Question

我写了一个Windows驱动程序（文件系统）。我的所有日志都由DbgPrint函数打印。使用DebugView程序（捕获内核 - ），我可以看到所有日志。

我想显示/保存其日志。所以，我想听内核消息。

我试着写一些：

struct DbWinBuffer
{
    DWORD dwProcessId;
    char data[4096 - sizeof(DWORD)];
};

DbWinBuffer* dbBuffer;

HANDLE hAckEvent;
HANDLE hEvent;
HANDLE hSharedFile;

SECURITY_DESCRIPTOR sd;
SECURITY_ATTRIBUTES sa;

sa.nLength = sizeof(SECURITY_ATTRIBUTES);
sa.bInheritHandle = true;
sa.lpSecurityDescriptor = &sd;

if (!InitializeSecurityDescriptor(&sd, SECURITY_DESCRIPTOR_REVISION))
{
    printf("ERROR: InitializeSecurityDescriptor\\n");
    return 1;
}

if (!SetSecurityDescriptorDacl(&sd, true, 0, false))
{
    printf("ERROR: SetSecurityDescriptorDacl\n");
    return 1;
}

hAckEvent = CreateEvent(&sa, false, false, L"DBWIN_BUFFER_READY");
if (!hAckEvent)
{
    printf("ERROR: CreateEvent(\\"DBWIN_BUFFER_READY\\")\\n");
    return 1;
}

hEvent = CreateEvent(&sa, false, false, L"DBWIN_DATA_READY");
if (!hEvent)
{
    printf("ERROR: CreateEvent(\\"DBWIN_DATA_READY\\")\\n");
    return 1;
}

hSharedFile = CreateFileMapping((HANDLE)-1, &sa, PAGE_READWRITE, 0, 4096, L"DBWIN_BUFFER");
if (!hSharedFile)
{
    printf("ERROR: CreateFileMapping(\\"DBWIN_BUFFER\\")\\n");
    return 1;
}

dbBuffer = static_cast<DbWinBuffer*>(MapViewOfFile(hSharedFile, FILE_MAP_READ, 0, 0, 4096));
if (!dbBuffer)
{
    printf("ERROR: MapViewOfFile\\n");
    return 1;
}

SetEvent(hAckEvent);

DWORD pid = GetCurrentProcessId();
printf("Tracing PID: %dnn", pid);

for (;;)
{
    DWORD ret = WaitForSingleObject(hEvent, INFINITE);
    if (ret == WAIT_FAILED)
    {
        printf("ERROR: WaitForSingleObject\\n");
        return 1;
    }
    SetEvent(hAckEvent);
}

在这个例子中，我只得到OutputDebugString，而不是DbgPrint。如何获取DbgPrint消息？

编写我自己的DebugView版本

0 个答案: