- Implement RCreateServiceA.
[reactos.git] / reactos / dll / win32 / advapi32 / service / eventlog.c
index a842c42..2ad4544 100644 (file)
  *
  * You should have received a copy of the GNU Lesser General Public
  * License along with this library; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
  */
 
 #include <advapi32.h>
 #include "wine/debug.h"
 
 WINE_DEFAULT_DEBUG_CHANNEL(advapi);
-WINE_DECLARE_DEBUG_CHANNEL(eventlog);
 
-typedef struct _LOG_INFO
+static RPC_UNICODE_STRING EmptyString = { 0, 0, L"" };
+
+static inline LPWSTR SERV_dup( LPCSTR str )
 {
-    RPC_BINDING_HANDLE BindingHandle;
-    IELF_HANDLE LogHandle;
-    BOOL bLocal;
-} LOG_INFO, *PLOG_INFO;
+    UINT len;
+    LPWSTR wstr;
+
+    if( !str )
+        return NULL;
+    len = MultiByteToWideChar( CP_ACP, 0, str, -1, NULL, 0 );
+    wstr = HeapAlloc( GetProcessHeap(), 0, len*sizeof (WCHAR) );
+    MultiByteToWideChar( CP_ACP, 0, str, -1, wstr, len );
+    return wstr;
+}
+
+handle_t __RPC_USER
+EVENTLOG_HANDLE_A_bind(EVENTLOG_HANDLE_A UNCServerName)
+{
+    handle_t hBinding = NULL;
+    UCHAR *pszStringBinding;
+    RPC_STATUS status;
+
+    TRACE("EVENTLOG_HANDLE_A_bind() called\n");
+
+    status = RpcStringBindingComposeA(NULL,
+                                      (UCHAR *)"ncacn_np",
+                                      (UCHAR *)UNCServerName,
+                                      (UCHAR *)"\\pipe\\ntsvcs",
+                                      NULL,
+                                      (UCHAR **)&pszStringBinding);
+    if (status)
+    {
+        ERR("RpcStringBindingCompose returned 0x%x\n", status);
+        return NULL;
+    }
+
+    /* Set the binding handle that will be used to bind to the server. */
+    status = RpcBindingFromStringBindingA(pszStringBinding,
+                                          &hBinding);
+    if (status)
+    {
+        ERR("RpcBindingFromStringBinding returned 0x%x\n", status);
+    }
+
+    status = RpcStringFreeA(&pszStringBinding);
+    if (status)
+    {
+        ERR("RpcStringFree returned 0x%x\n", status);
+    }
+
+    return hBinding;
+}
+
+
+void __RPC_USER
+EVENTLOG_HANDLE_A_unbind(EVENTLOG_HANDLE_A UNCServerName,
+                         handle_t hBinding)
+{
+    RPC_STATUS status;
+
+    TRACE("EVENTLOG_HANDLE_A_unbind() called\n");
+
+    status = RpcBindingFree(&hBinding);
+    if (status)
+    {
+        ERR("RpcBindingFree returned 0x%x\n", status);
+    }
+}
+
+
+handle_t __RPC_USER
+EVENTLOG_HANDLE_W_bind(EVENTLOG_HANDLE_W UNCServerName)
+{
+    handle_t hBinding = NULL;
+    LPWSTR pszStringBinding;
+    RPC_STATUS status;
+
+    TRACE("EVENTLOG_HANDLE_W_bind() called\n");
+
+    status = RpcStringBindingComposeW(NULL,
+                                      L"ncacn_np",
+                                      (LPWSTR)UNCServerName,
+                                      L"\\pipe\\EventLog",
+                                      NULL,
+                                      &pszStringBinding);
+    if (status)
+    {
+        ERR("RpcStringBindingCompose returned 0x%x\n", status);
+        return NULL;
+    }
+
+    /* Set the binding handle that will be used to bind to the server. */
+    status = RpcBindingFromStringBindingW(pszStringBinding,
+                                          &hBinding);
+    if (status)
+    {
+        ERR("RpcBindingFromStringBinding returned 0x%x\n", status);
+    }
+
+    status = RpcStringFreeW(&pszStringBinding);
+    if (status)
+    {
+        ERR("RpcStringFree returned 0x%x\n", status);
+    }
+
+    return hBinding;
+}
+
+
+void __RPC_USER
+EVENTLOG_HANDLE_W_unbind(EVENTLOG_HANDLE_W UNCServerName,
+                         handle_t hBinding)
+{
+    RPC_STATUS status;
+
+    TRACE("EVENTLOG_HANDLE_W_unbind() called\n");
+
+    status = RpcBindingFree(&hBinding);
+    if (status)
+    {
+        ERR("RpcBindingFree returned 0x%x\n", status);
+    }
+}
 
