HyperDbgHyperLogImports.h File Reference

Headers relating exported functions from hyperlog project. More...

Go to the source code of this file.

Macros
#define	IMPORT_EXPORT_HYPERLOG   __declspec(dllimport)

Functions
IMPORT_EXPORT_HYPERLOG BOOLEAN	LogInitialize (MESSAGE_TRACING_CALLBACKS *MsgTracingCallbacks)
	Initialize the buffer relating to log message tracing.
IMPORT_EXPORT_HYPERLOG VOID	LogUnInitialize ()
	Uninitialize the buffer relating to log message tracing.
IMPORT_EXPORT_HYPERLOG UINT32	LogMarkAllAsRead (BOOLEAN IsVmxRoot)
	Mark all buffers as read.
IMPORT_EXPORT_HYPERLOG BOOLEAN	LogCallbackPrepareAndSendMessageToQueue (UINT32 OperationCode, BOOLEAN IsImmediateMessage, BOOLEAN ShowCurrentSystemTime, BOOLEAN Priority, const char *Fmt,...)
	routines callback for preparing and sending message to queue
IMPORT_EXPORT_HYPERLOG BOOLEAN	LogCallbackPrepareAndSendMessageToQueueWrapper (UINT32 OperationCode, BOOLEAN IsImmediateMessage, BOOLEAN ShowCurrentSystemTime, BOOLEAN Priority, const char *Fmt, va_list ArgList)
	Prepare a printf-style message mapping and send string messages and tracing for logging and monitoring.
IMPORT_EXPORT_HYPERLOG BOOLEAN	LogCallbackSendBuffer (_In_ UINT32 OperationCode, _In_reads_bytes_(BufferLength) PVOID Buffer, _In_ UINT32 BufferLength, _In_ BOOLEAN Priority)
	routines callback for sending buffer
IMPORT_EXPORT_HYPERLOG BOOLEAN	LogCallbackCheckIfBufferIsFull (BOOLEAN Priority)
	routines callback for checking if buffer is full
IMPORT_EXPORT_HYPERLOG BOOLEAN	LogCallbackSendMessageToQueue (UINT32 OperationCode, BOOLEAN IsImmediateMessage, CHAR *LogMessage, UINT32 BufferLen, BOOLEAN Priority)
	routines callback for sending message to queue
IMPORT_EXPORT_HYPERLOG BOOLEAN	LogRegisterEventBasedNotification (PVOID TargetIrp)
	Create an event-based usermode notifying mechanism.
IMPORT_EXPORT_HYPERLOG BOOLEAN	LogRegisterIrpBasedNotification (PVOID TargetIrp, LONG *Status)
	Register a new IRP Pending thread which listens for new buffers.

Detailed Description

Headers relating exported functions from hyperlog project.

Author

Sina Karvandi (sina@.nosp@m.hype.nosp@m.rdbg..nosp@m.org)

Version

0.1

Date

2023-01-15

Copyright

This project is released under the GNU Public License v3.

Macro Definition Documentation

IMPORT_EXPORT_HYPERLOG

#define IMPORT_EXPORT_HYPERLOG   __declspec(dllimport)

Function Documentation

LogCallbackCheckIfBufferIsFull()

IMPORT_EXPORT_HYPERLOG BOOLEAN LogCallbackCheckIfBufferIsFull

(

BOOLEAN

Priority

)

routines callback for checking if buffer is full

Parameters

Priority

Returns

BOOLEAN

routines callback for checking if buffer is full

Parameters

Priority

Whether the buffer has priority

Returns

BOOLEAN Returns true if the buffer is full, otherwise, return false

{
    if (g_Callbacks.LogCallbackCheckIfBufferIsFull == NULL)
    {
        //
        // Ignore sending message to queue
        //
        return FALSE;
    }
 
    return g_Callbacks.LogCallbackCheckIfBufferIsFull(Priority);
}

LogCallbackPrepareAndSendMessageToQueue()

IMPORT_EXPORT_HYPERLOG BOOLEAN LogCallbackPrepareAndSendMessageToQueue	(	UINT32	OperationCode,
		BOOLEAN	IsImmediateMessage,
		BOOLEAN	ShowCurrentSystemTime,
		BOOLEAN	Priority,
		const char *	Fmt,
			... )

routines callback for preparing and sending message to queue

Parameters

OperationCode
IsImmediateMessage
ShowCurrentSystemTime
Priority
Fmt
...

