en-us/dotnet/fundamentals/diagnostics/runtime-garbage-collection-events
+    pub const CORECLR_GC_HANDLE_KEYWORD: u64 = 0x2;
+    pub const CORECLR_BINDER_KEYWORD: u64 = 0x4; // https://learn.microsoft.com/en-us/dotnet/fundamentals/diagnostics/runtime-loader-binder-events
+    pub const CORECLR_LOADER_KEYWORD: u64 = 0x8; // https://learn.microsoft.com/en-us/dotnet/fundamentals/diagnostics/runtime-loader-binder-events
+    pub const CORECLR_JIT_KEYWORD: u64 = 0x10; // https://learn.microsoft.com/en-us/dotnet/fundamentals/diagnostics/runtime-method-events
+    pub const CORECLR_NGEN_KEYWORD: u64 = 0x20; // https://learn.microsoft.com/en-us/dotnet/fundamentals/diagnostics/runtime-method-events
+    pub const CORECLR_RUNDOWN_START_KEYWORD: u64 = 0x00000040;
+    pub const CORECLR_INTEROP_KEYWORD: u64 = 0x2000; // https://learn.microsoft.com/en-us/dotnet/fundamentals/diagnostics/runtime-interop-events
+    pub const CORECLR_CONTENTION_KEYWORD: u64 = 0x4000;
+    pub const CORECLR_EXCEPTION_KEYWORD: u64 = 0x8000; // https://learn.microsoft.com/en-us/dotnet/fundamentals/diagnostics/runtime-exception-events
+    pub const CORECLR_THREADING_KEYWORD: u64 = 0x10000; // https://learn.microsoft.com/en-us/dotnet/fundamentals/diagnostics/runtime-thread-events
+    pub const CORECLR_JIT_TO_NATIVE_METHOD_MAP_KEYWORD: u64 = 0x20000;
+    pub const CORECLR_GC_SAMPLED_OBJECT_ALLOCATION_HIGH_KEYWORD: u64 = 0x200000; // https://medium.com/criteo-engineering/build-your-own-net-memory-profiler-in-c-allocations-1-2-9c9f0c86cefd
+    pub const CORECLR_GC_HEAP_AND_TYPE_NAMES: u64 = 0x1000000;
+    pub const CORECLR_GC_SAMPLED_OBJECT_ALLOCATION_LOW_KEYWORD: u64 = 0x2000000;
+    pub const CORECLR_STACK_KEYWORD: u64 = 0x40000000; // https://learn.microsoft.com/en-us/dotnet/framework/performance/stack-etw-event (note: says .NET Framework, but applies to CoreCLR also)
+    pub const CORECLR_COMPILATION_KEYWORD: u64 = 0x1000000000;
+    pub const CORECLR_COMPILATION_DIAGNOSTIC_KEYWORD: u64 = 0x2000000000;
+    pub const CORECLR_TYPE_DIAGNOSTIC_KEYWORD: u64 = 0x8000000000;
+}
+
+/// Given a set of CoreClrProviderProps, return the list of appropriate
+/// provider strings for xperf or dotnet-trace.
+pub fn coreclr_provider_args(props: CoreClrProviderProps) -> Vec<String> {
+    let mut providers = vec![];
+
+    // Enabling all the DotNETRuntime keywords is very expensive. In particular,
+    // enabling the NGenKeyword causes info to be generated for every NGen'd method; we should
+    // instead use the native PDB info from ModuleLoad events to get this information.
+    //
+    // Also enabling the rundown keyword causes a bunch of DCStart/DCEnd events to be generated,
+    // which is only useful if we're tracing an already running process.
+    // if STACK is enabled, then every CoreCLR event will also generate a stack event right afterwards
+    use constants::*;
+    let mut info_keywords = CORECLR_LOADER_KEYWORD;
+    info_keywords |=
+        CORECLR_COMPILATION_DIAGNOSTIC_KEYWORD | CORECLR_JIT_TO_NATIVE_METHOD_MAP_KEYWORD;
+    if props.event_stacks {
+        info_keywords |= CORECLR_STACK_KEYWORD;
+    }
+    if props.gc_markers || props.gc_suspensions || props.gc_detailed_allocs {
+        info_keywords |= CORECLR_GC_KEYWORD;
+    }
+
+    let mut verbose_keywords = CORECLR_JIT_KEYWORD | CORECLR_NGEN_KEYWORD;
+
+    // if we're attaching, ask for a rundown of method info at the start of collection
+    let rundown_verbose_keywords = if props.is_attach {
+        CORECLR_LOADER_KEYWORD | CORECLR_JIT_KEYWORD | CORECLR_NGEN_KEYWORD | CORECLR_RUNDOWN_START_KEYWORD
+    } else {
+        CORECLR_JIT_KEYWORD | CORECLR_NGEN_KEYWORD
+    };
+
+    if props.gc_detailed_allocs {
+        info_keywords |= CORECLR_GC_SAMPLED_OBJECT_ALLOCATION_HIGH_KEYWORD
+            | CORECLR_GC_SAMPLED_OBJECT_ALLOCATION_LOW_KEYWORD;
+    }
+
+    verbose_keywords |= info_keywords;
+    info_keywords = 0;
+
+    if info_keywords != 0 {
+        providers.push(format!(
+            "Microsoft-Windows-DotNETRuntime:0x{:x}:4",
+            info_keywords
+        ));
+    }
+
+    if verbose_keywords != 0 {
+        // For some reason, we don't get JIT MethodLoad (non-Verbose) in Info level,
+        // even though we should. This is OK though, because non-Verbose MethodLoad doesn't
+        // include the method string names (we would have to pull it out based on MethodID,
+        // and I'm not sure which events include the mapping -- MethodJittingStarted is also
+        // verbose).
+        providers.push(format!(
+            "Microsoft-Windows-DotNETRuntime:0x{:x}:5",
+            verbose_keywords
+        ));
+    }
+
+    if rundown_verbose_keywords != 0 {
+        providers.push(format!(
+            "Microsoft-Windows-DotNETRuntimeRundown:0x{:x}:5",
+            rundown_verbose_keywords
+        ));
+    }
+
+    //providers.push(format!("Microsoft-Windows-DotNETRuntime"));
+
+    providers
+}
diff --git a/samply/src/shared/lib_mappings.rs b/samply/src/shared/lib_mappings.rs
index 9a631c65..9b0536c2 100644
--- a/samply/src/shared/lib_mappings.rs
+++ b/samply/src/shared/lib_mappings.rs
@@ -132,20 +132,32 @@ impl LibMappingsHierarchy {
 }
 
 #[derive(Debug, Clone, Default)]
-pub struct LibMappingOpQueue(Vec<(u64, LibMappingOp)>);
+pub struct LibMappingOpQueue(Vec<(u64, LibMappingOp)>, bool);
 
 impl LibMappingOpQueue {
     pub fn push(&mut self, timestamp: u64, op: LibMappingOp) {
         self.0.push((timestamp, op));
     }
 
