#include "trace.h"

Functions
	TRACELOGGING_DEFINE_PROVIDER (g_hPanoProvider, "Panoptes",(0x7036af95, 0x9daf, 0x4486, 0x8d, 0x93, 0x70, 0x5, 0xd4, 0x5a, 0x6a, 0x6))

void	TraceInit ()

void	TraceUninit ()

void	Log_DriverEntry (PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath)

void	Log_DriverExit (PDRIVER_OBJECT DriverObject)

void	Log_MailSlotOpen (HANDLE ProcessId, HANDLE ThreadId, PWCH FileName)

void	Log_MailSlotCreate (HANDLE ProcessId, HANDLE ThreadId, PWCH FileName)

void	Log_NamedPipeCreate (HANDLE ProcessId, HANDLE ThreadId, PWCH FileName)

void	Log_NamedPipeOpen (HANDLE ProcessId, HANDLE ThreadId, PWCH FileName)

void	Log_FileCreated (HANDLE ProcessId, HANDLE ThreadId, PWCH FileName, BOOLEAN Oplocked)

void	Log_FileOpen (HANDLE ProcessId, HANDLE ThreadId, PWCH FileName, BOOLEAN Oplocked)

void	Log_FileOverwritten (HANDLE ProcessId, HANDLE ThreadId, PWCH FileName)

void	Log_FileRead (HANDLE ProcessId, HANDLE ThreadId, PWCH FileName, LARGE_INTEGER FileOffset, ULONG ReadLength, BOOLEAN Compressed)

void	Log_FileWrite (HANDLE ProcessId, HANDLE ThreadId, PWCH FileName, LARGE_INTEGER FileOffset, ULONG ReadLength, BOOLEAN Compressed)

void	Log_FileSuperseded (HANDLE ProcessId, HANDLE ThreadId, PWCH FileName)

Variables
PDRIVER_OBJECT	g_DriverObject

Function Documentation

◆ Log_DriverEntry()

void Log_DriverEntry	(	PDRIVER_OBJECT	DriverObject,
		PUNICODE_STRING	RegistryPath
	)

Definition at line 22 of file trace.cpp.

{
    g_DriverObject = DriverObject;
 
    TraceLoggingWrite(g_hPanoProvider, "PanoptesStart",
        TraceLoggingPointer(DriverObject),
        TraceLoggingUnicodeString(RegistryPath, "RegPath"));
}

References g_DriverObject.

Referenced by DriverEntry().

◆ Log_DriverExit()

void Log_DriverExit ( PDRIVER_OBJECT DriverObject )

Definition at line 34 of file trace.cpp.

{
    TraceLoggingWrite(g_hPanoProvider, "PanoptesExit",
        TraceLoggingPointer(DriverObject));
}

Referenced by UnloadPanoptes().

◆ Log_FileCreated()

void Log_FileCreated	(	HANDLE	ProcessId,
		HANDLE	ThreadId,
		PWCH	FileName,
		BOOLEAN	Oplocked
	)

Definition at line 97 of file trace.cpp.

{
    TraceLoggingWrite(g_hPanoProvider, "FileCreated",
        TraceLoggingValue(ProcessId, "SourceProcessId"),
        TraceLoggingValue(ThreadId, "SourceThreadId"),
        TraceLoggingWideString(FileName, "FileName"),
        TraceLoggingBool(Oplocked, "Oplocked"));
}

◆ Log_FileOpen()

void Log_FileOpen	(	HANDLE	ProcessId,
		HANDLE	ThreadId,
		PWCH	FileName,
		BOOLEAN	Oplocked
	)

Definition at line 111 of file trace.cpp.

{
    TraceLoggingWrite(g_hPanoProvider, "FileOpened",
        TraceLoggingValue(ProcessId, "SourceProcessId"),
        TraceLoggingValue(ThreadId, "SourceThreadId"),
        TraceLoggingWideString(FileName, "FileName"),
        TraceLoggingBool(Oplocked, "Oplocked"));
}

◆ Log_FileOverwritten()

void Log_FileOverwritten	(	HANDLE	ProcessId,
		HANDLE	ThreadId,
		PWCH	FileName
	)

Definition at line 125 of file trace.cpp.

{
    TraceLoggingWrite(g_hPanoProvider, "FileOverwritten",
        TraceLoggingValue(ProcessId, "SourceProcessId"),
        TraceLoggingValue(ThreadId, "SourceThreadId"),
        TraceLoggingWideString(FileName, "FileName"));
}

◆ Log_FileRead()

void Log_FileRead	(	HANDLE	ProcessId,
		HANDLE	ThreadId,
		PWCH	FileName,
		LARGE_INTEGER	FileOffset,
		ULONG	ReadLength,
		BOOLEAN	Compressed
	)

Definition at line 137 of file trace.cpp.

