[ { "path": ".codecov.yml", "content": "coverage:\n precision: 2\n round: down\n range: 70...100\n status:\n project: true\n patch: true\n changes: false\n ignore:\n - \"libbfio/*\"\n - \"libcdata/*\"\n - \"libcdirectory/*\"\n - \"libcerror/*\"\n - \"libcfile/*\"\n - \"libclocale/*\"\n - \"libcnotify/*\"\n - \"libcpath/*\"\n - \"libcsplit/*\"\n - \"libcthreads/*\"\n - \"libexe/*\"\n - \"libfcache/*\"\n - \"libfdata/*\"\n - \"libfdatetime/*\"\n - \"libfguid/*\"\n - \"libfvalue/*\"\n - \"libfwevt/*\"\n - \"libfwnt/*\"\n - \"libregf/*\"\n - \"libuna/*\"\n - \"libwrc/*\"\n - \"tests/*\"\n" }, { "path": ".github/workflows/build.yml", "content": "# Build from source.\nname: build\non: [push, pull_request]\npermissions: read-all\njobs:\n build_ubuntu:\n runs-on: ubuntu-latest\n strategy:\n matrix:\n include:\n - architecture: 'x86'\n compiler: 'clang'\n configure_options: ''\n - architecture: 'x64'\n compiler: 'clang'\n configure_options: ''\n - architecture: 'x86'\n compiler: 'gcc'\n configure_options: ''\n - architecture: 'x64'\n compiler: 'gcc'\n configure_options: ''\n - architecture: 'x64'\n compiler: 'gcc'\n configure_options: '--with-pthread=no'\n - architecture: 'x64'\n compiler: 'gcc'\n configure_options: '--enable-wide-character-type'\n - architecture: 'x64'\n compiler: 'gcc'\n configure_options: '--enable-static-executables=yes --enable-multi-threading-support=no'\n steps:\n - uses: actions/checkout@v5\n - name: Install build dependencies\n run: |\n sudo apt-get -y install autoconf automake autopoint build-essential git libtool pkg-config\n - name: Download test data\n run: |\n if test -x \"synctestdata.sh\"; then ./synctestdata.sh; fi\n - name: Building from source\n env:\n CC: ${{ matrix.compiler }}\n run: |\n tests/build.sh ${{ matrix.configure_options }}\n - name: Run tests\n run: |\n tests/runtests.sh\n build_dist:\n runs-on: ubuntu-latest\n strategy:\n matrix:\n include:\n - architecture: 'x64'\n compiler: 'gcc'\n configure_options: ''\n steps:\n - uses: actions/checkout@v5\n - name: Install build dependencies\n run: |\n sudo apt-get -y install autoconf automake autopoint build-essential git libtool pkg-config\n - name: Download test data\n run: |\n if test -x \"synctestdata.sh\"; then ./synctestdata.sh; fi\n - name: Building from source\n env:\n CC: ${{ matrix.compiler }}\n run: |\n tests/build.sh ${{ matrix.configure_options }}\n - name: Run tests\n run: |\n make distcheck\n build_python_ubuntu:\n runs-on: ubuntu-latest\n strategy:\n matrix:\n include:\n - architecture: 'x64'\n compiler: 'gcc'\n configure_options: '--enable-python'\n python_version: ''\n steps:\n - uses: actions/checkout@v5\n - name: Install build dependencies\n run: |\n sudo add-apt-repository universe &&\n sudo apt-get update &&\n sudo apt-get -y install autoconf automake autopoint build-essential git libtool pkg-config python3-dev python-dev-is-python3\n - name: Download test data\n run: |\n if test -x \"synctestdata.sh\"; then ./synctestdata.sh; fi\n - name: Building from source\n env:\n CC: ${{ matrix.compiler }}\n run: |\n tests/build.sh ${{ matrix.configure_options }}\n - name: Run tests\n env:\n PYTHON_VERSION: ${{ matrix.python_version }}\n run: |\n tests/runtests.sh\n build_setup_py_ubuntu:\n runs-on: ubuntu-latest\n strategy:\n matrix:\n include:\n - architecture: 'x64'\n compiler: 'gcc'\n configure_options: ''\n python-version: '3.10'\n steps:\n - uses: actions/checkout@v5\n - name: Set up Python ${{ matrix.python-version }}\n uses: actions/setup-python@v5\n with:\n python-version: ${{ matrix.python-version }}\n - name: Install build dependencies\n run: |\n sudo add-apt-repository universe &&\n sudo apt-get update &&\n sudo apt-get -y install autoconf automake autopoint build-essential git libtool pkg-config python3-dev python-dev-is-python3\n - name: Building from source\n env:\n CC: ${{ matrix.compiler }}\n run: |\n tests/build.sh ${{ matrix.configure_options }}\n - name: Build Python module\n run: |\n python setup.py build\n coverage_ubuntu:\n runs-on: ubuntu-latest\n strategy:\n matrix:\n include:\n - architecture: 'x86'\n compiler: 'gcc'\n configure_options: '--enable-wide-character-type'\n - architecture: 'x64'\n compiler: 'gcc'\n configure_options: '--enable-wide-character-type'\n steps:\n - uses: actions/checkout@v5\n - name: Install build dependencies\n run: |\n sudo apt-get -y install autoconf automake autopoint build-essential git libtool pkg-config\n - name: Download test data\n run: |\n if test -x \"synctestdata.sh\"; then ./synctestdata.sh; fi\n - name: Building from source\n env:\n CC: ${{ matrix.compiler }}\n run: |\n tests/build.sh ${{ matrix.configure_options }} --enable-shared=no CFLAGS=\"--coverage -O0\" CPPFLAGS=\"-DOPTIMIZATION_DISABLED\" LDFLAGS=\"--coverage\"\n - name: Run tests\n run: |\n make check CHECK_WITH_STDERR=1 SKIP_TOOLS_END_TO_END_TESTS=1\n - name: Generate coverage data\n run: |\n for DIRECTORY in `find . -maxdepth 1 -type d`; do \\\n (cd ${DIRECTORY} && find . -maxdepth 1 -name \\*.gcno -type f -exec gcov -pb {} \\;) \\\n done\n - name: Upload coverage report to Codecov\n uses: codecov/codecov-action@v5\n with:\n name: linux-${{ matrix.architecture }}-gcc-no-optimization\n token: ${{ secrets.CODECOV_TOKEN }}\n" }, { "path": ".github/workflows/build_freebsd.yml", "content": "# Build from source on FreeBSD.\nname: build_freebsd\non: [push]\npermissions: read-all\njobs:\n build_freebsd:\n runs-on: ubuntu-latest\n steps:\n - uses: actions/checkout@v5\n - name: Building from source\n id: build_freebsd\n uses: vmactions/freebsd-vm@v1\n with:\n usesh: true\n mem: 4096\n # Note that the test scripts require bash\n prepare: |\n pkg install -y autoconf automake bash gettext git libtool pkgconf\n run: |\n tests/build.sh\n tests/runtests.sh\n" }, { "path": ".github/workflows/build_macos.yml", "content": "# Build from source.\nname: build_macos\non: [push, pull_request]\npermissions: read-all\njobs:\n build_macos:\n runs-on: ${{ matrix.os }}\n strategy:\n matrix:\n include:\n - os: macos-14\n configure_options: ''\n - os: macos-15\n configure_options: ''\n - os: macos-15-intel\n configure_options: ''\n - os: macos-26\n configure_options: ''\n steps:\n - uses: actions/checkout@v5\n - name: Install build dependencies\n run: |\n brew update -q\n brew install -q autoconf automake gettext gnu-sed libtool pkg-config || true\n brew link --force gettext\n ln -s /usr/local/bin/glibtoolize /usr/local/bin/libtoolize\n - name: Download test data\n run: |\n if test -x \"synctestdata.sh\"; then ./synctestdata.sh; fi\n - name: Building from source\n env:\n CC: ${{ matrix.compiler }}\n run: |\n tests/build.sh ${{ matrix.configure_options }}\n - name: Run tests\n run: |\n tests/runtests.sh\n" }, { "path": ".github/workflows/build_ossfuzz.yml", "content": "# Build OSSFuzz fuzz targets from source.\nname: build_ossfuzz\non:\n push:\n branches: [main]\npermissions: read-all\njobs:\n build_ossfuzz:\n runs-on: ubuntu-latest\n strategy:\n matrix:\n include:\n - architecture: 'x64'\n compiler: 'gcc'\n configure_options: ''\n steps:\n - name: Install build dependencies\n run: |\n sudo apt-get -y install git\n - uses: actions/checkout@v5\n with:\n repository: google/oss-fuzz\n path: oss-fuzz\n - name: Build OSSFuzz fuzz targets\n working-directory: oss-fuzz\n run: |\n mkdir -p projects/libevtx\n cp projects/libyal/build.sh projects/libevtx/\n cp projects/libyal/project.yaml projects/libevtx/\n head -n 20 projects/libyal/Dockerfile > projects/libevtx/Dockerfile\n echo \"RUN git clone --depth 1 https://github.com/libyal/libevtx.git libevtx\" >> projects/libevtx/Dockerfile\n tail -n 3 projects/libyal/Dockerfile >> projects/libevtx/Dockerfile\n python3 infra/helper.py build_image --pull libevtx\n python3 infra/helper.py build_fuzzers --sanitizer address libevtx\n python3 infra/helper.py check_build libevtx\n" }, { "path": ".github/workflows/build_shared.yml", "content": "# Build from source with libyal dependencies as shared libraries.\nname: build_shared\non:\n push:\n branches: [main]\npermissions: read-all\njobs:\n build_shared_ubuntu:\n runs-on: ubuntu-latest\n strategy:\n matrix:\n include:\n - architecture: 'x64'\n compiler: 'gcc'\n configure_options: ''\n - architecture: 'x64'\n compiler: 'gcc'\n configure_options: '--enable-wide-character-type'\n steps:\n - uses: actions/checkout@v5\n - name: Install build dependencies\n run: |\n sudo apt-get -y install autoconf automake autopoint build-essential git libtool pkg-config\n - name: Download test data\n run: |\n if test -x \"synctestdata.sh\"; then ./synctestdata.sh; fi\n - name: Prepare shared libraries\n run: |\n tests/syncsharedlibs.sh --use-head\n - name: Building from source\n env:\n CC: ${{ matrix.compiler }}\n run: |\n tests/build.sh ${{ matrix.configure_options }}\n - name: Run tests\n run: |\n tests/runtests.sh\n" }, { "path": ".github/workflows/build_wheel.yml", "content": "# Build Python wheels from source using cibuildwheel.\nname: build_wheels\non: [push, pull_request]\npermissions: read-all\njobs:\n build_wheels_linux:\n name: Build wheels on ${{ matrix.os }}\n runs-on: ${{ matrix.os }}\n strategy:\n matrix:\n include:\n - os: ubuntu-24.04-arm\n - os: ubuntu-latest\n steps:\n - uses: actions/checkout@v5\n - name: Install build dependencies\n run: |\n sudo apt-get -y install autoconf automake autopoint build-essential git libtool pkg-config\n - name: Prepare build\n run: |\n ./synclibs.sh\n ./autogen.sh\n ./configure\n make sources >/dev/null\n - name: Build Python wheels\n uses: pypa/cibuildwheel@v3.3.0\n env:\n CIBW_TEST_COMMAND: python tests/runtests.py\n CIBW_TEST_SOURCES: tests\n with:\n package-dir: .\n output-dir: dist\n - uses: actions/upload-artifact@v4\n with:\n name: cibw-wheels-${{ matrix.os }}-${{ strategy.job-index }}\n path: dist/*.whl\n build_wheels_macos:\n name: Build wheels on ${{ matrix.os }}\n runs-on: ${{ matrix.os }}\n strategy:\n matrix:\n include:\n - os: macos-14\n - os: macos-15-intel\n steps:\n - uses: actions/checkout@v5\n - name: Install build dependencies\n run: |\n brew update -q\n brew install -q autoconf automake gettext gnu-sed libtool pkg-config || true\n brew link --force gettext\n ln -s /usr/local/bin/glibtoolize /usr/local/bin/libtoolize\n - name: Prepare build\n run: |\n ./synclibs.sh\n ./autogen.sh\n ./configure\n make sources >/dev/null\n - name: Build Python wheels\n uses: pypa/cibuildwheel@v3.3.0\n env:\n CIBW_TEST_COMMAND: python tests/runtests.py\n CIBW_TEST_SOURCES: tests\n with:\n package-dir: .\n output-dir: dist\n - uses: actions/upload-artifact@v4\n with:\n name: cibw-wheels-${{ matrix.os }}-${{ strategy.job-index }}\n path: dist/*.whl\n build_wheels_windows:\n name: Build wheels on ${{ matrix.os }}\n runs-on: ${{ matrix.os }}\n strategy:\n matrix:\n include:\n - os: windows-11-arm\n - os: windows-latest\n steps:\n - uses: actions/checkout@v5\n - name: Prepare build\n run: |\n .\\synclibs.ps1\n .\\autogen.ps1\n - name: Build Python wheels\n uses: pypa/cibuildwheel@v3.3.0\n env:\n CIBW_TEST_COMMAND: python tests/runtests.py\n CIBW_TEST_SOURCES: tests\n with:\n package-dir: .\n output-dir: dist\n - uses: actions/upload-artifact@v4\n with:\n name: cibw-wheels-${{ matrix.os }}-${{ strategy.job-index }}\n path: dist/*.whl\n" }, { "path": ".gitignore", "content": "# Files to ignore by git\n#\n# Version: 20231119\n\n# Generic auto-generated build files\n*~\n*.a\n*.gcda\n*.gcno\n*.gcov\n*.la\n*.lai\n*.lib\n*.lineno\n*.lo\n*.log\n*.loT\n*.o\n*.obj\n*.Plo\n*.Po\n*.so\n*.so.[0-9][0-9]*\n*.so.[0-9][0-9]*.[0-9][0-9]*.[0-9][0-9]*\n*.swp\n*.Tpo\n*.trs\n*.whl\n/*.egg-info/\n__pycache__\n.deps\n.dirstamp\n.libs\n.tox\nINSTALL\nMakefile\nMakefile.bcc\nMakefile.in\nstamp-h[1-9]\n\n# Specific auto-generated build files\n/ABOUT-NLS\n/aclocal.m4\n/autom4te.cache/\n/build\n/compile\n/confdefs.h\n/config.cache\n/config.guess\n/config.log\n/config.rpath\n/config.status\n/config.sub\n/configure\n/conftest.c\n/depcomp\n/dist\n/install-sh\n/libtool\n/ltmain.sh\n/m4/codeset.m4\n/m4/extern-inline.m4\n/m4/fcntl-o.m4\n/m4/gettext.m4\n/m4/glibc21.m4\n/m4/glibc2.m4\n/m4/host-cpu-c-abi.m4\n/m4/iconv.m4\n/m4/intdiv0.m4\n/m4/intldir.m4\n/m4/intl.m4\n/m4/intlmacosx.m4\n/m4/intmax.m4\n/m4/inttypes_h.m4\n/m4/inttypes-pri.m4\n/m4/lcmessage.m4\n/m4/lib-ld.m4\n/m4/lib-link.m4\n/m4/lib-prefix.m4\n/m4/libtool.m4\n/m4/lock.m4\n/m4/longlong.m4\n/m4/lt~obsolete.m4\n/m4/ltoptions.m4\n/m4/ltsugar.m4\n/m4/ltversion.m4\n/m4/nls.m4\n/m4/pkg.m4\n/m4/po.m4\n/m4/printf-posix.m4\n/m4/progtest.m4\n/m4/size_max.m4\n/m4/stdint_h.m4\n/m4/threadlib.m4\n/m4/uintmax_t.m4\n/m4/visibility.m4\n/m4/wchar_t.m4\n/m4/wint_t.m4\n/m4/xsize.m4\n/MANIFEST\n/missing\n/po/boldquot.sed\n/po/en@boldquot.header\n/po/en@quot.header\n/po/insert-header.sin\n/po/Makefile.in.in\n/po/Makevars\n/po/Makevars.template\n/po/POTFILES\n/po/quot.sed\n/po/remove-potcdate.sed\n/po/remove-potcdate.sin\n/po/Rules-quot\n/test-driver\n/ylwrap\n\n# Project specific files\n/common/config.h\n/common/config.h.in\n/common/types.h\n/dpkg/changelog\n/include/libevtx.h\n/include/libevtx/definitions.h\n/include/libevtx/features.h\n/include/libevtx/types.h\n/libevtx.pc\n/libevtx.spec\n/libevtx/libevtx.rc\n/libevtx/libevtx_definitions.h\n/setup.cfg\n/evtxtools/*.exe\n/evtxtools/evtxexport\n/evtxtools/evtxinfo\n/tests/*.exe\n/tests/evtx_test_chunk\n/tests/evtx_test_chunks_table\n/tests/evtx_test_error\n/tests/evtx_test_file\n/tests/evtx_test_io_handle\n/tests/evtx_test_notify\n/tests/evtx_test_record\n/tests/evtx_test_record_values\n/tests/evtx_test_support\n/tests/evtx_test_template_definition\n/tests/evtx_test_tools_info_handle\n/tests/evtx_test_tools_message_handle\n/tests/evtx_test_tools_message_string\n/tests/evtx_test_tools_output\n/tests/evtx_test_tools_path_handle\n/tests/evtx_test_tools_registry_file\n/tests/evtx_test_tools_resource_file\n/tests/evtx_test_tools_signal\n/tests/input\n/tests/notify_stream.log\n/tests/tmp*\n\n# Local library dependencies specific files\n/libbfio\n/libcdata\n/libcdirectory\n/libcerror\n/libcfile\n/libclocale\n/libcnotify\n/libcpath\n/libcsplit\n/libcthreads\n/libexe\n/libfcache\n/libfdata\n/libfdatetime\n/libfguid\n/libfvalue\n/libfwevt\n/libfwnt\n/libregf\n/libuna\n/libwrc\n" }, { "path": "AUTHORS", "content": "Acknowledgements: libevtx\n\nCopyright (C) 2011-2025, Joachim Metz \n\n" }, { "path": "COPYING", "content": " GNU GENERAL PUBLIC LICENSE\n Version 3, 29 June 2007\n\n Copyright (C) 2007 Free Software Foundation, Inc. \n Everyone is permitted to copy and distribute verbatim copies\n of this license document, but changing it is not allowed.\n\n Preamble\n\n The GNU General Public License is a free, copyleft license for\nsoftware and other kinds of works.\n\n The licenses for most software and other practical works are designed\nto take away your freedom to share and change the works. By contrast,\nthe GNU General Public License is intended to guarantee your freedom to\nshare and change all versions of a program--to make sure it remains free\nsoftware for all its users. We, the Free Software Foundation, use the\nGNU General Public License for most of our software; it applies also to\nany other work released this way by its authors. You can apply it to\nyour programs, too.\n\n When we speak of free software, we are referring to freedom, not\nprice. Our General Public Licenses are designed to make sure that you\nhave the freedom to distribute copies of free software (and charge for\nthem if you wish), that you receive source code or can get it if you\nwant it, that you can change the software or use pieces of it in new\nfree programs, and that you know you can do these things.\n\n To protect your rights, we need to prevent others from denying you\nthese rights or asking you to surrender the rights. Therefore, you have\ncertain responsibilities if you distribute copies of the software, or if\nyou modify it: responsibilities to respect the freedom of others.\n\n For example, if you distribute copies of such a program, whether\ngratis or for a fee, you must pass on to the recipients the same\nfreedoms that you received. You must make sure that they, too, receive\nor can get the source code. And you must show them these terms so they\nknow their rights.\n\n Developers that use the GNU GPL protect your rights with two steps:\n(1) assert copyright on the software, and (2) offer you this License\ngiving you legal permission to copy, distribute and/or modify it.\n\n For the developers' and authors' protection, the GPL clearly explains\nthat there is no warranty for this free software. For both users' and\nauthors' sake, the GPL requires that modified versions be marked as\nchanged, so that their problems will not be attributed erroneously to\nauthors of previous versions.\n\n Some devices are designed to deny users access to install or run\nmodified versions of the software inside them, although the manufacturer\ncan do so. This is fundamentally incompatible with the aim of\nprotecting users' freedom to change the software. The systematic\npattern of such abuse occurs in the area of products for individuals to\nuse, which is precisely where it is most unacceptable. Therefore, we\nhave designed this version of the GPL to prohibit the practice for those\nproducts. If such problems arise substantially in other domains, we\nstand ready to extend this provision to those domains in future versions\nof the GPL, as needed to protect the freedom of users.\n\n Finally, every program is threatened constantly by software patents.\nStates should not allow patents to restrict development and use of\nsoftware on general-purpose computers, but in those that do, we wish to\navoid the special danger that patents applied to a free program could\nmake it effectively proprietary. To prevent this, the GPL assures that\npatents cannot be used to render the program non-free.\n\n The precise terms and conditions for copying, distribution and\nmodification follow.\n\n TERMS AND CONDITIONS\n\n 0. Definitions.\n\n \"This License\" refers to version 3 of the GNU General Public License.\n\n \"Copyright\" also means copyright-like laws that apply to other kinds of\nworks, such as semiconductor masks.\n\n \"The Program\" refers to any copyrightable work licensed under this\nLicense. Each licensee is addressed as \"you\". \"Licensees\" and\n\"recipients\" may be individuals or organizations.\n\n To \"modify\" a work means to copy from or adapt all or part of the work\nin a fashion requiring copyright permission, other than the making of an\nexact copy. The resulting work is called a \"modified version\" of the\nearlier work or a work \"based on\" the earlier work.\n\n A \"covered work\" means either the unmodified Program or a work based\non the Program.\n\n To \"propagate\" a work means to do anything with it that, without\npermission, would make you directly or secondarily liable for\ninfringement under applicable copyright law, except executing it on a\ncomputer or modifying a private copy. Propagation includes copying,\ndistribution (with or without modification), making available to the\npublic, and in some countries other activities as well.\n\n To \"convey\" a work means any kind of propagation that enables other\nparties to make or receive copies. Mere interaction with a user through\na computer network, with no transfer of a copy, is not conveying.\n\n An interactive user interface displays \"Appropriate Legal Notices\"\nto the extent that it includes a convenient and prominently visible\nfeature that (1) displays an appropriate copyright notice, and (2)\ntells the user that there is no warranty for the work (except to the\nextent that warranties are provided), that licensees may convey the\nwork under this License, and how to view a copy of this License. If\nthe interface presents a list of user commands or options, such as a\nmenu, a prominent item in the list meets this criterion.\n\n 1. Source Code.\n\n The \"source code\" for a work means the preferred form of the work\nfor making modifications to it. \"Object code\" means any non-source\nform of a work.\n\n A \"Standard Interface\" means an interface that either is an official\nstandard defined by a recognized standards body, or, in the case of\ninterfaces specified for a particular programming language, one that\nis widely used among developers working in that language.\n\n The \"System Libraries\" of an executable work include anything, other\nthan the work as a whole, that (a) is included in the normal form of\npackaging a Major Component, but which is not part of that Major\nComponent, and (b) serves only to enable use of the work with that\nMajor Component, or to implement a Standard Interface for which an\nimplementation is available to the public in source code form. A\n\"Major Component\", in this context, means a major essential component\n(kernel, window system, and so on) of the specific operating system\n(if any) on which the executable work runs, or a compiler used to\nproduce the work, or an object code interpreter used to run it.\n\n The \"Corresponding Source\" for a work in object code form means all\nthe source code needed to generate, install, and (for an executable\nwork) run the object code and to modify the work, including scripts to\ncontrol those activities. However, it does not include the work's\nSystem Libraries, or general-purpose tools or generally available free\nprograms which are used unmodified in performing those activities but\nwhich are not part of the work. For example, Corresponding Source\nincludes interface definition files associated with source files for\nthe work, and the source code for shared libraries and dynamically\nlinked subprograms that the work is specifically designed to require,\nsuch as by intimate data communication or control flow between those\nsubprograms and other parts of the work.\n\n The Corresponding Source need not include anything that users\ncan regenerate automatically from other parts of the Corresponding\nSource.\n\n The Corresponding Source for a work in source code form is that\nsame work.\n\n 2. Basic Permissions.\n\n All rights granted under this License are granted for the term of\ncopyright on the Program, and are irrevocable provided the stated\nconditions are met. This License explicitly affirms your unlimited\npermission to run the unmodified Program. The output from running a\ncovered work is covered by this License only if the output, given its\ncontent, constitutes a covered work. This License acknowledges your\nrights of fair use or other equivalent, as provided by copyright law.\n\n You may make, run and propagate covered works that you do not\nconvey, without conditions so long as your license otherwise remains\nin force. You may convey covered works to others for the sole purpose\nof having them make modifications exclusively for you, or provide you\nwith facilities for running those works, provided that you comply with\nthe terms of this License in conveying all material for which you do\nnot control copyright. Those thus making or running the covered works\nfor you must do so exclusively on your behalf, under your direction\nand control, on terms that prohibit them from making any copies of\nyour copyrighted material outside their relationship with you.\n\n Conveying under any other circumstances is permitted solely under\nthe conditions stated below. Sublicensing is not allowed; section 10\nmakes it unnecessary.\n\n 3. Protecting Users' Legal Rights From Anti-Circumvention Law.\n\n No covered work shall be deemed part of an effective technological\nmeasure under any applicable law fulfilling obligations under article\n11 of the WIPO copyright treaty adopted on 20 December 1996, or\nsimilar laws prohibiting or restricting circumvention of such\nmeasures.\n\n When you convey a covered work, you waive any legal power to forbid\ncircumvention of technological measures to the extent such circumvention\nis effected by exercising rights under this License with respect to\nthe covered work, and you disclaim any intention to limit operation or\nmodification of the work as a means of enforcing, against the work's\nusers, your or third parties' legal rights to forbid circumvention of\ntechnological measures.\n\n 4. Conveying Verbatim Copies.\n\n You may convey verbatim copies of the Program's source code as you\nreceive it, in any medium, provided that you conspicuously and\nappropriately publish on each copy an appropriate copyright notice;\nkeep intact all notices stating that this License and any\nnon-permissive terms added in accord with section 7 apply to the code;\nkeep intact all notices of the absence of any warranty; and give all\nrecipients a copy of this License along with the Program.\n\n You may charge any price or no price for each copy that you convey,\nand you may offer support or warranty protection for a fee.\n\n 5. Conveying Modified Source Versions.\n\n You may convey a work based on the Program, or the modifications to\nproduce it from the Program, in the form of source code under the\nterms of section 4, provided that you also meet all of these conditions:\n\n a) The work must carry prominent notices stating that you modified\n it, and giving a relevant date.\n\n b) The work must carry prominent notices stating that it is\n released under this License and any conditions added under section\n 7. This requirement modifies the requirement in section 4 to\n \"keep intact all notices\".\n\n c) You must license the entire work, as a whole, under this\n License to anyone who comes into possession of a copy. This\n License will therefore apply, along with any applicable section 7\n additional terms, to the whole of the work, and all its parts,\n regardless of how they are packaged. This License gives no\n permission to license the work in any other way, but it does not\n invalidate such permission if you have separately received it.\n\n d) If the work has interactive user interfaces, each must display\n Appropriate Legal Notices; however, if the Program has interactive\n interfaces that do not display Appropriate Legal Notices, your\n work need not make them do so.\n\n A compilation of a covered work with other separate and independent\nworks, which are not by their nature extensions of the covered work,\nand which are not combined with it such as to form a larger program,\nin or on a volume of a storage or distribution medium, is called an\n\"aggregate\" if the compilation and its resulting copyright are not\nused to limit the access or legal rights of the compilation's users\nbeyond what the individual works permit. Inclusion of a covered work\nin an aggregate does not cause this License to apply to the other\nparts of the aggregate.\n\n 6. Conveying Non-Source Forms.\n\n You may convey a covered work in object code form under the terms\nof sections 4 and 5, provided that you also convey the\nmachine-readable Corresponding Source under the terms of this License,\nin one of these ways:\n\n a) Convey the object code in, or embodied in, a physical product\n (including a physical distribution medium), accompanied by the\n Corresponding Source fixed on a durable physical medium\n customarily used for software interchange.\n\n b) Convey the object code in, or embodied in, a physical product\n (including a physical distribution medium), accompanied by a\n written offer, valid for at least three years and valid for as\n long as you offer spare parts or customer support for that product\n model, to give anyone who possesses the object code either (1) a\n copy of the Corresponding Source for all the software in the\n product that is covered by this License, on a durable physical\n medium customarily used for software interchange, for a price no\n more than your reasonable cost of physically performing this\n conveying of source, or (2) access to copy the\n Corresponding Source from a network server at no charge.\n\n c) Convey individual copies of the object code with a copy of the\n written offer to provide the Corresponding Source. This\n alternative is allowed only occasionally and noncommercially, and\n only if you received the object code with such an offer, in accord\n with subsection 6b.\n\n d) Convey the object code by offering access from a designated\n place (gratis or for a charge), and offer equivalent access to the\n Corresponding Source in the same way through the same place at no\n further charge. You need not require recipients to copy the\n Corresponding Source along with the object code. If the place to\n copy the object code is a network server, the Corresponding Source\n may be on a different server (operated by you or a third party)\n that supports equivalent copying facilities, provided you maintain\n clear directions next to the object code saying where to find the\n Corresponding Source. Regardless of what server hosts the\n Corresponding Source, you remain obligated to ensure that it is\n available for as long as needed to satisfy these requirements.\n\n e) Convey the object code using peer-to-peer transmission, provided\n you inform other peers where the object code and Corresponding\n Source of the work are being offered to the general public at no\n charge under subsection 6d.\n\n A separable portion of the object code, whose source code is excluded\nfrom the Corresponding Source as a System Library, need not be\nincluded in conveying the object code work.\n\n A \"User Product\" is either (1) a \"consumer product\", which means any\ntangible personal property which is normally used for personal, family,\nor household purposes, or (2) anything designed or sold for incorporation\ninto a dwelling. In determining whether a product is a consumer product,\ndoubtful cases shall be resolved in favor of coverage. For a particular\nproduct received by a particular user, \"normally used\" refers to a\ntypical or common use of that class of product, regardless of the status\nof the particular user or of the way in which the particular user\nactually uses, or expects or is expected to use, the product. A product\nis a consumer product regardless of whether the product has substantial\ncommercial, industrial or non-consumer uses, unless such uses represent\nthe only significant mode of use of the product.\n\n \"Installation Information\" for a User Product means any methods,\nprocedures, authorization keys, or other information required to install\nand execute modified versions of a covered work in that User Product from\na modified version of its Corresponding Source. The information must\nsuffice to ensure that the continued functioning of the modified object\ncode is in no case prevented or interfered with solely because\nmodification has been made.\n\n If you convey an object code work under this section in, or with, or\nspecifically for use in, a User Product, and the conveying occurs as\npart of a transaction in which the right of possession and use of the\nUser Product is transferred to the recipient in perpetuity or for a\nfixed term (regardless of how the transaction is characterized), the\nCorresponding Source conveyed under this section must be accompanied\nby the Installation Information. But this requirement does not apply\nif neither you nor any third party retains the ability to install\nmodified object code on the User Product (for example, the work has\nbeen installed in ROM).\n\n The requirement to provide Installation Information does not include a\nrequirement to continue to provide support service, warranty, or updates\nfor a work that has been modified or installed by the recipient, or for\nthe User Product in which it has been modified or installed. Access to a\nnetwork may be denied when the modification itself materially and\nadversely affects the operation of the network or violates the rules and\nprotocols for communication across the network.\n\n Corresponding Source conveyed, and Installation Information provided,\nin accord with this section must be in a format that is publicly\ndocumented (and with an implementation available to the public in\nsource code form), and must require no special password or key for\nunpacking, reading or copying.\n\n 7. Additional Terms.\n\n \"Additional permissions\" are terms that supplement the terms of this\nLicense by making exceptions from one or more of its conditions.\nAdditional permissions that are applicable to the entire Program shall\nbe treated as though they were included in this License, to the extent\nthat they are valid under applicable law. If additional permissions\napply only to part of the Program, that part may be used separately\nunder those permissions, but the entire Program remains governed by\nthis License without regard to the additional permissions.\n\n When you convey a copy of a covered work, you may at your option\nremove any additional permissions from that copy, or from any part of\nit. (Additional permissions may be written to require their own\nremoval in certain cases when you modify the work.) You may place\nadditional permissions on material, added by you to a covered work,\nfor which you have or can give appropriate copyright permission.\n\n Notwithstanding any other provision of this License, for material you\nadd to a covered work, you may (if authorized by the copyright holders of\nthat material) supplement the terms of this License with terms:\n\n a) Disclaiming warranty or limiting liability differently from the\n terms of sections 15 and 16 of this License; or\n\n b) Requiring preservation of specified reasonable legal notices or\n author attributions in that material or in the Appropriate Legal\n Notices displayed by works containing it; or\n\n c) Prohibiting misrepresentation of the origin of that material, or\n requiring that modified versions of such material be marked in\n reasonable ways as different from the original version; or\n\n d) Limiting the use for publicity purposes of names of licensors or\n authors of the material; or\n\n e) Declining to grant rights under trademark law for use of some\n trade names, trademarks, or service marks; or\n\n f) Requiring indemnification of licensors and authors of that\n material by anyone who conveys the material (or modified versions of\n it) with contractual assumptions of liability to the recipient, for\n any liability that these contractual assumptions directly impose on\n those licensors and authors.\n\n All other non-permissive additional terms are considered \"further\nrestrictions\" within the meaning of section 10. If the Program as you\nreceived it, or any part of it, contains a notice stating that it is\ngoverned by this License along with a term that is a further\nrestriction, you may remove that term. If a license document contains\na further restriction but permits relicensing or conveying under this\nLicense, you may add to a covered work material governed by the terms\nof that license document, provided that the further restriction does\nnot survive such relicensing or conveying.\n\n If you add terms to a covered work in accord with this section, you\nmust place, in the relevant source files, a statement of the\nadditional terms that apply to those files, or a notice indicating\nwhere to find the applicable terms.\n\n Additional terms, permissive or non-permissive, may be stated in the\nform of a separately written license, or stated as exceptions;\nthe above requirements apply either way.\n\n 8. Termination.\n\n You may not propagate or modify a covered work except as expressly\nprovided under this License. Any attempt otherwise to propagate or\nmodify it is void, and will automatically terminate your rights under\nthis License (including any patent licenses granted under the third\nparagraph of section 11).\n\n However, if you cease all violation of this License, then your\nlicense from a particular copyright holder is reinstated (a)\nprovisionally, unless and until the copyright holder explicitly and\nfinally terminates your license, and (b) permanently, if the copyright\nholder fails to notify you of the violation by some reasonable means\nprior to 60 days after the cessation.\n\n Moreover, your license from a particular copyright holder is\nreinstated permanently if the copyright holder notifies you of the\nviolation by some reasonable means, this is the first time you have\nreceived notice of violation of this License (for any work) from that\ncopyright holder, and you cure the violation prior to 30 days after\nyour receipt of the notice.\n\n Termination of your rights under this section does not terminate the\nlicenses of parties who have received copies or rights from you under\nthis License. If your rights have been terminated and not permanently\nreinstated, you do not qualify to receive new licenses for the same\nmaterial under section 10.\n\n 9. Acceptance Not Required for Having Copies.\n\n You are not required to accept this License in order to receive or\nrun a copy of the Program. Ancillary propagation of a covered work\noccurring solely as a consequence of using peer-to-peer transmission\nto receive a copy likewise does not require acceptance. However,\nnothing other than this License grants you permission to propagate or\nmodify any covered work. These actions infringe copyright if you do\nnot accept this License. Therefore, by modifying or propagating a\ncovered work, you indicate your acceptance of this License to do so.\n\n 10. Automatic Licensing of Downstream Recipients.\n\n Each time you convey a covered work, the recipient automatically\nreceives a license from the original licensors, to run, modify and\npropagate that work, subject to this License. You are not responsible\nfor enforcing compliance by third parties with this License.\n\n An \"entity transaction\" is a transaction transferring control of an\norganization, or substantially all assets of one, or subdividing an\norganization, or merging organizations. If propagation of a covered\nwork results from an entity transaction, each party to that\ntransaction who receives a copy of the work also receives whatever\nlicenses to the work the party's predecessor in interest had or could\ngive under the previous paragraph, plus a right to possession of the\nCorresponding Source of the work from the predecessor in interest, if\nthe predecessor has it or can get it with reasonable efforts.\n\n You may not impose any further restrictions on the exercise of the\nrights granted or affirmed under this License. For example, you may\nnot impose a license fee, royalty, or other charge for exercise of\nrights granted under this License, and you may not initiate litigation\n(including a cross-claim or counterclaim in a lawsuit) alleging that\nany patent claim is infringed by making, using, selling, offering for\nsale, or importing the Program or any portion of it.\n\n 11. Patents.\n\n A \"contributor\" is a copyright holder who authorizes use under this\nLicense of the Program or a work on which the Program is based. The\nwork thus licensed is called the contributor's \"contributor version\".\n\n A contributor's \"essential patent claims\" are all patent claims\nowned or controlled by the contributor, whether already acquired or\nhereafter acquired, that would be infringed by some manner, permitted\nby this License, of making, using, or selling its contributor version,\nbut do not include claims that would be infringed only as a\nconsequence of further modification of the contributor version. For\npurposes of this definition, \"control\" includes the right to grant\npatent sublicenses in a manner consistent with the requirements of\nthis License.\n\n Each contributor grants you a non-exclusive, worldwide, royalty-free\npatent license under the contributor's essential patent claims, to\nmake, use, sell, offer for sale, import and otherwise run, modify and\npropagate the contents of its contributor version.\n\n In the following three paragraphs, a \"patent license\" is any express\nagreement or commitment, however denominated, not to enforce a patent\n(such as an express permission to practice a patent or covenant not to\nsue for patent infringement). To \"grant\" such a patent license to a\nparty means to make such an agreement or commitment not to enforce a\npatent against the party.\n\n If you convey a covered work, knowingly relying on a patent license,\nand the Corresponding Source of the work is not available for anyone\nto copy, free of charge and under the terms of this License, through a\npublicly available network server or other readily accessible means,\nthen you must either (1) cause the Corresponding Source to be so\navailable, or (2) arrange to deprive yourself of the benefit of the\npatent license for this particular work, or (3) arrange, in a manner\nconsistent with the requirements of this License, to extend the patent\nlicense to downstream recipients. \"Knowingly relying\" means you have\nactual knowledge that, but for the patent license, your conveying the\ncovered work in a country, or your recipient's use of the covered work\nin a country, would infringe one or more identifiable patents in that\ncountry that you have reason to believe are valid.\n\n If, pursuant to or in connection with a single transaction or\narrangement, you convey, or propagate by procuring conveyance of, a\ncovered work, and grant a patent license to some of the parties\nreceiving the covered work authorizing them to use, propagate, modify\nor convey a specific copy of the covered work, then the patent license\nyou grant is automatically extended to all recipients of the covered\nwork and works based on it.\n\n A patent license is \"discriminatory\" if it does not include within\nthe scope of its coverage, prohibits the exercise of, or is\nconditioned on the non-exercise of one or more of the rights that are\nspecifically granted under this License. You may not convey a covered\nwork if you are a party to an arrangement with a third party that is\nin the business of distributing software, under which you make payment\nto the third party based on the extent of your activity of conveying\nthe work, and under which the third party grants, to any of the\nparties who would receive the covered work from you, a discriminatory\npatent license (a) in connection with copies of the covered work\nconveyed by you (or copies made from those copies), or (b) primarily\nfor and in connection with specific products or compilations that\ncontain the covered work, unless you entered into that arrangement,\nor that patent license was granted, prior to 28 March 2007.\n\n Nothing in this License shall be construed as excluding or limiting\nany implied license or other defenses to infringement that may\notherwise be available to you under applicable patent law.\n\n 12. No Surrender of Others' Freedom.\n\n If conditions are imposed on you (whether by court order, agreement or\notherwise) that contradict the conditions of this License, they do not\nexcuse you from the conditions of this License. If you cannot convey a\ncovered work so as to satisfy simultaneously your obligations under this\nLicense and any other pertinent obligations, then as a consequence you may\nnot convey it at all. For example, if you agree to terms that obligate you\nto collect a royalty for further conveying from those to whom you convey\nthe Program, the only way you could satisfy both those terms and this\nLicense would be to refrain entirely from conveying the Program.\n\n 13. Use with the GNU Affero General Public License.\n\n Notwithstanding any other provision of this License, you have\npermission to link or combine any covered work with a work licensed\nunder version 3 of the GNU Affero General Public License into a single\ncombined work, and to convey the resulting work. The terms of this\nLicense will continue to apply to the part which is the covered work,\nbut the special requirements of the GNU Affero General Public License,\nsection 13, concerning interaction through a network will apply to the\ncombination as such.\n\n 14. Revised Versions of this License.\n\n The Free Software Foundation may publish revised and/or new versions of\nthe GNU General Public License from time to time. Such new versions will\nbe similar in spirit to the present version, but may differ in detail to\naddress new problems or concerns.\n\n Each version is given a distinguishing version number. If the\nProgram specifies that a certain numbered version of the GNU General\nPublic License \"or any later version\" applies to it, you have the\noption of following the terms and conditions either of that numbered\nversion or of any later version published by the Free Software\nFoundation. If the Program does not specify a version number of the\nGNU General Public License, you may choose any version ever published\nby the Free Software Foundation.\n\n If the Program specifies that a proxy can decide which future\nversions of the GNU General Public License can be used, that proxy's\npublic statement of acceptance of a version permanently authorizes you\nto choose that version for the Program.\n\n Later license versions may give you additional or different\npermissions. However, no additional obligations are imposed on any\nauthor or copyright holder as a result of your choosing to follow a\nlater version.\n\n 15. Disclaimer of Warranty.\n\n THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY\nAPPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT\nHOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM \"AS IS\" WITHOUT WARRANTY\nOF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,\nTHE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR\nPURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM\nIS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF\nALL NECESSARY SERVICING, REPAIR OR CORRECTION.\n\n 16. Limitation of Liability.\n\n IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING\nWILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS\nTHE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY\nGENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE\nUSE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF\nDATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD\nPARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),\nEVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF\nSUCH DAMAGES.