19 #define EVTLTRACE(...) DPRINT("EvtLib: " __VA_ARGS__) 21 #define EVTLTRACE1(...) DPRINT1("EvtLib: " __VA_ARGS__) 29 0x11111111, 0x22222222, 0x33333333, 0x44444444,
48 SIZE_T ReadBufLength = 0, OldReadBufLength;
50 ASSERT(LogFile->CurrentSize <= LogFile->Header.MaxSize);
57 NextOffset->QuadPart = 0
LL;
63 Status = LogFile->FileRead(LogFile,
76 OldReadBufLength = ReadBufLength;
86 Status = LogFile->FileRead(LogFile,
97 ReadBufLength += OldReadBufLength;
122 SIZE_T WrittenBufLength = 0, OldWrittenBufLength;
125 ASSERT(!LogFile->ReadOnly);
131 ASSERT(LogFile->CurrentSize <= LogFile->Header.MaxSize);
138 NextOffset->QuadPart = 0
LL;
144 Status = LogFile->FileWrite(LogFile,
157 OldWrittenBufLength = WrittenBufLength;
167 Status = LogFile->FileWrite(LogFile,
178 WrittenBufLength += OldWrittenBufLength;
185 *WrittenLength = WrittenBufLength;
203 for (
i = 0;
i < LogFile->OffsetInfoNext;
i++)
205 if (LogFile->OffsetInfo[
i].EventNumber == RecordNumber)
206 return LogFile->OffsetInfo[
i].EventOffset;
211 #define OFFSET_INFO_INCREMENT 64 221 if (LogFile->OffsetInfoNext == LogFile->OffsetInfoSize)
235 if (LogFile->OffsetInfo)
241 LogFile->Free(LogFile->OffsetInfo, 0,
TAG_ELF);
247 LogFile->OffsetInfo[LogFile->OffsetInfoNext].EventNumber = ulNumber;
248 LogFile->OffsetInfo[LogFile->OffsetInfoNext].EventOffset = ulOffset;
249 LogFile->OffsetInfoNext++;
262 if (ulNumberMin > ulNumberMax)
266 while (ulNumberMin <= ulNumberMax)
273 if (ulNumberMin != LogFile->OffsetInfo[0].EventNumber)
281 for (
i = 0;
i < LogFile->OffsetInfoNext - 1;
i++)
283 LogFile->OffsetInfo[
i].EventNumber = LogFile->OffsetInfo[
i + 1].EventNumber;
284 LogFile->OffsetInfo[
i].EventOffset = LogFile->OffsetInfo[
i + 1].EventOffset;
286 LogFile->OffsetInfoNext--;
313 LogFile->Header.MajorVersion =
MAJORVER;
314 LogFile->Header.MinorVersion =
MINORVER;
321 LogFile->Header.CurrentRecordNumber = 1;
323 LogFile->Header.OldestRecordNumber = 0;
330 LogFile->CurrentSize = LogFile->Header.MaxSize;
331 LogFile->FileSetSize(LogFile, LogFile->CurrentSize, 0);
333 LogFile->Header.Flags = 0;
334 LogFile->Header.Retention = Retention;
339 Status = LogFile->FileWrite(LogFile,
353 EofRec.
EndRecord = LogFile->Header.EndOffset;
357 Status = LogFile->FileWrite(LogFile,
368 Status = LogFile->FileFlush(LogFile,
NULL, 0);
388 ULONG RecordNumber = 0;
399 Status = LogFile->FileRead(LogFile,
411 EVTLTRACE(
"Invalid file `%wZ'.\n", &LogFile->FileName);
420 EVTLTRACE(
"Invalid header size in `%wZ'.\n", &LogFile->FileName);
426 EVTLTRACE(
"Invalid signature %x in `%wZ'.\n",
427 LogFile->Header.Signature, &LogFile->FileName);
434 if (LogFile->ReadOnly && IsLogDirty)
436 EVTLTRACE(
"Read-only log `%wZ' is dirty.\n", &LogFile->FileName);
449 if (LogFile->CurrentSize > LogFile->Header.MaxSize)
450 LogFile->Header.MaxSize = LogFile->CurrentSize;
456 LogFile->Header.Retention = Retention;
466 (LogFile->Header.EndOffset < LogFile->CurrentSize) &&
467 (LogFile->Header.EndOffset & 3) == 0)
470 RecOffset = LogFile->Header.EndOffset;
483 if (Wrapping &&
FileOffset.QuadPart >= RecOffset)
503 EVTLTRACE1(
"Cannot read at most an EOF record!\n");
531 if (
FileOffset.QuadPart >= LogFile->CurrentSize )
558 EVTLTRACE1(
"Cannot read the full EOF record!\n");
566 DPRINT1(
"EOF record %llx is corrupted (0x%x vs. 0x%x ; 0x%x vs. 0x%llx), expected 0x%x 0x%x!\n",
582 if ( (LogFile->Header.StartOffset != EofRec.
