Unit DriverCommands;

{
  Prace a komunikace s ovladacem logptm.sys.
}

Interface

Const
  // Redefinice konstant a datovych typu ze souboru logptm.h
  EVENT_TYPE_PROCESS = 1;
  EVENT_TYPE_IMAGE  = 2;
  EVENT_TYPE_THREAD = 3;


Type
  // Zaznam uvozujici kazdou udalost
  UM_EVENT = Record
    EventType : Integer;
    EventSize : Integer;
    Time : Int64;
    end;
  PUM_EVENT = ^UM_EVENT;

  // Udalost o vytvoreni ci ukonceni procesu
  EVENT_PROCESS = Record
    PID : Int64;
    ParentPID : Int64;
    CreatorPID : Int64;
    CreatorTID : Int64;
    Created : Boolean;
    end;
  PEVENT_PROCESS = ^EVENT_PROCESS;

  // Udalost o nacteni souboru PE do pameti
  EVENT_IMAGE = Record
    PID : Int64;
    TID : Int64;
    BaseAddress : Int64;
    Size : Integer;
    NameLength : Integer;
    Name : Array [0..0] Of WideChar;
    end;
  PEVENT_IMAGE = ^EVENT_IMAGE;

  // Udalost ukonceni ci vytvoreni vlakna
  EVENT_THREAD = Record
    PID : Int64;
    TID : Int64;
    CreatorTID : Int64;
    CreatorPID : Int64;
    Created : Boolean;
    end;
  PEVENT_THREAD = ^EVENT_THREAD;


Function LogptmDriverInit:Boolean;
Function LogptmDriverLoad:Boolean;
Procedure LogptmDriverUnload;
Procedure LogptmDriverFinit;
Function LogptmDriverGetEvent(Var E:PUM_EVENT):Boolean;

Implementation

Uses
  Windows, SysUtils, Driver;

Const
  // Zprava IOCTL, kterou ovladac logptm.sys
  // umi obslouzit. Ve vystupnich bufferech
  // vraci data o jedne udalosti.
  IOCTL_LOGPTM_GET_EVENT = $c07fc004;

Function LogptmDriverInit:Boolean;
{
  Nainstaluje ovladac logptm.sys.
}
begin
Result := DriverInit('logptm', ExtractFilePath(ParamStr(0)) + 'logptm.sys', 'logptm', [IOCTL_LOGPTM_GET_EVENT]);
end;

Function LogptmDriverLoad:Boolean;
{
  Nacte ovladac do jadra a pripoji se k jeho
  zarizeni.
}
begin
Result := DriverLoad;
If Result Then
  begin
  Result := DriverConnect;
  If Not Result Then
    DriverUnload;
  end;
end;


Procedure LogptmDriverUnload;
{
  Uvolni ovladac logptm.sys z jadra. Provede
  i odpojeni aplikace od jeho zarizeni.
}
begin
DriverDisconnect;
DriverUnload;
end;

Procedure LogptmDriverFinit;
{
  Odinstaluje ovladac.
}
begin
DriverFinit;
end;

Function LogptmDriverGetEvent(Var E:PUM_EVENT):Boolean;
{
  Vrati prvni udalost ze seznamu udalosti, ktery
  si uchovava v sobe ovladac logptm.sys. Po jejim
  zpracovani je nutne pamet, kterou dana udalost
  zabrala, explicitne uvolnit pomoci volani HeapFree.

  Pokud je seznam udalosti ovladace logptm.sys prazdny,
  funkce vrati False a GetLastError vraci
  ERROR_NO_MORE_ITEMS.
}
Var
  Size : Cardinal;
begin
E := Nil;
Size := 256;
Result := False;
While Not Result Do
  begin
  if Assigned(E) then
    begin
    HeapFree(GetProcessHeap, 0, E);
    E := Nil;
    end;

  Size := Size * 2;
  E := HeapAlloc(GetProcessHeap, 0, Size);
  If Assigned(E) Then
    begin
    Result := DriverIOCTL(0, Nil, 0, E, Size);
    If (Not Result) And
       (GetLastError = ERROR_NO_MORE_ITEMS) Then
      Break;
    end
  Else Break;
  end;

If Not Result Then
  begin
  If Assigned(E) Then
    begin
    HeapFree(GetProcessHeap, 0, E);
    E := Nil;
    end;
  end;
end;

End.

