Extended logging of the Windows boot process

At one of our customers the workstations hang at startup when one of our services was installed. And as the UserEnvDebugLevel and ntbtlog.txt stuff together with enabled tracing in our own service did not give any clues: I was clueless about what was going on.

I was already preparing myself for the coming "trail and error" torture, when it hit me: NT Kernel Tracing, this fantastic driver development tool, why not use it to track what is going on during boot.

And it turned out to be fantastically helpful and easy to use. I got all the information I needed process start times, threads, file I/O, registry…

Check out Boot-Time Global Logger Session in the Windows Driver Kit it saved me lots of work.

Also check out WMI Event Tracing or Event Tracing for Windows (Vista) which is the framework.

Windows ReadPrinter BIDI communication is possible!

Just read in a post from Jeffrey Tan that BIDI communication with the printer is actually possible.

I always thought that this was impossible, as Windows restrics the read access to any ports to language monitors only.

But now it turns out, you can work around this, by creating a dummy job, and then opening a handle to that job with OpenPrinter. You ofcourse still need the port monitor to support bidi.

#define BUFSIZE 256
BOOL TestReadPrinterWithJob(LPSTR szPrinterName)
{
HANDLE hPrinter = NULL;
HANDLE hPrinterJob = NULL;
DWORD dwBytesRead;
LPVOID lpBytes = NULL;
DOC_INFO_1 dc;
DWORD jobid;
TCHAR jobStr[100];
// Open a handle to the printer.
if (!OpenPrinter(szPrinterName, &hPrinter, NULL))
{
PrintError(GetLastError(), "OpenPrinter");
return FALSE;
}
// We can't read from a printer handle, but we can read from
// a printer job handle, So the trick is to create a Job using
// StartDocPrinter, then open a handle to the printer job...
ZeroMemory(&dc, sizeof(DOC_INFO_1));
dc.pDocName="Dummy job";
jobid = StartDocPrinter(hPrinter,1,(LPSTR)&dc); // start a Doc 
if (jobid == 0)
{
ClosePrinter(hPrinter);
PrintError(GetLastError(), "OpenPrinter");
return FALSE;
}
// Open handle to the printer job...
wsprintf(jobStr, "%s,Job %i", szPrinterName, jobid);
if (!OpenPrinter(jobStr, &hPrinterJob, NULL))
{
ClosePrinter(hPrinter);
PrintError(GetLastError(), "OpenPrinter Job");
return FALSE;
}
 

Vista does cache printer handles from OpenPrinter

According to a interesting post by Carey Gregory, Windows Vista is caching printer handles that are opened with OpenPrinter even when they are BIDI handles.

So if you use OpenPrinter to do stuff like accessing the job or the Xvc interface, you gonna get problems. To fix this, you need to use OpenPrinter2 (on Vista) and specify PRINTER_OPTION_NO_CACHE.

Ahrg!

My first post

I will try this blog’in, and see how it goes. The net includes lots of other blogs I found very helpfull, so maybe I can share some knowledge too.

This is my first blog, so I don’t know how this will be something i enjoy, or not. But you never know if you don’t try.