BeginRecord) ||
583 (LogFile->Header.EndOffset != EofRec.
EndRecord) ||
588 "Log header or EOF record is corrupted:\n" 589 " StartOffset: 0x%x, expected 0x%x; EndOffset: 0x%x, expected 0x%x;\n" 590 " CurrentRecordNumber: %d, expected %d; OldestRecordNumber: %d, expected %d.\n",
592 LogFile->Header.EndOffset , EofRec.
EndRecord,
601 if (!LogFile->ReadOnly && IsLogDirty)
604 LogFile->Header.EndOffset = EofRec.
EndRecord;
619 if ((LogFile->Header.StartOffset >= LogFile->CurrentSize) ||
620 (LogFile->Header.StartOffset & 3) != 0)
622 EVTLTRACE(
"Invalid start offset 0x%x in `%wZ'.\n",
623 LogFile->Header.StartOffset, &LogFile->FileName);
626 if ((LogFile->Header.EndOffset >= LogFile->CurrentSize) ||
627 (LogFile->Header.EndOffset & 3) != 0)
629 EVTLTRACE(
"Invalid EOF offset 0x%x in `%wZ'.\n",
630 LogFile->Header.EndOffset, &LogFile->FileName);
634 if ((LogFile->Header.StartOffset != LogFile->Header.EndOffset) &&
635 (LogFile->Header.MaxSize - LogFile->Header.StartOffset <
sizeof(
EVENTLOGRECORD)))
641 EVTLTRACE(
"Invalid start offset 0x%x in `%wZ'.\n",
642 LogFile->Header.StartOffset, &LogFile->FileName);
646 if ((LogFile->Header.StartOffset < LogFile->Header.EndOffset) &&
647 (LogFile->Header.EndOffset - LogFile->Header.StartOffset <
sizeof(
EVENTLOGRECORD)))
653 EVTLTRACE(
"Invalid start offset 0x%x or end offset 0x%x in `%wZ'.\n",
654 LogFile->Header.StartOffset, LogFile->Header.EndOffset, &LogFile->FileName);
658 if (LogFile->Header.StartOffset <= LogFile->Header.EndOffset)
664 if (LogFile->Header.MaxSize - LogFile->Header.EndOffset +
667 EVTLTRACE(
"Invalid EOF offset 0x%x in `%wZ'.\n",
668 LogFile->Header.EndOffset, &LogFile->FileName);
678 if (LogFile->Header.StartOffset - LogFile->Header.EndOffset <
sizeof(
EVENTLOGEOF))
680 EVTLTRACE(
"Invalid EOF offset 0x%x in `%wZ'.\n",
681 LogFile->Header.EndOffset, &LogFile->FileName);
687 RecOffset = LogFile->Header.StartOffset;
698 DPRINT(
"StartOffset = 0x%x, EndOffset = 0x%x\n",
699 LogFile->Header.StartOffset, LogFile->Header.EndOffset);
706 if (!LogFile->ReadOnly)
711 DPRINT1(
"Cannot allocate temporary buffer, skip event reorganization.\n");
720 DPRINT1(
"StartOffset = 0x%x, EndOffset = 0x%x\n",
721 LogFile->Header.StartOffset, LogFile->Header.EndOffset);
726 if (Wrapping &&
FileOffset.QuadPart >= RecOffset)
733 Status = LogFile->FileRead(LogFile,
745 DPRINT1(
"Length != sizeof(RecBuf)\n");
793 if (*pRecSize2 != RecBuf.
Length)
795 EVTLTRACE1(
"Invalid RecordSizeEnd of record %d (0x%x) in `%wZ'\n",
796 RecordNumber, *pRecSize2, &LogFile->FileName);
809 EVTLTRACE1(
"ElfpAddOffsetInformation() failed!\n");
816 if (NextOffset.