Returns

BOOLEAN

routines callback for preparing and sending message to queue

Parameters

OperationCode	Optional operation code
IsImmediateMessage	Should be sent immediately
ShowCurrentSystemTime	Show system-time
Priority	Whether the message has priority
Fmt	Message format-string
...

Returns

BOOLEAN if it was successful then return TRUE, otherwise returns FALSE

{
    BOOLEAN Result;
    va_list ArgList;
 
    if (g_Callbacks.LogCallbackPrepareAndSendMessageToQueueWrapper == NULL)
    {
        //
        // Ignore sending message to queue
        //
        return FALSE;
    }
 
    va_start(ArgList, Fmt);
 
    Result = g_Callbacks.LogCallbackPrepareAndSendMessageToQueueWrapper(OperationCode,
                                                                        IsImmediateMessage,
                                                                        ShowCurrentSystemTime,
                                                                        Priority,
                                                                        Fmt,
                                                                        ArgList);
    va_end(ArgList);
 
    return Result;
}

LogCallbackPrepareAndSendMessageToQueueWrapper()

IMPORT_EXPORT_HYPERLOG BOOLEAN LogCallbackPrepareAndSendMessageToQueueWrapper	(	UINT32	OperationCode,
		BOOLEAN	IsImmediateMessage,
		BOOLEAN	ShowCurrentSystemTime,
		BOOLEAN	Priority,
		const char *	Fmt,
		va_list	ArgList )

Prepare a printf-style message mapping and send string messages and tracing for logging and monitoring.

Parameters

OperationCode	Optional operation code
IsImmediateMessage	Should be sent immediately
ShowCurrentSystemTime	Show system-time
Priority	Whether the message has priority
Fmt	Message format-string
...

Returns

BOOLEAN if it was successful then return TRUE, otherwise returns FALSE

{
    int     SprintfResult;
    size_t  WrittenSize;
    BOOLEAN IsVmxRootMode;
    BOOLEAN Result         = FALSE; // by default, we assume error happens
    char *  LogMessage     = NULL;
    char *  TempMessage    = NULL;
    char    TimeBuffer[20] = {0};
    ULONG   CurrentCore    = KeGetCurrentProcessorNumberEx(NULL);
 
    //
    // Set Vmx State
    //
    IsVmxRootMode = LogCheckVmxOperation();
 
    //
    // Set the buffer here, we avoid use stack (local variables) because stack might growth
    // and be problematic
    //
    if (IsVmxRootMode)
    {
        LogMessage  = &VmxLogMessage[CurrentCore * PacketChunkSize];
        TempMessage = &VmxTempMessage[CurrentCore * PacketChunkSize];
    }
    else
    {
        //
        // To avoid buffer collision and buffer re-writing in VMX non-root, allocate pool
        //
        LogMessage = PlatformMemAllocateNonPagedPool(PacketChunkSize);
 
        if (LogMessage == NULL)
        {
            //
            // Insufficient space
            //
            return FALSE;
        }
        TempMessage = PlatformMemAllocateNonPagedPool(PacketChunkSize);
 
        if (TempMessage == NULL)
        {
            //
            // Insufficient space
            //
            PlatformMemFreePool(LogMessage);
            return FALSE;
        }
    }
 
    if (ShowCurrentSystemTime)
    {
        //
        // It's actually not necessary to use -1 but because user-mode code might assume a null-terminated buffer so
        // it's better to use - 1
        //
 
        //
        // We won't use this because we can't use in any IRQL
        // Status = RtlStringCchVPrintfA(TempMessage, PacketChunkSize - 1, Fmt, ArgList);
        //
        SprintfResult = vsprintf_s(TempMessage, PacketChunkSize - 1, Fmt, ArgList);
 
        //
        // Check if the buffer passed the limit
        //
        if (SprintfResult == -1)
        {
            //
            // Probably the buffer is large that we can't store it
            //
            goto FreeBufferAndReturn;
        }
 
