ReactOS  r73918
evtlib.h
Go to the documentation of this file.
1 /*
2  * PROJECT: ReactOS EventLog File Library
3  * LICENSE: GPL - See COPYING in the top level directory
4  * FILE: sdk/lib/evtlib/evtlib.h
5  * PURPOSE: Provides a library for reading and writing EventLog files
6  * in the NT <= 5.2 (.evt) format.
7  * PROGRAMMERS: Copyright 2005 Saveliy Tretiakov
8  * Michael Martin
9  * Hermes Belusca-Maito
10  */
11 
12 #ifndef __EVTLIB_H__
13 #define __EVTLIB_H__
14 
15 /* PSDK/NDK Headers */
16 // #define WIN32_NO_STATUS
17 // #include <windef.h>
18 // #include <winbase.h>
19 // #include <winnt.h>
20 
21 #define NTOS_MODE_USER
22 #include <ndk/rtlfuncs.h>
23 
24 #ifndef ROUND_DOWN
25 #define ROUND_DOWN(n, align) (((ULONG)n) & ~((align) - 1l))
26 #endif
27 
28 #ifndef ROUND_UP
29 #define ROUND_UP(n, align) ROUND_DOWN(((ULONG)n) + (align) - 1, (align))
30 #endif
31 
32 /*
33  * Our file format will be compatible with NT's
34  */
35 #define MAJORVER 1
36 #define MINORVER 1
37 #define LOGFILE_SIGNATURE 0x654c664c // "LfLe"
38 
39 /*
40  * Flags used in the logfile header
41  */
42 #define ELF_LOGFILE_HEADER_DIRTY 1
43 #define ELF_LOGFILE_HEADER_WRAP 2
44 #define ELF_LOGFILE_LOGFULL_WRITTEN 4
45 #define ELF_LOGFILE_ARCHIVE_SET 8
46 
47 /*
48  * On-disk event log structures (log file header, event record and EOF record).
49  * NOTE: Contrary to what MSDN claims, both the EVENTLOGHEADER and EVENTLOGEOF
50  * structures are absent from winnt.h .
51  */
52 
53 #include <pshpack4.h> // pshpack1
54 
55 // ELF_LOGFILE_HEADER
56 typedef struct _EVENTLOGHEADER
57 {
71 
72 
73 /* Those flags and structure are defined in winnt.h */
74 #ifndef _WINNT_
75 
76 /* EventType flags */
77 #define EVENTLOG_SUCCESS 0
78 #define EVENTLOG_ERROR_TYPE 1
79 #define EVENTLOG_WARNING_TYPE 2
80 #define EVENTLOG_INFORMATION_TYPE 4
81 #define EVENTLOG_AUDIT_SUCCESS 8
82 #define EVENTLOG_AUDIT_FAILURE 16
83 
84 typedef struct _EVENTLOGRECORD
85 {
86  ULONG Length; /* Length of full record, including the data portion */
93  USHORT NumStrings; /* Number of strings in the 'Strings' array */
100  ULONG DataLength; /* Length of the data portion */
101  ULONG DataOffset; /* Offset from beginning of record */
102 /*
103  * Length-varying data:
104  *
105  * WCHAR SourceName[];
106  * WCHAR ComputerName[];
107  * SID UserSid; // Must be aligned on a DWORD boundary
108  * WCHAR Strings[];
109  * BYTE Data[];
110  * CHAR Pad[]; // Padding for DWORD boundary
111  * ULONG Length; // Same as the first 'Length' member at the beginning
112  */
114 
115 #endif // _WINNT_
116 
117 
118 // ELF_EOF_RECORD
119 typedef struct _EVENTLOGEOF
120 {
132 
133 #define EVENTLOGEOF_SIZE_FIXED (5 * sizeof(ULONG))
135 
136 #include <poppack.h>
137 
138 
139 typedef struct _EVENT_OFFSET_INFO
140 {
144 
145 #define TAG_ELF ' flE'
146 #define TAG_ELF_BUF 'BflE'
147 
148 struct _EVTLOGFILE;
149 
150 typedef PVOID
151 (NTAPI *PELF_ALLOCATE_ROUTINE)(
152  IN SIZE_T Size,
154  IN ULONG Tag
155 );
156 
157 typedef VOID
159  IN PVOID Ptr,
