Donat Was Here

DonatShell
Server IP : 180.180.241.3 / Your IP : 216.73.216.252
Web Server : Microsoft-IIS/7.5
System : Windows NT NETWORK-NHRC 6.1 build 7601 (Windows Server 2008 R2 Standard Edition Service Pack 1) i586
User : IUSR ( 0)
PHP Version : 5.3.28
Disable Function : NONE
MySQL : ON | cURL : ON | WGET : OFF | Perl : OFF | Python : OFF | Sudo : OFF | Pkexec : OFF
Directory : /Program Files/Malwarebytes/Anti-Malware/sdk/
Upload File :
[ HOME SHELL ]
Current File : /Program Files/Malwarebytes/Anti-Malware/sdk/MBAMSwissArmy.tmf
// PDB:  e:\jenkins\workspace\N_Swissarmy_Kernel\src\..\bin\x64\Win7_Release\mbamswissarmy.pdb
// PDB:  Last Updated :2024-06-04:16:40:19:196 (UTC) [tracepdb]
a73b0b10-a83a-333a-6e02-d44fa848fff1 SwissarmyKernel // SRC=util.c MJ= MN=
#typev util_c368 23 "%0Invalid DOS header!" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=BreakExecutableHeader
{
}
#typev util_c374 24 "%0Invalid NT header!" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=BreakExecutableHeader
{
}
#typev util_c361 22 "%0Invalid DOS header!" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=BreakExecutableHeader
{
}
#typev util_c92 14 "%0Invalid Parameter" //   LEVEL=MBLogLevelError FLAGS=TraceFlag FUNC=ConcatFileName
{
}
#typev util_c98 15 "%0Memory allocaiton failure.  size (%10!d!)" //   LEVEL=MBLogLevelError FLAGS=TraceFlag FUNC=ConcatFileName
{
(PrefixLength + FileNameLength + 2) * sizeof(WCHAR), ItemLong -- 10
}
#typev util_c56 11 "%0Invalid input string." //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=CopyFileName
{
}
#typev util_c70 13 "%0String copy failed (%10!s!).  status (%11!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=CopyFileName
{
FileName, ItemWString -- 10
ntStatus, ItemNTSTATUS -- 11
}
#typev util_c63 12 "%0Memory allocation failure.  size (%10!I64d!)" //   LEVEL=MBLogLevelError FLAGS=TraceFlag FUNC=CopyFileName
{
(fileNameLength + 1) * sizeof(WCHAR), ItemLongLong -- 10
}
#typev util_c49 10 "%0Invalid Parameter" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=CopyFileName
{
}
#typev util_c443 26 "%0RootKey empty." //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=RecursiveDeleteKey
{
}
#typev util_c472 29 "%0Memory allocation failure.  size (%10!d!)" //   LEVEL=MBLogLevelError FLAGS=TraceFlag FUNC=RecursiveDeleteKey
{
sizeof(RECURSION_ENTRY), ItemLong -- 10
}
#typev util_c657 40 "%0Could not delete registry key (%10!p!), status (%11!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=RecursiveDeleteKey
{
nextKey->Handle, ItemPtr -- 10
delStatus, ItemNTSTATUS -- 11
}
#typev util_c652 39 "%0Delete registry key (%10!p!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=RecursiveDeleteKey
{
nextKey->Handle, ItemPtr -- 10
}
#typev util_c622 38 "%0Error enumerating registry value (%10!p!) status = (%11!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=RecursiveDeleteKey
{
nextKey->Handle, ItemPtr -- 10
ntStatus, ItemNTSTATUS -- 11
}
#typev util_c616 37 "%0Error resetting key value (%10!s!), parent handle (%11!p!), status (%12!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=RecursiveDeleteKey
{
&valueName, ItemPWString -- 10
nextKey->Handle, ItemPtr -- 11
resetStatus, ItemNTSTATUS -- 12
}
#typev util_c603 36 "%0Reset registry value (%10!s!), parent handle (%11!p!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=RecursiveDeleteKey
{
&valueName, ItemPWString -- 10
nextKey->Handle, ItemPtr -- 11
}
#typev util_c593 35 "%0Memory allocation failure.  size (%10!d!)" //   LEVEL=MBLogLevelError FLAGS=TraceFlag FUNC=RecursiveDeleteKey
{
enumBufferLength, ItemLong -- 10
}
#typev util_c562 34 "%0Error enumerating registry key (%10!p!) status = (%11!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=RecursiveDeleteKey
{
nextKey->Handle, ItemPtr -- 10
ntStatus, ItemNTSTATUS -- 11
}
#typev util_c556 33 "%0Cannot open registry key (%10!s!), parent handle (%11!p!), status (%12!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=RecursiveDeleteKey
{
&keyName, ItemPWString -- 10
hKey, ItemPtr -- 11
insertStatus, ItemNTSTATUS -- 12
}
#typev util_c549 32 "%0Memory allocation failure.  size (%10!d!)" //   LEVEL=MBLogLevelError FLAGS=TraceFlag FUNC=RecursiveDeleteKey
{
sizeof(RECURSION_ENTRY), ItemLong -- 10
}
#typev util_c522 30 "%0Memory allocation failure.  size (%10!d!)" //   LEVEL=MBLogLevelError FLAGS=TraceFlag FUNC=RecursiveDeleteKey
{
enumBufferLength, ItemLong -- 10
}
#typev util_c542 31 "%0Add subkey to key  list (%10!s!), handle (%11!p!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=RecursiveDeleteKey
{
&keyName, ItemPWString -- 10
hKey, ItemPtr -- 11
}
#typev util_c457 28 "%0Open Root Key (%10!s!), Handle (%11!p!)" //   LEVEL=MBLogLevelTrace FLAGS=TraceFlag FUNC=RecursiveDeleteKey
{
RootKey, ItemPWString -- 10
hKey, ItemPtr -- 11
}
#typev util_c453 27 "%0Cannot open RootKey (%10!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=RecursiveDeleteKey
{
ntStatus, ItemNTSTATUS -- 10
}
#typev util_c439 25 "%0RootKey (%10!s!), Nullify (%11!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=RecursiveDeleteKey
{
RootKey, ItemPWString -- 10
ResetValues ? 'TRUE' : 'FALSE', ItemString -- 11
}
#typev util_c697 42 "%0Empty FolderName" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=RecursiveFolderDelete
{
}
#typev util_c724 44 "%0Memory allocation failure.  size (%10!d!)" //   LEVEL=MBLogLevelError FLAGS=TraceFlag FUNC=RecursiveFolderDelete
{
sizeof(RECURSION_ENTRY), ItemLong -- 10
}
#typev util_c884 57 "%0Could not delete folder (%10!p!), status (%11!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=RecursiveFolderDelete
{
nextFolder->Handle, ItemPtr -- 10
ntStatus, ItemNTSTATUS -- 11
}
#typev util_c878 56 "%0Delete Folder (%10!p!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=RecursiveFolderDelete
{
nextFolder->Handle, ItemPtr -- 10
}
#typev util_c857 55 "%0Error enumerating folder (%10!p!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=RecursiveFolderDelete
{
nextFolder->Handle, ItemPtr -- 10
}
#typev util_c850 54 "%0Could not open file for deleteion (%10!s!), parent handle (%11!p!), status (%12!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=RecursiveFolderDelete
{
&delFile, ItemPWString -- 10
nextFolder->Handle, ItemPtr -- 11
delStatus, ItemNTSTATUS -- 12
}
#typev util_c843 53 "%0Could not delete file (%10!s!), parent handle (%11!p!), status (%12!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=RecursiveFolderDelete
{
&delFile, ItemPWString -- 10
nextFolder->Handle, ItemPtr -- 11
delStatus, ItemNTSTATUS -- 12
}
#typev util_c835 52 "%0Could not reset ReadOnly attribute on (%10!s!), parent handle (%11!p!), status (%12!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=RecursiveFolderDelete
{
&delFile, ItemPWString -- 10
nextFolder->Handle, ItemPtr -- 11
delStatus, ItemNTSTATUS -- 12
}
#typev util_c829 51 "%0Reset ReadOnly attribute on (%10!s!), parent handle (%11!p!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=RecursiveFolderDelete
{
&delFile, ItemPWString -- 10
nextFolder->Handle, ItemPtr -- 11
}
#typev util_c813 50 "%0Delete File (%10!s!), parent handle (%11!p!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=RecursiveFolderDelete
{
&delFile, ItemPWString -- 10
nextFolder->Handle, ItemPtr -- 11
}
#typev util_c798 49 "%0Could not open folder (%10!s!), parent handle (%11!p!), status (%12!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=RecursiveFolderDelete
{
&folderName, ItemPWString -- 10
nextFolder->Handle, ItemPtr -- 11
ntStatus, ItemNTSTATUS -- 12
}
#typev util_c793 48 "%0Memory allocation failure.  size (%10!d!)" //   LEVEL=MBLogLevelError FLAGS=TraceFlag FUNC=RecursiveFolderDelete
{
sizeof(RECURSION_ENTRY), ItemLong -- 10
}
#typev util_c782 47 "%0Could not reset ReadOnly attribute on (%10!s!), handle (%11!p!), parent handle (%12!p!), status (%13!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=RecursiveFolderDelete
{
&folderName, ItemPWString -- 10
hFolder, ItemPtr -- 11
nextFolder->Handle, ItemPtr -- 12
roStatus, ItemNTSTATUS -- 13
}
#typev util_c776 46 "%0Reset ReadOnly attribute on (%10!s!), handle (%11!p!), parent handle (%12!p!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=RecursiveFolderDelete
{
&folderName, ItemPWString -- 10
hFolder, ItemPtr -- 11
nextFolder->Handle, ItemPtr -- 12
}
#typev util_c771 45 "%0Add folder to list (%10!s!), handle (%11!p!), parent handle (%12!p!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=RecursiveFolderDelete
{
&folderName, ItemPWString -- 10
hFolder, ItemPtr -- 11
nextFolder->Handle, ItemPtr -- 12
}
#typev util_c716 43 "%0Cannot open root folder (%10!s!), status (%11!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=RecursiveFolderDelete
{
FolderName, ItemPWString -- 10
ntStatus, ItemNTSTATUS -- 11
}
#typev util_c693 41 "%0Delete Folder (%10!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=RecursiveFolderDelete
{
FolderName, ItemPWString -- 10
}
#typev util_c184 20 "%0Registry value not a string (%10!s! | %11!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=RegistryGetString
{
RegKey, ItemPWString -- 10
RegValue, ItemPWString -- 11
}
#typev util_c157 18 "%0ZwQueryValueKey (%10!s! | %11!s!) failed with status (%12!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=RegistryGetString
{
RegKey, ItemPWString -- 10
RegValue, ItemPWString -- 11
ntStatus, ItemNTSTATUS -- 12
}
#typev util_c150 17 "%0Memory allocation failure.  size (%10!d!)" //   LEVEL=MBLogLevelError FLAGS=TraceFlag FUNC=RegistryGetString
{
queryValueSize, ItemLong -- 10
}
#typev util_c163 19 "%0ZwQueryValueKey (%10!s! | %11!s!) failed with status (%12!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=RegistryGetString
{
RegKey, ItemPWString -- 10
RegValue, ItemPWString -- 11
ntStatus, ItemNTSTATUS -- 12
}
#typev util_c137 16 "%0ZwOpenKey (%10!s!) failed with status (%11!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=RegistryGetString
{
RegKey, ItemPWString -- 10
ntStatus, ItemNTSTATUS -- 11
}
#typev util_c184 20 "%0Registry value not a string (%10!s! | %11!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=RegistryGetString$fin$0
{
RegKey, ItemPWString -- 10
RegValue, ItemPWString -- 11
}
#typev util_c157 18 "%0ZwQueryValueKey (%10!s! | %11!s!) failed with status (%12!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=RegistryGetString$fin$0
{
RegKey, ItemPWString -- 10
RegValue, ItemPWString -- 11
ntStatus, ItemNTSTATUS -- 12
}
#typev util_c150 17 "%0Memory allocation failure.  size (%10!d!)" //   LEVEL=MBLogLevelError FLAGS=TraceFlag FUNC=RegistryGetString$fin$0
{
queryValueSize, ItemLong -- 10
}
#typev util_c163 19 "%0ZwQueryValueKey (%10!s! | %11!s!) failed with status (%12!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=RegistryGetString$fin$0
{
RegKey, ItemPWString -- 10
RegValue, ItemPWString -- 11
ntStatus, ItemNTSTATUS -- 12
}
#typev util_c137 16 "%0ZwOpenKey (%10!s!) failed with status (%11!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=RegistryGetString$fin$0
{
RegKey, ItemPWString -- 10
ntStatus, ItemNTSTATUS -- 11
}
#typev util_c273 21 "%0Memory allocation failure.  size (%10!d!)" //   LEVEL=MBLogLevelError FLAGS=TraceFlag FUNC=SplitPath
{
(pathArrayLength + 2) * sizeof(WCHAR), ItemLong -- 10
}
// PDB:  e:\jenkins\workspace\N_Swissarmy_Kernel\src\..\bin\x64\Win7_Release\mbamswissarmy.pdb
// PDB:  Last Updated :2024-06-04:16:40:19:196 (UTC) [tracepdb]
b6bbc7b6-fec7-320f-ea3a-ba77b8aa817f SwissarmyKernel // SRC=swissarmy.c MJ= MN=
#typev swissarmy_c280 16 "%0Could not verify process attempting to connect." //   LEVEL=MBLogLevelWarning FLAGS=TraceFlag FUNC=DispatchCreateClose
{
}
#typev swissarmy_c414 20 "%0Invalid volume (%10!hd!:) in input "%11!s!"" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=DispatchDeviceControl
{
volumeLetter, ItemShort -- 10
inputBuffer, ItemWString -- 11
}
#typev swissarmy_c441 22 "%0SwitchVolume( %10!hd!: ) failed with status (%11!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=DispatchDeviceControl
{
volumeLetter, ItemShort -- 10
ntStatus, ItemNTSTATUS -- 11
}
#typev swissarmy_c422 21 "%0Invalid volume syntax (%10!hd!%11!hd!) in input "%12!s!"" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=DispatchDeviceControl
{
volumeLetter, ItemShort -- 10
inputBuffer[1], ItemShort -- 11
inputBuffer, ItemWString -- 12
}
#typev swissarmy_c396 19 "%0Memory allocation failure.  size (%10!d!)" //   LEVEL=MBLogLevelError FLAGS=TraceFlag FUNC=DispatchDeviceControl
{
inputBufferLength + sizeof(WCHAR), ItemLong -- 10
}
#typev swissarmy_c389 18 "%0Insufficient input data" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=DispatchDeviceControl
{
}
#typev swissarmy_c383 17 "%0No input data" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=DispatchDeviceControl
{
}
#typev swissarmy_c171 14 "%0MBAMSwissArmy service started.  (%10!d!.%11!d!.%12!d!.%13!d!)" //   LEVEL=MBLogLevelInfo FLAGS=TraceFlag FUNC=DriverEntry
{
VERSION_MAJOR, ItemLong -- 10
VERSION_MINOR, ItemLong -- 11
VERSION_REVISION, ItemLong -- 12
VERSION_BUILD, ItemLong -- 13
}
#typev swissarmy_c140 13 "%0Memory allocation failure.  size (%10!d!)" //   LEVEL=MBLogLevelError FLAGS=TraceFlag FUNC=DriverEntry
{
sizeof(PHYSICAL_DRIVE_DATA) * (MAX_PHYSICAL_DRIVE_NUMBER + 2), ItemLong -- 10
}
#typev swissarmy_c127 12 "%0IoCreateSymbolicLink failed.  status (%10!s!)" //   LEVEL=MBLogLevelError FLAGS=TraceFlag FUNC=DriverEntry
{
ntStatus, ItemNTSTATUS -- 10
}
#typev swissarmy_c111 11 "%0IoCreateDevice failed.  status (%10!s!)" //   LEVEL=MBLogLevelError FLAGS=TraceFlag FUNC=DriverEntry
{
ntStatus, ItemNTSTATUS -- 10
}
#typev swissarmy_c92 10 "%0Could not read driver parameters from the registry (%10!s!).  status (%11!s!)" //   LEVEL=MBLogLevelError FLAGS=TraceFlag FUNC=DriverEntry
{
RegistryPath, ItemPWString -- 10
ntStatus, ItemNTSTATUS -- 11
}
// PDB:  e:\jenkins\workspace\N_Swissarmy_Kernel\src\..\bin\x64\Win7_Release\mbamswissarmy.pdb
// PDB:  Last Updated :2024-06-04:16:40:19:196 (UTC) [tracepdb]
b6bbc7b6-fec7-320f-ea3a-ba77b8aa817f SwissarmyKernel // SRC=swissarmy.c MJ= MN=
#typev swissarmy_c255 15 "%0MBAMSwissArmy service stopped" //   LEVEL=MBLogLevelInfo FLAGS=TraceFlag FUNC=DriverUnload
{
}
#typev swissarmy_c790 24 "%0Invalid Service Key." //   LEVEL=MBLogLevelError FLAGS=TraceFlag FUNC=ResetEarlyBootStartMode
{
}
#typev swissarmy_c828 26 "%0Could not open Service Key." //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ResetEarlyBootStartMode
{
}
#typev swissarmy_c822 25 "%0Could not reset Service Group." //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ResetEarlyBootStartMode
{
}
#typev swissarmy_c782 23 "%0Not in boot mode." //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ResetEarlyBootStartMode
{
}
// PDB:  e:\jenkins\workspace\N_Swissarmy_Kernel\src\..\bin\x64\Win7_Release\mbamswissarmy.pdb
// PDB:  Last Updated :2024-06-04:16:40:19:196 (UTC) [tracepdb]
d88d7751-d181-3b62-d860-f8c4f303f6b5 SwissarmyKernel // SRC=ntfsutil.c MJ= MN=
#typev ntfsutil_c774 19 "%0Memory allocation failure.  size (%10!d!)" //   LEVEL=MBLogLevelError FLAGS=TraceFlag FUNC=AddNTFSIndexCacheEntry
{
sizeof(NTFS_INDEX_CACHE), ItemLong -- 10
}
#typev ntfsutil_c112 11 "%0Disk corruption detected in file record %10!I64d!:  failed multisector transfer" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ApplyNTFSUpdateSequence
{
FSData->NTFS.OpenRecord, ItemLongLong -- 10
}
#typev ntfsutil_c546 17 "%0Memory allocation failure.  size (%10!d!)" //   LEVEL=MBLogLevelError FLAGS=TraceFlag FUNC=CompressNTFSRunList
{
*Length, ItemLong -- 10
}
#typev ntfsutil_c203 13 "%0Invalid runlist data in file record %10!I64d!" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=DecompressNTFSRunList
{
FSData->NTFS.OpenRecord, ItemLongLong -- 10
}
#typev ntfsutil_c191 12 "%0data corruption ( record %10!I64d! ) detected" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=DecompressNTFSRunList
{
FSData->NTFS.OpenRecord, ItemLongLong -- 10
}
#typev ntfsutil_c210 14 "%0Memory allocation failure.  size (%10!d!)" //   LEVEL=MBLogLevelError FLAGS=TraceFlag FUNC=DecompressNTFSRunList
{
(length + 1) * sizeof(RunListData), ItemLong -- 10
}
#typev ntfsutil_c49 10 "%0Could not read MFT file record at (%10!I64x!).  status (%11!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=GetNTFSFileRecord
{
offset, ItemLongLongX -- 10
ntStatus, ItemNTSTATUS -- 11
}
#typev ntfsutil_c397 16 "%0ProcessNTFSIndexData failed with status (%10!s!), FileName: (%11!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=GetNTFSIndexEntryByName
{
ntStatus, ItemNTSTATUS -- 10
FileName, ItemWString -- 11
}
#typev ntfsutil_c393 15 "%0No index entry for (%10!s!) found in file record %11!I64d!" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=GetNTFSIndexEntryByName
{
FileName, ItemWString -- 10
FSData->NTFS.OpenRecord, ItemLongLong -- 11
}
#typev ntfsutil_c664 18 "%0Memory allocaiton failure.  size (%10!d!)" //   LEVEL=MBLogLevelError FLAGS=TraceFlag FUNC=SetNTFSFileState
{
bufferSize, ItemLong -- 10
}
// PDB:  e:\jenkins\workspace\N_Swissarmy_Kernel\src\..\bin\x64\Win7_Release\mbamswissarmy.pdb
// PDB:  Last Updated :2024-06-04:16:40:19:196 (UTC) [tracepdb]
f9b13885-6b99-345d-dc46-57a05906b790 SwissarmyKernel // SRC=ntfsops.c MJ= MN=
#typev ntfsops_c457 32 "%0Data attribute out or order runlist (%10!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=BreakNTFSFile
{
FileName, ItemWString -- 10
}
#typev ntfsops_c444 31 "%0File (%10!s!) is compressed, sparse, or encrypted.  flags (0x%11!08x!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=BreakNTFSFile
{
FileName, ItemWString -- 10
attributeHeader->Flags, ItemLong -- 11
}
#typev ntfsops_c436 30 "%0OpenNTFSDataStream could not open stream (%10!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=BreakNTFSFile
{
FileName, ItemWString -- 10
}
#typev ntfsops_c51 12 "%0SectorSize = %10!d!, ClusterSize = %11!d!, MFTRecordSize = %12!d!, MFTIndexSize = %13!d! bytes" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=BuildNTFSVolumeData
{
g_DriverData.SectorSize, ItemLong -- 10
g_DriverData.ClusterSize, ItemLong -- 11
FSData->NTFS.MFTRecordSize, ItemLong -- 12
FSData->NTFS.MFTIndexSize, ItemLong -- 13
}
#typev ntfsops_c50 11 "%0Warning:  Nonstandard physical parameters on drive %10!hd!:" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=BuildNTFSVolumeData
{
VolumeLetter, ItemShort -- 10
}
#typev ntfsops_c36 10 "%0ReadNTFSBootSector (%10!hd!:) failed.  status (%11!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=BuildNTFSVolumeData
{
VolumeLetter, ItemShort -- 10
ntStatus, ItemNTSTATUS -- 11
}
#typev ntfsops_c243 21 "%0Could not open NTFS file record by name (%10!s!).  status (%11!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=EnumerateNTFSADS
{
FileName, ItemWString -- 10
ntStatus, ItemNTSTATUS -- 11
}
#typev ntfsops_c215 20 "%0Could not open NTFS file record by name (%10!s!).  status (%11!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=EnumerateNTFSDirectory
{
DirectoryName, ItemWString -- 10
ntStatus, ItemNTSTATUS -- 11
}
#typev ntfsops_c1222 49 "%0Error writing $BITMAP file.  status (%10!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=NTFSAllocateClustersForFile
{
ntStatus, ItemNTSTATUS -- 10
}
#typev ntfsops_c1326 50 "%0Failed $BITMAP write.  status (%10!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=NTFSFreeClustersOfFile
{
ntStatus, ItemNTSTATUS -- 10
}
#typev ntfsops_c1383 52 "%0Failed ProcessNTFSAttributeData.  status (%10!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=NTFSFreeClustersOfFileRecord
{
ntStatus, ItemNTSTATUS -- 10
}
#typev ntfsops_c1370 51 "%0Failed FileRecord write.  status (%10!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=NTFSFreeClustersOfFileRecord
{
ntStatus, ItemNTSTATUS -- 10
}
