IFR (In-Flight Record WPP) is not work

[RickYCHsieh]

Hi,

Excuse me that, I met issues with IFR logs. and I hope to get some clues here.

Thanks in advance.

Issues

refer IFR[1] and GetIfr.ps1[2] , I did some modifications in my KMDF DRIVER

I got etl files, and decode it with my own pdb file,

But it comes out a log with empty content.

I add changes below
1. I add below in my vcxproj
<ClCompile Include=...>
<WppEnabled>true</WppEnabled>
<WppKernelMode>true</WppKernelMode>
<WppRecorderEnabled>true</WppRecorderEnabled>
...
</ClCompile>

2. I make sure the sys file has dependency, such as WppRecorder.sys, and I think my modifications in vcxprj are correct.
3. I use windbg and GetIfr.ps1 to check log dump. Both logs are empty.
4. My changes in .c files, by using custom log. I see WppRecorderLogCreate failed. But I have no idea what's wrong with it .


#ifdef IFR_LOG


WPP_INIT_TRACING(pDriverObj, RegPath);

RECORDER_CONFIGURE_PARAMS recorderConfig;
RECORDER_LOG_CREATE_PARAMS recorderCreate;

RECORDER_LOG logHandle = NULL;

RECORDER_CONFIGURE_PARAMS_INIT(&recorderConfig);
recorderConfig.CreateDefaultLog = FALSE;
recorderCreate.TotalBufferSize = 4 * 1024;

WppRecorderConfigure(&recorderConfig);

RECORDER_LOG_CREATE_PARAMS_INIT(&recorderCreate, NULL);
NTSTATUS WppStatus = WppRecorderLogCreate(&recorderCreate, &logHandle);

if (!NT_SUCCESS(WppStatus))
{
RT_TRACE_IFR_CUSTOM(logHandle,COMP_IFR,DBG_LOUD,("Rick Driver FAILED1")) ;
}
else
{
RT_TRACE_IFR_CUSTOM(logHandle,COMP_IFR,DBG_LOUD,("Rick Driver OKAY3")) ;
}

//WDF_OBJECT_ATTRIBUTES_INIT(&attributes);

#endif



Background Knowledge

1. refer Inflight Trace Recorder (IFR) for logging traces - Windows drivers

2. refer Video: Accessing Driver Logs without a Debugger

Continue reading...