22 |
#include <Wmistr.h> |
#include <Wmistr.h> |
23 |
#include <Evntrace.h> |
#include <Evntrace.h> |
24 |
#include <cardmod.h> |
#include <cardmod.h> |
25 |
|
#include <DelayImp.h> |
26 |
|
#pragma comment(lib, "Delayimp.lib") |
27 |
#include "Tracing.h" |
#include "Tracing.h" |
28 |
|
|
29 |
|
/** We are doing a lot of complicated stuff (like hooking a delay load import) |
30 |
|
because the Vista tracing function is much better than XP ones. |
31 |
|
The choice was : |
32 |
|
- do not allow the driver to run on xp (set WINVER to 0x600) |
33 |
|
- don't use the great vista tracing functions (set WINVER to 0x500 and comment the function) |
34 |
|
- run on xp AND use this function (set WINVER to 0x600 and allow to run on xp) |
35 |
|
|
36 |
|
=> tried to have the best |
37 |
|
*/ |
38 |
|
|
39 |
#define MessageBoxWin32(status) MessageBoxWin32Ex (status, __FILE__,__LINE__); |
#define MessageBoxWin32(status) MessageBoxWin32Ex (status, __FILE__,__LINE__); |
40 |
|
|
41 |
// to enable tracing in kernel debugger, issue the following command in windbg : ed nt!Kd_DEFAULT_MASK 0xFFFFFFFF |
// to enable tracing in kernel debugger, issue the following command in windbg : ed nt!Kd_DEFAULT_MASK 0xFFFFFFFF |
49 |
0x81cce5f, 0x5f9c, 0x4b43, 0x9a, 0x15, 0x1d, 0xcf, 0x5d, 0x2d, 0x45, 0xf5); |
0x81cce5f, 0x5f9c, 0x4b43, 0x9a, 0x15, 0x1d, 0xcf, 0x5d, 0x2d, 0x45, 0xf5); |
50 |
|
|
51 |
REGHANDLE hPub = 0; |
REGHANDLE hPub = 0; |
52 |
|
BOOL g_bTracingEnabled = FALSE; |
53 |
|
TRACEHANDLE g_SessionHandle = 0; // The handle to the session that enabled the provider. |
54 |
|
UCHAR g_EnableLevel = 0; // Determines the severity of events to log. |
55 |
|
extern BOOL fRunOnVistaAndLater; |
56 |
|
BOOL fDebugOutputIsEnabled = FALSE; |
57 |
|
|
58 |
void TracingRegister() |
typedef struct _event |
59 |
{ |
{ |
60 |
EventRegister(&TracingGuid,NULL,NULL,&hPub); |
EVENT_TRACE_HEADER Header; |
61 |
|
MOF_FIELD Data[MAX_MOF_FIELDS]; // Event-specific data |
62 |
|
} MY_EVENT, *PMY_EVENT; |
63 |
|
|
64 |
|
#define MY_EVENT_TYPE 1 |
65 |
|
#define EVENT_DATA_FIELDS_CNT 1 |
66 |
|
|
67 |
|
INT_PTR FAR WINAPI DoNothing() |
68 |
|
{ |
69 |
|
return 0; |
70 |
} |
} |
71 |
|
|
72 |
void TracingUnRegister() |
// delayHookFunc - Delay load hooking function |
73 |
|
// don't fail to load our dll is the computer is xp |
74 |
|
FARPROC WINAPI delayHookFailureFunc (unsigned dliNotify, PDelayLoadInfo pdli) |
75 |
{ |
{ |
76 |
EventUnregister(hPub); |
UNREFERENCED_PARAMETER(pdli); |
77 |
|
if (_stricmp(pdli->szDll,"advapi32.dll") == 0 && dliNotify == dliFailGetProc) |
78 |
|
{ |
79 |
|
return &DoNothing; |
80 |
|
} |
81 |
|
|
82 |
|
return NULL; |
83 |
} |
} |
84 |
|
|
85 |
|
|
86 |
|
// __delayLoadHelper gets the hook function in here: |
87 |
|
PfnDliHook __pfnDliFailureHook2 = delayHookFailureFunc; |
88 |
|
|
89 |
|
|
90 |
|
|
91 |
|
// The callback function that receives enable/disable notifications |
92 |
|
// from one or more ETW sessions. Because more than one session |
93 |
|
// can enable the provider, this example ignores requests from other |
94 |
|
// sessions if it is already enabled. |
95 |
|
|
96 |
|
ULONG WINAPI ControlCallback( |
97 |
|
WMIDPREQUESTCODE RequestCode, |
98 |
|
PVOID Context, |
99 |
|
ULONG* Reserved, |
100 |
|
PVOID Header |
101 |
|
) |
102 |
|
{ |
103 |
|
ULONG status = ERROR_SUCCESS; |
104 |
|
TRACEHANDLE TempSessionHandle = 0; |
105 |
|
|
106 |
|
