trunk/OpenPGPminidriver/Tracing.c

/*      OpenPGP Smart Card Mini Driver
    Copyright (C) 2009 Vincent Le Toux

    This library is Free software; you can redistribute it and/or
    modify it under the terms of the GNU Lesser General Public
    License version 2.1 as published by the Free Software Foundation.

    This library is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
    Lesser General Public License for more details.

    You should have received a copy of the GNU Lesser General Public
    License along with this library; if not, write to the Free Software
    Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
*/

#include <windows.h>
#include <tchar.h>
#include <Evntprov.h>
#include <initguid.h>
#include <Wmistr.h>
#include <Evntrace.h>
#include <cardmod.h>
#include <DelayImp.h>
#pragma comment(lib, "Delayimp.lib")
#include "Tracing.h"

/** We are doing a lot of complicated stuff (like hooking a delay load import)
because the Vista tracing function is much better than XP ones.
The choice was :
- do not allow the driver to run on xp (set WINVER to 0x600)
- don't use the great vista tracing functions (set WINVER to 0x500 and comment the function)
- run on xp AND use this function (set WINVER to 0x600 and allow to run on xp)

=> tried to have the best
*/

#define MessageBoxWin32(status) MessageBoxWin32Ex (status, __FILE__,__LINE__);

// to enable tracing in kernel debugger, issue the following command in windbg : ed nt!Kd_DEFAULT_MASK  0xFFFFFFFF
// OR
// Open up the registry and go to this path,
// HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Debug Print Filter 
// and add the following value "DEFAULT" : REG_DWORD : 0xFFFFFFFF and then reboot

// {081CCE5F-5F9C-4b43-9A15-1DCF5D2D45F5}
DEFINE_GUID(TracingGuid, 
0x81cce5f, 0x5f9c, 0x4b43, 0x9a, 0x15, 0x1d, 0xcf, 0x5d, 0x2d, 0x45, 0xf5);

REGHANDLE hPub = 0;
BOOL          g_bTracingEnabled         = FALSE;
TRACEHANDLE   g_SessionHandle = 0; // The handle to the session that enabled the provider.
UCHAR g_EnableLevel = 0; // Determines the severity of events to log.
extern BOOL fRunOnVistaAndLater;
BOOL fDebugOutputIsEnabled = FALSE;

typedef struct _event
{
    EVENT_TRACE_HEADER Header;
    MOF_FIELD Data[MAX_MOF_FIELDS];  // Event-specific data
} MY_EVENT, *PMY_EVENT;

#define MY_EVENT_TYPE 1
#define EVENT_DATA_FIELDS_CNT  1

INT_PTR FAR WINAPI DoNothing()
{
        return 0;
}

// delayHookFunc - Delay load hooking function
// don't fail to load our dll is the computer is xp
FARPROC WINAPI delayHookFailureFunc (unsigned dliNotify, PDelayLoadInfo pdli)
{
        UNREFERENCED_PARAMETER(pdli);
        if (_stricmp(pdli->szDll,"advapi32.dll") == 0 && dliNotify == dliFailGetProc)
        {
                return &DoNothing;
        }

        return NULL;
}


// __delayLoadHelper gets the hook function in here:
PfnDliHook __pfnDliFailureHook2 = delayHookFailureFunc;


// The callback function that receives enable/disable notifications
// from one or more ETW sessions. Because more than one session
// can enable the provider, this example ignores requests from other 
// sessions if it is already enabled.

ULONG WINAPI ControlCallback(
    WMIDPREQUESTCODE RequestCode,
    PVOID Context,
    ULONG* Reserved, 
    PVOID Header
    )
{
    ULONG status = ERROR_SUCCESS;
    TRACEHANDLE TempSessionHandle = 0; 

    switch (RequestCode)
    {
        case WMI_ENABLE_EVENTS:  // Enable the provider.
        {
            SetLastError(0);

            // If the provider is already enabled to a provider, ignore 
            // the request. Get the session handle of the enabling session.
            // You need the session handle to call the TraceEvent function.
            // The session could be enabling the provider or it could be
            // updating the level and enable flags.

            TempSessionHandle = GetTraceLoggerHandle(Header);
            if (INVALID_HANDLE_VALUE == (HANDLE)TempSessionHandle)
            {
                wprintf(L"GetTraceLoggerHandle failed. Error code is %lu.\n", status = GetLastError());
                break;
            }

            if (0 == g_SessionHandle)
            {
                g_SessionHandle = TempSessionHandle;
            }
            else if (g_SessionHandle != TempSessionHandle)
            {
                break;
            }

            // Get the severity level of the events that the
            // session wants you to log.

            g_EnableLevel = GetTraceEnableLevel(g_SessionHandle); 
            g_bTracingEnabled = TRUE;
            break;
        }
 
        case WMI_DISABLE_EVENTS:  // Disable the provider.
        {
            // Disable the provider only if the request is coming from the
            // session that enabled the provider.

