From 3b9ccf3f7d441874e27afe24f1dc9f56a7b7bfda Mon Sep 17 00:00:00 2001 From: Colin Finck Date: Sat, 13 Oct 2007 10:15:37 +0000 Subject: [PATCH] Add an Event Log Viewer coded by Marc Piulachs (marc DOT piulachs AT codexchange DOT net) The icons were taken from the comctl32.dll. I did not add it to the "reactos.dff" as ReactOS doesn't support Event Logs yet. See issue #2602 for more details. svn path=/trunk/; revision=29547 --- .../applications/mscutils/directory.rbuild | 23 +- .../applications/mscutils/eventvwr/eventvwr.c | 1137 +++++++++++++++++ .../applications/mscutils/eventvwr/eventvwr.h | 3 + .../mscutils/eventvwr/eventvwr.rbuild | 16 + .../mscutils/eventvwr/eventvwr.rc | 13 + .../mscutils/eventvwr/lang/en-US.rc | 211 +++ .../mscutils/eventvwr/res/error.ico | Bin 0 -> 318 bytes .../mscutils/eventvwr/res/eventvwr.ico | Bin 0 -> 23558 bytes .../mscutils/eventvwr/res/info.ico | Bin 0 -> 318 bytes .../mscutils/eventvwr/res/warning.ico | Bin 0 -> 318 bytes .../applications/mscutils/eventvwr/resource.h | 62 + .../applications/mscutils/eventvwr/rsrc.rc | 6 + 12 files changed, 1461 insertions(+), 10 deletions(-) create mode 100644 reactos/base/applications/mscutils/eventvwr/eventvwr.c create mode 100644 reactos/base/applications/mscutils/eventvwr/eventvwr.h create mode 100644 reactos/base/applications/mscutils/eventvwr/eventvwr.rbuild create mode 100644 reactos/base/applications/mscutils/eventvwr/eventvwr.rc create mode 100644 reactos/base/applications/mscutils/eventvwr/lang/en-US.rc create mode 100644 reactos/base/applications/mscutils/eventvwr/res/error.ico create mode 100644 reactos/base/applications/mscutils/eventvwr/res/eventvwr.ico create mode 100644 reactos/base/applications/mscutils/eventvwr/res/info.ico create mode 100644 reactos/base/applications/mscutils/eventvwr/res/warning.ico create mode 100644 reactos/base/applications/mscutils/eventvwr/resource.h create mode 100644 reactos/base/applications/mscutils/eventvwr/rsrc.rc diff --git a/reactos/base/applications/mscutils/directory.rbuild b/reactos/base/applications/mscutils/directory.rbuild index 042fe821aa5..454397af7cc 100644 --- a/reactos/base/applications/mscutils/directory.rbuild +++ b/reactos/base/applications/mscutils/directory.rbuild @@ -1,10 +1,13 @@ - - - - - - - - - - + + + + + + + + + + + + + diff --git a/reactos/base/applications/mscutils/eventvwr/eventvwr.c b/reactos/base/applications/mscutils/eventvwr/eventvwr.c new file mode 100644 index 00000000000..792f2b51390 --- /dev/null +++ b/reactos/base/applications/mscutils/eventvwr/eventvwr.c @@ -0,0 +1,1137 @@ +/* + * ReactOS Win32 Applications + * Copyright (C) 2007 ReactOS Team + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. + */ +/* + * COPYRIGHT : See COPYING in the top level directory + * PROJECT : Event Log Viewer + * FILE : eventvwr.c + * PROGRAMMER: Marc Piulachs (marc.piulachs at codexchange [dot] net) + */ + +#include "eventvwr.h" +#include // Standard windows include file +#include // For ListView control APIs +#include // For TCHAR and string functions. +#include +#include + +#if _MSC_VER + #pragma warning(disable: 4996) // 'strdup' was declared deprecated + #define _CRT_SECURE_NO_DEPRECATE // all deprecated 'unsafe string functions +#endif + +static const LPSTR EVENT_SOURCE_APPLICATION = "Application"; +static const LPSTR EVENT_SOURCE_SECURITY = "Security"; +static const LPSTR EVENT_SOURCE_SYSTEM = "System"; + +//MessageFile message buffer size +#define EVENT_MESSAGE_FILE_BUFFER 1024*10 +#define EVENT_DLL_SEPARATOR ";" +#define EVENT_MESSAGE_FILE "EventMessageFile" +#define EVENT_CATEGORY_MESSAGE_FILE "CategoryMessageFile" +#define EVENT_PARAMETER_MESSAGE_FILE "ParameterMessageFile" + +#define MAX_LOADSTRING 255 + +// Global Variables: +HINSTANCE hInst; // current instance +TCHAR szTitle[MAX_LOADSTRING]; // The title bar text +TCHAR szWindowClass[MAX_LOADSTRING]; // the main window class name + +// Globals +HWND hwndMainWindow; // Main window +HWND hwndListView; // ListView control +HWND hwndStatus; // Status bar + +LPTSTR lpSourceLogName = NULL; +LPTSTR lpComputerName = NULL; + +// Forward declarations of functions included in this code module: +ATOM MyRegisterClass(HINSTANCE hInstance); +BOOL InitInstance(HINSTANCE, int); +LRESULT CALLBACK WndProc (HWND, UINT, WPARAM, LPARAM); +INT_PTR CALLBACK About (HWND, UINT, WPARAM, LPARAM); +INT_PTR CALLBACK EventDetails (HWND, UINT, WPARAM, LPARAM); +static INT_PTR CALLBACK StatusMessageWindowProc (HWND, UINT, WPARAM, LPARAM); + +int APIENTRY _tWinMain(HINSTANCE hInstance, + HINSTANCE hPrevInstance, + LPTSTR lpCmdLine, + int nCmdShow) +{ + MSG msg; + HACCEL hAccelTable; + INITCOMMONCONTROLSEX iccx; + + UNREFERENCED_PARAMETER(hPrevInstance); + UNREFERENCED_PARAMETER(lpCmdLine); + + // Whenever any of the common controls are used in your app, + // you must call InitCommonControlsEx() to register the classes + // for those controls. + iccx.dwSize = sizeof(INITCOMMONCONTROLSEX); + iccx.dwICC = ICC_LISTVIEW_CLASSES; + InitCommonControlsEx(&iccx); + + // Initialize global strings + LoadString(hInstance, IDS_APP_TITLE, szTitle, MAX_LOADSTRING); + LoadString(hInstance, IDC_EVENTVWR, szWindowClass, MAX_LOADSTRING); + MyRegisterClass(hInstance); + + // Perform