multiline problem not solved, turns out the first doubleword is actually the message size (*duh*) not a command
fixed reading messages from sysinternals debugview
completed debugview protocol analyses including filetime and qpc timestamps (cpu frequecy dependand)