#typev ntfsops_c1517 58 "%0Write file failed (%10!s!).  status (%11!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=NTFSOverwriteFile
{
DestinationName, ItemWString -- 10
ntStatus, ItemNTSTATUS -- 11
}
#typev ntfsops_c1509 57 "%0Read file failed (%10!s!).  status (%11!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=NTFSOverwriteFile
{
SourceName, ItemWString -- 10
ntStatus, ItemNTSTATUS -- 11
}
#typev ntfsops_c1500 56 "%0Memory allocation failure.  size (%10!I64d!)" //   LEVEL=MBLogLevelError FLAGS=TraceFlag FUNC=NTFSOverwriteFile
{
allocationSize, ItemLongLong -- 10
}
#typev ntfsops_c1481 55 "%0Query file size failed (%10!s!).  status (%11!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=NTFSOverwriteFile
{
SourceName, ItemWString -- 10
ntStatus, ItemNTSTATUS -- 11
}
#typev ntfsops_c1455 54 "%0SwitchVolume (%10!hd!) failed.  status (%11!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=NTFSOverwriteFile
{
SourceName[0], ItemShort -- 10
ntStatus, ItemNTSTATUS -- 11
}
#typev ntfsops_c909 48 "%0Can't read Bitmap.  status (%10!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=NTFSReadBitmap
{
ntStatus, ItemNTSTATUS -- 10
}
#typev ntfsops_c895 47 "%0Memory allocation failure.  size(%10!I64d!)" //   LEVEL=MBLogLevelError FLAGS=TraceFlag FUNC=NTFSReadBitmap
{
bitmapAllocatedDataLen, ItemLongLong -- 10
}
#typev ntfsops_c879 46 "%0Can't read Bitmap Run List Data" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=NTFSReadBitmap
{
}
#typev ntfsops_c870 45 "%0Could not get $BITMAP attribute" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=NTFSReadBitmap
{
}
#typev ntfsops_c1562 61 "%0OpenNTFSDataStream Could not get $DATA attribute for file (%10!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=NTFSWriteBufferToFile
{
DestinationName, ItemWString -- 10
}
#typev ntfsops_c1553 60 "%0NTFSReadBitmap failed.  status (%10!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=NTFSWriteBufferToFile
{
ntStatus, ItemNTSTATUS -- 10
}
#typev ntfsops_c1545 59 "%0Switch Volume failed (%10!hd!).  status (%11!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=NTFSWriteBufferToFile
{
DestinationName[0], ItemShort -- 10
ntStatus, ItemNTSTATUS -- 11
}
#typev ntfsops_c707 42 "%0Could not open NTFS file record by name (%10!s!).  status (%11!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=OpenNTFSDataStream
{
StreamName, ItemWString -- 10
ntStatus, ItemNTSTATUS -- 11
}
#typev ntfsops_c649 40 "%0Error build currentPath (%10!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=OpenNTFSFileRecordByName
{
ntStatus, ItemNTSTATUS -- 10
}
#typev ntfsops_c673 41 "%0GetNTFSFileRecord (%10!I64d!) failed.  status (%11!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=OpenNTFSFileRecordByName
{
refNum, ItemLongLong -- 10
ntStatus, ItemNTSTATUS -- 11
}
#typev ntfsops_c627 39 "%0Could not open NTFS root file record, status 0x%10!08x!" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=OpenNTFSFileRecordByName
{
ntStatus, ItemLong -- 10
}
#typev ntfsops_c614 38 "%0Invalid directory path (%10!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=OpenNTFSFileRecordByName
{
StreamName, ItemWString -- 10
}
#typev ntfsops_c603 37 "%0Invalid Input path (%10!s!).  status (%11!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=OpenNTFSFileRecordByName
{
StreamName, ItemWString -- 10
ntStatus, ItemNTSTATUS -- 11
}
#typev ntfsops_c595 36 "%0Memory allocation failure.  size (%10!I64d!)" //   LEVEL=MBLogLevelError FLAGS=TraceFlag FUNC=OpenNTFSFileRecordByName
{
pathLength, ItemLongLong -- 10
}
#typev ntfsops_c583 35 "%0Get NTFS FileRecord (%10!I64d!) failed.  status (%11!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=OpenNTFSFileRecordByName
{
refNum, ItemLongLong -- 10
ntStatus, ItemNTSTATUS -- 11
}
#typev ntfsops_c562 34 "%0Path too long (%10!I64d!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=OpenNTFSFileRecordByName
{
pathLength, ItemLongLong -- 10
}
#typev ntfsops_c1414 53 "%0GetNTFSFileRecord( %10!I64d! ) failed.  status (%11!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=OpenNTFSIndexByRef
{
refNum, ItemLongLong -- 10
ntStatus, ItemNTSTATUS -- 11
}
#typev ntfsops_c750 43 "%0ProcessNTFSIndexData failed.  status (%10!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=QueryNTFSEnumerateLength
{
ntStatus, ItemNTSTATUS -- 10
}
#typev ntfsops_c155 19 "%0Memory allocaiton failure.  size (%10!d!)" //   LEVEL=MBLogLevelError FLAGS=TraceFlag FUNC=ReadNTFSBootSector
{
sizeof(NTFS_INDEX_CACHE), ItemLong -- 10
}
#typev ntfsops_c144 18 "%0Could not get Master File Table run list" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ReadNTFSBootSector
{
}
#typev ntfsops_c131 17 "%0Memory allocation failure.  size (%10!d!)" //   LEVEL=MBLogLevelError FLAGS=TraceFlag FUNC=ReadNTFSBootSector
{
bufferSize, ItemLong -- 10
}
#typev ntfsops_c123 16 "%0Memory allocation failure.  size (%10!d!)" //   LEVEL=MBLogLevelError FLAGS=TraceFlag FUNC=ReadNTFSBootSector
{
bufferSize, ItemLong -- 10
}
#typev ntfsops_c91 15 "%0Physical cluster size overflow ( %10!d! bytes )" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ReadNTFSBootSector
{
(ULONG)g_DriverData.SectorSize * (ULONG)bootSector->BPB.SectorsPerCluster, ItemLong -- 10
}
#typev ntfsops_c81 14 "%0ReadBytes failed with status (%10!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ReadNTFSBootSector
{
ntStatus, ItemNTSTATUS -- 10
}
#typev ntfsops_c71 13 "%0Memory allocation failure.  size (%10!d!)" //   LEVEL=MBLogLevelError FLAGS=TraceFlag FUNC=ReadNTFSBootSector
{
sizeof(NTFS_BOOT_SECTOR), ItemLong -- 10
}
#typev ntfsops_c365 26 "%0Resident attribute encountered!" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ReadNTFSFile
{
}
#typev ntfsops_c372 27 "%0Invalid runlist data in file record %10!I64d!" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ReadNTFSFile
{
FSData->NTFS.OpenRecord, ItemLongLong -- 10
}
#typev ntfsops_c380 28 "%0Unable to allocate RunListList entry" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ReadNTFSFile
{
}
#typev ntfsops_c397 29 "%0OpenNTFSDataStream could not open stream "%10!s!"" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ReadNTFSFile
{
FileName, ItemWString -- 10
}
#typev ntfsops_c342 25 "%0File "%10!s!" is sparse ( flags = %11!d! )" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ReadNTFSFile
{
FileName, ItemWString -- 10
attributeHeader->Flags, ItemLong -- 11
}
#typev ntfsops_c336 24 "%0File "%10!s!" is compressed ( flags = %11!d! )" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ReadNTFSFile
{
FileName, ItemWString -- 10
attributeHeader->Flags, ItemLong -- 11
}
#typev ntfsops_c317 23 "%0File "%10!s!" is encrypted ( flags = %11!d! )" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ReadNTFSFile
{
FileName, ItemWString -- 10
attributeHeader->Flags, ItemLong -- 11
}
#typev ntfsops_c311 22 "%0OpenNTFSDataStream could not open stream (%10!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ReadNTFSFile
{
FileName, ItemWString -- 10
}
#typev ntfsops_c535 33 "%0GetNTFSFileRecord( %10!I64d! ) failed with status (%11!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=SkipCachedPathElements
{
refNum, ItemLongLong -- 10
ntStatus, ItemNTSTATUS -- 11
}
#typev ntfsops_c773 44 "%0ProcessNTFSIndexData failed.  status (%10!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=WriteNTFSEnumerateData
{
ntStatus, ItemNTSTATUS -- 10
}
// PDB:  e:\jenkins\workspace\N_Swissarmy_Kernel\src\..\bin\x64\Win7_Release\mbamswissarmy.pdb
// PDB:  Last Updated :2024-06-04:16:40:19:196 (UTC) [tracepdb]
dfdaa0c6-2dc7-37a3-7d9f-b71f13e6bafd SwissarmyKernel // SRC=ntfsdata.c MJ= MN=
#typev ntfsdata_c864 20 "%0Memory allocation failure.  size (%10!d!)" //   LEVEL=MBLogLevelError FLAGS=TraceFlag FUNC=CreateFileRecord
{
((*FileNames)[refCount].NtfsFileName.FileNameLength + 1) * sizeof(WCHAR), ItemLong -- 10
}
#typev ntfsdata_c776 19 "%0Memory allocation failure.  size (%10!d!)" //   LEVEL=MBLogLevelError FLAGS=TraceFlag FUNC=CreateFileRecord
{
fileHeader->ReferenceCount * sizeof(NTFSFileName), ItemLong -- 10
}
#typev ntfsdata_c744 18 "%0Memory allocation failure.  size (%10!d!)" //   LEVEL=MBLogLevelError FLAGS=TraceFlag FUNC=CreateFileRecord
{
FSData->NTFS.MFTRecordSize, ItemLong -- 10
}
#typev ntfsdata_c371 17 "%0Memory allocation failure.  size (%10!d!)" //   LEVEL=MBLogLevelError FLAGS=TraceFlag FUNC=NTFSSearchIndexesCallback
{
bufferSize, ItemLong -- 10
}
#typev ntfsdata_c78 10 "%0Invalid runlist data in file record %10!I64d!" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ProcessNTFSAttributeData
{
FSData->NTFS.OpenRecord, ItemLongLong -- 10
}
#typev ntfsdata_c191 13 "%0ApplyNTFSUpdateSequence found data corruption in cluster %10!I64d!" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ProcessNTFSDataBlock
{
Offset / g_DriverData.ClusterSize, ItemLongLong -- 10
}
#typev ntfsdata_c168 12 "%0ReadBytes( cluster %10!I64d! ) failed.  status (%11!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ProcessNTFSDataBlock
{
Offset / g_DriverData.ClusterSize, ItemLongLong -- 10
ntStatus, ItemNTSTATUS -- 11
}
#typev ntfsdata_c161 11 "%0Memory allocation failure.  size (%10!I64d!)" //   LEVEL=MBLogLevelError FLAGS=TraceFlag FUNC=ProcessNTFSDataBlock
{
BlockSize * NumBlocks, ItemLongLong -- 10
}
#typev ntfsdata_c262 16 "%0Could not get INDEX_ALLOCATION attribute from file record %10!I64d!" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ProcessNTFSIndexData
{
refNum, ItemLongLong -- 10
}
#typev ntfsdata_c245 15 "%0ProcessNTFSAttributeData (INDEX_ROOT) failed.  status (%10!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ProcessNTFSIndexData
{
ntStatus, ItemNTSTATUS -- 10
}
#typev ntfsdata_c232 14 "%0Could not get INDEX_ROOT attribute from file record %10!I64d!" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ProcessNTFSIndexData
{
refNum, ItemLongLong -- 10
}
// PDB:  e:\jenkins\workspace\N_Swissarmy_Kernel\src\..\bin\x64\Win7_Release\mbamswissarmy.pdb
// PDB:  Last Updated :2024-06-04:16:40:19:196 (UTC) [tracepdb]
301d2b0a-eafc-304a-f6ae-a81ebd47da13 SwissarmyKernel // SRC=ntfsattrib.c MJ= MN=
#typev ntfsattrib_c158 11 "%0GetNTFSAttributeListEntryCallback(record %10!I64d!) failed.  status (%11!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=GetNTFSAttribute
{
FSData->NTFS.OpenRecord, ItemLongLong -- 10
ntStatus, ItemNTSTATUS -- 11
}
#typev ntfsattrib_c102 10 "%0GetNTFSFileRecord(%10!I64d!) failed.  status (%11!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=GetNTFSAttributeByRefNum
{
RefNum, ItemLongLong -- 10
ntStatus, ItemNTSTATUS -- 11
}
#typev ntfsattrib_c338 19 "%0File record %10!I64d! has fragmented $DATA attribute" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=GetNTFSAttributeDataSize
{
FSData->NTFS.OpenRecord, ItemLongLong -- 10
}
#typev ntfsattrib_c217 14 "%0Attribute data read failed.  status (%10!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=LoadLocalBitmap
{
ntStatus, ItemNTSTATUS -- 10
}
#typev ntfsattrib_c208 13 "%0Memory allocation failure.  size (%10!I64d!)" //   LEVEL=MBLogLevelError FLAGS=TraceFlag FUNC=LoadLocalBitmap
{
bitmapSize, ItemLongLong -- 10
}
#typev ntfsattrib_c187 12 "%0Memory allocation failure.  size (%10!d!)" //   LEVEL=MBLogLevelError FLAGS=TraceFlag FUNC=LoadLocalBitmap
{
recordSize, ItemLong -- 10
}
#typev ntfsattrib_c622 29 "%0Sparse run misalignment. bytesleft (%10!I64x!), bytesLeftInRun (%11!I64x!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ReadNTFSAttributeData
{
bytesLeft, ItemLongLongX -- 10
bytesLeftInRun, ItemLongLongX -- 11
}
#typev ntfsattrib_c594 28 "%0RtlDecompressBuffer failed with status 0x%10!08x!" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ReadNTFSAttributeData
{
ntStatus, ItemLong -- 10
}
#typev ntfsattrib_c580 27 "%0Malformed sparse run entry in compressed file. RunLength (%10!I64x!), chunk buffer remaining (%11!x!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ReadNTFSAttributeData
{
runListEntry->RunLength, ItemLongLongX -- 10
chunkBufferSize - chunkBufferOffset, ItemLong -- 11
}
#typev ntfsattrib_c539 25 "%0ReadBytes( cluster %10!I64d! ) failed with status 0x%11!08x!" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ReadNTFSAttributeData
{
currentLogicalOffset / g_DriverData.ClusterSize, ItemLongLong -- 10
ntStatus, ItemLong -- 11
}
#typev ntfsattrib_c556 26 "%0ReadBytes( cluster %10!I64d! ) failed with status 0x%11!08x!" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ReadNTFSAttributeData
{
currentLogicalOffset / g_DriverData.ClusterSize, ItemLongLong -- 10
ntStatus, ItemLong -- 11
}
#typev ntfsattrib_c508 24 "%0ReadBytes( cluster %10!I64d! ) failed with status 0x%11!08x!" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ReadNTFSAttributeData
{
currentLogicalOffset / g_DriverData.ClusterSize, ItemLongLong -- 10
ntStatus, ItemLong -- 11
}
#typev ntfsattrib_c476 23 "%0ReadBytes( cluster %10!I64d! ) failed with status 0x%11!08x!" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ReadNTFSAttributeData
{
runListEntry->LogicalOffset / g_DriverData.ClusterSize, ItemLongLong -- 10
ntStatus, ItemLong -- 11
}
#typev ntfsattrib_c414 22 "%0Invalid runlist data in file record %10!I64d!" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ReadNTFSAttributeData
{
FSData->NTFS.OpenRecord, ItemLongLong -- 10
}
#typev ntfsattrib_c400 21 "%0Cannot allocate decompresion buffers of size (0x%10!08x!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ReadNTFSAttributeData
{
chunkBufferSize, ItemLong -- 10
}
#typev ntfsattrib_c367 20 "%0Output buffer too small (%10!I64d!), FileSize (%11!d!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ReadNTFSAttributeData
{
BufferSize, ItemLongLong -- 10
AttributeHeader->Form.Resident.ValueLength, ItemLong -- 11
}
#typev ntfsattrib_c622 29 "%0Sparse run misalignment. bytesleft (%10!I64x!), bytesLeftInRun (%11!I64x!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ReadNTFSAttributeData$fin$0
{
bytesLeft, ItemLongLongX -- 10
bytesLeftInRun, ItemLongLongX -- 11
}
#typev ntfsattrib_c594 28 "%0RtlDecompressBuffer failed with status 0x%10!08x!" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ReadNTFSAttributeData$fin$0
{
ntStatus, ItemLong -- 10
}
#typev ntfsattrib_c580 27 "%0Malformed sparse run entry in compressed file. RunLength (%10!I64x!), chunk buffer remaining (%11!x!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ReadNTFSAttributeData$fin$0
{
runListEntry->RunLength, ItemLongLongX -- 10
chunkBufferSize - chunkBufferOffset, ItemLong -- 11
}
#typev ntfsattrib_c539 25 "%0ReadBytes( cluster %10!I64d! ) failed with status 0x%11!08x!" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ReadNTFSAttributeData$fin$0
{
currentLogicalOffset / g_DriverData.ClusterSize, ItemLongLong -- 10
ntStatus, ItemLong -- 11
}
#typev ntfsattrib_c556 26 "%0ReadBytes( cluster %10!I64d! ) failed with status 0x%11!08x!" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ReadNTFSAttributeData$fin$0
{
currentLogicalOffset / g_DriverData.ClusterSize, ItemLongLong -- 10
ntStatus, ItemLong -- 11
}
#typev ntfsattrib_c508 24 "%0ReadBytes( cluster %10!I64d! ) failed with status 0x%11!08x!" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ReadNTFSAttributeData$fin$0
{
currentLogicalOffset / g_DriverData.ClusterSize, ItemLongLong -- 10
ntStatus, ItemLong -- 11
}
#typev ntfsattrib_c476 23 "%0ReadBytes( cluster %10!I64d! ) failed with status 0x%11!08x!" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ReadNTFSAttributeData$fin$0
{
runListEntry->LogicalOffset / g_DriverData.ClusterSize, ItemLongLong -- 10
ntStatus, ItemLong -- 11
}
#typev ntfsattrib_c414 22 "%0Invalid runlist data in file record %10!I64d!" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ReadNTFSAttributeData$fin$0
{
FSData->NTFS.OpenRecord, ItemLongLong -- 10
}
#typev ntfsattrib_c400 21 "%0Cannot allocate decompresion buffers of size (0x%10!08x!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ReadNTFSAttributeData$fin$0
{
chunkBufferSize, ItemLong -- 10
}
#typev ntfsattrib_c367 20 "%0Output buffer too small (%10!I64d!), FileSize (%11!d!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ReadNTFSAttributeData$fin$0
{
BufferSize, ItemLongLong -- 10
AttributeHeader->Form.Resident.ValueLength, ItemLong -- 11
}
#typev ntfsattrib_c314 18 "%0ProcessNTFSAttributeData( record %10!I64d! ) failed.  status (%11!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=SearchNTFSIndexEntryByRefNum
{
FSData->NTFS.OpenRecord, ItemLongLong -- 10
ntStatus, ItemNTSTATUS -- 11
}
#typev ntfsattrib_c292 17 "%0ProcessNTFSAttributeData(%10!I64d!) failed.  status (%11!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=SearchNTFSIndexEntryByRefNum
{
RefNum, ItemLongLong -- 10
ntStatus, ItemNTSTATUS -- 11
}
#typev ntfsattrib_c265 16 "%0Memory allocation failure.  size (%10!d!)" //   LEVEL=MBLogLevelError FLAGS=TraceFlag FUNC=SearchNTFSIndexEntryByRefNum
{
bufferSize, ItemLong -- 10
}
#typev ntfsattrib_c247 15 "%0GetNTFSFileRecord( %10!I64d! ) failed.  status (%11!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=SearchNTFSIndexEntryByRefNum
{
RefNum, ItemLongLong -- 10
ntStatus, ItemNTSTATUS -- 11
}
#typev ntfsattrib_c718 31 "%0Too much data in file record %10!I64d!" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=WriteNTFSAttributeData
{
FSData->NTFS.OpenRecord, ItemLongLong -- 10
}
#typev ntfsattrib_c726 32 "%0ReadBytes( cluster %10!I64d! ) failed.  status (%11!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=WriteNTFSAttributeData
{
runListEntry->LogicalOffset / g_DriverData.ClusterSize, ItemLongLong -- 10
ntStatus, ItemNTSTATUS -- 11
}
#typev ntfsattrib_c696 30 "%0Invalid runlist data in file record %10!I64d!" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=WriteNTFSAttributeData
{
FSData->NTFS.OpenRecord, ItemLongLong -- 10
}
// PDB:  e:\jenkins\workspace\N_Swissarmy_Kernel\src\..\bin\x64\Win7_Release\mbamswissarmy.pdb
// PDB:  Last Updated :2024-06-04:16:40:19:196 (UTC) [tracepdb]
1822e2f5-0226-3482-a89a-72793587dbea SwissarmyKernel // SRC=main.c MJ= MN=
#typev main_c75 12 "%0Could not build volume data for generic volume (%10!hd!:).  status (%11!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=BuildVolumeData
{
VolumeLetter, ItemShort -- 10
ntStatus, ItemNTSTATUS -- 11
}
#typev main_c70 11 "%0Unrecognized file system on (%10!hd!:)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=BuildVolumeData
{
VolumeLetter, ItemShort -- 10
}
#typev main_c91 13 "%0Could not build volume data for NTFS volume (%10!hd!:).  status (%11!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=BuildVolumeData
{
VolumeLetter, ItemShort -- 10
ntStatus, ItemNTSTATUS -- 11
}
#typev main_c107 14 "%0Could not build volume data for FAT32 volume (%10!hd!).  status (%11!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=BuildVolumeData
{
VolumeLetter, ItemShort -- 10
ntStatus, ItemNTSTATUS -- 11
}
#typev main_c125 16 "%0Could not build volume data for BitLocker volume (%10!hd!).  status (%11!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=BuildVolumeData
{
VolumeLetter, ItemShort -- 10
ntStatus, ItemNTSTATUS -- 11
}
#typev main_c120 15 "%0GetVolumeFileSystem(%10!hd!:) returned FILE_SYSTEM_BITLOCKER" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=BuildVolumeData
{
VolumeLetter, ItemShort -- 10
}
#typev main_c45 10 "%0OpenVolumeForDDA(%10!hd!:) failed with status (%11!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=BuildVolumeData
{
VolumeLetter, ItemShort -- 10
ntStatus, ItemNTSTATUS -- 11
}
#typev main_c249 18 "%0Cannot allocate memory for volume boot record, (%10!d!)" //   LEVEL=MBLogLevelError FLAGS=TraceFlag FUNC=GetVolumeFileSystem
{
BOOT_RECORD_SIZE, ItemLong -- 10
}
#typev main_c242 17 "%0Failed to read volume boot record (%10!hd!:).  status (%11!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=GetVolumeFileSystem
