// log to a file void LogToFile(wchar_t* OutFile) { HANDLE hOutFile = CreateFile(OutFile, GENERIC_WRITE, FILE_SHARE_WRITE | FILE_SHARE_READ | FILE_SHARE_DELETE, NULL, CREATE_ALWAYS, FILE_FLAG_SEQUENTIAL_SCAN, NULL); Step_Event* se; LONG64 LogCnt = 1; DWORD wrote = 0; while (hOutFile != INVALID_HANDLE_VALUE) { // We should try to queue up 4096/sizeof(step_event) and do writes based on 4k // then flush out if we get any of the CtrlHandler events // double check to unblock LogPopIP se = LogPopIP(); if (se != NULL && se->RIP != 0) { if (!WriteFile(hOutFile, se, sizeof(Step_Event) * LogCnt, &wrote, NULL)) { wprintf(L"Error writing output file %s", OutFile); return; } memset(se, 0, sizeof(Step_Event) * LogCnt); se = NULL; } else Sleep(0); } }
// just loop and dump info void LogDump() { Step_Event* se; while (true) { se = LogPopIP(); if (se != NULL && se->RIP != 0) { wprintf(L"tid [%d] flags[%x] rip[%llx]\n", se->u.TID, se->u.eFlags, se->RIP); se->RIP = 0; se->u.Synth = 0; se = NULL; } Sleep(0); } }
int main() #endif { SetupLogger(STRACE_LOG_BUFFER_SIZE); //NoLogThrId = GetCurrentThreadId(); HMODULE dNTdll = GetModuleHandleA("ntdll.dll"); loadSystemDebugControl = (NtSystemDebugControl)GetProcAddress(dNTdll, "NtSystemDebugControl"); if (loadSystemDebugControl == NULL) wprintf(L"Not using NtSystemDebugControl\n"); if (Initalize(vEhTracer)) wprintf(L"Initialize failed\n"); #ifdef ALIB_BUILD printf("installing on current thread\n"); // this is since were a static lib attach InstallThread(GetCurrentThreadId(), 9); return 0; #endif HANDLE hTestThr = CreateThread(NULL, 0, (LPTHREAD_START_ROUTINE)DoRandomTestStuff, 0, CREATE_SUSPENDED, NULL); InstallThread(GetThreadId(hTestThr), 4); ResumeThread(hTestThr); //wprintf(L"hit a key to start dumping logs"); #if STANDALONE_APREP Step_Event* se; while (true) { se = LogPopIP(); if(se != NULL && se->RIP != 0) { // major slowdown if we do this ;) #if FALSE wprintf(L"tid [%d] flags[%x] rip[%llx]\n", se->u.TID, se->u.eFlags, se->RIP); #endif se->RIP = 0; se->u.Synth = 0; se = NULL; } Sleep(0); } #endif Sleep(-1); return 0; }