ReactOS 0.4.15-dev-5863-g1fe3ab7
file.c File Reference
#include "eventlog.h"
#include <ndk/iofuncs.h>
#include <ndk/kefuncs.h>
#include <debug.h>
Include dependency graph for file.c:

Go to the source code of this file.

Macros

#define NDEBUG
 

Functions

VOID LogfListInitialize (VOID)
 
PLOGFILE LogfListItemByName (LPCWSTR Name)
 
PLOGFILE LogfListItemByIndex (DWORD Index)
 
DWORD LogfListItemCount (VOID)
 
static VOID LogfListAddItem (PLOGFILE Item)
 
static VOID LogfListRemoveItem (PLOGFILE Item)
 
static PVOID NTAPI LogfpAlloc (IN SIZE_T Size, IN ULONG Flags, IN ULONG Tag)
 
static VOID NTAPI LogfpFree (IN PVOID Ptr, IN ULONG Flags, IN ULONG Tag)
 
static NTSTATUS NTAPI LogfpReadFile (IN PEVTLOGFILE LogFile, IN PLARGE_INTEGER FileOffset, OUT PVOID Buffer, IN SIZE_T Length, OUT PSIZE_T ReadLength OPTIONAL)
 
static NTSTATUS NTAPI LogfpWriteFile (IN PEVTLOGFILE LogFile, IN PLARGE_INTEGER FileOffset, IN PVOID Buffer, IN SIZE_T Length, OUT PSIZE_T WrittenLength OPTIONAL)
 
static NTSTATUS NTAPI LogfpSetFileSize (IN PEVTLOGFILE LogFile, IN ULONG FileSize, IN ULONG OldFileSize)
 
static NTSTATUS NTAPI LogfpFlushFile (IN PEVTLOGFILE LogFile, IN PLARGE_INTEGER FileOffset, IN ULONG Length)
 
NTSTATUS LogfCreate (PLOGFILE *LogFile, PCWSTR LogName, PUNICODE_STRING FileName, ULONG MaxSize, ULONG Retention, BOOLEAN Permanent, BOOLEAN Backup)
 
VOID LogfClose (PLOGFILE LogFile, BOOLEAN ForceClose)
 
VOID LogfCloseAll (VOID)
 
NTSTATUS LogfClearFile (PLOGFILE LogFile, PUNICODE_STRING BackupFileName)
 
NTSTATUS LogfBackupFile (PLOGFILE LogFile, PUNICODE_STRING BackupFileName)
 
static NTSTATUS ReadRecord (IN PEVTLOGFILE LogFile, IN ULONG RecordNumber, OUT PEVENTLOGRECORD Record, IN SIZE_T BufSize, OUT PSIZE_T BytesRead OPTIONAL, OUT PSIZE_T BytesNeeded OPTIONAL, IN BOOLEAN Ansi)
 
NTSTATUS LogfReadEvents (PLOGFILE LogFile, ULONG Flags, PULONG RecordNumber, ULONG BufSize, PBYTE Buffer, PULONG BytesRead, PULONG BytesNeeded, BOOLEAN Ansi)
 
NTSTATUS LogfWriteRecord (PLOGFILE LogFile, PEVENTLOGRECORD Record, SIZE_T BufSize)
 
PEVENTLOGRECORD LogfAllocAndBuildNewRecord (PSIZE_T pRecSize, ULONG Time, USHORT wType, USHORT wCategory, ULONG dwEventId, PUNICODE_STRING SourceName, PUNICODE_STRING ComputerName, ULONG dwSidLength, PSID pUserSid, USHORT wNumStrings, PWSTR pStrings, ULONG dwDataSize, PVOID pRawData)
 
VOID LogfReportEvent (USHORT wType, USHORT wCategory, ULONG dwEventId, USHORT wNumStrings, PWSTR pStrings, ULONG dwDataSize, PVOID pRawData)
 

Variables

static LIST_ENTRY LogFileListHead
 
static CRITICAL_SECTION LogFileListCs
 

Macro Definition Documentation

◆ NDEBUG

#define NDEBUG

Definition at line 17 of file file.c.

Function Documentation

◆ LogfAllocAndBuildNewRecord()

PEVENTLOGRECORD LogfAllocAndBuildNewRecord ( PSIZE_T  pRecSize,
ULONG  Time,
USHORT  wType,
USHORT  wCategory,
ULONG  dwEventId,
PUNICODE_STRING  SourceName,
PUNICODE_STRING  ComputerName,
ULONG  dwSidLength,
PSID  pUserSid,
USHORT  wNumStrings,
PWSTR  pStrings,
ULONG  dwDataSize,
PVOID  pRawData 
)

Definition at line 896 of file file.c.