\n\n 17. Interpretation of Sections 15 and 16.\n\n If the disclaimer of warranty and limitation of liability provided\nabove cannot be given local legal effect according to their terms,\nreviewing courts shall apply local law that most closely approximates\nan absolute waiver of all civil liability in connection with the\nProgram, unless a warranty or assumption of liability accompanies a\ncopy of the Program in return for a fee.\n\n END OF TERMS AND CONDITIONS\n\n How to Apply These Terms to Your New Programs\n\n If you develop a new program, and you want it to be of the greatest\npossible use to the public, the best way to achieve this is to make it\nfree software which everyone can redistribute and change under these terms.\n\n To do so, attach the following notices to the program. It is safest\nto attach them to the start of each source file to most effectively\nstate the exclusion of warranty; and each file should have at least\nthe \"copyright\" line and a pointer to where the full notice is found.\n\n \n Copyright (C) \n\n This program is free software: you can redistribute it and/or modify\n it under the terms of the GNU General Public License as published by\n the Free Software Foundation, either version 3 of the License, or\n (at your option) any later version.\n\n This program is distributed in the hope that it will be useful,\n but WITHOUT ANY WARRANTY; without even the implied warranty of\n MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n GNU General Public License for more details.\n\n You should have received a copy of the GNU General Public License\n along with this program. If not, see .\n\nAlso add information on how to contact you by electronic and paper mail.\n\n If the program does terminal interaction, make it output a short\nnotice like this when it starts in an interactive mode:\n\n Copyright (C) \n This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'.\n This is free software, and you are welcome to redistribute it\n under certain conditions; type `show c' for details.\n\nThe hypothetical commands `show w' and `show c' should show the appropriate\nparts of the General Public License. Of course, your program's commands\nmight be different; for a GUI interface, you would use an \"about box\".\n\n You should also get your employer (if you work as a programmer) or school,\nif any, to sign a \"copyright disclaimer\" for the program, if necessary.\nFor more information on this, and how to apply and follow the GNU GPL, see\n.\n\n The GNU General Public License does not permit incorporating your program\ninto proprietary programs. If your program is a subroutine library, you\nmay consider it more useful to permit linking proprietary applications with\nthe library. If this is what you want to do, use the GNU Lesser General\nPublic License instead of this License. But first, please read\n.\n" }, { "path": "COPYING.LESSER", "content": " GNU LESSER GENERAL PUBLIC LICENSE\n Version 3, 29 June 2007\n\n Copyright (C) 2007 Free Software Foundation, Inc. \n Everyone is permitted to copy and distribute verbatim copies\n of this license document, but changing it is not allowed.\n\n\n This version of the GNU Lesser General Public License incorporates\nthe terms and conditions of version 3 of the GNU General Public\nLicense, supplemented by the additional permissions listed below.\n\n 0. Additional Definitions.\n\n As used herein, \"this License\" refers to version 3 of the GNU Lesser\nGeneral Public License, and the \"GNU GPL\" refers to version 3 of the GNU\nGeneral Public License.\n\n \"The Library\" refers to a covered work governed by this License,\nother than an Application or a Combined Work as defined below.\n\n An \"Application\" is any work that makes use of an interface provided\nby the Library, but which is not otherwise based on the Library.\nDefining a subclass of a class defined by the Library is deemed a mode\nof using an interface provided by the Library.\n\n A \"Combined Work\" is a work produced by combining or linking an\nApplication with the Library. The particular version of the Library\nwith which the Combined Work was made is also called the \"Linked\nVersion\".\n\n The \"Minimal Corresponding Source\" for a Combined Work means the\nCorresponding Source for the Combined Work, excluding any source code\nfor portions of the Combined Work that, considered in isolation, are\nbased on the Application, and not on the Linked Version.\n\n The \"Corresponding Application Code\" for a Combined Work means the\nobject code and/or source code for the Application, including any data\nand utility programs needed for reproducing the Combined Work from the\nApplication, but excluding the System Libraries of the Combined Work.\n\n 1. Exception to Section 3 of the GNU GPL.\n\n You may convey a covered work under sections 3 and 4 of this License\nwithout being bound by section 3 of the GNU GPL.\n\n 2. Conveying Modified Versions.\n\n If you modify a copy of the Library, and, in your modifications, a\nfacility refers to a function or data to be supplied by an Application\nthat uses the facility (other than as an argument passed when the\nfacility is invoked), then you may convey a copy of the modified\nversion:\n\n a) under this License, provided that you make a good faith effort to\n ensure that, in the event an Application does not supply the\n function or data, the facility still operates, and performs\n whatever part of its purpose remains meaningful, or\n\n b) under the GNU GPL, with none of the additional permissions of\n this License applicable to that copy.\n\n 3. Object Code Incorporating Material from Library Header Files.\n\n The object code form of an Application may incorporate material from\na header file that is part of the Library. You may convey such object\ncode under terms of your choice, provided that, if the incorporated\nmaterial is not limited to numerical parameters, data structure\nlayouts and accessors, or small macros, inline functions and templates\n(ten or fewer lines in length), you do both of the following:\n\n a) Give prominent notice with each copy of the object code that the\n Library is used in it and that the Library and its use are\n covered by this License.\n\n b) Accompany the object code with a copy of the GNU GPL and this license\n document.\n\n 4. Combined Works.\n\n You may convey a Combined Work under terms of your choice that,\ntaken together, effectively do not restrict modification of the\nportions of the Library contained in the Combined Work and reverse\nengineering for debugging such modifications, if you also do each of\nthe following:\n\n a) Give prominent notice with each copy of the Combined Work that\n the Library is used in it and that the Library and its use are\n covered by this License.\n\n b) Accompany the Combined Work with a copy of the GNU GPL and this license\n document.\n\n c) For a Combined Work that displays copyright notices during\n execution, include the copyright notice for the Library among\n these notices, as well as a reference directing the user to the\n copies of the GNU GPL and this license document.\n\n d) Do one of the following:\n\n 0) Convey the Minimal Corresponding Source under the terms of this\n License, and the Corresponding Application Code in a form\n suitable for, and under terms that permit, the user to\n recombine or relink the Application with a modified version of\n the Linked Version to produce a modified Combined Work, in the\n manner specified by section 6 of the GNU GPL for conveying\n Corresponding Source.\n\n 1) Use a suitable shared library mechanism for linking with the\n Library. A suitable mechanism is one that (a) uses at run time\n a copy of the Library already present on the user's computer\n system, and (b) will operate properly with a modified version\n of the Library that is interface-compatible with the Linked\n Version.\n\n e) Provide Installation Information, but only if you would otherwise\n be required to provide such information under section 6 of the\n GNU GPL, and only to the extent that such information is\n necessary to install and execute a modified version of the\n Combined Work produced by recombining or relinking the\n Application with a modified version of the Linked Version. (If\n you use option 4d0, the Installation Information must accompany\n the Minimal Corresponding Source and Corresponding Application\n Code. If you use option 4d1, you must provide the Installation\n Information in the manner specified by section 6 of the GNU GPL\n for conveying Corresponding Source.)\n\n 5. Combined Libraries.\n\n You may place library facilities that are a work based on the\nLibrary side by side in a single library together with other library\nfacilities that are not Applications and are not covered by this\nLicense, and convey such a combined library under terms of your\nchoice, if you do both of the following:\n\n a) Accompany the combined library with a copy of the same work based\n on the Library, uncombined with any other library facilities,\n conveyed under the terms of this License.\n\n b) Give prominent notice with the combined library that part of it\n is a work based on the Library, and explaining where to find the\n accompanying uncombined form of the same work.\n\n 6. Revised Versions of the GNU Lesser General Public License.\n\n The Free Software Foundation may publish revised and/or new versions\nof the GNU Lesser General Public License from time to time. Such new\nversions will be similar in spirit to the present version, but may\ndiffer in detail to address new problems or concerns.\n\n Each version is given a distinguishing version number. If the\nLibrary as you received it specifies that a certain numbered version\nof the GNU Lesser General Public License \"or any later version\"\napplies to it, you have the option of following the terms and\nconditions either of that published version or of any later version\npublished by the Free Software Foundation. If the Library as you\nreceived it does not specify a version number of the GNU Lesser\nGeneral Public License, you may choose any version of the GNU Lesser\nGeneral Public License ever published by the Free Software Foundation.\n\n If the Library as you received it specifies that a proxy can decide\nwhether future versions of the GNU Lesser General Public License shall\napply, that proxy's public statement of acceptance of any version is\npermanent authorization for you to choose that version for the\nLibrary.\n" }, { "path": "ChangeLog", "content": "TODO\n* add parameter expansion support\n* evtxexport:\n - add add support for .mui files in the same directory\n - export EventRecordID in non-XML output\n - non-xml export format use evtexport like approach (add functions to get\n specific event data)\n* add clean IO handle function\n* msvscpp:\n - check and fix debug output generation\n* mark file as corrupted on CRC mismatch ?\n* check signal abort\n* parse binary data from EventData\n* event message file ?\n - correctly deal with \\\\ in C:\\Program Files\\Common Files\\McAfee\\SystemCore\\\\naievent.dll\n* improve detecting corrupted recovered event records\n* improve dealing with corrupted event records?\n* formatted output\n - check with test data if output is now correct\n* wevt\n - improve (template) codepage handling\n - improve template definition XML template value handling\n* message handle:\n - create: message string object\n - get %WinDir% from registry\n* resource file\n - cache message strings\n - cache template providers\n - cache template events\n - cache template definitions\n* tests\n - evtexport: handle \"Provider identifier\" in debug ouput\n\n* XML output change\n - Keywords add no leading 0's\n 0x8080000000000000\n\nstrings:\n - support non-contiguous data elements ?\n\nlibfwevt optimization:\n - reference value while parsing?\n - count number of data elements (strings) while parsing\n - reference binary (data) while parsing\n\n* API\n - get op code (0 => Info)\n - task category (none if not set)\n - keywords\n\n* recovery:\n - pass what type of chunk is being read\n - pass flag to binary xml parsing to ignore parsing errors ?\n or make this the default behavior\n - move read xml out of init record function ?\n* fix message filename retrieval, registry being read wrong ?\n* implement libevtx_xml_tag_get_attribute_by_utf8_path (and utf16 equivalent) ?\n* implement libevtx_xml_tag_get_element_by_utf8_path (and utf16 equivalent) ?\n* store name hash in value identifier\n* deal with corruption scenario\n* deal with trailing empty data ?\n* remove libevtx_libfguid.h once libfvalue wraps the format flags\n* add recovery scan\n* add debug function for binary XML token types\n* codepage support\n* flag internally if the file is corrupted (CRC mismatch)\n\nFormat:\n* what about empty binary xml data in the event record? does it only contain a 0x00 byte?\n\nDebug:\n* libfwevt: character reference print trailing data\n* handle empty XML document:\n libevtx_record_values_read_xml_document: XML document:\n libfwevt_xml_tag_debug_print: invalid XML tag.\n\nRecovery:\n* scan for records in chunk free space\n\n20110919\n* see `git log' for more recent change log\n* initial version based on libesedb 20110919\n\n" }, { "path": "Makefile.am", "content": "ACLOCAL_AMFLAGS = -I m4\n\nSUBDIRS = \\\n\tinclude \\\n\tcommon \\\n\tlibcerror \\\n\tlibcthreads \\\n\tlibcdata \\\n\tlibclocale \\\n\tlibcnotify \\\n\tlibcsplit \\\n\tlibuna \\\n\tlibcfile \\\n\tlibcpath \\\n\tlibbfio \\\n\tlibfcache \\\n\tlibfdata \\\n\tlibfdatetime \\\n\tlibfguid \\\n\tlibfvalue \\\n\tlibfwevt \\\n\tlibfwnt \\\n\tlibevtx \\\n\tlibexe \\\n\tlibregf \\\n\tlibwrc \\\n\tlibcdirectory \\\n\tevtxtools \\\n\tpyevtx \\\n\tpo \\\n\tmanuals \\\n\ttests \\\n\tossfuzz \\\n\tmsvscpp\n\nDPKG_FILES = \\\n\tdpkg/changelog \\\n\tdpkg/changelog.in \\\n\tdpkg/compat \\\n\tdpkg/control \\\n\tdpkg/copyright \\\n\tdpkg/rules \\\n\tdpkg/libevtx.install \\\n\tdpkg/libevtx-dev.install \\\n\tdpkg/libevtx-python3.install \\\n\tdpkg/libevtx-tools.install \\\n\tdpkg/source/format\n\nGETTEXT_FILES = \\\n\tconfig.rpath \\\n\tpo/Makevars.in\n\nPKGCONFIG_FILES = \\\n\tlibevtx.pc.in\n\nSETUP_PY_FILES = \\\n\tpyproject.toml \\\n\tsetup.cfg \\\n\tsetup.cfg.in \\\n\tsetup.py\n\nSPEC_FILES = \\\n\tlibevtx.spec \\\n\tlibevtx.spec.in\n\nEXTRA_DIST = \\\n\t$(DPKG_FILES) \\\n\t$(GETTEXT_FILES) \\\n\t$(PKGCONFIG_FILES) \\\n\t$(SETUP_PY_FILES) \\\n\t$(SPEC_FILES)\n\nDISTCLEANFILES = \\\n\tconfig.status \\\n\tconfig.cache \\\n\tconfig.log \\\n\tlibevtx.pc \\\n\tlibevtx.spec \\\n\tMakefile \\\n\tMakefile.in \\\n\tpo/Makevars\n\npkgconfigdir = $(libdir)/pkgconfig\n\npkgconfig_DATA = \\\n\tlibevtx.pc\n\nlibtool:\n\t@LIBTOOL_DEPS@\n\tcd $(srcdir) && $(SHELL) ./config.status --recheck\n\nlib: library\n\nlibrary:\n\t(cd $(srcdir)/common && $(MAKE) $(AM_MAKEFLAGS))\n\t(cd $(srcdir)/libcerror && $(MAKE) $(AM_MAKEFLAGS))\n\t(cd $(srcdir)/libcthreads && $(MAKE) $(AM_MAKEFLAGS))\n\t(cd $(srcdir)/libcdata && $(MAKE) $(AM_MAKEFLAGS))\n\t(cd $(srcdir)/libclocale && $(MAKE) $(AM_MAKEFLAGS))\n\t(cd $(srcdir)/libcnotify && $(MAKE) $(AM_MAKEFLAGS))\n\t(cd $(srcdir)/libcsplit && $(MAKE) $(AM_MAKEFLAGS))\n\t(cd $(srcdir)/libuna && $(MAKE) $(AM_MAKEFLAGS))\n\t(cd $(srcdir)/libcfile && $(MAKE) $(AM_MAKEFLAGS))\n\t(cd $(srcdir)/libcpath && $(MAKE) $(AM_MAKEFLAGS))\n\t(cd $(srcdir)/libbfio && $(MAKE) $(AM_MAKEFLAGS))\n\t(cd $(srcdir)/libfcache && $(MAKE) $(AM_MAKEFLAGS))\n\t(cd $(srcdir)/libfdata && $(MAKE) $(AM_MAKEFLAGS))\n\t(cd $(srcdir)/libfdatetime && $(MAKE) $(AM_MAKEFLAGS))\n\t(cd $(srcdir)/libfguid && $(MAKE) $(AM_MAKEFLAGS))\n\t(cd $(srcdir)/libfvalue && $(MAKE) $(AM_MAKEFLAGS))\n\t(cd $(srcdir)/libfwevt && $(MAKE) $(AM_MAKEFLAGS))\n\t(cd $(srcdir)/libfwnt && $(MAKE) $(AM_MAKEFLAGS))\n\t(cd $(srcdir)/libevtx && $(MAKE) $(AM_MAKEFLAGS))\n\t(cd $(srcdir)/po && $(MAKE) $(AM_MAKEFLAGS))\n\n" }, { "path": "NEWS", "content": "" }, { "path": "README", "content": "libevtx is a library to access the Windows XML Event Log (EVTX) format.\n\nProject information:\n\n* Status: alpha\n* Licence: LGPLv3+\n\nPlanned:\n\n* Multi-threading support\n\nFor more information see:\n\n* Project documentation: https://github.com/libyal/libevtx/wiki/Home\n* How to build from source: https://github.com/libyal/libevtx/wiki/Building\n\n" }, { "path": "acinclude.m4", "content": "dnl Checks for required headers and functions\ndnl\ndnl Version: 20200713\n\ndnl Function to detect if libevtx dependencies are available\nAC_DEFUN([AX_LIBEVTX_CHECK_LOCAL],\n [dnl Check for internationalization functions in libevtx/libevtx_i18n.c\n AC_CHECK_FUNCS([bindtextdomain])\n\n dnl Headers included in libevtx/libevtx_xml_tag.h\n AC_CHECK_HEADERS([wctype.h])\n\n dnl Functions used in libevtx/libevtx_xml_tag.h\n AC_CHECK_FUNCS([towupper])\n\n AS_IF(\n [test \"x$ac_cv_func_towupper\" != xyes],\n [AC_MSG_FAILURE(\n [Missing function: towupper],\n [1])\n ])\n])\n\ndnl Function to detect if evtxtools dependencies are available\nAC_DEFUN([AX_EVTXTOOLS_CHECK_LOCAL],\n [AC_CHECK_HEADERS([signal.h sys/signal.h unistd.h])\n\n AC_CHECK_FUNCS([close getopt setvbuf])\n\n AS_IF(\n [test \"x$ac_cv_func_close\" != xyes],\n [AC_MSG_FAILURE(\n [Missing function: close],\n [1])\n ])\n\n dnl Headers included in evtxtools/log_handle.c\n AC_CHECK_HEADERS([stdarg.h varargs.h])\n\n AS_IF(\n [test \"x$ac_cv_header_stdarg_h\" != xyes && test \"x$ac_cv_header_varargs_h\" != xyes],\n [AC_MSG_FAILURE(\n [Missing headers: stdarg.h and varargs.h],\n [1])\n ])\n])\n\ndnl Function to check if DLL support is needed\nAC_DEFUN([AX_LIBEVTX_CHECK_DLL_SUPPORT],\n [AS_IF(\n [test \"x$enable_shared\" = xyes && test \"x$ac_cv_enable_static_executables\" = xno],\n [AS_CASE(\n [$host],\n [*cygwin* | *mingw* | *msys*],\n [AC_DEFINE(\n [HAVE_DLLMAIN],\n [1],\n [Define to 1 to enable the DllMain function.])\n AC_SUBST(\n [HAVE_DLLMAIN],\n [1])\n\n AC_SUBST(\n [LIBEVTX_DLL_EXPORT],\n [\"-DLIBEVTX_DLL_EXPORT\"])\n\n AC_SUBST(\n [LIBEVTX_DLL_IMPORT],\n [\"-DLIBEVTX_DLL_IMPORT\"])\n ])\n ])\n ])\n\n" }, { "path": "appveyor.yml", "content": "environment:\n matrix:\n - TARGET: vs2008\n BUILD_ENVIRONMENT: msbuild\n APPVEYOR_BUILD_WORKER_IMAGE: Visual Studio 2013\n VisualStudioVersion: 9.0\n platform: Win32\n configuration: Release\n PYTHON_PATH: \"C:\\\\Python37\"\n - TARGET: vs2010\n BUILD_ENVIRONMENT: msbuild\n APPVEYOR_BUILD_WORKER_IMAGE: Visual Studio 2013\n VisualStudioVersion: 10.0\n platform: Win32\n configuration: Release\n PYTHON_PATH: \"C:\\\\Python37\"\n - TARGET: vs2012\n BUILD_ENVIRONMENT: msbuild\n APPVEYOR_BUILD_WORKER_IMAGE: Visual Studio 2013\n VisualStudioVersion: 11.0\n platform: Win32\n configuration: Release\n PYTHON_PATH: \"C:\\\\Python37\"\n - TARGET: vs2013\n BUILD_ENVIRONMENT: msbuild\n APPVEYOR_BUILD_WORKER_IMAGE: Visual Studio 2013\n VisualStudioVersion: 12.0\n platform: Win32\n configuration: Release\n PYTHON_PATH: \"C:\\\\Python37\"\n - TARGET: vs2015\n BUILD_ENVIRONMENT: msbuild\n APPVEYOR_BUILD_WORKER_IMAGE: Visual Studio 2015\n VisualStudioVersion: 14.0\n platform: Win32\n configuration: Release\n PYTHON_PATH: \"C:\\\\Python38\"\n - TARGET: vs2017\n BUILD_ENVIRONMENT: msbuild\n APPVEYOR_BUILD_WORKER_IMAGE: Visual Studio 2017\n VisualStudioVersion: 15.0\n platform: Win32\n configuration: Release\n PYTHON_PATH: \"C:\\\\Python38\"\n - TARGET: vs2019\n BUILD_ENVIRONMENT: msbuild\n APPVEYOR_BUILD_WORKER_IMAGE: Visual Studio 2019\n VisualStudioVersion: 16.0\n platform: Win32\n configuration: Release\n PYTHON_PATH: \"C:\\\\Python311\"\n - TARGET: vs2022\n BUILD_ENVIRONMENT: msbuild\n APPVEYOR_BUILD_WORKER_IMAGE: Visual Studio 2022\n VisualStudioVersion: 17.0\n platform: Win32\n configuration: Release\n PYTHON_PATH: \"C:\\\\Python311\"\n - TARGET: vs2022-vsdebug\n BUILD_ENVIRONMENT: msbuild\n APPVEYOR_BUILD_WORKER_IMAGE: Visual Studio 2022\n VisualStudioVersion: 17.0\n platform: Win32\n configuration: VSDebug\n PYTHON_PATH: \"C:\\\\Python311\"\n - TARGET: vs2022-x64\n BUILD_ENVIRONMENT: msbuild\n APPVEYOR_BUILD_WORKER_IMAGE: Visual Studio 2022\n VisualStudioVersion: 17.0\n platform: x64\n configuration: Release\n PYTHON_PATH: \"C:\\\\Python311\"\n - TARGET: vs2022-python\n BUILD_ENVIRONMENT: msbuild\n APPVEYOR_BUILD_WORKER_IMAGE: Visual Studio 2022\n VisualStudioVersion: 17.0\n platform: x64\n configuration: Release\n PYTHON_PATH: \"C:\\\\Python311-x64\"\n - TARGET: macos-x64-clang\n BUILD_ENVIRONMENT: xcode\n APPVEYOR_BUILD_WORKER_IMAGE: macos-sonoma\n HOMEBREW_NO_INSTALL_CLEANUP: 1\n CC: clang\n CFLAGS: \"-I/usr/local/include\"\n LDFLAGS: \"-L/usr/local/lib\"\n CONFIGURE_OPTIONS: \"\"\n - TARGET: macos-x64-gcc\n BUILD_ENVIRONMENT: xcode\n APPVEYOR_BUILD_WORKER_IMAGE: macos-sonoma\n HOMEBREW_NO_INSTALL_CLEANUP: 1\n CC: gcc\n CFLAGS: \"-I/usr/local/include\"\n LDFLAGS: \"-L/usr/local/lib\"\n CONFIGURE_OPTIONS: \"\"\n - TARGET: macos-x64-gcc-python\n BUILD_ENVIRONMENT: xcode\n APPVEYOR_BUILD_WORKER_IMAGE: macos-sonoma\n PYTHON: \"/usr/local/opt/python@3.11/bin/python3\"\n PYTHON_CONFIG: \"/usr/local/opt/python@3.11/bin/python3-config\"\n HOMEBREW_NO_INSTALL_CLEANUP: 1\n CC: gcc\n CFLAGS: \"-I/usr/local/include\"\n LDFLAGS: \"-L/usr/local/lib\"\n CONFIGURE_OPTIONS: \"--enable-python\"\n - TARGET: macos-pkgbuild\n BUILD_ENVIRONMENT: xcode\n APPVEYOR_BUILD_WORKER_IMAGE: macos-sonoma\n PYTHON: \"/usr/local/opt/python@3.11/bin/python3\"\n PYTHON_CONFIG: \"/usr/local/opt/python@3.11/bin/python3-config\"\n HOMEBREW_NO_INSTALL_CLEANUP: 1\n CC: gcc\n CFLAGS: \"-I/usr/local/include\"\n LDFLAGS: \"-L/usr/local/lib\"\n CONFIGURE_OPTIONS: \"--disable-dependency-tracking --prefix=/usr/local --enable-python --with-pyprefix\"\n - TARGET: cygwin64-gcc\n BUILD_ENVIRONMENT: cygwin64\n APPVEYOR_BUILD_WORKER_IMAGE: Visual Studio 2022\n CONFIGURE_OPTIONS: \"\"\n - TARGET: cygwin64-gcc-no-optimization\n BUILD_ENVIRONMENT: cygwin64\n APPVEYOR_BUILD_WORKER_IMAGE: Visual Studio 2022\n CONFIGURE_OPTIONS: \"--enable-shared=no\"\n CFLAGS: \"--coverage -O0\"\n CPPFLAGS: \"-DOPTIMIZATION_DISABLED\"\n LDFLAGS: \"--coverage\"\n - TARGET: cygwin64-gcc-python\n BUILD_ENVIRONMENT: cygwin64\n APPVEYOR_BUILD_WORKER_IMAGE: Visual Studio 2022\n CONFIGURE_OPTIONS: \"--enable-python\"\n - TARGET: cygwin64-gcc-static-executables\n BUILD_ENVIRONMENT: cygwin64\n APPVEYOR_BUILD_WORKER_IMAGE: Visual Studio 2022\n CONFIGURE_OPTIONS: \"--enable-static-executables\"\n - TARGET: mingw-w64-gcc\n BUILD_ENVIRONMENT: mingw-w64\n APPVEYOR_BUILD_WORKER_IMAGE: Visual Studio 2022\n CONFIGURE_OPTIONS: \"\"\n - TARGET: mingw-w64-gcc-no-optimization\n BUILD_ENVIRONMENT: mingw-w64\n APPVEYOR_BUILD_WORKER_IMAGE: Visual Studio 2022\n CONFIGURE_OPTIONS: \"--enable-shared=no\"\n CFLAGS: \"--coverage -O0\"\n CPPFLAGS: \"-DOPTIMIZATION_DISABLED\"\n LDFLAGS: \"--coverage\"\n - TARGET: mingw-w64-gcc-python\n BUILD_ENVIRONMENT: mingw-w64\n APPVEYOR_BUILD_WORKER_IMAGE: Visual Studio 2022\n CONFIGURE_OPTIONS: \"--enable-python\"\n - TARGET: mingw-w64-gcc-static-executables\n BUILD_ENVIRONMENT: mingw-w64\n APPVEYOR_BUILD_WORKER_IMAGE: Visual Studio 2022\n CONFIGURE_OPTIONS: \"--enable-static-executables\"\n\nmatrix:\n allow_failures:\n - TARGET: mingw-w64-gcc-python\n\ninstall:\n- cmd: if [%BUILD_ENVIRONMENT%]==[msbuild] (\n git clone https://github.com/libyal/vstools.git ..\\vstools )\n- ps: If (($env:BUILD_ENVIRONMENT -eq \"msbuild\") -And (Test-Path \".\\synctestdata.ps1\")) {\n .\\synctestdata.ps1 }\n- sh: if ( test ${BUILD_ENVIRONMENT} = \"xcode\" ) && test -f \"./synctestdata.sh\"; then ./synctestdata.sh; fi\n- sh: if test ${BUILD_ENVIRONMENT} = \"xcode\"; then brew untap homebrew/homebrew-cask-versions && brew update -q; fi\n- sh: if test ${BUILD_ENVIRONMENT} = \"xcode\"; then brew install -q autoconf automake gettext gnu-sed libtool pkg-config || true; fi\n- ps: If ($env:BUILD_ENVIRONMENT -eq \"cygwin64\") {\n (New-Object Net.WebClient).DownloadFile(\"https://cygwin.com/setup-x86_64.exe\", \"C:\\\\cygwin64\\\\setup-x86_64.exe\") }\n- cmd: if [%BUILD_ENVIRONMENT%]==[cygwin64] (\n C:\\cygwin64\\setup-x86_64.exe -qgnNdO -l C:\\cygwin64\\var\\cache\\setup -R c:\\cygwin64 -s http://cygwin.mirror.constant.com -P gettext-devel -P python3-devel -P wget )\n- cmd: if [%BUILD_ENVIRONMENT%]==[mingw-w64] (\n C:\\msys64\\usr\\bin\\pacman -S --noconfirm --needed autoconf automake gettext-devel libtool make mingw-w64-x86_64-gcc mingw-w64-x86_64-python3 pkg-config )\n- ps: If ( ( \"cygwin64-gcc-no-optimization\", \"mingw-w64-gcc-no-optimization\" ).Contains( $env:TARGET ) ) {\n $ProgressPreference = 'SilentlyContinue'; Invoke-WebRequest -Uri https://uploader.codecov.io/latest/windows/codecov.exe -Outfile ..\\codecov.exe }\n\nbuild_script:\n- ps: If ($env:BUILD_ENVIRONMENT -eq \"msbuild\") {\n .\\synclibs.ps1;\n .\\autogen.ps1 }\n- ps: If ($env:TARGET -eq \"vs2008\") {\n .\\build.ps1 -VisualStudioVersion 2008 -PythonPath $env:PYTHON_PATH -VSToolsOptions \"--no-python-dll\" }\n- ps: If ( ( \"vs2010\", \"vs2012\", \"vs2013\", \"vs2015\" ).Contains( $env:TARGET ) ) {\n .\\build.ps1 -VisualStudioVersion $env:TARGET.Substring(2, 4) -Configuration $env:CONFIGURATION -Platform $env:PLATFORM -PythonPath $env:PYTHON_PATH -VSToolsOptions \"--extend-with-x64 --no-python-dll\" }\n- ps: If ( ( \"vs2017\", \"vs2019\", \"vs2022\", \"vs2022-vsdebug\", \"vs2022-x64\" ).Contains( $env:TARGET ) ) {\n .\\build.ps1 -VisualStudioVersion $env:TARGET.Substring(2, 4) -Configuration $env:CONFIGURATION -Platform $env:PLATFORM -PythonPath $env:PYTHON_PATH -VSToolsOptions \"--extend-with-x64 --no-python-dll --with-dokany\" }\n- ps: If ($env:TARGET -eq \"vs2022-python\") {\n .\\build.ps1 -VisualStudioVersion $env:TARGET.Substring(2, 4) -Configuration $env:CONFIGURATION -Platform $env:PLATFORM -PythonPath $env:PYTHON_PATH -VSToolsOptions \"--extend-with-x64 --python-path $env:PYTHON_PATH --with-dokany\" }\n- sh: if test ${BUILD_ENVIRONMENT} = \"xcode\"; then export PATH=\"/usr/local/opt/gettext/bin:$PATH\"; export SED=\"/usr/local/bin/gsed\"; tests/build.sh ${CONFIGURE_OPTIONS}; fi\n- cmd: if [%BUILD_ENVIRONMENT%]==[cygwin64] (\n xcopy /i /q /s C:\\projects\\libevtx C:\\cygwin64\\home\\appveyor\\libevtx &&\n C:\\cygwin64\\bin\\bash -e -l -c \"cd libevtx && wget -q 'http://git.savannah.gnu.org/gitweb/?p=config.git;a=blob_plain;f=config.guess;hb=HEAD' -O './config.guess' && wget -q 'http://git.savannah.gnu.org/gitweb/?p=config.git;a=blob_plain;f=config.sub;hb=HEAD' -O './config.sub'\" &&\n C:\\cygwin64\\bin\\bash -e -l -c \"cd libevtx && tests/build.sh ${CONFIGURE_OPTIONS}\" )\n- cmd: if [%BUILD_ENVIRONMENT%]==[mingw-w64] (\n xcopy /i /q /s C:\\projects\\libevtx C:\\msys64\\home\\appveyor\\libevtx &&\n C:\\msys64\\usr\\bin\\bash -e -l -c \"cd libevtx && tests/build.sh ${CONFIGURE_OPTIONS}\" )\n\ntest_script:\n- cmd: rem Run tests\n- ps: If ($env:BUILD_ENVIRONMENT -eq \"msbuild\") {\n .\\runtests.ps1 }\n- sh: if test ${BUILD_ENVIRONMENT} = \"xcode\" && test ${TARGET} != \"macos-pkgbuild\"; then tests/runtests.sh; fi\n- sh: if test ${TARGET} = \"macos-pkgbuild\"; then tests/pkgbuild.sh; fi\n- cmd: if [%BUILD_ENVIRONMENT%]==[cygwin64] (\n C:\\cygwin64\\bin\\bash -l -c \"cd libevtx && tests/runtests.sh\" )\n- cmd: if [%BUILD_ENVIRONMENT%]==[mingw-w64] (\n C:\\msys64\\usr\\bin\\bash -l -c \"cd libevtx && tests/runtests.sh\" )\n\nafter_test:\n- cmd: if [%TARGET%]==[cygwin64-gcc-no-optimization] (\n C:\\cygwin64\\bin\\bash -e -l -c \"cd libevtx && for DIRECTORY in `find . -maxdepth 1 -type d`; do (cd ${DIRECTORY} && find . -maxdepth 1 -name \\*.gcno -type f -exec gcov -pb {} \\;) done\" &&\n C:\\projects\\codecov.exe -R \\cygwin64\\home\\appveyor\\libevtx --name %TARGET% )\n- cmd: if [%TARGET%]==[mingw-w64-gcc-no-optimization] (\n C:\\msys64\\usr\\bin\\bash -e -l -c \"cd libevtx && for DIRECTORY in `find . -maxdepth 1 -type d`; do (cd ${DIRECTORY} && find . -maxdepth 1 -name \\*.gcno -type f -exec gcov -pb {} \\;) done\" &&\n C:\\projects\\codecov.exe -R \\msys64\\home\\appveyor\\libevtx --name %TARGET% )\n\nartifacts:\n- path: dist\\*.whl\n\ndeploy_script:\n\n" }, { "path": "autogen.ps1", "content": "# Script to generate the necessary files for a msvscpp build\n#\n# Version: 20241014\n\n$WinFlex = \"..\\win_flex_bison\\win_flex.exe\"\n$WinBison = \"..\\win_flex_bison\\win_bison.exe\"\n\n$Library = Get-Content -Path configure.ac | select -skip 3 -first 1 | % { $_ -Replace \" \\[\",\"\" } | % { $_ -Replace \"\\],\",\"\" }\n$Version = Get-Content -Path configure.ac | select -skip 4 -first 1 | % { $_ -Replace \" \\[\",\"\" } | % { $_ -Replace \"\\],\",\"\" }\n$Prefix = ${Library}.Substring(3)\n\nGet-Content -Path \"include\\${Library}.h.in\" | Out-File -Encoding ascii \"include\\${Library}.h\"\nGet-Content -Path \"include\\${Library}\\definitions.h.in\" | % { $_ -Replace \"@VERSION@\",\"${Version}\" } | Out-File -Encoding ascii \"include\\${Library}\\definitions.h\"\nGet-Content -Path \"include\\${Library}\\features.h.in\" | % { $_ -Replace \"@[A-Z0-9_]*@\",\"0\" } | Out-File -Encoding ascii \"include\\${Library}\\features.h\"\nGet-Content -Path \"include\\${Library}\\types.h.in\" | % { $_ -Replace \"@[A-Z0-9_]*@\",\"0\" } | Out-File -Encoding ascii \"include\\${Library}\\types.h\"\nGet-Content -Path \"common\\types.h.in\" | % { $_ -Replace \"@PACKAGE@\",\"${Library}\" } | Out-File -Encoding ascii \"common\\types.h\"\nGet-Content -Path \"${Library}\\${Library}_definitions.h.in\" | % { $_ -Replace \"@VERSION@\",\"${Version}\" } | Out-File -Encoding ascii \"${Library}\\${Library}_definitions.h\"\nGet-Content -Path \"${Library}\\${Library}.rc.in\" | % { $_ -Replace \"@VERSION@\",\"${Version}\" } | Out-File -Encoding ascii \"${Library}\\${Library}.rc\"\n\nIf (Test-Path \"setup.cfg.in\")\n{\n\tGet-Content -Path \"setup.cfg.in\" | % { $_ -Replace \"@VERSION@\",\"${Version}\" } | Out-File -Encoding ascii \"setup.cfg\"\n}\n\nIf (Test-Path \"${Prefix}.net\")\n{\n\tGet-Content -Path \"${Prefix}.net\\${Prefix}.net.rc.in\" | % { $_ -Replace \"@VERSION@\",\"${Version}\" } | Out-File -Encoding ascii \"${Prefix}.net\\${Prefix}.net.rc\"\n}\n\n$NamePrefix = \"\"\n\nForEach (${Library} in Get-ChildItem -Directory -Path \"lib*\")\n{\n\tForEach (${DirectoryElement} in Get-ChildItem -Path \"${Library}\\*.l\")\n\t{\n\t\t$OutputFile = ${DirectoryElement} -Replace \".l$\",\".c\"\n\n\t\t$NamePrefix = Split-Path -path ${DirectoryElement} -leaf\n\t\t$NamePrefix = ${NamePrefix} -Replace \".l$\",\"_\"\n\n\t\tWrite-Host \"Running: ${WinFlex} -Cf ${DirectoryElement}\"\n\n\t\t# PowerShell will raise NativeCommandError if win_flex writes to stdout or stderr\n\t\t# therefore 2>&1 is added and the output is stored in a variable.\n\t\t$Output = Invoke-Expression -Command \"& '${WinFlex}' -Cf ${DirectoryElement} 2>&1\"\n\t\tWrite-Host ${Output}\n\n\t\t# Moving manually since `win_flex -o filename' does not provide the expected behavior.\n\t\tMove-Item \"lex.yy.c\" ${OutputFile} -force\n\t}\n\n\tForEach (${DirectoryElement} in Get-ChildItem -Path \"${Library}\\*.y\")\n\t{\n\t\t$OutputFile = ${DirectoryElement} -Replace \".y$\",\".c\"\n\n\t\tWrite-Host \"Running: ${WinBison} -d -v -l -p ${NamePrefix} -o ${OutputFile} ${DirectoryElement}\"\n\n\t\t# PowerShell will raise NativeCommandError if win_bison writes to stdout or stderr\n\t\t# therefore 2>&1 is added and the output is stored in a variable.\n\t\t$Output = Invoke-Expression -Command \"& '${WinBison}' -d -v -l -p ${NamePrefix} -o ${OutputFile} ${DirectoryElement} 2>&1\"\n\t\tWrite-Host ${Output}\n\t}\n}\n\n" }, { "path": "autogen.sh", "content": "#!/bin/sh\n# Script to generate configure and Makefile using the autotools.\n#\n# Version: 20241013\n\nEXIT_SUCCESS=0;\nEXIT_FAILURE=1;\n\nBINDIR=`which aclocal`;\nBINDIR=`dirname ${BINDIR}`;\n\nif ! test -x \"${BINDIR}/aclocal\" && test \"${BINDIR}\" != \"/usr/bin\";\nthen\n\tBINDIR=\"/usr/bin\";\nfi\nif ! test -x \"${BINDIR}/aclocal\" && test \"${BINDIR}\" != \"/usr/local/bin\";\nthen\n\tBINDIR=\"/usr/local/bin\";\nfi\nif ! test -x \"${BINDIR}/aclocal\" && test \"${BINDIR}\" != \"/opt/local/bin\";\nthen\n\t# Default location of MacPorts installed binaries.\n\tBINDIR=\"/opt/local/bin\";\nfi\nif ! test -x \"${BINDIR}/aclocal\" && test \"${BINDIR}\" != \"/opt/homebrew/bin\";\nthen\n\t# Default location of Homebrew installed binaries.\n\tBINDIR=\"/opt/homebrew/bin\";\nfi\nif ! test -x \"${BINDIR}/aclocal\" && test \"${BINDIR}\" != \"/mingw32/bin\";\nthen\n\t# Default location of 32-bit MSYS2-MinGW installed binaries.\n\tBINDIR=\"/mingw32/bin\";\nfi\nif ! test -x \"${BINDIR}/aclocal\" && test \"${BINDIR}\" != \"/mingw64/bin\";\nthen\n\t# Default location of 64-bit MSYS2-MinGW installed binaries.\n\tBINDIR=\"/mingw64/bin\";\nfi\n\nif ! test -x \"${BINDIR}/aclocal\";\nthen\n\techo \"Unable to find autotools\";\n\n\texit ${EXIT_FAILURE};\nfi\n\nACLOCAL=\"${BINDIR}/aclocal\";\nAUTOCONF=\"${BINDIR}/autoconf\";\nAUTOHEADER=\"${BINDIR}/autoheader\";\nAUTOMAKE=\"${BINDIR}/automake\";\nAUTOPOINT=\"${BINDIR}/autopoint\";\nAUTORECONF=\"${BINDIR}/autoreconf\";\nLIBTOOLIZE=\"${BINDIR}/libtoolize\";\nPKGCONFIG=\"${BINDIR}/pkg-config\";\n\nif test \"${OSTYPE}\" = \"msys\";\nthen\n\t# Work-around for autopoint failing to detect gettext version\n\t# using func_trace (which is not available) on MSYS by writing\n\t# the gettext version to intl/VERSION.\n\tif ! test -d intl;\n\tthen\n\t\tmkdir intl;\n\tfi\n\tGETTEXT_VERSION=`gettext --version | head -n1 | sed 's/^.* //'`;\n\n\techo \"gettext-${GETTEXT_VERSION}\" > intl/VERSION;\n\nelif ! test -x \"${PKGCONFIG}\";\nthen\n\tif test \"${BINDIR}\" != \"/usr/bin\";\n\tthen\n\t\t# On OpenBSD most of the autotools are located in\n\t\t# /usr/local/bin while pkg-config is located in /usr/bin\n\t\tPKGCONFIG=\"/usr/bin/pkg-config\";\n\tfi\n\tif ! test -x \"${PKGCONFIG}\";\n\tthen\n\t\techo \"Unable to find: pkg-config\";\n\n\t\texit ${EXIT_FAILURE};\n\tfi\nfi\n\nif test -x \"${AUTORECONF}\";\nthen\n\t${AUTORECONF} --force --install\n\tif test $? -ne 0;\n\tthen\n\t\texit $?;\n\tfi\nelse\n\tif ! test -x \"${ACLOCAL}\";\n\tthen\n\t\techo \"Unable to find: aclocal\";\n\n\t\texit ${EXIT_FAILURE};\n\tfi\n\tif ! test -x \"${AUTOCONF}\";\n\t\tthen\n\t\techo \"Unable to find: autoconf\";\n\n\t\texit ${EXIT_FAILURE};\n\tfi\n\tif ! test -x \"${AUTOHEADER}\";\n\tthen\n\t\techo \"Unable to find: autoheader\";\n\n\t\texit ${EXIT_FAILURE};\n\tfi\n\tif ! test -x \"${AUTOMAKE}\";\n\tthen\n\t\techo \"Unable to find: automake\";\n\n\t\texit ${EXIT_FAILURE};\n\tfi\n\tif ! test -x \"${AUTOPOINT}\";\n\tthen\n\t\techo \"Unable to find: autopoint\";\n\n\t\texit ${EXIT_FAILURE};\n\tfi\n\tif ! test -x \"${LIBTOOLIZE}\";\n\tthen\n\t\techo \"Unable to find: libtoolize\";\n\n\t\texit ${EXIT_FAILURE};\n\tfi\n\n\t${AUTOPOINT} --force;\n\tif test $? -ne 0;\n\tthen\n\t\texit $?;\n\tfi\n\n\t${ACLOCAL} --force --install -I m4;\n\tif test $? -ne 0;\n\tthen\n\t\texit $?;\n\tfi\n\n\t${LIBTOOLIZE} --force;\n\tif test $? -ne 0;\n\tthen\n\t\texit $?;\n\tfi\n\n\t${AUTOHEADER} --force;\n\tif test $? -ne 0;\n\tthen\n\t\texit $?;\n\tfi\n\n\t${AUTOCONF} --force;\n\tif test $? -ne 0;\n\tthen\n\t\texit $?;\n\tfi\n\n\t${AUTOMAKE} --force --add-missing;\n\tif test $? -ne 0;\n\tthen\n\t\texit $?;\n\tfi\n\nfi\n\nexit ${EXIT_SUCCESS};\n\n" }, { "path": "build.ps1", "content": "# Script that builds libevtx\n#\n# Version: 20251125\n\nParam (\n\t[string]$Configuration = ${Env:Configuration},\n\t[string]$Platform = ${Env:Platform},\n\t[string]$PlatformToolset = \"\",\n\t[string]$PythonPath = \"C:\\Python311\",\n\t[string]$VisualStudioVersion = \"\",\n\t[string]$VSToolsOptions = \"--extend-with-x64\",\n\t[string]$VSToolsPath = \"..\\vstools\"\n)\n\n$ExitSuccess = 0\n$ExitFailure = 1\n\n$Python = \"${PythonPath}\\python.exe\"\n\n$Git = \"git\"\n$GitUrl = \"https://github.com/libyal/vstools.git\"\n\n$MSVSCppConvert = \"${VSToolsPath}\\vstools\\scripts\\msvscpp_convert.py\"\n\nIf (-Not (Test-Path $Python))\n{\n Write-Host \"Missing Python: ${Python}\" -foreground Red\n\n Exit ${ExitFailure}\n}\nIf (-Not (Test-Path ${VSToolsPath}))\n{\n\t# PowerShell will raise NativeCommandError if git writes to stdout or stderr\n\t# therefore 2>&1 is added and the output is stored in a variable.\n\t$Output = Invoke-Expression -Command \"${Git} clone ${GitUrl} ${VSToolsPath} 2>&1\" | %{ \"$_\" }\n}\nElse\n{\n\tPush-Location \"${VSToolsPath}\"\n\n\tTry\n\t{\n\t\t# Make sure vstools are up to date.\n\t\t$Output = Invoke-Expression -Command \"${Git} pull 2>&1\" | %{ \"$_\" }\n\t}\n\tFinally\n\t{\n\t\tPop-Location\n\t}\n}\nIf (-Not (Test-Path ${MSVSCppConvert}))\n{\n\tWrite-Host \"Missing msvscpp_convert.py: ${MSVSCppConvert}\" -foreground Red\n\n\tExit ${ExitFailure}\n}\nIf (-Not ${VisualStudioVersion})\n{\n\t$VisualStudioVersion = \"2022\"\n\n\tWrite-Host \"Visual Studio version not set defauting to: ${VisualStudioVersion}\" -foreground Red\n}\nIf ((${VisualStudioVersion} -ne \"2008\") -And (${VisualStudioVersion} -ne \"2010\") -And (${VisualStudioVersion} -ne \"2012\") -And (${VisualStudioVersion} -ne \"2013\") -And (${VisualStudioVersion} -ne \"2015\") -And (${VisualStudioVersion} -ne \"2017\") -And (${VisualStudioVersion} -ne \"2019\") -And (${VisualStudioVersion} -ne \"2022\"))\n{\n\tWrite-Host \"Unsupported Visual Studio version: ${VisualStudioVersion}\" -foreground Red\n\n\tExit ${ExitFailure}\n}\n$MSBuild = \"\"\n\nIf (${VisualStudioVersion} -eq \"2008\")\n{\n\t$MSBuild = \"C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\MSBuild.exe\"\n}\nElseIf ((${VisualStudioVersion} -eq \"2010\") -Or (${VisualStudioVersion} -eq \"2012\"))\n{\n\t$MSBuild = \"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe\"\n}\nElseIf (${VisualStudioVersion} -eq \"2013\")\n{\n\t$MSBuild = \"C:\\Program Files (x86)\\MSBuild\\12.0\\Bin\\MSBuild.exe\"\n}\nElseIf (${VisualStudioVersion} -eq \"2015\")\n{\n\t$MSBuild = \"C:\\Program Files (x86)\\MSBuild\\14.0\\Bin\\MSBuild.exe\"\n}\nElseIf (${VisualStudioVersion} -eq \"2017\")\n{\n\t$Results = Get-ChildItem -Path \"C:\\Program Files\\Microsoft Visual Studio\\${VisualStudioVersion}\\*\\MSBuild\\15.0\\Bin\\MSBuild.exe\" -Recurse -ErrorAction SilentlyContinue -Force\n\n\tIf ($Results.Count -eq 0)\n\t{\n\t\t$Results = Get-ChildItem -Path \"C:\\Program Files (x86)\\Microsoft Visual Studio\\${VisualStudioVersion}\\*\\MSBuild\\15.0\\Bin\\MSBuild.exe\" -Recurse -ErrorAction SilentlyContinue -Force\n\t}\n\tIf ($Results.Count -gt 0)\n\t{\n\t\t$MSBuild = $Results[0].FullName\n\t}\n}\nElseIf (${VisualStudioVersion} -eq \"2019\" -Or ${VisualStudioVersion} -eq \"2022\")\n{\n\t$Results = Get-ChildItem -Path \"C:\\Program Files\\Microsoft Visual Studio\\${VisualStudioVersion}\\*\\MSBuild\\Current\\Bin\\MSBuild.exe\" -Recurse -ErrorAction SilentlyContinue -Force\n\n\tIf ($Results.Count -eq 0)\n\t{\n\t\t$Results = Get-ChildItem -Path \"C:\\Program Files (x86)\\Microsoft Visual Studio\\${VisualStudioVersion}\\*\\MSBuild\\Current\\Bin\\MSBuild.exe\" -Recurse -ErrorAction SilentlyContinue -Force\n\t}\n\tIf ($Results.Count -gt 0)\n\t{\n\t\t$MSBuild = $Results[0].FullName\n\t}\n}\nIf (-Not ${MSBuild})\n{\n\tWrite-Host \"Unable to determine path to msbuild.exe\" -foreground Red\n\n\tExit ${ExitFailure}\n}\nElseIf (-Not (Test-Path ${MSBuild}))\n{\n\tWrite-Host \"Missing msbuild.exe: ${MSBuild}\" -foreground Red\n\n\tExit ${ExitFailure}\n}\n\nIf (${VisualStudioVersion} -eq \"2008\")\n{\n\t$VSSolutionPath = \"msvscpp\"\n}\nElse\n{\n\t$VSSolutionPath = \"vs${VisualStudioVersion}\"\n\n\tIf (-Not (Test-Path \"${VSSolutionPath}\"))\n\t{\n\t\t${Env:PYTHONPATH} = ${VSToolsPath}\n\n\t\tInvoke-Expression -Command \"& '${Python}' ${MSVSCppConvert} --output-format ${VisualStudioVersion} ${VSToolsOptions} msvscpp\\libevtx.sln 2>&1\" | %{ \"$_\" }\n\t}\n}\n$VSSolutionFile = \"${VSSolutionPath}\\libevtx.sln\"\n\nIf (-Not (Test-Path \"${VSSolutionFile}\"))\n{\n\tWrite-Host \"Missing Visual Studio ${VisualStudioVersion} solution file: ${VSSolutionFile}\" -foreground Red\n\n\tExit ${ExitFailure}\n}\nIf (-Not ${Configuration})\n{\n\t$Configuration = \"Release\"\n\n\tWrite-Host \"Configuration not set defauting to: ${Configuration}\"\n}\nIf (-Not ${Platform})\n{\n\t$Platform = \"Win32\"\n\n\tWrite-Host \"Platform not set defauting to: ${Platform}\"\n}\n$PlatformToolset = \"\"\n\nIf (-Not ${PlatformToolset})\n{\n\tIf (${VisualStudioVersion} -eq \"2015\")\n\t{\n\t\t$PlatformToolset = \"v140\"\n\t}\n\tElseIf (${VisualStudioVersion} -eq \"2017\")\n\t{\n\t\t$PlatformToolset = \"v141\"\n\t}\n\tElseIf (${VisualStudioVersion} -eq \"2019\")\n\t{\n\t\t$PlatformToolset = \"v142\"\n\t}\n\tElseIf (${VisualStudioVersion} -eq \"2022\")\n\t{\n\t\t$PlatformToolset = \"v143\"\n\t}\n\tWrite-Host \"PlatformToolset not set defauting to: ${PlatformToolset}\"\n}\n$MSBuildOptions = \"/verbosity:quiet /target:Build /property:Configuration=${Configuration},Platform=${Platform}\"\n\nIf (${PlatformToolset})\n{\n\t$MSBuildOptions = \"${MSBuildOptions} /property:PlatformToolset=${PlatformToolset}\"\n}\nIf (${Env:APPVEYOR} -eq \"True\")\n{\n\tInvoke-Expression -Command \"& '${MSBuild}' ${MSBuildOptions} ${VSSolutionFile} /logger:'C:\\Program Files\\AppVeyor\\BuildAgent\\Appveyor.MSBuildLogger.dll' 2>&1\" | %{ \"$_\" }\n}\nElse\n{\n\tInvoke-Expression -Command \"& '${MSBuild}' ${MSBuildOptions} ${VSSolutionFile} 2>&1\" | %{ \"$_\" }\n}\n\nExit ${ExitSuccess}\n" }, { "path": "common/Makefile.am", "content": "AM_CPPFLAGS = \\\n\t-I../include -I$(top_srcdir)/include\n\nEXTRA_DIST = \\\n\tbyte_stream.h \\\n\tcommon.h \\\n\tconfig.h \\\n\tconfig_borlandc.h \\\n\tconfig_msc.h \\\n\tconfig_winapi.h \\\n\tfile_stream.h \\\n\tmemory.h \\\n\tnarrow_string.h \\\n\tsystem_string.h \\\n\ttypes.h \\\n\ttypes.h.in \\\n\twide_string.h\n\nDISTCLEANFILES = \\\n\tconfig.h \\\n\ttypes.h \\\n\tMakefile \\\n\tMakefile.in\n\n" }, { "path": "common/byte_stream.h", "content": "/*\n * Byte stream functions\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#if !defined( _BYTE_STREAM_H )\n#define _BYTE_STREAM_H\n\n#include \"common.h\"\n#include \"types.h\"\n\n#if defined( __cplusplus )\nextern \"C\" {\n#endif\n\n#define _BYTE_STREAM_HOST_IS_ENDIAN_BIG\t\t( *((uint32_t *) \"\\x01\\x02\\x03\\x04\" ) == 0x01020304 )\n#define _BYTE_STREAM_HOST_IS_ENDIAN_LITTLE\t( *((uint32_t *) \"\\x01\\x02\\x03\\x04\" ) == 0x04030201 )\n#define _BYTE_STREAM_HOST_IS_ENDIAN_MIDDLE\t( *((uint32_t *) \"\\x01\\x02\\x03\\x04\" ) == 0x02010403 )\n\n#define _BYTE_STREAM_ENDIAN_BIG\t\t\t(uint8_t) 'b'\n#define _BYTE_STREAM_ENDIAN_LITTLE\t\t(uint8_t) 'l'\n#define _BYTE_STREAM_ENDIAN_MIDDLE\t\t(uint8_t) 'm'\n\ntypedef union byte_stream_float32\n{\n\tfloat floating_point;\n\tuint32_t integer;\n\n} byte_stream_float32_t;\n\ntypedef union byte_stream_float64\n{\n\tdouble floating_point;\n\tuint64_t integer;\n\n} byte_stream_float64_t;\n\n#define byte_stream_copy_to_uint16_big_endian( byte_stream, value ) \\\n\t( value ) = ( byte_stream )[ 0 ]; \\\n\t( value ) <<= 8; \\\n\t( value ) |= ( byte_stream )[ 1 ];\n\n#define byte_stream_copy_to_uint16_little_endian( byte_stream, value ) \\\n\t( value ) = ( byte_stream )[ 1 ]; \\\n\t( value ) <<= 8; \\\n\t( value ) |= ( byte_stream )[ 0 ];\n\n#define byte_stream_copy_to_uint24_big_endian( byte_stream, value ) \\\n\t( value ) = ( byte_stream )[ 0 ]; \\\n\t( value ) <<= 8; \\\n\t( value ) |= ( byte_stream )[ 1 ]; \\\n\t( value ) <<= 8; \\\n\t( value ) |= ( byte_stream )[ 2 ];\n\n#define byte_stream_copy_to_uint24_little_endian( byte_stream, value ) \\\n\t( value ) = ( byte_stream )[ 2 ]; \\\n\t( value ) <<= 8; \\\n\t( value ) |= ( byte_stream )[ 1 ]; \\\n\t( value ) <<= 8; \\\n\t( value ) |= ( byte_stream )[ 0 ];\n\n#define byte_stream_copy_to_uint32_big_endian( byte_stream, value ) \\\n\t( value ) = ( byte_stream )[ 0 ]; \\\n\t( value ) <<= 8; \\\n\t( value ) |= ( byte_stream )[ 1 ]; \\\n\t( value ) <<= 8; \\\n\t( value ) |= ( byte_stream )[ 2 ]; \\\n\t( value ) <<= 8; \\\n\t( value ) |= ( byte_stream )[ 3 ];\n\n#define byte_stream_copy_to_uint32_little_endian( byte_stream, value ) \\\n\t( value ) = ( byte_stream )[ 3 ]; \\\n\t( value ) <<= 8; \\\n\t( value ) |= ( byte_stream )[ 2 ]; \\\n\t( value ) <<= 8; \\\n\t( value ) |= ( byte_stream )[ 1 ]; \\\n\t( value ) <<= 8; \\\n\t( value ) |= ( byte_stream )[ 0 ];\n\n#define byte_stream_copy_to_uint48_big_endian( byte_stream, value ) \\\n\t( value ) = ( byte_stream )[ 0 ]; \\\n\t( value ) <<= 8; \\\n\t( value ) |= ( byte_stream )[ 1 ]; \\\n\t( value ) <<= 8; \\\n\t( value ) |= ( byte_stream )[ 2 ]; \\\n\t( value ) <<= 8; \\\n\t( value ) |= ( byte_stream )[ 3 ]; \\\n\t( value ) <<= 8; \\\n\t( value ) |= ( byte_stream )[ 4 ]; \\\n\t( value ) <<= 8; \\\n\t( value ) |= ( byte_stream )[ 5 ];\n\n#define byte_stream_copy_to_uint48_little_endian( byte_stream, value ) \\\n\t( value ) |= ( byte_stream )[ 5 ]; \\\n\t( value ) <<= 8; \\\n\t( value ) |= ( byte_stream )[ 4 ]; \\\n\t( value ) <<= 8; \\\n\t( value ) |= ( byte_stream )[ 3 ]; \\\n\t( value ) <<= 8; \\\n\t( value ) |= ( byte_stream )[ 2 ]; \\\n\t( value ) <<= 8; \\\n\t( value ) |= ( byte_stream )[ 1 ]; \\\n\t( value ) <<= 8; \\\n\t( value ) |= ( byte_stream )[ 0 ];\n\n#define byte_stream_copy_to_uint64_big_endian( byte_stream, value ) \\\n\t( value ) = ( byte_stream )[ 0 ]; \\\n\t( value ) <<= 8; \\\n\t( value ) |= ( byte_stream )[ 1 ]; \\\n\t( value ) <<= 8; \\\n\t( value ) |= ( byte_stream )[ 2 ]; \\\n\t( value ) <<= 8; \\\n\t( value ) |= ( byte_stream )[ 3 ]; \\\n\t( value ) <<= 8; \\\n\t( value ) |= ( byte_stream )[ 4 ]; \\\n\t( value ) <<= 8; \\\n\t( value ) |= ( byte_stream )[ 5 ]; \\\n\t( value ) <<= 8; \\\n\t( value ) |= ( byte_stream )[ 6 ]; \\\n\t( value ) <<= 8; \\\n\t( value ) |= ( byte_stream )[ 7 ];\n\n#define byte_stream_copy_to_uint64_little_endian( byte_stream, value ) \\\n\t( value ) = ( byte_stream )[ 7 ]; \\\n\t( value ) <<= 8; \\\n\t( value ) |= ( byte_stream )[ 6 ]; \\\n\t( value ) <<= 8; \\\n\t( value ) |= ( byte_stream )[ 5 ]; \\\n\t( value ) <<= 8; \\\n\t( value ) |= ( byte_stream )[ 4 ]; \\\n\t( value ) <<= 8; \\\n\t( value ) |= ( byte_stream )[ 3 ]; \\\n\t( value ) <<= 8; \\\n\t( value ) |= ( byte_stream )[ 2 ]; \\\n\t( value ) <<= 8; \\\n\t( value ) |= ( byte_stream )[ 1 ]; \\\n\t( value ) <<= 8; \\\n\t( value ) |= ( byte_stream )[ 0 ];\n\n#define byte_stream_copy_from_uint16_big_endian( byte_stream, value ) \\\n\t( byte_stream )[ 0 ] = (uint8_t) ( ( ( value ) >> 8 ) & 0x0ff ); \\\n\t( byte_stream )[ 1 ] = (uint8_t) ( ( value ) & 0x0ff )\n\n#define byte_stream_copy_from_uint16_little_endian( byte_stream, value ) \\\n\t( byte_stream )[ 1 ] = (uint8_t) ( ( ( value ) >> 8 ) & 0x0ff ); \\\n\t( byte_stream )[ 0 ] = (uint8_t) ( ( value ) & 0x0ff )\n\n#define byte_stream_copy_from_uint24_big_endian( byte_stream, value ) \\\n\t( byte_stream )[ 0 ] = (uint8_t) ( ( ( value ) >> 16 ) & 0x0ff ); \\\n\t( byte_stream )[ 1 ] = (uint8_t) ( ( ( value ) >> 8 ) & 0x0ff ); \\\n\t( byte_stream )[ 2 ] = (uint8_t) ( ( value ) & 0x0ff )\n\n#define byte_stream_copy_from_uint24_little_endian( byte_stream, value ) \\\n\t( byte_stream )[ 2 ] = (uint8_t) ( ( ( value ) >> 16 ) & 0x0ff ); \\\n\t( byte_stream )[ 1 ] = (uint8_t) ( ( ( value ) >> 8 ) & 0x0ff ); \\\n\t( byte_stream )[ 0 ] = (uint8_t) ( ( value ) & 0x0ff )\n\n#define byte_stream_copy_from_uint32_big_endian( byte_stream, value ) \\\n\t( byte_stream )[ 0 ] = (uint8_t) ( ( ( value ) >> 24 ) & 0x0ff ); \\\n\t( byte_stream )[ 1 ] = (uint8_t) ( ( ( value ) >> 16 ) & 0x0ff ); \\\n\t( byte_stream )[ 2 ] = (uint8_t) ( ( ( value ) >> 8 ) & 0x0ff ); \\\n\t( byte_stream )[ 3 ] = (uint8_t) ( ( value ) & 0x0ff )\n\n#define byte_stream_copy_from_uint32_little_endian( byte_stream, value ) \\\n\t( byte_stream )[ 3 ] = (uint8_t) ( ( ( value ) >> 24 ) & 0x0ff ); \\\n\t( byte_stream )[ 2 ] = (uint8_t) ( ( ( value ) >> 16 ) & 0x0ff ); \\\n\t( byte_stream )[ 1 ] = (uint8_t) ( ( ( value ) >> 8 ) & 0x0ff ); \\\n\t( byte_stream )[ 0 ] = (uint8_t) ( ( value ) & 0x0ff )\n\n#define byte_stream_copy_from_uint48_big_endian( byte_stream, value ) \\\n\t( byte_stream )[ 0 ] = (uint8_t) ( ( ( value ) >> 40 ) & 0x0ff ); \\\n\t( byte_stream )[ 1 ] = (uint8_t) ( ( ( value ) >> 32 ) & 0x0ff ); \\\n\t( byte_stream )[ 2 ] = (uint8_t) ( ( ( value ) >> 24 ) & 0x0ff ); \\\n\t( byte_stream )[ 3 ] = (uint8_t) ( ( ( value ) >> 16 ) & 0x0ff ); \\\n\t( byte_stream )[ 4 ] = (uint8_t) ( ( ( value ) >> 8 ) & 0x0ff ); \\\n\t( byte_stream )[ 5 ] = (uint8_t) ( ( value ) & 0x0ff )\n\n#define byte_stream_copy_from_uint48_little_endian( byte_stream, value ) \\\n\t( byte_stream )[ 5 ] = (uint8_t) ( ( ( value ) >> 40 ) & 0x0ff ); \\\n\t( byte_stream )[ 4 ] = (uint8_t) ( ( ( value ) >> 32 ) & 0x0ff ); \\\n\t( byte_stream )[ 3 ] = (uint8_t) ( ( ( value ) >> 24 ) & 0x0ff ); \\\n\t( byte_stream )[ 2 ] = (uint8_t) ( ( ( value ) >> 16 ) & 0x0ff ); \\\n\t( byte_stream )[ 1 ] = (uint8_t) ( ( ( value ) >> 8 ) & 0x0ff ); \\\n\t( byte_stream )[ 0 ] = (uint8_t) ( ( value ) & 0x0ff )\n\n#define byte_stream_copy_from_uint64_big_endian( byte_stream, value ) \\\n\t( byte_stream )[ 0 ] = (uint8_t) ( ( ( value ) >> 56 ) & 0x0ff ); \\\n\t( byte_stream )[ 1 ] = (uint8_t) ( ( ( value ) >> 48 ) & 0x0ff ); \\\n\t( byte_stream )[ 2 ] = (uint8_t) ( ( ( value ) >> 40 ) & 0x0ff ); \\\n\t( byte_stream )[ 3 ] = (uint8_t) ( ( ( value ) >> 32 ) & 0x0ff ); \\\n\t( byte_stream )[ 4 ] = (uint8_t) ( ( ( value ) >> 24 ) & 0x0ff ); \\\n\t( byte_stream )[ 5 ] = (uint8_t) ( ( ( value ) >> 16 ) & 0x0ff ); \\\n\t( byte_stream )[ 6 ] = (uint8_t) ( ( ( value ) >> 8 ) & 0x0ff ); \\\n\t( byte_stream )[ 7 ] = (uint8_t) ( ( value ) & 0x0ff )\n\n#define byte_stream_copy_from_uint64_little_endian( byte_stream, value ) \\\n\t( byte_stream )[ 7 ] = (uint8_t) ( ( ( value ) >> 56 ) & 0x0ff ); \\\n\t( byte_stream )[ 6 ] = (uint8_t) ( ( ( value ) >> 48 ) & 0x0ff ); \\\n\t( byte_stream )[ 5 ] = (uint8_t) ( ( ( value ) >> 40 ) & 0x0ff ); \\\n\t( byte_stream )[ 4 ] = (uint8_t) ( ( ( value ) >> 32 ) & 0x0ff ); \\\n\t( byte_stream )[ 3 ] = (uint8_t) ( ( ( value ) >> 24 ) & 0x0ff ); \\\n\t( byte_stream )[ 2 ] = (uint8_t) ( ( ( value ) >> 16 ) & 0x0ff ); \\\n\t( byte_stream )[ 1 ] = (uint8_t) ( ( ( value ) >> 8 ) & 0x0ff ); \\\n\t( byte_stream )[ 0 ] = (uint8_t) ( ( value ) & 0x0ff )\n\n#define byte_stream_bit_rotate_left_8bit( byte_stream, number_of_bits ) \\\n\t( ( ( byte_stream ) << ( number_of_bits ) ) | ( ( byte_stream ) >> ( 8 - ( number_of_bits ) ) ) )\n\n#define byte_stream_bit_rotate_right_8bit( byte_stream, number_of_bits ) \\\n\t( ( ( byte_stream ) >> ( number_of_bits ) ) | ( ( byte_stream ) << ( 8 - ( number_of_bits ) ) ) )\n\n#define byte_stream_bit_rotate_left_16bit( byte_stream, number_of_bits ) \\\n\t( ( ( byte_stream ) << ( number_of_bits ) ) | ( ( byte_stream ) >> ( 16 - ( number_of_bits ) ) ) )\n\n#define byte_stream_bit_rotate_right_16bit( byte_stream, number_of_bits ) \\\n\t( ( ( byte_stream ) >> ( number_of_bits ) ) | ( ( byte_stream ) << ( 16 - ( number_of_bits ) ) ) )\n\n#define byte_stream_bit_rotate_left_32bit( byte_stream, number_of_bits ) \\\n\t( ( ( byte_stream ) << ( number_of_bits ) ) | ( ( byte_stream ) >> ( 32 - ( number_of_bits ) ) ) )\n\n#define byte_stream_bit_rotate_right_32bit( byte_stream, number_of_bits ) \\\n\t( ( ( byte_stream ) >> ( number_of_bits ) ) | ( ( byte_stream ) << ( 32 - ( number_of_bits ) ) ) )\n\n#define byte_stream_bit_rotate_left_64bit( byte_stream, number_of_bits ) \\\n\t( ( ( byte_stream ) << ( number_of_bits ) ) | ( ( byte_stream ) >> ( 64 - ( number_of_bits ) ) ) )\n\n#define byte_stream_bit_rotate_right_64bit( byte_stream, number_of_bits ) \\\n\t( ( ( byte_stream ) >> ( number_of_bits ) ) | ( ( byte_stream ) << ( 64 - ( number_of_bits ) ) ) )\n\n#define byte_stream_bit_rotate_left( value, number_of_bits ) \\\n\t( ( ( value ) << ( number_of_bits ) ) | ( ( value ) >> ( ( sizeof( value ) << 3 ) - ( number_of_bits ) ) ) )\n\n#define byte_stream_bit_rotate_right( value, number_of_bits ) \\\n\t( ( ( value ) >> ( number_of_bits ) ) | ( ( value ) << ( ( sizeof( value ) << 3 ) - ( number_of_bits ) ) ) )\n\n#if defined( __cplusplus )\n}\n#endif\n\n#endif /* !defined( _BYTE_STREAM_H ) */\n\n" }, { "path": "common/common.h", "content": "/*\n * Common include file\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#if !defined( _COMMON_H )\n#define _COMMON_H\n\n#if defined( HAVE_CONFIG_H )\n#include \"config.h\"\n#endif\n\n/* Include the Borland/CodeGear C++ Builder compiler specific configuration\n */\n#if defined( __BORLANDC__ )\n#include \"config_borlandc.h\"\n\n/* Include the Microsoft Visual Studio C++ compiler specific configuration\n */\n#elif defined( _MSC_VER )\n#include \"config_msc.h\"\n#endif\n\n#include \"config_winapi.h\"\n\n#endif /* !defined( _COMMON_H ) */\n\n" }, { "path": "common/config_borlandc.h", "content": "/*\n * Configuration for the Borland/CodeGear C++ Builder compiler\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#if !defined( _CONFIG_BORLANDC_H )\n#define _CONFIG_BORLANDC_H\n\n#endif /* !defined( _CONFIG_BORLANDC_H ) */\n\n" }, { "path": "common/config_msc.h", "content": "/*\n * Configuration for the Microsoft Visual Studio C++ compiler\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#if !defined( _CONFIG_MSC_H )\n#define _CONFIG_MSC_H\n\n/* Disable warning C4127: conditional expression is constant\n */\n#pragma warning( disable : 4127 )\n\n/* Disable warning C4201: nonstandard extension used : nameless struct/union\n */\n#pragma warning( disable : 4201 )\n\n#endif /* !defined( _CONFIG_MSC_H ) */\n\n" }, { "path": "common/config_winapi.h", "content": "/*\n * Configuration file for WINAPI\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#if !defined( _CONFIG_WINAPI_H )\n#define _CONFIG_WINAPI_H\n\n/* Define the earliest supported WINAPI version\n#define WINVER\t\t\t\t0x0501\n */\n\n/* If necessary make sure WINAPI is defined\n */\n#if defined( HAVE_WINDOWS_H ) || defined( __BORLANDC__ ) || defined( _MSC_VER )\n#include \n#endif\n\n#if defined( WINAPI )\n\n/* Define to the address where bug reports for this package should be sent.\n */\n#define PACKAGE_BUGREPORT\t\t\"joachim.metz@gmail.com\"\n\n/* Define the size of the integer for WINAPI\n */\n#if !defined( SIZEOF_INT )\n#define SIZEOF_INT\t\t\t4\n#endif\n\n/* Define the size of size_t for WINAPI\n * Do not define when pyconfig.h has been included via python.h\n */\n#if !defined( HAVE_PYCONFIG_H )\n\n#if !defined( SIZEOF_SIZE_T )\n#if __WORDSIZE == 64\n#define SIZEOF_SIZE_T\t\t\t8\n#else\n#define SIZEOF_SIZE_T\t\t\t4\n#endif\n#endif\n\n#endif /* !defined( HAVE_PYCONFIG_H ) */\n\n/* Define the size of the wide character for WINAPI\n */\n#if !defined( SIZEOF_WCHAR_T )\n#define SIZEOF_WCHAR_T\t\t\t2\n#endif\n\n/* Enable the DllMain function\n */\n#define HAVE_DLLMAIN\t\t\t1\n\n/* Enable verbose output\n#define HAVE_VERBOSE_OUTPUT\t\t1\n */\n\n/* Enable debug output\n#define HAVE_DEBUG_OUTPUT\t\t1\n */\n\n/* Enable both the narrow and wide character functions\n */\n#if !defined( HAVE_WIDE_CHARACTER_TYPE )\n#define HAVE_WIDE_CHARACTER_TYPE\t1\n#endif\n\n/* If not controlled by config.h enable multi-thread support\n */\n#if !defined( HAVE_CONFIG_H ) && !defined( HAVE_MULTI_THREAD_SUPPORT )\n#define HAVE_MULTI_THREAD_SUPPORT\t1\n#endif\n\n#endif /* defined( WINAPI ) */\n\n#endif /* !defined( _CONFIG_WINAPI_H ) */\n\n" }, { "path": "common/file_stream.h", "content": "/*\n * FILE stream functions\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#if !defined( _FILE_STREAM_H )\n#define _FILE_STREAM_H\n\n#include \"common.h\"\n\n#if defined( HAVE_GLIB_H )\n#include \n#include \n#endif\n\n#include \n\n#if defined( __cplusplus )\nextern \"C\" {\n#endif\n\n#define FILE_STREAM_OPEN_APPEND\t\t\t\"a\"\n#define FILE_STREAM_OPEN_READ\t\t\t\"r\"\n#define FILE_STREAM_OPEN_WRITE\t\t\t\"w\"\n\n#if defined( WINAPI )\n#define FILE_STREAM_BINARY_OPEN_APPEND\t\t\"ab\"\n#define FILE_STREAM_BINARY_OPEN_READ\t\t\"rb\"\n#define FILE_STREAM_BINARY_OPEN_WRITE\t\t\"wb\"\n\n#else\n#define FILE_STREAM_BINARY_OPEN_APPEND\t\t\"a\"\n#define FILE_STREAM_BINARY_OPEN_READ\t\t\"r\"\n#define FILE_STREAM_BINARY_OPEN_WRITE\t\t\"w\"\n\n#endif\n\n/* narrow character FILE stream open\n */\n#if defined( HAVE_GLIB_H )\n#define file_stream_open( filename, mode ) \\\n\tg_fopen( filename, mode )\n\n#elif defined( HAVE_FOPEN ) || defined( WINAPI )\n#define file_stream_open( filename, mode ) \\\n\tfopen( filename, mode )\n#endif\n\n/* wide character FILE stream open\n */\n#if defined( WINAPI )\n#define file_stream_open_wide( filename, mode ) \\\n\t_wfopen( filename, mode )\n#endif\n\n/* FILE stream close\n */\n#if defined( HAVE_FCLOSE ) || defined( WINAPI )\n#define file_stream_close( stream ) \\\n\tfclose( stream )\n#endif\n\n/* FILE stream read\n */\n#if defined( HAVE_FREAD ) || defined( WINAPI )\n#define file_stream_read( stream, data, size ) \\\n\tfread( data, 1, size, stream )\n#endif\n\n/* FILE stream write\n */\n#if defined( HAVE_FWRITE ) || defined( WINAPI )\n#define file_stream_write( stream, data, size ) \\\n\tfwrite( data, 1, size, stream )\n#endif\n\n/* FILE stream seek\n */\n#if defined( WINAPI )\n#define file_stream_seek_offset( stream, offset, whence ) \\\n\tfseek( stream, offset, whence )\n\n#elif defined( HAVE_FSEEKO )\n#define file_stream_seek_offset( stream, offset, whence ) \\\n\tfseeko( stream, offset, whence )\n\n#elif defined( HAVE_FSEEKO64 )\n#define file_stream_seek_offset( stream, offset, whence ) \\\n\tfseeko64( stream, offset, whence )\n#endif\n\n/* End of FILE stream\n */\n#if defined( HAVE_FEOF ) || defined( WINAPI )\n#define file_stream_at_end( stream ) \\\n feof( stream )\n#endif\n\n/* Get narrow character string from FILE stream\n */\n#if defined( HAVE_FGETS ) || defined( WINAPI )\n#define file_stream_get_string( stream, string, size ) \\\n fgets( string, size, stream )\n#endif\n\n/* Get wide characters string from FILE stream\n */\n#if defined( HAVE_FGETWS ) || defined( WINAPI )\n#define file_stream_get_string_wide( stream, string, size ) \\\n fgetws( string, size, stream )\n#endif\n\n/* Variable arguments formatted print to stream function\n */\n#if defined( HAVE_GLIB_H )\n#define file_stream_vfprintf( stream, format, ... ) \\\n\tg_vfprintf( stream, format, __VA_ARGS__ )\n\n/* Borland BCC previous to version 5.6.0 cannot handle the macro form: MACRO( ... )\n */\n#elif defined( __BORLANDC__ ) && ( __BORLANDC__ < 0x0560 )\n#define file_stream_vfprintf \\\n\tvfprintf\n\n#elif defined( HAVE_VFPRINTF ) || defined( WINAPI )\n#define file_stream_vfprintf( stream, format, ... ) \\\n\tvfprintf( stream, format, __VA_ARGS__ )\n#endif\n\n#if defined( __cplusplus )\n}\n#endif\n\n#endif /* !defined( _FILE_STREAM_H ) */\n\n" }, { "path": "common/memory.h", "content": "/*\n * Memory functions\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#if !defined( _MEMORY_H )\n#define _MEMORY_H\n\n#include \"common.h\"\n\n#if defined( HAVE_GLIB_H )\n#include \n#endif\n\n#if defined( HAVE_STDLIB_H ) || defined( WINAPI )\n#include \n#endif\n\n#if defined( HAVE_STRING_H ) || defined( WINAPI )\n#include \n#endif\n\n#if defined( __cplusplus )\nextern \"C\" {\n#endif\n\n/* Note that 128 MiB is an arbitrary selected upper limit here\n */\n#define MEMORY_MAXIMUM_ALLOCATION_SIZE \\\n\t( 128 * 1024 * 1024 )\n\n/* Memory allocation\n */\n#if defined( HAVE_GLIB_H )\n#define memory_allocate( size ) \\\n\tg_malloc( (gsize) size )\n\n#elif defined( WINAPI )\n#define memory_allocate( size ) \\\n\tHeapAlloc( GetProcessHeap(), 0, (SIZE_T) size )\n\n#elif defined( HAVE_MALLOC )\n#define memory_allocate( size ) \\\n\tmalloc( size )\n#endif\n\n#define memory_allocate_structure( type ) \\\n\t(type *) memory_allocate( sizeof( type ) )\n\n#define memory_allocate_structure_as_value( type ) \\\n\t(intptr_t *) memory_allocate( sizeof( type ) )\n\n/* Memory reallocation\n */\n#if defined( HAVE_GLIB_H )\n#define memory_reallocate( buffer, size ) \\\n\tg_realloc( (gpointer) buffer, (gsize) size )\n\n#elif defined( WINAPI )\n/* HeapReAlloc does not allocate empty (NULL) buffers as realloc does\n */\n#define memory_reallocate( buffer, size ) \\\n\t( buffer == NULL ) ? \\\n\tHeapAlloc( GetProcessHeap(), 0, (SIZE_T) size ) : \\\n\tHeapReAlloc( GetProcessHeap(), 0, (LPVOID) buffer, (SIZE_T) size )\n\n#elif defined( HAVE_REALLOC )\n#define memory_reallocate( buffer, size ) \\\n\trealloc( (void *) buffer, size )\n#endif\n\n/* Memory free\n */\n#if defined( HAVE_GLIB_H )\n#define memory_free( buffer ) \\\n\tg_free( (gpointer) buffer )\n\n#elif defined( WINAPI )\n#define memory_free( buffer ) \\\n\t( buffer == NULL ) ? TRUE : HeapFree( GetProcessHeap(), 0, (LPVOID) buffer )\n\n#elif defined( HAVE_FREE )\n#define memory_free( buffer ) \\\n\tfree( (void *) buffer )\n#endif\n\n/* Memory compare\n */\n#if defined( HAVE_MEMCMP ) || defined( WINAPI )\n#define memory_compare( buffer1, buffer2, size ) \\\n\tmemcmp( (const void *) buffer1, (const void *) buffer2, size )\n#endif\n\n/* Memory copy\n */\n#if defined( HAVE_MEMCPY ) || defined( WINAPI )\n#define memory_copy( destination, source, count ) \\\n\tmemcpy( (void *) destination, (void *) source, count )\n#endif\n\n/* Memory set\n */\n#if defined( HAVE_MEMSET ) || defined( WINAPI )\n#define memory_set( buffer, value, count ) \\\n\tmemset( (void *) buffer, (int) value, count )\n#endif\n\n#if defined( __cplusplus )\n}\n#endif\n\n#endif /* !defined( _MEMORY_H ) */\n\n" }, { "path": "common/narrow_string.h", "content": "/*\n * Narrow character string functions\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#if !defined( _NARROW_STRING_H )\n#define _NARROW_STRING_H\n\n#include \"common.h\"\n#include \"memory.h\"\n#include \"types.h\"\n\n#if defined( HAVE_GLIB_H )\n#include \n#endif\n\n#if defined( HAVE_STDLIB_H ) || defined( WINAPI )\n#include \n#endif\n\n#if defined( HAVE_STRING_H ) || defined( WINAPI )\n#include \n#endif\n\n#if defined( __cplusplus )\nextern \"C\" {\n#endif\n\n/* String allocation\n */\n#define narrow_string_allocate( size ) \\\n\t(char *) memory_allocate( sizeof( char ) * ( size ) )\n\n/* String reallocation\n */\n#define narrow_string_reallocate( string, size ) \\\n\t(char *) memory_reallocate( string, ( sizeof( char ) * ( size ) ) )\n\n/* String length\n */\n#if defined( HAVE_STRLEN ) || defined( WINAPI )\n#define narrow_string_length( string ) \\\n\tstrlen( string )\n#endif\n\n/* String compare\n */\n#if defined( HAVE_MEMCMP ) || defined( WINAPI )\n#define narrow_string_compare( string1, string2, size ) \\\n\tmemcmp( (void *) string1, (void *) string2, size )\n\n#elif defined( HAVE_STRNCMP )\n#define narrow_string_compare( string1, string2, size ) \\\n\tstrncmp( string1, string2, size )\n#endif\n\n/* Caseless string compare\n */\n#if defined( HAVE_GLIB_H )\n#define narrow_string_compare_no_case( string1, string2, size ) \\\n\tg_ascii_strncasecmp( string1, string2, size )\n\n#elif defined( _MSC_VER )\n#define narrow_string_compare_no_case( string1, string2, size ) \\\n\t_strnicmp( string1, string2, size )\n\n#elif ( defined( WINAPI ) && !defined( __CYGWIN__ ) ) || defined( HAVE_STRNICMP )\n#define narrow_string_compare_no_case( string1, string2, size ) \\\n\tstrnicmp( string1, string2, size )\n\n#elif defined( HAVE_STRNCASECMP )\n#define narrow_string_compare_no_case( string1, string2, size ) \\\n\tstrncasecmp( string1, string2, size )\n\n#elif defined( HAVE_STRCASECMP )\n#define narrow_string_compare_no_case( string1, string2, size ) \\\n\tstrcasecmp( string1, string2 )\n#endif\n\n/* String copy\n */\n#if defined( HAVE_MEMCPY ) || defined( WINAPI )\n#define narrow_string_copy( destination, source, size ) \\\n\t(char *) memcpy( (void *) destination, (void *) source, size )\n\n#elif defined( HAVE_STRNCPY )\n#define narrow_string_copy( destination, source, size ) \\\n\tstrncpy( destination, source, size )\n#endif\n\n/* String character search\n */\n#if defined( HAVE_MEMCHR ) || defined( WINAPI )\n#define narrow_string_search_character( string, character, size ) \\\n\t(char *) memchr( (void *) string, (int) character, size )\n\n#elif defined( HAVE_STRCHR )\n#define narrow_string_search_character( string, character, size ) \\\n\tstrchr( string, (int) character )\n#endif\n\n/* String reverse character search\n */\n#if defined( HAVE_MEMRCHR ) && ( HAVE_DECL_MEMRCHR == 1 )\n#define narrow_string_search_character_reverse( string, character, size ) \\\n\t(char *) memrchr( (void *) string, (int) character, size )\n\n#elif defined( HAVE_STRRCHR ) || defined( WINAPI )\n/* (void)(size) is used to suppress unused variable warnings */\n#define narrow_string_search_character_reverse( string, character, size ) \\\n\tstrrchr( string, (int) character ); (void)(size)\n#endif\n\n/* String sub-string search\n */\n#if defined( HAVE_STRSTR ) || defined( WINAPI )\n#define narrow_string_search_string( string, substring, size ) \\\n\tstrstr( string, substring )\n#endif\n\n/* String formatted print (snprintf)\n */\n#if defined( HAVE_GLIB_H )\n#define narrow_string_snprintf( target, size, ... ) \\\n\tg_snprintf( target, size, __VA_ARGS__ )\n\n#elif defined( _MSC_VER )\n#define narrow_string_snprintf( target, size, ... ) \\\n\tsprintf_s( target, size, __VA_ARGS__ )\n\n#elif defined( __BORLANDC__ ) && ( __BORLANDC__ < 0x0560 )\n#define narrow_string_snprintf \\\n\tsnprintf\n\n#elif defined( HAVE_SNPRINTF ) || defined( WINAPI )\n#define narrow_string_snprintf( target, size, ... ) \\\n\tsnprintf( target, size, __VA_ARGS__ )\n#endif\n\n/* String input conversion (sscanf)\n */\n#if defined( __BORLANDC__ ) && ( __BORLANDC__ < 0x0560 )\n#define narrow_string_sscanf \\\n\tsscanf\n\n#elif defined( HAVE_SSCANF ) || defined( WINAPI )\n#define narrow_string_sscanf( string, format, ... ) \\\n\tsscanf( string, format, __VA_ARGS__ )\n#endif\n\n/* Variable arguments formatted print to string function (vsnprintf)\n */\n#if defined( HAVE_GLIB_H )\n#define narrow_string_vsnprintf( string, size, format, ... ) \\\n\tg_vsnprintf( string, size, format, __VA_ARGS__ )\n\n#elif defined( __BORLANDC__ ) && ( __BORLANDC__ < 0x0560 )\n#define narrow_string_vsnprintf \\\n\tvsnprintf\n\n#elif defined( HAVE_VSNPRINTF ) || defined( WINAPI )\n#define narrow_string_vsnprintf( string, size, format, ... ) \\\n\tvsnprintf( string, size, format, __VA_ARGS__ )\n#endif\n\n#if defined( __cplusplus )\n}\n#endif\n\n#endif /* !defined( _NARROW_STRING_H ) */\n\n" }, { "path": "common/system_string.h", "content": "/*\n * System character string functions\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#if !defined( _SYSTEM_STRING_H )\n#define _SYSTEM_STRING_H\n\n#include \"common.h\"\n#include \"narrow_string.h\"\n#include \"types.h\"\n#include \"wide_string.h\"\n\n#if defined( _cplusplus )\nextern \"C\" {\n#endif\n\n#if defined( HAVE_WIDE_SYSTEM_CHARACTER )\n\n#if SIZEOF_WCHAR_T != 2\n#error Unsupported wide system character size\n#endif\n\n/* Intermediate version of the macro required\n * for correct evaluation predefined string\n */\n#define _SYSTEM_STRING_INTERMEDIATE( string ) \\\n\tL ## string\n\n#define _SYSTEM_STRING( string ) \\\n\t_SYSTEM_STRING_INTERMEDIATE( string )\n\n#define system_string_allocate( size ) \\\n\twide_string_allocate( size )\n\n#define system_string_reallocate( string, size ) \\\n\twide_string_reallocate( string, size )\n\n#define system_string_compare( destination, source, size ) \\\n\twide_string_compare( destination, source, size )\n\n#define system_string_compare_no_case( destination, source, size ) \\\n\twide_string_compare_no_case( destination, source, size )\n\n#define system_string_copy( destination, source, size ) \\\n\twide_string_copy( destination, source, size )\n\n#define system_string_length( string ) \\\n\twide_string_length( string )\n\n#define system_string_search_character( string, character, size ) \\\n\twide_string_search_character( string, character, size )\n\n#define system_string_search_character_reverse( string, character, size ) \\\n\twide_string_search_character_reverse( string, character, size )\n\n#define system_string_search_string( string, substring, size ) \\\n\twide_string_search_string( string, substring, size )\n\n#if defined( __BORLANDC__ ) && ( __BORLANDC__ < 0x0560 )\n#define system_string_sprintf \\\n\twide_string_snwprintf\n\n#else\n#define system_string_sprintf( string, size, format, ... ) \\\n\twide_string_snwprintf( string, size, format, __VA_ARGS__ )\n#endif\n\n#if defined( __BORLANDC__ ) && ( __BORLANDC__ < 0x0560 )\n#define system_string_vsnprintf \\\n\twide_string_vsnwprintf\n\n#else\n#define system_string_vsnprintf( string, size, format, ... ) \\\n\twide_string_vsnwprintf( string, size, format, __VA_ARGS__ )\n#endif\n\n#else\n\n#define _SYSTEM_STRING( string ) \\\n\tstring\n\n#define system_string_allocate( size ) \\\n\tnarrow_string_allocate( size )\n\n#define system_string_reallocate( string, size ) \\\n\tnarrow_string_reallocate( string, size )\n\n#define system_string_compare( destination, source, size ) \\\n\tnarrow_string_compare( destination, source, size )\n\n#define system_string_compare_no_case( destination, source, size ) \\\n\tnarrow_string_compare_no_case( destination, source, size )\n\n#define system_string_copy( destination, source, size ) \\\n\tnarrow_string_copy( destination, source, size )\n\n#define system_string_length( string ) \\\n\tnarrow_string_length( string )\n\n#define system_string_search_character( string, character, size ) \\\n\tnarrow_string_search_character( string, character, size )\n\n#define system_string_search_character_reverse( string, character, size ) \\\n\tnarrow_string_search_character_reverse( string, character, size )\n\n#define system_string_search_string( string, substring, size ) \\\n\tnarrow_string_search_string( string, substring, size )\n\n#if defined( __BORLANDC__ ) && ( __BORLANDC__ < 0x0560 )\n#define system_string_sprintf \\\n\tnarrow_string_snprintf\n\n#else\n#define system_string_sprintf( string, size, format, ... ) \\\n\tnarrow_string_snprintf( string, size, format, __VA_ARGS__ )\n#endif\n\n#if defined( __BORLANDC__ ) && ( __BORLANDC__ < 0x0560 )\n#define system_string_vsnprintf \\\n\tnarrow_string_vsnprintf\n\n#else\n#define system_string_vsnprintf( string, size, format, ... ) \\\n\tnarrow_string_vsnprintf( string, size, format, __VA_ARGS__ )\n#endif\n\n#endif /* defined( HAVE_WIDE_SYSTEM_CHARACTER ) */\n\n/* For backwards compatibility */\n#define system_string_vsprintf system_string_vsnprintf\n\n#if defined( _cplusplus )\n}\n#endif\n\n#endif /* !defined( _SYSTEM_STRING_H ) */\n\n" }, { "path": "common/types.h.in", "content": "/*\n * Type and type-support definitions\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#if !defined( _TYPES_H )\n#define _TYPES_H\n\n#include \"common.h\"\n\n#if defined( HAVE_LIMITS_H ) || defined( WINAPI )\n#include \n#endif\n\n/* Make sure to include inttypes.h or stdint.h before\n * PRI definitions are defined\n */\n#include <@PACKAGE@/types.h>\n\n#if defined( WINAPI ) && ( defined( _UNICODE ) || defined( UNICODE ) )\n\n#define HAVE_WIDE_SYSTEM_CHARACTER 1\n\n/* The system character type is wide\n * A system string contains either UTF-16 or UTF-32\n */\ntypedef wchar_t system_character_t;\ntypedef wint_t system_integer_t;\n\n#define PRIc_SYSTEM \"lc\"\n#define PRIs_SYSTEM \"ls\"\n\n#else\n\n/* The system character type is narrow\n * A system string contains either UTF-8 or extended ASCII with a codepage\n */\ntypedef char system_character_t;\ntypedef int system_integer_t;\n\n#define PRIc_SYSTEM \"c\"\n#define PRIs_SYSTEM \"s\"\n\n#endif /* defined( WINAPI ) && ( defined( _UNICODE ) || defined( UNICODE ) ) */\n\n/* Fallback for systems without PRI definitions\n * Do not define when pyconfig.h has been included via python.h\n */\n#if !defined( HAVE_PYCONFIG_H )\n\n#if !defined( PRId8 )\n#define PRId8 \"d\"\n#endif\n\n#if !defined( PRId16 )\n#define PRId16 \"d\"\n#endif\n\n#if !defined( PRId32 )\n#if defined( WINAPI )\n#define PRId32 \"I32d\"\n\n#else\n#define PRId32 \"d\"\n\n#endif\n#endif /* !defined( PRId32 ) */\n\n#if !defined( PRId64 )\n#if defined( WINAPI )\n#define PRId64 \"I64d\"\n\n#elif __WORDSIZE == 64\n#define PRId64 \"ld\"\n\n#else\n#define PRId64 \"lld\"\n\n#endif\n#endif /* !defined( PRId64 ) */\n\n#if !defined( PRIi8 )\n#define PRIi8 \"i\"\n#endif\n\n#if !defined( PRIi16 )\n#define PRIi16 \"i\"\n#endif\n\n#if !defined( PRIi32 )\n#if defined( WINAPI )\n#define PRIi32 \"I32i\"\n\n#else\n#define PRIi32 \"i\"\n\n#endif\n#endif /* !defined( PRIi32 ) */\n\n#if !defined( PRIi64 )\n#if defined( WINAPI )\n#define PRIi64 \"I64i\"\n\n#elif __WORDSIZE == 64\n#define PRIi64 \"li\"\n\n#else\n#define PRIi64 \"lli\"\n\n#endif\n#endif /* !defined( PRIi64 ) */\n\n#if !defined( PRIu8 )\n#define PRIu8 \"u\"\n#endif\n\n#if !defined( PRIu16 )\n#define PRIu16 \"u\"\n#endif\n\n#if !defined( PRIu32 )\n#if defined( WINAPI )\n#define PRIu32 \"I32u\"\n\n#else\n#define PRIu32 \"u\"\n\n#endif\n#endif /* !defined( PRIu32 ) */\n\n#if !defined( PRIu64 )\n#if defined( WINAPI )\n#define PRIu64 \"I64u\"\n\n#elif __WORDSIZE == 64\n#define PRIu64 \"lu\"\n\n#else\n#define PRIu64 \"llu\"\n\n#endif\n#endif /* !defined( PRIu64 ) */\n\n#if !defined( PRIo8 )\n#define PRIo8 \"o\"\n#endif\n\n#if !defined( PRIo16 )\n#define PRIo16 \"o\"\n#endif\n\n#if !defined( PRIo32 )\n#if defined( WINAPI )\n#define PRIo32 \"I32o\"\n\n#else\n#define PRIo32 \"o\"\n\n#endif\n#endif /* !defined( PRIo32 ) */\n\n#if !defined( PRIo64 )\n#if defined( WINAPI )\n#define PRIo64 \"I64o\"\n\n#elif __WORDSIZE == 64\n#define PRIo64 \"lo\"\n\n#else\n#define PRIo64 \"llo\"\n\n#endif\n#endif /* !defined( PRIo64 ) */\n\n#if !defined( PRIx8 )\n#define PRIx8 \"x\"\n#endif\n\n#if !defined( PRIx16 )\n#define PRIx16 \"x\"\n#endif\n\n#if !defined( PRIx32 )\n#if defined( WINAPI )\n#define PRIx32 \"I32x\"\n\n#else\n#define PRIx32 \"x\"\n\n#endif\n#endif /* !defined( PRIx32 ) */\n\n#if !defined( PRIx64 )\n#if defined( WINAPI )\n#define PRIx64 \"I64x\"\n\n#elif __WORDSIZE == 64\n#define PRIx64 \"lx\"\n\n#else\n#define PRIx64 \"llx\"\n\n#endif\n#endif /* !defined( PRIx64 ) */\n\n#endif /* !defined( HAVE_PYCONFIG_H ) */\n\n/* Fallback for systems without printf %jd definition\n */\n#if defined( HAVE_PRINTF_JD )\n#define PRIjd\t\"jd\"\n#define PRIji\t\"ji\"\n#define PRIju\t\"ju\"\n#define PRIjx\t\"jx\"\n\n#elif SIZEOF_OFF_T == 8\n#define PRIjd\tPRId64\n#define PRIji\tPRIi64\n#define PRIju\tPRIu64\n#define PRIjx\tPRIx64\n\n#else\n#define PRIjd\tPRId32\n#define PRIji\tPRIi32\n#define PRIju\tPRIu32\n#define PRIjx\tPRIx32\n\n#endif /* defined( HAVE_PRINTF_JD ) */\n\n/* Fallback for systems without printf %zd definition\n */\n#if defined( HAVE_PRINTF_ZD )\n#define PRIzd\t\"zd\"\n#define PRIzi\t\"zi\"\n#define PRIzu\t\"zu\"\n#define PRIzx\t\"zx\"\n\n#elif defined( _MSC_VER )\n#define PRIzd\t\"Id\"\n#define PRIzi\t\"Ii\"\n#define PRIzu\t\"Iu\"\n#define PRIzx\t\"Ix\"\n\n#elif SIZEOF_SIZE_T == 8\n#define PRIzd\tPRId64\n#define PRIzi\tPRIi64\n#define PRIzu\tPRIu64\n#define PRIzx\tPRIx64\n\n#else\n#define PRIzd\tPRId32\n#define PRIzi\tPRIi32\n#define PRIzu\tPRIu32\n#define PRIzx\tPRIx32\n\n#endif /* defined( HAVE_PRINTF_ZD ) */\n\n/* Fallback for systems without (U)INTx_MAX definitions\n */\n\n/* The maximum signed 8-bit integer is 127 (0x7f)\n */\n#if !defined( INT8_MAX )\n#define INT8_MAX (0x7f)\n#endif\n\n/* The maximum unsigned 8-bit integer is 256 (0xff)\n */\n#if !defined( UINT8_MAX )\n#define UINT8_MAX (0xff)\n#endif\n\n/* The maximum signed 16-bit integer is 32767 (0x7ffff)\n */\n#if !defined( INT16_MAX )\n#define INT16_MAX (0x7fff)\n#endif\n\n/* The maximum unsigned 16-bit integer is 65535 (0xffff)\n */\n#if !defined( UINT16_MAX )\n#define UINT16_MAX (0xffff)\n#endif\n\n/* The maximum signed 32-bit integer is 2147483647 (0x7fffffff)\n */\n#if !defined( INT32_MAX )\n#define INT32_MAX (0x7fffffffL)\n#endif\n\n/* The maximum unsigned 32-bit integer is 4294967295 (0xffffffff)\n */\n#if !defined( UINT32_MAX )\n#define UINT32_MAX (0xffffffffUL)\n#endif\n\n/* The minimum signed 64-bit integer is -9223372036854775808 (0x8000000000000000)\n */\n#if !defined( INT64_MIN )\n#if defined( __BORLANDC__ ) && ( __BORLANDC__ < 0x0560 )\n#define INT64_MIN (0x8000000000000000UL)\n#else\n#define INT64_MIN (0x8000000000000000ULL)\n#endif\n#endif /* !defined( INT64_MIN ) */\n\n/* The maximum signed 64-bit integer is 9223372036854775807 (0x7fffffffffffffff)\n */\n#if !defined( INT64_MAX )\n#if defined( __BORLANDC__ ) && ( __BORLANDC__ < 0x0560 )\n#define INT64_MAX (0x7fffffffffffffffUL)\n#else\n#define INT64_MAX (0x7fffffffffffffffULL)\n#endif\n#endif /* !defined( INT64_MAX ) */\n\n/* The maximum unsigned 64-bit integer is 18446744073709551615 (0xffffffffffffffff)\n */\n#if !defined( UINT64_MAX )\n#if defined( __BORLANDC__ ) && ( __BORLANDC__ < 0x0560 )\n#define UINT64_MAX (0xffffffffffffffffUL)\n#else\n#define UINT64_MAX (0xffffffffffffffffULL)\n#endif\n#endif /* !defined( UINT64_MAX ) */\n\n/* The maximum signed integer\n */\n#if !defined( INT_MAX )\n#define INT_MAX INT32_MAX\n#endif\n\n/* The maximum unsigned integer\n */\n#if !defined( UINT_MAX )\n#define UINT_MAX UINT32_MAX\n#endif\n\n/* The maximum signed long integer\n */\n#if !defined( LONG_MAX )\n#define LONG_MAX INT32_MAX\n#endif\n\n/* The maximum unsigned long integer\n */\n#if !defined( ULONG_MAX )\n#define ULONG_MAX UINT32_MAX\n#endif\n\n/* The maximum signed size type is platform dependent\n */\n#if !defined( SSIZE_MAX )\n\n#if defined( WINAPI )\n\n#if defined( _WIN64 )\n#define SSIZE_MAX INT64_MAX\n#else\n#define SSIZE_MAX INT32_MAX\n#endif\n\n#else\n\n#if __WORDSIZE == 64\n#define SSIZE_MAX INT64_MAX\n#else\n#define SSIZE_MAX INT32_MAX\n#endif\n\n#endif /* WINAPI */\n\n#endif /* SSIZE_MAX */\n\n#endif /* !defined( _TYPES_H ) */\n\n" }, { "path": "common/wide_string.h", "content": "/*\n * Wide character string functions\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#if !defined( _WIDE_STRING_H )\n#define _WIDE_STRING_H\n\n#include \"common.h\"\n#include \"memory.h\"\n#include \"types.h\"\n\n#if defined( HAVE_WCHAR_H ) || defined( WINAPI )\n#include \n#endif\n\n#if defined( __cplusplus )\nextern \"C\" {\n#endif\n\n/* Intermediate version of the macro required\n * for correct evaluation predefined string\n */\n#define _WIDE_STRING_INTERMEDIATE( string ) \\\n\tL ## string\n\n#define _WIDE_STRING( string ) \\\n\t_WIDE_STRING_INTERMEDIATE( string )\n\n/* String allocation\n */\n#define wide_string_allocate( size ) \\\n\t(wchar_t *) memory_allocate( sizeof( wchar_t ) * ( size ) )\n\n/* String reallocation\n */\n#define wide_string_reallocate( string, size ) \\\n\t(wchar_t *) memory_reallocate( string, ( sizeof( wchar_t ) * ( size ) ) )\n\n/* String length\n */\n#if defined( HAVE_WCSLEN ) || defined( WINAPI )\n#define wide_string_length( string ) \\\n\twcslen( string )\n#endif\n\n/* String compare\n */\n#if defined( HAVE_WMEMCMP )\n#define wide_string_compare( string1, string2, size ) \\\n\twmemcmp( (void *) string1, (void *) string2, size )\n\n#elif defined( HAVE_WCSNCMP ) || defined( WINAPI )\n#define wide_string_compare( string1, string2, size ) \\\n\twcsncmp( string1, string2, size )\n#endif\n\n/* Caseless string compare\n */\n#if defined( _MSC_VER ) || ( defined( __BORLANDC__ ) && ( __BORLANDC__ >= 0x0551 ) )\n#define wide_string_compare_no_case( string1, string2, size ) \\\n\t_wcsnicmp( string1, string2, size )\n\n#elif ( defined( WINAPI ) && !defined( __CYGWIN__ ) ) || defined( HAVE_WCSNICMP )\n#define wide_string_compare_no_case( string1, string2, size ) \\\n\twcsnicmp( string1, string2, size )\n\n#elif defined( HAVE_WCSNCASECMP )\n#define wide_string_compare_no_case( string1, string2, size ) \\\n\twcsncasecmp( string1, string2, size )\n\n#elif defined( HAVE_WCSCASECMP )\n#define wide_string_compare_no_case( string1, string2, size ) \\\n\twcscasecmp( string1, string2 )\n#endif\n\n/* String copy\n */\n#if defined( HAVE_WMEMCPY )\n#define wide_string_copy( destination, source, size ) \\\n\t(wchar_t *) wmemcpy( (void *) destination, (void *) source, size )\n\n#elif defined( HAVE_WCSNCPY ) || defined( WINAPI )\n#define wide_string_copy( destination, source, size ) \\\n\twcsncpy( destination, source, size )\n#endif\n\n/* String character search\n */\n#if defined( HAVE_WMEMCHR )\n#define wide_string_search_character( string, character, size ) \\\n\t(wchar_t *) wmemchr( (void *) string, (wchar_t) character, size )\n\n#elif defined( HAVE_WCSCHR ) || defined( WINAPI )\n#define wide_string_search_character( string, character, size ) \\\n\twcschr( string, (wchar_t) character )\n\n#endif\n\n/* String reverse character search\n */\n#if defined( HAVE_WMEMRCHR )\n#define wide_string_search_character_reverse( string, character, size ) \\\n\t(wchar_t *) wmemrchr( (void *) string, (wchar_t) character, size )\n\n#elif defined( HAVE_WCSRCHR ) || defined( WINAPI )\n/* (void)(size) is used to suppress unused variable warnings */\n#define wide_string_search_character_reverse( string, character, size ) \\\n\twcsrchr( string, (wchar_t) character ); (void)(size)\n#endif\n\n/* String sub-string search\n */\n#if defined( HAVE_WCSSTR ) || defined( WINAPI )\n#define wide_string_search_string( string, substring, size ) \\\n\twcsstr( string, substring )\n\n#endif\n\n/* String formatted print (snwprintf)\n */\n#if defined( _MSC_VER )\n#define wide_string_snwprintf( target, size, ... ) \\\n\tswprintf_s( target, size, __VA_ARGS__ )\n\n#elif defined( __BORLANDC__ ) && ( __BORLANDC__ < 0x0560 )\n#define wide_string_snwprintf \\\n\tsnwprintf\n\n#elif defined( WINAPI )\n#define wide_string_snwprintf( target, size, ... ) \\\n\tsnwprintf( target, size, __VA_ARGS__ )\n\n#elif defined( HAVE_SWPRINTF )\n#define wide_string_snwprintf( target, size, ... ) \\\n\tswprintf( target, size, __VA_ARGS__ )\n#endif\n\n/* Variable arguments formatted print to string function (vsnwprintf)\n */\n#if defined( __BORLANDC__ ) && ( __BORLANDC__ < 0x0560 )\n#define wide_string_vsnwprintf \\\n\t_vsnwprintf\n\n#elif defined( WINAPI )\n#define wide_string_vsnwprintf( string, size, format, ... ) \\\n\t_vsnwprintf( string, size, format, __VA_ARGS__ )\n\n#elif defined( HAVE_VSWPRINTF )\n#define wide_string_vsnwprintf( string, size, format, ... ) \\\n\tvswprintf( string, size, format, __VA_ARGS__ )\n#endif\n\n#if defined( __cplusplus )\n}\n#endif\n\n#endif /* !defined( _WIDE_STRING_H ) */\n\n" }, { "path": "configure.ac", "content": "AC_PREREQ([2.71])\n\nAC_INIT(\n [libevtx],\n [20251215],\n [joachim.metz@gmail.com])\n\nAC_CONFIG_SRCDIR(\n [include/libevtx.h.in])\n\nAM_INIT_AUTOMAKE([gnu 1.6 tar-ustar])\nAM_EXTRA_RECURSIVE_TARGETS([sources splint])\n\nAC_CONFIG_MACRO_DIR([m4])\n\ndnl Check for host type\nAC_CANONICAL_HOST\n\ndnl Check for libtool DLL support\nLT_INIT([win32-dll])\n\ndnl Checks for programs\nAC_PROG_CC\nAC_PROG_GCC_TRADITIONAL\nAC_PROG_CXX\nAC_PROG_MAKE_SET\nAC_PROG_INSTALL\n\ndnl Check for libtool\nAC_SUBST(LIBTOOL_DEPS)\n\ndnl Check for pkg-config\nAC_PATH_PROG(PKGCONFIG,[pkg-config])\n\ndnl Support of internationalization (i18n)\nAM_GNU_GETTEXT([external])\nAM_GNU_GETTEXT_VERSION([0.21])\n\ndnl Check for compiler language support\nAC_C_CONST\nAC_C_VOLATILE\n\ndnl Check for large file support\nAC_SYS_LARGEFILE\n\ndnl Check if shared library support should be disabled\nAX_COMMON_CHECK_DISABLE_SHARED_LIBS\n\ndnl Check if tools should be build as static executables\nAX_COMMON_CHECK_ENABLE_STATIC_EXECUTABLES\n\ndnl Check if WINAPI support should be enabled\nAX_COMMON_CHECK_ENABLE_WINAPI\n\ndnl Check if wide character type should be enabled\nAX_COMMON_CHECK_ENABLE_WIDE_CHARACTER_TYPE\n\ndnl Check if verbose output should be enabled\nAX_COMMON_CHECK_ENABLE_VERBOSE_OUTPUT\n\ndnl Check if debug output should be enabled\nAX_COMMON_CHECK_ENABLE_DEBUG_OUTPUT\n\ndnl Check for type definitions\nAX_TYPES_CHECK_LOCAL\n\ndnl Check if common required headers and functions are available\nAX_COMMON_CHECK_LOCAL\n\ndnl Check if libcerror or required headers and functions are available\nAX_LIBCERROR_CHECK_ENABLE\n\ndnl Check if libcthreads or required headers and functions are available\nAX_LIBCTHREADS_CHECK_ENABLE\n\ndnl Check if libcdata or required headers and functions are available\nAX_LIBCDATA_CHECK_ENABLE\n\ndnl Check if libclocale or required headers and functions are available\nAX_LIBCLOCALE_CHECK_ENABLE\n\ndnl Check if libcnotify or required headers and functions are available\nAX_LIBCNOTIFY_CHECK_ENABLE\n\ndnl Check if libcsplit or required headers and functions are available\nAX_LIBCSPLIT_CHECK_ENABLE\n\ndnl Check if libuna or required headers and functions are available\nAX_LIBUNA_CHECK_ENABLE\n\ndnl Check if libcfile or required headers and functions are available\nAX_LIBCFILE_CHECK_ENABLE\n\ndnl Check if libcpath or required headers and functions are available\nAX_LIBCPATH_CHECK_ENABLE\n\ndnl Check if libbfio or required headers and functions are available\nAX_LIBBFIO_CHECK_ENABLE\n\ndnl Check if libfcache or required headers and functions are available\nAX_LIBFCACHE_CHECK_ENABLE\n\ndnl Check if libfdata or required headers and functions are available\nAX_LIBFDATA_CHECK_ENABLE\n\ndnl Check if libfdatetime or required headers and functions are available\nAX_LIBFDATETIME_CHECK_ENABLE\n\ndnl Check if libfguid or required headers and functions are available\nAX_LIBFGUID_CHECK_ENABLE\n\ndnl Check if libfvalue or required headers and functions are available\nAX_LIBFVALUE_CHECK_ENABLE\n\ndnl Check if libfwevt or required headers and functions are available\nAX_LIBFWEVT_CHECK_ENABLE\n\ndnl Check if libfwnt or required headers and functions are available\nAX_LIBFWNT_CHECK_ENABLE\n\ndnl Check if libevtx required headers and functions are available\nAX_LIBEVTX_CHECK_LOCAL\n\ndnl Check if libevtx Python bindings (pyevtx) required headers and functions are available\nAX_PYTHON_CHECK_ENABLE\n\nAS_IF(\n [test \"x${ac_cv_enable_python}\" != xno],\n [dnl Headers included in pyevtx/pyevtx_error.c\n AC_CHECK_HEADERS([stdarg.h varargs.h])\n\n AS_IF(\n [test \"x$ac_cv_header_stdarg_h\" != xyes && test \"x$ac_cv_header_varargs_h\" != xyes],\n [AC_MSG_FAILURE(\n [Missing headers: stdarg.h and varargs.h],\n [1])\n ])\n ])\n\ndnl Check if libexe or required headers and functions are available\nAX_LIBEXE_CHECK_ENABLE\n\ndnl Check if libregf or required headers and functions are available\nAX_LIBREGF_CHECK_ENABLE\n\ndnl Check if libwrc or required headers and functions are available\nAX_LIBWRC_CHECK_ENABLE\n\ndnl Check if libcdirectory or required headers and functions are available\nAX_LIBCDIRECTORY_CHECK_ENABLE\n\ndnl Check if evtxtools required headers and functions are available\nAX_EVTXTOOLS_CHECK_LOCAL\n\ndnl Check if DLL support is needed\nAX_LIBEVTX_CHECK_DLL_SUPPORT\n\ndnl Check if tests required headers and functions are available\nAX_TESTS_CHECK_LOCAL\nAX_TESTS_CHECK_OSSFUZZ\n\ndnl Set additional compiler flags\nCFLAGS=\"$CFLAGS -Wall\";\n\ndnl Check if requires and build requires should be set in spec file\nAS_IF(\n [test \"x$ac_cv_libcerror\" = xyes || test \"x$ac_cv_libcthreads\" = xyes || test \"x$ac_cv_libcdata\" = xyes || test \"x$ac_cv_libclocale\" = xyes || test \"x$ac_cv_libcnotify\" = xyes || test \"x$ac_cv_libcsplit\" = xyes || test \"x$ac_cv_libuna\" = xyes || test \"x$ac_cv_libcfile\" = xyes || test \"x$ac_cv_libcpath\" = xyes || test \"x$ac_cv_libbfio\" = xyes || test \"x$ac_cv_libfcache\" = xyes || test \"x$ac_cv_libfdata\" = xyes || test \"x$ac_cv_libfdatetime\" = xyes || test \"x$ac_cv_libfguid\" = xyes || test \"x$ac_cv_libfvalue\" = xyes || test \"x$ac_cv_libfwevt\" = xyes || test \"x$ac_cv_libfwnt\" = xyes],\n [AC_SUBST(\n [libevtx_spec_requires],\n [Requires:])\n ])\n\nAS_IF(\n [test \"x$ac_cv_libexe\" = xyes || test \"x$ac_cv_libregf\" = xyes || test \"x$ac_cv_libwrc\" = xyes || test \"x$ac_cv_libcdirectory\" = xyes],\n [AC_SUBST(\n [libevtx_spec_tools_build_requires],\n [BuildRequires:])\n ])\n\ndnl Set the date for the dpkg files\nAC_SUBST(\n [DPKG_DATE],\n [`date -R 2> /dev/null`])\n\ndnl Set the date for the spec file\nAC_SUBST(\n [SPEC_DATE],\n [`date +\"%a %b %e %Y\" 2> /dev/null`])\n\ndnl Generate Makefiles\nAC_CONFIG_FILES([Makefile])\nAC_CONFIG_FILES([include/Makefile])\nAC_CONFIG_FILES([common/Makefile])\nAC_CONFIG_FILES([libcerror/Makefile])\nAC_CONFIG_FILES([libcthreads/Makefile])\nAC_CONFIG_FILES([libcdata/Makefile])\nAC_CONFIG_FILES([libclocale/Makefile])\nAC_CONFIG_FILES([libcnotify/Makefile])\nAC_CONFIG_FILES([libcsplit/Makefile])\nAC_CONFIG_FILES([libuna/Makefile])\nAC_CONFIG_FILES([libcfile/Makefile])\nAC_CONFIG_FILES([libcpath/Makefile])\nAC_CONFIG_FILES([libbfio/Makefile])\nAC_CONFIG_FILES([libfcache/Makefile])\nAC_CONFIG_FILES([libfdata/Makefile])\nAC_CONFIG_FILES([libfdatetime/Makefile])\nAC_CONFIG_FILES([libfguid/Makefile])\nAC_CONFIG_FILES([libfvalue/Makefile])\nAC_CONFIG_FILES([libfwevt/Makefile])\nAC_CONFIG_FILES([libfwnt/Makefile])\nAC_CONFIG_FILES([libevtx/Makefile])\nAC_CONFIG_FILES([pyevtx/Makefile])\nAC_CONFIG_FILES([libexe/Makefile])\nAC_CONFIG_FILES([libregf/Makefile])\nAC_CONFIG_FILES([libwrc/Makefile])\nAC_CONFIG_FILES([libcdirectory/Makefile])\nAC_CONFIG_FILES([evtxtools/Makefile])\nAC_CONFIG_FILES([po/Makefile.in])\nAC_CONFIG_FILES([po/Makevars])\nAC_CONFIG_FILES([manuals/Makefile])\nAC_CONFIG_FILES([tests/Makefile])\nAC_CONFIG_FILES([ossfuzz/Makefile])\nAC_CONFIG_FILES([msvscpp/Makefile])\ndnl Generate header files\nAC_CONFIG_FILES([include/libevtx.h])\nAC_CONFIG_FILES([include/libevtx/definitions.h])\nAC_CONFIG_FILES([include/libevtx/features.h])\nAC_CONFIG_FILES([include/libevtx/types.h])\nAC_CONFIG_FILES([libevtx/libevtx_definitions.h])\ndnl Generate distribution specific files\nAC_CONFIG_FILES([common/types.h])\nAC_CONFIG_FILES([dpkg/changelog])\nAC_CONFIG_FILES([libevtx/libevtx.rc])\nAC_CONFIG_FILES([libevtx.pc])\nAC_CONFIG_FILES([libevtx.spec])\nAC_CONFIG_FILES([setup.cfg])\ndnl Generate a source configuration file\nAC_CONFIG_HEADERS([common/config.h])\n\nAC_OUTPUT\n\ndnl Print a summary\nAC_MSG_NOTICE([\nBuilding:\n libcerror support: $ac_cv_libcerror\n libcthreads support: $ac_cv_libcthreads\n libcdata support: $ac_cv_libcdata\n libclocale support: $ac_cv_libclocale\n libcnotify support: $ac_cv_libcnotify\n libcsplit support: $ac_cv_libcsplit\n libuna support: $ac_cv_libuna\n libcfile support: $ac_cv_libcfile\n libcpath support: $ac_cv_libcpath\n libbfio support: $ac_cv_libbfio\n libfcache support: $ac_cv_libfcache\n libfdata support: $ac_cv_libfdata\n libfdatetime support: $ac_cv_libfdatetime\n libfguid support: $ac_cv_libfguid\n libfvalue support: $ac_cv_libfvalue\n libfwevt support: $ac_cv_libfwevt\n libfwnt support: $ac_cv_libfwnt\n libexe support: $ac_cv_libexe\n libregf support: $ac_cv_libregf\n libwrc support: $ac_cv_libwrc\n libcdirectory support: $ac_cv_libcdirectory\n\nFeatures:\n Multi-threading support: $ac_cv_libcthreads_multi_threading\n Wide character type support: $ac_cv_enable_wide_character_type\n evtxtools are build as static executables: $ac_cv_enable_static_executables\n Python (pyevtx) support: $ac_cv_enable_python\n Verbose output: $ac_cv_enable_verbose_output\n Debug output: $ac_cv_enable_debug_output\n]);\n\n" }, { "path": "documentation/Windows XML Event Log (EVTX).asciidoc", "content": "= Windows XML Event Log (EVTX) format\nAnalysis of EVTX\n\n:toc:\n:toclevels: 4\n\n:numbered!:\n[abstract]\n== Summary\n\nThe Windows XML EventLog (EVTX) format is used by Microsoft Windows to store\nsystem log information. This specification is based the work done by A.\nSchuster `[SCHUSTER11]` and on `[MS-EVEN6]`. It was complemented by other\npublic available information and was enhanced by analyzing test data.\n\nThis document is intended as a working document of the data format specification\nfor the libevtx project.\n\nSpecial thanks to A. Schuster for his excellent work on the format and test\nfiles.\n\n[preface]\n== Document information\n\n[cols=\"1,5\"]\n|===\n| Author(s): | Joachim Metz \n| Abstract: | This document contains information about the Windows XML Event Viewer Log (EVTX) format.\n| Classification: | Public\n| Keywords: | Windows XML Event Viewer Log, EVTX\n|===\n\n[preface]\n== License\n\n....\nCopyright (C) 2011-2024, Joachim Metz .\nPermission is granted to copy, distribute and/or modify this document under the\nterms of the GNU Free Documentation License, Version 1.3 or any later version\npublished by the Free Software Foundation; with no Invariant Sections, no\nFront-Cover Texts, and no Back-Cover Texts. A copy of the license is included\nin the section entitled \"GNU Free Documentation License\".