evtlib.c File Reference

#include "evtlib.h"
#include <debug.h>

Include dependency graph for evtlib.c:

Go to the source code of this file.

Macros
#define	NDEBUG
#define	EVTLTRACE(...)   DPRINT("EvtLib: " __VA_ARGS__)
#define	EVTLTRACE1(...)   DPRINT1("EvtLib: " __VA_ARGS__)
#define	OFFSET_INFO_INCREMENT   64

Functions
static NTSTATUS	ReadLogBuffer (IN PEVTLOGFILE LogFile, OUT PVOID Buffer, IN SIZE_T Length, OUT PSIZE_T ReadLength OPTIONAL, IN PLARGE_INTEGER ByteOffset, OUT PLARGE_INTEGER NextOffset OPTIONAL)
static NTSTATUS	WriteLogBuffer (IN PEVTLOGFILE LogFile, IN PVOID Buffer, IN SIZE_T Length, OUT PSIZE_T WrittenLength OPTIONAL, IN PLARGE_INTEGER ByteOffset, OUT PLARGE_INTEGER NextOffset OPTIONAL)
static ULONG	ElfpOffsetByNumber (IN PEVTLOGFILE LogFile, IN ULONG RecordNumber)
static BOOL	ElfpAddOffsetInformation (IN PEVTLOGFILE LogFile, IN ULONG ulNumber, IN ULONG ulOffset)
static BOOL	ElfpDeleteOffsetInformation (IN PEVTLOGFILE LogFile, IN ULONG ulNumberMin, IN ULONG ulNumberMax)
static NTSTATUS	ElfpInitNewFile (IN PEVTLOGFILE LogFile, IN ULONG FileSize, IN ULONG MaxSize, IN ULONG Retention)
static NTSTATUS	ElfpInitExistingFile (IN PEVTLOGFILE LogFile, IN ULONG FileSize, IN ULONG Retention)
NTSTATUS NTAPI	ElfCreateFile (IN OUT PEVTLOGFILE LogFile, IN PUNICODE_STRING FileName OPTIONAL, IN ULONG FileSize, IN ULONG MaxSize, IN ULONG Retention, IN BOOLEAN CreateNew, IN BOOLEAN ReadOnly, IN PELF_ALLOCATE_ROUTINE Allocate, IN PELF_FREE_ROUTINE Free, IN PELF_FILE_SET_SIZE_ROUTINE FileSetSize, IN PELF_FILE_WRITE_ROUTINE FileWrite, IN PELF_FILE_READ_ROUTINE FileRead, IN PELF_FILE_FLUSH_ROUTINE FileFlush)
NTSTATUS NTAPI	ElfReCreateFile (IN PEVTLOGFILE LogFile)
NTSTATUS NTAPI	ElfBackupFile (IN PEVTLOGFILE LogFile, IN PEVTLOGFILE BackupLogFile)
NTSTATUS NTAPI	ElfFlushFile (IN PEVTLOGFILE LogFile)
VOID NTAPI	ElfCloseFile (IN PEVTLOGFILE LogFile)
NTSTATUS NTAPI	ElfReadRecord (IN PEVTLOGFILE LogFile, IN ULONG RecordNumber, OUT PEVENTLOGRECORD Record, IN SIZE_T BufSize, OUT PSIZE_T BytesRead OPTIONAL, OUT PSIZE_T BytesNeeded OPTIONAL)
NTSTATUS NTAPI	ElfWriteRecord (IN PEVTLOGFILE LogFile, IN PEVENTLOGRECORD Record, IN SIZE_T BufSize)
ULONG NTAPI	ElfGetOldestRecord (IN PEVTLOGFILE LogFile)
ULONG NTAPI	ElfGetCurrentRecord (IN PEVTLOGFILE LogFile)
ULONG NTAPI	ElfGetFlags (IN PEVTLOGFILE LogFile)

Variables
static const EVENTLOGEOF	EOFRecord

Macro Definition Documentation

EVTLTRACE

#define EVTLTRACE

(

...

)

DPRINT("EvtLib: " __VA_ARGS__)

Definition at line 19 of file evtlib.c.

EVTLTRACE1

#define EVTLTRACE1

(

...

)

DPRINT1("EvtLib: " __VA_ARGS__)

Definition at line 21 of file evtlib.c.

NDEBUG

#define NDEBUG

Definition at line 16 of file evtlib.c.

OFFSET_INFO_INCREMENT

#define OFFSET_INFO_INCREMENT   64

Definition at line 211 of file evtlib.c.

Function Documentation

ElfBackupFile()

NTSTATUS NTAPI ElfBackupFile	(	IN PEVTLOGFILE	LogFile,
		IN PEVTLOGFILE	BackupLogFile
	)

Definition at line 979 of file evtlib.c.

{
    NTSTATUS Status;
 
    LARGE_INTEGER FileOffset;
    SIZE_T ReadLength, WrittenLength;
    PEVENTLOGHEADER Header;
    EVENTLOGRECORD RecBuf;
    EVENTLOGEOF EofRec;
    ULONG i;
    ULONG RecOffset;
    PVOID Buffer = NULL;
 
    ASSERT(LogFile);
 
    RtlZeroMemory(BackupLogFile, sizeof(*BackupLogFile));
 
    BackupLogFile->FileSetSize = LogFile->FileSetSize;
    BackupLogFile->FileWrite = LogFile->FileWrite;
    BackupLogFile->FileFlush = LogFile->FileFlush;
 
    // BackupLogFile->CurrentSize = LogFile->CurrentSize;
 
    BackupLogFile->ReadOnly = FALSE;
 
    /* Initialize the (dirty) log file header */
    Header = &BackupLogFile->Header;
    Header->HeaderSize = sizeof(EVENTLOGHEADER);
    Header->Signature = LOGFILE_SIGNATURE;
    Header->MajorVersion = MAJORVER;
    Header->MinorVersion = MINORVER;
    Header->StartOffset = sizeof(EVENTLOGHEADER);
    Header->EndOffset = sizeof(EVENTLOGHEADER);
    Header->CurrentRecordNumber = 1;
    Header->OldestRecordNumber = 0;
    Header->MaxSize = LogFile->Header.MaxSize;
    Header->Flags = ELF_LOGFILE_HEADER_DIRTY;
    Header->Retention = LogFile->Header.Retention;
    Header->EndHeaderSize = sizeof(EVENTLOGHEADER);
 
    /* Write the (dirty) log file header */
    FileOffset.QuadPart = 0LL;
    Status = BackupLogFile->FileWrite(BackupLogFile,
                                      &FileOffset,
                                      Header,
                                      sizeof(EVENTLOGHEADER),
                                      &WrittenLength);
    if (!NT_SUCCESS(Status))
    {
        EVTLTRACE1("Failed to write the log file header (Status 0x%08lx)\n", Status);
        goto Quit;
    }
 
    for (i = LogFile->Header.OldestRecordNumber; i < LogFile->Header.CurrentRecordNumber; i++)
    {
        RecOffset = ElfpOffsetByNumber(LogFile, i);
        if (RecOffset == 0)
            break;
 
        /* Read the next EVENTLOGRECORD header at once (it cannot be split) */
        FileOffset.QuadPart = RecOffset;
        Status = LogFile->FileRead(LogFile,
                                   &FileOffset,
                                   &RecBuf,
                                   sizeof(RecBuf),
                                   &ReadLength);
        if (!NT_SUCCESS(Status))
        {
            EVTLTRACE1("FileRead() failed (Status 0x%08lx)\n", Status);
            goto Quit;
        }
 
        // if (ReadLength != sizeof(RecBuf))
            // break;
 
        Buffer = LogFile->Allocate(RecBuf.Length, 0, TAG_ELF_BUF);
        if (Buffer == NULL)
        {
            EVTLTRACE1("Allocate() failed!\n");
            goto Quit;
        }
 
        /* Read the full EVENTLOGRECORD (header + data) with wrapping */
        Status = ReadLogBuffer(LogFile,
                               Buffer,
                               RecBuf.Length,
                               &ReadLength,
                               &FileOffset,
                               NULL);
        if (!NT_SUCCESS(Status))
        {
            EVTLTRACE1("ReadLogBuffer failed (Status 0x%08lx)\n", Status);
            LogFile->Free(Buffer, 0, TAG_ELF_BUF);
            // Status = STATUS_EVENTLOG_FILE_CORRUPT;
            goto Quit;
        }
 