+    pub fn push_unsorted(&mut self, timestamp: u64, op: LibMappingOp) {
+        self.0.push((timestamp, op));
+        self.1 = true;
+    }
+
     pub fn is_empty(&self) -> bool {
         self.0.is_empty()
     }
 
-    pub fn into_iter(self) -> LibMappingOpQueueIter {
+    pub fn into_iter(mut self) -> LibMappingOpQueueIter {
+        if self.1 /* unsorted */ {
+            self.sort();
+        }
         LibMappingOpQueueIter(self.0.into_iter().peekable())
     }
+
+    fn sort(&mut self) {
+        self.0.sort_by_key(|(timestamp, _)| *timestamp);
+    }
 }
 
 #[derive(Debug)]
diff --git a/samply/src/shared/mod.rs b/samply/src/shared/mod.rs
index e33d94f5..1fc392e7 100644
--- a/samply/src/shared/mod.rs
+++ b/samply/src/shared/mod.rs
@@ -1,4 +1,5 @@
 pub mod context_switch;
+pub mod coreclr;
 pub mod ctrl_c;
 pub mod included_processes;
 pub mod jit_category_manager;
diff --git a/samply/src/shared/recording_props.rs b/samply/src/shared/recording_props.rs
index 24e09c6c..bcd6b723 100644
--- a/samply/src/shared/recording_props.rs
+++ b/samply/src/shared/recording_props.rs
@@ -4,6 +4,8 @@ use std::time::Duration;
 
 use serde_derive::{Deserialize, Serialize};
 
+use super::coreclr::CoreClrProviderProps;
+
 #[derive(Debug, Default, Clone, Copy, Serialize, Deserialize)]
 pub struct CoreClrProfileProps {
     pub enabled: bool,
@@ -21,6 +23,16 @@ impl CoreClrProfileProps {
             || self.gc_detailed_allocs
             || self.event_stacks
     }
+
+    pub fn to_provider_props(&self) -> CoreClrProviderProps {
+        CoreClrProviderProps {
+            event_stacks: self.event_stacks,
+            gc_markers: self.gc_markers,
+            gc_suspensions: self.gc_suspensions,
+            gc_detailed_allocs: self.gc_detailed_allocs,
+            is_attach: false,
+        }
+    }
 }
 
 /// Properties which are meaningful both for recording a fresh process
diff --git a/samply/src/shared/timestamp_converter.rs b/samply/src/shared/timestamp_converter.rs
index f471526f..6b55d1d1 100644
--- a/samply/src/shared/timestamp_converter.rs
+++ b/samply/src/shared/timestamp_converter.rs
@@ -21,4 +21,10 @@ impl TimestampConverter {
             (time_us * 1000).saturating_sub(self.reference_raw * self.raw_to_ns_factor),
         )
     }
+
+    #[allow(unused)]
+    pub fn convert_to_raw(&self, timestamp: Timestamp) -> u64 {
+        (timestamp.as_nanos_since_reference() / self.raw_to_ns_factor)
+            .saturating_add(self.reference_raw)
+    }
 }
diff --git a/samply/src/windows/coreclr.rs b/samply/src/windows/coreclr.rs
index 973dc673..d399ab3f 100644
--- a/samply/src/windows/coreclr.rs
+++ b/samply/src/windows/coreclr.rs
@@ -1,75 +1,23 @@
-use std::{collections::HashMap, convert::TryInto, fmt::Display};
-
 use bitflags::bitflags;
-use fxprof_processed_profile::*;
-use num_derive::FromPrimitive;
-use num_traits::FromPrimitive;
 
-use etw_reader::{self, schema::TypedEvent};
-use etw_reader::{
-    event_properties_to_string,
-    parser::{Parser, TryParse},
-};
+use coreclr_tracing::{CoreClrEvent, EventMetadata, GcReason, GcSuspendEeReason, GcType};
+
+use crate::shared::coreclr::*;
 
-use crate::shared::recording_props::{CoreClrProfileProps, ProfileCreationProps};
 use crate::windows::profile_context::{KnownCategory, ProfileContext};
 
 use super::elevated_helper::ElevatedRecordingProps;
 
-struct SavedMarkerInfo {
-    start_timestamp_raw: u64,
-    name: String,
-    description: String,
-}
-
 pub struct CoreClrContext {
-    props: CoreClrProfileProps,
-    last_marker_on_thread: HashMap<u32, (ThreadHandle, MarkerHandle)>,
-    gc_markers_on_thread: HashMap<u32, HashMap<&'static str, SavedMarkerInfo>>,
-    unknown_event_markers: bool,
+    pub props: CoreClrProviderProps,
 }
 
 impl CoreClrContext {
-    pub fn new(profile_creation_props: ProfileCreationProps) -> Self {
+    pub fn new(context: &ProfileContext) -> Self {
         Self {
-            props: profile_creation_props.coreclr,
-            last_marker_on_thread: HashMap::new(),
-            gc_markers_on_thread: HashMap::new(),
-            unknown_event_markers: profile_creation_props.unknown_event_markers,
+            props: context.creation_props().coreclr.to_provider_props(),
         }
     }
-
-    fn remove_last_event_for_thread(&mut self, tid: u32) -> Option<(ThreadHandle, MarkerHandle)> {
-        self.last_marker_on_thread.remove(&tid)
-    }
-
-    fn set_last_event_for_thread(&mut self, tid: u32, thread_marker: (ThreadHandle, MarkerHandle)) {
-        self.last_marker_on_thread.insert(tid, thread_marker);
-    }
-
-    fn save_gc_marker(
-        &mut self,
-        tid: u32,
-        start_timestamp_raw: u64,
-        event: &'static str,
-        name: String,
-        description: String,
-    ) {
-        self.gc_markers_on_thread.entry(tid).or_default().insert(
-            event,
-            SavedMarkerInfo {
-                start_timestamp_raw,
-                name,
-                description,
-            },
-        );
-    }
-
-    fn remove_gc_marker(&mut self, tid: u32, event: &str) -> Option<SavedMarkerInfo> {
-        self.gc_markers_on_thread
-            .get_mut(&tid)
-            .and_then(|m| m.remove(event))
-    }
 }
 
