ReactOS  0.4.10-dev-19-g39281f0
evtlib.h
Go to the documentation of this file.
1 /*
2  * PROJECT: ReactOS EventLog File Library
3  * LICENSE: GPL - See COPYING in the top level directory
4  * FILE: sdk/lib/evtlib/evtlib.h
5  * PURPOSE: Provides functionality for reading and writing
6  * EventLog files in the NT <= 5.2 (.evt) format.
7  * PROGRAMMERS: Copyright 2005 Saveliy Tretiakov
8  * Michael Martin
9  * Hermes Belusca-Maito
10  */
11 
12 #ifndef __EVTLIB_H__
13 #define __EVTLIB_H__
14 
15 #pragma once
16 
17 #ifdef __cplusplus
18 extern "C" {
19 #endif
20 
21 /* PSDK/NDK Headers */
22 // #define WIN32_NO_STATUS
23 // #include <windef.h>
24 // #include <winbase.h>
25 // #include <winnt.h>
26 
27 #define NTOS_MODE_USER
28 #include <ndk/rtlfuncs.h>
29 
30 #ifndef ROUND_DOWN
31 #define ROUND_DOWN(n, align) (((ULONG)n) & ~((align) - 1l))
32 #endif
33 
34 #ifndef ROUND_UP
35 #define ROUND_UP(n, align) ROUND_DOWN(((ULONG)n) + (align) - 1, (align))
36 #endif
37 
38 /*
39  * Our file format will be compatible with NT's
40  */
41 #define MAJORVER 1
42 #define MINORVER 1
43 #define LOGFILE_SIGNATURE 0x654c664c // "LfLe"
44 
45 /*
46  * Flags used in the logfile header
47  */
48 #define ELF_LOGFILE_HEADER_DIRTY 1
49 #define ELF_LOGFILE_HEADER_WRAP 2
50 #define ELF_LOGFILE_LOGFULL_WRITTEN 4
51 #define ELF_LOGFILE_ARCHIVE_SET 8
52 
53 /*
54  * On-disk event log structures (log file header, event record and EOF record).
55  * NOTE: Contrary to what MSDN claims, both the EVENTLOGHEADER and EVENTLOGEOF
56  * structures are absent from winnt.h .
57  */
58 
59 #include <pshpack4.h> // pshpack1
60 
61 // ELF_LOGFILE_HEADER
62 typedef struct _EVENTLOGHEADER
63 {
77 
78 
79 /* Those flags and structure are defined in winnt.h */
80 #ifndef _WINNT_
81 
82 /* EventType flags */
83 #define EVENTLOG_SUCCESS 0
84 #define EVENTLOG_ERROR_TYPE 1
85 #define EVENTLOG_WARNING_TYPE 2
86 #define EVENTLOG_INFORMATION_TYPE 4
87 #define EVENTLOG_AUDIT_SUCCESS 8
88 #define EVENTLOG_AUDIT_FAILURE 16
89 
90 typedef struct _EVENTLOGRECORD
91 {
92  ULONG Length; /* Length of full record, including the data portion */
99  USHORT NumStrings; /* Number of strings in the 'Strings' array */
106  ULONG DataLength; /* Length of the data portion */
107  ULONG DataOffset; /* Offset from beginning of record */
108 /*
109  * Length-varying data:
110  *
111  * WCHAR SourceName[];
112  * WCHAR ComputerName[];
113  * SID UserSid; // Must be aligned on a DWORD boundary
114  * WCHAR Strings[];
115  * BYTE Data[];
116  * CHAR Pad[]; // Padding for DWORD boundary
117  * ULONG Length; // Same as the first 'Length' member at the beginning
118  */
120 
121 #endif // _WINNT_
122 
123 
124 // ELF_EOF_RECORD
125 typedef struct _EVENTLOGEOF
126 {
138 
139 #define EVENTLOGEOF_SIZE_FIXED (5 * sizeof(ULONG))
141 
142 #include <poppack.h>
143 
144 
145 typedef struct _EVENT_OFFSET_INFO
146 {
150 
151 #define TAG_ELF ' flE'
152 #define TAG_ELF_BUF 'BflE'
153 
154 struct _EVTLOGFILE;
155 
156 typedef PVOID
157 (NTAPI *PELF_ALLOCATE_ROUTINE)(
158  IN SIZE_T Size,