\n....\n\n[preface]\n== Revision history\n\n[cols=\"1,1,1,5\",options=\"header\"]\n|===\n| Version | Author | Date | Comments\n| 0.0.1 | J.B. Metz | September 2011 | Initial version.\n| 0.0.2 | J.B. Metz | March 2012 +\nApril 2012 | Additional information.\n| 0.0.3 | J.B. Metz | May 2012 | Additional information.\n| 0.0.4 | J.B. Metz | May 2012 | Updates for Windows 8 Consumer Preview.\n| 0.0.5 | J.B. Metz | October 2012 | Additional information regarding formatted messages.\n| 0.0.6 | J.B. Metz | December 2012 | Additional information regarding formatted messages.\n| 0.0.7 | J.B. Metz | February 2013 | Additional information regarding formatted messages.\n| 0.0.8 | J.B. Metz | February 2013 | Additional information regarding chunk offset values seen in archived EVTX files with thanks to R. Rumble.\n| 0.0.8 | J.B. Metz | February 2013 | Additional information regarding corruption scenarios.\n| 0.0.9 | J.B. Metz | March 2013 | Additional information regarding corruption scenarios.\n| 0.0.10 | J.B. Metz | May 2013 | Additional information regarding corruption scenarios.\n| 0.0.11 | J.B. Metz | July 2013 | Additional information regarding XML escaping with thanks to G. Torres.\n| 0.0.12 | J.B. Metz | July 2013 | Additional information regarding ProcessingErrorData.\n| 0.0.13 | J.B. Metz | July 2013 | Additional information regarding dirty file with invalid number of chunks corruption scenario with thanks to G. Torres.\n| 0.0.14 | J.B. Metz | October 2013 | Added information about parameter expansion.\n| 0.0.15 | J.B. Metz | February 2014 | Additional information regarding MUI and \"language specific\" event message files.\n| 0.0.16 | J.B. Metz | July 2014 | Additional information about parameter expansion.\n| 0.0.16 | J.B. Metz | March 2015 | Switched to asccidoc format.\n| 0.0.17 | J.B. Metz | January 2016 | Additional information about Binary XML type (0x21).\n| 0.0.18 | J.B. Metz | April 2016 | Fixed typo.\n| 0.0.19 | J.B. Metz | November 2020 | Changes for formatting.\n| 0.0.20 | J.B. Metz | May 2021 | Textual and formatting changes.\n| 0.0.21 | J.B. Metz | Octoboer 2021 | Additional information regarding format versions.\n| 0.0.22 | J.B. Metz | December 2021 | Additional information about MUI language neutral file.\n| 0.0.23 | J.B. Metz | December 2023 | Updated references and additional information about SystemResources directory.\n| 0.0.24 | J.B. Metz | January 2024 | Additional information about parameter message files.\n| 0.0.25 | J.B. Metz | April 2024 | Additional information about dependency identifier.\n| 0.0.26 | J.B. Metz | September 2024 | Additional information regarding format edge case with thanks to J. Solomon.\n|===\n\n:numbered:\n== Overview\n\nThe Windows XML EventLog (EVTX) format is used by Microsoft Windows, as of\nWindows Vista, to store system log information.\n\nThe EVTX format supersedes the Windows EventLog (EVT) format as used in Windows\nXP.\n\nAn EVTX file consists of:\n\n* file header\n* chunks\n* trailing empty values\n\n[cols=\"1,5\",options=\"header\"]\n|===\n| Characteristics | Description\n| Byte order | little-endian\n| Date and time values | FILETIME in UTC\n| Character strings | ASCII strings are Single Byte Character (SBC) or Multi Byte Character (MBC) string stored with a codepage. Sometimes referred to as ANSI string representation. +\nThough technically maybe incorrect, this document will use term (extended) ASCII string. +\nUnicode strings are stored in UTF-16 little-endian without the byte order mark (BOM).\n|===\n\n=== Test version\n\nThe following version of programs were used to test the information within this document:\n\n* Windows Vista\n* Windows 2008\n* Windows 7\n* Windows 8\n* [yellow-background]*TODO: Windows 2012*\n* Windows 10 (1903, 1909, 2004, 20H2)\n* Windows 11 (21H2)\n\n=== Event Log files\n\nThe event logs files can normally be found in:\n\n....\nC:\\Windows\\System32\\winevt\\Logs\\\n....\n\n[cols=\"1,3\",options=\"header\"]\n|===\n| Filename | Description\n| Application.evtx | Application events\n| DFS Replication.evtx | [yellow-background]*TODO*\n| HardwareEvents.evtx | [yellow-background]*TODO*\n| Internet Explorer.evtx | Internet Explorer events\n| Key Management Service.evtx | [yellow-background]*TODO*\n| Media Center.evtx | [yellow-background]*TODO*\n| Microsoft-Windows-Bits-Client%4Operational.evtx | [yellow-background]*TODO*\n| Microsoft-Windows-CodeIntegrity%4Operational.evtx | [yellow-background]*TODO*\n| Microsoft-Windows-CorruptedFileRecovery-Client%4Operational.evtx | [yellow-background]*TODO*\n| Microsoft-Windows-CorruptedFileRecovery-Server%4Operational.evtx | [yellow-background]*TODO*\n| Microsoft-Windows-DateTimeControlPanel%4Operational.evtx | [yellow-background]*TODO*\n| Microsoft-Windows-Diagnosis-DPS%4Operational.evtx | [yellow-background]*TODO*\n| Microsoft-Windows-Diagnosis-PLA%4Operational.evtx | [yellow-background]*TODO*\n| Microsoft-Windows-Diagnostics-Networking%4Operational.evtx | [yellow-background]*TODO*\n| Microsoft-Windows-Diagnostics-Performance%4Operational.evtx | [yellow-background]*TODO*\n| Microsoft-Windows-DiskDiagnostic%4Operational.evtx | [yellow-background]*TODO*\n| Microsoft-Windows-DiskDiagnosticDataCollector%4Operational.evtx | [yellow-background]*TODO*\n| Microsoft-Windows-DiskDiagnosticResolver%4Operational.evtx | [yellow-background]*TODO*\n| Microsoft-Windows-DriverFrameworks-UserMode%4Operational.evtx | [yellow-background]*TODO*\n| Microsoft-Windows-Forwarding%4Operational.evtx | [yellow-background]*TODO*\n| Microsoft-Windows-GroupPolicy%4Operational.evtx | [yellow-background]*TODO*\n| Microsoft-Windows-Help%4Operational.evtx | [yellow-background]*TODO*\n| Microsoft-Windows-International%4Operational.evtx | [yellow-background]*TODO*\n| Microsoft-Windows-Kernel-WDI%4Operational.evtx | [yellow-background]*TODO*\n| Microsoft-Windows-Kernel-WHEA.evtx | [yellow-background]*TODO*\n| Microsoft-Windows-LanguagePackSetup%4Operational.evtx | [yellow-background]*TODO*\n| Microsoft-Windows-MUI%4Operational.evtx | [yellow-background]*TODO*\n| Microsoft-Windows-NetworkAccessProtection%4Operational.evtx | [yellow-background]*TODO*\n| Microsoft-Windows-Program-Compatibility-Assistant%4Operational.evtx | [yellow-background]*TODO*\n| Microsoft-Windows-ReadyBoost%4Operational.evtx | [yellow-background]*TODO*\n| Microsoft-Windows-ReliabilityAnalysisComponent%4Metrics.evtx | [yellow-background]*TODO*\n| Microsoft-Windows-ReliabilityAnalysisComponent%4Operational.evtx | [yellow-background]*TODO*\n| Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx | [yellow-background]*TODO*\n| Microsoft-Windows-Resource-Exhaustion-Resolver%4Operational.evtx | [yellow-background]*TODO*\n| Microsoft-Windows-Resource-Leak-Diagnostic%4Operational.evtx | [yellow-background]*TODO*\n| Microsoft-Windows-RestartManager%4Operational.evtx | [yellow-background]*TODO*\n| Microsoft-Windows-TaskScheduler%4Operational.evtx | [yellow-background]*TODO*\n| Microsoft-Windows-TerminalServices-RDPClient%4Operational.evtx | [yellow-background]*TODO*\n| Microsoft-Windows-UAC%4Operational.evtx | [yellow-background]*TODO*\n| Microsoft-Windows-UAC-FileVirtualization%4Operational.evtx | [yellow-background]*TODO*\n| Microsoft-Windows-WindowsUpdateClient%4Operational.evtx | [yellow-background]*TODO*\n| Microsoft-Windows-Winlogon%4Operational.evtx | [yellow-background]*TODO*\n| Microsoft-Windows-Wired-AutoConfig%4Operational.evtx | [yellow-background]*TODO*\n| Microsoft-Windows-WLAN-AutoConfig%4Operational.evtx | [yellow-background]*TODO*\n| ODiag.evtx | [yellow-background]*TODO*\n| OSession.evtx | Office sessions events\n| Security.evtx | Security events\n| Setup.evtx | Setup events\n| System.evtx | System events\n|===\n\n== File header\n\nThe file header is 4096 bytes of size and consists of:\n\n[cols=\"1,1,1,5\",options=\"header\"]\n|===\n| Offset | Size | Value | Description\n| 0 | 8 | \"ElfFile\\x00\" | Signature\n| 8 | 8 | | First chunk number\n| 16 | 8 | | Last chunk number\n| 24 | 8 | | Next record identifier\n| 32 | 4 | 128 | Header size\n| 36 | 2 | | Minor format version +\nSee section: <>\n| 38 | 2 | | Major format version +\nSee section: <>\n| 40 | 2 | 4096 | Header block size +\n(or chunk data offset)\n| 42 | 2 | | Number of chunks\n| 44 | 76 | | [yellow-background]*Unknown (Empty values)*\n| 120 | 4 | | File flags +\nSee section: <>\n| 124 | 4 | | Checksum +\nCRC32 of the first 120 bytes of the file header\n| 128 | 3968 | | [yellow-background]*Unknown (Empty values)*\n|===\n\nThe CRC-32 is describe in RFC 1952 and uses an initial value of 0.\n\n[yellow-background]*TODO: check if: file size = ( Number of chunks * 65536 ) + 4096*\n\n=== [[format_versions]]Format versions\n\n[cols=\"1,5\",options=\"header\"]\n|===\n| Version +\n(Major.Minor) | Description\n| 3.1 | Seen on Windows Vista and later\n| 3.2 | Seen on Windows 10 (2004) and later\n|===\n\n=== [[file_flags]]File flags\n\n[cols=\"1,1,5\",options=\"header\"]\n|===\n| Value | Identifier | Description\n| 0x0001 | | Is dirty\n| 0x0002 | | Is full\n|===\n\n== Chunk\n\nThe chunk is 65536 bytes of size and consists of:\n\n* chunk header\n* array of event records\n* unused space\n\n=== Chunk header\n\nThe chunk header is 512 bytes of size and consists of:\n\n[cols=\"1,1,1,5\",options=\"header\"]\n|===\n| Offset | Size | Value | Description\n| 0 | 8 | \"ElfChnk\\x00\" | Signature\n| 8 | 8 | | First event record number\n| 16 | 8 | | Last event record number\n| 24 | 8 | | First event record identifier\n| 32 | 8 | | Last event record identifier\n| 40 | 4 | 128 | Header size +\n(or offset to [yellow-background]*pointer data*)\n| 44 | 4 | | Last event record data offset +\nOffset to the data of the last event record. +\nThe offset is relative to the start of the chunk header.\n| 48 | 4 | | Free space offset +\nOffset to free space in the chunk. The offset is relative to the start of the chunk header.\n| 52 | 4 | | Event records checksum +\nCRC32 of the events records data\n| 56 | 64 | | [yellow-background]*Unknown (Empty values)*\n| 120 | 4 | | [yellow-background]*Unknown (flags?)*\n| 124 | 4 | | Checksum +\nCRC32 of the first 120 bytes and bytes 128 to 512 of the chunk.\n|===\n\nThe CRC-32 is describe in RFC 1952 with an uses an initial value of 0.\n\nThe free space offset is not the end of event records data offset, is sometimes\npoint to the end of the chunk, where the chunk after the last event record was\nfilled with 0-byte values. This behavior was seen in archived EVTX files.\n\n[cols=\"1,1,1,5\",options=\"header\"]\n|===\n| Offset | Size | Value | Description\n| 128 | 64 x 4 = 256 | | [yellow-background]*Common string offset array* +\n[yellow-background]*The offsets are relative from the start of the chunk*\n| 384 | 32 x 4 = 128 | | [yellow-background]*TemplatePtr* +\n[yellow-background]*Array of 32 x 32-bit values*\n|===\n\n[yellow-background]*The common string offset array contains the offsets of\nstrings that are common in the event records stored in the chunk so that they\nonly have to be stored once in the first event record and can be referenced\nfrom successive event records.*\n\n[yellow-background]*Identifier/Number of first and last event record in chunk*\n\n[yellow-background]*Data after header and before event record?*\n\n=== Event record\n\nThe event record is variable of size and consists of:\n\n[cols=\"1,1,1,5\",options=\"header\"]\n|===\n| Offset | Size | Value | Description\n| 0 | 4 | \"\\x2a\\x2a\\x00\\x00\" | Signature\n| 4 | 4 | | Size +\nThe size of the event record including the signature and the size\n| 8 | 8 | | Event record identifier\n| 16 | 8 | | Written date and time +\nContains a FILETIME +\nThe date and time the event record was written (logged)\n| 24 | ... | | Event +\nContains binary XML +\nSee section: <>\n| ... | 4 | | Copy of size\n|===\n\n== [[binary_xml]]Binary XML\n\n=== Document structure\n\nAccording `[MS-EVEN6]` the binary XML structure should consist of:\n\nThe document (BinXMLDocument) consists of:\n\n* Prologue (BinXMLPI) (zero or one)\n* Fragment (zero or more)\n* Miscellaneous (BinXMLPI) (zero or one)\n* End of file token\n\n==== Fragment\n\nThe fragment (BinXMLFragment) consists of:\n\n* fragment header\n* an element or a template instance\n\n==== Fragment header\n\nThe fragment header (BinXMLFragmentHeader) is 4 byte of size and consists of:\n\n[cols=\"1,1,1,5\",options=\"header\"]\n|===\n| Offset | Size | Value | Description\n| 0 | 1 | 0x0f | Fragment header token +\nShould be: BinXmlFragmentHeaderToken +\nSee section: <>\n| 1 | 1 | 0x01 | Major version\n| 2 | 1 | 0x01 | Minor version\n| 3 | 1 | 0x00 | Flags\n|===\n\n==== Element\n\nAn element (BinXMLElement) can either be 'empty' or a 'filled'.\n\nBinXMLEmpyElement:\n\n* element start\n* close empty element token\n\nExample of an 'empty' element in textual XML:\n\n....\n\n....\n\nBinXMLFilledElement:\n\n* element start\n* close start element token\n* content\n* end element token\n\nExample of a 'filled' element in textual XML:\n\n....\n400\n....\n\n[yellow-background]*TODO: is it valid for a fragment with more then one element?*\n\n==== Element start\n\nThe element start (BinXMLElementStart) is variable of size and consists of:\n\n[cols=\"1,1,1,5\",options=\"header\"]\n|===\n| Offset | Size | Value | Description\n| 0 | 1 | 0x01 +\n0x41 | Open start element tag token +\nShould be: BinXmlTokenOpenStartElementTag +\nSee section: <>\n4+| _Optional see notes below_\n| 1 | 2 | | Dependency identifier +\n-1 (0xffff) => not set\n4+| _Common_\n| 3 | 4 | | Data size +\nThe size of the data. +\nThis includes the size of the element name, attribute list, close element tag, content and end element tag, except for the first 5 or 7 bytes of the element start.\n4+| _Optional see notes below_\n| 7 | 4 | | Element name offset +\nThe offset is relative from the start of the chunk +\nSee section: <>\n4+| _Common_\n| 11 | ... | | Attribute list +\nSee section: <>\n|===\n\nA token type of 0x01 indicates that the element start tag contains no elements;\na token type of 0x41 indicates that an attribute list can be expected in the\nelement start tag.\n\n[NOTE]\nThe element name can be stored before the attribute list.\n\n[NOTE]\nThe name offset is not present in the binary XML in the Windows Event Template\nresource.\n\n[NOTE]\nAccording to `[MS-EVEN6]` the dependency identifier is not present when the\nelement start is used in a substitution token with value type: Binary XML\n(0x21).\n\n==== [[attribute_list]]Attribute list\n\nThe attribute (BinXmlAttributeList) is variable of size and consists of:\n\n[cols=\"1,1,1,5\",options=\"header\"]\n|===\n| Offset | Size | Value | Description\n| 0 | 4 | | Data size +\nDoes not include the 4 byte of the size.\n| 4 | ... | | Array of attributes +\nSee section: <>\n|===\n\n[yellow-background]*TODO: if attribute list is empty it is trailed by 2 bytes?\nIs this 32-bit alignment padding?*\n\n==== [[attribute]]Attribute\n\nThe attribute (BinXmlAttribute) is variable of size and consists of:\n\n[cols=\"1,1,1,5\",options=\"header\"]\n|===\n| Offset | Size | Value | Description\n| 0 | 1 | 0x06 +\n0x46 | Attribute token +\nShould be: BinXmlTokenAttribute +\nSee section: <>\n4+| _Optional see notes below_\n| 1 | 4 | | Attribute name offset +\nThe offset is relative from the start of the chunk +\nSee section: <>\n4+| _Common_\n| 5 | ... | | Attribute data\n|===\n\nA token type of 0x46 indicates that there is another attribute in the attribute\nlist; a token type of 0x06 indicates that no more attributes exist.\n\n[NOTE]\nThe attribute name can be stored before the attribute list.\n\nThe attribute data (BinXMLAttributeData) can be:\n\n* value text\n* substitution\n* character entity reference\n* entity reference\n\n[NOTE]\nThe name offset is not present in the binary XML in the Windows Event Template\nresource.\n\n==== [[name]]Name\n\nThe name (BinXmlName) is variable of size and consists of:\n\n[cols=\"1,1,1,5\",options=\"header\"]\n|===\n| Offset | Size | Value | Description\n| 0 | 4 | | [yellow-background]*Unknown*\n| 4 | 2 | | Name hash +\n[yellow-background]*Which hash algorithm?*\n| 6 | 2 | | Number of characters\n| 8 | ... | | UTF-16 little-endian string with an end-of-string character\n|===\n\nThe unknown 4 bytes are not present in the binary XML in the Windows Event\nTemplate resource.\n\n==== Content\n\nThe content (BinXMLContent) can be:\n\n* an element\n* content string data\n* character entity reference\n* entity reference\n* CDATA section\n* PI\n\n==== Content string\n\nThe content string data (BinXMLContentStringData) can be:\n\n* value text\n* substitution\n\n[yellow-background]*TODO: a content string containing an end-of-line character\nseems to be considered empty by Event Viewer*\n\n==== Value text\n\nThe value text (BinXmlValueText) is variable of size and consists of:\n\n[cols=\"1,1,1,5\",options=\"header\"]\n|===\n| Offset | Size | Value | Description\n| 0 | 1 | 0x05 +\n0x45 | Value token +\nShould be: BinXmlTokenValue +\nSee section: <>\n| 1 | 1 | 0x01 | Value type +\nShould be: StringType +\nSee section: <>\n| 2 | ... | | Value data +\nSee section: <>\n|===\n\nA token type of 0x45 indicates that more data can be expected to follow in the\ncurrent content of the element or attribute; a token type of 0x05 indicates\nthat no more such data follows.\n\nA value text can be stored spanning multiple value tokens.\n\n==== Substitution\n\nThe substitution (BinXmSubstitution) can be:\n\n* normal substitution\n* optional substitution\n\n==== Normal substitution\n\nThe normal substitution (BinXmNormalSubstitution) is 4 byte of size and\nconsists of:\n\n[cols=\"1,1,1,5\",options=\"header\"]\n|===\n| Offset | Size | Value | Description\n| 0 | 1 | 0x0d | Normal substitution token +\nShould be: BinXmlTokenNormalSubstitution +\nSee section: <>\n| 1 | 2 | | Substitution identifier +\nIdentifier of the value in the template instance data, where 0 represents the first value\n| 3 | 1 | | Value type +\nSee section: <>\n|===\n\nIf the value type is an array type (0x80) the substitution is repeated for\nevery element of the array. If the size of an array type is 0 then a single\nempty element should be created.\n\nIf the value type is Size (0x10) the corresponding substitution value should be\na 32-bit hexadecimal integer (0x14) or 64-bit hexadecimal integer (0x15). The\nsame applies to an array of Size (0x90) where the substitution value should be\nan array of 32-bit hexadecimal integer (0x94) or an array of 64-bit hexadecimal\ninteger (0x95).\n\nIf the value type is the Binary XML type (0x21) the value data should be one of\nthe following:\n\n* an open start element tag (BinXmlTokenOpenStartElementTag);\n* a fragment (BinXMLFragment);\n* a template instance (BinXmlTemplateInstance).\n\n==== Optional substitution\n\nThe optional substitution (BinXmlOptionalSubstitution) is 4 byte of size and\nconsists of:\n\n[cols=\"1,1,1,5\",options=\"header\"]\n|===\n| Offset | Size | Value | Description\n| 0 | 1 | 0x0e | Optional substitution token +\nShould be: BinXmlTokenOptionallSubstitution +\nSee section: <>\n| 1 | 2 | | Substitution identifier +\nIdentifier of the value in the template instance data, where 0 represents the first value\n| 3 | 1 | | Value type +\nSee section: <>\n|===\n\nIf the value type of the corresponding template value is NULL (0x00) the\nelement should be ignored and not created.\n\nIf the value type is an array type (0x80) the substitution is repeated for\nevery element of the array. If the size of an array type is 0 then a single\nempty element should be created.\n\nIf the value type is Size (0x10) the corresponding substitution value should be\na 32-bit hexadecimal integer (0x14) or 64-bit hexadecimal integer (0x15). The\nsame applies to an array of Size (0x90) where the substitution value should be\nan array of 32-bit hexadecimal integer (0x94) or an array of 64-bit hexadecimal\ninteger (0x95).\n\nIf the value type is the Binary XML type (0x21) the value data should be one of\nthe following:\n\n* an open start element tag (BinXmlTokenOpenStartElementTag);\n* a fragment (BinXMLFragment);\n* a template instance (BinXmlTemplateInstance).\n\n==== Character entity reference\n\nThe character entity reference (BinXmlCharacterEntityReference) is 3 byte of size and consists of:\n\n[cols=\"1,1,1,5\",options=\"header\"]\n|===\n| Offset | Size | Value | Description\n| 0 | 1 | 0x08 +\n0x48 | Character entity reference token +\nShould be: BinXmlTokenCharRef +\nSee section: <>\n| 1 | 2 | | Character entity value\n|===\n\nA token type of 0x48 indicates that more data can be expected to follow in the\ncurrent content of the element or attribute; a token type of 0x08 indicates\nthat no more such data follows.\n\nIn the resulting XML the character entity is replaced e.g. `38` becomes `&`.\n\n[yellow-background]*According to `[MS-EVEN6]` emit the characters '&' and '#'\nand the decimal string representation of the value. TODO create a test file.*\n\n==== Entity reference\n\nThe entity reference (BinXmlEntityReference) is 5 bytes of size and consists of:\n\n[cols=\"1,1,1,5\",options=\"header\"]\n|===\n| Offset | Size | Value | Description\n| 0 | 1 | 0x09 +\n0x49 | Entity reference token +\nShould be: BinXmlTokenEntityRef +\nSee section: <>\n4+| _Optional see notes below_\n| 1 | 4 | | Entity name offset +\nThe offset is relative from the start of the chunk +\nSee section: <>\n|===\n\nA token type of 0x49 indicates that more data can be expected to follow in the\ncurrent content of the element or attribute; a token type of 0x09 indicates\nthat no more such data follows.\n\nIn the resulting string the entity is replaced e.g. `amp` becomes & for a\nUnicode string and `&` for an XML string.\n\n[NOTE]\nThe name offset is not present in the binary XML in the Windows Event Template\nresource.\n\nIt currently is assumed that the following entity references are supported lt,\ngt, amp, quot and apos.\n\n==== CDATA section\n\nThe entity reference (BinXmlEntityReference) is variable of size and consists of:\n\n[cols=\"1,1,1,5\",options=\"header\"]\n|===\n| Offset | Size | Value | Description\n| 0 | 1 | 0x07 +\n0x47 | CDATA section token +\nShould be: BinXmlTokenCDATASection +\nSee section: <>\n| 1 | ... | | CDATA text +\nSee section: <>\n|===\n\nA token type of 0x47 indicates that more data can be expected to follow in the\ncurrent content of the element or attribute; a token type of 0x07 indicates\nthat no more such data follows.\n\n==== Template instance\n\nThe template instance (BinXmlTemplateInstance) is variable of size and consists of:\n\n[cols=\"1,1,1,5\",options=\"header\"]\n|===\n| Offset | Size | Value | Description\n| 0 | 1 | 0x0c | Template instance token +\nShould be: BinXmlTokenTemplateInstance +\nSee section: <>\n| 1 | ... | | Template definition\n| ... | ... | | Template instance data\n|===\n\n==== Template definition\n\nThe template definition (BinXmlTemplateDefinition) is variable of size and\nconsists of:\n\n[cols=\"1,1,1,5\",options=\"header\"]\n|===\n| Offset | Size | Value | Description\n| 0 | 1 | | [yellow-background]*Unknown(Version? Or number of template defs?)* +\n[yellow-background]*Seen: 0x01*\n| 1 | 4 | | [yellow-background]*Unknown (Template identifier?)*\n| 5 | 4 | | Template definition data offset +\nTemplate definition data\n| 9 | 4 | | [yellow-background]*Unknown (Next template definition offset)* +\n[yellow-background]*0 if not used*\n| 13 | 16 | | Template identifier +\nContains a GUID\n| 29 | 4 | | Data size +\nThe size of the data. +\nThis includes the size of the fragment header, element and end of file token, except for the first 33 bytes of the template definition.\n| 33 | ... | | Fragment header\n| ... | ... | | Element\n| ... | 1 | | End of file token +\nShould be: BinXmlTokenEOF +\nSee section: <>\n|===\n\n[NOTE]\nThe template definition data offset either point to the offset directly after\nthis value or somewhere previously in the chunk. The template definition can\ntherefore be stored non-continuous.\n\n[yellow-background]*What does the %b0 in `[MS-EVEN6]` signify?*\n[yellow-background]*Possibly a bit value of 0 seeing that in other MSDN documentation %d16 indicates a decimal value of 16.*\n\n==== Template instance data\n\nThe template instance data (BinXmlTemplateInstanceData) is variable of size and\nconsists of:\n\n[cols=\"1,1,1,5\",options=\"header\"]\n|===\n| Offset | Size | Value | Description\n| 0 | 4 | | Number of template values\n| 4 | ... | | Array of template value descriptors\n| ... | ... | | Array of template value data\n|===\n\nThe template value descriptor is 4 bytes of size and consists of:\n\n[cols=\"1,1,1,5\",options=\"header\"]\n|===\n| Offset | Size | Value | Description\n| 0 | 2 | | Value size\n| 2 | 1 | | Value type\n| 1 | 1 | 0x00 | [yellow-background]*Unknown (Empty value)*\n|===\n\n==== [[unicode_text_string]]Unicode text string\n\nThe Unicode text string is variable of size and consists of:\n\n[cols=\"1,1,1,5\",options=\"header\"]\n|===\n| Offset | Size | Value | Description\n| 2 | 2 | | Number of characters\n| 4 | ... | | UTF-16 little-endian string without an end-of-string character\n|===\n\n==== PI\n\nThe PI consists of:\n\n* PI target\n* PI data\n\n==== PI target\n\nThe PI target (BinXmlPITarget) is 5 bytes of size and consists of:\n\n[cols=\"1,1,1,5\",options=\"header\"]\n|===\n| Offset | Size | Value | Description\n| 0 | 1 | 0x0a | PI target reference token +\nShould be: BinXmlTokenPITarget +\nSee section: <>\n4+| _Optional see notes below_\n| 1 | 4 | | PI target name offset +\nThe offset is relative from the start of the chunk +\nSee section: <>\n|===\n\n[NOTE]\nThe name offset is not present in the binary XML in the Windows Event Template\nresource.\n\n==== PI data\n\nThe entity reference (BinXmlPIData) is variable of size and consists of:\n\n[cols=\"1,1,1,5\",options=\"header\"]\n|===\n| Offset | Size | Value | Description\n| 0 | 1 | 0x0b | PI data token +\nShould be: BinXmlTokenCDATASection +\nSee section: <>\n| 1 | ... | | PI data text +\nSee section: <>\n|===\n\n=== [[token_types]]Token types\n\nBinary XML defines multiple token types.\n\n[cols=\"1,1,5\",options=\"header\"]\n|===\n| Value | Identifier | Description\n| 0x00 | BinXmlTokenEOF | End of file\n| 0x01 +\n0x41 | BinXmlTokenOpenStartElementTag | Open start element tag +\nIndicates the start of a start element, correlates to '<' in ''\n| 0x02 | BinXmlTokenCloseStartElementTag | Close start element tag +\nIndicates the end of a start element, correlates to '>' in ''\n| 0x03 | BinXmlTokenCloseEmptyElementTag | Close empty element tag +\nIndicates the end of a start element, correlates to '/>' in ''\n| 0x04 | BinXmlTokenEndElementTag | Close end element tag +\nIndicates the end of element, correlates to ''\n| 0x05 +\n0x45 | BinXmlTokenValue | Value\n| 0x06 +\n0x46 | BinXmlTokenAttribute | Attribute\n| 0x07 +\n0x47 | BinXmlTokenCDATASection | CDATA section\n| 0x08 +\n0x48 | BinXmlTokenCharRef | Character entity reference\n| 0x09 +\n0x49 | BinXmlTokenEntityRef | Entity reference\n| 0x0a | BinXmlTokenPITarget | Processing instructions (PI) target +\nXML processing instructions\n| 0x0b | BinXmlTokenPIData | Processing instructions (PI) data +\nXML processing instructions\n| 0x0c | BinXmlTokenTemplateInstance | Template instance\n| 0x0d | BinXmlTokenNormalSubstitution | Normal substitution\n| 0x0e | BinXmlTokenOptionalSubstitution | Optional substitution\n| 0x0f | BinXmlFragmentHeaderToken | Fragment header token\n|===\n\nSome of the token types can contain the has more data flag 0x40.\n\n[yellow-background]*TODO bitmask of 0x1f ? is this defined in winevt.h ? If so\nwhat do the other flags signify?*\n\n=== [[value_types]]Value types\n\n[cols=\"1,1,5\",options=\"header\"]\n|===\n| Value | Identifier | Description\n| 0x00 | NullType | NULL or empty\n| 0x01 | StringType | Unicode string +\nStored as UTF-16 little-endian without an end-of-string character\n| 0x02 | AnsiStringType | ASCII string +\nStored using a codepage without an end-of-string character\n| 0x03 | Int8Type | 8-bit integer signed\n| 0x04 | UInt8Type | 8-bit integer unsigned\n| 0x05 | Int16Type | 16-bit integer signed\n| 0x06 | UInt16Type | 16-bit integer unsigned\n| 0x07 | Int32Type | 32-bit integer signed\n| 0x08 | UInt32Type | 32-bit integer unsigned\n| 0x09 | Int64Type | 64-bit integer signed\n| 0x0a | UInt64Type | 64-bit integer unsigned\n| 0x0b | Real32Type | Floating point 32-bit (single precision)\n| 0x0c | Real64Type | Floating point 64-bit (double precision)\n| 0x0d | BoolType | Boolean +\n[yellow-background]*An 32-bit integer that MUST be 0x00 or 0x01 (mapping to true or false, respectively).*\n| 0x0e | BinaryType | Binary data\n| 0x0f | GuidType | GUID +\nStored in little-endian\n| 0x10 | SizeTType | Size type +\nEither 32 or 64-bits. This value type should be pair up with a HexInt32Type or HexInt64Type\n| 0x11 | FileTimeType | FILETIME (64-bit) +\nStored in little-endian\n| 0x12 | SysTimeType | System time (128-bit) +\nStored in little-endian\n| 0x13 | SidType | NT Security Identifier (SID) +\nSee `[LIBFWNT]`\n| 0x14 | HexInt32Type | 32-bit integer hexadecimal +\n32-bit (unsigned) integer that should be represented in hexadecimal notation\n| 0x15 | HexInt64Type | 64-bit integer hexadecimal +\n64-bit (unsigned) integer that should be represented in hexadecimal notation\n| | |\n| 0x20 | EvtHandle | [yellow-background]*Unknown*\n| 0x21 | BinXmlType | Binary XML fragment\n| | |\n| 0x23 | EvtXml | [yellow-background]*Unknown*\n|===\n\nIf the MSB of the value type (0x80) is use to indicate an array type. According\nto `[MSDN]` binary data and binary XML fragment types are not supported. For the\nstring types the end-of-string character is used as a separator.\n\n[cols=\"1,1,5\",options=\"header\"]\n|===\n| Value | Identifier | Description\n| 0x81 | | Array of Unicode strings +\nIndividual strings are stored as UTF-16 little-endian with an end-of-string character\n| 0x82 | | Array of ASCII strings +\nIndividual strings are stored as ASCII string using a codepage with an end-of-string character\n| 0x83 | | Array of 8-bit integer signed +\nEvery 1 byte is an individual value\n| 0x84 | | Array of 8-bit integer unsigned +\nEvery 1 byte is an individual value\n| 0x85 | | Array of 16-bit integer signed +\nEvery 2 bytes are an individual value in little-endian\n| 0x86 | | Array of 16-bit integer unsigned +\nEvery 2 bytes are an individual value in little-endian\n| 0x87 | | Array of 32-bit integer signed +\nEvery 4 bytes are an individual value in little-endian\n| 0x88 | | Array of 32-bit integer unsigned +\nEvery 4 bytes are an individual value in little-endian\n| 0x89 | | Array of 64-bit integer signed +\nEvery 8 bytes are an individual value in little-endian\n| 0x8a | | Array of 64-bit integer unsigned +\nEvery 8 bytes are an individual value in little-endian\n| 0x8b | | Array of Floating point 32-bit (single precision) +\nEvery 4 bytes are an individual value in little-endian\n| 0x8c | | Array of Floating point 64-bit (double precision) +\nEvery 8 bytes are an individual value in little-endian\n| 0x8d | | [yellow-background]*Array of boolean* +\n[yellow-background]*Every 4 bytes are an individual value in little-endian*\n| | |\n| 0x8f | | Array of GUID +\nEvery 16 bytes are an individual value in little-endian\n| 0x90 | | Array of size type +\nAn individual value is either 32 or 64-bits. This value type should be pair up with an array of HexInt32Type or HexInt64Type\n| 0x91 | | Array of FILETIME +\nEvery 8 bytes are an individual value in little-endian\n| 0x92 | | Array of system time +\nEvery 16 bytes are an individual value in little-endian\n| 0x93 | | [yellow-background]*Array of NT Security Identifiers (SID)*\n| 0x94 | | Array of 32-bit integer hexadecimal +\nEvery 4 bytes are an individual value in little-endian\n| 0x95 | | Array of 64-bit integer hexadecimal +\nEvery 8 bytes are an individual value in little-endian\n|===\n\n==== String\n\nIf in a string the characters: <, >, &, \" and ' are not escaped they must\nrespectively be replaced by the following character entities: `<`, `>`,\n`&`, `"` and `'`. This does not apply to Character entity\nreference and Entity reference encoded strings.\n\nEvent Viewer will not escape the character entities in the XML view, but will\nwhen exported as XML. Event Viewer seems to apply the XML character entity\nescaping inside element values for &, < and > but not for ' and \".\n\n==== Systemtime\n\nThe systemtime is 16 bytes of size and consists of:\n\n[cols=\"1,1,1,5\",options=\"header\"]\n|===\n| Offset | Size | Value | Description\n| 0 | 2 | | Year\n| 2 | 2 | | Month\n| 4 | 2 | | Day of week\n| 6 | 2 | | Day of month\n| 8 | 2 | | Hours\n| 10 | 2 | | Minutes\n| 12 | 2 | | Seconds\n| 14 | 2 | | Milliseconds\n|===\n\n==== Floating point\n\nFloating point values are represented as the following stings.\n\n[cols=\"1,1,5\",options=\"header\"]\n|===\n| Value | Identifier | Description\n| -1.#INF | | Negative infinity/overflow\n| 1.#INF | | Positive infinity/overflow\n| -1.#IND | | Indeterminate\n| [-]?0 | | Positive or negative zero\n| [yellow-background]*[-]?[0-9]+* | | [yellow-background]*Any positive or negative value that can be represented as an integer*\n| [yellow-background]*[-]?[0-9]+.[0-9]{6}* | | [yellow-background]*Any positive or negative value that can be represented in 6 fractional digits*\n| [yellow-background]*[-]?[0-9]+.[0-9]{6}e-[0-9]{3}* | | [yellow-background]*Any positive or negative value that could not be represented in 6 fractional digits*\n|===\n\n[yellow-background]*TODO validate the highlighted ones; 32-bit fractional of 6,\n64-bit fractional of 14*\n\n== Event\n\n=== Event identifier\n\nThe event identifier is 4 bytes of size and consist of:\n\n[cols=\"1,1,1,5\",options=\"header\"]\n|===\n| Offset | Size | Value | Description\n| 0.0 | 16 bits | | Code\n| 2.0 | 12 bits | | Facility\n| 3.4 | 1 bit | | Reserved\n| 3.5 | 1 bit | | Customer flags +\n0 => System code +\n1 => Customer code\n| 3.6 | 2 bits | | Severity +\n00 => Success +\n01 => Informational +\n10 => Warning +\n11 => Error\n|===\n\n=== Level\n\n[cols=\"1,1,5\",options=\"header\"]\n|===\n| Value | Identifier | Description\n| 0x00000000 | | Identifies an event that should always be logged +\n(win:LogAlways) +\nShown as \"Information\" in Event Viewer\n| 0x00000001 | WINEVENT_LEVEL_CRITICAL | Identifies an abnormal exit or termination event +\n(win:Critical)\n| 0x00000002 | WINEVENT_LEVEL_ERROR | Identifies a severe error event +\n(win:Error)\n| 0x00000003 | WINEVENT_LEVEL_WARNING | Identifies a warning event such as an allocation failure +\n(win:Warning)\n| 0x00000004 | WINEVENT_LEVEL_INFO | Identifies a non-error event such as an entry or exit event +\n(win:Informational)\n| 0x00000005 | WINEVENT_LEVEL_VERBOSE | Identifies a detailed trace event +\n(win:Verbose)\n| 0x00000006 | | [yellow-background]*Reserved* +\n[yellow-background]*(win:ReservedLevel6)*\n| 0x00000007 | | [yellow-background]*Reserved* +\n[yellow-background]*(win:ReservedLevel7)*\n| 0x00000008 | | [yellow-background]*Reserved* +\n[yellow-background]*(win:ReservedLevel8)*\n| 0x00000009 | | [yellow-background]*Reserved* +\n[yellow-background]*(win:ReservedLevel9)*\n| 0x0000000a | | [yellow-background]*Reserved* +\n[yellow-background]*(win:ReservedLevel10)*\n| 0x0000000b | | [yellow-background]*Reserved* +\n[yellow-background]*(win:ReservedLevel11)*\n| 0x0000000c | | [yellow-background]*Reserved* +\n[yellow-background]*(win:ReservedLevel12)*\n| 0x0000000d | | [yellow-background]*Reserved* +\n[yellow-background]*(win:ReservedLevel13)*\n| 0x0000000e | | [yellow-background]*Reserved* +\n[yellow-background]*(win:ReservedLevel14)*\n| 0x0000000f | | [yellow-background]*Reserved* +\n[yellow-background]*(win:ReservedLevel15)*\n|===\n\n=== Keywords\n\n[cols=\"1,1,5\",options=\"header\"]\n|===\n| 0x0000000000000000 | | [yellow-background]*win:AnyKeyword*\n| | |\n| [yellow-background]*0x0000000000010000* | | [yellow-background]*Shell*\n| [yellow-background]*0x0000000000020000* | | [yellow-background]*Properties*\n| [yellow-background]*0x0000000000040000* | | [yellow-background]*FileClassStoreAndIconCache*\n| [yellow-background]*0x0000000000080000* | | [yellow-background]*Controls*\n| [yellow-background]*0x0000000000100000* | | [yellow-background]*APICalls*\n| [yellow-background]*0x0000000000200000* | | [yellow-background]*InternetExplorer*\n| [yellow-background]*0x0000000000400000* | | [yellow-background]*ShutdownUX*\n| [yellow-background]*0x0000000000800000* | | [yellow-background]*CopyEngine*\n| [yellow-background]*0x0000000001000000* | | [yellow-background]*Tasks*\n| [yellow-background]*0x0000000002000000* | | [yellow-background]*WDI*\n| [yellow-background]*0x0000000004000000* | | [yellow-background]*StartupPerf*\n| [yellow-background]*0x0000000008000000* | | [yellow-background]*StructuredQuery*\n| | |\n| 0x0001000000000000 | | [yellow-background]*win:Reserved*\n| 0x0002000000000000 | | [yellow-background]*win:WDIContext*\n| 0x0004000000000000 | | [yellow-background]*win:WDIDiag*\n| 0x0008000000000000 | | [yellow-background]*win:SQM*\n| 0x0010000000000000 | | [yellow-background]*win:AuditFailure*\n| 0x0020000000000000 | | [yellow-background]*win:AuditSuccess*\n| 0x0040000000000000 | | [yellow-background]*win:CorrelationHint*\n| 0x0080000000000000 | | [yellow-background]*Classic* +\n[yellow-background]*win:EventlogClassic*\n| 0x0100000000000000 | | [yellow-background]*win:ReservedKeyword56*\n| 0x0200000000000000 | | [yellow-background]*win:ReservedKeyword57*\n| 0x0400000000000000 | | [yellow-background]*win:ReservedKeyword58*\n| 0x0800000000000000 | | [yellow-background]*win:ReservedKeyword59*\n| 0x1000000000000000 | | [yellow-background]*win:ReservedKeyword60*\n| 0x2000000000000000 | | [yellow-background]*win:ReservedKeyword61*\n| 0x4000000000000000 | | [yellow-background]*win:ReservedKeyword62*\n| 0x8000000000000000 | | [yellow-background]*win:ReservedKeyword63* +\n[yellow-background]*Microsoft-Windows-Shell-Core/Diagnostic*\n|===\n\n=== Externally stored values\n\nSome of the data that Event Viewer shows is stored outside the event log files.\n\nOn Windows XP (and earlier) the first step to determine the location of these\nvalues is find the corresponding \"eventlog type sub key\" in the Windows\nRegistry under:\n\n....\nHKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\EventLog\\\n....\n\nEvery event log type has its own sub key, e.g.:\n\n....\nHKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\EventLog\\System\n....\n\nCommon event log types are:\n\n* Application\n* Security\n* System\n\n[NOTE]\nThe event log type is also stored in the \"Channel\" event XML element.\n\nThe event log type sub key has a \"event source sub key\" for every source name,\ne.g for the source name \"Workstation\":\n\n....\nHKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\EventLog\\System\\Workstation\n....\n\n[NOTE]\nThe source name is case insensitive; so \"Workstation\" and \"workstation\" are\nconsidered equivalent.\n\nThe source name is stored as an attribute of the \"Provider\" element within the Event XML, e.g.\n\n....\n\n \n \n....\n\nThe \"EventSourceName\" attribute contains the source name. If there is no\n\"EventSourceName\" attribute the \"Name\" attribute is used.\n\nAs of Windows Vista the event log type sub key contains the value\n\"ProviderGuid\" which should contain the same GUID as indicated in the Event XML:\n\n....\n{CA4E628D-8567-4896-AB6B-835B221F373F}\n....\n\nThe corresponding provider settings can be found in the event message provider\nRegistry key:\n\n....\nHKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WINEVT\\Publishers\\{ca4e628d-8567-4896-ab6b-835b221f373f}\n....\n\nOn a Windows Vista (or later) system \"wevtutil\" can be used to determine more\nabout the provider. E.g.\n\n....\nwevtutil gp Microsoft-Windows-Search\n....\n\n==== Message strings\n\nThe event message strings are stored in event message files.\n\nThe event message provider Registry key has a value named \"EventMessageFile\"\nwhich contains a path specification of the event message file, e.g.\n\n....\n%SystemRoot%\\System32\\netmsg.dll\n....\n\n[NOTE]\nThe value can contain multiple filenames separated by a semi colon (;)\ncharacter and that the name of the event message files is case insensitive.\n\nOn Windows XP (and earlier) the event source sub key has a value named\n\"EventMessageFile\" which contains the same path. As of Windows Vista this value\nis not always present and using the value \"MessageFileName\" in the event\nmessage provider Registry key seems to be the preferred method. However it is\npossible that the event message provider Registry key is not present and the\nevent source sub key is needs to be used instead.\n\nHere \"%SystemRoot%\" is case insensitive and needs to be expanded to the Windows\ndirectory. The actual value of %SystemRoot% can be found in the Registry value:\n\n....\nKey: HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\\nValue: SystemRoot\n....\n\nThis value is depended on the Windows version, e.g.\n\n[cols=\"1,5\",options=\"header\"]\n|===\n| Value | Version\n| C:\\WINDOWS | Windows XP (NT 5.1) and later\n| C:\\WINNT | Windows NT 3.1, Windows NT 4.0 and Windows 2000 (NT 5.0)\n| C:\\WINNT35 | Windows NT 3.5x\n| C:\\WTSRV | Windows NT 4.0 Terminal Server\n|===\n\nOther placeholders that found to be used are:\n\n....\n%WinDir%\n....\n\nThe actual value of e.g. %WinDir% can be found in the Registry value:\n\n....\nKey: HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Session Manager\\Environment\\\nValue: windir\n....\n\nEvent message files are PE/COFF executables that contains a resource (\".rsrc \")\nsection. Event message files can have various extensions, e.g. \".exe\", \".dll\",\n\".dll.mui\", \".sys\".\n\nThere different types of event message files:\n\n* Message-table resource\n* Multilingual User Interface (MUI) resource\n\nThe event message files can have any combination of these resources. The rules\nof preference seems to be:\n\n* use message-table resource if present, before checking MUI resource\n\n===== Event resource file\n\nThe event message provider Registry key has a value named \"ResourceFileName\".\nIt is currently assumed that this Registry value contains a path specification\nof the event resource file, e.g.\n\n....\n%SystemRoot%\\System32\\tquery.dll\n....\n\nThe event resource file should contain a Windows Event Template (WEVT_TEMPLATE)\nresource. The MUI resource should also contain a main name type \"WEVT_TEMPLATE\".\n\nOn recent version of Windows 10 the WEVT_TEMPLATE resource can also be stored\nin a corresponding file in the SystemResources directory.\n\n....\nC:\\Windows\\SystemResources\\tquery.dll.mun\n....\n\nThe information stored in this resource is used to:\n\n* determine the message string identifier\n* determine the string identifiers of channels, keywords, levels, opcodes and tasks\n* parse Event XML \"UserData\"\n\nFor more detailed information see: `[LIBEXE]` and `[LIBFWEVT]`;\n\n===== Message string identifier\n\nOn Windows XP (and earlier) the message string identifier was a direct mapping\nof the event identifier as of Windows Vista this is no longer the case. There\nseem to be multiple methods how the event identifier is mapped to the message\nstring identifier, namely:\n\n* Using the event identifier qualifiers\n* Using the Windows Event Template resource\n\n====== Using the event identifier qualifiers\n\nIf the EventID element in Event XML has the Qualifiers attribute set, e.g.:\n\n....\n7036\n....\n\nThen the message string identifier can be determined as following:\n\n....\n16384 in hexadecimal is 0x4000\n 7036 in hexadecimal is 0x1b7c\n....\n\n....\nmessage string identifier = ( 0x4000 << 16 ) | 0x1b7c = 0x40001b7c\n....\n\n====== Using the Windows Event Template (WEVT_TEMPLATE) resource\n\nIf an event resource file has been specified and if the Provider element in the\nEvent XML has the GUID attribute set, e.g.:\n\n....\n\n1\n....\n\nThis GUID can be used to find a corresponding provider in the Windows Event\nTemplate (WEVT_TEMPLATE) resource. This resource should contain an event\ndefinition with the same identifier as the EventID in the Event XML, e.g. in\ncase of the example 1. The event definition will also contain a reference the\nthe message identifier, e.g. in case of the example 0xb9000001.\n\n===== Message-table resource event message files\n\nIn a message-table resource event message file the event message strings are\nstored in the message-table resource of the event message file.\n\nThe resource section of a message-table resource event message file contains a\nmessage-table resource which contains the event message strings. E.g. on\nWindows Vista\n\n....\nC:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\EventLogMessages.dll\n....\n\nThe event message strings have identifiers similar to the event identifiers.\nE.g. if the event identifier is 0 and the message string identifier 0, the\ncorresponding event message string would be:\n\n....\n%1\n....\n\nThe placeholder values %1 represent the first string in the event.\n\nThe event strings are stored as \"Data\" elements in the \"EventData\" element\n\n....\nwithin the Event XML, e.g.\n \n Service has been successfully shut down.\n \n....\n\nFor a more comprehensive description of how to extract the event strings from\nthe Event XML see section: <>. Sometimes the message\nstring can have more placeholder than the event data contains strings, it seems\nin such a case the placeholders are not replaced and shown as %# in the\nresulting string.\n\nNote that the event message strings are language specific. An event message\nfile can therefore contain event message strings for multiple languages.\n\n===== Multilingual User Interface (MUI) event message files\n\nThe resource section of a Multilingual User Interface (MUI) event message file\ncontains Multilingual User Interface (MUI) resource. E.g. on Windows Vista\n\n....\nC:\\Windows\\System32\\services.exe\n....