trunk/OpenPGPminidriver/Tracing.c

/*      OpenPGP Smart Card Mini Driver
    Copyright (C) 2009 Vincent Le Toux

    This library is Free software; you can redistribute it and/or
    modify it under the terms of the GNU Lesser General Public
    License version 2.1 as published by the Free Software Foundation.

    This library is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
    Lesser General Public License for more details.

    You should have received a copy of the GNU Lesser General Public
    License along with this library; if not, write to the Free Software
    Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
*/

#include <windows.h>
#include <tchar.h>
#include <Evntprov.h>
#include <initguid.h>
#include <Wmistr.h>
#include <Evntrace.h>
#include <cardmod.h>
#include <DelayImp.h>
#pragma comment(lib, "Delayimp.lib")
#include "Tracing.h"

/** We are doing a lot of complicated stuff (like hooking a delay load import)
because the Vista tracing function is much better than XP ones.
The choice was :
- do not allow the driver to run on xp (set WINVER to 0x600)
- don't use the great vista tracing functions (set WINVER to 0x500 and comment the function)
- run on xp AND use this function (set WINVER to 0x600 and allow to run on xp)

=> tried to have the best
*/

#define MessageBoxWin32(status) MessageBoxWin32Ex (status, __FILE__,__LINE__);

// to enable tracing in kernel debugger, issue the following command in windbg : ed nt!Kd_DEFAULT_MASK  0xFFFFFFFF
// OR
// Open up the registry and go to this path,
// HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Debug Print Filter 
// and add the following value "DEFAULT" : REG_DWORD : 0xFFFFFFFF and then reboot

// {081CCE5F-5F9C-4b43-9A15-1DCF5D2D45F5}
DEFINE_GUID(TracingGuid, 
0x81cce5f, 0x5f9c, 0x4b43, 0x9a, 0x15, 0x1d, 0xcf, 0x5d, 0x2d, 0x45, 0xf5);

REGHANDLE hPub = 0;
BOOL          g_bTracingEnabled         = FALSE;
TRACEHANDLE   g_SessionHandle = 0; // The handle to the session that enabled the provider.
UCHAR g_EnableLevel = 0; // Determines the severity of events to log.
extern BOOL fRunOnVistaAndLater;
BOOL fDebugOutputIsEnabled = FALSE;

typedef struct _event
{
    EVENT_TRACE_HEADER Header;
    MOF_FIELD Data[MAX_MOF_FIELDS];  // Event-specific data
} MY_EVENT, *PMY_EVENT;

#define MY_EVENT_TYPE 1
#define EVENT_DATA_FIELDS_CNT  1

INT_PTR FAR WINAPI DoNothing()
{
        return 0;
}

// delayHookFunc - Delay load hooking function
// don't fail to load our dll is the computer is xp
FARPROC WINAPI delayHookFailureFunc (unsigned dliNotify, PDelayLoadInfo pdli)
{
        UNREFERENCED_PARAMETER(pdli);
        if (_stricmp(pdli->szDll,"advapi32.dll") == 0 && dliNotify == dliFailGetProc)
        {
                return &DoNothing;
        }

        return NULL;
}


// __delayLoadHelper gets the hook function in here:
PfnDliHook __pfnDliFailureHook2 = delayHookFailureFunc;


// The callback function that receives enable/disable notifications
// from one or more ETW sessions. Because more than one session
// can enable the provider, this example ignores requests from other 
// sessions if it is already enabled.

ULONG WINAPI ControlCallback(
    WMIDPREQUESTCODE RequestCode,
    PVOID Context,
    ULONG* Reserved, 
    PVOID Header
    )
{
    ULONG status = ERROR_SUCCESS;
    TRACEHANDLE TempSessionHandle = 0; 

    switch (RequestCode)
    {
        case WMI_ENABLE_EVENTS:  // Enable the provider.
        {
            SetLastError(0);

            // If the provider is already enabled to a provider, ignore 
            // the request. Get the session handle of the enabling session.
            // You need the session handle to call the TraceEvent function.
            // The session could be enabling the provider or it could be
            // updating the level and enable flags.

            TempSessionHandle = GetTraceLoggerHandle(Header);
            if (INVALID_HANDLE_VALUE == (HANDLE)TempSessionHandle)
            {
                wprintf(L"GetTraceLoggerHandle failed. Error code is %lu.\n", status = GetLastError());
                break;
            }

            if (0 == g_SessionHandle)
            {
                g_SessionHandle = TempSessionHandle;
            }
            else if (g_SessionHandle != TempSessionHandle)
            {
                break;
            }

            // Get the severity level of the events that the
            // session wants you to log.

            g_EnableLevel = GetTraceEnableLevel(g_SessionHandle); 
            g_bTracingEnabled = TRUE;
            break;
        }
 
        case WMI_DISABLE_EVENTS:  // Disable the provider.
        {
            // Disable the provider only if the request is coming from the
            // session that enabled the provider.

