trunk/OpenPGPminidriver/Tracing.c

/*      OpenPGP Smart Card Mini Driver
    Copyright (C) 2009 Vincent Le Toux

    This library is Free software; you can redistribute it and/or
    modify it under the terms of the GNU Lesser General Public
    License version 2.1 as published by the Free Software Foundation.

    This library is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
    Lesser General Public License for more details.

    You should have received a copy of the GNU Lesser General Public
    License along with this library; if not, write to the Free Software
    Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
*/

#include <windows.h>
#include <tchar.h>
#include <Evntprov.h>
#include <initguid.h>
#include <Wmistr.h>
#include <Evntrace.h>
#include <cardmod.h>
#include "Tracing.h"

#define MessageBoxWin32(status) MessageBoxWin32Ex (status, __FILE__,__LINE__);

// to enable tracing in kernel debugger, issue the following command in windbg : ed nt!Kd_DEFAULT_MASK  0xFFFFFFFF
// OR
// Open up the registry and go to this path,
// HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Debug Print Filter 
// and add the following value "DEFAULT" : REG_DWORD : 0xFFFFFFFF and then reboot

// {081CCE5F-5F9C-4b43-9A15-1DCF5D2D45F5}
DEFINE_GUID(TracingGuid, 
0x81cce5f, 0x5f9c, 0x4b43, 0x9a, 0x15, 0x1d, 0xcf, 0x5d, 0x2d, 0x45, 0xf5);

REGHANDLE hPub = 0;

void TracingRegister() {
        EventRegister(&TracingGuid,NULL,NULL,&hPub);
}

void TracingUnRegister() {
        EventUnregister(hPub);
}


void TraceEx(LPCSTR szFile, DWORD dwLine, LPCSTR szFunction, UCHAR dwLevel, PCWSTR szFormat,...) {
#ifndef _DEBUG
        UNREFERENCED_PARAMETER(dwLine);
        UNREFERENCED_PARAMETER(szFile);
#endif
        WCHAR Buffer[256];
        WCHAR Buffer2[356];
        int ret;
        va_list ap;

        if (!hPub) TracingRegister();

        va_start (ap, szFormat);
        ret = _vsnwprintf_s (Buffer, 256, 256, szFormat, ap);
        va_end (ap);
        if (ret <= 0) return;
        if (ret > 256) ret = 255;
        Buffer[255] = L'\0';
#ifdef _DEBUG
        swprintf_s(Buffer2,356,L"%S(%d) : %S - %s\r\n",szFile,dwLine,szFunction,Buffer);
        OutputDebugString(Buffer2);
#endif
        swprintf_s(Buffer2,356,L"%S(%d) : %s",szFunction,dwLine,Buffer);
        EventWriteString(hPub,dwLevel,0,Buffer2);

}

void TraceDumpEx(LPCSTR szFile, DWORD dwLine, LPCSTR szFunction, UCHAR dwLevel,
                          __in PBYTE pbCmd, __in DWORD dwCmdSize)
{
        WCHAR szData[10 * 3 + 1];
        DWORD dwI;
        PWSTR szPointer = szData;
        for(dwI = 0; dwI < dwCmdSize; dwI++)
        {
                if (dwI%10 == 0 && dwI != 0)
                {
                        TraceEx(szFile,dwLine,szFunction,dwLevel,L"DUMP : %s",szData);
                        szPointer = szData;
                }
                swprintf_s(szPointer + 3 * (dwI%10),4,L"%02X ",pbCmd[dwI]);
                
