Skip to content

Commit e006d8e

Browse files
author
Willi Ballenthin
committed
scripts: print is a function, py3.
1 parent a26a68c commit e006d8e

9 files changed

Lines changed: 532 additions & 532 deletions

‎scripts/eid_record_numbers.py‎

Lines changed: 33 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -1,33 +1,33 @@
1-
from lxml.etree import XMLSyntaxError
2-
from Evtx.Evtx import Evtx
3-
from Evtx.Views import evtx_file_xml_view
4-
5-
from filter_records import get_child
6-
from filter_records import to_lxml
7-
8-
9-
def main():
10-
import argparse
11-
12-
parser = argparse.ArgumentParser(
13-
description="Print the record numbers of EVTX log entries "
14-
"that match the given EID.")
15-
parser.add_argument("evtx", type=str,
16-
help="Path to the Windows EVTX file")
17-
parser.add_argument("eid", type=int,
18-
help="The EID of records to extract")
19-
args = parser.parse_args()
20-
21-
with Evtx(args.evtx) as evtx:
22-
for xml, record in evtx_file_xml_view(evtx.get_file_header()):
23-
try:
24-
node = to_lxml(xml)
25-
except XMLSyntaxError:
26-
continue
27-
if args.eid != int(get_child(get_child(node, "System"), "EventID").text):
28-
continue
29-
print record.record_num()
30-
31-
32-
if __name__ == "__main__":
33-
main()
1+
from lxml.etree import XMLSyntaxError
2+
from Evtx.Evtx import Evtx
3+
from Evtx.Views import evtx_file_xml_view
4+
5+
from filter_records import get_child
6+
from filter_records import to_lxml
7+
8+
9+
def main():
10+
import argparse
11+
12+
parser = argparse.ArgumentParser(
13+
description="Print the record numbers of EVTX log entries "
14+
"that match the given EID.")
15+
parser.add_argument("evtx", type=str,
16+
help="Path to the Windows EVTX file")
17+
parser.add_argument("eid", type=int,
18+
help="The EID of records to extract")
19+
args = parser.parse_args()
20+
21+
with Evtx(args.evtx) as evtx:
22+
for xml, record in evtx_file_xml_view(evtx.get_file_header()):
23+
try:
24+
node = to_lxml(xml)
25+
except XMLSyntaxError:
26+
continue
27+
if args.eid != int(get_child(get_child(node, "System"), "EventID").text):
28+
continue
29+
print(record.record_num())
30+
31+
32+
if __name__ == "__main__":
33+
main()

‎scripts/evtxdump.py‎

Lines changed: 49 additions & 49 deletions
Original file line numberDiff line numberDiff line change
@@ -1,49 +1,49 @@
1-
#!/usr/bin/env python
2-
# This file is part of python-evtx.
3-
#
4-
# Copyright 2012, 2013 Willi Ballenthin <william.ballenthin@mandiant.com>
5-
# while at Mandiant <http://www.mandiant.com>
6-
#
7-
# Licensed under the Apache License, Version 2.0 (the "License");
8-
# you may not use this file except in compliance with the License.
9-
# You may obtain a copy of the License at
10-
#
11-
# http://www.apache.org/licenses/LICENSE-2.0
12-
#
13-
# Unless required by applicable law or agreed to in writing, software
14-
# distributed under the License is distributed on an "AS IS" BASIS,
15-
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16-
# See the License for the specific language governing permissions and
17-
# limitations under the License.
18-
#
19-
# Version v0.1.1
20-
import mmap
21-
import contextlib
22-
23-
import argparse
24-
25-
from Evtx.Evtx import FileHeader
26-
from Evtx.Views import evtx_file_xml_view
27-
28-
29-
def main():
30-
parser = argparse.ArgumentParser(
31-
description="Dump a binary EVTX file into XML.")
32-
parser.add_argument("--cleanup", action="store_true",
33-
help="Cleanup unused XML entities (slower)"),
34-
parser.add_argument("evtx", type=str,
35-
help="Path to the Windows EVTX event log file")
36-
args = parser.parse_args()
37-
38-
with open(args.evtx, 'r') as f:
39-
with contextlib.closing(mmap.mmap(f.fileno(), 0,
40-
access=mmap.ACCESS_READ)) as buf:
41-
fh = FileHeader(buf, 0x0)
42-
print "<?xml version=\"1.0\" encoding=\"utf-8\" standalone=\"yes\" ?>"
43-
print "<Events>"
44-
for xml, record in evtx_file_xml_view(fh):
45-
print xml
46-
print "</Events>"
47-
48-
if __name__ == "__main__":
49-
main()
1+
#!/usr/bin/env python
2+
# This file is part of python-evtx.
3+
#
4+
# Copyright 2012, 2013 Willi Ballenthin <william.ballenthin@mandiant.com>
5+
# while at Mandiant <http://www.mandiant.com>
6+
#
7+
# Licensed under the Apache License, Version 2.0 (the "License");
8+
# you may not use this file except in compliance with the License.
9+
# You may obtain a copy of the License at
10+
#
11+
# http://www.apache.org/licenses/LICENSE-2.0
12+
#
13+
# Unless required by applicable law or agreed to in writing, software
14+
# distributed under the License is distributed on an "AS IS" BASIS,
15+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16+
# See the License for the specific language governing permissions and
17+
# limitations under the License.
18+
#
19+
# Version v0.1.1
20+
import mmap
21+
import contextlib
22+
23+
import argparse
24+
25+
from Evtx.Evtx import FileHeader
26+
from Evtx.Views import evtx_file_xml_view
27+
28+
29+
def main():
30+
parser = argparse.ArgumentParser(
31+
description="Dump a binary EVTX file into XML.")
32+
parser.add_argument("--cleanup", action="store_true",
33+
help="Cleanup unused XML entities (slower)"),
34+
parser.add_argument("evtx", type=str,
35+
help="Path to the Windows EVTX event log file")
36+
args = parser.parse_args()
37+
38+
with open(args.evtx, 'r') as f:
39+
with contextlib.closing(mmap.mmap(f.fileno(), 0,
40+
access=mmap.ACCESS_READ)) as buf:
41+
fh = FileHeader(buf, 0x0)
42+
print("<?xml version=\"1.0\" encoding=\"utf-8\" standalone=\"yes\" ?>")
43+
print("<Events>")
44+
for xml, record in evtx_file_xml_view(fh):
45+
print(xml)
46+
print("</Events>")
47+
48+
if __name__ == "__main__":
49+
main()