-static RPC_UNICODE_STRING EmptyString = { 0, 0, L"" };
 
 /******************************************************************************
  * BackupEventLogA [ADVAPI32.@]
@@ -43,26 +158,27 @@ BOOL WINAPI
 BackupEventLogA(IN HANDLE hEventLog,
                 IN LPCSTR lpBackupFileName)
 {
-    PLOG_INFO pLog;
-    NTSTATUS Status;
     RPC_STRING BackupFileName;
+    NTSTATUS Status;
 
     TRACE("%p, %s\n", hEventLog, lpBackupFileName);
 
     BackupFileName.Buffer = (LPSTR)lpBackupFileName;
     BackupFileName.Length = BackupFileName.MaximumLength =
         lpBackupFileName ? strlen(lpBackupFileName) : 0;
+       BackupFileName.MaximumLength += sizeof(CHAR);
 
-    pLog = (PLOG_INFO)hEventLog;
-    if (!pLog)
+    RpcTryExcept
     {
-        SetLastError(ERROR_INVALID_HANDLE);
-        return FALSE;
+        Status = ElfrBackupELFA(hEventLog,
+                                &BackupFileName);
     }
+    RpcExcept(EXCEPTION_EXECUTE_HANDLER)
+    {
+        Status = I_RpcMapWin32Status(RpcExceptionCode());
+    }
+    RpcEndExcept;
 
-    Status = ElfrBackupELFA(pLog->BindingHandle,
-                            pLog->LogHandle,
-                            &BackupFileName);
     if (!NT_SUCCESS(Status))
     {
         SetLastError(RtlNtStatusToDosError(Status));
@@ -83,26 +199,27 @@ BOOL WINAPI
 BackupEventLogW(IN HANDLE hEventLog,
                 IN LPCWSTR lpBackupFileName)
 {
-    PLOG_INFO pLog;
-    NTSTATUS Status;
     RPC_UNICODE_STRING BackupFileName;
+    NTSTATUS Status;
 
     TRACE("%p, %s\n", hEventLog, debugstr_w(lpBackupFileName));
 
     BackupFileName.Buffer = (LPWSTR)lpBackupFileName;
     BackupFileName.Length = BackupFileName.MaximumLength =
         lpBackupFileName ? wcslen(lpBackupFileName) * sizeof(WCHAR) : 0;
+    BackupFileName.MaximumLength += sizeof(WCHAR);
 
-    pLog = (PLOG_INFO)hEventLog;
-    if (!pLog)
+    RpcTryExcept
     {
-        SetLastError(ERROR_INVALID_HANDLE);
-        return FALSE;
+        Status = ElfrBackupELFW(hEventLog,
+                                &BackupFileName);
+    }
+    RpcExcept(EXCEPTION_EXECUTE_HANDLER)
+    {
+        Status = I_RpcMapWin32Status(RpcExceptionCode());
     }
+    RpcEndExcept;
 
-    Status = ElfrBackupELFW(pLog->BindingHandle,
-                            pLog->LogHandle,
-                            &BackupFileName);
     if (!NT_SUCCESS(Status))
     {
         SetLastError(RtlNtStatusToDosError(Status));
@@ -120,26 +237,27 @@ BOOL WINAPI
 ClearEventLogA(IN HANDLE hEventLog,
                IN LPCSTR lpBackupFileName)
 {
-    PLOG_INFO pLog;
-    NTSTATUS Status;
     RPC_STRING BackupFileName;
+    NTSTATUS Status;
 
     TRACE("%p, %s\n", hEventLog, lpBackupFileName);
 
     BackupFileName.Buffer = (LPSTR)lpBackupFileName;
     BackupFileName.Length = BackupFileName.MaximumLength =
         lpBackupFileName ? strlen(lpBackupFileName) : 0;
+    BackupFileName.MaximumLength += sizeof(CHAR);
 
-    pLog = (PLOG_INFO)hEventLog;
-    if (!pLog)
+    RpcTryExcept
     {
-        SetLastError(ERROR_INVALID_HANDLE);
-        return FALSE;
+        Status = ElfrClearELFA(hEventLog,
+                               &BackupFileName);
+    }
+    RpcExcept(EXCEPTION_EXECUTE_HANDLER)
+    {
+        Status = I_RpcMapWin32Status(RpcExceptionCode());
     }
+    RpcEndExcept;
 