{
VolumeLetter, ItemShort -- 10
ntStatus, ItemNTSTATUS -- 11
}
// PDB:  e:\jenkins\workspace\N_Swissarmy_Kernel\src\..\bin\x64\Win7_Release\mbamswissarmy.pdb
// PDB:  Last Updated :2024-06-04:16:40:19:196 (UTC) [tracepdb]
639c492a-65ec-32c2-d37b-00257c0876b8 SwissarmyKernel // SRC=lock.c MJ= MN=
#typev lock_c81 10 "%0ClassReleaseRemoveLock: Released for Object %10!p! & irp %11!p! - count is %12!d!" //   LEVEL=MBLogLevelTrace FLAGS=TraceFlag FUNC=ClassReleaseRemoveLock
{
DeviceObject, ItemPtr -- 10
Tag, ItemPtr -- 11
lockValue, ItemLong -- 12
}
// PDB:  e:\jenkins\workspace\N_Swissarmy_Kernel\src\..\bin\x64\Win7_Release\mbamswissarmy.pdb
// PDB:  Last Updated :2024-06-04:16:40:19:196 (UTC) [tracepdb]
aa0e8b33-429a-3583-94f2-f65f196d05c1 SwissarmyKernel // SRC=KernelImage.c MJ= MN=
#typev kernelimage_c594 24 "%0Could not create disk device object copy (%10!s!)" //   LEVEL=MBLogLevelError FLAGS=TraceFlag FUNC=CreateLowerDevice
{
ntStatus, ItemNTSTATUS -- 10
}
#typev kernelimage_c588 23 "%0Memory allocation failure.  size (%10!d!)" //   LEVEL=MBLogLevelError FLAGS=TraceFlag FUNC=CreateLowerDevice
{
sizeof(MBPDEVICEDATA), ItemLong -- 10
}
#typev kernelimage_c546 22 "%0Memory allocation failure.  size (%10!d!)" //   LEVEL=MBLogLevelError FLAGS=TraceFlag FUNC=CreateUpperDevice
{
sizeof(MBPDEVICEDATA), ItemLong -- 10
}
#typev kernelimage_c540 21 "%0Failed to create disk device object.  status (%10!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=CreateUpperDevice
{
ntStatus, ItemNTSTATUS -- 10
}
#typev kernelimage_c513 20 "%0Memory allocation failure.  size (%10!d!)" //   LEVEL=MBLogLevelError FLAGS=TraceFlag FUNC=CreateUpperDevice
{
sizeof(MBPDEVICEDATA), ItemLong -- 10
}
#typev kernelimage_c645 27 "%0Could not get driver object name.  status (%10!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ExtractDriverName
{
ntStatus, ItemNTSTATUS -- 10
}
#typev kernelimage_c638 26 "%0Memory allocation failure.  size (%10!d!)" //   LEVEL=MBLogLevelError FLAGS=TraceFlag FUNC=ExtractDriverName
{
tempDriverName->Length + sizeof(WCHAR), ItemLong -- 10
}
#typev kernelimage_c633 25 "%0Could not extract driver name from device object name (%10!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ExtractDriverName
{
(PWCHAR)*DriverName, ItemWString -- 10
}
#typev kernelimage_c1113 42 "%0Invalid DeviceType or Flags,  DeviceType (%10!d!), Flags (0x%11!x!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ExtractLowerDevice
{
DiskDeviceObject->DeviceType, ItemLong -- 10
DiskDeviceObject->Flags, ItemLong -- 11
}
#typev kernelimage_c1206 45 "%0Could not determine driver name.  status (%10!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ExtractLowerDevice
{
ntStatus, ItemNTSTATUS -- 10
}
#typev kernelimage_c1128 44 "%0Could not allocate memory for device name (%10!d!)" //   LEVEL=MBLogLevelError FLAGS=TraceFlag FUNC=ExtractLowerDevice
{
retLength, ItemLong -- 10
}
#typev kernelimage_c1120 43 "%0Could not determine DiskDeviceObject name.  status (%10!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ExtractLowerDevice
{
ntStatus, ItemNTSTATUS -- 10
}
#typev kernelimage_c2267 58 "%0Cannot test unhooking on Win8+" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=HandleIoctlIsInfected
{
}
#typev kernelimage_c1308 48 "%0Invalid parameter - DriverObject is NULL" //   LEVEL=MBLogLevelError FLAGS=TraceFlag FUNC=InspectPortDriver
{
}
#typev kernelimage_c2109 57 "%0IofCompleteRequest is hooked!" //   LEVEL=MBLogLevelWarning FLAGS=TraceFlag FUNC=IsKernelHooked
{
}
#typev kernelimage_c2099 56 "%0IofCallDriver is hooked!" //   LEVEL=MBLogLevelWarning FLAGS=TraceFlag FUNC=IsKernelHooked
{
}
#typev kernelimage_c2087 55 "%0Could not load system process module (%10!s!).  status (%11!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=IsKernelHooked
{
&kernelPath, ItemPWString -- 10
ntStatus, ItemNTSTATUS -- 11
}
#typev kernelimage_c2073 54 "%0Could not retrieve system process info (%10!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=IsKernelHooked
{
ntStatus, ItemNTSTATUS -- 10
}
#typev kernelimage_c978 40 "%0Could not create driver object.  status (%10!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=LoadDriverCopy
{
ntStatus, ItemNTSTATUS -- 10
}
#typev kernelimage_c991 41 "%0Memory allocation failure.  size (%10!d!)" //   LEVEL=MBLogLevelError FLAGS=TraceFlag FUNC=LoadDriverCopy
{
sizeof(IO_DRIVER_EXTENSION), ItemLong -- 10
}
#typev kernelimage_c952 39 "%0Driver name not found." //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=LoadDriverCopy
{
}
#typev kernelimage_c946 38 "%0Memory allocation failure.  size (%10!d!)" //   LEVEL=MBLogLevelError FLAGS=TraceFlag FUNC=LoadDriverCopy
{
ansiDriverName.MaximumLength, ItemLong -- 10
}
#typev kernelimage_c941 37 "%0Could not convert Unicodes string to Ansi String (%10!s!).  status (%11!s!)" //   LEVEL=MBLogLevelError FLAGS=TraceFlag FUNC=LoadDriverCopy
{
&unicodeDriverName, ItemPWString -- 10
ntStatus, ItemNTSTATUS -- 11
}
#typev kernelimage_c936 36 "%0Error appending driver file extsnsion (%10!s!).  status (%11!s!)" //   LEVEL=MBLogLevelError FLAGS=TraceFlag FUNC=LoadDriverCopy
{
&ansiDriverName, ItemPString -- 10
ntStatus, ItemNTSTATUS -- 11
}
#typev kernelimage_c931 35 "%0Failed to get module info for (%10!s!).  status (%11!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=LoadDriverCopy
{
&ansiDriverName, ItemPString -- 10
ntStatus, ItemNTSTATUS -- 11
}
#typev kernelimage_c926 34 "%0Failed to load driver module (%10!s!).  status (%11!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=LoadDriverCopy
{
&ansiDriverName, ItemPString -- 10
ntStatus, ItemNTSTATUS -- 11
}
#typev kernelimage_c826 33 "%0Device could not be retrieved.  status (%10!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=LoadDriverCopy
{
ntStatus, ItemNTSTATUS -- 10
}
#typev kernelimage_c809 32 "%0Memory allocation failure.  size (%10!d!)" //   LEVEL=MBLogLevelError FLAGS=TraceFlag FUNC=LoadDriverCopy
{
sizeof(MBPDEVICEDATA), ItemLong -- 10
}
#typev kernelimage_c790 31 "%0Could not build global device name.  status (%10!s!)" //   LEVEL=MBLogLevelError FLAGS=TraceFlag FUNC=LoadDriverCopy
{
ntStatus, ItemNTSTATUS -- 10
}
#typev kernelimage_c716 30 "%0Could not get image NT header (%10!s!).  status (%11!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=LoadModule
{
ModuleName, ItemPWString -- 10
ntStatus, ItemNTSTATUS -- 11
}
#typev kernelimage_c707 29 "%0Could not determine image size (%10!s!).  status (%11!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=LoadModule
{
ModuleName, ItemPWString -- 10
ntStatus, ItemNTSTATUS -- 11
}
#typev kernelimage_c700 28 "%0Could not load PE Image (%10!s!).  status (%11!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=LoadModule
{
ModuleName, ItemPWString -- 10
ntStatus, ItemNTSTATUS -- 11
}
#typev kernelimage_c319 19 "%0Failed to get module info for (%10!s!).  status (%11!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=MBpApplyIAT
{
dllName, ItemString -- 10
ntStatus, ItemNTSTATUS -- 11
}
#typev kernelimage_c296 18 "%0Could not get image nt header (%10!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=MBpApplyIAT
{
ntStatus, ItemNTSTATUS -- 10
}
#typev kernelimage_c233 17 "%0Could not parse nt image header (%10!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=MBpApplyRelocation
{
ntStatus, ItemNTSTATUS -- 10
}
#typev kernelimage_c204 16 "%0Could not open Image File (%10!s!).  status (%11!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=MBpLoadPeImage
{
ImageFile, ItemPWString -- 10
ntStatus, ItemNTSTATUS -- 11
}
#typev kernelimage_c198 15 "%0Could not create memory section for image file (%10!s!).  status (%11!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=MBpLoadPeImage
{
ImageFile, ItemPWString -- 10
ntStatus, ItemNTSTATUS -- 11
}
#typev kernelimage_c192 14 "%0Could not map section for image file (%10!s!).  status (%11!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=MBpLoadPeImage
{
ImageFile, ItemPWString -- 10
ntStatus, ItemNTSTATUS -- 11
}
#typev kernelimage_c184 13 "%0Memory allocation failure.  size (%10!I64d!)" //   LEVEL=MBLogLevelError FLAGS=TraceFlag FUNC=MBpLoadPeImage
{
*ImageSize, ItemLongLong -- 10
}
#typev kernelimage_c179 12 "%0Failed to read image file from disk (%10!s!).  status (%11!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=MBpLoadPeImage
{
ImageFile, ItemPWString -- 10
ntStatus, ItemNTSTATUS -- 11
}
#typev kernelimage_c90 11 "%0Invalid or corrupt file format.  bigger (%10!I64d!), smaller (%11!I64d!), imageLeft (%12!I64d!), PointerToRawData (%13!d!), DiskImageSize (%14!I64d!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=MBpReadDiskImage
{
bigger, ItemLongLong -- 10
smaller, ItemLongLong -- 11
imageLeft, ItemLongLong -- 12
sectionHeader[i].PointerToRawData, ItemLong -- 13
DiskImageSize, ItemLongLong -- 14
}
#typev kernelimage_c67 10 "%0Invalid PE image format.  sizeofOfHeaders (%10!I64d!), imageLeft (%11!I64d!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=MBpReadDiskImage
{
sizeOfHeaders, ItemLongLong -- 10
imageLeft, ItemLongLong -- 11
}
#typev kernelimage_c2521 65 "%0Could not build imageFileName.  status (%10!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ParseModuleName
{
ntStatus, ItemNTSTATUS -- 10
}
#typev kernelimage_c2510 64 "%0Memory allocation failure.  size (%10!d!)" //   LEVEL=MBLogLevelError FLAGS=TraceFlag FUNC=ParseModuleName
{
imageFileName->MaximumLength, ItemLong -- 10
}
#typev kernelimage_c2501 63 "%0Memory allocation failure.  size (%10!d!)" //   LEVEL=MBLogLevelError FLAGS=TraceFlag FUNC=ParseModuleName
{
sizeof(UNICODE_STRING), ItemLong -- 10
}
#typev kernelimage_c2467 62 "%0Memory allocation failure.  size (%10!d!)" //   LEVEL=MBLogLevelError FLAGS=TraceFlag FUNC=ParseModuleName
{
Pattern->Length + sizeof(WCHAR) * 2, ItemLong -- 10
}
#typev kernelimage_c2452 61 "%0Memory allocation failure.  size (%10!d!)" //   LEVEL=MBLogLevelError FLAGS=TraceFlag FUNC=ParseModuleName
{
Pattern->Length - sizeof(WCHAR) * skip, ItemLong -- 10
}
#typev kernelimage_c2434 60 "%0Memory allocation failure.  size (%10!d!)" //   LEVEL=MBLogLevelError FLAGS=TraceFlag FUNC=ParseModuleName
{
Pattern->MaximumLength, ItemLong -- 10
}
#typev kernelimage_c2413 59 "%0Invalid parameter.  Pattern->Buffer is NULL" //   LEVEL=MBLogLevelError FLAGS=TraceFlag FUNC=ParseModuleName
{
}
#typev kernelimage_c1993 53 "%0Invalid image header format.  sizeOfHeaders (%10!d!), imageLeft (%11!I64d!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ReadMemoryImage
{
sizeOfHeaders, ItemLong -- 10
imageLeft, ItemLongLong -- 11
}
#typev kernelimage_c1960 52 "%0Could not get image header (%10!s!).  status (%11!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ReadMemoryImage
{
imageNameAnsi.Buffer, ItemString -- 10
ntStatus, ItemNTSTATUS -- 11
}
#typev kernelimage_c1952 51 "%0Could not get module info (%10!s!).  status (%11!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ReadMemoryImage
{
imageNameAnsi.Buffer, ItemString -- 10
ntStatus, ItemNTSTATUS -- 11
}
#typev kernelimage_c1939 50 "%0Could not convert unicode to ansi (%10!s!).  status (%11!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ReadMemoryImage
{
&imageNameUnicode, ItemPWString -- 10
ntStatus, ItemNTSTATUS -- 11
}
#typev kernelimage_c1931 49 "%0Memory allocation failure.  size (%10!d!)" //   LEVEL=MBLogLevelError FLAGS=TraceFlag FUNC=ReadMemoryImage
{
imageNameAnsi.MaximumLength, ItemLong -- 10
}
#typev kernelimage_c1270 47 "%0Could not reference disk device.  status (%10!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=UnhookingOn
{
ntStatus, ItemNTSTATUS -- 10
}
#typev kernelimage_c1226 46 "%0Cannot enable unhooking on Win8+" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=UnhookingOn
{
}
#typev kernelimage_c2870 70 "%0Memory allocation failure.  size (%10!d!)" //   LEVEL=MBLogLevelError FLAGS=TraceFlag FUNC=VerifyProcess
{
imageFileName.Length + sizeof(WCHAR), ItemLong -- 10
}
#typev kernelimage_c2816 69 "%0Could not reference process handle (%10!p!).  status (%11!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=VerifyRunDll32CommandLine
{
ProcessHandle, ItemPtr -- 10
ntStatus, ItemNTSTATUS -- 11
}
#typev kernelimage_c2746 68 "%0Could nor query process information (%10!p!).  stauts (%11!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=VerifyRunDll32CommandLine
{
ProcessHandle, ItemPtr -- 10
ntStatus, ItemNTSTATUS -- 11
}
#typev kernelimage_c2614 67 "%0Memory allocation failure.  size (%10!d!)" //   LEVEL=MBLogLevelError FLAGS=TraceFlag FUNC=VerifyRunDll32CommandLine
{
sizeof(KAPC_STATE), ItemLong -- 10
}
#typev kernelimage_c2605 66 "%0Could not query process information (%10!p!).  status (%11!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=VerifyRunDll32CommandLine
{
ProcessHandle, ItemPtr -- 10
ntStatus, ItemNTSTATUS -- 11
}
// PDB:  e:\jenkins\workspace\N_Swissarmy_Kernel\src\..\bin\x64\Win7_Release\mbamswissarmy.pdb
// PDB:  Last Updated :2024-06-04:16:40:19:196 (UTC) [tracepdb]
216f16f0-4d17-3cb4-1b21-1049dbfb217a SwissarmyKernel // SRC=ioctl.c MJ= MN=
#typev ioctl_c1145 80 "%0Pre-boot schedule too big to save (%10!I64d!)" //   LEVEL=MBLogLevelError FLAGS=TraceFlag FUNC=CreateScheduleBlob
{
blobSize, ItemLongLong -- 10
}
#typev ioctl_c1136 79 "%0Invalid Pre-Boot schedule command.  ioctl (0x%10!x!), status (%11!s!)" //   LEVEL=MBLogLevelError FLAGS=TraceFlag FUNC=CreateScheduleBlob
{
scheduledOperation->IoControlCode, ItemLong -- 10
ntStatus, ItemNTSTATUS -- 11
}
#typev ioctl_c1519 99 "%0key value empty!" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=GetParams
{
}
#typev ioctl_c1509 98 "%0Could not query key value.  status (%10!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=GetParams
{
ntStatus, ItemNTSTATUS -- 10
}
#typev ioctl_c1498 97 "%0Memory allocation failure.  size (%10!d!)" //   LEVEL=MBLogLevelError FLAGS=TraceFlag FUNC=GetParams
{
length + sizeof(WCHAR), ItemLong -- 10
}
#typev ioctl_c1489 96 "%0Could not query key value length.  status (%10!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=GetParams
{
ntStatus, ItemNTSTATUS -- 10
}
#typev ioctl_c1914 116 "%0Non-DOR value - %10!s!" //   LEVEL=MBLogLevelWarning FLAGS=TraceFlag FUNC=HandleEarlyBootCleanup
{
&nextDor->DorName, ItemPWString -- 10
}
#typev ioctl_c1869 115 "%0Error enumerating scheduled items (%10!s!)" //   LEVEL=MBLogLevelWarning FLAGS=TraceFlag FUNC=HandleEarlyBootCleanup
{
ntStatus, ItemNTSTATUS -- 10
}
#typev ioctl_c1844 114 "%0Memory allocation failure.  size (%10!d!)" //   LEVEL=MBLogLevelError FLAGS=TraceFlag FUNC=HandleEarlyBootCleanup
{
valueNameInfoSize, ItemLong -- 10
}
#typev ioctl_c1833 113 "%0Could not open DOR registry path (%10!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=HandleEarlyBootCleanup
{
ntStatus, ItemNTSTATUS -- 10
}
#typev ioctl_c1829 112 "%0No pending DOR operations found!" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=HandleEarlyBootCleanup
{
}
#typev ioctl_c1814 111 "%0Memory allocation failure.  size (%10!d!)" //   LEVEL=MBLogLevelError FLAGS=TraceFlag FUNC=HandleEarlyBootCleanup
{
schedulePath.MaximumLength, ItemLong -- 10
}
#typev ioctl_c1794 110 "%0DeleteEntry = %10!s!" //   LEVEL=MBLogLevelTrace FLAGS=TraceFlag FUNC=HandleEarlyBootCleanup
{
DeleteEntry ? 'TRUE' : 'FALSE', ItemString -- 10
}
#typev ioctl_c475 42 "%0Unrecognized volume (%10!d!)" //   LEVEL=MBLogLevelWarning FLAGS=TraceFlag FUNC=HandleIoctlBreakDriverFile
{
g_DriverData.FileSystem, ItemLong -- 10
}
#typev ioctl_c482 43 "%0Failed to break driver file (%10!s!).  status (%11!s!)" //   LEVEL=MBLogLevelWarning FLAGS=TraceFlag FUNC=HandleIoctlBreakDriverFile
{
DriverName, ItemWString -- 10
ntStatus, ItemNTSTATUS -- 11
}
#typev ioctl_c459 41 "%0BreakDriverFile (%10!s!)" //   LEVEL=MBLogLevelTrace FLAGS=TraceFlag FUNC=HandleIoctlBreakDriverFile
{
DriverName, ItemWString -- 10
}
#typev ioctl_c439 40 "%0Schedule break driver file failed (%10!s!).  status (%11!s!_" //   LEVEL=MBLogLevelWarning FLAGS=TraceFlag FUNC=HandleIoctlBreakFile
{
FileName, ItemWString -- 10
ntStatus, ItemNTSTATUS -- 11
}
#typev ioctl_c422 38 "%0Unrecognized volume (%10!d!)" //   LEVEL=MBLogLevelWarning FLAGS=TraceFlag FUNC=HandleIoctlBreakFile
{
g_DriverData.FileSystem, ItemLong -- 10
}
#typev ioctl_c429 39 "%0Failed to break (%10!s!) with status (%11!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=HandleIoctlBreakFile
{
FileName, ItemWString -- 10
ntStatus, ItemNTSTATUS -- 11
}
#typev ioctl_c394 37 "%0Failed to normalize driver path (%10!s!) with status (%11!s!)" //   LEVEL=MBLogLevelWarning FLAGS=TraceFlag FUNC=HandleIoctlBreakFile
{
expression.Buffer, ItemWString -- 10
ntStatus, ItemNTSTATUS -- 11
}
#typev ioctl_c386 36 "%0BreakFile (%10!s!)" //   LEVEL=MBLogLevelTrace FLAGS=TraceFlag FUNC=HandleIoctlBreakFile
{
FileName, ItemWString -- 10
}
#typev ioctl_c554 48 "%0 Failed to break driver file (%10!s!).  status (%11!s!)" //   LEVEL=MBLogLevelWarning FLAGS=TraceFlag FUNC=HandleIoctlBreakFileOnShutdown
{
FileName, ItemWString -- 10
ntStatus, ItemNTSTATUS -- 11
}
#typev ioctl_c539 46 "%0Unrecognized volume (%10!d!)" //   LEVEL=MBLogLevelWarning FLAGS=TraceFlag FUNC=HandleIoctlBreakFileOnShutdown
{
g_DriverData.FileSystem, ItemLong -- 10
}
#typev ioctl_c546 47 "%0Failed to break (%10!s!).  status (%11!s!)" //   LEVEL=MBLogLevelWarning FLAGS=TraceFlag FUNC=HandleIoctlBreakFileOnShutdown
{
FileName, ItemWString -- 10
ntStatus, ItemNTSTATUS -- 11
}
#typev ioctl_c511 45 "%0Failed to normalize driver path (%10!s!) with status %11!s!" //   LEVEL=MBLogLevelWarning FLAGS=TraceFlag FUNC=HandleIoctlBreakFileOnShutdown
{
expression.Buffer, ItemWString -- 10
ntStatus, ItemNTSTATUS -- 11
}
#typev ioctl_c503 44 "%0BreakFileOnShutdown (%10!s!)" //   LEVEL=MBLogLevelTrace FLAGS=TraceFlag FUNC=HandleIoctlBreakFileOnShutdown
{
FileName, ItemWString -- 10
}
#typev ioctl_c603 52 "%0Could not build full path string (%10!s!).  status (%11!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=HandleIoctlCheck
{
ObjectName, ItemWString -- 10
ntStatus, ItemNTSTATUS -- 11
}
#typev ioctl_c595 51 "%0Could not allocate memory for file name (%10!d!)" //   LEVEL=MBLogLevelError FLAGS=TraceFlag FUNC=HandleIoctlCheck
{
objectNameLength * sizeof(WCHAR), ItemLong -- 10
}
#typev ioctl_c586 50 "%0Path too long (%10!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=HandleIoctlCheck
{
ObjectName, ItemWString -- 10
}
#typev ioctl_c581 49 "%0Check File or Folder existance (%10!s!)" //   LEVEL=MBLogLevelTrace FLAGS=TraceFlag FUNC=HandleIoctlCheck
{
ObjectName, ItemWString -- 10
}
#typev ioctl_c80 11 "%0Unrecognized volume (%10!d!)" //   LEVEL=MBLogLevelWarning FLAGS=TraceFlag FUNC=HandleIoctlEnumerate
{
g_DriverData.FileSystem, ItemLong -- 10
}
#typev ioctl_c123 16 "%0Enumerate of (%10!s!) done." //   LEVEL=MBLogLevelTrace FLAGS=TraceFlag FUNC=HandleIoctlEnumerate
{
DirectoryPath, ItemWString -- 10
}
#typev ioctl_c116 15 "%0Could not enumerate folder (%10!s!).  status %11!s!)" //   LEVEL=MBLogLevelWarning FLAGS=TraceFlag FUNC=HandleIoctlEnumerate
{
DirectoryPath, ItemWString -- 10
ntStatus, ItemNTSTATUS -- 11
}
#typev ioctl_c109 14 "%0Could not map output MDL (%10!p!) for (%11!s!)" //   LEVEL=MBLogLevelError FLAGS=TraceFlag FUNC=HandleIoctlEnumerate
{
Irp->MdlAddress, ItemPtr -- 10
DirectoryPath, ItemWString -- 11
}
#typev ioctl_c102 13 "%0Output buffer too small (%10!s!):  %11!d! bytes supplied, %12!d! bytes required" //   LEVEL=MBLogLevelWarning FLAGS=TraceFlag FUNC=HandleIoctlEnumerate
{
DirectoryPath, ItemWString -- 10
outputBufferLength, ItemLong -- 11
bytesRequired, ItemLong -- 12
}
#typev ioctl_c90 12 "%0Could not determine enumerateion size of folder (%10!s!).  status (%11!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=HandleIoctlEnumerate