160  IN ULONG Tag
161 );
162 
163 typedef VOID
165  IN PVOID Ptr,
166  IN ULONG Flags,
167  IN ULONG Tag
168 );
169 
170 typedef NTSTATUS
172  IN struct _EVTLOGFILE* LogFile,
174  OUT PVOID Buffer,
175  IN SIZE_T Length,
176  OUT PSIZE_T ReadLength OPTIONAL
177 );
178 
179 typedef NTSTATUS
181  IN struct _EVTLOGFILE* LogFile,
183  IN PVOID Buffer,
184  IN SIZE_T Length,
185  OUT PSIZE_T WrittenLength OPTIONAL
186 );
187 
188 typedef NTSTATUS
190  IN struct _EVTLOGFILE* LogFile,
191  IN ULONG FileSize,
192  IN ULONG OldFileSize
193 );
194 
195 typedef NTSTATUS
197  IN struct _EVTLOGFILE* LogFile,
199  IN ULONG Length
200 );
201 
202 typedef struct _EVTLOGFILE
203 {
204  PELF_ALLOCATE_ROUTINE Allocate;
205  PELF_FREE_ROUTINE Free;
206  PELF_FILE_SET_SIZE_ROUTINE FileSetSize;
207  PELF_FILE_WRITE_ROUTINE FileWrite;
208  PELF_FILE_READ_ROUTINE FileRead;
209  PELF_FILE_FLUSH_ROUTINE FileFlush;
210 
212  ULONG CurrentSize; /* Equivalent to the file size, is <= MaxSize and can be extended to MaxSize if needed */
214  PEVENT_OFFSET_INFO OffsetInfo;
219 
220 
221 NTSTATUS
222 NTAPI
224  IN OUT PEVTLOGFILE LogFile,
226  IN ULONG FileSize,
227  IN ULONG MaxSize,
228  IN ULONG Retention,
229  IN BOOLEAN CreateNew,
231  IN PELF_ALLOCATE_ROUTINE Allocate,
232  IN PELF_FREE_ROUTINE Free,
233  IN PELF_FILE_SET_SIZE_ROUTINE FileSetSize,
234  IN PELF_FILE_WRITE_ROUTINE FileWrite,
235  IN PELF_FILE_READ_ROUTINE FileRead,
236  IN PELF_FILE_FLUSH_ROUTINE FileFlush); // What about Seek ??
237 
238 NTSTATUS
239 NTAPI
241  IN PEVTLOGFILE LogFile);
242 
243 // NTSTATUS
244 // ElfClearFile(PEVTLOGFILE LogFile);
245 
246 NTSTATUS
247 NTAPI
249  IN PEVTLOGFILE LogFile,
250  IN PEVTLOGFILE BackupLogFile);
251 
252 NTSTATUS
253 NTAPI
255  IN PEVTLOGFILE LogFile);
256 
257 VOID
258 NTAPI
259 ElfCloseFile( // ElfFree
260  IN PEVTLOGFILE LogFile);
261 
262 NTSTATUS
263 NTAPI
265  IN PEVTLOGFILE LogFile,
266  IN ULONG RecordNumber,
267  OUT PEVENTLOGRECORD Record,
268  IN SIZE_T BufSize, // Length
270  OUT PSIZE_T BytesNeeded OPTIONAL);
271 
272 NTSTATUS
273 NTAPI
275  IN PEVTLOGFILE LogFile,
276  IN PEVENTLOGRECORD Record,
277  IN SIZE_T BufSize);
278 
279 ULONG
280 NTAPI
282  IN PEVTLOGFILE LogFile);
283 
284 ULONG
285 NTAPI
287  IN PEVTLOGFILE LogFile);
288 
289 ULONG
290 NTAPI
292  IN PEVTLOGFILE LogFile);
293 
294 #if DBG
295 VOID PRINT_HEADER(PEVENTLOGHEADER Header);
296 #endif
297 
298 #ifdef __cplusplus
299 }
300 #endif
301 #endif /* __EVTLIB_H__ */
DWORD *typedef PVOID
Definition: winlogon.h:52
struct _EVENTLOGRECORD * PEVENTLOGRECORD
ULONG StringOffset
Definition: evtlib.h:103
#define IN
Definition: typedefs.h:38
struct _EVENTLOGEOF * PEVENTLOGEOF
ULONG RecordNumber
Definition: evtlib.h:94
BOOLEAN ReadOnly
Definition: evtlib.h:217
USHORT EventType
Definition: evtlib.h:98
NTSTATUS NTAPI ElfReadRecord(IN PEVTLOGFILE LogFile, IN ULONG RecordNumber, OUT PEVENTLOGRECORD Record, IN SIZE_T BufSize, OUT PSIZE_T BytesRead OPTIONAL, OUT PSIZE_T BytesNeeded OPTIONAL)
Definition: evtlib.c:1197
ULONG DataLength
Definition: evtlib.h:106
