I try to display wpp logs from a very simple driver. I followed this tutorial.
Below code of my simple driver:
#include <ntddk.h>#include <wdf.h>#include "trace.h"#include "driver.tmh"DRIVER_INITIALIZE DriverEntry;EVT_WDF_DRIVER_DEVICE_ADD PouetEvtDeviceAdd;NTSTATUSDriverEntry( _In_ PDRIVER_OBJECT DriverObject, _In_ PUNICODE_STRING RegistryPath){ // NTSTATUS variable to record success or failure NTSTATUS status = STATUS_SUCCESS; // Initialize WPP tracing in DriverEntry WPP_INIT_TRACING(DriverObject, RegistryPath); // Allocate the driver configuration object WDF_DRIVER_CONFIG config; // Print "Hello World" for DriverEntry KdPrintEx((DPFLTR_IHVDRIVER_ID, DPFLTR_INFO_LEVEL, "KmdfHelloWorld: DriverEntry1\n")); DoTraceMessage(TRACE_DRIVER, "DoTraceMessage\n"); KdPrintEx((DPFLTR_IHVDRIVER_ID, DPFLTR_INFO_LEVEL, "KmdfHelloWorld: DriverEntry2\n")); // Initialize the driver configuration object to register the // entry point for the EvtDeviceAdd callback, KmdfHelloWorldEvtDeviceAdd WDF_DRIVER_CONFIG_INIT(&config, PouetEvtDeviceAdd); // Finally, create the driver object status = WdfDriverCreate(DriverObject, RegistryPath, WDF_NO_OBJECT_ATTRIBUTES, &config, WDF_NO_HANDLE ); return status;}NTSTATUSPouetEvtDeviceAdd( _In_ WDFDRIVER Driver, _Inout_ PWDFDEVICE_INIT DeviceInit){ // We're not using the driver object, // so we need to mark it as unreferenced UNREFERENCED_PARAMETER(Driver); NTSTATUS status; // Allocate the device object WDFDEVICE hDevice; // Print "Hello World" KdPrintEx((DPFLTR_IHVDRIVER_ID, DPFLTR_INFO_LEVEL, "KmdfHelloWorld: PouetEvtDeviceAdd\n")); DoTraceMessage(TRACE_DRIVER, "DoTraceMessage2\n"); KdPrintEx((DPFLTR_IHVDRIVER_ID, DPFLTR_INFO_LEVEL, "KmdfHelloWorld: PouetEvtDeviceAdd 2\n")); // Create the device object status = WdfDeviceCreate(&DeviceInit, WDF_NO_OBJECT_ATTRIBUTES, &hDevice); return status;}
Below code of my wpp header trace.h:
#define WPP_CONTROL_GUIDS \ WPP_DEFINE_CONTROL_GUID( \ myDriverTraceGuid, (c81e24ca,9d1b,4725,89fd,1abb15c1accc), \ WPP_DEFINE_BIT(MYDRIVER_ALL_INFO) /* bit 0 = 0x00000001 */ \ WPP_DEFINE_BIT(TRACE_DRIVER) /* bit 1 = 0x00000002 */ \ )
To compile I use Visual Studio Community 2019.
If I use a remote kernel debugger (windbg for exemple), I see the traces made by kdPrintEx functions.If I open a trace session like below:
logman create trace "PouetTraceSession" -p {11C3AAE4-0D88-41b3-43BD-AC38BF747E19} 0xffffffff 0xff -o d:\trace\TracePouet.etllogman start PouetTraceSessionlogman stop PouetTraceSession.
I check the generated etl file with traceview but there is no trace/event recorded.
Can you tell what I forget ?Thanks a lot !