trunk/OpenPGPminidriver/Tracing.c

/*      OpenPGP Smart Card Mini Driver
    Copyright (C) 2009 Vincent Le Toux

    This library is Free software; you can redistribute it and/or
    modify it under the terms of the GNU Lesser General Public
    License version 2.1 as published by the Free Software Foundation.

    This library is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
    Lesser General Public License for more details.

    You should have received a copy of the GNU Lesser General Public
    License along with this library; if not, write to the Free Software
    Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
*/

#include <windows.h>
#include <tchar.h>
#include <Evntprov.h>
#include <initguid.h>
#include <Wmistr.h>
#include <Evntrace.h>
#include <cardmod.h>
#include "Tracing.h"

#define MessageBoxWin32(status) MessageBoxWin32Ex (status, __FILE__,__LINE__);

// to enable tracing in kernel debugger, issue the following command in windbg : ed nt!Kd_DEFAULT_MASK  0xFFFFFFFF
// OR
// Open up the registry and go to this path,
// HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Debug Print Filter 
// and add the following value "DEFAULT" : REG_DWORD : 0xFFFFFFFF and then reboot

// {081CCE5F-5F9C-4b43-9A15-1DCF5D2D45F5}
DEFINE_GUID(TracingGuid, 
0x81cce5f, 0x5f9c, 0x4b43, 0x9a, 0x15, 0x1d, 0xcf, 0x5d, 0x2d, 0x45, 0xf5);

REGHANDLE hPub = 0;

void TracingRegister() 
{
        EventRegister(&TracingGuid,NULL,NULL,&hPub);
}

void TracingUnRegister() 
{
        EventUnregister(hPub);
}


void TraceEx(LPCSTR szFile, DWORD dwLine, LPCSTR szFunction, UCHAR dwLevel, PCWSTR szFormat,...) 
{
        WCHAR Buffer[256];
        WCHAR Buffer2[356];
        int ret;
        va_list ap;
#ifndef _DEBUG
        UNREFERENCED_PARAMETER(dwLine);
        UNREFERENCED_PARAMETER(szFile);
#endif
        if (!hPub) TracingRegister();

        va_start (ap, szFormat);
        ret = _vsnwprintf_s (Buffer, 256, _TRUNCATE, szFormat, ap);
        va_end (ap);
        if (ret <= 0) return;
        if (ret > 256) ret = 255;
        Buffer[255] = L'\0';
#ifdef _DEBUG
        swprintf_s(Buffer2,356,L"%S(%d) : %S - %s\r\n",szFile,dwLine,szFunction,Buffer);
        OutputDebugString(Buffer2);
#endif
        swprintf_s(Buffer2,356,L"%S(%d) : %s",szFunction,dwLine,Buffer);
        EventWriteString(hPub,dwLevel,0,Buffer2);

}

void TraceDumpEx(LPCSTR szFile, DWORD dwLine, LPCSTR szFunction, UCHAR dwLevel,
                          __in PBYTE pbCmd, __in DWORD dwCmdSize)
{
        WCHAR szData[10 * 3 + 1];
        DWORD dwI;
        PWSTR szPointer = szData;
        for(dwI = 0; dwI < dwCmdSize; dwI++)
        {
                if (dwI%10 == 0 && dwI != 0)
                {
                        TraceEx(szFile,dwLine,szFunction,dwLevel,L"DUMP : %s",szData);
                        szPointer = szData;
                }
                swprintf_s(szPointer + 3 * (dwI%10),4,L"%02X ",pbCmd[dwI]);
                
