Re: windows内核态日志打印问题，急寻帮助

Windows内核调试

windows内核态日志打印问题，急寻帮助

---

peterwtu 2012-11-07, 17:14 下午
大家好，请问在windows核态中，当IRQL <= DISPATCH_LEVEL时，有什么方法可以实现日志的打印吗？主要是想将日志保存下来，方便日后出现问题时进行回查，便于分析。试过将内核打印的信息写到文件中的方式，但当IRQL级别高于PASSIVE_LEVEL时就会蓝屏，所写的驱动是miniport，所以不能使用WPP方式，请问各位大牛除了写文件、WPP、ETW、CLFS外还有什么其它方法吗？还请大家帮下忙，不胜感激。

Re: windows内核态日志打印问题，急寻帮助

---

土豆泥 2012-11-08, 20:06 下午

有意思，这个问题好有一比：

我想从南京到北京，除了汽车、火车、轮船、飞机之外，还能坐什么？

答案，还有驴车啊 :-)

 

Re: windows内核态日志打印问题，急寻帮助

---

土豆泥 2012-11-08, 20:43 下午

看下ATAPORT这个mini port驱动用的啥：

ataport!AtaPortEtwTraceLog:
8575d60a 8bff            mov     edi,edi
8575d60c 55              push    ebp
8575d60d 8bec            mov     ebp,esp
8575d60f 83ec10          sub     esp,10h
8575d612 803d68a0768500  cmp     byte ptr [ataport!AtaEtwEnabled (8576a068)],0
8575d619 0f84a4000000    je      ataport!AtaPortEtwTraceLog+0xb9 (8575d6c3)

ataport!AtaPortEtwTraceLog+0x15:
8575d61f 8b4508          mov     eax,dword ptr [ebp+8]
8575d622 48              dec     eax
8575d623 56              push    esi
8575d624 743c            je      ataport!AtaPortEtwTraceLog+0x58 (8575d662)

ataport!AtaPortEtwTraceLog+0x1c:
8575d626 48              dec     eax
8575d627 7432            je      ataport!AtaPortEtwTraceLog+0x51 (8575d65b)

ataport!AtaPortEtwTraceLog+0x1f:
8575d629 48              dec     eax
8575d62a 7428            je      ataport!AtaPortEtwTraceLog+0x4a (8575d654)

ataport!AtaPortEtwTraceLog+0x22:
8575d62c 48              dec     eax
8575d62d 741c            je      ataport!AtaPortEtwTraceLog+0x41 (8575d64b)

ataport!AtaPortEtwTraceLog+0x25:
8575d62f 48              dec     eax
8575d630 7412            je      ataport!AtaPortEtwTraceLog+0x3a (8575d644)

ataport!AtaPortEtwTraceLog+0x28:
8575d632 48              dec     eax
8575d633 7406            je      ataport!AtaPortEtwTraceLog+0x31 (8575d63b)

ataport!AtaPortEtwTraceLog+0x2b:
8575d635 33f6            xor     esi,esi
8575d637 33c0            xor     eax,eax
8575d639 eb2f            jmp     ataport!AtaPortEtwTraceLog+0x60 (8575d66a)

ataport!AtaPortEtwTraceLog+0x31:
8575d63b bee0937685      mov     esi,offset ataport!ATAPORT_EVENT_CHANNEL_RESET_COMPLETE (857693e0)

ataport!AtaPortEtwTraceLog+0x36:
8575d640 6a08            push    8
8575d642 eb25            jmp     ataport!AtaPortEtwTraceLog+0x5f (8575d669)

ataport!AtaPortEtwTraceLog+0x3a:
8575d644 bed0937685      mov     esi,offset ataport!ATAPORT_EVENT_CHANNEL_RESET_INIT (857693d0)
8575d649 ebf5            jmp     ataport!AtaPortEtwTraceLog+0x36 (8575d640)

ataport!AtaPortEtwTraceLog+0x41:
8575d64b be20947685      mov     esi,offset ataport!ATAPORT_EVENT_CHANNEL_START_COMPLETE (85769420)

ataport!AtaPortEtwTraceLog+0x46:
8575d650 6a02            push    2
8575d652 eb15            jmp     ataport!AtaPortEtwTraceLog+0x5f (8575d669)

