base/applications/mscutils/eventvwr/eventvwr.c

   1 /*
   2  *  ReactOS Win32 Applications
   3  *  Copyright (C) 2007 ReactOS Team
   4  *
   5  *  This program is free software; you can redistribute it and/or modify
   6  *  it under the terms of the GNU General Public License as published by
   7  *  the Free Software Foundation; either version 2 of the License, or
   8  *  (at your option) any later version.
   9  *
  10  *  This program is distributed in the hope that it will be useful,
  11  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  12  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  13  *  GNU General Public License for more details.
  14  *
  15  *  You should have received a copy of the GNU General Public License along
  16  *  with this program; if not, write to the Free Software Foundation, Inc.,
  17  *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  18  */
  19 /*
  20  * COPYRIGHT : See COPYING in the top level directory
  21  * PROJECT   : Event Log Viewer
  22  * FILE      : eventvwr.c
  23  * PROGRAMMER: Marc Piulachs (marc.piulachs at codexchange [dot] net)
  24  */
  25
  26 #include "eventvwr.h"
  27 #include <windows.h>
  28 #include <commctrl.h>
  29 #include <stdio.h>
  30 #include <time.h>
  31
  32 #if _MSC_VER
  33     #pragma warning(disable: 4996)   /* 'strdup' was declared deprecated */
  34     #define _CRT_SECURE_NO_DEPRECATE /* all deprecated unsafe string functions */
  35 #endif
  36
  37 static const LPWSTR EVENT_SOURCE_APPLICATION = L"Application";
  38 static const LPWSTR EVENT_SOURCE_SECURITY    = L"Security";
  39 static const LPWSTR EVENT_SOURCE_SYSTEM      = L"System";
  40 static const WCHAR szWindowClass[]          = L"EVENTVWR"; /* the main window class name*/
  41
  42 //MessageFile message buffer size
  43 #define EVENT_MESSAGE_EVENTTEXT_BUFFER  1024*10
  44 #define EVENT_MESSAGE_FILE_BUFFER       1024*10
  45 #define EVENT_DLL_SEPARATOR             L";"
  46 #define EVENT_MESSAGE_FILE              L"EventMessageFile"
  47 #define EVENT_CATEGORY_MESSAGE_FILE     L"CategoryMessageFile"
  48 #define EVENT_PARAMETER_MESSAGE_FILE    L"ParameterMessageFile"
  49
  50 #define MAX_LOADSTRING 255
  51
  52 /* Globals */
  53 HINSTANCE hInst;                /* current instance */
  54 WCHAR szTitle[MAX_LOADSTRING];  /* The title bar text */
  55 HWND hwndMainWindow;            /* Main window */
  56 HWND hwndListView;              /* ListView control */
  57 HWND hwndStatus;                /* Status bar */
  58 PEVENTLOGRECORD *g_RecordPtrs = NULL;
  59 DWORD g_TotalRecords = 0;
  60
  61 LPWSTR lpSourceLogName = NULL;
  62 LPWSTR lpComputerName  = NULL;
  63
  64 /* Forward declarations of functions included in this code module: */
  65 ATOM MyRegisterClass(HINSTANCE hInstance);
  66 BOOL InitInstance(HINSTANCE, int);
  67 LRESULT CALLBACK WndProc(HWND, UINT, WPARAM, LPARAM);
  68 INT_PTR CALLBACK About(HWND, UINT, WPARAM, LPARAM);
  69 INT_PTR CALLBACK EventDetails(HWND, UINT, WPARAM, LPARAM);
  70 static INT_PTR CALLBACK StatusMessageWindowProc (HWND, UINT, WPARAM, LPARAM);
  71
  72
  73 int APIENTRY
  74 wWinMain(HINSTANCE hInstance,
  75           HINSTANCE hPrevInstance,
  76           LPWSTR    lpCmdLine,
  77           int       nCmdShow)
  78 {
  79     MSG msg;
  80     HACCEL hAccelTable;
  81     INITCOMMONCONTROLSEX iccx;
  82
  83     UNREFERENCED_PARAMETER(hPrevInstance);
  84     UNREFERENCED_PARAMETER(lpCmdLine);
  85
  86     /* Whenever any of the common controls are used in your app,
  87      * you must call InitCommonControlsEx() to register the classes
  88      * for those controls. */
  89     iccx.dwSize = sizeof(INITCOMMONCONTROLSEX);
  90     iccx.dwICC = ICC_LISTVIEW_CLASSES;
  91     InitCommonControlsEx(&iccx);
  92
  93     /* Initialize global strings */
  94     LoadStringW(hInstance, IDS_APP_TITLE, szTitle, MAX_LOADSTRING);
  95     MyRegisterClass(hInstance);
  96
  97     /* Perform application initialization: */
  98     if (!InitInstance(hInstance, nCmdShow))
  99     {
 100         return FALSE;
 101     }
 102
 103     hAccelTable = LoadAccelerators(hInstance, MAKEINTRESOURCE(IDC_EVENTVWR));
 104
 105     /* Main message loop: */
 106     while (GetMessageW(&msg, NULL, 0, 0))
 107     {
 108         if (!TranslateAcceleratorW(msg.hwnd, hAccelTable, &msg))
 109         {
 110             TranslateMessage(&msg);
 111             DispatchMessage(&msg);
 112         }
 113     }
 114
 115     return (int)msg.wParam;
 116 }
 117
 118 static void FreeRecords(void)
 119 {
 120     DWORD iIndex;
 121
 122     if (!g_RecordPtrs)
 123         return;
 124
 125     for (iIndex = 0; iIndex < g_TotalRecords; iIndex++)
 126         HeapFree(GetProcessHeap(), 0, (PEVENTLOGRECORD) g_RecordPtrs[iIndex]);
 127     HeapFree(GetProcessHeap(), 0, (PEVENTLOGRECORD) g_RecordPtrs);
 128     g_RecordPtrs = NULL;
 129 }
 130
 131 VOID
 132 EventTimeToSystemTime(DWORD EventTime,
 133                       SYSTEMTIME *pSystemTime)
 134 {
 135     SYSTEMTIME st1970 = { 1970, 1, 0, 1, 0, 0, 0, 0 };
 136     FILETIME ftLocal;
 137     union
 138     {
 139         FILETIME ft;
 140         ULONGLONG ll;
 141     } u1970, uUCT;
 142
 143     uUCT.ft.dwHighDateTime = 0;
 144     uUCT.ft.dwLowDateTime = EventTime;
 145     SystemTimeToFileTime(&st1970, &u1970.ft);
 146     uUCT.ll = uUCT.ll * 10000000 + u1970.ll;
 147     FileTimeToLocalFileTime(&uUCT.ft, &ftLocal);
