53 CurrentEntry = CurrentEntry->
Flink;
83 CurrentEntry = CurrentEntry->
Flink;
110 CurrentEntry = CurrentEntry->
Flink;
128 CurrentEntry = CurrentEntry->
Flink;
271 sizeof(FileAllocInfo),
313 DPRINT1(
"Cannot allocate heap!\n");
317 LogNameLen = (LogName ?
wcslen(LogName) : 0) + 1;
321 DPRINT1(
"Cannot allocate heap\n");
355 DPRINT(
"%wZ %s successfully\n",
FileName, CreateNew ?
"created" :
"opened");
374 DPRINT1(
"EventLog: NtQueryInformationFile failed (Status 0x%08lx)\n",
Status);
475 if (BackupFileName->
Length > 0)
489 DPRINT1(
"LogfInitializeNew failed (Status 0x%08lx)\n",
Status);
507 DPRINT(
"LogfBackupFile(%p, %wZ)\n", LogFile, BackupFileName);
531 DPRINT(
"Cannot create backup file `%wZ' (Status 0x%08lx)\n", BackupFileName,
Status);
564 PVOID SrcPtr, DstPtr;
567 DWORD dwRecordLength;
587 if (UnicodeBuffer ==
NULL)
667 for (
i = 0;
i <
Dst->NumStrings;
i++)
698 Dst->Length = dwRecordLength;
732 SIZE_T ReadLength, NeededSize;
778 RecNum = *RecordNumber;
795 if (BufferUsage == 0)
808 if (BufferUsage == 0)
810 *BytesNeeded = NeededSize;
838 BufferUsage += ReadLength;
840 while (BufferUsage <=
BufSize);
843 *RecordNumber = RecNum;
911 SIZE_T SourceNameSize, ComputerNameSize, StringLen;
918 ComputerNameSize = (ComputerName && ComputerName->
Buffer) ? ComputerName->
Length : 0;
921 SourceNameSize + ComputerNameSize + 2*
sizeof(
UNICODE_NULL);
926 RecSize += dwSidLength;
929 ASSERT((pStrings ==
NULL && wNumStrings == 0) ||
930 (pStrings !=
NULL && wNumStrings >= 0));
931 for (
i = 0,
str = pStrings;
i < wNumStrings;
i++)
934 RecSize += StringLen *
sizeof(
WCHAR);
939 RecSize += dwDataSize;
945 RecSize +=
sizeof(
ULONG);
950 DPRINT1(
"Cannot allocate heap!\n");
986 if (ComputerNameSize)
989 ComputerName->
Buffer, ComputerNameSize);
1007 for (
i = 0,
str = pStrings;
i < wNumStrings;
i++)
1032 *pRecSize = RecSize;
1051 DWORD dwComputerNameLength;
1059 dwComputerNameLength =
ARRAYSIZE(szComputerName);
1061 szComputerName[0] =
L'\0';
1081 if (LogBuffer ==
NULL)
1083 DPRINT1(
"LogfAllocAndBuildNewRecord failed!\n");
1090 DPRINT1(
"ERROR writing to event log `%S' (Status 0x%08lx)\n",
ULONG NTAPI ElfGetOldestRecord(IN PEVTLOGFILE LogFile)
IN PUNICODE_STRING IN POBJECT_ATTRIBUTES ObjectAttributes
VOID LogfClose(PLOGFILE LogFile, BOOLEAN ForceClose)
static NTSTATUS NTAPI LogfpWriteFile(IN PEVTLOGFILE LogFile, IN PLARGE_INTEGER FileOffset, IN PVOID Buffer, IN SIZE_T Length, OUT PSIZE_T WrittenLength OPTIONAL)
NTSYSAPI VOID NTAPI RtlCopyMemory(VOID UNALIGNED *Destination, CONST VOID UNALIGNED *Source, ULONG Length)