-    Status = ElfrClearELFA(pLog->BindingHandle,
-                           pLog->LogHandle,
-                           &BackupFileName);
     if (!NT_SUCCESS(Status))
     {
         SetLastError(RtlNtStatusToDosError(Status));
@@ -157,26 +275,27 @@ BOOL WINAPI
 ClearEventLogW(IN HANDLE hEventLog,
                IN LPCWSTR lpBackupFileName)
 {
-    PLOG_INFO pLog;
-    NTSTATUS Status;
     RPC_UNICODE_STRING BackupFileName;
+    NTSTATUS Status;
 
     TRACE("%p, %s\n", hEventLog, debugstr_w(lpBackupFileName));
 
     BackupFileName.Buffer = (LPWSTR)lpBackupFileName;
     BackupFileName.Length = BackupFileName.MaximumLength =
         lpBackupFileName ? wcslen(lpBackupFileName) * sizeof(WCHAR) : 0;
+    BackupFileName.MaximumLength += sizeof(WCHAR);
 
-    pLog = (PLOG_INFO)hEventLog;
-    if (!pLog)
+    RpcTryExcept
     {
-        SetLastError(ERROR_INVALID_HANDLE);
-        return FALSE;
+        Status = ElfrClearELFW(hEventLog,
+                               &BackupFileName);
     }
+    RpcExcept(EXCEPTION_EXECUTE_HANDLER)
+    {
+        Status = I_RpcMapWin32Status(RpcExceptionCode());
+    }
+    RpcEndExcept;
 
-    Status = ElfrClearELFW(pLog->BindingHandle,
-                           pLog->LogHandle,
-                           &BackupFileName);
     if (!NT_SUCCESS(Status))
     {
         SetLastError(RtlNtStatusToDosError(Status));
@@ -193,35 +312,25 @@ ClearEventLogW(IN HANDLE hEventLog,
 BOOL WINAPI
 CloseEventLog(IN HANDLE hEventLog)
 {
-    PLOG_INFO pLog;
     NTSTATUS Status;
 
     TRACE("%p\n", hEventLog);
 
-    pLog = (PLOG_INFO)hEventLog;
-    if (!pLog)
-        return TRUE;
-
-    if (pLog->bLocal == FALSE)
+    RpcTryExcept
     {
-        if (!EvtUnbindRpc(pLog->BindingHandle))
-        {
-            SetLastError(ERROR_ACCESS_DENIED);
-            return FALSE;
-        }
+        Status = ElfrCloseEL(&hEventLog);
     }
-    else
+    RpcExcept(EXCEPTION_EXECUTE_HANDLER)
     {
-        Status = ElfrCloseEL(pLog->BindingHandle,
-                             &pLog->LogHandle);
-        if (!NT_SUCCESS(Status))
-        {
-            SetLastError(RtlNtStatusToDosError(Status));
-            return FALSE;
-        }
+        Status = I_RpcMapWin32Status(RpcExceptionCode());
     }
+    RpcEndExcept;
 
-    HeapFree(GetProcessHeap(), 0, pLog);
+    if (!NT_SUCCESS(Status))
+    {
+        SetLastError(RtlNtStatusToDosError(Status));
+        return FALSE;
+    }
 
     return TRUE;
 }
@@ -239,17 +348,20 @@ CloseEventLog(IN HANDLE hEventLog)
 BOOL WINAPI
 DeregisterEventSource(IN HANDLE hEventLog)
 {
-    PLOG_INFO pLog;
     NTSTATUS Status;
 
     TRACE("%p\n", hEventLog);
 
-    pLog = (PLOG_INFO)hEventLog;
-    if (!pLog)
-        return TRUE;
+    RpcTryExcept
+    {
+        Status = ElfrDeregisterEventSource(&hEventLog);
+    }
+    RpcExcept(EXCEPTION_EXECUTE_HANDLER)
+    {
+        Status = I_RpcMapWin32Status(RpcExceptionCode());
+    }
+    RpcEndExcept;
 
-    Status = ElfrDeregisterEventSource(pLog->BindingHandle,
-                                       &pLog->LogHandle);
     if (!NT_SUCCESS(Status))
     {
         SetLastError(RtlNtStatusToDosError(Status));
@@ -260,6 +372,29 @@ DeregisterEventSource(IN HANDLE hEventLog)
 }
 
