archive
/
windows-xp
mirror of https://github.com/tongzx/nt5src
2
0
Fork 0
Code Issues Projects Releases Wiki Activity
Source code of Windows XP (NT5)
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
6 Commits
1 Branch
0 Tags
2.0 GiB
 
 
 
 
 
 
Tree: daad8a087a
Branches Tags
${ item.name }
Create tag ${ searchTerm }
Create branch ${ searchTerm }
from 'daad8a087a'
${ noResults }
windows-xp/Source/XPSP1/NT/sdktools/trace/traceprt/traceprt.c

2860 lines
84 KiB
Raw Blame History

/*++
Copyright (c) 1997-2000 Microsoft Corporation
Module Name:
traceprt.c
Abstract:
Trace formatting library. Converts binary trace file to CSV format,
and other formattted string formats.
Author:
Jee Fung Pang (jeepang) 03-Dec-1997
Revision History:
GorN: 10/09/2000: ItemHRESULT added
--*/
#ifdef __cplusplus
extern "C"{
#endif
#define UNICODE
#define _UNICODE
#include <stdio.h>
#include <stdlib.h>
#include <nt.h>
#include <ntrtl.h>
#include <nturtl.h>
#include <windows.h>
#include <shellapi.h>
#include <tchar.h>
#include <wmistr.h>
#include <initguid.h>
#include <evntrace.h>
#include <ntwmi.h>
#include <netevent.h>
#include <netevent.dbg>
#include <winerror.dbg>
#pragma warning( disable : 4005) // Disable warning message 4005
#include <ntstatus.h>
#include <ntstatus.dbg>
#pragma warning( default : 4005) // Enable warning message 4005
#define TRACE_EXPORTS 1
#include "traceint.h"
#undef TRACE_API
#define TRACE_API
#include "traceprt.h"
#include <sddl.h> // for ConvertStringSidToSid //
// %1 GUID Friendly Name string
// %2 GUID SubType Name string
// %3 Thread ID ULONG_PTR
// %4 System Time String
// %5 Kernel Time or User Time String
// %6 User Time or NULL String
// %7 Sequence Number LONG
// %8 Unused String
// %9 CPU Number LONG
// %128 Indent String
ULONG TimerResolution = 10;
__int64 ElapseTime;
ULONG UserMode = FALSE ; // TODO: Pick this up from the stream itself.
#define MAXBUFS 4096
#define MAXCHARS MAXBUFS/sizeof(TCHAR)
#define MAXBUFS2 2 * MAXBUFS
#define MAXCHARS2 MAXBUFS2/sizeof(TCHAR)
#define MAXITEMS 256
#define MAXINDENT 256
#define MAXNAMEARG 256
TCHAR ItemBuf[MAXBUFS]; // Temporary String Item buffer
TCHAR ItemBBuf[MAXBUFS2]; // Item String Buffer
TCHAR * pItemBuf[MAXITEMS]; // Pointer to items in the String Item Buffer.
BYTE ItemRBuf[MAXBUFS]; // Item Raw Byte Buffer
ULONG_PTR * pItemRBuf[MAXITEMS]; // Pointer to Raw Byte Items
SIZE_T ItemRSize; // Size of Item in Raw Buffer.
BOOL bItemIsString = FALSE ; // And type of item
int iItemCount, i;
LONG ItemsInBuf = 0;
LONG ItemsInRBuf = 0;
ULONG PointerSize = sizeof(PVOID) ;
BYTE Event[4096];
HANDLE hLibrary ;
TCHAR StdPrefix[MAXSTR];
TCHAR IndentBuf[MAXINDENT + 1];
INT Indent;
#define TRACE_FORMAT_SEARCH_PATH L"TRACE_FORMAT_SEARCH_PATH"
#define TRACE_FORMAT_PREFIX L"TRACE_FORMAT_PREFIX"
//#define STD_PREFIX L"[%!CPU!]%!PID!.%!TID!::%!NOW! [%!FILE!] "
#define STD_PREFIX_NOSEQ L"[%9!d!]%8!04X!.%3!04X!::%4!s! [%1!s!]"
#define STD_PREFIX_SEQ L"[%9!d!]%8!04X!.%3!04X!::%4!s! %7!08x! [%1!s!]"
TCHAR *STD_PREFIX = STD_PREFIX_NOSEQ;
BOOL bSequence = FALSE;
BOOL bGmt = FALSE;
BOOL bIndent = FALSE;
TCHAR *pNoValueString = _T("<NoValue>");
void ReplaceStringUnsafe(TCHAR* buf, TCHAR* find, TCHAR* replace)
{
TCHAR source[MAXCHARS], *src, *dst;
int nf = _tcslen(find);
int nr = _tcslen(replace);
src = source;
dst = buf;
_tcsncpy(source, buf, MAXCHARS );
for(;;) {
TCHAR* p = src;
for(;;) {
p = _tcsstr(p, find);
if (!p) goto exit_outer_loop;
// special kludge not to replace
// %!Someting! when it is actually %%!Something!
if (p == source || p[0] != '%' || p[-1] != '%') {
break;
}
p += nf;
}
memcpy(dst, src, (p-src) * sizeof(TCHAR) );
dst += p-src;
src = p + nf;
_tcsncpy(dst, replace,(MAXCHARS - (p-source)));
dst += nr;
}
exit_outer_loop:
_tcscpy(dst, src);
}
TCHAR* FindValue(TCHAR* buf, TCHAR* ValueName)
{
static TCHAR valueBuf[256]; // largest identifier in PDB
TCHAR *p = _tcsstr(buf, ValueName);
TCHAR *q = p;
if (p) {
p += _tcslen(ValueName);
q = p;
while ( *p && !isspace(*p) ) ++p;
memcpy(valueBuf, q, (p-q) * sizeof(TCHAR) );
}
valueBuf[p-q] = 0;
return valueBuf;
}
int FindIntValue(TCHAR* buf, TCHAR* ValueName)
{
TCHAR* v = FindValue(buf, ValueName), *end;
int sgn = 1;
if (v[0] == '+') {
++v;
} else if (v[0] == '-') {
sgn = -1;
++v;
}
return sgn * _tcstol(v, &end, 10);
}
PMOF_INFO
GetMofInfoHead(
OUT PLIST_ENTRY * EventListhead,
IN LPGUID pGuid,
IN LPTSTR strType,
IN LONG TypeIndex,
IN ULONG TypeOfType,
IN LPTSTR TypeFormat,
IN BOOL bBestMatch
);
void RemoveMofInfo(PLIST_ENTRY pMofInfo);
ULONG ahextoi(TCHAR *s);
PTCHAR GuidToString(PTCHAR s, LPGUID piid);
ULONG
WINAPI
GetTraceGuidsW(
TCHAR * GuidFile,
PLIST_ENTRY * HeadEventList
);
static
void
reduce(
PCHAR Src
)
{
char *Start = Src;
if (!Src)
return;
while (*Src)
{
if ('\t' == *Src)
*Src = ' ';
else if (',' == *Src)
*Src = ' ';
else if ('\n' == *Src)
*Src = ',';
else if ('\r' == *Src)
*Src = ' ';
++Src;
}
--Src;
while ((Start < Src) && ((' ' == *Src) || (',' == *Src)))
{
*Src = 0x00;
--Src;
}
}
static void reduceW(WCHAR *Src)
{
WCHAR *Start = Src;
if (!Src)
return;
while (*Src)
{
if (L'\t' == *Src)
*Src = L' ';
else if (L',' == *Src)
*Src = L' ';
else if (L'\n' == *Src)
*Src = L',';
else if (L'\r' == *Src)
*Src = L' ';
++Src;
}
--Src;
while ((Start < Src) && ((L' ' == *Src) || (L',' == *Src)))
{
*Src = 0x00;
--Src;
}
}
#ifdef UNICODE
# define _stnprintf _snwprintf
#else
# define _stnprintf _snprintf
#endif
int FormatTimeDelta(TCHAR *buffer, size_t count, LONGLONG time)
{
SYSTEMTIME st;
int s = 0, result;
ZeroMemory(&st, sizeof(st) );
if (count == 0)
return -1;
if (time < 0) {
*buffer++ = '-';
--count;
time = -time;
s = 1;
}
// Get rid of the nano and micro seconds
time /= 10000;
st.wMilliseconds = (USHORT)(time % 1000);
time /= 1000;
if (time == 0) {
result = _stnprintf(buffer,count,L"%dms",st.wMilliseconds);
goto end;
}
st.wSecond = (USHORT)(time % 60);
time /= 60;
st.wMinute = (USHORT)(time % 60);
time /= 60;
if (time == 0) {
if (st.wMinute <= 10) {
result = _stnprintf(buffer,count,L"%d.%03ds",st.wMinute * 60 + st.wSecond, st.wMilliseconds);
} else {
result = _stnprintf(buffer,count,L"%d:%d.%03ds",st.wMinute, st.wSecond, st.wMilliseconds);
}
goto end;
}
st.wHour = (USHORT)(time % 24);
time /= 24;
if (time == 0) {
result = _stnprintf(buffer,count,L"%d:%d:%d.%03ds",st.wHour, st.wMinute, st.wSecond, st.wMilliseconds);
goto end;
}
st.wDay = (USHORT)time;
result = _stnprintf(buffer,count,L"%d~%d:%d:%d.%03ds",st.wDay,st.wHour, st.wMinute, st.wSecond, st.wMilliseconds);
end:
if (result >= 0)
result += s;
return result;
}
typedef struct _ERROR_MAP{
NTSTATUS MessageId;
char *SymbolicName;
} ERROR_MAP;
SIZE_T
WINAPI
FormatTraceEventW(
PLIST_ENTRY HeadEventList,
PEVENT_TRACE pInEvent,
TCHAR *EventBuf,
ULONG SizeEventBuf,
TCHAR * pszMask
)
{
PEVENT_TRACE_HEADER pHeader;
PEVENT_TRACE pEvent = NULL;
ULONG TraceMarker, TraceType;
TCHAR tstrName[MAXSTR];
TCHAR tstrType[MAXSTR];
ULONG tstrTypeOfType = 0;
TCHAR * tstrFormat;
int iItemCount, i;
SIZE_T ItemsInBuf = 0;
ULONG_PTR MessageSequence = -1 ;
USHORT MessageNumber = 0 ;
USHORT MessageFlags = 0 ;
char * pMessageData ;
ULONG MessageLength ;
if (pInEvent == NULL)
{
return (0);
}
pEvent = pInEvent ;
// Make a copy of the PTR and length as we may adjust these depending
// on the header
pMessageData = pEvent->MofData ;
MessageLength = pEvent->MofLength ;
TraceMarker = ((PSYSTEM_TRACE_HEADER)pInEvent)->Marker;
if ((TraceMarker & TRACE_MESSAGE)== TRACE_MESSAGE ) {
// This handles the TRACE_MESSAGE type.
TraceType = TRACE_HEADER_TYPE_MESSAGE ; // This one has special processing
//
// Now Process the header options
//
MessageNumber = ((PMESSAGE_TRACE_HEADER)pEvent)->Packet.MessageNumber ; // Message Number
MessageFlags = ((PMESSAGE_TRACE_HEADER)pEvent)->Packet.OptionFlags ;
// Note that the order in which these are added is critical New entries must
// be added at the end!
