Skip to content

Commit 84a03b3

Browse files
williballenthinwilliballenthin
committed
*: dos2unix
1 parent fad7659 commit 84a03b3

9 files changed

Lines changed: 544 additions & 544 deletions

‎scripts/evtx_dump.py‎

Lines changed: 53 additions & 53 deletions
Original file line numberDiff line numberDiff line change
@@ -1,53 +1,53 @@
1-
#!/usr/bin/env python
2-
# This file is part of python-evtx.
3-
#
4-
# Copyright 2012, 2013 Willi Ballenthin <william.ballenthin@mandiant.com>
5-
# while at Mandiant <http://www.mandiant.com>
6-
#
7-
# Licensed under the Apache License, Version 2.0 (the "License");
8-
# you may not use this file except in compliance with the License.
9-
# You may obtain a copy of the License at
10-
#
11-
# http://www.apache.org/licenses/LICENSE-2.0
12-
#
13-
# Unless required by applicable law or agreed to in writing, software
14-
# distributed under the License is distributed on an "AS IS" BASIS,
15-
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16-
# See the License for the specific language governing permissions and
17-
# limitations under the License.
18-
#
19-
# Version v0.1.1
20-
import mmap
21-
import contextlib
22-
23-
import argparse
24-
25-
from Evtx.Evtx import FileHeader
26-
from Evtx.Views import evtx_file_xml_view
27-
28-
29-
def ascii(s):
30-
return s.encode('ascii', 'replace').decode('ascii')
31-
32-
33-
def main():
34-
parser = argparse.ArgumentParser(
35-
description="Dump a binary EVTX file into XML.")
36-
parser.add_argument("--cleanup", action="store_true",
37-
help="Cleanup unused XML entities (slower)"),
38-
parser.add_argument("evtx", type=str,
39-
help="Path to the Windows EVTX event log file")
40-
args = parser.parse_args()
41-
42-
with open(args.evtx, 'r') as f:
43-
with contextlib.closing(mmap.mmap(f.fileno(), 0,
44-
access=mmap.ACCESS_READ)) as buf:
45-
fh = FileHeader(buf, 0x0)
46-
print("<?xml version=\"1.0\" encoding=\"utf-8\" standalone=\"yes\" ?>")
47-
print("<Events>")
48-
for xml, record in evtx_file_xml_view(fh):
49-
print(ascii(xml))
50-
print("</Events>")
51-
52-
if __name__ == "__main__":
53-
main()
1+
#!/usr/bin/env python
2+
# This file is part of python-evtx.
3+
#
4+
# Copyright 2012, 2013 Willi Ballenthin <william.ballenthin@mandiant.com>
5+
# while at Mandiant <http://www.mandiant.com>
6+
#
7+
# Licensed under the Apache License, Version 2.0 (the "License");
8+
# you may not use this file except in compliance with the License.
9+
# You may obtain a copy of the License at
10+
#
11+
# http://www.apache.org/licenses/LICENSE-2.0
12+
#
13+
# Unless required by applicable law or agreed to in writing, software
14+
# distributed under the License is distributed on an "AS IS" BASIS,
15+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16+
# See the License for the specific language governing permissions and
17+
# limitations under the License.
18+
#
19+
# Version v0.1.1
20+
import mmap
21+
import contextlib
22+
23+
import argparse
24+
25+
from Evtx.Evtx import FileHeader
26+
from Evtx.Views import evtx_file_xml_view
27+
28+
29+
def ascii(s):
30+
return s.encode('ascii', 'replace').decode('ascii')
31+
32+
33+
def main():
34+
parser = argparse.ArgumentParser(
35+
description="Dump a binary EVTX file into XML.")
36+
parser.add_argument("--cleanup", action="store_true",
37+
help="Cleanup unused XML entities (slower)"),
38+
parser.add_argument("evtx", type=str,
39+
help="Path to the Windows EVTX event log file")
40+
args = parser.parse_args()
41+
42+
with open(args.evtx, 'r') as f:
43+
with contextlib.closing(mmap.mmap(f.fileno(), 0,
44+
access=mmap.ACCESS_READ)) as buf:
45+
fh = FileHeader(buf, 0x0)
46+
print("<?xml version=\"1.0\" encoding=\"utf-8\" standalone=\"yes\" ?>")
47+
print("<Events>")
48+
for xml, record in evtx_file_xml_view(fh):
49+
print(ascii(xml))
50+
print("</Events>")
51+
52+
if __name__ == "__main__":
53+
main()

