- Update structs and flags to correct names based on documentation.

svn path=/trunk/; revision=38327
This commit is contained in:
Michael Martin 2008-12-24 12:14:30 +00:00
parent 5759ff871c
commit 21c30014ed
4 changed files with 89 additions and 91 deletions

View file

@ -271,24 +271,24 @@ VOID SystemTimeToEventTime(SYSTEMTIME * pSystemTime, DWORD * pEventTime)
*pEventTime = (Time.ll - u1970.ll) / 10000000; *pEventTime = (Time.ll - u1970.ll) / 10000000;
} }
VOID PRINT_HEADER(PFILE_HEADER header) VOID PRINT_HEADER(PEVENTLOGHEADER header)
{ {
DPRINT("SizeOfHeader = %d\n", header->SizeOfHeader); DPRINT("HeaderSize = %d\n", header->HeaderSize);
DPRINT("Signature = 0x%x\n", header->Signature); DPRINT("Signature = 0x%x\n", header->Signature);
DPRINT("MajorVersion = %d\n", header->MajorVersion); DPRINT("MajorVersion = %d\n", header->MajorVersion);
DPRINT("MinorVersion = %d\n", header->MinorVersion); DPRINT("MinorVersion = %d\n", header->MinorVersion);
DPRINT("FirstRecordOffset = %d\n", header->FirstRecordOffset); DPRINT("StartOffset = %d\n", header->StartOffset);
DPRINT("EofOffset = 0x%x\n", header->EofOffset); DPRINT("EndOffset = 0x%x\n", header->EndOffset);
DPRINT("NextRecord = %d\n", header->NextRecord); DPRINT("CurrentRecordNumber = %d\n", header->CurrentRecordNumber);
DPRINT("OldestRecord = %d\n", header->OldestRecord); DPRINT("OldestRecordNumber = %d\n", header->OldestRecordNumber);
DPRINT("unknown1 = 0x%x\n", header->unknown1); DPRINT("MaxSize = 0x%x\n", header->MaxSize);
DPRINT("unknown2 = 0x%x\n", header->unknown2); DPRINT("Retention = 0x%x\n", header->Retention);
DPRINT("SizeOfHeader2 = %d\n", header->SizeOfHeader2); DPRINT("EndHeaderSize = %d\n", header->EndHeaderSize);
DPRINT("Flags: "); DPRINT("Flags: ");
if (header->Flags & LOGFILE_FLAG1) DPRINT("LOGFILE_FLAG1 "); if (header->Flags & ELF_LOGFILE_HEADER_DIRTY) DPRINT("ELF_LOGFILE_HEADER_DIRTY");
if (header->Flags & LOGFILE_FLAG2) DPRINT("| LOGFILE_FLAG2 "); if (header->Flags & ELF_LOGFILE_HEADER_WRAP) DPRINT("| ELF_LOGFILE_HEADER_WRAP ");
if (header->Flags & LOGFILE_FLAG3) DPRINT("| LOGFILE_FLAG3 "); if (header->Flags & ELF_LOGGFILE_LOGFULL_WRITTEN) DPRINT("| ELF_LOGGFILE_LOGFULL_WRITTEN ");
if (header->Flags & LOGFILE_FLAG4) DPRINT("| LOGFILE_FLAG4"); if (header->Flags & ELF_LOGFILE_ARCHIVE_SET) DPRINT("| ELF_LOGFILE_ARCHIVE_SET ");
DPRINT("\n"); DPRINT("\n");
} }