//
// [First Entry] Sequence Number
if (MessageFlags&TRACE_MESSAGE_SEQUENCE) {
RtlCopyMemory(&MessageSequence, pMessageData, sizeof(ULONG)) ;
pMessageData += sizeof(ULONG) ;
MessageLength -= sizeof(ULONG);
}
// [Second Entry] GUID ? or CompnentID ?
if (MessageFlags&TRACE_MESSAGE_COMPONENTID) {
RtlCopyMemory(&pEvent->Header.Guid,pMessageData,sizeof(ULONG)) ;
pMessageData += sizeof(ULONG) ;
MessageLength -= sizeof(ULONG) ;
} else if (MessageFlags&TRACE_MESSAGE_GUID) { // Can't have both
RtlCopyMemory(&pEvent->Header.Guid,pMessageData, sizeof(GUID));
pMessageData += sizeof(GUID) ;
MessageLength -= sizeof(GUID);
}
// [Third Entry] Timestamp?
if (MessageFlags&TRACE_MESSAGE_TIMESTAMP) {
RtlCopyMemory(&pEvent->Header.TimeStamp,pMessageData,sizeof(LARGE_INTEGER));
pMessageData += sizeof(LARGE_INTEGER);
MessageLength -= sizeof(LARGE_INTEGER);
}
// [Fourth Entry] System Information?
if (MessageFlags&TRACE_MESSAGE_SYSTEMINFO) {
pHeader = (PEVENT_TRACE_HEADER) &pEvent->Header;
RtlCopyMemory(&pHeader->ThreadId, pMessageData, sizeof(ULONG)) ;
pMessageData += sizeof(ULONG);
MessageLength -=sizeof(ULONG);
RtlCopyMemory(&pHeader->ProcessId,pMessageData, sizeof(ULONG)) ;
pMessageData += sizeof(ULONG);
MessageLength -=sizeof(ULONG);
}
//
// Add New Header Entries immediately before this comment!
//
}
else
{
// Must be WNODE_HEADER
//
TraceType = 0;
pEvent = pInEvent ;
MessageNumber = pEvent->Header.Class.Type ;
if (MessageNumber == 0xFF) { // W2K Compatability escape code
if (pEvent->MofLength >= sizeof(USHORT)) {
// The real Message Number is in the first USHORT
memcpy(&MessageNumber,pEvent->MofData,sizeof(USHORT)) ;
pMessageData += sizeof(USHORT);
MessageLength -= sizeof(USHORT);
}
}
}
// Reset the Pointer and length if they have been adjusted
pEvent->MofData = pMessageData ;
pEvent->MofLength = MessageLength ;
pHeader = (PEVENT_TRACE_HEADER) &pEvent->Header;
MapGuidToName(
&HeadEventList,
& pEvent->Header.Guid,
MessageNumber,
tstrName);
if ( IsEqualGUID(&pEvent->Header.Guid, &EventTraceGuid)
&& pEvent->Header.Class.Type == EVENT_TRACE_TYPE_INFO)
{
PTRACE_LOGFILE_HEADER head = (PTRACE_LOGFILE_HEADER)pEvent->MofData;
if (head->TimerResolution > 0)
{
TimerResolution = head->TimerResolution / 10000;
}
ElapseTime = head->EndTime.QuadPart -
pEvent->Header.TimeStamp.QuadPart;
PointerSize = head->PointerSize;
if (PointerSize < 2 ) // minimum is 16 bits
PointerSize = 4 ; // defaults = 32 bits
}
if (pEvent != NULL)
{
PITEM_DESC pItem;
char str[MAXSTR];
#ifdef UNICODE
TCHAR wstr[MAXSTR];
#endif /* #ifdef UNICODE */
PCHAR ptr = NULL;
PCHAR iMofPtr = NULL;
ULONG ulongword;
PMOF_INFO pMofInfo = NULL;
PLIST_ENTRY Head, Next;
int i;
pMofInfo = GetMofInfoHead(
(PLIST_ENTRY *) HeadEventList,
&pEvent->Header.Guid,
NULL,
MessageNumber,
0,
NULL,
TRUE);
if((pMofInfo != NULL) && (pMofInfo->strType != NULL))
{
TCHAR* p ;
_sntprintf(tstrType,MAXSTR,_T("%s"),pMofInfo->strType);
tstrFormat = pMofInfo->TypeFormat; // Pointer to the format string
tstrTypeOfType = pMofInfo->TypeOfType; // And the type of Format
p = tstrFormat;
if(p) {
while (*p != 0) {
if(*p == 'Z' && p > tstrFormat && p[-1] == '!' && p[1] == '!') {
*p = 's';
}
++p;
}
}
}
else
{
_sntprintf(tstrType,MAXSTR,_T("%3d"),MessageNumber);
tstrFormat = NULL ;
tstrTypeOfType = 0 ;
}
// From here on we start processing the parameters, we actually do
// two versions. One is built for original #type format statements,
// and everything is converted to being an ASCII string.
// The other is built for #type2 format statements and everything is
// converted into a string of raw bytes aliggned on a 64-bit boundary.
iItemCount = 0 ; // How many Items we process
for (i = 0; i < MAXITEMS; i++) // Clean up the pointers
{
pItemBuf[i] = pNoValueString;
pItemRBuf[i] = 0 ;
}
RtlZeroMemory(ItemBuf, MAXBUFS * sizeof(TCHAR));
RtlZeroMemory(ItemBBuf, (2*MAXBUFS) * sizeof(TCHAR));
RtlZeroMemory(ItemRBuf, MAXBUFS * sizeof(BYTE));
RtlZeroMemory(EventBuf, SizeEventBuf * sizeof(TCHAR));
pItemBuf[iItemCount] = ItemBBuf; // Where they go (Strings)
// Make Parameter %1 Type Name
_sntprintf(pItemBuf[iItemCount],
MAXBUFS2-ItemsInBuf,
_T("%s"),
tstrName);
pItemBuf[iItemCount + 1] =
pItemBuf[iItemCount] + _tcslen(tstrName) + 1;
ItemsInBuf = ItemsInBuf + _tcslen(tstrName) + 1;
pItemRBuf[iItemCount] = (ULONG_PTR *) pItemBuf[iItemCount]; // just use the same for Raw bytes
iItemCount ++;
// Make Parameter %2 Type sub Type
_sntprintf(pItemBuf[iItemCount],
MAXBUFS2-ItemsInBuf,
_T("%s"),
tstrType);
pItemBuf[iItemCount + 1] =
pItemBuf[iItemCount] + _tcslen(tstrType) + 1;
ItemsInBuf = ItemsInBuf + _tcslen(tstrType) + 1;
pItemRBuf[iItemCount] = (ULONG_PTR *)pItemBuf[iItemCount]; // just use the same for raw bytes
iItemCount ++;
// Make Parameter %3 ThreadId
RtlCopyMemory(&pItemRBuf[iItemCount] , &pHeader->ThreadId, sizeof(ULONG)) ;
_sntprintf(ItemBuf,
MAXBUFS,
_T("0x%04X"),
pItemRBuf[iItemCount]);
_sntprintf(pItemBuf[iItemCount],
MAXBUFS2-ItemsInBuf,
_T("0x%04X"),
pHeader->ThreadId);
pItemBuf[iItemCount + 1] =
pItemBuf[iItemCount] + _tcslen(ItemBuf) + 1;
ItemsInBuf = ItemsInBuf + _tcslen(ItemBuf) + 1;
iItemCount++;
// Make Parameter %4 System Time
if (tstrFormat != NULL)
{
FILETIME stdTime, localTime;
SYSTEMTIME sysTime;
stdTime.dwHighDateTime = pEvent->Header.TimeStamp.HighPart;
stdTime.dwLowDateTime = pEvent->Header.TimeStamp.LowPart;
if (bGmt) {
FileTimeToSystemTime(&stdTime, &sysTime);
} else {
FileTimeToLocalFileTime(&stdTime, &localTime);
FileTimeToSystemTime(&localTime, &sysTime);
}
_sntprintf(ItemBuf,
MAXBUFS,
_T("%02d/%02d/%04d-%02d:%02d:%02d.%03d"),
sysTime.wMonth,
sysTime.wDay,
sysTime.wYear,
sysTime.wHour,
sysTime.wMinute,
sysTime.wSecond,
sysTime.wMilliseconds);
}
else
{
_sntprintf(ItemBuf, MAXBUFS, _T("%20I64u"), pHeader->TimeStamp.QuadPart);
}
_sntprintf(pItemBuf[iItemCount],
MAXBUFS2-ItemsInBuf,
_T("%s"),
ItemBuf);
pItemBuf[iItemCount + 1] =
pItemBuf[iItemCount] + _tcslen(ItemBuf) + 1;
ItemsInBuf = ItemsInBuf + _tcslen(ItemBuf) + 1;
pItemRBuf[iItemCount] = (ULONG_PTR *)pItemBuf[iItemCount]; // just use the same
iItemCount ++;
if (!UserMode)
{
// Make Parameter %5 Kernel Time
_sntprintf(ItemBuf,
MAXBUFS,
_T("%8lu"),
pHeader->KernelTime * TimerResolution);
_sntprintf(pItemBuf[iItemCount],
MAXBUFS2-ItemsInBuf,
_T("%s"),
ItemBuf);
pItemBuf[iItemCount + 1] =
pItemBuf[iItemCount] + _tcslen(ItemBuf) + 1;
ItemsInBuf = ItemsInBuf + _tcslen(ItemBuf) + 1;
pItemRBuf[iItemCount] = (ULONG_PTR *) pItemBuf[iItemCount]; // just use the same
iItemCount ++;
// Make Parameter %6 User Time
_sntprintf(ItemBuf,
MAXBUFS,
_T("%8lu"),
pHeader->UserTime * TimerResolution);
_sntprintf(pItemBuf[iItemCount],
MAXBUFS2-ItemsInBuf,
_T("%s"),
ItemBuf);
pItemBuf[iItemCount + 1] =
pItemBuf[iItemCount] + _tcslen(ItemBuf) + 1;
ItemsInBuf = ItemsInBuf + _tcslen(ItemBuf) + 1;
pItemRBuf[iItemCount] = (ULONG_PTR *) pItemBuf[iItemCount]; // just use the same
iItemCount ++;
}
else
{
// Make Parameter %5 processor Time
_sntprintf(ItemBuf, MAXBUFS,_T("%I64u"), pHeader->ProcessorTime);
_sntprintf(pItemBuf[iItemCount], MAXBUFS2-ItemsInBuf,_T("%s"), ItemBuf);
pItemBuf[iItemCount + 1] =
pItemBuf[iItemCount] + _tcslen(ItemBuf) + 1;
ItemsInBuf = ItemsInBuf + _tcslen(ItemBuf) + 1;
pItemRBuf[iItemCount] = (ULONG_PTR *) pItemBuf[iItemCount]; // just use the same
iItemCount ++;
// Make Parameter %6 NULL
_sntprintf(ItemBuf, MAXBUFS, _T("%s"), NULL);
_sntprintf(pItemBuf[iItemCount], MAXBUFS2-ItemsInBuf,_T("%s"), ItemBuf);
pItemBuf[iItemCount + 1] =
pItemBuf[iItemCount] + _tcslen(ItemBuf) + 1;
ItemsInBuf = ItemsInBuf + _tcslen(ItemBuf) + 1;
pItemRBuf[iItemCount] = (ULONG_PTR *) pItemBuf[iItemCount]; // just use the same
iItemCount ++;
}
// Make Parameter %7 Sequence Number
_sntprintf(ItemBuf, MAXBUFS, _T("%d"), MessageSequence);
_sntprintf(pItemBuf[iItemCount], MAXBUFS2-ItemsInBuf, _T("%s"), ItemBuf);
pItemBuf[iItemCount + 1] =
pItemBuf[iItemCount] + _tcslen(ItemBuf) + 1;
ItemsInBuf = ItemsInBuf + _tcslen(ItemBuf) + 1;
pItemRBuf[iItemCount] = (ULONG_PTR *) MessageSequence ; // Raw just point at the value
iItemCount ++;
// Make Parameter %8 ProcessId
RtlCopyMemory(&pItemRBuf[iItemCount],&pHeader->ProcessId,sizeof(ULONG));
_sntprintf(ItemBuf,MAXBUFS,_T("0x%04X"),pItemRBuf[iItemCount]);
_sntprintf(pItemBuf[iItemCount], MAXBUFS2-ItemsInBuf, _T("%s"), ItemBuf);
pItemBuf[iItemCount + 1] =
pItemBuf[iItemCount] + _tcslen(ItemBuf) + 1;
ItemsInBuf = ItemsInBuf + _tcslen(ItemBuf) + 1;
iItemCount ++;
// Make Parameter %9 CPU Number
_sntprintf(ItemBuf,
MAXBUFS,
_T("%d"),
((PWMI_CLIENT_CONTEXT)&(pEvent->ClientContext))->ProcessorNumber);
_sntprintf(pItemBuf[iItemCount], MAXBUFS2-ItemsInBuf, _T("%s"), ItemBuf);
pItemBuf[iItemCount + 1] =
pItemBuf[iItemCount] + _tcslen(ItemBuf) + 1;
ItemsInBuf = ItemsInBuf + _tcslen(ItemBuf) + 1;
pItemRBuf[iItemCount] = (ULONG_PTR *) (((PWMI_CLIENT_CONTEXT)&(pEvent->ClientContext))->ProcessorNumber) ;
iItemCount ++;
// Done processing Parameters
if (pMofInfo != NULL) {
Head = pMofInfo->ItemHeader;
pMofInfo->EventCount ++;
Next = Head->Flink;
} else {
Head = Next = NULL ;
}
__try {
iMofPtr = (char *) malloc(pEvent->MofLength + sizeof(UNICODE_NULL));
if(iMofPtr == NULL)
return -1;
RtlZeroMemory(iMofPtr, pEvent->MofLength + sizeof(UNICODE_NULL));
RtlCopyMemory(iMofPtr, pEvent->MofData, pEvent->MofLength);
ptr = iMofPtr;
while (Head != Next)
{
ULONG * ULongPtr = (ULONG *) & ItemRBuf[0];
USHORT * UShortPtr = (USHORT *) & ItemRBuf[0];
LONGLONG * LongLongPtr = (LONGLONG *) & ItemRBuf[0];
ULONGLONG * ULongLongPtr = (ULONGLONG *) & ItemRBuf[0];
double * DoublePtr = (double *) & ItemRBuf[0];
TCHAR * PtrFmt1, * PtrFmt2 ;
pItem = CONTAINING_RECORD(Next, ITEM_DESC, Entry);
if ((ULONG) (ptr - iMofPtr) >= pEvent->MofLength)
{
break;
}
RtlZeroMemory(ItemBuf, MAXBUFS * sizeof(TCHAR));
RtlZeroMemory(ItemRBuf, MAXBUFS * sizeof(BYTE));
bItemIsString = FALSE ; // Assume its a RAW value
ItemRSize = 0 ; // Raw length of zero
switch (pItem->ItemType)
{
case ItemChar:
case ItemUChar:
ItemRSize = sizeof(CHAR);
RtlCopyMemory(ItemRBuf, ptr, ItemRSize);
_sntprintf(ItemBuf, MAXBUFS, _T("%c"), ItemRBuf);
ptr += ItemRSize;
break;
case ItemCharSign:
ItemRSize = sizeof(CHAR) * 2;
RtlCopyMemory(ItemRBuf, ptr, ItemRSize);
ItemRBuf[2] = '\0';
_sntprintf(ItemBuf, MAXBUFS,_T("\"%s\""), ItemRBuf);
ptr += ItemRSize;
break;
case ItemCharShort:
ItemRSize = sizeof(CHAR);
RtlCopyMemory(ItemRBuf, ptr, ItemRSize);
_sntprintf(ItemBuf, MAXBUFS, _T("%d"), * ItemRBuf);
ptr += ItemRSize;
break;
case ItemShort:
ItemRSize = sizeof(USHORT);
RtlCopyMemory(ItemRBuf, ptr, ItemRSize);
_sntprintf(ItemBuf,MAXBUFS, _T("%6d"), * UShortPtr);
ptr += ItemRSize;
break;
case ItemDouble:
ItemRSize = sizeof(double);
RtlCopyMemory(ItemRBuf, ptr, ItemRSize);
_sntprintf(ItemBuf,MAXBUFS, _T("%g"), * DoublePtr);
ptr += ItemRSize;
ItemRSize = 0; // FormatMessage cannot print 8 byte stuff properly on x86
break;
case ItemUShort:
ItemRSize = sizeof(USHORT);
RtlCopyMemory(ItemRBuf, ptr, ItemRSize);
_sntprintf(ItemBuf,MAXBUFS, _T("%6u"), * UShortPtr);
ptr += ItemRSize;
break;
case ItemLong:
ItemRSize = sizeof(LONG);
RtlCopyMemory(ItemRBuf, ptr, ItemRSize);
_sntprintf(ItemBuf,MAXBUFS, _T("%8l"), (LONG) * ULongPtr);
ptr += ItemRSize;
break;
case ItemULong:
ItemRSize = sizeof(ULONG);
RtlCopyMemory(ItemRBuf, ptr, ItemRSize);
_sntprintf(ItemBuf,MAXBUFS, _T("%8lu"), * ULongPtr);
ptr += ItemRSize;
break;
case ItemULongX:
ItemRSize = sizeof(ULONG);
RtlCopyMemory(ItemRBuf, ptr, ItemRSize);
_sntprintf(ItemBuf,MAXBUFS, _T("0x%08X"), * ULongPtr);
ptr += ItemRSize;
break;
case ItemPtr :
PtrFmt2 = _T("%08X%08X") ;
PtrFmt1 = _T("%08X") ;
// goto ItemPtrCommon ;
//ItemPtrCommon:
{
ULONG ulongword2;
if (PointerSize == 8) { // 64 bits
RtlCopyMemory(&ulongword,ptr,4);
RtlCopyMemory(&ulongword2,ptr+4,4);
_sntprintf(ItemBuf,MAXBUFS, PtrFmt2 , ulongword2,ulongword);
}
else { // assumes 32 bit otherwise
RtlCopyMemory(&ulongword,ptr,PointerSize);
_sntprintf(ItemBuf,MAXBUFS, PtrFmt1 , ulongword);
}
ItemRSize = 0 ; // Pointers are always co-erced to be strings
ptr += PointerSize;
}
break;
case ItemIPAddr:
ItemRSize = 0; // Only String form exists
memcpy(&ulongword, ptr, sizeof(ULONG));
// Convert it to readable form
//
_sntprintf(
ItemBuf, MAXBUFS,
_T("%03d.%03d.%03d.%03d"),
(ulongword >> 0) & 0xff,
(ulongword >> 8) & 0xff,
(ulongword >> 16) & 0xff,
(ulongword >> 24) & 0xff);
ptr += sizeof (ULONG);
break;
case ItemPort:
ItemRSize = 0; // Only String form exists
_sntprintf(ItemBuf,MAXBUFS, _T("%u"), (UCHAR)ptr[0] * 256 + (UCHAR)ptr[1] * 1);
ptr += sizeof (USHORT);
break;
case ItemLongLong:
ItemRSize = sizeof(LONGLONG);
RtlCopyMemory(ItemRBuf, ptr, ItemRSize);
_sntprintf(ItemBuf,MAXBUFS, _T("%16I64x"), *LongLongPtr);
ptr += sizeof(LONGLONG);
ItemRSize = 0; // FormatMessage cannot print 8 byte stuff properly on x86
break;
case ItemULongLong:
ItemRSize = sizeof(ULONGLONG);
RtlCopyMemory(ItemRBuf, ptr, ItemRSize);
_sntprintf(ItemBuf,MAXBUFS, _T("%16I64x"), *ULongLongPtr);
ptr += sizeof(ULONGLONG);
ItemRSize = 0; // FormatMessage cannot print 8 byte stuff properly on x86
break;
case ItemString:
case ItemRString:
{
SIZE_T pLen = strlen((CHAR *) ptr);
if (pLen > 0)
{
strcpy(str, ptr);
if (pItem->ItemType == ItemRString)
{
reduce(str);
}
#ifdef UNICODE
MultiByteToWideChar(CP_ACP, 0, str, -1, wstr, MAXSTR);
_sntprintf(ItemBuf,MAXBUFS, _T("\"%ws\""), wstr);
_sntprintf((TCHAR *)ItemRBuf, MAXCHARS, _T("%ws"), wstr);
#else
_sntprintf(ItemBuf,MAXBUFS, _T("\"%s\""), str);
_stprintf((TCHAR *)ItemRBuf, MAXCHARS,_T("%s"), str);
#endif /* #ifdef UNICODE */
} else {
_sntprintf(ItemBuf,MAXBUFS,_T("<NULL>"));
_sntprintf((TCHAR *)ItemRBuf,MAXCHARS,_T("<NULL>"));
}
ItemRSize = _tcslen((TCHAR *)ItemRBuf) * sizeof(TCHAR);
bItemIsString = TRUE;
ptr += (pLen + 1);
break;
}
case ItemRWString:
case ItemWString:
{
size_t pLen = 0;
size_t i;
if (*(WCHAR *) ptr)
{
if (pItem->ItemType == ItemRWString)
{
reduceW((WCHAR *) ptr);
}
pLen = ((wcslen((WCHAR*)ptr) + 1) * sizeof(WCHAR));
memcpy(wstr, ptr, pLen);
for (i = 0; i < pLen / 2; i++)
{
if (((USHORT) wstr[i] == (USHORT) 0xFFFF))
{
wstr[i] = (USHORT) 0;
}
}
wstr[pLen / 2] = wstr[(pLen / 2) + 1]= '\0';
_sntprintf(ItemBuf,MAXBUFS, _T("\"%ws\""), wstr);
_sntprintf((TCHAR *)ItemRBuf, MAXCHARS,_T("%ws"), wstr);
ItemRSize = _tcslen((TCHAR *)ItemRBuf) * sizeof(TCHAR);
bItemIsString = TRUE;
}
ptr += pLen; // + sizeof(ULONG);
break;
}
case ItemDSString: // Counted String
{
USHORT pLen = 256 * ((USHORT) * ptr) + ((USHORT) * (ptr + 1));
ptr += sizeof(USHORT);
if (pLen > 0)
{
strcpy(str, ptr);
#ifdef UNICODE
MultiByteToWideChar(CP_ACP, 0, str, -1, wstr, MAXSTR);
_sntprintf(ItemBuf,MAXBUFS, _T("\"%ws\""), wstr);
_sntprintf((TCHAR *)ItemRBuf, MAXCHARS,_T("%ws"), wstr);
#else
_sntprintf(ItemBuf,MAXBUFS, _T("\"%s\""), str);
_sntprintf((TCHAR *)ItemRBuf, MAXCHARS, _T("%s"), str);
#endif
}
ItemRSize = _tcslen((TCHAR *)ItemRBuf) * sizeof(TCHAR);
bItemIsString = TRUE;
ptr += (pLen + 1);
break;
}
case ItemPString: // Counted String
{
USHORT pLen = 256 * ((USHORT) * ptr) + ((USHORT) * (ptr + 1));
ptr += sizeof(USHORT);
if (pLen > 0)
{
strcpy(str, ptr);
#ifdef UNICODE
MultiByteToWideChar(CP_ACP, 0, str, -1, wstr, MAXSTR);
_sntprintf(ItemBuf,MAXBUFS, _T("\"%ws\""), wstr);
_sntprintf((TCHAR *)ItemRBuf, MAXCHARS,_T("%ws"), wstr);
#else
_sntprintf(ItemBuf,MAXBUFS, _T("\"%s\""), str);
_sntprintf((TCHAR *)ItemRBuf, MAXCHARS, _T("%s"), str);
#endif /* #ifdef UNICODE */
} else {
_sntprintf(ItemBuf,MAXBUFS, _T("<NULL>"));
_sntprintf((TCHAR *)ItemRBuf, MAXCHARS, _T("<NULL>"));
}
