ReactOS  r76032
evtlib.h
Go to the documentation of this file.
1 /*
2  * PROJECT: ReactOS EventLog File Library
3  * LICENSE: GPL - See COPYING in the top level directory
4  * FILE: sdk/lib/evtlib/evtlib.h
5  * PURPOSE: Provides functionality for reading and writing
6  * EventLog files in the NT <= 5.2 (.evt) format.
7  * PROGRAMMERS: Copyright 2005 Saveliy Tretiakov
8  * Michael Martin
9  * Hermes Belusca-Maito
10  */
11 
12 #ifndef __EVTLIB_H__
13 #define __EVTLIB_H__
14 
15 #pragma once
16 
17 /* PSDK/NDK Headers */
18 // #define WIN32_NO_STATUS
19 // #include <windef.h>
20 // #include <winbase.h>
21 // #include <winnt.h>
22 
23 #define NTOS_MODE_USER
24 #include <ndk/rtlfuncs.h>
25 
26 #ifndef ROUND_DOWN
27 #define ROUND_DOWN(n, align) (((ULONG)n) & ~((align) - 1l))
28 #endif
29 
30 #ifndef ROUND_UP
31 #define ROUND_UP(n, align) ROUND_DOWN(((ULONG)n) + (align) - 1, (align))
32 #endif
33 
34 /*
35  * Our file format will be compatible with NT's
36  */
37 #define MAJORVER 1
38 #define MINORVER 1
39 #define LOGFILE_SIGNATURE 0x654c664c // "LfLe"
40 
41 /*
42  * Flags used in the logfile header
43  */
44 #define ELF_LOGFILE_HEADER_DIRTY 1
45 #define ELF_LOGFILE_HEADER_WRAP 2
46 #define ELF_LOGFILE_LOGFULL_WRITTEN 4
47 #define ELF_LOGFILE_ARCHIVE_SET 8
48 
49 /*
50  * On-disk event log structures (log file header, event record and EOF record).
51  * NOTE: Contrary to what MSDN claims, both the EVENTLOGHEADER and EVENTLOGEOF
52  * structures are absent from winnt.h .
53  */
54 
55 #include <pshpack4.h> // pshpack1
56 
57 // ELF_LOGFILE_HEADER
58 typedef struct _EVENTLOGHEADER
59 {
73 
74 
75 /* Those flags and structure are defined in winnt.h */
76 #ifndef _WINNT_
77 
78 /* EventType flags */
79 #define EVENTLOG_SUCCESS 0
80 #define EVENTLOG_ERROR_TYPE 1
81 #define EVENTLOG_WARNING_TYPE 2
82 #define EVENTLOG_INFORMATION_TYPE 4
83 #define EVENTLOG_AUDIT_SUCCESS 8
84 #define EVENTLOG_AUDIT_FAILURE 16
85 
86 typedef struct _EVENTLOGRECORD
87 {
88  ULONG Length; /* Length of full record, including the data portion */
95  USHORT NumStrings; /* Number of strings in the 'Strings' array */
102  ULONG DataLength; /* Length of the data portion */
103  ULONG DataOffset; /* Offset from beginning of record */
104 /*
105  * Length-varying data:
106  *
107  * WCHAR SourceName[];
108  * WCHAR ComputerName[];
109  * SID UserSid; // Must be aligned on a DWORD boundary
110  * WCHAR Strings[];
111  * BYTE Data[];
112  * CHAR Pad[]; // Padding for DWORD boundary
113  * ULONG Length; // Same as the first 'Length' member at the beginning
114  */
116 
117 #endif // _WINNT_
118 
119 
120 // ELF_EOF_RECORD
121 typedef struct _EVENTLOGEOF
122 {
134 
135 #define EVENTLOGEOF_SIZE_FIXED (5 * sizeof(ULONG))
137 
138 #include <poppack.h>
139 
140 
141 typedef struct _EVENT_OFFSET_INFO
142 {
146 
147 #define TAG_ELF ' flE'
148 #define TAG_ELF_BUF 'BflE'
149 
150 struct _EVTLOGFILE;
151 
152 typedef PVOID
153 (NTAPI *PELF_ALLOCATE_ROUTINE)(
154  IN SIZE_T Size,
156  IN ULONG Tag
157 );
158 
159 typedef VOID