        /* Write the event record (no wrap for the backup log) */
        Status = BackupLogFile->FileWrite(BackupLogFile,
                                          NULL,
                                          Buffer,
                                          RecBuf.Length,
                                          &WrittenLength);
        if (!NT_SUCCESS(Status))
        {
            EVTLTRACE1("FileWrite() failed (Status 0x%08lx)\n", Status);
            LogFile->Free(Buffer, 0, TAG_ELF_BUF);
            goto Quit;
        }
 
        /* Update the header information */
        Header->EndOffset += RecBuf.Length;
 
        /* Free the buffer */
        LogFile->Free(Buffer, 0, TAG_ELF_BUF);
        Buffer = NULL;
    }
 
// Quit:
 
    /* Initialize the ELF_EOF_RECORD and write it (no wrap for the backup log) */
    RtlCopyMemory(&EofRec, &EOFRecord, sizeof(EOFRecord));
    EofRec.BeginRecord = Header->StartOffset;
    EofRec.EndRecord   = Header->EndOffset;
    EofRec.CurrentRecordNumber = LogFile->Header.CurrentRecordNumber;
    EofRec.OldestRecordNumber  = LogFile->Header.OldestRecordNumber;
 
    Status = BackupLogFile->FileWrite(BackupLogFile,
                                      NULL,
                                      &EofRec,
                                      sizeof(EofRec),
                                      &WrittenLength);
    if (!NT_SUCCESS(Status))
    {
        EVTLTRACE1("FileWrite() failed (Status 0x%08lx)\n", Status);
        goto Quit;
    }
 
    /* Update the header information */
    Header->CurrentRecordNumber = LogFile->Header.CurrentRecordNumber;
    Header->OldestRecordNumber  = LogFile->Header.OldestRecordNumber;
    Header->MaxSize = ROUND_UP(Header->EndOffset + sizeof(EofRec), sizeof(ULONG));
    Header->Flags = 0; // FIXME?
 
    /* Flush the log file - Write the (clean) log file header */
    Status = ElfFlushFile(BackupLogFile);
 
Quit:
    return Status;
}

Referenced by LogfBackupFile().

ElfCloseFile()

VOID NTAPI ElfCloseFile

(

IN PEVTLOGFILE

LogFile

)

Definition at line 1179 of file evtlib.c.

{
    ASSERT(LogFile);
 
    /* Flush the log file */
    ElfFlushFile(LogFile);
 
    /* Free the data */
    LogFile->Free(LogFile->OffsetInfo, 0, TAG_ELF);
 
    if (LogFile->FileName.Buffer)
        LogFile->Free(LogFile->FileName.Buffer, 0, TAG_ELF);
    RtlInitEmptyUnicodeString(&LogFile->FileName, NULL, 0);
}

Referenced by LogfClose().

ElfCreateFile()

NTSTATUS NTAPI ElfCreateFile	(	IN OUT PEVTLOGFILE	LogFile,
		IN PUNICODE_STRING FileName	OPTIONAL,
		IN ULONG	FileSize,
		IN ULONG	MaxSize,
		IN ULONG	Retention,
		IN BOOLEAN	CreateNew,
		IN BOOLEAN	ReadOnly,
		IN PELF_ALLOCATE_ROUTINE	Allocate,
		IN PELF_FREE_ROUTINE	Free,
		IN PELF_FILE_SET_SIZE_ROUTINE	FileSetSize,
		IN PELF_FILE_WRITE_ROUTINE	FileWrite,
		IN PELF_FILE_READ_ROUTINE	FileRead,
		IN PELF_FILE_FLUSH_ROUTINE	FileFlush
	)

Definition at line 876 of file evtlib.c.

{
    NTSTATUS Status = STATUS_SUCCESS;
 
    ASSERT(LogFile);
 
    /* Creating a new log file with the 'ReadOnly' flag set is incompatible */
    if (CreateNew && ReadOnly)
        return STATUS_INVALID_PARAMETER;
 
    RtlZeroMemory(LogFile, sizeof(*LogFile));
 
    LogFile->Allocate  = Allocate;
    LogFile->Free      = Free;
    LogFile->FileSetSize = FileSetSize;
    LogFile->FileWrite = FileWrite;
    LogFile->FileRead  = FileRead;
    LogFile->FileFlush = FileFlush;
 
    /* Copy the log file name if provided (optional) */
    RtlInitEmptyUnicodeString(&LogFile->FileName, NULL, 0);
    if (FileName && FileName->Buffer && FileName->Length &&
        (FileName->Length <= FileName->MaximumLength))
    {
        LogFile->FileName.Buffer = LogFile->Allocate(FileName->Length,
                                                     HEAP_ZERO_MEMORY,
                                                     TAG_ELF);
        if (LogFile->FileName.Buffer)
        {
            LogFile->FileName.MaximumLength = FileName->Length;
            RtlCopyUnicodeString(&LogFile->FileName, FileName);
        }
    }
 
    LogFile->OffsetInfo = LogFile->Allocate(OFFSET_INFO_INCREMENT * sizeof(EVENT_OFFSET_INFO),
                                            HEAP_ZERO_MEMORY,
                                            TAG_ELF);
    if (LogFile->OffsetInfo == NULL)
    {
        EVTLTRACE1("Cannot allocate heap\n");
        Status = STATUS_NO_MEMORY;
        goto Quit;
    }
    LogFile->OffsetInfoSize = OFFSET_INFO_INCREMENT;
    LogFile->OffsetInfoNext = 0;
 
    // FIXME: Always use the regitry values for MaxSize,
    // even for existing logs!
 
    // FIXME: On Windows, EventLog uses the MaxSize setting
    // from the registry itself; the MaxSize from the header
    // is just for information purposes.
 
    EVTLTRACE("Initializing log file `%wZ'\n", &LogFile->FileName);
 
    LogFile->ReadOnly = ReadOnly; // !CreateNew && ReadOnly;
 
    if (CreateNew)
        Status = ElfpInitNewFile(LogFile, FileSize, MaxSize, Retention);
    else
        Status = ElfpInitExistingFile(LogFile, FileSize, /* MaxSize, */ Retention);
 
Quit:
    if (!NT_SUCCESS(Status))
    {
        if (LogFile->OffsetInfo)
            LogFile->Free(LogFile->OffsetInfo, 0, TAG_ELF);
 
        if (LogFile->FileName.Buffer)
            LogFile->Free(LogFile->FileName.Buffer, 0, TAG_ELF);
    }
 
    return Status;
}

Referenced by LogfCreate().

ElfFlushFile()

NTSTATUS NTAPI ElfFlushFile

(

IN PEVTLOGFILE

LogFile

)

Definition at line 1134 of file evtlib.c.

{
    NTSTATUS Status;
    LARGE_INTEGER FileOffset;
    SIZE_T WrittenLength;
 
    ASSERT(LogFile);
 
    if (LogFile->ReadOnly)
        return STATUS_SUCCESS; // STATUS_ACCESS_DENIED;
 
    /*
     * NOTE that both the EOF record *AND* the log file header
     * are supposed to be already updated!
     * We just remove the dirty log bit.
     */
    LogFile->Header.Flags &= ~ELF_LOGFILE_HEADER_DIRTY;
 
    /* Update the log file header */
    FileOffset.QuadPart = 0LL;
    Status = LogFile->FileWrite(LogFile,
                                &FileOffset,
                                &LogFile->Header,
                                sizeof(EVENTLOGHEADER),
                                &WrittenLength);
    if (!NT_SUCCESS(Status))
    {
        EVTLTRACE1("FileWrite() failed (Status 0x%08lx)\n", Status);
        return Status;
    }
 
    /* Flush the log file */
    Status = LogFile->FileFlush(LogFile, NULL, 0);
    if (!NT_SUCCESS(Status))
    {
        EVTLTRACE1("FileFlush() failed (Status 0x%08lx)\n", Status);
        return Status;
    }
 
    return STATUS_SUCCESS;
}

Referenced by ElfBackupFile(), ElfCloseFile(), ElfpInitExistingFile(), ElfrFlushEL(), and ElfWriteRecord().

ElfGetCurrentRecord()

ULONG NTAPI ElfGetCurrentRecord

(

IN PEVTLOGFILE

LogFile

)

Definition at line 1598 of file evtlib.c.

{
    ASSERT(LogFile);
    return LogFile->Header.CurrentRecordNumber;
}

Referenced by ElfrNumberOfRecords(), and LogfReadEvents().

ElfGetFlags()

ULONG NTAPI ElfGetFlags

(

IN PEVTLOGFILE

LogFile

)

Definition at line 1607 of file evtlib.c.

{
    ASSERT(LogFile);
    return LogFile->Header.Flags;
}

Referenced by ElfrGetLogInformation().

