// Concatenates meta information such as the current time and a process ID to
// user given log message.
EXTERN_C static NTSTATUS LogpMakePrefix(_In_ ULONG Level,
_In_ const char *FunctionName,
_In_ const char *LogMessage,
_Out_ char *LogBuffer,
_In_ size_t LogBufferLength) {
char const *levelString = nullptr;
switch (Level) {
case LOGP_LEVEL_DEBUG:
levelString = "DBG";
break;
case LOGP_LEVEL_INFO:
levelString = "INF";
break;
case LOGP_LEVEL_WARN:
levelString = "WRN";
break;
case LOGP_LEVEL_ERROR:
levelString = "ERR";
break;
default:
return STATUS_INVALID_PARAMETER;
}
auto status = STATUS_SUCCESS;
char timeBuffer[20] = {};
if ((g_LogpDebugFlag & LOG_OPT_DISABLE_TIME) == 0) {
// Want the current time.
TIME_FIELDS timeFields;
LARGE_INTEGER systemTime, localTime;
KeQuerySystemTime(&systemTime);
ExSystemTimeToLocalTime(&systemTime, &localTime);
RtlTimeToTimeFields(&localTime, &timeFields);
status = RtlStringCchPrintfA(timeBuffer, RTL_NUMBER_OF(timeBuffer),
"%02u:%02u:%02u.%03u\t", timeFields.Hour,
timeFields.Minute, timeFields.Second,
timeFields.Milliseconds);
if (!NT_SUCCESS(status)) {
return status;
}
}
char functionNameBuffer[50] = {};
if ((g_LogpDebugFlag & LOG_OPT_DISABLE_FUNCTION_NAME) == 0) {
// Want the function name
const auto baseFunctionName = LogpFindBaseFunctionName(FunctionName);
status = RtlStringCchPrintfA(functionNameBuffer,
RTL_NUMBER_OF(functionNameBuffer), "%-40s\t",
baseFunctionName);
if (!NT_SUCCESS(status)) {
return status;
}
}
//
// It uses PsGetProcessId(PsGetCurrentProcess()) instead of
// PsGetCurrentThreadProcessId() because the later sometimes returns
// unwanted value, for example:
// PID == 4 but its image name != ntoskrnl.exe
// The author is guessing that it is related to attaching processes but
// not quite sure. The former way works as expected.
//
status = RtlStringCchPrintfA(
LogBuffer, LogBufferLength, "%s%s\t%5lu\t%5lu\t%-15s\t%s%s\r\n", timeBuffer,
levelString,
reinterpret_cast<ULONG_PTR>(PsGetProcessId(PsGetCurrentProcess())),
reinterpret_cast<ULONG_PTR>(PsGetCurrentThreadId()),
PsGetProcessImageFileName(PsGetCurrentProcess()), functionNameBuffer,
LogMessage);
return status;
}
// Concatenates meta information such as the current time and a process ID to
// user given log message.
_Use_decl_annotations_ static NTSTATUS LogpMakePrefix(
ULONG level, const char *function_name, const char *log_message,
char *log_buffer, SIZE_T log_buffer_length) {
char const *level_string = nullptr;
switch (level) {
case kLogpLevelDebug:
level_string = "DBG\t";
break;
case kLogpLevelInfo:
level_string = "INF\t";
break;
case kLogpLevelWarn:
level_string = "WRN\t";
break;
case kLogpLevelError:
level_string = "ERR\t";
break;
default:
return STATUS_INVALID_PARAMETER;
}
auto status = STATUS_SUCCESS;
char time_buffer[20] = {};
if ((g_logp_debug_flag & kLogOptDisableTime) == 0) {
// Want the current time.
TIME_FIELDS time_fields;
LARGE_INTEGER system_time, local_time;
KeQuerySystemTime(&system_time);
ExSystemTimeToLocalTime(&system_time, &local_time);
RtlTimeToTimeFields(&local_time, &time_fields);
status = RtlStringCchPrintfA(time_buffer, RTL_NUMBER_OF(time_buffer),
"%02u:%02u:%02u.%03u\t", time_fields.Hour,
time_fields.Minute, time_fields.Second,
time_fields.Milliseconds);
if (!NT_SUCCESS(status)) {
return status;
}
}
// Want the function name
char function_name_buffer[50] = {};
if ((g_logp_debug_flag & kLogOptDisableFunctionName) == 0) {
const auto base_function_name = LogpFindBaseFunctionName(function_name);
status = RtlStringCchPrintfA(function_name_buffer,
RTL_NUMBER_OF(function_name_buffer), "%-40s\t",
base_function_name);
if (!NT_SUCCESS(status)) {
return status;
}
}
// Want the processor number
char processro_number[10] = {};
if ((g_logp_debug_flag & kLogOptDisableProcessorNumber) == 0) {
status =
RtlStringCchPrintfA(processro_number, RTL_NUMBER_OF(processro_number),
"#%lu\t", KeGetCurrentProcessorNumberEx(nullptr));
if (!NT_SUCCESS(status)) {
return status;
}
}
// It uses PsGetProcessId(PsGetCurrentProcess()) instead of
// PsGetCurrentThreadProcessId() because the later sometimes returns
// unwanted value, for example:
// PID == 4 but its image name != ntoskrnl.exe
// The author is guessing that it is related to attaching processes but
// not quite sure. The former way works as expected.
status = RtlStringCchPrintfA(
log_buffer, log_buffer_length, "%s%s%s%5Iu\t%5Iu\t%-15s\t%s%s\r\n",
time_buffer, level_string, processro_number,
reinterpret_cast<ULONG_PTR>(PsGetProcessId(PsGetCurrentProcess())),
reinterpret_cast<ULONG_PTR>(PsGetCurrentThreadId()),
PsGetProcessImageFileName(PsGetCurrentProcess()), function_name_buffer,
log_message);
return status;
}