        }
        TraceEx(szFile,dwLine,szFunction,dwLevel,L"DUMP : %s",szData);
}

/**
 *  Display a messagebox giving an error code
 */
void MessageBoxWin32Ex(DWORD status, LPCSTR szFile, DWORD dwLine) {
        LPVOID Error;
        TCHAR szTitle[1024];
#ifdef UNICODE
        _stprintf_s(szTitle,ARRAYSIZE(szTitle),TEXT("%S(%d)"),szFile, dwLine);
#else
        _stprintf_s(szTitle,ARRAYSIZE(szTitle),TEXT("%s(%d)"),szFile, dwLine);
#endif
        FormatMessage(FORMAT_MESSAGE_ALLOCATE_BUFFER|FORMAT_MESSAGE_FROM_SYSTEM,
                NULL,status,0,(LPTSTR)&Error,0,NULL);
        MessageBox(NULL,(LPCTSTR)Error,szTitle ,MB_ICONASTERISK);
        LocalFree(Error);
}

BOOL StartLogging()
{
        BOOL fReturn = FALSE;
        TRACEHANDLE SessionHandle;
        struct _Prop
        {
                EVENT_TRACE_PROPERTIES TraceProperties;
                TCHAR LogFileName[1024];
                TCHAR LoggerName[1024];
        } Properties;
        ULONG err;
        __try
        {
                memset(&Properties, 0, sizeof(Properties));
                Properties.TraceProperties.Wnode.BufferSize = sizeof(Properties);
                Properties.TraceProperties.Wnode.Guid = TracingGuid;
                Properties.TraceProperties.Wnode.Flags = WNODE_FLAG_TRACED_GUID;
                Properties.TraceProperties.Wnode.ClientContext = 1;
                Properties.TraceProperties.LogFileMode = 4864; 
                Properties.TraceProperties.LogFileNameOffset = sizeof(EVENT_TRACE_PROPERTIES);
                Properties.TraceProperties.LoggerNameOffset = sizeof(EVENT_TRACE_PROPERTIES) + 1024;
                Properties.TraceProperties.MaximumFileSize = 8;
                _tcscpy_s(Properties.LogFileName,1024,TEXT("c:\\Windows\\system32\\LogFiles\\WMI\\OpenPGPmdrv.etl"));
                DeleteFile(Properties.LogFileName);
                err = StartTrace(&SessionHandle, TEXT("OpenPGPmdrv"), &(Properties.TraceProperties));
                if (err != ERROR_SUCCESS)
                {
                        MessageBoxWin32(err);
                        __leave;
                }
                err = EnableTraceEx(&TracingGuid,NULL,SessionHandle,TRUE,WINEVENT_LEVEL_VERBOSE,0,0,0,NULL);
                if (err != ERROR_SUCCESS)
                {
                        MessageBoxWin32(err);
                        __leave;
                }
                fReturn = TRUE;
        }
        __finally
        {
        }
        return fReturn;
}

void StopLogging()
{
        LONG err;
        struct _Prop
        {
                EVENT_TRACE_PROPERTIES TraceProperties;
                TCHAR LogFileName[1024];
                TCHAR LoggerName[1024];
        } Properties;
        memset(&Properties, 0, sizeof(Properties));
        Properties.TraceProperties.Wnode.BufferSize = sizeof(Properties);
        Properties.TraceProperties.Wnode.Guid = TracingGuid;
        Properties.TraceProperties.Wnode.Flags = WNODE_FLAG_TRACED_GUID;
        Properties.TraceProperties.LogFileMode = 4864; 
        Properties.TraceProperties.LogFileNameOffset = sizeof(EVENT_TRACE_PROPERTIES);
        Properties.TraceProperties.LoggerNameOffset = sizeof(EVENT_TRACE_PROPERTIES) + 1024 * sizeof(TCHAR);
        Properties.TraceProperties.MaximumFileSize = 8;
        err = ControlTrace((TRACEHANDLE)NULL, TEXT("OpenPGPmdrv"), &(Properties.TraceProperties),EVENT_TRACE_CONTROL_STOP);
        if (err != ERROR_SUCCESS && err != 0x00001069)
        {
                MessageBoxWin32(err);
        }
}

void EnableLogging()
{
        DWORD64 qdwValue;
        DWORD dwValue;
        LONG err;