ElfGetOldestRecord()

ULONG NTAPI ElfGetOldestRecord

(

IN PEVTLOGFILE

LogFile

)

Definition at line 1589 of file evtlib.c.

{
    ASSERT(LogFile);
    return LogFile->Header.OldestRecordNumber;
}

Referenced by ElfrNumberOfRecords(), ElfrOldestRecord(), and LogfReadEvents().

ElfpAddOffsetInformation()

static BOOL ElfpAddOffsetInformation ( IN PEVTLOGFILE  LogFile, IN ULONG  ulNumber, IN ULONG  ulOffset  )

static

Definition at line 214 of file evtlib.c.

{
    PVOID NewOffsetInfo;
 
    if (LogFile->OffsetInfoNext == LogFile->OffsetInfoSize)
    {
        /* Allocate a new offset table */
        NewOffsetInfo = LogFile->Allocate((LogFile->OffsetInfoSize + OFFSET_INFO_INCREMENT) *
                                              sizeof(EVENT_OFFSET_INFO),
                                          HEAP_ZERO_MEMORY,
                                          TAG_ELF);
        if (!NewOffsetInfo)
        {
            EVTLTRACE1("Cannot reallocate heap.\n");
            return FALSE;
        }
 
        /* Free the old offset table and use the new one */
        if (LogFile->OffsetInfo)
        {
            /* Copy the handles from the old table to the new one */
            RtlCopyMemory(NewOffsetInfo,
                          LogFile->OffsetInfo,
                          LogFile->OffsetInfoSize * sizeof(EVENT_OFFSET_INFO));
            LogFile->Free(LogFile->OffsetInfo, 0, TAG_ELF);
        }
        LogFile->OffsetInfo = (PEVENT_OFFSET_INFO)NewOffsetInfo;
        LogFile->OffsetInfoSize += OFFSET_INFO_INCREMENT;
    }
 
    LogFile->OffsetInfo[LogFile->OffsetInfoNext].EventNumber = ulNumber;
    LogFile->OffsetInfo[LogFile->OffsetInfoNext].EventOffset = ulOffset;
    LogFile->OffsetInfoNext++;
 
    return TRUE;
}

Referenced by ElfpInitExistingFile(), and ElfWriteRecord().

ElfpDeleteOffsetInformation()

static BOOL ElfpDeleteOffsetInformation ( IN PEVTLOGFILE  LogFile, IN ULONG  ulNumberMin, IN ULONG  ulNumberMax  )

static

Definition at line 255 of file evtlib.c.

{
    UINT i;
 
    if (ulNumberMin > ulNumberMax)
        return FALSE;
 
    /* Remove records ulNumberMin to ulNumberMax inclusive */
    while (ulNumberMin <= ulNumberMax)
    {
        /*
         * As the offset information is listed in increasing order, and we want
         * to keep the list without holes, we demand that ulNumberMin is the first
         * element in the list.
         */
        if (ulNumberMin != LogFile->OffsetInfo[0].EventNumber)
            return FALSE;
 
        /*
         * RtlMoveMemory(&LogFile->OffsetInfo[0],
         *               &LogFile->OffsetInfo[1],
         *               sizeof(EVENT_OFFSET_INFO) * (LogFile->OffsetInfoNext - 1));
         */
        for (i = 0; i < LogFile->OffsetInfoNext - 1; i++)
        {
            LogFile->OffsetInfo[i].EventNumber = LogFile->OffsetInfo[i + 1].EventNumber;
            LogFile->OffsetInfo[i].EventOffset = LogFile->OffsetInfo[i + 1].EventOffset;
        }
        LogFile->OffsetInfoNext--;
 
        /* Go to the next offset information */
        ulNumberMin++;
    }
 
    return TRUE;
}

Referenced by ElfWriteRecord().

ElfpInitExistingFile()

static NTSTATUS ElfpInitExistingFile ( IN PEVTLOGFILE  LogFile, IN ULONG  FileSize, IN ULONG  Retention  )

static

Definition at line 379 of file evtlib.c.

{
    NTSTATUS Status;
    LARGE_INTEGER FileOffset, NextOffset;
    SIZE_T ReadLength;
    ULONG RecordNumber = 0;
    ULONG RecOffset;
    PULONG pRecSize2;
    EVENTLOGEOF EofRec;
    EVENTLOGRECORD RecBuf;
    PEVENTLOGRECORD pRecBuf;
    BOOLEAN Wrapping = FALSE;
    BOOLEAN IsLogDirty = FALSE;
 
    /* Read the log header */
    FileOffset.QuadPart = 0LL;
    Status = LogFile->FileRead(LogFile,
                               &FileOffset,
                               &LogFile->Header,
                               sizeof(EVENTLOGHEADER),
                               &ReadLength);
    if (!NT_SUCCESS(Status))
    {
        EVTLTRACE1("FileRead() failed (Status 0x%08lx)\n", Status);
        return STATUS_EVENTLOG_FILE_CORRUPT; // return Status;
    }
    if (ReadLength != sizeof(EVENTLOGHEADER))
    {
        EVTLTRACE("Invalid file `%wZ'.\n", &LogFile->FileName);
        return STATUS_EVENTLOG_FILE_CORRUPT;
    }
 
    /* Header validity checks */
 
    if (LogFile->Header.HeaderSize != sizeof(EVENTLOGHEADER) ||
        LogFile->Header.EndHeaderSize != sizeof(EVENTLOGHEADER))
    {
        EVTLTRACE("Invalid header size in `%wZ'.\n", &LogFile->FileName);
        return STATUS_EVENTLOG_FILE_CORRUPT;
    }
 
    if (LogFile->Header.Signature != LOGFILE_SIGNATURE)
    {
        EVTLTRACE("Invalid signature %x in `%wZ'.\n",
               LogFile->Header.Signature, &LogFile->FileName);
        return STATUS_EVENTLOG_FILE_CORRUPT;
    }
 
    IsLogDirty = (LogFile->Header.Flags & ELF_LOGFILE_HEADER_DIRTY);
 
    /* If the log is read-only (e.g. a backup log) and is dirty, then it is corrupted */
    if (LogFile->ReadOnly && IsLogDirty)
    {
        EVTLTRACE("Read-only log `%wZ' is dirty.\n", &LogFile->FileName);
        return STATUS_EVENTLOG_FILE_CORRUPT;
    }
 
    LogFile->CurrentSize = FileSize;
    // FIXME!! What to do? And what to do if the MaxSize from the registry
    // is strictly less than the CurrentSize?? Should we "reduce" the log size
    // by clearing it completely??
    // --> ANSWER: Save the new MaxSize somewhere, and only when the log is
    //     being cleared, use the new MaxSize to resize (ie. shrink) it.
    // LogFile->FileSetSize(LogFile, LogFile->CurrentSize, 0);
 
    /* Adjust the log maximum size if needed */
    if (LogFile->CurrentSize > LogFile->Header.MaxSize)
        LogFile->Header.MaxSize = LogFile->CurrentSize;
 
    /*
     * Reset the log retention value. The value stored
     * in the log file is just for information purposes.
     */
    LogFile->Header.Retention = Retention;
 
    /*
     * For a non-read-only dirty log, the most up-to-date information about
     * the Start/End offsets and the Oldest and Current event record numbers
     * are found in the EOF record. We need to locate the EOF record without
     * relying on the log header's EndOffset, then patch the log header with
     * the values from the EOF record.
     */
    if ((LogFile->Header.EndOffset >= sizeof(EVENTLOGHEADER)) &&
        (LogFile->Header.EndOffset <  LogFile->CurrentSize) &&
        (LogFile->Header.EndOffset & 3) == 0) // EndOffset % sizeof(ULONG) == 0
    {
        /* The header EOF offset may be valid, try to start with it */
        RecOffset = LogFile->Header.EndOffset;
    }
    else
    {
        /* The header EOF offset could not be valid, so start from the beginning */
        RecOffset = sizeof(EVENTLOGHEADER);
    }
 
    FileOffset.QuadPart = RecOffset;
    Wrapping = FALSE;
 
    for (;;)
    {
        if (Wrapping && FileOffset.QuadPart >= RecOffset)
        {
            EVTLTRACE1("EOF record not found!\n");
            return STATUS_EVENTLOG_FILE_CORRUPT;
        }
 
