📄 debug.c
字号:
RtlInitAnsiString(&AnsiString, fileName);
Status = RtlAnsiStringToUnicodeString(&UnicodeString, &AnsiString, FALSE);
if(NT_SUCCESS(Status))
{
InitializeObjectAttributes (&ObjAttributes, &UnicodeString, OBJ_CASE_INSENSITIVE, NULL, NULL);
Status = ZwCreateFile(&gsDebugOutFile,
FILE_APPEND_DATA,
&ObjAttributes,
&IoStatus,
0,
FILE_ATTRIBUTE_NORMAL,
FILE_SHARE_READ|FILE_SHARE_WRITE,
FILE_OPEN_IF,
FILE_SYNCHRONOUS_IO_NONALERT,
NULL,
0);
if (!NT_SUCCESS(Status))
{
gsCurrentDebugOut = DOUT_CONSOLE;
Ext2DbgPrint (D_ERROR, "Ext2DbgSetOut: *** ZwCreateFile failed (%08lX, %s). ***",
Status, Ext2DbgNtStatusToString(Status));
}
}
}
RELEASEMUTEX ();
return old;
}
__U32 Ext2DbgPrint (__U32 flag, PSZ format, ...)
/*
* Description: Writes a debug message to the current output medium.
*
* Arguments: printf like variable args.
*
* Return value: None.
*
* Notes:
*
* o The debug medium must be initialised.
*
* o Format of the message:
*
* Console:
*
* $DRIVER_NAME [Process] [module]: message
*
* File:
*
* [Process] [module]: message
*
* o An eol is always appended to the message.
*
* o The variable length specifier does not work (e.g.,%*s).
*
*/
{
va_list argptr;
__U32 which = 0;
__U32 len = 0;
__U32 len2 = 0;
__U8 buf[BUFSZ];
NTSTATUS Status;
IO_STATUS_BLOCK IoStatus;
ACQUIREMUTEX ();
RtlZeroMemory (buf, sizeof (buf));
RtlZeroMemory (&IoStatus, sizeof (IO_STATUS_BLOCK));
do
{
BREAK_IF_TRUE (flag > D_END);
if (D_ALWAYS == flag)
{
which = 0;
}
else
{
which = 1;
while (0 == (flag & 1))
{
which++;
flag >>= 1;
}
}
len = sprintf (buf, "[%16s] [%s]: ", GetCurrentProcessName(), gsDebugPrefix[which]);
va_start(argptr, format);
len2 = vsprintf(buf+len, format, argptr);
va_end(argptr);
len = len + len2;
switch (gsCurrentDebugOut)
{
case DOUT_FILE:
buf[len] = '\n';
Status = ZwWriteFile (
gsDebugOutFile,
NULL,
NULL,
NULL,
&IoStatus,
buf,
len+1,
NULL,
NULL);
BREAK_IF_EQUAL (STATUS_SUCCESS, Status);
// We encountered some error, try dumping it to the console from now on.
