コード例 #1
0
        public Template(BinaryReader log, long chunkOffset, LogRoot root)
        {
            this.Position            = log.BaseStream.Position;
            this.LogRoot             = root;
            this.ChunkOffset         = chunkOffset;
            log.BaseStream.Position += 1;
            int templateID = log.ReadInt32();
            int ptr        = log.ReadInt32();

            log.BaseStream.Position = this.ChunkOffset + ptr;

            int nextTemplate = log.ReadInt32();
            int templateID2  = log.ReadInt32();

            log.BaseStream.Position -= 4;

            byte[] g            = log.ReadBytes(16);
            Guid   templateGuid = new Guid(g);

            this.Length = log.ReadInt32();
            long i = this.Length;

            this.ChildNodes = new List <INode>();
            while (i >= 0 && !root.ReachedEOS)
            {
                Console.WriteLine("Current length: " + i);
                INode node = LogNode.NewNode(log, this, chunkOffset, root);
                this.ChildNodes.Add(node);
                i -= node.Length;
                if (node is _x00)
                {
                    root.ReachedEOS = true;
                }
            }
        }
コード例 #2
0
ファイル: 0x01.cs プロジェクト: VolatileMindsLLC/evtx-sharp
        public _x01(BinaryReader log, long chunkOffset, int flags, LogRoot root, INode parent)
        {
            this.Position         = log.BaseStream.Position;
            this.LogRoot          = root;
            this.SelfEnclosed     = false;
            this.LogRoot.TagState = 1;
            this.ChunkOffset      = chunkOffset;
            _addFour = ((flags & 4) == 0) ? false : true;

            log.BaseStream.Position += 2;             //short unk1
            _length = log.ReadInt32();
            _ptr    = log.ReadInt32();
            long i = 0;

            if (!root.ParentLog.Strings.ContainsKey((long)(this.ChunkOffset + _ptr)))
            {
                log.BaseStream.Position = this.ChunkOffset + _ptr;

                _next    = log.ReadInt32();
                _hash    = log.ReadInt16();
                _length2 = log.ReadInt16();

                _posdiff    = 2;
                this.Length = _length + 6;                 //6?

                _str = log.ReadBytes((int)(_length2 * 2));
                log.BaseStream.Position += _posdiff + (_addFour ? 4 : 0);
                this.String              = root.ParentLog.Strings[this.ChunkOffset + _ptr] = System.Text.Encoding.Unicode.GetString(_str);
                i = this.Length - (11 + (_length2 + 1) * 2 + (_addFour ? 4 : 0));
            }
            else
            {
                this.String              = root.ParentLog.Strings[this.ChunkOffset + _ptr];
                _length2                 = 0;
                log.BaseStream.Position += (_addFour ? 4 : 0);
                i = this.Length - (11 + (_addFour ? 4 : 0));
            }

            this.ChildNodes = new List <INode>();
            i -= 8;
            while (i >= 0 && !root.ReachedEOS)
            {
                Console.WriteLine("Current length: " + i);
                INode node = LogNode.NewNode(log, this, chunkOffset, this.LogRoot);
                this.ChildNodes.Add(node);
                i -= node.Length;

                if (node is _x00)
                {
                    root.ReachedEOS = true;
                }
            }
        }
コード例 #3
0
        public LogRoot(BinaryReader log, long chunkOffset, uint length, EventLog parent)
        {
            this.ParentLog   = parent;
            this.Position    = log.BaseStream.Position;
            this.ChunkOffset = chunkOffset;
            this.Nodes       = new List <INode>();
            this.Strings     = new Dictionary <long, string>();
            this.Length      = length;

            while (this.Length >= 0 && !this.ReachedEOS)
            {
                INode node = LogNode.NewNode(log, this, chunkOffset, this);
                this.Nodes.Add(node);
                this.Length -= node.Length;

                if (node is _x00)
                {
                    this.ReachedEOS = true;
                }
            }

            this.SubstitutionArray = new SubstitutionArray(log, chunkOffset, this);
        }