            TempSessionHandle = GetTraceLoggerHandle(Header);
            if (INVALID_HANDLE_VALUE == (HANDLE)TempSessionHandle)
            {
                wprintf(L"GetTraceLoggerHandle failed. Error code is %lu.\n", status = GetLastError());
                break;
            }

            if (g_SessionHandle == TempSessionHandle)
            {
                g_bTracingEnabled = FALSE;
                g_SessionHandle = 0;
            }
            break;
        }

        default:
        {
            status = ERROR_INVALID_PARAMETER;
            break;
        }
    }

    return status;
}

// callback to know if the tracing is activated
VOID NTAPI ControlCallbackVista (
    __in LPCGUID SourceId,
    __in ULONG IsEnabled,
    __in UCHAR Level,
    __in ULONGLONG MatchAnyKeyword,
    __in ULONGLONG MatchAllKeyword,
    __in_opt PEVENT_FILTER_DESCRIPTOR FilterData,
    __in_opt PVOID CallbackContext
    )
{
        g_bTracingEnabled = (IsEnabled?TRUE:FALSE);
}

// called to setup the tracing context
void TracingRegister() 
{
        if (fRunOnVistaAndLater)
        {
                EventRegister(&TracingGuid,ControlCallbackVista,NULL,&hPub);
        }
        else
        {
                RegisterTraceGuids(
                          ControlCallback,
                          NULL,
                          &TracingGuid, 
                          0, NULL, NULL, 
                          NULL,
                          &hPub);
        }
#ifdef _DEBUG
        fDebugOutputIsEnabled = TRUE;
#endif
}
// called to clean up the tracing context
void TracingUnRegister() 
{
        if (fRunOnVistaAndLater)
        {
                EventUnregister(hPub);
        }
        else
        {
                UnregisterTraceGuids(hPub );
        }
}
// write a single line in the trace
void WriteTrace(UCHAR dwLevel, PWSTR szTrace)
{
        if (fRunOnVistaAndLater)
        {
                EventWriteString(hPub,dwLevel,0,szTrace);
        }
        else
        {
                MY_EVENT MyEvent; 
                NTSTATUS status;
                
                if (g_bTracingEnabled && (0 == g_EnableLevel || dwLevel <= g_EnableLevel))
                {
                        // Initialize the event data structure.

                        ZeroMemory(&MyEvent, sizeof(MY_EVENT));
                        MyEvent.Header.Size = sizeof(EVENT_TRACE_HEADER) + (sizeof(MOF_FIELD) * EVENT_DATA_FIELDS_CNT);
                        MyEvent.Header.Flags = WNODE_FLAG_TRACED_GUID | WNODE_FLAG_USE_MOF_PTR;
                        MyEvent.Header.Guid = TracingGuid;
                        MyEvent.Header.Class.Type = MY_EVENT_TYPE;
                        MyEvent.Header.Class.Version = 1;
                        MyEvent.Header.Class.Level = dwLevel;

                        // Load the event data. You can also use the DEFINE_TRACE_MOF_FIELD
                        // macro defined in evntrace.h to set the MOF_FIELD members. For example,
                        // DEFINE_TRACE_MOF_FIELD(&EventData.Data[0], &EventData.Cost, sizeof(EventData.Cost), 0);

                        MyEvent.Data[0].DataPtr = (ULONG64) szTrace;
                        MyEvent.Data[0].Length = (ULONG) (sizeof(WCHAR) * (1 + wcslen(szTrace)));
                        MyEvent.Data[0].DataType = ETW_STRING_TYPE_VALUE;

                        // Write the event.

                        status = TraceEvent(g_SessionHandle, &(MyEvent.Header));
                        if (ERROR_SUCCESS != status)
                        {
                                g_bTracingEnabled = FALSE;
                        }
                }
        }
}

void TraceEx(LPCSTR szFile, DWORD dwLine, LPCSTR szFunction, UCHAR dwLevel, PCWSTR szFormat,...) 
{
        WCHAR Buffer[256];
        WCHAR Buffer2[356];
        int ret;
        va_list ap;
#ifndef _DEBUG
        UNREFERENCED_PARAMETER(dwLine);
        UNREFERENCED_PARAMETER(szFile);
#endif
        if (!hPub) TracingRegister();
        if ( g_bTracingEnabled || fDebugOutputIsEnabled) {

                va_start (ap, szFormat);
                ret = _vsnwprintf_s (Buffer, 256, _TRUNCATE, szFormat, ap);
                va_end (ap);
                if (ret <= 0) return;
                if (ret > 256) ret = 255;
                Buffer[255] = L'\0';
                if (fDebugOutputIsEnabled)
                {
                        swprintf_s(Buffer2,356,L"%S(%d) : %S - %s\r\n",szFile,dwLine,szFunction,Buffer);
                        OutputDebugString(Buffer2);
                }
                if (g_bTracingEnabled)
                {
                        swprintf_s(Buffer2,356,L"%S(%d) : %s",szFunction,dwLine,Buffer);
                        WriteTrace(dwLevel, Buffer2);
                }
        }
}


void TraceDumpEx(LPCSTR szFile, DWORD dwLine, LPCSTR szFunction, UCHAR dwLevel,
                          __in PBYTE pbCmd, __in DWORD dwCmdSize)
{
        WCHAR szData[10 * 3 + 1];
        DWORD dwI;
        PWSTR szPointer = szData;
        for(dwI = 0; dwI < dwCmdSize; dwI++)
        {
                if (dwI%10 == 0 && dwI != 0)
                {
                        TraceEx(szFile,dwLine,szFunction,dwLevel,L"DUMP : %s",szData);
                        szPointer = szData;
                }
                swprintf_s(szPointer + 3 * (dwI%10),4,L"%02X ",pbCmd[dwI]);
                
