Comments (7)
williballenthin
commented on June 15, 2024
hey @john-corcoran
Thanks for raising this issue. The easiest way to triage it will be to share the .evtx file. I'd be happy to take a peek if you send to my email: [email protected]
from python-evtx.
williballenthin
commented on June 15, 2024
@john-corcoran just wanted to let you know i still have my eye on this issue. been doing some traveling so haven't had as much time as i'd have liked to triage the bug. the evtx files you provided should be enough for me to figure things out in the next few days.
from python-evtx.
williballenthin
commented on June 15, 2024
I suspect this evtx file is corrupt. For example, when I simply print the record numbers, we get output like:
[...]
180
181
182
183
184
185
186
187
188
7999193089
[exception traceback]
clearly, 7999193089 is not a valid record number. I think expected behavior would be to identify this corruption earlier, and then notify the user that something is wrong (rather than trying to interpret invalid data).
from python-evtx.
williballenthin
commented on June 15, 2024
evtx_info.py also fails:
λ C:\Users\user\env2\Scripts\python ..\scripts\evtx_info.py data\issue_45.evtx
Information from file header:
Format version : 3.1
Flags : 0x00000000
File is : clean
Log is full : no
Current chunk : 2 of 3
Oldest chunk : 1
Next record# : 189
Check sum : pass
Information from chunks:
Chunk file (first/last) log (first/last) Header Data
- ----- --------------------- --------------------- ------ ------
> 1 1 66 1 66 pass pass
2 67 123 67 123 pass pass
* 3 124 188 124 188 pass pass
Traceback (most recent call last):
File "..\scripts\evtx_info.py", line 109, in <module>
main()
File "..\scripts\evtx_info.py", line 82, in main
if not chunk.check_magic():
File "c:\users\user\documents\code\python-evtx\Evtx\Evtx.py", line 308, in check_magic
return self.magic() == "ElfChnk\x00"
File "c:\users\user\documents\code\python-evtx\Evtx\BinaryParser.py", line 211, in explicit_length_handler
return f(offset, length)
File "c:\users\user\documents\code\python-evtx\Evtx\BinaryParser.py", line 475, in unpack_string
return self.unpack_binary(offset, length).decode('ascii')
UnicodeDecodeError: 'ascii' codec can't decode byte 0xa1 in position 2: ordinal not in range(128)
from python-evtx.
williballenthin
commented on June 15, 2024
seems like this file contains junk data after 3 valid chunks:
λ C:\Users\user\env2\Scripts\python ..\scripts\evtx_info.py data\issue_45.evtx
Information from file header:
Format version : 3.1
Flags : 0x00000000
File is : clean
Log is full : no
Current chunk : 2 of 3
Oldest chunk : 1
Next record# : 189
Check sum : pass
Information from chunks:
Chunk file (first/last) log (first/last) Header Data
- ----- --------------------- --------------------- ------ ------
> 1 1 66 1 66 pass pass
2 67 123 67 123 pass pass
* 3 124 188 124 188 pass pass
4 [INVALID]
5 [INVALID]
6 [INVALID]
7 [INVALID]
8 [INVALID]
9 [INVALID]
10 [INVALID]
11 [INVALID]
12 [INVALID]
13 [INVALID]
14 [INVALID]
15 [INVALID]
16 [INVALID]
commits 5d2754f and 1ed29cf improve the robustness of the code that parses chunks.
from python-evtx.
williballenthin
commented on June 15, 2024
i think the issue is that when enumerating chunks (and therefore records) via the Evtx log object, the log object doesn't take into account how many chunks are declared to be in the log file. Instead, it keeps reading until the end of the file. So, if there's junk data appended to the file, it attempts to parse this as valid data. See here:
Line 92 in 5fb7662
from python-evtx.
williballenthin
commented on June 15, 2024
confirmed the theory above, and addressed the issue in df8edf4.
thanks to @john-corcoran for reporting this issue!
from python-evtx.
Related Issues (20)
- utf decode error in unpack_wstring HOT 1
- KeyError in processing_instruction_target
- Modify parsing exceptions (errors when parsing non-uniform substrings of null values)
- Log Size HOT 2
- Make the package working with pytest4 (and two cosmetic nit-fixes) HOT 1
- setup.py issues on Ubuntu 18.04.3, pip pinning needed HOT 1
- UnicodeDecodeError on BinaryParser
- OSError: [Errno 22] Invalid argument HOT 2
- AccessList values map HOT 1
- parse_filetime error HOT 6
- AttributeError: module 'evtx' has no attribute 'Evtx' HOT 3
- evtx_dump_chunk_slack: write argument must be str not bytes HOT 1
- Get the task to task category mapping
- format xml to binary xml HOT 2
- Update project url? HOT 4
- Dump in JSON format HOT 2
- parse data from dirty chunks HOT 2
- Loop through the records in reversed order HOT 1
- Slow performance compared to https://github.com/0xrawsec/golang-evtx HOT 1
- It is not returning all events
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from python-evtx.