QuadPart == LogFile->Header.EndOffset)
819 DPRINT(
"NextOffset.QuadPart == LogFile->Header.EndOffset, break\n");
841 DPRINT(
"Wrapping = TRUE;\n");
850 if (RecordNumber != 0 && LogFile->Header.OldestRecordNumber == 0)
851 LogFile->Header.OldestRecordNumber = 1;
853 LogFile->Header.CurrentRecordNumber = RecordNumber + LogFile->Header.OldestRecordNumber;
854 if (LogFile->Header.CurrentRecordNumber == 0)
855 LogFile->Header.CurrentRecordNumber = 1;
858 if (!LogFile->ReadOnly)
902 LogFile->Free =
Free;
903 LogFile->FileSetSize = FileSetSize;
904 LogFile->FileWrite = FileWrite;
905 LogFile->FileRead = FileRead;
906 LogFile->FileFlush = FileFlush;
909 RtlInitEmptyUnicodeString(&LogFile->FileName,
NULL, 0);
913 LogFile->FileName.Buffer = LogFile->Allocate(
FileName->Length,
916 if (LogFile->FileName.Buffer)
918 LogFile->FileName.MaximumLength =
FileName->Length;
926 if (LogFile->OffsetInfo ==
NULL)
933 LogFile->OffsetInfoNext = 0;
942 EVTLTRACE(
"Initializing log file `%wZ'\n", &LogFile->FileName);
954 if (LogFile->OffsetInfo)
955 LogFile->Free(LogFile->OffsetInfo, 0,
TAG_ELF);
957 if (LogFile->FileName.Buffer)
958 LogFile->Free(LogFile->FileName.Buffer, 0,
TAG_ELF);
972 LogFile->CurrentSize,
973 LogFile->Header.MaxSize,
974 LogFile->Header.Retention);
998 BackupLogFile->FileSetSize = LogFile->FileSetSize;
999 BackupLogFile->FileWrite = LogFile->FileWrite;
1000 BackupLogFile->FileFlush = LogFile->FileFlush;
1004 BackupLogFile->ReadOnly =
FALSE;
1014 Header->CurrentRecordNumber = 1;
1015 Header->OldestRecordNumber = 0;
1023 Status = BackupLogFile->FileWrite(BackupLogFile,
1030 EVTLTRACE1(
"Failed to write the log file header (Status 0x%08lx)\n",
Status);
1034 for (
i = LogFile->Header.OldestRecordNumber; i < LogFile->
Header.CurrentRecordNumber;
i++)
1042 Status = LogFile->FileRead(LogFile,
1079 Status = BackupLogFile->FileWrite(BackupLogFile,
1108 Status = BackupLogFile->FileWrite(BackupLogFile,
1120 Header->CurrentRecordNumber = LogFile->
Header.CurrentRecordNumber;
1121 Header->OldestRecordNumber = LogFile->
Header.OldestRecordNumber;
1143 if (LogFile->ReadOnly)
1155 Status = LogFile->FileWrite(LogFile,
1167 Status = LogFile->FileFlush(LogFile,
NULL, 0);
1188 LogFile->Free(LogFile->OffsetInfo, 0,
TAG_ELF);
1190 if (LogFile->FileName.Buffer)
1191 LogFile->Free(LogFile->FileName.Buffer, 0,
TAG_ELF);
1192 RtlInitEmptyUnicodeString(&LogFile->FileName,
NULL, 0);
1226 Status = LogFile->FileRead(LogFile,
1242 *BytesNeeded = RecSize;
1279 ULONG FreeSpace = 0;
1285 if (LogFile->ReadOnly)
1293 Record->RecordNumber = LogFile->Header.CurrentRecordNumber;
1296 if (LogFile->Header.StartOffset <= LogFile->Header.EndOffset)
1297 FreeSpace = LogFile->Header.MaxSize - LogFile->Header.EndOffset + LogFile->Header.StartOffset -
sizeof(
EVENTLOGHEADER);
1299 FreeSpace = LogFile->Header.StartOffset - LogFile->Header.EndOffset;
1304 if (LogFile->Header.OldestRecordNumber == 0)
1305 LogFile->Header.OldestRecordNumber = 1;
1314 if (LogFile->Header.StartOffset <= LogFile->Header.EndOffset)
1315 UpperBound = LogFile->Header.MaxSize;
1317 UpperBound = LogFile->Header.StartOffset;
1322 EVTLTRACE(
"The event log file has reached maximum size (0x%x), wrapping...\n" 1323 "UpperBound = 0x%x, WriteOffset = 0x%x, BufSize = 0x%x\n",
1328 if ( (LogFile->Header.StartOffset < LogFile->Header.EndOffset) &&
1329 (LogFile->Header.MaxSize -
WriteOffset <
sizeof(RecBuf)) )
1343 UpperBound = LogFile->Header.StartOffset;
1345 FreeSpace = LogFile->Header.StartOffset -
WriteOffset;
1360 ULONG OrgOldestRecordNumber, OldestRecordNumber;
1364 OldestRecordNumber = OrgOldestRecordNumber = LogFile->Header.OldestRecordNumber;
1375 while (FreeSpace <
BufSize +
sizeof(EofRec))
1381 EVTLTRACE1(
"Record number %d cannot be found, or log file is full and cannot wrap!\n", OldestRecordNumber);
1389 Status = LogFile->FileRead(LogFile,
1403 EVTLTRACE1(
"The event log file is corrupted!\n");
1419 if (LogFile->Header.Retention != 0 &&
1424 EVTLTRACE1(
"The event log file is full and cannot wrap because of the retention policy.\n");