            TempSessionHandle = GetTraceLoggerHandle(Header);
            if (INVALID_HANDLE_VALUE == (HANDLE)TempSessionHandle)
            {
                wprintf(L"GetTraceLoggerHandle failed. Error code is %lu.\n", status = GetLastError());
                break;
            }

            if (g_SessionHandle == TempSessionHandle)
            {
                g_bTracingEnabled = FALSE;
                g_SessionHandle = 0;
            }
            break;
        }

        default:
        {
            status = ERROR_INVALID_PARAMETER;
            break;
        }
    }

    return status;
}

// callback to know if the tracing is activated
VOID NTAPI ControlCallbackVista (
    __in LPCGUID SourceId,
    __in ULONG IsEnabled,
    __in UCHAR Level,
    __in ULONGLONG MatchAnyKeyword,
    __in ULONGLONG MatchAllKeyword,
    __in_opt PEVENT_FILTER_DESCRIPTOR FilterData,
    __in_opt PVOID CallbackContext
    )
{
        g_bTracingEnabled = (IsEnabled?TRUE:FALSE);
}

// called to setup the tracing context
void TracingRegister() 
{
        if (fRunOnVistaAndLater)
        {
                EventRegister(&TracingGuid,ControlCallbackVista,NULL,&hPub);
        }
        else
        {
                RegisterTraceGuids(
                          ControlCallback,
                          NULL,
                          &TracingGuid, 
                          0, NULL, NULL, 
                          NULL,
                          &hPub);
        }
#ifdef _DEBUG
        fDebugOutputIsEnabled = TRUE;
#endif
}
// called to clean up the tracing context
void TracingUnRegister() 
{
        if (fRunOnVistaAndLater)
        {
                EventUnregister(hPub);
        }
        else
        {
                UnregisterTraceGuids(hPub );
        }
}
// write a single line in the trace
void WriteTrace(UCHAR dwLevel, PWSTR szTrace)
{
        if (fRunOnVistaAndLater)
        {
                EventWriteString(hPub,dwLevel,0,szTrace);
        }
        else
        {
                MY_EVENT MyEvent; 
                NTSTATUS status;
                
                if (g_bTracingEnabled && (0 == g_EnableLevel || dwLevel <= g_EnableLevel))
                {
                        // Initialize the event data structure.

                        ZeroMemory(&MyEvent, sizeof(MY_EVENT));
                        MyEvent.Header.Size = sizeof(EVENT_TRACE_HEADER) + (sizeof(MOF_FIELD) * EVENT_DATA_FIELDS_CNT);
                        MyEvent.Header.Flags = WNODE_FLAG_TRACED_GUID | WNODE_FLAG_USE_MOF_PTR;
                        MyEvent.Header.Guid = TracingGuid;
                        MyEvent.Header.Class.Type = MY_EVENT_TYPE;
                        MyEvent.Header.Class.Version = 1;
                        MyEvent.Header.Class.Level = dwLevel;

                        // Load the event data. You can also use the DEFINE_TRACE_MOF_FIELD
                        // macro defined in evntrace.h to set the MOF_FIELD members. For example,
                        // DEFINE_TRACE_MOF_FIELD(&EventData.Data[0], &EventData.Cost, sizeof(EventData.Cost), 0);

                        MyEvent.Data[0].DataPtr = (ULONG64) szTrace;
                        MyEvent.Data[0].Length = (ULONG) (sizeof(WCHAR) * (1 + wcslen(szTrace)));
                        MyEvent.Data[0].DataType = ETW_STRING_TYPE_VALUE;

                        // Write the event.

                        status = TraceEvent(g_SessionHandle, &(MyEvent.Header));
                        if (ERROR_SUCCESS != status)
                        {
                                g_bTracingEnabled = FALSE;
                        }
                }
        }
}

void TraceEx(LPCSTR szFile, DWORD dwLine, LPCSTR szFunction, UCHAR dwLevel, PCWSTR szFormat,...) 
{
        WCHAR Buffer[256];
        WCHAR Buffer2[356];
        int ret;
        va_list ap;
#ifndef _DEBUG
        UNREFERENCED_PARAMETER(dwLine);
        UNREFERENCED_PARAMETER(szFile);
#endif
        if (!hPub) TracingRegister();
        if ( g_bTracingEnabled || fDebugOutputIsEnabled) {

                va_start (ap, szFormat);
                ret = _vsnwprintf_s (Buffer, 256, _TRUNCATE, szFormat, ap);
                va_end (ap);
                if (ret <= 0) return;
                if (ret > 256) ret = 255;
                Buffer[255] = L'\0';
                if (fDebugOutputIsEnabled)
                {
                        swprintf_s(Buffer2,356,L"%S(%d) : %S - %s\r\n",szFile,dwLine,szFunction,Buffer);
                        OutputDebugString(Buffer2);
                }
                if (g_bTracingEnabled)
                {
                        swprintf_s(Buffer2,356,L"%S(%d) : %s",szFunction,dwLine,Buffer);
                        WriteTrace(dwLevel, Buffer2);
                }
        }
}


void TraceDumpEx(LPCSTR szFile, DWORD dwLine, LPCSTR szFunction, UCHAR dwLevel,
                          __in PBYTE pbCmd, __in DWORD dwCmdSize)
{
        WCHAR szData[10 * 3 + 1];
        DWORD dwI;
        PWSTR szPointer = szData;
        for(dwI = 0; dwI < dwCmdSize; dwI++)
        {
                if (dwI%10 == 0 && dwI != 0)
                {
                        TraceEx(szFile,dwLine,szFunction,dwLevel,L"DUMP : %s",szData);
                        szPointer = szData;
                }
                swprintf_s(szPointer + 3 * (dwI%10),4,L"%02X ",pbCmd[dwI]);
                