 148     FileTimeToSystemTime(&ftLocal, pSystemTime);
 149 }
 150
 151
 152 void
 153 TrimNulls(LPWSTR s)
 154 {
 155     WCHAR *c;
 156
 157     if (s != NULL)
 158     {
 159         c = s + wcslen(s) - 1;
 160         while (c >= s && iswspace(*c))
 161             --c;
 162         *++c = L'\0';
 163     }
 164 }
 165
 166
 167 BOOL
 168 GetEventMessageFileDLL(IN LPCWSTR lpLogName,
 169                        IN LPCWSTR SourceName,
 170                        IN LPCWSTR EntryName,
 171                        OUT LPWSTR ExpandedName)
 172 {
 173     DWORD dwSize;
 174     BYTE szModuleName[MAX_PATH];
 175     WCHAR szKeyName[MAX_PATH];
 176     HKEY hAppKey = NULL;
 177     HKEY hSourceKey = NULL;
 178     BOOL bReturn = FALSE;
 179
 180     wcscpy(szKeyName, L"SYSTEM\\CurrentControlSet\\Services\\EventLog\\");
 181     wcscat(szKeyName, lpLogName);
 182
 183     if (RegOpenKeyExW(HKEY_LOCAL_MACHINE,
 184                      szKeyName,
 185                      0,
 186                      KEY_READ,
 187                      &hAppKey) == ERROR_SUCCESS)
 188     {
 189         if (RegOpenKeyExW(hAppKey,
 190                          SourceName,
 191                          0,
 192                          KEY_READ,
 193                          &hSourceKey) == ERROR_SUCCESS)
 194         {
 195             dwSize = MAX_PATH;
 196             if (RegQueryValueExW(hSourceKey,
 197                                 EntryName,
 198                                 NULL,
 199                                 NULL,
 200                                 (LPBYTE)szModuleName,
 201                                 &dwSize) == ERROR_SUCCESS)
 202             {
 203                 /* Returns a string containing the requested substituted environment variable. */
 204                 ExpandEnvironmentStringsW((LPCWSTR)szModuleName, ExpandedName, MAX_PATH);
 205
 206                 /* Succesfull */
 207                 bReturn = TRUE;
 208             }
 209         }
 210     }
 211     else
 212     {
 213         MessageBoxW(NULL,
 214                    L"Registry access failed!",
 215                    L"Event Log",
 216                    MB_OK | MB_ICONINFORMATION);
 217     }
 218
 219     if (hSourceKey != NULL)
 220         RegCloseKey(hSourceKey);
 221
 222     if (hAppKey != NULL)
 223         RegCloseKey(hAppKey);
 224
 225     return bReturn;
 226 }
 227
 228
 229 BOOL
 230 GetEventCategory(IN LPCWSTR KeyName,
 231                  IN LPCWSTR SourceName,
 232                  IN EVENTLOGRECORD *pevlr,
 233                  OUT LPWSTR CategoryName)
 234 {
 235     HANDLE hLibrary = NULL;
 236     WCHAR szMessageDLL[MAX_PATH];
 237     LPVOID lpMsgBuf = NULL;
 238
 239     if (GetEventMessageFileDLL (KeyName, SourceName, EVENT_CATEGORY_MESSAGE_FILE , szMessageDLL))
 240     {
 241         hLibrary = LoadLibraryExW(szMessageDLL,
 242                                  NULL,
 243                                  DONT_RESOLVE_DLL_REFERENCES | LOAD_LIBRARY_AS_DATAFILE);
 244         if (hLibrary != NULL)
 245         {
 246             /* Retrieve the message string. */
 247             if (FormatMessageW(FORMAT_MESSAGE_FROM_SYSTEM | FORMAT_MESSAGE_ALLOCATE_BUFFER | FORMAT_MESSAGE_FROM_HMODULE | FORMAT_MESSAGE_ARGUMENT_ARRAY,
 248                               hLibrary,
 249                               pevlr->EventCategory,
 250                               MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT),
 251                               (LPWSTR)&lpMsgBuf,
 252                               EVENT_MESSAGE_FILE_BUFFER,
 253                               NULL) != 0)
 254             {
 255                 if (lpMsgBuf)
 256                 {
 257                     /* Trim the string */
 258                     TrimNulls((LPWSTR)lpMsgBuf);
 259
 260                     /* Copy the category name */
 261                     wcscpy(CategoryName, (LPCWSTR)lpMsgBuf);
 262                 }
 263                 else
 264                 {
 265                     wcscpy(CategoryName, (LPCWSTR)lpMsgBuf);
 266                 }
 267             }
 268             else
 269             {
 270                 wcscpy(CategoryName, L"None");
 271             }
 272
 273             if (hLibrary != NULL)
 274                 FreeLibrary(hLibrary);
 275
 276             /* Free the buffer allocated by FormatMessage */
 277             if (lpMsgBuf)
 278                 LocalFree(lpMsgBuf);
 279
 280             return TRUE;
 281         }
 282     }
 283
 284     wcscpy(CategoryName, L"None");
 285
 286     return FALSE;
 287 }
 288
 289
 290 BOOL
 291 GetEventMessage(IN LPCWSTR KeyName,
 292                 IN LPCWSTR SourceName,
 293                 IN EVENTLOGRECORD *pevlr,
 294                 OUT LPWSTR EventText)
 295 {
 296     DWORD i;
 297     HANDLE hLibrary = NULL;
 298     WCHAR SourceModuleName[1000];
 299     WCHAR ParameterModuleName[1000];
 300     LPWSTR lpMsgBuf = NULL;
 301     WCHAR szStringIDNotFound[MAX_LOADSTRING];
 302     LPWSTR szDll;
 303     LPWSTR szMessage;
 304     LPWSTR *szArguments;
 305     BOOL bDone = FALSE;
 306
 307     /* TODO : GetEventMessageFileDLL can return a comma separated list of DLLs */
 308     if (GetEventMessageFileDLL (KeyName, SourceName, EVENT_MESSAGE_FILE, SourceModuleName))
 309     {
 310         /* Get the event message */
 311         szMessage = (LPWSTR)((LPBYTE)pevlr + pevlr->StringOffset);
