aboutsummaryrefslogblamecommitdiffstatshomepage
path: root/ringlogger/dump.go
blob: 05a9b27fbfd0645596652e92a42902fe5d5e5160 (plain) (tree)
1
2
3
4
5
6
7
8
9
10







                                                         

            
                       


                                           
 
                                                 


                                                    
                       




                                                 
                                                     














                                                                                                                                                                  
                                                                                               
         
                                  



















                                                                                                                   
/* SPDX-License-Identifier: MIT
 *
 * Copyright (C) 2019 WireGuard LLC. All Rights Reserved.
 */

package ringlogger

import (
	"io"
	"os"
	"path/filepath"

	"golang.org/x/sys/windows"
	"golang.org/x/sys/windows/registry"

	"golang.zx2c4.com/wireguard/windows/conf"
)

func DumpTo(out io.Writer, localSystem bool) error {
	var path string
	if !localSystem {
		root, err := conf.RootDirectory()
		if err != nil {
			return err
		}
		path = filepath.Join(root, "log.bin")
	} else {
		k, err := registry.OpenKey(registry.LOCAL_MACHINE, "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-18", registry.QUERY_VALUE)
		if err != nil {
			return err
		}
		defer k.Close()

		systemprofile, _, err := k.GetStringValue("ProfileImagePath")
		if err != nil {
			return err
		}
		systemprofile, err = registry.ExpandString(systemprofile)
		if err != nil {
			return err
		}
		path = filepath.Join(systemprofile, "AppData", "Local", "WireGuard", "log.bin")
	}
	file, err := os.Open(path)
	if err != nil {
		return err
	}
	defer file.Close()
	mapping, err := windows.CreateFileMapping(windows.Handle(file.Fd()), nil, windows.PAGE_READONLY, 0, 0, nil)
	if err != nil {
		return err
	}
	rl, err := newRingloggerFromMappingHandle(mapping, "DMP", windows.FILE_MAP_READ)
	if err != nil {
		windows.CloseHandle(mapping)
		return err
	}
	defer rl.Close()
	_, err = rl.WriteTo(out)
	if err != nil {
		return err
	}
	return nil
}