        }
        TraceEx(szFile,dwLine,szFunction,dwLevel,L"DUMP : %s",szData);
}

/**
 *  Display a messagebox giving an error code
 */
void MessageBoxWin32Ex(DWORD status, LPCSTR szFile, DWORD dwLine) {
        LPVOID Error;
        TCHAR szTitle[1024];
#ifdef UNICODE
        _stprintf_s(szTitle,ARRAYSIZE(szTitle),TEXT("%S(%d)"),szFile, dwLine);
#else
        _stprintf_s(szTitle,ARRAYSIZE(szTitle),TEXT("%s(%d)"),szFile, dwLine);
#endif
        FormatMessage(FORMAT_MESSAGE_ALLOCATE_BUFFER|FORMAT_MESSAGE_FROM_SYSTEM,
                NULL,status,0,(LPTSTR)&Error,0,NULL);
        MessageBox(NULL,(LPCTSTR)Error,szTitle ,MB_ICONASTERISK);
        LocalFree(Error);
}

BOOL StartLogging()
{
        BOOL fReturn = FALSE;
        TRACEHANDLE SessionHandle;
        struct _Prop
        {
                EVENT_TRACE_PROPERTIES TraceProperties;
                TCHAR LogFileName[1024];
                TCHAR LoggerName[1024];
        } Properties;
        ULONG err;
        __try
        {
                memset(&Properties, 0, sizeof(Properties));
                Properties.TraceProperties.Wnode.BufferSize = sizeof(Properties);
                Properties.TraceProperties.Wnode.Guid = TracingGuid;
                Properties.TraceProperties.Wnode.Flags = WNODE_FLAG_TRACED_GUID;
                Properties.TraceProperties.Wnode.ClientContext = 1;
                Properties.TraceProperties.LogFileMode = 4864; 
                Properties.TraceProperties.LogFileNameOffset = sizeof(EVENT_TRACE_PROPERTIES);
                Properties.TraceProperties.LoggerNameOffset = sizeof(EVENT_TRACE_PROPERTIES) + 1024;
                Properties.TraceProperties.MaximumFileSize = 8;
                _tcscpy_s(Properties.LogFileName,1024,TEXT("c:\\Windows\\system32\\LogFiles\\WMI\\OpenPGPmdrv.etl"));
                DeleteFile(Properties.LogFileName);
                err = StartTrace(&SessionHandle, TEXT("OpenPGPmdrv"), &(Properties.TraceProperties));
                if (err != ERROR_SUCCESS)
                {
                        MessageBoxWin32(err);
                        __leave;
                }
                err = EnableTraceEx(&TracingGuid,NULL,SessionHandle,TRUE,WINEVENT_LEVEL_VERBOSE,0,0,0,NULL);
                if (err != ERROR_SUCCESS)
                {
                        MessageBoxWin32(err);
                        __leave;
                }
                fReturn = TRUE;
        }
        __finally
        {
        }
        return fReturn;
}

void StopLogging()
{
        LONG err;
        struct _Prop
        {
                EVENT_TRACE_PROPERTIES TraceProperties;
                TCHAR LogFileName[1024];
                TCHAR LoggerName[1024];
        } Properties;
        memset(&Properties, 0, sizeof(Properties));
        Properties.TraceProperties.Wnode.BufferSize = sizeof(Properties);
        Properties.TraceProperties.Wnode.Guid = TracingGuid;
        Properties.TraceProperties.Wnode.Flags = WNODE_FLAG_TRACED_GUID;
        Properties.TraceProperties.LogFileMode = 4864; 
        Properties.TraceProperties.LogFileNameOffset = sizeof(EVENT_TRACE_PROPERTIES);
        Properties.TraceProperties.LoggerNameOffset = sizeof(EVENT_TRACE_PROPERTIES) + 1024 * sizeof(TCHAR);
        Properties.TraceProperties.MaximumFileSize = 8;
        err = ControlTrace((TRACEHANDLE)NULL, TEXT("OpenPGPmdrv"), &(Properties.TraceProperties),EVENT_TRACE_CONTROL_STOP);
        if (err != ERROR_SUCCESS && err != 0x00001069)
        {
                MessageBoxWin32(err);
        }
}

void EnableLogging()
{
        DWORD64 qdwValue;
        DWORD dwValue;
        LONG err;