 
+/******************************************************************************
+ * GetEventLogInformation [ADVAPI32.@]
+ *
+ * PARAMS
+ *   hEventLog      [I] Handle to event log
+ *   dwInfoLevel    [I] Level of event log information to return
+ *   lpBuffer       [O] Buffer that receives the event log information
+ *   cbBufSize      [I] Size of the lpBuffer buffer
+ *   pcbBytesNeeded [O] Required buffer size
+ */
+BOOL WINAPI
+GetEventLogInformation(IN HANDLE hEventLog,
+                       IN DWORD dwInfoLevel,
+                       OUT LPVOID lpBuffer,
+                       IN DWORD cbBufSize,
+                       OUT LPDWORD pcbBytesNeeded)
+{
+    UNIMPLEMENTED;
+    SetLastError(ERROR_CALL_NOT_IMPLEMENTED);
+    return FALSE;
+}
+
+
 /******************************************************************************
  * GetNumberOfEventLogRecords [ADVAPI32.@]
  *
@@ -271,22 +406,28 @@ BOOL WINAPI
 GetNumberOfEventLogRecords(IN HANDLE hEventLog,
                            OUT PDWORD NumberOfRecords)
 {
-    PLOG_INFO pLog;
     NTSTATUS Status;
     DWORD Records;
 
     TRACE("%p, %p\n", hEventLog, NumberOfRecords);
 
-    pLog = (PLOG_INFO)hEventLog;
-    if (!pLog)
+    if(!NumberOfRecords)
     {
-        SetLastError(ERROR_INVALID_HANDLE);
+        SetLastError(ERROR_INVALID_PARAMETER);
         return FALSE;
     }
+    
+    RpcTryExcept
+    {
+        Status = ElfrNumberOfRecords(hEventLog,
+                                     &Records);
+    }
+    RpcExcept(EXCEPTION_EXECUTE_HANDLER)
+    {
+        Status = I_RpcMapWin32Status(RpcExceptionCode());
+    }
+    RpcEndExcept;
 
-    Status = ElfrNumberOfRecords(pLog->BindingHandle,
-                                 pLog->LogHandle,
-                                 &Records);
     if (!NT_SUCCESS(Status))
     {
         SetLastError(RtlNtStatusToDosError(Status));
@@ -310,22 +451,28 @@ BOOL WINAPI
 GetOldestEventLogRecord(IN HANDLE hEventLog,
                         OUT PDWORD OldestRecord)
 {
-    PLOG_INFO pLog;
     NTSTATUS Status;
     DWORD Oldest;
 
     TRACE("%p, %p\n", hEventLog, OldestRecord);
 
-    pLog = (PLOG_INFO)hEventLog;
-    if (!pLog)
+    if(!OldestRecord)
     {
-        SetLastError(ERROR_INVALID_HANDLE);
+        SetLastError(ERROR_INVALID_PARAMETER);
         return FALSE;
     }
+    
+    RpcTryExcept
+    {
+        Status = ElfrOldestRecord(hEventLog,
+                                  &Oldest);
+    }
+    RpcExcept(EXCEPTION_EXECUTE_HANDLER)
+    {
+        Status = I_RpcMapWin32Status(RpcExceptionCode());
+    }
+    RpcEndExcept;
 
-    Status = ElfrOldestRecord(pLog->BindingHandle,
-                              pLog->LogHandle,
-                              &Oldest);
     if (!NT_SUCCESS(Status))
     {
         SetLastError(RtlNtStatusToDosError(Status));
@@ -403,96 +550,69 @@ HANDLE WINAPI
 OpenBackupEventLogW(IN LPCWSTR lpUNCServerName,
                     IN LPCWSTR lpFileName)
 {
-    PLOG_INFO pLog;
-    NTSTATUS Status;
     RPC_UNICODE_STRING FileName;
+    IELF_HANDLE LogHandle;
+    NTSTATUS Status;
 
     TRACE("%s, %s\n", debugstr_w(lpUNCServerName), debugstr_w(lpFileName));
 
     FileName.Buffer = (LPWSTR)lpFileName;
     FileName.Length = FileName.MaximumLength =
         lpFileName ? wcslen(lpFileName) * sizeof(WCHAR) : 0;
+    FileName.MaximumLength += sizeof(WCHAR);
 
