fix deprecation warnings

Author: williballenthin

Evtx/BinaryParser.py

@@ -20,7 +20,7 @@
 from __future__ import absolute_import
 
 import struct
-from datetime import datetime
+import datetime
 from functools import partial
 
 
@@ -96,20 +96,20 @@ def dosdate(dosdate, dostime):
         minute  = (t & 0b0000011111100000) >> 5
         hour    = (t & 0b1111100000000000) >> 11
 
-        return datetime(year, month, day, hour, minute, sec)
+        return datetime.datetime(year, month, day, hour, minute, sec)
     except:
-        return datetime.min
+        return datetime.datetime.min
 
 
 def parse_filetime(qword):
     # see http://integriography.wordpress.com/2010/01/16/using-phython-to-parse-and-present-windows-64-bit-timestamps/
     if qword == 0:
-        return datetime.min
+        return datetime.datetime.min
 
     try:
-        return datetime.utcfromtimestamp(float(qword) * 1e-7 - 11644473600)
+        return datetime.datetime.fromtimestamp(float(qword) * 1e-7 - 11644473600, datetime.UTC)
     except (ValueError, OSError):
-        return datetime.min
+        return datetime.datetime.min
 
 
 class BinaryParserException(Exception):
@@ -533,10 +533,10 @@ def unpack_systemtime(self, offset):
             parts = struct.unpack_from("<HHHHHHHH", self._buf, o)
         except struct.error:
             raise OverrunBufferException(o, len(self._buf))
-        return datetime(parts[0], parts[1],
-                        parts[3],  # skip part 2 (day of week)
-                        parts[4], parts[5],
-                        parts[6], parts[7])
+        return datetime.datetime(parts[0], parts[1],
+                                parts[3],  # skip part 2 (day of week)
+                                parts[4], parts[5],
+                                parts[6], parts[7])
 
     def unpack_guid(self, offset):
         """

tests/fixtures.py

@@ -19,7 +19,7 @@ def system_path():
     return systempath
 
 
-@pytest.yield_fixture
+@pytest.fixture
 def system():
     '''
     yields the contents of the system.evtx test file.
@@ -49,7 +49,7 @@ def security_path():
     return secpath
 
 
-@pytest.yield_fixture
+@pytest.fixture
 def security():
     '''
     yields the contents of the security.evtx test file.

tests/test_issue_39.py

@@ -44,5 +44,5 @@ def test_systemtime(data_path):
                 continue
 
             time_created = get_children(record.lxml(), ['System', 'TimeCreated'])
-            assert time_created.get('SystemTime') == '2017-04-21 07:41:17.003393'
+            assert time_created.get('SystemTime') == '2017-04-21 07:41:17.003393+00:00'
 

tests/test_records.py

@@ -209,7 +209,7 @@ def test_parse_record(system):
           ['UnsignedWordTypeNode', '105'],
           ['NullTypeNode'],
           ['Hex64TypeNode', '0x8000000000000000'],
-          ['FiletimeTypeNode', '2012-03-14 04:17:43.354563'],
+          ['FiletimeTypeNode', '2012-03-14 04:17:43.354563+00:00'],
           ['NullTypeNode'],
           ['UnsignedDwordTypeNode', '820'],
           ['UnsignedDwordTypeNode', '2868'],
@@ -248,7 +248,7 @@ def test_parse_record(system):
                     ['EndOfStreamNode']]]]],
               ['Substitutions', None, [
                 ['WstringTypeNode', 'System'],
-                ['WstringTypeNode', 'C:\Windows\System32\Winevt\Logs\Archive-System-2012-03-14-04-17-39-932.evtx']]]]]]]]]]]
+                ['WstringTypeNode', r'C:\Windows\System32\Winevt\Logs\Archive-System-2012-03-14-04-17-39-932.evtx']]]]]]]]]]]
 
     assert extract_structure(record.root()) == expected
 
@@ -273,7 +273,7 @@ def test_render_record(system):
                                      <Task>105</Task>
                                      <Opcode>0</Opcode>
                                      <Keywords>0x8000000000000000</Keywords>
-                                     <TimeCreated SystemTime="2012-03-14 04:17:43.354563"></TimeCreated>
+                                     <TimeCreated SystemTime="2012-03-14 04:17:43.354563+00:00"></TimeCreated>
                                      <EventRecordID>12049</EventRecordID>
                                      <Correlation ActivityID="" RelatedActivityID=""></Correlation>
                                      <Execution ProcessID="820" ThreadID="2868"></Execution>