        err = RegSetKeyValue(   HKEY_LOCAL_MACHINE, 
                TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv"), 
                TEXT("Guid"), REG_SZ, TEXT("{081CCE5F-5F9C-4b43-9A15-1DCF5D2D45F5}"),sizeof(TEXT("{081CCE5F-5F9C-4b43-9A15-1DCF5D2D45F5}")));
        if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
        err = RegSetKeyValue(   HKEY_LOCAL_MACHINE, 
                TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv"), 
                TEXT("FileName"), REG_SZ, TEXT("c:\\windows\\system32\\LogFiles\\WMI\\OpenPGPmdrv.etl"),sizeof(TEXT("c:\\windows\\system32\\LogFiles\\WMI\\OpenPGPmdrv.etl")));
        if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
        dwValue = 8;
        err = RegSetKeyValue(   HKEY_LOCAL_MACHINE, 
                TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv"), 
                TEXT("FileMax"), REG_DWORD,&dwValue,sizeof(DWORD));
        if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
        dwValue = 1;
        err = RegSetKeyValue(   HKEY_LOCAL_MACHINE, 
                TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv"), 
                TEXT("Start"), REG_DWORD,&dwValue,sizeof(DWORD));
        if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
        dwValue = 8;
        err = RegSetKeyValue(   HKEY_LOCAL_MACHINE, 
                TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv"), 
                TEXT("BufferSize"), REG_DWORD,&dwValue,sizeof(DWORD));
        if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
        dwValue = 0;
        err = RegSetKeyValue(   HKEY_LOCAL_MACHINE, 
                TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv"), 
                TEXT("FlushTimer"), REG_DWORD,&dwValue,sizeof(DWORD));
        if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
        dwValue = 0;
        err = RegSetKeyValue(   HKEY_LOCAL_MACHINE, 
                TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv"), 
                TEXT("MaximumBuffers"), REG_DWORD,&dwValue,sizeof(DWORD));
        if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
        dwValue = 0;
        err = RegSetKeyValue(   HKEY_LOCAL_MACHINE, 
                TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv"), 
                TEXT("MinimumBuffers"), REG_DWORD,&dwValue,sizeof(DWORD));
        if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
        dwValue = 1;
        err = RegSetKeyValue(   HKEY_LOCAL_MACHINE, 
                TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv"), 
                TEXT("ClockType"), REG_DWORD,&dwValue,sizeof(DWORD));
        if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
        dwValue = 64;
        err = RegSetKeyValue(   HKEY_LOCAL_MACHINE, 
                TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv"), 
                TEXT("MaxFileSize"), REG_DWORD,&dwValue,sizeof(DWORD));
        if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
        dwValue = 4864;
        err = RegSetKeyValue(   HKEY_LOCAL_MACHINE, 
                TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv"), 
                TEXT("LogFileMode"), REG_DWORD,&dwValue,sizeof(DWORD));
        if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
        dwValue = 5;
        err = RegSetKeyValue(   HKEY_LOCAL_MACHINE, 
                TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv"), 
                TEXT("FileCounter"), REG_DWORD,&dwValue,sizeof(DWORD));
        if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
        dwValue = 0;
        err = RegSetKeyValue(   HKEY_LOCAL_MACHINE, 
                TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv"), 
                TEXT("Status"), REG_DWORD,&dwValue,sizeof(DWORD));
        if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}