-    pLog = HeapAlloc(GetProcessHeap(), 0, sizeof(LOG_INFO));
-    if (!pLog)
-    {
-        SetLastError(ERROR_NOT_ENOUGH_MEMORY);
-        return NULL;
-    }
-
-    ZeroMemory(pLog, sizeof(LOG_INFO));
-
-    if (lpUNCServerName == NULL || *lpUNCServerName == 0)
+    RpcTryExcept
     {
-        pLog->bLocal = TRUE;
-
-        if (!EvtGetLocalHandle(&pLog->BindingHandle))
-        {
-            HeapFree(GetProcessHeap(), 0, pLog);
-            SetLastError(ERROR_GEN_FAILURE);
-            return NULL;
-        }
+        Status = ElfrOpenBELW((LPWSTR)lpUNCServerName,
+                              &FileName,
+                              1,
+                              1,
+                              &LogHandle);
     }
-    else
+    RpcExcept(EXCEPTION_EXECUTE_HANDLER)
     {
-        pLog->bLocal = FALSE;
-
-        if (!EvtBindRpc(lpUNCServerName, &pLog->BindingHandle))
-        {
-            HeapFree(GetProcessHeap(), 0, pLog);
-            SetLastError(ERROR_INVALID_COMPUTERNAME);
-            return NULL;
-        }
+        Status = I_RpcMapWin32Status(RpcExceptionCode());
     }
+    RpcEndExcept;
 
-    Status = ElfrOpenBELW(pLog->BindingHandle,
-                          (LPWSTR)lpUNCServerName,
-                          &FileName,
-                          0,
-                          0,
-                          &pLog->LogHandle);
     if (!NT_SUCCESS(Status))
     {
         SetLastError(RtlNtStatusToDosError(Status));
-        HeapFree(GetProcessHeap(), 0, pLog);
         return NULL;
     }
 
-    return pLog;
+    return (HANDLE)LogHandle;
 }
 
 
 /******************************************************************************
  * OpenEventLogA [ADVAPI32.@]
+ *
+ * Opens a handle to the specified event log.
+ *
+ * PARAMS
+ *  lpUNCServerName [I] UNC name of the server on which the event log is
+ *                      opened.
+ *  lpSourceName    [I] Name of the log.
+ *
+ * RETURNS
+ *  Success: Handle to an event log.
+ *  Failure: NULL
  */
 HANDLE WINAPI
-OpenEventLogA(IN LPCSTR lpUNCServerName,
-              IN LPCSTR lpSourceName)
+OpenEventLogA(IN LPCSTR uncname,
+              IN LPCSTR source)
 {
-    UNICODE_STRING UNCServerName;
-    UNICODE_STRING SourceName;
-    HANDLE Handle;
-
-    if (!RtlCreateUnicodeStringFromAsciiz(&UNCServerName, lpUNCServerName))
-    {
-        SetLastError(ERROR_NOT_ENOUGH_MEMORY);
-        return NULL;
-    }
+    LPWSTR uncnameW, sourceW;
+    HANDLE handle;
 
-    if (!RtlCreateUnicodeStringFromAsciiz(&SourceName, lpSourceName))
-    {
-        RtlFreeUnicodeString(&UNCServerName);
-        SetLastError(ERROR_NOT_ENOUGH_MEMORY);
-        return NULL;
-    }
-
-    Handle = OpenEventLogW(UNCServerName.Buffer,
-                           SourceName.Buffer);
+    uncnameW = SERV_dup(uncname);
+    sourceW = SERV_dup(source);
+    handle = OpenEventLogW(uncnameW, sourceW);
+    HeapFree(GetProcessHeap(), 0, uncnameW);
+    HeapFree(GetProcessHeap(), 0, sourceW);
 
-    RtlFreeUnicodeString(&UNCServerName);
-    RtlFreeUnicodeString(&SourceName);
-
-    return Handle;
+    return handle;
 }
 
 
@@ -507,63 +627,39 @@ HANDLE WINAPI
 OpenEventLogW(IN LPCWSTR lpUNCServerName,
               IN LPCWSTR lpSourceName)
 {
-    PLOG_INFO pLog;
-    NTSTATUS Status;
     RPC_UNICODE_STRING SourceName;
+    IELF_HANDLE LogHandle;
+    NTSTATUS Status;
 
     TRACE("%s, %s\n", debugstr_w(lpUNCServerName), debugstr_w(lpSourceName));
 
     SourceName.Buffer = (LPWSTR)lpSourceName;
     SourceName.Length = SourceName.MaximumLength =
         lpSourceName ? wcslen(lpSourceName) * sizeof(WCHAR) : 0;
+    SourceName.MaximumLength += sizeof(WCHAR);
 