 bitflags! {
@@ -106,697 +54,121 @@ bitflags! {
     }
 }
 
-#[allow(unused)]
-mod constants {
-    pub const CORECLR_GC_KEYWORD: u64 = 0x1; // https://learn.microsoft.com/en-us/dotnet/fundamentals/diagnostics/runtime-garbage-collection-events
-    pub const CORECLR_GC_HANDLE_KEYWORD: u64 = 0x2;
-    pub const CORECLR_BINDER_KEYWORD: u64 = 0x4; // https://learn.microsoft.com/en-us/dotnet/fundamentals/diagnostics/runtime-loader-binder-events
-    pub const CORECLR_LOADER_KEYWORD: u64 = 0x8; // https://learn.microsoft.com/en-us/dotnet/fundamentals/diagnostics/runtime-loader-binder-events
-    pub const CORECLR_JIT_KEYWORD: u64 = 0x10; // https://learn.microsoft.com/en-us/dotnet/fundamentals/diagnostics/runtime-method-events
-    pub const CORECLR_NGEN_KEYWORD: u64 = 0x20; // https://learn.microsoft.com/en-us/dotnet/fundamentals/diagnostics/runtime-method-events
-    pub const CORECLR_RUNDOWN_START_KEYWORD: u64 = 0x00000040;
-    pub const CORECLR_INTEROP_KEYWORD: u64 = 0x2000; // https://learn.microsoft.com/en-us/dotnet/fundamentals/diagnostics/runtime-interop-events
-    pub const CORECLR_CONTENTION_KEYWORD: u64 = 0x4000;
-    pub const CORECLR_EXCEPTION_KEYWORD: u64 = 0x8000; // https://learn.microsoft.com/en-us/dotnet/fundamentals/diagnostics/runtime-exception-events
-    pub const CORECLR_THREADING_KEYWORD: u64 = 0x10000; // https://learn.microsoft.com/en-us/dotnet/fundamentals/diagnostics/runtime-thread-events
-    pub const CORECLR_JIT_TO_NATIVE_METHOD_MAP_KEYWORD: u64 = 0x20000;
-    pub const CORECLR_GC_SAMPLED_OBJECT_ALLOCATION_HIGH_KEYWORD: u64 = 0x200000; // https://medium.com/criteo-engineering/build-your-own-net-memory-profiler-in-c-allocations-1-2-9c9f0c86cefd
-    pub const CORECLR_GC_HEAP_AND_TYPE_NAMES: u64 = 0x1000000;
-    pub const CORECLR_GC_SAMPLED_OBJECT_ALLOCATION_LOW_KEYWORD: u64 = 0x2000000;
-    pub const CORECLR_STACK_KEYWORD: u64 = 0x40000000; // https://learn.microsoft.com/en-us/dotnet/framework/performance/stack-etw-event (note: says .NET Framework, but applies to CoreCLR also)
-    pub const CORECLR_COMPILATION_KEYWORD: u64 = 0x1000000000;
-    pub const CORECLR_COMPILATION_DIAGNOSTIC_KEYWORD: u64 = 0x2000000000;
-    pub const CORECLR_TYPE_DIAGNOSTIC_KEYWORD: u64 = 0x8000000000;
-}
-
-#[derive(Debug, Clone, FromPrimitive)]
-enum GcReason {
-    AllocSmall = 0,
-    Induced,
-    LowMemory,
-    Empty,
-    AllocLarge,
-    OutOfSpaceSmallObjectHeap,
-    OutOfSpaceLargeObjectHeap,
-    InducedNoForce,
-    Stress,
-    InducedLowMemory,
-}
-
-impl Display for GcReason {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        match self {
-            GcReason::AllocSmall => f.write_str("Small object heap allocation"),
-            GcReason::Induced => f.write_str("Induced"),
-            GcReason::LowMemory => f.write_str("Low memory"),
-            GcReason::Empty => f.write_str("Empty"),
-            GcReason::AllocLarge => f.write_str("Large object heap allocation"),
-            GcReason::OutOfSpaceSmallObjectHeap => {
-                f.write_str("Out of space (for small object heap)")
-            }
-            GcReason::OutOfSpaceLargeObjectHeap => {
-                f.write_str("Out of space (for large object heap)")
-            }
-            GcReason::InducedNoForce => f.write_str("Induced but not forced as blocking"),
-            GcReason::Stress => f.write_str("Stress"),
-            GcReason::InducedLowMemory => f.write_str("Induced low memory"),
-        }
-    }
-}
-
-#[derive(Debug, Clone, FromPrimitive)]
-enum GcSuspendEeReason {
-    Other = 0,
-    GC,
-    AppDomainShutdown,
-    CodePitching,
-    Shutdown,
-    Debugger,
-    GcPrep,
-    DebuggerSweep,
-}
-
-impl Display for GcSuspendEeReason {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        match self {
-            GcSuspendEeReason::Other => f.write_str("Other"),
-            GcSuspendEeReason::GC => f.write_str("GC"),
-            GcSuspendEeReason::AppDomainShutdown => f.write_str("AppDomain shutdown"),
-            GcSuspendEeReason::CodePitching => f.write_str("Code pitching"),
-            GcSuspendEeReason::Shutdown => f.write_str("Shutdown"),
-            GcSuspendEeReason::Debugger => f.write_str("Debugger"),
-            GcSuspendEeReason::GcPrep => f.write_str("GC prep"),
-            GcSuspendEeReason::DebuggerSweep => f.write_str("Debugger sweep"),
-        }
-    }
-}
-
-#[derive(Debug, Clone, FromPrimitive)]
-enum GcType {
-    Blocking,
-    Background,
-    BlockingDuringBackground,
-}
-
-impl Display for GcType {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        match self {
-            GcType::Blocking => f.write_str("Blocking GC"),
-            GcType::Background => f.write_str("Background GC"),
-            GcType::BlockingDuringBackground => f.write_str("Blocking GC during background GC"),
-        }
-    }
-}
-// String is type name
-#[derive(Debug, Clone)]
-pub struct CoreClrGcAllocMarker(StringHandle, f64, CategoryHandle);
-
-impl StaticSchemaMarker for CoreClrGcAllocMarker {
-    const UNIQUE_MARKER_TYPE_NAME: &'static str = "GC Alloc";
-
-    fn schema() -> MarkerSchema {
-        MarkerSchema {
-            type_name: Self::UNIQUE_MARKER_TYPE_NAME.into(),
-            locations: vec![
-                MarkerLocation::MarkerChart,
-                MarkerLocation::MarkerTable,
-                MarkerLocation::TimelineMemory,
-            ],
-            chart_label: Some("GC Alloc".into()),
-            tooltip_label: Some(
-                "GC Alloc: {marker.data.clrtype} ({marker.data.size} bytes)".into(),
-            ),
-            table_label: Some("GC Alloc".into()),
-            fields: vec![
-                MarkerFieldSchema {
-                    key: "clrtype".into(),
-                    label: "CLR Type".into(),
-                    format: MarkerFieldFormat::String,
-                    searchable: true,
-                },
-                MarkerFieldSchema {
-                    key: "size".into(),
-                    label: "Size".into(),
-                    format: MarkerFieldFormat::Bytes,
-                    searchable: false,
-                },
-            ],
-            static_fields: vec![MarkerStaticField {
-                label: "Description".into(),
-                value: "GC Allocation.".into(),
-            }],
-        }
-    }
-
-    fn name(&self, profile: &mut Profile) -> StringHandle {
-        profile.intern_string("GC Alloc")
-    }
-
-    fn category(&self, _profile: &mut Profile) -> CategoryHandle {
-        self.2
-    }
-
-    fn string_field_value(&self, _field_index: u32) -> StringHandle {
-        self.0
-    }
-
-    fn number_field_value(&self, _field_index: u32) -> f64 {
-        self.1
-    }
-}
-
-#[derive(Debug, Clone)]
-pub struct CoreClrGcEventMarker(StringHandle, StringHandle, CategoryHandle);
-
-impl StaticSchemaMarker for CoreClrGcEventMarker {
-    const UNIQUE_MARKER_TYPE_NAME: &'static str = "GC Event";
-
-    fn schema() -> MarkerSchema {
-        MarkerSchema {
-            type_name: Self::UNIQUE_MARKER_TYPE_NAME.into(),
-            locations: vec![
-                MarkerLocation::MarkerChart,
-                MarkerLocation::MarkerTable,
-                MarkerLocation::TimelineMemory,
-            ],
-            chart_label: Some("{marker.data.event}".into()),
-            tooltip_label: Some("{marker.data.event}".into()),
-            table_label: Some("{marker.data.event}".into()),
-            fields: vec![MarkerFieldSchema {
-                key: "event".into(),
-                label: "Event".into(),
-                format: MarkerFieldFormat::String,
-                searchable: true,
-            }],
-            static_fields: vec![MarkerStaticField {
-                label: "Description".into(),
-                value: "Generic GC Event.".into(),
-            }],
-        }
-    }
-
-    fn name(&self, _profile: &mut Profile) -> StringHandle {
-        self.0
-    }
-
-    fn category(&self, _profile: &mut Profile) -> CategoryHandle {
-        self.2
-    }
-
-    fn string_field_value(&self, _field_index: u32) -> StringHandle {
-        self.1
-    }
-
-    fn number_field_value(&self, _field_index: u32) -> f64 {
-        unreachable!()
-    }
-}
-
-#[derive(Debug, Clone, PartialEq, Eq)]
-struct DisplayUnknownIfNone<'a, T>(pub &'a Option<T>);
-
-impl<'a, T: Display> Display for DisplayUnknownIfNone<'a, T> {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        match self.0 {
-            Some(value) => value.fmt(f),
-            None => f.write_str("Unknown"),
-        }
-    }
-}
-
 pub fn coreclr_xperf_args(props: &ElevatedRecordingProps) -> Vec<String> {
-    let mut providers = vec![];
-
     if !props.coreclr.any_enabled() {
-        return providers;
-    }
-
-    // Enabling all the DotNETRuntime keywords is very expensive. In particular,
-    // enabling the NGenKeyword causes info to be generated for every NGen'd method; we should
-    // instead use the native PDB info from ModuleLoad events to get this information.
-    //
-    // Also enabling the rundown keyword causes a bunch of DCStart/DCEnd events to be generated,
-    // which is only useful if we're tracing an already running process.
-    // if STACK is enabled, then every CoreCLR event will also generate a stack event right afterwards
-    use constants::*;
-    let mut info_keywords = CORECLR_LOADER_KEYWORD;
-    if props.coreclr.event_stacks {
-        info_keywords |= CORECLR_STACK_KEYWORD;
-    }
-    if props.coreclr.gc_markers || props.coreclr.gc_suspensions || props.coreclr.gc_detailed_allocs
-    {
-        info_keywords |= CORECLR_GC_KEYWORD;
+        return vec![];
     }
 