        /* Attempt to read the fixed part of an EVENTLOGEOF (may wrap) */
        Status = ReadLogBuffer(LogFile,
                               &EofRec,
                               EVENTLOGEOF_SIZE_FIXED,
                               &ReadLength,
                               &FileOffset,
                               NULL);
        if (!NT_SUCCESS(Status))
        {
            EVTLTRACE1("ReadLogBuffer failed (Status 0x%08lx)\n", Status);
            return STATUS_EVENTLOG_FILE_CORRUPT;
        }
        if (ReadLength != EVENTLOGEOF_SIZE_FIXED)
        {
            EVTLTRACE1("Cannot read at most an EOF record!\n");
            return STATUS_EVENTLOG_FILE_CORRUPT;
        }
 
        /* Is it an EVENTLOGEOF record? */
        if (RtlCompareMemory(&EofRec, &EOFRecord, EVENTLOGEOF_SIZE_FIXED) == EVENTLOGEOF_SIZE_FIXED)
        {
            DPRINT("Found EOF record at %llx\n", FileOffset.QuadPart);
 
            /* Got it! Break the loop and continue */
            break;
        }
 
        /* No, continue looping */
        if (*(PULONG)((ULONG_PTR)&EofRec + sizeof(ULONG)) == *(PULONG)(&EOFRecord))
            FileOffset.QuadPart += sizeof(ULONG);
        else
        if (*(PULONG)((ULONG_PTR)&EofRec + 2*sizeof(ULONG)) == *(PULONG)(&EOFRecord))
            FileOffset.QuadPart += 2*sizeof(ULONG);
        else
        if (*(PULONG)((ULONG_PTR)&EofRec + 3*sizeof(ULONG)) == *(PULONG)(&EOFRecord))
            FileOffset.QuadPart += 3*sizeof(ULONG);
        else
        if (*(PULONG)((ULONG_PTR)&EofRec + 4*sizeof(ULONG)) == *(PULONG)(&EOFRecord))
            FileOffset.QuadPart += 4*sizeof(ULONG);
        else
            FileOffset.QuadPart += 5*sizeof(ULONG); // EVENTLOGEOF_SIZE_FIXED
 
        if (FileOffset.QuadPart >= LogFile->CurrentSize /* LogFile->Header.MaxSize */)
        {
            /* Wrap the offset */
            FileOffset.QuadPart -= LogFile->CurrentSize /* LogFile->Header.MaxSize */ - sizeof(EVENTLOGHEADER);
            Wrapping = TRUE;
        }
    }
    /*
     * The only way to be there is to have found a valid EOF record.
     * Otherwise the previous loop has failed and STATUS_EVENTLOG_FILE_CORRUPT
     * was returned.
     */
 
    /* Read the full EVENTLOGEOF (may wrap) and validate it */
    Status = ReadLogBuffer(LogFile,
                           &EofRec,
                           sizeof(EofRec),
                           &ReadLength,
                           &FileOffset,
                           NULL);
    if (!NT_SUCCESS(Status))
    {
        EVTLTRACE1("ReadLogBuffer failed (Status 0x%08lx)\n", Status);
        return STATUS_EVENTLOG_FILE_CORRUPT;
    }
    if (ReadLength != sizeof(EofRec))
    {
        EVTLTRACE1("Cannot read the full EOF record!\n");
        return STATUS_EVENTLOG_FILE_CORRUPT;
    }
 
    /* Complete validity checks */
    if ((EofRec.RecordSizeEnd != EofRec.RecordSizeBeginning) ||
        (EofRec.EndRecord != FileOffset.QuadPart))
    {
        DPRINT1("EOF record %llx is corrupted (0x%x vs. 0x%x ; 0x%x vs. 0x%llx), expected 0x%x 0x%x!\n",
                FileOffset.QuadPart,
                EofRec.RecordSizeEnd, EofRec.RecordSizeBeginning,
                EofRec.EndRecord, FileOffset.QuadPart,
                EOFRecord.RecordSizeEnd, EOFRecord.RecordSizeBeginning);
        DPRINT1("RecordSizeEnd = 0x%x\n", EofRec.RecordSizeEnd);
        DPRINT1("RecordSizeBeginning = 0x%x\n", EofRec.RecordSizeBeginning);
        DPRINT1("EndRecord = 0x%x\n", EofRec.EndRecord);
        return STATUS_EVENTLOG_FILE_CORRUPT;
    }
 
    /* The EOF record is valid, break the loop and continue */
 
    /* If the log is not dirty, the header values should correspond to the EOF ones */
    if (!IsLogDirty)
    {
        if ( (LogFile->Header.StartOffset != EofRec.BeginRecord) ||
             (LogFile->Header.EndOffset   != EofRec.EndRecord)   ||
             (LogFile->Header.CurrentRecordNumber != EofRec.CurrentRecordNumber) ||
             (LogFile->Header.OldestRecordNumber  != EofRec.OldestRecordNumber) )
        {
            DPRINT1("\n"
                    "Log header or EOF record is corrupted:\n"
                    "    StartOffset: 0x%x, expected 0x%x; EndOffset: 0x%x, expected 0x%x;\n"
                    "    CurrentRecordNumber: %d, expected %d; OldestRecordNumber: %d, expected %d.\n",
                    LogFile->Header.StartOffset, EofRec.BeginRecord,
                    LogFile->Header.EndOffset  , EofRec.EndRecord,
                    LogFile->Header.CurrentRecordNumber, EofRec.CurrentRecordNumber,
                    LogFile->Header.OldestRecordNumber , EofRec.OldestRecordNumber);
 
            return STATUS_EVENTLOG_FILE_CORRUPT;
        }
    }
 
    /* If the log is dirty, patch the log header with the values from the EOF record */
    if (!LogFile->ReadOnly && IsLogDirty)
    {
        LogFile->Header.StartOffset = EofRec.BeginRecord;
        LogFile->Header.EndOffset   = EofRec.EndRecord;
        LogFile->Header.CurrentRecordNumber = EofRec.CurrentRecordNumber;
        LogFile->Header.OldestRecordNumber  = EofRec.OldestRecordNumber;
    }
 
    /*
     * FIXME! During operations the EOF record is the one that is the most
     * updated (its Oldest & Current record numbers are always up-to
     * date) while the ones from the header may be unsync. When closing
     * (or flushing?) the event log, the header's record numbers get
     * updated with the same values as the ones stored in the EOF record.
     */
 
    /* Verify Start/End offsets boundaries */
 
    if ((LogFile->Header.StartOffset >= LogFile->CurrentSize) ||
        (LogFile->Header.StartOffset & 3) != 0) // StartOffset % sizeof(ULONG) != 0
    {
        EVTLTRACE("Invalid start offset 0x%x in `%wZ'.\n",
               LogFile->Header.StartOffset, &LogFile->FileName);
        return STATUS_EVENTLOG_FILE_CORRUPT;
    }
    if ((LogFile->Header.EndOffset >= LogFile->CurrentSize) ||
        (LogFile->Header.EndOffset & 3) != 0) // EndOffset % sizeof(ULONG) != 0
    {
        EVTLTRACE("Invalid EOF offset 0x%x in `%wZ'.\n",
               LogFile->Header.EndOffset, &LogFile->FileName);
        return STATUS_EVENTLOG_FILE_CORRUPT;
    }
 
    if ((LogFile->Header.StartOffset != LogFile->Header.EndOffset) &&
        (LogFile->Header.MaxSize - LogFile->Header.StartOffset < sizeof(EVENTLOGRECORD)))
    {
        /*
         * If StartOffset does not point to EndOffset i.e. to an EVENTLOGEOF,
         * it should point to a non-splitted EVENTLOGRECORD.
         */
        EVTLTRACE("Invalid start offset 0x%x in `%wZ'.\n",
               LogFile->Header.StartOffset, &LogFile->FileName);
        return STATUS_EVENTLOG_FILE_CORRUPT;
    }
 
    if ((LogFile->Header.StartOffset < LogFile->Header.EndOffset) &&
        (LogFile->Header.EndOffset - LogFile->Header.StartOffset < sizeof(EVENTLOGRECORD)))
    {
        /*
         * In non-wrapping case, there must be enough space between StartOffset
         * and EndOffset to contain at least a full EVENTLOGRECORD.
         */
        EVTLTRACE("Invalid start offset 0x%x or end offset 0x%x in `%wZ'.\n",
               LogFile->Header.StartOffset, LogFile->Header.EndOffset, &LogFile->FileName);
        return STATUS_EVENTLOG_FILE_CORRUPT;
    }
 
    if (LogFile->Header.StartOffset <= LogFile->Header.EndOffset)
    {
        /*
         * Non-wrapping case: the (wrapping) free space starting at EndOffset
         * must be able to contain an EVENTLOGEOF.
         */
        if (LogFile->Header.MaxSize - LogFile->Header.EndOffset +
            LogFile->Header.StartOffset - sizeof(EVENTLOGHEADER) < sizeof(EVENTLOGEOF))
        {
            EVTLTRACE("Invalid EOF offset 0x%x in `%wZ'.\n",
                   LogFile->Header.EndOffset, &LogFile->FileName);
            return STATUS_EVENTLOG_FILE_CORRUPT;
        }
    }
    else // if (LogFile->Header.StartOffset > LogFile->Header.EndOffset)
    {
        /*
         * Wrapping case: the free space between EndOffset and StartOffset
         * must be able to contain an EVENTLOGEOF.
         */
        if (LogFile->Header.StartOffset - LogFile->Header.EndOffset < sizeof(EVENTLOGEOF))
        {
            EVTLTRACE("Invalid EOF offset 0x%x in `%wZ'.\n",
                   LogFile->Header.EndOffset, &LogFile->FileName);
            return STATUS_EVENTLOG_FILE_CORRUPT;
        }
    }
 