\n\nThe MUI event message (or language neutral) files do not have to contain\na message-table resource but forward to a language specific message-table\nresource event message file, e.g. \"en-US\":\n\n....\nC:\\Windows\\System32\\en-US\\services.exe.mui\n....\n\nNote that it also possible that the corresponding \"language specific\" event\nmessage file is stored in the same directory as the MUI event message file.\n\n....\nC:\\Windows\\System32\\services.exe.mui\n....\n\nIt is this file that contains the language specific event message-table\nresource.\n\nThe event message strings have identifiers similar to the event identifiers.\nE.g. if the event identifier in XML is:\n\n....\n7036\n....\n\nThis would correspond to the event message string identifier:\n\n....\n16384 in hexadecimal is 0x4000\n 7036 in hexadecimal is 0x1b7c\n....\n\n....\nevent message string identifier = ( 0x4000 << 16 ) | 0x1b7c = 0x40001b7c\n....\n\nThe corresponding event message string would be:\n\n....\nThe %1 service entered the %2 state.\n....\n\nThe placeholder values %1 and %2 represent the first and second string in the\nevent.\n\nThe event strings are stored as \"Data\" elements in the \"EventData\" element\nwithin the Event XML, e.g.\n\n....\n \n Volume Shadow Copy\n stopped\n \n....\n\n===== [[event_data]]Event data\n\nAs previously mentioned the event strings (and binary data) are stored as\n\"Data\" elements in the \"EventData\" element within the Event XML. Another way to\nstore the event data is in a \"UserData\" element. The information in this\nsection is partially deduced on the behavior of the \"General\", \"Details\nFriendly View\" and \"Details XML View\" of Event Viewer.\n\nLet's start out with the following variant of event data.\n\n....\n \n SessionEnv\n D9060000\n \n....\n\nIn this case \"EventData\" in the \"Details Friendly View\" contains both the value\nof the \"Data\" and the \"Binary\" tag. The value of the Binary tag is additionally\ninterpreted as \"Binary Data\", which is base16 encoded.\n\n....\n SessionEnv\n D9060000\n....\n\nIf the Data has a corresponding \"Name\" attribute the \"EventData\" in the\n\"Details Friendly View\" shows the value of the \"Name\" attribute followed by the\nvalue of the \"Data\" tag, e.g.\n\n....\n \n 86400\n SuppressDuplicateDuration\n Software\\Microsoft\\EventSystem\\EventLog\n \n....\n\n....\n param1 86400\n param2 SuppressDuplicateDuration\n param3 Software\\Microsoft\\EventSystem\\EventLog\n....\n\nThe data of an empty \"Data\" is not ignored but not directly visible int the\n\"Details Friendly View\". In case of the following example on the value of the\n\"Name\" attribute would be shown.\n\n....\n \n \n \n\n ExtraInfo\n....\n\nProcessingErrorData is a variation of EventData:\n\n....\n \n 15005\n Value\n 804110C3E253BF01\n \n....\n\n....\n ErrorCode 15005\n DataItemName Value\n EventPayload 804110C3E253BF01\n....\n\nIn some events the data is not stored in a \"EventData\" tag within the Event XML\nbut in a \"UserData\" tag, e.g.\n\n....\n \n \n WmiApRpl\n WmiApRpl\n 4\n 44415441\n \n \n....\n\nIn this case the \"EventData\" in the \"Details Friendly View\" will show the data\nas:\n\n....\nEventXML\n param1 WmiApRpl\n param2 WmiApRpl\n binaryDataSize 4\n binaryData 44415441\n....\n\nThe binary data is not interpreted as the binary data seen with the \"EventData\"\ntag.\n\nHere \"WmiApRpl\" is the first string and \"44415441\" the fourth.\n\nEvent strings can also be stored as attribute values.\n\n....\n \n \n \n 4616\n Microsoft-Windows-Security-Auditing\n \n \n....\n\n....\nEventProcessingFailure\n Error\n [Code] 15007\n EventID 4616\n PublisherID Microsoft-Windows-Security-Auditing\n....\n\nThe corresponding message string is:\n\n....\nThe event logging service encountered an error while processing an incoming event published from %3.\n....\n\nWhich indicates the attribute value should be considered the first event string.\n\nSome event records have a corresponding template definition in the\nWEVT_TEMPLATE data.\n\nAn example of an event record with a corresponding template definition is:\n\n....\n \n 1 user registry handles leaked from ...\n \n....\n\n....\n\n Detail\n\n....\n\nNote that not all event records have corresponding WEVT_TEMPLATE data or\ntemplate definition. Sometimes the template definition does not entirely match\nthe event record e.g. the following example where the template definition\ncontains Name=\"%1\" but not the event record.\n\n....\n \n http://www.download.windowsupdate.com/...\n The data is invalid.\n \n....\n\n....\n\n %1\n %2\n\n....\n\nThis however might be a special case of the \"EventData\".\n\n===== Parsing event data\n\nIn the initial phases of the libevtx project several attempts have been made to\nuniformly parse the event data.\n\nFirstly the naive approach. This approach considers the element values of the\nsub elements of the \"EventData\" or \"UserData\" elements as event string. Alas\nthis approach fails to handle event strings that are defined as element\nattributes values mainly seen in \"UserData\" elements, e.g.\n\n....\n \n \n \n 4616\n Microsoft-Windows-Security-Auditing\n \n \n....\n\nThe next approach was to use the template definitions, if available, to parse\nthe \"EventData\" and \"UserData\" elements. This approach seemed to solve the\nissue with the event strings defined as attribute values. Alas not every\ntemplate definition seem to match the event record data, at least for some of\nthe \"EventData\" elements, e.g.\n\n....\n \n http://www.download.windowsupdate.com/...\n The data is invalid.\n \n....\n\n....\n\n %1\n %2\n\n....\n\nHowever using the template definitions to parse the event data proved an\ninteresting insight that the the binary XML substitution tokens of the template\ndefinition match those of the event record. Which is the technique used as of\nversion 20130208.\n\n===== Parameter expansion\n\nParameter expansion is e.g. seen in event identifier 7006 of the Service\nControl Manager (log source \"SC Manager\").\n\n....\n \n ScRegSetValueExW\n FailureActions\n %%5\n \n....\n\nHere the string translates to:\n\n....\nThe ScRegSetValueExW call failed for FailureActions with the following error:\nAccess is denied.\n....\n\nThe event source sub key has a value named \"ParameterMessageFile\" which for the\nService Control Manager refers to:\n\n....\n%SystemRoot%\\System32\\MsObjs.dll\n....\n\nHere %%5 corresponds to the message string with identifier 5 stored in\nMsObjs.dll (or its MUI equivalent), which is expanded to \"Access is denied.\".\n\nNote that if no parameter message file is defined EventViewer seems to:\n\n* first fallback to the event message files;\n* next fallback to default parameter message files, like MsObjs.dll and kernel32.dll on Windows 10.\n\n==== Category\n\n[yellow-background]*TODO: describe CategoryMessageFile*\n\n== Recovery\n\n1. Scan the chunk free space for event records and make sure the size and copy of size match.\n2. Ignore any record with an identifier that already exists. Often the free space contains former versions of existing event records.\n\n[yellow-background]*How useful are former versions of event records for\ncorrecting corrupted event records?*\n\n=== Detecting corrupted records\n\nComparing the size and copy of size is a quick way to detect corrupted records\nbut sometimes the sizes match while the record is not recoverable. The\ndetection of corrupted records can be improved by looking at:\nthe Binary XML data.\n\n[yellow-background]*TODO what about the identifier is it signed?*\n\nAccording `[MS-EVEN6]` the binary XML structure should consist of:\n\nThe document (BinXMLDocument) consists of:\n\n* Prologue (BinXMLPI) (zero or one)\n* Fragment (zero or more)\n* Miscellaneous (BinXMLPI) (zero or one)\n* End of file token\n\nThis translates to the Binary XML data should start with either:\n\n* 0x0a; the data size must be 5 or more bytes (for EVTX)\n* 0x0f 0x01 0x01 0x00; the data size must be 4 or more bytes\n* 0x00; which means there is no Binary XML data\n\n== Corruption scenarios\n\n=== String value oddities\n\nThis has been seen in PI data and CDATA section structures.\n\n....\nlibevtx_binary_xml_document_read_pi_data: type : 0x0b\nlibevtx_binary_xml_document_read_pi_data: number of characters : 18\nlibevtx_binary_xml_document_read_pi_data: value data:\n00000000: 4d 00 79 00 50 00 69 00 44 00 61 00 74 00 61 00 M.y.P.i. D.a.t.a.\n00000010: 3d 00 22 00 76 00 61 00 6c 00 75 00 65 00 22 00 =.\".v.a. l.u.e.\".\n00000020: 01 ff ff 0f 05 ff ff 0f ....\n....\n\nEventViewer seems to interpret 05 ff ff 0f as part of the string? But 18 x 2\nseems to be the correct data size.\n....\n\n！?>\n....\n\nEven 01 ff ff 0f part of the string looks like valid BinXML.\n\n....\nlibevtx_binary_xml_document_read_cdata_section: type : 0x07\nlibevtx_binary_xml_document_read_cdata_section: number of characters : 110\nlibevtx_binary_xml_document_read_cdata_section: value data:\n00000000: 0d 00 0a 00 66 00 75 00 6e 00 63 00 74 00 69 00 ....f.u. n.c.t.i.\n00000010: 6f 00 6e 00 20 00 6d 00 61 00 74 00 63 00 68 00 o.n. .m. a.t.c.h.\n00000020: 77 00 6f 00 28 00 61 00 2c 00 62 00 29 00 0d 00 w.o.(.a. ,.b.)...\n00000030: 0a 00 7b 00 0d 00 0a 00 69 00 66 00 20 00 28 00 ..{..... i.f. .(.\n00000040: 61 00 20 00 3c 00 20 00 62 00 20 00 26 00 26 00 a. .<. . b. .&.&.\n00000050: 20 00 61 00 20 00 3c 00 20 00 30 00 29 00 20 00 .a. .<. .0.). .\n00000060: 74 00 68 00 65 00 6e 00 0d 00 0a 00 20 00 20 00 t.h.e.n. .... . .\n00000070: 7b 00 0d 00 0a 00 20 00 20 00 72 00 65 00 74 00 {..... . .r.e.t.\n00000080: 75 00 72 00 6e 00 20 00 31 00 3b 00 0d 00 0a 00 u.r.n. . 1.;.....\n00000090: 20 00 20 00 7d 00 0d 00 0a 00 65 00 6c 00 73 00 . .}... ..e.l.s.\n000000a0: 65 00 0d 00 0a 00 20 00 20 00 7b 00 0d 00 0a 00 e..... . .{.....\n000000b0: 20 00 20 00 72 00 65 00 74 00 75 00 72 00 6e 00 . .r.e. t.u.r.n.\n000000c0: 20 00 30 00 3b 00 0d 00 0a 00 20 00 20 00 7d 00 .0.;... .. . .}.\n000000d0: 0d 00 0a 00 7d 00 0d 00 0a 00 04 04 04 04 ....}... ....\n....\n\n....\n \n....\n\nEventViewer shows the last line as:\n\n....\nЄЄ]]>\n....\n\nEven the 04 04 part of the string looks like valid BinXML.\n\n=== Corrupted file header with correct checksum\n\nFor some reason in EVTX file the file header was written with incorrect data\nalthough the checksum checks out. As you can see the first chunk number: 206\nexceeds last chunk number: 205.\n\n....\nsignature : ElfFile\\x00\nfirst chunk number : 206\nlast chunk number : 205\nnext record identifier : 123510\nheader size : 128\nminor version : 1\nmajor version : 3\nheader block size : 4096\nnumber of chunks : 1024\nflags : 0x00000000\nchecksum : 0x7fc747e2\n....\n\n[yellow-background]*TODO check the number of chunks in the file and if the\nevent ids are in sequential order. At first glance it seems to be this way.*\n\n=== Dirty file with invalid number of chunks\n\nIn the dirty file with invalid offset values scenarios the file header\nindicates the incorrect number of chunks in the file; in this case less than\nthe actual number of chunks.\n\n....\nsignature : ElfFile\\x00\nfirst chunk number : 0\nlast chunk number : 35\nnext record identifier : 150158\nheader size : 128\nminor version : 1\nmajor version : 3\nheader block size : 4096\nnumber of chunks : 36\nflags : 0x00000001\nchecksum : 0x98053517\n....\n\nEvent Viewer seems to \"correct\" files that are dirty and where the number of\nchunks in the file header is less than the actual number of chunks.\n\nThe approach implemented in libevtx 20130713 to deal with these files is to\nkeep scanning for chunks after the last chunk indicated by the file header. The\nrecords in these chunks are not marked as recovered records.\n\n=== Corrupt event record\n\nCorruption of an event record can occur in multiple ways, the following variant\nhave been seen:\n\n* In the middle of a chunk there is suddenly a large block of 0-byte values directly after an event record.\n* In the middle of a chunk there is an event record that is corrupt e.g. the size of the event record does not match the copy of size.\n\nThe approach is to start scanning for recoverable event records in the\nremainder of the chunk. Any event records found are considered recovered.\n\n=== Corrupted chunk\n\nCorruption of an chunk can occur in multiple ways, the following variant have\nbeen seen:\n\n* In the middle of a chunk there is suddenly a large block of 0-byte values directly after an event record. These 0-byte values continue across the next (expected) chunk header.\n\nThe approach is to start scanning for recoverable event records until a correct\nchunk header is found or the end of file is reached. Any event records found\nare considered recovered.\n\n=== Empty computer name\n\nIt is not clear if this is a corruption scenario or an undesirable edge case.\nIt has been observed that the format allows for the computer value to be empty.\n\n== Notes\n\n=== Normal behavior\n\nLets consider a \"normal\" Application.evtx file.\n\nEventViewer shows 20568 events.\n\nUsing \"Save All Events As ...\" as an XML file from EventViewer shows 4168 events.\n\nWevtutil get-log-info shows 20568 events.\n\n....\nwevtutil qli /lf:true file.evtx\n....\n\n[yellow-background]*TODO behavior of oldestRecordNumber*\n\nWevtutil query-events shows 20568 events.\n\n....\nwevtutil qe /lf:true file.evtx > file.xml\n....\n\n....\ncat file.xml | grep EventRecordID | wc -l\n....\n\nThis file has the following header.\n\n....\nsignature : ElfFile\\x00\nfirst chunk number : 0\nlast chunk number : 181\nnext record identifier : 20569\nheader size : 128\nminor version : 1\nmajor version : 3\nheader block size : 4096\nnumber of chunks : 182\nfile flags : 0x00000000\nchecksum : 0x9d4c00e2\n....\n\nIn the file the event records are in order, meaning that the first chunk\ncontains the event record with the lowest event record number.\n\n....\nsignature : ElfChnk\\x00\nfirst event record number : 1\nlast event record number : 117\nfirst event record identifier : 1\nlast event record identifier : 117\nheader size : 128\nlast event record offset : 0x0000e380\nfree space offset : 0x0000f3b0\nevent records checksum : 0x731087d8\n....\n\nThe number of event records in the chunk should be:\n\n....\nlast event record number - first event record number + 1\n....\n\nSuccessive chunks contain successive event record numbers.\n\n....\nsignature : ElfChnk\\x00\nfirst event record number : 118\nlast event record number : 232\nfirst event record identifier : 118\nlast event record identifier : 232\nheader size : 128\nlast event record offset : 0x0000fcc8\nfree space offset : 0x0000ff30\nevent records checksum : 0x7fa7a9df\n....\n\n[yellow-background]*TODO determine if gaps in event record identifiers is\nnormal behavior?*\n\n=== Corruption scenario: event record mismatch between size and copy of size\n\nLets consider a dirty Security.evtx file.\n\nEventViewer shows 4001 events.\n\nUsing \"Save All Events As ...\" as an XML file from EventViewer shows 1180 events.\n\nWevtutil get-log-info shows 4001 events.\n\n....\nwevtutil qli /lf:true file.evtx\n....\n\nThe \"oldestRecordNumber\" is 1 and does not match the data in the file.\n\nWevtutil query-events shows 4001 events.\n\n....\nwevtutil qe /lf:true file.evtx > file.xml\n....\n\n....\ncat file.xml | grep EventRecordID | wc -l\n....\n\nLooking at the file in more detail the following chunk seems to be corrupt.\n\n....\nsignature : ElfChnk\\x00\nfirst event record number : 72431823\nlast event record number : 72431919\nfirst event record identifier : 72433834\nlast event record identifier : 72433930\nheader size : 128\nlast event record offset : 0x0000fd18\nfree space offset : 0x0000ffb0\nevent records checksum : 0x6df0577c\nchecksum : 0x5ff97a22\n....\n\nmismatch in chunk: 14 event records CRC-32 checksum (0x6df0577c != 0xd97de631)\n\nIn the middle of this chunk the size of the event record does not match the\ncopy of size.\n\n....\nsignature : \\x2a\\x2a\\x00\\x00\nsize : 664\nidentifier : 72433924\nwritten time : Feb 20, 2013 20:50:20.671208000 UTC\nsize copy : 1694526976\n....\n\nJudging by the data structures the size points in the middle of the binary XML.\n\nIn this case scanning for event record signatures in the remainder of the chunk\nyields 6 results:\n\n* 1x corrupt event record (72433924)\n* 5x recoverable event records (73882240 - 73882244)\n\nThe discontinuation in event record numbers suggest that the file was copied\nwhile event record 72433924 was being written.\n\nBy continuing scanning for event records in total 21045 event records were\nfound with the first event number of 72432422.\n\n=== Corruption scenario: cross chunk 0-byte values\n\nLets consider a dirty Security.evtx file.\n\nEventViewer shows 102019 events.\n\nUsing \"Save All Events As ...\" as an XML file from EventViewer shows 68269\nevents.\n\nWevtutil get-log-info shows 102019 events.\n\n....\nwevtutil qli file.evtx /lf:true\n....\n\nThe \"oldestRecordNumber\" is 20496.\n\nWevtutil query-events shows 19660 events.\n\n....\nwevtutil qe file.evtx /lf:true > file.xml\n....\n\nFailed to read events. The event log file is corrupted.\n\n....\ncat file.xml | grep EventRecordID | wc -l\n....\n\nRecall that in the previous corruption scenario wevtutil did not report it but\nin this case it does.\n\n....\nsignature : ElfChnk\\x00\nfirst event record number : 40163\nlast event record number : 40261\nfirst event record identifier : 41158\nlast event record identifier : 41256\nheader size : 128\nlast event record offset : 0x0000fba8\nfree space offset : 0x0000fe18\nevent records checksum : 0x9981f715\nchecksum : 0x4931f4a2\n....\n\n....\nmismatch in chunk: 402 event records CRC-32 checksum (0x9981f715 != 0x31aa1bb0).\n....\n\n....\nsignature : \\x2a\\x2a\\x00\\x00\nsize : 624\nidentifier : 41173\nwritten time : Mar 15, 2012 11:03:23.546212500 UTC\nsize copy : 0\n....\n\n....\nchunk header data:\n00000000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........\n...\n00000070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........\n....\n\nBy continuing scanning for event records in total 98927 event records and 1043\nrecoverable event records were found.\n\n=== Other\n\nWhat are .ax files? As seen in:\n\n....\nSource : Microsoft-Windows-DirectShow-KernelSupport\nCategories : None\nMessages : [u'ksproxy.ax']\n....\n\n:numbered!:\n[appendix]\n== References\n\n[cols=\"1,5\",options=\"header\"]\n|===\n| Title | The Shell Core Provider\n| Author(s) | G. Chappel\n| Date | December 29, 2008\n| URL | http://www.geoffchappell.com/notes/windows/shell/events/core.htm\n|===\n\n`[LIBEXE]`\n\n[cols=\"1,5\",options=\"header\"]\n|===\n| Title | MZ, PE-COFF executable file format (EXE)\n| Author(s) | J.B. Metz\n| Date | October 2011\n| URL | https://github.com/libyal/libexe/blob/master/documentation/Executable%20(EXE)%20file%20format.asciidoc\n|===\n\n`[LIBFWEVT]`\n\n[cols=\"1,5\",options=\"header\"]\n|===\n| Title | Windows Event manifest binary format\n| Author(s) | J.B. Metz\n| Date | October 2011\n| URL | https://github.com/libyal/libfwevt/blob/main/documentation/Windows%20Event%20manifest%20binary%20format.asciidoc\n|===\n\n`[MS-EVEN6]`\n\n[cols=\"1,5\",options=\"header\"]\n|===\n| Title | EventLog Remoting Protocol Version 6.0 Specification\n| URL | http://msdn.microsoft.com/en-us/library/cc231282(v=prot.10).aspx\n|===\n\n`[MSDN]`\n\n[cols=\"1,5\",options=\"header\"]\n|===\n| Title | BinXml\n| URL | https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-even6/e6fc7c72-b8c0-475b-aef7-25eaf1a64530\n|===\n\n[cols=\"1,5\",options=\"header\"]\n|===\n| Title | Array Types\n| URL | https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-even6/3e08eb46-ec3d-464c-9614-16af6e232fa9\n|===\n\n[cols=\"1,5\",options=\"header\"]\n|===\n| Title | LevelType Complex Type\n| URL | https://learn.microsoft.com/en-us/windows/win32/wes/eventmanifestschema-leveltype-complextype\n|===\n\n[cols=\"1,5\",options=\"header\"]\n|===\n| Title | Type System\n| URL | https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-even6/8aa98312-f199-4e37-a51f-d3a2ccb50d60\n|===\n\n[cols=\"1,5\",options=\"header\"]\n|===\n| Title | MS-PLA: Product Behavior\n| URL | https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-pla/905cad7f-1a12-49b4-a263-461a2977ab71\n|===\n\n`[LIBFWNT]`\n\n[cols=\"1,5\",options=\"header\"]\n|===\n| Title: | Security Descriptor\n| URL: | https://github.com/libyal/libfwnt/blob/main/documentation/Security%20Descriptor.asciidoc\n|===\n\n[cols=\"1,5\",options=\"header\"]\n|===\n| Title | Introducing the Microsoft Vista Event Log File Format.\n| Author(s) | A. Schuster\n| Date | 2007\n|===\n\n[cols=\"1,5\",options=\"header\"]\n|===\n| Tittle | Linking Event Messages and Resource DLLs\n| Author(s) | A. Schuster\n| Date | October 5, 2010\n|===\n\n`[SCHUSTER11]`\n\n[cols=\"1,5\",options=\"header\"]\n|===\n| Title | Microsoft Windows Event Logging - Dokumentation der Binärformate\n| Author(s) | A. Schuster\n| Version | 148\n| Date | February 6, 2011\n|===\n\n[cols=\"1,5\",options=\"header\"]\n|===\n| Title | Extensible Markup Language (XML) 1.0 (Fifth Edition)\n| Date | November 26, 2008\n| URL | http://www.w3.org/TR/REC-xml/\n|===\n\n[appendix]\n== GNU Free Documentation License\n\nVersion 1.3, 3 November 2008\nCopyright © 2000, 2001, 2002, 2007, 2008 Free Software Foundation, Inc.\n\n\nEveryone is permitted to copy and distribute verbatim copies of this license\ndocument, but changing it is not allowed.\n\n=== 0. PREAMBLE\n\nThe purpose of this License is to make a manual, textbook, or other functional\nand useful document \"free\" in the sense of freedom: to assure everyone the\neffective freedom to copy and redistribute it, with or without modifying it,\neither commercially or noncommercially. Secondarily, this License preserves for\nthe author and publisher a way to get credit for their work, while not being\nconsidered responsible for modifications made by others.\n\nThis License is a kind of \"copyleft\", which means that derivative works of the\ndocument must themselves be free in the same sense. It complements the GNU\nGeneral Public License, which is a copyleft license designed for free software.\n\nWe have designed this License in order to use it for manuals for free software,\nbecause free software needs free documentation: a free program should come with\nmanuals providing the same freedoms that the software does. But this License is\nnot limited to software manuals; it can be used for any textual work,\nregardless of subject matter or whether it is published as a printed book. We\nrecommend this License principally for works whose purpose is instruction or\nreference.\n\n=== 1. APPLICABILITY AND DEFINITIONS\n\nThis License applies to any manual or other work, in any medium, that contains\na notice placed by the copyright holder saying it can be distributed under the\nterms of this License. Such a notice grants a world-wide, royalty-free license,\nunlimited in duration, to use that work under the conditions stated herein. The\n\"Document\", below, refers to any such manual or work. Any member of the public\nis a licensee, and is addressed as \"you\". You accept the license if you copy,\nmodify or distribute the work in a way requiring permission under copyright law.\n\nA \"Modified Version\" of the Document means any work containing the Document or\na portion of it, either copied verbatim, or with modifications and/or\ntranslated into another language.\n\nA \"Secondary Section\" is a named appendix or a front-matter section of the\nDocument that deals exclusively with the relationship of the publishers or\nauthors of the Document to the Document's overall subject (or to related\nmatters) and contains nothing that could fall directly within that overall\nsubject. (Thus, if the Document is in part a textbook of mathematics, a\nSecondary Section may not explain any mathematics.) The relationship could be a\nmatter of historical connection with the subject or with related matters, or of\nlegal, commercial, philosophical, ethical or political position regarding them.\n\nThe \"Invariant Sections\" are certain Secondary Sections whose titles are\ndesignated, as being those of Invariant Sections, in the notice that says that\nthe Document is released under this License. If a section does not fit the\nabove definition of Secondary then it is not allowed to be designated as\nInvariant. The Document may contain zero Invariant Sections. If the Document\ndoes not identify any Invariant Sections then there are none.\n\nThe \"Cover Texts\" are certain short passages of text that are listed, as\nFront-Cover Texts or Back-Cover Texts, in the notice that says that the\nDocument is released under this License. A Front-Cover Text may be at most 5\nwords, and a Back-Cover Text may be at most 25 words.\n\nA \"Transparent\" copy of the Document means a machine-readable copy, represented\nin a format whose specification is available to the general public, that is\nsuitable for revising the document straightforwardly with generic text editors\nor (for images composed of pixels) generic paint programs or (for drawings)\nsome widely available drawing editor, and that is suitable for input to text\nformatters or for automatic translation to a variety of formats suitable for\ninput to text formatters. A copy made in an otherwise Transparent file format\nwhose markup, or absence of markup, has been arranged to thwart or discourage\nsubsequent modification by readers is not Transparent. An image format is not\nTransparent if used for any substantial amount of text. A copy that is not\n\"Transparent\" is called \"Opaque\".\n\nExamples of suitable formats for Transparent copies include plain ASCII without\nmarkup, Texinfo input format, LaTeX input format, SGML or XML using a publicly\navailable DTD, and standard-conforming simple HTML, PostScript or PDF designed\nfor human modification. Examples of transparent image formats include PNG, XCF\nand JPG. Opaque formats include proprietary formats that can be read and edited\nonly by proprietary word processors, SGML or XML for which the DTD and/or\nprocessing tools are not generally available, and the machine-generated HTML,\nPostScript or PDF produced by some word processors for output purposes only.\n\nThe \"Title Page\" means, for a printed book, the title page itself, plus such\nfollowing pages as are needed to hold, legibly, the material this License\nrequires to appear in the title page. For works in formats which do not have\nany title page as such, \"Title Page\" means the text near the most prominent\nappearance of the work's title, preceding the beginning of the body of the text.\n\nThe \"publisher\" means any person or entity that distributes copies of the\nDocument to the public.\n\nA section \"Entitled XYZ\" means a named subunit of the Document whose title\neither is precisely XYZ or contains XYZ in parentheses following text that\ntranslates XYZ in another language. (Here XYZ stands for a specific section\nname mentioned below, such as \"Acknowledgements\", \"Dedications\",\n\"Endorsements\", or \"History\".) To \"Preserve the Title\" of such a section when\nyou modify the Document means that it remains a section \"Entitled XYZ\"\naccording to this definition.\n\nThe Document may include Warranty Disclaimers next to the notice which states\nthat this License applies to the Document. These Warranty Disclaimers are\nconsidered to be included by reference in this License, but only as regards\ndisclaiming warranties: any other implication that these Warranty Disclaimers\nmay have is void and has no effect on the meaning of this License.\n\n=== 2. VERBATIM COPYING\n\nYou may copy and distribute the Document in any medium, either commercially or\nnoncommercially, provided that this License, the copyright notices, and the\nlicense notice saying this License applies to the Document are reproduced in\nall copies, and that you add no other conditions whatsoever to those of this\nLicense. You may not use technical measures to obstruct or control the reading\nor further copying of the copies you make or distribute. However, you may\naccept compensation in exchange for copies. If you distribute a large enough\nnumber of copies you must also follow the conditions in section 3.\n\nYou may also lend copies, under the same conditions stated above, and you may\npublicly display copies.\n\n=== 3. COPYING IN QUANTITY\n\nIf you publish printed copies (or copies in media that commonly have printed\ncovers) of the Document, numbering more than 100, and the Document's license\nnotice requires Cover Texts, you must enclose the copies in covers that carry,\nclearly and legibly, all these Cover Texts: Front-Cover Texts on the front\ncover, and Back-Cover Texts on the back cover. Both covers must also clearly\nand legibly identify you as the publisher of these copies. The front cover must\npresent the full title with all words of the title equally prominent and\nvisible. You may add other material on the covers in addition. Copying with\nchanges limited to the covers, as long as they preserve the title of the\nDocument and satisfy these conditions, can be treated as verbatim copying in\nother respects.\n\nIf the required texts for either cover are too voluminous to fit legibly, you\nshould put the first ones listed (as many as fit reasonably) on the actual\ncover, and continue the rest onto adjacent pages.\n\nIf you publish or distribute Opaque copies of the Document numbering more than\n100, you must either include a machine-readable Transparent copy along with\neach Opaque copy, or state in or with each Opaque copy a computer-network\nlocation from which the general network-using public has access to download\nusing public-standard network protocols a complete Transparent copy of the\nDocument, free of added material. If you use the latter option, you must take\nreasonably prudent steps, when you begin distribution of Opaque copies in\nquantity, to ensure that this Transparent copy will remain thus accessible at\nthe stated location until at least one year after the last time you distribute\nan Opaque copy (directly or through your agents or retailers) of that edition\nto the public.\n\nIt is requested, but not required, that you contact the authors of the Document\nwell before redistributing any large number of copies, to give them a chance to\nprovide you with an updated version of the Document.\n\n=== 4. MODIFICATIONS\n\nYou may copy and distribute a Modified Version of the Document under the\nconditions of sections 2 and 3 above, provided that you release the Modified\nVersion under precisely this License, with the Modified Version filling the\nrole of the Document, thus licensing distribution and modification of the\nModified Version to whoever possesses a copy of it. In addition, you must do\nthese things in the Modified Version:\n\nA. Use in the Title Page (and on the covers, if any) a title distinct from that\nof the Document, and from those of previous versions (which should, if there\nwere any, be listed in the History section of the Document). You may use the\nsame title as a previous version if the original publisher of that version\ngives permission.\n\nB. List on the Title Page, as authors, one or more persons or entities\nresponsible for authorship of the modifications in the Modified Version,\ntogether with at least five of the principal authors of the Document (all of\nits principal authors, if it has fewer than five), unless they release you from\nthis requirement.\n\nC. State on the Title page the name of the publisher of the Modified Version,\nas the publisher.\n\nD. Preserve all the copyright notices of the Document.\n\nE. Add an appropriate copyright notice for your modifications adjacent to the\nother copyright notices.\n\nF. Include, immediately after the copyright notices, a license notice giving\nthe public permission to use the Modified Version under the terms of this\nLicense, in the form shown in the Addendum below.\n\nG. Preserve in that license notice the full lists of Invariant Sections and\nrequired Cover Texts given in the Document's license notice.\n\nH. Include an unaltered copy of this License.\n\nI. Preserve the section Entitled \"History\", Preserve its Title, and add to it\nan item stating at least the title, year, new authors, and publisher of the\nModified Version as given on the Title Page. If there is no section Entitled\n\"History\" in the Document, create one stating the title, year, authors, and\npublisher of the Document as given on its Title Page, then add an item\ndescribing the Modified Version as stated in the previous sentence.\n\nJ. Preserve the network location, if any, given in the Document for public\naccess to a Transparent copy of the Document, and likewise the network\nlocations given in the Document for previous versions it was based on. These\nmay be placed in the \"History\" section. You may omit a network location for a\nwork that was published at least four years before the Document itself, or if\nthe original publisher of the version it refers to gives permission.\n\nK. For any section Entitled \"Acknowledgements\" or \"Dedications\", Preserve the\nTitle of the section, and preserve in the section all the substance and tone of\neach of the contributor acknowledgements and/or dedications given therein.\n\nL. Preserve all the Invariant Sections of the Document, unaltered in their text\nand in their titles. Section numbers or the equivalent are not considered part\nof the section titles.\n\nM. Delete any section Entitled \"Endorsements\". Such a section may not be\nincluded in the Modified Version.\n\nN. Do not retitle any existing section to be Entitled \"Endorsements\" or to\nconflict in title with any Invariant Section.\n\nO. Preserve any Warranty Disclaimers.\n\nIf the Modified Version includes new front-matter sections or appendices that\nqualify as Secondary Sections and contain no material copied from the Document,\nyou may at your option designate some or all of these sections as invariant. To\ndo this, add their titles to the list of Invariant Sections in the Modified\nVersion's license notice. These titles must be distinct from any other section\ntitles.\n\nYou may add a section Entitled \"Endorsements\", provided it contains nothing but\nendorsements of your Modified Version by various parties—for example,\nstatements of peer review or that the text has been approved by an organization\nas the authoritative definition of a standard.\n\nYou may add a passage of up to five words as a Front-Cover Text, and a passage\nof up to 25 words as a Back-Cover Text, to the end of the list of Cover Texts\nin the Modified Version. Only one passage of Front-Cover Text and one of\nBack-Cover Text may be added by (or through arrangements made by) any one\nentity. If the Document already includes a cover text for the same cover,\npreviously added by you or by arrangement made by the same entity you are\nacting on behalf of, you may not add another; but you may replace the old one,\non explicit permission from the previous publisher that added the old one.\n\nThe author(s) and publisher(s) of the Document do not by this License give\npermission to use their names for publicity for or to assert or imply\nendorsement of any Modified Version.\n\n=== 5. COMBINING DOCUMENTS\n\nYou may combine the Document with other documents released under this License,\nunder the terms defined in section 4 above for modified versions, provided that\nyou include in the combination all of the Invariant Sections of all of the\noriginal documents, unmodified, and list them all as Invariant Sections of your\ncombined work in its license notice, and that you preserve all their Warranty\nDisclaimers.\n\nThe combined work need only contain one copy of this License, and multiple\nidentical Invariant Sections may be replaced with a single copy. If there are\nmultiple Invariant Sections with the same name but different contents, make the\ntitle of each such section unique by adding at the end of it, in parentheses,\nthe name of the original author or publisher of that section if known, or else\na unique number. Make the same adjustment to the section titles in the list of\nInvariant Sections in the license notice of the combined work.\n\nIn the combination, you must combine any sections Entitled \"History\" in the\nvarious original documents, forming one section Entitled \"History\"; likewise\ncombine any sections Entitled \"Acknowledgements\", and any sections Entitled\n\"Dedications\". You must delete all sections Entitled \"Endorsements\".\n\n=== 6. COLLECTIONS OF DOCUMENTS\n\nYou may make a collection consisting of the Document and other documents\nreleased under this License, and replace the individual copies of this License\nin the various documents with a single copy that is included in the collection,\nprovided that you follow the rules of this License for verbatim copying of each\nof the documents in all other respects.\n\nYou may extract a single document from such a collection, and distribute it\nindividually under this License, provided you insert a copy of this License\ninto the extracted document, and follow this License in all other respects\nregarding verbatim copying of that document.\n\n=== 7. AGGREGATION WITH INDEPENDENT WORKS\n\nA compilation of the Document or its derivatives with other separate and\nindependent documents or works, in or on a volume of a storage or distribution\nmedium, is called an \"aggregate\" if the copyright resulting from the\ncompilation is not used to limit the legal rights of the compilation's users\nbeyond what the individual works permit. When the Document is included in an\naggregate, this License does not apply to the other works in the aggregate\nwhich are not themselves derivative works of the Document.\n\nIf the Cover Text requirement of section 3 is applicable to these copies of the\nDocument, then if the Document is less than one half of the entire aggregate,\nthe Document's Cover Texts may be placed on covers that bracket the Document\nwithin the aggregate, or the electronic equivalent of covers if the Document is\nin electronic form. Otherwise they must appear on printed covers that bracket\nthe whole aggregate.\n\n=== 8. TRANSLATION\n\nTranslation is considered a kind of modification, so you may distribute\ntranslations of the Document under the terms of section 4. Replacing Invariant\nSections with translations requires special permission from their copyright\nholders, but you may include translations of some or all Invariant Sections in\naddition to the original versions of these Invariant Sections. You may include\na translation of this License, and all the license notices in the Document, and\nany Warranty Disclaimers, provided that you also include the original English\nversion of this License and the original versions of those notices and\ndisclaimers. In case of a disagreement between the translation and the original\nversion of this License or a notice or disclaimer, the original version will\nprevail.\n\nIf a section in the Document is Entitled \"Acknowledgements\", \"Dedications\", or\n\"History\", the requirement (section 4) to Preserve its Title (section 1) will\ntypically require changing the actual title.\n\n=== 9. TERMINATION\n\nYou may not copy, modify, sublicense, or distribute the Document except as\nexpressly provided under this License. Any attempt otherwise to copy, modify,\nsublicense, or distribute it is void, and will automatically terminate your\nrights under this License.\n\nHowever, if you cease all violation of this License, then your license from a\nparticular copyright holder is reinstated (a) provisionally, unless and until\nthe copyright holder explicitly and finally terminates your license, and (b)\npermanently, if the copyright holder fails to notify you of the violation by\nsome reasonable means prior to 60 days after the cessation.\n\nMoreover, your license from a particular copyright holder is reinstated\npermanently if the copyright holder notifies you of the violation by some\nreasonable means, this is the first time you have received notice of violation\nof this License (for any work) from that copyright holder, and you cure the\nviolation prior to 30 days after your receipt of the notice.\n\nTermination of your rights under this section does not terminate the licenses\nof parties who have received copies or rights from you under this License. If\nyour rights have been terminated and not permanently reinstated, receipt of a\ncopy of some or all of the same material does not give you any rights to use it.\n\n=== 10. FUTURE REVISIONS OF THIS LICENSE\n\nThe Free Software Foundation may publish new, revised versions of the GNU Free\nDocumentation License from time to time. Such new versions will be similar in\nspirit to the present version, but may differ in detail to address new problems\nor concerns. See http://www.gnu.org/copyleft/.\n\nEach version of the License is given a distinguishing version number. If the\nDocument specifies that a particular numbered version of this License \"or any\nlater version\" applies to it, you have the option of following the terms and\nconditions either of that specified version or of any later version that has\nbeen published (not as a draft) by the Free Software Foundation. If the\nDocument does not specify a version number of this License, you may choose any\nversion ever published (not as a draft) by the Free Software Foundation. If the\nDocument specifies that a proxy can decide which future versions of this\nLicense can be used, that proxy's public statement of acceptance of a version\npermanently authorizes you to choose that version for the Document.\n\n=== 11. RELICENSING\n\n\"Massive Multiauthor Collaboration Site\" (or \"MMC Site\") means any World Wide\nWeb server that publishes copyrightable works and also provides prominent\nfacilities for anybody to edit those works. A public wiki that anybody can edit\nis an example of such a server. A \"Massive Multiauthor Collaboration\" (or\n\"MMC\") contained in the site means any set of copyrightable works thus\npublished on the MMC site.\n\n\"CC-BY-SA\" means the Creative Commons Attribution-Share Alike 3.0 license\npublished by Creative Commons Corporation, a not-for-profit corporation with a\nprincipal place of business in San Francisco, California, as well as future\ncopyleft versions of that license published by that same organization.\n\n\"Incorporate\" means to publish or republish a Document, in whole or in part, as\npart of another Document.\n\nAn MMC is \"eligible for relicensing\" if it is licensed under this License, and\nif all works that were first published under this License somewhere other than\nthis MMC, and subsequently incorporated in whole or in part into the MMC, (1)\nhad no cover texts or invariant sections, and (2) were thus incorporated prior\nto November 1, 2008.\n\nThe operator of an MMC Site may republish an MMC contained in the site under\nCC-BY-SA on the same site at any time before August 1, 2009, provided the MMC\nis eligible for relicensing.\n\n" }, { "path": "dpkg/changelog.in", "content": "libevtx (@VERSION@-1) unstable; urgency=low\n\n * Auto-generated\n\n -- Joachim Metz @DPKG_DATE@\n" }, { "path": "dpkg/compat", "content": "10\n" }, { "path": "dpkg/control", "content": "Source: libevtx\nPriority: extra\nMaintainer: Joachim Metz \nBuild-Depends: debhelper (>= 9), dh-autoreconf, dh-python, pkg-config, python3-dev, python3-setuptools\nStandards-Version: 4.1.4\nSection: libs\nHomepage: https://github.com/libyal/libevtx\nVcs-Git: https://github.com/libyal/libevtx.git\n\nPackage: libevtx\nArchitecture: any\nDepends: ${shlibs:Depends}, ${misc:Depends}\nConflicts: libevtx1\nReplaces: libevtx1\nSuggests: libevtx-dbg\nDescription: Library to access the Windows XML Event Log (EVTX) format\n libevtx is a library to access the Windows XML Event Log (EVTX) format.\n\nPackage: libevtx-dbg\nArchitecture: any\nSection: debug\nDepends: libevtx (= ${binary:Version}), ${misc:Depends}\nDescription: Debugging symbols for libevtx\n Debugging symbols for libevtx.\n\nPackage: libevtx-dev\nSection: libdevel\nArchitecture: any\nDepends: libevtx (= ${binary:Version}), ${misc:Depends}\nDescription: Header files and libraries for developing applications for libevtx\n Header files and libraries for developing applications for libevtx.\n\nPackage: libevtx-tools\nSection: utils\nArchitecture: any\nDepends: libevtx (= ${binary:Version}), ${shlibs:Depends}, ${misc:Depends}\nConflicts: libevtx-utils\nReplaces: libevtx-utils\nDescription: Several tools for reading Windows XML Event Log (EVTX) files\n Several tools for reading Windows XML Event Log (EVTX) files.\n\nPackage: libevtx-tools-dbg\nSection: debug\nArchitecture: any\nDepends: libevtx-tools (= ${binary:Version}), ${misc:Depends}\nDescription: Debugging symbols for libevtx-tools\n Debugging symbols for libevtx-tools.\n\nPackage: libevtx-python3\nSection: python\nArchitecture: any\nDepends: libevtx (= ${binary:Version}), ${shlibs:Depends}, ${misc:Depends}\nConflicts: python3-libevtx\nReplaces: python3-libevtx\nSuggests: libevtx-python3-dbg\nDescription: Python 3 bindings for libevtx\n Python 3 bindings for libevtx.\n\nPackage: libevtx-python3-dbg\nSection: debug\nArchitecture: any\nDepends: libevtx-python3 (= ${binary:Version}), ${misc:Depends}\nDescription: Debugging symbols for libevtx-python3\n Debugging symbols for libevtx-python3.\n\n" }, { "path": "dpkg/copyright", "content": "Format: http://www.debian.org/doc/packaging-manuals/copyright-format/1.0/\nUpstream-Name: libevtx\nSource: https://github.com/libyal/libevtx\n\nFiles: *\nCopyright: 2011-2025, Joachim Metz \nLicense: LGPL-3.0+\n\nLicense: LGPL-3.0+\n This package is free software; you can redistribute it and/or\n modify it under the terms of the GNU Lesser General Public\n License as published by the Free Software Foundation; either\n version 3 of the License, or (at your option) any later version.\n .