sdk/lib/evtlib/evtlib.h

   1 /*
   2  * PROJECT:         ReactOS EventLog File Library
   3  * LICENSE:         GPL - See COPYING in the top level directory
   4  * FILE:            sdk/lib/evtlib/evtlib.h
   5  * PURPOSE:         Provides functionality for reading and writing
   6  *                  EventLog files in the NT <= 5.2 (.evt) format.
   7  * PROGRAMMERS:     Copyright 2005 Saveliy Tretiakov
   8  *                  Michael Martin
   9  *                  Hermes Belusca-Maito
  10  */
  11
  12 #ifndef __EVTLIB_H__
  13 #define __EVTLIB_H__
  14
  15 #pragma once
  16
  17 #ifdef __cplusplus
  18 extern "C" {
  19 #endif
  20
  21 /* PSDK/NDK Headers */
  22 // #define WIN32_NO_STATUS
  23 // #include <windef.h>
  24 // #include <winbase.h>
  25 // #include <winnt.h>
  26
  27 #define NTOS_MODE_USER
  28 #include <ndk/rtlfuncs.h>
  29
  30 #ifndef ROUND_DOWN
  31 #define ROUND_DOWN(n, align) (((ULONG)n) & ~((align) - 1l))
  32 #endif
  33
  34 #ifndef ROUND_UP
  35 #define ROUND_UP(n, align) ROUND_DOWN(((ULONG)n) + (align) - 1, (align))
  36 #endif
  37
  38 /*
  39  * Our file format will be compatible with NT's
  40  */
  41 #define MAJORVER    1
  42 #define MINORVER    1
  43 #define LOGFILE_SIGNATURE   0x654c664c  // "LfLe"
  44
  45 /*
  46  * Flags used in the logfile header
  47  */
  48 #define ELF_LOGFILE_HEADER_DIRTY    1
  49 #define ELF_LOGFILE_HEADER_WRAP     2
  50 #define ELF_LOGFILE_LOGFULL_WRITTEN 4
  51 #define ELF_LOGFILE_ARCHIVE_SET     8
  52
  53 /*
  54  * On-disk event log structures (log file header, event record and EOF record).
  55  * NOTE: Contrary to what MSDN claims, both the EVENTLOGHEADER and EVENTLOGEOF
  56  * structures are absent from winnt.h .
  57  */
  58
  59 #include <pshpack4.h> // pshpack1
  60
  61 // ELF_LOGFILE_HEADER
  62 typedef struct _EVENTLOGHEADER
  63 {
  64     ULONG HeaderSize;
  65     ULONG Signature;
  66     ULONG MajorVersion;
  67     ULONG MinorVersion;
  68     ULONG StartOffset;
  69     ULONG EndOffset;
  70     ULONG CurrentRecordNumber;
  71     ULONG OldestRecordNumber;
  72     ULONG MaxSize;
  73     ULONG Flags;
  74     ULONG Retention;
  75     ULONG EndHeaderSize;
  76 } EVENTLOGHEADER, *PEVENTLOGHEADER;
  77
  78
  79 /* Those flags and structure are defined in winnt.h */
  80 #ifndef _WINNT_
  81
  82 /* EventType flags */
  83 #define EVENTLOG_SUCCESS            0
  84 #define EVENTLOG_ERROR_TYPE         1
  85 #define EVENTLOG_WARNING_TYPE       2
  86 #define EVENTLOG_INFORMATION_TYPE   4
  87 #define EVENTLOG_AUDIT_SUCCESS      8
  88 #define EVENTLOG_AUDIT_FAILURE      16
  89
  90 typedef struct _EVENTLOGRECORD
  91 {
  92     ULONG  Length;              /* Length of full record, including the data portion */
  93     ULONG  Reserved;