ItemRSize = _tcslen((TCHAR *)ItemRBuf) * sizeof(TCHAR);
bItemIsString = TRUE;
ptr += (pLen + 1);
break;
}
case ItemDSWString: // DS Counted Wide Strings
case ItemPWString: // Counted Wide Strings
{
USHORT pLen = ( pItem->ItemType == ItemDSWString)
? (256 * ((USHORT) * ptr) + ((USHORT) * (ptr + 1)))
: (* ((USHORT *) ptr));
ptr += sizeof(USHORT);
if (pLen > MAXSTR * sizeof(WCHAR))
{
pLen = MAXSTR * sizeof(WCHAR);
}
if (pLen > 0)
{
memcpy(wstr, ptr, pLen);
wstr[pLen / sizeof(WCHAR)] = L'\0';
_sntprintf(ItemBuf,MAXBUFS, _T("\"%ws\""), wstr);
_sntprintf((TCHAR *)ItemRBuf, MAXCHARS, _T("%ws"), wstr);
ItemRSize = _tcslen((TCHAR *)ItemRBuf) * sizeof(TCHAR) ;
bItemIsString = TRUE;
}
ptr += pLen;
break;
}
case ItemNWString: // Non Null Terminated String
{
USHORT Size;
Size = (USHORT) (pEvent->MofLength -
(ULONG) (ptr - iMofPtr));
if (Size > MAXSTR )
{
Size = MAXSTR;
}
if (Size > 0)
{
memcpy(wstr, ptr, Size);
wstr[Size / 2] = '\0';
_sntprintf(ItemBuf,MAXBUFS, _T("\"%ws\""), wstr);
_sntprintf((TCHAR *)ItemRBuf, MAXCHARS, _T("%ws"), wstr);
ItemRSize = _tcslen((TCHAR *)ItemRBuf) * sizeof(TCHAR) ;
bItemIsString = TRUE;
}
ptr += Size;
break;
}
case ItemMLString: // Multi Line String
{
SIZE_T pLen;
char * src, * dest;
BOOL inQ = FALSE;
BOOL skip = FALSE;
UINT lineCount = 0;
ptr += sizeof(UCHAR) * 2;
pLen = strlen(ptr);
if (pLen > 0)
{
src = ptr;
dest = str;
while (*src != '\0')
{
if (*src == '\n')
{
if (!lineCount)
{
* dest ++ = ' ';
}
lineCount ++;
}
else if (*src == '\"')
{
if (inQ)
{
char strCount[32];
char * cpy;
sprintf(strCount, "{%dx}", lineCount);
cpy = &strCount[0];
while (*cpy != '\0')
{
* dest ++ = * cpy ++;
}
}
inQ = !inQ;
}
else if (!skip)
{
*dest++ = *src;
}
skip = (lineCount > 1 && inQ);
src++;
}
*dest = '\0';
#ifdef UNICODE
MultiByteToWideChar(CP_ACP, 0, str, -1, wstr, MAXSTR);
_sntprintf(ItemBuf,MAXBUFS, _T("\"%ws\""), wstr);
_sntprintf((TCHAR *)ItemRBuf, MAXCHARS, _T("%ws"), wstr);
#else
_sntprintf(ItemBuf,MAXBUFS, _T("\"%s\""), str);
_sntprintf((TCHAR *)ItemRBuf, MAXCHARS, _T("%s"), str);
#endif /* #ifdef UNICODE */
ItemRSize = _tcslen((TCHAR *)ItemRBuf) * sizeof(TCHAR) ;
bItemIsString = TRUE;
}
ptr += (pLen);
break;
}
case ItemSid:
{
TCHAR UserName[64];
TCHAR Domain[64];
TCHAR FullName[256];
ULONG asize = 0;
ULONG bsize = 0;
ULONG Sid[64];
PULONG pSid = &Sid[0];
SID_NAME_USE Se;
ULONG nSidLength;
pSid = (PULONG) ptr;
if (* pSid == 0)
{
ptr += 4;
_sntprintf(ItemBuf,MAXBUFS, _T("<NULL>"));
_sntprintf((TCHAR *)ItemRBuf, MAXCHARS, _T("<NULL>"));
ItemRSize = _tcslen((TCHAR *)ItemRBuf) * sizeof(TCHAR) ;
bItemIsString = TRUE ;
}
else
{
ptr += 8; // skip the TOKEN_USER structure
nSidLength = 8 + (4 * ptr[1]);
asize = 64;
bsize = 64;
// LookupAccountSid cannot accept asize, bsize as size_t
if (LookupAccountSid(
NULL,
(PSID) ptr,
(LPTSTR) & UserName[0],
&asize,
(LPTSTR) & Domain[0],
& bsize,
& Se))
{
LPTSTR pFullName = & FullName[0];
_tcscpy(pFullName, _T("\\\\"));
_tcscat(pFullName, Domain);
_tcscat(pFullName, _T("\\"));
_tcscat(pFullName, UserName);
asize = (ULONG) _tcslen(pFullName); // Truncate here
if (asize > 0)
{
_sntprintf(ItemBuf,MAXBUFS, _T("\"%s\""), pFullName);
_sntprintf((TCHAR *)ItemRBuf, MAXCHARS, _T("%s"), pFullName);
}
}
else
{
LPTSTR sidStr;
if ( ConvertSidToStringSid(pSid, &sidStr) ) {
_sntprintf(ItemBuf,MAXBUFS, _T("\"%s\""), sidStr); // BUGBUG check size
_sntprintf((TCHAR *)ItemRBuf, MAXCHARS,_T("%s"), sidStr);
} else {
_sntprintf(ItemBuf,MAXBUFS, _T("\"%s(%d)\""), _T("System"), GetLastError() );
_sntprintf((TCHAR *)ItemRBuf, MAXCHARS,_T("%s(%d)"), _T("System"), GetLastError() );
}
}
SetLastError(ERROR_SUCCESS);
ItemRSize = _tcslen((TCHAR *)ItemRBuf) * sizeof(TCHAR);
bItemIsString = TRUE;
ptr += nSidLength;
}
break;
}
case ItemChar4:
ItemRSize = 4 * sizeof(TCHAR);
_sntprintf(ItemBuf,MAXBUFS,
_T("%c%c%c%c"),
ptr[0], ptr[1], ptr[2], ptr[3]);
ptr += ItemRSize ;
_tcscpy((LPTSTR)ItemRBuf, ItemBuf);
bItemIsString = TRUE;
break;
case ItemCharHidden:
ItemRSize = 0 ;
_stscanf(pItem->ItemList,_T("%d"),&ItemRSize);
if (ItemRSize > MAXBUFS) {
ItemRSize = MAXBUFS ;
}
_tprintf(_T("size is %d\n"),ItemRSize);
RtlCopyMemory(ItemBuf,ptr,ItemRSize);
ptr += ItemRSize ;
bItemIsString = TRUE ;
break;
case ItemSetByte:
ItemRSize = sizeof(BYTE);
goto ItemSetCommon;
case ItemSetShort:
ItemRSize = sizeof(USHORT);
goto ItemSetCommon;
case ItemSetLong:
ItemRSize = sizeof(ULONG);
// goto ItemSetCommon;
ItemSetCommon:
{
TCHAR * name;
ULONG Countr = 0;
ULONG ItemMask = 0;
TCHAR iList[MAXBUFS];
BOOL first = TRUE;
RtlCopyMemory(&ItemMask, ptr, ItemRSize);
ptr += ItemRSize;
_tcscpy(ItemBuf, _T("["));
_sntprintf(iList, MAXBUFS,_T("%s"), pItem->ItemList);
name = _tcstok(iList, _T(","));
while( name != NULL )
{
// While there are tokens in "string"
//
if (ItemMask & (1 << Countr) )
{
if (!first) _tcscat(ItemBuf, _T(","));
_tcscat(ItemBuf, name); first = FALSE;
}
// Get next token:
//
name = _tcstok( NULL, _T(","));
Countr++;
}
while (Countr < ItemRSize * 8) {
if (ItemMask & (1 << Countr) )
{
TCHAR smallBuf[20];
_sntprintf(smallBuf, 20, _T("%d"),Countr);
if (!first) _tcscat(ItemBuf, _T(","));
_tcscat(ItemBuf, smallBuf); first = FALSE;
}
Countr++;
}
_tcscat(ItemBuf, _T("]") );
ItemRSize = 0; // Strings will be the same Raw and otherwise
}
break;
case ItemListByte:
ItemRSize = sizeof(BYTE);
goto ItemListCommon;
case ItemListShort:
ItemRSize = sizeof(USHORT);
goto ItemListCommon;
case ItemListLong:
ItemRSize = sizeof(ULONG);
// goto ItemListCommon;
ItemListCommon:
{
TCHAR * name;
ULONG Countr = 0;
ULONG ItemIndex = 0;
TCHAR iList[MAXBUFS];
RtlCopyMemory(&ItemIndex, ptr, ItemRSize);
ptr += ItemRSize;
ItemRSize = 0; // Strings will be the same Raw and otherwise
_sntprintf(ItemBuf,MAXBUFS, _T("!%X!"),ItemIndex);
_sntprintf(iList, MAXBUFS, _T("%s"), pItem->ItemList);
name = _tcstok(iList, _T(","));
while( name != NULL )
{
// While there are tokens in "string"
//
if (ItemIndex == Countr ++)
{
_sntprintf(ItemBuf,MAXBUFS, _T("%s"), name);
break;
}
// Get next token:
//
name = _tcstok( NULL, _T(","));
}
}
break;
case ItemNTerror:
ItemRSize = 0; // Only string form exists
RtlCopyMemory(ItemRBuf, ptr, sizeof(ULONG));
ptr += sizeof(ULONG);
// Translate the NT Error Message
if ((FormatMessage(
FORMAT_MESSAGE_FROM_SYSTEM |
FORMAT_MESSAGE_IGNORE_INSERTS,
NULL,
*ULongPtr,
MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT), // Default language
ItemBuf,
MAXBUFS,
NULL )) == 0) {
_sntprintf(ItemBuf,MAXBUFS,_T("!NT Error %d unrecognised!"),*ULongPtr);
}
break;
case ItemMerror:
ItemRSize = 0; // Only string form exists
RtlCopyMemory(ItemRBuf, ptr, sizeof(ULONG));
ptr += sizeof(ULONG);
// Translate the Module Message
if (pItem->ItemList == NULL) {
_sntprintf(ItemBuf,MAXBUFS,_T("! Error %d No Module Name!"),*ULongPtr);
} else {
if ((hLibrary = LoadLibraryEx(
pItem->ItemList, // file name of module
NULL, // reserved, must be NULL
LOAD_LIBRARY_AS_DATAFILE // entry-point execution flag
)) == NULL) {
_sntprintf(ItemBuf,MAXBUFS,_T("!ItemMerror %d : LoadLibrary of %s failed %d!"),
*ULongPtr,
pItem->ItemList,
GetLastError());
} else {
if ((FormatMessage(
FORMAT_MESSAGE_FROM_HMODULE |
FORMAT_MESSAGE_FROM_SYSTEM |
FORMAT_MESSAGE_IGNORE_INSERTS,
hLibrary,
*ULongPtr,
MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT), // Default language
ItemBuf,
MAXBUFS,
NULL )) == 0) {
_sntprintf(ItemBuf,MAXBUFS,_T("!Module Error %d unrecognised!"),*ULongPtr);
}
if (!FreeLibrary(hLibrary)) {
_sntprintf(ItemBuf,MAXBUFS,_T("Failed to free library (%s) handle, err = %d"),
pItem->ItemList, GetLastError());
}
}
}
break;
case ItemHRESULT:
{
NTSTATUS TempNTSTATUS, Error ;
ItemRSize = 0 ;
RtlCopyMemory(&TempNTSTATUS, ptr, sizeof(NTSTATUS));
ptr += sizeof(ULONG);
Error = TempNTSTATUS;
if (TempNTSTATUS == 0) { // Special case STATUS_SUCCESS just like everyone else!