 312
 313         /* Allocate space for parameters */
 314         szArguments = (LPWSTR*)malloc(sizeof(LPVOID) * pevlr->NumStrings);
 315         if (!szArguments)
 316         {
 317             return FALSE;
 318         }
 319
 320         for (i = 0; i < pevlr->NumStrings ; i++)
 321         {
 322             if (wcsstr(szMessage , L"%%"))
 323             {
 324                 if (GetEventMessageFileDLL(KeyName, SourceName, EVENT_PARAMETER_MESSAGE_FILE, ParameterModuleName))
 325                 {
 326                     /* Not yet support for reading messages from parameter message DLL */
 327                 }
 328
 329                 szArguments[i] = szMessage;
 330                 szMessage += wcslen(szMessage) + 1;
 331             }
 332             else
 333             {
 334                 szArguments[i] = szMessage;
 335                 szMessage += wcslen(szMessage) + 1;
 336             }
 337         }
 338
 339         szDll = wcstok(SourceModuleName, EVENT_DLL_SEPARATOR);
 340         while ((szDll != NULL) && (!bDone))
 341         {
 342             hLibrary = LoadLibraryExW(szDll,
 343                                      NULL,
 344                                      DONT_RESOLVE_DLL_REFERENCES | LOAD_LIBRARY_AS_DATAFILE);
 345             if (hLibrary == NULL)
 346             {
 347                 /* The DLL could not be loaded try the next one (if any) */
 348                 szDll = wcstok(NULL, EVENT_DLL_SEPARATOR);
 349             }
 350             else
 351             {
 352                 /* Retrieve the message string. */
 353                 if (FormatMessageW(FORMAT_MESSAGE_FROM_SYSTEM |
 354                                   FORMAT_MESSAGE_ALLOCATE_BUFFER |
 355                                   FORMAT_MESSAGE_FROM_HMODULE |
 356                                   FORMAT_MESSAGE_ARGUMENT_ARRAY,
 357                                   hLibrary,
 358                                   pevlr->EventID,
 359                                   MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT),
 360                                   (LPWSTR)&lpMsgBuf,
 361                                   0,
 362                                   (va_list*)szArguments) == 0)
 363                 {
 364                     /* We haven't found the string , get next DLL (if any) */
 365                     szDll = wcstok(NULL, EVENT_DLL_SEPARATOR);
 366                 }
 367                 else
 368                 {
 369                     if (lpMsgBuf)
 370                     {
 371                         /* The ID was found and the message was formated */
 372                         bDone = TRUE;
 373
 374                         /* Trim the string */
 375                         TrimNulls((LPWSTR)lpMsgBuf);
 376
 377                         /* Copy the event text */
 378                         wcscpy(EventText ,lpMsgBuf);
 379                     }
 380                 }
 381
 382                 FreeLibrary(hLibrary);
 383             }
 384         }
 385
 386         if (!bDone)
 387         {
 388             LoadStringW(hInst, IDC_EVENTSTRINGIDNOTFOUND, szStringIDNotFound, MAX_LOADSTRING);
 389             swprintf(EventText, szStringIDNotFound, (DWORD)(pevlr->EventID & 0xFFFF), SourceName);
 390         }
 391
 392         free(szArguments);
 393
 394         /* No more dlls to try, return result */
 395         return bDone;
 396     }
 397
 398     LoadStringW(hInst, IDC_EVENTSTRINGIDNOTFOUND, szStringIDNotFound, MAX_LOADSTRING);
 399     swprintf(EventText, szStringIDNotFound, (DWORD)(pevlr->EventID & 0xFFFF), SourceName);
 400
 401     return FALSE;
 402 }
 403
 404
 405 VOID
 406 GetEventType(IN WORD dwEventType,
 407              OUT LPWSTR eventTypeText)
 408 {
 409     switch (dwEventType)
 410     {
 411         case EVENTLOG_ERROR_TYPE:
 412             LoadStringW(hInst, IDC_EVENTLOG_ERROR_TYPE, eventTypeText, MAX_LOADSTRING);
 413             break;
 414         case EVENTLOG_WARNING_TYPE:
 415             LoadStringW(hInst, IDC_EVENTLOG_WARNING_TYPE, eventTypeText, MAX_LOADSTRING);
 416             break;
 417         case EVENTLOG_INFORMATION_TYPE:
 418             LoadStringW(hInst, IDC_EVENTLOG_INFORMATION_TYPE, eventTypeText, MAX_LOADSTRING);
 419             break;
 420         case EVENTLOG_AUDIT_SUCCESS:
 421             LoadStringW(hInst, IDC_EVENTLOG_AUDIT_SUCCESS, eventTypeText, MAX_LOADSTRING);
 422             break;
 423         case EVENTLOG_AUDIT_FAILURE:
 424             LoadStringW(hInst, IDC_EVENTLOG_AUDIT_FAILURE, eventTypeText, MAX_LOADSTRING);
 425             break;
 426         case EVENTLOG_SUCCESS:
 427             LoadStringW(hInst, IDC_EVENTLOG_SUCCESS, eventTypeText, MAX_LOADSTRING);
 428             break;
 429         default:
 430             LoadStringW(hInst, IDC_EVENTLOG_UNKNOWN_TYPE, eventTypeText, MAX_LOADSTRING);
 431             break;
 432     }
 433 }
 434
 435 BOOL
 436 GetEventUserName(EVENTLOGRECORD *pelr,
 437                  OUT LPWSTR pszUser)
 438 {
 439     PSID lpSid;
 440     WCHAR szName[1024];
 441     WCHAR szDomain[1024];
 442     SID_NAME_USE peUse;
 443     DWORD cbName = 1024;
 444     DWORD cbDomain = 1024;
 445
 446     /* Point to the SID. */
 447     lpSid = (PSID)((LPBYTE)pelr + pelr->UserSidOffset);
 448
 449     /* User SID */
 450     if (pelr->UserSidLength > 0)
 451     {