        }
        TraceEx(szFile,dwLine,szFunction,dwLevel,L"DUMP : %s",szData);
}

/**
 *  Display a messagebox giving an error code
 */
void MessageBoxWin32Ex(DWORD status, LPCSTR szFile, DWORD dwLine) {
        LPVOID Error;
        TCHAR szTitle[1024];
#ifdef UNICODE
        _stprintf_s(szTitle,ARRAYSIZE(szTitle),TEXT("%S(%d)"),szFile, dwLine);
#else
        _stprintf_s(szTitle,ARRAYSIZE(szTitle),TEXT("%s(%d)"),szFile, dwLine);
#endif
        FormatMessage(FORMAT_MESSAGE_ALLOCATE_BUFFER|FORMAT_MESSAGE_FROM_SYSTEM,
                NULL,status,0,(LPTSTR)&Error,0,NULL);
        MessageBox(NULL,(LPCTSTR)Error,szTitle ,MB_ICONASTERISK);
        LocalFree(Error);
}

BOOL StartLogging()
{
        BOOL fReturn = FALSE;
        TRACEHANDLE SessionHandle;
        struct _Prop
        {
                EVENT_TRACE_PROPERTIES TraceProperties;
                TCHAR LogFileName[1024];
                TCHAR LoggerName[1024];
        } Properties;
        ULONG err;
        __try
        {
                memset(&Properties, 0, sizeof(Properties));
                Properties.TraceProperties.Wnode.BufferSize = sizeof(Properties);
                Properties.TraceProperties.Wnode.Guid = TracingGuid;
                Properties.TraceProperties.Wnode.Flags = WNODE_FLAG_TRACED_GUID;
                Properties.TraceProperties.Wnode.ClientContext = 1;
                Properties.TraceProperties.LogFileMode = 4864; 
                Properties.TraceProperties.LogFileNameOffset = sizeof(EVENT_TRACE_PROPERTIES);
                Properties.TraceProperties.LoggerNameOffset = sizeof(EVENT_TRACE_PROPERTIES) + 1024;
                Properties.TraceProperties.MaximumFileSize = 8;
                _tcscpy_s(Properties.LogFileName,1024,TEXT("c:\\Windows\\system32\\LogFiles\\WMI\\OpenPGPmdrv.etl"));
                DeleteFile(Properties.LogFileName);
                err = StartTrace(&SessionHandle, TEXT("OpenPGPmdrv"), &(Properties.TraceProperties));
                if (err != ERROR_SUCCESS)
                {
                        MessageBoxWin32(err);
                        __leave;
                }
                err = EnableTraceEx(&TracingGuid,NULL,SessionHandle,TRUE,WINEVENT_LEVEL_VERBOSE,0,0,0,NULL);
                if (err != ERROR_SUCCESS)
                {
                        MessageBoxWin32(err);
                        __leave;
                }
                fReturn = TRUE;
        }
        __finally
        {
        }
        return fReturn;
}

void StopLogging()
{
        LONG err;
        struct _Prop
        {
                EVENT_TRACE_PROPERTIES TraceProperties;
                TCHAR LogFileName[1024];
                TCHAR LoggerName[1024];
        } Properties;
        memset(&Properties, 0, sizeof(Properties));
        Properties.TraceProperties.Wnode.BufferSize = sizeof(Properties);
        Properties.TraceProperties.Wnode.Guid = TracingGuid;
        Properties.TraceProperties.Wnode.Flags = WNODE_FLAG_TRACED_GUID;
        Properties.TraceProperties.LogFileMode = 4864; 
        Properties.TraceProperties.LogFileNameOffset = sizeof(EVENT_TRACE_PROPERTIES);
        Properties.TraceProperties.LoggerNameOffset = sizeof(EVENT_TRACE_PROPERTIES) + 1024 * sizeof(TCHAR);
        Properties.TraceProperties.MaximumFileSize = 8;
        err = ControlTrace((TRACEHANDLE)NULL, TEXT("OpenPGPmdrv"), &(Properties.TraceProperties),EVENT_TRACE_CONTROL_STOP);
        if (err != ERROR_SUCCESS && err != 0x00001069)
        {
                MessageBoxWin32(err);
        }
}

void EnableLogging()
{
        DWORD64 qdwValue;
        DWORD dwValue;
        LONG err;