{
    TraceLoggingWrite(g_hPanoProvider, "FileRead",
        TraceLoggingValue(ProcessId, "SourceProcessId"),
        TraceLoggingValue(ThreadId, "SourceThreadId"),
        TraceLoggingWideString(FileName, "FileName"),
        TraceLoggingULong(ReadLength, "ReadLength"),
        TraceLoggingValue(FileOffset.QuadPart, "FileOffset"),
        TraceLoggingBoolean(Compressed, "CompressedFile"));
}

◆ Log_FileSuperseded()

void Log_FileSuperseded	(	HANDLE	ProcessId,
		HANDLE	ThreadId,
		PWCH	FileName
	)

Definition at line 173 of file trace.cpp.

{
    TraceLoggingWrite(g_hPanoProvider, "FileSuperseded",
        TraceLoggingValue(ProcessId, "SourceProcessId"),
        TraceLoggingValue(ThreadId, "SourceThreadId"),
        TraceLoggingWideString(FileName, "FileName"));
}

◆ Log_FileWrite()

void Log_FileWrite	(	HANDLE	ProcessId,
		HANDLE	ThreadId,
		PWCH	FileName,
		LARGE_INTEGER	FileOffset,
		ULONG	ReadLength,
		BOOLEAN	Compressed
	)

Definition at line 155 of file trace.cpp.

{
    TraceLoggingWrite(g_hPanoProvider, "FileWrite",
        TraceLoggingValue(ProcessId, "SourceProcessId"),
        TraceLoggingValue(ThreadId, "SourceThreadId"),
        TraceLoggingWideString(FileName, "FileName"),
        TraceLoggingULong(ReadLength, "WriteLength"),
        TraceLoggingValue(FileOffset.QuadPart, "FileOffset"),
        TraceLoggingBoolean(Compressed, "CompressedFile"));
}

◆ Log_MailSlotCreate()

void Log_MailSlotCreate	(	HANDLE	ProcessId,
		HANDLE	ThreadId,
		PWCH	FileName
	)

Definition at line 56 of file trace.cpp.

{
    TraceLoggingWrite(g_hPanoProvider, "MailSlotCreate",
        TraceLoggingValue(ProcessId, "SourceProcessId"),
        TraceLoggingValue(ThreadId, "SourceThreadId"),
        TraceLoggingWideString(FileName, "MailSlotName"));
}

◆ Log_MailSlotOpen()

void Log_MailSlotOpen	(	HANDLE	ProcessId,
		HANDLE	ThreadId,
		PWCH	FileName
	)

Definition at line 44 of file trace.cpp.

{
    TraceLoggingWrite(g_hPanoProvider, "MailSlotOpen",
        TraceLoggingValue(ProcessId, "SourceProcessId"),
        TraceLoggingValue(ThreadId, "SourceThreadId"),
        TraceLoggingWideString(FileName, "MailSlotName"));
}

◆ Log_NamedPipeCreate()

void Log_NamedPipeCreate	(	HANDLE	ProcessId,
		HANDLE	ThreadId,
		PWCH	FileName
	)

Definition at line 70 of file trace.cpp.

{
    TraceLoggingWrite(g_hPanoProvider, "NamedPipeCreate",
        TraceLoggingValue(ProcessId, "SourceProcessId"),
        TraceLoggingValue(ThreadId, "SourceThreadId"),
        TraceLoggingWideString(FileName, "NamedPipeName"));
}

◆ Log_NamedPipeOpen()

void Log_NamedPipeOpen	(	HANDLE	ProcessId,
		HANDLE	ThreadId,
		PWCH	FileName
	)

Definition at line 82 of file trace.cpp.

{
    TraceLoggingWrite(g_hPanoProvider, "NamedPipeOpen",
        TraceLoggingValue(ProcessId, "SourceProcessId"),
        TraceLoggingValue(ThreadId, "SourceThreadId"),
        TraceLoggingWideString(FileName, "NamedPipeName"));
}

◆ TraceInit()

void TraceInit ( )

Definition at line 10 of file trace.cpp.

{
    TraceLoggingRegister(g_hPanoProvider);
}

◆ TRACELOGGING_DEFINE_PROVIDER()

TRACELOGGING_DEFINE_PROVIDER	(	g_hPanoProvider	,
		"Panoptes"	,
		(0x7036af95, 0x9daf, 0x4486, 0x8d, 0x93, 0x70, 0x5, 0xd4, 0x5a, 0x6a, 0x6)
	)

◆ TraceUninit()

void TraceUninit ( )

Definition at line 15 of file trace.cpp.

{
    TraceLoggingUnregister(g_hPanoProvider);
}

Variable Documentation

◆ g_DriverObject

PDRIVER_OBJECT g_DriverObject

Definition at line 3 of file trace.cpp.

Referenced by Log_DriverEntry().

Functions

Variables