1435 OldestRecordNumber++;
1436 RecOffset += RecBuf.
Length;
1437 FreeSpace += RecBuf.
Length;
1444 if (LogFile->Header.MaxSize - RecOffset <
sizeof(
EVENTLOGRECORD))
1447 FreeSpace += LogFile->Header.MaxSize - RecOffset;
1451 EVTLTRACE(
"Record will fit. FreeSpace %d, BufSize %d\n", FreeSpace,
BufSize);
1464 LogFile->Header.OldestRecordNumber = OldestRecordNumber;
1466 if (LogFile->Header.StartOffset == 0)
1477 EVTLTRACE(
"MaxSize = 0x%x, StartOffset = 0x%x, WriteOffset = 0x%x, EndOffset = 0x%x, BufSize = 0x%x\n" 1478 "OldestRecordNumber = %d\n",
1479 LogFile->Header.MaxSize, LogFile->Header.StartOffset,
WriteOffset, LogFile->Header.EndOffset,
BufSize,
1480 OldestRecordNumber);
1489 if (LogFile->CurrentSize < LogFile->Header.MaxSize)
1491 EVTLTRACE1(
"Expanding the log file from %lu to %lu\n",
1492 LogFile->CurrentSize, LogFile->Header.MaxSize);
1494 LogFile->CurrentSize = LogFile->Header.MaxSize;
1495 LogFile->FileSetSize(LogFile, LogFile->CurrentSize, 0);
1506 WrittenLength =
ROUND_DOWN(LogFile->Header.MaxSize - LogFile->Header.EndOffset,
sizeof(
ULONG));
1510 Status = LogFile->FileWrite(LogFile,
1545 LogFile->Header.CurrentRecordNumber++;
1546 if (LogFile->Header.CurrentRecordNumber == 0)
1547 LogFile->Header.CurrentRecordNumber = 1;
1554 LogFile->Header.EndOffset =
FileOffset.QuadPart;
1558 EofRec.
EndRecord = LogFile->Header.EndOffset;
1593 return LogFile->Header.OldestRecordNumber;
1602 return LogFile->Header.CurrentRecordNumber;
1611 return LogFile->Header.Flags;
1627 DbgPrint(
"CurrentRecordNumber = %lu\n",
Header->CurrentRecordNumber);
1628 DbgPrint(
"OldestRecordNumber = %lu\n",
Header->OldestRecordNumber);
1635 DbgPrint(
"ELF_LOGFILE_HEADER_DIRTY");
1641 DbgPrint(
"ELF_LOGFILE_HEADER_WRAP");
1647 DbgPrint(
"ELF_LOGFILE_LOGFULL_WRITTEN");
1653 DbgPrint(
"ELF_LOGFILE_ARCHIVE_SET");
NTSTATUS(NTAPI * PELF_FILE_READ_ROUTINE)(IN struct _EVTLOGFILE *LogFile, IN PLARGE_INTEGER FileOffset, OUT PVOID Buffer, IN SIZE_T Length, OUT PSIZE_T ReadLength OPTIONAL)
ULONG NTAPI ElfGetOldestRecord(IN PEVTLOGFILE LogFile)
_In_ ULONG _In_ ULONG _In_ ULONG Length
#define ROUND_UP(n, align)
FSRTL_ADVANCED_FCB_HEADER Header
#define STATUS_INVALID_PARAMETER
VOID(NTAPI * PELF_FREE_ROUTINE)(IN PVOID Ptr, IN ULONG Flags, IN ULONG Tag)
#define OFFSET_INFO_INCREMENT
_Must_inspect_result_ _In_ WDFUSBPIPE _In_ WDFREQUEST _In_opt_ WDFMEMORY _In_opt_ PWDFMEMORY_OFFSET WriteOffset
#define STATUS_LOG_FILE_FULL
#define STATUS_EVENTLOG_FILE_CORRUPT
#define EVENTLOGEOF_SIZE_FIXED
ULONG RecordSizeBeginning
NTSTATUS(NTAPI * PELF_FILE_SET_SIZE_ROUTINE)(IN struct _EVTLOGFILE *LogFile, IN ULONG FileSize, IN ULONG OldFileSize)