\n This package is distributed in the hope that it will be useful,\n but WITHOUT ANY WARRANTY; without even the implied warranty of\n MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU\n Lesser General Public License for more details.\n .\n You should have received a copy of the GNU General Public License\n along with this program. If not, see .\n .\n On Debian systems, the complete text of the GNU Lesser General\n Public License can be found in \"/usr/share/common-licenses/LGPL-3\".\n\n" }, { "path": "dpkg/libevtx-dev.install", "content": "usr/include/*\nusr/lib/*-*/lib*.a\nusr/lib/*-*/lib*.so\nusr/lib/*-*/pkgconfig/*\nusr/share/man/man3\n" }, { "path": "dpkg/libevtx-python3.install", "content": "/usr/lib/python3*\n" }, { "path": "dpkg/libevtx-tools.install", "content": "usr/bin\nusr/share/man/man1\n" }, { "path": "dpkg/libevtx.install", "content": "usr/lib/*-*/lib*.so.*\n" }, { "path": "dpkg/rules", "content": "#!/usr/bin/make -f\n# -*- makefile -*-\n\n# Uncomment for debhelper verbose output.\n# export DH_VERBOSE=1\n\nexport SKIP_PYTHON_TESTS=1\n\n%:\n\tdh $@ --buildsystem=autoconf --with=autoreconf,python3\n\n.PHONY: override_dh_auto_configure\noverride_dh_auto_configure:\n\tdh_auto_configure -- --enable-python CFLAGS=\"-g\"\n\n.PHONY: override_dh_install\noverride_dh_install:\n\tdh_install --fail-missing -X.la -X/pyevtx.a\n\n.PHONY: override_dh_missing\noverride_dh_missing:\n\tdh_missing -X.la -X/pyevtx.a --fail-missing\n\n.PHONY: override_dh_strip\noverride_dh_strip:\nifeq (,$(filter nostrip,$(DEB_BUILD_OPTIONS)))\n\tdh_strip -plibevtx --dbg-package=libevtx-dbg\n\tdh_strip -plibevtx-tools --dbg-package=libevtx-tools-dbg\n\tdh_strip -plibevtx-python3 --dbg-package=libevtx-python3-dbg\nendif\n\n" }, { "path": "dpkg/source/format", "content": "3.0 (quilt)\n" }, { "path": "dtfabric.yaml", "content": "name: evtx\ntype: format\ndescription: Windows XML Event Log (EVTX) format\nurls: [\"https://github.com/libyal/libevtx/blob/main/documentation/Windows%20XML%20Event%20Log%20(EVTX).asciidoc\"\nmetadata:\n authors: ['Joachim Metz ']\n year: 2011\nattributes:\n byte_order: little-endian\nlayout:\n- data_type: file_header\n offset: 0\n---\nname: byte\ntype: integer\nattributes:\n format: unsigned\n size: 1\n units: bytes\n---\nname: uint32\ntype: integer\nattributes:\n format: unsigned\n size: 4\n units: bytes\n---\nname: uint64\ntype: integer\nattributes:\n format: unsigned\n size: 8\n units: bytes\n---\nname: file_header\ntype: structure\ndescription: File header\nmembers:\n- name: signature\n type: stream\n element_data_type: byte\n elements_data_size: 8\n value: \"ElfFile\\x00\"\n- name: first_chunk_number\n data_type: uint64\n- name: last_chunk_number\n data_type: uint64\n- name: next_record_identifier\n data_type: uint64\n- name: header_size\n data_type: uint32\n- name: minor_format_version\n data_type: uint16\n- name: major_format_version\n data_type: uint16\n- name: header_block_size\n data_type: uint16\n- name: number_of_chunks\n data_type: uint16\n- name: unknown1\n type: stream\n element_data_type: byte\n elements_data_size: 76\n- name: file_flags\n data_type: uint32\n- name: checksum\n data_type: uint32\n" }, { "path": "evtxtools/Makefile.am", "content": "AM_CPPFLAGS = \\\n\t-I../include -I$(top_srcdir)/include \\\n\t-I../common -I$(top_srcdir)/common \\\n\t@LIBCERROR_CPPFLAGS@ \\\n\t@LIBCDATA_CPPFLAGS@ \\\n\t@LIBCTHREADS_CPPFLAGS@ \\\n\t@LIBCLOCALE_CPPFLAGS@ \\\n\t@LIBCNOTIFY_CPPFLAGS@ \\\n\t@LIBCSPLIT_CPPFLAGS@ \\\n\t@LIBUNA_CPPFLAGS@ \\\n\t@LIBCFILE_CPPFLAGS@ \\\n\t@LIBCPATH_CPPFLAGS@ \\\n\t@LIBBFIO_CPPFLAGS@ \\\n\t@LIBFCACHE_CPPFLAGS@ \\\n\t@LIBFDATA_CPPFLAGS@ \\\n\t@LIBFDATETIME_CPPFLAGS@ \\\n\t@LIBFGUID_CPPFLAGS@ \\\n\t@LIBFVALUE_CPPFLAGS@ \\\n\t@LIBFWEVT_CPPFLAGS@ \\\n\t@LIBFWNT_CPPFLAGS@ \\\n\t@LIBEXE_CPPFLAGS@ \\\n\t@LIBREGF_CPPFLAGS@ \\\n\t@LIBWRC_CPPFLAGS@ \\\n\t@LIBCDIRECTORY_CPPFLAGS@ \\\n\t@PTHREAD_CPPFLAGS@ \\\n\t@LIBEVTX_DLL_IMPORT@\n\nAM_LDFLAGS = @STATIC_LDFLAGS@\n\nbin_PROGRAMS = \\\n\tevtxexport \\\n\tevtxinfo\n\nevtxexport_SOURCES = \\\n\tevtxexport.c \\\n\tevtxinput.c evtxinput.h \\\n\tevtxtools_getopt.c evtxtools_getopt.h \\\n\tevtxtools_i18n.h \\\n\tevtxtools_libbfio.h \\\n\tevtxtools_libcdirectory.h \\\n\tevtxtools_libcerror.h \\\n\tevtxtools_libclocale.h \\\n\tevtxtools_libcnotify.h \\\n\tevtxtools_libcpath.h \\\n\tevtxtools_libcsplit.h \\\n\tevtxtools_libevtx.h \\\n\tevtxtools_libfcache.h \\\n\tevtxtools_libfdatetime.h \\\n\tevtxtools_libfguid.h \\\n\tevtxtools_libfvalue.h \\\n\tevtxtools_libfwevt.h \\\n\tevtxtools_libfwnt.h \\\n\tevtxtools_libexe.h \\\n\tevtxtools_libregf.h \\\n\tevtxtools_libuna.h \\\n\tevtxtools_libwrc.h \\\n\tevtxtools_output.c evtxtools_output.h \\\n\tevtxtools_signal.c evtxtools_signal.h \\\n\tevtxtools_system_split_string.h \\\n\tevtxtools_unused.h \\\n\tevtxtools_wide_string.c evtxtools_wide_string.h \\\n\texport_handle.c export_handle.h \\\n\tlog_handle.c log_handle.h \\\n\tmessage_handle.c message_handle.h \\\n\tmessage_string.c message_string.h \\\n\tpath_handle.c path_handle.h \\\n\tregistry_file.c registry_file.h \\\n\tresource_file.c resource_file.h\n\nevtxexport_LDADD = \\\n\t@LIBREGF_LIBADD@ \\\n\t@LIBWRC_LIBADD@ \\\n\t@LIBEXE_LIBADD@ \\\n\t@LIBFVALUE_LIBADD@ \\\n\t@LIBFWNT_LIBADD@ \\\n\t@LIBFWEVT_LIBADD@ \\\n\t@LIBFGUID_LIBADD@ \\\n\t@LIBFDATETIME_LIBADD@ \\\n\t@LIBFDATA_LIBADD@ \\\n\t@LIBFCACHE_LIBADD@ \\\n\t@LIBBFIO_LIBADD@ \\\n\t@LIBCPATH_LIBADD@ \\\n\t@LIBCFILE_LIBADD@ \\\n\t@LIBCDIRECTORY_LIBADD@ \\\n\t@LIBUNA_LIBADD@ \\\n\t@LIBCSPLIT_LIBADD@ \\\n\t@LIBCNOTIFY_LIBADD@ \\\n\t@LIBCLOCALE_LIBADD@ \\\n\t@LIBCDATA_LIBADD@ \\\n\t../libevtx/libevtx.la \\\n\t@LIBCTHREADS_LIBADD@ \\\n\t@LIBCERROR_LIBADD@ \\\n\t@LIBINTL@ \\\n\t@PTHREAD_LIBADD@\n\nevtxinfo_SOURCES = \\\n\tevtxinfo.c \\\n\tevtxinput.c evtxinput.h \\\n\tevtxtools_getopt.c evtxtools_getopt.h \\\n\tevtxtools_i18n.h \\\n\tevtxtools_libcerror.h \\\n\tevtxtools_libclocale.h \\\n\tevtxtools_libcnotify.h \\\n\tevtxtools_libevtx.h \\\n\tevtxtools_libfdatetime.h \\\n\tevtxtools_libfguid.h \\\n\tevtxtools_libfvalue.h \\\n\tevtxtools_libfwnt.h \\\n\tevtxtools_libuna.h \\\n\tevtxtools_output.c evtxtools_output.h \\\n\tevtxtools_signal.c evtxtools_signal.h \\\n\tevtxtools_wide_string.c evtxtools_wide_string.h \\\n\tevtxtools_unused.h \\\n\tinfo_handle.c info_handle.h\n\nevtxinfo_LDADD = \\\n\t@LIBUNA_LIBADD@ \\\n\t@LIBCSPLIT_LIBADD@ \\\n\t@LIBCNOTIFY_LIBADD@ \\\n\t@LIBCLOCALE_LIBADD@ \\\n\t../libevtx/libevtx.la \\\n\t@LIBCTHREADS_LIBADD@ \\\n\t@LIBCERROR_LIBADD@ \\\n\t@LIBINTL@ \\\n\t@PTHREAD_LIBADD@\n\nDISTCLEANFILES = \\\n\tMakefile \\\n\tMakefile.in\n\nsplint-local:\n\t@echo \"Running splint on evtxexport ...\"\n\t-splint -preproc -redef $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(evtxexport_SOURCES)\n\t@echo \"Running splint on evtxinfo ...\"\n\t-splint -preproc -redef $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(evtxinfo_SOURCES)\n\n" }, { "path": "evtxtools/evtxexport.c", "content": "/*\n * Extracts items from a Windows XML Event Viewer Log (EVTX) file\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#include \n#include \n#include \n#include \n\n#if defined( HAVE_UNISTD_H )\n#include \n#endif\n\n#if defined( HAVE_STDLIB_H ) || defined( WINAPI )\n#include \n#endif\n\n#include \"evtxtools_getopt.h\"\n#include \"evtxtools_libcerror.h\"\n#include \"evtxtools_libclocale.h\"\n#include \"evtxtools_libcnotify.h\"\n#include \"evtxtools_libevtx.h\"\n#include \"evtxtools_output.h\"\n#include \"evtxtools_signal.h\"\n#include \"evtxtools_unused.h\"\n#include \"export_handle.h\"\n#include \"log_handle.h\"\n\nexport_handle_t *evtxexport_export_handle = NULL;\nint evtxexport_abort = 0;\n\n/* Prints the executable usage information\n */\nvoid usage_fprint(\n FILE *stream )\n{\n\tif( stream == NULL )\n\t{\n\t\treturn;\n\t}\n\tfprintf( stream, \"Use evtxexport to export items stored in a Windows XML Event Viewer\\n\"\n\t \"Log (EVTX) file.\\n\\n\" );\n\n\tfprintf( stream, \"Usage: evtxexport [ -c codepage ] [ -f format ] [ -l log_file ]\\n\"\n\t \" [ -m mode ] [ -p resource_files_path ]\\n\"\n\t \" [ -r registy_files_path ] [ -s system_file ]\\n\"\n\t \" [ -S software_file ] [ -t event_log_type ]\\n\"\n\t \" [ -hTvV ] source\\n\\n\" );\n\n\n\tfprintf( stream, \"\\tsource: the source file\\n\\n\" );\n\n\tfprintf( stream, \"\\t-c: codepage of ASCII strings, options: ascii, windows-874,\\n\"\n\t \"\\t windows-932, windows-936, windows-949, windows-950,\\n\"\n\t \"\\t windows-1250, windows-1251, windows-1252 (default),\\n\"\n\t \"\\t windows-1253, windows-1254, windows-1255, windows-1256\\n\"\n\t \"\\t windows-1257 or windows-1258\\n\" );\n\tfprintf( stream, \"\\t-f: output format, options: xml, text (default)\\n\" );\n\tfprintf( stream, \"\\t-h: shows this help\\n\" );\n\tfprintf( stream, \"\\t-l: logs information about the exported items\\n\" );\n\tfprintf( stream, \"\\t-m: export mode, option: all, items (default), recovered\\n\"\n\t \"\\t 'all' exports the (allocated) items and recovered items,\\n\"\n\t \"\\t 'items' exports the (allocated) items and 'recovered' exports\\n\"\n\t \"\\t the recovered items\\n\" );\n\tfprintf( stream, \"\\t-p: search PATH for the resource files\\n\" );\n\tfprintf( stream, \"\\t-r: name of the directory containing the SOFTWARE and SYSTEM\\n\"\n\t \"\\t (Windows) Registry file\\n\" );\n\tfprintf( stream, \"\\t-s: filename of the SYSTEM (Windows) Registry file.\\n\"\n\t \"\\t This option overrides the path provided by -r\\n\" );\n\tfprintf( stream, \"\\t-S: filename of the SOFTWARE (Windows) Registry file.\\n\"\n\t \"\\t This option overrides the path provided by -r\\n\" );\n\tfprintf( stream, \"\\t-t: event log type, options: application, security, system\\n\"\n\t \"\\t if not specified the event log type is determined based\\n\"\n\t \"\\t on the filename.\\n\" );\n\tfprintf( stream, \"\\t-T: use event template definitions to parse the event record data\\n\" );\n\tfprintf( stream, \"\\t-v: verbose output to stderr\\n\" );\n\tfprintf( stream, \"\\t-V: print version\\n\" );\n}\n\n/* Signal handler for evtxexport\n */\nvoid evtxexport_signal_handler(\n evtxtools_signal_t signal EVTXTOOLS_ATTRIBUTE_UNUSED )\n{\n\tlibcerror_error_t *error = NULL;\n\tstatic char *function = \"evtxexport_signal_handler\";\n\n\tEVTXTOOLS_UNREFERENCED_PARAMETER( signal )\n\n\tevtxexport_abort = 1;\n\n\tif( evtxexport_export_handle != NULL )\n\t{\n\t\tif( export_handle_signal_abort(\n\t\t evtxexport_export_handle,\n\t\t &error ) != 1 )\n\t\t{\n\t\t\tlibcnotify_printf(\n\t\t\t \"%s: unable to signal export handle to abort.\\n\",\n\t\t\t function );\n\n\t\t\tlibcnotify_print_error_backtrace(\n\t\t\t error );\n\t\t\tlibcerror_error_free(\n\t\t\t &error );\n\t\t}\n\t}\n\t/* Force stdin to close otherwise any function reading it will remain blocked\n\t */\n#if defined( WINAPI ) && !defined( __CYGWIN__ )\n\tif( _close(\n\t 0 ) != 0 )\n#else\n\tif( close(\n\t 0 ) != 0 )\n#endif\n\t{\n\t\tlibcnotify_printf(\n\t\t \"%s: unable to close stdin.\\n\",\n\t\t function );\n\t}\n}\n\n/* The main program\n */\n#if defined( HAVE_WIDE_SYSTEM_CHARACTER )\nint wmain( int argc, wchar_t * const argv[] )\n#else\nint main( int argc, char * const argv[] )\n#endif\n{\n\tlibcerror_error_t *error = NULL;\n\tlog_handle_t *log_handle = NULL;\n\tsystem_character_t *option_ascii_codepage = NULL;\n\tsystem_character_t *option_event_log_type = NULL;\n\tsystem_character_t *option_export_format = NULL;\n\tsystem_character_t *option_export_mode = NULL;\n\tsystem_character_t *option_log_filename = NULL;\n\tsystem_character_t *option_resource_files_path = NULL;\n\tsystem_character_t *option_preferred_language = NULL;\n\tsystem_character_t *option_registry_directory_name = NULL;\n\tsystem_character_t *option_software_registry_filename = NULL;\n\tsystem_character_t *option_system_registry_filename = NULL;\n\tsystem_character_t *source = NULL;\n\tchar *program = \"evtxexport\";\n\tsystem_integer_t option = 0;\n\tint result = 0;\n\tint use_template_definition = 0;\n\tint verbose = 0;\n\n\tlibcnotify_stream_set(\n\t stderr,\n\t NULL );\n\tlibcnotify_verbose_set(\n\t 1 );\n\n\tif( libclocale_initialize(\n\t \"evtxtools\",\n\t &error ) != 1 )\n\t{\n\t\tfprintf(\n\t\t stderr,\n\t\t \"Unable to initialize locale values.\\n\" );\n\n\t\tgoto on_error;\n\t}\n\tif( evtxtools_output_initialize(\n\t _IONBF,\n\t &error ) != 1 )\n\t{\n\t\tfprintf(\n\t\t stderr,\n\t\t \"Unable to initialize output settings.\\n\" );\n\n\t\tgoto on_error;\n\t}\n\tevtxoutput_version_fprint(\n\t stdout,\n\t program );\n\n\twhile( ( option = evtxtools_getopt(\n\t argc,\n\t argv,\n\t _SYSTEM_STRING( \"c:f:hl:m:p:r:s:S:t:TvV\" ) ) ) != (system_integer_t) -1 )\n\t{\n\t\tswitch( option )\n\t\t{\n\t\t\tcase (system_integer_t) '?':\n\t\t\tdefault:\n\t\t\t\tfprintf(\n\t\t\t\t stderr,\n\t\t\t\t \"Invalid argument: %\" PRIs_SYSTEM \"\\n\",\n\t\t\t\t argv[ optind - 1 ] );\n\n\t\t\t\tusage_fprint(\n\t\t\t\t stdout );\n\n\t\t\t\treturn( EXIT_FAILURE );\n\n\t\t\tcase (system_integer_t) 'c':\n\t\t\t\toption_ascii_codepage = optarg;\n\n\t\t\t\tbreak;\n\n\t\t\tcase (system_integer_t) 'f':\n\t\t\t\toption_export_format = optarg;\n\n\t\t\t\tbreak;\n\n\t\t\tcase (system_integer_t) 'h':\n\t\t\t\tusage_fprint(\n\t\t\t\t stdout );\n\n\t\t\t\treturn( EXIT_SUCCESS );\n\n\t\t\tcase (system_integer_t) 'l':\n\t\t\t\toption_log_filename = optarg;\n\n\t\t\t\tbreak;\n\n\t\t\tcase (system_integer_t) 'm':\n\t\t\t\toption_export_mode = optarg;\n\n\t\t\t\tbreak;\n\n\t\t\tcase (system_integer_t) 'p':\n\t\t\t\toption_resource_files_path = optarg;\n\n\t\t\t\tbreak;\n\n\t\t\tcase (system_integer_t) 'r':\n\t\t\t\toption_registry_directory_name = optarg;\n\n\t\t\t\tbreak;\n\n\t\t\tcase (system_integer_t) 's':\n\t\t\t\toption_system_registry_filename = optarg;\n\n\t\t\t\tbreak;\n\n\t\t\tcase (system_integer_t) 'S':\n\t\t\t\toption_software_registry_filename = optarg;\n\n\t\t\t\tbreak;\n\n\t\t\tcase (system_integer_t) 't':\n\t\t\t\toption_event_log_type = optarg;\n\n\t\t\t\tbreak;\n\n\t\t\tcase (system_integer_t) 'T':\n\t\t\t\tuse_template_definition = 1;\n\n\t\t\t\tbreak;\n\n\t\t\tcase (system_integer_t) 'v':\n\t\t\t\tverbose = 1;\n\n\t\t\t\tbreak;\n\n\t\t\tcase (system_integer_t) 'V':\n\t\t\t\tevtxoutput_copyright_fprint(\n\t\t\t\t stdout );\n\n\t\t\t\treturn( EXIT_SUCCESS );\n\t\t}\n\t}\n\tif( optind == argc )\n\t{\n\t\tfprintf(\n\t\t stderr,\n\t\t \"Missing source file.\\n\" );\n\n\t\tusage_fprint(\n\t\t stdout );\n\n\t\treturn( EXIT_FAILURE );\n\t}\n\tsource = argv[ optind ];\n\n\tlibcnotify_verbose_set(\n\t verbose );\n\tlibevtx_notify_set_stream(\n\t stderr,\n\t NULL );\n\tlibevtx_notify_set_verbose(\n\t verbose );\n\n\tif( log_handle_initialize(\n\t &log_handle,\n\t &error ) != 1 )\n\t{\n\t\tfprintf(\n\t\t stderr,\n\t\t \"Unable to initialize log handle.\\n\" );\n\n\t\tgoto on_error;\n\t}\n\tif( export_handle_initialize(\n\t &evtxexport_export_handle,\n\t &error ) != 1 )\n\t{\n\t\tfprintf(\n\t\t stderr,\n\t\t \"Unable to initialize export handle.\\n\" );\n\n\t\tgoto on_error;\n\t}\n\tif( option_ascii_codepage != NULL )\n\t{\n\t\tresult = export_handle_set_ascii_codepage(\n\t\t evtxexport_export_handle,\n\t\t option_ascii_codepage,\n\t\t &error );\n\n\t\tif( result == -1 )\n\t\t{\n\t\t\tfprintf(\n\t\t\t stderr,\n\t\t\t \"Unable to set ASCII codepage in export handle.\\n\" );\n\n\t\t\tgoto on_error;\n\t\t}\n\t\telse if( result == 0 )\n\t\t{\n\t\t\tfprintf(\n\t\t\t stderr,\n\t\t\t \"Unsupported ASCII codepage defaulting to: windows-1252.\\n\" );\n\t\t}\n\t}\n\tif( option_event_log_type != NULL )\n\t{\n\t\tresult = export_handle_set_event_log_type(\n\t\t evtxexport_export_handle,\n\t\t option_event_log_type,\n\t\t &error );\n\n\t\tif( result == -1 )\n\t\t{\n\t\t\tfprintf(\n\t\t\t stderr,\n\t\t\t \"Unable to set event log type in export handle.\\n\" );\n\n\t\t\tgoto on_error;\n\t\t}\n\t}\n\tif( option_export_format != NULL )\n\t{\n\t\tresult = export_handle_set_export_format(\n\t\t\t evtxexport_export_handle,\n\t\t\t option_export_format,\n\t\t\t &error );\n\n\t\tif( result == -1 )\n\t\t{\n\t\t\tfprintf(\n\t\t\t stderr,\n\t\t\t \"Unable to set export format.\\n\" );\n\n\t\t\tgoto on_error;\n\t\t}\n\t\telse if( result == 0 )\n\t\t{\n\t\t\tfprintf(\n\t\t\t stderr,\n\t\t\t \"Unsupported export format defaulting to: text.\\n\" );\n\t\t}\n\t}\n\tif( option_export_mode != NULL )\n\t{\n\t\tresult = export_handle_set_export_mode(\n\t\t\t evtxexport_export_handle,\n\t\t\t option_export_mode,\n\t\t\t &error );\n\n\t\tif( result == -1 )\n\t\t{\n\t\t\tfprintf(\n\t\t\t stderr,\n\t\t\t \"Unable to set export mode.\\n\" );\n\n\t\t\tgoto on_error;\n\t\t}\n\t\telse if( result == 0 )\n\t\t{\n\t\t\tfprintf(\n\t\t\t stderr,\n\t\t\t \"Unsupported export mode defaulting to: items.\\n\" );\n\t\t}\n\t}\n\tif( ( option_event_log_type == NULL )\n\t || ( result == 0 ) )\n\t{\n\t\tresult = export_handle_set_event_log_type_from_filename(\n\t\t\t evtxexport_export_handle,\n\t\t\t source,\n\t\t\t &error );\n\n\t\tif( result == -1 )\n\t\t{\n\t\t\tfprintf(\n\t\t\t stderr,\n\t\t\t \"Unable to set event log type from filename in export handle.\\n\" );\n\n\t\t\tgoto on_error;\n\t\t}\n\t}\n\tif( option_resource_files_path != NULL )\n\t{\n\t\tif( export_handle_set_resource_files_path(\n\t\t evtxexport_export_handle,\n\t\t option_resource_files_path,\n\t\t &error ) != 1 )\n\t\t{\n\t\t\tfprintf(\n\t\t\t stderr,\n\t\t\t \"Unable to set resource files path in export handle.\\n\" );\n\n\t\t\tgoto on_error;\n\t\t}\n\t}\n\tif( option_software_registry_filename != NULL )\n\t{\n\t\tif( export_handle_set_software_registry_filename(\n\t\t evtxexport_export_handle,\n\t\t option_software_registry_filename,\n\t\t &error ) != 1 )\n\t\t{\n\t\t\tfprintf(\n\t\t\t stderr,\n\t\t\t \"Unable to set software registry filename in export handle.\\n\" );\n\n\t\t\tgoto on_error;\n\t\t}\n\t}\n\tif( option_system_registry_filename != NULL )\n\t{\n\t\tif( export_handle_set_system_registry_filename(\n\t\t evtxexport_export_handle,\n\t\t option_system_registry_filename,\n\t\t &error ) != 1 )\n\t\t{\n\t\t\tfprintf(\n\t\t\t stderr,\n\t\t\t \"Unable to set system registry filename in export handle.\\n\" );\n\n\t\t\tgoto on_error;\n\t\t}\n\t}\n\tif( option_registry_directory_name != NULL )\n\t{\n\t\tif( export_handle_set_registry_directory_name(\n\t\t evtxexport_export_handle,\n\t\t option_registry_directory_name,\n\t\t &error ) != 1 )\n\t\t{\n\t\t\tfprintf(\n\t\t\t stderr,\n\t\t\t \"Unable to set registry directory name in export handle.\\n\" );\n\n\t\t\tgoto on_error;\n\t\t}\n\t}\n\tif( option_preferred_language != NULL )\n\t{\n/* TODO set preferred language identifier from input */\n\t\tif( export_handle_set_preferred_language_identifier(\n\t\t evtxexport_export_handle,\n\t\t 0x0409,\n\t\t &error ) != 1 )\n\t\t{\n\t\t\tfprintf(\n\t\t\t stderr,\n\t\t\t \"Unable to set preferred language identifier in export handle.\\n\" );\n\n\t\t\tgoto on_error;\n\t\t}\n\t}\n\tevtxexport_export_handle->use_template_definition = use_template_definition;\n\tevtxexport_export_handle->verbose = verbose;\n\n\tif( log_handle_open(\n\t log_handle,\n\t option_log_filename,\n\t &error ) != 1 )\n\t{\n\t\tfprintf(\n\t\t stderr,\n\t\t \"Unable to open log file: %\" PRIs_SYSTEM \".\\n\",\n\t\t option_log_filename );\n\n\t\tgoto on_error;\n\t}\n\tif( export_handle_open_input(\n\t evtxexport_export_handle,\n\t source,\n\t &error ) != 1 )\n\t{\n\t\tfprintf(\n\t\t stderr,\n\t\t \"Unable to open: %\" PRIs_SYSTEM \".\\n\",\n\t\t source );\n\n\t\tgoto on_error;\n\t}\n\tresult = export_handle_export_file(\n\t evtxexport_export_handle,\n\t log_handle,\n\t &error );\n\n\tif( result == -1 )\n\t{\n\t\tfprintf(\n\t\t stderr,\n\t\t \"Unable to export file.\\n\" );\n\n\t\tgoto on_error;\n\t}\n\tif( export_handle_close_input(\n\t evtxexport_export_handle,\n\t &error ) != 0 )\n\t{\n\t\tfprintf(\n\t\t stderr,\n\t\t \"Unable to close export handle.\\n\" );\n\n\t\tgoto on_error;\n\t}\n\tif( export_handle_free(\n\t &evtxexport_export_handle,\n\t &error ) != 1 )\n\t{\n\t\tfprintf(\n\t\t stderr,\n\t\t \"Unable to free export handle.\\n\" );\n\n\t\tgoto on_error;\n\t}\n\tif( log_handle_close(\n\t log_handle,\n\t &error ) != 0 )\n\t{\n\t\tfprintf(\n\t\t stderr,\n\t\t \"Unable to close log handle.\\n\" );\n\n\t\tgoto on_error;\n\t}\n\tif( log_handle_free(\n\t &log_handle,\n\t &error ) != 1 )\n\t{\n\t\tfprintf(\n\t\t stderr,\n\t\t \"Unable to free log handle.\\n\" );\n\n\t\tgoto on_error;\n\t}\n\tif( result == 0 )\n\t{\n\t\tfprintf(\n\t\t stdout,\n\t\t \"No records to export.\\n\" );\n\t}\n\treturn( EXIT_SUCCESS );\n\non_error:\n\tif( error != NULL )\n\t{\n\t\tlibcnotify_print_error_backtrace(\n\t\t error );\n\t\tlibcerror_error_free(\n\t\t &error );\n\t}\n\tif( evtxexport_export_handle != NULL )\n\t{\n\t\texport_handle_free(\n\t\t &evtxexport_export_handle,\n\t\t NULL );\n\t}\n\tif( log_handle != NULL )\n\t{\n\t\tlog_handle_free(\n\t\t &log_handle,\n\t\t NULL );\n\t}\n\treturn( EXIT_FAILURE );\n}\n\n" }, { "path": "evtxtools/evtxinfo.c", "content": "/*\n * Shows information obtained from a Windows XML Event Viewer Log (EVTX) file\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#include \n#include \n#include \n#include \n#include \n\n#if defined( HAVE_UNISTD_H )\n#include \n#endif\n\n#if defined( HAVE_STDLIB_H ) || defined( WINAPI )\n#include \n#endif\n\n#include \"evtxtools_getopt.h\"\n#include \"evtxtools_libcerror.h\"\n#include \"evtxtools_libclocale.h\"\n#include \"evtxtools_libcnotify.h\"\n#include \"evtxtools_libevtx.h\"\n#include \"evtxtools_output.h\"\n#include \"evtxtools_signal.h\"\n#include \"evtxtools_unused.h\"\n#include \"info_handle.h\"\n\ninfo_handle_t *evtxinfo_info_handle = NULL;\nint evtxinfo_abort = 0;\n\n/* Prints the executable usage information\n */\nvoid usage_fprint(\n FILE *stream )\n{\n\tif( stream == NULL )\n\t{\n\t\treturn;\n\t}\n\tfprintf( stream, \"Use evtxinfo to determine information about a Windows XML Event Viewer\\n\"\n\t \"Log (EVTX) file\\n\\n\" );\n\n\tfprintf( stream, \"Usage: evtxinfo [ -c codepage ] [ -hvV ] source\\n\\n\" );\n\n\tfprintf( stream, \"\\tsource: the source file\\n\\n\" );\n\n\tfprintf( stream, \"\\t-c: codepage of ASCII strings, options: ascii, windows-874,\\n\"\n\t \"\\t windows-932, windows-936, windows-949, windows-950,\\n\"\n\t \"\\t windows-1250, windows-1251, windows-1252 (default),\\n\"\n\t \"\\t windows-1253, windows-1254, windows-1255, windows-1256\\n\"\n\t \"\\t windows-1257 or windows-1258\\n\" );\n\tfprintf( stream, \"\\t-h: shows this help\\n\" );\n\tfprintf( stream, \"\\t-v: verbose output to stderr\\n\" );\n\tfprintf( stream, \"\\t-V: print version\\n\" );\n}\n\n/* Signal handler for evtxinfo\n */\nvoid evtxinfo_signal_handler(\n evtxtools_signal_t signal EVTXTOOLS_ATTRIBUTE_UNUSED )\n{\n\tlibcerror_error_t *error = NULL;\n\tstatic char *function = \"evtxinfo_signal_handler\";\n\n\tEVTXTOOLS_UNREFERENCED_PARAMETER( signal )\n\n\tevtxinfo_abort = 1;\n\n\tif( evtxinfo_info_handle != NULL )\n\t{\n\t\tif( info_handle_signal_abort(\n\t\t evtxinfo_info_handle,\n\t\t &error ) != 1 )\n\t\t{\n\t\t\tlibcnotify_printf(\n\t\t\t \"%s: unable to signal info handle to abort.\\n\",\n\t\t\t function );\n\n\t\t\tlibcnotify_print_error_backtrace(\n\t\t\t error );\n\t\t\tlibcerror_error_free(\n\t\t\t &error );\n\t\t}\n\t}\n\t/* Force stdin to close otherwise any function reading it will remain blocked\n\t */\n#if defined( WINAPI ) && !defined( __CYGWIN__ )\n\tif( _close(\n\t 0 ) != 0 )\n#else\n\tif( close(\n\t 0 ) != 0 )\n#endif\n\t{\n\t\tlibcnotify_printf(\n\t\t \"%s: unable to close stdin.\\n\",\n\t\t function );\n\t}\n}\n\n/* The main program\n */\n#if defined( HAVE_WIDE_SYSTEM_CHARACTER )\nint wmain( int argc, wchar_t * const argv[] )\n#else\nint main( int argc, char * const argv[] )\n#endif\n{\n\tlibevtx_error_t *error = NULL;\n\tsystem_character_t *option_ascii_codepage = NULL;\n\tsystem_character_t *source = NULL;\n\tchar *program = \"evtxinfo\";\n\tsystem_integer_t option = 0;\n\tint result = 0;\n\tint verbose = 0;\n\n\tlibcnotify_stream_set(\n\t stderr,\n\t NULL );\n\tlibcnotify_verbose_set(\n\t 1 );\n\n\tif( libclocale_initialize(\n\t \"evtxtools\",\n\t &error ) != 1 )\n\t{\n\t\tfprintf(\n\t\t stderr,\n\t\t \"Unable to initialize locale values.\\n\" );\n\n\t\tgoto on_error;\n\t}\n if( evtxtools_output_initialize(\n _IONBF,\n &error ) != 1 )\n\t{\n\t\tfprintf(\n\t\t stderr,\n\t\t \"Unable to initialize output settings.\\n\" );\n\n\t\tgoto on_error;\n\t}\n\tevtxoutput_version_fprint(\n\t stdout,\n\t program );\n\n\twhile( ( option = evtxtools_getopt(\n\t argc,\n\t argv,\n\t _SYSTEM_STRING( \"c:hvV\" ) ) ) != (system_integer_t) -1 )\n\t{\n\t\tswitch( option )\n\t\t{\n\t\t\tcase (system_integer_t) '?':\n\t\t\tdefault:\n\t\t\t\tfprintf(\n\t\t\t\t stderr,\n\t\t\t\t \"Invalid argument: %\" PRIs_SYSTEM \"\\n\",\n\t\t\t\t argv[ optind - 1 ] );\n\n\t\t\t\tusage_fprint(\n\t\t\t\t stdout );\n\n\t\t\t\treturn( EXIT_FAILURE );\n\n\t\t\tcase (system_integer_t) 'c':\n\t\t\t\toption_ascii_codepage = optarg;\n\n\t\t\t\tbreak;\n\n\t\t\tcase (system_integer_t) 'h':\n\t\t\t\tusage_fprint(\n\t\t\t\t stdout );\n\n\t\t\t\treturn( EXIT_SUCCESS );\n\n\t\t\tcase (system_integer_t) 'v':\n\t\t\t\tverbose = 1;\n\n\t\t\t\tbreak;\n\n\t\t\tcase (system_integer_t) 'V':\n\t\t\t\tevtxoutput_copyright_fprint(\n\t\t\t\t stdout );\n\n\t\t\t\treturn( EXIT_SUCCESS );\n\t\t}\n\t}\n\tif( optind == argc )\n\t{\n\t\tfprintf(\n\t\t stderr,\n\t\t \"Missing source file.\\n\" );\n\n\t\tusage_fprint(\n\t\t stdout );\n\n\t\treturn( EXIT_FAILURE );\n\t}\n\tsource = argv[ optind ];\n\n\tlibcnotify_verbose_set(\n\t verbose );\n\tlibevtx_notify_set_stream(\n\t stderr,\n\t NULL );\n\tlibevtx_notify_set_verbose(\n\t verbose );\n\n\tif( info_handle_initialize(\n\t &evtxinfo_info_handle,\n\t &error ) != 1 )\n\t{\n\t\tfprintf(\n\t\t stderr,\n\t\t \"Unable to initialize info handle.\\n\" );\n\n\t\tgoto on_error;\n\t}\n\tif( option_ascii_codepage != NULL )\n\t{\n\t\tresult = info_handle_set_ascii_codepage(\n\t\t evtxinfo_info_handle,\n\t\t option_ascii_codepage,\n\t\t &error );\n\n\t\tif( result == -1 )\n\t\t{\n\t\t\tfprintf(\n\t\t\t stderr,\n\t\t\t \"Unable to set ASCII codepage in info handle.\\n\" );\n\n\t\t\tgoto on_error;\n\t\t}\n\t\telse if( result == 0 )\n\t\t{\n\t\t\tfprintf(\n\t\t\t stderr,\n\t\t\t \"Unsupported ASCII codepage defaulting to: windows-1252.\\n\" );\n\t\t}\n\t}\n\tresult = info_handle_set_event_log_type_from_filename(\n\t evtxinfo_info_handle,\n\t source,\n\t &error );\n\n\tif( result == -1 )\n\t{\n\t\tfprintf(\n\t\t stderr,\n\t\t \"Unable to set event log type from filename in info handle.\\n\" );\n\n\t\tgoto on_error;\n\t}\n\tif( info_handle_open(\n\t evtxinfo_info_handle,\n\t source,\n\t &error ) != 1 )\n\t{\n\t\tfprintf(\n\t\t stderr,\n\t\t \"Unable to open: %\" PRIs_SYSTEM \".\\n\",\n\t\t source );\n\n\t\tgoto on_error;\n\t}\n\tif( info_handle_file_fprint(\n\t evtxinfo_info_handle,\n\t &error ) != 1 )\n\t{\n\t\tfprintf(\n\t\t stderr,\n\t\t \"Unable to print file information.\\n\" );\n\n\t\tgoto on_error;\n\t}\n\tif( info_handle_close(\n\t evtxinfo_info_handle,\n\t &error ) != 0 )\n\t{\n\t\tfprintf(\n\t\t stderr,\n\t\t \"Unable to close info handle.\\n\" );\n\n\t\tgoto on_error;\n\t}\n\tif( info_handle_free(\n\t &evtxinfo_info_handle,\n\t &error ) != 1 )\n\t{\n\t\tfprintf(\n\t\t stderr,\n\t\t \"Unable to free info handle.\\n\" );\n\n\t\tgoto on_error;\n\t}\n\treturn( EXIT_SUCCESS );\n\non_error:\n\tif( error != NULL )\n\t{\n\t\tlibcnotify_print_error_backtrace(\n\t\t error );\n\t\tlibcerror_error_free(\n\t\t &error );\n\t}\n\tif( evtxinfo_info_handle != NULL )\n\t{\n\t\tinfo_handle_free(\n\t\t &evtxinfo_info_handle,\n\t\t NULL );\n\t}\n\treturn( EXIT_FAILURE );\n}\n\n" }, { "path": "evtxtools/evtxinput.c", "content": "/*\n * Common input functions for the evtxtools\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#include \n#include \n#include \n#include \n#include \n\n#include \"evtxinput.h\"\n#include \"evtxtools_libcerror.h\"\n#include \"evtxtools_libcpath.h\"\n#include \"evtxtools_libevtx.h\"\n#include \"evtxtools_wide_string.h\"\n\n/* Determines the event log type from a string\n * Returns 1 if successful, 0 if unsupported value or -1 on error\n */\nint evtxinput_determine_event_log_type(\n const system_character_t *string,\n int *event_log_type,\n libcerror_error_t **error )\n{\n\tstatic char *function = \"evtxinput_determine_event_log_type\";\n\tsize_t string_length = 0;\n\tint result = 0;\n\n\tif( string == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid string.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( event_log_type == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid event log type.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tstring_length = system_string_length(\n\t string );\n\n\tif( string_length == 6 )\n\t{\n\t\tif( system_string_compare_no_case(\n\t\t string,\n\t\t _SYSTEM_STRING( \"system\" ),\n\t\t 6 ) == 0 )\n\t\t{\n\t\t\t*event_log_type = EVTXTOOLS_EVENT_LOG_TYPE_SYSTEM;\n\t\t\tresult = 1;\n\t\t}\n\t}\n\telse if( string_length == 8 )\n\t{\n\t\tif( system_string_compare_no_case(\n\t\t string,\n\t\t _SYSTEM_STRING( \"security\" ),\n\t\t 8 ) == 0 )\n\t\t{\n\t\t\t*event_log_type = EVTXTOOLS_EVENT_LOG_TYPE_SECURITY;\n\t\t\tresult = 1;\n\t\t}\n\t}\n\telse if( string_length == 11 )\n\t{\n\t\tif( system_string_compare_no_case(\n\t\t string,\n\t\t _SYSTEM_STRING( \"application\" ),\n\t\t 11 ) == 0 )\n\t\t{\n\t\t\t*event_log_type = EVTXTOOLS_EVENT_LOG_TYPE_APPLICATION;\n\t\t\tresult = 1;\n\t\t}\n\t}\n\treturn( result );\n}\n\n/* Determines the event log type from the filename\n * Returns 1 if successful, 0 if unsupported value or -1 on error\n */\nint evtxinput_determine_event_log_type_from_filename(\n const system_character_t *filename,\n int *event_log_type,\n libcerror_error_t **error )\n{\n\tconst system_character_t *path_separator = NULL;\n\tstatic char *function = \"evtxinput_determine_event_log_type_from_filename\";\n\tsize_t filename_length = 0;\n\tint result = 0;\n\n\tif( filename == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid filename.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( event_log_type == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid event log type.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tfilename_length = system_string_length(\n\t filename );\n\n\tpath_separator = system_string_search_character_reverse(\n\t\t\t filename,\n\t\t\t (system_character_t) LIBCPATH_SEPARATOR,\n\t\t\t filename_length );\n\n\tif( path_separator == NULL )\n\t{\n\t\tpath_separator = filename;\n\t}\n\telse\n\t{\n\t\tpath_separator++;\n\n\t\tfilename_length = system_string_length(\n\t\t path_separator );\n\t}\n\tif( filename_length == 11 )\n\t{\n\t\tif( system_string_compare_no_case(\n\t\t path_separator,\n\t\t _SYSTEM_STRING( \"System.evtx\" ),\n\t\t 11 ) == 0 )\n\t\t{\n\t\t\t*event_log_type = EVTXTOOLS_EVENT_LOG_TYPE_SYSTEM;\n\t\t\tresult = 1;\n\t\t}\n\t}\n\telse if( filename_length == 13 )\n\t{\n\t\tif( system_string_compare_no_case(\n\t\t path_separator,\n\t\t _SYSTEM_STRING( \"Security.evtx\" ),\n\t\t 13 ) == 0 )\n\t\t{\n\t\t\t*event_log_type = EVTXTOOLS_EVENT_LOG_TYPE_SECURITY;\n\t\t\tresult = 1;\n\t\t}\n\t}\n\telse if( filename_length == 16 )\n\t{\n\t\tif( system_string_compare_no_case(\n\t\t path_separator,\n\t\t _SYSTEM_STRING( \"Application.evtx\" ),\n\t\t 16 ) == 0 )\n\t\t{\n\t\t\t*event_log_type = EVTXTOOLS_EVENT_LOG_TYPE_APPLICATION;\n\t\t\tresult = 1;\n\t\t}\n\t}\n\telse if( filename_length == 17 )\n\t{\n\t\tif( system_string_compare_no_case(\n\t\t path_separator,\n\t\t _SYSTEM_STRING( \"Media Center.evtx\" ),\n\t\t 17 ) == 0 )\n\t\t{\n\t\t\t*event_log_type = EVTXTOOLS_EVENT_LOG_TYPE_MEDIA_CENTER;\n\t\t\tresult = 1;\n\t\t}\n\t}\n\telse if( filename_length == 19 )\n\t{\n\t\tif( system_string_compare_no_case(\n\t\t path_separator,\n\t\t _SYSTEM_STRING( \"HardwareEvents.evtx\" ),\n\t\t 19 ) == 0 )\n\t\t{\n\t\t\t*event_log_type = EVTXTOOLS_EVENT_LOG_TYPE_HARDWARE_EVENTS;\n\t\t\tresult = 1;\n\t\t}\n\t}\n\telse if( filename_length == 20 )\n\t{\n\t\tif( system_string_compare_no_case(\n\t\t path_separator,\n\t\t _SYSTEM_STRING( \"DFS Replication.evtx\" ),\n\t\t 20 ) == 0 )\n\t\t{\n\t\t\t*event_log_type = EVTXTOOLS_EVENT_LOG_TYPE_DFS_REPLICATION;\n\t\t\tresult = 1;\n\t\t}\n\t}\n\telse if( filename_length == 22 )\n\t{\n\t\tif( system_string_compare_no_case(\n\t\t path_separator,\n\t\t _SYSTEM_STRING( \"Internet Explorer.evtx\" ),\n\t\t 22 ) == 0 )\n\t\t{\n\t\t\t*event_log_type = EVTXTOOLS_EVENT_LOG_TYPE_INTERNET_EXPLORER;\n\t\t\tresult = 1;\n\t\t}\n\t}\n\telse if( filename_length == 27 )\n\t{\n\t\tif( system_string_compare_no_case(\n\t\t path_separator,\n\t\t _SYSTEM_STRING( \"Key Management Service.evtx\" ),\n\t\t 27 ) == 0 )\n\t\t{\n\t\t\t*event_log_type = EVTXTOOLS_EVENT_LOG_TYPE_KEY_MANAGEMENT_SERVICE;\n\t\t\tresult = 1;\n\t\t}\n\t}\n\treturn( result );\n}\n\n" }, { "path": "evtxtools/evtxinput.h", "content": "/*\n * Common input functions for the evtxtools\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#if !defined( _EVTXINPUT_H )\n#define _EVTXINPUT_H\n\n#include \n#include \n\n#include \"evtxtools_libcerror.h\"\n\n#if defined( __cplusplus )\nextern \"C\" {\n#endif\n\nenum EVTXTOOLS_EVENT_LOG_TYPES\n{\n\tEVTXTOOLS_EVENT_LOG_TYPE_UNKNOWN,\n\tEVTXTOOLS_EVENT_LOG_TYPE_APPLICATION,\n\tEVTXTOOLS_EVENT_LOG_TYPE_DFS_REPLICATION,\n\tEVTXTOOLS_EVENT_LOG_TYPE_HARDWARE_EVENTS,\n\tEVTXTOOLS_EVENT_LOG_TYPE_INTERNET_EXPLORER,\n\tEVTXTOOLS_EVENT_LOG_TYPE_KEY_MANAGEMENT_SERVICE,\n\tEVTXTOOLS_EVENT_LOG_TYPE_MEDIA_CENTER,\n\tEVTXTOOLS_EVENT_LOG_TYPE_SECURITY,\n\tEVTXTOOLS_EVENT_LOG_TYPE_SYSTEM\n};\n\nint evtxinput_determine_event_log_type(\n const system_character_t *string,\n int *event_log_type,\n libcerror_error_t **error );\n\nint evtxinput_determine_event_log_type_from_filename(\n const system_character_t *filename,\n int *event_log_type,\n libcerror_error_t **error );\n\n#if defined( __cplusplus )\n}\n#endif\n\n#endif /* !defined( _EVTXINPUT_H ) */\n\n" }, { "path": "evtxtools/evtxtools_getopt.c", "content": "/*\n * GetOpt functions\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#include \n#include \n#include \n#include \n#include \n\n#if defined( HAVE_STDLIB_H ) || defined( WINAPI )\n#include \n#endif\n\n#include \"evtxtools_getopt.h\"\n#include \"evtxtools_libcnotify.h\"\n\n#if !defined( HAVE_GETOPT )\n\n/* The option index\n * Start with argument 1 (argument 0 is the program name)\n */\nint optind = 1;\n\n/* The current option argument\n */\nsystem_character_t *optarg = NULL;\n\n/* Value to indicate the current option\n */\nsystem_integer_t optopt = 0;\n\n/* The next option in a group\n */\nsystem_character_t *next_option = NULL;\n\n/* Get the program options\n * Function for platforms that do not have the getopt function\n * Returns the option character processed, or -1 on error,\n * ? if the option was not in the options string, : if the option argument was missing\n */\nsystem_integer_t evtxtools_getopt(\n int argument_count,\n system_character_t * const argument_values[],\n const system_character_t *options_string )\n{\n\tsystem_character_t *argument_value = NULL;\n\tsystem_character_t *option_value = NULL;\n\tstatic char *function = \"evtxtools_getopt\";\n\tsize_t options_string_length = 0;\n\n\tif( next_option != NULL )\n\t{\n\t\targument_value = next_option;\n\t\tnext_option = NULL;\n\t}\n\telse if( optind >= argument_count )\n\t{\n\t\treturn( (system_integer_t) -1 );\n\t}\n\telse\n\t{\n\t\targument_value = argument_values[ optind ];\n\n\t\t/* Check if the argument value is not an empty string\n\t\t */\n\t\tif( *argument_value == (system_character_t) '\\0' )\n\t\t{\n\t\t\treturn( (system_integer_t) -1 );\n\t\t}\n\t\t/* Check if the first character is a option marker '-'\n\t\t */\n\t\tif( *argument_value != (system_character_t) '-' )\n\t\t{\n\t\t\treturn( (system_integer_t) -1 );\n\t\t}\n\t\targument_value++;\n\n\t\t/* Check if long options are provided '--'\n\t\t */\n\t\tif( *argument_value == (system_character_t) '-' )\n\t\t{\n\t\t\toptind++;\n\n\t\t\treturn( (system_integer_t) -1 );\n\t\t}\n\t}\n\toptions_string_length = system_string_length(\n\t options_string );\n\n\toptopt = *argument_value;\n\toption_value = system_string_search_character(\n\t options_string,\n\t optopt,\n\t options_string_length );\n\n\targument_value++;\n\n\t/* Check if an argument was specified or that the option was not found\n\t * in the option string\n\t */\n\tif( ( optopt == (system_integer_t) ':' )\n\t || ( option_value == NULL ) )\n\t{\n\t\tif( *argument_value == (system_character_t) '\\0' )\n\t\t{\n\t\t\toptind++;\n\t\t}\n\t\tif( ( *options_string != (system_character_t) ':' )\n\t\t && ( optopt != (system_integer_t) '?' ) )\n\t\t{\n\t\t\tlibcnotify_printf(\n\t\t\t \"%s: no such option: %\" PRIc_SYSTEM \".\\n\",\n\t\t\t function,\n\t\t\t optopt );\n\t\t}\n\t\treturn( (system_integer_t) '?' );\n\t}\n\toption_value++;\n\n\t/* Check if no option argument is required\n\t */\n\tif( *option_value != (system_character_t) ':' )\n\t{\n\t\toptarg = NULL;\n\n\t\tif( *argument_value == (system_character_t) '\\0' )\n\t\t{\n\t\t\toptind++;\n\t\t}\n\t\telse\n\t\t{\n\t\t\t/* Multiple options are grouped\n\t\t\t */\n\t\t\tnext_option = argument_value;\n\t\t}\n\t}\n\t/* Check if the argument is right after the option flag with no space in between\n\t */\n\telse if( *argument_value != (system_character_t) '\\0' )\n\t{\n\t\toptarg = argument_value;\n\n\t\toptind++;\n\t}\n\telse\n\t{\n\t\toptind++;\n\n\t\t/* Check if the argument was provided as the next argument value\n\t\t */\n\t\tif( argument_count <= optind )\n\t\t{\n\t\t\tif( *option_value == ':' )\n\t\t\t{\n\t\t\t\treturn( (system_integer_t) ':' );\n\t\t\t}\n\t\t\tlibcnotify_printf(\n\t\t\t \"%s: option: %\" PRIc_SYSTEM \" requires an argument.\\n\",\n\t\t\t function,\n\t\t\t optopt );\n\n\t\t\treturn( (system_integer_t) '?' );\n\t\t}\n\t\toptarg = argument_values[ optind ];\n\n\t\toptind++;\n\t}\n\treturn( optopt );\n}\n\n#endif /* !defined( HAVE_GETOPT ) */\n\n" }, { "path": "evtxtools/evtxtools_getopt.h", "content": "/*\n * GetOpt functions\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#if !defined( _EVTXTOOLS_GETOPT_H )\n#define _EVTXTOOLS_GETOPT_H\n\n#include \n#include \n\n/* unistd.h is included here to export getopt, optarg, optind and optopt\n */\n#if defined( HAVE_UNISTD_H )\n#include \n#endif\n\n#if defined( __cplusplus )\nextern \"C\" {\n#endif\n\n#if defined( HAVE_GETOPT )\n#define evtxtools_getopt( argument_count, argument_values, options_string ) \\\n\tgetopt( argument_count, argument_values, options_string )\n\n#else\n\n#if !defined( __CYGWIN__ )\nextern int optind;\nextern system_character_t *optarg;\nextern system_integer_t optopt;\n\n#else\nint optind;\nsystem_character_t *optarg;\nsystem_integer_t optopt;\n\n#endif /* !defined( __CYGWIN__ ) */\n\nsystem_integer_t evtxtools_getopt(\n int argument_count,\n system_character_t * const argument_values[],\n const system_character_t *options_string );\n\n#endif /* defined( HAVE_GETOPT ) */\n\n#if defined( __cplusplus )\n}\n#endif\n\n#endif /* !defined( _EVTXTOOLS_GETOPT_H ) */\n\n" }, { "path": "evtxtools/evtxtools_i18n.h", "content": "/*\n * Internationalization (i18n) functions\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#if !defined( _EVTXTOOLS_I18N_H )\n#define _EVTXTOOLS_I18N_H\n\n#include \n\n#if defined( HAVE_LIBINTL_H )\n#include \n#endif\n\n#if defined( __cplusplus )\nextern \"C\" {\n#endif\n\n/* TODO for now do nothing i18n-like\n#define\t_( string ) \\\n\tgettext( string )\n*/\n\n#define\t_( string ) \\\n\tstring\n\n#if defined( __cplusplus )\n}\n#endif\n\n#endif /* !defined( _EVTXTOOLS_I18N_H ) */\n\n" }, { "path": "evtxtools/evtxtools_libbfio.h", "content": "/*\n * The libbfio header wrapper\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#if !defined( _EVTXTOOLS_LIBBFIO_H )\n#define _EVTXTOOLS_LIBBFIO_H\n\n#include \n\n/* Define HAVE_LOCAL_LIBBFIO for local use of libbfio\n */\n#if defined( HAVE_LOCAL_LIBBFIO )\n\n#include \n#include \n#include \n#include \n#include \n#include \n#include \n#include \n\n#else\n\n/* If libtool DLL support is enabled set LIBBFIO_DLL_IMPORT\n * before including libbfio.h\n */\n#if defined( _WIN32 ) && defined( DLL_IMPORT ) && !defined( HAVE_STATIC_EXECUTABLES )\n#define LIBBFIO_DLL_IMPORT\n#endif\n\n#include \n\n#if defined( HAVE_MULTI_THREAD_SUPPORT ) && !defined( LIBBFIO_HAVE_MULTI_THREAD_SUPPORT )\n#error Multi-threading support requires libbfio with multi-threading support\n#endif\n\n#endif /* defined( HAVE_LOCAL_LIBBFIO ) */\n\n#endif /* !defined( _EVTXTOOLS_LIBBFIO_H ) */\n\n" }, { "path": "evtxtools/evtxtools_libcdirectory.h", "content": "/*\n * The internal libcdirectory header\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#if !defined( _EVTXTOOLS_LIBCDIRECTORY_H )\n#define _EVTXTOOLS_LIBCDIRECTORY_H\n\n#include \n\n/* Define HAVE_LOCAL_LIBCDIRECTORY for local use of libcdirectory\n */\n#if defined( HAVE_LOCAL_LIBCDIRECTORY )\n\n#include \n#include \n#include \n#include \n\n#else\n\n/* If libtool DLL support is enabled set LIBCDIRECTORY_DLL_IMPORT\n * before including libcdirectory.h\n */\n#if defined( _WIN32 ) && defined( DLL_IMPORT )\n#define LIBCDIRECTORY_DLL_IMPORT\n#endif\n\n#include \n\n#endif\n\n#endif\n\n" }, { "path": "evtxtools/evtxtools_libcerror.h", "content": "/*\n * The libcerror header wrapper\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#if !defined( _EVTXTOOLS_LIBCERROR_H )\n#define _EVTXTOOLS_LIBCERROR_H\n\n#include \n\n/* Define HAVE_LOCAL_LIBCERROR for local use of libcerror\n */\n#if defined( HAVE_LOCAL_LIBCERROR )\n\n#include \n#include \n#include \n#include \n\n#else\n\n/* If libtool DLL support is enabled set LIBCERROR_DLL_IMPORT\n * before including libcerror.h\n */\n#if defined( _WIN32 ) && defined( DLL_IMPORT ) && !defined( HAVE_STATIC_EXECUTABLES )\n#define LIBCERROR_DLL_IMPORT\n#endif\n\n#include \n\n#endif /* defined( HAVE_LOCAL_LIBCERROR ) */\n\n#endif /* !defined( _EVTXTOOLS_LIBCERROR_H ) */\n\n" }, { "path": "evtxtools/evtxtools_libclocale.h", "content": "/*\n * The libclocale header wrapper\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#if !defined( _EVTXTOOLS_LIBCLOCALE_H )\n#define _EVTXTOOLS_LIBCLOCALE_H\n\n#include \n\n/* Define HAVE_LOCAL_LIBCLOCALE for local use of libclocale\n */\n#if defined( HAVE_LOCAL_LIBCLOCALE )\n\n#include \n#include \n#include \n#include \n\n#else\n\n/* If libtool DLL support is enabled set LIBCLOCALE_DLL_IMPORT\n * before including libclocale.h\n */\n#if defined( _WIN32 ) && defined( DLL_IMPORT ) && !defined( HAVE_STATIC_EXECUTABLES )\n#define LIBCLOCALE_DLL_IMPORT\n#endif\n\n#include \n\n#endif /* defined( HAVE_LOCAL_LIBCLOCALE ) */\n\n#endif /* !defined( _EVTXTOOLS_LIBCLOCALE_H ) */\n\n" }, { "path": "evtxtools/evtxtools_libcnotify.h", "content": "/*\n * The libcnotify header wrapper\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#if !defined( _EVTXTOOLS_LIBCNOTIFY_H )\n#define _EVTXTOOLS_LIBCNOTIFY_H\n\n#include \n\n/* Define HAVE_LOCAL_LIBCNOTIFY for local use of libcnotify\n */\n#if defined( HAVE_LOCAL_LIBCNOTIFY )\n\n#include \n#include \n#include \n#include \n\n#else\n\n/* If libtool DLL support is enabled set LIBCNOTIFY_DLL_IMPORT\n * before including libcnotify.h\n */\n#if defined( _WIN32 ) && defined( DLL_IMPORT ) && !defined( HAVE_STATIC_EXECUTABLES )\n#define LIBCNOTIFY_DLL_IMPORT\n#endif\n\n#include \n\n#endif /* defined( HAVE_LOCAL_LIBCNOTIFY ) */\n\n#endif /* !defined( _EVTXTOOLS_LIBCNOTIFY_H ) */\n\n" }, { "path": "evtxtools/evtxtools_libcpath.h", "content": "/*\n * The libcpath header wrapper\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#if !defined( _EVTXTOOLS_LIBCPATH_H )\n#define _EVTXTOOLS_LIBCPATH_H\n\n#include \n\n/* Define HAVE_LOCAL_LIBCPATH for local use of libcpath\n */\n#if defined( HAVE_LOCAL_LIBCPATH )\n\n#include \n#include \n\n#else\n\n/* If libtool DLL support is enabled set LIBCPATH_DLL_IMPORT\n * before including libcpath.h\n */\n#if defined( _WIN32 ) && defined( DLL_IMPORT ) && !defined( HAVE_STATIC_EXECUTABLES )\n#define LIBCPATH_DLL_IMPORT\n#endif\n\n#include \n\n#endif /* defined( HAVE_LOCAL_LIBCPATH ) */\n\n#endif /* !defined( _EVTXTOOLS_LIBCPATH_H ) */\n\n" }, { "path": "evtxtools/evtxtools_libcsplit.h", "content": "/*\n * The internal libcsplit header\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#if !defined( _EVTXTOOLS_LIBCSPLIT_H )\n#define _EVTXTOOLS_LIBCSPLIT_H\n\n#include \n\n/* Define HAVE_LOCAL_LIBCSPLIT for local use of libcsplit\n */\n#if defined( HAVE_LOCAL_LIBCSPLIT )\n\n#include \n#include \n#include \n#include \n#include \n#include \n\n#else\n\n/* If libtool DLL support is enabled set LIBCSPLIT_DLL_IMPORT\n * before including libcsplit.h\n */\n#if defined( _WIN32 ) && defined( DLL_IMPORT )\n#define LIBCSPLIT_DLL_IMPORT\n#endif\n\n#include \n\n#endif\n\n#endif\n\n" }, { "path": "evtxtools/evtxtools_libevtx.h", "content": "/*\n * The libevtx header wrapper\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#if !defined( _EVTXTOOLS_LIBEVTX_H )\n#define _EVTXTOOLS_LIBEVTX_H\n\n#include \n\n#include \n\n#endif /* !defined( _EVTXTOOLS_LIBEVTX_H ) */\n\n" }, { "path": "evtxtools/evtxtools_libexe.h", "content": "/*\n * The libexe header wrapper\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#if !defined( _EVTXTOOLS_LIBEXE_H )\n#define _EVTXTOOLS_LIBEXE_H\n\n#include \n\n/* Define HAVE_LOCAL_LIBEXE for local use of libexe\n */\n#if defined( HAVE_LOCAL_LIBEXE )\n\n#include \n#include \n#include \n#include \n\n#else\n\n/* If libtool DLL support is enabled set LIBEXE_DLL_IMPORT\n * before including libexe.h\n */\n#if defined( _WIN32 ) && defined( DLL_IMPORT )\n#define LIBEXE_DLL_IMPORT\n#endif\n\n#include \n\n#endif\n\n#endif\n\n" }, { "path": "evtxtools/evtxtools_libfcache.h", "content": "/*\n * The libfcache header wrapper\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#if !defined( _EVTXTOOLS_LIBFCACHE_H )\n#define _EVTXTOOLS_LIBFCACHE_H\n\n#include \n\n/* Define HAVE_LOCAL_LIBFCACHE for local use of libfcache\n */\n#if defined( HAVE_LOCAL_LIBFCACHE )\n\n#include \n#include \n#include \n#include \n\n#else\n\n/* If libtool DLL support is enabled set LIBFCACHE_DLL_IMPORT\n * before including libfcache.h\n */\n#if defined( _WIN32 ) && defined( DLL_IMPORT ) && !defined( HAVE_STATIC_EXECUTABLES )\n#define LIBFCACHE_DLL_IMPORT\n#endif\n\n#include \n\n#endif /* defined( HAVE_LOCAL_LIBFCACHE ) */\n\n#endif /* !defined( _EVTXTOOLS_LIBFCACHE_H ) */\n\n" }, { "path": "evtxtools/evtxtools_libfdatetime.h", "content": "/*\n * The libfdatetime header wrapper\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#if !defined( _EVTXTOOLS_LIBFDATETIME_H )\n#define _EVTXTOOLS_LIBFDATETIME_H\n\n#include \n\n/* Define HAVE_LOCAL_LIBFDATETIME for local use of libfdatetime\n */\n#if defined( HAVE_LOCAL_LIBFDATETIME )\n\n#include \n#include \n#include \n#include \n#include \n#include \n#include \n#include \n#include \n#include \n\n#else\n\n/* If libtool DLL support is enabled set LIBFDATETIME_DLL_IMPORT\n * before including libfdatetime.h\n */\n#if defined( _WIN32 ) && defined( DLL_IMPORT ) && !defined( HAVE_STATIC_EXECUTABLES )\n#define LIBFDATETIME_DLL_IMPORT\n#endif\n\n#include \n\n#endif /* defined( HAVE_LOCAL_LIBFDATETIME ) */\n\n#endif /* !defined( _EVTXTOOLS_LIBFDATETIME_H ) */\n\n" }, { "path": "evtxtools/evtxtools_libfguid.h", "content": "/*\n * The libfguid header wrapper\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#if !defined( _EVTXTOOLS_LIBFGUID_H )\n#define _EVTXTOOLS_LIBFGUID_H\n\n#include \n\n/* Define HAVE_LOCAL_LIBFGUID for local use of libfguid\n */\n#if defined( HAVE_LOCAL_LIBFGUID )\n\n#include \n#include \n#include \n\n#else\n\n/* If libtool DLL support is enabled set LIBFGUID_DLL_IMPORT\n * before including libfguid.h\n */\n#if defined( _WIN32 ) && defined( DLL_IMPORT ) && !defined( HAVE_STATIC_EXECUTABLES )\n#define LIBFGUID_DLL_IMPORT\n#endif\n\n#include \n\n#endif /* defined( HAVE_LOCAL_LIBFGUID ) */\n\n#endif /* !defined( _EVTXTOOLS_LIBFGUID_H ) */\n\n" }, { "path": "evtxtools/evtxtools_libfvalue.h", "content": "/*\n * The libfvalue header wrapper\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#if !defined( _EVTXTOOLS_LIBFVALUE_H )\n#define _EVTXTOOLS_LIBFVALUE_H\n\n#include \n\n/* Define HAVE_LOCAL_LIBFVALUE for local use of libfvalue\n */\n#if defined( HAVE_LOCAL_LIBFVALUE )\n\n#include \n#include \n#include \n#include \n#include \n#include \n#include \n#include \n#include \n#include \n#include \n#include \n#include \n\n#else\n\n/* If libtool DLL support is enabled set LIBFVALUE_DLL_IMPORT\n * before including libfvalue.h\n */\n#if defined( _WIN32 ) && defined( DLL_IMPORT )\n#define LIBFVALUE_DLL_IMPORT\n#endif\n\n#include \n\n#endif /* defined( HAVE_LOCAL_LIBFVALUE ) */\n\n#endif /* !defined( _EVTXTOOLS_LIBFVALUE_H ) */\n\n" }, { "path": "evtxtools/evtxtools_libfwevt.h", "content": "/*\n * The libfwevt header wrapper\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#if !defined( _EVTXTOOLS_LIBFWEVT_H )\n#define _EVTXTOOLS_LIBFWEVT_H\n\n#include \n\n/* Define HAVE_LOCAL_LIBFWEVT for local use of libfwevt\n */\n#if defined( HAVE_LOCAL_LIBFWEVT )\n\n#include \n#include \n#include \n#include \n#include \n#include \n#include \n#include \n#include \n#include \n#include \n#include \n#include \n#include \n#include \n#include \n\n#else\n\n/* If libtool DLL support is enabled set LIBFWEVT_DLL_IMPORT\n * before including libfwevt.h\n */\n#if defined( _WIN32 ) && defined( DLL_IMPORT )\n#define LIBFWEVT_DLL_IMPORT\n#endif\n\n#include \n\n#endif /* defined( HAVE_LOCAL_LIBFWEVT ) */\n\n#endif /* !defined( _EVTXTOOLS_LIBFWEVT_H ) */\n\n" }, { "path": "evtxtools/evtxtools_libfwnt.h", "content": "/*\n * The libfwnt header wrapper\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#if !defined( _EVTXTOOLS_LIBFWNT_H )\n#define _EVTXTOOLS_LIBFWNT_H\n\n#include \n\n/* Define HAVE_LOCAL_LIBFWNT for local use of libfwnt\n */\n#if defined( HAVE_LOCAL_LIBFWNT )\n\n#include \n#include \n#include \n#include \n#include \n#include \n#include \n#include \n#include \n#include \n#include \n#include \n\n#else\n\n/* If libtool DLL support is enabled set LIBFWNT_DLL_IMPORT\n * before including libfwnt.h\n */\n#if defined( _WIN32 ) && defined( DLL_IMPORT ) && !defined( HAVE_STATIC_EXECUTABLES )\n#define LIBFWNT_DLL_IMPORT\n#endif\n\n#include \n\n#endif /* defined( HAVE_LOCAL_LIBFWNT ) */\n\n#endif /* !defined( _EVTXTOOLS_LIBFWNT_H ) */\n\n" }, { "path": "evtxtools/evtxtools_libregf.h", "content": "/*\n * The libregf header wrapper\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#if !defined( _EVTXTOOLS_LIBREGF_H )\n#define _EVTXTOOLS_LIBREGF_H\n\n#include \n\n/* Define HAVE_LOCAL_LIBREGF for local use of libregf\n */\n#if defined( HAVE_LOCAL_LIBREGF )\n\n#include \n#include \n#include \n#include \n#include \n#include \n\n#else\n\n/* If libtool DLL support is enabled set LIBREGF_DLL_IMPORT\n * before including libregf.h\n */\n#if defined( _WIN32 ) && defined( DLL_IMPORT )\n#define LIBREGF_DLL_IMPORT\n#endif\n\n#include \n\n#endif\n\n#endif\n\n" }, { "path": "evtxtools/evtxtools_libuna.h", "content": "/*\n * The libuna header wrapper\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#if !defined( _EVTXTOOLS_LIBUNA_H )\n#define _EVTXTOOLS_LIBUNA_H\n\n#include \n\n/* Define HAVE_LOCAL_LIBUNA for local use of libuna\n */\n#if defined( HAVE_LOCAL_LIBUNA )\n\n#include \n#include \n#include \n#include \n#include \n#include \n#include \n#include \n#include \n#include \n#include \n#include \n#include \n#include \n\n#else\n\n/* If libtool DLL support is enabled set LIBUNA_DLL_IMPORT\n * before including libuna.h\n */\n#if defined( _WIN32 ) && defined( DLL_IMPORT ) && !defined( HAVE_STATIC_EXECUTABLES )\n#define LIBUNA_DLL_IMPORT\n#endif\n\n#include \n\n#endif /* defined( HAVE_LOCAL_LIBUNA ) */\n\n#endif /* !defined( _EVTXTOOLS_LIBUNA_H ) */\n\n" }, { "path": "evtxtools/evtxtools_libwrc.h", "content": "/*\n * The libwrc header wrapper\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#if !defined( _EVTXTOOLS_LIBWRC_H )\n#define _EVTXTOOLS_LIBWRC_H\n\n#include \n\n/* Define HAVE_LOCAL_LIBWRC for local use of libwrc\n */\n#if defined( HAVE_LOCAL_LIBWRC )\n\n#include \n#include \n#include \n#include \n#include \n#include \n#include \n#include \n#include \n#include \n\n#else\n\n/* If libtool DLL support is enabled set LIBWRC_DLL_IMPORT\n * before including libwrc.h\n */\n#if defined( _WIN32 ) && defined( DLL_IMPORT )\n#define LIBWRC_DLL_IMPORT\n#endif\n\n#include \n\n#endif /* defined( HAVE_LOCAL_LIBWRC ) */\n\n#endif /* !defined( _EVTXTOOLS_LIBWRC_H ) */\n\n" }, { "path": "evtxtools/evtxtools_output.c", "content": "/*\n * Common output functions for the evtxtools\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#include \n#include \n#include \n#include \n\n#include \"evtxtools_i18n.h\"\n#include \"evtxtools_libbfio.h\"\n#include \"evtxtools_libcerror.h\"\n#include \"evtxtools_libclocale.h\"\n#include \"evtxtools_libevtx.h\"\n#include \"evtxtools_libfdatetime.h\"\n#include \"evtxtools_libfvalue.h\"\n#include \"evtxtools_libfwnt.h\"\n#include \"evtxtools_libfguid.h\"\n#include \"evtxtools_libuna.h\"\n#include \"evtxtools_output.h\"\n\n/* Initializes output settings\n * Returns 1 if successful or -1 on error\n */\nint evtxtools_output_initialize(\n int stdio_mode,\n libcerror_error_t **error )\n{\n\tstatic char *function = \"evtxtools_output_initialize\";\n\n\tif( ( stdio_mode != _IOFBF )\n\t && ( stdio_mode != _IOLBF )\n\t && ( stdio_mode != _IONBF ) )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_UNSUPPORTED_VALUE,\n\t\t \"%s: unsupported standard IO mode.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n#if !defined( __BORLANDC__ )\n\tif( setvbuf(\n\t stdout,\n\t NULL,\n\t stdio_mode,\n\t 0 ) != 0 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_SET_FAILED,\n\t\t \"%s: unable to set IO mode of stdout.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( setvbuf(\n\t stderr,\n\t NULL,\n\t stdio_mode,\n\t 0 ) != 0 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_SET_FAILED,\n\t\t \"%s: unable to set IO mode of stderr.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n#endif /* !defined( __BORLANDC__ ) */\n\n\treturn( 1 );\n}\n\n/* Prints the copyright information\n */\nvoid evtxoutput_copyright_fprint(\n FILE *stream )\n{\n\tif( stream == NULL )\n\t{\n\t\treturn;\n\t}\n\t/* TRANSLATORS: This is a proper name.\n\t */\n\tfprintf(\n\t stream,\n\t _( \"Copyright (C) 2011-2025, %s.\\n\" ),\n\t _( \"Joachim Metz\" ) );\n\n\tfprintf(\n\t stream,\n\t _( \"This is free software; see the source for copying conditions. There is NO\\n\"\n\t \"warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.\\n\" ) );\n\n\t/* TRANSLATORS: The placeholder indicates the bug-reporting address\n\t * for this package. Please add _another line_ saying\n\t * \"Report translation bugs to <...>\\n\" with the address for translation\n\t * bugs (typically your translation team's web or email address).\n\t */\n\tfprintf(\n\t stream,\n\t _( \"Report bugs to <%s>.\\n\" ),\n\t PACKAGE_BUGREPORT );\n}\n\n/* Prints the (basic) version information\n */\nvoid evtxoutput_version_fprint(\n FILE *stream,\n const char *program )\n{\n\tif( stream == NULL )\n\t{\n\t\treturn;\n\t}\n\tif( program == NULL )\n\t{\n\t\treturn;\n\t}\n fprintf(\n\t stream,\n\t \"%s %s\\n\\n\",\n program,\n\t LIBEVTX_VERSION_STRING );\n}\n\n/* Prints the detailed version information\n */\nvoid evtxoutput_version_detailed_fprint(\n FILE *stream,\n const char *program )\n{\n\tif( stream == NULL )\n\t{\n\t\treturn;\n\t}\n\tif( program == NULL )\n\t{\n\t\treturn;\n\t}\n fprintf(\n\t stream,\n\t \"%s %s (libevtx %s\",\n program,\n\t LIBEVTX_VERSION_STRING,\n\t LIBEVTX_VERSION_STRING );\n\n\tfprintf(\n\t stream,\n\t \", libuna %s\",\n\t LIBUNA_VERSION_STRING );\n\n\tfprintf(\n\t stream,\n\t \", libbfio %s\",\n\t LIBBFIO_VERSION_STRING );\n\n/* TODO libfcache, libfdata */\n\n\tfprintf(\n\t stream,\n\t \", libfdatetime %s\",\n\t LIBFDATETIME_VERSION_STRING );\n\n\tfprintf(\n\t stream,\n\t \", libfguid %s\",\n\t LIBFGUID_VERSION_STRING );\n\n\tfprintf(\n\t stream,\n\t \", libfvalue %s\",\n\t LIBFVALUE_VERSION_STRING );\n\n\tfprintf(\n\t stream,\n\t \", libfwnt %s\",\n\t LIBFWNT_VERSION_STRING );\n\n fprintf(\n\t stream,\n\t \")\\n\\n\" );\n}\n\n" }, { "path": "evtxtools/evtxtools_output.h", "content": "/*\n * Common output functions for the evtxtools\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#if !defined( _EVTXTOOLS_OUTPUT_H )\n#define _EVTXTOOLS_OUTPUT_H\n\n#include \n#include \n#include \n\n#include \"evtxtools_libcerror.h\"\n\n#if defined( __cplusplus )\nextern \"C\" {\n#endif\n\nint evtxtools_output_initialize(\n int stdio_mode,\n libcerror_error_t **error );\n\nvoid evtxoutput_copyright_fprint(\n FILE *stream );\n\nvoid evtxoutput_version_fprint(\n FILE *stream,\n const char *program );\n\nvoid evtxoutput_version_detailed_fprint(\n FILE *stream,\n const char *program );\n\n#if defined( __cplusplus )\n}\n#endif\n\n#endif /* !defined( _EVTXTOOLS_OUTPUT_H ) */\n\n" }, { "path": "evtxtools/evtxtools_signal.c", "content": "/*\n * Signal handling functions\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#include \n#include \n\n#if defined( HAVE_SIGNAL_H )\n#include \n#endif\n\n#if defined( _MSC_VER )\n#include \n#endif\n\n#include \"evtxtools_libcerror.h\"\n#include \"evtxtools_signal.h\"\n\n#if defined( WINAPI )\n\nvoid (*evtxtools_signal_signal_handler)( evtxtools_signal_t ) = NULL;\n\n/* Signal handler for Ctrl+C or Ctrl+Break signals\n */\nBOOL WINAPI evtxtools_signal_handler(\n evtxtools_signal_t signal )\n{\n\tstatic char *function = \"evtxtools_signal_handler\";\n\n\tswitch( signal )\n\t{\n\t\t/* use Ctrl+C or Ctrl+Break to simulate SERVICE_CONTROL_STOP in debug mode\n\t\t */\n\t\tcase CTRL_BREAK_EVENT:\n\t\tcase CTRL_C_EVENT:\n\t\t\tif( evtxtools_signal_signal_handler != NULL )\n\t\t\t{\n\t\t\t\tevtxtools_signal_signal_handler(\n\t\t\t\t signal );\n\t\t\t}\n\t\t\treturn( TRUE );\n\n\t\tdefault:\n\t\t\tbreak;\n\t}\n\treturn( FALSE );\n}\n\n#if defined( _MSC_VER )\n\n/* Initialize memory usage and leakage debugging\n */\nvoid evtxtools_signal_initialize_memory_debug(\n void )\n{\n\tint flag = 0;\n\n\t/* Get the current state of the flag and store it in a temporary variable\n\t */\n\tflag = _CrtSetDbgFlag(\n\t _CRTDBG_REPORT_FLAG );\n\n\t/* Turn on client block identifiers and automatic leak detection\n\t */\n\tflag |= ( _CRTDBG_ALLOC_MEM_DF | _CRTDBG_LEAK_CHECK_DF );\n\n\t/* Set the new state for the flag\n\t */\n\t_CrtSetDbgFlag(\n\t flag );\n}\n\n#endif /* defined( _MSC_VER ) */\n\n/* Attaches a signal handler for Ctrl+C or Ctrl+Break signals\n * Returns 1 if successful or -1 on error\n */\nint evtxtools_signal_attach(\n void (*signal_handler)( evtxtools_signal_t ),\n libcerror_error_t **error )\n{\n\tstatic char *function = \"evtxtools_signal_attach\";\n\n\tif( signal_handler == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid signal handler.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tevtxtools_signal_signal_handler = signal_handler;\n\n\tif( SetConsoleCtrlHandler(\n\t (PHANDLER_ROUTINE) evtxtools_signal_handler,\n\t TRUE ) == 0 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_SET_FAILED,\n\t\t \"%s: unable to attach signal handler.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( SetConsoleCtrlHandler(\n\t NULL,\n\t FALSE ) == 0 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_SET_FAILED,\n\t\t \"%s: unable to attach break signal.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n#if defined( _MSC_VER )\n\tevtxtools_signal_initialize_memory_debug();\n#endif\n\n\tSetErrorMode(\n\t SEM_FAILCRITICALERRORS );\n\n#if defined( LOCALE_SUPPORT )\n\t/* Allow subsequent threads to have their own locale.\n\t * If the application is single threaded this call has\n\t * no practical effect.\n\t */\n\t_configthreadlocale(\n\t _ENABLE_PER_THREAD_LOCALE );\n\n\t/* Set the current thread locale to the user default\n\t * ANSI code page.\n\t */\n\tsetlocale(\n\t LC_ALL,\n\t \"\" );\n\n\t/* Set the the code page used by multibyte functions\n\t * to use the same code page as the previous call to setlocale.\n\t */\n\t_setmbcp(\n\t _MB_CP_LOCALE );\n\n#endif /* defined( LOCALE_SUPPORT ) */\n\n\treturn( 1 );\n}\n\n/* Detaches a signal handler for Ctrl+C or Ctrl+Break signals\n * Returns 1 if successful or -1 on error\n */\nint evtxtools_signal_detach(\n libcerror_error_t **error )\n{\n\tstatic char *function = \"evtxtools_signal_detach\";\n\n\tif( SetConsoleCtrlHandler(\n\t (PHANDLER_ROUTINE) evtxtools_signal_handler,\n\t FALSE ) == 0 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_SET_FAILED,\n\t\t \"%s: unable to detach signal handler.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tevtxtools_signal_signal_handler = NULL;\n\n\treturn( 1 );\n}\n\n#else\n\n/* Attaches a signal handler for SIGINT\n * Returns 1 if successful or -1 on error\n */\nint evtxtools_signal_attach(\n void (*signal_handler)( evtxtools_signal_t ),\n libcerror_error_t **error )\n{\n\tstatic char *function = \"evtxtools_signal_attach\";\n\n\tif( signal_handler == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid signal handler.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( signal(\n\t SIGINT,\n\t signal_handler ) == SIG_ERR )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_SET_FAILED,\n\t\t \"%s: unable to attach signal handler.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\treturn( 1 );\n}\n\n/* Detaches a signal handler for SIGINT\n * Returns 1 if successful or -1 on error\n */\nint evtxtools_signal_detach(\n libcerror_error_t **error )\n{\n\tstatic char *function = \"evtxtools_signal_detach\";\n\n\tif( signal(\n\t SIGINT,\n\t SIG_DFL ) == SIG_ERR )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_SET_FAILED,\n\t\t \"%s: unable to detach signal handler.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\treturn( 1 );\n}\n\n#endif /* defined( WINAPI ) */\n\n" }, { "path": "evtxtools/evtxtools_signal.h", "content": "/*\n * Signal handling functions\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#if !defined( _EVTXTOOLS_SIGNAL_H )\n#define _EVTXTOOLS_SIGNAL_H\n\n#include \n#include \n\n#include \"evtxtools_libcerror.h\"\n\n#if defined( __cplusplus )\nextern \"C\" {\n#endif\n\n#if !defined( HAVE_SIGNAL_H ) && !defined( WINAPI )\n#error missing signal functions\n#endif\n\n#if defined( WINAPI )\ntypedef unsigned long evtxtools_signal_t;\n\n#else\ntypedef int evtxtools_signal_t;\n\n#endif /* defined( WINAPI ) */\n\n#if defined( WINAPI )\n\nBOOL WINAPI evtxtools_signal_handler(\n evtxtools_signal_t signal );\n\n#if defined( _MSC_VER )\n\nvoid evtxtools_signal_initialize_memory_debug(\n void );\n\n#endif /* defined( _MSC_VER ) */\n\n#endif /* defined( WINAPI ) */\n\nint evtxtools_signal_attach(\n void (*signal_handler)( evtxtools_signal_t ),\n libcerror_error_t **error );\n\nint evtxtools_signal_detach(\n libcerror_error_t **error );\n\n#if defined( __cplusplus )\n}\n#endif\n\n#endif /* !defined( _EVTXTOOLS_SIGNAL_H ) */\n\n" }, { "path": "evtxtools/evtxtools_system_split_string.h", "content": "/*\n * Split system string functions\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#if !defined( _EVTXTOOLS_SYSTEM_SPLIT_STRING_H )\n#define _EVTXTOOLS_SYSTEM_SPLIT_STRING_H\n\n#include \n#include \n\n#include \"evtxtools_libcsplit.h\"\n\n#if defined( __cplusplus )\nextern \"C\" {\n#endif\n\n#if defined( HAVE_WIDE_SYSTEM_CHARACTER )\n#define system_split_string_t \\\n\tlibcsplit_wide_split_string_t\n\n#define system_split_string_free( split_string, error ) \\\n\tlibcsplit_wide_split_string_free( split_string, error )\n\n#define system_split_string_get_number_of_segments( split_string, number_of_segments, error ) \\\n\tlibcsplit_wide_split_string_get_number_of_segments( split_string, number_of_segments, error )\n\n#define system_split_string_get_segment_by_index( split_string, segment_index, string_segment, string_segment_size, error ) \\\n\tlibcsplit_wide_split_string_get_segment_by_index( split_string, segment_index, string_segment, string_segment_size, error )\n\n#define system_string_split( string, string_size, delimiter, split_string, error ) \\\n\tlibcsplit_wide_string_split( string, string_size, (wchar_t) delimiter, split_string, error )\n\n#else\n#define system_split_string_t \\\n\tlibcsplit_narrow_split_string_t\n\n#define system_split_string_free( split_string, error ) \\\n\tlibcsplit_narrow_split_string_free( split_string, error )\n\n#define system_split_string_get_number_of_segments( split_string, number_of_segments, error ) \\\n\tlibcsplit_narrow_split_string_get_number_of_segments( split_string, number_of_segments, error )\n\n#define system_split_string_get_segment_by_index( split_string, segment_index, string_segment, string_segment_size, error ) \\\n\tlibcsplit_narrow_split_string_get_segment_by_index( split_string, segment_index, string_segment, string_segment_size, error )\n\n#define system_string_split( string, string_size, delimiter, split_string, error ) \\\n\tlibcsplit_narrow_string_split( string, string_size, (char) delimiter, split_string, error )\n\n#endif /* defined( HAVE_WIDE_SYSTEM_CHARACTER ) */\n\n#if defined( __cplusplus )\n}\n#endif\n\n#endif /* !defined( _EVTXTOOLS_SYSTEM_SPLIT_STRING_H ) */\n\n" }, { "path": "evtxtools/evtxtools_unused.h", "content": "/*\n * Definitions to silence compiler warnings about unused function attributes/parameters.\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#if !defined( _EVTXTOOLS_UNUSED_H )\n#define _EVTXTOOLS_UNUSED_H\n\n#include \n\n#if !defined( EVTXTOOLS_ATTRIBUTE_UNUSED )\n\n#if defined( __GNUC__ ) && __GNUC__ >= 3\n#define EVTXTOOLS_ATTRIBUTE_UNUSED\t__attribute__ ((__unused__))\n\n#else\n#define EVTXTOOLS_ATTRIBUTE_UNUSED\n\n#endif /* defined( __GNUC__ ) && __GNUC__ >= 3 */\n\n#endif /* !defined( EVTXTOOLS_ATTRIBUTE_UNUSED ) */\n\n#if defined( _MSC_VER )\n#define EVTXTOOLS_UNREFERENCED_PARAMETER( parameter ) \\\n\tUNREFERENCED_PARAMETER( parameter );\n\n#else\n#define EVTXTOOLS_UNREFERENCED_PARAMETER( parameter ) \\\n\t/* parameter */\n\n#endif /* defined( _MSC_VER ) */\n\n#endif /* !defined( _EVTXTOOLS_UNUSED_H ) */\n\n" }, { "path": "evtxtools/evtxtools_wide_string.c", "content": "/*\n * Wide character string functions\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#include \n#include \n\n#if defined( HAVE_WCTYPE_H )\n#include \n#endif\n\n#include \"evtxtools_wide_string.h\"\n\n#if defined( TOWLOWER ) && !defined( HAVE_WCSNCASECMP ) && !defined( HAVE_WCSCASECMP ) && !defined( WINAPI )\n\n/* Replacement for missing: wcsncasecmp\n * Compares no more than a specified number of wide characters of string1 and string2,\n * ignoring case, returning less than, equal to or greater than zero if string1 is\n * less than, equal to or greater than string.\n */\nint evtxtools_wide_string_compare_no_case(\n const wchar_t *string1,\n const wchar_t *string2,\n size_t comparision_length )\n{\n\twint_t character1 = 0;\n\twint_t character2 = 0;\n\n\tif( string1 == string2 )\n\t{\n\t\treturn( 0 );\n\t}\n\twhile( comparision_length > 0 )\n\t{\n\t\tcharacter1 = towlower( *string1 );\n\t\tcharacter2 = towlower( *string2 );\n\n\t\tif( ( character1 == 0 )\n\t\t || ( character1 != character2 ) )\n\t\t{\n\t\t\treturn( character1 - character2 );\n\t\t}\n\t\tstring1++;\n\t\tstring2++;\n\n\t\tcomparision_length--;\n\t}\n\treturn( 0 );\n}\n\n#endif /* defined( TOWLOWER ) && !defined( HAVE_WCSNCASECMP ) && !defined( HAVE_WCSCASECMP ) && !defined( WINAPI ) */\n\n" }, { "path": "evtxtools/evtxtools_wide_string.h", "content": "/*\n * Wide character string functions\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#if !defined( _EVTXTOOLS_WIDE_STRING_H )\n#define _EVTXTOOLS_WIDE_STRING_H\n\n#include \n#include \n#include \n\n#if defined( __cplusplus )\nextern \"C\" {\n#endif\n\n#if !defined( wide_string_compare_no_case )\n\n#define wide_string_compare_no_case( string1, string2, size ) \\\n\tevtxtools_wide_string_compare_no_case( string1, string2, size )\n\n#endif /* !defined( wide_string_compare_no_case ) */\n\n#if defined( TOWLOWER ) && !defined( HAVE_WCSNCASECMP ) && !defined( HAVE_WCSCASECMP ) && !defined( WINAPI )\n\nint evtxtools_wide_string_compare_no_case(\n const wchar_t *string1,\n const wchar_t *string2,\n size_t comparision_length );\n\n#endif /* defined( TOWLOWER ) && !defined( HAVE_WCSNCASECMP ) && !defined( HAVE_WCSCASECMP ) && !defined( WINAPI ) */\n\n#if defined( __cplusplus )\n}\n#endif\n\n#endif /* !defined( _EVTXTOOLS_WIDE_STRING_H ) */\n\n" }, { "path": "evtxtools/export_handle.c", "content": "/*\n * Export handle\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#include \n#include \n#include \n#include \n#include \n#include \n\n#include \"evtxinput.h\"\n#include \"evtxtools_libcerror.h\"\n#include \"evtxtools_libcnotify.h\"\n#include \"evtxtools_libclocale.h\"\n#include \"evtxtools_libevtx.h\"\n#include \"evtxtools_libfdatetime.h\"\n#include \"evtxtools_libfguid.h\"\n#include \"evtxtools_libfwevt.h\"\n#include \"export_handle.h\"\n#include \"log_handle.h\"\n#include \"message_handle.h\"\n#include \"message_string.h\"\n#include \"resource_file.h\"\n\n#define EXPORT_HANDLE_NOTIFY_STREAM\t\tstdout\n\nconst char *export_handle_get_event_log_key_name(\n int event_log_type )\n{\n\tswitch( event_log_type )\n\t{\n\t\tcase EVTXTOOLS_EVENT_LOG_TYPE_APPLICATION:\n\t\t\treturn( \"Application\" );\n\n\t\tcase EVTXTOOLS_EVENT_LOG_TYPE_DFS_REPLICATION:\n\t\t\treturn( \"DFS Replication\" );\n\n\t\tcase EVTXTOOLS_EVENT_LOG_TYPE_HARDWARE_EVENTS:\n\t\t\treturn( \"Hardware Events\" );\n\n\t\tcase EVTXTOOLS_EVENT_LOG_TYPE_INTERNET_EXPLORER:\n\t\t\treturn( \"Internet Explorer\" );\n\n\t\tcase EVTXTOOLS_EVENT_LOG_TYPE_KEY_MANAGEMENT_SERVICE:\n\t\t\treturn( \"Key Management Service\" );\n\n\t\tcase EVTXTOOLS_EVENT_LOG_TYPE_MEDIA_CENTER:\n\t\t\treturn( \"Media Center\" );\n\n\t\tcase EVTXTOOLS_EVENT_LOG_TYPE_SECURITY:\n\t\t\treturn( \"Security\" );\n\n\t\tcase EVTXTOOLS_EVENT_LOG_TYPE_SYSTEM:\n\t\t\treturn( \"System\" );\n\n\t\tdefault:\n\t\t\tbreak;\n\t}\n\treturn( \"(Unknown)\" );\n}\n\nconst char *export_handle_get_event_level(\n uint8_t event_level )\n{\n\tswitch( event_level )\n\t{\n\t\tcase LIBEVTX_EVENT_LEVEL_CRITICAL:\n\t\t\treturn( \"Critical\" );\n\n\t\tcase LIBEVTX_EVENT_LEVEL_ERROR:\n\t\t\treturn( \"Error\" );\n\n\t\tcase LIBEVTX_EVENT_LEVEL_WARNING:\n\t\t\treturn( \"Warning\" );\n\n\t\tcase 0:\n\t\tcase LIBEVTX_EVENT_LEVEL_INFORMATION:\n\t\t\treturn( \"Information\" );\n\n\t\tcase LIBEVTX_EVENT_LEVEL_VERBOSE:\n\t\t\treturn( \"Verbose\" );\n\n\t\tdefault:\n\t\t\tbreak;\n\t}\n\treturn( \"(Unknown)\" );\n}\n\n/* Creates an export handle\n * Make sure the value export_handle is referencing, is set to NULL\n * Returns 1 if successful or -1 on error\n */\nint export_handle_initialize(\n export_handle_t **export_handle,\n libcerror_error_t **error )\n{\n\tstatic char *function = \"export_handle_initialize\";\n\n\tif( export_handle == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid export handle.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( *export_handle != NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_VALUE_ALREADY_SET,\n\t\t \"%s: invalid export handle value already set.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\t*export_handle = memory_allocate_structure(\n\t export_handle_t );\n\n\tif( *export_handle == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_MEMORY,\n\t\t LIBCERROR_MEMORY_ERROR_INSUFFICIENT,\n\t\t \"%s: unable to create export handle.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tif( memory_set(\n\t *export_handle,\n\t 0,\n\t sizeof( export_handle_t ) ) == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_MEMORY,\n\t\t LIBCERROR_MEMORY_ERROR_SET_FAILED,\n\t\t \"%s: unable to clear export handle.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tif( message_handle_initialize(\n\t &( ( *export_handle )->message_handle ),\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_INITIALIZE_FAILED,\n\t\t \"%s: unable to create message handle.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tif( libevtx_file_initialize(\n\t &( ( *export_handle )->input_file ),\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_INITIALIZE_FAILED,\n\t\t \"%s: unable to initialize input file.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\t( *export_handle )->export_mode = EXPORT_MODE_ITEMS;\n\t( *export_handle )->export_format = EXPORT_FORMAT_TEXT;\n\t( *export_handle )->event_log_type = EVTXTOOLS_EVENT_LOG_TYPE_UNKNOWN;\n\t( *export_handle )->ascii_codepage = LIBEVTX_CODEPAGE_WINDOWS_1252;\n\t( *export_handle )->notify_stream = EXPORT_HANDLE_NOTIFY_STREAM;\n\n\treturn( 1 );\n\non_error:\n\tif( *export_handle != NULL )\n\t{\n\t\tif( ( *export_handle )->message_handle != NULL )\n\t\t{\n\t\t\tmessage_handle_free(\n\t\t\t &( ( *export_handle )->message_handle ),\n\t\t\t NULL );\n\t\t}\n\t\tmemory_free(\n\t\t *export_handle );\n\n\t\t*export_handle = NULL;\n\t}\n\treturn( -1 );\n}\n\n/* Frees an export handle\n * Returns 1 if successful or -1 on error\n */\nint export_handle_free(\n export_handle_t **export_handle,\n libcerror_error_t **error )\n{\n\tstatic char *function = \"export_handle_free\";\n\tint result = 1;\n\n\tif( export_handle == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid export handle.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( *export_handle != NULL )\n\t{\n\t\tif( ( *export_handle )->input_is_open != 0 )\n\t\t{\n\t\t\tif( export_handle_close_input(\n\t\t\t *export_handle,\n\t\t\t error ) != 0 )\n\t\t\t{\n\t\t\t\tlibcerror_error_set(\n\t\t\t\t error,\n\t\t\t\t LIBCERROR_ERROR_DOMAIN_IO,\n\t\t\t\t LIBCERROR_IO_ERROR_CLOSE_FAILED,\n\t\t\t\t \"%s: unable to close export handle.\",\n\t\t\t\t function );\n\n\t\t\t\tresult = -1;\n\t\t\t}\n\t\t}\n\t\tif( message_handle_free(\n\t\t &( ( *export_handle )->message_handle ),\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED,\n\t\t\t \"%s: unable to free message handle.\",\n\t\t\t function );\n\n\t\t\tresult = -1;\n\t\t}\n\t\tif( libevtx_file_free(\n\t\t &( ( *export_handle )->input_file ),\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED,\n\t\t\t \"%s: unable to free input file.\",\n\t\t\t function );\n\n\t\t\tresult = -1;\n\t\t}\n\t\tmemory_free(\n\t\t *export_handle );\n\n\t\t*export_handle = NULL;\n\t}\n\treturn( result );\n}\n\n/* Signals the export handle to abort\n * Returns 1 if successful or -1 on error\n */\nint export_handle_signal_abort(\n export_handle_t *export_handle,\n libcerror_error_t **error )\n{\n\tstatic char *function = \"export_handle_signal_abort\";\n\n\tif( export_handle == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid export handle.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\texport_handle->abort = 1;\n\n\tif( message_handle_signal_abort(\n\t export_handle->message_handle,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_SET_FAILED,\n\t\t \"%s: unable to signal message handle to abort.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( export_handle->input_file != NULL )\n\t{\n\t\tif( libevtx_file_signal_abort(\n\t\t export_handle->input_file,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_SET_FAILED,\n\t\t\t \"%s: unable to signal input file to abort.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t}\n\treturn( 1 );\n}\n\n/* Sets the export mode\n * Returns 1 if successful, 0 if unsupported values or -1 on error\n */\nint export_handle_set_export_mode(\n export_handle_t *export_handle,\n const system_character_t *string,\n libcerror_error_t **error )\n{\n\tstatic char *function = \"export_handle_set_export_mode\";\n\tsize_t string_length = 0;\n\tint result = 0;\n\n\tif( export_handle == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid export handle.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( string == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid string.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tstring_length = system_string_length(\n\t string );\n\n\tif( string_length == 3 )\n\t{\n\t\tif( system_string_compare(\n\t\t string,\n\t\t _SYSTEM_STRING( \"all\" ),\n\t\t 3 ) == 0 )\n\t\t{\n\t\t\texport_handle->export_mode = EXPORT_MODE_ALL;\n\n\t\t\tresult = 1;\n\t\t}\n\t}\n\telse if( string_length == 5 )\n\t{\n\t\tif( system_string_compare(\n\t\t string,\n\t\t _SYSTEM_STRING( \"items\" ),\n\t\t 5 ) == 0 )\n\t\t{\n\t\t\texport_handle->export_mode = EXPORT_MODE_ITEMS;\n\n\t\t\tresult = 1;\n\t\t}\n\t}\n\telse if( string_length == 9 )\n\t{\n\t\tif( system_string_compare(\n\t\t string,\n\t\t _SYSTEM_STRING( \"recovered\" ),\n\t\t 9 ) == 0 )\n\t\t{\n\t\t\texport_handle->export_mode = EXPORT_MODE_RECOVERED;\n\n\t\t\tresult = 1;\n\t\t}\n\t}\n\treturn( result );\n}\n\n/* Sets the export format\n * Returns 1 if successful, 0 if unsupported values or -1 on error\n */\nint export_handle_set_export_format(\n export_handle_t *export_handle,\n const system_character_t *string,\n libcerror_error_t **error )\n{\n\tstatic char *function = \"export_handle_export_format\";\n\tsize_t string_length = 0;\n\tint result = 0;\n\n\tif( export_handle == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid export handle.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tstring_length = system_string_length(\n\t string );\n\n\tif( string_length == 3 )\n\t{\n\t\tif( system_string_compare(\n\t\t string,\n\t\t _SYSTEM_STRING( \"xml\" ),\n\t\t 3 ) == 0 )\n\t\t{\n\t\t\texport_handle->export_format = EXPORT_FORMAT_XML;\n\n\t\t\tresult = 1;\n\t\t}\n\t}\n\telse if( string_length == 4 )\n\t{\n\t\tif( system_string_compare(\n\t\t string,\n\t\t _SYSTEM_STRING( \"text\" ),\n\t\t 4 ) == 0 )\n\t\t{\n\t\t\texport_handle->export_format = EXPORT_FORMAT_TEXT;\n\n\t\t\tresult = 1;\n\t\t}\n\t}\n\treturn( result );\n}\n\n/* Sets the ascii codepage\n * Returns 1 if successful or -1 on error\n */\nint export_handle_set_ascii_codepage(\n export_handle_t *export_handle,\n const system_character_t *string,\n libcerror_error_t **error )\n{\n\tstatic char *function = \"export_handle_set_ascii_codepage\";\n\tsize_t string_length = 0;\n\tuint32_t feature_flags = 0;\n\tint result = 0;\n\n\tif( export_handle == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid export handle.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tfeature_flags = LIBCLOCALE_CODEPAGE_FEATURE_FLAG_HAVE_KOI8\n\t | LIBCLOCALE_CODEPAGE_FEATURE_FLAG_HAVE_WINDOWS;\n\n\tstring_length = system_string_length(\n\t string );\n\n#if defined( HAVE_WIDE_SYSTEM_CHARACTER )\n\tresult = libclocale_codepage_copy_from_string_wide(\n\t &( export_handle->ascii_codepage ),\n\t string,\n\t string_length,\n\t feature_flags,\n\t error );\n#else\n\tresult = libclocale_codepage_copy_from_string(\n\t &( export_handle->ascii_codepage ),\n\t string,\n\t string_length,\n\t feature_flags,\n\t error );\n#endif\n\tif( result == -1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to determine ASCII codepage.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\telse if( result != 0 )\n\t{\n\t\tif( message_handle_set_ascii_codepage(\n\t\t export_handle->message_handle,\n\t\t export_handle->ascii_codepage,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_SET_FAILED,\n\t\t\t \"%s: unable to set ASCII codepage in message handle.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t}\n\treturn( result );\n}\n\n/* Sets the preferred language identifier\n * Returns 1 if successful or -1 on error\n */\nint export_handle_set_preferred_language_identifier(\n export_handle_t *export_handle,\n uint32_t preferred_language_identifier,\n libcerror_error_t **error )\n{\n\tstatic char *function = \"export_handle_set_preferred_language_identifier\";\n\n\tif( export_handle == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid export handle.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( message_handle_set_preferred_language_identifier(\n\t export_handle->message_handle,\n\t preferred_language_identifier,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_SET_FAILED,\n\t\t \"%s: unable to set preferred language identifier in message handle.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\treturn( 1 );\n}\n\n/* Sets the event log type\n * Returns 1 if successful or -1 on error\n */\nint export_handle_set_event_log_type(\n export_handle_t *export_handle,\n const system_character_t *string,\n libcerror_error_t **error )\n{\n\tstatic char *function = \"export_handle_set_event_log_type\";\n\tint result = 0;\n\n\tif( export_handle == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid export handle.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tresult = evtxinput_determine_event_log_type(\n\t string,\n\t &( export_handle->event_log_type ),\n\t error );\n\n\tif( result == -1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to determine event log type.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\treturn( result );\n}\n\n/* Sets the event log type from the filename\n * Returns 1 if successful or -1 on error\n */\nint export_handle_set_event_log_type_from_filename(\n export_handle_t *export_handle,\n const system_character_t *filename,\n libcerror_error_t **error )\n{\n\tstatic char *function = \"export_handle_set_event_log_type_from_filename\";\n\tint result = 0;\n\n\tif( export_handle == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid export handle.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tresult = evtxinput_determine_event_log_type_from_filename(\n\t filename,\n\t &( export_handle->event_log_type ),\n\t error );\n\n\tif( result == -1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to determine event log type from filename.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\treturn( result );\n}\n\n/* Sets the name of the software registry file\n * Returns 1 if successful or -1 error\n */\nint export_handle_set_software_registry_filename(\n export_handle_t *export_handle,\n const system_character_t *filename,\n libcerror_error_t **error )\n{\n\tstatic char *function = \"export_handle_set_software_registry_filename\";\n\n\tif( export_handle == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid export handle.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( message_handle_set_software_registry_filename(\n\t export_handle->message_handle,\n\t filename,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_SET_FAILED,\n\t\t \"%s: unable to set SOFTWARE registry filename in message handle.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\treturn( 1 );\n}\n\n/* Sets the name of the system registry file\n * Returns 1 if successful or -1 error\n */\nint export_handle_set_system_registry_filename(\n export_handle_t *export_handle,\n const system_character_t *filename,\n libcerror_error_t **error )\n{\n\tstatic char *function = \"export_handle_set_system_registry_filename\";\n\n\tif( export_handle == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid export handle.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( message_handle_set_system_registry_filename(\n\t export_handle->message_handle,\n\t filename,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_SET_FAILED,\n\t\t \"%s: unable to set SYSTEM registry filename in message handle.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\treturn( 1 );\n}\n\n/* Sets the name of the directory containing the software and system registry file\n * Returns 1 if successful or -1 error\n */\nint export_handle_set_registry_directory_name(\n export_handle_t *export_handle,\n const system_character_t *name,\n libcerror_error_t **error )\n{\n\tstatic char *function = \"export_handle_set_registry_directory_name\";\n\n\tif( export_handle == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid export handle.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( message_handle_set_registry_directory_name(\n\t export_handle->message_handle,\n\t name,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_SET_FAILED,\n\t\t \"%s: unable to set registry directory name in message handle.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\treturn( 1 );\n}\n\n/* Sets the path of the resource files\n * Returns 1 if successful or -1 error\n */\nint export_handle_set_resource_files_path(\n export_handle_t *export_handle,\n const system_character_t *path,\n libcerror_error_t **error )\n{\n\tstatic char *function = \"export_handle_set_resource_files_path\";\n\n\tif( export_handle == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid export handle.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( message_handle_set_resource_files_path(\n\t export_handle->message_handle,\n\t path,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_SET_FAILED,\n\t\t \"%s: unable to set resource files path in message handle.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\treturn( 1 );\n}\n\n/* Opens the input\n * Returns 1 if successful or -1 on error\n */\nint export_handle_open_input(\n export_handle_t *export_handle,\n const system_character_t *filename,\n libcerror_error_t **error )\n{\n\tstatic char *function = \"export_handle_open_input\";\n\n\tif( export_handle == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid export handle.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( export_handle->input_is_open != 0 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_VALUE_ALREADY_SET,\n\t\t \"%s: invalid export handle input is already open.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( message_handle_open_input(\n\t export_handle->message_handle,\n\t export_handle_get_event_log_key_name(\n\t export_handle->event_log_type ),\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_IO,\n\t\t LIBCERROR_IO_ERROR_OPEN_FAILED,\n\t\t \"%s: unable to open input of message handle.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( libevtx_file_set_ascii_codepage(\n\t export_handle->input_file,\n\t export_handle->ascii_codepage,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_SET_FAILED,\n\t\t \"%s: unable to set ASCII codepage in input file.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n#if defined( HAVE_WIDE_SYSTEM_CHARACTER )\n\tif( libevtx_file_open_wide(\n\t export_handle->input_file,\n\t filename,\n\t LIBEVTX_OPEN_READ,\n\t error ) != 1 )\n#else\n\tif( libevtx_file_open(\n\t export_handle->input_file,\n\t filename,\n\t LIBEVTX_OPEN_READ,\n\t error ) != 1 )\n#endif\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_IO,\n\t\t LIBCERROR_IO_ERROR_OPEN_FAILED,\n\t\t \"%s: unable to open input file.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\texport_handle->input_is_open = 1;\n\n\treturn( 1 );\n}\n\n/* Closes the input\n * Returns the 0 if succesful or -1 on error\n */\nint export_handle_close_input(\n export_handle_t *export_handle,\n libcerror_error_t **error )\n{\n\tstatic char *function = \"export_handle_close_input\";\n\tint result = 0;\n\n\tif( export_handle == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid export handle.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( export_handle->input_is_open != 0 )\n\t{\n\t\tif( message_handle_close_input(\n\t\t export_handle->message_handle,\n\t\t error ) != 0 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_IO,\n\t\t\t LIBCERROR_IO_ERROR_CLOSE_FAILED,\n\t\t\t \"%s: unable to close input of message handle.\",\n\t\t\t function );\n\n\t\t\tresult = -1;\n\t\t}\n\t\tif( libevtx_file_close(\n\t\t export_handle->input_file,\n\t\t error ) != 0 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_IO,\n\t\t\t LIBCERROR_IO_ERROR_CLOSE_FAILED,\n\t\t\t \"%s: unable to close input file.\",\n\t\t\t function );\n\n\t\t\tresult = -1;\n\t\t}\n\t\texport_handle->input_is_open = 0;\n\t}\n\treturn( result );\n}\n\n/* Copies the GUID string to a byte stream\n * Returns 1 if successful or -1 on error\n */\nint export_handle_guid_string_copy_to_byte_stream(\n export_handle_t *export_handle,\n const system_character_t *string,\n size_t string_length,\n uint8_t *byte_stream,\n size_t byte_stream_size,\n libcerror_error_t **error )\n{\n\tlibfguid_identifier_t *guid = NULL;\n\tstatic char *function = \"export_handle_guid_string_copy_to_byte_stream\";\n\tint result = 0;\n\n\tif( export_handle == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid export handle.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( libfguid_identifier_initialize(\n\t &guid,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_INITIALIZE_FAILED,\n\t\t \"%s: unable to create GUID.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n#if defined( HAVE_WIDE_SYSTEM_CHARACTER )\n\tresult = libfguid_identifier_copy_from_utf16_string(\n\t\t guid,\n\t\t (uint16_t *) string,\n\t\t string_length,\n\t\t LIBFGUID_STRING_FORMAT_FLAG_USE_MIXED_CASE | LIBFGUID_STRING_FORMAT_FLAG_USE_SURROUNDING_BRACES,\n\t\t error );\n#else\n\tresult = libfguid_identifier_copy_from_utf8_string(\n\t\t guid,\n\t\t (uint8_t *) string,\n\t\t string_length,\n\t\t LIBFGUID_STRING_FORMAT_FLAG_USE_MIXED_CASE | LIBFGUID_STRING_FORMAT_FLAG_USE_SURROUNDING_BRACES,\n\t\t error );\n#endif\n\tif( result != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_SET_FAILED,\n\t\t \"%s: unable to copy GUID from string.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tif( libfguid_identifier_copy_to_byte_stream(\n\t guid,\n\t byte_stream,\n\t byte_stream_size,\n\t LIBFGUID_ENDIAN_LITTLE,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_SET_FAILED,\n\t\t \"%s: unable to copy GUID to byte stream.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tif( libfguid_identifier_free(\n\t &guid,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED,\n\t\t \"%s: unable to free GUID.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\treturn( 1 );\n\non_error:\n\tif( guid != NULL )\n\t{\n\t\tlibfguid_identifier_free(\n\t\t &guid,\n\t\t NULL );\n\t}\n\treturn( -1 );\n}\n\n/* Retrieves the template definition from the resource file\n * Returns 1 if successful, 0 if not available or -1 on error\n */\nint export_handle_resource_file_get_template_definition(\n export_handle_t *export_handle,\n resource_file_t *resource_file,\n const uint8_t *provider_identifier,\n size_t provider_identifier_size,\n uint32_t event_identifier,\n libevtx_template_definition_t **template_definition,\n libcerror_error_t **error )\n{\n\tlibfwevt_event_t *wevt_event = NULL;\n\tlibfwevt_provider_t *wevt_provider = NULL;\n\tlibfwevt_template_t *wevt_template = NULL;\n\tconst uint8_t *template_data = NULL;\n\tstatic char *function = \"export_handle_resource_file_get_template_definition\";\n\tsize_t template_data_size = 0;\n\tuint32_t template_data_offset = 0;\n\tint result = 0;\n\n\tif( export_handle == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid export handle.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( template_definition == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid template definition.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tresult = resource_file_get_template_definition(\n\t\t resource_file,\n\t\t provider_identifier,\n\t\t provider_identifier_size,\n\t\t event_identifier,\n\t\t &wevt_provider,\n\t\t &wevt_event,\n\t\t &wevt_template,\n\t\t error );\n\n\tif( result == -1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to retrieve WEVT template definition.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\telse if( result != 0 )\n\t{\n\t\tif( libfwevt_template_get_offset(\n\t\t wevt_template,\n\t\t &template_data_offset,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve template offset.\",\n\t\t\t function );\n\n\t\t\tgoto on_error;\n\t\t}\n/* TODO make a local copy of the data instead */\n\t\tif( libfwevt_template_get_data(\n\t\t wevt_template,\n\t\t &template_data,\n\t\t &template_data_size,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve template data.\",\n\t\t\t function );\n\n\t\t\tgoto on_error;\n\t\t}\n/* TODO cache the EVTX template definitions ? */\n\t\tif( libevtx_template_definition_initialize(\n\t\t template_definition,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_INITIALIZE_FAILED,\n\t\t\t \"%s: unable to create template definitions.\",\n\t\t\t function );\n\n\t\t\tgoto on_error;\n\t\t}\n\t\tif( libevtx_template_definition_set_data(\n\t\t *template_definition,\n\t\t template_data,\n\t\t template_data_size,\n\t\t template_data_offset,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_SET_FAILED,\n\t\t\t \"%s: unable to set template data.\",\n\t\t\t function );\n\n\t\t\tgoto on_error;\n\t\t}\n\t\tif( libfwevt_template_free(\n\t\t &wevt_template,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED,\n\t\t\t \"%s: unable to free template definition.