    /* Start enumerating the event records from the beginning */
    RecOffset = LogFile->Header.StartOffset;
    FileOffset.QuadPart = RecOffset;
    Wrapping = FALSE;
 
    // // FIXME! FIXME!
    // if (!(LogFile->Header.Flags & ELF_LOGFILE_HEADER_WRAP))
    // {
        // DPRINT1("Log file was wrapping but the flag was not set! Fixing...\n");
        // LogFile->Header.Flags |= ELF_LOGFILE_HEADER_WRAP;
    // }
 
    DPRINT("StartOffset = 0x%x, EndOffset = 0x%x\n",
           LogFile->Header.StartOffset, LogFile->Header.EndOffset);
 
    /*
     * For non-read-only logs of size < MaxSize, reorganize the events
     * such that they do not wrap as soon as we write new ones.
     */
#if 0
    if (!LogFile->ReadOnly)
    {
        pRecBuf = LogFile->Allocate(RecBuf.Length, 0, TAG_ELF_BUF);
        if (pRecBuf == NULL)
        {
            DPRINT1("Cannot allocate temporary buffer, skip event reorganization.\n");
            goto Continue;
        }
 
        // TODO: Do the job!
    }
 
Continue:
 
    DPRINT1("StartOffset = 0x%x, EndOffset = 0x%x\n",
            LogFile->Header.StartOffset, LogFile->Header.EndOffset);
#endif
 
    while (FileOffset.QuadPart != LogFile->Header.EndOffset)
    {
        if (Wrapping && FileOffset.QuadPart >= RecOffset)
        {
            /* We have finished enumerating all the event records */
            break;
        }
 
        /* Read the next EVENTLOGRECORD header at once (it cannot be split) */
        Status = LogFile->FileRead(LogFile,
                                   &FileOffset,
                                   &RecBuf,
                                   sizeof(RecBuf),
                                   &ReadLength);
        if (!NT_SUCCESS(Status))
        {
            EVTLTRACE1("FileRead() failed (Status 0x%08lx)\n", Status);
            return STATUS_EVENTLOG_FILE_CORRUPT;
        }
        if (ReadLength != sizeof(RecBuf))
        {
            DPRINT1("Length != sizeof(RecBuf)\n");
            break;
        }
 
        if (RecBuf.Reserved != LOGFILE_SIGNATURE ||
            RecBuf.Length < sizeof(EVENTLOGRECORD))
        {
            DPRINT1("RecBuf problem\n");
            break;
        }
 
        /* Allocate a full EVENTLOGRECORD (header + data) */
        pRecBuf = LogFile->Allocate(RecBuf.Length, 0, TAG_ELF_BUF);
        if (pRecBuf == NULL)
        {
            EVTLTRACE1("Cannot allocate heap!\n");
            return STATUS_NO_MEMORY;
        }
 
        /* Attempt to read the full EVENTLOGRECORD (can wrap) */
        Status = ReadLogBuffer(LogFile,
                               pRecBuf,
                               RecBuf.Length,
                               &ReadLength,
                               &FileOffset,
                               &NextOffset);
        if (!NT_SUCCESS(Status))
        {
            EVTLTRACE1("ReadLogBuffer failed (Status 0x%08lx)\n", Status);
            LogFile->Free(pRecBuf, 0, TAG_ELF_BUF);
            return STATUS_EVENTLOG_FILE_CORRUPT;
        }
        if (ReadLength != RecBuf.Length)
        {
            DPRINT1("Oh oh!!\n");
            LogFile->Free(pRecBuf, 0, TAG_ELF_BUF);
            break;
        }
 
        // /* If OverWrittenRecords is TRUE and this record has already been read */
        // if (OverWrittenRecords && (pRecBuf->RecordNumber == LogFile->Header.OldestRecordNumber))
        // {
            // LogFile->Free(pRecBuf, 0, TAG_ELF_BUF);
            // break;
        // }
 
        pRecSize2 = (PULONG)((ULONG_PTR)pRecBuf + RecBuf.Length - 4);
 
        if (*pRecSize2 != RecBuf.Length)
        {
            EVTLTRACE1("Invalid RecordSizeEnd of record %d (0x%x) in `%wZ'\n",
                    RecordNumber, *pRecSize2, &LogFile->FileName);
            LogFile->Free(pRecBuf, 0, TAG_ELF_BUF);
            break;
        }
 
        EVTLTRACE("Add new record %d @ offset 0x%x\n", pRecBuf->RecordNumber, FileOffset.QuadPart);
 
        RecordNumber++;
 
        if (!ElfpAddOffsetInformation(LogFile,
                                      pRecBuf->RecordNumber,
                                      FileOffset.QuadPart))
        {
            EVTLTRACE1("ElfpAddOffsetInformation() failed!\n");
            LogFile->Free(pRecBuf, 0, TAG_ELF_BUF);
            return STATUS_EVENTLOG_FILE_CORRUPT;
        }
 
        LogFile->Free(pRecBuf, 0, TAG_ELF_BUF);
 
        if (NextOffset.QuadPart == LogFile->Header.EndOffset)
        {
            /* We have finished enumerating all the event records */
            DPRINT("NextOffset.QuadPart == LogFile->Header.EndOffset, break\n");
            break;
        }
 
        /*
         * If this was the last event record before the end of the log file,
         * the next one should start at the beginning of the log and the space
         * between the last event record and the end of the file is padded.
         */
        if (LogFile->Header.MaxSize - NextOffset.QuadPart < sizeof(EVENTLOGRECORD))
        {
            /* Wrap to the beginning of the log */
            DPRINT("Wrap!\n");
            NextOffset.QuadPart = sizeof(EVENTLOGHEADER);
        }
 
        /*
         * If the next offset to read is below the current offset,
         * this means we are wrapping.
         */
        if (FileOffset.QuadPart > NextOffset.QuadPart)
        {
            DPRINT("Wrapping = TRUE;\n");
            Wrapping = TRUE;
        }
 
        /* Move the current offset */
        FileOffset = NextOffset;
    }
 
    /* If the event log was empty, it will now contain one record */
    if (RecordNumber != 0 && LogFile->Header.OldestRecordNumber == 0)
        LogFile->Header.OldestRecordNumber = 1;
 
    LogFile->Header.CurrentRecordNumber = RecordNumber + LogFile->Header.OldestRecordNumber;
    if (LogFile->Header.CurrentRecordNumber == 0)
        LogFile->Header.CurrentRecordNumber = 1;
 
    /* Flush the log if it is not read-only */
    if (!LogFile->ReadOnly)
    {
        Status = ElfFlushFile(LogFile);
        if (!NT_SUCCESS(Status))
        {
            EVTLTRACE1("ElfFlushFile() failed (Status 0x%08lx)\n", Status);
            return STATUS_EVENTLOG_FILE_CORRUPT; // Status;
        }
    }
 
    return STATUS_SUCCESS;
}

Referenced by ElfCreateFile().

ElfpInitNewFile()

static NTSTATUS ElfpInitNewFile ( IN PEVTLOGFILE  LogFile, IN ULONG  FileSize, IN ULONG  MaxSize, IN ULONG  Retention  )

static

Definition at line 297 of file evtlib.c.