160  IN ULONG Flags
161 );
162 
163 typedef NTSTATUS
165  IN struct _EVTLOGFILE* LogFile,
167  OUT PVOID Buffer,
168  IN SIZE_T Length,
169  OUT PSIZE_T ReadLength OPTIONAL
170 );
171 
172 typedef NTSTATUS
174  IN struct _EVTLOGFILE* LogFile,
176  IN PVOID Buffer,
177  IN SIZE_T Length,
178  OUT PSIZE_T WrittenLength OPTIONAL
179 );
180 
181 typedef NTSTATUS
183  IN struct _EVTLOGFILE* LogFile,
184  IN ULONG FileSize,
185  IN ULONG OldFileSize
186 );
187 
188 typedef NTSTATUS
190  IN struct _EVTLOGFILE* LogFile,
192  IN ULONG Length
193 );
194 
195 typedef struct _EVTLOGFILE
196 {
197  PELF_ALLOCATE_ROUTINE Allocate;
198  PELF_FREE_ROUTINE Free;
199  PELF_FILE_SET_SIZE_ROUTINE FileSetSize;
200  PELF_FILE_WRITE_ROUTINE FileWrite;
201  PELF_FILE_READ_ROUTINE FileRead;
202  PELF_FILE_FLUSH_ROUTINE FileFlush;
203 
205  ULONG CurrentSize; /* Equivalent to the file size, is <= MaxSize and can be extended to MaxSize if needed */
207  PEVENT_OFFSET_INFO OffsetInfo;
212 
213 
214 NTSTATUS
215 NTAPI
217  IN PEVTLOGFILE LogFile,
219  IN ULONG FileSize,
220  IN ULONG MaxSize,
221  IN ULONG Retention,
222  IN BOOLEAN CreateNew,
224  IN PELF_ALLOCATE_ROUTINE Allocate,
225  IN PELF_FREE_ROUTINE Free,
226  IN PELF_FILE_SET_SIZE_ROUTINE FileSetSize,
227  IN PELF_FILE_WRITE_ROUTINE FileWrite,
228  IN PELF_FILE_READ_ROUTINE FileRead,
229  IN PELF_FILE_FLUSH_ROUTINE FileFlush); // What about Seek ??
230 
231 NTSTATUS
232 NTAPI
234  IN PEVTLOGFILE LogFile);
235 
236 // NTSTATUS
237 // ElfClearFile(PEVTLOGFILE LogFile);
238 
239 NTSTATUS
240 NTAPI
242  IN PEVTLOGFILE LogFile,
243  IN PEVTLOGFILE BackupLogFile);
244 
245 NTSTATUS
246 NTAPI
248  IN PEVTLOGFILE LogFile);
249 
250 VOID
251 NTAPI
252 ElfCloseFile( // ElfFree
253  IN PEVTLOGFILE LogFile);
254 
255 NTSTATUS
256 NTAPI
258  IN PEVTLOGFILE LogFile,
259  IN ULONG RecordNumber,
260  OUT PEVENTLOGRECORD Record,
261  IN SIZE_T BufSize, // Length
263  OUT PSIZE_T BytesNeeded OPTIONAL);
264 
265 NTSTATUS
266 NTAPI
268  IN PEVTLOGFILE LogFile,
269  IN PEVENTLOGRECORD Record,
270  IN SIZE_T BufSize);
271 
272 ULONG
273 NTAPI
275  IN PEVTLOGFILE LogFile);
276 
277 ULONG
278 NTAPI
280  IN PEVTLOGFILE LogFile);
281 
282 ULONG
283 NTAPI
285  IN PEVTLOGFILE LogFile);
286 
287 #if DBG
288 VOID PRINT_HEADER(PEVENTLOGHEADER Header);
289 #endif
290 
291 #endif /* __EVTLIB_H__ */
DWORD *typedef PVOID
Definition: winlogon.h:52
struct _EVENTLOGRECORD * PEVENTLOGRECORD
ULONG StringOffset
Definition: evtlib.h:97
#define IN
Definition: typedefs.h:39
struct _EVENTLOGEOF * PEVENTLOGEOF
ULONG RecordNumber
Definition: evtlib.h:88
BOOLEAN ReadOnly
Definition: evtlib.h:210
USHORT EventType
Definition: evtlib.h:92
NTSTATUS NTAPI ElfReadRecord(IN PEVTLOGFILE LogFile, IN ULONG RecordNumber, OUT PEVENTLOGRECORD Record, IN SIZE_T BufSize, OUT PSIZE_T BytesRead OPTIONAL, OUT PSIZE_T BytesNeeded OPTIONAL)
Definition: evtlib.c:1198
ULONG DataLength
Definition: evtlib.h:100
VOID NTAPI ElfCloseFile(IN PEVTLOGFILE LogFile)
Definition: evtlib.c:1180
