Is there a wsprintf()-type function from a low-level library such as kernel32.dll or ntdll.dll?

c00000fd

I'm writing a low-level logger function that appends text string to the end of a text (log) file. The requirement is that this function should not invoke any WinAPIs from DLLs that may not be yet available for the process -- such as when it's called from a DllMain handler. In other words, it can't use any libraries other than the ones that are guaranteed to be loaded into any user-mode process, i.e. kernel32.dll or ntdll.dll.

I was able to get by quite nicely with just CreateFile, WriteFile, CloseHandle, HeapAlloc, HeapFree, etc. that are all from kernel32.dll.

The issue is formatting the output string. For instance, I need to add some additional (automatically generated) details, such as current time, process ID, session ID, etc. I would normally use wsprintf type function for that, or StringCchPrintf to be exact, as such:

StringCchPrintf(buffer, buffer_size, L"%04u-%02u-%02u %02u:%02u:%02u pid=0x%x, sessID=%d, %s\r\n", /* parameters */ );

but those APIs violate the rule I noted above.

Does anyone know if there's a low level printf type formatting API available?

RbMm

all versions of ntdll.dll support how minimum next(from xp) string formating functions:

_snprintf
_snwprintf
_vsnprintf
_vsnwprintf
sprintf
swprintf
vsprintf

the signatures of course full matches same functions from crt. we can free use this api. new versions of ntdll add some new format string api. say win7 (and all latest version) ntdll.dll export next:

_snprintf
_snprintf_s
_snwprintf
_snwprintf_s
_swprintf
_vscwprintf
_vsnprintf
_vsnprintf_s
_vsnwprintf
_vsnwprintf_s
_vswprintf
swprintf
swprintf_s
vsprintf
vsprintf_s
vswprintf_s

Collected from the Internet

Please contact [email protected] to delete if infringement.

edited at
0

Comments

0 comments
Login to comment

Related

From Dev

vba dll call writefile from kernel32 creates huge file

From Dev

Symbols for "ntdll.dll" could not be downloaded from Microsoft Symbol Servers

From Dev

Error from ntdll.dll because of a malloc (C++)

From Dev

Are Win32 applications automatically linked against ntdll.dll?

From Dev

Is it good to use ntdll.dll in a win32 console application?

From Dev

windows - how to link against API sets (*ms-win*) instead kernel32.dll, ntdll.dll etc.?

From Dev

Dll export symbol of function from static linked library

From Dev

C# - call function from dynamic library dll

From Dev

Using GetPrivateProfileString from kernel32.dll

From Dev

LInk to ntdll.lib and call functions inside ntdll.dll

From Dev

Is there a Linux equivalent module and function for LoadLibrary() from kernel32.dll that i can call from .Net Core?

From Dev

ReactOS – Where are the ntdll.dll stubs?

From Dev

UWP debug/release error with ntdll.dll

From Dev

MFC application Crashes in NTDLL.dll

From Dev

Error loading Office.dll COMException: 'Errorloading type library/DLL'

From Dev

Running ASP.NET 5 on Nano Server throws "Unable to load DLL 'kernel32'"

From Dev

Need to fix this error: 'Can't find DLL entry point GetSystemInfo in kernel32'

From Dev

InterlockedExchange method of kernel32 not found when linking a dll to a c# project

From Dev

Windows 10 explorer.exe heap corruption ntdll.dll when opened from taskbar

From Dev

Windows 7 SP1 32-bit - Windows Explorer Crashing with faulting "ntdll.dll" module

From Dev

Calling function from dll with QT

From Dev

python call function from DLL

From Dev

NativeCall can't find a function in Kernel32.dll

From Dev

Run wpf application from class library (dll)

From Java

How to unload library (DLL) from the JVM

From Dev

Creating dll library from generated c code

From Dev

type error using ctypes with windows dll function

From Dev

How to call static library static class member function from victim process of dll-injection process

From Dev

function call from dll [expression preceding parentheses of apparent call must have (pointer-to-) function type]

Related Related

  1. 1

    vba dll call writefile from kernel32 creates huge file

  2. 2

    Symbols for "ntdll.dll" could not be downloaded from Microsoft Symbol Servers

  3. 3

    Error from ntdll.dll because of a malloc (C++)

  4. 4

    Are Win32 applications automatically linked against ntdll.dll?

  5. 5

    Is it good to use ntdll.dll in a win32 console application?

  6. 6

    windows - how to link against API sets (*ms-win*) instead kernel32.dll, ntdll.dll etc.?

  7. 7

    Dll export symbol of function from static linked library

  8. 8

    C# - call function from dynamic library dll

  9. 9

    Using GetPrivateProfileString from kernel32.dll

  10. 10

    LInk to ntdll.lib and call functions inside ntdll.dll

  11. 11

    Is there a Linux equivalent module and function for LoadLibrary() from kernel32.dll that i can call from .Net Core?

  12. 12

    ReactOS – Where are the ntdll.dll stubs?

  13. 13

    UWP debug/release error with ntdll.dll

  14. 14

    MFC application Crashes in NTDLL.dll

  15. 15

    Error loading Office.dll COMException: 'Errorloading type library/DLL'

  16. 16

    Running ASP.NET 5 on Nano Server throws "Unable to load DLL 'kernel32'"

  17. 17

    Need to fix this error: 'Can't find DLL entry point GetSystemInfo in kernel32'

  18. 18

    InterlockedExchange method of kernel32 not found when linking a dll to a c# project

  19. 19

    Windows 10 explorer.exe heap corruption ntdll.dll when opened from taskbar

  20. 20

    Windows 7 SP1 32-bit - Windows Explorer Crashing with faulting "ntdll.dll" module

  21. 21

    Calling function from dll with QT

  22. 22

    python call function from DLL

  23. 23

    NativeCall can't find a function in Kernel32.dll

  24. 24

    Run wpf application from class library (dll)

  25. 25

    How to unload library (DLL) from the JVM

  26. 26

    Creating dll library from generated c code

  27. 27

    type error using ctypes with windows dll function

  28. 28

    How to call static library static class member function from victim process of dll-injection process

  29. 29

    function call from dll [expression preceding parentheses of apparent call must have (pointer-to-) function type]

HotTag

Archive