_sntprintf(ItemBuf,MAXBUFS,_T("S_OK"));
} else {
const ERROR_MAP* map = (ERROR_MAP*)winerrorSymbolicNames;
_sntprintf(ItemBuf,MAXBUFS,_T("HRESULT=%8X"),TempNTSTATUS);
if( FACILITY_NT_BIT & TempNTSTATUS ) {
map = (ERROR_MAP*)ntstatusSymbolicNames;
Error &= ~FACILITY_NT_BIT;
} else if (HRESULT_FACILITY(Error) == FACILITY_WIN32) {
Error &= 0xFFFF;
}
while (map->MessageId != 0xFFFFFFFF) {
if (map->MessageId == Error) {
_sntprintf(ItemBuf,MAXBUFS,_T("0x%08x(%S)"), TempNTSTATUS, map->SymbolicName);
break;
}
++map;
}
}
}
break;
case ItemNTSTATUS:
{
int i = 0 ;
NTSTATUS TempNTSTATUS ;
ItemRSize = 0 ;
RtlCopyMemory(&TempNTSTATUS, ptr, sizeof(NTSTATUS));
ptr += sizeof(ULONG);
if (TempNTSTATUS == 0) { // Special case STATUS_SUCCESS just like everyone else!
_sntprintf(ItemBuf,MAXBUFS,_T("STATUS_SUCCESS"));
} else {
_sntprintf(ItemBuf,MAXBUFS,_T("NTSTATUS=%8X"),TempNTSTATUS);
while (ntstatusSymbolicNames[i].MessageId != 0xFFFFFFFF) {
if (ntstatusSymbolicNames[i].MessageId == TempNTSTATUS) {
_sntprintf(ItemBuf,MAXBUFS,_T("0x%08x(%S)"), TempNTSTATUS, ntstatusSymbolicNames[i].SymbolicName);
break;
}
i++ ;
}
}
}
break;
case ItemWINERROR:
{
int i = 0 ;
DWORD TempWINERROR ;
ItemRSize = 0 ;
RtlCopyMemory(&TempWINERROR, ptr, sizeof(DWORD));
ptr += sizeof(ULONG);
_sntprintf(ItemBuf,MAXBUFS,_T("WINERROR=%8X"),TempWINERROR);
while (winerrorSymbolicNames[i].MessageId != 0xFFFFFFFF) {
if (winerrorSymbolicNames[i].MessageId == TempWINERROR) {
_sntprintf(ItemBuf,MAXBUFS,_T("%d(%S)"), TempWINERROR, winerrorSymbolicNames[i].SymbolicName);
break;
}
i++ ;
}
}
break;
case ItemNETEVENT:
{
int i = 0 ;
DWORD TempNETEVENT ;
ItemRSize = 0 ;
RtlCopyMemory(&TempNETEVENT, ptr, sizeof(DWORD));
ptr += sizeof(ULONG);
_sntprintf(ItemBuf,MAXBUFS,_T("NETEVENT=%8X"),TempNETEVENT);
while (neteventSymbolicNames[i].MessageId != 0xFFFFFFFF) {
if (neteventSymbolicNames[i].MessageId == TempNETEVENT) {
_sntprintf(ItemBuf,MAXBUFS,_T("%S"), neteventSymbolicNames[i].SymbolicName);
break;
}
i++ ;
}
}
break;
case ItemGuid:
GuidToString(ItemBuf, (LPGUID) ptr);
ItemRSize = 0; // Only string form exists
ptr += sizeof(GUID);
break;
case ItemTimeDelta:
{
LONGLONG time;
RtlCopyMemory(&time, ptr, sizeof(time));
FormatTimeDelta(ItemBuf, MAXBUFS, time);
ItemRSize = 0; // Only string form exists
ptr += sizeof(LONGLONG);
}
break;
case ItemWaitTime:
{
LONGLONG time;
RtlCopyMemory(&time, ptr, sizeof(time));
if (time <= 0) {
time = -time;
ItemBuf[0]='+';
FormatTimeDelta(ItemBuf+1, MAXBUFS-1, time);
ItemRSize = 0; // Only string form exists
ptr += sizeof(LONGLONG);
break;
}
// Fall thru
}
case ItemTimestamp:
{
LARGE_INTEGER LargeTmp;
FILETIME stdTime, localTime;
SYSTEMTIME sysTime;
RtlCopyMemory(&LargeTmp, ptr, sizeof(ULONGLONG));
stdTime.dwHighDateTime = LargeTmp.HighPart;
stdTime.dwLowDateTime = LargeTmp.LowPart;
if (!FileTimeToLocalFileTime(&stdTime, &localTime)) {
_sntprintf(ItemBuf,MAXBUFS,_T("FileTimeToLocalFileTime error 0x%8X\n"),GetLastError());
break;
}
if (!FileTimeToSystemTime(&localTime, &sysTime)){
_sntprintf(ItemBuf,MAXBUFS,_T("FileTimeToSystemTime error 0x%8X\n"),GetLastError());
break;
}
_sntprintf(ItemBuf,MAXBUFS, _T("%02d/%02d/%04d-%02d:%02d:%02d.%03d"),
sysTime.wMonth,
sysTime.wDay,
sysTime.wYear,
sysTime.wHour,
sysTime.wMinute,
sysTime.wSecond,
sysTime.wMilliseconds);
}
ItemRSize = 0; // Only string form exists
ptr += sizeof(ULONGLONG);
break;
default:
ptr += sizeof (int);
}
_sntprintf(pItemBuf[iItemCount],
MAXBUFS2-ItemsInBuf,
_T("%s"),
ItemBuf);
pItemBuf[iItemCount + 1] =
pItemBuf[iItemCount] + _tcslen(ItemBuf) + sizeof(TCHAR);
ItemsInBuf = ItemsInBuf + _tcslen(ItemBuf) + sizeof(TCHAR);
if (ItemRSize == 0) {
// Raw and String are the same
pItemRBuf[iItemCount] = (ULONG_PTR *) pItemBuf[iItemCount];
}
else
{
if (ItemRSize > MAXBUFS) {
ItemRSize = MAXBUFS ;
}
pItemRBuf[iItemCount] =pItemRBuf[iItemCount+1] = 0 ;
if (!bItemIsString) {
RtlCopyMemory(&pItemRBuf[iItemCount],ItemRBuf,ItemRSize);
} else {
// Share scratch buffer
if ((LONG)(ItemsInBuf+ItemRSize+sizeof(TCHAR)) < (LONG)sizeof(ItemBBuf)) {
(TCHAR *)pItemRBuf[iItemCount] = pItemBuf[iItemCount+1] ;
RtlCopyMemory(pItemRBuf[iItemCount],ItemRBuf,ItemRSize);
pItemBuf[iItemCount+1] =(TCHAR *)pItemRBuf[iItemCount] + ItemRSize + sizeof(TCHAR) ;
ItemsInBuf = ItemsInBuf + ItemRSize + sizeof(TCHAR) ;
} else {
pItemRBuf[iItemCount] = (ULONG_PTR *) pItemBuf[iItemCount];
}
}
}
iItemCount ++;
Next = Next->Flink;
}
// Ok we are finished with the MofData
//
free(iMofPtr);
}
__except(EXCEPTION_EXECUTE_HANDLER)
{
_sntprintf(EventBuf,
SizeEventBuf,
_T("\n*****FormatMessage %s of %s, parameter %d raised an exception*****\n"),
tstrName,
tstrFormat,
iItemCount);
return( (SIZE_T)_tcslen(EventBuf));
}
}
// All argument processing is complete
// No prepare the final formatting.
if ((tstrFormat == NULL) || (tstrFormat[0] == 0))
{
TCHAR GuidString[32] ;
// Build a helpful format
RtlZeroMemory(EventBuf, SizeEventBuf);
if (!IsEqualGUID(&pEvent->Header.Guid, &EventTraceGuid) ) {
GuidToString(GuidString, (LPGUID) &pEvent->Header.Guid);
_sntprintf(EventBuf,
SizeEventBuf,
_T("%s(%s): GUID=%s (No Format Information found)."),
pItemBuf[0], // name if any
pItemBuf[1], // sub name or number
GuidString // GUID
);
} else {
// Display nothing for a header for now
// Might be a good place to display some general info ?
}
}
else
{
DWORD dwResult;
if (tstrTypeOfType == 1)
{
__try
{
dwResult = FormatMessage(
FORMAT_MESSAGE_FROM_STRING + FORMAT_MESSAGE_ARGUMENT_ARRAY,
// source and processing options
(LPCVOID) tstrFormat, // pointer to message source
0, // requested message identifier
0, // language identifier
(LPTSTR) EventBuf, // pointer to message buffer
SizeEventBuf, // maximum size of message buffer
(va_list *) pItemBuf); // pointer to array of message inserts
if (dwResult == 0)
{
_sntprintf(
EventBuf, SizeEventBuf,
_T("FormatMessage (Type 1) Failed 0x%X (%s/%s) (\n"),
GetLastError(),
pItemBuf[0],
pItemBuf[1]);
return(GetLastError());
}
}
__except(EXCEPTION_EXECUTE_HANDLER)
{
_sntprintf(EventBuf,
SizeEventBuf,
_T("\n*****FormatMessage (#Type) of %s, raised an exception*****\n"),
tstrFormat);
return( (SIZE_T)_tcslen(EventBuf));
}
}
else if (tstrTypeOfType == 2)
{
__try
{
#if !defined(STRINGFIXUP)
dwResult = FormatMessage(
FORMAT_MESSAGE_FROM_STRING + FORMAT_MESSAGE_ARGUMENT_ARRAY,
// source and processing options
(LPCVOID) tstrFormat, // pointer to message source
0, // requested message identifier
0, // language identifier
(LPTSTR) EventBuf, // pointer to message buffer
SizeEventBuf, // maximum size of message buffer
(va_list *) pItemRBuf); // pointer to array of message inserts
if (dwResult == 0)
{
_sntprintf(
EventBuf,
SizeEventBuf,
_T("FormatMessage (#Typev) Failed 0x%X (%s/%s) (\n"),
GetLastError(),
pItemBuf[0],
pItemBuf[1]);
return(GetLastError());
}
#else // if !defined(STRINGFIXUP)
ULONG ReturnLength ;
dwResult = (DWORD)TraceFormatMessage(
tstrFormat, // message format
0,
FALSE, // Don't ignore inserts,
#if defined(UNICODE)
FALSE, // Arguments Are not Ansi,
#else // #if defined(UNICODE)
TRUE, // Arguments are Ansi
#endif // #if defined(UNICODE)
TRUE, // Arguments Are An Array,
(va_list *) pItemRBuf, // Arguments,
EventBuf, // Buffer,
SizeEventBuf, // maximum size of message buffer
&ReturnLength // Coutnof Data Returned
);
if (ReturnLength == 0)
{
_sntprintf(
EventBuf,
SizeEventBuf,
_T("FormatMessage (#Typev) Failed 0x%X (%s/%s) (\n"),
dwResult,
pItemBuf[0],
pItemBuf[1]);
return(dwResult);
}
#endif // if !defined(STRINGFIXUP)
}
__except(EXCEPTION_EXECUTE_HANDLER)
{
_sntprintf( EventBuf,
SizeEventBuf,
_T("\n*****FormatMessage (#Typev) raised an exception (Format = %s) ****\n**** [Check for missing \"!\" Formats]*****\n"), tstrFormat);
return((SIZE_T)_tcslen(EventBuf));
}
}
else
{
return (-12);
}
}
if (pszMask != NULL)
{
// Has he imposed a Filter?
