IoWriteErrorLogEntry產生Event Log

Eventlog Blog：http://driverentry.com.br/en/blog/?p=348

字串處理函數：http://mzf2008.blog.163.com/blog/static/3559978620101112115510592/

1.寫mc檔案

MessageIdTypedef = NTSTATUS

SeverityNames =
(
    Success         = 0x0:STATUS_SEVERITY_SUCCESS
    Informational   = 0x1:STATUS_SEVERITY_INFORMATIONAL
    Warning         = 0x2:STATUS_SEVERITY_WARNING
    Error           = 0x3:STATUS_SEVERITY_ERROR
)

FacilityNames =
(
    System          = 0x0
    DriverEntryLogs = 0x2A:DRIVERENTRY_FACILITY_CODE
)

LanguageNames =
(
    English     = 0x0409:msg00002
)

MessageId = 0x0001
Facility = DriverEntryLogs
Severity = Informational
SymbolicName = EVT_HELLO_MESSAGE

Language = English
Hello world!
.

MessageId = 0x0002
Facility = DriverEntryLogs
Severity = Warning
SymbolicName = EVT_DEIOS_MESSAGE

Language = English
The  %2 Deios function/module KdPrint:%3.
.

詳述：MSDN

http://msdn.microsoft.com/en-us/library/windows/hardware/ff543017(v=vs.85).aspx#ddk_compiling_the_error_message_text_file_kg

2. mc.exe將mc檔案生產rc、bin和.h檔案，利用IO_ERROR_LOG_PACKET structure、IoAllocateErrorLogEntry和IoWriteErrorLogEntry函數產生Event日誌

Event Log的構成

詳述：MSDN

http://msdn.microsoft.com/en-us/library/windows/hardware/ff550571(v=vs.85).aspx

http://msdn.microsoft.com/en-us/library/windows/hardware/ff566411(v=vs.85).aspx

3.載入完驅動後需要在註冊表中載入sys作為image file正常方可正常顯示日誌內容

詳述：MSDN

http://msdn.microsoft.com/en-us/library/windows/hardware/ff560866(v=vs.85).aspx