application initialization: + if (!InitInstance (hInstance, nCmdShow)) + { + return FALSE; + } + + hAccelTable = LoadAccelerators(hInstance, MAKEINTRESOURCE(IDC_EVENTVWR)); + + // Main message loop: + while (GetMessage(&msg, NULL, 0, 0)) + { + if (!TranslateAccelerator(msg.hwnd, hAccelTable, &msg)) + { + TranslateMessage(&msg); + DispatchMessage(&msg); + } + } + + return (int) msg.wParam; +} + +VOID EventTimeToSystemTime (DWORD EventTime, SYSTEMTIME *pSystemTime) +{ + SYSTEMTIME st1970 = { 1970, 1, 0, 1, 0, 0, 0, 0 }; + FILETIME ftLocal; + union { + FILETIME ft; + ULONGLONG ll; + } u1970, uUCT; + + uUCT.ft.dwHighDateTime = 0; + uUCT.ft.dwLowDateTime = EventTime; + SystemTimeToFileTime(&st1970, &u1970.ft); + uUCT.ll = uUCT.ll * 10000000 + u1970.ll; + FileTimeToLocalFileTime(&uUCT.ft, &ftLocal); + FileTimeToSystemTime(&ftLocal, pSystemTime); +} + +void +TrimNulls ( LPSTR s ) +{ + char *c; + + if ( s != (char *) NULL ) + { + c = s + strlen ( s ) - 1; + while ( c >= s && isspace ( *c ) ) + --c; + *++c = '\0'; + } +} + +BOOL GetEventMessageFileDLL( + IN LPCTSTR lpLogName, + IN LPCTSTR SourceName, + IN LPCTSTR EntryName, + OUT LPSTR ExpandedName) +{ + DWORD dwSize; + BYTE szModuleName[MAX_PATH]; + TCHAR szKeyName[MAX_PATH]; + HKEY hAppKey = NULL; + HKEY hSourceKey = NULL; + BOOL bReturn = FALSE; // Return + + _tcscpy(szKeyName, TEXT("SYSTEM\\CurrentControlSet\\Services\\EventLog")); + _tcscat(szKeyName, _T("\\")); + _tcscat(szKeyName, lpLogName); + + if (RegOpenKeyEx( + HKEY_LOCAL_MACHINE, + szKeyName, + 0, + KEY_READ, + &hAppKey) == ERROR_SUCCESS) + { + if (RegOpenKeyEx( + hAppKey, + SourceName, + 0, + KEY_READ, + &hSourceKey) == ERROR_SUCCESS) + { + dwSize = MAX_PATH; + if (RegQueryValueEx( + hSourceKey, + EntryName, + NULL, + NULL, + (LPBYTE)szModuleName, + &dwSize) == ERROR_SUCCESS) + { + // Returns a string containing the requested substituted environment variable. + ExpandEnvironmentStrings ((LPCTSTR)szModuleName, ExpandedName, MAX_PATH); + + // Succesfull + bReturn = TRUE; + } + } + } + else + { + MessageBox (NULL , + _TEXT("Registry access failed!") , + _TEXT("Event Log") , + MB_OK | MB_ICONINFORMATION); + } + + if (hSourceKey != NULL) + RegCloseKey(hSourceKey); + + if (hAppKey != NULL) + RegCloseKey(hAppKey); + + return bReturn; +} + +BOOL GetEventCategory( + IN LPCTSTR KeyName, + IN LPCTSTR SourceName, + IN EVENTLOGRECORD *pevlr, + OUT LPTSTR CategoryName) +{ + HANDLE hLibrary = NULL; + TCHAR szMessageDLL[MAX_PATH]; + LPVOID lpMsgBuf = NULL; + + if(GetEventMessageFileDLL (KeyName, SourceName, EVENT_CATEGORY_MESSAGE_FILE , szMessageDLL)) + { + hLibrary = LoadLibraryEx( + szMessageDLL, + NULL, + DONT_RESOLVE_DLL_REFERENCES | LOAD_LIBRARY_AS_DATAFILE); + + if(hLibrary != NULL) + { + // Retrieve the message string. + if(FormatMessage( + FORMAT_MESSAGE_FROM_SYSTEM | FORMAT_MESSAGE_ALLOCATE_BUFFER | FORMAT_MESSAGE_FROM_HMODULE | FORMAT_MESSAGE_ARGUMENT_ARRAY, + hLibrary, + pevlr->EventCategory, + MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT), + (LPTSTR)&lpMsgBuf, + EVENT_MESSAGE_FILE_BUFFER, + NULL) != 0) + { + if (lpMsgBuf) + { + //Trim the string + TrimNulls ((LPSTR)lpMsgBuf); + + // Copy the category name + strcpy (CategoryName, (LPCTSTR)lpMsgBuf); + } + else + { + strcpy (CategoryName, (LPCTSTR)lpMsgBuf); + } + }else{ + strcpy (CategoryName, "None"); + } + + if(hLibrary != NULL) + FreeLibrary(hLibrary); + + // Free the buffer allocated by FormatMessage + if (lpMsgBuf) + LocalFree(lpMsgBuf); + + return TRUE; + } + } + + strcpy (CategoryName, "None"); + + return FALSE; +} + +BOOL GetEventMessage( + IN LPCTSTR KeyName, + IN LPCTSTR SourceName, + IN EVENTLOGRECORD *pevlr, + OUT LPTSTR EventText) +{ + DWORD i; + HANDLE hLibrary = NULL; + char SourceModuleName[1000]; + char ParameterModuleName[1000]; + LPTSTR lpMsgBuf = NULL; + TCHAR szStringIDNotFound[MAX_LOADSTRING]; + LPTSTR szDll; + LPTSTR szMessage; + LPTSTR *szArguments; + BOOL bDone = FALSE; + + /* TODO : GetEventMessageFileDLL can return a comma separated list of DLLs */ + if (GetEventMessageFileDLL (KeyName , SourceName, EVENT_MESSAGE_FILE , SourceModuleName)) + { + // Get the event message + szMessage = (LPTSTR)((LPBYTE)pevlr + pevlr->StringOffset); + + // Allocate space for parameters + szArguments = (LPTSTR*)malloc(sizeof(LPVOID)* pevlr->NumStrings); + + for (i = 0; i < pevlr->NumStrings ; i++) + { + if (strstr(szMessage , "%%")) + { + if (GetEventMessageFileDLL (KeyName , SourceName, EVENT_PARAMETER_MESSAGE_FILE , ParameterModuleName)) + { + //Not yet support for reading messages from parameter message DLL + } + + szArguments[i] = szMessage; + szMessage += strlen(szMessage) + 1; + } + else + { + szArguments[i] = szMessage; + szMessage += strlen(szMessage) + 1; + } + } + + szDll = strtok(SourceModuleName, EVENT_DLL_SEPARATOR); + while ((szDll != NULL) && (!bDone)) + { + hLibrary = LoadLibraryEx( + szDll, + NULL, + DONT_RESOLVE_DLL_REFERENCES | LOAD_LIBRARY_AS_DATAFILE); + + if (hLibrary == NULL) + { + // The DLL could not be loaded try the next one (if any) + szDll = strtok (NULL, EVENT_DLL_SEPARATOR); + } + else + { + // Retrieve the message string. + if(FormatMessage( + FORMAT_MESSAGE_FROM_SYSTEM | + FORMAT_MESSAGE_ALLOCATE_BUFFER | + FORMAT_MESSAGE_FROM_HMODULE | + FORMAT_MESSAGE_ARGUMENT_ARRAY, + hLibrary, + pevlr->EventID, + MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT), + (LPTSTR)&lpMsgBuf, + 0, + szArguments) == 0) + { + // We haven't found the string , get next DLL (if any) + szDll = strtok (NULL, EVENT_DLL_SEPARATOR); + } + else + { + if (lpMsgBuf) + { + // The ID was found and the message was formated + bDone = TRUE; + + //Trim the string + TrimNulls ((LPSTR)lpMsgBuf); + + // Copy the event text + strcpy (EventText ,lpMsgBuf); + } + } + + FreeLibrary (hLibrary); + } + } + + if (!bDone) + { + LoadString(hInst, IDC_EVENTSTRINGIDNOTFOUND, szStringIDNotFound, MAX_LOADSTRING); + wsprintf (EventText, szStringIDNotFound , (DWORD)(pevlr->EventID & 0xFFFF) , SourceName ); + } + + // No more dlls to try , return result + return bDone; + } + + LoadString(hInst, IDC_EVENTSTRINGIDNOTFOUND, szStringIDNotFound, MAX_LOADSTRING); + wsprintf (EventText, szStringIDNotFound , (DWORD)(pevlr->EventID & 0xFFFF) , SourceName ); + + return FALSE; +} + +char* GetEventType (WORD dwEventType) +{ + switch(dwEventType) + { + case EVENTLOG_ERROR_TYPE: + return "Error"; + break; + case EVENTLOG_WARNING_TYPE: + return "Warning"; + break; + case EVENTLOG_INFORMATION_TYPE: + return "Information"; + break; + case EVENTLOG_AUDIT_SUCCESS: + return "Audit Success"; + break; + case EVENTLOG_AUDIT_FAILURE: + return "Audit Failure"; + break; + default: + return "Unknown Event"; + break; + } +} + +BOOL +GetEventUserName (EVENTLOGRECORD *pelr, OUT LPSTR pszUser) +{ + PSID lpSid; + char szName[1024]; + char szDomain[1024]; + SID_NAME_USE peUse; + DWORD cbName = 1024; + DWORD cbDomain = 1024; + + // Point to the SID. + lpSid = (PSID)((LPBYTE) pelr + pelr->UserSidOffset); + + // User SID + if(pelr->UserSidLength > 0) + { + if (LookupAccountSid( + NULL, + lpSid, + szName, + &cbName, + szDomain, + &cbDomain, + &peUse)) + { + strcpy (pszUser , szName); + return TRUE; + } + } + + return FALSE; +} + +static DWORD WINAPI +ShowStatusMessageThread( + IN LPVOID lpParameter) +{ + HWND *phWnd = (HWND *)lpParameter; + HWND hWnd; + MSG Msg; + + hWnd = CreateDialogParam( + hInst, + MAKEINTRESOURCE(IDD_PROGRESSBOX), + GetDesktopWindow(), + StatusMessageWindowProc, + (LPARAM)NULL); + if (!hWnd) + return 0; + *phWnd = hWnd; + + ShowWindow(hWnd, SW_SHOW); + + /* Message loop for the Status window */ + while (GetMessage(&Msg, NULL, 0, 0)) + { + TranslateMessage(&Msg); + DispatchMessage(&Msg); + } + + return 0; +} + +VOID QueryEventMessages ( + LPTSTR lpMachineName , + LPTSTR lpLogName) +{ + HWND hwndDlg; + HANDLE hEventLog; + EVENTLOGRECORD *pevlr; + BYTE bBuffer[MAX_PATH]; + DWORD dwRead, dwNeeded, dwThisRecord , dwTotalRecords , dwCurrentRecord = 1 , dwRecordsToRead = 0 , dwFlags; + LPSTR lpSourceName; + LPSTR lpComputerName; + LPSTR lpEventStr; + LPSTR lpData; + BOOL bResult = TRUE; // Read succeeded. + + char szWindowTitle[MAX_PATH]; + char szStatusText[MAX_PATH]; + char szLocalDate[MAX_PATH]; + char szLocalTime[MAX_PATH]; + char szEventID[MAX_PATH]; + char szCategoryID[MAX_PATH]; + char szUsername[MAX_PATH]; + char szEventText[EVENT_MESSAGE_FILE_BUFFER]; + char szCategory[MAX_PATH]; + + SYSTEMTIME time; + LVITEM lviEventItem; + + dwFlags = EVENTLOG_FORWARDS_READ | EVENTLOG_SEQUENTIAL_READ; + + lpSourceLogName = lpLogName; + lpComputerName = lpMachineName; + + // Open the event log. + hEventLog = OpenEventLog( + lpMachineName, + lpLogName); + + if (hEventLog == NULL) + { + MessageBox (NULL , + _TEXT("Could not open the event log.") , + _TEXT("Event Log") , + MB_OK | MB_ICONINFORMATION); + return; + } + + //Disable listview redraw + SendMessage(hwndListView, WM_SETREDRAW, FALSE, 0); + + // Clear the list view + (void)ListView_DeleteAllItems (hwndListView); + + // Initialize the event record buffer. + pevlr = (EVENTLOGRECORD *)&bBuffer; + + // Get the record number of the oldest event log record. + GetOldestEventLogRecord(hEventLog, &dwThisRecord); + + // Get the total number of event log records. + GetNumberOfEventLogRecords (hEventLog , &dwTotalRecords); + + //If we have at least 1000 records show the waiting dialog + if (dwTotalRecords > 1000) + { + CreateThread( + NULL, + 0, + ShowStatusMessageThread, + (LPVOID)&hwndDlg, + 0, + NULL); + } + + while (dwCurrentRecord < dwTotalRecords) + { + pevlr = (EVENTLOGRECORD*)malloc(MAX_PATH); + + bResult = ReadEventLog( + hEventLog, // Event log handle + dwFlags, // Sequential read + 0, // Ignored for sequential read + pevlr, // Pointer to buffer + MAX_PATH, // Size of buffer + &dwRead, // Number of bytes read + &dwNeeded); // Bytes in the next record + + if((!bResult) && (GetLastError () == ERROR_INSUFFICIENT_BUFFER)) + { + pevlr = (EVENTLOGRECORD*)malloc (dwNeeded); + + ReadEventLog( + hEventLog, // event log handle + dwFlags, // read flags + 0, // offset; default is 0 + pevlr, // pointer to buffer + dwNeeded, // size of buffer + &dwRead, // number of bytes read + &dwNeeded); // bytes in next record + } + + while (dwRead > 0) + { + strcpy (szUsername , "N/A"); + strcpy (szEventText , "N/A"); + strcpy (szCategory , "None"); + + // Get the event source name. + lpSourceName = (LPSTR) ((LPBYTE) pevlr + sizeof(EVENTLOGRECORD)); + + // Get the computer name + lpComputerName = (LPSTR) ((LPBYTE) pevlr + sizeof(EVENTLOGRECORD) + lstrlen(lpSourceName) + 1); + + // This ist the data section of the current event + lpData = (LPSTR) ((LPBYTE)pevlr + pevlr->DataOffset); + + // This is the text of the current event + lpEventStr = (LPSTR) ((LPBYTE) pevlr + pevlr->StringOffset); + + // Compute the event type + EventTimeToSystemTime(pevlr->TimeWritten, &time); + + // Get the username that generated the event + GetEventUserName (pevlr , szUsername); + + GetDateFormat( LOCALE_USER_DEFAULT, DATE_SHORTDATE, &time, NULL, szLocalDate, MAX_PATH ); + GetTimeFormat( LOCALE_USER_DEFAULT, TIME_NOSECONDS, &time, NULL, szLocalTime, MAX_PATH ); + + GetEventCategory (lpLogName , lpSourceName , pevlr , szCategory); + //GetEventMessage (lpLogName , lpSourceName , pevlr , szEventText); + + wsprintf (szEventID, "%u", (DWORD)(pevlr->EventID & 0xFFFF)); + wsprintf (szCategoryID, "%u", (DWORD)(pevlr->EventCategory)); + + lviEventItem.mask = LVIF_IMAGE | LVIF_TEXT | LVIF_PARAM; + lviEventItem.iItem = 0; + lviEventItem.iSubItem = 0; + lviEventItem.lParam = (LPARAM)pevlr; + + switch(pevlr->EventType) + { + case EVENTLOG_ERROR_TYPE: + lviEventItem.pszText = "Error"; + lviEventItem.iImage = 2; + break; + case EVENTLOG_AUDIT_FAILURE: + lviEventItem.pszText = "Audit Failure"; + lviEventItem.iImage = 2; + break; + case EVENTLOG_WARNING_TYPE: + lviEventItem.pszText = "Warning"; + lviEventItem.iImage = 1; + break; + case EVENTLOG_INFORMATION_TYPE: + lviEventItem.pszText = "Information"; + lviEventItem.iImage = 0; + break; + case EVENTLOG_AUDIT_SUCCESS: + lviEventItem.pszText = "Audit Success"; + lviEventItem.iImage = 0; + break; + case EVENTLOG_SUCCESS: + lviEventItem.pszText = "Success"; + lviEventItem.iImage = 0; + break; + } + + lviEventItem.iItem = ListView_InsertItem(hwndListView, &lviEventItem); + + ListView_SetItemText(hwndListView, lviEventItem.iItem, 1, szLocalDate); + ListView_SetItemText(hwndListView, lviEventItem.iItem, 2, szLocalTime); + ListView_SetItemText(hwndListView, lviEventItem.iItem, 3, lpSourceName); + ListView_SetItemText(hwndListView, lviEventItem.iItem, 4, szCategory); + ListView_SetItemText(hwndListView, lviEventItem.iItem, 5, szEventID); + ListView_SetItemText(hwndListView, lviEventItem.iItem, 6, szUsername); //User + ListView_SetItemText(hwndListView, lviEventItem.iItem, 7, lpComputerName); //Computer + ListView_SetItemText(hwndListView, lviEventItem.iItem, 8, lpData); //Event Text + + dwRead -= pevlr->Length; + pevlr = (EVENTLOGRECORD *) ((LPBYTE) pevlr + pevlr->Length); + } + + dwRecordsToRead--; + dwCurrentRecord++; + + pevlr = (EVENTLOGRECORD *) &bBuffer; + } + + //All events loaded + EndDialog(hwndDlg, 0); + + wsprintf (szWindowTitle, "%s - %s Log on \\\\%s", szTitle , lpLogName , lpComputerName); + wsprintf (szStatusText, "%s has %d event(s)", lpLogName , dwTotalRecords); + + //Update the status bar + SendMessage (hwndStatus, SB_SETTEXT, (WPARAM)0, (LPARAM)szStatusText); + + //Set the window title + SetWindowText ( hwndMainWindow , szWindowTitle); + + //Resume list view redraw + SendMessage(hwndListView, WM_SETREDRAW, TRUE, 0); + + // Close the event log. + CloseEventLog(hEventLog); +} + +VOID +Refresh (VOID) +{ + QueryEventMessages( + lpComputerName , + lpSourceLogName); +} + +// +// FUNCTION: MyRegisterClass() +// +// PURPOSE: Registers the window class. +// +// COMMENTS: +// +// This function and its usage are only necessary if you want this code +// to be compatible with Win32 systems prior to the 'RegisterClassEx' +// function that was added to Windows 95. It is important to call this function +// so that the application will get 'well formed' small icons associated +// with it. +// +ATOM MyRegisterClass(HINSTANCE hInstance) +{ + WNDCLASSEX wcex; + + wcex.cbSize = sizeof(WNDCLASSEX); + + wcex.style = CS_HREDRAW | CS_VREDRAW; + wcex.lpfnWndProc = WndProc; + wcex.cbClsExtra = 0; + wcex.cbWndExtra = 0; + wcex.hInstance = hInstance; + wcex.hIcon = LoadIcon(hInstance, MAKEINTRESOURCE(IDI_EVENTVWR)); + wcex.hCursor = LoadCursor(NULL, IDC_ARROW); + wcex.hbrBackground = (HBRUSH)(COLOR_WINDOW+1); + wcex.lpszMenuName = MAKEINTRESOURCE(IDC_EVENTVWR); + wcex.lpszClassName = szWindowClass; + wcex.hIconSm = LoadIcon(wcex.hInstance, MAKEINTRESOURCE(IDI_SMALL)); + + return RegisterClassEx(&wcex); +} + +// +// FUNCTION: InitInstance(HINSTANCE, int) +// +// PURPOSE: Saves instance handle and creates main window +// +// COMMENTS: +// +// In this function, we save the instance handle in a global variable and +// create and display the main program window. +// +BOOL InitInstance(HINSTANCE hInstance, int nCmdShow) +{ + HIMAGELIST hSmall; + LVCOLUMN lvc = {0}; + + hInst = hInstance; // Store instance handle in our global variable + + hwndMainWindow = CreateWindow( + szWindowClass, + szTitle, + WS_OVERLAPPEDWINDOW, + CW_USEDEFAULT, 0, CW_USEDEFAULT, 0, + NULL, + NULL, + hInstance, + NULL); + + if (!hwndMainWindow) + { + return FALSE; + } + + hwndStatus = CreateWindowEx( + 0, // no extended styles + STATUSCLASSNAME, // status bar + "Done.", // no text + WS_CHILD | WS_BORDER | WS_VISIBLE, // styles + 0, 0, 0, 0, // x, y, cx, cy + hwndMainWindow, // parent window + (HMENU)100, // window ID + hInstance, // instance + NULL); // window data + + // Create our