// break;
Ext2DbgSetOut (DOUT_CONSOLE, NULL);
DbgPrint("%s *** ZwWriteFile in Ext2DbgPrint failed *** (%08lX, %s)",
DRIVER_NAME, Status, Ext2DbgNtStatusToString(Status));
case DOUT_CONSOLE:
default:
buf[len] = '\0';
DbgPrint("%s %s", DRIVER_NAME, buf);
break;
}
} while (FALSE);
RELEASEMUTEX();
return len;
}
__U32 Ext2DbgPrintCall (__U32 flag, PDEVICE_OBJECT DeviceObject, PIRP Irp)
{
PUCHAR FileName;
PFILE_OBJECT FileObject;
PIO_STACK_LOCATION IoStackLocation;
PEXT2_FCB Fcb;
FILE_INFORMATION_CLASS FileInformationClass;
FS_INFORMATION_CLASS FsInformationClass;
IoStackLocation = IoGetCurrentIrpStackLocation(Irp);
FileObject = IoStackLocation->FileObject;
FileName = "Unknown";
if (DeviceObject == gExt2Global->DeviceObject)
{
FileName = "\\" DRIVER_NAME;
}
else if (FileObject && FileObject->FsContext)
{
Fcb = (PEXT2_FCB) FileObject->FsContext;
if (Fcb->Identifier.Type == EXT2VCB)
{
FileName = "\\Volume";
}
else if (Fcb->Identifier.Type == EXT2FCB &&
Fcb->AnsiFileName.Buffer)
{
FileName = Fcb->AnsiFileName.Buffer;
}
}
switch (IoStackLocation->MajorFunction)
{
case IRP_MJ_CREATE:
FileName = NULL;
if (DeviceObject == gExt2Global->DeviceObject)
{
FileName = "\\" DRIVER_NAME;
}
else if (IoStackLocation->FileObject->FileName.Length == 0)
{
FileName = "\\Volume";
}
if (FileName)
{
Ext2DbgPrint(flag, "%s %s",
gsIRPMajorStrings[IoStackLocation->MajorFunction],
FileName
);
}
else if (IoStackLocation->FileObject->FileName.Buffer)
{
Ext2DbgPrint(flag, "%s %s",
gsIRPMajorStrings[IoStackLocation->MajorFunction],
IoStackLocation->FileObject->FileName.Buffer
);
}
else
{
Ext2DbgPrint(flag, "%s %s",
gsIRPMajorStrings[IoStackLocation->MajorFunction],
"Unknown"
);
}
break;
case IRP_MJ_CLOSE:
Ext2DbgPrint(flag, "%s %s",
gsIRPMajorStrings[IoStackLocation->MajorFunction],
FileName
);
break;
case IRP_MJ_READ:
if (IoStackLocation->MinorFunction & IRP_MN_COMPLETE)
{
Ext2DbgPrint(flag, "%s %s IRP_MN_COMPLETE",
gsIRPMajorStrings[IoStackLocation->MajorFunction],
FileName
);
}
else
{
Ext2DbgPrint(flag, "%s %s Offset: %I64u Length: %u %s%s%s%s%s%s",
gsIRPMajorStrings[IoStackLocation->MajorFunction],
FileName,
IoStackLocation->Parameters.Read.ByteOffset.QuadPart,
IoStackLocation->Parameters.Read.Length,
(IoStackLocation->MinorFunction & IRP_MN_DPC ? "IRP_MN_DPC " : ""),
(IoStackLocation->MinorFunction & IRP_MN_MDL ? "IRP_MN_MDL " : ""),
(IoStackLocation->MinorFunction & IRP_MN_COMPRESSED ? "IRP_MN_COMPRESSED " : ""),
(Irp->Flags & IRP_PAGING_IO ? "IRP_PAGING_IO " : ""),
(Irp->Flags & IRP_NOCACHE ? "IRP_NOCACHE " : ""),
(FileObject->Flags & FO_SYNCHRONOUS_IO ? "FO_SYNCHRONOUS_IO " : "")
);
}
break;
case IRP_MJ_QUERY_INFORMATION:
FileInformationClass = IoStackLocation->Parameters.QueryFile.FileInformationClass;
if (FileInformationClass <= FileMaximumInformation)
{
Ext2DbgPrint(flag, "%s %s %s",
gsIRPMajorStrings[IoStackLocation->MajorFunction],
FileName,
gsFileInfoClassStrings[FileInformationClass]
);
}
else
{
Ext2DbgPrint (flag, "%s %s Unknown FileInformationClass %u",
gsIRPMajorStrings[IoStackLocation->MajorFunction],
FileName,
FileInformationClass
);
}
break;
case IRP_MJ_SET_INFORMATION:
FileInformationClass =
IoStackLocation->Parameters.SetFile.FileInformationClass;
if (FileInformationClass <= FileMaximumInformation)
{
Ext2DbgPrint (flag, "%s %s %s",
gsIRPMajorStrings[IoStackLocation->MajorFunction],
FileName
⌨️ 快捷键说明
复制代码
Ctrl + C
搜索代码
Ctrl + F
全屏模式
F11
切换主题
Ctrl + Shift + D
显示快捷键
?
增大字号
Ctrl + =
减小字号
Ctrl + -