#define ELF_LOGFILE_HEADER_WRAP
NTSTATUS NTAPI ElfCreateFile(IN OUT PEVTLOGFILE LogFile, IN PUNICODE_STRING FileName OPTIONAL, IN ULONG FileSize, IN ULONG MaxSize, IN ULONG Retention, IN BOOLEAN CreateNew, IN BOOLEAN ReadOnly, IN PELF_ALLOCATE_ROUTINE Allocate, IN PELF_FREE_ROUTINE Free, IN PELF_FILE_SET_SIZE_ROUTINE FileSetSize, IN PELF_FILE_WRITE_ROUTINE FileWrite, IN PELF_FILE_READ_ROUTINE FileRead, IN PELF_FILE_FLUSH_ROUTINE FileFlush)
static NTSTATUS ElfpInitNewFile(IN PEVTLOGFILE LogFile, IN ULONG FileSize, IN ULONG MaxSize, IN ULONG Retention)
_In_opt_ PALLOCATE_FUNCTION Allocate
_Must_inspect_result_ _In_ WDFIOTARGET _In_opt_ WDFREQUEST _In_opt_ PWDF_MEMORY_DESCRIPTOR _In_opt_ PLONGLONG _In_opt_ PWDF_REQUEST_SEND_OPTIONS _Out_opt_ PULONG_PTR BytesRead
NTSYSAPI VOID NTAPI RtlCopyUnicodeString(PUNICODE_STRING DestinationString, PUNICODE_STRING SourceString)
#define STATUS_BUFFER_TOO_SMALL
static BOOL ElfpAddOffsetInformation(IN PEVTLOGFILE LogFile, IN ULONG ulNumber, IN ULONG ulOffset)
_In_opt_ PALLOCATE_FUNCTION _In_opt_ PFREE_FUNCTION Free
_In_ struct _KBUGCHECK_REASON_CALLBACK_RECORD * Record
static const EVENTLOGEOF EOFRecord
NTSTATUS(* NTAPI)(IN PFILE_FULL_EA_INFORMATION EaBuffer, IN ULONG EaLength, OUT PULONG ErrorOffset)
struct _EVENT_OFFSET_INFO * PEVENT_OFFSET_INFO
struct _EVENTLOGHEADER EVENTLOGHEADER
#define ELF_LOGFILE_LOGFULL_WRITTEN
#define RtlFillMemoryUlong(dst, len, val)
_Must_inspect_result_ _In_ ULONG Flags
#define LOGFILE_SIGNATURE
#define NT_SUCCESS(StatCode)
ULONG NTAPI ElfGetCurrentRecord(IN PEVTLOGFILE LogFile)
NTSTATUS NTAPI ElfWriteRecord(IN PEVTLOGFILE LogFile, IN PEVENTLOGRECORD Record, IN SIZE_T BufSize)
#define STATUS_ACCESS_DENIED
#define ELF_LOGFILE_ARCHIVE_SET
static NTSTATUS ReadLogBuffer(IN PEVTLOGFILE LogFile, OUT PVOID Buffer, IN SIZE_T Length, OUT PSIZE_T ReadLength OPTIONAL, IN PLARGE_INTEGER ByteOffset, OUT PLARGE_INTEGER NextOffset OPTIONAL)
_Must_inspect_result_ _Out_ PLARGE_INTEGER FileSize
NTSTATUS NTAPI ElfReadRecord(IN PEVTLOGFILE LogFile, IN ULONG RecordNumber, OUT PEVENTLOGRECORD Record, IN SIZE_T BufSize, OUT PSIZE_T BytesRead OPTIONAL, OUT PSIZE_T BytesNeeded OPTIONAL)
#define ELF_LOGFILE_HEADER_DIRTY
VOID NTAPI ElfCloseFile(IN PEVTLOGFILE LogFile)
NTSTATUS NTAPI ElfBackupFile(IN PEVTLOGFILE LogFile, IN PEVTLOGFILE BackupLogFile)
ULONG CurrentRecordNumber
#define ROUND_DOWN(n, align)
ULONG NTAPI ElfGetFlags(IN PEVTLOGFILE LogFile)
NTSTATUS(NTAPI * PELF_FILE_WRITE_ROUTINE)(IN struct _EVTLOGFILE *LogFile, IN PLARGE_INTEGER FileOffset, IN PVOID Buffer, IN SIZE_T Length, OUT PSIZE_T WrittenLength OPTIONAL)