161  IN PVOID Ptr,
162  IN ULONG Flags,
163  IN ULONG Tag
164 );
165 
166 typedef NTSTATUS
168  IN struct _EVTLOGFILE* LogFile,
170  OUT PVOID Buffer,
171  IN SIZE_T Length,
172  OUT PSIZE_T ReadLength OPTIONAL
173 );
174 
175 typedef NTSTATUS
177  IN struct _EVTLOGFILE* LogFile,
179  IN PVOID Buffer,
180  IN SIZE_T Length,
181  OUT PSIZE_T WrittenLength OPTIONAL
182 );
183 
184 typedef NTSTATUS
186  IN struct _EVTLOGFILE* LogFile,
187  IN ULONG FileSize,
188  IN ULONG OldFileSize
189 );
190 
191 typedef NTSTATUS
193  IN struct _EVTLOGFILE* LogFile,
195  IN ULONG Length
196 );
197 
198 typedef struct _EVTLOGFILE
199 {
200  PELF_ALLOCATE_ROUTINE Allocate;
201  PELF_FREE_ROUTINE Free;
202  PELF_FILE_SET_SIZE_ROUTINE FileSetSize;
203  PELF_FILE_WRITE_ROUTINE FileWrite;
204  PELF_FILE_READ_ROUTINE FileRead;
205  PELF_FILE_FLUSH_ROUTINE FileFlush;
206 
208  ULONG CurrentSize; /* Equivalent to the file size, is <= MaxSize and can be extended to MaxSize if needed */
210  PEVENT_OFFSET_INFO OffsetInfo;
215 
216 
217 NTSTATUS
218 NTAPI
220  IN OUT PEVTLOGFILE LogFile,
222  IN ULONG FileSize,
223  IN ULONG MaxSize,
224  IN ULONG Retention,
225  IN BOOLEAN CreateNew,
227  IN PELF_ALLOCATE_ROUTINE Allocate,
228  IN PELF_FREE_ROUTINE Free,
229  IN PELF_FILE_SET_SIZE_ROUTINE FileSetSize,
230  IN PELF_FILE_WRITE_ROUTINE FileWrite,
231  IN PELF_FILE_READ_ROUTINE FileRead,
232  IN PELF_FILE_FLUSH_ROUTINE FileFlush); // What about Seek ??
233 
234 NTSTATUS
235 NTAPI
237  IN PEVTLOGFILE LogFile);
238 
239 // NTSTATUS
240 // ElfClearFile(PEVTLOGFILE LogFile);
241 
242 NTSTATUS
243 NTAPI
245  IN PEVTLOGFILE LogFile,
246  IN PEVTLOGFILE BackupLogFile);
247 
248 NTSTATUS
249 NTAPI
251  IN PEVTLOGFILE LogFile);
252 
253 VOID
254 NTAPI
255 ElfCloseFile( // ElfFree
256  IN PEVTLOGFILE LogFile);
257 
258 NTSTATUS
259 NTAPI
261  IN PEVTLOGFILE LogFile,
262  IN ULONG RecordNumber,
263  OUT PEVENTLOGRECORD Record,
264  IN SIZE_T BufSize, // Length
266  OUT PSIZE_T BytesNeeded OPTIONAL);
267 
268 NTSTATUS
269 NTAPI
271  IN PEVTLOGFILE LogFile,
272  IN PEVENTLOGRECORD Record,
273  IN SIZE_T BufSize);
274 
275 ULONG
276 NTAPI
278  IN PEVTLOGFILE LogFile);
279 
280 ULONG
281 NTAPI
283  IN PEVTLOGFILE LogFile);
284 
285 ULONG
286 NTAPI
288  IN PEVTLOGFILE LogFile);
289 
290 #if DBG
291 VOID PRINT_HEADER(PEVENTLOGHEADER Header);
292 #endif
293 
294 #endif /* __EVTLIB_H__ */
DWORD *typedef PVOID
Definition: winlogon.h:52
struct _EVENTLOGRECORD * PEVENTLOGRECORD
ULONG StringOffset
Definition: evtlib.h:99
#define IN
Definition: typedefs.h:38
struct _EVENTLOGEOF * PEVENTLOGEOF
ULONG RecordNumber
Definition: evtlib.h:90
BOOLEAN ReadOnly
Definition: evtlib.h:213
USHORT EventType
Definition: evtlib.h:94
NTSTATUS NTAPI ElfReadRecord(IN PEVTLOGFILE LogFile, IN ULONG RecordNumber, OUT PEVENTLOGRECORD Record, IN SIZE_T BufSize, OUT PSIZE_T BytesRead OPTIONAL, OUT PSIZE_T BytesNeeded OPTIONAL)
Definition: evtlib.c:1197
ULONG DataLength
Definition: evtlib.h:102
VOID NTAPI ElfCloseFile(IN PEVTLOGFILE LogFile)
Definition: evtlib.c:1179