VOID NTAPI ElfCloseFile(IN PEVTLOGFILE LogFile)
Definition: evtlib.c:1179
ULONG DataOffset
Definition: evtlib.h:107
NTSTATUS NTAPI ElfBackupFile(IN PEVTLOGFILE LogFile, IN PEVTLOGFILE BackupLogFile)
Definition: evtlib.c:979
typedef PVOID(NTAPI *PELF_ALLOCATE_ROUTINE)(IN SIZE_T Size
EVENTLOGHEADER Header
Definition: evtlib.h:211
static SIZE_T FileSize
Definition: cabinet.c:52
Definition: arc.h:80
ULONG Twos
Definition: evtlib.h:129
ULONG EventID
Definition: evtlib.h:97
NTSTATUS(NTAPI * PELF_FILE_WRITE_ROUTINE)(IN struct _EVTLOGFILE *LogFile, IN PLARGE_INTEGER FileOffset, IN PVOID Buffer, IN SIZE_T Length, OUT PSIZE_T WrittenLength OPTIONAL)
Definition: evtlib.h:180
_Must_inspect_result_ _In_ PFSRTL_PER_STREAM_CONTEXT Ptr
Definition: fsrtlfuncs.h:898
NTSTATUS NTAPI ElfWriteRecord(IN PEVTLOGFILE LogFile, IN PEVENTLOGRECORD Record, IN SIZE_T BufSize)
Definition: evtlib.c:1269
PEVENT_OFFSET_INFO OffsetInfo
Definition: evtlib.h:214
#define EVENTLOGEOF_SIZE_FIXED
Definition: evtlib.h:139
struct _EVTLOGFILE EVTLOGFILE
NTSTATUS NTAPI ElfReCreateFile(IN PEVTLOGFILE LogFile)
Definition: evtlib.c:966
ULONG CurrentSize
Definition: evtlib.h:212
ULONG Signature
Definition: evtlib.h:65
ULONG RecordSizeBeginning
Definition: evtlib.h:127
struct _EVENTLOGRECORD EVENTLOGRECORD
ULONG Length
Definition: evtlib.h:92
ULONG NTAPI ElfGetOldestRecord(IN PEVTLOGFILE LogFile)
Definition: evtlib.c:1589
ULONG RecordSizeEnd
Definition: evtlib.h:136
_In_opt_ PALLOCATE_FUNCTION Allocate
Definition: exfuncs.h:656
VOID(NTAPI * PELF_FREE_ROUTINE)(IN PVOID Ptr, IN ULONG Flags, IN ULONG Tag)
Definition: evtlib.h:164
_In_opt_ PALLOCATE_FUNCTION _In_opt_ PFREE_FUNCTION Free
Definition: exfuncs.h:656
ULONG UserSidOffset
Definition: evtlib.h:105
ULONG UserSidLength
Definition: evtlib.h:104
ULONG OldestRecordNumber
Definition: evtlib.h:135
ULONG NTAPI ElfGetCurrentRecord(IN PEVTLOGFILE LogFile)
Definition: evtlib.c:1598
USHORT ReservedFlags
Definition: evtlib.h:101
_In_ struct _KBUGCHECK_REASON_CALLBACK_RECORD * Record
Definition: ketypes.h:256
ULONG OffsetInfoNext
Definition: evtlib.h:216
NTSTATUS(NTAPI * PELF_FILE_FLUSH_ROUTINE)(IN struct _EVTLOGFILE *LogFile, IN PLARGE_INTEGER FileOffset, IN ULONG Length)
Definition: evtlib.h:196
ULONG_PTR * PSIZE_T
Definition: typedefs.h:78
NTSTATUS(* NTAPI)(IN PFILE_FULL_EA_INFORMATION EaBuffer, IN ULONG EaLength, OUT PULONG ErrorOffset)
Definition: IoEaTest.cpp:117
PELF_ALLOCATE_ROUTINE Allocate
Definition: evtlib.h:204
Definition: Header.h:8
NTSTATUS(NTAPI * PELF_FILE_SET_SIZE_ROUTINE)(IN struct _EVTLOGFILE *LogFile, IN ULONG FileSize, IN ULONG OldFileSize)
Definition: evtlib.h:189
PELF_FILE_WRITE_ROUTINE FileWrite
Definition: evtlib.h:207
ULONG TimeGenerated
Definition: evtlib.h:95
ULONG EndRecord
Definition: evtlib.h:133
ULONG EventOffset
Definition: evtlib.h:148
struct _EVENT_OFFSET_INFO * PEVENT_OFFSET_INFO
PELF_FREE_ROUTINE Free
Definition: evtlib.h:205
struct _EVENTLOGHEADER EVENTLOGHEADER
#define BufSize
Definition: FsRtlTunnel.c:28
NTSTATUS NTAPI ElfFlushFile(IN PEVTLOGFILE LogFile)
Definition: evtlib.c:1134