        dwValue = 1;
        err = RegSetKeyValue(   HKEY_LOCAL_MACHINE, 
                TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv\\{081CCE5F-5F9C-4b43-9A15-1DCF5D2D45F5}"), 
                TEXT("Enabled"), REG_DWORD,&dwValue,sizeof(DWORD));
        if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
        dwValue = 5;
        err = RegSetKeyValue(   HKEY_LOCAL_MACHINE, 
                TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv\\{081CCE5F-5F9C-4b43-9A15-1DCF5D2D45F5}"), 
                TEXT("EnableLevel"), REG_DWORD,&dwValue,sizeof(DWORD));
        if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
        dwValue = 0;
        err = RegSetKeyValue(   HKEY_LOCAL_MACHINE, 
                TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv\\{081CCE5F-5F9C-4b43-9A15-1DCF5D2D45F5}"), 
                TEXT("EnableProperty"), REG_DWORD,&dwValue,sizeof(DWORD));
        if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
        dwValue = 0;
        err = RegSetKeyValue(   HKEY_LOCAL_MACHINE, 
                TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv\\{081CCE5F-5F9C-4b43-9A15-1DCF5D2D45F5}"), 
                TEXT("Status"), REG_DWORD,&dwValue,sizeof(DWORD));
        if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
        qdwValue = 0;
        err = RegSetKeyValue(   HKEY_LOCAL_MACHINE, 
                TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv\\{081CCE5F-5F9C-4b43-9A15-1DCF5D2D45F5}"), 
                TEXT("MatchAllKeyword"), REG_QWORD,&qdwValue,sizeof(DWORD64));
        if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
        qdwValue = 0;
        err = RegSetKeyValue(   HKEY_LOCAL_MACHINE, 
                TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv\\{081CCE5F-5F9C-4b43-9A15-1DCF5D2D45F5}"), 
                TEXT("MatchAnyKeyword"), REG_QWORD,&qdwValue,sizeof(DWORD64));
        if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
        StartLogging();
}