ULONG DataOffset
Definition: evtlib.h:103
NTSTATUS NTAPI ElfBackupFile(IN PEVTLOGFILE LogFile, IN PEVTLOGFILE BackupLogFile)
Definition: evtlib.c:979
typedef PVOID(NTAPI *PELF_ALLOCATE_ROUTINE)(IN SIZE_T Size
EVENTLOGHEADER Header
Definition: evtlib.h:207
static SIZE_T FileSize
Definition: cabinet.c:51
Definition: arc.h:80
ULONG Twos
Definition: evtlib.h:125
ULONG EventID
Definition: evtlib.h:93
NTSTATUS(NTAPI * PELF_FILE_WRITE_ROUTINE)(IN struct _EVTLOGFILE *LogFile, IN PLARGE_INTEGER FileOffset, IN PVOID Buffer, IN SIZE_T Length, OUT PSIZE_T WrittenLength OPTIONAL)
Definition: evtlib.h:176
_Must_inspect_result_ _In_ PFSRTL_PER_STREAM_CONTEXT Ptr
Definition: fsrtlfuncs.h:898
NTSTATUS NTAPI ElfWriteRecord(IN PEVTLOGFILE LogFile, IN PEVENTLOGRECORD Record, IN SIZE_T BufSize)
Definition: evtlib.c:1269
PEVENT_OFFSET_INFO OffsetInfo
Definition: evtlib.h:210
#define EVENTLOGEOF_SIZE_FIXED
Definition: evtlib.h:135
struct _EVTLOGFILE EVTLOGFILE
NTSTATUS NTAPI ElfReCreateFile(IN PEVTLOGFILE LogFile)
Definition: evtlib.c:966
ULONG CurrentSize
Definition: evtlib.h:208
ULONG Signature
Definition: evtlib.h:61
ULONG RecordSizeBeginning
Definition: evtlib.h:123
struct _EVENTLOGRECORD EVENTLOGRECORD
ULONG Length
Definition: evtlib.h:88
ULONG NTAPI ElfGetOldestRecord(IN PEVTLOGFILE LogFile)
Definition: evtlib.c:1589
ULONG RecordSizeEnd
Definition: evtlib.h:132
_In_opt_ PALLOCATE_FUNCTION Allocate
Definition: exfuncs.h:656
VOID(NTAPI * PELF_FREE_ROUTINE)(IN PVOID Ptr, IN ULONG Flags, IN ULONG Tag)
Definition: evtlib.h:160
_In_opt_ PALLOCATE_FUNCTION _In_opt_ PFREE_FUNCTION Free
Definition: exfuncs.h:656
ULONG UserSidOffset
Definition: evtlib.h:101
ULONG UserSidLength
Definition: evtlib.h:100
ULONG OldestRecordNumber
Definition: evtlib.h:131
ULONG NTAPI ElfGetCurrentRecord(IN PEVTLOGFILE LogFile)
Definition: evtlib.c:1598
USHORT ReservedFlags
Definition: evtlib.h:97
_In_ struct _KBUGCHECK_REASON_CALLBACK_RECORD * Record
Definition: ketypes.h:256
ULONG OffsetInfoNext
Definition: evtlib.h:212
NTSTATUS(NTAPI * PELF_FILE_FLUSH_ROUTINE)(IN struct _EVTLOGFILE *LogFile, IN PLARGE_INTEGER FileOffset, IN ULONG Length)
Definition: evtlib.h:192
ULONG_PTR * PSIZE_T
Definition: typedefs.h:78
NTSTATUS(* NTAPI)(IN PFILE_FULL_EA_INFORMATION EaBuffer, IN ULONG EaLength, OUT PULONG ErrorOffset)
Definition: IoEaTest.cpp:117
PELF_ALLOCATE_ROUTINE Allocate
Definition: evtlib.h:200
Definition: Header.h:8
NTSTATUS(NTAPI * PELF_FILE_SET_SIZE_ROUTINE)(IN struct _EVTLOGFILE *LogFile, IN ULONG FileSize, IN ULONG OldFileSize)
Definition: evtlib.h:185
PELF_FILE_WRITE_ROUTINE FileWrite
Definition: evtlib.h:203
ULONG TimeGenerated
Definition: evtlib.h:91
ULONG EndRecord
Definition: evtlib.h:129
ULONG EventOffset
Definition: evtlib.h:144
struct _EVENT_OFFSET_INFO * PEVENT_OFFSET_INFO
PELF_FREE_ROUTINE Free
Definition: evtlib.h:201
struct _EVENTLOGHEADER EVENTLOGHEADER
#define BufSize
Definition: FsRtlTunnel.c:28
NTSTATUS NTAPI ElfFlushFile(IN PEVTLOGFILE LogFile)
Definition: evtlib.c:1134
UINTN Size
Definition: acefiex.h:555