{
    NTSTATUS Status;
    LARGE_INTEGER FileOffset;
    SIZE_T WrittenLength;
    EVENTLOGEOF EofRec;
 
    /* Initialize the event log header */
    RtlZeroMemory(&LogFile->Header, sizeof(EVENTLOGHEADER));
 
    LogFile->Header.HeaderSize = sizeof(EVENTLOGHEADER);
    LogFile->Header.Signature  = LOGFILE_SIGNATURE;
    LogFile->Header.MajorVersion = MAJORVER;
    LogFile->Header.MinorVersion = MINORVER;
 
    /* Set the offset to the oldest record */
    LogFile->Header.StartOffset = sizeof(EVENTLOGHEADER);
    /* Set the offset to the ELF_EOF_RECORD */
    LogFile->Header.EndOffset = sizeof(EVENTLOGHEADER);
    /* Set the number of the next record that will be added */
    LogFile->Header.CurrentRecordNumber = 1;
    /* The event log is empty, there is no record so far */
    LogFile->Header.OldestRecordNumber = 0;
 
    // FIXME: Windows' EventLog log file sizes are always multiple of 64kB
    // but that does not mean the real log size is == file size.
 
    /* Round MaxSize to be a multiple of ULONG (normally on Windows: multiple of 64 kB) */
    LogFile->Header.MaxSize = ROUND_UP(MaxSize, sizeof(ULONG));
    LogFile->CurrentSize = LogFile->Header.MaxSize; // or: FileSize ??
    LogFile->FileSetSize(LogFile, LogFile->CurrentSize, 0);
 
    LogFile->Header.Flags = 0;
    LogFile->Header.Retention = Retention;
    LogFile->Header.EndHeaderSize = sizeof(EVENTLOGHEADER);
 
    /* Write the header */
    FileOffset.QuadPart = 0LL;
    Status = LogFile->FileWrite(LogFile,
                                &FileOffset,
                                &LogFile->Header,
                                sizeof(EVENTLOGHEADER),
                                &WrittenLength);
    if (!NT_SUCCESS(Status))
    {
        EVTLTRACE1("FileWrite() failed (Status 0x%08lx)\n", Status);
        return Status;
    }
 
    /* Initialize the ELF_EOF_RECORD and write it */
    RtlCopyMemory(&EofRec, &EOFRecord, sizeof(EOFRecord));
    EofRec.BeginRecord = LogFile->Header.StartOffset;
    EofRec.EndRecord   = LogFile->Header.EndOffset;
    EofRec.CurrentRecordNumber = LogFile->Header.CurrentRecordNumber;
    EofRec.OldestRecordNumber  = LogFile->Header.OldestRecordNumber;
 
    Status = LogFile->FileWrite(LogFile,
                                NULL,
                                &EofRec,
                                sizeof(EofRec),
                                &WrittenLength);
    if (!NT_SUCCESS(Status))
    {
        EVTLTRACE1("FileWrite() failed (Status 0x%08lx)\n", Status);
        return Status;
    }
 
    Status = LogFile->FileFlush(LogFile, NULL, 0);
    if (!NT_SUCCESS(Status))
    {
        EVTLTRACE1("FileFlush() failed (Status 0x%08lx)\n", Status);
        return Status;
    }
 
    return STATUS_SUCCESS;
}

Referenced by ElfCreateFile(), and ElfReCreateFile().

ElfpOffsetByNumber()

static ULONG ElfpOffsetByNumber ( IN PEVTLOGFILE  LogFile, IN ULONG  RecordNumber  )

static

Definition at line 197 of file evtlib.c.

{
    UINT i;
 
    for (i = 0; i < LogFile->OffsetInfoNext; i++)
    {
        if (LogFile->OffsetInfo[i].EventNumber == RecordNumber)
            return LogFile->OffsetInfo[i].EventOffset;
    }
    return 0;
}

Referenced by ElfBackupFile(), ElfReadRecord(), and ElfWriteRecord().

ElfReadRecord()

NTSTATUS NTAPI ElfReadRecord	(	IN PEVTLOGFILE	LogFile,
		IN ULONG	RecordNumber,
		OUT PEVENTLOGRECORD	Record,
		IN SIZE_T	BufSize,
		OUT PSIZE_T BytesRead	OPTIONAL,
		OUT PSIZE_T BytesNeeded	OPTIONAL
	)

Definition at line 1197 of file evtlib.c.

{
    NTSTATUS Status;
    LARGE_INTEGER FileOffset;
    ULONG RecOffset;
    ULONG RecSize;
    SIZE_T ReadLength;
 
    ASSERT(LogFile);
 
    if (BytesRead)
        *BytesRead = 0;
 
    if (BytesNeeded)
        *BytesNeeded = 0;
 
    /* Retrieve the offset of the event record */
    RecOffset = ElfpOffsetByNumber(LogFile, RecordNumber);
    if (RecOffset == 0)
        return STATUS_NOT_FOUND;
 
    /* Retrieve its full size */
    FileOffset.QuadPart = RecOffset;
    Status = LogFile->FileRead(LogFile,
                               &FileOffset,
                               &RecSize,
                               sizeof(RecSize),
                               &ReadLength);
    if (!NT_SUCCESS(Status))
    {
        EVTLTRACE1("FileRead() failed (Status 0x%08lx)\n", Status);
        // Status = STATUS_EVENTLOG_FILE_CORRUPT;
        return Status;
    }
 
    /* Check whether the buffer is big enough to hold the event record */
    if (BufSize < RecSize)
    {
        if (BytesNeeded)
            *BytesNeeded = RecSize;
 
        return STATUS_BUFFER_TOO_SMALL;
    }
 
    /* Read the event record into the buffer */
    FileOffset.QuadPart = RecOffset;
    Status = ReadLogBuffer(LogFile,
                           Record,
                           RecSize,
                           &ReadLength,
                           &FileOffset,
                           NULL);
    if (!NT_SUCCESS(Status))
    {
        EVTLTRACE1("ReadLogBuffer failed (Status 0x%08lx)\n", Status);
        // Status = STATUS_EVENTLOG_FILE_CORRUPT;
    }
 
    if (BytesRead)
        *BytesRead = ReadLength;
 
    return Status;
}

Referenced by ReadRecord().

ElfReCreateFile()

NTSTATUS NTAPI ElfReCreateFile

(

IN PEVTLOGFILE

LogFile

)

Definition at line 966 of file evtlib.c.

{
    ASSERT(LogFile);
 
    return ElfpInitNewFile(LogFile,
                           LogFile->CurrentSize,
                           LogFile->Header.MaxSize,
                           LogFile->Header.Retention);
}

Referenced by LogfClearFile().

ElfWriteRecord()

NTSTATUS NTAPI ElfWriteRecord	(	IN PEVTLOGFILE	LogFile,
		IN PEVENTLOGRECORD	Record,
		IN SIZE_T	BufSize
	)

Definition at line 1269 of file evtlib.c.

{
    NTSTATUS Status;
    LARGE_INTEGER FileOffset, NextOffset;
    SIZE_T ReadLength, WrittenLength;
    EVENTLOGEOF EofRec;
    EVENTLOGRECORD RecBuf;
    ULONG FreeSpace = 0;
    ULONG UpperBound;
    ULONG RecOffset, WriteOffset;
 
    ASSERT(LogFile);
 
    if (LogFile->ReadOnly)
        return STATUS_ACCESS_DENIED;
 
    // ASSERT(sizeof(*Record) == sizeof(RecBuf));
 
    if (!Record || BufSize < sizeof(*Record))
        return STATUS_INVALID_PARAMETER;
 
    Record->RecordNumber = LogFile->Header.CurrentRecordNumber;
 
    /* Compute the available log free space */
    if (LogFile->Header.StartOffset <= LogFile->Header.EndOffset)
        FreeSpace = LogFile->Header.MaxSize - LogFile->Header.EndOffset + LogFile->Header.StartOffset - sizeof(EVENTLOGHEADER);
    else // if (LogFile->Header.StartOffset > LogFile->Header.EndOffset)
        FreeSpace = LogFile->Header.StartOffset - LogFile->Header.EndOffset;
 
    LogFile->Header.Flags |= ELF_LOGFILE_HEADER_DIRTY;
 
    /* If the event log was empty, it will now contain one record */
    if (LogFile->Header.OldestRecordNumber == 0)
        LogFile->Header.OldestRecordNumber = 1;
 
    /* By default we append the new record at the old EOF record offset */
    WriteOffset = LogFile->Header.EndOffset;
 
    /*
     * Check whether the log is going to wrap (the events being overwritten).
     */
 
    if (LogFile->Header.StartOffset <= LogFile->Header.EndOffset)
        UpperBound = LogFile->Header.MaxSize;
    else // if (LogFile->Header.StartOffset > LogFile->Header.EndOffset)
        UpperBound = LogFile->Header.StartOffset;
 