listview child window. Note that I use WS_EX_CLIENTEDGE + // and WS_BORDER to create the normal "sunken" look. Also note that + // LVS_EX_ styles cannot be set in CreateWindowEx(). + hwndListView = CreateWindowEx( + WS_EX_CLIENTEDGE, + WC_LISTVIEW, + _T(""), + LVS_SHOWSELALWAYS | WS_CHILD | WS_VISIBLE | LVS_REPORT, + 0, + 0, + 243, + 200, + hwndMainWindow, + NULL, + hInstance, + NULL); + + // After the ListView is created, we can add extended list view styles. + (void)ListView_SetExtendedListViewStyle (hwndListView, LVS_EX_FULLROWSELECT); + + // Create the ImageList + hSmall = ImageList_Create( + GetSystemMetrics(SM_CXSMICON), + GetSystemMetrics(SM_CYSMICON), + ILC_MASK, + 1, + 1); + + // Add event type icons to ImageList + ImageList_AddIcon (hSmall, LoadIcon(hInstance, MAKEINTRESOURCE(IDI_INFORMATIONICON))); + ImageList_AddIcon (hSmall, LoadIcon(hInstance, MAKEINTRESOURCE(IDI_WARNINGICON))); + ImageList_AddIcon (hSmall, LoadIcon(hInstance, MAKEINTRESOURCE(IDI_ERRORICON))); + + // Assign ImageList to List View + (void)ListView_SetImageList (hwndListView, hSmall, LVSIL_SMALL); + + // Now set up the listview with its columns. + lvc.mask = LVCF_TEXT | LVCF_WIDTH; + lvc.cx = 90; + lvc.pszText = _T("Type"); + (void)ListView_InsertColumn(hwndListView, 0, &lvc); + + lvc.cx = 70; + lvc.pszText = _T("Date"); + (void)ListView_InsertColumn(hwndListView, 1, &lvc); + + lvc.cx = 70; + lvc.pszText = _T("Time"); + (void)ListView_InsertColumn(hwndListView, 2, &lvc); + + lvc.cx = 150; + lvc.pszText = _T("Source"); + (void)ListView_InsertColumn(hwndListView, 3, &lvc); + + lvc.cx = 100; + lvc.pszText = _T("Category"); + (void)ListView_InsertColumn(hwndListView, 4, &lvc); + + lvc.cx = 60; + lvc.pszText = _T("Event"); + (void)ListView_InsertColumn(hwndListView, 5, &lvc); + + lvc.cx = 120; + lvc.pszText = _T("User"); + (void)ListView_InsertColumn(hwndListView, 6, &lvc); + + lvc.cx = 100; + lvc.pszText = _T("Computer"); + (void)ListView_InsertColumn(hwndListView, 7, &lvc); + + lvc.cx = 0; + lvc.pszText = _T("Event Data"); + (void)ListView_InsertColumn(hwndListView, 8, &lvc); + + ShowWindow(hwndMainWindow, nCmdShow); + UpdateWindow(hwndMainWindow); + + QueryEventMessages ( + lpComputerName, // Use the local computer. + EVENT_SOURCE_APPLICATION); // The event log category + + return TRUE; +} + +// +// FUNCTION: WndProc(HWND, UINT, WPARAM, LPARAM) +// +// PURPOSE: Processes messages for the main window. +// +// WM_COMMAND - process the application menu +// WM_PAINT - Paint the main window +// WM_DESTROY - post a quit message and return +// +// +LRESULT CALLBACK WndProc(HWND hWnd, UINT message, WPARAM wParam, LPARAM lParam) +{ + int wmId, wmEvent; + RECT rect; + NMHDR *hdr; + HMENU hMenu ; + + switch (message) + { + case WM_NOTIFY : + switch(((LPNMHDR)lParam)->code) + { + case NM_DBLCLK : + hdr = (NMHDR FAR*)lParam; + if(hdr->hwndFrom == hwndListView) + { + LPNMITEMACTIVATE lpnmitem = (LPNMITEMACTIVATE)lParam; + + if(lpnmitem->iItem != -1) + { + DialogBox (hInst, MAKEINTRESOURCE(IDD_EVENTDETAILDIALOG), hWnd, EventDetails); + } + } + break; + } + break; + case WM_COMMAND: + wmId = LOWORD(wParam); + wmEvent = HIWORD(wParam); + + if ((wmId == ID_LOG_APPLICATION) || + (wmId == ID_LOG_SYSTEM) || + (wmId == ID_LOG_SECURITY)) + { + hMenu = GetMenu (hWnd) ; // get the menu handle. Use it below + + CheckMenuItem (hMenu, ID_LOG_APPLICATION , MF_UNCHECKED) ; + CheckMenuItem (hMenu, ID_LOG_SYSTEM , MF_UNCHECKED) ; + CheckMenuItem (hMenu, ID_LOG_SECURITY , MF_UNCHECKED) ; + + if (hMenu) + { + CheckMenuItem (hMenu, wmId , MF_CHECKED) ; + } + } + + // Parse the menu selections: + switch (wmId) + { + case ID_LOG_APPLICATION: + QueryEventMessages ( + lpComputerName, // Use the local computer. + EVENT_SOURCE_APPLICATION); // The event log category + break; + case ID_LOG_SYSTEM: + QueryEventMessages ( + lpComputerName, // Use the local computer. + EVENT_SOURCE_SYSTEM); // The event log category + break; + case ID_LOG_SECURITY: + QueryEventMessages ( + lpComputerName, // Use the local computer. + EVENT_SOURCE_SECURITY); // The event log category + break; + case IDM_REFRESH: + Refresh (); + break; + case IDM_ABOUT: + DialogBox(hInst, MAKEINTRESOURCE(IDD_ABOUTBOX), hWnd, About); + break; + case IDM_HELP: + MessageBox ( + NULL , + _TEXT("Help not implemented yet!") , + _TEXT("Event Log") , + MB_OK | MB_ICONINFORMATION); + break; + case IDM_EXIT: + DestroyWindow(hWnd); + break; + default: + return DefWindowProc(hWnd, message, wParam, lParam); + } + break; + case WM_SIZE: + { + //Gets the window rectangle + GetClientRect(hWnd, &rect); + + //Relocate the listview + MoveWindow( + hwndListView, + 0, + 0, + rect.right, + rect.bottom - 20, + 1); + + // Resize the statusbar; + SendMessage (hwndStatus, message, wParam, lParam); + } + break; + case WM_DESTROY: + PostQuitMessage(0); + break; + default: + return DefWindowProc(hWnd, message, wParam, lParam); + } + return 0; +} + +// Message handler for about box. +INT_PTR CALLBACK About(HWND hDlg, UINT message, WPARAM wParam, LPARAM lParam) +{ + UNREFERENCED_PARAMETER(lParam); + switch (message) + { + case WM_INITDIALOG: + { + return (INT_PTR)TRUE; + } + case WM_COMMAND: + if (LOWORD(wParam) == IDOK || LOWORD(wParam) == IDCANCEL) + { + EndDialog(hDlg, LOWORD(wParam)); + return (INT_PTR)TRUE; + } + + break; + } + return (INT_PTR)FALSE; +} + +VOID +DisplayEvent (HWND hDlg) +{ + char szEventType[MAX_PATH]; + char szTime[MAX_PATH]; + char szDate[MAX_PATH]; + char szUser[MAX_PATH]; + char szComputer[MAX_PATH]; + char szSource[MAX_PATH]; + char szCategory[MAX_PATH]; + char szEventID[MAX_PATH]; + char szEventText[MAX_PATH*10]; + char szEventData[MAX_PATH]; + BOOL bEventData = FALSE; + LVITEM li; + EVENTLOGRECORD* pevlr; + + // Get index of selected item + int iIndex = (int)SendMessage (hwndListView ,LVM_GETNEXTITEM, -1 , LVNI_SELECTED | LVNI_FOCUSED); + + li.mask = LVIF_PARAM; + li.iItem = iIndex; + li.iSubItem = 0; + + ListView_GetItem(hwndListView, &li); + + pevlr = (EVENTLOGRECORD*)li.lParam; + + if (iIndex != -1) + { + ListView_GetItemText (hwndListView , iIndex , 0 , szEventType , sizeof( szEventType )); + ListView_GetItemText (hwndListView , iIndex , 1 , szDate , sizeof( szDate )); + ListView_GetItemText (hwndListView , iIndex , 2 , szTime , sizeof( szTime )); + ListView_GetItemText (hwndListView , iIndex , 3 , szSource , sizeof( szSource )); + ListView_GetItemText (hwndListView , iIndex , 4 , szCategory , sizeof( szCategory )); + ListView_GetItemText (hwndListView , iIndex , 5 , szEventID , sizeof( szEventID )); + ListView_GetItemText (hwndListView , iIndex , 6 , szUser , sizeof( szUser )); + ListView_GetItemText (hwndListView , iIndex , 7 , szComputer , sizeof( szComputer )); + ListView_GetItemText (hwndListView , iIndex , 8 , szEventData , sizeof( szEventData )); + + bEventData = !(strlen(szEventData) == 0); + + GetEventMessage (lpSourceLogName , szSource , pevlr , szEventText); + + EnableWindow(GetDlgItem(hDlg , IDC_BYTESRADIO) , bEventData); + EnableWindow(GetDlgItem(hDlg , IDC_WORDRADIO) , bEventData); + + SetDlgItemText (hDlg, IDC_EVENTDATESTATIC , szDate); + SetDlgItemText (hDlg, IDC_EVENTTIMESTATIC , szTime); + SetDlgItemText (hDlg, IDC_EVENTUSERSTATIC , szUser); + SetDlgItemText (hDlg, IDC_EVENTSOURCESTATIC , szSource); + SetDlgItemText (hDlg, IDC_EVENTCOMPUTERSTATIC , szComputer); + SetDlgItemText (hDlg, IDC_EVENTCATEGORYSTATIC , szCategory); + SetDlgItemText (hDlg, IDC_EVENTIDSTATIC , szEventID); + SetDlgItemText (hDlg, IDC_EVENTTYPESTATIC , szEventType); + SetDlgItemText (hDlg, IDC_EVENTTEXTEDIT , szEventText); + SetDlgItemText (hDlg, IDC_EVENTDATAEDIT , szEventData); + } + else + { + MessageBox( + NULL, + "No Items in ListView", + "Error", + MB_OK | MB_ICONINFORMATION); + } +} + +static +INT_PTR CALLBACK StatusMessageWindowProc( + IN HWND hwndDlg, + IN UINT uMsg, + IN WPARAM wParam, + IN LPARAM lParam) +{ + UNREFERENCED_PARAMETER(wParam); + + switch (uMsg) + { + case WM_INITDIALOG: + { + return TRUE; + } + } + return FALSE; +} + +// Message handler for event details box. +INT_PTR CALLBACK EventDetails(HWND hDlg, UINT message, WPARAM wParam, LPARAM lParam) +{ + UNREFERENCED_PARAMETER(lParam); + switch (message) + { + case WM_INITDIALOG: + { + // Show event info on dialog box + DisplayEvent (hDlg); + return (INT_PTR)TRUE; + } + + case WM_COMMAND: + if (LOWORD(wParam) == IDOK || LOWORD(wParam) == IDCANCEL) + { + EndDialog(hDlg, LOWORD(wParam)); + return (INT_PTR)TRUE; + } + if (LOWORD(wParam) == IDPREVIOUS) + { + SendMessage (hwndListView, WM_KEYDOWN, VK_UP, 0); + + // Show event info on dialog box + DisplayEvent (hDlg); + return (INT_PTR)TRUE; + } + + if (LOWORD(wParam) == IDNEXT) + { + SendMessage (hwndListView, WM_KEYDOWN, VK_DOWN, 0); + + // Show event info on dialog box + DisplayEvent (hDlg); + return (INT_PTR)TRUE; + } + + if (LOWORD(wParam) == IDC_BYTESRADIO) + { + return (INT_PTR)TRUE; + } + + if (LOWORD(wParam) == IDC_WORDRADIO) + { + return (INT_PTR)TRUE; + } + + if (LOWORD(wParam) == IDHELP) + { + MessageBox (NULL , + _TEXT("Help not implemented yet!") , + _TEXT("Event Log") , + MB_OK | MB_ICONINFORMATION); + return (INT_PTR)TRUE; + } + break; + } + return (INT_PTR)FALSE; +} diff --git a/reactos/base/applications/mscutils/eventvwr/eventvwr.h b/reactos/base/applications/mscutils/eventvwr/eventvwr.h new file mode 100644 index 00000000000..d00d47e7885 --- /dev/null +++ b/reactos/base/applications/mscutils/eventvwr/eventvwr.h @@ -0,0 +1,3 @@ +#pragma once + +#include "resource.h" diff --git a/reactos/base/applications/mscutils/eventvwr/eventvwr.rbuild b/reactos/base/applications/mscutils/eventvwr/eventvwr.rbuild new file mode 100644 index 00000000000..9267c350a47 --- /dev/null +++ b/reactos/base/applications/mscutils/eventvwr/eventvwr.rbuild @@ -0,0 +1,16 @@ + + + + . + + + 0x600 + 0x501 + kernel32 + user32 + comctl32 + advapi32 + eventvwr.c + eventvwr.rc + + diff --git a/reactos/base/applications/mscutils/eventvwr/eventvwr.rc b/reactos/base/applications/mscutils/eventvwr/eventvwr.rc new file mode 100644 index 00000000000..e1ec24d24fc --- /dev/null +++ b/reactos/base/applications/mscutils/eventvwr/eventvwr.rc @@ -0,0 +1,13 @@ +#include +#include +#include "resource.h" + + +#define REACTOS_STR_FILE_DESCRIPTION "ReactOS Event Log Viewer\0" +#define REACTOS_STR_INTERNAL_NAME "eventvwr\0" +#define REACTOS_STR_ORIGINAL_FILENAME "eventvwr.exe\0" +#include + +#include "rsrc.rc" + + diff --git a/reactos/base/applications/mscutils/eventvwr/lang/en-US.rc