        err = RegSetKeyValue(   HKEY_LOCAL_MACHINE, 
                TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv"), 
                TEXT("Guid"), REG_SZ, TEXT("{081CCE5F-5F9C-4b43-9A15-1DCF5D2D45F5}"),sizeof(TEXT("{081CCE5F-5F9C-4b43-9A15-1DCF5D2D45F5}")));
        if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
        err = RegSetKeyValue(   HKEY_LOCAL_MACHINE, 
                TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv"), 
                TEXT("FileName"), REG_SZ, TEXT("c:\\windows\\system32\\LogFiles\\WMI\\OpenPGPmdrv.etl"),sizeof(TEXT("c:\\windows\\system32\\LogFiles\\WMI\\OpenPGPmdrv.etl")));
        if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
        dwValue = 8;
        err = RegSetKeyValue(   HKEY_LOCAL_MACHINE, 
                TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv"), 
                TEXT("FileMax"), REG_DWORD,&dwValue,sizeof(DWORD));
        if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
        dwValue = 1;
        err = RegSetKeyValue(   HKEY_LOCAL_MACHINE, 
                TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv"), 
                TEXT("Start"), REG_DWORD,&dwValue,sizeof(DWORD));
        if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
        dwValue = 8;
        err = RegSetKeyValue(   HKEY_LOCAL_MACHINE, 
                TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv"), 
                TEXT("BufferSize"), REG_DWORD,&dwValue,sizeof(DWORD));
        if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
        dwValue = 0;
        err = RegSetKeyValue(   HKEY_LOCAL_MACHINE, 
                TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv"), 
                TEXT("FlushTimer"), REG_DWORD,&dwValue,sizeof(DWORD));
        if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
        dwValue = 0;
        err = RegSetKeyValue(   HKEY_LOCAL_MACHINE, 
                TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv"), 
                TEXT("MaximumBuffers"), REG_DWORD,&dwValue,sizeof(DWORD));
        if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
        dwValue = 0;
        err = RegSetKeyValue(   HKEY_LOCAL_MACHINE, 
                TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv"), 
                TEXT("MinimumBuffers"), REG_DWORD,&dwValue,sizeof(DWORD));
        if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
        dwValue = 1;
        err = RegSetKeyValue(   HKEY_LOCAL_MACHINE, 
                TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv"), 
                TEXT("ClockType"), REG_DWORD,&dwValue,sizeof(DWORD));
        if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
        dwValue = 64;
        err = RegSetKeyValue(   HKEY_LOCAL_MACHINE, 
                TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv"), 
                TEXT("MaxFileSize"), REG_DWORD,&dwValue,sizeof(DWORD));
        if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
        dwValue = 4864;
        err = RegSetKeyValue(   HKEY_LOCAL_MACHINE, 
                TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv"), 
                TEXT("LogFileMode"), REG_DWORD,&dwValue,sizeof(DWORD));
        if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
        dwValue = 5;
        err = RegSetKeyValue(   HKEY_LOCAL_MACHINE, 
                TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv"), 
                TEXT("FileCounter"), REG_DWORD,&dwValue,sizeof(DWORD));
        if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
        dwValue = 0;
        err = RegSetKeyValue(   HKEY_LOCAL_MACHINE, 
                TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv"), 
                TEXT("Status"), REG_DWORD,&dwValue,sizeof(DWORD));
        if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}

