I was already preparing myself for the coming "trail and error" torture, when it hit me: NT Kernel Tracing, this fantastic driver development tool, why not use it to track what is going on during boot.

And it turned out to be fantastically helpful and easy to use. I got all the information I needed process start times, threads, file I/O, registry…

Check out Boot-Time Global Logger Session in the Windows Driver Kit it saved me lots of work.

Also check out WMI Event Tracing or Event Tracing for Windows (Vista) which is the framework.

I always thought that this was impossible, as Windows restrics the read access to any ports to language monitors only.

But now it turns out, you can work around this, by creating a dummy job, and then opening a handle to that job with OpenPrinter. You ofcourse still need the port monitor to support bidi.

#define BUFSIZE 256
BOOL TestReadPrinterWithJob(LPSTR szPrinterName)
{
HANDLE hPrinter = NULL;
HANDLE hPrinterJob = NULL;
DWORD dwBytesRead;
LPVOID lpBytes = NULL;
DOC_INFO_1 dc;
DWORD jobid;
TCHAR jobStr[100];
// Open a handle to the printer.
if (!OpenPrinter(szPrinterName, &hPrinter, NULL))
{
PrintError(GetLastError(), "OpenPrinter");
return FALSE;
}
// We can't read from a printer handle, but we can read from
// a printer job handle, So the trick is to create a Job using
// StartDocPrinter, then open a handle to the printer job...
ZeroMemory(&dc, sizeof(DOC_INFO_1));
dc.pDocName="Dummy job";
jobid = StartDocPrinter(hPrinter,1,(LPSTR)&dc); // start a Doc 
if (jobid == 0)
{
ClosePrinter(hPrinter);
PrintError(GetLastError(), "OpenPrinter");
return FALSE;
}
// Open handle to the printer job...
wsprintf(jobStr, "%s,Job %i", szPrinterName, jobid);
if (!OpenPrinter(jobStr, &hPrinterJob, NULL))
{
ClosePrinter(hPrinter);
PrintError(GetLastError(), "OpenPrinter Job");
return FALSE;
}
// Allocate a buffer to read printer data into...
lpBytes = (LPVOID)malloc(BUFSIZE);
if (!lpBytes)
{
PrintError(GetLastError(), "malloc");
ClosePrinter(hPrinter);
ClosePrinter(hPrinterJob);
return FALSE;
}
// Try ReadPrinter...
SetLastError(0);
if (!ReadPrinter(hPrinterJob, lpBytes, BUFSIZE, &dwBytesRead))
{
PrintError(GetLastError(), "ReadPrinter");
ClosePrinter(hPrinter);
ClosePrinter(hPrinterJob);
if (lpBytes)
free(lpBytes);
return FALSE;
}
else
{
printf("%i bytes successfully read by ReadPrinter (%i attempted)\n",
dwBytesRead, BUFSIZE);
}
// Clean up...
ClosePrinter(hPrinterJob);
EndDocPrinter(hPrinter); // end the doc 
ClosePrinter(hPrinter);
if (lpBytes)
free(lpBytes);
return TRUE;
}
void PrintError( DWORD dwError, LPCSTR lpString )
{
#define MAX_MSG_BUF_SIZE 512
char *msgBuf;
DWORD cMsgLen;
cMsgLen = FormatMessage(FORMAT_MESSAGE_FROM_SYSTEM |
FORMAT_MESSAGE_ALLOCATE_BUFFER | 40, NULL, dwError,
MAKELANGID(0, SUBLANG_ENGLISH_US), (LPTSTR) &msgBuf, MAX_MSG_BUF_SIZE,
NULL);
printf( "%s Error [%d]:: %s\n", lpString, dwError, msgBuf );
LocalFree( msgBuf );
#undef MAX_MSG_BUF_SIZE
}

So if you use OpenPrinter to do stuff like accessing the job or the Xvc interface, you gonna get problems. To fix this, you need to use OpenPrinter2 (on Vista) and specify PRINTER_OPTION_NO_CACHE.

Ahrg!

This is my first blog, so I don’t know how this will be something i enjoy, or not. But you never know if you don’t try.