View file

@ -36,43 +36,41 @@ typedef struct _IO_ERROR_LPC
#define LOGFILE_SIGNATURE 0x654c664c #define LOGFILE_SIGNATURE 0x654c664c
/* /*
* FIXME
* Flags used in logfile header * Flags used in logfile header
*/ */
#define LOGFILE_FLAG1 1 #define ELF_LOGFILE_HEADER_DIRTY 1
#define LOGFILE_FLAG2 2 #define ELF_LOGFILE_HEADER_WRAP 2
#define LOGFILE_FLAG3 4 #define ELF_LOGGFILE_LOGFULL_WRITTEN 4
#define LOGFILE_FLAG4 8 #define ELF_LOGFILE_ARCHIVE_SET 8
typedef struct /* FIXME: MSDN reads that the following two structs are in winnt.h. Are they? */
{ typedef struct _EVENTLOGHEADER {
DWORD SizeOfHeader; ULONG HeaderSize;
DWORD Signature; ULONG Signature;
DWORD MajorVersion; ULONG MajorVersion;
DWORD MinorVersion; ULONG MinorVersion;
DWORD FirstRecordOffset; ULONG StartOffset;
DWORD EofOffset; ULONG EndOffset;
DWORD NextRecord; ULONG CurrentRecordNumber;
DWORD OldestRecord; ULONG OldestRecordNumber;
DWORD unknown1; ULONG MaxSize;
DWORD Flags; ULONG Flags;
DWORD unknown2; ULONG Retention;
DWORD SizeOfHeader2; ULONG EndHeaderSize;
} FILE_HEADER, *PFILE_HEADER; } EVENTLOGHEADER, *PEVENTLOGHEADER;
typedef struct typedef struct _EVENTLOGEOF {
{ ULONG RecordSizeBeginning;
DWORD Size1; ULONG Ones;
DWORD Ones; // Must be 0x11111111 ULONG Twos;
DWORD Twos; // Must be 0x22222222 ULONG Threes;
DWORD Threes; // Must be 0x33333333 ULONG Fours;
DWORD Fours; // Must be 0x44444444 ULONG BeginRecord;
DWORD StartOffset; ULONG EndRecord;
DWORD EndOffset; ULONG CurrentRecordNumber;
DWORD NextRecordNumber; ULONG OldestRecordNumber;
DWORD OldestRecordNumber; ULONG RecordSizeEnd;
DWORD Size2; } EVENTLOGEOF, *PEVENTLOGEOF;
} EOF_RECORD, *PEOF_RECORD;
typedef struct typedef struct
{ {
@ -83,7 +81,7 @@ typedef struct
typedef struct typedef struct
{ {
HANDLE hFile; HANDLE hFile;
FILE_HEADER Header; EVENTLOGHEADER Header;
WCHAR *LogName; WCHAR *LogName;
WCHAR *FileName; WCHAR *FileName;
CRITICAL_SECTION cs; CRITICAL_SECTION cs;
@ -165,7 +163,7 @@ PBYTE LogfAllocAndBuildNewRecord(LPDWORD lpRecSize,
/* eventlog.c */ /* eventlog.c */
extern HANDLE MyHeap; extern HANDLE MyHeap;
VOID PRINT_HEADER(PFILE_HEADER header); VOID PRINT_HEADER(PEVENTLOGHEADER header);
VOID PRINT_RECORD(PEVENTLOGRECORD pRec); VOID PRINT_RECORD(PEVENTLOGRECORD pRec);