        err = RegSetKeyValue(   HKEY_LOCAL_MACHINE, 
                TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv"), 
                TEXT("Guid"), REG_SZ, TEXT("{081CCE5F-5F9C-4b43-9A15-1DCF5D2D45F5}"),sizeof(TEXT("{081CCE5F-5F9C-4b43-9A15-1DCF5D2D45F5}")));
        if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
        err = RegSetKeyValue(   HKEY_LOCAL_MACHINE, 
                TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv"), 
                TEXT("FileName"), REG_SZ, TEXT("c:\\windows\\system32\\LogFiles\\WMI\\OpenPGPmdrv.etl"),sizeof(TEXT("c:\\windows\\system32\\LogFiles\\WMI\\OpenPGPmdrv.etl")));
        if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
        dwValue = 8;
        err = RegSetKeyValue(   HKEY_LOCAL_MACHINE, 
                TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv"), 
                TEXT("FileMax"), REG_DWORD,&dwValue,sizeof(DWORD));
        if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
        dwValue = 1;
        err = RegSetKeyValue(   HKEY_LOCAL_MACHINE, 
                TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv"), 
                TEXT("Start"), REG_DWORD,&dwValue,sizeof(DWORD));
        if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
        dwValue = 8;
        err = RegSetKeyValue(   HKEY_LOCAL_MACHINE, 
                TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv"), 
                TEXT("BufferSize"), REG_DWORD,&dwValue,sizeof(DWORD));
        if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
        dwValue = 0;
        err = RegSetKeyValue(   HKEY_LOCAL_MACHINE, 
                TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv"), 
                TEXT("FlushTimer"), REG_DWORD,&dwValue,sizeof(DWORD));
        if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
        dwValue = 0;
        err = RegSetKeyValue(   HKEY_LOCAL_MACHINE, 
                TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv"), 
                TEXT("MaximumBuffers"), REG_DWORD,&dwValue,sizeof(DWORD));
        if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
        dwValue = 0;
        err = RegSetKeyValue(   HKEY_LOCAL_MACHINE, 
                TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv"), 
                TEXT("MinimumBuffers"), REG_DWORD,&dwValue,sizeof(DWORD));
        if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
        dwValue = 1;
        err = RegSetKeyValue(   HKEY_LOCAL_MACHINE, 
                TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv"), 
                TEXT("ClockType"), REG_DWORD,&dwValue,sizeof(DWORD));
        if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
        dwValue = 64;
        err = RegSetKeyValue(   HKEY_LOCAL_MACHINE, 
                TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv"), 
                TEXT("MaxFileSize"), REG_DWORD,&dwValue,sizeof(DWORD));
        if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
        dwValue = 4864;
        err = RegSetKeyValue(   HKEY_LOCAL_MACHINE, 
                TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv"), 
                TEXT("LogFileMode"), REG_DWORD,&dwValue,sizeof(DWORD));
        if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
        dwValue = 5;
        err = RegSetKeyValue(   HKEY_LOCAL_MACHINE, 
                TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv"), 
                TEXT("FileCounter"), REG_DWORD,&dwValue,sizeof(DWORD));
        if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
        dwValue = 0;
        err = RegSetKeyValue(   HKEY_LOCAL_MACHINE, 
                TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv"), 
                TEXT("Status"), REG_DWORD,&dwValue,sizeof(DWORD));
        if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}

        dwValue = 1;
        err = RegSetKeyValue(   HKEY_LOCAL_MACHINE, 
                TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv\\{081CCE5F-5F9C-4b43-9A15-1DCF5D2D45F5}"), 
                TEXT("Enabled"), REG_DWORD,&dwValue,sizeof(DWORD));
        if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
        dwValue = 5;
        err = RegSetKeyValue(   HKEY_LOCAL_MACHINE, 
                TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv\\{081CCE5F-5F9C-4b43-9A15-1DCF5D2D45F5}"), 
                TEXT("EnableLevel"), REG_DWORD,&dwValue,sizeof(DWORD));
        if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
        dwValue = 0;
        err = RegSetKeyValue(   HKEY_LOCAL_MACHINE, 
                TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv\\{081CCE5F-5F9C-4b43-9A15-1DCF5D2D45F5}"), 
                TEXT("EnableProperty"), REG_DWORD,&dwValue,sizeof(DWORD));
        if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
        dwValue = 0;
        err = RegSetKeyValue(   HKEY_LOCAL_MACHINE, 
                TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv\\{081CCE5F-5F9C-4b43-9A15-1DCF5D2D45F5}"), 
                TEXT("Status"), REG_DWORD,&dwValue,sizeof(DWORD));
        if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
        qdwValue = 0;
        err = RegSetKeyValue(   HKEY_LOCAL_MACHINE, 
                TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv\\{081CCE5F-5F9C-4b43-9A15-1DCF5D2D45F5}"), 
                TEXT("MatchAllKeyword"), REG_QWORD,&qdwValue,sizeof(DWORD64));
        if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
        qdwValue = 0;
        err = RegSetKeyValue(   HKEY_LOCAL_MACHINE, 
                TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv\\{081CCE5F-5F9C-4b43-9A15-1DCF5D2D45F5}"), 
                TEXT("MatchAnyKeyword"), REG_QWORD,&qdwValue,sizeof(DWORD64));
        if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
        StartLogging();
}