        //
        // Fill the above with timer
        //
        TIME_FIELDS   TimeFields;
        LARGE_INTEGER SystemTime, LocalTime;
        KeQuerySystemTime(&SystemTime);
        ExSystemTimeToLocalTime(&SystemTime, &LocalTime);
        RtlTimeToTimeFields(&LocalTime, &TimeFields);
 
        //
        // We won't use this because we can't use in any IRQL
        // Status = RtlStringCchPrintfA(TimeBuffer, RTL_NUMBER_OF(TimeBuffer),
        //  "%02hd:%02hd:%02hd.%03hd", TimeFields.Hour,
        //  TimeFields.Minute, TimeFields.Second,
        //  TimeFields.Milliseconds);
        //
        //
        // Append time with previous message
        //
        // Status = RtlStringCchPrintfA(LogMessage, PacketChunkSize - 1, "(%s)\t %s", TimeBuffer, TempMessage);
        //
 
        //
        // this function probably run without error, so there is no need to check the return value
        //
        sprintf_s(TimeBuffer, RTL_NUMBER_OF(TimeBuffer), "%02hd:%02hd:%02hd.%03hd", TimeFields.Hour, TimeFields.Minute, TimeFields.Second, TimeFields.Milliseconds);
 
        //
        // Append time with previous message
        //
        SprintfResult = sprintf_s(LogMessage, PacketChunkSize - 1, "(%s - core : %d - vmx-root? %s)\t %s", TimeBuffer, CurrentCore, IsVmxRootMode ? "yes" : "no", TempMessage);
 
        //
        // Check if the buffer passed the limit
        //
        if (SprintfResult == -1)
        {
            //
            // Probably the buffer is large that we can't store it
            //
            goto FreeBufferAndReturn;
        }
    }
    else
    {
        //
        // It's actually not necessary to use -1 but because user-mode code might assume a null-terminated buffer so
        // it's better to use - 1
        //
 
        //
        // We won't use this because we can't use in any IRQL
        // Status = RtlStringCchVPrintfA(LogMessage, PacketChunkSize - 1, Fmt, ArgList);
        //
        SprintfResult = vsprintf_s(LogMessage, PacketChunkSize - 1, Fmt, ArgList);
 
        //
        // Check if the buffer passed the limit
        //
        if (SprintfResult == -1)
        {
            //
            // Probably the buffer is large that we can't store it
            //
            goto FreeBufferAndReturn;
        }
    }
 
    //
    // Use std function because they can be run in any IRQL
    // RtlStringCchLengthA(LogMessage, PacketChunkSize - 1, &WrittenSize);
    //
    WrittenSize = strnlen_s(LogMessage, PacketChunkSize - 1);
 
    if (LogMessage[0] == '\0')
    {
        //
        // nothing to write
        //
        goto FreeBufferAndReturn;
    }
 
    //
    // Send the prepared buffer (with no priority)
    //
    Result = LogCallbackSendMessageToQueue(OperationCode, IsImmediateMessage, LogMessage, (UINT32)WrittenSize, Priority);
 
FreeBufferAndReturn:
 
    if (!IsVmxRootMode)
    {
        PlatformMemFreePool(LogMessage);
        PlatformMemFreePool(TempMessage);
    }
 
    return Result;
}

LogCallbackSendBuffer()

IMPORT_EXPORT_HYPERLOG BOOLEAN LogCallbackSendBuffer	(	_In_ UINT32	OperationCode,
		_In_reads_bytes_(BufferLength) PVOID	Buffer,
		_In_ UINT32	BufferLength,
		_In_ BOOLEAN	Priority )

routines callback for sending buffer

Parameters

OperationCode
Buffer
BufferLength
Priority

Returns

BOOLEAN

{
    if (g_Callbacks.LogCallbackSendBuffer == NULL)
    {
        //
        // Ignore sending buffer
        //
        return FALSE;
    }
 
    return g_Callbacks.LogCallbackSendBuffer(OperationCode,
                                             Buffer,
                                             BufferLength,
                                             Priority);
}

LogCallbackSendMessageToQueue()