NTSYSAPI VOID NTAPI RtlDeleteResource(_In_ PRTL_RESOURCE Resource)
#define ROUND_UP(n, align)
PLOGFILE LogfListItemByName(LPCWSTR Name)
STRSAFEAPI StringCbCopyNW(STRSAFE_LPWSTR pszDest, size_t cbDest, STRSAFE_LPCWSTR pszSrc, size_t cbToCopy)
BOOLEAN NTAPI RtlTimeToSecondsSince1970(PLARGE_INTEGER Time, PULONG ElapsedSeconds)
#define UNREFERENCED_PARAMETER(P)
#define STATUS_INVALID_PARAMETER
struct _LOGFILE * PLOGFILE
NTSYSAPI BOOLEAN NTAPI RtlAcquireResourceShared(_In_ PRTL_RESOURCE Resource, _In_ BOOLEAN Wait)
_Must_inspect_result_ _In_ PFSRTL_PER_STREAM_CONTEXT Ptr
#define STATUS_LOG_FILE_FULL
NTSTATUS LogfCreate(PLOGFILE *LogFile, PCWSTR LogName, PUNICODE_STRING FileName, ULONG MaxSize, ULONG Retention, BOOLEAN Permanent, BOOLEAN Backup)
BOOLEAN NTAPI RtlFreeHeap(IN PVOID HeapHandle, IN ULONG Flags, IN PVOID HeapBase)
#define STATUS_EVENTLOG_FILE_CORRUPT
static __inline void LogfFreeRecord(PEVENTLOGRECORD Record)
PEVENTLOGRECORD LogfAllocAndBuildNewRecord(PSIZE_T pRecSize, ULONG Time, USHORT wType, USHORT wCategory, ULONG dwEventId, PUNICODE_STRING SourceName, PUNICODE_STRING ComputerName, ULONG dwSidLength, PSID pUserSid, USHORT wNumStrings, PWSTR pStrings, ULONG dwDataSize, PVOID pRawData)
NTSTATUS NTAPI NtFlushBuffersFile(IN HANDLE FileHandle, OUT PIO_STATUS_BLOCK IoStatusBlock)
NTSTATUS NTAPI ElfCreateFile(IN OUT PEVTLOGFILE LogFile, IN PUNICODE_STRING FileName OPTIONAL, IN ULONG FileSize, IN ULONG MaxSize, IN ULONG Retention, IN BOOLEAN CreateNew, IN BOOLEAN ReadOnly, IN PELF_ALLOCATE_ROUTINE Allocate, IN PELF_FREE_ROUTINE Free, IN PELF_FILE_SET_SIZE_ROUTINE FileSetSize, IN PELF_FILE_WRITE_ROUTINE FileWrite, IN PELF_FILE_READ_ROUTINE FileRead, IN PELF_FILE_FLUSH_ROUTINE FileFlush)
BOOL WINAPI GetComputerNameW(LPWSTR lpBuffer, LPDWORD lpnSize)
void WINAPI EnterCriticalSection(LPCRITICAL_SECTION)
#define InsertTailList(ListHead, Entry)
static PVOID NTAPI LogfpAlloc(IN SIZE_T Size, IN ULONG Flags, IN ULONG Tag)
NTSYSAPI VOID NTAPI RtlReleaseResource(_In_ PRTL_RESOURCE Resource)
_Must_inspect_result_ FORCEINLINE BOOLEAN IsListEmpty(_In_ const LIST_ENTRY *ListHead)
#define STATUS_BUFFER_TOO_SMALL
#define EVENTLOG_BACKWARDS_READ
#define STATUS_END_OF_FILE
FORCEINLINE BOOLEAN RemoveEntryList(_In_ PLIST_ENTRY Entry)
struct _EVENTLOGRECORD EVENTLOGRECORD
_In_ struct _KBUGCHECK_REASON_CALLBACK_RECORD * Record
_Must_inspect_result_ _In_ ULONG Flags
