Type: New Feature
Fix Version/s: None
DbpPrint() (also known as KdPrint() macro) and OutputDebugString() to file logging utility. Supports log rotation. Maximum log-file size is limited to 128Mb. When file size limit is reached, utility automatically creates new file. For example, if logging was started from dbgprint.log file, next files will be named dbgprint1.log, dbgprint2.log, etc. Supports keyboard control. You can pause/resume logging or force switching to next log-file. In contrast to SysInternals DbgView this utility has no limitations to total amout of logs. (DbgView crashes on huge logs, about 4Gb). Has a number of settings and can be reconfigured from keyboard without restart.
It works so: driver locates the point where DbgPrint() sends string to internal kernel function. Then it patches call address to point to hook routine. Hook copies messages to 1Mb buffer. user-mode application obtains these messages from driver via IOCTL. Messages from OutputDebugString() are catched by separate thread in user-mode app.
Latest versions can capture boot-time logs and can operate as service, so user is not required to log in. You can use -svc and -drv switches to enable this functionality (see below).
Note: driver and service installation code looks for DbgPrintLog.exe and DbgPrnHk.sys in the directory where DbgPrintLog.exe is located. Thus I recommend you to specify full path to DbgPrintLog.exe or run it from the directory where it is located. This will help to avoid execution of previously installed version from %SystemRoot%\System32 or some other place specified in %PATH% environment variable.
For convenience of writing scripts, oriented on software testing, the EchoDbg utility is added to this package. In contrast to standard echo command EchoDbg allows sending text messages to DebugConsole using OutputDebugString(). In addition EchoDbg can redirect StdIn to DebugConsole. When used in testing scripts EchoDbg makes easy to synchronize logs from top-level requests (for example sequences of file manipulation commands) with low-level application responses (for example from underlaying file system driver).
You can also use something like SDK - .H and .LIB, those makes easy to send debug-messages directly to driver's intarnal buffer. It has API similar to printf().
Also, if you are interested, here you can read more about internals of KdPrint()/OutputDebugString().