 452         if (LookupAccountSidW(NULL,
 453                              lpSid,
 454                              szName,
 455                              &cbName,
 456                              szDomain,
 457                              &cbDomain,
 458                              &peUse))
 459         {
 460             wcscpy(pszUser, szName);
 461             return TRUE;
 462         }
 463     }
 464
 465     return FALSE;
 466 }
 467
 468
 469 static DWORD WINAPI
 470 ShowStatusMessageThread(IN LPVOID lpParameter)
 471 {
 472     HWND *phWnd = (HWND *)lpParameter;
 473     HWND hWnd;
 474     MSG Msg;
 475
 476     hWnd = CreateDialogParam(hInst,
 477                              MAKEINTRESOURCE(IDD_PROGRESSBOX),
 478                              GetDesktopWindow(),
 479                              StatusMessageWindowProc,
 480                              (LPARAM)NULL);
 481     if (!hWnd)
 482         return 0;
 483
 484     *phWnd = hWnd;
 485
 486     ShowWindow(hWnd, SW_SHOW);
 487
 488     /* Message loop for the Status window */
 489     while (GetMessage(&Msg, NULL, 0, 0))
 490     {
 491         TranslateMessage(&Msg);
 492         DispatchMessage(&Msg);
 493     }
 494
 495     return 0;
 496 }
 497
 498
 499 BOOL
 500 QueryEventMessages(LPWSTR lpMachineName,
 501                    LPWSTR lpLogName)
 502 {
 503     HWND hwndDlg;
 504     HANDLE hEventLog;
 505     EVENTLOGRECORD *pevlr;
 506     DWORD dwRead, dwNeeded, dwThisRecord, dwTotalRecords = 0, dwCurrentRecord = 1, dwRecordsToRead = 0, dwFlags;
 507     LPWSTR lpSourceName;
 508     LPWSTR lpComputerName;
 509     LPWSTR lpEventStr;
 510     LPWSTR lpData;
 511     BOOL bResult = TRUE; /* Read succeeded. */
 512
 513     WCHAR szWindowTitle[MAX_PATH];
 514     WCHAR szStatusText[MAX_PATH];
 515     WCHAR szLocalDate[MAX_PATH];
 516     WCHAR szLocalTime[MAX_PATH];
 517     WCHAR szEventID[MAX_PATH];
 518     WCHAR szEventTypeText[MAX_PATH];
 519     WCHAR szCategoryID[MAX_PATH];
 520     WCHAR szUsername[MAX_PATH];
 521     WCHAR szEventText[EVENT_MESSAGE_FILE_BUFFER];
 522     WCHAR szCategory[MAX_PATH];
 523
 524     SYSTEMTIME time;
 525     LVITEMW lviEventItem;
 526
 527     dwFlags = EVENTLOG_FORWARDS_READ | EVENTLOG_SEQUENTIAL_READ;
 528
 529     lpSourceLogName = lpLogName;
 530     lpComputerName = lpMachineName;
 531
 532     /* Open the event log. */
 533     hEventLog = OpenEventLogW(lpMachineName,
 534                              lpLogName);
 535     if (hEventLog == NULL)
 536     {
 537         MessageBoxW(NULL,
 538                    L"Could not open the event log.",
 539                    L"Event Log",
 540                    MB_OK | MB_ICONINFORMATION);
 541         return FALSE;
 542     }
 543
 544     /* Disable listview redraw */
 545     SendMessage(hwndListView, WM_SETREDRAW, FALSE, 0);
 546
 547     /* Clear the list view */
 548     (void)ListView_DeleteAllItems (hwndListView);
 549     FreeRecords();
 550
 551     GetOldestEventLogRecord(hEventLog, &dwThisRecord);
 552
 553     /* Get the total number of event log records. */
 554     GetNumberOfEventLogRecords (hEventLog , &dwTotalRecords);
 555     g_TotalRecords = dwTotalRecords;
 556
 557     g_RecordPtrs = HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, dwTotalRecords * sizeof(PEVENTLOGRECORD));
 558
 559     /* If we have at least 1000 records show the waiting dialog */
 560     if (dwTotalRecords > 1000)
 561     {
 562         CreateThread(NULL,
 563                      0,
 564                      ShowStatusMessageThread,
 565                      (LPVOID)&hwndDlg,
 566                      0,
 567                      NULL);
 568     }
 569
 570     while (dwCurrentRecord < dwTotalRecords)
 571     {
 572         pevlr = (EVENTLOGRECORD*) HeapAlloc(GetProcessHeap(), 0, sizeof(EVENTLOGRECORD) * dwTotalRecords);
 573         g_RecordPtrs[dwCurrentRecord] = pevlr;
 574
 575         bResult = ReadEventLog(hEventLog,  // Event log handle
 576                                dwFlags,    // Sequential read
 577                                0,          // Ignored for sequential read
 578                                pevlr,      // Pointer to buffer
 579                                sizeof(EVENTLOGRECORD),   // Size of buffer
 580                                &dwRead,    // Number of bytes read
 581                                &dwNeeded); // Bytes in the next record
 582         if((!bResult) && (GetLastError () == ERROR_INSUFFICIENT_BUFFER))
 583         {
 584             HeapFree(GetProcessHeap(), 0, pevlr);
 585             pevlr = (EVENTLOGRECORD*) HeapAlloc(GetProcessHeap(), 0, dwNeeded);
 586             g_RecordPtrs[dwCurrentRecord] = pevlr;
 587
 588             ReadEventLogW(hEventLog,  // event log handle
 589                          dwFlags,    // read flags
 590                          0,          // offset; default is 0
 591                          pevlr,      // pointer to buffer
 592                          dwNeeded,   // size of buffer
 593                          &dwRead,    // number of bytes read
 594                          &dwNeeded); // bytes in next record
 595         }
 596
 597         while (dwRead > 0)
 598         {
 599             wcscpy(szUsername , L"N/A");
 600             wcscpy(szEventText , L"N/A");
 601             wcscpy(szCategory , L"None");
 602
 603             // Get the event source name.
