无法在简单的驱动程序中生成 wpp 跟踪
我尝试从一个非常简单的驱动程序显示 wpp 日志。我遵循了这个 教程。
下面是我的简单驱动程序的代码：
#include <ntddk.h>
#include <wdf.h>
#include "trace.h"
#include "driver.tmh"
DRIVER_INITIALIZE DriverEntry;
EVT_WDF_DRIVER_DEVICE_ADD PouetEvtDeviceAdd;
NTSTATUS
DriverEntry(
_In_ PDRIVER_OBJECT DriverObject,
_In_ PUNICODE_STRING RegistryPath
)
{
// NTSTATUS variable to record success or failure
NTSTATUS status = STATUS_SUCCESS;
// Initialize WPP tracing in DriverEntry
WPP_INIT_TRACING(DriverObject, RegistryPath);
// Allocate the driver configuration object
WDF_DRIVER_CONFIG config;
// Print "Hello World" for DriverEntry
KdPrintEx((DPFLTR_IHVDRIVER_ID, DPFLTR_INFO_LEVEL, "KmdfHelloWorld: DriverEntry1\n"));
DoTraceMessage(TRACE_DRIVER, "DoTraceMessage\n");
KdPrintEx((DPFLTR_IHVDRIVER_ID, DPFLTR_INFO_LEVEL, "KmdfHelloWorld: DriverEntry2\n"));
// Initialize the driver configuration object to register the
// entry point for the EvtDeviceAdd callback, KmdfHelloWorldEvtDeviceAdd
WDF_DRIVER_CONFIG_INIT(&config, PouetEvtDeviceAdd);
// Finally, create the driver object
status = WdfDriverCreate(DriverObject, RegistryPath, WDF_NO_OBJECT_ATTRIBUTES, &config, WDF_NO_HANDLE );
return status;
}
NTSTATUS
PouetEvtDeviceAdd(
_In_ WDFDRIVER Driver,
_Inout_ PWDFDEVICE_INIT DeviceInit
)
{
// We're not using the driver object,
// so we need to mark it as unreferenced
UNREFERENCED_PARAMETER(Driver);
NTSTATUS status;
// Allocate the device object
WDFDEVICE hDevice;
// Print "Hello World"
KdPrintEx((DPFLTR_IHVDRIVER_ID, DPFLTR_INFO_LEVEL, "KmdfHelloWorld: PouetEvtDeviceAdd\n"));
DoTraceMessage(TRACE_DRIVER, "DoTraceMessage2\n");
KdPrintEx((DPFLTR_IHVDRIVER_ID, DPFLTR_INFO_LEVEL, "KmdfHelloWorld: PouetEvtDeviceAdd 2\n"));
// Create the device object
status = WdfDeviceCreate(&DeviceInit, WDF_NO_OBJECT_ATTRIBUTES, &hDevice);
return status;
}
下面是我的 wpp 标头trace.h 的代码：
#define WPP_CONTROL_GUIDS \
WPP_DEFINE_CONTROL_GUID( \
myDriverTraceGuid, (c81e24ca,9d1b,4725,89fd,1abb15c1accc), \
WPP_DEFINE_BIT(MYDRIVER_ALL_INFO) /* bit 0 = 0x00000001 */ \
WPP_DEFINE_BIT(TRACE_DRIVER) /* bit 1 = 0x00000002 */ \
)
为了进行编译，我使用 Visual Studio Community 2019。
如果我使用远程内核调试器（例如 Windbg），我会看到 kdPrintEx 函数生成的跟踪。 如果我打开如下所示的跟踪会话：
logman create trace "PouetTraceSession" -p {c81e24ca-9d1b-4725-89fd-1abb15c1accc} 0xffffffff 0xff -o d:\trace\TracePouet.etl
logman start PouetTraceSession
logman stop PouetTraceSession.