        }
        TraceEx(szFile,dwLine,szFunction,dwLevel,L"DUMP : %s",szData);
}

/**
 *  Display a messagebox giving an error code
 */
void MessageBoxWin32Ex(DWORD status, LPCSTR szFile, DWORD dwLine) {
        LPVOID Error;
        TCHAR szTitle[1024];
#ifdef UNICODE
        _stprintf_s(szTitle,ARRAYSIZE(szTitle),TEXT("%S(%d)"),szFile, dwLine);
#else
        _stprintf_s(szTitle,ARRAYSIZE(szTitle),TEXT("%s(%d)"),szFile, dwLine);
#endif
        FormatMessage(FORMAT_MESSAGE_ALLOCATE_BUFFER|FORMAT_MESSAGE_FROM_SYSTEM,
                NULL,status,0,(LPTSTR)&Error,0,NULL);
        MessageBox(NULL,(LPCTSTR)Error,szTitle ,MB_ICONASTERISK);
        LocalFree(Error);
}

BOOL StartLogging()
{
        BOOL fReturn = FALSE;
        TRACEHANDLE SessionHandle;
        struct _Prop
        {
                EVENT_TRACE_PROPERTIES TraceProperties;
                TCHAR LogFileName[1024];
                TCHAR LoggerName[1024];
        } Properties;
        ULONG err;
        __try
        {
                memset(&Properties, 0, sizeof(Properties));
                Properties.TraceProperties.Wnode.BufferSize = sizeof(Properties);
                Properties.TraceProperties.Wnode.Guid = TracingGuid;
                Properties.TraceProperties.Wnode.Flags = WNODE_FLAG_TRACED_GUID;
                Properties.TraceProperties.Wnode.ClientContext = 1;
                Properties.TraceProperties.LogFileMode = 4864; 
                Properties.TraceProperties.LogFileNameOffset = sizeof(EVENT_TRACE_PROPERTIES);
                Properties.TraceProperties.LoggerNameOffset = sizeof(EVENT_TRACE_PROPERTIES) + 1024;
                Properties.TraceProperties.MaximumFileSize = 8;
                _tcscpy_s(Properties.LogFileName,1024,TEXT("c:\\Windows\\system32\\LogFiles\\WMI\\OpenPGPmdrv.etl"));
                DeleteFile(Properties.LogFileName);
                err = StartTrace(&SessionHandle, TEXT("OpenPGPmdrv"), &(Properties.TraceProperties));
                if (err != ERROR_SUCCESS)
                {
                        MessageBoxWin32(err);
                        __leave;
                }
                err = EnableTraceEx(&TracingGuid,NULL,SessionHandle,TRUE,WINEVENT_LEVEL_VERBOSE,0,0,0,NULL);
                if (err != ERROR_SUCCESS)
                {
                        MessageBoxWin32(err);
                        __leave;
                }
                fReturn = TRUE;
        }
        __finally
        {
        }
        return fReturn;
}

void StopLogging()
{
        LONG err;
        struct _Prop
        {
                EVENT_TRACE_PROPERTIES TraceProperties;
                TCHAR LogFileName[1024];
                TCHAR LoggerName[1024];
        } Properties;
        memset(&Properties, 0, sizeof(Properties));
        Properties.TraceProperties.Wnode.BufferSize = sizeof(Properties);
        Properties.TraceProperties.Wnode.Guid = TracingGuid;
        Properties.TraceProperties.Wnode.Flags = WNODE_FLAG_TRACED_GUID;
        Properties.TraceProperties.LogFileMode = 4864; 
        Properties.TraceProperties.LogFileNameOffset = sizeof(EVENT_TRACE_PROPERTIES);
        Properties.TraceProperties.LoggerNameOffset = sizeof(EVENT_TRACE_PROPERTIES) + 1024 * sizeof(TCHAR);
        Properties.TraceProperties.MaximumFileSize = 8;
        err = ControlTrace((TRACEHANDLE)NULL, TEXT("OpenPGPmdrv"), &(Properties.TraceProperties),EVENT_TRACE_CONTROL_STOP);
        if (err != ERROR_SUCCESS && err != 0x00001069)
        {
                MessageBoxWin32(err);
        }
}

void EnableLogging()
{
        DWORD64 qdwValue;
        DWORD dwValue;
        LONG err;