GLsizei GLenum const GLvoid GLsizei GLenum GLbyte GLbyte GLbyte GLdouble GLdouble GLdouble GLfloat GLfloat GLfloat GLint GLint GLint GLshort GLshort GLshort GLubyte GLubyte GLubyte GLuint GLuint GLuint GLushort GLushort GLushort GLbyte GLbyte GLbyte GLbyte GLdouble GLdouble GLdouble GLdouble GLfloat GLfloat GLfloat GLfloat GLint GLint GLint GLint GLshort GLshort GLshort GLshort GLubyte GLubyte GLubyte GLubyte GLuint GLuint GLuint GLuint GLushort GLushort GLushort GLushort GLboolean const GLdouble const GLfloat const GLint const GLshort const GLbyte const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLdouble const GLfloat const GLfloat const GLint const GLint const GLshort const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort GLenum GLenum GLenum GLfloat GLenum GLint GLenum GLenum GLenum GLfloat GLenum GLenum GLint GLenum GLfloat GLenum GLint GLint GLushort GLenum GLenum GLfloat GLenum GLenum GLint GLfloat const GLubyte GLenum GLenum GLenum const GLfloat GLenum GLenum const GLint GLenum GLint GLint GLsizei GLsizei GLint GLenum GLenum const GLvoid GLenum GLenum const GLfloat GLenum GLenum const GLint GLenum GLenum const GLdouble GLenum GLenum const GLfloat GLenum GLenum const GLint GLsizei GLuint GLfloat GLuint GLbitfield GLfloat GLint GLuint GLboolean GLenum GLfloat GLenum GLbitfield GLenum GLfloat GLfloat GLint GLint const GLfloat GLenum GLfloat GLfloat GLint GLint GLfloat GLfloat GLint GLint const GLfloat GLint GLfloat GLfloat GLint GLfloat GLfloat GLint GLfloat GLfloat const GLdouble const GLfloat const GLdouble const GLfloat GLint i
_In_ PFCB _In_ LONGLONG FileOffset
static NTSTATUS WriteLogBuffer(IN PEVTLOGFILE LogFile, IN PVOID Buffer, IN SIZE_T Length, OUT PSIZE_T WrittenLength OPTIONAL, IN PLARGE_INTEGER ByteOffset, OUT PLARGE_INTEGER NextOffset OPTIONAL)
NTSTATUS NTAPI ElfFlushFile(IN PEVTLOGFILE LogFile)
#define RtlZeroMemory(Destination, Length)
#define RtlCopyMemory(Destination, Source, Length)
static ULONG ElfpOffsetByNumber(IN PEVTLOGFILE LogFile, IN ULONG RecordNumber)
NTSTATUS NTAPI ElfReCreateFile(IN PEVTLOGFILE LogFile)
static NTSTATUS ElfpInitExistingFile(IN PEVTLOGFILE LogFile, IN ULONG FileSize, IN ULONG Retention)
#define RtlCompareMemory(s1, s2, l)
NTSTATUS(NTAPI * PELF_FILE_FLUSH_ROUTINE)(IN struct _EVTLOGFILE *LogFile, IN PLARGE_INTEGER FileOffset, IN ULONG Length)
IN PDCB IN PCCB IN VBO IN OUT PULONG OUT PDIRENT OUT PBCB OUT PVBO ByteOffset
static BOOL ElfpDeleteOffsetInformation(IN PEVTLOGFILE LogFile, IN ULONG ulNumberMin, IN ULONG ulNumberMax)
PULONG MinorVersion OPTIONAL