-    let verbose_keywords = CORECLR_JIT_KEYWORD | CORECLR_NGEN_KEYWORD;
-
-    // if we're attaching, ask for a rundown of method info at the start of collection
-    let rundown_verbose_keywords = if props.is_attach {
-        CORECLR_LOADER_KEYWORD | CORECLR_JIT_KEYWORD | CORECLR_RUNDOWN_START_KEYWORD
-    } else {
-        0
+    // copy matching property names from props.coreclr into CoreClrProviderProperties
+    let coreclr_props = CoreClrProviderProps {
+        is_attach: props.is_attach,
+        gc_markers: props.coreclr.gc_markers,
+        gc_suspensions: props.coreclr.gc_suspensions,
+        gc_detailed_allocs: props.coreclr.gc_detailed_allocs,
+        event_stacks: props.coreclr.event_stacks,
     };
 
-    if props.coreclr.gc_detailed_allocs {
-        info_keywords |= CORECLR_GC_SAMPLED_OBJECT_ALLOCATION_HIGH_KEYWORD
-            | CORECLR_GC_SAMPLED_OBJECT_ALLOCATION_LOW_KEYWORD;
-    }
-
-    if info_keywords != 0 {
-        providers.push(format!(
-            "Microsoft-Windows-DotNETRuntime:0x{:x}:4",
-            info_keywords
-        ));
-    }
-
-    if verbose_keywords != 0 {
-        // For some reason, we don't get JIT MethodLoad (non-Verbose) in Info level,
-        // even though we should. This is OK though, because non-Verbose MethodLoad doesn't
-        // include the method string names (we would have to pull it out based on MethodID,
-        // and I'm not sure which events include the mapping -- MethodJittingStarted is also
-        // verbose).
-        providers.push(format!(
-            "Microsoft-Windows-DotNETRuntime:0x{:x}:5",
-            verbose_keywords
-        ));
-    }
-
-    if rundown_verbose_keywords != 0 {
-        providers.push(format!(
-            "Microsoft-Windows-DotNETRuntimeRundown:0x{:x}:5",
-            rundown_verbose_keywords
-        ));
-    }
-
-    //providers.push(format!("Microsoft-Windows-DotNETRuntime"));
-
-    providers
+    coreclr_provider_args(coreclr_props)
 }
 
-pub fn handle_coreclr_event(
+pub fn handle_coreclr_tracing_event(
     context: &mut ProfileContext,
     coreclr_context: &mut CoreClrContext,
-    s: &TypedEvent,
-    parser: &mut Parser,
+    event_meta: &EventMetadata,
+    event_coreclr: &CoreClrEvent,
     is_in_time_range: bool,
 ) {
-    let (gc_markers, gc_suspensions, gc_allocs, event_stacks) = (
+    let (gc_markers, gc_suspensions, gc_allocs) = (
         coreclr_context.props.gc_markers,
         coreclr_context.props.gc_suspensions,
         coreclr_context.props.gc_detailed_allocs,
-        coreclr_context.props.event_stacks,
     );
 