void DisableLogging()
{
        
        LONG err = RegDeleteTree(HKEY_LOCAL_MACHINE, TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv"));
        if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
        StopLogging();
}
1	vletoux	1	/* OpenPGP Smart Card Mini Driver
2			Copyright (C) 2009 Vincent Le Toux
3
4			This library is Free software; you can redistribute it and/or
5			modify it under the terms of the GNU Lesser General Public
6			License version 2.1 as published by the Free Software Foundation.
7
8			This library is distributed in the hope that it will be useful,
9			but WITHOUT ANY WARRANTY; without even the implied warranty of
10			MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
11			Lesser General Public License for more details.
12
13			You should have received a copy of the GNU Lesser General Public
14			License along with this library; if not, write to the Free Software
15			Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
16			*/
17
18			#include <windows.h>
19			#include <tchar.h>
20			#include <Evntprov.h>
21			#include <initguid.h>
22			#include <Wmistr.h>
23			#include <Evntrace.h>
24			#include <cardmod.h>
25	vletoux	12	#include <DelayImp.h>
26			#pragma comment(lib, "Delayimp.lib")
27	vletoux	1	#include "Tracing.h"
28
29	vletoux	12	/** We are doing a lot of complicated stuff (like hooking a delay load import)
30			because the Vista tracing function is much better than XP ones.
31			The choice was :
32			- do not allow the driver to run on xp (set WINVER to 0x600)
33			- don't use the great vista tracing functions (set WINVER to 0x500 and comment the function)
34			- run on xp AND use this function (set WINVER to 0x600 and allow to run on xp)
35
36			=> tried to have the best
37			*/
38
39	vletoux	1	#define MessageBoxWin32(status) MessageBoxWin32Ex (status, __FILE__,__LINE__);
40
41			// to enable tracing in kernel debugger, issue the following command in windbg : ed nt!Kd_DEFAULT_MASK 0xFFFFFFFF
42			// OR
43			// Open up the registry and go to this path,
44			// HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Debug Print Filter
45			// and add the following value "DEFAULT" : REG_DWORD : 0xFFFFFFFF and then reboot
46
47			// {081CCE5F-5F9C-4b43-9A15-1DCF5D2D45F5}
48			DEFINE_GUID(TracingGuid,
49			0x81cce5f, 0x5f9c, 0x4b43, 0x9a, 0x15, 0x1d, 0xcf, 0x5d, 0x2d, 0x45, 0xf5);
50
51			REGHANDLE hPub = 0;
52	vletoux	12	BOOL g_bTracingEnabled = FALSE;
53			TRACEHANDLE g_SessionHandle = 0; // The handle to the session that enabled the provider.
54			UCHAR g_EnableLevel = 0; // Determines the severity of events to log.
55			extern BOOL fRunOnVistaAndLater;
56			BOOL fDebugOutputIsEnabled = FALSE;
57	vletoux	1
58	vletoux	12	typedef struct _event
59			{
60			EVENT_TRACE_HEADER Header;
61			MOF_FIELD Data[MAX_MOF_FIELDS]; // Event-specific data
62			} MY_EVENT, *PMY_EVENT;
63
64			#define MY_EVENT_TYPE 1
65			#define EVENT_DATA_FIELDS_CNT 1
66
67			INT_PTR FAR WINAPI DoNothing()
68			{
69			return 0;
70			}
71
72			// delayHookFunc - Delay load hooking function
73			// don't fail to load our dll is the computer is xp
74			FARPROC WINAPI delayHookFailureFunc (unsigned dliNotify, PDelayLoadInfo pdli)
75			{
76			UNREFERENCED_PARAMETER(pdli);
77			if (_stricmp(pdli->szDll,"advapi32.dll") == 0 && dliNotify == dliFailGetProc)
78			{
79			return &DoNothing;
80			}
81
82			return NULL;
83			}
84
85
86			// __delayLoadHelper gets the hook function in here:
87			PfnDliHook __pfnDliFailureHook2 = delayHookFailureFunc;
88
89
90
91			// The callback function that receives enable/disable notifications
92			// from one or more ETW sessions. Because more than one session
93			// can enable the provider, this example ignores requests from other
94			// sessions if it is already enabled.
95
96			ULONG WINAPI ControlCallback(
97			WMIDPREQUESTCODE RequestCode,
98			PVOID Context,
99			ULONG* Reserved,
100			PVOID Header
101			)
102			{
103			ULONG status = ERROR_SUCCESS;
104			TRACEHANDLE TempSessionHandle = 0;
105
106			switch (RequestCode)
107			{
108			case WMI_ENABLE_EVENTS: // Enable the provider.
109			{
110			SetLastError(0);
111
112			// If the provider is already enabled to a provider, ignore
113			// the request. Get the session handle of the enabling session.
114			// You need the session handle to call the TraceEvent function.
115			// The session could be enabling the provider or it could be
116			// updating the level and enable flags.
117
118			TempSessionHandle = GetTraceLoggerHandle(Header);
119			if (INVALID_HANDLE_VALUE == (HANDLE)TempSessionHandle)
120			{
121			wprintf(L"GetTraceLoggerHandle failed. Error code is %lu.\n", status = GetLastError());
122			break;
123			}
