Tbsi_Get_TCG_Log function

Gets the Windows Boot Counter Log (WBCL)TCG log.

Syntax


TBS_RESULT WINAPI Tbsi_Get_TCG_Log(
  _In_     TBS_HCONTEXT hContext,
  _Out_    PBYTE *pabOutput,
  _Inout_  PUNIT32 *pcbOutput
);

Parameters

hContext [in]

The TBS handle of the context that is getting the TCG log. You get this parameter from a previous call to the Tbsi_Context_Create function.

pabOutput [out]

A pointer to a buffer to receive and store the WBCL. This parameter may be NULL to estimate the required buffer when the location pointed to by pcbOutput is also 0 on input.

pcbOutput [in, out]

A pointer to an unsigned long integer that, on input, specifies the size, in bytes, of the output buffer. If the function succeeds, this parameter, on output, receives the size, in bytes, of the data pointed to by pOutputBuf. If the function fails, this parameter does not receive a value.

Calling the Tbsi_Get_TCG_Log function with a zero length buffer will return the size of the buffer required.

Windows Vista with SP1 and Windows Server 2008:  This functionality is not available.

Return value

Return code/valueDescription
TBS_SUCCESS
0 (0x0)

The function succeeded.

TBS_E_INTERNAL_ERROR
2150121473 (0x80284001)

An internal software error occurred.

Note  If TBS_E_INTERNAL_ERROR is returned, the system event log may contain event ID 16385 from the TBS event source with error code 0x80070032. This may indicate that the hardware platform does not provide a TCG event log to the operating system. Sometimes this can be resolved by installing a BIOS upgrade from the platform manufacturer.

TBS_E_INVALID_OUTPUT_POINTER
2150121475 (0x80284003)

A specified output pointer is not valid.

TBS_E_INVALID_CONTEXT
2150121476 (0x80284004)

The specified context handle does not refer to a valid context.

TBS_E_INSUFFICIENT_BUFFER
2150121477 (0x80284005)

The output buffer is too small.

TBS_E_BUFFER_TOO_LARGE
2150121486 (0x8028400E)

The output buffer is too large.

TBS_E_TPM_NOT_FOUND
2150121487 (0x8028400F)

A compatible Trusted Platform Module (TPM) Security Device cannot be found on this computer.

TBS_E_DEACTIVATED
2150121494 (0x80284016)

The Trusted Platform Module (TPM) Security Device is deactivated.

Windows Vista with SP1 and Windows Server 2008:  This return value is not available.

 

Remarks

The Tbsi_Get_TCG_Log function returns the TCG Event Log copied by Windows in the preboot environment, and the buffer size depends on the number of events. The value of PCR 11 is overwritten after this copy is performed, so it should be treated as random. The function returns the log from the last boot of the platform that was not a resume from hibernation. After a resume from hibernation, the log may not match the TPM's current PCR values.

Windows Vista with SP1 and Windows Server 2008:  The function returns the log directly from the ACPI table and returns the entire ACPI allocated buffer, including the unused buffer after any events.

The Windows-defined events in the TCG event log are a tuple of {Type, Length, Value}. You can parse the log using the following TCG_PCR_EVENT structure from the TCG PC Client spec. You can create a correlation between lists of log events using the information in the TPM PCP Toolkit and the TPM Main Specification.


typedef struct {
  TCG_PCRINDEX PCRIndex;
  TCG_EVENTTYPE EventType;
  TCG_DIGEST Digest;
  UINT32 EventSize;
  UINT8 Event[EventSize];
} TCG_PCR_EVENT;

The memory size required for the pOutputBuf parameter should either be the constant in TBS_IN_OUT_BUF_SIZE_MAX, defined in the Tbs.h header file, or it should be obtained by calling the Tbsi_Get_TCG_Log function with a zero length buffer to get the required buffer size.

Windows Vista with SP1 and Windows Server 2008:  Calling the Tbsi_Get_TCG_Log function with a zero length buffer to get the required buffer size is not supported. We recommend that you use the constant TBS_IN_OUT_BUF_SIZE_MAX, defined in the Tbs.h header file, for the memory size for the pOutputBuf parameter.

Examples


#include <windows.h>
#include <tbs.h>
#pragma comment(lib, "Tbs.lib")

void main()
{
    TBS_RESULT result;
    TBS_HCONTEXT hContext;
    TBS_CONTEXT_PARAMS contextParams;
    contextParams.version = TBS_CONTEXT_VERSION_ONE;
    result = Tbsi_Context_Create(&contextParams, &hContext);
    if (result == TBS_SUCCESS) 
    {
        UINT32 iLogSize = TBS_IN_OUT_BUF_SIZE_MAX;
        BYTE* pLogBuffer = new BYTE[iLogSize];
        result = Tbsi_Get_TCG_Log(hContext, pLogBuffer, &iLogSize);
    }
}


Requirements

Minimum supported client

Windows Vista with SP1 [desktop apps only]

Minimum supported server

Windows Server 2008 [desktop apps only]

Header

Tbs.h

Library

Tbs.lib

DLL

Tbs.dll

 

 

Community Additions

ADD
Show:
© 2014 Microsoft