switch (RequestCode) |
107 |
|
{ |
108 |
|
case WMI_ENABLE_EVENTS: // Enable the provider. |
109 |
|
{ |
110 |
|
SetLastError(0); |
111 |
|
|
112 |
|
// If the provider is already enabled to a provider, ignore |
113 |
|
// the request. Get the session handle of the enabling session. |
114 |
|
// You need the session handle to call the TraceEvent function. |
115 |
|
// The session could be enabling the provider or it could be |
116 |
|
// updating the level and enable flags. |
117 |
|
|
118 |
|
TempSessionHandle = GetTraceLoggerHandle(Header); |
119 |
|
if (INVALID_HANDLE_VALUE == (HANDLE)TempSessionHandle) |
120 |
|
{ |
121 |
|
wprintf(L"GetTraceLoggerHandle failed. Error code is %lu.\n", status = GetLastError()); |
122 |
|
break; |
123 |
|
} |
124 |
|
|
125 |
|
if (0 == g_SessionHandle) |
126 |
|
{ |
127 |
|
g_SessionHandle = TempSessionHandle; |
128 |
|
} |
129 |
|
else if (g_SessionHandle != TempSessionHandle) |
130 |
|
{ |
131 |
|
break; |
132 |
|
} |
133 |
|
|
134 |
|
// Get the severity level of the events that the |
135 |
|
// session wants you to log. |
136 |
|
|
137 |
|
g_EnableLevel = GetTraceEnableLevel(g_SessionHandle); |
138 |
|
g_bTracingEnabled = TRUE; |
139 |
|
break; |
140 |
|
} |
141 |
|
|
142 |
|
case WMI_DISABLE_EVENTS: // Disable the provider. |
143 |
|
{ |
144 |
|
// Disable the provider only if the request is coming from the |
145 |
|
// session that enabled the provider. |
146 |
|
|
147 |
|
TempSessionHandle = GetTraceLoggerHandle(Header); |
148 |
|
if (INVALID_HANDLE_VALUE == (HANDLE)TempSessionHandle) |
149 |
|
{ |
150 |
|
wprintf(L"GetTraceLoggerHandle failed. Error code is %lu.\n", status = GetLastError()); |
151 |
|
break; |
152 |
|
} |
153 |
|
|
154 |
|
if (g_SessionHandle == TempSessionHandle) |
155 |
|
{ |
156 |
|
g_bTracingEnabled = FALSE; |
157 |
|
g_SessionHandle = 0; |
158 |
|
} |
159 |
|
break; |
160 |
|
} |
161 |
|
|
162 |
|
default: |
163 |
|
{ |
164 |
|
status = ERROR_INVALID_PARAMETER; |
165 |
|
break; |
166 |
|
} |
167 |
|
} |
168 |
|
|
169 |
|
return status; |
170 |
|
} |
171 |
|
|
172 |
|
// callback to know if the tracing is activated |
173 |
|
VOID NTAPI ControlCallbackVista ( |
174 |
|
__in LPCGUID SourceId, |
175 |
|
__in ULONG IsEnabled, |
176 |
|
__in UCHAR Level, |
177 |
|
__in ULONGLONG MatchAnyKeyword, |
178 |
|
__in ULONGLONG MatchAllKeyword, |
179 |
|
__in_opt PEVENT_FILTER_DESCRIPTOR FilterData, |
180 |
|
__in_opt PVOID CallbackContext |
181 |
|
) |
182 |
|
{ |
183 |
|
g_bTracingEnabled = (IsEnabled?TRUE:FALSE); |
184 |
|
} |
185 |
|
|
186 |
|
// called to setup the tracing context |
187 |
|
void TracingRegister() |
188 |
|
{ |
189 |
|
if (fRunOnVistaAndLater) |
190 |
|
{ |
191 |
|
EventRegister(&TracingGuid,ControlCallbackVista,NULL,&hPub); |
192 |
|
} |
193 |
|
else |
194 |
|
{ |
195 |
|
RegisterTraceGuids( |
196 |
|
ControlCallback, |
197 |
|
NULL, |
198 |
|
&TracingGuid, |
199 |
|
0, NULL, NULL, |
200 |
|
NULL, |
201 |
|
&hPub); |
202 |
|
} |
203 |
|
#ifdef _DEBUG |
204 |
|
fDebugOutputIsEnabled = TRUE; |
205 |
|
#endif |
206 |
|
} |
207 |
|
// called to clean up the tracing context |
208 |
|
void TracingUnRegister() |
209 |
|
{ |
210 |
|
if (fRunOnVistaAndLater) |
211 |
|
{ |
212 |
|
EventUnregister(hPub); |
213 |
|
} |
214 |
|
else |
215 |
|
{ |
216 |
|
UnregisterTraceGuids(hPub ); |
217 |
|
} |
218 |
|
} |
219 |
|
// write a single line in the trace |
220 |
|