View file

@ -20,24 +20,24 @@ static CRITICAL_SECTION LogFileListCs;
BOOL LogfInitializeNew(PLOGFILE LogFile) BOOL LogfInitializeNew(PLOGFILE LogFile)
{ {
DWORD dwWritten; DWORD dwWritten;
EOF_RECORD EofRec; EVENTLOGEOF EofRec;
ZeroMemory(&LogFile->Header, sizeof(FILE_HEADER)); ZeroMemory(&LogFile->Header, sizeof(EVENTLOGHEADER));
SetFilePointer(LogFile->hFile, 0, NULL, FILE_BEGIN); SetFilePointer(LogFile->hFile, 0, NULL, FILE_BEGIN);
SetEndOfFile(LogFile->hFile); SetEndOfFile(LogFile->hFile);
LogFile->Header.SizeOfHeader = sizeof(FILE_HEADER); LogFile->Header.HeaderSize = sizeof(EVENTLOGHEADER);
LogFile->Header.SizeOfHeader2 = sizeof(FILE_HEADER); LogFile->Header.EndHeaderSize = sizeof(EVENTLOGHEADER);
LogFile->Header.FirstRecordOffset = sizeof(FILE_HEADER); LogFile->Header.StartOffset = sizeof(EVENTLOGHEADER);
LogFile->Header.EofOffset = sizeof(FILE_HEADER); LogFile->Header.EndOffset = sizeof(EVENTLOGHEADER);
LogFile->Header.MajorVersion = MAJORVER; LogFile->Header.MajorVersion = MAJORVER;
LogFile->Header.MinorVersion = MINORVER; LogFile->Header.MinorVersion = MINORVER;
LogFile->Header.NextRecord = 1; LogFile->Header.CurrentRecordNumber = 1;
LogFile->Header.Signature = LOGFILE_SIGNATURE; LogFile->Header.Signature = LOGFILE_SIGNATURE;
if (!WriteFile(LogFile->hFile, if (!WriteFile(LogFile->hFile,
&LogFile->Header, &LogFile->Header,
sizeof(FILE_HEADER), sizeof(EVENTLOGHEADER),
&dwWritten, &dwWritten,
NULL)) NULL))
{ {
@ -49,16 +49,16 @@ BOOL LogfInitializeNew(PLOGFILE LogFile)
EofRec.Twos = 0x22222222; EofRec.Twos = 0x22222222;
EofRec.Threes = 0x33333333; EofRec.Threes = 0x33333333;
EofRec.Fours = 0x44444444; EofRec.Fours = 0x44444444;
EofRec.Size1 = sizeof(EOF_RECORD); EofRec.RecordSizeBeginning = sizeof(EVENTLOGEOF);
EofRec.Size2 = sizeof(EOF_RECORD); EofRec.RecordSizeEnd = sizeof(EVENTLOGEOF);
EofRec.NextRecordNumber = LogFile->Header.NextRecord; EofRec.CurrentRecordNumber = LogFile->Header.CurrentRecordNumber;
EofRec.OldestRecordNumber = LogFile->Header.OldestRecord; EofRec.OldestRecordNumber = LogFile->Header.OldestRecordNumber;
EofRec.StartOffset = LogFile->Header.FirstRecordOffset; EofRec.BeginRecord = LogFile->Header.StartOffset;
EofRec.EndOffset = LogFile->Header.EofOffset; EofRec.EndRecord = LogFile->Header.EndOffset;
if (!WriteFile(LogFile->hFile, if (!WriteFile(LogFile->hFile,
&EofRec, &EofRec,
sizeof(EOF_RECORD), sizeof(EVENTLOGEOF),
&dwWritten, &dwWritten,
NULL)) NULL))
{ {
@ -92,7 +92,7 @@ BOOL LogfInitializeExisting(PLOGFILE LogFile)
if (!ReadFile(LogFile->hFile, if (!ReadFile(LogFile->hFile,
&LogFile->Header, &LogFile->Header,
sizeof(FILE_HEADER), sizeof(EVENTLOGHEADER),
&dwRead, &dwRead,
NULL)) NULL))
{ {
@ -100,14 +100,14 @@ BOOL LogfInitializeExisting(PLOGFILE LogFile)
return FALSE; return FALSE;
} }
if (dwRead != sizeof(FILE_HEADER)) if (dwRead != sizeof(EVENTLOGHEADER))
{ {
DPRINT("EventLog: Invalid file %S.\n", LogFile->FileName); DPRINT("EventLog: Invalid file %S.\n", LogFile->FileName);
