...
A driver which produces such logs is registered with the system with an xml file, which identifies the source of the logs, and the form they take (data types), names, and other details.
The xml file is added to the project and will end up in the Resource Files folder.
The xml is processed by the Message Compiler by adding this to the project file in each ItemDeffinitipnGroup (ie, DebugARM64 and ReleaseARM64)
| Code Block |
|---|
<MessageCompile>
<HeaderFilePath>.\\</HeaderFilePath>
<RCFilePath>.\\</RCFilePath>
<GenerateKernelModeLoggingMacros>true</GenerateKernelModeLoggingMacros>
<UseBaseNameOfInput>true</UseBaseNameOfInput>
</MessageCompile> |
The generated header file is then included in the source code, and the generated binary file is added to the end of the resources file like this:
| Code Block |
|---|
LANGUAGE 0x9,0x1
1 11 "Wperf_DriverETW_schema_MSG00001.bin"
1 WEVT_TEMPLATE "Wperf_driverETW_schemaTEMP.BIN" |
Registering:
This xml file is copied with the driver to the system32\drivers directory, and needs to be registered with the system on install with wevtutil.exe im Wperf_DriverETW_schema.xml from the drivers directory.
To unregister call wevtutil.exe um Wperf_DriverETW_schema.xml.
...
You will be presented with logs like this
WPR / WPA