void DisableLogging()
{
        
        LONG err = RegDeleteTree(HKEY_LOCAL_MACHINE, TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv"));
        if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
        StopLogging();
}
1	/* OpenPGP Smart Card Mini Driver
2	Copyright (C) 2009 Vincent Le Toux
3
4	This library is Free software; you can redistribute it and/or
5	modify it under the terms of the GNU Lesser General Public
6	License version 2.1 as published by the Free Software Foundation.
7
8	This library is distributed in the hope that it will be useful,
9	but WITHOUT ANY WARRANTY; without even the implied warranty of
10	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
11	Lesser General Public License for more details.
12
13	You should have received a copy of the GNU Lesser General Public
14	License along with this library; if not, write to the Free Software
15	Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
16	*/
17
18	#include <windows.h>
19	#include <tchar.h>
20	#include <Evntprov.h>
21	#include <initguid.h>
22	#include <Wmistr.h>
23	#include <Evntrace.h>
24	#include <cardmod.h>
25	#include "Tracing.h"
26
27	#define MessageBoxWin32(status) MessageBoxWin32Ex (status, __FILE__,__LINE__);
28
29	// to enable tracing in kernel debugger, issue the following command in windbg : ed nt!Kd_DEFAULT_MASK 0xFFFFFFFF
30	// OR
31	// Open up the registry and go to this path,
32	// HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Debug Print Filter
33	// and add the following value "DEFAULT" : REG_DWORD : 0xFFFFFFFF and then reboot
34
35	// {081CCE5F-5F9C-4b43-9A15-1DCF5D2D45F5}
36	DEFINE_GUID(TracingGuid,
37	0x81cce5f, 0x5f9c, 0x4b43, 0x9a, 0x15, 0x1d, 0xcf, 0x5d, 0x2d, 0x45, 0xf5);
38
39	REGHANDLE hPub = 0;
40
41	void TracingRegister()
42	{
43	EventRegister(&TracingGuid,NULL,NULL,&hPub);
44	}
45
46	void TracingUnRegister()
47	{
48	EventUnregister(hPub);
49	}
50
51
52	void TraceEx(LPCSTR szFile, DWORD dwLine, LPCSTR szFunction, UCHAR dwLevel, PCWSTR szFormat,...)
53	{
54	WCHAR Buffer[256];
55	WCHAR Buffer2[356];
56	int ret;
57	va_list ap;
58	#ifndef _DEBUG
59	UNREFERENCED_PARAMETER(dwLine);
60	UNREFERENCED_PARAMETER(szFile);
61	#endif
62	if (!hPub) TracingRegister();
63
64	va_start (ap, szFormat);
65	ret = _vsnwprintf_s (Buffer, 256, _TRUNCATE, szFormat, ap);
66	va_end (ap);
67	if (ret <= 0) return;
68	if (ret > 256) ret = 255;
69	Buffer[255] = L'\0';
70	#ifdef _DEBUG
71	swprintf_s(Buffer2,356,L"%S(%d) : %S - %s\r\n",szFile,dwLine,szFunction,Buffer);
72	OutputDebugString(Buffer2);
73	#endif
74	swprintf_s(Buffer2,356,L"%S(%d) : %s",szFunction,dwLine,Buffer);
75	EventWriteString(hPub,dwLevel,0,Buffer2);
76
77	}
78
79	void TraceDumpEx(LPCSTR szFile, DWORD dwLine, LPCSTR szFunction, UCHAR dwLevel,
80	__in PBYTE pbCmd, __in DWORD dwCmdSize)
81	{
82	WCHAR szData[10 * 3 + 1];
83	DWORD dwI;
84	PWSTR szPointer = szData;
85	for(dwI = 0; dwI < dwCmdSize; dwI++)
86	{
87	if (dwI%10 == 0 && dwI != 0)
88	{
89	TraceEx(szFile,dwLine,szFunction,dwLevel,L"DUMP : %s",szData);
90	szPointer = szData;
91	}
92	swprintf_s(szPointer + 3 * (dwI%10),4,L"%02X ",pbCmd[dwI]);
93
94	}
95	TraceEx(szFile,dwLine,szFunction,dwLevel,L"DUMP : %s",szData);
96	}
97
98	/**
99	* Display a messagebox giving an error code
100	*/
101	void MessageBoxWin32Ex(DWORD status, LPCSTR szFile, DWORD dwLine) {
102	LPVOID Error;
103	TCHAR szTitle[1024];
104	#ifdef UNICODE
105	_stprintf_s(szTitle,ARRAYSIZE(szTitle),TEXT("%S(%d)"),szFile, dwLine);
106	#else
107	_stprintf_s(szTitle,ARRAYSIZE(szTitle),TEXT("%s(%d)"),szFile, dwLine);
108	#endif
109	FormatMessage(FORMAT_MESSAGE_ALLOCATE_BUFFER\|FORMAT_MESSAGE_FROM_SYSTEM,
110	NULL,status,0,(LPTSTR)&Error,0,NULL);
111	MessageBox(NULL,(LPCTSTR)Error,szTitle ,MB_ICONASTERISK);
112	LocalFree(Error);
113	}
114
115	BOOL StartLogging()
116	{
117	BOOL fReturn = FALSE;