IMPORT_EXPORT_HYPERLOG BOOLEAN LogCallbackSendMessageToQueue	(	UINT32	OperationCode,
		BOOLEAN	IsImmediateMessage,
		CHAR *	LogMessage,
		UINT32	BufferLen,
		BOOLEAN	Priority )

routines callback for sending message to queue

Parameters

OperationCode
IsImmediateMessage
LogMessage
BufferLen
Priority

Returns

BOOLEAN

routines callback for sending message to queue

Parameters

OperationCode	Optional operation code
IsImmediateMessage	Should be sent immediately
LogMessage	Link of message buffer
BufferLen	Length of buffer
Priority	Whether the buffer has priority

Returns

BOOLEAN if it was successful then return TRUE, otherwise returns FALSE

{
    if (g_Callbacks.LogCallbackSendMessageToQueue == NULL)
    {
        //
        // Ignore sending message to queue
        //
        return FALSE;
    }
 
    return g_Callbacks.LogCallbackSendMessageToQueue(OperationCode,
                                                     IsImmediateMessage,
                                                     LogMessage,
                                                     BufferLen,
                                                     Priority);
}

LogInitialize()

IMPORT_EXPORT_HYPERLOG BOOLEAN LogInitialize

(

MESSAGE_TRACING_CALLBACKS *

MsgTracingCallbacks

)

Initialize the buffer relating to log message tracing.

Parameters

MsgTracingCallbacks

specify the callbacks

Returns

BOOLEAN

{
    ULONG ProcessorsCount;
 
    ProcessorsCount = KeQueryActiveProcessorCount(0);
 
    //
    // Initialize buffers for trace message and data messages
    //(we have two buffers one for vmx root and one for vmx non-root)
    //
    MessageBufferInformation = PlatformMemAllocateZeroedNonPagedPool(sizeof(LOG_BUFFER_INFORMATION) * 2);
 
    if (!MessageBufferInformation)
    {
        return FALSE; // STATUS_INSUFFICIENT_RESOURCES
    }
 
    //
    // Allocate VmxTempMessage and VmxLogMessage
    //
    VmxTempMessage = NULL;
    VmxTempMessage = PlatformMemAllocateZeroedNonPagedPool(PacketChunkSize * ProcessorsCount);
 
    if (!VmxTempMessage)
    {
        PlatformMemFreePool(MessageBufferInformation);
        MessageBufferInformation = NULL;
        return FALSE; // STATUS_INSUFFICIENT_RESOURCES
    }
 
    VmxLogMessage = NULL;
    VmxLogMessage = PlatformMemAllocateZeroedNonPagedPool(PacketChunkSize * ProcessorsCount);
 
    if (!VmxLogMessage)
    {
        PlatformMemFreePool(MessageBufferInformation);
        MessageBufferInformation = NULL;
 
        PlatformMemFreePool(VmxTempMessage);
        VmxTempMessage = NULL;
 
        return FALSE; // STATUS_INSUFFICIENT_RESOURCES
    }
 
    //
    // Initialize the lock for Vmx-root mode (HIGH_IRQL Spinlock)
    //
    VmxRootLoggingLock = 0;
 
    //
    // Allocate buffer for messages and initialize the core buffer information
    //
    for (int i = 0; i < 2; i++)
    {
        //
        // initialize the lock
        // Actually, only the 0th buffer use this spinlock but let initialize it
        // for both but the second buffer spinlock is useless
        // as we use our custom spinlock
        //
        KeInitializeSpinLock(&MessageBufferInformation[i].BufferLock);
        KeInitializeSpinLock(&MessageBufferInformation[i].BufferLockForNonImmMessage);
 
        //
        // allocate the buffer for regular buffers
        //
        MessageBufferInformation[i].BufferStartAddress                   = (UINT64)PlatformMemAllocateNonPagedPool(LogBufferSize);
        MessageBufferInformation[i].BufferForMultipleNonImmediateMessage = (UINT64)PlatformMemAllocateNonPagedPool(PacketChunkSize);
 
        if (!MessageBufferInformation[i].BufferStartAddress ||
            !MessageBufferInformation[i].BufferForMultipleNonImmediateMessage)
        {
            return FALSE; // STATUS_INSUFFICIENT_RESOURCES
        }
 
