parse ETW using C#

Question

I'm trying to consume Event Trace for Windows(ETW) from provider "Active Directory Domain Services: Core"^[1].
I've collect events successfully, event names are parse correctly, however most payload can not be parsed.
By using the example code below, I can parse nothing but timestamp.
Rest print [CANT PARSE]

Is "Active Directory Domain Services: Core" a Classic provider or Manifest-based provider?
How to parse these payload?

remark

1. "Active Directory Domain Services: Core" is a etw provider for Active Directory Domain Services.
2. The question is raised under the environment of Windows Server 2012 R2 with Active Directory Domain Services enabled

Code

using Diagnostics.Tracing;
using Diagnostics.Tracing.Parsers;
using System;
using System.Diagnostics;
using System.IO;

namespace ProcessMonitor
{
    class Program
    {
        static int Main(string[] args)
        {
            if (!(TraceEventSession.IsElevated() ?? false))
            {
                Console.WriteLine("To turn on ETW events you need to be Administrator, please run from an Admin process.");
                return -1;
            }

            var sessionName = "ProessMonitorSession";
            using (var session = new TraceEventSession(sessionName, null))
            {
                session.StopOnDispose = true;

                Console.CancelKeyPress += delegate(object sender, ConsoleCancelEventArgs e) { session.Dispose(); };

                using (var source = new ETWTraceEventSource(sessionName, TraceEventSourceType.Session))
                {
                    Action<TraceEvent> action = delegate(TraceEvent data)
                    {
                        var taskName = data.TaskName;
                        var eventName = data.EventName;
                        if (taskName == "DsDirSearch" && eventName == "DsDirSearch/Start")
                        {
                            Console.WriteLine("{0:yyyy-MM-dd HH:mm:ss.fff}: {1}, {2}, {3}, {4}, {5}, {6}, {7}", 
                                data.TimeStamp,
                                data.PayloadByName("Signature"),
                                data.PayloadByName("caller"),
                                data.PayloadByName("Choice"),
                                data.PayloadByName("CommonArgs"),
                                data.PayloadByName("Null7"),
                                data.PayloadByName("Null8"),
                                data.PayloadByName("ObjDN"));
                        }
                    };

                    var registeredParser = new RegisteredTraceEventParser(source);
                    registeredParser.All += action;

                    var processProviderGuid = TraceEventSession.GetProviderByName("Active Directory Domain Services: Core");
                    if (processProviderGuid == Guid.Empty)
                    {
                        Console.WriteLine("Error could not find Microsoft-Windows-Kernel-Process etw provider.");
                        return -1;
                    }

                    session.EnableProvider(processProviderGuid, TraceEventLevel.Informational, 0x254);

                    Console.WriteLine("Starting Listening for events");
                    source.Process();
                    Console.WriteLine();
                    Console.WriteLine("Stopping Listening for events");
                }
            }
            return 0;
        }
    }

}