UVNC Source

[lebowski]

Hello everyone,

I have a question about mslogon.log which is generated in `debug` after connections.
The problem is, in mslogon.log

4/11/2014 15:55 Connection received from xxx
04/11/2014 15:55:33 Connection received from xxx using yyy account
4/11/2014 15:55 Connection received from xxx
4/11/2014 15:57 Client xxx disconnected

In winvnc, logging,cpp while I can make changes on LOGEXIT, LOGFAILED.. I cannot make any changes on LOGLOGONUSER to have date,time in same format.
Any ideas? Thank you.

[Rudi De Vos]

logging.cpp is used by logging.dll, so you created a new dll and copied to the vnc folder.

Time is set via

Code: Select all

void LOGLOGON(char *machine)
{
                FILE *file;
		const char* ps[3];
		char texttowrite[512];
		SYSTEMTIME time;
		GetLocalTime(& time);
		char			szText[256];
		sprintf(szText,"%d/%d/%d %d:%.2d   ", time.wDay,time.wMonth,time.wYear,time.wHour,time.wMinute );
		strcpy(texttowrite,szText);
		strcat(texttowrite,"Invalid attempt from client ");

this is exact the same as

Code: Select all

void LOGLOGONUSER(char *machine,char *user)
{
		FILE *file;
		const char* ps[3];
		char texttowrite[512];
		SYSTEMTIME time;
		GetLocalTime(& time);
		char			szText[256];
		sprintf(szText,"%d/%d/%d %d:%.2d   ", time.wDay,time.wMonth,time.wYear,time.wHour,time.wMinute );

I don't see a reason that both can have a different format...so it have to be another dll.

Check EventLogging.cpp (authssp.dll)

Code: Select all

void LOG(long EventID, const TCHAR *format, ...) {
    FILE *file;
...
GetLocalTime(& time);
		_stprintf(szTimestamp,_T("%.2d/%.2d/%d %.2d:%.2d:%.2d  "), 
			time.wDay, time.wMonth, time.wYear, time.wHour, time.wMinute, time.wSecond);

called from
vncSPP.cpp

Code: Select all

// This logging should be moved to LOGLOGONUSER etc.
		FILE *file = fopen("WinVNC-authSSP.log", "a");
		if (file) {
            time_t current;
			time(&current);
			char* timestr = ctime(&current);
			timestr[24] = '\0'; // remove newline
			fprintf(file, "%s - CUPSD2: Access is %u, user %s is %sauthenticated, access granted is 0x%x\n",
				timestr, isAccessOK, userin, isAuthenticated ? "" : "not ", dwAccessGranted);
			fclose(file);
		}
	} else { // message text to be moved to localization.h
		MessageBox(NULL, _T("New MS-Logon currently not supported on Win9x"), _T("Warning"), MB_OK);
		return FALSE;
	}

	if (isAccessOK) {
		if (dwAccessGranted & ViewOnly) isViewOnly = true;
		if (dwAccessGranted & Interact) isInteract = true;
	}
	
	//LookupAccountName(NULL, user2, Sid, cbSid, DomainName, cbDomainName, peUse);

	if (isInteract)	{
		LOG(0x00640001L, _T("Connection received from %s using %s account\n"), machine2, user2);
	} else if (isViewOnly) {
		LOG(0x00640001L, _T("Connection received from %s using %s account\n"), machine2, user2);
		isAccessOK = 2;

[lebowski]

Hello Rudi. Thank you again for your reply. The change on EventLogging.cpp solved it.