        //
        // allocate the buffer for priority buffers
        //
        MessageBufferInformation[i].BufferStartAddressPriority = (UINT64)PlatformMemAllocateNonPagedPool(LogBufferSizePriority);
 
        if (!MessageBufferInformation[i].BufferStartAddressPriority)
        {
            return FALSE; // STATUS_INSUFFICIENT_RESOURCES
        }
 
        //
        // Zeroing the buffer
        //
        RtlZeroMemory((void *)MessageBufferInformation[i].BufferStartAddress, LogBufferSize);
        RtlZeroMemory((void *)MessageBufferInformation[i].BufferForMultipleNonImmediateMessage, PacketChunkSize);
        RtlZeroMemory((void *)MessageBufferInformation[i].BufferStartAddressPriority, LogBufferSizePriority);
 
        //
        // Set the end address
        //
        MessageBufferInformation[i].BufferEndAddress         = (UINT64)MessageBufferInformation[i].BufferStartAddress + LogBufferSize;
        MessageBufferInformation[i].BufferEndAddressPriority = (UINT64)MessageBufferInformation[i].BufferStartAddressPriority + LogBufferSizePriority;
    }
 
    //
    // Copy the callbacks into the global callback holder
    //
    RtlCopyBytes(&g_MsgTracingCallbacks, MsgTracingCallbacks, sizeof(MESSAGE_TRACING_CALLBACKS));
 
    return TRUE;
}

LogMarkAllAsRead()

IMPORT_EXPORT_HYPERLOG UINT32 LogMarkAllAsRead

(

BOOLEAN

IsVmxRoot

)

Mark all buffers as read.

Priority buffers won't be set as read

Parameters

IsVmxRoot

Determine whether you want to read vmx root buffer or vmx non root buffer

Returns

UINT32 return count of messages that set to invalid

{
    UINT32 Index;
    UINT32 ResultsOfBuffersSetToRead = 0;
    KIRQL  OldIRQL                   = NULL_ZERO;
 
    //
    // Check if we're in Vmx-root, if it is then we use our customized HIGH_IRQL Spinlock,
    // if not we use the windows spinlock
    //
    if (IsVmxRoot)
    {
        //
        // Set the index
        //
        Index = 1;
 
        //
        // Acquire the lock
        //
        SpinlockLock(&VmxRootLoggingLock);
    }
    else
    {
        //
        // Set the index
        //
        Index = 0;
 
        //
        // Acquire the lock
        //
        KeAcquireSpinLock(&MessageBufferInformation[Index].BufferLock, &OldIRQL);
    }
 
    //
    // We have iterate through the all indexes
    //
    for (size_t i = 0; i < MaximumPacketsCapacity; i++)
    {
        //
        // Compute the current buffer to read
        //
        BUFFER_HEADER * Header = (BUFFER_HEADER *)((UINT64)MessageBufferInformation[Index].BufferStartAddress +
                                                   (MessageBufferInformation[Index].CurrentIndexToSend *
                                                    (PacketChunkSize + sizeof(BUFFER_HEADER))));
 
        if (!Header->Valid)
        {
            //
            // there is nothing to send
            //
 
            //
            // Check if we're in Vmx-root, if it is then we use our customized HIGH_IRQL Spinlock,
            // if not we use the windows spinlock
            //
            if (IsVmxRoot)
            {
                SpinlockUnlock(&VmxRootLoggingLock);
            }
            else
            {
                //
                // Release the lock
                //
                KeReleaseSpinLock(&MessageBufferInformation[Index].BufferLock, OldIRQL);
            }
 
            return ResultsOfBuffersSetToRead;
        }
 
        //
        // If we reached here, means that there is sth to send
        //
        ResultsOfBuffersSetToRead++;
 
        //
        // Second, save the buffer contents
        //
        PVOID SendingBuffer = (PVOID)((UINT64)MessageBufferInformation[Index].BufferStartAddress + (MessageBufferInformation[Index].CurrentIndexToSend * (PacketChunkSize + sizeof(BUFFER_HEADER))) + sizeof(BUFFER_HEADER));
 
        //
        // Finally, set the current index to invalid as we sent it
        //
        Header->Valid = FALSE;
 
