3 replies to this topic

[Slider]

This is putting an event in the application log file, but
it also brings up Dr. Watson.

What have I left out?

Thanks.

; Report_Event.asm Append string to end of Application Event Log
;

INCLUDE    \masm32\include\masm32rt.inc
include    \masm32\include\advapi32.inc
includelib \masm32\lib\advapi32.lib   

.data

Provider_Name   db  "MyEventProvider",0 
Failed          db  "RegisterEventSource failed.",0
AppName         db  "SiegeWorks",0
string1         db  "An unhandled exception has occured.",0 
string2         db  " "
string3         db  " "

.DATA?

hEventLog       HWND  ?
dwEventDataSize dw    ?

.code

start:

stringpointers label dword
DWORD offset string1
DWORD offset string2
DWORD offset string3
    
    push 	offset Provider_Name
    push 	NULL
    Call 	RegisterEventSource
    mov         [hEventLog], eax ; Store handle 
    
.IF eax == NULL
   ;invoke GetLastError
   ;invoke wsprintf, addr OutputBuffer, addr Failed, eax
   invoke  MessageBox, NULL, addr Failed, addr AppName, MB_OK
.ENDIF

mov [dwEventDataSize], (sizeof stringpointers)

invoke ReportEvent,hEventLog,EVENTLOG_INFORMATION_TYPE,0,0,NULL,3,dwEventDataSize,addr stringpointers,NULL

invoke DeregisterEventSource,hEventLog

invoke ExitProcess, NULL

end start

[RhetoricalRuvim]

Quote

.IF eax == NULL

   ;invoke GetLastError

   ;invoke wsprintf, addr OutputBuffer, addr Failed, eax

   invoke  MessageBox, NULL, addr Failed, addr AppName, MB_OK

.ENDIF


mov [dwEventDataSize], (sizeof stringpointers)


invoke ReportEvent,hEventLog,EVENTLOG_INFORMATION_TYPE,0,0,NULL,3,dwEventDataSize,addr stringpointers,NULL


invoke DeregisterEventSource,hEventLog


invoke ExitProcess, NULL

Maybe it's not, but should it be like this?:

.IF eax == NULL

   ;invoke GetLastError

   ;invoke wsprintf, addr OutputBuffer, addr Failed, eax

   invoke  MessageBox, NULL, addr Failed, addr AppName, MB_OK

.ELSE 


mov [dwEventDataSize], (sizeof stringpointers)


invoke ReportEvent,hEventLog,EVENTLOG_INFORMATION_TYPE,0,0,NULL,3,dwEventDataSize,addr stringpointers,NULL


invoke DeregisterEventSource,hEventLog


.ENDIF 


invoke ExitProcess, NULL

And sorry for the question, but what do you mean by "Dr. Watson?"

[Slider]

I found source and an example program in this file.
XEventLog_demo.zip

I am working with it to develop an MASM assembly equivalent.

Dr. Watson is the default XP debugger that is activated whenever there is a Major program error.

Andy

[dargueta]

I think you're going to have to change the OS settings to not bring up Dr. Watson.