i invoked ReportEvent and failed, and error message is "the parameter is incorrect."
the function prototype is:
BOOL ReportEvent(
  HANDLE hEventLog,
  WORD wType,
  WORD wCategory,
  DWORD dwEventID,
  PSID lpUserSid,
  WORD wNumStrings,
  DWORD dwDataSize,
  LPCTSTR* lpStrings,
  LPVOID lpRawData

i think the 8th parameter lpStrings was wrong, can anyone tell me how to fix it?


;*************** code snippet*******************

WriteEventLog proc , lpString

invoke RegisterEventSource,NULL,CTXT("Eyes Protector")
mov hEventLog,eax

.if ( eax == NULL )
invoke MessageBox,NULL,CTXT("WRONG"),addr szServiceName,MB_ABORTRETRYIGNORE

invoke ReportEvent,hEventLog,EVENTLOG_INFORMATION_TYPE,0,0,NULL,1,0,addr szServiceName,NULL

.if( eax == NULL )
invoke MessageError

invoke DeregisterEventSource,hEventLog


WriteEventLog endp
Posted on 2005-11-07 09:10:23 by czg1997
The parameter is not a pointer to a string, but a pointer to an array of pointers to strings (phew).

So, something like...

stringpointers label dword
DWORD offset string1
DWORD offset string2
DWORD offset string3

then use "addr stringpointers". You need to do it this way even for a single string.
Posted on 2005-11-07 09:26:58 by f0dder