-    let pid = s.process_id();
-    let tid = s.thread_id();
-
-    if !context.is_interesting_process(pid, None, None) {
-        return;
-    }
-
-    let timestamp_raw = s.timestamp() as u64;
-
-    let mut name_parts = s.name().splitn(3, '/');
-    let provider = name_parts.next().unwrap();
-    let task = name_parts.next().unwrap();
-    let opcode = name_parts.next().unwrap();
-
-    match provider {
-        "Microsoft-Windows-DotNETRuntime" | "Microsoft-Windows-DotNETRuntimeRundown" => {}
-        _ => {
-            panic!("Unexpected event {}", s.name())
-        }
-    }
-
-    // TODO -- we may need to use the rundown provider if we trace running processes
-    // https://learn.microsoft.com/en-us/dotnet/framework/performance/clr-etw-providers
-
-    // We get DbgID_RSDS for ReadyToRun loaded images, along with PDB files. We also get ModuleLoad events for the same:
-    // this means we can ignore the ModuleLoadEvents because we'll get dbginfo already mapped properly when the image
-    // is loaded.
-
-    let mut handled = false;
-
-    //eprintln!("event: {} [pid: {} tid: {}] {}", timestamp_raw, s.pid(), s.tid(), dotnet_event);
-
-    // If we get a non-stackwalk event followed by a non-stackwalk event for a given thread,
-    // clear out any marker that may have been created to make sure the stackwalk doesn't
-    // get attached to the wrong thing.
-    if (task, opcode) != ("CLRStack", "CLRStackWalk") {
-        coreclr_context.remove_last_event_for_thread(tid);
-    }
-
-    match (task, opcode) {
-        ("CLRMethod" | "CLRMethodRundown", method_event) => {
-            match method_event {
-            // there's MethodDCStart & MethodDCStartVerbose & MethodLoad
-            // difference between *Verbose and not, is Verbose includes the names
-
-            "MethodLoadVerbose" | "MethodDCStartVerbose"
-            // | "R2RGetEntryPoint" // not sure we need this? R2R methods should be covered by PDB files
-            => {
-                // R2RGetEntryPoint shares a lot of fields with MethodLoadVerbose
-                let is_r2r = method_event == "R2RGetEntryPoint";
-
-                //let method_id: u64 = parser.parse("MethodID");
-                //let clr_instance_id: u32 = parser.parse("ClrInstanceID"); // v1/v2 only
-
-                let method_basename: String = parser.parse("MethodName");
-                let method_namespace: String = parser.parse("MethodNamespace");
-                let method_signature: String = parser.parse("MethodSignature");
-
-                let method_start_address: u64 = if is_r2r { parser.parse("EntryPoint") } else { parser.parse("MethodStartAddress") };
-                let method_size: u32 = parser.parse("MethodSize"); // TODO: R2R doesn't have a size?
-
-                // There's a v0, v1, and v2 version of this event. There are rules in `eventtrace.cpp` in the runtime
-                // that describe the rules, but basically:
-                // - during a first-JIT, only a v1 (not v0 and not v2+) MethodLoad is emitted.
-                // - during a re-jit, a v2 event is emitted.
-                // - v2 contains a "NativeCodeId" field which will be nonzero in v2. 
-                // - the unique key for a method extent is MethodId + MethodCodeId + extent (hot/cold)
-
-                // there's some stuff in MethodFlags -- might be tiered JIT info?
-                // also ClrInstanceID -- we probably won't have more than one runtime, but maybe.
-
-                let method_name = format!("{method_basename} [{method_namespace}] \u{2329}{method_signature}\u{232a}");
-
-                context.handle_coreclr_method_load(timestamp_raw, pid, method_name, method_start_address, method_size);
-                handled = true;
-            }
-            "ModuleLoad" | "ModuleDCStart" |
-            "ModuleUnload" | "ModuleDCEnd" => {
-                // do we need this for ReadyToRun code?
-
-                //let module_id: u64 = parser.parse("ModuleID");
-                //let assembly_id: u64 = parser.parse("AssemblyId");
-                //let managed_pdb_signature: u?? = parser.parse("ManagedPdbSignature");
-                //let managed_pdb_age: u?? = parser.parse("ManagedPdbAge");
-                //let managed_pdb_path: String = parser.parse("ManagedPdbPath");
-                //let native_pdb_signature: u?? = parser.parse("NativePdbSignature");
-                //let native_pdb_age: u?? = parser.parse("NativePdbAge");
-                //let native_pdb_path: String = parser.parse("NativePdbPath");
-                handled = true;
-            }
-            _ => {
-                // don't care about any other CLRMethod events
-                handled = true;
+    // Handle events that we need to handle whether in time range or not first
+
+    match event_coreclr {
+        CoreClrEvent::MethodLoad(e) => {
+            let method_basename = e.method_name.to_string();
+            let method_namespace = e.method_namespace.to_string();
+            let method_signature = e.method_signature.to_string();
+            let method_name = CoreClrMethodName::format(&method_basename, &method_namespace, &method_signature);
+            context.handle_coreclr_method_load(
+                event_meta.timestamp,
+                event_meta.process_id,
+                method_name,
+                e.method_start_address,
+                e.method_size,
+            );
+        }
+        CoreClrEvent::MethodUnload(_e) => {
+            // don't care
+        }
+        CoreClrEvent::GcTriggered(_e) if is_in_time_range && gc_markers => {
+            let category = context.known_category(KnownCategory::CoreClrGc);
+            let m = context.add_thread_instant_marker(
+                event_meta.timestamp,
+                event_meta.thread_id,
+                CoreClrGcMarker(category));
+            if let Some(stack) = event_meta.stack.as_ref() {
+                context.handle_coreclr_stack(event_meta.timestamp, event_meta.process_id, stack.iter().map(|v| *v), m);
             }
         }
-        }
-        ("Type", "BulkType") => {
-            //         <template tid="BulkType">
-            // <data name="Count" inType="win:UInt32"    />
-            // <data name="ClrInstanceID" inType="win:UInt16" />
-            // <struct name="Values" count="Count" >
-            // <data name="TypeID" inType="win:UInt64" outType="win:HexInt64" />
-            // <data name="ModuleID" inType="win:UInt64" outType="win:HexInt64" />
-            // <data name="TypeNameID" inType="win:UInt32" />
-            // <data name="Flags" inType="win:UInt32" map="TypeFlagsMap"/>
-            // <data name="CorElementType"  inType="win:UInt8" />
-            // <data name="Name" inType="win:UnicodeString" />
-            // <data name="TypeParameterCount" inType="win:UInt32" />
-            // <data name="TypeParameters"  count="TypeParameterCount"  inType="win:UInt64" outType="win:HexInt64" />
-            // </struct>
-            // <UserData>
-            // <Type xmlns="myNs">
-            // <Count> %1 </Count>
-            // <ClrInstanceID> %2 </ClrInstanceID>
-            // </Type>
-            // </UserData>
-            //let count: u32 = parser.parse("Count");
-
-            // uint32 + uint16 at the front (Count and ClrInstanceID), then struct of values. We don't need a Vec<u8> copy.
-            //let values: Vec<u8> = parser.parse("Values");
