FileTimeToSystemTime(&ftLocal, pSystemTime);
}
+VOID SystemTimeToEventTime(SYSTEMTIME * pSystemTime, DWORD * pEventTime)
+{
+ SYSTEMTIME st1970 = { 1970, 1, 0, 1, 0, 0, 0, 0 };
+ union
+ {
+ FILETIME ft;
+ ULONGLONG ll;
+ } Time, u1970;
+
+ SystemTimeToFileTime(pSystemTime, &Time.ft);
+ SystemTimeToFileTime(&st1970, &u1970.ft);
+ *pEventTime = (DWORD)((Time.ll - u1970.ll) / 10000000ull);
+}
+
VOID PRINT_HEADER(PEVENTLOGHEADER header)
{
DPRINT("HeaderSize = %d\n", header->HeaderSize);
{
DWORD dwWritten;
DWORD dwRead;
+ SYSTEMTIME st;
EVENTLOGEOF EofRec;
PEVENTLOGRECORD RecBuf;
LARGE_INTEGER logFileSize;
- LARGE_INTEGER SystemTime;
ULONG RecOffSet;
ULONG WriteOffSet;
if (!Buffer)
return FALSE;
- NtQuerySystemTime(&SystemTime);
- RtlTimeToSecondsSince1970(&SystemTime, &((PEVENTLOGRECORD) Buffer)->TimeWritten);
+ GetSystemTime(&st);
+ SystemTimeToEventTime(&st, &((PEVENTLOGRECORD) Buffer)->TimeWritten);
EnterCriticalSection(&LogFile->cs);
PBYTE LogfAllocAndBuildNewRecord(LPDWORD lpRecSize,
DWORD dwRecordNumber,
- DWORD dwTime,
WORD wType,
WORD wCategory,
DWORD dwEventId,
{
DWORD dwRecSize;
PEVENTLOGRECORD pRec;
+ SYSTEMTIME SysTime;
WCHAR *str;
UINT i, pos;
PBYTE Buffer;
sizeof(EVENTLOGRECORD) + (lstrlenW(ComputerName) +
lstrlenW(SourceName) + 2) * sizeof(WCHAR);
- if (dwRecSize % sizeof(DWORD) != 0)
- dwRecSize += sizeof(DWORD) - (dwRecSize % sizeof(DWORD));
+ if (dwRecSize % 4 != 0)
+ dwRecSize += 4 - (dwRecSize % 4);
dwRecSize += dwSidLength;
}
dwRecSize += dwDataSize;
- if (dwRecSize % sizeof(DWORD) != 0)
- dwRecSize += sizeof(DWORD) - (dwRecSize % sizeof(DWORD));
+ if (dwRecSize % 4 != 0)
+ dwRecSize += 4 - (dwRecSize % 4);
- dwRecSize += sizeof(DWORD);
+ dwRecSize += 4;
Buffer = HeapAlloc(MyHeap, HEAP_ZERO_MEMORY, dwRecSize);
pRec->Reserved = LOGFILE_SIGNATURE;
pRec->RecordNumber = dwRecordNumber;
- pRec->TimeGenerated = dwTime;
- pRec->TimeWritten = dwTime;
+ GetSystemTime(&SysTime);
+ SystemTimeToEventTime(&SysTime, &pRec->TimeGenerated);
+ SystemTimeToEventTime(&SysTime, &pRec->TimeWritten);
pRec->EventID = dwEventId;
pRec->EventType = wType;
pRec->UserSidOffset = pos;
- if (pos % sizeof(DWORD) != 0)
- pos += sizeof(DWORD) - (pos % sizeof(DWORD));
+ if (pos % 4 != 0)
+ pos += 4 - (pos % 4);
if (dwSidLength)
{
pos += dwDataSize;
}
- if (pos % sizeof(DWORD) != 0)
- pos += sizeof(DWORD) - (pos % sizeof(DWORD));
+ if (pos % 4 != 0)
+ pos += 4 - (pos % 4);
*((PDWORD) (Buffer + pos)) = dwRecSize;
DWORD lastRec;
DWORD recSize;
DWORD dwError;
- DWORD dwTime;
- LARGE_INTEGER SystemTime;
if (!GetComputerNameW(szComputerName, &dwComputerNameLength))
{
return;
}
- NtQuerySystemTime(&SystemTime);
- RtlTimeToSecondsSince1970(&SystemTime, &dwTime);
-
lastRec = LogfGetCurrentRecord(pEventSource->LogFile);
logBuffer = LogfAllocAndBuildNewRecord(&recSize,
- dwTime,
lastRec,
wType,
wCategory,
DWORD dwRecSize;
NTSTATUS Status;
PLOGFILE SystemLog = NULL;
- LARGE_INTEGER SystemTime;
- ULONG Seconds;
DPRINT("ProcessPortMessage() called\n");
Message = (PIO_ERROR_LOG_MESSAGE) & Request.Message;
ulRecNum = SystemLog ? SystemLog->Header.CurrentRecordNumber : 0;
- NtQuerySystemTime(&SystemTime);
- RtlTimeToSecondsSince1970(&SystemTime, &Seconds);
-
- pRec = (PEVENTLOGRECORD) LogfAllocAndBuildNewRecord(&dwRecSize, Seconds,
+ pRec = (PEVENTLOGRECORD) LogfAllocAndBuildNewRecord(&dwRecSize,
ulRecNum, Message->Type, Message->EntryData.EventCategory,
Message->EntryData.ErrorCode,
(WCHAR *) (((PBYTE) Message) + Message->DriverNameOffset),