        err = RegSetKeyValue(   HKEY_LOCAL_MACHINE, 
                TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv"), 
                TEXT("Guid"), REG_SZ, TEXT("{081CCE5F-5F9C-4b43-9A15-1DCF5D2D45F5}"),sizeof(TEXT("{081CCE5F-5F9C-4b43-9A15-1DCF5D2D45F5}")));
        if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
        err = RegSetKeyValue(   HKEY_LOCAL_MACHINE, 
                TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv"), 
                TEXT("FileName"), REG_SZ, TEXT("c:\\windows\\system32\\LogFiles\\WMI\\OpenPGPmdrv.etl"),sizeof(TEXT("c:\\windows\\system32\\LogFiles\\WMI\\OpenPGPmdrv.etl")));
        if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
        dwValue = 8;
        err = RegSetKeyValue(   HKEY_LOCAL_MACHINE, 
                TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv"), 
                TEXT("FileMax"), REG_DWORD,&dwValue,sizeof(DWORD));
        if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
        dwValue = 1;
        err = RegSetKeyValue(   HKEY_LOCAL_MACHINE, 
                TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv"), 
                TEXT("Start"), REG_DWORD,&dwValue,sizeof(DWORD));
        if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
        dwValue = 8;
        err = RegSetKeyValue(   HKEY_LOCAL_MACHINE, 
                TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv"), 
                TEXT("BufferSize"), REG_DWORD,&dwValue,sizeof(DWORD));
        if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
        dwValue = 0;
        err = RegSetKeyValue(   HKEY_LOCAL_MACHINE, 
                TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv"), 
                TEXT("FlushTimer"), REG_DWORD,&dwValue,sizeof(DWORD));
        if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
        dwValue = 0;
        err = RegSetKeyValue(   HKEY_LOCAL_MACHINE, 
                TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv"), 
                TEXT("MaximumBuffers"), REG_DWORD,&dwValue,sizeof(DWORD));
        if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
        dwValue = 0;
        err = RegSetKeyValue(   HKEY_LOCAL_MACHINE, 
                TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv"), 
                TEXT("MinimumBuffers"), REG_DWORD,&dwValue,sizeof(DWORD));
        if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
        dwValue = 1;
        err = RegSetKeyValue(   HKEY_LOCAL_MACHINE, 
                TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv"), 
                TEXT("ClockType"), REG_DWORD,&dwValue,sizeof(DWORD));
        if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
        dwValue = 64;
        err = RegSetKeyValue(   HKEY_LOCAL_MACHINE, 
                TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv"), 
                TEXT("MaxFileSize"), REG_DWORD,&dwValue,sizeof(DWORD));
        if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
        dwValue = 4864;
        err = RegSetKeyValue(   HKEY_LOCAL_MACHINE, 
                TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv"), 
                TEXT("LogFileMode"), REG_DWORD,&dwValue,sizeof(DWORD));
        if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
        dwValue = 5;
        err = RegSetKeyValue(   HKEY_LOCAL_MACHINE, 
                TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv"), 
                TEXT("FileCounter"), REG_DWORD,&dwValue,sizeof(DWORD));
        if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
        dwValue = 0;
        err = RegSetKeyValue(   HKEY_LOCAL_MACHINE, 
                TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv"), 
                TEXT("Status"), REG_DWORD,&dwValue,sizeof(DWORD));
        if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}

        dwValue = 1;
        err = RegSetKeyValue(   HKEY_LOCAL_MACHINE, 
                TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv\\{081CCE5F-5F9C-4b43-9A15-1DCF5D2D45F5}"), 
                TEXT("Enabled"), REG_DWORD,&dwValue,sizeof(DWORD));
        if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
        dwValue = 5;
        err = RegSetKeyValue(   HKEY_LOCAL_MACHINE, 
                TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv\\{081CCE5F-5F9C-4b43-9A15-1DCF5D2D45F5}"), 
                TEXT("EnableLevel"), REG_DWORD,&dwValue,sizeof(DWORD));
        if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
        dwValue = 0;
        err = RegSetKeyValue(   HKEY_LOCAL_MACHINE, 
                TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv\\{081CCE5F-5F9C-4b43-9A15-1DCF5D2D45F5}"), 
                TEXT("EnableProperty"), REG_DWORD,&dwValue,sizeof(DWORD));
        if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
        dwValue = 0;
        err = RegSetKeyValue(   HKEY_LOCAL_MACHINE, 
                TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv\\{081CCE5F-5F9C-4b43-9A15-1DCF5D2D45F5}"), 
                TEXT("Status"), REG_DWORD,&dwValue,sizeof(DWORD));
        if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
        qdwValue = 0;
        err = RegSetKeyValue(   HKEY_LOCAL_MACHINE, 
                TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv\\{081CCE5F-5F9C-4b43-9A15-1DCF5D2D45F5}"), 
                TEXT("MatchAllKeyword"), REG_QWORD,&qdwValue,sizeof(DWORD64));
        if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
        qdwValue = 0;
        err = RegSetKeyValue(   HKEY_LOCAL_MACHINE, 
                TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv\\{081CCE5F-5F9C-4b43-9A15-1DCF5D2D45F5}"), 
                TEXT("MatchAnyKeyword"), REG_QWORD,&qdwValue,sizeof(DWORD64));
        if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
        StartLogging();
}