//
if (_tcsstr(_tcslwr(pszMask), _tcslwr(tstrName)) !=0)
{
return( (SIZE_T)_tcslen(EventBuf));
}
else
{
return(0);
}
}
return ( (SIZE_T)_tcslen(EventBuf));
}
PMOF_INFO
GetMofInfoHead(
PLIST_ENTRY * HeadEventList,
LPGUID pGuid,
LPTSTR strType,
LONG TypeIndex,
ULONG TypeOfType,
LPTSTR TypeFormat,
BOOL bBestMatch
)
{
PLIST_ENTRY Head, Next;
PMOF_INFO pMofInfo;
// Search the eventList for this Guid and find the head
//
if (HeadEventList == NULL) {
return NULL ;
}
if (*HeadEventList == NULL)
{
if( (*HeadEventList = (PLIST_ENTRY) malloc(sizeof(LIST_ENTRY))) == NULL)
return NULL;
RtlZeroMemory(*HeadEventList, sizeof(LIST_ENTRY));
InitializeListHead(*HeadEventList);
}
// Traverse the list and look for the Mof info head for this Guid.
//
Head = *HeadEventList;
Next = Head->Flink;
if (bBestMatch)
{
PMOF_INFO pBestMatch = NULL;
while (Head != Next)
{
pMofInfo = CONTAINING_RECORD(Next, MOF_INFO, Entry);
if (IsEqualGUID(&pMofInfo->Guid, pGuid))
{
if (pMofInfo->TypeIndex == TypeIndex)
{
return pMofInfo;
}
else if (pMofInfo->strType == NULL)
{
pBestMatch = pMofInfo;
}
}
Next = Next->Flink;
}
if(pBestMatch != NULL)
{
return pBestMatch;
}
}
else
{
while (Head != Next)
{
pMofInfo = CONTAINING_RECORD(Next, MOF_INFO, Entry);
if ( (strType != NULL)
&& (pMofInfo->strType != NULL)
&& (IsEqualGUID(&pMofInfo->Guid, pGuid))
&& (!(_tcscmp(strType, pMofInfo->strType))))
{
return pMofInfo;
}
else if ( (strType == NULL)
&& (pMofInfo->strType == NULL)
&& (IsEqualGUID(&pMofInfo->Guid, pGuid)))
{
return pMofInfo;
}
Next = Next->Flink;
}
}
// If One does not exist, create one.
//
if( (pMofInfo = (PMOF_INFO) malloc(sizeof(MOF_INFO))) == NULL)
return NULL;
RtlZeroMemory(pMofInfo, sizeof(MOF_INFO));
memcpy(&pMofInfo->Guid, pGuid, sizeof(GUID));
pMofInfo->ItemHeader = (PLIST_ENTRY) malloc(sizeof(LIST_ENTRY));
if( pMofInfo->ItemHeader == NULL){
free(pMofInfo);
return NULL;
}
RtlZeroMemory(pMofInfo->ItemHeader, sizeof(LIST_ENTRY));
if (strType != NULL)
{
if ((pMofInfo->strType = (LPTSTR) malloc((_tcslen(strType) + 1) * sizeof(TCHAR))) == NULL ) {
free(pMofInfo);
return NULL ;
}
_tcscpy(pMofInfo->strType,strType);
}
if (TypeOfType != 0)
{
pMofInfo->TypeOfType = TypeOfType;
}
if (TypeFormat != NULL)
{
if ((pMofInfo->TypeFormat =
(LPTSTR) malloc((_tcslen(TypeFormat) + 1) * sizeof(TCHAR)))== NULL) {
free(pMofInfo->strType);
free(pMofInfo);
return NULL ;
}
_tcscpy(pMofInfo->TypeFormat,TypeFormat);
}
pMofInfo->TypeIndex = bBestMatch ? -1 : TypeIndex;
InitializeListHead(pMofInfo->ItemHeader);
InsertTailList(*HeadEventList, &pMofInfo->Entry);
return pMofInfo;
}
void
MapGuidToName(
OUT PLIST_ENTRY *HeadEventList,
IN LPGUID pGuid,
IN ULONG nType,
OUT LPTSTR wstr
)
{
if (IsEqualGUID(pGuid, &EventTraceGuid))
{
_tcscpy(wstr, GUID_TYPE_HEADER);
}
else if (!UserDefinedGuid(*HeadEventList,pGuid, wstr))
{
TCHAR filename[MAX_PATH], filepath[MAX_PATH];
LPTSTR lpFilePart ;
LPTSTR lppath = NULL; // Path for finding TMF files
INT len, waslen = 0 ;
while (((len = GetEnvironmentVariable(TRACE_FORMAT_SEARCH_PATH, lppath, waslen )) - waslen) > 0) {
if (len - waslen > 0 ) {
if (lppath != NULL) {
free(lppath);
}
lppath = malloc((len+1) * sizeof(TCHAR)) ;
waslen = len ;
}
}
if (lppath != NULL) {
// Try to find it on the path //
swprintf(filename,L"%08x-%04x-%04x-%02x%02x-%02x%02x%02x%02x%02x%02x.tmf",
pGuid->Data1,pGuid->Data2,pGuid->Data3,
pGuid->Data4[0],pGuid->Data4[1],pGuid->Data4[2],pGuid->Data4[3],
pGuid->Data4[4],pGuid->Data4[5],pGuid->Data4[6],pGuid->Data4[7] );
if ((len = SearchPath(
lppath, // search path semi-colon seperated
filename, // file name with extension
NULL, // file extension (not reqd.)
MAX_PATH, // size of buffer
filepath, // found file name buffer
&lpFilePart // file component
) !=0) && (len <= MAX_PATH)) {
//_tprintf(_T("Opening file %s\n"),filepath);
if(GetTraceGuidsW(filepath, HeadEventList))
{
if (UserDefinedGuid(*HeadEventList,pGuid, wstr)) {
free(lppath);
return;
}
}
}
free(lppath);
}
_tcscpy(wstr, GUID_TYPE_UNKNOWN);
}
}
ULONG
UserDefinedGuid(
OUT PLIST_ENTRY HeadEventList,
IN LPGUID pGuid,
OUT LPTSTR wstr
)
{
PLIST_ENTRY Head, Next;
PMOF_INFO pMofInfo;
// Search the eventList for this Guid and find the head
//
if (HeadEventList == NULL)
{
/*
HeadEventList = (PLIST_ENTRY) malloc(sizeof(LIST_ENTRY));
if(HeadEventList == NULL)
return FALSE;
InitializeListHead(HeadEventList); */
return FALSE;
}
// Traverse the list and look for the Mof info head for this Guid.
//
Head = HeadEventList;
Next = Head->Flink;
while(Head != Next && Next != NULL){
pMofInfo = CONTAINING_RECORD(Next, MOF_INFO, Entry);
if (pMofInfo != NULL && IsEqualGUID(&pMofInfo->Guid, pGuid))
{
if ( pMofInfo->strDescription == NULL)
{
return FALSE;
}
else
{
_tcscpy(wstr, pMofInfo->strDescription);
return TRUE;
}
}
Next = Next->Flink;
}
return FALSE;
}
ULONG
WINAPI
GetTraceGuidsW(
TCHAR * GuidFile,
PLIST_ENTRY * HeadEventList )
{
FILE * f;
TCHAR line[MAXSTR],
nextline[MAXSTR],
arg[MAXSTR],
strGuid[MAXSTR];
PMOF_TYPE types;
LPGUID Guid;
UINT i,
n;
TCHAR * name,
* s,
* guidName;
PMOF_INFO pMofInfo;
SIZE_T len = 0;
UINT typeCount = 0;
BOOL inInfo = FALSE;
BOOL eof = FALSE ;
BOOL nextlineF = FALSE ;
if (HeadEventList == NULL) {
return 0 ;
}
if (*HeadEventList == NULL)
{
if( (*HeadEventList = (PLIST_ENTRY) malloc(sizeof(LIST_ENTRY))) == NULL)
return 0 ;
RtlZeroMemory(*HeadEventList, sizeof(LIST_ENTRY));
InitializeListHead(*HeadEventList);
}
Guid = (LPGUID) malloc(sizeof(GUID));
if (Guid == NULL)
{
return 0;
}
types = (PMOF_TYPE) malloc(MAXTYPE * sizeof(MOF_TYPE));
if (types == NULL)
{
free(Guid);
return 0;
}
RtlZeroMemory(types, MAXTYPE * sizeof(MOF_TYPE));
RtlZeroMemory(line, MAXSTR * sizeof(TCHAR));
RtlZeroMemory(strGuid, MAXSTR * sizeof(TCHAR));
f = _tfopen( GuidFile, _T("r"));
if (f == NULL)
{
free(Guid);
free(types);
return 0;
}
n = 0;
while (!eof )
{
if (nextlineF) { // Sometimes we read ahead a bit
_tcscpy(line, nextline);
nextlineF = FALSE ;
} else {
if (_fgetts(line, MAXSTR, f) == NULL) {
eof = TRUE ;
break;
}
}
// jump_inside:;
if (line[0] == '/')
{
continue;
}
else if (line[0] == '{')
{
inInfo = TRUE;
}
else if ( line[0] == '}')
{
typeCount = 0;
inInfo = FALSE;
}
else if (inInfo)
{
ITEM_TYPE type;
PTCHAR ItemListValue = NULL;
name = _tcstok(line, _T("\n\t,"));
s = _tcstok(NULL, _T(" \n\t,("));
if (s != NULL && name != NULL )
{
if (!_tcsicmp(s,STR_ItemChar)) type = ItemChar;
else if (!_tcsicmp(s,STR_ItemUChar)) type = ItemUChar;
else if (!_tcsicmp(s,STR_ItemCharShort)) type = ItemCharShort;
else if (!_tcsicmp(s,STR_ItemCharSign)) type = ItemCharSign;
else if (!_tcsicmp(s,STR_ItemShort)) type = ItemShort;
else if (!_tcsicmp(s,STR_ItemHRESULT)) type = ItemHRESULT;
else if (!_tcsicmp(s,STR_ItemDouble)) type = ItemDouble;
else if (!_tcsicmp(s,STR_ItemUShort)) type = ItemUShort;
else if (!_tcsicmp(s,STR_ItemLong)) type = ItemLong;
else if (!_tcsicmp(s,STR_ItemULong)) type = ItemULong;
else if (!_tcsicmp(s,STR_ItemULongX)) type = ItemULongX;
else if (!_tcsicmp(s,STR_ItemLongLong)) type = ItemLongLong;
else if (!_tcsicmp(s,STR_ItemULongLong)) type = ItemULongLong;
else if (!_tcsicmp(s,STR_ItemString)) type = ItemString;
else if (!_tcsicmp(s,STR_ItemWString)) type = ItemWString;
else if (!_tcsicmp(s,STR_ItemRString)) type = ItemRString;
else if (!_tcsicmp(s,STR_ItemRWString)) type = ItemRWString;
else if (!_tcsicmp(s,STR_ItemPString)) type = ItemPString;
else if (!_tcsicmp(s,STR_ItemMLString)) type = ItemMLString;
else if (!_tcsicmp(s,STR_ItemNWString)) type = ItemNWString;
else if (!_tcsicmp(s,STR_ItemPWString)) type = ItemPWString;