{
DirectoryPath, ItemWString -- 10
ntStatus, ItemNTSTATUS -- 11
}
#typev ioctl_c64 10 "%0Enumerate Folder (%10!s!)" //   LEVEL=MBLogLevelTrace FLAGS=TraceFlag FUNC=HandleIoctlEnumerate
{
DirectoryPath, ItemWString -- 10
}
#typev ioctl_c155 18 "%0Can only enumerate alternate data streams on NTFS (%10!s!)." //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=HandleIoctlEnumerateADS
{
ObjectName, ItemWString -- 10
}
#typev ioctl_c195 22 "%0Could not enumerate ADS of (%10!s!).  status (%11!s!)" //   LEVEL=MBLogLevelWarning FLAGS=TraceFlag FUNC=HandleIoctlEnumerateADS
{
ObjectName, ItemWString -- 10
ntStatus, ItemNTSTATUS -- 11
}
#typev ioctl_c188 21 "%0Could not map output MDL (%10!p!) for (%11!s!)" //   LEVEL=MBLogLevelError FLAGS=TraceFlag FUNC=HandleIoctlEnumerateADS
{
Irp->MdlAddress, ItemPtr -- 10
ObjectName, ItemWString -- 11
}
#typev ioctl_c181 20 "%0Output buffer too small (%10!s!):  %11!d! bytes supplied, %12!d! bytes required" //   LEVEL=MBLogLevelWarning FLAGS=TraceFlag FUNC=HandleIoctlEnumerateADS
{
ObjectName, ItemWString -- 10
outputBufferLength, ItemLong -- 11
bytesRequired, ItemLong -- 12
}
#typev ioctl_c168 19 "%0Could not determine enumeration size of ADS for (%10!s!).  status (%11!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=HandleIoctlEnumerateADS
{
ObjectName, ItemWString -- 10
ntStatus, ItemNTSTATUS -- 11
}
#typev ioctl_c139 17 "%0Enumerate ADS (%10!s!)" //   LEVEL=MBLogLevelTrace FLAGS=TraceFlag FUNC=HandleIoctlEnumerateADS
{
ObjectName, ItemWString -- 10
}
#typev ioctl_c2706 178 "%0Could not map output MDL" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=HandleIoctlGetDriverVersion
{
}
#typev ioctl_c2699 177 "%0Buffer is too small" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=HandleIoctlGetDriverVersion
{
}
#typev ioctl_c722 57 "%0Unrecognized volume (%10!d!)" //   LEVEL=MBLogLevelWarning FLAGS=TraceFlag FUNC=HandleIoctlOverwriteFile
{
g_DriverData.FileSystem, ItemLong -- 10
}
#typev ioctl_c729 58 "%0Failed to overwrite (%10!s!) with (%11!s!).  status (%12!s!)" //   LEVEL=MBLogLevelWarning FLAGS=TraceFlag FUNC=HandleIoctlOverwriteFile
{
destinationFile, ItemWString -- 10
sourceFile, ItemWString -- 11
ntStatus, ItemNTSTATUS -- 12
}
#typev ioctl_c706 56 "%0Overwrite file (%10!s!) with (%11!s!)" //   LEVEL=MBLogLevelTrace FLAGS=TraceFlag FUNC=HandleIoctlOverwriteFile
{
destinationFile, ItemWString -- 10
sourceFile, ItemWString -- 11
}
#typev ioctl_c237 24 "%0Unrecognized volume (%10!d!)" //   LEVEL=MBLogLevelWarning FLAGS=TraceFlag FUNC=HandleIoctlReadFile
{
g_DriverData.FileSystem, ItemLong -- 10
}
#typev ioctl_c290 29 "%0Could not read file data (%10!s!).  status %11!s!" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=HandleIoctlReadFile
{
FileName, ItemWString -- 10
ntStatus, ItemNTSTATUS -- 11
}
#typev ioctl_c283 28 "%0Could not map output MDL (%10!p!) for (%11!s!)" //   LEVEL=MBLogLevelError FLAGS=TraceFlag FUNC=HandleIoctlReadFile
{
Irp->MdlAddress, ItemPtr -- 10
FileName, ItemWString -- 11
}
#typev ioctl_c276 27 "%0Output buffer too small (%10!s!):  %11!d! bytes supplied, %12!I64d! bytes required" //   LEVEL=MBLogLevelWarning FLAGS=TraceFlag FUNC=HandleIoctlReadFile
{
FileName, ItemWString -- 10
outputBufferLength, ItemLong -- 11
bytesRequired, ItemLongLong -- 12
}
#typev ioctl_c259 26 "%0File (%10!s!) is too large for input/output. (%11!I64d!) bytes" //   LEVEL=MBLogLevelWarning FLAGS=TraceFlag FUNC=HandleIoctlReadFile
{
FileName, ItemWString -- 10
fileSize, ItemLongLong -- 11
}
#typev ioctl_c247 25 "%0Could not query file size of (%10!s!).  status %11!s!" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=HandleIoctlReadFile
{
FileName, ItemWString -- 10
ntStatus, ItemNTSTATUS -- 11
}
#typev ioctl_c216 23 "%0ReadFile (%10!s!)" //   LEVEL=MBLogLevelTrace FLAGS=TraceFlag FUNC=HandleIoctlReadFile
{
FileName, ItemWString -- 10
}
#typev ioctl_c361 35 "%0Could not read memory image of (%10!s!).  status (%11!s!)" //   LEVEL=MBLogLevelWarning FLAGS=TraceFlag FUNC=HandleIoctlReadMemoryImage
{
ImageName, ItemWString -- 10
ntStatus, ItemNTSTATUS -- 11
}
#typev ioctl_c354 34 "%0Could not map output MDL (%10!p!) for (%11!s!)" //   LEVEL=MBLogLevelError FLAGS=TraceFlag FUNC=HandleIoctlReadMemoryImage
{
Irp->MdlAddress, ItemPtr -- 10
ImageName, ItemWString -- 11
}
#typev ioctl_c347 33 "%0Output buffer too small (%10!s!):  %11!d! bytes supplied, %12!I64d! bytes required" //   LEVEL=MBLogLevelWarning FLAGS=TraceFlag FUNC=HandleIoctlReadMemoryImage
{
ImageName, ItemWString -- 10
outputBufferLength, ItemLong -- 11
bytesRequired, ItemLongLong -- 12
}
#typev ioctl_c330 32 "%0File (%10!s!) is too large for input/output (%11!I64d! bytes)" //   LEVEL=MBLogLevelWarning FLAGS=TraceFlag FUNC=HandleIoctlReadMemoryImage
{
ImageName, ItemWString -- 10
fileSize, ItemLongLong -- 11
}
#typev ioctl_c322 31 "%0Could not determine memory image size of (%10!s!).  status (%11!s!)" //   LEVEL=MBLogLevelWarning FLAGS=TraceFlag FUNC=HandleIoctlReadMemoryImage
{
ImageName, ItemWString -- 10
ntStatus, ItemNTSTATUS -- 11
}
#typev ioctl_c315 30 "%0ReadMemoryImage (%10!s!)" //   LEVEL=MBLogLevelTrace FLAGS=TraceFlag FUNC=HandleIoctlReadMemoryImage
{
ImageName, ItemWString -- 10
}
#typev ioctl_c669 55 "%0Sector (%10!I64d!) failed on %11!s! operation with status (%12!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=HandleIoctlReadWritePhysicalSector
{
sectorOperation->SectorNumber, ItemLongLong -- 10
Read == TRUE ? 'read' : 'write', ItemString -- 11
ntStatus, ItemNTSTATUS -- 12
}
#typev ioctl_c657 54 "%0Could not map output MDL (%10!p!) for (%11!s!)" //   LEVEL=MBLogLevelError FLAGS=TraceFlag FUNC=HandleIoctlReadWritePhysicalSector
{
Irp->MdlAddress, ItemPtr -- 10
PhysicalSectorOperation, ItemWString -- 11
}
#typev ioctl_c650 53 "%0%10!s! PhysicalSector, drive (%11!d!), sector (%12!I64d!)" //   LEVEL=MBLogLevelTrace FLAGS=TraceFlag FUNC=HandleIoctlReadWritePhysicalSector
{
Read ? 'Read' : 'Write', ItemString -- 10
sectorOperation->DriveNumber, ItemLong -- 11
sectorOperation->SectorNumber, ItemLongLong -- 12
}
#typev ioctl_c922 72 "%0Schedule shutdown task (%10!s!)" //   LEVEL=MBLogLevelTrace FLAGS=TraceFlag FUNC=HandleIoctlSchedule
{
Command, ItemWString -- 10
}
#typev ioctl_c796 63 "%0Invalid Parameter - pVol (%10!p!), *pVol (%11!s!), pSect (%12!p!), *pSect (%13!s!)" //   LEVEL=MBLogLevelWarning FLAGS=TraceFlag FUNC=HandleOverwriteAbsoluteSector
{
targetVolumeStr, ItemPtr -- 10
targetVolumeStr != NULL ? targetVolumeStr : L'Invalid', ItemWString -- 11
targetSectorStr, ItemPtr -- 12
targetSectorStr != NULL ? targetSectorStr : L'Invalid', ItemWString -- 13
}
#typev ioctl_c821 65 "%0Unrecognized volume (%10!d!)" //   LEVEL=MBLogLevelWarning FLAGS=TraceFlag FUNC=HandleOverwriteAbsoluteSector
{
g_DriverData.FileSystem, ItemLong -- 10
}
#typev ioctl_c856 69 "%0Failed to overwrite volume (%10!d!) sector (%11!I64d!) with (%12!s!).  status (%13!s!)" //   LEVEL=MBLogLevelWarning FLAGS=TraceFlag FUNC=HandleOverwriteAbsoluteSector
{
(ULONG)targetVolume, ItemLong -- 10
targetSector, ItemLongLong -- 11
srcFileName, ItemWString -- 12
ntStatus, ItemNTSTATUS -- 13
}
#typev ioctl_c847 68 "%0Failed to read source file (%10!s!).  status (%11!s!)" //   LEVEL=MBLogLevelWarning FLAGS=TraceFlag FUNC=HandleOverwriteAbsoluteSector
{
srcFileName, ItemWString -- 10
ntStatus, ItemNTSTATUS -- 11
}
#typev ioctl_c839 67 "%0Memory allocation failure.  size (%10!I64d!)" //   LEVEL=MBLogLevelError FLAGS=TraceFlag FUNC=HandleOverwriteAbsoluteSector
{
allocationSize, ItemLongLong -- 10
}
#typev ioctl_c830 66 "%0Failed to query size of (%10!s!).  status (%11!s!)" //   LEVEL=MBLogLevelWarning FLAGS=TraceFlag FUNC=HandleOverwriteAbsoluteSector
{
srcFileName, ItemWString -- 10
ntStatus, ItemNTSTATUS -- 11
}
#typev ioctl_c805 64 "%0Overwrite Volume (%10!d!) Sector (%11!I64d!) with contents of (%12!s!)" //   LEVEL=MBLogLevelTrace FLAGS=TraceFlag FUNC=HandleOverwriteAbsoluteSector
{
(ULONG)targetVolume, ItemLong -- 10
targetSector, ItemLongLong -- 11
srcFileName, ItemWString -- 12
}
#typev ioctl_c987 74 "%0Scheduled overwrite file failed (%10!s!).  status (%11!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=HandleShutdownNotification
{
scheduledTask->Command, ItemWString -- 10
ntStatus, ItemNTSTATUS -- 11
}
#typev ioctl_c1009 75 "%0Scheduled break file failed (%10!s!).  status (%11!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=HandleShutdownNotification
{
scheduledTask->Command, ItemWString -- 10
ntStatus, ItemNTSTATUS -- 11
}
#typev ioctl_c1053 77 "%0Scheduled write sector failed (%10!s!).  status (%11!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=HandleShutdownNotification
{
scheduledTask->Command, ItemWString -- 10
ntStatus, ItemNTSTATUS -- 11
}
#typev ioctl_c1031 76 "%0Scheduled break driver file failed (%10!s!).  status (%11!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=HandleShutdownNotification
{
scheduledTask->Command, ItemWString -- 10
ntStatus, ItemNTSTATUS -- 11
}
#typev ioctl_c1065 78 "%0Wrong IOCTL code : 0x%10!08x!" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=HandleShutdownNotification
{
scheduledTask->IoControlCode, ItemLong -- 10
}
#typev ioctl_c966 73 "%0Switch volume to (%10!hd!:) failed.  status (%11!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=HandleShutdownNotification
{
volumeLetter, ItemShort -- 10
ntStatus, ItemNTSTATUS -- 11
}
#typev ioctl_c766 62 "%0Disable unhooking." //   LEVEL=MBLogLevelTrace FLAGS=TraceFlag FUNC=HandleUnhookingOff
{
}
#typev ioctl_c756 61 "%0Could not enable unhooking, status (%10!s!)" //   LEVEL=MBLogLevelWarning FLAGS=TraceFlag FUNC=HandleUnhookingOn
{
ntStatus, ItemNTSTATUS -- 10
}
#typev ioctl_c745 60 "%0Unhooking already unabled." //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=HandleUnhookingOn
{
}
#typev ioctl_c741 59 "%0Enable unhooking." //   LEVEL=MBLogLevelTrace FLAGS=TraceFlag FUNC=HandleUnhookingOn
{
}
#typev ioctl_c1440 95 "%0Could not load user hive (%10!s!)." //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=LoadUserHive
{
ntStatus, ItemNTSTATUS -- 10
}
#typev ioctl_c1428 94 "%0Could not build UserHiveFilePath (%10!s!)." //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=LoadUserHive
{
ntStatus, ItemNTSTATUS -- 10
}
#typev ioctl_c1403 92 "%0Could not build UserHiveFilePath (%10!s!)." //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=LoadUserHive
{
ntStatus, ItemNTSTATUS -- 10
}
#typev ioctl_c1413 93 "%0Could not build UserHiveFilePath (%10!s!)." //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=LoadUserHive
{
ntStatus, ItemNTSTATUS -- 10
}
#typev ioctl_c1364 91 "%0Memory allocation failure.  size (%10!d!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=LoadUserHive
{
userHiveFilePath.MaximumLength, ItemLong -- 10
}
#typev ioctl_c1354 90 "%0Could not read userProfilePath (%10!s!).  status (%11!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=LoadUserHive
{
&userProfileKey, ItemPWString -- 10
ntStatus, ItemNTSTATUS -- 11
}
#typev ioctl_c1347 89 "%0Could not build userProfileKey (%10!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=LoadUserHive
{
ntStatus, ItemNTSTATUS -- 10
}
#typev ioctl_c1339 88 "%0Memory allocation failure.  size (%10!d!)" //   LEVEL=MBLogLevelError FLAGS=TraceFlag FUNC=LoadUserHive
{
userProfileKey.MaximumLength, ItemLong -- 10
}
#typev ioctl_c1325 87 "%0User Class hive (%10!s!)." //   LEVEL=MBLogLevelTrace FLAGS=TraceFlag FUNC=LoadUserHive
{
&userSID, ItemPWString -- 10
}
#typev ioctl_c1299 86 "%0KeyPath not in HKU hive (%10!s!)." //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=LoadUserHive
{
KeyPath, ItemPWString -- 10
}
#typev ioctl_c1440 95 "%0Could not load user hive (%10!s!)." //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=LoadUserHive$fin$0
{
ntStatus, ItemNTSTATUS -- 10
}
#typev ioctl_c1428 94 "%0Could not build UserHiveFilePath (%10!s!)." //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=LoadUserHive$fin$0
{
ntStatus, ItemNTSTATUS -- 10
}
#typev ioctl_c1403 92 "%0Could not build UserHiveFilePath (%10!s!)." //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=LoadUserHive$fin$0
{
ntStatus, ItemNTSTATUS -- 10
}
#typev ioctl_c1413 93 "%0Could not build UserHiveFilePath (%10!s!)." //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=LoadUserHive$fin$0
{
ntStatus, ItemNTSTATUS -- 10
}
#typev ioctl_c1364 91 "%0Memory allocation failure.  size (%10!d!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=LoadUserHive$fin$0
{
userHiveFilePath.MaximumLength, ItemLong -- 10
}
#typev ioctl_c1354 90 "%0Could not read userProfilePath (%10!s!).  status (%11!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=LoadUserHive$fin$0
{
&userProfileKey, ItemPWString -- 10
ntStatus, ItemNTSTATUS -- 11
}
#typev ioctl_c1347 89 "%0Could not build userProfileKey (%10!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=LoadUserHive$fin$0
{
ntStatus, ItemNTSTATUS -- 10
}
#typev ioctl_c1339 88 "%0Memory allocation failure.  size (%10!d!)" //   LEVEL=MBLogLevelError FLAGS=TraceFlag FUNC=LoadUserHive$fin$0
{
userProfileKey.MaximumLength, ItemLong -- 10
}
#typev ioctl_c1325 87 "%0User Class hive (%10!s!)." //   LEVEL=MBLogLevelTrace FLAGS=TraceFlag FUNC=LoadUserHive$fin$0
{
&userSID, ItemPWString -- 10
}
#typev ioctl_c1299 86 "%0KeyPath not in HKU hive (%10!s!)." //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=LoadUserHive$fin$0
{
KeyPath, ItemPWString -- 10
}
#typev ioctl_c1666 104 "%0Could not read pre-boot schedule from registry.  status (%10!s!)" //   LEVEL=MBLogLevelError FLAGS=TraceFlag FUNC=RestorePreBootSchedule
{
ntStatus, ItemNTSTATUS -- 10
}
#typev ioctl_c1662 103 "%0Memory allocation failure.  size (%10!d!)" //   LEVEL=MBLogLevelError FLAGS=TraceFlag FUNC=RestorePreBootSchedule
{
scheduleLength, ItemLong -- 10
}
#typev ioctl_c1735 109 "%0Invalid pre-boot schedule data." //   LEVEL=MBLogLevelError FLAGS=TraceFlag FUNC=RestorePreBootSchedule
{
}
#typev ioctl_c1728 108 "%0Corrupt pre-boot schedule command.  status (%10!s!)" //   LEVEL=MBLogLevelError FLAGS=TraceFlag FUNC=RestorePreBootSchedule
{
ntStatus, ItemNTSTATUS -- 10
}
#typev ioctl_c1721 107 "%0Memory allocation failure.  size (%10!d!)" //   LEVEL=MBLogLevelError FLAGS=TraceFlag FUNC=RestorePreBootSchedule
{
(ULONG)(sizeof(SHUTDOWN_SCHEDULE)), ItemLong -- 10
}
#typev ioctl_c1713 106 "%0Memory allocation failure.  size (%10!d!)" //   LEVEL=MBLogLevelError FLAGS=TraceFlag FUNC=RestorePreBootSchedule
{
(ULONG)(cmdLength + sizeof(WCHAR)), ItemLong -- 10
}
#typev ioctl_c1691 105 "%0Invalid schedule control code (0x%10!x!)" //   LEVEL=MBLogLevelError FLAGS=TraceFlag FUNC=RestorePreBootSchedule
{
scheduleOperation, ItemLong -- 10
}
#typev ioctl_c1648 102 "%0Found pre-boot scheduled actions at driver start." //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=RestorePreBootSchedule
{
}
#typev ioctl_c1635 101 "%0Unable to build PBR key string.  status (%10!s!)" //   LEVEL=MBLogLevelError FLAGS=TraceFlag FUNC=RestorePreBootSchedule
{
ntStatus, ItemNTSTATUS -- 10
}
#typev ioctl_c1628 100 "%0Memory allocation failure.  size (%10!d!)" //   LEVEL=MBLogLevelError FLAGS=TraceFlag FUNC=RestorePreBootSchedule
{
fullKey.MaximumLength, ItemLong -- 10
}
#typev ioctl_c1666 104 "%0Could not read pre-boot schedule from registry.  status (%10!s!)" //   LEVEL=MBLogLevelError FLAGS=TraceFlag FUNC=RestorePreBootSchedule$fin$0
{
ntStatus, ItemNTSTATUS -- 10
}
#typev ioctl_c1662 103 "%0Memory allocation failure.  size (%10!d!)" //   LEVEL=MBLogLevelError FLAGS=TraceFlag FUNC=RestorePreBootSchedule$fin$0
{
scheduleLength, ItemLong -- 10
}
#typev ioctl_c1735 109 "%0Invalid pre-boot schedule data." //   LEVEL=MBLogLevelError FLAGS=TraceFlag FUNC=RestorePreBootSchedule$fin$0
{
}
#typev ioctl_c1728 108 "%0Corrupt pre-boot schedule command.  status (%10!s!)" //   LEVEL=MBLogLevelError FLAGS=TraceFlag FUNC=RestorePreBootSchedule$fin$0
{
ntStatus, ItemNTSTATUS -- 10
}
#typev ioctl_c1721 107 "%0Memory allocation failure.  size (%10!d!)" //   LEVEL=MBLogLevelError FLAGS=TraceFlag FUNC=RestorePreBootSchedule$fin$0
{
(ULONG)(sizeof(SHUTDOWN_SCHEDULE)), ItemLong -- 10
}
#typev ioctl_c1713 106 "%0Memory allocation failure.  size (%10!d!)" //   LEVEL=MBLogLevelError FLAGS=TraceFlag FUNC=RestorePreBootSchedule$fin$0
{
(ULONG)(cmdLength + sizeof(WCHAR)), ItemLong -- 10
}
#typev ioctl_c1691 105 "%0Invalid schedule control code (0x%10!x!)" //   LEVEL=MBLogLevelError FLAGS=TraceFlag FUNC=RestorePreBootSchedule$fin$0
{
scheduleOperation, ItemLong -- 10
}
#typev ioctl_c1648 102 "%0Found pre-boot scheduled actions at driver start." //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=RestorePreBootSchedule$fin$0
{
}
#typev ioctl_c1635 101 "%0Unable to build PBR key string.  status (%10!s!)" //   LEVEL=MBLogLevelError FLAGS=TraceFlag FUNC=RestorePreBootSchedule$fin$0
{
ntStatus, ItemNTSTATUS -- 10
}
#typev ioctl_c1628 100 "%0Memory allocation failure.  size (%10!d!)" //   LEVEL=MBLogLevelError FLAGS=TraceFlag FUNC=RestorePreBootSchedule$fin$0
{
fullKey.MaximumLength, ItemLong -- 10
}
#typev ioctl_c1232 85 "%0Could not parse Schedule list. status (%10!s!)" //   LEVEL=MBLogLevelError FLAGS=TraceFlag FUNC=SaveScheduleData
{
listStatus, ItemNTSTATUS -- 10
}
#typev ioctl_c1227 84 "%0Memory allocation error.  size (%10!d!)" //   LEVEL=MBLogLevelError FLAGS=TraceFlag FUNC=SaveScheduleData
{
keyName.MaximumLength, ItemLong -- 10
}
#typev ioctl_c1221 83 "%0Could not open PBR key. status (%10!s!)" //   LEVEL=MBLogLevelError FLAGS=TraceFlag FUNC=SaveScheduleData
{
listStatus, ItemNTSTATUS -- 10
}
#typev ioctl_c1184 81 "%0Memory allocation error.  size (%10!d!)" //   LEVEL=MBLogLevelError FLAGS=TraceFlag FUNC=SaveScheduleData
{
listSize, ItemLong -- 10
}
#typev ioctl_c1215 82 "%0Could not save PBR value. status (%10!s!)" //   LEVEL=MBLogLevelError FLAGS=TraceFlag FUNC=SaveScheduleData
{
listStatus, ItemNTSTATUS -- 10
}
#typev ioctl_c902 71 "%0Memory allocation failure.  size (%10!d!)" //   LEVEL=MBLogLevelError FLAGS=TraceFlag FUNC=ScheduleTask
{
sizeof(SHUTDOWN_SCHEDULE), ItemLong -- 10
}
#typev ioctl_c889 70 "%0Failed to register shutdown notification (%10!s!)" //   LEVEL=MBLogLevelError FLAGS=TraceFlag FUNC=ScheduleTask
{
ntStatus, ItemNTSTATUS -- 10
}
#typev ioctl_c2446 157 "%0Could not delete scheduled operation (%10!s!).  status (%11!s!)" //   LEVEL=MBLogLevelWarning FLAGS=TraceFlag FUNC=ScheduledDeleteFile
{
ScheduleName, ItemPWString -- 10
ntStatus, ItemNTSTATUS -- 11
}
#typev ioctl_c2436 156 "%0Could not open file (%10!s!).  status (%11!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ScheduledDeleteFile
{
&fileName, ItemPWString -- 10
ntStatus, ItemNTSTATUS -- 11
}
#typev ioctl_c2426 155 "%0Could not query file information (%10!s!).  status (%11!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ScheduledDeleteFile
{
&fileName, ItemPWString -- 10
ntStatus, ItemNTSTATUS -- 11
}
#typev ioctl_c2421 154 "%0Could not set delete disposition on (%10!s!).  status (%11!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ScheduledDeleteFile
{
&fileName, ItemPWString -- 10
ntStatus, ItemNTSTATUS -- 11
}
#typev ioctl_c2413 153 "%0Could not reset read-only attribute on (%10!s!).  status (%11!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ScheduledDeleteFile
{
&fileName, ItemPWString -- 10
ntStatus, ItemNTSTATUS -- 11
}
#typev ioctl_c2387 152 "%0File - (%10!s!)" //   LEVEL=MBLogLevelTrace FLAGS=TraceFlag FUNC=ScheduledDeleteFile
{
&fileName, ItemPWString -- 10
}
#typev ioctl_c2383 151 "%0Could not parse scheduled operation (%10!s!)" //   LEVEL=MBLogLevelWarning FLAGS=TraceFlag FUNC=ScheduledDeleteFile
{
ScheduleName, ItemPWString -- 10
}