GLsizei GLenum const GLvoid GLsizei GLenum GLbyte GLbyte GLbyte GLdouble GLdouble GLdouble GLfloat GLfloat GLfloat GLint GLint GLint GLshort GLshort GLshort GLubyte GLubyte GLubyte GLuint GLuint GLuint GLushort GLushort GLushort GLbyte GLbyte GLbyte GLbyte GLdouble GLdouble GLdouble GLdouble GLfloat GLfloat GLfloat GLfloat GLint GLint GLint GLint GLshort GLshort GLshort GLshort GLubyte GLubyte GLubyte GLubyte GLuint GLuint GLuint GLuint GLushort GLushort GLushort GLushort GLboolean const GLdouble const GLfloat const GLint const GLshort const GLbyte const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLdouble const GLfloat const GLfloat const GLint const GLint const GLshort const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort GLenum GLenum GLenum GLfloat GLenum GLint GLenum GLenum GLenum GLfloat GLenum GLenum GLint GLenum GLfloat GLenum GLint GLint GLushort GLenum GLenum GLfloat GLenum GLenum GLint GLfloat const GLubyte GLenum GLenum GLenum const GLfloat GLenum GLenum const GLint GLenum GLint GLint GLsizei GLsizei GLint GLenum GLenum const GLvoid GLenum GLenum const GLfloat GLenum GLenum const GLint GLenum GLenum const GLdouble GLenum GLenum const GLfloat GLenum GLenum const GLint GLsizei GLuint GLfloat GLuint GLbitfield GLfloat GLint GLuint GLboolean GLenum GLfloat GLenum GLbitfield GLenum GLfloat GLfloat GLint GLint const GLfloat GLenum GLfloat GLfloat GLint GLint GLfloat GLfloat GLint GLint const GLfloat GLint GLfloat GLfloat GLint GLfloat GLfloat GLint GLfloat GLfloat const GLdouble const GLfloat const GLdouble const GLfloat GLint i
NTSTATUS(* NTAPI)(IN PFILE_FULL_EA_INFORMATION EaBuffer, IN ULONG EaLength, OUT PULONG ErrorOffset)
STRSAFEAPI StringCchCopyW(STRSAFE_LPWSTR pszDest, size_t cchDest, STRSAFE_LPCWSTR pszSrc)
#define FILE_WRITE_THROUGH
VOID WINAPI InitializeCriticalSection(OUT LPCRITICAL_SECTION lpCriticalSection)
NTSTATUS LogfWriteRecord(PLOGFILE LogFile, PEVENTLOGRECORD Record, SIZE_T BufSize)
_At_(*)(_In_ PWSK_CLIENT Client, _In_opt_ PUNICODE_STRING NodeName, _In_opt_ PUNICODE_STRING ServiceName, _In_opt_ ULONG NameSpace, _In_opt_ GUID *Provider, _In_opt_ PADDRINFOEXW Hints, _Outptr_ PADDRINFOEXW *Result, _In_opt_ PEPROCESS OwningProcess, _In_opt_ PETHREAD OwningThread, _Inout_ PIRP Irp Result)(Mem)) NTSTATUS(WSKAPI *PFN_WSK_GET_ADDRESS_INFO
static CRITICAL_SECTION LogFileListCs
VOID LogfListInitialize(VOID)
static VOID NTAPI LogfpFree(IN PVOID Ptr, IN ULONG Flags, IN ULONG Tag)
NTSYSAPI NTSTATUS NTAPI RtlUnicodeStringToAnsiString(PANSI_STRING DestinationString, PUNICODE_STRING SourceString, BOOLEAN AllocateDestinationString)