        dwValue = 1;
        err = RegSetKeyValue(   HKEY_LOCAL_MACHINE, 
                TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv\\{081CCE5F-5F9C-4b43-9A15-1DCF5D2D45F5}"), 
                TEXT("Enabled"), REG_DWORD,&dwValue,sizeof(DWORD));
        if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
        dwValue = 5;
        err = RegSetKeyValue(   HKEY_LOCAL_MACHINE, 
                TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv\\{081CCE5F-5F9C-4b43-9A15-1DCF5D2D45F5}"), 
                TEXT("EnableLevel"), REG_DWORD,&dwValue,sizeof(DWORD));
        if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
        dwValue = 0;
        err = RegSetKeyValue(   HKEY_LOCAL_MACHINE, 
                TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv\\{081CCE5F-5F9C-4b43-9A15-1DCF5D2D45F5}"), 
                TEXT("EnableProperty"), REG_DWORD,&dwValue,sizeof(DWORD));
        if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
        dwValue = 0;
        err = RegSetKeyValue(   HKEY_LOCAL_MACHINE, 
                TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv\\{081CCE5F-5F9C-4b43-9A15-1DCF5D2D45F5}"), 
                TEXT("Status"), REG_DWORD,&dwValue,sizeof(DWORD));
        if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
        qdwValue = 0;
        err = RegSetKeyValue(   HKEY_LOCAL_MACHINE, 
                TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv\\{081CCE5F-5F9C-4b43-9A15-1DCF5D2D45F5}"), 
                TEXT("MatchAllKeyword"), REG_QWORD,&qdwValue,sizeof(DWORD64));
        if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
        qdwValue = 0;
        err = RegSetKeyValue(   HKEY_LOCAL_MACHINE, 
                TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv\\{081CCE5F-5F9C-4b43-9A15-1DCF5D2D45F5}"), 
                TEXT("MatchAnyKeyword"), REG_QWORD,&qdwValue,sizeof(DWORD64));
        if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
        StartLogging();
}

