/** @file notify_events.c
 *
 *  Tento soubor obsahuje rutiny pro vytvareni udalosti specifickych pro
 *  projekt logptm.
 */
#include <ntddk.h>
#include "events.h"
#include "notify_events.h"



/** Vytvori zaznam udalosti procesu.
 *
 * @param cas Cas, kdy k udalosti doslo.
 * @param rodic PID identifikator rodicovkseho procesu (validni pouze pokud vytvoren = TRUE).
 * @param tvurce PID identifikator tvurce procesu (validni pouze pokud vytvoren = TRUE). 
 * @param tvurce_tid Identifikator vlakna, ktere novy proces vytvorilo.
 * @param novy PID identifikator noveho procesu (novy = TRUE), nebo PID 
 *   identifikator procesu, ktery je prave ukoncovan (vytvoren = FALSE).
 * @param vytvoren Urcuje, zda udalost reprezentuje vytvoreni noveho procesu (TRUE)
 *    ci ukonceni existujiciho procesu (FALSE).
 */
PEVENT ProcessEventCreate(PLARGE_INTEGER Time, HANDLE ParentPID, HANDLE CreatorPID, HANDLE CreatorTID, HANDLE NewPID, BOOLEAN Created)
{
  PEVENT Event = NULL;
  PEVENT_PROCESS ep = NULL;
  KdPrint(("notify_events.c: ProcessEventCreate(Time=0x%p; ParentPID=0x%p; CreatorPID=0x%p; CreatorTID=0x%p; NewPID=0x%p; Created=%u)\n", Time, ParentPID, CreatorPID, CreatorTID, NewPID, Created));

  Event = EventAlloc(EVENT_TYPE_PROCESS, sizeof(EVENT_PROCESS));
  if (Event != NULL) {
    Event->Time.QuadPart = Time->QuadPart;
    ep = (PEVENT_PROCESS)EVENT_TO_DATA(Event);
    ep->PID =(ULONG64)NewPID;
    ep->ParentPID = (ULONG64)ParentPID;
    ep->CreatorPID = (ULONG64)CreatorPID;
    ep->CreatorTID = (ULONG64)CreatorTID;
    ep->Created = Created;
  }

  KdPrint(("notify_events.c: ProcessEventCreate(-):0x%p\n", Event));
  return Event; 
}


/** Vytvori novy zaznam udalosti vlakna.
 *
 * @param cas Cas, kdy k udalosti doslo.
 * @param tid TID identifikator nove vytvoreneho vlakna, nebo zanikajiciho vlakna.
 * @param pid PID procesu, ktery prislusne vlakno vlastni.
 * @param tvurce_tid TID identifikator vlakna, ktere vytvorilo nove vlakno.
 * @param tvurce_pid PID identifikator procesu, jehoz vlakno vytvorilo nove vlakno.
 * @param vytvoreno Urcuje, zda se jedna o vytvoreni noveho vlakna (hodnota TRUE)
 *   ci ukonceni behu existujiciho vlakna (hodnota FALSE).
 */
PEVENT ThreadEventCreate(PLARGE_INTEGER Time, HANDLE TID, HANDLE PID, HANDLE CreatorTID, HANDLE CreatorPID, BOOLEAN Created)
{
  PEVENT Event = NULL;
  PEVENT_THREAD et = NULL;
  KdPrint(("notify_events.c: ThreadEventCreate(Time=0x%p; TID=0x%p; PID=0x%p; CreatorTID=0x%p; CreatorPID=0x%p; Created=%u)\n", Time, TID, PID, CreatorTID, CreatorPID, Created));

  Event = EventAlloc(EVENT_TYPE_THREAD, sizeof(EVENT_THREAD));
  if (Event != NULL) {
    Event->Time.QuadPart = Time->QuadPart;
    et = (PEVENT_THREAD)EVENT_TO_DATA(Event);
    et->PID = (ULONG64)PID;
    et->TID = (ULONG64)TID;
    et->CreatorTID = (ULONG64)CreatorTID;
    et->CreatorPID = (ULONG64)CreatorPID;
    et->Created = Created;
  }

  KdPrint(("notify_events.c: ThreadEventCreate(-):0x%p\n", Event));
  return Event;
}


/** Vytvori zaznam udalosti modulu.
 *
 * @param cas Cas, kdy udalost nastala.
 * @param jmeno Jmeno souboru modulu.
 * @param pid PID procesu, do jehoz adresoveho prostoru byl modul nacten (NULL v pripade ovladace).
 * @param tid TID procesu, v jehoz kontextu k nacteni modulu doslo.
 * @param base Virtualni adresa pocatku modulu.
 * @param velikost Velikost nove nacteneho modulu v bytech.
 */
PEVENT ImageEventCreate(PLARGE_INTEGER Time, PUNICODE_STRING Name, HANDLE PID, HANDLE TID, PVOID BaseAddress, ULONG ImageSize)
{
  PEVENT Event = NULL;
  PEVENT_IMAGE ei = NULL;
  KdPrint(("notify_events.c: ImageEventCreate(Time=0x%p; Name=\"%S\"; PID=0x%p; TID=0x%p; BaseAddress=0x%p; ImageSize=%u)\n", Time, Name->Buffer, PID, TID, BaseAddress, ImageSize));

  Event = EventAlloc(EVENT_TYPE_IMAGE, sizeof(EVENT_IMAGE) + Name->Length + sizeof(WCHAR));
  if (Event != NULL) {
    Event->Time.QuadPart = Time->QuadPart;
    ei = (PEVENT_IMAGE)EVENT_TO_DATA(Event);
    ei->PID = (ULONG64)PID;
    ei->TID = (ULONG64)TID;
    ei->BaseAddress = (ULONG64)BaseAddress;
    ei->ImageSize = ImageSize;
    ei->NameLength = Name->Length;
    RtlCopyMemory(&ei->Name, Name->Buffer, Name->Length);
  }

  KdPrint(("notify_events.c: ImageEventCreate(-):0x%p\n", Event));
  return Event;
}