PFLT_MESSAGE_WAITER_QUEUE CONTAINING_RECORD(Csq, DEVICE_EXTENSION, IrpQueue)) -> WaiterQ.mLock) _IRQL_raises_(DISPATCH_LEVEL) VOID NTAPI FltpAcquireMessageWaiterLock(_In_ PIO_CSQ Csq, _Out_ PKIRQL Irql)
PLOGFILE LogfListItemByIndex(DWORD Index)
PVOID NTAPI RtlAllocateHeap(IN PVOID HeapHandle, IN ULONG Flags, IN SIZE_T Size)
struct _LIST_ENTRY * Flink
NTSYSAPI VOID NTAPI RtlInitializeResource(_In_ PRTL_RESOURCE Resource)
static NTSTATUS NTAPI LogfpSetFileSize(IN PEVTLOGFILE LogFile, IN ULONG FileSize, IN ULONG OldFileSize)
#define LOGFILE_SIGNATURE
void WINAPI DeleteCriticalSection(PCRITICAL_SECTION)
#define NT_SUCCESS(StatCode)
ULONG NTAPI ElfGetCurrentRecord(IN PEVTLOGFILE LogFile)
PEVENTSOURCE EventLogSource
#define EVENTLOG_SEQUENTIAL_READ
static const UCHAR Index[8]
NTSYSAPI VOID NTAPI RtlFreeAnsiString(PANSI_STRING AnsiString)
NTSTATUS NTAPI ElfWriteRecord(IN PEVTLOGFILE LogFile, IN PEVENTLOGRECORD Record, IN SIZE_T BufSize)
VOID LogfReportEvent(USHORT wType, USHORT wCategory, ULONG dwEventId, USHORT wNumStrings, PWSTR pStrings, ULONG dwDataSize, PVOID pRawData)
_In_ ULONG _In_ ULONG _In_ ULONG Length
NTSTATUS NTAPI NtClose(IN HANDLE Handle)
#define OBJ_CASE_INSENSITIVE
ASSERT((InvokeOnSuccess||InvokeOnError||InvokeOnCancel) ?(CompletionRoutine !=NULL) :TRUE)
#define FILE_ATTRIBUTE_NORMAL
struct _EVENTLOGRECORD * PEVENTLOGRECORD
static LIST_ENTRY LogFileListHead
NTSYSAPI NTSTATUS NTAPI NtWriteFile(IN HANDLE hFile, IN HANDLE hEvent OPTIONAL, IN PIO_APC_ROUTINE IoApcRoutine OPTIONAL, IN PVOID IoApcContext OPTIONAL, OUT PIO_STATUS_BLOCK pIoStatusBlock, IN PVOID WriteBuffer, IN ULONG WriteBufferLength, IN PLARGE_INTEGER FileOffset OPTIONAL, IN PULONG LockOperationKey OPTIONAL)
_Must_inspect_result_ _Out_ PLARGE_INTEGER FileSize
NTSTATUS NTAPI NtQueryInformationFile(HANDLE hFile, PIO_STATUS_BLOCK io, PVOID ptr, ULONG len, FILE_INFORMATION_CLASS FileInformationClass)
NTSTATUS NTAPI ElfReadRecord(IN PEVTLOGFILE LogFile, IN ULONG RecordNumber, OUT PEVENTLOGRECORD Record, IN SIZE_T BufSize, OUT PSIZE_T BytesRead OPTIONAL, OUT PSIZE_T BytesNeeded OPTIONAL)
IN PVOID IN PVOID IN USHORT IN USHORT Size
NTSTATUS LogfReadEvents(PLOGFILE LogFile, ULONG Flags, PULONG RecordNumber, ULONG BufSize, PBYTE Buffer, PULONG BytesRead, PULONG BytesNeeded, BOOLEAN Ansi)
#define EVENTLOG_SEEK_READ
VOID NTAPI ElfCloseFile(IN PEVTLOGFILE LogFile)
NTSTATUS NTAPI ElfBackupFile(IN PEVTLOGFILE LogFile, IN PEVTLOGFILE BackupLogFile)
static const WCHAR StringW[]