 604             lpSourceName = (LPWSTR)((LPBYTE)pevlr + sizeof(EVENTLOGRECORD));
 605
 606             // Get the computer name
 607             lpComputerName = (LPWSTR)((LPBYTE)pevlr + sizeof(EVENTLOGRECORD) + (wcslen(lpSourceName) + 1) * sizeof(WCHAR));
 608
 609             // This ist the data section of the current event
 610             lpData = (LPWSTR)((LPBYTE)pevlr + pevlr->DataOffset);
 611
 612             // This is the text of the current event
 613             lpEventStr = (LPWSTR)((LPBYTE)pevlr + pevlr->StringOffset);
 614
 615             // Compute the event type
 616             EventTimeToSystemTime(pevlr->TimeWritten, &time);
 617
 618             // Get the username that generated the event
 619             GetEventUserName(pevlr, szUsername);
 620
 621             GetDateFormatW(LOCALE_USER_DEFAULT, DATE_SHORTDATE, &time, NULL, szLocalDate, MAX_PATH);
 622             GetTimeFormatW(LOCALE_USER_DEFAULT, TIME_NOSECONDS, &time, NULL, szLocalTime, MAX_PATH);
 623
 624             GetEventType(pevlr->EventType, szEventTypeText);
 625             GetEventCategory(lpLogName, lpSourceName, pevlr, szCategory);
 626
 627             swprintf(szEventID, L"%u", (DWORD)(pevlr->EventID & 0xFFFF));
 628             swprintf(szCategoryID, L"%u", (DWORD)(pevlr->EventCategory));
 629
 630             lviEventItem.mask = LVIF_IMAGE | LVIF_TEXT | LVIF_PARAM;
 631             lviEventItem.iItem = 0;
 632             lviEventItem.iSubItem = 0;
 633             lviEventItem.lParam = (LPARAM)pevlr;
 634             lviEventItem.pszText = szEventTypeText;
 635
 636             switch (pevlr->EventType)
 637             {
 638                 case EVENTLOG_ERROR_TYPE:
 639                     lviEventItem.iImage = 2;
 640                     break;
 641
 642                 case EVENTLOG_AUDIT_FAILURE:
 643                     lviEventItem.iImage = 2;
 644                     break;
 645
 646                 case EVENTLOG_WARNING_TYPE:
 647                     lviEventItem.iImage = 1;
 648                     break;
 649
 650                 case EVENTLOG_INFORMATION_TYPE:
 651                     lviEventItem.iImage = 0;
 652                     break;
 653
 654                 case EVENTLOG_AUDIT_SUCCESS:
 655                     lviEventItem.iImage = 0;
 656                     break;
 657
 658                 case EVENTLOG_SUCCESS:
 659                     lviEventItem.iImage = 0;
 660                     break;
 661             }
 662
 663             lviEventItem.iItem = ListView_InsertItem(hwndListView, &lviEventItem);
 664
 665             ListView_SetItemText(hwndListView, lviEventItem.iItem, 1, szLocalDate);
 666             ListView_SetItemText(hwndListView, lviEventItem.iItem, 2, szLocalTime);
 667             ListView_SetItemText(hwndListView, lviEventItem.iItem, 3, lpSourceName);
 668             ListView_SetItemText(hwndListView, lviEventItem.iItem, 4, szCategory);
 669             ListView_SetItemText(hwndListView, lviEventItem.iItem, 5, szEventID);
 670             ListView_SetItemText(hwndListView, lviEventItem.iItem, 6, szUsername); //User
 671             ListView_SetItemText(hwndListView, lviEventItem.iItem, 7, lpComputerName); //Computer
 672             ListView_SetItemText(hwndListView, lviEventItem.iItem, 8, lpData); //Event Text
 673
 674             dwRead -= pevlr->Length;
 675             pevlr = (EVENTLOGRECORD *)((LPBYTE) pevlr + pevlr->Length);
 676         }
 677
 678         dwRecordsToRead--;
 679         dwCurrentRecord++;
 680     }
 681
 682     // All events loaded
 683     EndDialog(hwndDlg, 0);
 684
 685     swprintf(szWindowTitle, L"%s - %s Log on \\\\%s", szTitle, lpLogName, lpComputerName);
 686     swprintf(szStatusText, L"%s has %d event(s)", lpLogName, dwTotalRecords);
 687
 688     // Update the status bar
 689     SendMessageW(hwndStatus, SB_SETTEXT, (WPARAM)0, (LPARAM)szStatusText);
 690
 691     // Set the window title
 692     SetWindowTextW(hwndMainWindow, szWindowTitle);
 693
 694     // Resume list view redraw
 695     SendMessageW(hwndListView, WM_SETREDRAW, TRUE, 0);
 696
 697     // Close the event log.
 698     CloseEventLog(hEventLog);
 699
 700     return TRUE;
 701 }
 702
 703
 704 VOID
 705 Refresh(VOID)
 706 {
 707     QueryEventMessages(lpComputerName,
 708                        lpSourceLogName);
 709 }
 710
 711
 712 //
 713 //  FUNCTION: MyRegisterClass()
 714 //
 715 //  PURPOSE: Registers the window class.
 716 //
 717 //  COMMENTS:
 718 //
 719 //    This function and its usage are only necessary if you want this code
 720 //    to be compatible with Win32 systems prior to the 'RegisterClassEx'
 721 //    function that was added to Windows 95. It is important to call this function
 722 //    so that the application will get 'well formed' small icons associated
 723 //    with it.