909{
910 SIZE_T RecSize;
911 SIZE_T SourceNameSize, ComputerNameSize, StringLen;
913 PEVENTLOGRECORD pRec;
914 PWSTR str;
915 UINT i, pos;
916
917 SourceNameSize = (SourceName && SourceName->Buffer) ? SourceName->Length : 0;
918 ComputerNameSize = (ComputerName && ComputerName->Buffer) ? ComputerName->Length : 0;
919
920 RecSize = sizeof(EVENTLOGRECORD) + /* Add the sizes of the strings, NULL-terminated */
921 SourceNameSize + ComputerNameSize + 2*sizeof(UNICODE_NULL);
922
923 /* Align on DWORD boundary for the SID */
924 RecSize = ROUND_UP(RecSize, sizeof(ULONG));
925
926 RecSize += dwSidLength;
927
928 /* Add the sizes for the strings array */
929 ASSERT((pStrings == NULL && wNumStrings == 0) ||
930 (pStrings != NULL && wNumStrings >= 0));
931 for (i = 0, str = pStrings; i < wNumStrings; i++)
932 {
933 StringLen = wcslen(str) + 1; // str must be != NULL
934 RecSize += StringLen * sizeof(WCHAR);
935 str += StringLen;
936 }
937
938 /* Add the data size */
939 RecSize += dwDataSize;
940
941 /* Align on DWORD boundary for the full structure */
942 RecSize = ROUND_UP(RecSize, sizeof(ULONG));
943
944 /* Size of the trailing 'Length' member */
945 RecSize += sizeof(ULONG);
946
948 if (!Buffer)
949 {
950 DPRINT1("Cannot allocate heap!\n");
951 return NULL;
952 }
953
954 pRec = (PEVENTLOGRECORD)Buffer;
955 pRec->Length = RecSize;
957
958 /*
959 * Do not assign here any precomputed record number to the event record.
960 * The true record number will be assigned atomically and sequentially in
961 * LogfWriteRecord, so that all the event records will have consistent and
962 * unique record numbers.
963 */
964 pRec->RecordNumber = 0;
965
966 /*
967 * Set the generated time, and temporarily set the written time
968 * with the generated time.
969 */
970 pRec->TimeGenerated = Time;
971 pRec->TimeWritten = Time;
972
973 pRec->EventID = dwEventId;
974 pRec->EventType = wType;
975 pRec->EventCategory = wCategory;
976
977 pos = sizeof(EVENTLOGRECORD);
978
979 /* NOTE: Equivalents of RtlStringCbCopyUnicodeString calls */
980 if (SourceNameSize)
981 {
982 StringCbCopyNW((PWSTR)(Buffer + pos), SourceNameSize + sizeof(UNICODE_NULL),
983 SourceName->Buffer, SourceNameSize);
984 }
985 pos += SourceNameSize + sizeof(UNICODE_NULL);
986 if (ComputerNameSize)
987 {
988 StringCbCopyNW((PWSTR)(Buffer + pos), ComputerNameSize + sizeof(UNICODE_NULL),
989 ComputerName->Buffer, ComputerNameSize);
990 }
991 pos += ComputerNameSize + sizeof(UNICODE_NULL);
992
993 /* Align on DWORD boundary for the SID */
994 pos = ROUND_UP(pos, sizeof(ULONG));
995
996 pRec->UserSidLength = 0;
997 pRec->UserSidOffset = 0;
998 if (dwSidLength)
999 {
1000 RtlCopyMemory(Buffer + pos, pUserSid, dwSidLength);
1001 pRec->UserSidLength = dwSidLength;
1002 pRec->UserSidOffset = pos;
1003 pos += dwSidLength;
1004 }
1005
1006 pRec->StringOffset = pos;
1007 for (i = 0, str = pStrings; i < wNumStrings; i++)
1008 {
1009 StringLen = wcslen(str) + 1; // str must be != NULL
1010 StringCchCopyW((PWSTR)(Buffer + pos), StringLen, str);
1011 str += StringLen;
1012 pos += StringLen * sizeof(WCHAR);
1013 }
1014 pRec->NumStrings = wNumStrings;
1015
1016 pRec->DataLength = 0;
1017 pRec->DataOffset = 0;
1018 if (dwDataSize)
1019 {
1020 RtlCopyMemory(Buffer + pos, pRawData, dwDataSize);
1021 pRec->DataLength = dwDataSize;
1022 pRec->DataOffset = pos;
1023 pos += dwDataSize;
1024 }
1025
1026 /* Align on DWORD boundary for the full structure */
1027 pos = ROUND_UP(pos, sizeof(ULONG));
1028
1029 /* Initialize the trailing 'Length' member */
1030 *((PDWORD)(Buffer + pos)) = RecSize;
1031
1032 *pRecSize = RecSize;
1033 return pRec;
1034}
WCHAR SourceName[256]
Definition: arping.c:28
#define DPRINT1
Definition: precomp.h:8
PVOID NTAPI RtlAllocateHeap(IN PVOID HeapHandle, IN ULONG Flags, IN SIZE_T Size)
Definition: heap.c:588
Definition: bufpool.h:45
#define NULL
Definition: types.h:112
#define GetProcessHeap()
Definition: compat.h:736
#define HEAP_ZERO_MEMORY
Definition: compat.h:134
#define ROUND_UP(n, align)
Definition: eventvwr.h:34
#define LOGFILE_SIGNATURE
Definition: evtlib.h:43
GLsizei GLenum const GLvoid GLsizei GLenum GLbyte GLbyte GLbyte GLdouble GLdouble GLdouble GLfloat GLfloat GLfloat GLint GLint GLint GLshort GLshort GLshort GLubyte GLubyte GLubyte GLuint GLuint GLuint GLushort GLushort GLushort GLbyte GLbyte GLbyte GLbyte GLdouble GLdouble GLdouble GLdouble GLfloat GLfloat GLfloat GLfloat GLint GLint GLint GLint GLshort GLshort GLshort GLshort GLubyte GLubyte GLubyte GLubyte GLuint GLuint GLuint GLuint GLushort GLushort GLushort GLushort GLboolean const GLdouble const GLfloat const GLint const GLshort const GLbyte const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLdouble const GLfloat const GLfloat const GLint const GLint const GLshort const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort GLenum GLenum GLenum GLfloat GLenum GLint GLenum GLenum GLenum GLfloat GLenum GLenum GLint GLenum GLfloat GLenum GLint GLint GLushort GLenum GLenum GLfloat GLenum GLenum GLint GLfloat const GLubyte GLenum GLenum GLenum const GLfloat GLenum GLenum const GLint GLenum GLint GLint GLsizei GLsizei GLint GLenum GLenum const GLvoid GLenum GLenum const GLfloat GLenum GLenum const GLint GLenum GLenum const GLdouble GLenum GLenum const GLfloat GLenum GLenum const GLint GLsizei GLuint GLfloat GLuint GLbitfield GLfloat GLint GLuint GLboolean GLenum GLfloat GLenum GLbitfield GLenum GLfloat GLfloat GLint GLint const GLfloat GLenum GLfloat GLfloat GLint GLint GLfloat GLfloat GLint GLint const GLfloat GLint GLfloat GLfloat GLint GLfloat GLfloat GLint GLfloat GLfloat const GLdouble const GLfloat const GLdouble const GLfloat GLint i
Definition: glfuncs.h:248
_CRTIMP size_t __cdecl wcslen(_In_z_ const wchar_t *_Str)
#define ASSERT(a)
Definition: mode.c:44
static PLARGE_INTEGER Time
Definition: time.c:105
unsigned int UINT
Definition: ndis.h:50
#define UNICODE_NULL
BYTE * PBYTE
Definition: pedump.c:66
DWORD * PDWORD
Definition: pedump.c:68
const WCHAR * str
STRSAFEAPI StringCbCopyNW(STRSAFE_LPWSTR pszDest, size_t cbDest, STRSAFE_LPCWSTR pszSrc, size_t cbToCopy)
Definition: strsafe.h:255
STRSAFEAPI StringCchCopyW(STRSAFE_LPWSTR pszDest, size_t cchDest, STRSAFE_LPCWSTR pszSrc)
Definition: strsafe.h:149
DWORD StringOffset
Definition: winnt_old.h:2899
DWORD TimeGenerated
Definition: winnt_old.h:2891
DWORD RecordNumber
Definition: winnt_old.h:2890
DWORD UserSidOffset
Definition: winnt_old.h:2901
DWORD UserSidLength
Definition: winnt_old.h:2900
uint16_t * PWSTR
Definition: typedefs.h:56
ULONG_PTR SIZE_T
Definition: typedefs.h:80
#define RtlCopyMemory(Destination, Source, Length)
Definition: typedefs.h:263
uint32_t ULONG
Definition: typedefs.h:59
struct _EVENTLOGRECORD EVENTLOGRECORD
struct _EVENTLOGRECORD * PEVENTLOGRECORD
__wchar_t WCHAR
Definition: xmlstorage.h:180

Referenced by ElfrIntReportEventW(), LogfReportEvent(), and ProcessPortMessage().

◆ LogfBackupFile()

NTSTATUS LogfBackupFile ( PLOGFILE  LogFile,
PUNICODE_STRING  BackupFileName 
)

Definition at line 499 of file file.c.