-            //let values = &s.user_buffer()[6..];
-
-            //eprintln!("Type/BulkType count: {} user_buffer size: {} values len: {}", count, s.user_buffer().len(), values.len());
-        }
-        ("CLRStack", "CLRStackWalk") => {
-            if !is_in_time_range {
-                return;
+        CoreClrEvent::GcAllocationTick(e) if is_in_time_range && gc_allocs => {
+            let type_name_str = context.intern_profile_string(&e.type_name);
+            let category = context.known_category(KnownCategory::CoreClrGc);
+            let amount = if e.allocation_amount64 != 0 { e.allocation_amount64 as usize } else { e.allocation_amount as usize };
+            let m = context.add_thread_instant_marker(
+                event_meta.timestamp,
+                event_meta.thread_id,
+                CoreClrGcAllocTickMarker(type_name_str, amount, category));
+            if let Some(stack) = event_meta.stack.as_ref() {
+                context.handle_coreclr_stack(event_meta.timestamp, event_meta.process_id, stack.iter().map(|v| *v), m);
             }
-            // If the STACK keyword is enabled, we get a CLRStackWalk following each CLR event that supports stacks. Not every event
-            // does. The info about which does and doesn't is here: https://github.com/dotnet/runtime/blob/main/src/coreclr/vm/ClrEtwAllMeta.lst
-            // Current dotnet (8.0.x) seems to have a bug where `MethodJitMemoryAllocatedForCode` events will fire a stackwalk,
-            // but the event itself doesn't end up in the trace. (https://github.com/dotnet/runtime/issues/102004)
-            if !event_stacks {
-                return;
-            }
-
-            // if we don't have anything to attach this stack to, just skip it
-            let Some(marker) = coreclr_context.remove_last_event_for_thread(tid) else {
-                return;
-            };
-
-            // "Stack" is explicitly declared as length 2 in the manifest, so the first two addresses are in here, rest
-            // are in user data buffer.
-            let first_addresses: Vec<u8> = parser.parse("Stack");
-            let address_iter = first_addresses
-                .chunks_exact(8)
-                .chain(parser.buffer.chunks_exact(8))
-                .map(|chunk| u64::from_le_bytes(chunk.try_into().unwrap()));
-
-            context.handle_coreclr_stack(timestamp_raw, tid, address_iter, marker);
-            handled = true;
         }
-        ("GarbageCollection", gc_event) => {
-            // if we're not in the range, or if the thread isn't recorded (because --main-thread-only)
-            if !is_in_time_range || !context.has_thread_at_time(tid, timestamp_raw) {
-                return;
-            }
-
-            match gc_event {
-                "GCSampledObjectAllocation" => {
-                    if !gc_allocs {
-                        return;
-                    }
-
-                    // If High/Low flags are set, then we get one of these for every alloc. Otherwise only
-                    // when a threshold is hit. (100kb) The count and size are aggregates in that case.
-                    let type_id: u64 = parser.parse("TypeID"); // TODO: convert to str, with bulk type data
-                                                               //let address: u64 = parser.parse("Address");
-                    let _object_count: u32 = parser.parse("ObjectCountForTypeSample");
-                    let total_size: u64 = parser.parse("TotalSizeForTypeSample");
-
-                    let category = context.known_category(KnownCategory::CoreClrGc);
-                    let clr_type = context.intern_profile_string(&format!("0x{:x}", type_id));
-                    let mh = context.add_thread_instant_marker(
-                        timestamp_raw,
-                        tid,
-                        CoreClrGcAllocMarker(clr_type, total_size as f64, category),
-                    );
-                    coreclr_context.set_last_event_for_thread(tid, mh);
-                    handled = true;
-                }
-                "Triggered" => {
-                    if !gc_markers {
-                        return;
-                    }
-
-                    let reason: u32 = parser.parse("Reason");
-                    let reason = GcReason::from_u32(reason).or_else(|| {
-                        eprintln!("Unknown CLR GC Triggered reason: {}", reason);
-                        None
-                    });
-
-                    let category = context.known_category(KnownCategory::CoreClrGc);
-                    let name = context.intern_profile_string("GC Trigger");
-                    let description = context.intern_profile_string(&format!(
-                        "GC Trigger: {}",
-                        DisplayUnknownIfNone(&reason)
-                    ));
-                    let mh = context.add_thread_instant_marker(
-                        timestamp_raw,
-                        tid,
-                        CoreClrGcEventMarker(name, description, category),
-                    );
-                    coreclr_context.set_last_event_for_thread(tid, mh);
-                    handled = true;
-                }
-                "GCSuspendEEBegin" => {
-                    if !gc_suspensions {
-                        return;
-                    }
-
-                    // Reason, Count
-                    let _count: u32 = parser.parse("Count");
-                    let reason: u32 = parser.parse("Reason");
-
-                    let reason = GcSuspendEeReason::from_u32(reason).or_else(|| {
-                        eprintln!("Unknown CLR GCSuspendEEBegin reason: {}", reason);
-                        None
-                    });
-
-                    coreclr_context.save_gc_marker(
-                        tid,
-                        timestamp_raw,
-                        "GCSuspendEE",
-                        "GC Suspended Thread".to_owned(),
-                        format!("Suspended: {}", DisplayUnknownIfNone(&reason)),
-                    );
-                    handled = true;
-                }
-                "GCSuspendEEEnd" | "GCRestartEEBegin" => {
-                    // don't care -- we only care about SuspendBegin and RestartEnd
-                    handled = true;
-                }
-                "GCRestartEEEnd" => {
-                    if !gc_suspensions {
-                        return;
-                    }
-
-                    if let Some(info) = coreclr_context.remove_gc_marker(tid, "GCSuspendEE") {
-                        let category = context.known_category(KnownCategory::CoreClrGc);
-                        let name = context.intern_profile_string(&info.name);
-                        let description = context.intern_profile_string(&info.description);
-                        context.add_thread_interval_marker(
-                            info.start_timestamp_raw,
-                            timestamp_raw,
-                            tid,
-                            CoreClrGcEventMarker(name, description, category),
-                        );
-                    }
-                    handled = true;
-                }
-                "win:Start" => {
-                    if !gc_markers {
-                        return;
-                    }
-
-                    let count: u32 = parser.parse("Count");