  94     ULONG  RecordNumber;
  95     ULONG  TimeGenerated;
  96     ULONG  TimeWritten;
  97     ULONG  EventID;
  98     USHORT EventType;
  99     USHORT NumStrings;          /* Number of strings in the 'Strings' array */
 100     USHORT EventCategory;
 101     USHORT ReservedFlags;
 102     ULONG  ClosingRecordNumber;
 103     ULONG  StringOffset;
 104     ULONG  UserSidLength;
 105     ULONG  UserSidOffset;
 106     ULONG  DataLength;          /* Length of the data portion */
 107     ULONG  DataOffset;          /* Offset from beginning of record */
 108 /*
 109  * Length-varying data:
 110  *
 111  *  WCHAR SourceName[];
 112  *  WCHAR ComputerName[];
 113  *  SID   UserSid;              // Must be aligned on a DWORD boundary
 114  *  WCHAR Strings[];
 115  *  BYTE  Data[];
 116  *  CHAR  Pad[];                // Padding for DWORD boundary
 117  *  ULONG Length;               // Same as the first 'Length' member at the beginning
 118  */
 119 } EVENTLOGRECORD, *PEVENTLOGRECORD;
 120
 121 #endif // _WINNT_
 122
 123
 124 // ELF_EOF_RECORD
 125 typedef struct _EVENTLOGEOF
 126 {
 127     ULONG RecordSizeBeginning;
 128     ULONG Ones;
 129     ULONG Twos;
 130     ULONG Threes;
 131     ULONG Fours;
 132     ULONG BeginRecord;
 133     ULONG EndRecord;
 134     ULONG CurrentRecordNumber;
 135     ULONG OldestRecordNumber;
 136     ULONG RecordSizeEnd;
 137 } EVENTLOGEOF, *PEVENTLOGEOF;
 138
 139 #define EVENTLOGEOF_SIZE_FIXED  (5 * sizeof(ULONG))
 140 C_ASSERT(EVENTLOGEOF_SIZE_FIXED == FIELD_OFFSET(EVENTLOGEOF, BeginRecord));
 141
 142 #include <poppack.h>
 143
 144
 145 typedef struct _EVENT_OFFSET_INFO
 146 {
 147     ULONG EventNumber;
 148     ULONG EventOffset;
 149 } EVENT_OFFSET_INFO, *PEVENT_OFFSET_INFO;
 150
 151 #define TAG_ELF     ' flE'
 152 #define TAG_ELF_BUF 'BflE'
 153
 154 struct _EVTLOGFILE;
 155
 156 typedef PVOID
 157 (NTAPI *PELF_ALLOCATE_ROUTINE)(
 158     IN SIZE_T Size,
 159     IN ULONG Flags,
 160     IN ULONG Tag
 161 );
 162
 163 typedef VOID
 164 (NTAPI *PELF_FREE_ROUTINE)(
 165     IN PVOID Ptr,
 166     IN ULONG Flags,
 167     IN ULONG Tag
 168 );
 169
 170 typedef NTSTATUS
 171 (NTAPI *PELF_FILE_READ_ROUTINE)(
 172     IN  struct _EVTLOGFILE* LogFile,
 173     IN  PLARGE_INTEGER FileOffset,
 174     OUT PVOID   Buffer,
 175     IN  SIZE_T  Length,
 176     OUT PSIZE_T ReadLength OPTIONAL
 177 );
 178
 179 typedef NTSTATUS
 180 (NTAPI *PELF_FILE_WRITE_ROUTINE)(
 181     IN  struct _EVTLOGFILE* LogFile,
 182     IN  PLARGE_INTEGER FileOffset,
 183     IN  PVOID   Buffer,
 184     IN  SIZE_T  Length,
 185     OUT PSIZE_T WrittenLength OPTIONAL
 186 );
 187
 188 typedef NTSTATUS
 189 (NTAPI *PELF_FILE_SET_SIZE_ROUTINE)(
 190     IN struct _EVTLOGFILE* LogFile,
 191     IN ULONG FileSize,