501{
503 LOGFILE BackupLogFile;
506
507 DPRINT("LogfBackupFile(%p, %wZ)\n", LogFile, BackupFileName);
508
509 /* Lock the log file shared */
511
513 BackupFileName,
515 NULL,
516 NULL);
517
518 Status = NtCreateFile(&BackupLogFile.FileHandle,
522 NULL,
527 NULL,
528 0);
529 if (!NT_SUCCESS(Status))
530 {
531 DPRINT("Cannot create backup file `%wZ' (Status 0x%08lx)\n", BackupFileName, Status);
532 goto Quit;
533 }
534
535 Status = ElfBackupFile(&LogFile->LogFile,
536 &BackupLogFile.LogFile);
537
538Quit:
539 /* Close the backup file */
540 if (BackupLogFile.FileHandle != NULL)
541 NtClose(BackupLogFile.FileHandle);
542
543 /* Unlock the log file */
544 RtlReleaseResource(&LogFile->Lock);
545
546 return Status;
547}
LONG NTSTATUS
Definition: precomp.h:26
IN PUNICODE_STRING IN POBJECT_ATTRIBUTES ObjectAttributes
Definition: conport.c:36
#define TRUE
Definition: types.h:120
#define NT_SUCCESS(StatCode)
Definition: apphelp.c:32
#define GENERIC_READ
Definition: compat.h:135
#define FILE_ATTRIBUTE_NORMAL
Definition: compat.h:137
#define FILE_SHARE_READ
Definition: compat.h:136
NTSTATUS NTAPI ElfBackupFile(IN PEVTLOGFILE LogFile, IN PEVTLOGFILE BackupLogFile)
Definition: evtlib.c:979
#define FILE_CREATE
Definition: from_kernel.h:55
#define FILE_SYNCHRONOUS_IO_NONALERT
Definition: from_kernel.h:31
#define FILE_WRITE_THROUGH
Definition: from_kernel.h:26
Status
Definition: gdiplustypes.h:25
#define OBJ_CASE_INSENSITIVE
Definition: winternl.h:228
static OUT PIO_STATUS_BLOCK IoStatusBlock
Definition: pipe.c:75
#define InitializeObjectAttributes(p, n, a, r, s)
Definition: reg.c:106
NTSYSAPI BOOLEAN NTAPI RtlAcquireResourceShared(_In_ PRTL_RESOURCE Resource, _In_ BOOLEAN Wait)
NTSYSAPI VOID NTAPI RtlReleaseResource(_In_ PRTL_RESOURCE Resource)
#define SYNCHRONIZE
Definition: nt_native.h:61
NTSTATUS NTAPI NtClose(IN HANDLE Handle)
Definition: obhandle.c:3402
NTSTATUS NTAPI NtCreateFile(OUT PHANDLE FileHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes, OUT PIO_STATUS_BLOCK IoStatusBlock, IN PLARGE_INTEGER AllocationSize OPTIONAL, IN ULONG FileAttributes, IN ULONG ShareAccess, IN ULONG CreateDisposition, IN ULONG CreateOptions, IN PVOID EaBuffer OPTIONAL, IN ULONG EaLength)
#define GENERIC_WRITE
Definition: nt_native.h:90
#define DPRINT
Definition: sndvol32.h:71
RTL_RESOURCE Lock
Definition: eventlog.h:39
EVTLOGFILE LogFile
Definition: eventlog.h:36
HANDLE FileHandle
Definition: eventlog.h:37

Referenced by ElfrBackupELFW(), and LogfClearFile().

◆ LogfClearFile()

NTSTATUS LogfClearFile ( PLOGFILE  LogFile,
PUNICODE_STRING  BackupFileName 
)

Definition at line 467 of file file.c.

469{
471
472 /* Lock the log file exclusive */
474
475 if (BackupFileName->Length > 0)
476 {
477 /* Write a backup file */
478 Status = LogfBackupFile(LogFile, BackupFileName);
479 if (!NT_SUCCESS(Status))
480 {
481 DPRINT1("LogfBackupFile failed (Status 0x%08lx)\n", Status);
482 goto Quit;
483 }
484 }
485
486 Status = ElfReCreateFile(&LogFile->LogFile);
487 if (!NT_SUCCESS(Status))
488 {
489 DPRINT1("LogfInitializeNew failed (Status 0x%08lx)\n", Status);
490 }
491
492Quit:
493 /* Unlock the log file */
494 RtlReleaseResource(&LogFile->Lock);
495 return Status;
496}
NTSTATUS LogfBackupFile(PLOGFILE LogFile, PUNICODE_STRING BackupFileName)
Definition: file.c:499
NTSTATUS NTAPI ElfReCreateFile(IN PEVTLOGFILE LogFile)
Definition: evtlib.c:966
NTSYSAPI BOOLEAN NTAPI RtlAcquireResourceExclusive(_In_ PRTL_RESOURCE Resource, _In_ BOOLEAN Wait)

Referenced by ElfrClearELFW().

◆ LogfClose()

VOID LogfClose ( PLOGFILE  LogFile,
BOOLEAN  ForceClose 
)

Definition at line 428 of file file.c.

430{
431 if (LogFile == NULL)
432 return;
433
434 if (!ForceClose && LogFile->Permanent)
435 return;
436
438
439 LogfListRemoveItem(LogFile);
440
441 ElfCloseFile(&LogFile->LogFile);
442 NtClose(LogFile->FileHandle);
443 LogfpFree(LogFile->LogName, 0, 0);
444
445 RtlDeleteResource(&LogFile->Lock);
446
447 LogfpFree(LogFile, 0, TAG_ELF);
448
449 return;
450}
static VOID LogfListRemoveItem(PLOGFILE Item)
Definition: file.c:145
static VOID NTAPI LogfpFree(IN PVOID Ptr, IN ULONG Flags, IN ULONG Tag)
Definition: file.c:169
VOID NTAPI ElfCloseFile(IN PEVTLOGFILE LogFile)
Definition: evtlib.c:1179
#define TAG_ELF
Definition: evtlib.h:151
NTSYSAPI VOID NTAPI RtlDeleteResource(_In_ PRTL_RESOURCE Resource)
BOOL Permanent
Definition: eventlog.h:40
WCHAR * LogName
Definition: eventlog.h:38

Referenced by ElfDeleteEventLogHandle(), and LogfCloseAll().

◆ LogfCloseAll()

VOID LogfCloseAll ( VOID  )

Definition at line 452 of file file.c.

453{
455
457 {
459 }
460
462
464}
VOID LogfClose(PLOGFILE LogFile, BOOLEAN ForceClose)
Definition: file.c:428
static LIST_ENTRY LogFileListHead
Definition: file.c:22
static CRITICAL_SECTION LogFileListCs
Definition: file.c:23
#define IsListEmpty(ListHead)
Definition: env_spec_w32.h:954
struct _LIST_ENTRY * Flink
Definition: typedefs.h:121
#define CONTAINING_RECORD(address, type, field)
Definition: typedefs.h:260
void WINAPI LeaveCriticalSection(LPCRITICAL_SECTION)
void WINAPI EnterCriticalSection(LPCRITICAL_SECTION)
void WINAPI DeleteCriticalSection(PCRITICAL_SECTION)

Referenced by wmain().

◆ LogfCreate()

NTSTATUS LogfCreate ( PLOGFILE LogFile,
PCWSTR  LogName,
PUNICODE_STRING  FileName,
ULONG  MaxSize,
ULONG  Retention,
BOOLEAN  Permanent,
BOOLEAN  Backup 
)

Definition at line 294 of file file.c.