118	TRACEHANDLE SessionHandle;
119	struct _Prop
120	{
121	EVENT_TRACE_PROPERTIES TraceProperties;
122	TCHAR LogFileName[1024];
123	TCHAR LoggerName[1024];
124	} Properties;
125	ULONG err;
126	__try
127	{
128	memset(&Properties, 0, sizeof(Properties));
129	Properties.TraceProperties.Wnode.BufferSize = sizeof(Properties);
130	Properties.TraceProperties.Wnode.Guid = TracingGuid;
131	Properties.TraceProperties.Wnode.Flags = WNODE_FLAG_TRACED_GUID;
132	Properties.TraceProperties.Wnode.ClientContext = 1;
133	Properties.TraceProperties.LogFileMode = 4864;
134	Properties.TraceProperties.LogFileNameOffset = sizeof(EVENT_TRACE_PROPERTIES);
135	Properties.TraceProperties.LoggerNameOffset = sizeof(EVENT_TRACE_PROPERTIES) + 1024;
136	Properties.TraceProperties.MaximumFileSize = 8;
137	_tcscpy_s(Properties.LogFileName,1024,TEXT("c:\\Windows\\system32\\LogFiles\\WMI\\OpenPGPmdrv.etl"));
138	DeleteFile(Properties.LogFileName);
139	err = StartTrace(&SessionHandle, TEXT("OpenPGPmdrv"), &(Properties.TraceProperties));
140	if (err != ERROR_SUCCESS)
141	{
142	MessageBoxWin32(err);
143	__leave;
144	}
145	err = EnableTraceEx(&TracingGuid,NULL,SessionHandle,TRUE,WINEVENT_LEVEL_VERBOSE,0,0,0,NULL);
146	if (err != ERROR_SUCCESS)
147	{
148	MessageBoxWin32(err);
149	__leave;
150	}
151	fReturn = TRUE;
152	}
153	__finally
154	{
155	}
156	return fReturn;
157	}
158
159	void StopLogging()
160	{
161	LONG err;
162	struct _Prop
163	{
164	EVENT_TRACE_PROPERTIES TraceProperties;
165	TCHAR LogFileName[1024];
166	TCHAR LoggerName[1024];
167	} Properties;
168	memset(&Properties, 0, sizeof(Properties));
169	Properties.TraceProperties.Wnode.BufferSize = sizeof(Properties);
170	Properties.TraceProperties.Wnode.Guid = TracingGuid;
171	Properties.TraceProperties.Wnode.Flags = WNODE_FLAG_TRACED_GUID;
172	Properties.TraceProperties.LogFileMode = 4864;
173	Properties.TraceProperties.LogFileNameOffset = sizeof(EVENT_TRACE_PROPERTIES);
174	Properties.TraceProperties.LoggerNameOffset = sizeof(EVENT_TRACE_PROPERTIES) + 1024 * sizeof(TCHAR);
175	Properties.TraceProperties.MaximumFileSize = 8;
176	err = ControlTrace((TRACEHANDLE)NULL, TEXT("OpenPGPmdrv"), &(Properties.TraceProperties),EVENT_TRACE_CONTROL_STOP);
177	if (err != ERROR_SUCCESS && err != 0x00001069)
178	{
179	MessageBoxWin32(err);
180	}
181	}
182
183	void EnableLogging()
184	{
185	DWORD64 qdwValue;
186	DWORD dwValue;
187	LONG err;
188
189	err = RegSetKeyValue( HKEY_LOCAL_MACHINE,
190	TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv"),
191	TEXT("Guid"), REG_SZ, TEXT("{081CCE5F-5F9C-4b43-9A15-1DCF5D2D45F5}"),sizeof(TEXT("{081CCE5F-5F9C-4b43-9A15-1DCF5D2D45F5}")));
192	if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
193	err = RegSetKeyValue( HKEY_LOCAL_MACHINE,
194	TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv"),
195	TEXT("FileName"), REG_SZ, TEXT("c:\\windows\\system32\\LogFiles\\WMI\\OpenPGPmdrv.etl"),sizeof(TEXT("c:\\windows\\system32\\LogFiles\\WMI\\OpenPGPmdrv.etl")));
196	if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
197	dwValue = 8;
198	err = RegSetKeyValue( HKEY_LOCAL_MACHINE,
199	TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv"),
200	TEXT("FileMax"), REG_DWORD,&dwValue,sizeof(DWORD));
201	if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
202	dwValue = 1;
203	err = RegSetKeyValue( HKEY_LOCAL_MACHINE,
204	TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv"),
205	TEXT("Start"), REG_DWORD,&dwValue,sizeof(DWORD));
206	if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
207	dwValue = 8;
208	err = RegSetKeyValue( HKEY_LOCAL_MACHINE,
209	TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv"),
210	TEXT("BufferSize"), REG_DWORD,&dwValue,sizeof(DWORD));
211	if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
212	dwValue = 0;
213	err = RegSetKeyValue( HKEY_LOCAL_MACHINE,
214	TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv"),