void DisableLogging()
{
        
        LONG err = RegDeleteTree(HKEY_LOCAL_MACHINE, TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv"));
        if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
        StopLogging();
}
1	/* OpenPGP Smart Card Mini Driver
2	Copyright (C) 2009 Vincent Le Toux
3
4	This library is Free software; you can redistribute it and/or
5	modify it under the terms of the GNU Lesser General Public
6	License version 2.1 as published by the Free Software Foundation.
7
8	This library is distributed in the hope that it will be useful,
9	but WITHOUT ANY WARRANTY; without even the implied warranty of
10	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
11	Lesser General Public License for more details.
12
13	You should have received a copy of the GNU Lesser General Public
14	License along with this library; if not, write to the Free Software
15	Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
16	*/
17
18	#include <windows.h>
19	#include <tchar.h>
20	#include <Evntprov.h>
21	#include <initguid.h>
22	#include <Wmistr.h>
23	#include <Evntrace.h>
24	#include <cardmod.h>
25	#include <DelayImp.h>
26	#pragma comment(lib, "Delayimp.lib")
27	#include "Tracing.h"
28
29	/** We are doing a lot of complicated stuff (like hooking a delay load import)
30	because the Vista tracing function is much better than XP ones.
31	The choice was :
32	- do not allow the driver to run on xp (set WINVER to 0x600)
33	- don't use the great vista tracing functions (set WINVER to 0x500 and comment the function)
34	- run on xp AND use this function (set WINVER to 0x600 and allow to run on xp)
35
36	=> tried to have the best
37	*/
38
39	#define MessageBoxWin32(status) MessageBoxWin32Ex (status, __FILE__,__LINE__);
40
41	// to enable tracing in kernel debugger, issue the following command in windbg : ed nt!Kd_DEFAULT_MASK 0xFFFFFFFF
42	// OR
43	// Open up the registry and go to this path,
44	// HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Debug Print Filter
45	// and add the following value "DEFAULT" : REG_DWORD : 0xFFFFFFFF and then reboot
46
47	// {081CCE5F-5F9C-4b43-9A15-1DCF5D2D45F5}
48	DEFINE_GUID(TracingGuid,
49	0x81cce5f, 0x5f9c, 0x4b43, 0x9a, 0x15, 0x1d, 0xcf, 0x5d, 0x2d, 0x45, 0xf5);
50
51	REGHANDLE hPub = 0;
52	BOOL g_bTracingEnabled = FALSE;
53	TRACEHANDLE g_SessionHandle = 0; // The handle to the session that enabled the provider.
54	UCHAR g_EnableLevel = 0; // Determines the severity of events to log.
55	extern BOOL fRunOnVistaAndLater;
56	BOOL fDebugOutputIsEnabled = FALSE;
57
58	typedef struct _event
59	{
60	EVENT_TRACE_HEADER Header;
61	MOF_FIELD Data[MAX_MOF_FIELDS]; // Event-specific data
62	} MY_EVENT, *PMY_EVENT;
63
64	#define MY_EVENT_TYPE 1
65	#define EVENT_DATA_FIELDS_CNT 1
66
67	INT_PTR FAR WINAPI DoNothing()
68	{
69	return 0;
70	}
71
72	// delayHookFunc - Delay load hooking function
73	// don't fail to load our dll is the computer is xp
74	FARPROC WINAPI delayHookFailureFunc (unsigned dliNotify, PDelayLoadInfo pdli)
75	{
76	UNREFERENCED_PARAMETER(pdli);
77	if (_stricmp(pdli->szDll,"advapi32.dll") == 0 && dliNotify == dliFailGetProc)
78	{
79	return &DoNothing;
80	}
81
82	return NULL;
83	}
84
85
86	// __delayLoadHelper gets the hook function in here:
87	PfnDliHook __pfnDliFailureHook2 = delayHookFailureFunc;
88
89
90
91	// The callback function that receives enable/disable notifications
92	// from one or more ETW sessions. Because more than one session
93	// can enable the provider, this example ignores requests from other
94	// sessions if it is already enabled.
95
96	ULONG WINAPI ControlCallback(
97	WMIDPREQUESTCODE RequestCode,
98	PVOID Context,
99	ULONG* Reserved,
100	PVOID Header
101	)
102	{
103	ULONG status = ERROR_SUCCESS;
104	TRACEHANDLE TempSessionHandle = 0;
105
106	switch (RequestCode)
107	{
108	case WMI_ENABLE_EVENTS: // Enable the provider.
109	{
110	SetLastError(0);
111
112	// If the provider is already enabled to a provider, ignore
113	// the request. Get the session handle of the enabling session.
114	// You need the session handle to call the TraceEvent function.
115	// The session could be enabling the provider or it could be
116	// updating the level and enable flags.
117
118	TempSessionHandle = GetTraceLoggerHandle(Header);
119	if (INVALID_HANDLE_VALUE == (HANDLE)TempSessionHandle)
120	{
121	wprintf(L"GetTraceLoggerHandle failed. Error code is %lu.\n", status = GetLastError());