-    pLog = HeapAlloc(GetProcessHeap(), 0, sizeof(LOG_INFO));
-    if (!pLog)
+    RpcTryExcept
     {
-        SetLastError(ERROR_NOT_ENOUGH_MEMORY);
-        return NULL;
+        Status = ElfrOpenELW((LPWSTR)lpUNCServerName,
+                             &SourceName,
+                             &EmptyString,
+                             1,
+                             1,
+                             &LogHandle);
     }
-
-    ZeroMemory(pLog, sizeof(LOG_INFO));
-
-    if (lpUNCServerName == NULL || *lpUNCServerName == 0)
+    RpcExcept(EXCEPTION_EXECUTE_HANDLER)
     {
-        pLog->bLocal = TRUE;
-
-        if (!EvtGetLocalHandle(&pLog->BindingHandle))
-        {
-            HeapFree(GetProcessHeap(), 0, pLog);
-            SetLastError(ERROR_GEN_FAILURE);
-            return NULL;
-        }
-    }
-    else
-    {
-        pLog->bLocal = FALSE;
-
-        if (!EvtBindRpc(lpUNCServerName, &pLog->BindingHandle))
-        {
-            HeapFree(GetProcessHeap(), 0, pLog);
-            SetLastError(ERROR_INVALID_COMPUTERNAME);
-            return NULL;
-        }
+        Status = I_RpcMapWin32Status(RpcExceptionCode());
     }
+    RpcEndExcept;
 
-    Status = ElfrOpenELW(pLog->BindingHandle,
-                         (LPWSTR)lpUNCServerName,
-                         &SourceName,
-                         &EmptyString,
-                         0,
-                         0,
-                         &pLog->LogHandle);
     if (!NT_SUCCESS(Status))
     {
         SetLastError(RtlNtStatusToDosError(Status));
-        HeapFree(GetProcessHeap(), 0, pLog);
         return NULL;
     }
 
-    return pLog;
+    return (HANDLE)LogHandle;
 }
 
 
@@ -579,7 +675,6 @@ ReadEventLogA(IN HANDLE hEventLog,
               OUT DWORD *pnBytesRead,
               OUT DWORD *pnMinNumberOfBytesNeeded)
 {
-    PLOG_INFO pLog;
     NTSTATUS Status;
     DWORD bytesRead, minNumberOfBytesNeeded;
 
@@ -587,30 +682,44 @@ ReadEventLogA(IN HANDLE hEventLog,
         hEventLog, dwReadFlags, dwRecordOffset, lpBuffer,
         nNumberOfBytesToRead, pnBytesRead, pnMinNumberOfBytesNeeded);
 
-    pLog = (PLOG_INFO)hEventLog;
-    if (!pLog)
+    if(!pnBytesRead || !pnMinNumberOfBytesNeeded)
     {
-        SetLastError(ERROR_INVALID_HANDLE);
+        SetLastError(ERROR_INVALID_PARAMETER);
         return FALSE;
     }
 
-    Status = ElfrReadELA(pLog->BindingHandle,
-                         pLog->LogHandle,
-                         dwReadFlags,
-                         dwRecordOffset,
-                         nNumberOfBytesToRead,
-                         lpBuffer,
-                         &bytesRead,
-                         &minNumberOfBytesNeeded);
-    if (!NT_SUCCESS(Status))
+    /* If buffer is NULL set nNumberOfBytesToRead to 0 to prevent rpcrt4 from
+       trying to access a null pointer */
+    if (!lpBuffer)
     {
-        SetLastError(RtlNtStatusToDosError(Status));
-        return FALSE;
+        nNumberOfBytesToRead = 0;
+    }
+
+    RpcTryExcept
+    {
+        Status = ElfrReadELA(hEventLog,
+                             dwReadFlags,
+                             dwRecordOffset,
+                             nNumberOfBytesToRead,
+                             lpBuffer,
+                             &bytesRead,
+                             &minNumberOfBytesNeeded);
+    }
+    RpcExcept(EXCEPTION_EXECUTE_HANDLER)
+    {
+        Status = I_RpcMapWin32Status(RpcExceptionCode());
     }
+    RpcEndExcept;
 
     *pnBytesRead = (DWORD)bytesRead;
     *pnMinNumberOfBytesNeeded = (DWORD)minNumberOfBytesNeeded;
 
+    if (!NT_SUCCESS(Status))
+    {
+        SetLastError(RtlNtStatusToDosError(Status));
+        return FALSE;
+    }
+
     return TRUE;
 }
 
@@ -636,7 +745,6 @@ ReadEventLogW(IN HANDLE hEventLog,
               OUT DWORD *pnBytesRead,
               OUT DWORD *pnMinNumberOfBytesNeeded)
 {
-    PLOG_INFO pLog;
     NTSTATUS Status;
     DWORD bytesRead, minNumberOfBytesNeeded;
 