我使用 Traceview 检查生成的 etl 文件，但没有记录跟踪/事件。
你能告诉我我忘记了什么吗？ 多谢 ！
I try to display wpp logs from a very simple driver. I followed this tutorial.
Below code of my simple driver:
#include <ntddk.h>
#include <wdf.h>
#include "trace.h"
#include "driver.tmh"
DRIVER_INITIALIZE DriverEntry;
EVT_WDF_DRIVER_DEVICE_ADD PouetEvtDeviceAdd;
NTSTATUS
DriverEntry(
_In_ PDRIVER_OBJECT DriverObject,
_In_ PUNICODE_STRING RegistryPath
)
{
// NTSTATUS variable to record success or failure
NTSTATUS status = STATUS_SUCCESS;
// Initialize WPP tracing in DriverEntry
WPP_INIT_TRACING(DriverObject, RegistryPath);
// Allocate the driver configuration object
WDF_DRIVER_CONFIG config;
// Print "Hello World" for DriverEntry
KdPrintEx((DPFLTR_IHVDRIVER_ID, DPFLTR_INFO_LEVEL, "KmdfHelloWorld: DriverEntry1\n"));
DoTraceMessage(TRACE_DRIVER, "DoTraceMessage\n");
KdPrintEx((DPFLTR_IHVDRIVER_ID, DPFLTR_INFO_LEVEL, "KmdfHelloWorld: DriverEntry2\n"));
// Initialize the driver configuration object to register the
// entry point for the EvtDeviceAdd callback, KmdfHelloWorldEvtDeviceAdd
WDF_DRIVER_CONFIG_INIT(&config, PouetEvtDeviceAdd);
// Finally, create the driver object
status = WdfDriverCreate(DriverObject, RegistryPath, WDF_NO_OBJECT_ATTRIBUTES, &config, WDF_NO_HANDLE );
return status;
}
NTSTATUS
PouetEvtDeviceAdd(
_In_ WDFDRIVER Driver,
_Inout_ PWDFDEVICE_INIT DeviceInit
)
{
// We're not using the driver object,
// so we need to mark it as unreferenced
UNREFERENCED_PARAMETER(Driver);
NTSTATUS status;
// Allocate the device object
WDFDEVICE hDevice;
// Print "Hello World"
KdPrintEx((DPFLTR_IHVDRIVER_ID, DPFLTR_INFO_LEVEL, "KmdfHelloWorld: PouetEvtDeviceAdd\n"));
DoTraceMessage(TRACE_DRIVER, "DoTraceMessage2\n");
KdPrintEx((DPFLTR_IHVDRIVER_ID, DPFLTR_INFO_LEVEL, "KmdfHelloWorld: PouetEvtDeviceAdd 2\n"));
// Create the device object
status = WdfDeviceCreate(&DeviceInit, WDF_NO_OBJECT_ATTRIBUTES, &hDevice);
return status;
}
Below code of my wpp header trace.h:
#define WPP_CONTROL_GUIDS \
WPP_DEFINE_CONTROL_GUID( \
myDriverTraceGuid, (c81e24ca,9d1b,4725,89fd,1abb15c1accc), \
WPP_DEFINE_BIT(MYDRIVER_ALL_INFO) /* bit 0 = 0x00000001 */ \
WPP_DEFINE_BIT(TRACE_DRIVER) /* bit 1 = 0x00000002 */ \
)
To compile I use Visual Studio Community 2019.
If I use a remote kernel debugger (windbg for exemple), I see the traces made by kdPrintEx functions.
If I open a trace session like below:
logman create trace "PouetTraceSession" -p {c81e24ca-9d1b-4725-89fd-1abb15c1accc} 0xffffffff 0xff -o d:\trace\TracePouet.etl
logman start PouetTraceSession
logman stop PouetTraceSession.
I check the generated etl file with traceview but there is no trace/event recorded.
Can you tell what I forget ?
Thanks a lot !
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
我用来编译驱动程序的vxproj。
The vxproj I used to compile the driver.