UINTN Size
Definition: acefiex.h:555
IN ULONG Flags
Definition: evtlib.h:159
unsigned char BOOLEAN
ULONG Threes
Definition: evtlib.h:130
ULONG NTAPI ElfGetFlags(IN PEVTLOGFILE LogFile)
Definition: evtlib.c:1607
struct _EVTLOGFILE * PEVTLOGFILE
ULONG Ones
Definition: evtlib.h:128
LONG NTSTATUS
Definition: precomp.h:26
ULONG Flags
Definition: evtlib.h:73
ULONG TimeWritten
Definition: evtlib.h:96
struct _EVENTLOGEOF EVENTLOGEOF
PELF_FILE_FLUSH_ROUTINE FileFlush
Definition: evtlib.h:209
ULONG MajorVersion
Definition: evtlib.h:66
ULONG OldestRecordNumber
Definition: evtlib.h:71
UINTN VOID * Buffer
Definition: acefiex.h:370
ULONG MinorVersion
Definition: evtlib.h:67
VOID UINTN Length
Definition: acefiex.h:744
#define NTSTATUS
Definition: precomp.h:20
ULONG BeginRecord
Definition: evtlib.h:132
#define VOID
Definition: acefi.h:82
ULONG EndHeaderSize
Definition: evtlib.h:75
ULONG CurrentRecordNumber
Definition: evtlib.h:70
struct _EVENT_OFFSET_INFO EVENT_OFFSET_INFO
ULONG Fours
Definition: evtlib.h:131
UNICODE_STRING FileName
Definition: evtlib.h:213
ULONG MaxSize
Definition: evtlib.h:72
#define OPTIONAL
Definition: typedefs.h:40
ULONG EndOffset
Definition: evtlib.h:69
USHORT NumStrings
Definition: evtlib.h:99
ULONG CurrentRecordNumber
Definition: evtlib.h:134
NTSTATUS(NTAPI * PELF_FILE_READ_ROUTINE)(IN struct _EVTLOGFILE *LogFile, IN PLARGE_INTEGER FileOffset, OUT PVOID Buffer, IN SIZE_T Length, OUT PSIZE_T ReadLength OPTIONAL)
Definition: evtlib.h:171
ULONG_PTR SIZE_T
Definition: typedefs.h:78
ULONG EventNumber
Definition: evtlib.h:147
ULONG HeaderSize
Definition: evtlib.h:64
unsigned short USHORT
Definition: pedump.c:61
ULONG Retention
Definition: evtlib.h:74
#define FIELD_OFFSET(t, f)
Definition: typedefs.h:254
PELF_FILE_READ_ROUTINE FileRead
Definition: evtlib.h:208
NTSTATUS NTAPI ElfCreateFile(IN OUT PEVTLOGFILE LogFile, IN PUNICODE_STRING FileName OPTIONAL, IN ULONG FileSize, IN ULONG MaxSize, IN ULONG Retention, IN BOOLEAN CreateNew, IN BOOLEAN ReadOnly, IN PELF_ALLOCATE_ROUTINE Allocate, IN PELF_FREE_ROUTINE Free, IN PELF_FILE_SET_SIZE_ROUTINE FileSetSize, IN PELF_FILE_WRITE_ROUTINE FileWrite, IN PELF_FILE_READ_ROUTINE FileRead, IN PELF_FILE_FLUSH_ROUTINE FileFlush)
Definition: evtlib.c:876
struct _EVENTLOGHEADER * PEVENTLOGHEADER
ULONG OffsetInfoSize
Definition: evtlib.h:215
IN ULONG IN ULONG Tag
Definition: evtlib.h:159
_In_ PLARGE_INTEGER FileOffset
Definition: cctypes.h:53
ULONG StartOffset
Definition: evtlib.h:68
#define OUT
Definition: typedefs.h:39
PELF_FILE_SET_SIZE_ROUTINE FileSetSize
Definition: evtlib.h:206
unsigned int ULONG
Definition: retypes.h:1
C_ASSERT(EVENTLOGEOF_SIZE_FIXED==FIELD_OFFSET(EVENTLOGEOF, BeginRecord))
ULONG Reserved
Definition: evtlib.h:93
USHORT EventCategory
Definition: evtlib.h:100
ULONG ClosingRecordNumber
Definition: evtlib.h:102
IN HDEVINFO IN PSP_DEVINFO_DATA DeviceInfoData OPTIONAL
Definition: devinst.c:44
_Must_inspect_result_ _In_ PFILE_OBJECT _In_opt_ PLARGE_INTEGER _In_ ULONG _In_ FLT_IO_OPERATION_FLAGS _Out_opt_ PULONG BytesRead
Definition: fltkernel.h:1255