‎scripts/evtx_eid_record_numbers.py‎

Lines changed: 35 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -1,35 +1,35 @@
1-
#!/usr/bin/env python
2-
3-
from lxml.etree import XMLSyntaxError
4-
from Evtx.Evtx import Evtx
5-
from Evtx.Views import evtx_file_xml_view
6-
7-
from filter_records import get_child
8-
from filter_records import to_lxml
9-
10-
11-
def main():
12-
import argparse
13-
14-
parser = argparse.ArgumentParser(
15-
description="Print the record numbers of EVTX log entries "
16-
"that match the given EID.")
17-
parser.add_argument("evtx", type=str,
18-
help="Path to the Windows EVTX file")
19-
parser.add_argument("eid", type=int,
20-
help="The EID of records to extract")
21-
args = parser.parse_args()
22-
23-
with Evtx(args.evtx) as evtx:
24-
for xml, record in evtx_file_xml_view(evtx.get_file_header()):
25-
try:
26-
node = to_lxml(xml)
27-
except XMLSyntaxError:
28-
continue
29-
if args.eid != int(get_child(get_child(node, "System"), "EventID").text):
30-
continue
31-
print(record.record_num())
32-
33-
34-
if __name__ == "__main__":
35-
main()
1+
#!/usr/bin/env python
2+
3+
from lxml.etree import XMLSyntaxError
4+
from Evtx.Evtx import Evtx
5+
from Evtx.Views import evtx_file_xml_view
6+
7+
from filter_records import get_child
8+
from filter_records import to_lxml
9+
10+
11+
def main():
12+
import argparse
13+
14+
parser = argparse.ArgumentParser(
15+
description="Print the record numbers of EVTX log entries "
16+
"that match the given EID.")
17+
parser.add_argument("evtx", type=str,
18+
help="Path to the Windows EVTX file")
19+
parser.add_argument("eid", type=int,
20+
help="The EID of records to extract")
21+
args = parser.parse_args()
22+
23+
with Evtx(args.evtx) as evtx:
24+
for xml, record in evtx_file_xml_view(evtx.get_file_header()):
25+
try:
26+
node = to_lxml(xml)
27+
except XMLSyntaxError:
28+
continue
29+
if args.eid != int(get_child(get_child(node, "System"), "EventID").text):
30+
continue
31+
print(record.record_num())
32+
33+
34+
if __name__ == "__main__":
35+
main()

‎scripts/evtx_filter_records.py‎

Lines changed: 65 additions & 65 deletions
Original file line numberDiff line numberDiff line change
@@ -1,65 +1,65 @@
1-
#!/usr/bin/env python
2-
3-
from lxml import etree
4-
#import xml.etree.cElementTree as etree
5-
6-
from Evtx.Evtx import Evtx
7-
from Evtx.Views import evtx_file_xml_view
8-
9-
10-
def to_lxml(record_xml):
11-
"""
12-
@type record: Record
13-
"""
14-
return etree.fromstring("<?xml version=\"1.0\" encoding=\"utf-8\" standalone=\"yes\" ?>%s" %
15-
record_xml)
16-
17-
18-
def xml_records(filename):
19-
"""
20-
If the second return value is not None, then it is an
21-
Exception encountered during parsing. The first return value
22-
will be the XML string.
23-
24-
@type filename str
25-
@rtype: generator of (etree.Element or str), (None or Exception)
26-
"""
27-
with Evtx(filename) as evtx:
28-
for xml, record in evtx_file_xml_view(evtx.get_file_header()):
29-
try:
30-
yield to_lxml(xml), None
31-
except etree.XMLSyntaxError as e:
32-
yield xml, e
33-
34-
35-
def get_child(node, tag, ns="{http://schemas.microsoft.com/win/2004/08/events/event}"):
36-
"""
37-
@type node: etree.Element
38-
@type tag: str
39-
@type ns: str
40-
"""
41-
return node.find("%s%s" % (ns, tag))
42-
43-
44-
def main():
45-
import argparse
46-
47-
parser = argparse.ArgumentParser(
48-
description="Print only entries from an EVTX file with a given EID.")
49-
parser.add_argument("evtx", type=str,
50-
help="Path to the Windows EVTX file")
51-
parser.add_argument("eid", type=int,
52-
help="The EID of records to print")
53-
54-
args = parser.parse_args()
55-
56-
for node, err in xml_records(args.evtx):
57-
if err is not None:
58-
continue
59-
sys = get_child(node, "System")
60-
if args.eid == int(get_child(sys, "EventID").text):
61-
print(etree.tostring(node, pretty_print=True))
62-
63-
64-
if __name__ == "__main__":
65-
main()
1+
#!/usr/bin/env python
2+
3+
from lxml import etree
4+
#import xml.etree.cElementTree as etree
5+
6+
from Evtx.Evtx import Evtx
7+
from Evtx.Views import evtx_file_xml_view
8+
9+
10+
def to_lxml(record_xml):
11+
"""
12+
@type record: Record
13+
"""
14+
return etree.fromstring("<?xml version=\"1.0\" encoding=\"utf-8\" standalone=\"yes\" ?>%s" %
15+
record_xml)
16+
17+
18+
def xml_records(filename):
19+
"""
20+
If the second return value is not None, then it is an
21+
Exception encountered during parsing. The first return value
22+
will be the XML string.
23+
24+
@type filename str
25+
@rtype: generator of (etree.Element or str), (None or Exception)
26+
"""
27+
with Evtx(filename) as evtx:
28+
for xml, record in evtx_file_xml_view(evtx.get_file_header()):
29+
try:
30+
yield to_lxml(xml), None
31+
except etree.XMLSyntaxError as e:
32+
yield xml, e
33+
34+
35+
def get_child(node, tag, ns="{http://schemas.microsoft.com/win/2004/08/events/event}"):
36+
"""
37+
@type node: etree.Element
38+
@type tag: str
39+
@type ns: str
40+
"""
41+
return node.find("%s%s" % (ns, tag))
42+
43+
44+
def main():
45+
import argparse
46+
47+
parser = argparse.ArgumentParser(
48+
description="Print only entries from an EVTX file with a given EID.")
49+
parser.add_argument("evtx", type=str,
50+
help="Path to the Windows EVTX file")
51+
parser.add_argument("eid", type=int,
52+
help="The EID of records to print")
53+
54+
args = parser.parse_args()
55+
56+
for node, err in xml_records(args.evtx):
57+
if err is not None:
58+
continue
59+
sys = get_child(node, "System")
60+
if args.eid == int(get_child(sys, "EventID").text):
61+
print(etree.tostring(node, pretty_print=True))
62+
63+
64+
if __name__ == "__main__":
65+
main()