ataport!AtaPortEtwTraceLog+0x4a:
8575d654 be10947685      mov     esi,offset ataport!ATAPORT_EVENT_CHANNEL_START_INIT (85769410)
8575d659 ebf5            jmp     ataport!AtaPortEtwTraceLog+0x46 (8575d650)

ataport!AtaPortEtwTraceLog+0x51:
8575d65b be50937685      mov     esi,offset ataport!ATAPORT_EVENT_LPM_POWERSTATE_SLUMBER (85769350)
8575d660 eb05            jmp     ataport!AtaPortEtwTraceLog+0x5d (8575d667)

ataport!AtaPortEtwTraceLog+0x58:
8575d662 be40937685      mov     esi,offset ataport!ATAPORT_EVENT_LPM_POWERSTATE_PARTIAL (85769340)

ataport!AtaPortEtwTraceLog+0x5d:
8575d667 6a20            push    20h

ataport!AtaPortEtwTraceLog+0x5f:
8575d669 58              pop     eax

ataport!AtaPortEtwTraceLog+0x60:
8575d66a 85056ca07685    test    dword ptr [ataport!AtaMatchAnyKeyword (8576a06c)],eax
8575d670 7450            je      ataport!AtaPortEtwTraceLog+0xb8 (8575d6c2)

ataport!AtaPortEtwTraceLog+0x68:
8575d672 8b4d0c          mov     ecx,dword ptr [ebp+0Ch]
8575d675 85c9            test    ecx,ecx
8575d677 7419            je      ataport!AtaPortEtwTraceLog+0x88 (8575d692)

ataport!AtaPortEtwTraceLog+0x6f:
8575d679 8b4510          mov     eax,dword ptr [ebp+10h]
8575d67c 85c0            test    eax,eax
8575d67e 7612            jbe     ataport!AtaPortEtwTraceLog+0x88 (8575d692)

ataport!AtaPortEtwTraceLog+0x76:
8575d680 8365f400        and     dword ptr [ebp-0Ch],0
8575d684 8365fc00        and     dword ptr [ebp-4],0
8575d688 b201            mov     dl,1
8575d68a 894df0          mov     dword ptr [ebp-10h],ecx
8575d68d 8945f8          mov     dword ptr [ebp-8],eax
8575d690 eb02            jmp     ataport!AtaPortEtwTraceLog+0x8a (8575d694)

ataport!AtaPortEtwTraceLog+0x88:
8575d692 32d2            xor     dl,dl

ataport!AtaPortEtwTraceLog+0x8a:
8575d694 85f6            test    esi,esi
8575d696 742a            je      ataport!AtaPortEtwTraceLog+0xb8 (8575d6c2)

ataport!AtaPortEtwTraceLog+0x8e:
8575d698 0fb6c2          movzx   eax,dl
8575d69b f7d8            neg     eax
8575d69d 1bc0            sbb     eax,eax
8575d69f 8d4df0          lea     ecx,[ebp-10h]
8575d6a2 23c1            and     eax,ecx
8575d6a4 50              push    eax
8575d6a5 33c0            xor     eax,eax
8575d6a7 84d2            test    dl,dl
8575d6a9 0f95c0          setne   al
8575d6ac 50              push    eax
8575d6ad 6a00            push    0
8575d6af 56              push    esi
8575d6b0 ff3564a07685    push    dword ptr [ataport!AtaEtwHandle+0x4 (8576a064)]
8575d6b6 ff3560a07685    push    dword ptr [ataport!AtaEtwHandle (8576a060)]
8575d6bc ff1578907685    call    dword ptr [ataport!_imp__EtwWrite (85769078)]

ataport!AtaPortEtwTraceLog+0xb8:
8575d6c2 5e              pop     esi

ataport!AtaPortEtwTraceLog+0xb9:
8575d6c3 c9              leave
8575d6c4 c20c00          ret     0Ch

Re: windows内核态日志打印问题，急寻帮助

---

peterwtu 2012-11-13, 20:14 下午
非常感谢你的回答，目前选择了IoWriteErrorLogEntry作为解决方案