-                    let depth: u32 = parser.parse("Depth");
-                    let reason: u32 = parser.parse("Reason");
-                    let gc_type: u32 = parser.parse("Type");
-
-                    let reason = GcReason::from_u32(reason).or_else(|| {
-                        eprintln!("Unknown CLR GCStart reason: {}", reason);
-                        None
-                    });
-
-                    let gc_type = GcType::from_u32(gc_type).or_else(|| {
-                        eprintln!("Unknown CLR GCStart type: {}", gc_type);
-                        None
-                    });
-
-                    // TODO: use gc_type_str as the name
-                    coreclr_context.save_gc_marker(
-                        tid,
-                        timestamp_raw,
-                        "GC",
-                        "GC".to_owned(),
-                        format!(
-                            "{}: {} (GC #{}, gen{})",
-                            DisplayUnknownIfNone(&gc_type),
-                            DisplayUnknownIfNone(&reason),
-                            count,
-                            depth
-                        ),
-                    );
-                    handled = true;
-                }
-                "win:Stop" => {
-                    if !gc_markers {
-                        return;
-                    }
-
-                    //let count: u32 = parser.parse("Count");
-                    //let depth: u32 = parser.parse("Depth");
-                    if let Some(info) = coreclr_context.remove_gc_marker(tid, "GC") {
-                        let category = context.known_category(KnownCategory::CoreClrGc);
-                        let name = context.intern_profile_string(&info.name);
-                        let description = context.intern_profile_string(&info.description);
-                        context.add_thread_interval_marker(
-                            info.start_timestamp_raw,
-                            timestamp_raw,
-                            tid,
-                            CoreClrGcEventMarker(name, description, category),
-                        );
-                    }
-                    handled = true;
-                }
-                "SetGCHandle" => {
-                    // TODO
-                }
-                "DestroyGCHandle" => {
-                    // TODO
-                }
-                "GCFinalizersBegin" | "GCFinalizersEnd" | "FinalizeObject" => {
-                    // TODO: create an interval
-                    handled = true;
-                }
-                "GCCreateSegment" | "GCFreeSegment" | "GCDynamicEvent" | "GCHeapStats" => {
-                    // don't care
-                    handled = true;
-                }
-                _ => {
-                    // don't care
-                    handled = true;
-                }
+        CoreClrEvent::GcSampledObjectAllocation(e) if is_in_time_range && gc_allocs => {
+            let type_name_str = context.intern_profile_string(&format!("type{}", e.type_id));
+            let category = context.known_category(KnownCategory::CoreClrGc);
+            let m = context.add_thread_instant_marker(
+                event_meta.timestamp,
+                event_meta.thread_id,
+                CoreClrGcAllocMarker(type_name_str, e.total_size_for_type_sample as usize, category));
+            if let Some(stack) = event_meta.stack.as_ref() {
+                context.handle_coreclr_stack(event_meta.timestamp, event_meta.process_id, stack.iter().map(|v| *v), m);
             }
         }
-        ("CLRRuntimeInformation", _) => {
-            handled = true;
-        }
-        ("CLRLoader", _) => {
-            // AppDomain, Assembly, Module Load/Unload
-            handled = true;
+        CoreClrEvent::GcStart(_e) if is_in_time_range && gc_markers => {
+            // TODO: save this start marker, and emit a range when we get a GcEnd
+            // TODO: save this as a CoreClrGcDetailedMarker, instead of putting
+            // the types, reason, GC# and generation into a string
+            /*
+            // TODO: use gc_type_str as the name
+            coreclr_context.save_gc_marker(
+                event_meta.thread_id,
+                e.common.timestamp,
+                format!(
+                    "{}: {} (GC #{}, gen{})",
+                    DisplayUnknownIfNone(&e.gc_type),
+                    e.reason,
+                    e.count,
+                    DisplayUnknownIfNone(&e.depth)
+                ),
+            );
+            */
+        }
+        CoreClrEvent::GcEnd(_e) if is_in_time_range && gc_markers => {
+            /*
+            if let Some(info) = coreclr_context.remove_gc_marker(event_meta.thread_id, "GC") {
+                context.add_thread_interval_marker(
+                    info.start_timestamp_raw,
+                    e.common.timestamp,
+                    event_meta.thread_id,
+                    KnownCategory::CoreClrGc,
+                    &info.name,
+                    CoreClrGcEventMarker(info.description),
+                );
+            }
+            */
         }
         _ => {}
     }
-
-    if !handled && coreclr_context.unknown_event_markers {
-        let text = event_properties_to_string(s, parser, None);
-        let name = context.intern_profile_string(s.name().split_once('/').unwrap().1);
-        let description = context.intern_profile_string(&text);
-        let marker_handle = context.add_thread_instant_marker(
-            timestamp_raw,
-            tid,
-            OtherClrMarker(name, description),
-        );
-
-        coreclr_context.set_last_event_for_thread(tid, marker_handle);
-    }
-}
-
-#[derive(Debug, Clone)]
-pub struct OtherClrMarker(StringHandle, StringHandle);
-
-impl StaticSchemaMarker for OtherClrMarker {
-    const UNIQUE_MARKER_TYPE_NAME: &'static str = "OtherClrMarker";
-
-    fn schema() -> MarkerSchema {
-        MarkerSchema {
-            type_name: Self::UNIQUE_MARKER_TYPE_NAME.into(),
-            locations: vec![MarkerLocation::MarkerChart, MarkerLocation::MarkerTable],
-            chart_label: Some("{marker.data.name}".into()),
-            tooltip_label: Some("{marker.data.name}".into()),
-            table_label: Some("{marker.data.name}".into()),
-            fields: vec![MarkerFieldSchema {
-                key: "name".into(),
-                label: "Name".into(),
-                format: MarkerFieldFormat::String,
-                searchable: true,
-            }],
-            static_fields: vec![MarkerStaticField {
-                label: "Description".into(),
-                value: "CoreCLR marker of unknown type.".into(),
-            }],
-        }
-    }
-
-    fn name(&self, _profile: &mut Profile) -> StringHandle {
-        self.0
-    }
-
-    fn category(&self, _profile: &mut Profile) -> CategoryHandle {
-        CategoryHandle::OTHER
-    }
-
-    fn string_field_value(&self, _field_index: u32) -> StringHandle {
-        self.1
-    }
-
-    fn number_field_value(&self, _field_index: u32) -> f64 {
-        unreachable!()
-    }
 }
diff --git a/samply/src/windows/etw_gecko.rs b/samply/src/windows/etw_gecko.rs
index 26074c0e..5b46d684 100644
--- a/samply/src/windows/etw_gecko.rs
+++ b/samply/src/windows/etw_gecko.rs
@@ -11,10 +11,10 @@ use etw_reader::{
 use fxprof_processed_profile::debugid;
 use uuid::Uuid;
 
