Something went wrong. Try again.
Reactos
Something went wrong. Try again.
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302/* * PROJECT: ReactOS EventLog File Library * LICENSE: GPL - See COPYING in the top level directory * FILE: sdk/lib/evtlib/evtlib.h * PURPOSE: Provides functionality for reading and writing * EventLog files in the NT <= 5.2 (.evt) format. * PROGRAMMERS: Copyright 2005 Saveliy Tretiakov * Michael Martin * Hermes Belusca-Maito */
#ifndef __EVTLIB_H__#define __EVTLIB_H__
#pragma once
#ifdef __cplusplusextern "C" {#endif
/* PSDK/NDK Headers */// #define WIN32_NO_STATUS// #include <windef.h>// #include <winbase.h>// #include <winnt.h>
#define NTOS_MODE_USER#include <ndk/rtlfuncs.h>
#ifndef ROUND_DOWN#define ROUND_DOWN(n, align) (((ULONG)n) & ~((align) - 1l))#endif
#ifndef ROUND_UP#define ROUND_UP(n, align) ROUND_DOWN(((ULONG)n) + (align) - 1, (align))#endif
/* * Our file format will be compatible with NT's */#define MAJORVER 1#define MINORVER 1#define LOGFILE_SIGNATURE 0x654c664c // "LfLe"
/* * Flags used in the logfile header */#define ELF_LOGFILE_HEADER_DIRTY 1#define ELF_LOGFILE_HEADER_WRAP 2#define ELF_LOGFILE_LOGFULL_WRITTEN 4#define ELF_LOGFILE_ARCHIVE_SET 8
/* * On-disk event log structures (log file header, event record and EOF record). * NOTE: Contrary to what MSDN claims, both the EVENTLOGHEADER and EVENTLOGEOF * structures are absent from winnt.h . */
#include <pshpack4.h> // pshpack1
// ELF_LOGFILE_HEADERtypedef struct _EVENTLOGHEADER{ ULONG HeaderSize; ULONG Signature; ULONG MajorVersion; ULONG MinorVersion; ULONG StartOffset; ULONG EndOffset; ULONG CurrentRecordNumber; ULONG OldestRecordNumber; ULONG MaxSize; ULONG Flags; ULONG Retention; ULONG EndHeaderSize;} EVENTLOGHEADER, *PEVENTLOGHEADER;
/* Those flags and structure are defined in winnt.h */#ifndef _WINNT_
/* EventType flags */#define EVENTLOG_SUCCESS 0#define EVENTLOG_ERROR_TYPE 1#define EVENTLOG_WARNING_TYPE 2#define EVENTLOG_INFORMATION_TYPE 4#define EVENTLOG_AUDIT_SUCCESS 8#define EVENTLOG_AUDIT_FAILURE 16
typedef struct _EVENTLOGRECORD{ ULONG Length; /* Length of full record, including the data portion */ ULONG Reserved; ULONG RecordNumber; ULONG TimeGenerated; ULONG TimeWritten; ULONG EventID; USHORT EventType; USHORT NumStrings; /* Number of strings in the 'Strings' array */ USHORT EventCategory; USHORT ReservedFlags; ULONG ClosingRecordNumber; ULONG StringOffset; ULONG UserSidLength; ULONG UserSidOffset; ULONG DataLength; /* Length of the data portion */ ULONG DataOffset; /* Offset from beginning of record *//* * Length-varying data: * * WCHAR SourceName[]; * WCHAR ComputerName[]; * SID UserSid; // Must be aligned on a DWORD boundary * WCHAR Strings[]; * BYTE Data[]; * CHAR Pad[]; // Padding for DWORD boundary * ULONG Length; // Same as the first 'Length' member at the beginning */} EVENTLOGRECORD, *PEVENTLOGRECORD;
#endif // _WINNT_
// ELF_EOF_RECORDtypedef struct _EVENTLOGEOF{ ULONG RecordSizeBeginning; ULONG Ones; ULONG Twos; ULONG Threes; ULONG Fours; ULONG BeginRecord; ULONG EndRecord; ULONG CurrentRecordNumber; ULONG OldestRecordNumber; ULONG RecordSizeEnd;} EVENTLOGEOF, *PEVENTLOGEOF;