301{
305 FILE_STANDARD_INFORMATION FileStdInfo;
306 PLOGFILE pLogFile;
307 SIZE_T LogNameLen;
308 BOOLEAN CreateNew;
309
310 pLogFile = LogfpAlloc(sizeof(*pLogFile), HEAP_ZERO_MEMORY, TAG_ELF);
311 if (!pLogFile)
312 {
313 DPRINT1("Cannot allocate heap!\n");
314 return STATUS_NO_MEMORY;
315 }
316
317 LogNameLen = (LogName ? wcslen(LogName) : 0) + 1;
318 pLogFile->LogName = LogfpAlloc(LogNameLen * sizeof(WCHAR), HEAP_ZERO_MEMORY, 0);
319 if (pLogFile->LogName == NULL)
320 {
321 DPRINT1("Cannot allocate heap\n");
323 goto Quit;
324 }
325
326 if (LogName)
327 StringCchCopyW(pLogFile->LogName, LogNameLen, LogName);
328
330 FileName,
332 NULL,
333 NULL);
334
335 DPRINT("Going to create or open %wZ\n", FileName);
336 Status = NtCreateFile(&pLogFile->FileHandle,
337 Backup ? (GENERIC_READ | SYNCHRONIZE)
341 NULL,
344 Backup ? FILE_OPEN : FILE_OPEN_IF,
346 NULL,
347 0);
348 if (!NT_SUCCESS(Status))
349 {
350 DPRINT1("Cannot create file `%wZ' (Status 0x%08lx)\n", FileName, Status);
351 goto Quit;
352 }
353
354 CreateNew = (IoStatusBlock.Information == FILE_CREATED);
355 DPRINT("%wZ %s successfully\n", FileName, CreateNew ? "created" : "opened");
356
357 /*
358 * Retrieve the log file size and check whether the file is not too large;
359 * this log format only supports files of theoretical size < 0xFFFFFFFF .
360 *
361 * As it happens that, on Windows (and ReactOS), retrieving the End-Of-File
362 * information using NtQueryInformationFile with the FileEndOfFileInformation
363 * class is invalid (who knows why...), use instead the FileStandardInformation
364 * class, and the EndOfFile member of the returned FILE_STANDARD_INFORMATION
365 * structure will give the desired information.
366 */
369 &FileStdInfo,
370 sizeof(FileStdInfo),
372 if (!NT_SUCCESS(Status))
373 {
374 DPRINT1("EventLog: NtQueryInformationFile failed (Status 0x%08lx)\n", Status);
375 goto Quit;
376 }
377 if (FileStdInfo.EndOfFile.HighPart != 0)
378 {
379 DPRINT1("EventLog: Log `%wZ' is too large.\n", FileName);
380 Status = STATUS_EVENTLOG_FILE_CORRUPT; // STATUS_FILE_TOO_LARGE;
381 goto Quit;
382 }
383
384 DPRINT("Initializing LogFile `%S'\n", pLogFile->LogName);
385
386 Status = ElfCreateFile(&pLogFile->LogFile,
387 FileName,
388 FileStdInfo.EndOfFile.LowPart,
389 MaxSize,
390 Retention,
391 CreateNew,
392 Backup,
394 LogfpFree,
399 if (!NT_SUCCESS(Status))
400 goto Quit;
401
402 pLogFile->Permanent = Permanent;
403
404 RtlInitializeResource(&pLogFile->Lock);
405
406 LogfListAddItem(pLogFile);
407
408Quit:
409 if (!NT_SUCCESS(Status))
410 {
411 if (pLogFile->FileHandle != NULL)
412 NtClose(pLogFile->FileHandle);
413
414 if (pLogFile->LogName)
415 LogfpFree(pLogFile->LogName, 0, 0);
416
417 LogfpFree(pLogFile, 0, TAG_ELF);
418 }
419 else
420 {
421 *LogFile = pLogFile;
422 }
423
424 return Status;
425}
unsigned char BOOLEAN
static NTSTATUS NTAPI LogfpSetFileSize(IN PEVTLOGFILE LogFile, IN ULONG FileSize, IN ULONG OldFileSize)
Definition: file.c:244
static PVOID NTAPI LogfpAlloc(IN SIZE_T Size, IN ULONG Flags, IN ULONG Tag)
Definition: file.c:158
static NTSTATUS NTAPI LogfpFlushFile(IN PEVTLOGFILE LogFile, IN PLARGE_INTEGER FileOffset, IN ULONG Length)
Definition: file.c:280
static NTSTATUS NTAPI LogfpWriteFile(IN PEVTLOGFILE LogFile, IN PLARGE_INTEGER FileOffset, IN PVOID Buffer, IN SIZE_T Length, OUT PSIZE_T WrittenLength OPTIONAL)
Definition: file.c:212
static VOID LogfListAddItem(PLOGFILE Item)
Definition: file.c:137
static NTSTATUS NTAPI LogfpReadFile(IN PEVTLOGFILE LogFile, IN PLARGE_INTEGER FileOffset, OUT PVOID Buffer, IN SIZE_T Length, OUT PSIZE_T ReadLength OPTIONAL)
Definition: file.c:180
NTSTATUS NTAPI ElfCreateFile(IN OUT PEVTLOGFILE LogFile, IN PUNICODE_STRING FileName OPTIONAL, IN ULONG FileSize, IN ULONG MaxSize, IN ULONG Retention, IN BOOLEAN CreateNew, IN BOOLEAN ReadOnly, IN PELF_ALLOCATE_ROUTINE Allocate, IN PELF_FREE_ROUTINE Free, IN PELF_FILE_SET_SIZE_ROUTINE FileSetSize, IN PELF_FILE_WRITE_ROUTINE FileWrite, IN PELF_FILE_READ_ROUTINE FileRead, IN PELF_FILE_FLUSH_ROUTINE FileFlush)
Definition: evtlib.c:876
#define FILE_OPEN
Definition: from_kernel.h:54
#define FILE_OPEN_IF
Definition: from_kernel.h:56
NTSYSAPI VOID NTAPI RtlInitializeResource(_In_ PRTL_RESOURCE Resource)
#define FILE_CREATED
Definition: nt_native.h:770
NTSYSAPI NTSTATUS NTAPI NtQueryInformationFile(IN HANDLE hFile, OUT PIO_STATUS_BLOCK pIoStatusBlock, OUT PVOID FileInformationBuffer, IN ULONG FileInformationBufferLength, IN FILE_INFORMATION_CLASS FileInfoClass)
#define STATUS_NO_MEMORY
Definition: ntstatus.h:260
#define STATUS_EVENTLOG_FILE_CORRUPT
Definition: ntstatus.h:631
#define FileStandardInformation
Definition: propsheet.cpp:61
ULONG LowPart
Definition: typedefs.h:106

Referenced by ElfCreateBackupLogHandle(), and LoadLogFile().

◆ LogfListAddItem()

static VOID LogfListAddItem ( PLOGFILE  Item)
static

Definition at line 137 of file file.c.

138{
140 InsertTailList(&LogFileListHead, &Item->ListEntry);
142}
#define InsertTailList(ListHead, Entry)
_In_ WDFCOLLECTION _In_ WDFOBJECT Item

Referenced by LogfCreate().

◆ LogfListInitialize()

VOID LogfListInitialize ( VOID  )

Definition at line 27 of file file.c.

28{
31}
#define InitializeListHead(ListHead)
Definition: env_spec_w32.h:944
VOID WINAPI InitializeCriticalSection(OUT LPCRITICAL_SECTION lpCriticalSection)
Definition: synch.c:751

Referenced by wmain().

