I try to display wpp logs from a very simple driver. I followed this tutorial.
Below code of my simple driver:
#include <ntddk.h>
#include <wdf.h>
#include "trace.h"
#include "driver.tmh"
DRIVER_INITIALIZE DriverEntry;
EVT_WDF_DRIVER_DEVICE_ADD PouetEvtDeviceAdd;
NTSTATUS
DriverEntry(
_In_ PDRIVER_OBJECT DriverObject,
_In_ PUNICODE_STRING RegistryPath
)
{
// NTSTATUS variable to record success or failure
NTSTATUS status = STATUS_SUCCESS;
// Initialize WPP tracing in DriverEntry
WPP_INIT_TRACING(DriverObject, RegistryPath);
// Allocate the driver configuration object
WDF_DRIVER_CONFIG config;
// Print "Hello World" for DriverEntry
KdPrintEx((DPFLTR_IHVDRIVER_ID, DPFLTR_INFO_LEVEL, "KmdfHelloWorld: DriverEntry1\n"));
DoTraceMessage(TRACE_DRIVER, "DoTraceMessage\n");
KdPrintEx((DPFLTR_IHVDRIVER_ID, DPFLTR_INFO_LEVEL, "KmdfHelloWorld: DriverEntry2\n"));
// Initialize the driver configuration object to register the
// entry point for the EvtDeviceAdd callback, KmdfHelloWorldEvtDeviceAdd
WDF_DRIVER_CONFIG_INIT(&config, PouetEvtDeviceAdd);
// Finally, create the driver object
status = WdfDriverCreate(DriverObject, RegistryPath, WDF_NO_OBJECT_ATTRIBUTES, &config, WDF_NO_HANDLE );
return status;
}
NTSTATUS
PouetEvtDeviceAdd(
_In_ WDFDRIVER Driver,
_Inout_ PWDFDEVICE_INIT DeviceInit
)
{
// We're not using the driver object,
// so we need to mark it as unreferenced
UNREFERENCED_PARAMETER(Driver);
NTSTATUS status;
// Allocate the device object
WDFDEVICE hDevice;
// Print "Hello World"
KdPrintEx((DPFLTR_IHVDRIVER_ID, DPFLTR_INFO_LEVEL, "KmdfHelloWorld: PouetEvtDeviceAdd\n"));
DoTraceMessage(TRACE_DRIVER, "DoTraceMessage2\n");
KdPrintEx((DPFLTR_IHVDRIVER_ID, DPFLTR_INFO_LEVEL, "KmdfHelloWorld: PouetEvtDeviceAdd 2\n"));
// Create the device object
status = WdfDeviceCreate(&DeviceInit, WDF_NO_OBJECT_ATTRIBUTES, &hDevice);
return status;
}
Below code of my wpp header trace.h:
#define WPP_CONTROL_GUIDS \
WPP_DEFINE_CONTROL_GUID( \
myDriverTraceGuid, (c81e24ca,9d1b,4725,89fd,1abb15c1accc), \
WPP_DEFINE_BIT(MYDRIVER_ALL_INFO) /* bit 0 = 0x00000001 */ \
WPP_DEFINE_BIT(TRACE_DRIVER) /* bit 1 = 0x00000002 */ \
)
To compile I use Visual Studio Community 2019.
If I use a remote kernel debugger (windbg for exemple), I see the traces made by kdPrintEx functions. If I open a trace session like below:
logman create trace "PouetTraceSession" -p {c81e24ca-9d1b-4725-89fd-1abb15c1accc} 0xffffffff 0xff -o d:\trace\TracePouet.etl
logman start PouetTraceSession
logman stop PouetTraceSession.
I check the generated etl file with traceview but there is no trace/event recorded.
Can you tell what I forget ? Thanks a lot !