 724 //
 725 ATOM
 726 MyRegisterClass(HINSTANCE hInstance)
 727 {
 728     WNDCLASSEXW wcex;
 729
 730     wcex.cbSize = sizeof(WNDCLASSEX);
 731
 732     wcex.style = CS_HREDRAW | CS_VREDRAW;
 733     wcex.lpfnWndProc = WndProc;
 734     wcex.cbClsExtra = 0;
 735     wcex.cbWndExtra = 0;
 736     wcex.hInstance = hInstance;
 737     wcex.hIcon = LoadIcon(hInstance, MAKEINTRESOURCE(IDI_EVENTVWR));
 738     wcex.hCursor = LoadCursor(NULL, IDC_ARROW);
 739     wcex.hbrBackground = (HBRUSH)(COLOR_WINDOW + 1);
 740     wcex.lpszMenuName = MAKEINTRESOURCE(IDC_EVENTVWR);
 741     wcex.lpszClassName = szWindowClass;
 742     wcex.hIconSm = LoadIcon(wcex.hInstance, MAKEINTRESOURCE(IDI_SMALL));
 743
 744     return RegisterClassExW(&wcex);
 745 }
 746
 747
 748 //
 749 //   FUNCTION: InitInstance(HINSTANCE, int)
 750 //
 751 //   PURPOSE: Saves instance handle and creates main window
 752 //
 753 //   COMMENTS:
 754 //
 755 //        In this function, we save the instance handle in a global variable and
 756 //        create and display the main program window.
 757 //
 758 BOOL
 759 InitInstance(HINSTANCE hInstance,
 760              int nCmdShow)
 761 {
 762     HIMAGELIST hSmall;
 763     LVCOLUMNW lvc = {0};
 764
 765     hInst = hInstance; // Store instance handle in our global variable
 766
 767     hwndMainWindow = CreateWindowW(szWindowClass,
 768                                   szTitle,
 769                                   WS_OVERLAPPEDWINDOW,
 770                                   CW_USEDEFAULT, 0, CW_USEDEFAULT, 0,
 771                                   NULL,
 772                                   NULL,
 773                                   hInstance,
 774                                   NULL);
 775     if (!hwndMainWindow)
 776     {
 777         return FALSE;
 778     }
 779
 780     hwndStatus = CreateWindowExW(0,                                  // no extended styles
 781                                 STATUSCLASSNAMEW,                    // status bar
 782                                 L"Done.",                     // no text
 783                                 WS_CHILD | WS_BORDER | WS_VISIBLE,  // styles
 784                                 0, 0, 0, 0,                         // x, y, cx, cy
 785                                 hwndMainWindow,                     // parent window
 786                                 (HMENU)100,                         // window ID
 787                                 hInstance,                          // instance
 788                                 NULL);                              // window data
 789
 790     // Create our listview child window.  Note that I use WS_EX_CLIENTEDGE
 791     // and WS_BORDER to create the normal "sunken" look.  Also note that
 792     // LVS_EX_ styles cannot be set in CreateWindowEx().
 793     hwndListView = CreateWindowExW(WS_EX_CLIENTEDGE,
 794                                   WC_LISTVIEWW,
 795                                   L"",
 796                                   LVS_SHOWSELALWAYS | WS_CHILD | WS_VISIBLE | LVS_REPORT,
 797                                   0,
 798                                   0,
 799                                   243,
 800                                   200,
 801                                   hwndMainWindow,
 802                                   NULL,
 803                                   hInstance,
 804                                   NULL);
 805
 806     // After the ListView is created, we can add extended list view styles.
 807     (void)ListView_SetExtendedListViewStyle (hwndListView, LVS_EX_FULLROWSELECT);
 808
 809     // Create the ImageList
 810     hSmall = ImageList_Create(GetSystemMetrics(SM_CXSMICON),
 811                               GetSystemMetrics(SM_CYSMICON),
 812                               ILC_MASK,
 813                               1,
 814                               1);
 815
 816     // Add event type icons to ImageList
 817     ImageList_AddIcon (hSmall, LoadIcon(hInstance, MAKEINTRESOURCE(IDI_INFORMATIONICON)));
 818     ImageList_AddIcon (hSmall, LoadIcon(hInstance, MAKEINTRESOURCE(IDI_WARNINGICON)));
 819     ImageList_AddIcon (hSmall, LoadIcon(hInstance, MAKEINTRESOURCE(IDI_ERRORICON)));
 820
 821     // Assign ImageList to List View
 822     (void)ListView_SetImageList (hwndListView, hSmall, LVSIL_SMALL);
 823
 824     // Now set up the listview with its columns.
 825     lvc.mask = LVCF_TEXT | LVCF_WIDTH;
 826     lvc.cx = 90;
 827     lvc.pszText = L"Type";
 828     (void)ListView_InsertColumn(hwndListView, 0, &lvc);
 829
 830     lvc.cx = 70;
 831     lvc.pszText = L"Date";
 832     (void)ListView_InsertColumn(hwndListView, 1, &lvc);
 833
 834     lvc.cx = 70;
 835     lvc.pszText = L"Time";
 836     (void)ListView_InsertColumn(hwndListView, 2, &lvc);
 837
 838     lvc.cx = 150;
 839     lvc.pszText = L"Source";
 840     (void)ListView_InsertColumn(hwndListView, 3, &lvc);
 841
 842     lvc.cx = 100;
 843     lvc.pszText = L"Category";
 844     (void)ListView_InsertColumn(hwndListView, 4, &lvc);
 845
 846     lvc.cx = 60;
 847     lvc.pszText = L"Event";
 848     (void)ListView_InsertColumn(hwndListView, 5, &lvc);
 849
 850     lvc.cx = 120;
 851     lvc.pszText = L"User";
 852     (void)ListView_InsertColumn(hwndListView, 6, &lvc);
 853
 854     lvc.cx = 100;
 855     lvc.pszText = L"Computer";
 856     (void)ListView_InsertColumn(hwndListView, 7, &lvc);
 857
 858     lvc.cx = 0;
 859     lvc.pszText = L"Event Data";
 860     (void)ListView_InsertColumn(hwndListView, 8, &lvc);
 861
 862     ShowWindow(hwndMainWindow, nCmdShow);
 863     UpdateWindow(hwndMainWindow);
 864
 865     QueryEventMessages(lpComputerName,            // Use the local computer.
 866                        EVENT_SOURCE_APPLICATION); // The event log category
 867
 868     return TRUE;
 869 }
 870
 871
 872 //
 873 //  FUNCTION: WndProc(HWND, UINT, WPARAM, LPARAM)
 874 //
 875 //  PURPOSE:  Processes messages for the main window.
