Specifying log file name in ClfsCreateLogFile

NTFSD
1

I’m not able to open/create a CLFS log file using ClfsCreateLogFile because it is failing with an object path not found error (0xC000003A). The documentation makes it look simple; you specify “log:” or “log::” followed by the physical log file path and name. In my case, I’m creating a dedicated log so I’m using “log:”. I then give the path and name for the log.

In my case, I’m creating a log named “MyDrvLg” in C:\ so the log file name would be: “log:c:\MyDrvLg” but that’s failing with the error mentioned. I tried some combinations but they either fail with the object path not found or an invalid parameter error. Here are some variations I’ve tried with no luck:

    * log:\??\c:\MyDrvL
    * log:c:\logs\MyDrvL
    * log:\??\c:\logs\MyDrvL
    * log:c:\MyDrvLg.blf

And so on.

Does anyone know exactly what CLFS is looking for? Again, the docs make it sound pretty simple but I’m just missing some finesse, at least, I’m assuming that.

Thanks in advance.

2

I’ve never called it myself so I opened WinDbg and set a breakpoint on nt!ClfsCreateLogFile. From the function prototype the path is in the second argument, which is in RDX on my x64 target. Here are the formats I see for successful calls:

Breakpoint 0 hit
nt!ClfsCreateLogFile:
fffff800`02afbdb2 jmp     qword ptr [nt!_imp_ClfsCreateLogFile (fffff800`02a5e0b0)]
0: kd> dS @rdx
fffff8a0`0051ded0  "\??\LOG:\Device\HarddiskVolume1\"
fffff8a0`0051df10  "$Extend\$RmMetadata\$TxfLog\$Txf"
fffff8a0`0051df50  "Log::KtmLog"

Breakpoint 0 hit
nt!ClfsCreateLogFile:
fffff800`02afbdb2 jmp     qword ptr [nt!_imp_ClfsCreateLogFile (fffff800`02a5e0b0)]
1: kd> dS @rdx
fffff8a0`151d72b0  "\??\LOG:\SystemRoot\System32\Con"
fffff8a0`151d72f0  "fig\TxR\{016888cd-6c6f-11de-8d1d"
fffff8a0`151d7330  "-001e0bcde3ec}.TM"

Looks to me like the example paths in the ClfsCreateLogFile documentation are user mode examples (i.e. they’re missing the starting ??).

Can’t help but note that I suspect you’ll be one of very few people to ever call this API outside of Microsoft. Not saying that’s a bad thing, but just a heads up :slight_smile:

3

Thanks very much Scott! Yeah, the docs are obviously written for user-mode. From my experimentation, I did try "??" and also “\Device\HarddiskVolumeNnn” (where ‘Nnn’ is the number of the volume for the log) but I didn’t put them both together correctly.