b/reactos/base/applications/mscutils/eventvwr/lang/en-US.rc new file mode 100644 index 00000000000..72a807f114b --- /dev/null +++ b/reactos/base/applications/mscutils/eventvwr/lang/en-US.rc @@ -0,0 +1,211 @@ +// Microsoft Visual C++ generated resource script. +// +#include "resource.h" + +#define APSTUDIO_READONLY_SYMBOLS +///////////////////////////////////////////////////////////////////////////// +// +// Generated from the TEXTINCLUDE 2 resource. +// +#define APSTUDIO_HIDDEN_SYMBOLS +#include "windows.h" +#undef APSTUDIO_HIDDEN_SYMBOLS + +///////////////////////////////////////////////////////////////////////////// +#undef APSTUDIO_READONLY_SYMBOLS + +///////////////////////////////////////////////////////////////////////////// +// English (U.S.) resources + +#if !defined(AFX_RESOURCE_DLL) || defined(AFX_TARG_ENU) +#ifdef _WIN32 +LANGUAGE LANG_ENGLISH, SUBLANG_ENGLISH_US +#pragma code_page(1252) +#endif //_WIN32 + +///////////////////////////////////////////////////////////////////////////// +// +// Icon +// + +// Icon with lowest ID value placed first to ensure application icon +// remains consistent on all systems. +IDI_EVENTVWR ICON "res\\eventvwr.ico" +IDI_WARNINGICON ICON "res\\warning.ico" +IDI_INFORMATIONICON ICON "res\\info.ico" +IDI_ERRORICON ICON "res\\error.ico" + +///////////////////////////////////////////////////////////////////////////// +// +// Menu +// + +IDC_EVENTVWR MENU +BEGIN + POPUP "&Log" + BEGIN + MENUITEM "&Aplication", ID_LOG_APPLICATION, CHECKED + MENUITEM "&Security", ID_LOG_SECURITY + MENUITEM "&System", ID_LOG_SYSTEM + MENUITEM SEPARATOR + MENUITEM "E&xit", IDM_EXIT + END + POPUP "&View" + BEGIN + MENUITEM "&Refresh", IDM_REFRESH + END + MENUITEM "&Options", ID_OPTIONS + POPUP "&Help" + BEGIN + MENUITEM "H&elp", IDM_HELP + MENUITEM SEPARATOR + MENUITEM "&About ...", IDM_ABOUT + END +END + + +///////////////////////////////////////////////////////////////////////////// +// +// Accelerator +// + +IDC_EVENTVWR ACCELERATORS +BEGIN + "?", IDM_ABOUT, ASCII, ALT + "/", IDM_ABOUT, ASCII, ALT +END + + +///////////////////////////////////////////////////////////////////////////// +// +// Dialog +// + +IDD_ABOUTBOX DIALOGEX 0, 0, 230, 75 +STYLE DS_SETFONT | DS_MODALFRAME | DS_FIXEDSYS | DS_CENTER | WS_CAPTION | WS_SYSMENU +CAPTION "About" +FONT 8, "MS Shell Dlg", 0, 0, 0x0 +BEGIN + ICON IDI_EVENTVWR,IDC_MYICON,14,9,21,20 + LTEXT "ReactOS Event Viewer Version 1.0",IDC_STATIC,49,10,119,8,SS_NOPREFIX + LTEXT "Copyright (C) 2007 Marc Piulachs (marc.piulachs@codexchange.net)",IDC_STATIC,49,20,119,22 + DEFPUSHBUTTON "OK",IDOK,90,48,42,16,WS_GROUP +END + +IDD_PROGRESSBOX DIALOGEX 0, 0, 230, 40 +STYLE DS_SETFONT | DS_MODALFRAME | DS_FIXEDSYS | DS_CENTER +CAPTION "Wait.." +FONT 8, "MS Shell Dlg", 0, 0, 0x0 +BEGIN + LTEXT "Loading Event Logs. Please wait ...",IDC_STATIC,49,15,119,8,SS_NOPREFIX +END + +IDD_EVENTDETAILDIALOG DIALOGEX 0, 0, 276, 282 +STYLE DS_SETFONT | DS_MODALFRAME | DS_FIXEDSYS | DS_CENTER | WS_POPUP | WS_CAPTION | WS_SYSMENU +EXSTYLE WS_EX_CONTEXTHELP +CAPTION "Event Detail" +FONT 8, "MS Shell Dlg", 400, 0, 0x1 +BEGIN + DEFPUSHBUTTON "&Close",IDOK,12,258,50,14 + PUSHBUTTON "&Previous",IDPREVIOUS,78,258,50,14 + PUSHBUTTON "&Next",IDNEXT,144,258,50,14 + PUSHBUTTON "&Help",IDHELP,210,258,50,14 + EDITTEXT IDC_EVENTTEXTEDIT,14,81,247,108,ES_MULTILINE | ES_READONLY + LTEXT "&Description:",IDC_STATIC,15,70,39,8 + LTEXT "Date:",IDC_STATIC,14,14,36,8 + LTEXT "Static",IDC_EVENTDATESTATIC,56,14,72,8 + LTEXT "Time:",IDC_STATIC,14,27,36,8 + LTEXT "Static",IDC_EVENTTIMESTATIC,56,27,72,8 + LTEXT "&User:",IDC_STATIC,14,41,36,8 + LTEXT "Static",IDC_EVENTUSERSTATIC,56,41,72,8 + LTEXT "&Computer:",IDC_STATIC,14,54,36,8 + LTEXT "Static",IDC_EVENTCOMPUTERSTATIC,56,54,72,8 + LTEXT "EventID :",IDC_STATIC,133,15,36,8 + LTEXT "Static",IDC_EVENTIDSTATIC,175,15,87,8 + LTEXT "Source:",IDC_STATIC,133,28,36,8 + LTEXT "Static",IDC_EVENTSOURCESTATIC,175,28,87,8 + LTEXT "Type:",IDC_STATIC,133,42,36,8 + LTEXT "Static",IDC_EVENTTYPESTATIC,175,42,87,8 + LTEXT "Category:",IDC_STATIC,133,55,36,8 + LTEXT "Static",IDC_EVENTCATEGORYSTATIC,175,55,87,8 + EDITTEXT IDC_EVENTDATAEDIT,14,204,247,44,ES_MULTILINE | ES_READONLY + LTEXT "D&ata",IDC_STATIC,14,194,16,8 + CONTROL "&Bytes",IDC_BYTESRADIO,"Button",BS_AUTORADIOBUTTON,39,194,34,10 + CONTROL "&Word",IDC_WORDRADIO,"Button",BS_AUTORADIOBUTTON,77,194,33,10 +END + + +#ifdef APSTUDIO_INVOKED +///////////////////////////////////////////////////////////////////////////// +// +// TEXTINCLUDE +// + +1 TEXTINCLUDE +BEGIN + "resource.h\0" +END + +2 TEXTINCLUDE +BEGIN + "#define APSTUDIO_HIDDEN_SYMBOLS\r\n" + "#include ""windows.h""\r\n" + "#undef APSTUDIO_HIDDEN_SYMBOLS\r\n" + "\0" +END + +3 TEXTINCLUDE +BEGIN + "\r\n" + "\0" +END + +#endif // APSTUDIO_INVOKED + + +///////////////////////////////////////////////////////////////////////////// +// +// DESIGNINFO +// + +#ifdef APSTUDIO_INVOKED +GUIDELINES DESIGNINFO +BEGIN + IDD_EVENTDETAILDIALOG, DIALOG + BEGIN + LEFTMARGIN, 7 + RIGHTMARGIN, 269 + TOPMARGIN, 7 + BOTTOMMARGIN, 275 + END +END +#endif // APSTUDIO_INVOKED + + +///////////////////////////////////////////////////////////////////////////// +// +// String Table +// + +STRINGTABLE +BEGIN + IDS_APP_TITLE "Event