IoWriteErrorLogEntry生成Event Log

Eventlog Blog：http://driverentry.com.br/en/blog/?p=348

字符串处理函数：http://mzf2008.blog.163.com/blog/static/3559978620101112115510592/

1.写mc文件

MessageIdTypedef = NTSTATUS

SeverityNames =
(
    Success         = 0x0:STATUS_SEVERITY_SUCCESS
    Informational   = 0x1:STATUS_SEVERITY_INFORMATIONAL
    Warning         = 0x2:STATUS_SEVERITY_WARNING
    Error           = 0x3:STATUS_SEVERITY_ERROR
)

FacilityNames =
(
    System          = 0x0
    DriverEntryLogs = 0x2A:DRIVERENTRY_FACILITY_CODE
)

LanguageNames =
(
    English     = 0x0409:msg00002
)

MessageId = 0x0001
Facility = DriverEntryLogs
Severity = Informational
SymbolicName = EVT_HELLO_MESSAGE

Language = English
Hello world!
.

MessageId = 0x0002
Facility = DriverEntryLogs
Severity = Warning
SymbolicName = EVT_DEIOS_MESSAGE

Language = English
The  %2 Deios function/module KdPrint:%3.
.

详述：MSDN http://msdn.microsoft.com/en-us/library/windows/hardware/ff543017(v=vs.85).aspx#ddk_compiling_the_error_message_text_file_kg

2. mc.exe将mc文件生产rc、bin和.h文件，利用IO_ERROR_LOG_PACKET structure、IoAllocateErrorLogEntry和IoWriteErrorLogEntry函数生成Event日志

Event Log的构成

详述：MSDN http://msdn.microsoft.com/en-us/library/windows/hardware/ff550571(v=vs.85).aspx

http://msdn.microsoft.com/en-us/library/windows/hardware/ff566411(v=vs.85).aspx

3.加载完驱动后需要在注册表中加载sys作为image file正常方可正常显示日志内容

详述：MSDN http://msdn.microsoft.com/en-us/library/windows/hardware/ff560866(v=vs.85).aspx