ULONG DataOffset
Definition: evtlib.h:101
NTSTATUS NTAPI ElfBackupFile(IN PEVTLOGFILE LogFile, IN PEVTLOGFILE BackupLogFile)
Definition: evtlib.c:980
typedef PVOID(NTAPI *PELF_ALLOCATE_ROUTINE)(IN SIZE_T Size
EVENTLOGHEADER Header
Definition: evtlib.h:204
static SIZE_T FileSize
Definition: cabinet.c:51
Definition: arc.h:80
ULONG Twos
Definition: evtlib.h:123
ULONG EventID
Definition: evtlib.h:91
NTSTATUS(NTAPI * PELF_FILE_WRITE_ROUTINE)(IN struct _EVTLOGFILE *LogFile, IN PLARGE_INTEGER FileOffset, IN PVOID Buffer, IN SIZE_T Length, OUT PSIZE_T WrittenLength OPTIONAL)
Definition: evtlib.h:173
_Must_inspect_result_ _In_ PFSRTL_PER_STREAM_CONTEXT Ptr
Definition: fsrtlfuncs.h:898
NTSTATUS NTAPI ElfWriteRecord(IN PEVTLOGFILE LogFile, IN PEVENTLOGRECORD Record, IN SIZE_T BufSize)
Definition: evtlib.c:1270
VOID(NTAPI * PELF_FREE_ROUTINE)(IN PVOID Ptr, IN ULONG Flags)
Definition: evtlib.h:158
PEVENT_OFFSET_INFO OffsetInfo
Definition: evtlib.h:207
#define EVENTLOGEOF_SIZE_FIXED
Definition: evtlib.h:133
struct _EVTLOGFILE EVTLOGFILE
NTSTATUS NTAPI ElfReCreateFile(IN PEVTLOGFILE LogFile)
Definition: evtlib.c:967
ULONG CurrentSize
Definition: evtlib.h:205
ULONG Signature
Definition: evtlib.h:59
ULONG RecordSizeBeginning
Definition: evtlib.h:121
struct _EVENTLOGRECORD EVENTLOGRECORD
ULONG Length
Definition: evtlib.h:86
ULONG NTAPI ElfGetOldestRecord(IN PEVTLOGFILE LogFile)
Definition: evtlib.c:1590
ULONG RecordSizeEnd
Definition: evtlib.h:130
_In_opt_ PALLOCATE_FUNCTION Allocate
Definition: exfuncs.h:656
_In_opt_ PALLOCATE_FUNCTION _In_opt_ PFREE_FUNCTION Free
Definition: exfuncs.h:656
ULONG UserSidOffset
Definition: evtlib.h:99
ULONG UserSidLength
Definition: evtlib.h:98
ULONG OldestRecordNumber
Definition: evtlib.h:129
ULONG NTAPI ElfGetCurrentRecord(IN PEVTLOGFILE LogFile)
Definition: evtlib.c:1599
USHORT ReservedFlags
Definition: evtlib.h:95
_In_ struct _KBUGCHECK_REASON_CALLBACK_RECORD * Record
Definition: ketypes.h:256
ULONG OffsetInfoNext
Definition: evtlib.h:209
NTSTATUS(NTAPI * PELF_FILE_FLUSH_ROUTINE)(IN struct _EVTLOGFILE *LogFile, IN PLARGE_INTEGER FileOffset, IN ULONG Length)
Definition: evtlib.h:189
ULONG_PTR * PSIZE_T
Definition: typedefs.h:79
NTSTATUS(* NTAPI)(IN PFILE_FULL_EA_INFORMATION EaBuffer, IN ULONG EaLength, OUT PULONG ErrorOffset)
Definition: IoEaTest.cpp:117
PELF_ALLOCATE_ROUTINE Allocate
Definition: evtlib.h:197
Definition: Header.h:8
NTSTATUS(NTAPI * PELF_FILE_SET_SIZE_ROUTINE)(IN struct _EVTLOGFILE *LogFile, IN ULONG FileSize, IN ULONG OldFileSize)
Definition: evtlib.h:182
PELF_FILE_WRITE_ROUTINE FileWrite
Definition: evtlib.h:200
ULONG TimeGenerated
Definition: evtlib.h:89
ULONG EndRecord
Definition: evtlib.h:127
ULONG EventOffset
Definition: evtlib.h:142
struct _EVENT_OFFSET_INFO * PEVENT_OFFSET_INFO
PELF_FREE_ROUTINE Free
Definition: evtlib.h:198
struct _EVENTLOGHEADER EVENTLOGHEADER
#define BufSize
Definition: FsRtlTunnel.c:28
NTSTATUS NTAPI ElfFlushFile(IN PEVTLOGFILE LogFile)
Definition: evtlib.c:1135
UINTN Size
Definition: acefiex.h:550