◆ LogfListItemByIndex()

PLOGFILE LogfListItemByIndex ( DWORD  Index)

Definition at line 93 of file file.c.

94{
95 PLIST_ENTRY CurrentEntry;
97 DWORD i = 1;
98
100
101 CurrentEntry = LogFileListHead.Flink;
102 while (CurrentEntry != &LogFileListHead)
103 {
104 if (i == Index)
105 {
106 Result = CONTAINING_RECORD(CurrentEntry, LOGFILE, ListEntry);
107 break;
108 }
109
110 CurrentEntry = CurrentEntry->Flink;
111 i++;
112 }
113
115 return Result;
116}
unsigned long DWORD
Definition: ntddk_ex.h:95
Definition: typedefs.h:120
_In_ WDFCOLLECTION _In_ ULONG Index
_At_(*)(_In_ PWSK_CLIENT Client, _In_opt_ PUNICODE_STRING NodeName, _In_opt_ PUNICODE_STRING ServiceName, _In_opt_ ULONG NameSpace, _In_opt_ GUID *Provider, _In_opt_ PADDRINFOEXW Hints, _Outptr_ PADDRINFOEXW *Result, _In_opt_ PEPROCESS OwningProcess, _In_opt_ PETHREAD OwningThread, _Inout_ PIRP Irp Result)(Mem)) NTSTATUS(WSKAPI *PFN_WSK_GET_ADDRESS_INFO
Definition: wsk.h:426

Referenced by ElfCreateEventLogHandle().

◆ LogfListItemByName()

PLOGFILE LogfListItemByName ( LPCWSTR  Name)

Definition at line 33 of file file.c.

34{
35 PLIST_ENTRY CurrentEntry;
37
38 ASSERT(Name);
39
41
42 CurrentEntry = LogFileListHead.Flink;
43 while (CurrentEntry != &LogFileListHead)
44 {
45 Item = CONTAINING_RECORD(CurrentEntry, LOGFILE, ListEntry);
46
47 if (Item->LogName && !_wcsicmp(Item->LogName, Name))
48 {
49 Result = Item;
50 break;
51 }
52
53 CurrentEntry = CurrentEntry->Flink;
54 }
55
57 return Result;
58}
_Check_return_ _CRTIMP int __cdecl _wcsicmp(_In_z_ const wchar_t *_Str1, _In_z_ const wchar_t *_Str2)

Referenced by ElfCreateEventLogHandle(), and ProcessPortMessage().

◆ LogfListItemCount()

DWORD LogfListItemCount ( VOID  )

Definition at line 118 of file file.c.

119{
120 PLIST_ENTRY CurrentEntry;
121 DWORD i = 0;
122
124
125 CurrentEntry = LogFileListHead.Flink;
126 while (CurrentEntry != &LogFileListHead)
127 {
128 CurrentEntry = CurrentEntry->Flink;
129 i++;
130 }
131
133 return i;
134}

Referenced by ElfCreateEventLogHandle().

◆ LogfListRemoveItem()

static VOID LogfListRemoveItem ( PLOGFILE  Item)
static

Definition at line 145 of file file.c.

146{
148 RemoveEntryList(&Item->ListEntry);
150}
#define RemoveEntryList(Entry)
Definition: env_spec_w32.h:986

Referenced by LogfClose().

◆ LogfpAlloc()

static PVOID NTAPI LogfpAlloc ( IN SIZE_T  Size,
IN ULONG  Flags,
IN ULONG  Tag 
)
static

Definition at line 158 of file file.c.

161{
164}
#define UNREFERENCED_PARAMETER(P)
Definition: ntbasedef.h:317
_Must_inspect_result_ _In_ WDFDEVICE _In_ BOOLEAN _In_opt_ PVOID Tag
Definition: wdfdevice.h:4065
_Must_inspect_result_ _In_ WDFDEVICE _In_ PWDF_DEVICE_PROPERTY_DATA _In_ DEVPROPTYPE _In_ ULONG Size
Definition: wdfdevice.h:4533
_Must_inspect_result_ _In_ ULONG Flags
Definition: wsk.h:170

Referenced by LogfCreate(), and ReadRecord().

◆ LogfpFlushFile()

static NTSTATUS NTAPI LogfpFlushFile ( IN PEVTLOGFILE  LogFile,
IN PLARGE_INTEGER  FileOffset,
IN ULONG  Length 
)
static

Definition at line 280 of file file.c.

283{
284 PLOGFILE pLogFile = (PLOGFILE)LogFile;
286
289
290 return NtFlushBuffersFile(pLogFile->FileHandle, &IoStatusBlock);
291}
_In_ PFCB _In_ LONGLONG FileOffset
Definition: cdprocs.h:160
struct _LOGFILE * PLOGFILE
NTSTATUS NTAPI NtFlushBuffersFile(IN HANDLE FileHandle, OUT PIO_STATUS_BLOCK IoStatusBlock)
Definition: iofunc.c:1487
_In_ ULONG _In_ ULONG _In_ ULONG Length
Definition: ntddpcm.h:102

Referenced by LogfCreate().

◆ LogfpFree()

static VOID NTAPI LogfpFree ( IN PVOID  Ptr,
IN ULONG  Flags,
IN ULONG  Tag 
)
static

Definition at line 169 of file file.c.

172{
175}
BOOLEAN NTAPI RtlFreeHeap(IN PVOID HeapHandle, IN ULONG Flags, IN PVOID HeapBase)
Definition: heap.c:606
_Must_inspect_result_ _In_ PFSRTL_PER_STREAM_CONTEXT Ptr
Definition: fsrtlfuncs.h:898

Referenced by LogfClose(), LogfCreate(), and ReadRecord().

◆ LogfpReadFile()

static NTSTATUS NTAPI LogfpReadFile ( IN PEVTLOGFILE  LogFile,
IN PLARGE_INTEGER  FileOffset,
OUT PVOID  Buffer,
IN SIZE_T  Length,
OUT PSIZE_T ReadLength  OPTIONAL 
)
static

Definition at line 180 of file file.c.

185{
187 PLOGFILE pLogFile = (PLOGFILE)LogFile;
189
190 if (ReadLength)
191 *ReadLength = 0;
192
193 Status = NtReadFile(pLogFile->FileHandle,
194 NULL,
195 NULL,
196 NULL,
198 Buffer,
199 Length,
201 NULL);
202
203 if (ReadLength)
205
206 return Status;
207}
ULONG ReadLength
NTSTATUS NTAPI NtReadFile(HANDLE FileHandle, HANDLE Event, PIO_APC_ROUTINE ApcRoutine, PVOID ApcContext, PIO_STATUS_BLOCK IoStatusBlock, PVOID Buffer, ULONG Length, PLARGE_INTEGER ByteOffset, PULONG Key)

Referenced by LogfCreate().

◆ LogfpSetFileSize()

static NTSTATUS NTAPI LogfpSetFileSize ( IN PEVTLOGFILE  LogFile,
IN ULONG  FileSize,
IN ULONG  OldFileSize 
)
static

Definition at line 244 of file file.c.