NTSTATUS LogfBackupFile(PLOGFILE LogFile, PUNICODE_STRING BackupFileName)
#define MAX_COMPUTERNAME_LENGTH
_In_ PFCB _In_ LONGLONG FileOffset
#define InitializeListHead(ListHead)
static OUT PIO_STATUS_BLOCK IoStatusBlock
NTSTATUS NTAPI NtCreateFile(PHANDLE FileHandle, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes, PIO_STATUS_BLOCK IoStatusBlock, PLARGE_INTEGER AllocateSize, ULONG FileAttributes, ULONG ShareAccess, ULONG CreateDisposition, ULONG CreateOptions, PVOID EaBuffer, ULONG EaLength)
#define EVENTLOG_FORWARDS_READ
static VOID LogfListAddItem(PLOGFILE Item)
#define FileStandardInformation
#define FILE_SYNCHRONOUS_IO_NONALERT
NTSYSAPI VOID NTAPI RtlInitUnicodeString(PUNICODE_STRING DestinationString, PCWSTR SourceString)
#define RtlZeroMemory(Destination, Length)
NTSTATUS NTAPI NtQuerySystemTime(OUT PLARGE_INTEGER SystemTime)
#define InitializeObjectAttributes(p, n, a, r, s)
static VOID LogfListRemoveItem(PLOGFILE Item)
static NTSTATUS NTAPI LogfpFlushFile(IN PEVTLOGFILE LogFile, IN PLARGE_INTEGER FileOffset, IN ULONG Length)
NTSTATUS LogfClearFile(PLOGFILE LogFile, PUNICODE_STRING BackupFileName)
void WINAPI LeaveCriticalSection(LPCRITICAL_SECTION)
DWORD LogfListItemCount(VOID)
IN BOOLEAN OUT PSTR Buffer
static NTSTATUS ReadRecord(IN PEVTLOGFILE LogFile, IN ULONG RecordNumber, OUT PEVENTLOGRECORD Record, IN SIZE_T BufSize, OUT PSIZE_T BytesRead OPTIONAL, OUT PSIZE_T BytesNeeded OPTIONAL, IN BOOLEAN Ansi)
size_t __cdecl wcslen(_In_z_ const wchar_t *_Str)
static NTSTATUS NTAPI LogfpReadFile(IN PEVTLOGFILE LogFile, IN PLARGE_INTEGER FileOffset, OUT PVOID Buffer, IN SIZE_T Length, OUT PSIZE_T ReadLength OPTIONAL)
static PLARGE_INTEGER Time
_Check_return_ _CRTIMP int __cdecl _wcsicmp(_In_z_ const wchar_t *_Str1, _In_z_ const wchar_t *_Str2)
_Must_inspect_result_ _In_ PFILE_OBJECT _In_opt_ PLARGE_INTEGER _In_ ULONG _In_ FLT_IO_OPERATION_FLAGS _Out_opt_ PULONG BytesRead
NTSTATUS NTAPI ElfReCreateFile(IN PEVTLOGFILE LogFile)
NTSYSAPI NTSTATUS NTAPI NtSetInformationFile(IN HANDLE hFile, OUT PIO_STATUS_BLOCK pIoStatusBlock, IN PVOID FileInformationBuffer, IN ULONG FileInformationBufferLength, IN FILE_INFORMATION_CLASS FileInfoClass)
NTSTATUS NTAPI NtReadFile(HANDLE FileHandle, HANDLE Event, PIO_APC_ROUTINE ApcRoutine, PVOID ApcContext, PIO_STATUS_BLOCK IoStatusBlock, PVOID Buffer, ULONG Length, PLARGE_INTEGER ByteOffset, PULONG Key)
PULONG MinorVersion OPTIONAL
NTSYSAPI BOOLEAN NTAPI RtlAcquireResourceExclusive(_In_ PRTL_RESOURCE Resource, _In_ BOOLEAN Wait)