    // if (LogFile->Header.MaxSize - WriteOffset < BufSize + sizeof(EofRec))
    if (UpperBound - WriteOffset < BufSize + sizeof(EofRec))
    {
        EVTLTRACE("The event log file has reached maximum size (0x%x), wrapping...\n"
               "UpperBound = 0x%x, WriteOffset = 0x%x, BufSize = 0x%x\n",
               LogFile->Header.MaxSize, UpperBound, WriteOffset, BufSize);
        /* This will be done later */
    }
 
    if ( (LogFile->Header.StartOffset < LogFile->Header.EndOffset) &&
         (LogFile->Header.MaxSize - WriteOffset < sizeof(RecBuf)) ) // (UpperBound - WriteOffset < sizeof(RecBuf))
    {
        // ASSERT(UpperBound  == LogFile->Header.MaxSize);
        // ASSERT(WriteOffset == LogFile->Header.EndOffset);
 
        /*
         * We cannot fit the EVENTLOGRECORD header of the buffer before
         * the end of the file. We need to pad the end of the log with
         * 0x00000027, normally we will need to pad at most 0x37 bytes
         * (corresponding to sizeof(EVENTLOGRECORD) - 1).
         */
 
        /* Rewind to the beginning of the log, just after the header */
        WriteOffset = sizeof(EVENTLOGHEADER);
        UpperBound = LogFile->Header.StartOffset;
 
        FreeSpace = LogFile->Header.StartOffset - WriteOffset;
 
        LogFile->Header.Flags |= ELF_LOGFILE_HEADER_WRAP;
    }
    /*
     * Otherwise, we can fit the header and only part
     * of the data will overwrite the oldest records.
     *
     * It might be possible that all the event record can fit in one piece,
     * but that the EOF record needs to be split. This is not a problem,
     * EVENTLOGEOF can be splitted while EVENTLOGRECORD cannot be.
     */
 
    if (UpperBound - WriteOffset < BufSize + sizeof(EofRec))
    {
        ULONG OrgOldestRecordNumber, OldestRecordNumber;
 
        // DPRINT("EventLogFile has reached maximum size, wrapping...\n");
 
        OldestRecordNumber = OrgOldestRecordNumber = LogFile->Header.OldestRecordNumber;
 
        // FIXME: Assert whether LogFile->Header.StartOffset is the beginning of a record???
        // NOTE: It should be, by construction (and this should have been checked when
        // initializing a new, or existing log).
 
        /*
         * Determine how many old records need to be overwritten.
         * Check the size of the record as the record added may be larger.
         * Need to take into account that we append the EOF record.
         */
        while (FreeSpace < BufSize + sizeof(EofRec))
        {
            /* Get the oldest record data */
            RecOffset = ElfpOffsetByNumber(LogFile, OldestRecordNumber);
            if (RecOffset == 0)
            {
                EVTLTRACE1("Record number %d cannot be found, or log file is full and cannot wrap!\n", OldestRecordNumber);
                LogFile->Header.Flags |= ELF_LOGFILE_LOGFULL_WRITTEN;
                return STATUS_LOG_FILE_FULL;
            }
 
            RtlZeroMemory(&RecBuf, sizeof(RecBuf));
 
            FileOffset.QuadPart = RecOffset;
            Status = LogFile->FileRead(LogFile,
                                       &FileOffset,
                                       &RecBuf,
                                       sizeof(RecBuf),
                                       &ReadLength);
            if (!NT_SUCCESS(Status))
            {
                EVTLTRACE1("FileRead() failed (Status 0x%08lx)\n", Status);
                // Status = STATUS_EVENTLOG_FILE_CORRUPT;
                return Status;
            }
 
            if (RecBuf.Reserved != LOGFILE_SIGNATURE)
            {
                EVTLTRACE1("The event log file is corrupted!\n");
                return STATUS_EVENTLOG_FILE_CORRUPT;
            }
 
            /*
             * Check whether this event can be overwritten by comparing its
             * written timestamp with the log's retention value. This value
             * is the time interval, in seconds, that events records are
             * protected from being overwritten.
             *
             * If the retention value is zero the events are always overwritten.
             *
             * If the retention value is non-zero, when the age of an event,
             * in seconds, reaches or exceeds this value, it can be overwritten.
             * Also if the events are in the future, we do not overwrite them.
             */
            if (LogFile->Header.Retention != 0 &&
                (Record->TimeWritten <  RecBuf.TimeWritten ||
                (Record->TimeWritten >= RecBuf.TimeWritten &&
                 Record->TimeWritten -  RecBuf.TimeWritten < LogFile->Header.Retention)))
            {
                EVTLTRACE1("The event log file is full and cannot wrap because of the retention policy.\n");
                LogFile->Header.Flags |= ELF_LOGFILE_LOGFULL_WRITTEN;
                return STATUS_LOG_FILE_FULL;
            }
 
            /*
             * Advance the oldest record number, add the event record length
             * (as long as it is valid...) then take account for the possible
             * paddind after the record, in case this is the last one at the
             * end of the file.
             */
            OldestRecordNumber++;
            RecOffset += RecBuf.Length;
            FreeSpace += RecBuf.Length;
 
            /*
             * If this was the last event record before the end of the log file,
             * the next one should start at the beginning of the log and the space
             * between the last event record and the end of the file is padded.
             */
            if (LogFile->Header.MaxSize - RecOffset < sizeof(EVENTLOGRECORD))
            {
                /* Add the padding size */
                FreeSpace += LogFile->Header.MaxSize - RecOffset;
            }
        }
 
        EVTLTRACE("Record will fit. FreeSpace %d, BufSize %d\n", FreeSpace, BufSize);
 
        /* The log records are wrapping */
        LogFile->Header.Flags |= ELF_LOGFILE_HEADER_WRAP;
 
 
        // FIXME: May lead to corruption if the other subsequent calls fail...
 
        /*
         * We have validated all the region of events to be discarded,
         * now we can perform their deletion.
         */
        ElfpDeleteOffsetInformation(LogFile, OrgOldestRecordNumber, OldestRecordNumber - 1);
        LogFile->Header.OldestRecordNumber = OldestRecordNumber;
        LogFile->Header.StartOffset = ElfpOffsetByNumber(LogFile, OldestRecordNumber);
        if (LogFile->Header.StartOffset == 0)
        {
            /*
             * We have deleted all the existing event records to make place
             * for the new one. We can put it at the start of the event log.
             */
            LogFile->Header.StartOffset = sizeof(EVENTLOGHEADER);
            WriteOffset = LogFile->Header.StartOffset;
            LogFile->Header.EndOffset = WriteOffset;
        }
 
        EVTLTRACE("MaxSize = 0x%x, StartOffset = 0x%x, WriteOffset = 0x%x, EndOffset = 0x%x, BufSize = 0x%x\n"
                  "OldestRecordNumber = %d\n",
                  LogFile->Header.MaxSize, LogFile->Header.StartOffset, WriteOffset, LogFile->Header.EndOffset, BufSize,
                  OldestRecordNumber);
    }
 
    /*
     * Expand the log file if needed.
     * NOTE: It may be needed to perform this task a bit sooner if we need
     * such a thing for performing read operations, in the future...
     * Or if this operation needs to modify 'FreeSpace'...
     */
    if (LogFile->CurrentSize < LogFile->Header.MaxSize)
    {
        EVTLTRACE1("Expanding the log file from %lu to %lu\n",
                LogFile->CurrentSize, LogFile->Header.MaxSize);
 
        LogFile->CurrentSize = LogFile->Header.MaxSize;
        LogFile->FileSetSize(LogFile, LogFile->CurrentSize, 0);
    }
 
    /* Since we can write events in the log, clear the log full flag */
    LogFile->Header.Flags &= ~ELF_LOGFILE_LOGFULL_WRITTEN;
 
    /* Pad the end of the log */
    // if (LogFile->Header.EndOffset + sizeof(RecBuf) > LogFile->Header.MaxSize)
    if (WriteOffset < LogFile->Header.EndOffset)
    {
        /* Pad all the space from LogFile->Header.EndOffset to LogFile->Header.MaxSize */
        WrittenLength = ROUND_DOWN(LogFile->Header.MaxSize - LogFile->Header.EndOffset, sizeof(ULONG));
        RtlFillMemoryUlong(&RecBuf, WrittenLength, 0x00000027);
 
        FileOffset.QuadPart = LogFile->Header.EndOffset;
        Status = LogFile->FileWrite(LogFile,
                                    &FileOffset,
                                    &RecBuf,
                                    WrittenLength,
                                    &WrittenLength);
        if (!NT_SUCCESS(Status))
        {
            EVTLTRACE1("FileWrite() failed (Status 0x%08lx)\n", Status);
            // return Status;
        }
    }
 