Viewer" + IDC_EVENTVWR "EVENTVWR" + IDC_EVENTSTRINGIDNOTFOUND "The description for Event ID ( %lu ) in Source ( %s ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer." +END + +#endif // English (U.S.) resources +///////////////////////////////////////////////////////////////////////////// + + + +#ifndef APSTUDIO_INVOKED +///////////////////////////////////////////////////////////////////////////// +// +// Generated from the TEXTINCLUDE 3 resource. +// + + +///////////////////////////////////////////////////////////////////////////// +#endif // not APSTUDIO_INVOKED + diff --git a/reactos/base/applications/mscutils/eventvwr/res/error.ico b/reactos/base/applications/mscutils/eventvwr/res/error.ico new file mode 100644 index 0000000000000000000000000000000000000000..7e5bc5ab578786f61abe6df1084f04776b715259 GIT binary patch literal 318 zcmYjNITFG!3|tM&kPf?Hk_yWFg0G3rZAw-7il4$Wa3xlbhe7tPSJL`O0O3d}0XSn7 z;6}9)QF#!;dW3d9D0+b-^k}MfPcS8Ftz0SKeZoBy!4ah(Or?ZndgUBK7PDLcE@rce zHM6#<>~6bnWifBwY+jf-4YV=+_N=+wHsYe$U#6ePmShD&p^B>2uySylbs@uYIPy&-w#c zpc-6UYC)x+ErDgUwQ8BlZ7hIURRB*7exZ#T}AXG2* z=^weGTI5~Inq#r?3QZRh5>Vvy7AqDy*^i;1p6BY7;LQSXZ{;g>M z?fm5AM!1uJ~14CP5-;mbWJGeF0 z_iurN!(6GBI54yo4h(CB{j~e(6Em$hj*V=Fqpvo{5$e#07L+U2`wvFkn8s8S#Efo= z^|!}o{tozLT1|Z7UlaSMxZ(5FgK^Rilm(Khv|vko7i5X}36?lI))Ggklas69 zVxSe$=33+10BfA^v%)uXY;b;dHGCaV4e6oPadwt1PEE7L#SjO4G`kKy33kG#^P1yK zcx(J^Ra<Ti+?95-JJvGIWK0JnTs;vs^DcXy)=jK$w z=lme~e0CM~SM61i7E+Zy6!Vv8(?YCpX|5H%3$bS21{dbq;8I96Tne>C8jm-9o*mM| z?2r~#1K&~U^BwT@ygK+I#1UDG8sIO%&iE*}A+E1$jbGNa!S(fRas9ovxba>)TBY{5 zxxo`Rq9|oIDtY0?rjE#1t!!u9+}s5>w|2#i&D55z%y+}h?JrQ>af9~O4zA^n9=Nr$ z7jEt9gPXg&@$23JxV49(y|Q~4emOiI-)H_6dH=qKoBYhlq5e+&PW_AegZf|U-_)N} z9@RJC3MS7vp?yXL1qC4>AOQaU{+Kjr5++WZhzS!Wz}MFoW5Wxo&I+1!G$zZHn#$;`!98-<yjHIyy#~ zd!^|5sm6LSF)_!K%8;V#rWzZU(N_%@(#Q5Ewg{KRHI95 zY?=LIo2D9@#Ky*zb^O>SmHu~IE44l?Dgh-;K81z)WLJ`;4wqn z_ZrZ%LmzL?wy3kD_lL%jZ@l`n*YIJJ=8o?=KVm^dc=tK8XTNSrUK1xwofb5!|4WPJ z4;&O=5uecStt8`&$o&U)@7lX>*XEsj-g|fBj_upFZrx%^n^vq{{r0M5OP8-%`Odni z4ek1_pUw~WS3(xf3w~KkBmDdVRSL~dfr0)bOf7sI@n%@?lm1=c0pd4Z&T02Hm@RH2 z)we;5{I7(S*0d0%twR;wLsA|##n-X4buN70s`TsBg@MbpxknH6!QPjfV-K~P+VA6v z_lLE?{$Xwi?eB?&gE}IlpC>|?5A<%2&;edpIl33d4IhkA?7Qcs#@NdnYWsbf({dao zjuAS*69M!eGt37G)4CyX#*2ub-V>ij1>vuo!mzs+z)KgL@b7{zHqOE48v-$!zJ3#Y zv6uJbc6$T6dQ*KU=65px!K_Y5n$a2Cr*_9zn`Ys&O+gqt+y{pT0q+l>1_JwOKM87w zj|1D|zXCjwI@=4Ewok|DRTFSw+Z#B)bq3CDnTav%mol33yacQq;D9qB?)YqOTV(8< zhO{02IO`82u>Hs|UYpK$#ksIn_%f8&v3sW=YtK}ip9y^Z1~r3H`B~I#;2iDQ=@jeE zsP;Kl_%^%|E=9QF`(^IPTIr6TH*`S`ui5^ww+}9?dJfr}dg8{OA;>xEhiiu?LYUzwb+T)8Ci=PAZtkjWKvm68X{|HBivlm3|Y&X;^sP6+GhB5eJk92w>5I2 z+$j(Ix}hC1827D>9dK(?2jp()h@8zG@!QT$$l2N%x3+e|?QJ|JOre?J8PhnJ%Ni~CLrzWB&44|iS%zyB8@if zn`DaR3m@|O^QyPhwX#dzrgIKY+OQIBHLeiIw|EP z&VT0+jvL~&)rdRJe}-vnAIJ6*Q-ZDH1N-*w-gRv2&ZLw99b3D3xO=#{xw*T!wQ+Oz@bGBcd0?|n&$#sN_2S8-lrFX#RqEa{~iIg60Iwp0)kazxeJo zgX#N&>G3k(9Zpk`k46?8yGp_NR9<~gx%0b2>EBc6h6N*s;*a0{2Wy6O#7ZA8q(u55 zXmAg#9`ZC+QBk9x#nSQpa4CKpR!sCp#>stnXRBl-)qQFW^fsryy=(Z?FI2AS<5;lV$HB*W zpm$$$hhFu3THa~z+qYL;AE$u>2QZl)2G;Ru)3f^vUAny3rOUHDp6~jct50i}CXE|6 zZPK7&qvp+?vT*b1+^M5y`wmZgdAPT0`%H^xiXL6DvWOu*60xx;u6V#Q2{0r8adCy( zEn;IuV&g28p4jI>W#CW53OF&!CsAr~RottogHM>&s@S>DKq|7h|3SD9 zqF9XiYwfgmNUJRFhY%(1o6xLY)@?;QKJMM%9Zv1};>0~2!r#}0zp0zW`xNH9UeDj( zg}=XRQtjm}{_d~Eq+;bB6m$ICmr^L!lH$^jp`^CQQOEr>=J>f^rrg)^KRssd^D)QI zeLuo|80KTp^Sb>{=X%)v)pLRSmCW&T|B@EJinpT1Tyzb%m&zPJ_g4w`z?hFg`Rd1_ z>Wj7&9jm;{DmLy1Gsn+8Vp@!PtSTNouWWh8cdz+W{M_4Sj-PwjDs;R>k4LR3_uiS~ z=YBll{weJklr8FC(aI`*?jJPA&pn00ytW2@1pNNmFr)z)}MRaMZIsT^P*Jr zd{v~ficiI=V%Fb3xlf-prc}}2|5bcSDrP-?@&@_Qn~c8Rs-)*Df-M*%`H0H+%lZ72 zvi{EGQOr#h;dxS84CWx2AwMJBn{b$~fyU%&3N}@!=X}9qDHtRuG5tUm68j-~fkG1sqOUyGmYlwPgb z2OYaS`ssnHnDzL{f$7y1HvU2ZvOsRl96y=1qRkb)O#V)fzZuy)A>;K#iJYK%{YIx)`7mahDM1B1t%cm9kaZNYkD4X_DC9qd+$8->B5TQhB} zPLpFP(T5^y$$V8IA1dTRh5V#84>?gGBg(O=3b|S#mnh^Cg)FI%vsB;THmdl^aSGW> zA@3;U9fcgEkcSj)tKX)y|CMyJ9 zWMGAisgNZVGNwZIRLI7bES?uKuA0cIN->306SAtME58p}SdPK5N}H!(y?QQ$SPR)# zEw=cH;9p8myVEOE~ZJrY}3iIg?0rP&%LTBp=}8h@I%TXv<9-xUO`%}-uWt5a*E=2Z6^)Nip$4?6}mrb=W3r9pMm{N(?%I<=0f{ZX!iK0oKQ1d^EdG#^%`N>O4Lp#&)lc_BC`N?cbBh&ou z$Ha>#mE4>Z3XbJ2L!+Nt++W%XmzCnEDKwe#1XEVN#&9kX7z*Ba>aDt~p(O7d58 ztNMbLMIj4qo}V1Gs?t)?V|bWl{j*<9L>}8bKN)V*HyMT)&Xn7jpKpqbGz6zmVk@{(S%;moMb= zg`B=PIy$QPUCF}>xq2agFXZoq+`W*w*DN`FAuBIr%G&-D!IW`F9}` zFJ#_@jJ%MQmz-@~sV+i3UdYL7B1xFE+kg*rC_sn}}eaYVo*?J*YFZ>$;!oOJ{ z{QCgB-)1FF4i?imzkPZz{4Rvr{h7I>sgUu{%LsSK%b0JUml0-1RnN;GSP!(-+jpO%JopO`B((dnpK-(&yRaUJ6F; zchnE_k$Wv1f4{oG;*T$8Vx5|ss!Wf01@yO_$nuNBLZ4Gvb)Vu6x9f7RD3t3{RPFna z@~=**zWfUs8kYPPZCSL4e)B1xT|TXnSM+U>y|{O?8%m4vtzIr_BVKg5vCP}`*3dR} z&a!{N#n>%>kU18z!$Q_q$meQ#RW3=oZ=knFmg=8&V&`qOUg~p1N&lWwnpHmPb9YW3 zw+z)kIP(xwOMAJX5{|A*v__uZdtvV;w2rOkgeCCc1i z#a5Q%Amc3IgIa3+fBIm(x&OWTs_~Un|HxNN{coH$#m{POUDev^Dy>e{FMhe1Y5iiu zZmaQs-hGgQ|L_C% NFqjoQE8guUeE}V6U1b0O literal 0 HcmV?d00001 diff --git a/reactos/base/applications/mscutils/eventvwr/res/warning.ico b/reactos/base/applications/mscutils/eventvwr/res/warning.ico new file mode 100644 index 0000000000000000000000000000000000000000..e86b2f333a58fbdd269a07252c35e6163df26671 GIT binary patch literal 318 zcmYLEF%H5o5OWkHh75FKg|TBLMut9(ds6pX@)VxH$bbm;odBmkUuL>k;PFj3EDz!9;k3%uD&flji3U} zH+L$SGp3@2HZ +#include "resource.h" + +LANGUAGE LANG_NEUTRAL, SUBLANG_NEUTRAL + +#include "lang/en-US.rc"