122	break;
123	}
124
125	if (0 == g_SessionHandle)
126	{
127	g_SessionHandle = TempSessionHandle;
128	}
129	else if (g_SessionHandle != TempSessionHandle)
130	{
131	break;
132	}
133
134	// Get the severity level of the events that the
135	// session wants you to log.
136
137	g_EnableLevel = GetTraceEnableLevel(g_SessionHandle);
138	g_bTracingEnabled = TRUE;
139	break;
140	}
141
142	case WMI_DISABLE_EVENTS: // Disable the provider.
143	{
144	// Disable the provider only if the request is coming from the
145	// session that enabled the provider.
146
147	TempSessionHandle = GetTraceLoggerHandle(Header);
148	if (INVALID_HANDLE_VALUE == (HANDLE)TempSessionHandle)
149	{
150	wprintf(L"GetTraceLoggerHandle failed. Error code is %lu.\n", status = GetLastError());
151	break;
152	}
153
154	if (g_SessionHandle == TempSessionHandle)
155	{
156	g_bTracingEnabled = FALSE;
157	g_SessionHandle = 0;
158	}
159	break;
160	}
161
162	default:
163	{
164	status = ERROR_INVALID_PARAMETER;
165	break;
166	}
167	}
168
169	return status;
170	}
171
172	// callback to know if the tracing is activated
173	VOID NTAPI ControlCallbackVista (
174	__in LPCGUID SourceId,
175	__in ULONG IsEnabled,
176	__in UCHAR Level,
177	__in ULONGLONG MatchAnyKeyword,
178	__in ULONGLONG MatchAllKeyword,
179	__in_opt PEVENT_FILTER_DESCRIPTOR FilterData,
180	__in_opt PVOID CallbackContext
181	)
182	{
183	g_bTracingEnabled = (IsEnabled?TRUE:FALSE);
184	}
185
186	// called to setup the tracing context
187	void TracingRegister()
188	{
189	if (fRunOnVistaAndLater)
190	{
191	EventRegister(&TracingGuid,ControlCallbackVista,NULL,&hPub);
192	}
193	else
194	{
195	RegisterTraceGuids(
196	ControlCallback,
197	NULL,
198	&TracingGuid,
199	0, NULL, NULL,
200	NULL,
201	&hPub);
202	}
203	#ifdef _DEBUG
204	fDebugOutputIsEnabled = TRUE;
205	#endif
206	}
207	// called to clean up the tracing context
208	void TracingUnRegister()
209	{
210	if (fRunOnVistaAndLater)
211	{
212	EventUnregister(hPub);
213	}
214	else
215	{
216	UnregisterTraceGuids(hPub );
217	}
218	}
219	// write a single line in the trace
220	void WriteTrace(UCHAR dwLevel, PWSTR szTrace)
221	{
222	if (fRunOnVistaAndLater)
223	{
224	EventWriteString(hPub,dwLevel,0,szTrace);
225	}
226	else
227	{
228	MY_EVENT MyEvent;
229	NTSTATUS status;
230
231	if (g_bTracingEnabled && (0 == g_EnableLevel \|\| dwLevel <= g_EnableLevel))
232	{
233	// Initialize the event data structure.
234
235	ZeroMemory(&MyEvent, sizeof(MY_EVENT));
236	MyEvent.Header.Size = sizeof(EVENT_TRACE_HEADER) + (sizeof(MOF_FIELD) * EVENT_DATA_FIELDS_CNT);
237	MyEvent.Header.Flags = WNODE_FLAG_TRACED_GUID \| WNODE_FLAG_USE_MOF_PTR;
238	MyEvent.Header.Guid = TracingGuid;
239	MyEvent.Header.Class.Type = MY_EVENT_TYPE;
240	MyEvent.Header.Class.Version = 1;
241	MyEvent.Header.Class.Level = dwLevel;
242
243	// Load the event data. You can also use the DEFINE_TRACE_MOF_FIELD
244	// macro defined in evntrace.h to set the MOF_FIELD members. For example,
245	// DEFINE_TRACE_MOF_FIELD(&EventData.Data[0], &EventData.Cost, sizeof(EventData.Cost), 0);
246
247	MyEvent.Data[0].DataPtr = (ULONG64) szTrace;
248	MyEvent.Data[0].Length = (ULONG) (sizeof(WCHAR) * (1 + wcslen(szTrace)));
249	MyEvent.Data[0].DataType = ETW_STRING_TYPE_VALUE;
250
251	// Write the event.
252
253	status = TraceEvent(g_SessionHandle, &(MyEvent.Header));
254	if (ERROR_SUCCESS != status)
255	{
256	g_bTracingEnabled = FALSE;
257	}
258	}
259	}
260	}
261
262	void TraceEx(LPCSTR szFile, DWORD dwLine, LPCSTR szFunction, UCHAR dwLevel, PCWSTR szFormat,...)
263	{
264	WCHAR Buffer[256];
265	WCHAR Buffer2[356];
266	int ret;
267	va_list ap;
268	#ifndef _DEBUG
269	UNREFERENCED_PARAMETER(dwLine);
270	UNREFERENCED_PARAMETER(szFile);
271	#endif
272	if (!hPub) TracingRegister();
273	if ( g_bTracingEnabled \|\| fDebugOutputIsEnabled) {
274
275	va_start (ap, szFormat);
276	ret = _vsnwprintf_s (Buffer, 256, _TRUNCATE, szFormat, ap);
277	va_end (ap);
278	if (ret <= 0) return;
279	if (ret > 256) ret = 255;
280	Buffer[255] = L'\0';
281	if (fDebugOutputIsEnabled)
282	{
283	swprintf_s(Buffer2,356,L"%S(%d) : %S - %s\r\n",szFile,dwLine,szFunction,Buffer);
284	OutputDebugString(Buffer2);
285	}
286	if (g_bTracingEnabled)
287	{
288	swprintf_s(Buffer2,356,L"%S(%d) : %s",szFunction,dwLine,Buffer);
289	WriteTrace(dwLevel, Buffer2);
290	}
291	}
292	}
293
294
295
296	void TraceDumpEx(LPCSTR szFile, DWORD dwLine, LPCSTR szFunction, UCHAR dwLevel,