    /* Write the event record buffer with possible wrap at offset sizeof(EVENTLOGHEADER) */
    FileOffset.QuadPart = WriteOffset;
    Status = WriteLogBuffer(LogFile,
                            Record,
                            BufSize,
                            &WrittenLength,
                            &FileOffset,
                            &NextOffset);
    if (!NT_SUCCESS(Status))
    {
        EVTLTRACE1("WriteLogBuffer failed (Status 0x%08lx)\n", Status);
        return Status;
    }
    /* FileOffset now contains the offset just after the end of the record buffer */
    FileOffset = NextOffset;
 
    if (!ElfpAddOffsetInformation(LogFile,
                                  Record->RecordNumber,
                                  WriteOffset))
    {
        return STATUS_NO_MEMORY; // STATUS_EVENTLOG_FILE_CORRUPT;
    }
 
    LogFile->Header.CurrentRecordNumber++;
    if (LogFile->Header.CurrentRecordNumber == 0)
        LogFile->Header.CurrentRecordNumber = 1;
 
    /*
     * Write the new EOF record offset just after the event record.
     * The EOF record can wrap (be splitted) if less than sizeof(EVENTLOGEOF)
     * bytes remains between the end of the record and the end of the log file.
     */
    LogFile->Header.EndOffset = FileOffset.QuadPart;
 
    RtlCopyMemory(&EofRec, &EOFRecord, sizeof(EOFRecord));
    EofRec.BeginRecord = LogFile->Header.StartOffset;
    EofRec.EndRecord   = LogFile->Header.EndOffset;
    EofRec.CurrentRecordNumber = LogFile->Header.CurrentRecordNumber;
    EofRec.OldestRecordNumber  = LogFile->Header.OldestRecordNumber;
 
    // FileOffset.QuadPart = LogFile->Header.EndOffset;
    Status = WriteLogBuffer(LogFile,
                            &EofRec,
                            sizeof(EofRec),
                            &WrittenLength,
                            &FileOffset,
                            &NextOffset);
    if (!NT_SUCCESS(Status))
    {
        EVTLTRACE1("WriteLogBuffer failed (Status 0x%08lx)\n", Status);
        return Status;
    }
    FileOffset = NextOffset;
 
    /* Flush the log file */
    Status = ElfFlushFile(LogFile);
    if (!NT_SUCCESS(Status))
    {
        EVTLTRACE1("ElfFlushFile() failed (Status 0x%08lx)\n", Status);
        return STATUS_EVENTLOG_FILE_CORRUPT; // Status;
    }
 
    return Status;
}

Referenced by LogfWriteRecord().

ReadLogBuffer()

static NTSTATUS ReadLogBuffer ( IN PEVTLOGFILE  LogFile, OUT PVOID  Buffer, IN SIZE_T  Length, OUT PSIZE_T ReadLength  OPTIONAL, IN PLARGE_INTEGER  ByteOffset, OUT PLARGE_INTEGER NextOffset  OPTIONAL  )

static

Definition at line 37 of file evtlib.c.

{
    NTSTATUS Status;
    LARGE_INTEGER FileOffset;
    SIZE_T BufSize;
    SIZE_T ReadBufLength = 0, OldReadBufLength;
 
    ASSERT(LogFile->CurrentSize <= LogFile->Header.MaxSize);
    ASSERT(ByteOffset->QuadPart <= LogFile->CurrentSize);
 
    if (ReadLength)
        *ReadLength = 0;
 
    if (NextOffset)
        NextOffset->QuadPart = 0LL;
 
    /* Read the first part of the buffer */
    FileOffset = *ByteOffset;
    BufSize = min(Length, LogFile->CurrentSize - FileOffset.QuadPart);
 
    Status = LogFile->FileRead(LogFile,
                               &FileOffset,
                               Buffer,
                               BufSize,
                               &ReadBufLength);
    if (!NT_SUCCESS(Status))
    {
        EVTLTRACE("FileRead() failed (Status 0x%08lx)\n", Status);
        return Status;
    }
 
    if (Length > BufSize)
    {
        OldReadBufLength = ReadBufLength;
 
        /*
         * The buffer was splitted in two, its second part
         * is to be read at the beginning of the log.
         */
        Buffer = (PVOID)((ULONG_PTR)Buffer + BufSize);
        BufSize = Length - BufSize;
        FileOffset.QuadPart = sizeof(EVENTLOGHEADER);
 
        Status = LogFile->FileRead(LogFile,
                                   &FileOffset,
                                   Buffer,
                                   BufSize,
                                   &ReadBufLength);
        if (!NT_SUCCESS(Status))
        {
            EVTLTRACE("FileRead() failed (Status 0x%08lx)\n", Status);
            return Status;
        }
        /* Add the read number of bytes from the first read */
        ReadBufLength += OldReadBufLength;
    }
 
    if (ReadLength)
        *ReadLength = ReadBufLength;
 
    /* We return the offset just after the end of the read buffer */
    if (NextOffset)
        NextOffset->QuadPart = FileOffset.QuadPart + BufSize;
 
    return Status;
}

Referenced by ElfBackupFile(), ElfpInitExistingFile(), and ElfReadRecord().

WriteLogBuffer()

static NTSTATUS WriteLogBuffer ( IN PEVTLOGFILE  LogFile, IN PVOID  Buffer, IN SIZE_T  Length, OUT PSIZE_T WrittenLength  OPTIONAL, IN PLARGE_INTEGER  ByteOffset, OUT PLARGE_INTEGER NextOffset  OPTIONAL  )

static

Definition at line 111 of file evtlib.c.

{
    NTSTATUS Status;
    LARGE_INTEGER FileOffset;
    SIZE_T BufSize;
    SIZE_T WrittenBufLength = 0, OldWrittenBufLength;
 
    /* We must have write access to the log file */
    ASSERT(!LogFile->ReadOnly);
 
    /*
     * It is expected that the log file is already correctly expanded
     * before we can write in it. Therefore the following assertions hold.
     */
    ASSERT(LogFile->CurrentSize <= LogFile->Header.MaxSize);
    ASSERT(ByteOffset->QuadPart <= LogFile->CurrentSize);
 
    if (WrittenLength)
        *WrittenLength = 0;
 
    if (NextOffset)
        NextOffset->QuadPart = 0LL;
 
    /* Write the first part of the buffer */
    FileOffset = *ByteOffset;
    BufSize = min(Length, LogFile->CurrentSize - FileOffset.QuadPart);
 
    Status = LogFile->FileWrite(LogFile,
                                &FileOffset,
                                Buffer,
                                BufSize,
                                &WrittenBufLength);
    if (!NT_SUCCESS(Status))
    {
        EVTLTRACE("FileWrite() failed (Status 0x%08lx)\n", Status);
        return Status;
    }
 
    if (Length > BufSize)
    {
        OldWrittenBufLength = WrittenBufLength;
 
        /*
         * The buffer was splitted in two, its second part
         * is written at the beginning of the log.
         */
        Buffer = (PVOID)((ULONG_PTR)Buffer + BufSize);
        BufSize = Length - BufSize;
        FileOffset.QuadPart = sizeof(EVENTLOGHEADER);
 
        Status = LogFile->FileWrite(LogFile,
                                    &FileOffset,
                                    Buffer,
                                    BufSize,
                                    &WrittenBufLength);
        if (!NT_SUCCESS(Status))
        {
            EVTLTRACE("FileWrite() failed (Status 0x%08lx)\n", Status);
            return Status;
        }
        /* Add the written number of bytes from the first write */
        WrittenBufLength += OldWrittenBufLength;
 
        /* The log wraps */
        LogFile->Header.Flags |= ELF_LOGFILE_HEADER_WRAP;
    }
 
    if (WrittenLength)
        *WrittenLength = WrittenBufLength;
 
    /* We return the offset just after the end of the written buffer */
    if (NextOffset)
        NextOffset->QuadPart = FileOffset.QuadPart + BufSize;
 
    return Status;
}

Referenced by ElfWriteRecord().

Variable Documentation

EOFRecord

const EVENTLOGEOF EOFRecord

static

Initial value:

=
{
    sizeof(EOFRecord),
    0x11111111, 0x22222222, 0x33333333, 0x44444444,
    0, 0, 0, 0,
    sizeof(EOFRecord)
}

Definition at line 26 of file evtlib.c.

Referenced by ElfBackupFile(), ElfpInitExistingFile(), ElfpInitNewFile(), and ElfWriteRecord().