return LogfInitializeNew(LogFile); return LogfInitializeNew(LogFile);
} }
if (LogFile->Header.SizeOfHeader != sizeof(FILE_HEADER) || if (LogFile->Header.HeaderSize != sizeof(EVENTLOGHEADER) ||
LogFile->Header.SizeOfHeader2 != sizeof(FILE_HEADER)) LogFile->Header.EndHeaderSize != sizeof(EVENTLOGHEADER))
{ {
DPRINT("EventLog: Invalid header size in %S.\n", LogFile->FileName); DPRINT("EventLog: Invalid header size in %S.\n", LogFile->FileName);
return LogfInitializeNew(LogFile); return LogfInitializeNew(LogFile);
@ -120,10 +120,10 @@ BOOL LogfInitializeExisting(PLOGFILE LogFile)
return LogfInitializeNew(LogFile); return LogfInitializeNew(LogFile);
} }
if (LogFile->Header.EofOffset > GetFileSize(LogFile->hFile, NULL) + 1) if (LogFile->Header.EndOffset > GetFileSize(LogFile->hFile, NULL) + 1)
{ {
DPRINT("EventLog: Invalid eof offset %x in %S.\n", DPRINT("EventLog: Invalid eof offset %x in %S.\n",
LogFile->Header.EofOffset, LogFile->FileName); LogFile->Header.EndOffset, LogFile->FileName);
return LogfInitializeNew(LogFile); return LogfInitializeNew(LogFile);
} }
@ -204,7 +204,7 @@ BOOL LogfInitializeExisting(PLOGFILE LogFile)
if (*pdwRecSize2 != dwRecSize) if (*pdwRecSize2 != dwRecSize)
{ {
DPRINT1("Invalid size2 of record %d (%x) in %S\n", DPRINT1("Invalid RecordSizeEnd of record %d (%x) in %S\n",
dwRecordsNumber, *pdwRecSize2, LogFile->LogName); dwRecordsNumber, *pdwRecSize2, LogFile->LogName);
HeapFree(MyHeap, 0, RecBuf); HeapFree(MyHeap, 0, RecBuf);
break; break;
@ -224,8 +224,8 @@ BOOL LogfInitializeExisting(PLOGFILE LogFile)
HeapFree(MyHeap, 0, RecBuf); HeapFree(MyHeap, 0, RecBuf);
} // for(;;) } // for(;;)
LogFile->Header.NextRecord = dwRecordsNumber + 1; LogFile->Header.CurrentRecordNumber = dwRecordsNumber + 1;
LogFile->Header.OldestRecord = dwRecordsNumber ? 1 : 0; // FIXME LogFile->Header.OldestRecordNumber = dwRecordsNumber ? 1 : 0; // FIXME
if (!SetFilePointer(LogFile->hFile, 0, NULL, FILE_CURRENT) == if (!SetFilePointer(LogFile->hFile, 0, NULL, FILE_CURRENT) ==
INVALID_SET_FILE_POINTER) INVALID_SET_FILE_POINTER)
@ -236,7 +236,7 @@ BOOL LogfInitializeExisting(PLOGFILE LogFile)
if (!WriteFile(LogFile->hFile, if (!WriteFile(LogFile->hFile,
&LogFile->Header, &LogFile->Header,
sizeof(FILE_HEADER), sizeof(EVENTLOGHEADER),
&dwRead, &dwRead,
NULL)) NULL))
{ {
@ -648,7 +648,7 @@ BOOL LogfWriteData(PLOGFILE LogFile, DWORD BufSize, PBYTE Buffer)
{ {
DWORD dwWritten; DWORD dwWritten;
SYSTEMTIME st; SYSTEMTIME st;
EOF_RECORD EofRec; EVENTLOGEOF EofRec;
if (!Buffer) if (!Buffer)
return FALSE; return FALSE;
@ -659,7 +659,7 @@ BOOL LogfWriteData(PLOGFILE LogFile, DWORD BufSize, PBYTE Buffer)
EnterCriticalSection(&LogFile->cs); EnterCriticalSection(&LogFile->cs);
if (SetFilePointer(LogFile->hFile, if (SetFilePointer(LogFile->hFile,
LogFile->Header.EofOffset, LogFile->Header.EndOffset,
NULL, NULL,
FILE_BEGIN) == INVALID_SET_FILE_POINTER) FILE_BEGIN) == INVALID_SET_FILE_POINTER)
{ {