297	__in PBYTE pbCmd, __in DWORD dwCmdSize)
298	{
299	WCHAR szData[10 * 3 + 1];
300	DWORD dwI;
301	PWSTR szPointer = szData;
302	for(dwI = 0; dwI < dwCmdSize; dwI++)
303	{
304	if (dwI%10 == 0 && dwI != 0)
305	{
306	TraceEx(szFile,dwLine,szFunction,dwLevel,L"DUMP : %s",szData);
307	szPointer = szData;
308	}
309	swprintf_s(szPointer + 3 * (dwI%10),4,L"%02X ",pbCmd[dwI]);
310
311	}
312	TraceEx(szFile,dwLine,szFunction,dwLevel,L"DUMP : %s",szData);
313	}
314
315	/**
316	* Display a messagebox giving an error code
317	*/
318	void MessageBoxWin32Ex(DWORD status, LPCSTR szFile, DWORD dwLine) {
319	LPVOID Error;
320	TCHAR szTitle[1024];
321	#ifdef UNICODE
322	_stprintf_s(szTitle,ARRAYSIZE(szTitle),TEXT("%S(%d)"),szFile, dwLine);
323	#else
324	_stprintf_s(szTitle,ARRAYSIZE(szTitle),TEXT("%s(%d)"),szFile, dwLine);
325	#endif
326	FormatMessage(FORMAT_MESSAGE_ALLOCATE_BUFFER\|FORMAT_MESSAGE_FROM_SYSTEM,
327	NULL,status,0,(LPTSTR)&Error,0,NULL);
328	MessageBox(NULL,(LPCTSTR)Error,szTitle ,MB_ICONASTERISK);
329	LocalFree(Error);
330	}
331
332	BOOL StartLogging()
333	{
334	BOOL fReturn = FALSE;
335	TRACEHANDLE SessionHandle;
336	struct _Prop
337	{
338	EVENT_TRACE_PROPERTIES TraceProperties;
339	TCHAR LogFileName[1024];
340	TCHAR LoggerName[1024];
341	} Properties;
342	ULONG err;
343	__try
344	{
345	memset(&Properties, 0, sizeof(Properties));
346	Properties.TraceProperties.Wnode.BufferSize = sizeof(Properties);
347	Properties.TraceProperties.Wnode.Guid = TracingGuid;
348	Properties.TraceProperties.Wnode.Flags = WNODE_FLAG_TRACED_GUID;
349	Properties.TraceProperties.Wnode.ClientContext = 1;
350	Properties.TraceProperties.LogFileMode = 4864;
351	Properties.TraceProperties.LogFileNameOffset = sizeof(EVENT_TRACE_PROPERTIES);
352	Properties.TraceProperties.LoggerNameOffset = sizeof(EVENT_TRACE_PROPERTIES) + 1024;
353	Properties.TraceProperties.MaximumFileSize = 8;
354	_tcscpy_s(Properties.LogFileName,1024,TEXT("c:\\Windows\\system32\\LogFiles\\WMI\\OpenPGPmdrv.etl"));
355	DeleteFile(Properties.LogFileName);
356	err = StartTrace(&SessionHandle, TEXT("OpenPGPmdrv"), &(Properties.TraceProperties));
357	if (err != ERROR_SUCCESS)
358	{
359	MessageBoxWin32(err);
360	__leave;
361	}
362	err = EnableTraceEx(&TracingGuid,NULL,SessionHandle,TRUE,WINEVENT_LEVEL_VERBOSE,0,0,0,NULL);
363	if (err != ERROR_SUCCESS)
364	{
365	MessageBoxWin32(err);
366	__leave;
367	}
368	fReturn = TRUE;
369	}
370	__finally
371	{
372	}
373	return fReturn;
374	}
375
376	void StopLogging()
377	{
378	LONG err;
379	struct _Prop
380	{
381	EVENT_TRACE_PROPERTIES TraceProperties;
382	TCHAR LogFileName[1024];
383	TCHAR LoggerName[1024];
384	} Properties;
385	memset(&Properties, 0, sizeof(Properties));
386	Properties.TraceProperties.Wnode.BufferSize = sizeof(Properties);
387	Properties.TraceProperties.Wnode.Guid = TracingGuid;
388	Properties.TraceProperties.Wnode.Flags = WNODE_FLAG_TRACED_GUID;
389	Properties.TraceProperties.LogFileMode = 4864;
390	Properties.TraceProperties.LogFileNameOffset = sizeof(EVENT_TRACE_PROPERTIES);
391	Properties.TraceProperties.LoggerNameOffset = sizeof(EVENT_TRACE_PROPERTIES) + 1024 * sizeof(TCHAR);
392	Properties.TraceProperties.MaximumFileSize = 8;
393	err = ControlTrace((TRACEHANDLE)NULL, TEXT("OpenPGPmdrv"), &(Properties.TraceProperties),EVENT_TRACE_CONTROL_STOP);
394	if (err != ERROR_SUCCESS && err != 0x00001069)
395	{
396	MessageBoxWin32(err);
397	}
398	}
399
400	void EnableLogging()
401	{
402	DWORD64 qdwValue;
403	DWORD dwValue;
404	LONG err;
405
406	err = RegSetKeyValue( HKEY_LOCAL_MACHINE,
407	TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv"),
408	TEXT("Guid"), REG_SZ, TEXT("{081CCE5F-5F9C-4b43-9A15-1DCF5D2D45F5}"),sizeof(TEXT("{081CCE5F-5F9C-4b43-9A15-1DCF5D2D45F5}")));
409	if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
410	err = RegSetKeyValue( HKEY_LOCAL_MACHINE,
411	TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv"),
412	TEXT("FileName"), REG_SZ, TEXT("c:\\windows\\system32\\LogFiles\\WMI\\OpenPGPmdrv.etl"),sizeof(TEXT("c:\\windows\\system32\\LogFiles\\WMI\\OpenPGPmdrv.etl")));
413	if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
414	dwValue = 8;
415	err = RegSetKeyValue( HKEY_LOCAL_MACHINE,
416	TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv"),
417	TEXT("FileMax"), REG_DWORD,&dwValue,sizeof(DWORD));
418	if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
419	dwValue = 1;
420	err = RegSetKeyValue( HKEY_LOCAL_MACHINE,