void DisableLogging()
{
        
        LONG err = RegDeleteTree(HKEY_LOCAL_MACHINE, TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv"));
        if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
        StopLogging();
}
1	vletoux	1	/* OpenPGP Smart Card Mini Driver
2			Copyright (C) 2009 Vincent Le Toux
3
4			This library is Free software; you can redistribute it and/or
5			modify it under the terms of the GNU Lesser General Public
6			License version 2.1 as published by the Free Software Foundation.
7
8			This library is distributed in the hope that it will be useful,
9			but WITHOUT ANY WARRANTY; without even the implied warranty of
10			MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
11			Lesser General Public License for more details.
12
13			You should have received a copy of the GNU Lesser General Public
14			License along with this library; if not, write to the Free Software
15			Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
16			*/
17
18			#include <windows.h>
19			#include <tchar.h>
20			#include <Evntprov.h>
21			#include <initguid.h>
22			#include <Wmistr.h>
23			#include <Evntrace.h>
24			#include <cardmod.h>
25			#include "Tracing.h"
26
27			#define MessageBoxWin32(status) MessageBoxWin32Ex (status, __FILE__,__LINE__);
28
29			// to enable tracing in kernel debugger, issue the following command in windbg : ed nt!Kd_DEFAULT_MASK 0xFFFFFFFF
30			// OR
31			// Open up the registry and go to this path,
32			// HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Debug Print Filter
33			// and add the following value "DEFAULT" : REG_DWORD : 0xFFFFFFFF and then reboot
34
35			// {081CCE5F-5F9C-4b43-9A15-1DCF5D2D45F5}
36			DEFINE_GUID(TracingGuid,
37			0x81cce5f, 0x5f9c, 0x4b43, 0x9a, 0x15, 0x1d, 0xcf, 0x5d, 0x2d, 0x45, 0xf5);
38
39			REGHANDLE hPub = 0;
40
41			void TracingRegister() {
42			EventRegister(&TracingGuid,NULL,NULL,&hPub);
43			}
44
45			void TracingUnRegister() {
46			EventUnregister(hPub);
47			}
48
49
50			void TraceEx(LPCSTR szFile, DWORD dwLine, LPCSTR szFunction, UCHAR dwLevel, PCWSTR szFormat,...) {
51			#ifndef _DEBUG
52			UNREFERENCED_PARAMETER(dwLine);
53			UNREFERENCED_PARAMETER(szFile);
54			#endif
55			WCHAR Buffer[256];
56			WCHAR Buffer2[356];
57			int ret;
58			va_list ap;
59
60			if (!hPub) TracingRegister();
61
62			va_start (ap, szFormat);
63			ret = _vsnwprintf_s (Buffer, 256, 256, szFormat, ap);
64			va_end (ap);
65			if (ret <= 0) return;
66			if (ret > 256) ret = 255;
67			Buffer[255] = L'\0';
68			#ifdef _DEBUG
69			swprintf_s(Buffer2,356,L"%S(%d) : %S - %s\r\n",szFile,dwLine,szFunction,Buffer);
70			OutputDebugString(Buffer2);
71			#endif
72			swprintf_s(Buffer2,356,L"%S(%d) : %s",szFunction,dwLine,Buffer);
73			EventWriteString(hPub,dwLevel,0,Buffer2);
74
75			}
76
77			void TraceDumpEx(LPCSTR szFile, DWORD dwLine, LPCSTR szFunction, UCHAR dwLevel,
78			__in PBYTE pbCmd, __in DWORD dwCmdSize)
79			{
80			WCHAR szData[10 * 3 + 1];
81			DWORD dwI;
82			PWSTR szPointer = szData;
83			for(dwI = 0; dwI < dwCmdSize; dwI++)
84			{
85			if (dwI%10 == 0 && dwI != 0)
86			{
87			TraceEx(szFile,dwLine,szFunction,dwLevel,L"DUMP : %s",szData);
88			szPointer = szData;
89			}
90			swprintf_s(szPointer + 3 * (dwI%10),4,L"%02X ",pbCmd[dwI]);
91
92			}
93			TraceEx(szFile,dwLine,szFunction,dwLevel,L"DUMP : %s",szData);
94			}
95
96			/**
97			* Display a messagebox giving an error code
98			*/
99			void MessageBoxWin32Ex(DWORD status, LPCSTR szFile, DWORD dwLine) {
100			LPVOID Error;
101			TCHAR szTitle[1024];
102			#ifdef UNICODE
103			_stprintf_s(szTitle,ARRAYSIZE(szTitle),TEXT("%S(%d)"),szFile, dwLine);
104			#else
105			_stprintf_s(szTitle,ARRAYSIZE(szTitle),TEXT("%s(%d)"),szFile, dwLine);
106			#endif
107			FormatMessage(FORMAT_MESSAGE_ALLOCATE_BUFFER\|FORMAT_MESSAGE_FROM_SYSTEM,
108			NULL,status,0,(LPTSTR)&Error,0,NULL);
109			MessageBox(NULL,(LPCTSTR)Error,szTitle ,MB_ICONASTERISK);
110			LocalFree(Error);
111			}
112
113			BOOL StartLogging()
114			{
115			BOOL fReturn = FALSE;