215	TEXT("FlushTimer"), REG_DWORD,&dwValue,sizeof(DWORD));
216	if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
217	dwValue = 0;
218	err = RegSetKeyValue( HKEY_LOCAL_MACHINE,
219	TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv"),
220	TEXT("MaximumBuffers"), REG_DWORD,&dwValue,sizeof(DWORD));
221	if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
222	dwValue = 0;
223	err = RegSetKeyValue( HKEY_LOCAL_MACHINE,
224	TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv"),
225	TEXT("MinimumBuffers"), REG_DWORD,&dwValue,sizeof(DWORD));
226	if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
227	dwValue = 1;
228	err = RegSetKeyValue( HKEY_LOCAL_MACHINE,
229	TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv"),
230	TEXT("ClockType"), REG_DWORD,&dwValue,sizeof(DWORD));
231	if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
232	dwValue = 64;
233	err = RegSetKeyValue( HKEY_LOCAL_MACHINE,
234	TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv"),
235	TEXT("MaxFileSize"), REG_DWORD,&dwValue,sizeof(DWORD));
236	if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
237	dwValue = 4864;
238	err = RegSetKeyValue( HKEY_LOCAL_MACHINE,
239	TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv"),
240	TEXT("LogFileMode"), REG_DWORD,&dwValue,sizeof(DWORD));
241	if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
242	dwValue = 5;
243	err = RegSetKeyValue( HKEY_LOCAL_MACHINE,
244	TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv"),
245	TEXT("FileCounter"), REG_DWORD,&dwValue,sizeof(DWORD));
246	if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
247	dwValue = 0;
248	err = RegSetKeyValue( HKEY_LOCAL_MACHINE,
249	TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv"),
250	TEXT("Status"), REG_DWORD,&dwValue,sizeof(DWORD));
251	if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
252
253	dwValue = 1;
254	err = RegSetKeyValue( HKEY_LOCAL_MACHINE,
255	TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv\\{081CCE5F-5F9C-4b43-9A15-1DCF5D2D45F5}"),
256	TEXT("Enabled"), REG_DWORD,&dwValue,sizeof(DWORD));
257	if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
258	dwValue = 5;
259	err = RegSetKeyValue( HKEY_LOCAL_MACHINE,
260	TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv\\{081CCE5F-5F9C-4b43-9A15-1DCF5D2D45F5}"),
261	TEXT("EnableLevel"), REG_DWORD,&dwValue,sizeof(DWORD));
262	if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
263	dwValue = 0;
264	err = RegSetKeyValue( HKEY_LOCAL_MACHINE,
265	TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv\\{081CCE5F-5F9C-4b43-9A15-1DCF5D2D45F5}"),
266	TEXT("EnableProperty"), REG_DWORD,&dwValue,sizeof(DWORD));
267	if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
268	dwValue = 0;
269	err = RegSetKeyValue( HKEY_LOCAL_MACHINE,
270	TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv\\{081CCE5F-5F9C-4b43-9A15-1DCF5D2D45F5}"),
271	TEXT("Status"), REG_DWORD,&dwValue,sizeof(DWORD));
272	if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
273	qdwValue = 0;
274	err = RegSetKeyValue( HKEY_LOCAL_MACHINE,
275	TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv\\{081CCE5F-5F9C-4b43-9A15-1DCF5D2D45F5}"),
276	TEXT("MatchAllKeyword"), REG_QWORD,&qdwValue,sizeof(DWORD64));
277	if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
278	qdwValue = 0;
279	err = RegSetKeyValue( HKEY_LOCAL_MACHINE,
280	TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv\\{081CCE5F-5F9C-4b43-9A15-1DCF5D2D45F5}"),
281	TEXT("MatchAnyKeyword"), REG_QWORD,&qdwValue,sizeof(DWORD64));
282	if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
283	StartLogging();
284	}
285
286	void DisableLogging()
287	{
288
289	LONG err = RegDeleteTree(HKEY_LOCAL_MACHINE, TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv"));
290	if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
291	StopLogging();
292	}