124
125			if (0 == g_SessionHandle)
126			{
127			g_SessionHandle = TempSessionHandle;
128			}
129			else if (g_SessionHandle != TempSessionHandle)
130			{
131			break;
132			}
133
134			// Get the severity level of the events that the
135			// session wants you to log.
136
137			g_EnableLevel = GetTraceEnableLevel(g_SessionHandle);
138			g_bTracingEnabled = TRUE;
139			break;
140			}
141
142			case WMI_DISABLE_EVENTS: // Disable the provider.
143			{
144			// Disable the provider only if the request is coming from the
145			// session that enabled the provider.
146
147			TempSessionHandle = GetTraceLoggerHandle(Header);
148			if (INVALID_HANDLE_VALUE == (HANDLE)TempSessionHandle)
149			{
150			wprintf(L"GetTraceLoggerHandle failed. Error code is %lu.\n", status = GetLastError());
151			break;
152			}
153
154			if (g_SessionHandle == TempSessionHandle)
155			{
156			g_bTracingEnabled = FALSE;
157			g_SessionHandle = 0;
158			}
159			break;
160			}
161
162			default:
163			{
164			status = ERROR_INVALID_PARAMETER;
165			break;
166			}
167			}
168
169			return status;
170			}
171
172			// callback to know if the tracing is activated
173			VOID NTAPI ControlCallbackVista (
174			__in LPCGUID SourceId,
175			__in ULONG IsEnabled,
176			__in UCHAR Level,
177			__in ULONGLONG MatchAnyKeyword,
178			__in ULONGLONG MatchAllKeyword,
179			__in_opt PEVENT_FILTER_DESCRIPTOR FilterData,
180			__in_opt PVOID CallbackContext
181			)
182			{
183			g_bTracingEnabled = (IsEnabled?TRUE:FALSE);
184			}
185
186			// called to setup the tracing context
187	vletoux	7	void TracingRegister()
188			{
189	vletoux	12	if (fRunOnVistaAndLater)
190			{
191			EventRegister(&TracingGuid,ControlCallbackVista,NULL,&hPub);
192			}
193			else
194			{
195			RegisterTraceGuids(
196			ControlCallback,
197			NULL,
198			&TracingGuid,
199			0, NULL, NULL,
200			NULL,
201			&hPub);
202			}
203			#ifdef _DEBUG
204			fDebugOutputIsEnabled = TRUE;
205			#endif
206	vletoux	1	}
207	vletoux	12	// called to clean up the tracing context
208	vletoux	7	void TracingUnRegister()
209			{
210	vletoux	12	if (fRunOnVistaAndLater)
211			{
212			EventUnregister(hPub);
213			}
214			else
215			{
216			UnregisterTraceGuids(hPub );
217			}
218	vletoux	1	}
219	vletoux	12	// write a single line in the trace
220			void WriteTrace(UCHAR dwLevel, PWSTR szTrace)
221			{
222			if (fRunOnVistaAndLater)
223			{
224			EventWriteString(hPub,dwLevel,0,szTrace);
225			}
226			else
227			{
228			MY_EVENT MyEvent;
229			NTSTATUS status;
230
231			if (g_bTracingEnabled && (0 == g_EnableLevel \|\| dwLevel <= g_EnableLevel))
232			{
233			// Initialize the event data structure.
234	vletoux	1
235	vletoux	12	ZeroMemory(&MyEvent, sizeof(MY_EVENT));
236			MyEvent.Header.Size = sizeof(EVENT_TRACE_HEADER) + (sizeof(MOF_FIELD) * EVENT_DATA_FIELDS_CNT);
237			MyEvent.Header.Flags = WNODE_FLAG_TRACED_GUID \| WNODE_FLAG_USE_MOF_PTR;
238			MyEvent.Header.Guid = TracingGuid;
239			MyEvent.Header.Class.Type = MY_EVENT_TYPE;
240			MyEvent.Header.Class.Version = 1;
241			MyEvent.Header.Class.Level = dwLevel;
242	vletoux	1
243	vletoux	12	// Load the event data. You can also use the DEFINE_TRACE_MOF_FIELD
244			// macro defined in evntrace.h to set the MOF_FIELD members. For example,
245			// DEFINE_TRACE_MOF_FIELD(&EventData.Data[0], &EventData.Cost, sizeof(EventData.Cost), 0);
246
247			MyEvent.Data[0].DataPtr = (ULONG64) szTrace;
248			MyEvent.Data[0].Length = (ULONG) (sizeof(WCHAR) * (1 + wcslen(szTrace)));
249			MyEvent.Data[0].DataType = ETW_STRING_TYPE_VALUE;
250
251			// Write the event.
252
253			status = TraceEvent(g_SessionHandle, &(MyEvent.Header));
254			if (ERROR_SUCCESS != status)
255			{
256			g_bTracingEnabled = FALSE;
257			}
258			}
259			}
260			}
261
262	vletoux	7	void TraceEx(LPCSTR szFile, DWORD dwLine, LPCSTR szFunction, UCHAR dwLevel, PCWSTR szFormat,...)
263			{
264			WCHAR Buffer[256];
265			WCHAR Buffer2[356];
266			int ret;
267			va_list ap;
268	vletoux	1	#ifndef _DEBUG
269			UNREFERENCED_PARAMETER(dwLine);
270			UNREFERENCED_PARAMETER(szFile);
271			#endif
272			if (!hPub) TracingRegister();
273	vletoux	12	if ( g_bTracingEnabled \|\| fDebugOutputIsEnabled) {
274	vletoux	1
275	vletoux	12	va_start (ap, szFormat);
276			ret = _vsnwprintf_s (Buffer, 256, _TRUNCATE, szFormat, ap);
277			va_end (ap);
278			if (ret <= 0) return;
279			if (ret > 256) ret = 255;
280			Buffer[255] = L'\0';
281			if (fDebugOutputIsEnabled)
282			{
283			swprintf_s(Buffer2,356,L"%S(%d) : %S - %s\r\n",szFile,dwLine,szFunction,Buffer);
284			OutputDebugString(Buffer2);
285			}
286			if (g_bTracingEnabled)
287			{
288			swprintf_s(Buffer2,356,L"%S(%d) : %s",szFunction,dwLine,Buffer);
289			WriteTrace(dwLevel, Buffer2);