116			TRACEHANDLE SessionHandle;
117			struct _Prop
118			{
119			EVENT_TRACE_PROPERTIES TraceProperties;
120			TCHAR LogFileName[1024];
121			TCHAR LoggerName[1024];
122			} Properties;
123			ULONG err;
124			__try
125			{
126			memset(&Properties, 0, sizeof(Properties));
127			Properties.TraceProperties.Wnode.BufferSize = sizeof(Properties);
128			Properties.TraceProperties.Wnode.Guid = TracingGuid;
129			Properties.TraceProperties.Wnode.Flags = WNODE_FLAG_TRACED_GUID;
130			Properties.TraceProperties.Wnode.ClientContext = 1;
131			Properties.TraceProperties.LogFileMode = 4864;
132			Properties.TraceProperties.LogFileNameOffset = sizeof(EVENT_TRACE_PROPERTIES);
133			Properties.TraceProperties.LoggerNameOffset = sizeof(EVENT_TRACE_PROPERTIES) + 1024;
134			Properties.TraceProperties.MaximumFileSize = 8;
135			_tcscpy_s(Properties.LogFileName,1024,TEXT("c:\\Windows\\system32\\LogFiles\\WMI\\OpenPGPmdrv.etl"));
136			DeleteFile(Properties.LogFileName);
137			err = StartTrace(&SessionHandle, TEXT("OpenPGPmdrv"), &(Properties.TraceProperties));
138			if (err != ERROR_SUCCESS)
139			{
140			MessageBoxWin32(err);
141			__leave;
142			}
143			err = EnableTraceEx(&TracingGuid,NULL,SessionHandle,TRUE,WINEVENT_LEVEL_VERBOSE,0,0,0,NULL);
144			if (err != ERROR_SUCCESS)
145			{
146			MessageBoxWin32(err);
147			__leave;
148			}
149			fReturn = TRUE;
150			}
151			__finally
152			{
153			}
154			return fReturn;
155			}
156
157			void StopLogging()
158			{
159			LONG err;
160			struct _Prop
161			{
162			EVENT_TRACE_PROPERTIES TraceProperties;
163			TCHAR LogFileName[1024];
164			TCHAR LoggerName[1024];
165			} Properties;
166			memset(&Properties, 0, sizeof(Properties));
167			Properties.TraceProperties.Wnode.BufferSize = sizeof(Properties);
168			Properties.TraceProperties.Wnode.Guid = TracingGuid;
169			Properties.TraceProperties.Wnode.Flags = WNODE_FLAG_TRACED_GUID;
170			Properties.TraceProperties.LogFileMode = 4864;
171			Properties.TraceProperties.LogFileNameOffset = sizeof(EVENT_TRACE_PROPERTIES);
172			Properties.TraceProperties.LoggerNameOffset = sizeof(EVENT_TRACE_PROPERTIES) + 1024 * sizeof(TCHAR);
173			Properties.TraceProperties.MaximumFileSize = 8;
174			err = ControlTrace((TRACEHANDLE)NULL, TEXT("OpenPGPmdrv"), &(Properties.TraceProperties),EVENT_TRACE_CONTROL_STOP);
175			if (err != ERROR_SUCCESS && err != 0x00001069)
176			{
177			MessageBoxWin32(err);
178			}
179			}
180
181			void EnableLogging()
182			{
183			DWORD64 qdwValue;
184			DWORD dwValue;
185			LONG err;
186
187			err = RegSetKeyValue( HKEY_LOCAL_MACHINE,
188			TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv"),
189			TEXT("Guid"), REG_SZ, TEXT("{081CCE5F-5F9C-4b43-9A15-1DCF5D2D45F5}"),sizeof(TEXT("{081CCE5F-5F9C-4b43-9A15-1DCF5D2D45F5}")));
190			if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
191			err = RegSetKeyValue( HKEY_LOCAL_MACHINE,
192			TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv"),
193			TEXT("FileName"), REG_SZ, TEXT("c:\\windows\\system32\\LogFiles\\WMI\\OpenPGPmdrv.etl"),sizeof(TEXT("c:\\windows\\system32\\LogFiles\\WMI\\OpenPGPmdrv.etl")));
194			if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
195			dwValue = 8;
196			err = RegSetKeyValue( HKEY_LOCAL_MACHINE,
197			TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv"),
198			TEXT("FileMax"), REG_DWORD,&dwValue,sizeof(DWORD));
199			if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
200			dwValue = 1;
201			err = RegSetKeyValue( HKEY_LOCAL_MACHINE,
202			TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv"),
203			TEXT("Start"), REG_DWORD,&dwValue,sizeof(DWORD));
204			if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
205			dwValue = 8;
206			err = RegSetKeyValue( HKEY_LOCAL_MACHINE,
207			TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv"),
208			TEXT("BufferSize"), REG_DWORD,&dwValue,sizeof(DWORD));
209			if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
210			dwValue = 0;
211			err = RegSetKeyValue( HKEY_LOCAL_MACHINE,