 876 //
 877 //  WM_COMMAND  - process the application menu
 878 //  WM_PAINT    - Paint the main window
 879 //  WM_DESTROY  - post a quit message and return
 880 //
 881 //
 882 LRESULT CALLBACK
 883 WndProc(HWND hWnd, UINT message, WPARAM wParam, LPARAM lParam)
 884 {
 885     RECT rect;
 886     NMHDR *hdr;
 887
 888     switch (message)
 889     {
 890         case WM_CREATE:
 891             CheckMenuRadioItem(GetMenu(hWnd),
 892                                ID_LOG_APPLICATION,
 893                                ID_LOG_SYSTEM,
 894                                ID_LOG_APPLICATION,
 895                                MF_BYCOMMAND);
 896             break;
 897
 898         case WM_NOTIFY:
 899             switch (((LPNMHDR)lParam)->code)
 900             {
 901                 case NM_DBLCLK :
 902                     hdr = (NMHDR FAR*)lParam;
 903                     if (hdr->hwndFrom == hwndListView)
 904                     {
 905                         LPNMITEMACTIVATE lpnmitem = (LPNMITEMACTIVATE)lParam;
 906
 907                         if (lpnmitem->iItem != -1)
 908                         {
 909                             DialogBox(hInst,
 910                                       MAKEINTRESOURCE(IDD_EVENTDETAILDIALOG),
 911                                       hWnd,
 912                                       EventDetails);
 913                         }
 914                     }
 915                     break;
 916             }
 917             break;
 918
 919         case WM_COMMAND:
 920             // Parse the menu selections:
 921             switch (LOWORD(wParam))
 922             {
 923                 case ID_LOG_APPLICATION:
 924                     if (QueryEventMessages(lpComputerName,            // Use the local computer.
 925                                            EVENT_SOURCE_APPLICATION)) // The event log category
 926                     {
 927                         CheckMenuRadioItem(GetMenu(hWnd),
 928                                            ID_LOG_APPLICATION,
 929                                            ID_LOG_SYSTEM,
 930                                            ID_LOG_APPLICATION,
 931                                            MF_BYCOMMAND);
 932                     }
 933                     break;
 934
 935                 case ID_LOG_SECURITY:
 936                     if (QueryEventMessages(lpComputerName,         // Use the local computer.
 937                                            EVENT_SOURCE_SECURITY)) // The event log category
 938                     {
 939                         CheckMenuRadioItem(GetMenu(hWnd),
 940                                            ID_LOG_APPLICATION,
 941                                            ID_LOG_SYSTEM,
 942                                            ID_LOG_SECURITY,
 943                                            MF_BYCOMMAND);
 944                     }
 945                     break;
 946
 947                 case ID_LOG_SYSTEM:
 948                     if (QueryEventMessages(lpComputerName,       // Use the local computer.
 949                                            EVENT_SOURCE_SYSTEM)) // The event log category
 950                     {
 951                         CheckMenuRadioItem(GetMenu(hWnd),
 952                                            ID_LOG_APPLICATION,
 953                                            ID_LOG_SYSTEM,
 954                                            ID_LOG_SYSTEM,
 955                                            MF_BYCOMMAND);
 956                     }
 957                     break;
 958
 959                 case IDM_REFRESH:
 960                     Refresh();
 961                     break;
 962
 963                 case IDM_ABOUT:
 964                     DialogBox(hInst, MAKEINTRESOURCE(IDD_ABOUTBOX), hWnd, About);
 965                     break;
 966
 967                 case IDM_HELP:
 968                     MessageBoxW(NULL,
 969                                L"Help not implemented yet!",
 970                                L"Event Log",
 971                                MB_OK | MB_ICONINFORMATION);
 972                                break;
 973
 974                 case IDM_EXIT:
 975                     DestroyWindow(hWnd);
 976                     break;
 977
 978                 default:
 979                     return DefWindowProc(hWnd, message, wParam, lParam);
 980             }
 981             break;
 982
 983         case WM_SIZE:
 984             {
 985                 // Gets the window rectangle
 986                 GetClientRect(hWnd, &rect);
 987
 988                 // Relocate the listview
 989                 MoveWindow(hwndListView,
 990                            0,
 991                            0,
 992                            rect.right,
 993                            rect.bottom - 20,
 994                            1);
 995
 996                 // Resize the statusbar;
 997                 SendMessage(hwndStatus, message, wParam, lParam);
 998             }
 999             break;
1000         case WM_DESTROY:
1001             FreeRecords();
1002             PostQuitMessage(0);
1003             break;
1004
1005         default:
1006             return DefWindowProc(hWnd, message, wParam, lParam);
1007     }
1008
1009     return 0;
1010 }
1011
1012
1013 // Message handler for about box.