247{
249 PLOGFILE pLogFile = (PLOGFILE)LogFile;
252 FILE_ALLOCATION_INFORMATION FileAllocInfo;
253
254 UNREFERENCED_PARAMETER(OldFileSize);
255
256 // FIXME: Should we round up FileSize ??
257
258 FileEofInfo.EndOfFile.QuadPart = FileSize;
261 &FileEofInfo,
262 sizeof(FileEofInfo),
264 if (!NT_SUCCESS(Status))
265 return Status;
266
267 FileAllocInfo.AllocationSize.QuadPart = FileSize;
270 &FileAllocInfo,
271 sizeof(FileAllocInfo),
273
274 return Status;
275}
@ FileEndOfFileInformation
Definition: from_kernel.h:81
@ FileAllocationInformation
Definition: from_kernel.h:80
_Must_inspect_result_ _Out_ PLARGE_INTEGER FileSize
Definition: fsrtlfuncs.h:108
NTSYSAPI NTSTATUS NTAPI NtSetInformationFile(IN HANDLE hFile, OUT PIO_STATUS_BLOCK pIoStatusBlock, IN PVOID FileInformationBuffer, IN ULONG FileInformationBufferLength, IN FILE_INFORMATION_CLASS FileInfoClass)
Definition: iofunc.c:3096
LARGE_INTEGER AllocationSize
Definition: winternl.h:688
LONGLONG QuadPart
Definition: typedefs.h:114

Referenced by LogfCreate().

◆ LogfpWriteFile()

static NTSTATUS NTAPI LogfpWriteFile ( IN PEVTLOGFILE  LogFile,
IN PLARGE_INTEGER  FileOffset,
IN PVOID  Buffer,
IN SIZE_T  Length,
OUT PSIZE_T WrittenLength  OPTIONAL 
)
static

Definition at line 212 of file file.c.

217{
219 PLOGFILE pLogFile = (PLOGFILE)LogFile;
221
222 if (WrittenLength)
223 *WrittenLength = 0;
224
225 Status = NtWriteFile(pLogFile->FileHandle,
226 NULL,
227 NULL,
228 NULL,
230 Buffer,
231 Length,
233 NULL);
234
235 if (WrittenLength)
236 *WrittenLength = IoStatusBlock.Information;
237
238 return Status;
239}
NTSYSAPI NTSTATUS NTAPI NtWriteFile(IN HANDLE hFile, IN HANDLE hEvent OPTIONAL, IN PIO_APC_ROUTINE IoApcRoutine OPTIONAL, IN PVOID IoApcContext OPTIONAL, OUT PIO_STATUS_BLOCK pIoStatusBlock, IN PVOID WriteBuffer, IN ULONG WriteBufferLength, IN PLARGE_INTEGER FileOffset OPTIONAL, IN PULONG LockOperationKey OPTIONAL)

Referenced by LogfCreate().

◆ LogfReadEvents()

NTSTATUS LogfReadEvents ( PLOGFILE  LogFile,
ULONG  Flags,
PULONG  RecordNumber,
ULONG  BufSize,
PBYTE  Buffer,
PULONG  BytesRead,
PULONG  BytesNeeded,
BOOLEAN  Ansi 
)

Definition at line 721 of file file.c.

729{
731 ULONG RecNum;
732 SIZE_T ReadLength, NeededSize;
733 ULONG BufferUsage;
734
735 /* Parameters validation */
736
737 /* EVENTLOG_SEQUENTIAL_READ and EVENTLOG_SEEK_READ are mutually exclusive */
740
743
744 /* EVENTLOG_FORWARDS_READ and EVENTLOG_BACKWARDS_READ are mutually exclusive */
747
750
751 if (!Buffer || !BytesRead || !BytesNeeded)
753
754 /* In seek read mode, a record number of 0 is invalid */
755 if (!(Flags & EVENTLOG_SEQUENTIAL_READ) && (*RecordNumber == 0))
757
758 /* Lock the log file shared */
760
761 /*
762 * In sequential read mode, a record number of 0 means we need
763 * to determine where to start the read operation. Otherwise
764 * we just use the provided record number.
765 */
766 if ((Flags & EVENTLOG_SEQUENTIAL_READ) && (*RecordNumber == 0))
767 {
769 {
770 *RecordNumber = ElfGetOldestRecord(&LogFile->LogFile);
771 }
772 else // if (Flags & EVENTLOG_BACKWARDS_READ)
773 {
774 *RecordNumber = ElfGetCurrentRecord(&LogFile->LogFile) - 1;
775 }
776 }
777
778 RecNum = *RecordNumber;
779
780 *BytesRead = 0;
781 *BytesNeeded = 0;
782
783 BufferUsage = 0;
784 do
785 {
786 Status = ReadRecord(&LogFile->LogFile,
787 RecNum,
788 (PEVENTLOGRECORD)(Buffer + BufferUsage),
789 BufSize - BufferUsage,
790 &ReadLength,
791 &NeededSize,
792 Ansi);
794 {
795 if (BufferUsage == 0)
796 {
798 goto Quit;
799 }
800 else
801 {
802 break;
803 }
804 }
805 else
807 {
808 if (BufferUsage == 0)
809 {
810 *BytesNeeded = NeededSize;
811 // Status = STATUS_BUFFER_TOO_SMALL;
812 goto Quit;
813 }
814 else
815 {
816 break;
817 }
818 }
819 else
820 if (!NT_SUCCESS(Status))
821 {
822 DPRINT1("ElfReadRecord failed (Status 0x%08lx)\n", Status);
823 goto Quit;
824 }
825
826 /* Go to the next event record */
827 /*
828 * NOTE: This implicitly supposes that all the other record numbers
829 * are consecutive (and do not jump than more than one unit); but if
830 * it is not the case, then we would prefer here to call some
831 * "get_next_record_number" function.
832 */
834 RecNum++;
835 else // if (Flags & EVENTLOG_BACKWARDS_READ)
836 RecNum--;
837
838 BufferUsage += ReadLength;
839 }
840 while (BufferUsage <= BufSize);
841
842 *BytesRead = BufferUsage;
843 *RecordNumber = RecNum;
844
846
847Quit:
848 /* Unlock the log file */
849 RtlReleaseResource(&LogFile->Lock);
850
851 if (!NT_SUCCESS(Status))
852 DPRINT1("LogfReadEvents failed (Status 0x%08lx)\n", Status);
853
854 return Status;
855}
#define BufSize
Definition: FsRtlTunnel.c:28
static NTSTATUS ReadRecord(IN PEVTLOGFILE LogFile, IN ULONG RecordNumber, OUT PEVENTLOGRECORD Record, IN SIZE_T BufSize, OUT PSIZE_T BytesRead OPTIONAL, OUT PSIZE_T BytesNeeded OPTIONAL, IN BOOLEAN Ansi)
Definition: file.c:551
ULONG NTAPI ElfGetOldestRecord(IN PEVTLOGFILE LogFile)
Definition: evtlib.c:1589
ULONG NTAPI ElfGetCurrentRecord(IN PEVTLOGFILE LogFile)
Definition: evtlib.c:1598
#define STATUS_END_OF_FILE
Definition: shellext.h:67
#define STATUS_SUCCESS
Definition: shellext.h:65
#define STATUS_NOT_FOUND
Definition: shellext.h:72
#define STATUS_BUFFER_TOO_SMALL
Definition: shellext.h:69
#define STATUS_INVALID_PARAMETER
Definition: udferr_usr.h:135
_Must_inspect_result_ _In_ WDFIOTARGET _In_opt_ WDFREQUEST _In_opt_ PWDF_MEMORY_DESCRIPTOR _In_opt_ PLONGLONG _In_opt_ PWDF_REQUEST_SEND_OPTIONS _Out_opt_ PULONG_PTR BytesRead
Definition: wdfiotarget.h:870
#define EVENTLOG_SEQUENTIAL_READ
Definition: winnt_old.h:2875
#define EVENTLOG_BACKWARDS_READ
Definition: winnt_old.h:2878
#define EVENTLOG_FORWARDS_READ
Definition: winnt_old.h:2877
#define EVENTLOG_SEEK_READ
Definition: winnt_old.h:2876

Referenced by ElfrReadELA(), and ElfrReadELW().