#define EVENTLOGEOF_SIZE_FIXED (5 * sizeof(ULONG))C_ASSERT(EVENTLOGEOF_SIZE_FIXED == FIELD_OFFSET(EVENTLOGEOF, BeginRecord));
#include <poppack.h>
typedef struct _EVENT_OFFSET_INFO{ ULONG EventNumber; ULONG EventOffset;} EVENT_OFFSET_INFO, *PEVENT_OFFSET_INFO;
#define TAG_ELF ' flE'#define TAG_ELF_BUF 'BflE'
struct _EVTLOGFILE;
typedef PVOID(NTAPI *PELF_ALLOCATE_ROUTINE)( IN SIZE_T Size, IN ULONG Flags, IN ULONG Tag);
typedef VOID(NTAPI *PELF_FREE_ROUTINE)( IN PVOID Ptr, IN ULONG Flags, IN ULONG Tag);
typedef NTSTATUS(NTAPI *PELF_FILE_READ_ROUTINE)( IN struct _EVTLOGFILE* LogFile, IN PLARGE_INTEGER FileOffset, OUT PVOID Buffer, IN SIZE_T Length, OUT PSIZE_T ReadLength OPTIONAL);
typedef NTSTATUS(NTAPI *PELF_FILE_WRITE_ROUTINE)( IN struct _EVTLOGFILE* LogFile, IN PLARGE_INTEGER FileOffset, IN PVOID Buffer, IN SIZE_T Length, OUT PSIZE_T WrittenLength OPTIONAL);
typedef NTSTATUS(NTAPI *PELF_FILE_SET_SIZE_ROUTINE)( IN struct _EVTLOGFILE* LogFile, IN ULONG FileSize, IN ULONG OldFileSize);
typedef NTSTATUS(NTAPI *PELF_FILE_FLUSH_ROUTINE)( IN struct _EVTLOGFILE* LogFile, IN PLARGE_INTEGER FileOffset, IN ULONG Length);
typedef struct _EVTLOGFILE{ PELF_ALLOCATE_ROUTINE Allocate; PELF_FREE_ROUTINE Free; PELF_FILE_SET_SIZE_ROUTINE FileSetSize; PELF_FILE_WRITE_ROUTINE FileWrite; PELF_FILE_READ_ROUTINE FileRead; PELF_FILE_FLUSH_ROUTINE FileFlush;
EVENTLOGHEADER Header; ULONG CurrentSize; /* Equivalent to the file size, is <= MaxSize and can be extended to MaxSize if needed */ UNICODE_STRING FileName; PEVENT_OFFSET_INFO OffsetInfo; ULONG OffsetInfoSize; ULONG OffsetInfoNext; BOOLEAN ReadOnly;} EVTLOGFILE, *PEVTLOGFILE;
NTSTATUSNTAPIElfCreateFile( IN OUT PEVTLOGFILE LogFile, IN PUNICODE_STRING FileName OPTIONAL, IN ULONG FileSize, IN ULONG MaxSize, IN ULONG Retention, IN BOOLEAN CreateNew, IN BOOLEAN ReadOnly, IN PELF_ALLOCATE_ROUTINE Allocate, IN PELF_FREE_ROUTINE Free, IN PELF_FILE_SET_SIZE_ROUTINE FileSetSize, IN PELF_FILE_WRITE_ROUTINE FileWrite, IN PELF_FILE_READ_ROUTINE FileRead, IN PELF_FILE_FLUSH_ROUTINE FileFlush); // What about Seek ??
NTSTATUSNTAPIElfReCreateFile( IN PEVTLOGFILE LogFile);
// NTSTATUS// ElfClearFile(PEVTLOGFILE LogFile);
NTSTATUSNTAPIElfBackupFile( IN PEVTLOGFILE LogFile, IN PEVTLOGFILE BackupLogFile);
NTSTATUSNTAPIElfFlushFile( IN PEVTLOGFILE LogFile);
VOIDNTAPIElfCloseFile( // ElfFree IN PEVTLOGFILE LogFile);
NTSTATUSNTAPIElfReadRecord( IN PEVTLOGFILE LogFile, IN ULONG RecordNumber, OUT PEVENTLOGRECORD Record, IN SIZE_T BufSize, // Length OUT PSIZE_T BytesRead OPTIONAL, OUT PSIZE_T BytesNeeded OPTIONAL);
NTSTATUSNTAPIElfWriteRecord( IN PEVTLOGFILE LogFile, IN PEVENTLOGRECORD Record, IN SIZE_T BufSize);
ULONGNTAPIElfGetOldestRecord( IN PEVTLOGFILE LogFile);
ULONGNTAPIElfGetCurrentRecord( IN PEVTLOGFILE LogFile);
ULONGNTAPIElfGetFlags( IN PEVTLOGFILE LogFile);
#if DBGVOID PRINT_HEADER(PEVENTLOGHEADER Header);#endif
#ifdef __cplusplus}#endif#endif /* __EVTLIB_H__ */