-use super::coreclr::CoreClrContext;
+use super::coreclr::{CoreClrContext, handle_coreclr_tracing_event};
 use super::profile_context::ProfileContext;
-use crate::windows::coreclr;
 use crate::windows::profile_context::{KnownCategory, PeInfo};
+use coreclr_tracing::etw::CoreClrEtwConverter;
 
 pub fn process_etl_files(
     context: &mut ProfileContext,
@@ -26,7 +26,9 @@ pub fn process_etl_files(
 
     let processing_start_timestamp = Instant::now();
 
-    let mut core_clr_context = CoreClrContext::new(context.creation_props());
+    let mut core_clr_context = CoreClrContext::new(context);
+
+    log::info!("Processing {}...", etl_file.to_string_lossy());
 
     let result = process_trace(
         etl_file,
@@ -40,6 +42,7 @@ pub fn process_etl_files(
     }
 
     for extra_etl_file in extra_etl_filenames {
+        log::info!("Processing {}...", etl_file.to_string_lossy());
         let result = process_trace(
             extra_etl_file,
             context,
@@ -68,6 +71,8 @@ fn process_trace(
     let demand_zero_faults = false; //pargs.contains("--demand-zero-faults");
     let mut pending_image_info: Option<((u32, u64), PeInfo)> = None;
 
+    let mut core_clr_converter = CoreClrEtwConverter::new();
+
     open_trace(etl_file, |e| {
         let Ok(s) = schema_locator.event_schema(e) else {
             return;
@@ -252,7 +257,16 @@ fn process_trace(
                 let pid = s.process_id(); // there isn't a ProcessId field here
                 let image_base: u64 = parser.try_parse("ImageBase").unwrap();
                 let image_timestamp: u32 = parser.try_parse("TimeDateStamp").unwrap();
-                let image_checksum: u32 = parser.try_parse("ImageChecksum").unwrap();
+                let image_checksum: u32 = if let Ok(checksum) = parser.try_parse("ImageChecksum") {
+                    checksum
+                } else {
+                    // This happens for pid 0 -- there's no ImageChecksum in these events. These will be seen
+                    // when importing/processing a whole-system ETL trace without filtering to processes.
+                    if pid != 0 {
+                        log::warn!("Missing ImageChecksum in KernelTraceControl/ImageID for pid {} image_base {:#x}", pid, image_base);
+                    }
+                    0
+                };
                 let image_size: u32 = parser.try_parse("ImageSize").unwrap();
                 let mut info = PeInfo::new_with_size_and_checksum(image_size, image_checksum);
                 info.image_timestamp = Some(image_timestamp);
@@ -496,13 +510,18 @@ fn process_trace(
                     return;
                 }
                 let is_in_range = context.is_in_time_range(timestamp_raw);
-                coreclr::handle_coreclr_event(
-                    context,
-                    core_clr_context,
+                if let Some(event) = core_clr_converter.etw_event_to_coreclr_event(
                     &s,
                     &mut parser,
-                    is_in_range,
-                );
+                ) {
+                    handle_coreclr_tracing_event(
+                        context,
+                        core_clr_context,
+                        &event.0,
+                        &event.1,
+                        is_in_range,
+                    );
+                }
             }
             _ => {
                 if !context.is_in_time_range(timestamp_raw) {
diff --git a/samply/src/windows/profile_context.rs b/samply/src/windows/profile_context.rs
index 3b37049c..33af5c20 100644
--- a/samply/src/windows/profile_context.rs
+++ b/samply/src/windows/profile_context.rs
@@ -1,7 +1,5 @@
 use std::collections::{BTreeMap, HashMap, VecDeque};
-use std::path::{Path, PathBuf};
-use std::str::FromStr;
-use std::sync::Arc;
+use std::path::Path;
 
 use debugid::DebugId;
 use fxprof_processed_profile::{
@@ -1888,6 +1886,10 @@ impl ProfileContext {
 
         self.profile
     }
+
+    pub fn convert_raw_timestamp(&self, ts_raw: u64) -> Timestamp {
+        self.timestamp_converter.convert_time(ts_raw)
+    }
 }
 
 #[derive(Debug, Clone)]
diff --git a/samply/src/windows/profiler.rs b/samply/src/windows/profiler.rs
index ed81937c..63181eef 100644
--- a/samply/src/windows/profiler.rs
+++ b/samply/src/windows/profiler.rs
@@ -128,11 +128,11 @@ pub fn start_recording(
 
     let (kernel_output_file, user_output_file) = elevated_helper
         .stop_xperf()
-        .expect("Should have produced a merged ETL file");
+        .expect("Should have produced ETL file(s)");
 
     elevated_helper.shutdown();
 
-    eprintln!("Processing ETL trace...");
+    eprintln!("Processing ETL files(s)...");
 
     let output_file = recording_props.output_file.clone();
 
diff --git a/samply/src/windows/xperf.rs b/samply/src/windows/xperf.rs
index dea0a743..a87f4cb7 100644
--- a/samply/src/windows/xperf.rs
+++ b/samply/src/windows/xperf.rs
@@ -40,7 +40,16 @@ impl Xperf {
         if let Some(p) = self.xperf_path.clone() {
             return Ok(p);
         }
-        let xperf_path = which::which("xperf").map_err(|_| XPERF_NOT_FOUND_ERROR_MSG)?;
+        let xperf_path = which::which("xperf")
+            .or_else(|_| {
+                let pf = std::env::var("ProgramFiles(x86)").map_err(|_| XPERF_NOT_FOUND_ERROR_MSG)?;
+                let xperf_install_path = PathBuf::from(pf).join("Windows Kits/10/Windows Performance Toolkit/xperf.exe");
+                if xperf_install_path.exists() {
+                    Ok(xperf_install_path)
+                } else {
+                    Err(XPERF_NOT_FOUND_ERROR_MSG)
+                }
+            })?;
         self.xperf_path = Some(xperf_path.clone());
         Ok(xperf_path)
     }
@@ -65,6 +74,10 @@ impl Xperf {
         user_providers.sort_unstable();
         user_providers.dedup();
 
+        // Will go to the elevated process so won't be seen, but one day we'll be able to
+        // run in-process if running as admin
+        log::trace!("xperf user providers: {:?}", user_providers);
+
         let xperf_path = self.get_xperf_path()?;
         // start xperf.exe, logging to the same location as the output file, just with a .etl
         // extension.
@@ -99,6 +112,11 @@ impl Xperf {
         xperf.arg("-f");
         xperf.arg(&kernel_etl_file);
 
+        // 1MB buffers. Default is 64Kb; 1MB is max. Default minimum buffer count
+        // is 64, max is 320, which seems totally reasonable for modern systems.
+        xperf.arg("-BufferSize");
+        xperf.arg("1024");
+
         let user_etl_file = if !user_providers.is_empty() {
             let mut user_etl_file = output_path.to_owned();
             if user_etl_file.extension() == Some(OsStr::new("gz")) {
@@ -115,6 +133,11 @@ impl Xperf {
             xperf.arg("-f");
             xperf.arg(&user_etl_file);
 
+            // 1MB buffers. Default is 64Kb; 1MB is max. Default minimum buffer count
+            // is 64, max is 320, which seems totally reasonable for modern systems.
+            xperf.arg("-BufferSize");
+            xperf.arg("1024");
+
             Some(user_etl_file)
         } else {
             None