Reading Event Log

[rth]

I need to read the Security Event Log and then show the EVENTLOGRECORD as a
String. Reading records works fine but when I format the string that I'm
going to show the FormatMessage function generate an "Unhandled exception ...
(NTDLL.DLL) ... Access violation". I found a code sample on the net that I've
used to format the string but this generate the same problem. I need your
help. Now, I posted this code this funtion to format the EVENTLOGRECORD data,
any suggestions?.

BOOL GetDescription( char *Log, EVENTLOGRECORD *EventLogRecPtr , char *tmpStr)
{
int i=0,I ,j;
unsigned long FileNameModuleS ize = 100;
char tmp[200];
HKEY nKeyHandle=0;
BYTE FileNameModule[100],expbuffer[BUFFER_SIZE];
LPTSTR message, *strings, AllocedStr[20] ;
LPVOID lpBuffer;

sprintf(tmp,"SY STEM\\CurrentCo ntrolSet\\Servi ces\\EventLog\\ %s\\%s",
Log, (LPBYTE)EventLo gRecPtr + sizeof(EVENTLOG RECORD));

RegOpenKey(HKEY _LOCAL_MACHINE, (LPTSTR) tmp,&nKeyHandle );

RegQueryValueEx (nKeyHandle,"Ev entMessageFile" ,NULL,NULL,
FileNameModule, &FileNameModule Size);

ExpandEnvironme ntStrings((LPCT STR)FileNameMod ule, (LPSTR)expbuffe r,
BUFFER_SIZE);
RegCloseKey(HKE Y_LOCAL_MACHINE );

if (nKeyHandle)
{
message = (LPTSTR)((LPBYT E)EventLogRecPt r + EventLogRecPtr->StringOffset );

strings = (char**)malloc( sizeof(LPVOID)* EventLogRecPtr->NumStrings);

for (j = 0; j < EventLogRecPtr->NumStrings;j++ )
{
if (strstr(message ,"%%"))
{
(LPTSTR) strings[j] = GetParameterMsg (message, tmp);
AllocedStr[i++] = strings[j];
}
else
(LPTSTR) strings[j] = message;

message = message + strlen(message) +1;

}

HMODULE hlib = LoadLibraryEx(( LPCTSTR)expbuff er, NULL,
LOAD_LIBRARY_AS _DATAFILE);

I=FormatMessage ( FORMAT_MESSAGE_ FROM_HMODULE |
FORMAT_MESSAGE_ ALLOCATE_BUFFER | FORMAT_MESSAGE_ ARGUMENT_ARRAY,
hlib,
EventLogRecPtr->EventID,
0,
(LPTSTR)&lpBuff er,
sizeof(lpBuffer ),
(LPTSTR *)(strings));

if( I == 0)
{
while (i >0)
{
free(AllocedStr[--i]);
}

MissatgesError( );

if(lpBuffer == NULL)
LocalFree( lpBuffer );
return False;
}

strcpy(tmpStr, (char *) lpBuffer);

for(I = 0; I< (int) strlen(tmpStr); I++)
{
if((tmpStr[I] != 0) && ((tmpStr[I] > 0 && tmpStr[I] < 32)))
tmpStr[I] = 32;
}

LocalFree( lpBuffer );
FreeLibrary(hli b);
return True;
}
return False;
}