Showing results for 
Search instead for 
Did you mean: 

Why doesn't FormatMessage return the message text from an EventLog message DLL?

Why doesn't FormatMessage return the message text from an EventLog message DLL?

I have created a CVI test project using the SDK to exploit the Windows Event Log. I can successfully generate an event using the functions: RegisterEventSource, ReportEvent, & DeregisterEventSource. The event is verified using the Windows Event Viewer.

Then I try using LoadLibraryEx and FormatMessage to retrieve and display the event description. LoadLibraryEx returns a handle to the message DLL. FormatMessage is always returning an empty string (and good status). I've built the message DLL according to the steps described in the SDK documentation (create a .mc file, compile into a .rc file using mc, use rc to generate a .res file, etc.) I'm using CVI to build the DLL. It seems to like the .res file as an input. (Likewise, if I try to get details on
the event in the Event Viewer I get a message indicating no further information is available.)

Has anyone else been able to successfully create a message DLL from within CVI and get the Windows Event Viewer to display them?
0 Kudos
Message 1 of 2

Re: Why doesn't FormatMessage return the message text from an EventLog message DLL?

Hello DAD,

The main reason why the Event Viewer indicated that there was no information available in your message is because the DLL you created in CVI is not formatted as a resource-only DLL.
I would suggest creating a resource-only DLL using another tool (Visual Basic, etc). The steps to create a resource-only DLL in VB are as follows:

(courtesy of
"Create an ActiveX DLL project and rename the default "Class1" class module to "NoInterface" (or something like that) to indicate that this ActiveX DLL isn't meant to be instantiated and called as a COM object, but rather meant to be a static source of resources. Next, open up the resource editor and add your custom resources and save the resource as part of the ActiveX DLL project. Compile and build your DLL."

If you do not have Visual Studio, I have attached a resource-only DLL which includes your sample resource file (ELTMessages.res).

1) Manually copy the attached DLL (or the one you create) into the system32 directory.
2) Edit the line: strcpy(szBuf, "C:\\WINDOWS\\system32\\Project1.dll");
with the name of your new DLL.
3) Then, you can delete the ELT registry key so that the key is created with the new path to the resource-only DLL.
4) Finally the message returned by FormatMessage() should be of type LPTSTR instead of an array of UCHAR.
In particular, the call should look like:
LPTSTR Message;
(LPSTR) &Message, 0, NULL);

Hope this helps.
Message 2 of 2