◆ LogfReportEvent()

VOID LogfReportEvent ( USHORT  wType,
USHORT  wCategory,
ULONG  dwEventId,
USHORT  wNumStrings,
PWSTR  pStrings,
ULONG  dwDataSize,
PVOID  pRawData 
)

Definition at line 1037 of file file.c.

1044{
1046 UNICODE_STRING SourceName, ComputerName;
1047 PEVENTLOGRECORD LogBuffer;
1048 LARGE_INTEGER SystemTime;
1049 ULONG Time;
1050 SIZE_T RecSize;
1051 DWORD dwComputerNameLength;
1052 WCHAR szComputerName[MAX_COMPUTERNAME_LENGTH + 1];
1053
1054 if (!EventLogSource)
1055 return;
1056
1058
1059 dwComputerNameLength = ARRAYSIZE(szComputerName);
1060 if (!GetComputerNameW(szComputerName, &dwComputerNameLength))
1061 szComputerName[0] = L'\0';
1062
1063 RtlInitUnicodeString(&ComputerName, szComputerName);
1064
1065 NtQuerySystemTime(&SystemTime);
1066 RtlTimeToSecondsSince1970(&SystemTime, &Time);
1067
1068 LogBuffer = LogfAllocAndBuildNewRecord(&RecSize,
1069 Time,
1070 wType,
1071 wCategory,
1072 dwEventId,
1073 &SourceName,
1074 &ComputerName,
1075 0,
1076 NULL,
1077 wNumStrings,
1078 pStrings,
1079 dwDataSize,
1080 pRawData);
1081 if (LogBuffer == NULL)
1082 {
1083 DPRINT1("LogfAllocAndBuildNewRecord failed!\n");
1084 return;
1085 }
1086
1087 Status = LogfWriteRecord(EventLogSource->LogFile, LogBuffer, RecSize);
1088 if (!NT_SUCCESS(Status))
1089 {
1090 DPRINT1("ERROR writing to event log `%S' (Status 0x%08lx)\n",
1092 }
1093
1094 LogfFreeRecord(LogBuffer);
1095}
PEVENTSOURCE EventLogSource
Definition: eventlog.c:35
NTSTATUS LogfWriteRecord(PLOGFILE LogFile, PEVENTLOGRECORD Record, SIZE_T BufSize)
Definition: file.c:858
PEVENTLOGRECORD LogfAllocAndBuildNewRecord(PSIZE_T pRecSize, ULONG Time, USHORT wType, USHORT wCategory, ULONG dwEventId, PUNICODE_STRING SourceName, PUNICODE_STRING ComputerName, ULONG dwSidLength, PSID pUserSid, USHORT wNumStrings, PWSTR pStrings, ULONG dwDataSize, PVOID pRawData)
Definition: file.c:896
BOOL WINAPI GetComputerNameW(LPWSTR lpBuffer, LPDWORD lpnSize)
Definition: compname.c:446
#define ARRAYSIZE(array)
Definition: filtermapper.c:47
static __inline void LogfFreeRecord(PEVENTLOGRECORD Record)
Definition: eventlog.h:143
BOOLEAN NTAPI RtlTimeToSecondsSince1970(PLARGE_INTEGER Time, PULONG ElapsedSeconds)
NTSYSAPI VOID NTAPI RtlInitUnicodeString(PUNICODE_STRING DestinationString, PCWSTR SourceString)
NTSTATUS NTAPI NtQuerySystemTime(OUT PLARGE_INTEGER SystemTime)
Definition: time.c:472
#define L(x)
Definition: ntvdm.h:50
WCHAR szName[1]
Definition: eventlog.h:48
PLOGFILE LogFile
Definition: eventlog.h:47
#define MAX_COMPUTERNAME_LENGTH
Definition: winbase.h:243

Referenced by ReportProductInfoEvent(), ServiceControlHandler(), and ServiceMain().

◆ LogfWriteRecord()

NTSTATUS LogfWriteRecord ( PLOGFILE  LogFile,
PEVENTLOGRECORD  Record,
SIZE_T  BufSize 
)

Definition at line 858 of file file.c.

861{
863 LARGE_INTEGER SystemTime;
864
865 // ASSERT(sizeof(*Record) == sizeof(RecBuf));
866
867 if (!Record || BufSize < sizeof(*Record))
869
870 /* Lock the log file exclusive */
872
873 /*
874 * Retrieve the record written time now, that will also be compared
875 * with the existing events timestamps in case the log is wrapping.
876 */
877 NtQuerySystemTime(&SystemTime);
878 RtlTimeToSecondsSince1970(&SystemTime, &Record->TimeWritten);
879
882 {
883 /* The event log file is full, queue a message box for the user and exit */
884 // TODO!
885 DPRINT1("Log file `%S' is full!\n", LogFile->LogName);
886 }
887
888 /* Unlock the log file */
889 RtlReleaseResource(&LogFile->Lock);
890
891 return Status;
892}
NTSTATUS NTAPI ElfWriteRecord(IN PEVTLOGFILE LogFile, IN PEVENTLOGRECORD Record, IN SIZE_T BufSize)
Definition: evtlib.c:1269
#define STATUS_LOG_FILE_FULL
Definition: ntstatus.h:625
_In_ struct _KBUGCHECK_REASON_CALLBACK_RECORD * Record
Definition: ketypes.h:256

Referenced by ElfrIntReportEventW(), LogfReportEvent(), and ProcessPortMessage().

◆ ReadRecord()

static NTSTATUS ReadRecord ( IN PEVTLOGFILE  LogFile,
IN ULONG  RecordNumber,
OUT PEVENTLOGRECORD  Record,
IN SIZE_T  BufSize,
OUT PSIZE_T BytesRead  OPTIONAL,
OUT PSIZE_T BytesNeeded  OPTIONAL,
IN BOOLEAN  Ansi 
)
static

Definition at line 551 of file file.c.