#typev ioctl_c2580 168 "%0Could not delete scheduled operation (%10!s!).  status (%11!s!)" //   LEVEL=MBLogLevelWarning FLAGS=TraceFlag FUNC=ScheduledDeleteFolder
{
ScheduleName, ItemPWString -- 10
ntStatus, ItemNTSTATUS -- 11
}
#typev ioctl_c2570 167 "%0Could not recursively delete folder (%10!s!).  status (%11!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ScheduledDeleteFolder
{
&folderName, ItemPWString -- 10
ntStatus, ItemNTSTATUS -- 11
}
#typev ioctl_c2565 166 "%0Folder - (%10!s!)" //   LEVEL=MBLogLevelTrace FLAGS=TraceFlag FUNC=ScheduledDeleteFolder
{
&folderName, ItemPWString -- 10
}
#typev ioctl_c2561 165 "%0Could not parse scheduled operation (%10!s!)" //   LEVEL=MBLogLevelWarning FLAGS=TraceFlag FUNC=ScheduledDeleteFolder
{
ScheduleName, ItemPWString -- 10
}
#typev ioctl_c2310 145 "%0Could not delete scheduled operation (%10!s!).  status (%11!s!)" //   LEVEL=MBLogLevelWarning FLAGS=TraceFlag FUNC=ScheduledDeleteKey
{
ScheduleName, ItemPWString -- 10
ntStatus, ItemNTSTATUS -- 11
}
#typev ioctl_c2299 144 "%0Could not unload user hive (%10!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ScheduledDeleteKey
{
&userHiveName, ItemPWString -- 10
}
#typev ioctl_c2290 143 "%0Could not delete (recursively) key (%10!s!).  status (%11!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ScheduledDeleteKey
{
&deleteKey, ItemPWString -- 10
ntStatus, ItemNTSTATUS -- 11
}
#typev ioctl_c2283 142 "%0Key - (%10!s!)" //   LEVEL=MBLogLevelTrace FLAGS=TraceFlag FUNC=ScheduledDeleteKey
{
&deleteKey, ItemPWString -- 10
}
#typev ioctl_c2279 141 "%0Could not parse scheduled operation (%10!s!)" //   LEVEL=MBLogLevelWarning FLAGS=TraceFlag FUNC=ScheduledDeleteKey
{
ScheduleName, ItemPWString -- 10
}
#typev ioctl_c2259 140 "%0Could not delete scheduled operation (%10!s!).  status (%11!s!)" //   LEVEL=MBLogLevelWarning FLAGS=TraceFlag FUNC=ScheduledDeleteValue
{
ScheduleName, ItemPWString -- 10
ntStatus, ItemNTSTATUS -- 11
}
#typev ioctl_c2248 139 "%0Could not unload user hive (%10!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ScheduledDeleteValue
{
&userHiveName, ItemPWString -- 10
}
#typev ioctl_c2240 138 "%0Could not delete registry value (%10!s!).  status (%11!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ScheduledDeleteValue
{
&deleteValueName, ItemPWString -- 10
ntStatus, ItemNTSTATUS -- 11
}
#typev ioctl_c2233 137 "%0Could not delete registry value (%10!s!) on key (%11!s!).  status (%12!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ScheduledDeleteValue
{
&deleteValueName, ItemPWString -- 10
&deleteValueKey, ItemPWString -- 11
ntStatus, ItemNTSTATUS -- 12
}
#typev ioctl_c2217 136 "%0Key - (%10!s!), Value Name - (%11!s!)" //   LEVEL=MBLogLevelTrace FLAGS=TraceFlag FUNC=ScheduledDeleteValue
{
&deleteValueKey, ItemPWString -- 10
&deleteValueName, ItemPWString -- 11
}
#typev ioctl_c2213 135 "%0Could not parse scheduled operation (%10!s!)" //   LEVEL=MBLogLevelError FLAGS=TraceFlag FUNC=ScheduledDeleteValue
{
ScheduleName, ItemPWString -- 10
}
#typev ioctl_c2682 176 "%0Could not delete scheduled operation (%10!s!).  status (%11!s!)" //   LEVEL=MBLogLevelWarning FLAGS=TraceFlag FUNC=ScheduledMoveFile
{
ScheduleName, ItemPWString -- 10
ntStatus, ItemNTSTATUS -- 11
}
#typev ioctl_c2672 175 "%0Could not open move source (%10!s!).  status (%11!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ScheduledMoveFile
{
&moveSource, ItemPWString -- 10
ntStatus, ItemNTSTATUS -- 11
}
#typev ioctl_c2662 174 "%0Could not query file information (%10!s!).  status (%11!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ScheduledMoveFile
{
&moveSource, ItemPWString -- 10
ntStatus, ItemNTSTATUS -- 11
}
#typev ioctl_c2657 173 "%0Memory allocation failure.  size (%10!d!)" //   LEVEL=MBLogLevelError FLAGS=TraceFlag FUNC=ScheduledMoveFile
{
sizeof(*renameInfo) + (moveTarget.Length + 32) * sizeof(WCHAR), ItemLong -- 10
}
#typev ioctl_c2649 172 "%0Could not rename file (%10!s!) to (%11!s!).  status (%12!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ScheduledMoveFile
{
&moveSource, ItemPWString -- 10
&moveTarget, ItemPWString -- 11
ntStatus, ItemNTSTATUS -- 12
}
#typev ioctl_c2633 171 "%0Could not reset read-only attribute on (%10!s!).  status (%11!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ScheduledMoveFile
{
&moveSource, ItemPWString -- 10
ntStatus, ItemNTSTATUS -- 11
}
#typev ioctl_c2607 170 "%0Move File (%10!s!) to (%11!s!)" //   LEVEL=MBLogLevelTrace FLAGS=TraceFlag FUNC=ScheduledMoveFile
{
&moveSource, ItemPWString -- 10
&moveTarget, ItemPWString -- 11
}
#typev ioctl_c2603 169 "%0Could not parse scheduled operation (%10!s!)" //   LEVEL=MBLogLevelWarning FLAGS=TraceFlag FUNC=ScheduledMoveFile
{
ScheduleName, ItemPWString -- 10
}
#typev ioctl_c2190 134 "%0Could not delete scheduled operation (%10!s!).  status (%11!s!)" //   LEVEL=MBLogLevelWarning FLAGS=TraceFlag FUNC=ScheduledReplaceValue
{
ScheduleName, ItemPWString -- 10
ntStatus, ItemNTSTATUS -- 11
}
#typev ioctl_c2179 133 "%0Could not unload user hive (%10!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ScheduledReplaceValue
{
&userHiveName, ItemPWString -- 10
}
#typev ioctl_c2171 132 "%0Could not open Registry Key (%10!s!) for replacement.  status (%11!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ScheduledReplaceValue
{
&replaceValueKey, ItemPWString -- 10
ntStatus, ItemNTSTATUS -- 11
}
#typev ioctl_c2161 131 "%0Could not replace value (%10!s!) in key (%11!s!).  status (%12!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ScheduledReplaceValue
{
&replaceValueName, ItemPWString -- 10
&replaceValueKey, ItemPWString -- 11
ntStatus, ItemNTSTATUS -- 12
}
#typev ioctl_c2109 128 "%0Could not convert input to binary-ansi string. key(%10!s!) valueName (%11!s!), value (%12!s!), status (%13!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ScheduledReplaceValue
{
&replaceValueKey, ItemPWString -- 10
&replaceValueName, ItemPWString -- 11
&strWCHAR, ItemPWString -- 12
ntStatus, ItemNTSTATUS -- 13
}
#typev ioctl_c2104 127 "%0Could not set REG_BINARY key. key (%10!s!), valueName (%11!s!), value (%12!s!), status (%13!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ScheduledReplaceValue
{
&replaceValueKey, ItemPWString -- 10
&replaceValueName, ItemPWString -- 11
&strWCHAR, ItemPWString -- 12
ntStatus, ItemNTSTATUS -- 13
}
#typev ioctl_c2059 124 "%0Could not convert input to dword. key (%10!s!), valueName (%11!s!), value (%12!s!), status (%13!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ScheduledReplaceValue
{
&replaceValueKey, ItemPWString -- 10
&replaceValueName, ItemPWString -- 11
&strDWORD, ItemPWString -- 12
ntStatus, ItemNTSTATUS -- 13
}
#typev ioctl_c2054 123 "%0Could not set REG_DWORD key. key (%10!s!), valueName (%11!s!), value (%12!d!), status (%13!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ScheduledReplaceValue
{
&replaceValueKey, ItemPWString -- 10
&replaceValueName, ItemPWString -- 11
regDWORD, ItemLong -- 12
ntStatus, ItemNTSTATUS -- 13
}
#typev ioctl_c2048 122 "%0Could not convert input to dword. key (%10!s!), valueName (%11!s!), value (%12!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ScheduledReplaceValue
{
&replaceValueKey, ItemPWString -- 10
&replaceValueName, ItemPWString -- 11
&strDWORD, ItemPWString -- 12
}
#typev ioctl_c2041 121 "%0Could not convert input to dword. key (%10!s!), valueName (%11!s!), value (%12!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ScheduledReplaceValue
{
&replaceValueKey, ItemPWString -- 10
&replaceValueName, ItemPWString -- 11
&strDWORD, ItemPWString -- 12
}
#typev ioctl_c2151 130 "%0Memory allocation failure.  size (%10!d!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ScheduledReplaceValue
{
replaceDataSize + 2 * sizeof(WCHAR), ItemLong -- 10
}
#typev ioctl_c2145 129 "%0Could not set REG_MULTI_SZ key. key (%10!s!) valueName (%11!s!) value(%12!s!) status (%13!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ScheduledReplaceValue
{
&replaceValueKey, ItemPWString -- 10
&replaceValueName, ItemPWString -- 11
&multiSz, ItemPWString -- 12
ntStatus, ItemNTSTATUS -- 13
}
#typev ioctl_c2084 126 "%0Could not convert input to ULONGLONG. key (%10!s!), valueName (%11!s!), value (%12!s!), status (%13!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ScheduledReplaceValue
{
&replaceValueKey, ItemPWString -- 10
&replaceValueName, ItemPWString -- 11
&uniQWORD, ItemPWString -- 12
ntStatus, ItemNTSTATUS -- 13
}
#typev ioctl_c2079 125 "%0Could not set REG_QWORD key. key (%10!s!), valueName (%11!s!), value (%12!I64d!), status (%13!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ScheduledReplaceValue
{
&replaceValueKey, ItemPWString -- 10
&replaceValueName, ItemPWString -- 11
regQWORD, ItemLongLong -- 12
ntStatus, ItemNTSTATUS -- 13
}
#typev ioctl_c2025 120 "%0Memory allocation failure.  size (%10!d!)" //   LEVEL=MBLogLevelError FLAGS=TraceFlag FUNC=ScheduledReplaceValue
{
sizeof(KEY_VALUE_BASIC_INFORMATION) + replaceValueName.Length, ItemLong -- 10
}
#typev ioctl_c2019 119 "%0Could not determine value type for REG_NONE replacement.  status (%10!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ScheduledReplaceValue
{
ntStatus, ItemNTSTATUS -- 10
}
#typev ioctl_c1998 118 "%0Key - (%10!s!), Value Name - (%11!s!)" //   LEVEL=MBLogLevelTrace FLAGS=TraceFlag FUNC=ScheduledReplaceValue
{
&replaceValueKey, ItemPWString -- 10
&replaceValueName, ItemPWString -- 11
}
#typev ioctl_c1994 117 "%0Could not parse scheduled operation (%10!s!)" //   LEVEL=MBLogLevelWarning FLAGS=TraceFlag FUNC=ScheduledReplaceValue
{
ScheduleName, ItemPWString -- 10
}
#typev ioctl_c2542 164 "%0Could not delete scheduled operation (%10!s!).  status (%11!s!)" //   LEVEL=MBLogLevelWarning FLAGS=TraceFlag FUNC=ScheduledResetFile
{
ScheduleName, ItemPWString -- 10
ntStatus, ItemNTSTATUS -- 11
}
#typev ioctl_c2532 163 "%0Could not open file (%10!s!).  status (%11!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ScheduledResetFile
{
&fileName, ItemPWString -- 10
ntStatus, ItemNTSTATUS -- 11
}
#typev ioctl_c2522 162 "%0Could not query file information (%10!s!).  status (%11!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ScheduledResetFile
{
&fileName, ItemPWString -- 10
ntStatus, ItemNTSTATUS -- 11
}
#typev ioctl_c2517 161 "%0Could not overwrite/supersede file (%10!s!).  status (%11!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ScheduledResetFile
{
&fileName, ItemPWString -- 10
ntStatus, ItemNTSTATUS -- 11
}
#typev ioctl_c2496 160 "%0Could not reset read-only attribute on (%10!s!).  status (%11!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ScheduledResetFile
{
&fileName, ItemPWString -- 10
ntStatus, ItemNTSTATUS -- 11
}
#typev ioctl_c2472 159 "%0File - (%10!s!)" //   LEVEL=MBLogLevelTrace FLAGS=TraceFlag FUNC=ScheduledResetFile
{
&fileName, ItemPWString -- 10
}
#typev ioctl_c2468 158 "%0Could not parse scheduled operation (%10!s!)" //   LEVEL=MBLogLevelWarning FLAGS=TraceFlag FUNC=ScheduledResetFile
{
ScheduleName, ItemPWString -- 10
}
#typev ioctl_c2361 150 "%0Could not delete scheduled operation (%10!s!).  status (%11!s!)" //   LEVEL=MBLogLevelWarning FLAGS=TraceFlag FUNC=ScheduledResetKey
{
ScheduleName, ItemPWString -- 10
ntStatus, ItemNTSTATUS -- 11
}
#typev ioctl_c2350 149 "%0Could not unload user hive (%10!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ScheduledResetKey
{
&userHiveName, ItemPWString -- 10
}
#typev ioctl_c2341 148 "%0Could not reset (recursively) key (%10!s!)." //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ScheduledResetKey
{
&resetKey, ItemPWString -- 10
}
#typev ioctl_c2334 147 "%0Key - (%10!s!)" //   LEVEL=MBLogLevelTrace FLAGS=TraceFlag FUNC=ScheduledResetKey
{
&resetKey, ItemPWString -- 10
}
#typev ioctl_c2330 146 "%0Could not parse scheduled operation (%10!s!)" //   LEVEL=MBLogLevelWarning FLAGS=TraceFlag FUNC=ScheduledResetKey
{
ScheduleName, ItemPWString -- 10
}
// PDB:  e:\jenkins\workspace\N_Swissarmy_Kernel\src\..\bin\x64\Win7_Release\mbamswissarmy.pdb
// PDB:  Last Updated :2024-06-04:16:40:19:196 (UTC) [tracepdb]
427f3c21-a916-3785-747a-719af8b490d3 SwissarmyKernel // SRC=genericfs.c MJ= MN=
#typev genericfs_c79 11 "%0Could not open volume root (%10!s!).  status (%11!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=BuildGenericFSVolumeData
{
&rootPath, ItemPWString -- 10
ntStatus, ItemNTSTATUS -- 11
}
#typev genericfs_c72 10 "%0Could not reference volume root (%10!s!)  status (%11!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=BuildGenericFSVolumeData
{
&rootPath, ItemPWString -- 10
ntStatus, ItemNTSTATUS -- 11
}
#typev genericfs_c671 14 "%0Unrecognized file system type (%10!d!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=GenericFSOverwriteFile
{
g_DriverData.FileSystem, ItemLong -- 10
}
#typev genericfs_c716 18 "%0Overwrite of file (%10!s!) failed.  status (%11!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=GenericFSOverwriteFile
{
DestinationName, ItemWString -- 10
ntStatus, ItemNTSTATUS -- 11
}
#typev genericfs_c708 17 "%0Read of (%10!s!) failed.  status (%11!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=GenericFSOverwriteFile
{
SourceName, ItemWString -- 10
ntStatus, ItemNTSTATUS -- 11
}
#typev genericfs_c699 16 "%0Failed to allocate sourceFileBuffer (%10!I64d!), file (%11!s!)" //   LEVEL=MBLogLevelError FLAGS=TraceFlag FUNC=GenericFSOverwriteFile
{
allocSize, ItemLongLong -- 10
SourceName, ItemWString -- 11
}
#typev genericfs_c680 15 "%0Failed to get file size of (%10!s!).  status (%11!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=GenericFSOverwriteFile
{
SourceName, ItemWString -- 10
ntStatus, ItemNTSTATUS -- 11
}
#typev genericfs_c653 13 "%0SwitchVolume (%10!hd!:) failed.  status (%11!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=GenericFSOverwriteFile
{
SourceName[0], ItemShort -- 10
ntStatus, ItemNTSTATUS -- 11
}
#typev genericfs_c538 12 "%0SwitchVolume("%10!hd!" ) failed with status 0x%11!08x!" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=GenericFSWriteBufferToFile
{
TargetFile[0], ItemShort -- 10
ntStatus, ItemLong -- 11
}
// PDB:  e:\jenkins\workspace\N_Swissarmy_Kernel\src\..\bin\x64\Win7_Release\mbamswissarmy.pdb
// PDB:  Last Updated :2024-06-04:16:40:19:196 (UTC) [tracepdb]
b577e052-ae4a-3aaa-398b-362731c7b706 SwissarmyKernel // SRC=fatutil.c MJ= MN=
#typev fatutil_c531 21 "%0WriteBytes(sector %10!I64d!) failed with status 0x%11!08x!" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=AllocateClustersInFAT
{
sectorToRead, ItemLongLong -- 10
ntStatus, ItemLong -- 11
}
#typev fatutil_c454 18 "%0SectorToRead(sector %10!I64d!) exceeded FAT size" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=AllocateClustersInFAT
{
sectorToRead, ItemLongLong -- 10
}
#typev fatutil_c462 19 "%0ReadBytes(sector %10!I64d!) failed with status 0x%11!08x!" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=AllocateClustersInFAT
{
sectorToRead, ItemLongLong -- 10
ntStatus, ItemLong -- 11
}
#typev fatutil_c516 20 "%0WriteBytes(sector %10!I64d!) failed with status 0x%11!08x!" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=AllocateClustersInFAT
{
sectorToRead, ItemLongLong -- 10
ntStatus, ItemLong -- 11
}
#typev fatutil_c375 15 "%0SectorToRead(sector %10!I64d!) exceeded FAT size" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=DeallocateFATForFile
{
sectorToRead, ItemLongLong -- 10
}
#typev fatutil_c382 16 "%0ReadBytes(sector %10!I64d!) failed with status 0x%11!08x!" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=DeallocateFATForFile
{
sectorToRead, ItemLongLong -- 10
ntStatus, ItemLong -- 11
}
#typev fatutil_c408 17 "%0WriteBytes(sector %10!I64d!) failed with status 0x%11!08x!" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=DeallocateFATForFile
{
sectorToRead, ItemLongLong -- 10
ntStatus, ItemLong -- 11
}
#typev fatutil_c58 11 "%0ReadBytes(cluster %10!d!) failed with status (%11!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=GetFATCluster
{
ClusterNumber, ItemLong -- 10
ntStatus, ItemNTSTATUS -- 11
}
#typev fatutil_c209 14 "%0Invalid short filename in cluster %10!d!, status (%11!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=GetFATDirectoryEntryByName
{
OpenCluster, ItemLong -- 10
ntStatus, ItemNTSTATUS -- 11
}
#typev fatutil_c32 10 "%0ReadBytes(sector %10!I64d!) failed with status (%11!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=GetNextClusterFromFAT
{
sectorToRead, ItemLongLong -- 10
ntStatus, ItemNTSTATUS -- 11
}
#typev fatutil_c161 13 "%0GetFATCluster(%10!d!) failed with status 0x%11!08x!" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=GetNextFATDirectoryEntryMultiCluster
{
nextCluster, ItemLong -- 10
ntStatus, ItemLong -- 11
}
#typev fatutil_c75 12 "%0WriteBytes(cluster %10!d!) failed with status (%11!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=WriteFATCluster
{
OpenCluster, ItemLong -- 10
ntStatus, ItemNTSTATUS -- 11
}
// PDB:  e:\jenkins\workspace\N_Swissarmy_Kernel\src\..\bin\x64\Win7_Release\mbamswissarmy.pdb
// PDB:  Last Updated :2024-06-04:16:40:19:196 (UTC) [tracepdb]
3ad96ba5-4968-369c-c94a-e07bb37bf2c4 SwissarmyKernel // SRC=fatops.c MJ= MN=
#typev fatops_c241 21 "%0WriteBytes(cluster %10!d!) failed with status 0x%11!08x!" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=BreakFATFile
{
firstCluster, ItemLong -- 10
ntStatus, ItemLong -- 11
}
#typev fatops_c234 20 "%0BreakExecutableHeader("%10!s!" ) failed with status 0x%11!08x!" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=BreakFATFile
{
FileName, ItemWString -- 10
ntStatus, ItemLong -- 11
}
#typev fatops_c227 19 "%0ReadBytes(cluster %10!d!) failed with status 0x%11!08x!" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=BreakFATFile
{
firstCluster, ItemLong -- 10
ntStatus, ItemLong -- 11
}
#typev fatops_c214 18 "%0Could not open file "%10!s!"" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=BreakFATFile
{
FileName, ItemWString -- 10
}
#typev fatops_c30 10 "%0Could not read FAT boot sector.  status (%10!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=BuildFATVolumeData
{
ntStatus, ItemNTSTATUS -- 10
}
#typev fatops_c122 15 "%0Data corruption in cluster %10!d! (%11!s!), status (%12!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=EnumerateFATDirectory
{
OpenCluster, ItemLong -- 10
DirectoryName, ItemWString -- 11
ntStatus, ItemNTSTATUS -- 12
}
#typev fatops_c111 14 "%0Could not open FAT cluster by name (%10!s!).  status (%11!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=EnumerateFATDirectory
{
DirectoryName, ItemWString -- 10
ntStatus, ItemNTSTATUS -- 11
}
#typev fatops_c526 37 "%0FATWriteBufferToFile("%10!s!" ) failed on READ operation with status 0x%11!08x!" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=FATOverwriteFile
{
DestinationName, ItemWString -- 10
ntStatus, ItemLong -- 11
}
#typev fatops_c518 36 "%0ReadFATFile("%10!s!" ) failed on READ operation with status 0x%11!08x!" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=FATOverwriteFile
{
SourceName, ItemWString -- 10
ntStatus, ItemLong -- 11
}
#typev fatops_c510 35 "%0ExAllocatePool("%10!s!" ) failed" //   LEVEL=MBLogLevelError FLAGS=TraceFlag FUNC=FATOverwriteFile
{
SourceName, ItemWString -- 10
}
#typev fatops_c491 34 "%0ReadFATFile("%10!s!" ) failed on QUERY operation with status 0x%11!08x!" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=FATOverwriteFile
{
SourceName, ItemWString -- 10
ntStatus, ItemLong -- 11
}
#typev fatops_c465 33 "%0SwitchVolume("%10!hd!" ) failed on READFILE operation with status 0x%11!08x!" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=FATOverwriteFile
{
SourceName[0], ItemShort -- 10
ntStatus, ItemLong -- 11
}
#typev fatops_c589 43 "%0WriteFATFileContents failed with status 0x%10!08x!" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=FATWriteBufferToFile
{
ntStatus, ItemLong -- 10
}