IN ULONG Flags
Definition: evtlib.h:153
unsigned char BOOLEAN
ULONG Threes
Definition: evtlib.h:124
ULONG NTAPI ElfGetFlags(IN PEVTLOGFILE LogFile)
Definition: evtlib.c:1608
struct _EVTLOGFILE * PEVTLOGFILE
ULONG Ones
Definition: evtlib.h:122
ULONG Flags
Definition: evtlib.h:67
NTSTATUS NTAPI ElfCreateFile(IN PEVTLOGFILE LogFile, IN PUNICODE_STRING FileName OPTIONAL, IN ULONG FileSize, IN ULONG MaxSize, IN ULONG Retention, IN BOOLEAN CreateNew, IN BOOLEAN ReadOnly, IN PELF_ALLOCATE_ROUTINE Allocate, IN PELF_FREE_ROUTINE Free, IN PELF_FILE_SET_SIZE_ROUTINE FileSetSize, IN PELF_FILE_WRITE_ROUTINE FileWrite, IN PELF_FILE_READ_ROUTINE FileRead, IN PELF_FILE_FLUSH_ROUTINE FileFlush)
Definition: evtlib.c:876
ULONG TimeWritten
Definition: evtlib.h:90
struct _EVENTLOGEOF EVENTLOGEOF
PELF_FILE_FLUSH_ROUTINE FileFlush
Definition: evtlib.h:202
ULONG MajorVersion
Definition: evtlib.h:60
ULONG OldestRecordNumber
Definition: evtlib.h:65
UINTN VOID * Buffer
Definition: acefiex.h:370
ULONG MinorVersion
Definition: evtlib.h:61
VOID UINTN Length
Definition: acefiex.h:718
ULONG BeginRecord
Definition: evtlib.h:126
#define VOID
Definition: acefi.h:69
ULONG EndHeaderSize
Definition: evtlib.h:69
ULONG CurrentRecordNumber
Definition: evtlib.h:64
struct _EVENT_OFFSET_INFO EVENT_OFFSET_INFO
ULONG Fours
Definition: evtlib.h:125
UNICODE_STRING FileName
Definition: evtlib.h:206
ULONG MaxSize
Definition: evtlib.h:66
#define OPTIONAL
Definition: typedefs.h:41
ULONG EndOffset
Definition: evtlib.h:63
USHORT NumStrings
Definition: evtlib.h:93
ULONG CurrentRecordNumber
Definition: evtlib.h:128
NTSTATUS(NTAPI * PELF_FILE_READ_ROUTINE)(IN struct _EVTLOGFILE *LogFile, IN PLARGE_INTEGER FileOffset, OUT PVOID Buffer, IN SIZE_T Length, OUT PSIZE_T ReadLength OPTIONAL)
Definition: evtlib.h:164
ULONG_PTR SIZE_T
Definition: typedefs.h:79
ULONG EventNumber
Definition: evtlib.h:141
LONG NTSTATUS
Definition: DriverTester.h:11
ULONG HeaderSize
Definition: evtlib.h:58
unsigned short USHORT
Definition: pedump.c:61
ULONG Retention
Definition: evtlib.h:68
#define FIELD_OFFSET(t, f)
Definition: typedefs.h:255
PELF_FILE_READ_ROUTINE FileRead
Definition: evtlib.h:201
struct _EVENTLOGHEADER * PEVENTLOGHEADER
ULONG OffsetInfoSize
Definition: evtlib.h:208
IN ULONG IN ULONG Tag
Definition: evtlib.h:153
_In_ PLARGE_INTEGER FileOffset
Definition: cctypes.h:53
ULONG StartOffset
Definition: evtlib.h:62
#define OUT
Definition: typedefs.h:40
PELF_FILE_SET_SIZE_ROUTINE FileSetSize
Definition: evtlib.h:199
unsigned int ULONG
Definition: retypes.h:1
#define NTSTATUS
Definition: env_spec_w32.h:77
C_ASSERT(EVENTLOGEOF_SIZE_FIXED==FIELD_OFFSET(EVENTLOGEOF, BeginRecord))
ULONG Reserved
Definition: evtlib.h:87
USHORT EventCategory
Definition: evtlib.h:94
ULONG ClosingRecordNumber
Definition: evtlib.h:96
IN HDEVINFO IN PSP_DEVINFO_DATA DeviceInfoData OPTIONAL
Definition: devinst.c:44
_Must_inspect_result_ _In_ PFILE_OBJECT _In_opt_ PLARGE_INTEGER _In_ ULONG _In_ FLT_IO_OPERATION_FLAGS _Out_opt_ PULONG BytesRead
Definition: fltkernel.h:1255