 192     IN ULONG OldFileSize
 193 );
 194
 195 typedef NTSTATUS
 196 (NTAPI *PELF_FILE_FLUSH_ROUTINE)(
 197     IN struct _EVTLOGFILE* LogFile,
 198     IN PLARGE_INTEGER FileOffset,
 199     IN ULONG Length
 200 );
 201
 202 typedef struct _EVTLOGFILE
 203 {
 204     PELF_ALLOCATE_ROUTINE   Allocate;
 205     PELF_FREE_ROUTINE       Free;
 206     PELF_FILE_SET_SIZE_ROUTINE FileSetSize;
 207     PELF_FILE_WRITE_ROUTINE FileWrite;
 208     PELF_FILE_READ_ROUTINE  FileRead;
 209     PELF_FILE_FLUSH_ROUTINE FileFlush;
 210
 211     EVENTLOGHEADER Header;
 212     ULONG CurrentSize;  /* Equivalent to the file size, is <= MaxSize and can be extended to MaxSize if needed */
 213     UNICODE_STRING FileName;
 214     PEVENT_OFFSET_INFO OffsetInfo;
 215     ULONG OffsetInfoSize;
 216     ULONG OffsetInfoNext;
 217     BOOLEAN ReadOnly;
 218 } EVTLOGFILE, *PEVTLOGFILE;
 219
 220
 221 NTSTATUS
 222 NTAPI
 223 ElfCreateFile(
 224     IN OUT PEVTLOGFILE LogFile,
 225     IN PUNICODE_STRING FileName OPTIONAL,
 226     IN ULONG    FileSize,
 227     IN ULONG    MaxSize,
 228     IN ULONG    Retention,
 229     IN BOOLEAN  CreateNew,
 230     IN BOOLEAN  ReadOnly,
 231     IN PELF_ALLOCATE_ROUTINE   Allocate,
 232     IN PELF_FREE_ROUTINE       Free,
 233     IN PELF_FILE_SET_SIZE_ROUTINE FileSetSize,
 234     IN PELF_FILE_WRITE_ROUTINE FileWrite,
 235     IN PELF_FILE_READ_ROUTINE  FileRead,
 236     IN PELF_FILE_FLUSH_ROUTINE FileFlush); // What about Seek ??
 237
 238 NTSTATUS
 239 NTAPI
 240 ElfReCreateFile(
 241     IN PEVTLOGFILE LogFile);
 242
 243 // NTSTATUS
 244 // ElfClearFile(PEVTLOGFILE LogFile);
 245
 246 NTSTATUS
 247 NTAPI
 248 ElfBackupFile(
 249     IN PEVTLOGFILE LogFile,
 250     IN PEVTLOGFILE BackupLogFile);
 251
 252 NTSTATUS
 253 NTAPI
 254 ElfFlushFile(
 255     IN PEVTLOGFILE LogFile);
 256
 257 VOID
 258 NTAPI
 259 ElfCloseFile(  // ElfFree
 260     IN PEVTLOGFILE LogFile);
 261
 262 NTSTATUS
 263 NTAPI
 264 ElfReadRecord(
 265     IN  PEVTLOGFILE LogFile,
 266     IN  ULONG RecordNumber,
 267     OUT PEVENTLOGRECORD Record,
 268     IN  SIZE_T  BufSize, // Length
 269     OUT PSIZE_T BytesRead OPTIONAL,
 270     OUT PSIZE_T BytesNeeded OPTIONAL);
 271
 272 NTSTATUS
 273 NTAPI
 274 ElfWriteRecord(
 275     IN PEVTLOGFILE LogFile,
 276     IN PEVENTLOGRECORD Record,
 277     IN SIZE_T BufSize);
 278
 279 ULONG
 280 NTAPI
 281 ElfGetOldestRecord(
 282     IN PEVTLOGFILE LogFile);
 283
 284 ULONG
 285 NTAPI
 286 ElfGetCurrentRecord(
 287     IN PEVTLOGFILE LogFile);
 288
 289 ULONG
 290 NTAPI
 291 ElfGetFlags(
 292     IN PEVTLOGFILE LogFile);
 293
 294 #if DBG
 295 VOID PRINT_HEADER(PEVENTLOGHEADER Header);
 296 #endif
 297
 298 #ifdef __cplusplus
 299 }
 300 #endif
 301 #endif  /* __EVTLIB_H__ */