#typev fatops_c582 42 "%0AllocateClustersInFAT() failed to allocate clusters with status 0x%10!08x!" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=FATWriteBufferToFile
{
ntStatus, ItemLong -- 10
}
#typev fatops_c575 41 "%0DeallocateFATForFile() failed to deallocate clusters with status 0x%10!08x!" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=FATWriteBufferToFile
{
ntStatus, ItemLong -- 10
}
#typev fatops_c566 40 "%0WriteFATCluster() failed on WRITE operation with status 0x%10!08x!" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=FATWriteBufferToFile
{
ntStatus, ItemLong -- 10
}
#typev fatops_c557 39 "%0Could not open file "%10!s!"" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=FATWriteBufferToFile
{
DestinationName, ItemWString -- 10
}
#typev fatops_c550 38 "%0SwitchVolume("%10!hd!" ) failed on READFILE operation with status 0x%11!08x!" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=FATWriteBufferToFile
{
DestinationName[0], ItemShort -- 10
ntStatus, ItemLong -- 11
}
#typev fatops_c298 24 "%0GetFATCluster(%10!d!) failed with status 0x%11!08x!" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=OpenFATClusterByName
{
nextCluster, ItemLong -- 10
ntStatus, ItemLong -- 11
}
#typev fatops_c269 23 "%0Could not open FAT root directory, status 0x%10!08x!" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=OpenFATClusterByName
{
ntStatus, ItemLong -- 10
}
#typev fatops_c262 22 "%0"%10!s!" is not a valid directory path" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=OpenFATClusterByName
{
FileName, ItemWString -- 10
}
#typev fatops_c346 28 "%0"%10!s!" is a directory, not a file" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=OpenFATFileByName
{
FileName, ItemWString -- 10
}
#typev fatops_c338 27 "%0File "%10!s!" does not exist" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=OpenFATFileByName
{
FileName, ItemWString -- 10
}
#typev fatops_c330 26 "%0OpenFATClusterByName("%10!s!") failed with status 0x%11!08x!" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=OpenFATFileByName
{
FileName, ItemWString -- 10
ntStatus, ItemLong -- 11
}
#typev fatops_c322 25 "%0Invalid file path "%10!s!"" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=OpenFATFileByName
{
FileName, ItemWString -- 10
}
#typev fatops_c81 13 "%0Could not allocate memory (%10!d!)" //   LEVEL=MBLogLevelError FLAGS=TraceFlag FUNC=ReadFATBootSector
{
g_DriverData.ClusterSize, ItemLong -- 10
}
#typev fatops_c55 12 "%0Physical cluster size overflow (%10!d! bytes)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ReadFATBootSector
{
clusterSize, ItemLong -- 10
}
#typev fatops_c46 11 "%0Read boot sector failed.   status (%10!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ReadFATBootSector
{
ntStatus, ItemNTSTATUS -- 10
}
#typev fatops_c194 17 "%0WriteFATFileContents("%10!s!" ) failed with status 0x%11!08x!" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ReadFATFile
{
FileName, ItemWString -- 10
ntStatus, ItemLong -- 11
}
#typev fatops_c179 16 "%0Could not open file "%10!s!"" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ReadFATFile
{
FileName, ItemWString -- 10
}
#typev fatops_c376 29 "%0File corruption in cluster %10!d!" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ReadFATFileContents
{
cluster, ItemLong -- 10
}
#typev fatops_c387 30 "%0ReadBytes(cluster %10!d!) failed with status 0x%11!08x!" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ReadFATFileContents
{
cluster, ItemLong -- 10
ntStatus, ItemLong -- 11
}
#typev fatops_c422 31 "%0File corruption in cluster %10!d!" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=WriteFATFileContents
{
cluster, ItemLong -- 10
}
#typev fatops_c433 32 "%0WriteBytes(cluster %10!d!) failed with status 0x%11!08x!" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=WriteFATFileContents
{
cluster, ItemLong -- 10
ntStatus, ItemLong -- 11
}
// PDB:  e:\jenkins\workspace\N_Swissarmy_Kernel\src\..\bin\x64\Win7_Release\mbamswissarmy.pdb
// PDB:  Last Updated :2024-06-04:16:40:19:196 (UTC) [tracepdb]
6d4cd175-11eb-3c18-429d-ecca5909aef1 SwissarmyKernel // SRC=dda.c MJ= MN=
#typev dda_c969 42 "%0DDAReadWrite failed with status (%10!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=DDAFlush
{
ntStatus, ItemNTSTATUS -- 10
}
#typev dda_c939 41 "%0IoCallDriver failed with status (%10!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=DDAReadWrite
{
ioStatus.Status, ItemNTSTATUS -- 10
}
#typev dda_c917 40 "%0Could not get next IRP stack location" //   LEVEL=MBLogLevelError FLAGS=TraceFlag FUNC=DDAReadWrite
{
}
#typev dda_c909 39 "%0Could not build IRP" //   LEVEL=MBLogLevelError FLAGS=TraceFlag FUNC=DDAReadWrite
{
}
#typev dda_c840 38 "%0Could not get next IRP stack location" //   LEVEL=MBLogLevelError FLAGS=TraceFlag FUNC=DDAReadWrite
{
}
#typev dda_c832 37 "%0Could not build IRP" //   LEVEL=MBLogLevelError FLAGS=TraceFlag FUNC=DDAReadWrite
{
}
#typev dda_c813 36 "%0Zero size Read | Write operation requested" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=DDAReadWrite
{
}
#typev dda_c611 31 "%0Error getting physical sector size for (%10!s!), status (%11!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=GetPhysicalDrivePointer
{
&driveName, ItemPWString -- 10
ntStatus, ItemNTSTATUS -- 11
}
#typev dda_c570 30 "%0Error getting device object for (%10!s!), status (%11!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=GetPhysicalDrivePointer
{
&driveName, ItemPWString -- 10
ntStatus, ItemNTSTATUS -- 11
}
#typev dda_c562 29 "%0Error referencing handle to (%10!s!), status (%11!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=GetPhysicalDrivePointer
{
&driveName, ItemPWString -- 10
ntStatus, ItemNTSTATUS -- 11
}
#typev dda_c554 28 "%0Could not build physical device name string (%10!d!).  status (%11!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=GetPhysicalDrivePointer
{
DriveNumber, ItemLong -- 10
ntStatus, ItemNTSTATUS -- 11
}
#typev dda_c427 26 "%0Memory allocation failure.  size (%10!d!)" //   LEVEL=MBLogLevelError FLAGS=TraceFlag FUNC=GetPhysicalSectorSize
{
index, ItemLong -- 10
}
#typev dda_c441 27 "%0Cannot determine sector size" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=GetPhysicalSectorSize
{
}
#typev dda_c150 12 "%0Memory allocation failure.  size (%10!d!)" //   LEVEL=MBLogLevelError FLAGS=TraceFlag FUNC=OpenPhysicalDriveBySignature
{
diskExtentSize, ItemLong -- 10
}
#typev dda_c380 25 "%0Could not find partition table %10!u! on PhysicalDrive%11!d!" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=OpenPhysicalDriveBySignature
{
devNum.PartitionNumber, ItemLong -- 10
physicalDrive, ItemLong -- 11
}
#typev dda_c367 24 "%0Could not find partition table %10!u! on PhysicalDrive%11!d!" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=OpenPhysicalDriveBySignature
{
devNum.PartitionNumber, ItemLong -- 10
physicalDrive, ItemLong -- 11
}
#typev dda_c340 23 "%0Could not read Master Boot Record of PhysicalDrive%10!d!, status (%11!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=OpenPhysicalDriveBySignature
{
physicalDrive, ItemLong -- 10
ntStatus, ItemNTSTATUS -- 11
}
#typev dda_c278 22 "%0MBR on physical drive %10!d! is corrupted" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=OpenPhysicalDriveBySignature
{
physicalDrive, ItemLong -- 10
}
#typev dda_c271 21 "%0Could not read Master Boot Record of PhysicalDrive%10!d!, status (%11!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=OpenPhysicalDriveBySignature
{
physicalDrive, ItemLong -- 10
ntStatus, ItemNTSTATUS -- 11
}
#typev dda_c260 20 "%0Memory allocation failure.  size (%10!d!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=OpenPhysicalDriveBySignature
{
PARTITION_BUFFER_LBA_COUNT * g_DriverData.DDA.PhysicalSectorSize, ItemLong -- 10
}
#typev dda_c251 19 "%0Could not get pointer to PhysicalDrive%10!d!, status (%11!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=OpenPhysicalDriveBySignature
{
physicalDrive, ItemLong -- 10
ntStatus, ItemNTSTATUS -- 11
}
#typev dda_c243 18 "%0Invalid physical drive number (%10!d!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=OpenPhysicalDriveBySignature
{
physicalDrive, ItemLong -- 10
}
#typev dda_c228 17 "%0Can't get device number.  status (%10!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=OpenPhysicalDriveBySignature
{
ntStatus, ItemNTSTATUS -- 10
}
#typev dda_c190 15 "%0Could not get pointer to PhysicalDrive%10!d!, status (%11!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=OpenPhysicalDriveBySignature
{
physicalDrive, ItemLong -- 10
ntStatus, ItemNTSTATUS -- 11
}
#typev dda_c181 14 "%0Invalid physical drive number (%10!d!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=OpenPhysicalDriveBySignature
{
physicalDrive, ItemLong -- 10
}
#typev dda_c212 16 "%0Could not build irp for device number!" //   LEVEL=MBLogLevelError FLAGS=TraceFlag FUNC=OpenPhysicalDriveBySignature
{
}
#typev dda_c157 13 "%0Could not build irp for volume extents!" //   LEVEL=MBLogLevelError FLAGS=TraceFlag FUNC=OpenPhysicalDriveBySignature
{
}
#typev dda_c108 11 "%0Could not open physical drive containing volume %10!hd!:.  status (%11!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=OpenVolumeForDDA
{
VolumeLetter, ItemShort -- 10
ntStatus, ItemNTSTATUS -- 11
}
#typev dda_c95 10 "%0Error referencing handle to (%10!s!), status (%11!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=OpenVolumeForDDA
{
&driveName, ItemPWString -- 10
ntStatus, ItemNTSTATUS -- 11
}
#typev dda_c752 35 "%0Could not read sector %10!I64d! of PhysicalDrive%11!d!, status (%12!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ReadWritePhysicalSector
{
SectorNumber, ItemLongLong -- 10
PhysicalDriveNumber, ItemLong -- 11
ntStatus, ItemNTSTATUS -- 12
}
#typev dda_c728 34 "%0Buffer size %10!d! for PhysicalDrive%11!d! is too small for sector size %12!d!" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ReadWritePhysicalSector
{
*BufferSize, ItemLong -- 10
PhysicalDriveNumber, ItemLong -- 11
g_DriverData.DDA.PhysicalSectorSize, ItemLong -- 12
}
#typev dda_c722 33 "%0Could not get pointer to PhysicalDrive%10!d!, status (%11!s!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ReadWritePhysicalSector
{
PhysicalDriveNumber, ItemLong -- 10
ntStatus, ItemNTSTATUS -- 11
}
#typev dda_c715 32 "%0Invalid PhysicalDriveNumber (%10!d!)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ReadWritePhysicalSector
{
PhysicalDriveNumber, ItemLong -- 10
}
// PDB:  e:\jenkins\workspace\N_Swissarmy_Kernel\src\..\bin\x64\Win7_Release\mbamswissarmy.pdb
// PDB:  Last Updated :2024-06-04:16:40:19:196 (UTC) [tracepdb]
978abbbc-23d7-3a97-dd55-1a7f3e5c1d58 SwissarmyKernel // SRC=class.c MJ= MN=
#typev class_c2418 80 "%0ClassBuildRequest: Write Command" //   LEVEL=MBLogLevelTrace FLAGS=TraceFlag FUNC=ClassBuildRequest
{
}
#typev class_c2411 79 "%0ClassBuildRequest: Read Command" //   LEVEL=MBLogLevelTrace FLAGS=TraceFlag FUNC=ClassBuildRequest
{
}
#typev class_c3122 87 "%0ClassGetDescriptor: error %10!x! trying to query properties #1" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ClassGetDescriptor
{
ioStatus.Status, ItemLong -- 10
}
#typev class_c3089 86 "%0ClassGetDescriptor: unable to memory for descriptor (%10!d! bytes)" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ClassGetDescriptor
{
length, ItemLong -- 10
}
#typev class_c3073 85 "%0ClassGetDescriptor: size returned was zero?! (status %10!x!" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ClassGetDescriptor
{
ioStatus.Status, ItemLong -- 10
}
#typev class_c3067 84 "%0ClassGetDescriptor: error %10!x! trying to query properties #1" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ClassGetDescriptor
{
ioStatus.Status, ItemLong -- 10
}
#typev class_c2009 78 "%0ClassInterpretSenseInfo: Too many errors; disabling disconnects." //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ClassInterpretSenseInfo
{
}
#typev class_c2000 77 "%0ClassInterpretSenseInfo: Too many errors; disabling tagged queuing and synchronous data tranfers." //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ClassInterpretSenseInfo
{
}
#typev class_c1842 76 "%0ClassInterpretSenseInfo: Request sense info not valid. SrbStatus %10!2x!" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ClassInterpretSenseInfo
{
SRB_STATUS(Srb->SrbStatus), ItemLong -- 10
}
#typev class_c1711 68 "%0ClassInterpretSenseInfo - Media change count for device %10!d! incremented to %11!#x!" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ClassInterpretSenseInfo
{
fdoExtension->DeviceNumber, ItemLong -- 10
fdoExtension->MediaChangeCount, ItemLong -- 11
}
#typev class_c1662 65 "%0ClassInterpretSenseInfo: Media changed" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ClassInterpretSenseInfo
{
}
#typev class_c1667 66 "%0ClassInterpretSenseInfo: Bus reset" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ClassInterpretSenseInfo
{
}
#typev class_c1671 67 "%0ClassInterpretSenseInfo: Unit attention" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ClassInterpretSenseInfo
{
}
#typev class_c1519 47 "%0ClassInterpretSenseInfo: Media write protected" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ClassInterpretSenseInfo
{
}
#typev class_c1724 70 "%0InterpretSenseInfo: Media blank check" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ClassInterpretSenseInfo
{
}
#typev class_c1718 69 "%0ClassInterpretSenseInfo: Command aborted" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ClassInterpretSenseInfo
{
}
#typev class_c1800 75 "%0ClassInterpretSenseInfo: Unrecognized sense code" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ClassInterpretSenseInfo
{
}
#typev class_c1571 51 "%0ClassInterpretSenseInfo: Illegal command" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ClassInterpretSenseInfo
{
}
#typev class_c1576 52 "%0ClassInterpretSenseInfo: Illegal block address" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ClassInterpretSenseInfo
{
}
#typev class_c1633 64 "%0ClassInterpretSenseInfo: Invalid CDB" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ClassInterpretSenseInfo
{
}
#typev class_c1583 53 "%0ClassInterpretSenseInfo: Invalid LUN" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ClassInterpretSenseInfo
{
}
#typev class_c1611 58 "%0ClassInterpretSenseInfo: Authentication failure" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ClassInterpretSenseInfo
{
}
#typev class_c1614 59 "%0ClassInterpretSenseInfo: Key not present" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ClassInterpretSenseInfo
{
}
#typev class_c1617 60 "%0ClassInterpretSenseInfo: Key not established" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ClassInterpretSenseInfo
{
}
#typev class_c1620 61 "%0ClassInterpretSenseInfo: Read of scrambled sector w/o authentication" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ClassInterpretSenseInfo
{
}
#typev class_c1623 62 "%0ClassInterpretSenseInfo: Media region does not logical unit region" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ClassInterpretSenseInfo
{
}
#typev class_c1626 63 "%0ClassInterpretSenseInfo: Region set error -- region may be permanent" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ClassInterpretSenseInfo
{
}
#typev class_c1604 57 "%0ClassInterpretSenseInfo: Copy protection failure" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ClassInterpretSenseInfo
{
}
#typev class_c1589 54 "%0ClassInterpretSenseInfo: Music area" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ClassInterpretSenseInfo
{
}
#typev class_c1594 55 "%0ClassInterpretSenseInfo: Data area" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ClassInterpretSenseInfo
{
}
#typev class_c1599 56 "%0ClassInterpretSenseInfo: Volume overflow" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ClassInterpretSenseInfo
{
}
#typev class_c1565 50 "%0ClassInterpretSenseInfo: Illegal SCSI request" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ClassInterpretSenseInfo
{
}
#typev class_c1791 74 "%0ClassInterpretSenseInfo: No specific sense key" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ClassInterpretSenseInfo
{
}
#typev class_c1785 73 "%0ClassInterpretSenseInfo: Incorrect length detected." //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ClassInterpretSenseInfo
{
}
#typev class_c1771 72 "%0ClassInterpretSenseInfo: Incorrect length detected." //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ClassInterpretSenseInfo
{
}
#typev class_c1732 71 "%0ClassInterpretSenseInfo: Recovered error" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ClassInterpretSenseInfo
{
}
#typev class_c1484 45 "%0ClassInterpretSenseInfo: Initializing command required" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ClassInterpretSenseInfo
{
}
#typev class_c1455 44 "%0ClassInterpretSenseInfo: not ready, cause unknown" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ClassInterpretSenseInfo
{
}
#typev class_c1433 41 "%0ClassInterpretSenseInfo: In process of becoming ready" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ClassInterpretSenseInfo
{
}
#typev class_c1439 42 "%0ClassInterpretSenseInfo: Manual intervention required" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ClassInterpretSenseInfo
{
}
#typev class_c1446 43 "%0ClassInterpretSenseInfo: Format in progress" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ClassInterpretSenseInfo
{
}
#typev class_c1428 40 "%0ClassInterpretSenseInfo: Operation In Progress" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ClassInterpretSenseInfo
{
}
#typev class_c1423 39 "%0ClassInterpretSenseInfo: Lun not ready" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ClassInterpretSenseInfo
{
}
#typev class_c1508 46 "%0ClassInterpretSenseInfo: No Media in device." //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ClassInterpretSenseInfo
{
}
#typev class_c1416 38 "%0ClassInterpretSenseInfo: Device not ready" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ClassInterpretSenseInfo
{
}
#typev class_c1526 48 "%0ClassInterpretSenseInfo: Bad media" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ClassInterpretSenseInfo
{
}
#typev class_c1554 49 "%0ClassInterpretSenseInfo: Hardware error" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ClassInterpretSenseInfo
{
}
#typev class_c1390 37 "%0ClassInterpretSenseInfo: Additional sense code qualifier is %10!x!" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ClassInterpretSenseInfo
{
senseBuffer->AdditionalSenseCodeQualifier, ItemLong -- 10
}
#typev class_c1389 36 "%0ClassInterpretSenseInfo: Additional sense code is %10!x!" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ClassInterpretSenseInfo
{
senseBuffer->AdditionalSenseCode, ItemLong -- 10
}
#typev class_c1388 35 "%0ClassInterpretSenseInfo: Sense key is %10!x!" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ClassInterpretSenseInfo
{
senseBuffer->SenseKey, ItemLong -- 10
}
#typev class_c1387 34 "%0ClassInterpretSenseInfo: Error code is %10!x!" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ClassInterpretSenseInfo
{
senseBuffer->ErrorCode, ItemLong -- 10
}
#typev class_c1378 33 "%0ClassInterpretSenseInfo: Internal Error code is %10!x!" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ClassInterpretSenseInfo
{
Srb->InternalStatus, ItemLong -- 10
}
#typev class_c1000 25 "%0ClassIoComplete: Not Freeing Srb @ %10!p! because SRB_CLASS_FLAGS_PERSISTANT set" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ClassIoComplete
{
srb, ItemPtr -- 10
}
#typev class_c968 24 "%0Retry request %10!p!" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ClassIoComplete
{
Irp, ItemPtr -- 10
}
#typev class_c928 23 "%0ClassIoComplete: IRP %10!p!, SRB %11!p!" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ClassIoComplete
{
Irp, ItemPtr -- 10
srb, ItemPtr -- 11