else if (!_tcsicmp(s,STR_ItemDSString)) type = ItemDSString;
else if (!_tcsicmp(s,STR_ItemDSWString)) type = ItemDSWString;
else if (!_tcsicmp(s,STR_ItemPtr)) type = ItemPtr;
else if (!_tcsicmp(s,STR_ItemSid)) type = ItemSid;
else if (!_tcsicmp(s,STR_ItemChar4)) type = ItemChar4;
else if (!_tcsicmp(s,STR_ItemIPAddr)) type = ItemIPAddr;
else if (!_tcsicmp(s,STR_ItemPort)) type = ItemPort;
else if (!_tcsicmp(s,STR_ItemListLong)) type = ItemListLong;
else if (!_tcsicmp(s,STR_ItemListShort)) type = ItemListShort;
else if (!_tcsicmp(s,STR_ItemListByte)) type = ItemListByte;
else if (!_tcsicmp(s,STR_ItemSetLong)) type = ItemSetLong;
else if (!_tcsicmp(s,STR_ItemSetShort)) type = ItemSetShort;
else if (!_tcsicmp(s,STR_ItemSetByte)) type = ItemSetByte;
else if (!_tcsicmp(s,STR_ItemNTerror)) type = ItemNTerror;
else if (!_tcsicmp(s,STR_ItemMerror)) type = ItemMerror;
else if (!_tcsicmp(s,STR_ItemTimestamp)) type = ItemTimestamp;
else if (!_tcsicmp(s,STR_ItemGuid)) type = ItemGuid;
else if (!_tcsicmp(s,STR_ItemWaitTime)) type = ItemWaitTime;
else if (!_tcsicmp(s,STR_ItemTimeDelta)) type = ItemTimeDelta;
else if (!_tcsicmp(s,STR_ItemNTSTATUS)) type = ItemNTSTATUS;
else if (!_tcsicmp(s,STR_ItemWINERROR)) type = ItemWINERROR;
else if (!_tcsicmp(s,STR_ItemNETEVENT)) type = ItemNETEVENT;
else if (!_tcsicmp(s,STR_ItemCharHidden)) type = ItemCharHidden;
else type = ItemUnknown;
// Get List elements
if ((type == ItemListLong) || (type == ItemListShort) || (type == ItemListByte)
||(type == ItemSetLong) || (type == ItemSetShort) || (type == ItemSetByte) )
{
s = _tcstok(NULL, _T("()"));
ItemListValue =
(TCHAR *) malloc((_tcslen(s) + 1) * sizeof(TCHAR));
if (ItemListValue == NULL) {
return 1 ;
}
RtlCopyMemory(
ItemListValue,
s,
(_tcslen(s) + 1) * sizeof(TCHAR));
}
// Get Module specification for ItemMerror
if ((type == ItemMerror)) {
TCHAR * ppos ;
s = _tcstok(NULL, _T(" \t"));
ppos = _tcsrchr(s,'\n');
if (ppos != NULL) {
*ppos = UNICODE_NULL ;
ItemListValue =
(TCHAR *) malloc((_tcslen(s) + 1) * sizeof(TCHAR));
if (ItemListValue == NULL) {
return 1 ;
}
RtlCopyMemory(
ItemListValue,
s,
(_tcslen(s) + 1) * sizeof(TCHAR));
}
}
// Get size for ItemCharHidden
if (type == ItemCharHidden) {
TCHAR * ppos ;
s = _tcstok(NULL, _T("["));
ppos = _tcsrchr(s,']');
if (ppos != NULL) {
*ppos = UNICODE_NULL ;
ItemListValue =
(TCHAR *) malloc((_tcslen(s) + 1) * sizeof(TCHAR));
if (ItemListValue == NULL) {
return 1 ;
}
RtlCopyMemory(
ItemListValue,
s,
(_tcslen(s) + 1) * sizeof(TCHAR));
}
}
if (typeCount == 0)
{
AddMofInfo(
* HeadEventList,
Guid,
NULL,
-1,
name,
type,
NULL,
0,
NULL);
}
else
{
for (i = 0; i < typeCount; i ++)
{
AddMofInfo(
* HeadEventList,
Guid,
types[i].strType,
types[i].TypeIndex,
name,
type,
ItemListValue,
types[i].TypeType,
types[i].TypeFormat);
}
}
}
}
else if (line[0] == '#')
{
TCHAR * token, * etoken;
int Indent ; // Special parameter values(numeric) from comments
TCHAR FuncName[MAXNAMEARG], // Special parameter values from comment
LevelName[MAXNAMEARG],
CompIDName[MAXNAMEARG],
*v ;
//This is a workaround to defend against newlines in TMF files.
while (!nextlineF && !eof) {
if (_fgetts(nextline,MAXSTR,f) != NULL) {
if ((nextline[0] != '{') && nextline[0] != '#') {
TCHAR * eol ;
if ((eol = _tcsrchr(line,'\n')) != NULL) {
*eol = 0 ;
}
_tcsncat(line,nextline,MAXSTR-_tcslen(line)) ;
} else {
nextlineF = TRUE ;
}
} else {
eof = TRUE ;
}
}
// Find any special names in the comments
// As this gets longer we should make it generic
Indent = FindIntValue(line,_T("INDENT=")); // Indentaion Level
v = FindValue(line,_T("FUNC=")); // Function Name
_tcsncpy(FuncName, v, MAXNAMEARG);
v = FindValue(line,_T("LEVEL=")); // Tracing level or Flags
_tcsncpy(LevelName, v, MAXNAMEARG);
v = FindValue(line,_T("COMPNAME=")); // Component ID
_tcsncpy(CompIDName, v, MAXNAMEARG);
token = _tcstok(line,_T(" \t"));
if (_tcsicmp(token,_T("#type")) == 0)
{
types[typeCount].TypeType = 1 ;
}
else if (_tcsicmp(token,_T("#typev")) == 0)
{
types[typeCount].TypeType = 2 ;
}
else
{
fclose(f);
free(Guid);
free(types);
return(-10);
}
token = _tcstok( NULL, _T(" \t\n")); // Get Type Name
_tcscpy(types[typeCount].strType,token);
token =_tcstok( NULL, _T("\"\n,")); // Look for a Format String
if (token != NULL) {
types[typeCount].TypeIndex = _ttoi(token); // Get the type Index
token =_tcstok( NULL, _T("\n"));
}
etoken = NULL;
if (token != NULL)
{
etoken = _tcsrchr(token,_T('\"')); // Find the closing quote
}
if (etoken !=NULL)
{
etoken[0] = 0;
}
else
{
token = NULL;
}
if (token != NULL)
{
if (token[0] == '%' && token[1] == '0') {
// add standard prefix
if (StdPrefix[0] == 0) {
// need to initialize it.
LPTSTR Prefix = NULL ; int len, waslen = 0 ;
while (((len = GetEnvironmentVariable(TRACE_FORMAT_PREFIX, Prefix, waslen )) - waslen) > 0) {
if (len - waslen > 0 ) {
if (Prefix != NULL) {
free(Prefix);
}
Prefix = malloc((len+1) * sizeof(TCHAR)) ;
if (Prefix == NULL) {
return -11 ;
}
waslen = len ;
}
}
if (Prefix) {
_tcsncpy(StdPrefix, Prefix, MAXSTR);
} else {
_tcscpy(StdPrefix, STD_PREFIX);
}
free(Prefix) ;
}
_tcscpy(types[typeCount].TypeFormat,StdPrefix);
_tcscat(types[typeCount].TypeFormat,token + 2);
} else {
_tcscpy(types[typeCount].TypeFormat,token);
}
// process the special variable names
// Make generic in future
ReplaceStringUnsafe(types[typeCount].TypeFormat, _T("%!FUNC!"), FuncName);
ReplaceStringUnsafe(types[typeCount].TypeFormat, _T("%!LEVEL!"), LevelName);
ReplaceStringUnsafe(types[typeCount].TypeFormat, _T("%!COMPNAME!"), CompIDName);
}
else
{
types[typeCount].TypeFormat[0] = types[typeCount].TypeFormat[1]
= 0;
}
if ( types[typeCount].TypeFormat[0] == 0
&& types[typeCount].TypeFormat[1] == 0)
{
pMofInfo = GetMofInfoHead(
HeadEventList,
Guid,
types[typeCount].strType,
types[typeCount].TypeIndex,
types[typeCount].TypeType,
NULL,
FALSE);
}
else
{
pMofInfo = GetMofInfoHead(
HeadEventList,
Guid,
types[typeCount].strType,
types[typeCount].TypeIndex,
types[typeCount].TypeType,
types[typeCount].TypeFormat,
FALSE);
}
if(pMofInfo == NULL){
fclose(f);
free(Guid);
free(types);
return 0;
}
if (_tcslen(strGuid) > 0)
{
pMofInfo->strDescription =
(PTCHAR) malloc((_tcslen(strGuid) + 1) * sizeof(TCHAR));
if (pMofInfo->strDescription == NULL) {
fclose(f);
free(Guid);
free(types);
return 0;
}
_tcscpy(pMofInfo->strDescription, strGuid);
}
typeCount++;
if(typeCount >= MAXTYPE)
{
fclose(f);
free(Guid);
free(types);
return(-11);
}
}
else if ( (line[0] >= '0' && line[0] <= '9')
|| (line[0] >= 'a' && line[0] <= 'f')
|| (line[0] >= 'A' && line[0] <= 'F'))
{
typeCount = 0;
_tcsncpy(arg, line, 8);
arg[8] = 0;
Guid->Data1 = ahextoi(arg);
_tcsncpy(arg, &line[9], 4);
arg[4] = 0;
Guid->Data2 = (USHORT) ahextoi(arg);
_tcsncpy(arg, &line[14], 4);
arg[4] = 0;
Guid->Data3 = (USHORT) ahextoi(arg);
for (i = 0; i < 2; i ++)
{
_tcsncpy(arg, &line[19 + (i * 2)], 2);
arg[2] = 0;
Guid->Data4[i] = (UCHAR) ahextoi(arg);
}
for (i = 2; i < 8; i ++)
{
_tcsncpy(arg, &line[20 + (i * 2)], 2);
arg[2] = 0;
Guid->Data4[i] = (UCHAR) ahextoi(arg);
}
// Find the next non whitespace character
//
guidName = &line[36];
while (*guidName == ' '|| *guidName == '\t')
{
guidName++;
}
// cut comment out (if present)
{
TCHAR* comment = _tcsstr(guidName, TEXT("//"));
if (comment) {
// remove whitespace
--comment;
while (comment >= guidName && isspace(*comment)) --comment;
*++comment = 0;
}
}
len = _tcslen(guidName);
s = guidName;
while (len > 0)
{
len -= 1;
if (*s == '\n' || *s == '\0' || *s == '\t')
{
*s = '\0';