@@ -644,30 +752,44 @@ ReadEventLogW(IN HANDLE hEventLog,
         hEventLog, dwReadFlags, dwRecordOffset, lpBuffer,
         nNumberOfBytesToRead, pnBytesRead, pnMinNumberOfBytesNeeded);
 
-    pLog = (PLOG_INFO)hEventLog;
-    if (!pLog)
+    if(!pnBytesRead || !pnMinNumberOfBytesNeeded)
     {
-        SetLastError(ERROR_INVALID_HANDLE);
+        SetLastError(ERROR_INVALID_PARAMETER);
         return FALSE;
     }
 
-    Status = ElfrReadELW(pLog->BindingHandle,
-                         pLog->LogHandle,
-                         dwReadFlags,
-                         dwRecordOffset,
-                         nNumberOfBytesToRead,
-                         lpBuffer,
-                         &bytesRead,
-                         &minNumberOfBytesNeeded);
-    if (!NT_SUCCESS(Status))
+    /* If buffer is NULL set nNumberOfBytesToRead to 0 to prevent rpcrt4 from
+       trying to access a null pointer */
+    if (!lpBuffer)
     {
-        SetLastError(RtlNtStatusToDosError(Status));
-        return FALSE;
+        nNumberOfBytesToRead = 0;
+    }
+
+    RpcTryExcept
+    {
+        Status = ElfrReadELW(hEventLog,
+                             dwReadFlags,
+                             dwRecordOffset,
+                             nNumberOfBytesToRead,
+                             lpBuffer,
+                             &bytesRead,
+                             &minNumberOfBytesNeeded);
+    }
+    RpcExcept(EXCEPTION_EXECUTE_HANDLER)
+    {
+        Status = I_RpcMapWin32Status(RpcExceptionCode());
     }
+    RpcEndExcept;
 
     *pnBytesRead = (DWORD)bytesRead;
     *pnMinNumberOfBytesNeeded = (DWORD)minNumberOfBytesNeeded;
 
+    if (!NT_SUCCESS(Status))
+    {
+        SetLastError(RtlNtStatusToDosError(Status));
+        return FALSE;
+    }
+
     return TRUE;
 }
 
@@ -724,63 +846,39 @@ HANDLE WINAPI
 RegisterEventSourceW(IN LPCWSTR lpUNCServerName,
                      IN LPCWSTR lpSourceName)
 {
-    PLOG_INFO pLog;
-    NTSTATUS Status;
     RPC_UNICODE_STRING SourceName;
+    IELF_HANDLE LogHandle;
+    NTSTATUS Status;
 
     TRACE("%s, %s\n", debugstr_w(lpUNCServerName), debugstr_w(lpSourceName));
 
     SourceName.Buffer = (LPWSTR)lpSourceName;
     SourceName.Length = SourceName.MaximumLength =
         lpSourceName ? wcslen(lpSourceName) * sizeof(WCHAR) : 0;
+    SourceName.MaximumLength += sizeof(WCHAR);
 
-    pLog = HeapAlloc(GetProcessHeap(), 0, sizeof(LOG_INFO));
-    if (!pLog)
+    RpcTryExcept
     {
-        SetLastError(ERROR_NOT_ENOUGH_MEMORY);
-        return NULL;
+        Status = ElfrRegisterEventSourceW((LPWSTR)lpUNCServerName,
+                                          &SourceName,
+                                          &EmptyString,
+                                          1,
+                                          1,
+                                          &LogHandle);
     }
-
-    ZeroMemory(pLog, sizeof(LOG_INFO));
-
-    if (lpUNCServerName == NULL || *lpUNCServerName == 0)
+    RpcExcept(EXCEPTION_EXECUTE_HANDLER)
     {
-        pLog->bLocal = TRUE;
-
-        if (!EvtGetLocalHandle(&pLog->BindingHandle))
-        {
-            HeapFree(GetProcessHeap(), 0, pLog);
-            SetLastError(ERROR_GEN_FAILURE);
-            return NULL;
-        }
+        Status = I_RpcMapWin32Status(RpcExceptionCode());
     }
-    else
-    {
-        pLog->bLocal = FALSE;
+    RpcEndExcept;
 
-        if (!EvtBindRpc(lpUNCServerName, &pLog->BindingHandle))
-        {
-            HeapFree(GetProcessHeap(), 0, pLog);
-            SetLastError(ERROR_INVALID_COMPUTERNAME);
-            return NULL;
-        }
-    }
-
-    Status = ElfrRegisterEventSourceW(pLog->BindingHandle,
-                                      (LPWSTR)lpUNCServerName,
-                                      &SourceName,
-                                      &EmptyString,
-                                      0,
-                                      0,
-                                      &pLog->LogHandle);
     if (!NT_SUCCESS(Status))
     {
         SetLastError(RtlNtStatusToDosError(Status));
-        HeapFree(GetProcessHeap(), 0, pLog);
         return NULL;
     }
 