}
#typev class_c1236 30 "%0ClassIoCompleteAssociated: All partial IRPs complete %10!p!" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ClassIoCompleteAssociated
{
originalIrp, ItemPtr -- 10
}
#typev class_c1220 29 "%0ClassIoCompleteAssociated: Partial IRPs left %10!d!" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ClassIoCompleteAssociated
{
irpCount, ItemLong -- 10
}
#typev class_c1176 28 "%0ClassIoCompleteAssociated: Partial xfer IRP %10!p!" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ClassIoCompleteAssociated
{
Irp, ItemPtr -- 10
}
#typev class_c1146 27 "%0Retry request %10!p!" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ClassIoCompleteAssociated
{
Irp, ItemPtr -- 10
}
#typev class_c1105 26 "%0ClassIoCompleteAssociated: IRP %10!p!, SRB %11!p!" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ClassIoCompleteAssociated
{
Irp, ItemPtr -- 10
srb, ItemPtr -- 11
}
#typev class_c242 13 "%0ClassReadWrite: Byte count is %10!x!" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ClassReadWrite
{
currentIrpStack->Parameters.Read.Length, ItemLong -- 10
}
#typev class_c241 12 "%0ClassReadWrite: Maximum is %10!x!" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ClassReadWrite
{
maximumTransferLength, ItemLong -- 10
}
#typev class_c240 11 "%0ClassReadWrite: Request greater than maximum" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ClassReadWrite
{
}
#typev class_c156 10 "%0ClassReadWrite (%10!p!): ClassReadWriteVerification must set irp status on error" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ClassReadWrite
{
DeviceObject, ItemPtr -- 10
}
#typev class_c837 22 "%0ClassSplitRequest: All partial IRPs completed for IRP %10!p!" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ClassSplitRequest
{
Irp, ItemPtr -- 10
}
#typev class_c639 17 "%0ClassSplitRequest: Can't allocate Irp" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ClassSplitRequest
{
}
#typev class_c697 19 "%0ClassSplitRequest: ClassBuildRequest failed" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ClassSplitRequest
{
}
#typev class_c711 20 "%0ClassSplitRequest: Can't allocate Srb" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ClassSplitRequest
{
}
#typev class_c649 18 "%0ClassSplitRequest: New IRP %10!p!" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ClassSplitRequest
{
newIrp, ItemPtr -- 10
}
#typev class_c617 16 "%0Integer overflow in calculating transfer packet size." //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ClassSplitRequest
{
}
#typev class_c590 15 "%0ClassSplitRequest: Original IRP %10!p!" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ClassSplitRequest
{
Irp, ItemPtr -- 10
}
#typev class_c589 14 "%0ClassSplitRequest: Requires %10!d! IRPs" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ClassSplitRequest
{
irpCount, ItemLong -- 10
}
#typev class_c2608 81 "%0ClassReleaseQueue: Allocating release queue irp" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=ClasspReleaseQueue
{
}
#typev class_c2837 83 "%0ClassCreateFdo: Can not create device object %10!x!" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=CreateDiskDeviceObject
{
status, ItemLong -- 10
}
#typev class_c2797 82 "%0ClassCreateFdo: Create device object" //   LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=CreateDiskDeviceObject
{
}
// PDB:  e:\jenkins\workspace\N_Swissarmy_Kernel\src\..\bin\x64\Win7_Release\mbamswissarmy.pdb
// PDB:  Last Updated :2024-06-04:16:40:19:196 (UTC) [tracepdb]
3e1d51bc-6e70-3287-f38b-cf85ef74c68c mbcommonkernel // SRC=FileVerify.cpp MJ= MN=
#typev fileverify_cpp2087 81 "%0Error getting memory at line %10!u!" //   LEVEL=MBLogLevelWarning FLAGS=TRACE_FLAG_SIGNATURE FUNC=EnumerateCerts
{
__LINE__, ItemLong -- 10
}
#typev fileverify_cpp2037 79 "%0Failed to open registry certificate store %10!s! 0x%11!x!" //   LEVEL=MBLogLevelWarning FLAGS=TRACE_FLAG_SIGNATURE FUNC=EnumerateStores
{
&name, ItemPWString -- 10
status, ItemLong -- 11
}
#typev fileverify_cpp2040 80 "%0Checking store: %10!s! %11!s!" //   LEVEL=MBLogLevelTrace FLAGS=TRACE_FLAG_REGCERT FUNC=EnumerateStores
{
Path.ObjectName, ItemPWString -- 10
&name, ItemPWString -- 11
}
#typev fileverify_cpp2015 78 "%0Error opening registry path %10!s! - 0x%11!x!" //   LEVEL=MBLogLevelWarning FLAGS=TRACE_FLAG_SIGNATURE FUNC=EnumerateStores
{
Path.ObjectName, ItemPWString -- 10
status, ItemLong -- 11
}
#typev fileverify_cpp2006 77 "%0Error getting memory at line %10!u!" //   LEVEL=MBLogLevelWarning FLAGS=TRACE_FLAG_SIGNATURE FUNC=EnumerateStores
{
__LINE__, ItemLong -- 10
}
#typev fileverify_cpp4637 138 "%0Allocate return Certificate %10!p!" //   LEVEL=MBLogLevelTrace FLAGS=TRACE_FLAG_CERTMEM FUNC=FetchCertificateInfo
{
pNew, ItemPtr -- 10
}
#typev fileverify_cpp4576 137 "%0Certificate exception %10!u!, %11!s!" //   LEVEL=MBLogLevelError FLAGS=TRACE_FLAG_SIGNATURE FUNC=FetchCertificateInfo
{
__LINE__, ItemLong -- 10
FileName == NULL ? L'??' : FileName, ItemWString -- 11
}
#typev fileverify_cpp4351 129 "%0Parameter Error - must pass trusted boolean- %10!x!" //   LEVEL=MBLogLevelTrace FLAGS=TRACE_FLAG_SIGNATURE FUNC=FetchCertificateInfo
{
status, ItemLong -- 10
}
#typev fileverify_cpp4358 130 "%0Parameter Error - %10!x!" //   LEVEL=MBLogLevelTrace FLAGS=TRACE_FLAG_SIGNATURE FUNC=FetchCertificateInfo
{
status, ItemLong -- 10
}
#typev fileverify_cpp4392 131 "%0Certificate did not start with sequence %10!u!, %11!s!" //   LEVEL=MBLogLevelTrace FLAGS=TRACE_FLAG_SIGNATURE FUNC=FetchCertificateInfo
{
__LINE__, ItemLong -- 10
FileName == NULL ? L'??' : FileName, ItemWString -- 11
}
#typev fileverify_cpp4562 135 "%0Certificate is not ASN 7. %10!u!, %11!s!" //   LEVEL=MBLogLevelTrace FLAGS=TRACE_FLAG_SIGNATURE FUNC=FetchCertificateInfo
{
__LINE__, ItemLong -- 10
parser.FileName == NULL ? L'??' : parser.FileName, ItemWString -- 11
}
#typev fileverify_cpp4456 132 "%0Certificate did not start with Optional. %10!u!, %11!s!" //   LEVEL=MBLogLevelTrace FLAGS=TRACE_FLAG_SIGNATURE FUNC=FetchCertificateInfo
{
__LINE__, ItemLong -- 10
FileName == NULL ? L'??' : FileName, ItemWString -- 11
}
#typev fileverify_cpp4555 134 "%0Certificate parsing error%10!u!, %11!s!" //   LEVEL=MBLogLevelTrace FLAGS=TRACE_FLAG_SIGNATURE FUNC=FetchCertificateInfo
{
__LINE__, ItemLong -- 10
parser.FileName == NULL ? L'??' : parser.FileName, ItemWString -- 11
}
#typev fileverify_cpp4548 133 "%0Certificate parsing error %10!u!, %11!s!" //   LEVEL=MBLogLevelTrace FLAGS=TRACE_FLAG_SIGNATURE FUNC=FetchCertificateInfo
{
__LINE__, ItemLong -- 10
parser.FileName == NULL ? L'??' : parser.FileName, ItemWString -- 11
}
#typev fileverify_cpp4323 128 "%0Allocate mbSigner Certificate %10!p!" //   LEVEL=MBLogLevelTrace FLAGS=TRACE_FLAG_CERTMEM FUNC=FetchCertificateInfo
{
mbSigner, ItemPtr -- 10
}
#typev fileverify_cpp4303 127 "%0Allocate Signer Certificate %10!p!" //   LEVEL=MBLogLevelTrace FLAGS=TRACE_FLAG_CERTMEM FUNC=FetchCertificateInfo
{
*SignerInfo, ItemPtr -- 10
}
#typev fileverify_cpp2361 93 "%0Checking %10!s!" //   LEVEL=MBLogLevelTrace FLAGS=TRACE_FLAG_REGCERT FUNC=FindCert
{
&name, ItemPWString -- 10
}
#typev fileverify_cpp2346 92 "%0Failed to open %10!s! - %11!x!" //   LEVEL=MBLogLevelWarning FLAGS=TRACE_FLAG_SIGNATURE FUNC=FindCert
{
CertPath, ItemWString -- 10
status, ItemLong -- 11
}
#typev fileverify_cpp2335 91 "%0Failed to allocate memory at line %10!u!" //   LEVEL=MBLogLevelWarning FLAGS=TRACE_FLAG_SIGNATURE FUNC=FindCert
{
__LINE__, ItemLong -- 10
}
#typev fileverify_cpp2296 90 "%0Exception in VerifyCertData - %10!x!" //   LEVEL=MBLogLevelError FLAGS=TRACE_FLAG_SIGNATURE FUNC=FindCertBy
{
status, ItemLong -- 10
}
#typev fileverify_cpp2259 89 "%0Found Cert by serial!!" //   LEVEL=MBLogLevelInfo FLAGS=TRACE_FLAG_REGCERT FUNC=FindCertBy
{
}
#typev fileverify_cpp2246 88 "%0Found Intermediate Cert!!" //   LEVEL=MBLogLevelInfo FLAGS=TRACE_FLAG_REGCERT FUNC=FindCertBy
{
}
#typev fileverify_cpp2194 84 "%0Parser error in registry certificate - %10!s!" //   LEVEL=MBLogLevelDebug FLAGS=TRACE_FLAG_SIGNATURE FUNC=FindCertBy
{
KeyName, ItemPWString -- 10
}
#typev fileverify_cpp2234 87 "%0Found Cert!!" //   LEVEL=MBLogLevelInfo FLAGS=TRACE_FLAG_REGCERT FUNC=FindCertBy
{
}
#typev fileverify_cpp2225 86 "%0Parser returns %10!x!" //   LEVEL=MBLogLevelWarning FLAGS=TRACE_FLAG_SIGNATURE FUNC=FindCertBy
{
status, ItemLong -- 10
}
#typev fileverify_cpp2214 85 "%0Allocate search Certificate %10!p!" //   LEVEL=MBLogLevelTrace FLAGS=TRACE_FLAG_CERTMEM FUNC=FindCertBy
{
pSignerCert, ItemPtr -- 10
}
#typev fileverify_cpp2167 83 "%0Failed to open registry key %10!s! - 0x%11!x!" //   LEVEL=MBLogLevelWarning FLAGS=TRACE_FLAG_SIGNATURE FUNC=FindCertBy
{
KeyName, ItemPWString -- 10
status, ItemLong -- 11
}
#typev fileverify_cpp2159 82 "%0Error getting memory at line %10!u!" //   LEVEL=MBLogLevelWarning FLAGS=TRACE_FLAG_SIGNATURE FUNC=FindCertBy
{
__LINE__, ItemLong -- 10
}
#typev fileverify_cpp1910 76 "%0FindCertInStore: Certificate %10!p!, Store %11!u! Attribute %12!u!" //   LEVEL=MBLogLevelTrace FLAGS=TRACE_FLAG_REGCERT FUNC=FindCertInStore
{
pCert, ItemPtr -- 10
Store, ItemLong -- 11
Attribute, ItemLong -- 12
}
#typev fileverify_cpp4196 126 "%0ConnectWise certificate is trusted!" //   LEVEL=MBLogLevelInfo FLAGS=TRACE_FLAG_CERTIFICATE FUNC=FindSigner
{
}
#typev fileverify_cpp4190 125 "%0Kaseya certificate is trusted!" //   LEVEL=MBLogLevelInfo FLAGS=TRACE_FLAG_CERTIFICATE FUNC=FindSigner
{
}
#typev fileverify_cpp1083 55 "%0Cert32 is beyond end of file" //   LEVEL=MBLogLevelTrace FLAGS=TRACE_FLAG_SIGNATURE FUNC=GetCertFromImageHeader32
{
}
#typev fileverify_cpp1071 54 "%0Header32 signature is incorrect" //   LEVEL=MBLogLevelTrace FLAGS=TRACE_FLAG_SIGNATURE FUNC=GetCertFromImageHeader32
{
}
#typev fileverify_cpp5413 156 "%0Certificate did not start with ASN_OPTIONAL %10!u!, %11!s!" //   LEVEL=MBLogLevelWarning FLAGS=TRACE_FLAG_SIGNATURE FUNC=ParseAsn
{
__LINE__, ItemLong -- 10
pParser->FileName == NULL ? L'??' : pParser->FileName, ItemWString -- 11
}
#typev fileverify_cpp5385 154 "%0Certificate bad tag size %10!u!, %11!s!" //   LEVEL=MBLogLevelTrace FLAGS=TRACE_FLAG_SIGNATURE FUNC=ParseAsn
{
__LINE__, ItemLong -- 10
pParser->FileName == NULL ? L'??' : pParser->FileName, ItemWString -- 11
}
#typev fileverify_cpp5344 153 "%0Certificate parsing error %10!u!, %11!s!" //   LEVEL=MBLogLevelTrace FLAGS=TRACE_FLAG_SIGNATURE FUNC=ParseAsn
{
__LINE__, ItemLong -- 10
pParser->FileName == NULL ? L'??' : pParser->FileName, ItemWString -- 11
}
#typev fileverify_cpp5334 152 "%0Certificate recursion error %10!u!, %11!s!" //   LEVEL=MBLogLevelTrace FLAGS=TRACE_FLAG_SIGNATURE FUNC=ParseAsn
{
__LINE__, ItemLong -- 10
pParser->FileName == NULL ? L'??' : pParser->FileName, ItemWString -- 11
}
#typev fileverify_cpp5294 151 "%0Certificate parsing error %10!u!, %11!s!" //   LEVEL=MBLogLevelTrace FLAGS=TRACE_FLAG_SIGNATURE FUNC=ParseAsn
{
__LINE__, ItemLong -- 10
pParser->FileName == NULL ? L'??' : pParser->FileName, ItemWString -- 11
}
#typev fileverify_cpp5206 149 "%0Certificate stack overflow! %10!u!, %11!s!" //   LEVEL=MBLogLevelError FLAGS=TRACE_FLAG_SIGNATURE FUNC=ParseAsn
{
__LINE__, ItemLong -- 10
pParser->FileName == NULL ? L'??' : pParser->FileName, ItemWString -- 11
}
#typev fileverify_cpp5199 148 "%0Not enough stack remaining - %10!u!" //   LEVEL=MBLogLevelInfo FLAGS=TRACE_FLAG_SIGNATURE FUNC=ParseAsn
{
(unsigned int) IoGetRemainingStackSize(), ItemLong -- 10
}
#typev fileverify_cpp6509 173 "%0Certificate certinfo parser error. %10!u!, %11!s!" //   LEVEL=MBLogLevelTrace FLAGS=TRACE_FLAG_SIGNATURE FUNC=ParseForCertificateInfo
{
__LINE__, ItemLong -- 10
PParser->FileName == NULL ? L'??' : PParser->FileName, ItemWString -- 11
}
#typev fileverify_cpp6490 172 "%0New Certificate %10!p!" //   LEVEL=MBLogLevelTrace FLAGS=TRACE_FLAG_CERTMEM FUNC=ParseForCertificateInfo
{
PParser->CurrentSignerCert->Next, ItemPtr -- 10
}
#typev fileverify_cpp6484 171 "%0Certificate certinfo memory error. %10!u!, %11!s!" //   LEVEL=MBLogLevelTrace FLAGS=TRACE_FLAG_SIGNATURE FUNC=ParseForCertificateInfo
{
__LINE__, ItemLong -- 10
PParser->FileName == NULL ? L'??' : PParser->FileName, ItemWString -- 11
}
#typev fileverify_cpp6618 174 "%0Certificate %10!p! Public Key Size = %11!u!" //   LEVEL=MBLogLevelTrace FLAGS=TRACE_FLAG_CERTIFICATE FUNC=ParseForCertificateInfo
{
PParser->CurrentSignerCert, ItemPtr -- 10
ObjSize - 1, ItemLong -- 11
}
#typev fileverify_cpp6803 183 "%0Certificate %10!p! Issuer Name: %11!s!" //   LEVEL=MBLogLevelTrace FLAGS=TRACE_FLAG_CERTIFICATE FUNC=ParseForCertificateInfo
{
PParser->CurrentSignerCert, ItemPtr -- 10
(char *)PParser->CurrentSignerCert->Issuer.Name, ItemString -- 11
}
#typev fileverify_cpp6797 182 "%0Certificate %10!p! Subject Name: %11!s!" //   LEVEL=MBLogLevelTrace FLAGS=TRACE_FLAG_CERTIFICATE FUNC=ParseForCertificateInfo
{
PParser->CurrentSignerCert, ItemPtr -- 10
(char *) PParser->CurrentSignerCert->Subject.Name, ItemString -- 11
}
#typev fileverify_cpp6755 181 "%0Certificate certinfo %10!p! ends. %11!u!, %12!s!" //   LEVEL=MBLogLevelTrace FLAGS=TRACE_FLAG_SIGNATURE FUNC=ParseForCertificateInfo
{
PParser->CurrentSignerCert, ItemPtr -- 10
__LINE__, ItemLong -- 11
PParser->FileName == NULL ? L'??' : PParser->FileName, ItemWString -- 12
}
#typev fileverify_cpp6743 180 "%0Certificate certinfo %10!p! hash error. %11!u!, %12!s!" //   LEVEL=MBLogLevelTrace FLAGS=TRACE_FLAG_SIGNATURE FUNC=ParseForCertificateInfo
{
PParser->CurrentSignerCert, ItemPtr -- 10
__LINE__, ItemLong -- 11
PParser->FileName == NULL ? L'??' : PParser->FileName, ItemWString -- 12
}
#typev fileverify_cpp6722 179 "%0Certificate %10!p! certinfo hash error. %11!u!, %12!s!" //   LEVEL=MBLogLevelTrace FLAGS=TRACE_FLAG_SIGNATURE FUNC=ParseForCertificateInfo
{
PParser->CurrentSignerCert, ItemPtr -- 10
__LINE__, ItemLong -- 11
PParser->FileName == NULL ? L'??' : PParser->FileName, ItemWString -- 12
}
#typev fileverify_cpp6703 178 "%0Certificate %10!p! certinfo hash error. %11!u!, %12!s!" //   LEVEL=MBLogLevelTrace FLAGS=TRACE_FLAG_SIGNATURE FUNC=ParseForCertificateInfo
{
PParser->CurrentSignerCert, ItemPtr -- 10
__LINE__, ItemLong -- 11
PParser->FileName == NULL ? L'??' : PParser->FileName, ItemWString -- 12
}
#typev fileverify_cpp6684 177 "%0Certificate %10!p! certinfo hash error. %11!u!, %12!s!" //   LEVEL=MBLogLevelTrace FLAGS=TRACE_FLAG_SIGNATURE FUNC=ParseForCertificateInfo
{
PParser->CurrentSignerCert, ItemPtr -- 10
__LINE__, ItemLong -- 11
PParser->FileName == NULL ? L'??' : PParser->FileName, ItemWString -- 12
}
#typev fileverify_cpp6665 176 "%0Certificate %10!p! certinfo hash error. %11!u!, %12!s!" //   LEVEL=MBLogLevelTrace FLAGS=TRACE_FLAG_SIGNATURE FUNC=ParseForCertificateInfo
{
PParser->CurrentSignerCert, ItemPtr -- 10
__LINE__, ItemLong -- 11
PParser->FileName == NULL ? L'??' : PParser->FileName, ItemWString -- 12
}
#typev fileverify_cpp6646 175 "%0Certificate %10!p! certinfo hash error. %11!u!, %12!s!" //   LEVEL=MBLogLevelTrace FLAGS=TRACE_FLAG_SIGNATURE FUNC=ParseForCertificateInfo
{
PParser->CurrentSignerCert, ItemPtr -- 10
__LINE__, ItemLong -- 11
PParser->FileName == NULL ? L'??' : PParser->FileName, ItemWString -- 12
}
#typev fileverify_cpp6948 187 "%0Certificate %10!p! UTC time 2" //   LEVEL=MBLogLevelTrace FLAGS=TRACE_FLAG_CERTIFICATE FUNC=ParseForCertificateInfo
{
PParser->CurrentSignerCert, ItemPtr -- 10
}
#typev fileverify_cpp6942 186 "%0Certificate %10!p! UTC time 1" //   LEVEL=MBLogLevelTrace FLAGS=TRACE_FLAG_CERTIFICATE FUNC=ParseForCertificateInfo
{
PParser->CurrentSignerCert, ItemPtr -- 10
}
#typev fileverify_cpp6931 185 "%0Certificate %10!p! Generalized time 2" //   LEVEL=MBLogLevelTrace FLAGS=TRACE_FLAG_CERTIFICATE FUNC=ParseForCertificateInfo
{
PParser->CurrentSignerCert, ItemPtr -- 10
}
#typev fileverify_cpp6925 184 "%0Certificate %10!p! Generalized time 1" //   LEVEL=MBLogLevelTrace FLAGS=TRACE_FLAG_CERTIFICATE FUNC=ParseForCertificateInfo
{
PParser->CurrentSignerCert, ItemPtr -- 10
}
#typev fileverify_cpp6366 168 "%0Certificate counter signature error. %10!u!, %11!s!" //   LEVEL=MBLogLevelTrace FLAGS=TRACE_FLAG_SIGNATURE FUNC=ParseForCounterSignature
{
__LINE__, ItemLong -- 10
PParser->FileName == NULL ? L'??' : PParser->FileName, ItemWString -- 11
}
#typev fileverify_cpp6356 167 "%0Certificate counter signature hash error. %10!u!, %11!s!" //   LEVEL=MBLogLevelTrace FLAGS=TRACE_FLAG_SIGNATURE FUNC=ParseForCounterSignature
{
__LINE__, ItemLong -- 10
PParser->FileName == NULL ? L'??' : PParser->FileName, ItemWString -- 11
}
#typev fileverify_cpp6386 169 "%0Certificate counter signature parsing error. %10!u!, %11!s!" //   LEVEL=MBLogLevelTrace FLAGS=TRACE_FLAG_SIGNATURE FUNC=ParseForCounterSignature
{
__LINE__, ItemLong -- 10
PParser->FileName == NULL ? L'??' : PParser->FileName, ItemWString -- 11
}
#typev fileverify_cpp5463 157 "%0Certificate Indirect data version error %10!u!, %11!s!" //   LEVEL=MBLogLevelTrace FLAGS=TRACE_FLAG_SIGNATURE FUNC=ParseForIndirectData
{
__LINE__, ItemLong -- 10
PParser->FileName = NULL ? L'??' : PParser->FileName, ItemWString -- 11
}
#typev fileverify_cpp5657 161 "%0Certificate Indirect hash mismatch. %10!u!, %11!s!" //   LEVEL=MBLogLevelTrace FLAGS=TRACE_FLAG_SIGNATURE FUNC=ParseForIndirectData
{
__LINE__, ItemLong -- 10
PParser->FileName== NULL ? L'??' : PParser->FileName, ItemWString -- 11
}
#typev fileverify_cpp5638 160 "%0Certificate Indirect parsing error %10!u!, %11!s!" //   LEVEL=MBLogLevelTrace FLAGS=TRACE_FLAG_SIGNATURE FUNC=ParseForIndirectData
{
__LINE__, ItemLong -- 10
PParser->FileName == NULL ? L'??' : PParser->FileName, ItemWString -- 11
}
#typev fileverify_cpp5628 159 "%0Certificate Indirect data hash error %10!u!, %11!s!" //   LEVEL=MBLogLevelTrace FLAGS=TRACE_FLAG_SIGNATURE FUNC=ParseForIndirectData
{
__LINE__, ItemLong -- 10
PParser->FileName == NULL ? L'??' : PParser->FileName, ItemWString -- 11
}
#typev fileverify_cpp5586 158 "%0Certificate Indirect data hash error %10!u!, %11!s!" //   LEVEL=MBLogLevelTrace FLAGS=TRACE_FLAG_SIGNATURE FUNC=ParseForIndirectData
{
__LINE__, ItemLong -- 10
PParser->FileName == NULL ?L'??' : PParser->FileName, ItemWString -- 11
}
#typev fileverify_cpp6115 163 "%0Certificate Indirect data did not verify %10!u!, %11!s!" //   LEVEL=MBLogLevelTrace FLAGS=TRACE_FLAG_SIGNATURE FUNC=ParseForSignerInfo
{
__LINE__, ItemLong -- 10
PParser->FileName == NULL ? L'??' : PParser->FileName, ItemWString -- 11
}
#typev fileverify_cpp6120 164 "%0Unexpected SIGN_SIZE_ value %10!u!, %11!s!" //   LEVEL=MBLogLevelTrace FLAGS=TRACE_FLAG_SIGNATURE FUNC=ParseForSignerInfo
{
__LINE__, ItemLong -- 10
PParser->FileName == NULL ? L'??' : PParser->FileName, ItemWString -- 11
}
#typev fileverify_cpp6072 162 "%0Certificate Indirect Hash mismatch. %10!u!, %11!s!" //   LEVEL=MBLogLevelTrace FLAGS=TRACE_FLAG_SIGNATURE FUNC=ParseForSignerInfo
{
__LINE__, ItemLong -- 10
PParser->FileName == NULL ? L'??' : PParser->FileName, ItemWString -- 11
}
#typev fileverify_cpp6170 166 "%0Certificate Indirect memory error. %10!u!, %11!s!" //   LEVEL=MBLogLevelTrace FLAGS=TRACE_FLAG_SIGNATURE FUNC=ParseForSignerInfo
{
__LINE__, ItemLong -- 10
PParser->FileName == NULL ? L'??' : PParser->FileName, ItemWString -- 11
}
#typev fileverify_cpp6157 165 "%0Certificate Indirect data hash error %10!u!, %11!s!" //   LEVEL=MBLogLevelTrace FLAGS=TRACE_FLAG_SIGNATURE FUNC=ParseForSignerInfo
{
__LINE__, ItemLong -- 10
PParser->FileName == NULL ? L'??' : PParser->FileName, ItemWString -- 11
}
#typev fileverify_cpp2550 101 "%0Found registry cert %10!p!" //   LEVEL=MBLogLevelInfo FLAGS=TRACE_FLAG_REGCERT FUNC=SearchForCert
{
pSignerCert, ItemPtr -- 10
}
#typev fileverify_cpp2517 100 "%0Parser returns %10!x!" //   LEVEL=MBLogLevelWarning FLAGS=TRACE_FLAG_SIGNATURE FUNC=SearchForCert
{
status, ItemLong -- 10
}