290			}
291			}
292	vletoux	1	}
293
294	vletoux	12
295
296	vletoux	1	void TraceDumpEx(LPCSTR szFile, DWORD dwLine, LPCSTR szFunction, UCHAR dwLevel,
297			__in PBYTE pbCmd, __in DWORD dwCmdSize)
298			{
299			WCHAR szData[10 * 3 + 1];
300			DWORD dwI;
301			PWSTR szPointer = szData;
302			for(dwI = 0; dwI < dwCmdSize; dwI++)
303			{
304			if (dwI%10 == 0 && dwI != 0)
305			{
306			TraceEx(szFile,dwLine,szFunction,dwLevel,L"DUMP : %s",szData);
307			szPointer = szData;
308			}
309			swprintf_s(szPointer + 3 * (dwI%10),4,L"%02X ",pbCmd[dwI]);
310
311			}
312			TraceEx(szFile,dwLine,szFunction,dwLevel,L"DUMP : %s",szData);
313			}
314
315			/**
316			* Display a messagebox giving an error code
317			*/
318			void MessageBoxWin32Ex(DWORD status, LPCSTR szFile, DWORD dwLine) {
319			LPVOID Error;
320			TCHAR szTitle[1024];
321			#ifdef UNICODE
322			_stprintf_s(szTitle,ARRAYSIZE(szTitle),TEXT("%S(%d)"),szFile, dwLine);
323			#else
324			_stprintf_s(szTitle,ARRAYSIZE(szTitle),TEXT("%s(%d)"),szFile, dwLine);
325			#endif
326			FormatMessage(FORMAT_MESSAGE_ALLOCATE_BUFFER\|FORMAT_MESSAGE_FROM_SYSTEM,
327			NULL,status,0,(LPTSTR)&Error,0,NULL);
328			MessageBox(NULL,(LPCTSTR)Error,szTitle ,MB_ICONASTERISK);
329			LocalFree(Error);
330			}
331
332			BOOL StartLogging()
333			{
334			BOOL fReturn = FALSE;
335			TRACEHANDLE SessionHandle;
336			struct _Prop
337			{
338			EVENT_TRACE_PROPERTIES TraceProperties;
339			TCHAR LogFileName[1024];
340			TCHAR LoggerName[1024];
341			} Properties;
342			ULONG err;
343			__try
344			{
345			memset(&Properties, 0, sizeof(Properties));
346			Properties.TraceProperties.Wnode.BufferSize = sizeof(Properties);
347			Properties.TraceProperties.Wnode.Guid = TracingGuid;
348			Properties.TraceProperties.Wnode.Flags = WNODE_FLAG_TRACED_GUID;
349			Properties.TraceProperties.Wnode.ClientContext = 1;
350			Properties.TraceProperties.LogFileMode = 4864;
351			Properties.TraceProperties.LogFileNameOffset = sizeof(EVENT_TRACE_PROPERTIES);
352			Properties.TraceProperties.LoggerNameOffset = sizeof(EVENT_TRACE_PROPERTIES) + 1024;
353			Properties.TraceProperties.MaximumFileSize = 8;
354			_tcscpy_s(Properties.LogFileName,1024,TEXT("c:\\Windows\\system32\\LogFiles\\WMI\\OpenPGPmdrv.etl"));
355			DeleteFile(Properties.LogFileName);
356			err = StartTrace(&SessionHandle, TEXT("OpenPGPmdrv"), &(Properties.TraceProperties));
357			if (err != ERROR_SUCCESS)
358			{
359			MessageBoxWin32(err);
360			__leave;
361			}
362			err = EnableTraceEx(&TracingGuid,NULL,SessionHandle,TRUE,WINEVENT_LEVEL_VERBOSE,0,0,0,NULL);
363			if (err != ERROR_SUCCESS)
364			{
365			MessageBoxWin32(err);
366			__leave;
367			}
368			fReturn = TRUE;
369			}
370			__finally
371			{
372			}
373			return fReturn;
374			}
375
376			void StopLogging()
377			{
378			LONG err;
379			struct _Prop
380			{
381			EVENT_TRACE_PROPERTIES TraceProperties;
382			TCHAR LogFileName[1024];
383			TCHAR LoggerName[1024];
384			} Properties;
385			memset(&Properties, 0, sizeof(Properties));
386			Properties.TraceProperties.Wnode.BufferSize = sizeof(Properties);
387			Properties.TraceProperties.Wnode.Guid = TracingGuid;
388			Properties.TraceProperties.Wnode.Flags = WNODE_FLAG_TRACED_GUID;
389			Properties.TraceProperties.LogFileMode = 4864;
390			Properties.TraceProperties.LogFileNameOffset = sizeof(EVENT_TRACE_PROPERTIES);
391			Properties.TraceProperties.LoggerNameOffset = sizeof(EVENT_TRACE_PROPERTIES) + 1024 * sizeof(TCHAR);
392			Properties.TraceProperties.MaximumFileSize = 8;
393			err = ControlTrace((TRACEHANDLE)NULL, TEXT("OpenPGPmdrv"), &(Properties.TraceProperties),EVENT_TRACE_CONTROL_STOP);
394			if (err != ERROR_SUCCESS && err != 0x00001069)
395			{
396			MessageBoxWin32(err);
397			}
398			}
399
400			void EnableLogging()
401			{
402			DWORD64 qdwValue;
403			DWORD dwValue;
404			LONG err;
405
406			err = RegSetKeyValue( HKEY_LOCAL_MACHINE,
407			TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv"),
408			TEXT("Guid"), REG_SZ, TEXT("{081CCE5F-5F9C-4b43-9A15-1DCF5D2D45F5}"),sizeof(TEXT("{081CCE5F-5F9C-4b43-9A15-1DCF5D2D45F5}")));
409			if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
410			err = RegSetKeyValue( HKEY_LOCAL_MACHINE,
411			TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv"),
412			TEXT("FileName"), REG_SZ, TEXT("c:\\windows\\system32\\LogFiles\\WMI\\OpenPGPmdrv.etl"),sizeof(TEXT("c:\\windows\\system32\\LogFiles\\WMI\\OpenPGPmdrv.etl")));
413			if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
414			dwValue = 8;
415			err = RegSetKeyValue( HKEY_LOCAL_MACHINE,
416			TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv"),
417			TEXT("FileMax"), REG_DWORD,&dwValue,sizeof(DWORD));