‎scripts/evtxinfo.py‎

Lines changed: 110 additions & 110 deletions
Original file line numberDiff line numberDiff line change
@@ -1,110 +1,110 @@
1-
#!/usr/bin/env python
2-
# This file is part of python-evtx.
3-
#
4-
# Copyright 2012, 2013 Willi Ballenthin <william.ballenthin@mandiant.com>
5-
# while at Mandiant <http://www.mandiant.com>
6-
#
7-
# Licensed under the Apache License, Version 2.0 (the "License");
8-
# you may not use this file except in compliance with the License.
9-
# You may obtain a copy of the License at
10-
#
11-
# http://www.apache.org/licenses/LICENSE-2.0
12-
#
13-
# Unless required by applicable law or agreed to in writing, software
14-
# distributed under the License is distributed on an "AS IS" BASIS,
15-
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16-
# See the License for the specific language governing permissions and
17-
# limitations under the License.
18-
#
19-
# Version v0.1
20-
21-
22-
import sys
23-
import binascii
24-
import mmap
25-
import contextlib
26-
27-
from Evtx.Evtx import FileHeader
28-
29-
30-
def main():
31-
with open(sys.argv[1], 'r') as f:
32-
with contextlib.closing(mmap.mmap(f.fileno(), 0,
33-
access=mmap.ACCESS_READ)) as buf:
34-
fh = FileHeader(buf, 0x0)
35-
36-
print "Information from file header:"
37-
print "Format version : %d.%d" % (fh.major_version(),
38-
fh.minor_version())
39-
print "Flags : 0x%08x" % (fh.flags())
40-
dirty_string = "clean"
41-
if fh.is_dirty():
42-
dirty_string = "dirty"
43-
print "File is : %s" % (dirty_string)
44-
full_string = "no"
45-
if fh.is_full():
46-
full_string = "yes"
47-
print "Log is full : %s" % (full_string)
48-
print "Current chunk : %d of %d" % (fh.current_chunk_number(),
49-
fh.chunk_count())
50-
print "Oldest chunk : %d" % (fh.oldest_chunk() + 1)
51-
print "Next record# : %d" % (fh.next_record_number())
52-
checksum_string = "fail"
53-
if fh.calculate_checksum() == fh.checksum():
54-
checksum_string = "pass"
55-
print "Check sum : %s" % (checksum_string)
56-
print ""
57-
58-
if fh.is_dirty():
59-
chunk_count = sum([1 for c in fh.chunks() if c.verify()])
60-
61-
last_chunk = None
62-
for chunk in fh.chunks():
63-
if not chunk.verify():
64-
continue
65-
last_chunk = chunk
66-
next_record_num = last_chunk.log_last_record_number() + 1
67-
68-
print "Suspected updated header values (header is dirty):"
69-
print "Current chunk : %d of %d" % (chunk_count,
70-
chunk_count)
71-
print "Next record# : %d" % (next_record_num)
72-
print ""
73-
74-
print "Information from chunks:"
75-
print " Chunk file (first/last) log (first/last) Header Data"
76-
print "- ----- --------------------- --------------------- ------ ------"
77-
for (i, chunk) in enumerate(fh.chunks(), 1):
78-
note_string = " "
79-
if i == fh.current_chunk_number() + 1:
80-
note_string = "*"
81-
elif i == fh.oldest_chunk() + 1:
82-
note_string = ">"
83-
84-
if not chunk.check_magic():
85-
if chunk.magic() == "\x00\x00\x00\x00\x00\x00\x00\x00":
86-
print "%s %4d [EMPTY]" % (note_string, i)
87-
else:
88-
print "%s %4d [INVALID]" % (note_string, i)
89-
continue
90-
91-
header_checksum_string = "fail"
92-
if chunk.calculate_header_checksum() == chunk.header_checksum():
93-
header_checksum_string = "pass"
94-
95-
data_checksum_string = "fail"
96-
if chunk.calculate_data_checksum() == chunk.data_checksum():
97-
data_checksum_string = "pass"
98-
99-
print "%s %4d %8d %8d %8d %8d %s %s" % \
100-
(note_string,
101-
i,
102-
chunk.file_first_record_number(),
103-
chunk.file_last_record_number(),
104-
chunk.log_first_record_number(),
105-
chunk.log_last_record_number(),
106-
header_checksum_string,
107-
data_checksum_string)
108-
109-