        //
        // Last step is to clear the current buffer (we can't do it once when CurrentIndexToSend is zero because
        // there might be multiple messages on the start of the queue that didn't read yet)
        // we don't free the header
        //
        RtlZeroMemory(SendingBuffer, Header->BufferLength);
 
        //
        // Check to see whether we passed the index or not
        //
        if (MessageBufferInformation[Index].CurrentIndexToSend > MaximumPacketsCapacity - 2)
        {
            MessageBufferInformation[Index].CurrentIndexToSend = 0;
        }
        else
        {
            //
            // Increment the next index to read
            //
            MessageBufferInformation[Index].CurrentIndexToSend = MessageBufferInformation[Index].CurrentIndexToSend + 1;
        }
    }
 
    //
    // Check if we're in Vmx-root, if it is then we use our customized HIGH_IRQL Spinlock,
    // if not we use the windows spinlock
    //
    if (IsVmxRoot)
    {
        SpinlockUnlock(&VmxRootLoggingLock);
    }
    else
    {
        //
        // Release the lock
        //
        KeReleaseSpinLock(&MessageBufferInformation[Index].BufferLock, OldIRQL);
    }
 
    return ResultsOfBuffersSetToRead;
}

LogRegisterEventBasedNotification()

IMPORT_EXPORT_HYPERLOG BOOLEAN LogRegisterEventBasedNotification

(

PVOID

TargetIrp

)

Create an event-based usermode notifying mechanism.

Parameters

TargetIrp

Returns

BOOLEAN

{
    PNOTIFY_RECORD          NotifyRecord;
    NTSTATUS                Status;
    PIO_STACK_LOCATION      IrpStack;
    PREGISTER_NOTIFY_BUFFER RegisterEvent;
    PIRP                    Irp = (PIRP)TargetIrp;
 
    IrpStack      = IoGetCurrentIrpStackLocation(Irp);
    RegisterEvent = (PREGISTER_NOTIFY_BUFFER)Irp->AssociatedIrp.SystemBuffer;
 
    //
    // Allocate a record and save all the event context
    //
    NotifyRecord = PlatformMemAllocateNonPagedPoolWithQuota(sizeof(NOTIFY_RECORD));
 
    if (NULL == NotifyRecord)
    {
        DbgPrint("Err, unable to allocate memory for notify record\n");
        return FALSE;
    }
 
    NotifyRecord->Type = EVENT_BASED;
 
    KeInitializeDpc(&NotifyRecord->Dpc,        // Dpc
                    LogNotifyUsermodeCallback, // DeferredRoutine
                    NotifyRecord               // DeferredContext
    );
 
    //
    // Get the object pointer from the handle
    // Note we must be in the context of the process that created the handle
    //
    Status = ObReferenceObjectByHandle(RegisterEvent->hEvent,
                                       SYNCHRONIZE | EVENT_MODIFY_STATE,
                                       *ExEventObjectType,
                                       Irp->RequestorMode,
                                       &NotifyRecord->Message.Event,
                                       NULL);
 
    if (!NT_SUCCESS(Status))
    {
        DbgPrint("Err, unable to reference user mode event object, status = 0x%x\n", Status);
        PlatformMemFreePool(NotifyRecord);
        return FALSE;
    }
 
    //
    // Insert dpc to the queue
    //
    KeInsertQueueDpc(&NotifyRecord->Dpc, NotifyRecord, NULL);
 
    return TRUE;
}

LogRegisterIrpBasedNotification()

IMPORT_EXPORT_HYPERLOG BOOLEAN LogRegisterIrpBasedNotification	(	PVOID	TargetIrp,
		LONG *	Status )

Register a new IRP Pending thread which listens for new buffers.