421	TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv"),
422	TEXT("Start"), REG_DWORD,&dwValue,sizeof(DWORD));
423	if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
424	dwValue = 8;
425	err = RegSetKeyValue( HKEY_LOCAL_MACHINE,
426	TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv"),
427	TEXT("BufferSize"), REG_DWORD,&dwValue,sizeof(DWORD));
428	if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
429	dwValue = 0;
430	err = RegSetKeyValue( HKEY_LOCAL_MACHINE,
431	TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv"),
432	TEXT("FlushTimer"), REG_DWORD,&dwValue,sizeof(DWORD));
433	if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
434	dwValue = 0;
435	err = RegSetKeyValue( HKEY_LOCAL_MACHINE,
436	TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv"),
437	TEXT("MaximumBuffers"), REG_DWORD,&dwValue,sizeof(DWORD));
438	if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
439	dwValue = 0;
440	err = RegSetKeyValue( HKEY_LOCAL_MACHINE,
441	TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv"),
442	TEXT("MinimumBuffers"), REG_DWORD,&dwValue,sizeof(DWORD));
443	if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
444	dwValue = 1;
445	err = RegSetKeyValue( HKEY_LOCAL_MACHINE,
446	TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv"),
447	TEXT("ClockType"), REG_DWORD,&dwValue,sizeof(DWORD));
448	if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
449	dwValue = 64;
450	err = RegSetKeyValue( HKEY_LOCAL_MACHINE,
451	TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv"),
452	TEXT("MaxFileSize"), REG_DWORD,&dwValue,sizeof(DWORD));
453	if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
454	dwValue = 4864;
455	err = RegSetKeyValue( HKEY_LOCAL_MACHINE,
456	TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv"),
457	TEXT("LogFileMode"), REG_DWORD,&dwValue,sizeof(DWORD));
458	if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
459	dwValue = 5;
460	err = RegSetKeyValue( HKEY_LOCAL_MACHINE,
461	TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv"),
462	TEXT("FileCounter"), REG_DWORD,&dwValue,sizeof(DWORD));
463	if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
464	dwValue = 0;
465	err = RegSetKeyValue( HKEY_LOCAL_MACHINE,
466	TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv"),
467	TEXT("Status"), REG_DWORD,&dwValue,sizeof(DWORD));
468	if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
469
470	dwValue = 1;
471	err = RegSetKeyValue( HKEY_LOCAL_MACHINE,
472	TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv\\{081CCE5F-5F9C-4b43-9A15-1DCF5D2D45F5}"),
473	TEXT("Enabled"), REG_DWORD,&dwValue,sizeof(DWORD));
474	if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
475	dwValue = 5;
476	err = RegSetKeyValue( HKEY_LOCAL_MACHINE,
477	TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv\\{081CCE5F-5F9C-4b43-9A15-1DCF5D2D45F5}"),
478	TEXT("EnableLevel"), REG_DWORD,&dwValue,sizeof(DWORD));
479	if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
480	dwValue = 0;
481	err = RegSetKeyValue( HKEY_LOCAL_MACHINE,
482	TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv\\{081CCE5F-5F9C-4b43-9A15-1DCF5D2D45F5}"),
483	TEXT("EnableProperty"), REG_DWORD,&dwValue,sizeof(DWORD));
484	if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
485	dwValue = 0;
486	err = RegSetKeyValue( HKEY_LOCAL_MACHINE,
487	TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv\\{081CCE5F-5F9C-4b43-9A15-1DCF5D2D45F5}"),
488	TEXT("Status"), REG_DWORD,&dwValue,sizeof(DWORD));
489	if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
490	qdwValue = 0;
491	err = RegSetKeyValue( HKEY_LOCAL_MACHINE,
492	TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv\\{081CCE5F-5F9C-4b43-9A15-1DCF5D2D45F5}"),
493	TEXT("MatchAllKeyword"), REG_QWORD,&qdwValue,sizeof(DWORD64));
494	if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
495	qdwValue = 0;
496	err = RegSetKeyValue( HKEY_LOCAL_MACHINE,
497	TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv\\{081CCE5F-5F9C-4b43-9A15-1DCF5D2D45F5}"),
498	TEXT("MatchAnyKeyword"), REG_QWORD,&qdwValue,sizeof(DWORD64));
499	if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
500	StartLogging();
501	}
502
503	void DisableLogging()
504	{
505
506	LONG err = RegDeleteTree(HKEY_LOCAL_MACHINE, TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv"));
507	if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
508	StopLogging();
509	}