@ -676,33 +676,33 @@ BOOL LogfWriteData(PLOGFILE LogFile, DWORD BufSize, PBYTE Buffer)
} }
if (!LogfAddOffsetInformation(LogFile, if (!LogfAddOffsetInformation(LogFile,
LogFile->Header.NextRecord, LogFile->Header.CurrentRecordNumber,
LogFile->Header.EofOffset)) LogFile->Header.EndOffset))
{ {
LeaveCriticalSection(&LogFile->cs); LeaveCriticalSection(&LogFile->cs);
return FALSE; return FALSE;
} }
LogFile->Header.NextRecord++; LogFile->Header.CurrentRecordNumber++;
LogFile->Header.EofOffset += dwWritten; LogFile->Header.EndOffset += dwWritten;
if (LogFile->Header.OldestRecord == 0) if (LogFile->Header.OldestRecordNumber == 0)
LogFile->Header.OldestRecord = 1; LogFile->Header.OldestRecordNumber = 1;
EofRec.Ones = 0x11111111; EofRec.Ones = 0x11111111;
EofRec.Twos = 0x22222222; EofRec.Twos = 0x22222222;
EofRec.Threes = 0x33333333; EofRec.Threes = 0x33333333;
EofRec.Fours = 0x44444444; EofRec.Fours = 0x44444444;
EofRec.Size1 = sizeof(EOF_RECORD); EofRec.RecordSizeBeginning = sizeof(EVENTLOGEOF);
EofRec.Size2 = sizeof(EOF_RECORD); EofRec.RecordSizeEnd = sizeof(EVENTLOGEOF);
EofRec.NextRecordNumber = LogFile->Header.NextRecord; EofRec.CurrentRecordNumber = LogFile->Header.CurrentRecordNumber;
EofRec.OldestRecordNumber = LogFile->Header.OldestRecord; EofRec.OldestRecordNumber = LogFile->Header.OldestRecordNumber;
EofRec.StartOffset = LogFile->Header.FirstRecordOffset; EofRec.BeginRecord = LogFile->Header.StartOffset;
EofRec.EndOffset = LogFile->Header.EofOffset; EofRec.EndRecord = LogFile->Header.EndOffset;
if (!WriteFile(LogFile->hFile, if (!WriteFile(LogFile->hFile,
&EofRec, &EofRec,
sizeof(EOF_RECORD), sizeof(EVENTLOGEOF),
&dwWritten, &dwWritten,
NULL)) NULL))
{ {
@ -721,7 +721,7 @@ BOOL LogfWriteData(PLOGFILE LogFile, DWORD BufSize, PBYTE Buffer)
if (!WriteFile(LogFile->hFile, if (!WriteFile(LogFile->hFile,
&LogFile->Header, &LogFile->Header,
sizeof(FILE_HEADER), sizeof(EVENTLOGHEADER),
&dwWritten, &dwWritten,
NULL)) NULL))
{ {
@ -757,7 +757,7 @@ ULONG LogfOffsetByNumber(PLOGFILE LogFile, DWORD RecordNumber)
DWORD LogfGetOldestRecord(PLOGFILE LogFile) DWORD LogfGetOldestRecord(PLOGFILE LogFile)
{ {
return LogFile->Header.OldestRecord; return LogFile->Header.OldestRecordNumber;
} }
BOOL LogfAddOffsetInformation(PLOGFILE LogFile, ULONG ulNumber, ULONG ulOffset) BOOL LogfAddOffsetInformation(PLOGFILE LogFile, ULONG ulNumber, ULONG ulOffset)

View file

@ -143,7 +143,7 @@ NTSTATUS ProcessPortMessage(VOID)
{ {
DPRINT("Received datagram\n"); DPRINT("Received datagram\n");
Message = (PIO_ERROR_LOG_MESSAGE) & Request.Message; Message = (PIO_ERROR_LOG_MESSAGE) & Request.Message;
ulRecNum = SystemLog ? SystemLog->Header.NextRecord : 0; ulRecNum = SystemLog ? SystemLog->Header.CurrentRecordNumber : 0;
pRec = (PEVENTLOGRECORD) LogfAllocAndBuildNewRecord(&dwRecSize, pRec = (PEVENTLOGRECORD) LogfAllocAndBuildNewRecord(&dwRecSize,
ulRecNum, Message->Type, Message->EntryData.EventCategory, ulRecNum, Message->Type, Message->EntryData.EventCategory,