Quantcast
Channel: Active questions tagged kernel - Stack Overflow
Viewing all articles
Browse latest Browse all 6334

Unable to generate wpp trace in a simple driver

$
0
0

I try to display wpp logs from a very simple driver. I followed this tutorial.

Below code of my simple driver:

#include <ntddk.h>#include <wdf.h>#include "trace.h"#include "driver.tmh"DRIVER_INITIALIZE DriverEntry;EVT_WDF_DRIVER_DEVICE_ADD PouetEvtDeviceAdd;NTSTATUSDriverEntry(    _In_ PDRIVER_OBJECT     DriverObject,    _In_ PUNICODE_STRING    RegistryPath){    // NTSTATUS variable to record success or failure    NTSTATUS status = STATUS_SUCCESS;    // Initialize WPP tracing in DriverEntry    WPP_INIT_TRACING(DriverObject, RegistryPath);    // Allocate the driver configuration object    WDF_DRIVER_CONFIG config;    // Print "Hello World" for DriverEntry    KdPrintEx((DPFLTR_IHVDRIVER_ID, DPFLTR_INFO_LEVEL, "KmdfHelloWorld: DriverEntry1\n"));    DoTraceMessage(TRACE_DRIVER, "DoTraceMessage\n");    KdPrintEx((DPFLTR_IHVDRIVER_ID, DPFLTR_INFO_LEVEL, "KmdfHelloWorld: DriverEntry2\n"));    // Initialize the driver configuration object to register the    // entry point for the EvtDeviceAdd callback, KmdfHelloWorldEvtDeviceAdd    WDF_DRIVER_CONFIG_INIT(&config, PouetEvtDeviceAdd);    // Finally, create the driver object    status = WdfDriverCreate(DriverObject, RegistryPath, WDF_NO_OBJECT_ATTRIBUTES, &config, WDF_NO_HANDLE );    return status;}NTSTATUSPouetEvtDeviceAdd(    _In_    WDFDRIVER       Driver,    _Inout_ PWDFDEVICE_INIT DeviceInit){    // We're not using the driver object,    // so we need to mark it as unreferenced    UNREFERENCED_PARAMETER(Driver);    NTSTATUS status;    // Allocate the device object    WDFDEVICE hDevice;    // Print "Hello World"    KdPrintEx((DPFLTR_IHVDRIVER_ID, DPFLTR_INFO_LEVEL, "KmdfHelloWorld: PouetEvtDeviceAdd\n"));    DoTraceMessage(TRACE_DRIVER, "DoTraceMessage2\n");    KdPrintEx((DPFLTR_IHVDRIVER_ID, DPFLTR_INFO_LEVEL, "KmdfHelloWorld: PouetEvtDeviceAdd 2\n"));    // Create the device object    status = WdfDeviceCreate(&DeviceInit, WDF_NO_OBJECT_ATTRIBUTES, &hDevice);    return status;}

Below code of my wpp header trace.h:

#define WPP_CONTROL_GUIDS                                              \    WPP_DEFINE_CONTROL_GUID(                                           \        myDriverTraceGuid, (c81e24ca,9d1b,4725,89fd,1abb15c1accc), \        WPP_DEFINE_BIT(MYDRIVER_ALL_INFO)        /* bit  0 = 0x00000001 */ \        WPP_DEFINE_BIT(TRACE_DRIVER)             /* bit  1 = 0x00000002 */ \        )

To compile I use Visual Studio Community 2019.

If I use a remote kernel debugger (windbg for exemple), I see the traces made by kdPrintEx functions.If I open a trace session like below:

logman create trace "PouetTraceSession" -p {11C3AAE4-0D88-41b3-43BD-AC38BF747E19} 0xffffffff 0xff -o d:\trace\TracePouet.etllogman start PouetTraceSessionlogman stop PouetTraceSession.

I check the generated etl file with traceview but there is no trace/event recorded.

Can you tell what I forget ?Thanks a lot !


Viewing all articles
Browse latest Browse all 6334

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>