如何使用Rust和winapi板条箱在Windows中为事件创建订阅？

How to create a subscription for events in Windows using Rust and the winapi crate?

我正在尝试使用Winapi板条箱中的EvtSubscribe订阅Windows事件，但是却获得了ERROR_INVALID_PARAMETER。

我在Rust中找不到示例，但确实找到了C示例。

我的产生ERROR_INVALID_PARAMETER的代码：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39

fn main() {
unsafe {
let mut callback: winapi::um::winevt::EVT_SUBSCRIBE_CALLBACK = None;
let mut session = std::ptr::null_mut();
let mut signal_event = std::ptr::null_mut();

let mut bookmark = std::ptr::null_mut();
let mut context = std::ptr::null_mut();
let channel_path ="Security";
let channel_path: winnt::LPWSTR = to_wchar(channel_path);
let query ="Event/System[EventID=4624]";
let query: winnt::LPWSTR = to_wchar(query);

let event_handle = winevt::EvtSubscribe(
session,
signal_event,
channel_path,
query,
bookmark,
context,
callback,
winevt::EvtSubscribeStartAtOldestRecord,
);

//println!("{:?}", &event_handle);
println!("{:?}", &winapi::um::errhandlingapi::GetLastError());
} //unsafe end
}

fn to_vec(str: &str) -> Vec<u16> {
return OsStr::new(str)
.encode_wide()
.chain(Some(0).into_iter())
.collect();
}

fn to_wchar(str: &str) -> *mut u16 {
return to_vec(str).as_mut_ptr();
}