558{
560 PEVENTLOGRECORD UnicodeBuffer = NULL;
561 PEVENTLOGRECORD Src, Dst;
562 ANSI_STRING StringA;
564 PVOID SrcPtr, DstPtr;
565 DWORD i;
566 DWORD dwPadding;
567 DWORD dwRecordLength;
568 PDWORD pLength;
569
570 if (!Ansi)
571 {
572 return ElfReadRecord(LogFile,
573 RecordNumber,
574 Record,
575 BufSize,
576 BytesRead,
577 BytesNeeded);
578 }
579
580 if (BytesRead)
581 *BytesRead = 0;
582
583 if (BytesNeeded)
584 *BytesNeeded = 0;
585
587 if (UnicodeBuffer == NULL)
588 {
589 DPRINT1("Alloc failed!\n");
590 return STATUS_NO_MEMORY;
591 }
592
593 Status = ElfReadRecord(LogFile,
594 RecordNumber,
595 UnicodeBuffer,
596 BufSize,
597 BytesRead,
598 BytesNeeded);
599 if (!NT_SUCCESS(Status))
600 goto Quit;
601
602 Src = UnicodeBuffer;
603 Dst = Record;
604
605 Dst->Reserved = Src->Reserved;
606 Dst->RecordNumber = Src->RecordNumber;
607 Dst->TimeGenerated = Src->TimeGenerated;
608 Dst->TimeWritten = Src->TimeWritten;
609 Dst->EventID = Src->EventID;
610 Dst->EventType = Src->EventType;
611 Dst->EventCategory = Src->EventCategory;
612 Dst->NumStrings = Src->NumStrings;
613 Dst->UserSidLength = Src->UserSidLength;
614 Dst->DataLength = Src->DataLength;
615
616 SrcPtr = (PVOID)((ULONG_PTR)Src + sizeof(EVENTLOGRECORD));
617 DstPtr = (PVOID)((ULONG_PTR)Dst + sizeof(EVENTLOGRECORD));
618
619 /* Convert the module name */
622 if (NT_SUCCESS(Status))
623 {
624 RtlCopyMemory(DstPtr, StringA.Buffer, StringA.MaximumLength);
625 DstPtr = (PVOID)((ULONG_PTR)DstPtr + StringA.MaximumLength);
626
627 RtlFreeAnsiString(&StringA);
628 }
629 else
630 {
631 RtlZeroMemory(DstPtr, StringW.MaximumLength / sizeof(WCHAR));
632 DstPtr = (PVOID)((ULONG_PTR)DstPtr + StringW.MaximumLength / sizeof(WCHAR));
633 }
634 SrcPtr = (PVOID)((ULONG_PTR)SrcPtr + StringW.MaximumLength);
635
636 /* Convert the computer name */
639 if (NT_SUCCESS(Status))
640 {
641 RtlCopyMemory(DstPtr, StringA.Buffer, StringA.MaximumLength);
642 DstPtr = (PVOID)((ULONG_PTR)DstPtr + StringA.MaximumLength);
643
644 RtlFreeAnsiString(&StringA);
645 }
646 else
647 {
648 RtlZeroMemory(DstPtr, StringW.MaximumLength / sizeof(WCHAR));
649 DstPtr = (PVOID)((ULONG_PTR)DstPtr + StringW.MaximumLength / sizeof(WCHAR));
650 }
651
652 /* Add the padding and the User SID */
653 dwPadding = sizeof(ULONG) - (((ULONG_PTR)DstPtr - (ULONG_PTR)Dst) % sizeof(ULONG));
654 RtlZeroMemory(DstPtr, dwPadding);
655
656 SrcPtr = (PVOID)((ULONG_PTR)Src + Src->UserSidOffset);
657 DstPtr = (PVOID)((ULONG_PTR)DstPtr + dwPadding);
658
659 Dst->UserSidOffset = (DWORD)((ULONG_PTR)DstPtr - (ULONG_PTR)Dst);
660 RtlCopyMemory(DstPtr, SrcPtr, Src->UserSidLength);
661
662 /* Convert the strings */
663 SrcPtr = (PVOID)((ULONG_PTR)Src + Src->StringOffset);
664 DstPtr = (PVOID)((ULONG_PTR)DstPtr + Src->UserSidLength);
665 Dst->StringOffset = (DWORD)((ULONG_PTR)DstPtr - (ULONG_PTR)Dst);
666
667 for (i = 0; i < Dst->NumStrings; i++)
668 {
671 if (NT_SUCCESS(Status))
672 {
673 RtlCopyMemory(DstPtr, StringA.Buffer, StringA.MaximumLength);
674 DstPtr = (PVOID)((ULONG_PTR)DstPtr + StringA.MaximumLength);
675
676 RtlFreeAnsiString(&StringA);
677 }
678 else
679 {
680 RtlZeroMemory(DstPtr, StringW.MaximumLength / sizeof(WCHAR));
681 DstPtr = (PVOID)((ULONG_PTR)DstPtr + StringW.MaximumLength / sizeof(WCHAR));
682 }
683 SrcPtr = (PVOID)((ULONG_PTR)SrcPtr + StringW.MaximumLength);
684 }
685
686 /* Copy the binary data */
687 SrcPtr = (PVOID)((ULONG_PTR)Src + Src->DataOffset);
688 Dst->DataOffset = (ULONG_PTR)DstPtr - (ULONG_PTR)Dst;
689 RtlCopyMemory(DstPtr, SrcPtr, Src->DataLength);
690 DstPtr = (PVOID)((ULONG_PTR)DstPtr + Src->DataLength);
691
692 /* Add the padding */
693 dwPadding = sizeof(ULONG) - (((ULONG_PTR)DstPtr - (ULONG_PTR)Dst) % sizeof(ULONG));
694 RtlZeroMemory(DstPtr, dwPadding);
695
696 /* Set the record length at the beginning and the end of the record */
697 dwRecordLength = (DWORD)((ULONG_PTR)DstPtr + dwPadding + sizeof(ULONG) - (ULONG_PTR)Dst);
698 Dst->Length = dwRecordLength;
699 pLength = (PDWORD)((ULONG_PTR)DstPtr + dwPadding);
700 *pLength = dwRecordLength;
701
702 if (BytesRead)
703 *BytesRead = dwRecordLength;
704
706
707Quit:
708 LogfpFree(UnicodeBuffer, 0, TAG_ELF_BUF);
709
710 return Status;
711}
#define ULONG_PTR
Definition: config.h:101
NTSTATUS NTAPI ElfReadRecord(IN PEVTLOGFILE LogFile, IN ULONG RecordNumber, OUT PEVENTLOGRECORD Record, IN SIZE_T BufSize, OUT PSIZE_T BytesRead OPTIONAL, OUT PSIZE_T BytesNeeded OPTIONAL)
Definition: evtlib.c:1197
#define TAG_ELF_BUF
Definition: evtlib.h:152
static const WCHAR StringW[]
Definition: global.c:49
#define Dst
Definition: mesh.h:153
NTSYSAPI NTSTATUS NTAPI RtlUnicodeStringToAnsiString(PANSI_STRING DestinationString, PUNICODE_STRING SourceString, BOOLEAN AllocateDestinationString)
NTSYSAPI VOID NTAPI RtlFreeAnsiString(PANSI_STRING AnsiString)
#define DWORD
Definition: nt_native.h:44
USHORT MaximumLength
Definition: env_spec_w32.h:377
void * PVOID
Definition: typedefs.h:50
#define RtlZeroMemory(Destination, Length)
Definition: typedefs.h:262
uint32_t ULONG_PTR
Definition: typedefs.h:65

Referenced by LogfReadEvents().

Variable Documentation

◆ LogFileListCs

◆ LogFileListHead