418			if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
419			dwValue = 1;
420			err = RegSetKeyValue( HKEY_LOCAL_MACHINE,
421			TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv"),
422			TEXT("Start"), REG_DWORD,&dwValue,sizeof(DWORD));
423			if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
424			dwValue = 8;
425			err = RegSetKeyValue( HKEY_LOCAL_MACHINE,
426			TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv"),
427			TEXT("BufferSize"), REG_DWORD,&dwValue,sizeof(DWORD));
428			if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
429			dwValue = 0;
430			err = RegSetKeyValue( HKEY_LOCAL_MACHINE,
431			TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv"),
432			TEXT("FlushTimer"), REG_DWORD,&dwValue,sizeof(DWORD));
433			if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
434			dwValue = 0;
435			err = RegSetKeyValue( HKEY_LOCAL_MACHINE,
436			TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv"),
437			TEXT("MaximumBuffers"), REG_DWORD,&dwValue,sizeof(DWORD));
438			if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
439			dwValue = 0;
440			err = RegSetKeyValue( HKEY_LOCAL_MACHINE,
441			TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv"),
442			TEXT("MinimumBuffers"), REG_DWORD,&dwValue,sizeof(DWORD));
443			if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
444			dwValue = 1;
445			err = RegSetKeyValue( HKEY_LOCAL_MACHINE,
446			TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv"),
447			TEXT("ClockType"), REG_DWORD,&dwValue,sizeof(DWORD));
448			if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
449			dwValue = 64;
450			err = RegSetKeyValue( HKEY_LOCAL_MACHINE,
451			TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv"),
452			TEXT("MaxFileSize"), REG_DWORD,&dwValue,sizeof(DWORD));
453			if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
454			dwValue = 4864;
455			err = RegSetKeyValue( HKEY_LOCAL_MACHINE,
456			TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv"),
457			TEXT("LogFileMode"), REG_DWORD,&dwValue,sizeof(DWORD));
458			if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
459			dwValue = 5;
460			err = RegSetKeyValue( HKEY_LOCAL_MACHINE,
461			TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv"),
462			TEXT("FileCounter"), REG_DWORD,&dwValue,sizeof(DWORD));
463			if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
464			dwValue = 0;
465			err = RegSetKeyValue( HKEY_LOCAL_MACHINE,
466			TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv"),
467			TEXT("Status"), REG_DWORD,&dwValue,sizeof(DWORD));
468			if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
469
470			dwValue = 1;
471			err = RegSetKeyValue( HKEY_LOCAL_MACHINE,
472			TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv\\{081CCE5F-5F9C-4b43-9A15-1DCF5D2D45F5}"),
473			TEXT("Enabled"), REG_DWORD,&dwValue,sizeof(DWORD));
474			if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
475			dwValue = 5;
476			err = RegSetKeyValue( HKEY_LOCAL_MACHINE,
477			TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv\\{081CCE5F-5F9C-4b43-9A15-1DCF5D2D45F5}"),
478			TEXT("EnableLevel"), REG_DWORD,&dwValue,sizeof(DWORD));
479			if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
480			dwValue = 0;
481			err = RegSetKeyValue( HKEY_LOCAL_MACHINE,
482			TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv\\{081CCE5F-5F9C-4b43-9A15-1DCF5D2D45F5}"),
483			TEXT("EnableProperty"), REG_DWORD,&dwValue,sizeof(DWORD));
484			if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
485			dwValue = 0;
486			err = RegSetKeyValue( HKEY_LOCAL_MACHINE,
487			TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv\\{081CCE5F-5F9C-4b43-9A15-1DCF5D2D45F5}"),
488			TEXT("Status"), REG_DWORD,&dwValue,sizeof(DWORD));
489			if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
490			qdwValue = 0;
491			err = RegSetKeyValue( HKEY_LOCAL_MACHINE,
492			TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv\\{081CCE5F-5F9C-4b43-9A15-1DCF5D2D45F5}"),
493			TEXT("MatchAllKeyword"), REG_QWORD,&qdwValue,sizeof(DWORD64));
494			if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
495			qdwValue = 0;
496			err = RegSetKeyValue( HKEY_LOCAL_MACHINE,
497			TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv\\{081CCE5F-5F9C-4b43-9A15-1DCF5D2D45F5}"),
498			TEXT("MatchAnyKeyword"), REG_QWORD,&qdwValue,sizeof(DWORD64));
499			if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
500			StartLogging();
501			}
502
503			void DisableLogging()
504			{
505
506			LONG err = RegDeleteTree(HKEY_LOCAL_MACHINE, TEXT("SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\OpenPGPmdrv"));
507			if (err != ERROR_SUCCESS) {MessageBoxWin32(err); return;}
508			StopLogging();
509			}