-    return pLog;
+    return (HANDLE)LogHandle;
 }
 
 
@@ -850,7 +948,7 @@ ReportEventA(IN HANDLE hEventLog,
 
     HeapFree(GetProcessHeap(),
              0,
-             wideStrArray);
+             (PVOID)wideStrArray);
 
     return ret;
 }
@@ -881,22 +979,14 @@ ReportEventW(IN HANDLE hEventLog,
              IN LPCWSTR *lpStrings,
              IN LPVOID lpRawData)
 {
-#if 0
-    PLOG_INFO pLog;
     NTSTATUS Status;
     UNICODE_STRING *Strings;
+    UNICODE_STRING ComputerName;
     WORD i;
 
     TRACE("%p, %u, %u, %lu, %p, %u, %lu, %p, %p\n",
-        hEventLog, wType, wCategory, dwEventID, lpUserSid,
-        wNumStrings, dwDataSize, lpStrings, lpRawData);
-
-    pLog = (PLOG_INFO)hEventLog;
-    if (!pLog)
-    {
-        SetLastError(ERROR_INVALID_HANDLE);
-        return FALSE;
-    }
+          hEventLog, wType, wCategory, dwEventID, lpUserSid,
+          wNumStrings, dwDataSize, lpStrings, lpRawData);
 
     Strings = HeapAlloc(GetProcessHeap(),
                         0,
@@ -910,21 +1000,32 @@ ReportEventW(IN HANDLE hEventLog,
     for (i = 0; i < wNumStrings; i++)
         RtlInitUnicodeString(&Strings[i], lpStrings[i]);
 
-    Status = ElfrReportEventW(pLog->BindingHandle,
-                              pLog->LogHandle,
-                              0, /* FIXME: Time */
-                              wType,
-                              wCategory,
-                              dwEventID,
-                              wNumStrings,
-                              dwDataSize,
-                              L"", /* FIXME: ComputerName */
-                              lpUserSid,
-                              (LPWSTR *)lpStrings, /* FIXME: should be Strings */
-                              lpRawData,
-                              0,
-                              NULL,
-                              NULL);
+    /*FIXME: ComputerName */
+    RtlInitUnicodeString(&ComputerName, L"");
+
+    RpcTryExcept
+    {
+        Status = ElfrReportEventW(hEventLog,
+                                  0, /* FIXME: Time */
+                                  wType,
+                                  wCategory,
+                                  dwEventID,
+                                  wNumStrings,
+                                  dwDataSize,
+                                  (PRPC_UNICODE_STRING) &ComputerName,
+                                  lpUserSid,
+                                  (PRPC_UNICODE_STRING*) &Strings,
+                                  lpRawData,
+                                  0,
+                                  NULL,
+                                  NULL);
+    }
+    RpcExcept(EXCEPTION_EXECUTE_HANDLER)
+    {
+        Status = I_RpcMapWin32Status(RpcExceptionCode());
+    }
+    RpcEndExcept;
+
     HeapFree(GetProcessHeap(), 0, Strings);
 
     if (!NT_SUCCESS(Status))
@@ -934,43 +1035,4 @@ ReportEventW(IN HANDLE hEventLog,
     }
 
     return TRUE;
-#else
-  int i;
-
-    /* partial stub */
-
-  if (wNumStrings == 0)
-    return TRUE;
-
-  if (lpStrings == NULL)
-    return TRUE;
-
-  for (i = 0; i < wNumStrings; i++)
-    {
-      switch (wType)
-        {
-        case EVENTLOG_SUCCESS:
-            TRACE_(eventlog)("Success: %S\n", lpStrings[i]);
-            break;
-
-        case EVENTLOG_ERROR_TYPE:
-            ERR_(eventlog)("Error: %S\n", lpStrings[i]);
-            break;
-
-        case EVENTLOG_WARNING_TYPE:
-            WARN_(eventlog)("Warning: %S\n", lpStrings[i]);
-            break;
-
-        case EVENTLOG_INFORMATION_TYPE:
-            TRACE_(eventlog)("Info: %S\n", lpStrings[i]);
-            break;
-
-        default:
-            TRACE_(eventlog)("Type %hu: %S\n", wType, lpStrings[i]);
-            break;
-        }
-    }
-
-  return TRUE;
-#endif
 }