‎scripts/evtx_find_bugs.py‎

Lines changed: 45 additions & 45 deletions
Original file line numberDiff line numberDiff line change
@@ -1,45 +1,45 @@
1-
#!/usr/bin/env python
2-
# This file is part of python-evtx.
3-
#
4-
# Copyright 2012, 2013 Willi Ballenthin <william.ballenthin@mandiant.com>
5-
# while at Mandiant <http://www.mandiant.com>
6-
#
7-
# Licensed under the Apache License, Version 2.0 (the "License");
8-
# you may not use this file except in compliance with the License.
9-
# You may obtain a copy of the License at
10-
#
11-
# http://www.apache.org/licenses/LICENSE-2.0
12-
#
13-
# Unless required by applicable law or agreed to in writing, software
14-
# distributed under the License is distributed on an "AS IS" BASIS,
15-
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16-
# See the License for the specific language governing permissions and
17-
# limitations under the License.
18-
#
19-
# Version v0.1.1
20-
21-
22-
import sys
23-
import mmap
24-
import contextlib
25-
from Evtx.Evtx import FileHeader
26-
from Evtx.Views import evtx_record_xml_view
27-
28-
29-
def main():
30-
with open(sys.argv[1], 'r') as f:
31-
with contextlib.closing(mmap.mmap(f.fileno(), 0,
32-
access=mmap.ACCESS_READ)) as buf:
33-
fh = FileHeader(buf, 0x0)
34-
for chunk in fh.chunks():
35-
for record in chunk.records():
36-
try:
37-
evtx_record_xml_view(record).encode("utf-8")
38-
except Exception as e:
39-
print(str(e))
40-
print(repr(e))
41-
print(evtx_record_xml_view(record).encode("utf-8"))
42-
return
43-
44-
if __name__ == "__main__":
45-
main()
1+
#!/usr/bin/env python
2+
# This file is part of python-evtx.
3+
#
4+
# Copyright 2012, 2013 Willi Ballenthin <william.ballenthin@mandiant.com>
5+
# while at Mandiant <http://www.mandiant.com>
6+
#
7+
# Licensed under the Apache License, Version 2.0 (the "License");
8+
# you may not use this file except in compliance with the License.
9+
# You may obtain a copy of the License at
10+
#
11+
# http://www.apache.org/licenses/LICENSE-2.0
12+
#
13+
# Unless required by applicable law or agreed to in writing, software
14+
# distributed under the License is distributed on an "AS IS" BASIS,
15+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16+
# See the License for the specific language governing permissions and
17+
# limitations under the License.
18+
#
19+
# Version v0.1.1
20+
21+
22+
import sys
23+
import mmap
24+
import contextlib
25+
from Evtx.Evtx import FileHeader
26+
from Evtx.Views import evtx_record_xml_view
27+
28+
29+
def main():
30+
with open(sys.argv[1], 'r') as f:
31+
with contextlib.closing(mmap.mmap(f.fileno(), 0,
32+
access=mmap.ACCESS_READ)) as buf:
33+
fh = FileHeader(buf, 0x0)
34+
for chunk in fh.chunks():
35+
for record in chunk.records():
36+
try:
37+
evtx_record_xml_view(record).encode("utf-8")
38+
except Exception as e:
39+
print(str(e))
40+
print(repr(e))
41+
print(evtx_record_xml_view(record).encode("utf-8"))
42+
return
43+
44+
if __name__ == "__main__":
45+
main()

0 commit comments

Comments
 (0)