Parameters

TargetIrp
Status

Returns

BOOLEAN

{
    PNOTIFY_RECORD          NotifyRecord;
    PIO_STACK_LOCATION      IrpStack;
    PREGISTER_NOTIFY_BUFFER RegisterEvent;
    PIRP                    Irp = (PIRP)TargetIrp;
 
    //
    // check if current core has another thread with pending IRP,
    // if no then put the current thread to pending
    // otherwise return and complete thread with STATUS_SUCCESS as
    // there is another thread waiting for message
    //
 
    if (g_GlobalNotifyRecord == NULL)
    {
        IrpStack      = IoGetCurrentIrpStackLocation(Irp);
        RegisterEvent = (PREGISTER_NOTIFY_BUFFER)Irp->AssociatedIrp.SystemBuffer;
 
        //
        // Allocate a record and save all the event context
        //
        NotifyRecord = PlatformMemAllocateNonPagedPoolWithQuota(sizeof(NOTIFY_RECORD));
 
        if (NULL == NotifyRecord)
        {
            *Status = (LONG)STATUS_INSUFFICIENT_RESOURCES;
            return FALSE;
        }
 
        NotifyRecord->Type               = IRP_BASED;
        NotifyRecord->Message.PendingIrp = Irp;
 
        KeInitializeDpc(&NotifyRecord->Dpc,        // Dpc
                        LogNotifyUsermodeCallback, // DeferredRoutine
                        NotifyRecord               // DeferredContext
        );
 
        IoMarkIrpPending(Irp);
 
        //
        // check for new message (for both Vmx-root mode or Vmx non root-mode)
        // First, we check for priority messages in both buffers then we check
        // for regular messages
        //
        if (LogCheckForNewMessage(FALSE, TRUE))
        {
            //
            // check vmx non-root (priority buffers)
            //
            NotifyRecord->CheckVmxRootMessagePool = FALSE;
 
            //
            // Insert dpc to queue
            //
            KeInsertQueueDpc(&NotifyRecord->Dpc, NotifyRecord, NULL);
        }
        else if (LogCheckForNewMessage(TRUE, TRUE))
        {
            //
            // check vmx root (priority buffers)
            //
            NotifyRecord->CheckVmxRootMessagePool = TRUE;
            //
            // Insert dpc to queue
            //
            KeInsertQueueDpc(&NotifyRecord->Dpc, NotifyRecord, NULL);
        }
        else if (LogCheckForNewMessage(FALSE, FALSE))
        {
            //
            // check vmx non-root
            //
            NotifyRecord->CheckVmxRootMessagePool = FALSE;
 
            //
            // Insert dpc to queue
            //
            KeInsertQueueDpc(&NotifyRecord->Dpc, NotifyRecord, NULL);
        }
        else if (LogCheckForNewMessage(TRUE, FALSE))
        {
            //
            // check vmx root
            //
            NotifyRecord->CheckVmxRootMessagePool = TRUE;
            //
            // Insert dpc to queue
            //
            KeInsertQueueDpc(&NotifyRecord->Dpc, NotifyRecord, NULL);
        }
        else
        {
            //
            // Set the notify routine to the global structure
            //
            g_GlobalNotifyRecord = NotifyRecord;
        }
        //
        // We will return pending as we have marked the IRP pending
        //
 
        *Status = (LONG)STATUS_PENDING;
        return TRUE;
    }
    else
    {
        *Status = (LONG)STATUS_SUCCESS;
        return TRUE;
    }
}

LogUnInitialize()

IMPORT_EXPORT_HYPERLOG VOID LogUnInitialize

(

)

Uninitialize the buffer relating to log message tracing.

Returns

VOID

{
    //
    // de-allocate buffer for messages and initialize the core buffer information (for vmx-root core)
    //
    for (int i = 0; i < 2; i++)
    {
        //
        // Free each buffers
        //
        if (MessageBufferInformation[i].BufferStartAddress != NULL64_ZERO)
        {
            PlatformMemFreePool((PVOID)MessageBufferInformation[i].BufferStartAddress);
        }
 
        if (MessageBufferInformation[i].BufferStartAddressPriority != NULL64_ZERO)
        {
            PlatformMemFreePool((PVOID)MessageBufferInformation[i].BufferStartAddressPriority);
        }
 
        if (MessageBufferInformation[i].BufferForMultipleNonImmediateMessage != NULL64_ZERO)
        {
            PlatformMemFreePool((PVOID)MessageBufferInformation[i].BufferForMultipleNonImmediateMessage);
        }
    }
 
    //
    // de-allocate buffers for trace message and data messages
    //
    PlatformMemFreePool((PVOID)MessageBufferInformation);
    MessageBufferInformation = NULL;
}