break;
}
s++;
}
pMofInfo = GetMofInfoHead(
HeadEventList, Guid, NULL, -1, 0, NULL, FALSE);
if(pMofInfo == NULL){
fclose(f);
free(Guid);
free(types);
return (ULONG) 0;
}
if (pMofInfo->strDescription != NULL)
{
free(pMofInfo->strDescription);
pMofInfo->strDescription = NULL;
}
_tcscpy(strGuid, guidName);
pMofInfo->strDescription =
(PTCHAR) malloc((_tcslen(guidName) + 1) * sizeof(TCHAR));
if (pMofInfo->strDescription == NULL ) {
// We really have problems
fclose(f);
free(Guid);
free(types);
return (ULONG) 0 ;
}
_tcscpy(pMofInfo->strDescription, strGuid);
n++ ; // Thats one more GUID
}
RtlZeroMemory(line, MAXSTR * sizeof(TCHAR));
}
fclose(f);
free(Guid);
free(types);
return (ULONG) n;
}
ULONG
ahextoi(
TCHAR *s
)
{
SSIZE_T len;
ULONG num, base, hex;
len = _tcslen(s);
hex = 0;
base = 1;
num = 0;
while (--len >= 0)
{
if ((s[len] == 'x' || s[len] == 'X') && (s[len-1] == '0'))
{
break;
}
if (s[len] >= '0' && s[len] <= '9')
{
num = s[len] - '0';
}
else if (s[len] >= 'a' && s[len] <= 'f')
{
num = (s[len] - 'a') + 10;
}
else if (s[len] >= 'A' && s[len] <= 'F')
{
num = (s[len] - 'A') + 10;
}
else
{
continue;
}
hex += num * base;
base = base * 16;
}
return hex;
}
void
WINAPI
SummaryTraceEventListW(
TCHAR * SummaryBlock,
ULONG SizeSummaryBlock,
PLIST_ENTRY EventListHead
)
{
PLIST_ENTRY Head, Next;
PMOF_INFO pMofInfo;
TCHAR strGuid[MAXSTR];
TCHAR strName[MAXSTR];
TCHAR strBuffer[MAXSTR];
if (EventListHead == NULL)
{
return;
}
if (SummaryBlock == NULL)
{
return;
}
RtlZeroMemory(SummaryBlock, sizeof(TCHAR) * SizeSummaryBlock);
Head = EventListHead;
Next = Head->Flink;
while (Head != Next)
{
RtlZeroMemory(strName, 256);
RtlZeroMemory(strBuffer, 256);
pMofInfo = CONTAINING_RECORD(Next, MOF_INFO, Entry);
if (pMofInfo->EventCount > 0)
{
GuidToString((PTCHAR) strGuid, &pMofInfo->Guid);
MapGuidToName(&EventListHead, &pMofInfo->Guid, 0, strName);
_sntprintf(strBuffer,
MAXSTR,
_T("|%10d %-20s %-10s %36s|\n"),
pMofInfo->EventCount,
strName,
pMofInfo->strType ? pMofInfo->strType : _T("General"),
strGuid);
_tcscat(SummaryBlock, strBuffer);
if (_tcslen(SummaryBlock) >= SizeSummaryBlock)
{
return;
}
}
Next = Next->Flink;
}
}
PTCHAR
GuidToString(
PTCHAR s,
LPGUID piid
)
{
_stprintf(s, _T("%08x-%04x-%04x-%02x%02x-%02x%02x%02x%02x%02x%02x"),
piid->Data1,
piid->Data2,
piid->Data3,
piid->Data4[0],
piid->Data4[1],
piid->Data4[2],
piid->Data4[3],
piid->Data4[4],
piid->Data4[5],
piid->Data4[6],
piid->Data4[7]);
return(s);
}
// This routine is called by the WBEM interface routine for each property
// found for this Guid. The ITEM_DESC structure is allocted for each Property.
//
VOID
AddMofInfo(
PLIST_ENTRY HeadEventList,
const GUID * Guid,
LPTSTR strType,
ULONG typeIndex,
LPTSTR strDesc,
ITEM_TYPE ItemType,
TCHAR * ItemList,
ULONG typeOfType,
LPTSTR typeFormat
)
{
PITEM_DESC pItem;
PLIST_ENTRY pListHead;
PMOF_INFO pMofInfo;
if (strDesc == NULL)
{
return;
}
pItem = (PITEM_DESC) malloc(sizeof(ITEM_DESC));
if(pItem == NULL)return; //silent error
RtlZeroMemory(pItem, sizeof(ITEM_DESC));
pItem->strDescription =
(LPTSTR) malloc((_tcslen(strDesc) + 1) * sizeof(TCHAR));
if( pItem->strDescription == NULL ){
free(pItem);
return;
}
_tcscpy(pItem->strDescription, strDesc);
pItem->ItemType = ItemType;
pItem->ItemList = ItemList ;
pMofInfo = GetMofInfoHead(
(PLIST_ENTRY *) HeadEventList,
(LPGUID) Guid,
strType,
typeIndex,
typeOfType,
typeFormat,
FALSE);
if (pMofInfo != NULL)
{
pListHead = pMofInfo->ItemHeader;
InsertTailList(pListHead, &pItem->Entry);
}
else{
free(pItem->strDescription);
free(pItem);
}
}
void
WINAPI
CleanupTraceEventList(
PLIST_ENTRY HeadEventList
)
{
PLIST_ENTRY Head, Next;
PMOF_INFO pMofInfo;
if (HeadEventList == NULL)
{
return;
}
Head = HeadEventList;
Next = Head->Flink;
while (Head != Next)
{
pMofInfo = CONTAINING_RECORD(Next, MOF_INFO, Entry);
RemoveEntryList(&pMofInfo->Entry);
RemoveMofInfo(pMofInfo->ItemHeader);
free(pMofInfo->ItemHeader);
free(pMofInfo->strDescription);
free(pMofInfo->TypeFormat);
free(pMofInfo->strType);
Next = Next->Flink;
free(pMofInfo);
}
free(HeadEventList);
}
void
RemoveMofInfo(
PLIST_ENTRY pMofInfo
)
{
PLIST_ENTRY Head, Next;
PITEM_DESC pItem;
Head = pMofInfo;
Next = Head->Flink;
while (Head != Next)
{
pItem = CONTAINING_RECORD(Next, ITEM_DESC, Entry);
Next = Next->Flink;
RemoveEntryList(&pItem->Entry);
if (pItem->strDescription != NULL)
free(pItem->strDescription);
if (pItem->ItemList != NULL)
free(pItem->ItemList);
free(pItem);
}
}
// Now for some of the ASCII Stuff
//
SIZE_T
WINAPI
FormatTraceEventA(
PLIST_ENTRY HeadEventList,
PEVENT_TRACE pInEvent,
CHAR * EventBuf,
ULONG SizeEventBuf,
CHAR * pszMask
)
{
SIZE_T Status;
ULONG uSizeEventBuf;
TCHAR * EventBufW;
TCHAR * pszMaskW;
EventBufW = (TCHAR *) malloc(SizeEventBuf * sizeof(TCHAR) + 2);
if (EventBufW == (TCHAR *) NULL)
{
return -1;
}
pszMaskW = (TCHAR *) NULL;
if (pszMask != NULL && strlen(pszMask) != 0)
{
pszMaskW = (TCHAR *) malloc(strlen(pszMask) * sizeof(TCHAR));
if (pszMaskW == (TCHAR *) NULL)
{
free(EventBufW);
return -1;
}
RtlZeroMemory(pszMaskW, strlen(pszMask) * sizeof(TCHAR));
}
uSizeEventBuf = SizeEventBuf;
Status = FormatTraceEventW(
HeadEventList,
pInEvent,
EventBufW,
SizeEventBuf,
pszMaskW);
if (Status == 0)
{
free(EventBufW);
free(pszMaskW);
return -1;
}
RtlZeroMemory(EventBuf,uSizeEventBuf);
WideCharToMultiByte(
CP_ACP,
0,
EventBufW,
(int) _tcslen(EventBufW), // Truncate in Sundown!!
EventBuf,
uSizeEventBuf,
NULL,
NULL);
free(EventBufW);
free(pszMaskW);
return Status;
}
ULONG
WINAPI
GetTraceGuidsA(
CHAR * GuidFile,
PLIST_ENTRY * HeadEventList
)
{
INT Status;
TCHAR * GuidFileW;
SIZE_T len;
if ((len = strlen(GuidFile)) == 0)
{
return 0;
}
GuidFileW = malloc(sizeof(TCHAR) * strlen(GuidFile) + 2);
if (GuidFileW == NULL)
{
return 0;
}
if ((MultiByteToWideChar(
CP_ACP,
0,
GuidFile,
-1,
GuidFileW,
(int) strlen(GuidFile) * sizeof(TCHAR))) // Truncate in Sundown!!
== 0)
{
free(GuidFileW);
return 0;
}
Status = GetTraceGuidsW(GuidFileW, HeadEventList);
free (GuidFileW);
return Status;
}
void
WINAPI
SummaryTraceEventListA(
CHAR * SummaryBlock,
ULONG SizeSummaryBlock,
PLIST_ENTRY EventListhead
)
{
TCHAR * SummaryBlockW;
if(SizeSummaryBlock <= 0 || SizeSummaryBlock * sizeof(TCHAR) <= 0 )return;
SummaryBlockW = (TCHAR *) malloc(SizeSummaryBlock * sizeof(TCHAR));
if (SummaryBlockW == (TCHAR *)NULL)
return;
//RtlZeroMemory(SummaryBlock, SizeSummaryBlock);
RtlZeroMemory(SummaryBlockW, SizeSummaryBlock*sizeof(TCHAR));
SummaryTraceEventListW(
SummaryBlockW,
SizeSummaryBlock * ((ULONG)sizeof(TCHAR)),
EventListhead);
WideCharToMultiByte(
CP_ACP,
0,
SummaryBlockW,
(int)_tcslen(SummaryBlockW), // Truncate in Sundown!!
SummaryBlock,
SizeSummaryBlock,
NULL,
NULL);
free(SummaryBlockW);
}
void
WINAPI
GetTraceElapseTime(
__int64 * pElapseTime
)
{
* pElapseTime = ElapseTime;
}
ULONG
WINAPI
SetTraceFormatParameter(
PARAMETER_TYPE Parameter ,
PVOID ParameterValue
)
{
switch (Parameter) {
case ParameterINDENT:
bIndent = PtrToUlong(ParameterValue);
break;
case ParameterSEQUENCE:
bSequence = PtrToUlong(ParameterValue);
if (bSequence) {
STD_PREFIX = STD_PREFIX_SEQ;
} else {
STD_PREFIX = STD_PREFIX_NOSEQ;
}
break;
case ParameterGMT:
bGmt = PtrToUlong(ParameterValue);
break;
case ParameterTraceFormatSearchPath:
break;
}
return 0 ;
}
ULONG
WINAPI
GetTraceFormatParameter(
PARAMETER_TYPE Parameter ,
PVOID ParameterValue
)
{
switch (Parameter) {
case ParameterINDENT: return bIndent;
case ParameterSEQUENCE: return bSequence;
case ParameterGMT: return bGmt;
}
return 0 ;
}
#ifdef __cplusplus
}
#endif