// Logs the entry according to Attribute and the thread condition. EXTERN_C static NTSTATUS LogpPut(_In_ char *Message, _In_ ULONG Attribute) { auto status = STATUS_SUCCESS; // Log the entry to a file or buffer. auto &info = g_LogpLogBufferInfo; if (LogpIsLogFileEnabled(info)) { // Can it log it to a file now? if (((Attribute & LOGP_LEVEL_OPT_SAFE) == 0) && KeGetCurrentIrql() == PASSIVE_LEVEL && !KeAreAllApcsDisabled()) { // Yes, it can. Do it. LogpWriteLogBufferToFile(&info); status = LogpWriteMessageToFile(Message, info); } else { // No, it cannot. Buffer it. status = LogpBufferMessage(Message, &info); } } // Can it safely be printed? if (KeGetCurrentIrql() >= CLOCK_LEVEL) { return STATUS_UNSUCCESSFUL; } const auto cr = strlen(Message) - 2; Message[cr] = '\n'; Message[cr + 1] = '\0'; DbgPrintEx(DPFLTR_DEFAULT_ID, DPFLTR_ERROR_LEVEL, "%s", Message); return status; }
EXTERN_C static VOID LogpBufferFlushThreadRoutine(_In_ void *StartContext) { PAGED_CODE(); auto status = STATUS_SUCCESS; auto info = reinterpret_cast<LogBufferInfo *>(StartContext); LOG_DEBUG("Log thread started."); NT_ASSERT(LogpIsLogFileEnabled(*info)); while (info->BufferFlushThreadShouldBeAlive) { LogpSleep(LOGP_AUTO_FLUSH_INTERVAL_MSEC); if (info->LogBufferHead[0]) { NT_ASSERT(KeGetCurrentIrql() == PASSIVE_LEVEL); NT_ASSERT(!KeAreAllApcsDisabled()); status = LogpWriteLogBufferToFile(info); // Do not flush the file for overall performance. Even a case of // bug check, we should be able to recover logs by looking at both // log buffers. } } LOG_DEBUG("Log thread is ending."); PsTerminateSystemThread(status); }
// Logs the entry according to attribute and the thread condition. _Use_decl_annotations_ static NTSTATUS LogpPut(char *message, ULONG attribute) { auto status = STATUS_SUCCESS; auto do_DbgPrint = ((attribute & kLogpLevelOptSafe) == 0 && KeGetCurrentIrql() < CLOCK_LEVEL); // Log the entry to a file or buffer. auto &info = g_logp_log_buffer_info; if (LogpIsLogFileEnabled(info)) { // Can it log it to a file now? if (((attribute & kLogpLevelOptSafe) == 0) && KeGetCurrentIrql() == PASSIVE_LEVEL && LogpIsLogFileActivated(info)) { #pragma warning(push) #pragma warning(disable : 28123) if (!KeAreAllApcsDisabled()) { // Yes, it can. Do it. LogpFlushLogBuffer(&info); status = LogpWriteMessageToFile(message, info); } #pragma warning(pop) } else { // No, it cannot. Set the prited bit if needed, and then buffer it. if (do_DbgPrint) { LogpSetPrintedBit(message, true); } status = LogpBufferMessage(message, &info); LogpSetPrintedBit(message, false); } } // Can it safely be printed? if (do_DbgPrint) { LogpDoDbgPrint(message); } return status; }