212			TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv"),
213			TEXT("FlushTimer"), REG_DWORD,&dwValue,sizeof(DWORD));
214			if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
215			dwValue = 0;
216			err = RegSetKeyValue( HKEY_LOCAL_MACHINE,
217			TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv"),
218			TEXT("MaximumBuffers"), REG_DWORD,&dwValue,sizeof(DWORD));
219			if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
220			dwValue = 0;
221			err = RegSetKeyValue( HKEY_LOCAL_MACHINE,
222			TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv"),
223			TEXT("MinimumBuffers"), REG_DWORD,&dwValue,sizeof(DWORD));
224			if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
225			dwValue = 1;
226			err = RegSetKeyValue( HKEY_LOCAL_MACHINE,
227			TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv"),
228			TEXT("ClockType"), REG_DWORD,&dwValue,sizeof(DWORD));
229			if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
230			dwValue = 64;
231			err = RegSetKeyValue( HKEY_LOCAL_MACHINE,
232			TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv"),
233			TEXT("MaxFileSize"), REG_DWORD,&dwValue,sizeof(DWORD));
234			if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
235			dwValue = 4864;
236			err = RegSetKeyValue( HKEY_LOCAL_MACHINE,
237			TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv"),
238			TEXT("LogFileMode"), REG_DWORD,&dwValue,sizeof(DWORD));
239			if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
240			dwValue = 5;
241			err = RegSetKeyValue( HKEY_LOCAL_MACHINE,
242			TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv"),
243			TEXT("FileCounter"), REG_DWORD,&dwValue,sizeof(DWORD));
244			if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
245			dwValue = 0;
246			err = RegSetKeyValue( HKEY_LOCAL_MACHINE,
247			TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv"),
248			TEXT("Status"), REG_DWORD,&dwValue,sizeof(DWORD));
249			if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
250
251			dwValue = 1;
252			err = RegSetKeyValue( HKEY_LOCAL_MACHINE,
253			TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv\\{081CCE5F-5F9C-4b43-9A15-1DCF5D2D45F5}"),
254			TEXT("Enabled"), REG_DWORD,&dwValue,sizeof(DWORD));
255			if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
256			dwValue = 5;
257			err = RegSetKeyValue( HKEY_LOCAL_MACHINE,
258			TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv\\{081CCE5F-5F9C-4b43-9A15-1DCF5D2D45F5}"),
259			TEXT("EnableLevel"), REG_DWORD,&dwValue,sizeof(DWORD));
260			if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
261			dwValue = 0;
262			err = RegSetKeyValue( HKEY_LOCAL_MACHINE,
263			TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv\\{081CCE5F-5F9C-4b43-9A15-1DCF5D2D45F5}"),
264			TEXT("EnableProperty"), REG_DWORD,&dwValue,sizeof(DWORD));
265			if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
266			dwValue = 0;
267			err = RegSetKeyValue( HKEY_LOCAL_MACHINE,
268			TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv\\{081CCE5F-5F9C-4b43-9A15-1DCF5D2D45F5}"),
269			TEXT("Status"), REG_DWORD,&dwValue,sizeof(DWORD));
270			if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
271			qdwValue = 0;
272			err = RegSetKeyValue( HKEY_LOCAL_MACHINE,
273			TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv\\{081CCE5F-5F9C-4b43-9A15-1DCF5D2D45F5}"),
274			TEXT("MatchAllKeyword"), REG_QWORD,&qdwValue,sizeof(DWORD64));
275			if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
276			qdwValue = 0;
277			err = RegSetKeyValue( HKEY_LOCAL_MACHINE,
278			TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv\\{081CCE5F-5F9C-4b43-9A15-1DCF5D2D45F5}"),
279			TEXT("MatchAnyKeyword"), REG_QWORD,&qdwValue,sizeof(DWORD64));
280			if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
281			StartLogging();
282			}
283
284			void DisableLogging()
285			{
286
287			LONG err = RegDeleteTree(HKEY_LOCAL_MACHINE, TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv"));
288			if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
289			StopLogging();
290			}