IN ULONG Flags
Definition: evtlib.h:155
unsigned char BOOLEAN
ULONG Threes
Definition: evtlib.h:126
ULONG NTAPI ElfGetFlags(IN PEVTLOGFILE LogFile)
Definition: evtlib.c:1607
struct _EVTLOGFILE * PEVTLOGFILE
ULONG Ones
Definition: evtlib.h:124
ULONG Flags
Definition: evtlib.h:69
ULONG TimeWritten
Definition: evtlib.h:92
struct _EVENTLOGEOF EVENTLOGEOF
PELF_FILE_FLUSH_ROUTINE FileFlush
Definition: evtlib.h:205
ULONG MajorVersion
Definition: evtlib.h:62
ULONG OldestRecordNumber
Definition: evtlib.h:67
UINTN VOID * Buffer
Definition: acefiex.h:370
ULONG MinorVersion
Definition: evtlib.h:63
VOID UINTN Length
Definition: acefiex.h:744
ULONG BeginRecord
Definition: evtlib.h:128
#define VOID
Definition: acefi.h:82
ULONG EndHeaderSize
Definition: evtlib.h:71
ULONG CurrentRecordNumber
Definition: evtlib.h:66
struct _EVENT_OFFSET_INFO EVENT_OFFSET_INFO
ULONG Fours
Definition: evtlib.h:127
UNICODE_STRING FileName
Definition: evtlib.h:209
ULONG MaxSize
Definition: evtlib.h:68
#define OPTIONAL
Definition: typedefs.h:40
ULONG EndOffset
Definition: evtlib.h:65
USHORT NumStrings
Definition: evtlib.h:95
ULONG CurrentRecordNumber
Definition: evtlib.h:130
NTSTATUS(NTAPI * PELF_FILE_READ_ROUTINE)(IN struct _EVTLOGFILE *LogFile, IN PLARGE_INTEGER FileOffset, OUT PVOID Buffer, IN SIZE_T Length, OUT PSIZE_T ReadLength OPTIONAL)
Definition: evtlib.h:167
ULONG_PTR SIZE_T
Definition: typedefs.h:78
ULONG EventNumber
Definition: evtlib.h:143
LONG NTSTATUS
Definition: DriverTester.h:11
ULONG HeaderSize
Definition: evtlib.h:60
unsigned short USHORT
Definition: pedump.c:61
ULONG Retention
Definition: evtlib.h:70
#define FIELD_OFFSET(t, f)
Definition: typedefs.h:254
PELF_FILE_READ_ROUTINE FileRead
Definition: evtlib.h:204
NTSTATUS NTAPI ElfCreateFile(IN OUT PEVTLOGFILE LogFile, IN PUNICODE_STRING FileName OPTIONAL, IN ULONG FileSize, IN ULONG MaxSize, IN ULONG Retention, IN BOOLEAN CreateNew, IN BOOLEAN ReadOnly, IN PELF_ALLOCATE_ROUTINE Allocate, IN PELF_FREE_ROUTINE Free, IN PELF_FILE_SET_SIZE_ROUTINE FileSetSize, IN PELF_FILE_WRITE_ROUTINE FileWrite, IN PELF_FILE_READ_ROUTINE FileRead, IN PELF_FILE_FLUSH_ROUTINE FileFlush)
Definition: evtlib.c:876
struct _EVENTLOGHEADER * PEVENTLOGHEADER
ULONG OffsetInfoSize
Definition: evtlib.h:211
IN ULONG IN ULONG Tag
Definition: evtlib.h:155
_In_ PLARGE_INTEGER FileOffset
Definition: cctypes.h:53
ULONG StartOffset
Definition: evtlib.h:64
#define OUT
Definition: typedefs.h:39
PELF_FILE_SET_SIZE_ROUTINE FileSetSize
Definition: evtlib.h:202
unsigned int ULONG
Definition: retypes.h:1
#define NTSTATUS
Definition: env_spec_w32.h:77
C_ASSERT(EVENTLOGEOF_SIZE_FIXED==FIELD_OFFSET(EVENTLOGEOF, BeginRecord))
ULONG Reserved
Definition: evtlib.h:89
USHORT EventCategory
Definition: evtlib.h:96
ULONG ClosingRecordNumber
Definition: evtlib.h:98
IN HDEVINFO IN PSP_DEVINFO_DATA DeviceInfoData OPTIONAL
Definition: devinst.c:44
_Must_inspect_result_ _In_ PFILE_OBJECT _In_opt_ PLARGE_INTEGER _In_ ULONG _In_ FLT_IO_OPERATION_FLAGS _Out_opt_ PULONG BytesRead
Definition: fltkernel.h:1255