void WriteTrace(UCHAR dwLevel, PWSTR szTrace) |
221 |
|
{ |
222 |
|
if (fRunOnVistaAndLater) |
223 |
|
{ |
224 |
|
EventWriteString(hPub,dwLevel,0,szTrace); |
225 |
|
} |
226 |
|
else |
227 |
|
{ |
228 |
|
MY_EVENT MyEvent; |
229 |
|
NTSTATUS status; |
230 |
|
|
231 |
|
if (g_bTracingEnabled && (0 == g_EnableLevel || dwLevel <= g_EnableLevel)) |
232 |
|
{ |
233 |
|
// Initialize the event data structure. |
234 |
|
|
235 |
|
ZeroMemory(&MyEvent, sizeof(MY_EVENT)); |
236 |
|
MyEvent.Header.Size = sizeof(EVENT_TRACE_HEADER) + (sizeof(MOF_FIELD) * EVENT_DATA_FIELDS_CNT); |
237 |
|
MyEvent.Header.Flags = WNODE_FLAG_TRACED_GUID | WNODE_FLAG_USE_MOF_PTR; |
238 |
|
MyEvent.Header.Guid = TracingGuid; |
239 |
|
MyEvent.Header.Class.Type = MY_EVENT_TYPE; |
240 |
|
MyEvent.Header.Class.Version = 1; |
241 |
|
MyEvent.Header.Class.Level = dwLevel; |
242 |
|
|
243 |
|
// Load the event data. You can also use the DEFINE_TRACE_MOF_FIELD |
244 |
|
// macro defined in evntrace.h to set the MOF_FIELD members. For example, |
245 |
|
// DEFINE_TRACE_MOF_FIELD(&EventData.Data[0], &EventData.Cost, sizeof(EventData.Cost), 0); |
246 |
|
|
247 |
|
MyEvent.Data[0].DataPtr = (ULONG64) szTrace; |
248 |
|
MyEvent.Data[0].Length = (ULONG) (sizeof(WCHAR) * (1 + wcslen(szTrace))); |
249 |
|
MyEvent.Data[0].DataType = ETW_STRING_TYPE_VALUE; |
250 |
|
|
251 |
|
// Write the event. |
252 |
|
|
253 |
|
status = TraceEvent(g_SessionHandle, &(MyEvent.Header)); |
254 |
|
if (ERROR_SUCCESS != status) |
255 |
|
{ |
256 |
|
g_bTracingEnabled = FALSE; |
257 |
|
} |
258 |
|
} |
259 |
|
} |
260 |
|
} |
261 |
|
|
262 |
void TraceEx(LPCSTR szFile, DWORD dwLine, LPCSTR szFunction, UCHAR dwLevel, PCWSTR szFormat,...) |
void TraceEx(LPCSTR szFile, DWORD dwLine, LPCSTR szFunction, UCHAR dwLevel, PCWSTR szFormat,...) |
263 |
{ |
{ |
264 |
WCHAR Buffer[256]; |
WCHAR Buffer[256]; |
270 |
UNREFERENCED_PARAMETER(szFile); |
UNREFERENCED_PARAMETER(szFile); |
271 |
#endif |
#endif |
272 |
if (!hPub) TracingRegister(); |
if (!hPub) TracingRegister(); |
273 |
|
if ( g_bTracingEnabled || fDebugOutputIsEnabled) { |
274 |
|
|
275 |
va_start (ap, szFormat); |
va_start (ap, szFormat); |
276 |
ret = _vsnwprintf_s (Buffer, 256, _TRUNCATE, szFormat, ap); |
ret = _vsnwprintf_s (Buffer, 256, _TRUNCATE, szFormat, ap); |
277 |
va_end (ap); |
va_end (ap); |
278 |
if (ret <= 0) return; |
if (ret <= 0) return; |
279 |
if (ret > 256) ret = 255; |
if (ret > 256) ret = 255; |
280 |
Buffer[255] = L'\0'; |
Buffer[255] = L'\0'; |
281 |
#ifdef _DEBUG |
if (fDebugOutputIsEnabled) |
282 |
swprintf_s(Buffer2,356,L"%S(%d) : %S - %s\r\n",szFile,dwLine,szFunction,Buffer); |
{ |
283 |
OutputDebugString(Buffer2); |
swprintf_s(Buffer2,356,L"%S(%d) : %S - %s\r\n",szFile,dwLine,szFunction,Buffer); |
284 |
#endif |
OutputDebugString(Buffer2); |
285 |
swprintf_s(Buffer2,356,L"%S(%d) : %s",szFunction,dwLine,Buffer); |
} |
286 |
EventWriteString(hPub,dwLevel,0,Buffer2); |
if (g_bTracingEnabled) |
287 |
|
{ |
288 |
|
swprintf_s(Buffer2,356,L"%S(%d) : %s",szFunction,dwLine,Buffer); |
289 |
|
WriteTrace(dwLevel, Buffer2); |
290 |
|
} |
291 |
|
} |
292 |
} |
} |
293 |
|
|
294 |
|
|
295 |
|
|
296 |
void TraceDumpEx(LPCSTR szFile, DWORD dwLine, LPCSTR szFunction, UCHAR dwLevel, |
void TraceDumpEx(LPCSTR szFile, DWORD dwLine, LPCSTR szFunction, UCHAR dwLevel, |
297 |
__in PBYTE pbCmd, __in DWORD dwCmdSize) |
__in PBYTE pbCmd, __in DWORD dwCmdSize) |
298 |
{ |
{ |