#typev fileverify_cpp2506 99 "%0Allocate search Certificate %10!p!" //   LEVEL=MBLogLevelTrace FLAGS=TRACE_FLAG_CERTMEM FUNC=SearchForCert
{
pSignerCert, ItemPtr -- 10
}
#typev fileverify_cpp2485 98 "%0Parser error in registry certificate %10!s!" //   LEVEL=MBLogLevelWarning FLAGS=TRACE_FLAG_SIGNATURE FUNC=SearchForCert
{
KeyName, ItemPWString -- 10
}
#typev fileverify_cpp2460 97 "%0Failed to allocate memory at line %10!u!" //   LEVEL=MBLogLevelWarning FLAGS=TRACE_FLAG_SIGNATURE FUNC=SearchForCert
{
__LINE__, ItemLong -- 10
}
#typev fileverify_cpp2446 96 "%0Failed to open %10!s! - %11!x!" //   LEVEL=MBLogLevelWarning FLAGS=TRACE_FLAG_SIGNATURE FUNC=SearchForCert
{
KeyName, ItemPWString -- 10
status, ItemLong -- 11
}
#typev fileverify_cpp2438 95 "%0Error allocating memory" //   LEVEL=MBLogLevelWarning FLAGS=TRACE_FLAG_SIGNATURE FUNC=SearchForCert
{
}
#typev fileverify_cpp2862 103 "%0Issuer:  %10!s! Subject: %11!s! Next = %12!p! Flags = %13!x! %14!s!" //   LEVEL=MBLogLevelTrace FLAGS=TRACE_FLAG_CERTIFICATE FUNC=VerifyAuthority
{
(char *)pSign->Issuer.Name, ItemString -- 10
(char *)pSign->Subject.Name, ItemString -- 11
pRet, ItemPtr -- 12
pSign->Flags, ItemLong -- 13
pSign->Signer ? 'Signer' : '', ItemString -- 14
}
#typev fileverify_cpp3659 124 "%0Allocate Return Certificate %10!p!" //   LEVEL=MBLogLevelTrace FLAGS=TRACE_FLAG_CERTMEM FUNC=VerifyCertData
{
pNew, ItemPtr -- 10
}
#typev fileverify_cpp3598 123 "%0Certificate exception %10!u!, %11!s!" //   LEVEL=MBLogLevelError FLAGS=TRACE_FLAG_SIGNATURE FUNC=VerifyCertData
{
__LINE__, ItemLong -- 10
FileName == NULL ? L'??' : FileName, ItemWString -- 11
}
#typev fileverify_cpp3034 107 "%0Parameter Error - must pass trusted boolean- %10!x!" //   LEVEL=MBLogLevelTrace FLAGS=TRACE_FLAG_SIGNATURE FUNC=VerifyCertData
{
status, ItemLong -- 10
}
#typev fileverify_cpp3041 108 "%0Parameter Error - %10!x!" //   LEVEL=MBLogLevelTrace FLAGS=TRACE_FLAG_SIGNATURE FUNC=VerifyCertData
{
status, ItemLong -- 10
}
#typev fileverify_cpp3076 109 "%0Certificate did not start with sequence (%10!u! %11!s!)" //   LEVEL=MBLogLevelTrace FLAGS=TRACE_FLAG_SIGNATURE FUNC=VerifyCertData
{
__LINE__, ItemLong -- 10
FileName == NULL ? L'???' : FileName, ItemWString -- 11
}
#typev fileverify_cpp3584 121 "%0Certificate is not asn7. %10!u!, %11!s!" //   LEVEL=MBLogLevelTrace FLAGS=TRACE_FLAG_SIGNATURE FUNC=VerifyCertData
{
__LINE__, ItemLong -- 10
parser.FileName == NULL ? L'??' : parser.FileName, ItemWString -- 11
}
#typev fileverify_cpp3139 110 "%0Certificate did not start with ASN_OPTIONAL %10!u!, %11!s!" //   LEVEL=MBLogLevelTrace FLAGS=TRACE_FLAG_SIGNATURE FUNC=VerifyCertData
{
__LINE__, ItemLong -- 10
FileName == NULL ? L'??' : FileName, ItemWString -- 11
}
#typev fileverify_cpp3577 120 "%0Certificate parsing error %10!u!, %11!s!" //   LEVEL=MBLogLevelTrace FLAGS=TRACE_FLAG_SIGNATURE FUNC=VerifyCertData
{
__LINE__, ItemLong -- 10
parser.FileName == NULL ? L'??' : parser.FileName, ItemWString -- 11
}
#typev fileverify_cpp3570 119 "%0Certificate indirect data error %10!u!, %11!s!" //   LEVEL=MBLogLevelTrace FLAGS=TRACE_FLAG_SIGNATURE FUNC=VerifyCertData
{
__LINE__, ItemLong -- 10
parser.FileName == NULL ? L'??' : parser.FileName, ItemWString -- 11
}
#typev fileverify_cpp3563 118 "%0Certificate parsing error. %10!u!, %11!s!" //   LEVEL=MBLogLevelTrace FLAGS=TRACE_FLAG_SIGNATURE FUNC=VerifyCertData
{
__LINE__, ItemLong -- 10
parser.FileName == NULL ? L'??' : parser.FileName, ItemWString -- 11
}
#typev fileverify_cpp3553 117 "%0Test sign cert is not trusted %10!u!" //   LEVEL=MBLogLevelTrace FLAGS=TRACE_FLAG_SIGNATURE FUNC=VerifyCertData
{
nCerts, ItemLong -- 10
}
#typev fileverify_cpp3545 116 "%0Test sign check Cert %10!u! - %11!x! %12!s!" //   LEVEL=MBLogLevelTrace FLAGS=TRACE_FLAG_SIGNATURE FUNC=VerifyCertData
{
nCerts, ItemLong -- 10
pCert->Flags, ItemLong -- 11
(char *) pCert->Subject.Name, ItemString -- 12
}
#typev fileverify_cpp3497 114 "%0Certificate is expired or not issued yet %10!u!, %11!s!" //   LEVEL=MBLogLevelTrace FLAGS=TRACE_FLAG_SIGNATURE FUNC=VerifyCertData
{
__LINE__, ItemLong -- 10
parser.FileName == NULL ? L'??' : parser.FileName, ItemWString -- 11
}
#typev fileverify_cpp3513 115 "%0Certificate expired lifetime. %10!u!, %11!s!" //   LEVEL=MBLogLevelTrace FLAGS=TRACE_FLAG_SIGNATURE FUNC=VerifyCertData
{
__LINE__, ItemLong -- 10
parser.FileName == NULL ? L'' : parser.FileName, ItemWString -- 11
}
#typev fileverify_cpp3483 113 "%0Certificate was not signed within valid certificate period. %10!u!, %11!s!" //   LEVEL=MBLogLevelTrace FLAGS=TRACE_FLAG_SIGNATURE FUNC=VerifyCertData
{
__LINE__, ItemLong -- 10
parser.FileName == NULL ? L'??' : parser.FileName, ItemWString -- 11
}
#typev fileverify_cpp3343 112 "%0Certificate was on the untrusted list! (%10!u! %11!s!" //   LEVEL=MBLogLevelTrace FLAGS=TRACE_FLAG_SIGNATURE FUNC=VerifyCertData
{
__LINE__, ItemLong -- 10
parser.FileName == NULL ? L'' : parser.FileName, ItemWString -- 11
}
#typev fileverify_cpp3314 111 "%0Certificate Has other EKU's with code signer EKU %10!u! %11!s!" //   LEVEL=MBLogLevelTrace FLAGS=TRACE_FLAG_SIGNATURE FUNC=VerifyCertData
{
__LINE__, ItemLong -- 10
parser.FileName == NULL ? L'' : parser.FileName, ItemWString -- 11
}
#typev fileverify_cpp3006 106 "%0Allocate mbSigner Certificate %10!p!" //   LEVEL=MBLogLevelTrace FLAGS=TRACE_FLAG_CERTMEM FUNC=VerifyCertData
{
mbSigner, ItemPtr -- 10
}
#typev fileverify_cpp2987 105 "%0Allocate Signer Certificate %10!p!" //   LEVEL=MBLogLevelTrace FLAGS=TRACE_FLAG_CERTMEM FUNC=VerifyCertData
{
*SignerInfo, ItemPtr -- 10
}
#typev fileverify_cpp2393 94 "%0Checking trust for Certificate %10!p!" //   LEVEL=MBLogLevelInfo FLAGS=TRACE_FLAG_SIGNATURE FUNC=VerifyCertTrusted
{
pCert, ItemPtr -- 10
}
#typev fileverify_cpp4789 139 "%0Free Certificate %10!p!" //   LEVEL=MBLogLevelTrace FLAGS=TRACE_FLAG_CERTMEM FUNC=FreeCertificates
{
pCert, ItemPtr -- 10
}
#typev fileverify_cpp933 49 "%0 Exception in VerifyBuffer - %10!x! - %11!s!" //   LEVEL=MBLogLevelError FLAGS=TRACE_FLAG_SIGNATURE FUNC=VerifyBuffer
{
status, ItemLong -- 10
Filename != NULL ? Filename : L'???', ItemWString -- 11
}
#typev fileverify_cpp887 47 "%0The Certificate is not there! - %10!s!" //   LEVEL=MBLogLevelTrace FLAGS=TRACE_FLAG_SIGNATURE FUNC=VerifyBuffer
{
Filename != NULL ? Filename : L'???', ItemWString -- 10
}
#typev fileverify_cpp872 46 "%0No NT Header" //   LEVEL=MBLogLevelWarning FLAGS=TRACE_FLAG_SIGNATURE FUNC=VerifyBuffer
{
}
#typev fileverify_cpp863 45 "%0Not a 64 bit header" //   LEVEL=MBLogLevelTrace FLAGS=TRACE_FLAG_SIGNATURE FUNC=VerifyBuffer
{
}
#typev fileverify_cpp855 44 "%0Not A Valid Dos Stub - %10!s!" //   LEVEL=MBLogLevelTrace FLAGS=TRACE_FLAG_SIGNATURE FUNC=VerifyBuffer
{
Filename != NULL ? Filename : L'???', ItemWString -- 10
}
#typev fileverify_cpp644 43 "%0Verified MBAM signature on %10!s!" //   LEVEL=MBLogLevelDebug FLAGS=TRACE_FLAG_SIGNATURE FUNC=VerifyFile
{
fileName == NULL ? L'??' : fileName, ItemWString -- 10
}
#typev fileverify_cpp638 42 "%0FO %10!p! failed verification - %11!x!" //   LEVEL=MBLogLevelWarning FLAGS=TRACE_FLAG_SIGNATURE FUNC=VerifyFile
{
pFileObj, ItemPtr -- 10
status, ItemLong -- 11
}
#typev fileverify_cpp634 41 "%0FO %10!p! failed verification - %11!x!" //   LEVEL=MBLogLevelWarning FLAGS=TRACE_FLAG_SIGNATURE FUNC=VerifyFile
{
pFileObj, ItemPtr -- 10
status, ItemLong -- 11
}
#typev fileverify_cpp625 40 "%0%10!s! failed verification - %11!x!" //   LEVEL=MBLogLevelWarning FLAGS=TRACE_FLAG_SIGNATURE FUNC=VerifyFile
{
fName, ItemPWString -- 10
status, ItemLong -- 11
}
#typev fileverify_cpp621 39 "%0%10!s! failed verification - %11!x!" //   LEVEL=MBLogLevelWarning FLAGS=TRACE_FLAG_SIGNATURE FUNC=VerifyFile
{
fName, ItemPWString -- 10
status, ItemLong -- 11
}
#typev fileverify_cpp579 34 "%0****  Failed to map %10!x! %11!I64u! bytes of memory to read the file FO %12!p!" //   LEVEL=MBLogLevelError FLAGS=TRACE_FLAG_SIGNATURE FUNC=VerifyFile
{
status, ItemLong -- 10
fInfo.EndOfFile.LowPart, ItemULongLong -- 11
pFileObj, ItemPtr -- 12
}
#typev fileverify_cpp575 33 "%0****  Failed to map %10!x! %11!I64u! bytes of memory to read %12!s!" //   LEVEL=MBLogLevelError FLAGS=TRACE_FLAG_SIGNATURE FUNC=VerifyFile
{
status, ItemLong -- 10
fInfo.EndOfFile.LowPart, ItemULongLong -- 11
fName, ItemPWString -- 12
}
#typev fileverify_cpp545 32 "%0****  File is too large!! - %10!I64u!  FO %11!p!" //   LEVEL=MBLogLevelError FLAGS=TRACE_FLAG_SIGNATURE FUNC=VerifyFile
{
fInfo.EndOfFile.QuadPart, ItemULongLong -- 10
pFileObj, ItemPtr -- 11
}
#typev fileverify_cpp541 31 "%0****  File is too large!! - %10!I64u! %11!s!" //   LEVEL=MBLogLevelError FLAGS=TRACE_FLAG_SIGNATURE FUNC=VerifyFile
{
fInfo.EndOfFile.QuadPart, ItemULongLong -- 10
fName, ItemPWString -- 11
}
#typev fileverify_cpp532 30 "%0**** Error 0x%10!x! returned by ZwQueryInformationFile FO = %11!p!" //   LEVEL=MBLogLevelWarning FLAGS=TRACE_FLAG_SIGNATURE FUNC=VerifyFile
{
status, ItemLong -- 10
pFileObj, ItemPtr -- 11
}
#typev fileverify_cpp528 29 "%0**** Error 0x%10!x! returned by ZwQueryInformationFile %11!s!" //   LEVEL=MBLogLevelWarning FLAGS=TRACE_FLAG_SIGNATURE FUNC=VerifyFile
{
status, ItemLong -- 10
fName, ItemPWString -- 11
}
#typev fileverify_cpp518 28 "%0**** Error 0x%10!x! returned by ZwCreateFile FileObj %11!p!" //   LEVEL=MBLogLevelWarning FLAGS=TRACE_FLAG_SIGNATURE FUNC=VerifyFile
{
status, ItemLong -- 10
pFileObj, ItemPtr -- 11
}
#typev fileverify_cpp514 27 "%0**** Error 0x%10!x! returned by ZwCreateFile %11!s!" //   LEVEL=MBLogLevelWarning FLAGS=TRACE_FLAG_SIGNATURE FUNC=VerifyFile
{
status, ItemLong -- 10
fName, ItemPWString -- 11
}
#typev fileverify_cpp502 26 "%0VerifyFile attempting to open file object" //   LEVEL=MBLogLevelInfo FLAGS=TRACE_FLAG_SIGNATURE FUNC=VerifyFile
{
}
#typev fileverify_cpp495 25 "%0VerifyFile attempting to open %10!s!" //   LEVEL=MBLogLevelDebug FLAGS=TRACE_FLAG_SIGNATURE FUNC=VerifyFile
{
fName, ItemPWString -- 10
}
// PDB:  e:\jenkins\workspace\N_Swissarmy_Kernel\src\..\bin\x64\Win7_Release\mbamswissarmy.pdb
// PDB:  Last Updated :2024-06-04:16:40:19:196 (UTC) [tracepdb]
226f22ed-d971-3079-721f-f5d0f00980db mbcommonkernel // SRC=SigCert.cpp MJ= MN=
#typev sigcert_cpp47 10 "%0%10!s! %11!s! %12!p!:  %13!s!" //   LEVEL=MBLogLevelTrace FLAGS=TRACE_FLAG_CERTIFICATE FUNC=DumpStrings
{
Type, ItemWString -- 10
Header, ItemString -- 11
PCERT, ItemPtr -- 12
(char *)ptr, ItemString -- 13
}
// PDB:  e:\jenkins\workspace\N_Swissarmy_Kernel\src\..\bin\x64\Win7_Release\mbamswissarmy.pdb
// PDB:  Last Updated :2024-06-04:16:40:19:196 (UTC) [tracepdb]
b3fda36b-1cdd-3cd4-101e-0a32853aaf98 mbcommonkernel // SRC=CryptoKernel.cpp MJ= MN=
#typev cryptokernel_cpp814 43 "%0**** Error 0x%10!x! returned by BCryptFinishHash" //   LEVEL=MBLogLevelWarning FLAGS=TRACE_FLAG_SIGNATURE FUNC=GetFileHash32
{
status, ItemLong -- 10
}
#typev cryptokernel_cpp796 41 "%0Error calculating rest of data!!" //   LEVEL=MBLogLevelWarning FLAGS=TRACE_FLAG_SIGNATURE FUNC=GetFileHash32
{
}
#typev cryptokernel_cpp767 40 "%0**** Error 0x%10!x! returned by BCryptHashData" //   LEVEL=MBLogLevelWarning FLAGS=TRACE_FLAG_SIGNATURE FUNC=GetFileHash32
{
status, ItemLong -- 10
}
#typev cryptokernel_cpp803 42 "%0**** Error 0x%10!x! returned by BCryptHashData" //   LEVEL=MBLogLevelWarning FLAGS=TRACE_FLAG_SIGNATURE FUNC=GetFileHash32
{
status, ItemLong -- 10
}
#typev cryptokernel_cpp705 39 "%0**** Error getting memory" //   LEVEL=MBLogLevelWarning FLAGS=TRACE_FLAG_SIGNATURE FUNC=GetFileHash32
{
}
#typev cryptokernel_cpp683 38 "%0**** Error 0x%10!x! returned by BCryptHashData" //   LEVEL=MBLogLevelWarning FLAGS=TRACE_FLAG_SIGNATURE FUNC=GetFileHash32
{
status, ItemLong -- 10
}
#typev cryptokernel_cpp657 37 "%0**** Error 0x%10!x! returned by BCryptHashData" //   LEVEL=MBLogLevelWarning FLAGS=TRACE_FLAG_SIGNATURE FUNC=GetFileHash32
{
status, ItemLong -- 10
}
#typev cryptokernel_cpp641 36 "%0**** Error 0x%10!x! returned by BCryptHashData" //   LEVEL=MBLogLevelWarning FLAGS=TRACE_FLAG_SIGNATURE FUNC=GetFileHash32
{
status, ItemLong -- 10
}
#typev cryptokernel_cpp623 35 "%0Not A Valid PE Executable" //   LEVEL=MBLogLevelWarning FLAGS=TRACE_FLAG_SIGNATURE FUNC=GetFileHash32
{
}
#typev cryptokernel_cpp616 34 "%0Not A Valid Dos Stub" //   LEVEL=MBLogLevelWarning FLAGS=TRACE_FLAG_SIGNATURE FUNC=GetFileHash32
{
}
#typev cryptokernel_cpp607 33 "%0**** Error 0x%10!x! returned by BCryptCreateHash" //   LEVEL=MBLogLevelWarning FLAGS=TRACE_FLAG_SIGNATURE FUNC=GetFileHash32
{
status, ItemLong -- 10
}
#typev cryptokernel_cpp598 32 "%0**** Invalid hash buffer: %10!p!" //   LEVEL=MBLogLevelWarning FLAGS=TRACE_FLAG_SIGNATURE FUNC=GetFileHash32
{
pbHash, ItemPtr -- 10
}
#typev cryptokernel_cpp591 31 "%0**** Invalid hash size: %10!u!, need %11!u!" //   LEVEL=MBLogLevelWarning FLAGS=TRACE_FLAG_SIGNATURE FUNC=GetFileHash32
{
*cbHash, ItemLong -- 10
rcbHash, ItemLong -- 11
}
#typev cryptokernel_cpp583 30 "%0**** Error 0x%10!x! returned by BCryptGetProperty getting hash length" //   LEVEL=MBLogLevelWarning FLAGS=TRACE_FLAG_SIGNATURE FUNC=GetFileHash32
{
status, ItemLong -- 10
}
#typev cryptokernel_cpp576 29 "%0**** memory allocation failed" //   LEVEL=MBLogLevelWarning FLAGS=TRACE_FLAG_SIGNATURE FUNC=GetFileHash32
{
}
#typev cryptokernel_cpp565 28 "%0**** Error 0x%10!x! returned by BCryptGetProperty getting object length" //   LEVEL=MBLogLevelWarning FLAGS=TRACE_FLAG_SIGNATURE FUNC=GetFileHash32
{
status, ItemLong -- 10
}
#typev cryptokernel_cpp558 27 "%0**** Error 0x%10!x! returned by BCryptOpenAlgorithmProvider - Hash" //   LEVEL=MBLogLevelWarning FLAGS=TRACE_FLAG_SIGNATURE FUNC=GetFileHash32
{
status, ItemLong -- 10
}
#typev cryptokernel_cpp1163 60 "%0**** Error 0x%10!x! returned by BCryptFinishHash" //   LEVEL=MBLogLevelWarning FLAGS=TRACE_FLAG_SIGNATURE FUNC=GetFileHash64
{
status, ItemLong -- 10
}
#typev cryptokernel_cpp1145 58 "%0Error calculating rest of data!!" //   LEVEL=MBLogLevelWarning FLAGS=TRACE_FLAG_SIGNATURE FUNC=GetFileHash64
{
}
#typev cryptokernel_cpp1117 57 "%0**** Error 0x%10!x! returned by BCryptHashData" //   LEVEL=MBLogLevelWarning FLAGS=TRACE_FLAG_SIGNATURE FUNC=GetFileHash64
{
status, ItemLong -- 10
}
#typev cryptokernel_cpp1152 59 "%0**** Error 0x%10!x! returned by BCryptHashData" //   LEVEL=MBLogLevelWarning FLAGS=TRACE_FLAG_SIGNATURE FUNC=GetFileHash64
{
status, ItemLong -- 10
}
#typev cryptokernel_cpp1055 56 "%0**** Error getting memory" //   LEVEL=MBLogLevelWarning FLAGS=TRACE_FLAG_SIGNATURE FUNC=GetFileHash64
{
}
#typev cryptokernel_cpp1033 55 "%0**** Error 0x%10!x! returned by BCryptHashData" //   LEVEL=MBLogLevelWarning FLAGS=TRACE_FLAG_SIGNATURE FUNC=GetFileHash64
{
status, ItemLong -- 10
}
#typev cryptokernel_cpp1006 54 "%0**** Error 0x%10!x! returned by BCryptHashData" //   LEVEL=MBLogLevelWarning FLAGS=TRACE_FLAG_SIGNATURE FUNC=GetFileHash64
{
status, ItemLong -- 10
}
#typev cryptokernel_cpp990 53 "%0**** Error 0x%10!x! returned by BCryptHashData" //   LEVEL=MBLogLevelWarning FLAGS=TRACE_FLAG_SIGNATURE FUNC=GetFileHash64
{
status, ItemLong -- 10
}
#typev cryptokernel_cpp972 52 "%0Not A Valid PE Executable" //   LEVEL=MBLogLevelWarning FLAGS=TRACE_FLAG_SIGNATURE FUNC=GetFileHash64
{
}
#typev cryptokernel_cpp965 51 "%0Not A Valid Dos Stub" //   LEVEL=MBLogLevelWarning FLAGS=TRACE_FLAG_SIGNATURE FUNC=GetFileHash64
{
}
#typev cryptokernel_cpp956 50 "%0**** Error 0x%10!x! returned by BCryptCreateHash" //   LEVEL=MBLogLevelWarning FLAGS=TRACE_FLAG_SIGNATURE FUNC=GetFileHash64
{
status, ItemLong -- 10
}
#typev cryptokernel_cpp947 49 "%0**** Invalid hash buffer: %10!p!" //   LEVEL=MBLogLevelWarning FLAGS=TRACE_FLAG_SIGNATURE FUNC=GetFileHash64
{
pbHash, ItemPtr -- 10
}
#typev cryptokernel_cpp940 48 "%0**** Invalid hash size: %10!u!, need %11!u!" //   LEVEL=MBLogLevelWarning FLAGS=TRACE_FLAG_SIGNATURE FUNC=GetFileHash64
{
*cbHash, ItemLong -- 10
rcbHash, ItemLong -- 11
}
#typev cryptokernel_cpp932 47 "%0**** Error 0x%10!x! returned by BCryptGetProperty getting hash length" //   LEVEL=MBLogLevelWarning FLAGS=TRACE_FLAG_SIGNATURE FUNC=GetFileHash64
{
status, ItemLong -- 10
}
#typev cryptokernel_cpp925 46 "%0**** memory allocation failed" //   LEVEL=MBLogLevelWarning FLAGS=TRACE_FLAG_SIGNATURE FUNC=GetFileHash64
{
}
#typev cryptokernel_cpp914 45 "%0**** Error 0x%10!x! returned by BCryptGetProperty getting object length" //   LEVEL=MBLogLevelWarning FLAGS=TRACE_FLAG_SIGNATURE FUNC=GetFileHash64
{
status, ItemLong -- 10
}
#typev cryptokernel_cpp907 44 "%0**** Error 0x%10!x! returned by BCryptOpenAlgorithmProvider - Hash" //   LEVEL=MBLogLevelWarning FLAGS=TRACE_FLAG_SIGNATURE FUNC=GetFileHash64
{
status, ItemLong -- 10
}
#typev cryptokernel_cpp234 20 "%0Failed to import the public key - 0x%10!x!" //   LEVEL=MBLogLevelDebug FLAGS=TRACE_FLAG_SIGNATURE FUNC=ImportRsaPublicKeyX
{
hr, ItemLong -- 10
}
#typev cryptokernel_cpp230 19 "%0Failed to import the public key - 0x%10!x!" //   LEVEL=MBLogLevelWarning FLAGS=TRACE_FLAG_SIGNATURE FUNC=ImportRsaPublicKeyX
{
hr, ItemLong -- 10
}
#typev cryptokernel_cpp167 17 "%0**** Error 0x%10!x! returned by BCryptHashData" //   LEVEL=MBLogLevelWarning FLAGS=TRACE_FLAG_SIGNATURE FUNC=MbHashMemory
{
status, ItemLong -- 10
}
#typev cryptokernel_cpp174 18 "%0**** Error 0x%10!x! returned by BCryptFinishHash" //   LEVEL=MBLogLevelWarning FLAGS=TRACE_FLAG_SIGNATURE FUNC=MbHashMemory
{
status, ItemLong -- 10
}
#typev cryptokernel_cpp159 16 "%0**** Error 0x%10!x! returned by BCryptCreateHash" //   LEVEL=MBLogLevelWarning FLAGS=TRACE_FLAG_SIGNATURE FUNC=MbHashMemory
{
status, ItemLong -- 10
}
#typev cryptokernel_cpp150 15 "%0**** Invalid hash buffer: %10!p!" //   LEVEL=MBLogLevelWarning FLAGS=TRACE_FLAG_SIGNATURE FUNC=MbHashMemory
{
Hash, ItemPtr -- 10
}
#typev cryptokernel_cpp143 14 "%0**** Invalid hash size: %10!u!, need %11!u!" //   LEVEL=MBLogLevelWarning FLAGS=TRACE_FLAG_SIGNATURE FUNC=MbHashMemory
{
*HashSize, ItemLong -- 10
rcbHash, ItemLong -- 11
}
#typev cryptokernel_cpp135 13 "%0**** Error 0x%10!x! returned by BCryptGetProperty getting hash length" //   LEVEL=MBLogLevelWarning FLAGS=TRACE_FLAG_SIGNATURE FUNC=MbHashMemory
{
status, ItemLong -- 10
}
#typev cryptokernel_cpp128 12 "%0**** memory allocation failed" //   LEVEL=MBLogLevelWarning FLAGS=TRACE_FLAG_SIGNATURE FUNC=MbHashMemory
{
}
#typev cryptokernel_cpp118 11 "%0**** Error 0x%10!x! returned by BCryptGetProperty getting object length" //   LEVEL=MBLogLevelWarning FLAGS=TRACE_FLAG_SIGNATURE FUNC=MbHashMemory
{
status, ItemLong -- 10
}
#typev cryptokernel_cpp111 10 "%0**** Error 0x%10!x! returned by BCryptOpenAlgorithmProvider - Hash" //   LEVEL=MBLogLevelWarning FLAGS=TRACE_FLAG_SIGNATURE FUNC=MbHashMemory
{
status, ItemLong -- 10
}
#typev cryptokernel_cpp444 26 "%0**** Failed to import public key - 0x%10!x!" //   LEVEL=MBLogLevelWarning FLAGS=TRACE_FLAG_SIGNATURE FUNC=VerifyData
{
status, ItemLong -- 10
}
#typev cryptokernel_cpp428 25 "%0Verify signature returns 0x%10!x!" //   LEVEL=MBLogLevelDebug FLAGS=TRACE_FLAG_SIGNATURE FUNC=VerifyData
{
status, ItemLong -- 10
}
#typev cryptokernel_cpp396 24 "%0**** Failed to import public key - 0x%10!x!" //   LEVEL=MBLogLevelWarning FLAGS=TRACE_FLAG_SIGNATURE FUNC=VerifyData
{
status, ItemLong -- 10
}
#typev cryptokernel_cpp385 23 "%0**** Error 0x%10!x! returned by BCryptOpenAlgorithmProvider" //   LEVEL=MBLogLevelWarning FLAGS=TRACE_FLAG_SIGNATURE FUNC=VerifyData
{
status, ItemLong -- 10
}
#typev cryptokernel_cpp294 22 "%0****> Failed to import public key - 0x%10!x!" //   LEVEL=MBLogLevelWarning FLAGS=TRACE_FLAG_SIGNATURE FUNC=VerifyTrusted
{
status, ItemLong -- 10
}
#typev cryptokernel_cpp280 21 "%0**** Error 0x%10!x! returned by BCryptOpenAlgorithmProvider" //   LEVEL=MBLogLevelWarning FLAGS=TRACE_FLAG_SIGNATURE FUNC=VerifyTrusted
{
status, ItemLong -- 10
}
Anon7 - 2022
AnonSec Team