if __name__ == "__main__":
110-
main()
1+
#!/usr/bin/env python
2+
# This file is part of python-evtx.
3+
#
4+
# Copyright 2012, 2013 Willi Ballenthin <william.ballenthin@mandiant.com>
5+
# while at Mandiant <http://www.mandiant.com>
6+
#
7+
# Licensed under the Apache License, Version 2.0 (the "License");
8+
# you may not use this file except in compliance with the License.
9+
# You may obtain a copy of the License at
10+
#
11+
# http://www.apache.org/licenses/LICENSE-2.0
12+
#
13+
# Unless required by applicable law or agreed to in writing, software
14+
# distributed under the License is distributed on an "AS IS" BASIS,
15+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16+
# See the License for the specific language governing permissions and
17+
# limitations under the License.
18+
#
19+
# Version v0.1
20+
21+
22+
import sys
23+
import binascii
24+
import mmap
25+
import contextlib
26+
27+
from Evtx.Evtx import FileHeader
28+
29+
30+
def main():
31+
with open(sys.argv[1], 'r') as f:
32+
with contextlib.closing(mmap.mmap(f.fileno(), 0,
33+
access=mmap.ACCESS_READ)) as buf:
34+
fh = FileHeader(buf, 0x0)
35+
36+
print("Information from file header:")
37+
print(("Format version : %d.%d" % (fh.major_version(),
38+
fh.minor_version())))
39+
print(("Flags : 0x%08x" % (fh.flags())))
40+
dirty_string = "clean"
41+
if fh.is_dirty():
42+
dirty_string = "dirty"
43+
print(("File is : %s" % (dirty_string)))
44+
full_string = "no"
45+
if fh.is_full():
46+
full_string = "yes"
47+
print(("Log is full : %s" % (full_string)))
48+
print(("Current chunk : %d of %d" % (fh.current_chunk_number(),
49+
fh.chunk_count())))
50+
print(("Oldest chunk : %d" % (fh.oldest_chunk() + 1)))
51+
print(("Next record# : %d" % (fh.next_record_number())))
52+
checksum_string = "fail"
53+
if fh.calculate_checksum() == fh.checksum():
54+
checksum_string = "pass"
55+
print(("Check sum : %s" % (checksum_string)))
56+
print("")
57+
58+
if fh.is_dirty():
59+
chunk_count = sum([1 for c in fh.chunks() if c.verify()])
60+
61+
last_chunk = None
62+
for chunk in fh.chunks():
63+
if not chunk.verify():
64+
continue
65+
last_chunk = chunk
66+
next_record_num = last_chunk.log_last_record_number() + 1
67+
68+
print("Suspected updated header values (header is dirty):")
69+
print(("Current chunk : %d of %d" % (chunk_count,
70+
chunk_count)))
71+
print(("Next record# : %d" % (next_record_num)))
72+
print("")
73+
74+
print("Information from chunks:")
75+
print(" Chunk file (first/last) log (first/last) Header Data")
76+
print("- ----- --------------------- --------------------- ------ ------")
77+
for (i, chunk) in enumerate(fh.chunks(), 1):
78+
note_string = " "
79+
if i == fh.current_chunk_number() + 1:
80+
note_string = "*"
81+
elif i == fh.oldest_chunk() + 1:
82+
note_string = ">"
83+
84+
if not chunk.check_magic():
85+
if chunk.magic() == "\x00\x00\x00\x00\x00\x00\x00\x00":
86+
print("%s %4d [EMPTY]" % (note_string, i))
87+
else:
88+
print("%s %4d [INVALID]" % (note_string, i))
89+
continue
90+
91+
header_checksum_string = "fail"
92+
if chunk.calculate_header_checksum() == chunk.header_checksum():
93+
header_checksum_string = "pass"
94+
95+
data_checksum_string = "fail"
96+
if chunk.calculate_data_checksum() == chunk.data_checksum():
97+
data_checksum_string = "pass"
98+
99+
print("%s %4d %8d %8d %8d %8d %s %s" % \
100+
(note_string,
101+
i,
102+
chunk.file_first_record_number(),
103+
chunk.file_last_record_number(),
104+
chunk.log_first_record_number(),
105+
chunk.log_last_record_number(),
106+
header_checksum_string,
107+
data_checksum_string))
108+
109+
if __name__ == "__main__":
110+
main()

0 commit comments

Comments
 (0)