1014 INT_PTR CALLBACK
1015 About(HWND hDlg, UINT message, WPARAM wParam, LPARAM lParam)
1016 {
1017     UNREFERENCED_PARAMETER(lParam);
1018     switch (message)
1019     {
1020         case WM_INITDIALOG:
1021             {
1022                 return (INT_PTR)TRUE;
1023             }
1024
1025         case WM_COMMAND:
1026             if (LOWORD(wParam) == IDOK || LOWORD(wParam) == IDCANCEL)
1027             {
1028                 EndDialog(hDlg, LOWORD(wParam));
1029                 return (INT_PTR)TRUE;
1030             }
1031             break;
1032     }
1033
1034     return (INT_PTR)FALSE;
1035 }
1036
1037 VOID
1038 DisplayEvent(HWND hDlg)
1039 {
1040     WCHAR szEventType[MAX_PATH];
1041     WCHAR szTime[MAX_PATH];
1042     WCHAR szDate[MAX_PATH];
1043     WCHAR szUser[MAX_PATH];
1044     WCHAR szComputer[MAX_PATH];
1045     WCHAR szSource[MAX_PATH];
1046     WCHAR szCategory[MAX_PATH];
1047     WCHAR szEventID[MAX_PATH];
1048     WCHAR szEventText[EVENT_MESSAGE_EVENTTEXT_BUFFER];
1049     WCHAR szEventData[MAX_PATH];
1050     BOOL bEventData = FALSE;
1051     LVITEMW li;
1052     EVENTLOGRECORD* pevlr;
1053     int iIndex;
1054
1055     // Get index of selected item
1056     iIndex = (int)SendMessage (hwndListView, LVM_GETNEXTITEM, -1, LVNI_SELECTED | LVNI_FOCUSED);
1057
1058     li.mask = LVIF_PARAM;
1059     li.iItem = iIndex;
1060     li.iSubItem = 0;
1061
1062     (void)ListView_GetItem(hwndListView, &li);
1063
1064     pevlr = (EVENTLOGRECORD*)li.lParam;
1065
1066     if (iIndex != -1)
1067     {
1068         ListView_GetItemText(hwndListView, iIndex, 0, szEventType, sizeof(szEventType) * sizeof(WCHAR));
1069         ListView_GetItemText(hwndListView, iIndex, 1, szDate, sizeof(szDate) * sizeof(WCHAR));
1070         ListView_GetItemText(hwndListView, iIndex, 2, szTime, sizeof(szTime) * sizeof(WCHAR));
1071         ListView_GetItemText(hwndListView, iIndex, 3, szSource, sizeof(szSource) * sizeof(WCHAR));
1072         ListView_GetItemText(hwndListView, iIndex, 4, szCategory, sizeof(szCategory) * sizeof(WCHAR));
1073         ListView_GetItemText(hwndListView, iIndex, 5, szEventID, sizeof(szEventID) * sizeof(WCHAR));
1074         ListView_GetItemText(hwndListView, iIndex, 6, szUser, sizeof(szUser) * sizeof(WCHAR));
1075         ListView_GetItemText(hwndListView, iIndex, 7, szComputer, sizeof(szComputer) * sizeof(WCHAR));
1076
1077         bEventData = !(pevlr->DataLength == 0);
1078
1079         if (pevlr->DataLength > 0)
1080         {
1081             MultiByteToWideChar(CP_ACP,
1082                                 0,
1083                                 (LPCSTR)((LPBYTE)pevlr + pevlr->DataOffset),
1084                                 pevlr->DataLength,
1085                                 szEventData,
1086                                 MAX_PATH);
1087         }
1088
1089         GetEventMessage(lpSourceLogName, szSource, pevlr, szEventText);
1090
1091         EnableWindow(GetDlgItem(hDlg, IDC_BYTESRADIO), bEventData);
1092         EnableWindow(GetDlgItem(hDlg, IDC_WORDRADIO), bEventData);
1093
1094         SetDlgItemTextW(hDlg, IDC_EVENTDATESTATIC, szDate);
1095         SetDlgItemTextW(hDlg, IDC_EVENTTIMESTATIC, szTime);
1096         SetDlgItemTextW(hDlg, IDC_EVENTUSERSTATIC, szUser);
1097         SetDlgItemTextW(hDlg, IDC_EVENTSOURCESTATIC, szSource);
1098         SetDlgItemTextW(hDlg, IDC_EVENTCOMPUTERSTATIC, szComputer);
1099         SetDlgItemTextW(hDlg, IDC_EVENTCATEGORYSTATIC, szCategory);
1100         SetDlgItemTextW(hDlg, IDC_EVENTIDSTATIC, szEventID);
1101         SetDlgItemTextW(hDlg, IDC_EVENTTYPESTATIC, szEventType);
1102         SetDlgItemTextW(hDlg, IDC_EVENTTEXTEDIT, szEventText);
1103         SetDlgItemTextW(hDlg, IDC_EVENTDATAEDIT, szEventData);
1104     }
1105     else
1106     {
1107         MessageBoxW(NULL,
1108                    L"No Items in ListView",
1109                    L"Error",
1110                    MB_OK | MB_ICONINFORMATION);
1111     }
1112 }
1113
1114
1115 static
1116 INT_PTR CALLBACK
1117 StatusMessageWindowProc(IN HWND hwndDlg,
1118                         IN UINT uMsg,
1119                         IN WPARAM wParam,
1120                         IN LPARAM lParam)
1121 {
1122     UNREFERENCED_PARAMETER(wParam);
1123
1124     switch (uMsg)
1125     {
1126         case WM_INITDIALOG:
1127         {
1128             return TRUE;
1129         }
1130     }
1131     return FALSE;
1132 }
1133
1134
1135 // Message handler for event details box.
1136 INT_PTR CALLBACK
1137 EventDetails(HWND hDlg, UINT message, WPARAM wParam, LPARAM lParam)
1138 {
1139     UNREFERENCED_PARAMETER(lParam);
1140
1141     switch (message)
1142     {
1143         case WM_INITDIALOG:
1144             // Show event info on dialog box
1145             DisplayEvent(hDlg);
1146             return (INT_PTR)TRUE;
1147
1148         case WM_COMMAND:
1149             switch (LOWORD(wParam))
1150             {
1151                 case IDOK:
1152                 case IDCANCEL:
1153                     EndDialog(hDlg, LOWORD(wParam));
1154                     return (INT_PTR)TRUE;
1155
1156                 case IDPREVIOUS:
1157                     SendMessage(hwndListView, WM_KEYDOWN, VK_UP, 0);
1158
1159                     // Show event info on dialog box
1160                     DisplayEvent(hDlg);
1161                     return (INT_PTR)TRUE;
1162
1163                 case IDNEXT:
1164                     SendMessage(hwndListView, WM_KEYDOWN, VK_DOWN, 0);
1165
1166                     // Show event info on dialog box
1167                     DisplayEvent(hDlg);
1168                     return (INT_PTR)TRUE;
1169
1170                 case IDC_BYTESRADIO:
1171                     return (INT_PTR)TRUE;
1172
1173                 case IDC_WORDRADIO:
1174                     return (INT_PTR)TRUE;
1175
1176                 case IDHELP:
1177                     MessageBoxW(NULL,
1178                                L"Help not implemented yet!",
1179                                L"Event Log",
1180                                MB_OK | MB_ICONINFORMATION);
1181                     return (INT_PTR)TRUE;
1182
1183                 default:
1184                     break;
1185             }
1186             break;
1187     }
1188
1189     return (INT_PTR)FALSE;
1190 }