\",\n\t\t\t function );\n\n\t\t\tgoto on_error;\n\t\t}\n\t\tif( libfwevt_event_free(\n\t\t &wevt_event,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED,\n\t\t\t \"%s: unable to free event.\",\n\t\t\t function );\n\n\t\t\tgoto on_error;\n\t\t}\n\t\tif( libfwevt_provider_free(\n\t\t &wevt_provider,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED,\n\t\t\t \"%s: unable to free provider.\",\n\t\t\t function );\n\n\t\t\tgoto on_error;\n\t\t}\n\t}\n\treturn( result );\n\non_error:\n\tif( wevt_template != NULL )\n\t{\n\t\tlibfwevt_template_free(\n\t\t &wevt_template,\n\t\t NULL );\n\t}\n\tif( wevt_event != NULL )\n\t{\n\t\tlibfwevt_event_free(\n\t\t &wevt_event,\n\t\t NULL );\n\t}\n\tif( wevt_provider != NULL )\n\t{\n\t\tlibfwevt_provider_free(\n\t\t &wevt_provider,\n\t\t NULL );\n\t}\n\tif( *template_definition != NULL )\n\t{\n\t\tlibevtx_template_definition_free(\n\t\t template_definition,\n\t\t NULL );\n\t}\n\treturn( -1 );\n}\n\n/* Exports the record event message\n * Returns 1 if successful or -1 on error\n */\nint export_handle_export_record_event_message(\n export_handle_t *export_handle,\n libevtx_record_t *record,\n const system_character_t *event_provider_identifier,\n size_t event_provider_identifier_length,\n const system_character_t *event_source,\n size_t event_source_length,\n uint32_t event_identifier,\n log_handle_t *log_handle,\n libcerror_error_t **error )\n{\n\tuint8_t provider_identifier[ 16 ];\n\n\tlibevtx_template_definition_t *template_definition = NULL;\n\tmessage_string_t *message_string = NULL;\n\tresource_file_t *resource_file = NULL;\n\tsystem_character_t *message_filename = NULL;\n\tsystem_character_t *resource_filename = NULL;\n\tsystem_character_t *value_string = NULL;\n\tstatic char *function = \"export_handle_export_record_event_message\";\n\tsize_t message_filename_size = 0;\n\tsize_t resource_filename_size = 0;\n\tsize_t value_string_size = 0;\n\tuint32_t event_identifier_qualifiers = 0;\n\tuint32_t message_identifier = 0;\n\tint number_of_strings = 0;\n\tint result = 0;\n\tint value_string_index = 0;\n\n\tif( export_handle == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid export handle.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( event_provider_identifier != NULL )\n\t{\n\t\tresult = message_handle_get_value_by_provider_identifier(\n\t\t export_handle->message_handle,\n\t\t event_provider_identifier,\n\t\t event_provider_identifier_length,\n\t\t _SYSTEM_STRING( \"ResourceFileName\" ),\n\t\t 16,\n\t\t &resource_filename,\n\t\t &resource_filename_size,\n\t\t error );\n\n\t\tif( result == -1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve resource filename by provider identifier.\",\n\t\t\t function );\n\n\t\t\tgoto on_error;\n\t\t}\n\t\tresult = message_handle_get_value_by_provider_identifier(\n\t\t export_handle->message_handle,\n\t\t event_provider_identifier,\n\t\t event_provider_identifier_length,\n\t\t _SYSTEM_STRING( \"MessageFileName\" ),\n\t\t 15,\n\t\t &message_filename,\n\t\t &message_filename_size,\n\t\t error );\n\n\t\tif( result == -1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve message filename by provider identifier.\",\n\t\t\t function );\n\n\t\t\tgoto on_error;\n\t\t}\n\t}\n\tif( ( message_filename == NULL )\n\t && ( event_source != NULL ) )\n\t{\n\t\tresult = message_handle_get_value_by_event_source(\n\t\t export_handle->message_handle,\n\t\t event_source,\n\t\t event_source_length,\n\t\t _SYSTEM_STRING( \"EventMessageFile\" ),\n\t\t 16,\n\t\t &message_filename,\n\t\t &message_filename_size,\n\t\t error );\n\n\t\tif( result == -1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve message filename by event source.\",\n\t\t\t function );\n\n\t\t\tgoto on_error;\n\t\t}\n\t}\n\tif( resource_filename != NULL )\n\t{\n\t\tfprintf(\n\t\t export_handle->notify_stream,\n\t\t \"Resource filename\\t\\t: %\" PRIs_SYSTEM \"\\n\",\n\t\t resource_filename );\n\t}\n\tif( resource_filename != NULL )\n\t{\n\t\tif( export_handle_guid_string_copy_to_byte_stream(\n\t\t export_handle,\n\t\t event_provider_identifier,\n\t\t event_provider_identifier_length,\n\t\t provider_identifier,\n\t\t 16,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_SET_FAILED,\n\t\t\t \"%s: unable to copy GUID from string.\",\n\t\t\t function );\n\n\t\t\tgoto on_error;\n\t\t}\n\t\tresult = message_handle_get_resource_file_by_provider_identifier(\n\t\t\t export_handle->message_handle,\n\t\t\t resource_filename,\n\t\t\t resource_filename_size - 1,\n\t\t\t provider_identifier,\n\t\t\t 16,\n\t\t\t &resource_file,\n\t\t\t error );\n\n\t\tif( result == -1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve resource file.\",\n\t\t\t function );\n\n\t\t\tgoto on_error;\n\t\t}\n\t\telse if( result != 0 )\n\t\t{\n\t\t\tresult = resource_file_get_event_message_identifier(\n\t\t\t\t resource_file,\n\t\t\t\t provider_identifier,\n\t\t\t\t 16,\n\t\t\t\t event_identifier,\n\t\t\t\t &message_identifier,\n\t\t\t\t error );\n\n\t\t\tif( result == -1 )\n\t\t\t{\n\t\t\t\tlibcerror_error_set(\n\t\t\t\t error,\n\t\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t\t \"%s: unable to retrieve message identifier.\",\n\t\t\t\t function );\n\n\t\t\t\tgoto on_error;\n\t\t\t}\n\t\t\telse if( result == 0 )\n\t\t\t{\n\t\t\t\tmessage_identifier = 0;\n\t\t\t}\n\t\t\tif( export_handle->use_template_definition != 0 )\n\t\t\t{\n\t\t\t\tresult = export_handle_resource_file_get_template_definition(\n\t\t\t\t\t export_handle,\n\t\t\t\t\t resource_file,\n\t\t\t\t\t provider_identifier,\n\t\t\t\t\t 16,\n\t\t\t\t\t event_identifier,\n\t\t\t\t\t &template_definition,\n\t\t\t\t\t error );\n\n\t\t\t\tif( result == -1 )\n\t\t\t\t{\n\t\t\t\t\tlibcerror_error_set(\n\t\t\t\t\t error,\n\t\t\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t\t\t \"%s: unable to retrieve tempate definition.\",\n\t\t\t\t\t function );\n\n\t\t\t\t\tgoto on_error;\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t\tmemory_free(\n\t\t resource_filename );\n\n\t\tresource_filename = NULL;\n\t}\n\tif( message_filename != NULL )\n\t{\n\t\tfprintf(\n\t\t export_handle->notify_stream,\n\t\t \"Message filename\\t\\t: %\" PRIs_SYSTEM \"\\n\",\n\t\t message_filename );\n\n\t\tif( message_identifier == 0 )\n\t\t{\n\t\t\tresult = libevtx_record_get_event_identifier_qualifiers(\n\t\t\t\t record,\n\t\t\t\t &event_identifier_qualifiers,\n\t\t\t\t error );\n\n\t\t\tif( result == -1 )\n\t\t\t{\n\t\t\t\tlibcerror_error_set(\n\t\t\t\t error,\n\t\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t\t \"%s: unable to retrieve event identifier qualifiers.\",\n\t\t\t\t function );\n\n\t\t\t\tgoto on_error;\n\t\t\t}\n\t\t\telse if( result != 0 )\n\t\t\t{\n\t\t\t\tif( export_handle->verbose != 0 )\n\t\t\t\t{\n\t\t\t\t\tfprintf(\n\t\t\t\t\t export_handle->notify_stream,\n\t\t\t\t\t \"Event identifier qualifiers\\t: 0x%08\" PRIx32 \"\\n\",\n\t\t\t\t\t event_identifier_qualifiers );\n\t\t\t\t}\n\t\t\t\tmessage_identifier = event_identifier_qualifiers << 16;\n\t\t\t}\n\t\t\tmessage_identifier |= event_identifier;\n\t\t}\n\t\tif( export_handle->verbose != 0 )\n\t\t{\n\t\t\tfprintf(\n\t\t\t export_handle->notify_stream,\n\t\t\t \"Message identifier\\t\\t: 0x%08\" PRIx32 \"\\n\",\n\t\t\t message_identifier );\n\t\t}\n\t\tresult = message_handle_get_message_string(\n\t\t\t export_handle->message_handle,\n\t\t\t message_filename,\n\t\t\t message_filename_size - 1,\n\t\t\t message_identifier,\n\t\t\t &message_string,\n\t\t\t error );\n\n\t\tif( result == -1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve message string.\",\n\t\t\t function );\n\n\t\t\tgoto on_error;\n\t\t}\n\t\tmemory_free(\n\t\t message_filename );\n\n\t\tmessage_filename = NULL;\n\t}\n\tif( export_handle->use_template_definition != 0 )\n\t{\n\t\tresult = libevtx_record_parse_data_with_template_definition(\n\t\t\t record,\n\t\t\t template_definition,\n\t\t\t error );\n\n\t\tif( result == -1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GENERIC,\n\t\t\t \"%s: unable to parse record data.\",\n\t\t\t function );\n\n#if defined( HAVE_DEBUG_OUTPUT )\n\t\t\tif( ( error != NULL )\n\t\t\t && ( *error != NULL ) )\n\t\t\t{\n\t\t\t\tlibcnotify_print_error_backtrace(\n\t\t\t\t *error );\n\t\t\t}\n#endif\n\t\t\tlibcerror_error_free(\n\t\t\t error );\n\t\t}\n\t\tif( libevtx_template_definition_free(\n\t\t &template_definition,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED,\n\t\t\t \"%s: unable to free template definition.\",\n\t\t\t function );\n\n\t\t\tgoto on_error;\n\t\t}\n\t}\n\tif( libevtx_record_get_number_of_strings(\n\t record,\n\t &number_of_strings,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to retrieve number of strings in record.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tfprintf(\n\t export_handle->notify_stream,\n\t \"Number of strings\\t\\t: %d\\n\",\n\t number_of_strings );\n\n\tfor( value_string_index = 0;\n\t value_string_index < number_of_strings;\n\t value_string_index++ )\n\t{\n\t\tfprintf(\n\t\t export_handle->notify_stream,\n\t\t \"String: %d\\t\\t\\t: \",\n\t\t value_string_index + 1 );\n\n#if defined( HAVE_WIDE_SYSTEM_CHARACTER )\n\t\tresult = libevtx_record_get_utf16_string_size(\n\t\t\t record,\n\t\t\t value_string_index,\n\t\t\t &value_string_size,\n\t\t\t error );\n#else\n\t\tresult = libevtx_record_get_utf8_string_size(\n\t\t\t record,\n\t\t\t value_string_index,\n\t\t\t &value_string_size,\n\t\t\t error );\n#endif\n\t\tif( result != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve string: %d size.\",\n\t\t\t function,\n\t\t\t value_string_index );\n\n\t\t\tgoto on_error;\n\t\t}\n\t\tif( value_string_size > 0 )\n\t\t{\n\t\t\tvalue_string = system_string_allocate(\n\t\t\t\t\tvalue_string_size );\n\n\t\t\tif( value_string == NULL )\n\t\t\t{\n\t\t\t\tlibcerror_error_set(\n\t\t\t\t error,\n\t\t\t\t LIBCERROR_ERROR_DOMAIN_MEMORY,\n\t\t\t\t LIBCERROR_MEMORY_ERROR_INSUFFICIENT,\n\t\t\t\t \"%s: unable to create value string.\",\n\t\t\t\t function );\n\n\t\t\t\tgoto on_error;\n\t\t\t}\n#if defined( HAVE_WIDE_SYSTEM_CHARACTER )\n\t\t\tresult = libevtx_record_get_utf16_string(\n\t\t\t\t record,\n\t\t\t\t value_string_index,\n\t\t\t\t (uint16_t *) value_string,\n\t\t\t\t value_string_size,\n\t\t\t\t error );\n#else\n\t\t\tresult = libevtx_record_get_utf8_string(\n\t\t\t\t record,\n\t\t\t\t value_string_index,\n\t\t\t\t (uint8_t *) value_string,\n\t\t\t\t value_string_size,\n\t\t\t\t error );\n#endif\n\t\t\tif( result != 1 )\n\t\t\t{\n\t\t\t\tlibcerror_error_set(\n\t\t\t\t error,\n\t\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t\t \"%s: unable to retrieve string: %d.\",\n\t\t\t\t function,\n\t\t\t\t value_string_index );\n\n\t\t\t\tgoto on_error;\n\t\t\t}\n\t\t\tfprintf(\n\t\t\t export_handle->notify_stream,\n\t\t\t \"%\" PRIs_SYSTEM \"\",\n\t\t\t value_string );\n\n\t\t\tmemory_free(\n\t\t\t value_string );\n\n\t\t\tvalue_string = NULL;\n\t\t}\n\t\tfprintf(\n\t\t export_handle->notify_stream,\n\t\t \"\\n\" );\n\t}\n\tif( message_string != NULL )\n\t{\n\t\tif( message_string_fprint(\n\t\t message_string,\n\t\t record,\n\t\t export_handle->notify_stream,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_PRINT_FAILED,\n\t\t\t \"%s: unable to print message string.\",\n\t\t\t function );\n\n\t\t\tgoto on_error;\n\t\t}\n\t\tmessage_string = NULL;\n\t}\n\treturn( 1 );\n\non_error:\n\tif( value_string != NULL )\n\t{\n\t\tmemory_free(\n\t\t value_string );\n\t}\n\tif( template_definition != NULL )\n\t{\n\t\tlibevtx_template_definition_free(\n\t\t &template_definition,\n\t\t NULL );\n\t}\n\tif( message_filename != NULL )\n\t{\n\t\tmemory_free(\n\t\t message_filename );\n\t}\n\tif( resource_filename != NULL )\n\t{\n\t\tmemory_free(\n\t\t resource_filename );\n\t}\n\treturn( -1 );\n}\n\n/* Exports the record\n * Returns 1 if successful or -1 on error\n */\nint export_handle_export_record(\n export_handle_t *export_handle,\n libevtx_record_t *record,\n log_handle_t *log_handle,\n libcerror_error_t **error )\n{\n\tstatic char *function = \"export_handle_export_record\";\n\n\tif( export_handle == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid export handle.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( export_handle->export_format == EXPORT_FORMAT_TEXT )\n\t{\n\t\tif( export_handle_export_record_text(\n\t\t export_handle,\n\t\t record,\n\t\t log_handle,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GENERIC,\n\t\t\t \"%s: unable to export record in text.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t}\n\telse if( export_handle->export_format == EXPORT_FORMAT_XML )\n\t{\n\t\tif( export_handle_export_record_xml(\n\t\t export_handle,\n\t\t record,\n\t\t log_handle,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GENERIC,\n\t\t\t \"%s: unable to export record in XML.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t}\n\treturn( 1 );\n}\n\n/* Exports the record in the text format\n * Returns 1 if successful or -1 on error\n */\nint export_handle_export_record_text(\n export_handle_t *export_handle,\n libevtx_record_t *record,\n log_handle_t *log_handle,\n libcerror_error_t **error )\n{\n\tsystem_character_t filetime_string[ 48 ];\n\n\tlibfdatetime_filetime_t *filetime = NULL;\n\tsystem_character_t *source_name = NULL;\n\tsystem_character_t *provider_identifier = NULL;\n\tsystem_character_t *value_string = NULL;\n\tstatic char *function = \"export_handle_export_record_text\";\n\tsize_t source_name_size = 0;\n\tsize_t provider_identifier_size = 0;\n\tsize_t value_string_size = 0;\n\tuint64_t value_64bit = 0;\n\tuint32_t event_identifier = 0;\n\tuint8_t event_level = 0;\n\tuint8_t event_version = 0;\n\tint result = 0;\n\n\tif( export_handle == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid export handle.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( record == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid record.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( libfdatetime_filetime_initialize(\n\t &filetime,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_INITIALIZE_FAILED,\n\t\t \"%s: unable to create filetime.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tif( libevtx_record_get_identifier(\n\t record,\n\t &value_64bit,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to retrieve identifier.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tfprintf(\n\t export_handle->notify_stream,\n\t \"Event number\\t\\t\\t: %\" PRIu64 \"\\n\",\n\t value_64bit );\n\n\tresult = libevtx_record_get_creation_time(\n\t record,\n\t &value_64bit,\n\t error );\n\n\tif( result == -1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to retrieve creation time.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\telse if( result != 0 )\n\t{\n\t\tif( libfdatetime_filetime_copy_from_64bit(\n\t\t filetime,\n\t\t value_64bit,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_SET_FAILED,\n\t\t\t \"%s: unable to copy filetime from 64-bit.\",\n\t\t\t function );\n\n\t\t\tgoto on_error;\n\t\t}\n#if defined( HAVE_WIDE_SYSTEM_CHARACTER )\n\t\tresult = libfdatetime_filetime_copy_to_utf16_string(\n\t\t\t filetime,\n\t\t\t (uint16_t *) filetime_string,\n\t\t\t 48,\n\t\t\t LIBFDATETIME_STRING_FORMAT_TYPE_CTIME | LIBFDATETIME_STRING_FORMAT_FLAG_DATE_TIME_NANO_SECONDS,\n\t\t\t error );\n#else\n\t\tresult = libfdatetime_filetime_copy_to_utf8_string(\n\t\t\t filetime,\n\t\t\t (uint8_t *) filetime_string,\n\t\t\t 48,\n\t\t\t LIBFDATETIME_STRING_FORMAT_TYPE_CTIME | LIBFDATETIME_STRING_FORMAT_FLAG_DATE_TIME_NANO_SECONDS,\n\t\t\t error );\n#endif\n\t\tif( result != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_SET_FAILED,\n\t\t\t \"%s: unable to copy filetime to string.\",\n\t\t\t function );\n\n\t\t\tgoto on_error;\n\t\t}\n\t\tfprintf(\n\t\t export_handle->notify_stream,\n\t\t \"Creation time\\t\\t\\t: %\" PRIs_SYSTEM \" UTC\\n\",\n\t\t filetime_string );\n\t}\n\tif( libevtx_record_get_written_time(\n\t record,\n\t &value_64bit,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to retrieve written time.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tif( libfdatetime_filetime_copy_from_64bit(\n\t filetime,\n\t value_64bit,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_SET_FAILED,\n\t\t \"%s: unable to copy filetime from 64-bit.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n#if defined( HAVE_WIDE_SYSTEM_CHARACTER )\n\tresult = libfdatetime_filetime_copy_to_utf16_string(\n\t\t filetime,\n\t\t (uint16_t *) filetime_string,\n\t\t 48,\n\t\t LIBFDATETIME_STRING_FORMAT_TYPE_CTIME | LIBFDATETIME_STRING_FORMAT_FLAG_DATE_TIME_NANO_SECONDS,\n\t\t error );\n#else\n\tresult = libfdatetime_filetime_copy_to_utf8_string(\n\t\t filetime,\n\t\t (uint8_t *) filetime_string,\n\t\t 48,\n\t\t LIBFDATETIME_STRING_FORMAT_TYPE_CTIME | LIBFDATETIME_STRING_FORMAT_FLAG_DATE_TIME_NANO_SECONDS,\n\t\t error );\n#endif\n\tif( result != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_SET_FAILED,\n\t\t \"%s: unable to copy filetime to string.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tfprintf(\n\t export_handle->notify_stream,\n\t \"Written time\\t\\t\\t: %\" PRIs_SYSTEM \" UTC\\n\",\n\t filetime_string );\n\n\tif( libfdatetime_filetime_free(\n\t &filetime,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED,\n\t\t \"%s: unable to free filetime.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tresult = libevtx_record_get_event_version(\n\t record,\n\t &event_version,\n\t error );\n\n\tif( result == -1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to retrieve event version.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\telse if( result != 0 )\n\t{\n\t\tfprintf(\n\t\t export_handle->notify_stream,\n\t\t \"Event version\\t\\t\\t: %d\\n\",\n\t\t event_version );\n\t}\n\tif( libevtx_record_get_event_level(\n\t record,\n\t &event_level,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to retrieve event level.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tfprintf(\n\t export_handle->notify_stream,\n\t \"Event level\\t\\t\\t: %s (%d)\\n\",\n\t export_handle_get_event_level(\n\t event_level ),\n\t event_level );\n\n#if defined( HAVE_WIDE_SYSTEM_CHARACTER )\n\tresult = libevtx_record_get_utf16_user_security_identifier_size(\n\t record,\n\t &value_string_size,\n\t error );\n#else\n\tresult = libevtx_record_get_utf8_user_security_identifier_size(\n\t record,\n\t &value_string_size,\n\t error );\n#endif\n\tif( result == -1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to retrieve user security identifier size.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tif( ( result != 0 )\n\t && ( value_string_size > 0 ) )\n\t{\n\t\tvalue_string = system_string_allocate(\n\t\t value_string_size );\n\n\t\tif( value_string == NULL )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_MEMORY,\n\t\t\t LIBCERROR_MEMORY_ERROR_INSUFFICIENT,\n\t\t\t \"%s: unable to create value string.\",\n\t\t\t function );\n\n\t\t\tgoto on_error;\n\t\t}\n#if defined( HAVE_WIDE_SYSTEM_CHARACTER )\n\t\tresult = libevtx_record_get_utf16_user_security_identifier(\n\t\t record,\n\t\t (uint16_t *) value_string,\n\t\t value_string_size,\n\t\t error );\n#else\n\t\tresult = libevtx_record_get_utf8_user_security_identifier(\n\t\t record,\n\t\t (uint8_t *) value_string,\n\t\t value_string_size,\n\t\t error );\n#endif\n\t\tif( result != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve user security identifier.\",\n\t\t\t function );\n\n\t\t\tgoto on_error;\n\t\t}\n\t\tfprintf(\n\t\t export_handle->notify_stream,\n\t\t \"User security identifier\\t: %\" PRIs_SYSTEM \"\\n\",\n\t\t value_string );\n\n\t\tmemory_free(\n\t\t value_string );\n\n\t\tvalue_string = NULL;\n\t}\n#if defined( HAVE_WIDE_SYSTEM_CHARACTER )\n\tresult = libevtx_record_get_utf16_computer_name_size(\n\t record,\n\t &value_string_size,\n\t error );\n#else\n\tresult = libevtx_record_get_utf8_computer_name_size(\n\t record,\n\t &value_string_size,\n\t error );\n#endif\n\tif( result == -1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to retrieve computer name size.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tif( ( result != 0 )\n\t && ( value_string_size > 0 ) )\n\t{\n\t\tvalue_string = system_string_allocate(\n\t\t value_string_size );\n\n\t\tif( value_string == NULL )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_MEMORY,\n\t\t\t LIBCERROR_MEMORY_ERROR_INSUFFICIENT,\n\t\t\t \"%s: unable to create value string.\",\n\t\t\t function );\n\n\t\t\tgoto on_error;\n\t\t}\n#if defined( HAVE_WIDE_SYSTEM_CHARACTER )\n\t\tresult = libevtx_record_get_utf16_computer_name(\n\t\t record,\n\t\t (uint16_t *) value_string,\n\t\t value_string_size,\n\t\t error );\n#else\n\t\tresult = libevtx_record_get_utf8_computer_name(\n\t\t record,\n\t\t (uint8_t *) value_string,\n\t\t value_string_size,\n\t\t error );\n#endif\n\t\tif( result != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve computer name.\",\n\t\t\t function );\n\n\t\t\tgoto on_error;\n\t\t}\n\t\tfprintf(\n\t\t export_handle->notify_stream,\n\t\t \"Computer name\\t\\t\\t: %\" PRIs_SYSTEM \"\\n\",\n\t\t value_string );\n\n\t\tmemory_free(\n\t\t value_string );\n\n\t\tvalue_string = NULL;\n\t}\n#if defined( HAVE_WIDE_SYSTEM_CHARACTER )\n\tresult = libevtx_record_get_utf16_provider_identifier_size(\n\t record,\n\t &provider_identifier_size,\n\t error );\n#else\n\tresult = libevtx_record_get_utf8_provider_identifier_size(\n\t record,\n\t &provider_identifier_size,\n\t error );\n#endif\n\tif( result == -1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to retrieve provider identifier size.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tif( ( result != 0 )\n\t && ( provider_identifier_size > 0 ) )\n\t{\n\t\tprovider_identifier = system_string_allocate(\n\t\t provider_identifier_size );\n\n\t\tif( provider_identifier == NULL )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_MEMORY,\n\t\t\t LIBCERROR_MEMORY_ERROR_INSUFFICIENT,\n\t\t\t \"%s: unable to create event source.\",\n\t\t\t function );\n\n\t\t\tgoto on_error;\n\t\t}\n#if defined( HAVE_WIDE_SYSTEM_CHARACTER )\n\t\tresult = libevtx_record_get_utf16_provider_identifier(\n\t\t record,\n\t\t (uint16_t *) provider_identifier,\n\t\t provider_identifier_size,\n\t\t error );\n#else\n\t\tresult = libevtx_record_get_utf8_provider_identifier(\n\t\t record,\n\t\t (uint8_t *) provider_identifier,\n\t\t provider_identifier_size,\n\t\t error );\n#endif\n\t\tif( result != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve provider identifier.\",\n\t\t\t function );\n\n\t\t\tgoto on_error;\n\t\t}\n\t\tif( export_handle->verbose != 0 )\n\t\t{\n\t\t\tfprintf(\n\t\t\t export_handle->notify_stream,\n\t\t\t \"Provider identifier\\t\\t: %\" PRIs_SYSTEM \"\\n\",\n\t\t\t provider_identifier );\n\t\t}\n\t}\n#if defined( HAVE_WIDE_SYSTEM_CHARACTER )\n\tresult = libevtx_record_get_utf16_source_name_size(\n\t record,\n\t &source_name_size,\n\t error );\n#else\n\tresult = libevtx_record_get_utf8_source_name_size(\n\t record,\n\t &source_name_size,\n\t error );\n#endif\n\tif( result == -1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to retrieve source name size.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tif( ( result != 0 )\n\t && ( source_name_size > 0 ) )\n\t{\n\t\tsource_name = system_string_allocate(\n\t\t source_name_size );\n\n\t\tif( source_name == NULL )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_MEMORY,\n\t\t\t LIBCERROR_MEMORY_ERROR_INSUFFICIENT,\n\t\t\t \"%s: unable to create event source.\",\n\t\t\t function );\n\n\t\t\tgoto on_error;\n\t\t}\n#if defined( HAVE_WIDE_SYSTEM_CHARACTER )\n\t\tresult = libevtx_record_get_utf16_source_name(\n\t\t record,\n\t\t (uint16_t *) source_name,\n\t\t source_name_size,\n\t\t error );\n#else\n\t\tresult = libevtx_record_get_utf8_source_name(\n\t\t record,\n\t\t (uint8_t *) source_name,\n\t\t source_name_size,\n\t\t error );\n#endif\n\t\tif( result != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve source name.\",\n\t\t\t function );\n\n\t\t\tgoto on_error;\n\t\t}\n\t\tfprintf(\n\t\t export_handle->notify_stream,\n\t\t \"Source name\\t\\t\\t: %\" PRIs_SYSTEM \"\\n\",\n\t\t source_name );\n\t}\n#if defined( HAVE_WIDE_SYSTEM_CHARACTER )\n\tresult = libevtx_record_get_utf16_channel_name_size(\n\t record,\n\t &value_string_size,\n\t error );\n#else\n\tresult = libevtx_record_get_utf8_channel_name_size(\n\t record,\n\t &value_string_size,\n\t error );\n#endif\n\tif( result == -1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to retrieve channel name size.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tif( ( result != 0 )\n\t && ( value_string_size > 0 ) )\n\t{\n\t\tvalue_string = system_string_allocate(\n\t\t value_string_size );\n\n\t\tif( value_string == NULL )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_MEMORY,\n\t\t\t LIBCERROR_MEMORY_ERROR_INSUFFICIENT,\n\t\t\t \"%s: unable to create value string.\",\n\t\t\t function );\n\n\t\t\tgoto on_error;\n\t\t}\n#if defined( HAVE_WIDE_SYSTEM_CHARACTER )\n\t\tresult = libevtx_record_get_utf16_channel_name(\n\t\t record,\n\t\t (uint16_t *) value_string,\n\t\t value_string_size,\n\t\t error );\n#else\n\t\tresult = libevtx_record_get_utf8_channel_name(\n\t\t record,\n\t\t (uint8_t *) value_string,\n\t\t value_string_size,\n\t\t error );\n#endif\n\t\tif( result != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve channel name.\",\n\t\t\t function );\n\n\t\t\tgoto on_error;\n\t\t}\n\t\tfprintf(\n\t\t export_handle->notify_stream,\n\t\t \"Channel name\\t\\t\\t: %\" PRIs_SYSTEM \"\\n\",\n\t\t value_string );\n\n\t\tmemory_free(\n\t\t value_string );\n\n\t\tvalue_string = NULL;\n\t}\n/* TODO category ? */\n\n\tif( libevtx_record_get_event_identifier(\n\t record,\n\t &event_identifier,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to retrieve event identifier.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tfprintf(\n\t export_handle->notify_stream,\n\t \"Event identifier\\t\\t: 0x%08\" PRIx32 \" (%\" PRIu32 \")\\n\",\n\t event_identifier,\n\t event_identifier );\n\n\tif( export_handle_export_record_event_message(\n\t export_handle,\n\t record,\n\t provider_identifier,\n\t provider_identifier_size - 1,\n\t source_name,\n\t source_name_size - 1,\n\t event_identifier,\n\t log_handle,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GENERIC,\n\t\t \"%s: unable to export event message.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tfprintf(\n\t export_handle->notify_stream,\n\t \"\\n\" );\n\n\tif( provider_identifier != NULL )\n\t{\n\t\tmemory_free(\n\t\t provider_identifier );\n\n\t\tprovider_identifier = NULL;\n\t}\n\tif( source_name != NULL )\n\t{\n\t\tmemory_free(\n\t\t source_name );\n\n\t\tsource_name = NULL;\n\t}\n\treturn( 1 );\n\non_error:\n\tif( provider_identifier != NULL )\n\t{\n\t\tmemory_free(\n\t\t provider_identifier );\n\t}\n\tif( source_name != NULL )\n\t{\n\t\tmemory_free(\n\t\t source_name );\n\t}\n\tif( value_string != NULL )\n\t{\n\t\tmemory_free(\n\t\t value_string );\n\t}\n\tif( filetime != NULL )\n\t{\n\t\tlibfdatetime_filetime_free(\n\t\t &filetime,\n\t\t NULL );\n\t}\n\treturn( -1 );\n}\n\n/* Exports the record in the XML format\n * Returns 1 if successful or -1 on error\n */\nint export_handle_export_record_xml(\n export_handle_t *export_handle,\n libevtx_record_t *record,\n log_handle_t *log_handle,\n libcerror_error_t **error )\n{\n\tsystem_character_t *event_xml = NULL;\n\tstatic char *function = \"export_handle_export_record_xml\";\n\tsize_t event_xml_size = 0;\n\n\tif( export_handle == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid export handle.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( record == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid record.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n#if defined( HAVE_WIDE_SYSTEM_CHARACTER )\n\tif( libevtx_record_get_utf16_xml_string_size(\n\t record,\n\t &event_xml_size,\n\t error ) != 1 )\n#else\n\tif( libevtx_record_get_utf8_xml_string_size(\n\t record,\n\t &event_xml_size,\n\t error ) != 1 )\n#endif\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to retrieve event XML size.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tif( event_xml_size > 0 )\n\t{\n\t\tevent_xml = system_string_allocate(\n\t\t event_xml_size );\n\n\t\tif( event_xml == NULL )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_MEMORY,\n\t\t\t LIBCERROR_MEMORY_ERROR_INSUFFICIENT,\n\t\t\t \"%s: unable to create event XML.\",\n\t\t\t function );\n\n\t\t\tgoto on_error;\n\t\t}\n#if defined( HAVE_WIDE_SYSTEM_CHARACTER )\n\t\tif( libevtx_record_get_utf16_xml_string(\n\t\t record,\n\t\t (uint16_t *) event_xml,\n\t\t event_xml_size,\n\t\t error ) != 1 )\n#else\n\t\tif( libevtx_record_get_utf8_xml_string(\n\t\t record,\n\t\t (uint8_t *) event_xml,\n\t\t event_xml_size,\n\t\t error ) != 1 )\n#endif\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve event XML.\",\n\t\t\t function );\n\n\t\t\tgoto on_error;\n\t\t}\n\t\t/* Note that the event XML ends with a new line\n\t\t */\n\t\tfprintf(\n\t\t export_handle->notify_stream,\n\t\t \"%\" PRIs_SYSTEM \"\",\n\t\t event_xml );\n\n\t\tmemory_free(\n\t\t event_xml );\n\n\t\tevent_xml = NULL;\n\t}\n\tfprintf(\n\t export_handle->notify_stream,\n\t \"\\n\" );\n\n\treturn( 1 );\n\non_error:\n\tif( event_xml != NULL )\n\t{\n\t\tmemory_free(\n\t\t event_xml );\n\t}\n\treturn( -1 );\n}\n\n/* Exports the records\n * Returns the 1 if succesful, 0 if no records are available or -1 on error\n */\nint export_handle_export_records(\n export_handle_t *export_handle,\n libevtx_file_t *file,\n log_handle_t *log_handle,\n libcerror_error_t **error )\n{\n\tlibevtx_record_t *record = NULL;\n\tstatic char *function = \"export_handle_export_records\";\n\tint number_of_records = 0;\n\tint record_index = 0;\n\n\tif( export_handle == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid export handle.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( file == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid file.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( libevtx_file_get_number_of_records(\n\t file,\n\t &number_of_records,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to retrieve number of records.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( number_of_records == 0 )\n\t{\n\t\treturn( 0 );\n\t}\n\tfor( record_index = 0;\n\t record_index < number_of_records;\n\t record_index++ )\n\t{\n\t\tif( export_handle->abort != 0 )\n\t\t{\n\t\t\treturn( -1 );\n\t\t}\n\t\tif( libevtx_file_get_record_by_index(\n\t\t file,\n\t\t record_index,\n\t\t &record,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve record: %d.\",\n\t\t\t function,\n\t\t\t record_index );\n\n\t\t\t/* Be error tollerant for corrupt records in dirty files\n\t\t\t */\n#if defined( HAVE_DEBUG_OUTPUT )\n\t\t\tif( ( error != NULL )\n\t\t\t && ( *error != NULL ) )\n\t\t\t{\n\t\t\t\tlibcnotify_print_error_backtrace(\n\t\t\t\t *error );\n\t\t\t}\n#endif\n\t\t\tlibcerror_error_free(\n\t\t\t error );\n\t\t}\n\t\telse if( export_handle_export_record(\n\t\t export_handle,\n\t\t record,\n\t\t log_handle,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tfprintf(\n\t\t\t export_handle->notify_stream,\n\t\t\t \"Unable to export record: %d.\\n\\n\",\n\t\t\t record_index );\n\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GENERIC,\n\t\t\t \"%s: unable to export record: %d.\",\n\t\t\t function,\n\t\t\t record_index );\n\n#if defined( HAVE_DEBUG_OUTPUT )\n\t\t\tif( ( error != NULL )\n\t\t\t && ( *error != NULL ) )\n\t\t\t{\n\t\t\t\tlibcnotify_print_error_backtrace(\n\t\t\t\t *error );\n\t\t\t}\n#endif\n\t\t\tlibcerror_error_free(\n\t\t\t error );\n\t\t}\n\t\tif( libevtx_record_free(\n\t\t &record,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED,\n\t\t\t \"%s: unable to free record: %d.\",\n\t\t\t function,\n\t\t\t record_index );\n\n\t\t\treturn( -1 );\n\t\t}\n\t}\n\treturn( 1 );\n}\n\n/* Exports the recovered records\n * Returns the 1 if succesful, 0 if no records are available or -1 on error\n */\nint export_handle_export_recovered_records(\n export_handle_t *export_handle,\n libevtx_file_t *file,\n log_handle_t *log_handle,\n libcerror_error_t **error )\n{\n\tlibevtx_record_t *record = NULL;\n\tstatic char *function = \"export_handle_export_recovered_records\";\n\tint number_of_records = 0;\n\tint record_index = 0;\n\n\tif( export_handle == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid export handle.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( file == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid file.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( libevtx_file_get_number_of_recovered_records(\n\t file,\n\t &number_of_records,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to retrieve number of recovered records.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( number_of_records == 0 )\n\t{\n\t\treturn( 0 );\n\t}\n\tfor( record_index = 0;\n\t record_index < number_of_records;\n\t record_index++ )\n\t{\n\t\tif( export_handle->abort != 0 )\n\t\t{\n\t\t\treturn( -1 );\n\t\t}\n\t\tif( libevtx_file_get_recovered_record_by_index(\n\t\t file,\n\t\t record_index,\n\t\t &record,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve recovered record: %d.\",\n\t\t\t function,\n\t\t\t record_index );\n\n#if defined( HAVE_DEBUG_OUTPUT )\n\t\t\tif( ( error != NULL )\n\t\t\t && ( *error != NULL ) )\n\t\t\t{\n\t\t\t\tlibcnotify_print_error_backtrace(\n\t\t\t\t *error );\n\t\t\t}\n#endif\n\t\t\tlibcerror_error_free(\n\t\t\t error );\n\t\t}\n\t\telse if( export_handle_export_record(\n\t\t export_handle,\n\t\t record,\n\t\t log_handle,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tfprintf(\n\t\t\t export_handle->notify_stream,\n\t\t\t \"Unable to export recovered record: %d.\\n\\n\",\n\t\t\t record_index );\n\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GENERIC,\n\t\t\t \"%s: unable to export recovered record: %d.\",\n\t\t\t function,\n\t\t\t record_index );\n\n#if defined( HAVE_DEBUG_OUTPUT )\n\t\t\tif( ( error != NULL )\n\t\t\t && ( *error != NULL ) )\n\t\t\t{\n\t\t\t\tlibcnotify_print_error_backtrace(\n\t\t\t\t *error );\n\t\t\t}\n#endif\n\t\t\tlibcerror_error_free(\n\t\t\t error );\n\t\t}\n\t\tif( libevtx_record_free(\n\t\t &record,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED,\n\t\t\t \"%s: unable to free record: %d.\",\n\t\t\t function,\n\t\t\t record_index );\n\n\t\t\treturn( -1 );\n\t\t}\n\t}\n\treturn( 1 );\n}\n\n/* Exports the records from the file\n * Returns the 1 if succesful, 0 if no records are available or -1 on error\n */\nint export_handle_export_file(\n export_handle_t *export_handle,\n log_handle_t *log_handle,\n libcerror_error_t **error )\n{\n\tstatic char *function = \"export_handle_export_file\";\n\tint result_recovered_records = 0;\n\tint result_records = 0;\n\n\tif( export_handle == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid export handle.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( export_handle->export_mode != EXPORT_MODE_RECOVERED )\n\t{\n\t\tresult_records = export_handle_export_records(\n\t\t\t\t export_handle,\n\t\t\t\t export_handle->input_file,\n\t\t\t\t log_handle,\n\t\t\t\t error );\n\n\t\tif( result_records == -1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GENERIC,\n\t\t\t \"%s: unable to export records.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t}\n\tif( export_handle->export_mode != EXPORT_MODE_ITEMS )\n\t{\n\t\tresult_recovered_records = export_handle_export_recovered_records(\n\t\t\t\t\t export_handle,\n\t\t\t\t\t export_handle->input_file,\n\t\t\t\t\t log_handle,\n\t\t\t\t\t error );\n\n\t\tif( result_recovered_records == -1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GENERIC,\n\t\t\t \"%s: unable to export recovered records.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t}\n\tif( ( result_records != 0 )\n\t || ( result_recovered_records != 0 ) )\n\t{\n\t\treturn( 1 );\n\t}\n\treturn( 0 );\n}\n\n" }, { "path": "evtxtools/export_handle.h", "content": "/*\n * Export handle\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#if !defined( _EXPORT_HANDLE_H )\n#define _EXPORT_HANDLE_H\n\n#include \n#include \n#include \n\n#include \"evtxtools_libcerror.h\"\n#include \"evtxtools_libevtx.h\"\n#include \"log_handle.h\"\n#include \"message_handle.h\"\n#include \"message_string.h\"\n#include \"resource_file.h\"\n\n#if defined( __cplusplus )\nextern \"C\" {\n#endif\n\nenum EXPORT_MODES\n{\n\tEXPORT_MODE_ALL\t\t\t\t= (int) 'a',\n\tEXPORT_MODE_ITEMS\t\t\t= (int) 'i',\n\tEXPORT_MODE_RECOVERED\t\t\t= (int) 'r'\n};\n\nenum EXPORT_FORMATS\n{\n\tEXPORT_FORMAT_TEXT\t\t\t= (int) 't',\n\tEXPORT_FORMAT_XML\t\t\t= (int) 'x'\n};\n\ntypedef struct export_handle export_handle_t;\n\nstruct export_handle\n{\n\t/* The export mode\n\t */\n\tuint8_t export_mode;\n\n\t/* The export format\n\t */\n\tuint8_t export_format;\n\n\t/* The libevtx input file\n\t */\n\tlibevtx_file_t *input_file;\n\n\t/* The message handle\n\t */\n\tmessage_handle_t *message_handle;\n\n\t/* The event log type\n\t */\n\tint event_log_type;\n\n\t/* Value to indicate to use a template definition to parse event data\n\t */\n\tint use_template_definition;\n\n\t/* Value to indicate the input is open\n\t */\n\tint input_is_open;\n\n\t/* The ascii codepage\n\t */\n\tint ascii_codepage;\n\n\t/* The notification output stream\n\t */\n\tFILE *notify_stream;\n\n\t/* Value to indicate if abort was signalled\n\t */\n\tint abort;\n\n\t/* Value to indicate if the output should be verbose\n\t */\n\tint verbose;\n};\n\nconst char *export_handle_get_event_log_key_name(\n int event_log_type );\n\nconst char *export_handle_get_event_level(\n uint8_t event_level );\n\nint export_handle_initialize(\n export_handle_t **export_handle,\n libcerror_error_t **error );\n\nint export_handle_free(\n export_handle_t **export_handle,\n libcerror_error_t **error );\n\nint export_handle_signal_abort(\n export_handle_t *export_handle,\n libcerror_error_t **error );\n\nint export_handle_set_export_mode(\n export_handle_t *export_handle,\n const system_character_t *string,\n libcerror_error_t **error );\n\nint export_handle_set_export_format(\n export_handle_t *export_handle,\n const system_character_t *string,\n libcerror_error_t **error );\n\nint export_handle_set_ascii_codepage(\n export_handle_t *export_handle,\n const system_character_t *string,\n libcerror_error_t **error );\n\nint export_handle_set_preferred_language_identifier(\n export_handle_t *export_handle,\n uint32_t preferred_language_identifier,\n libcerror_error_t **error );\n\nint export_handle_set_event_log_type(\n export_handle_t *export_handle,\n const system_character_t *string,\n libcerror_error_t **error );\n\nint export_handle_set_event_log_type_from_filename(\n export_handle_t *export_handle,\n const system_character_t *filename,\n libcerror_error_t **error );\n\nint export_handle_set_software_registry_filename(\n export_handle_t *export_handle,\n const system_character_t *filename,\n libcerror_error_t **error );\n\nint export_handle_set_system_registry_filename(\n export_handle_t *export_handle,\n const system_character_t *filename,\n libcerror_error_t **error );\n\nint export_handle_set_registry_directory_name(\n export_handle_t *export_handle,\n const system_character_t *name,\n libcerror_error_t **error );\n\nint export_handle_set_resource_files_path(\n export_handle_t *export_handle,\n const system_character_t *path,\n libcerror_error_t **error );\n\nint export_handle_open_input(\n export_handle_t *export_handle,\n const system_character_t *filename,\n libcerror_error_t **error );\n\nint export_handle_close_input(\n export_handle_t *export_handle,\n libcerror_error_t **error );\n\n/* Record specific export functions\n */\nint export_handle_guid_string_copy_to_byte_stream(\n export_handle_t *export_handle,\n const system_character_t *string,\n size_t string_length,\n uint8_t *byte_stream,\n size_t byte_stream_size,\n libcerror_error_t **error );\n\nint export_handle_resource_file_get_template_definition(\n export_handle_t *export_handle,\n resource_file_t *resource_file,\n const uint8_t *provider_identifier,\n size_t provider_identifier_size,\n uint32_t event_identifier,\n libevtx_template_definition_t **template_definition,\n libcerror_error_t **error );\n\nint export_handle_message_string_fprint(\n export_handle_t *export_handle,\n message_string_t *message_string,\n libevtx_record_t *record,\n libcerror_error_t **error );\n\nint export_handle_export_record_event_message(\n export_handle_t *export_handle,\n libevtx_record_t *record,\n const system_character_t *event_provider_identifier,\n size_t event_provider_identifier_length,\n const system_character_t *event_source,\n size_t event_source_length,\n uint32_t event_identifier,\n log_handle_t *log_handle,\n libcerror_error_t **error );\n\nint export_handle_export_record(\n export_handle_t *export_handle,\n libevtx_record_t *record,\n log_handle_t *log_handle,\n libcerror_error_t **error );\n\nint export_handle_export_record_text(\n export_handle_t *export_handle,\n libevtx_record_t *record,\n log_handle_t *log_handle,\n libcerror_error_t **error );\n\nint export_handle_export_record_xml(\n export_handle_t *export_handle,\n libevtx_record_t *record,\n log_handle_t *log_handle,\n libcerror_error_t **error );\n\n/* File export functions\n */\nint export_handle_export_records(\n export_handle_t *export_handle,\n libevtx_file_t *file,\n log_handle_t *log_handle,\n libcerror_error_t **error );\n\nint export_handle_export_recovered_records(\n export_handle_t *export_handle,\n libevtx_file_t *file,\n log_handle_t *log_handle,\n libcerror_error_t **error );\n\nint export_handle_export_file(\n export_handle_t *export_handle,\n log_handle_t *log_handle,\n libcerror_error_t **error );\n\n#if defined( __cplusplus )\n}\n#endif\n\n#endif /* !defined( _EXPORT_HANDLE_H ) */\n\n" }, { "path": "evtxtools/info_handle.c", "content": "/*\n * Info handle\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#include \n#include \n#include \n#include \n#include \n#include \n#include \n\n#include \"evtxinput.h\"\n#include \"evtxtools_libcerror.h\"\n#include \"evtxtools_libclocale.h\"\n#include \"evtxtools_libfdatetime.h\"\n#include \"evtxtools_libevtx.h\"\n#include \"info_handle.h\"\n\n#define INFO_HANDLE_NOTIFY_STREAM\tstdout\n\n/* Creates an info handle\n * Make sure the value info_handle is referencing, is set to NULL\n * Returns 1 if successful or -1 on error\n */\nint info_handle_initialize(\n info_handle_t **info_handle,\n libcerror_error_t **error )\n{\n\tstatic char *function = \"info_handle_initialize\";\n\n\tif( info_handle == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid info handle.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( *info_handle != NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_VALUE_ALREADY_SET,\n\t\t \"%s: invalid info handle value already set.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\t*info_handle = memory_allocate_structure(\n\t info_handle_t );\n\n\tif( *info_handle == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_MEMORY,\n\t\t LIBCERROR_MEMORY_ERROR_INSUFFICIENT,\n\t\t \"%s: unable to create info handle.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tif( memory_set(\n\t *info_handle,\n\t 0,\n\t sizeof( info_handle_t ) ) == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_MEMORY,\n\t\t LIBCERROR_MEMORY_ERROR_SET_FAILED,\n\t\t \"%s: unable to clear info handle.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tif( libevtx_file_initialize(\n\t &( ( *info_handle )->input_file ),\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_INITIALIZE_FAILED,\n\t\t \"%s: unable to initialize input file.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\t( *info_handle )->ascii_codepage = LIBEVTX_CODEPAGE_WINDOWS_1252;\n\t( *info_handle )->notify_stream = INFO_HANDLE_NOTIFY_STREAM;\n\n\treturn( 1 );\n\non_error:\n\tif( *info_handle != NULL )\n\t{\n\t\tmemory_free(\n\t\t *info_handle );\n\n\t\t*info_handle = NULL;\n\t}\n\treturn( -1 );\n}\n\n/* Frees an info handle\n * Returns 1 if successful or -1 on error\n */\nint info_handle_free(\n info_handle_t **info_handle,\n libcerror_error_t **error )\n{\n\tstatic char *function = \"info_handle_free\";\n\tint result = 1;\n\n\tif( info_handle == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid info handle.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( *info_handle != NULL )\n\t{\n\t\tif( ( *info_handle )->input_file != NULL )\n\t\t{\n\t\t\tif( libevtx_file_free(\n\t\t\t &( ( *info_handle )->input_file ),\n\t\t\t error ) != 1 )\n\t\t\t{\n\t\t\t\tlibcerror_error_set(\n\t\t\t\t error,\n\t\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t\t LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED,\n\t\t\t\t \"%s: unable to free input file.\",\n\t\t\t\t function );\n\n\t\t\t\tresult = -1;\n\t\t\t}\n\t\t}\n\t\tmemory_free(\n\t\t *info_handle );\n\n\t\t*info_handle = NULL;\n\t}\n\treturn( result );\n}\n\n/* Signals the info handle to abort\n * Returns 1 if successful or -1 on error\n */\nint info_handle_signal_abort(\n info_handle_t *info_handle,\n libcerror_error_t **error )\n{\n\tstatic char *function = \"info_handle_signal_abort\";\n\n\tif( info_handle == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid info handle.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tinfo_handle->abort = 1;\n\n\tif( info_handle->input_file != NULL )\n\t{\n\t\tif( libevtx_file_signal_abort(\n\t\t info_handle->input_file,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_SET_FAILED,\n\t\t\t \"%s: unable to signal input file to abort.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t}\n\treturn( 1 );\n}\n\n/* Sets the ascii codepage\n * Returns 1 if successful or -1 on error\n */\nint info_handle_set_ascii_codepage(\n info_handle_t *info_handle,\n const system_character_t *string,\n libcerror_error_t **error )\n{\n\tstatic char *function = \"info_handle_set_ascii_codepage\";\n\tsize_t string_length = 0;\n\tuint32_t feature_flags = 0;\n\tint result = 0;\n\n\tif( info_handle == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid info handle.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tfeature_flags = LIBCLOCALE_CODEPAGE_FEATURE_FLAG_HAVE_KOI8\n\t | LIBCLOCALE_CODEPAGE_FEATURE_FLAG_HAVE_WINDOWS;\n\n\tstring_length = system_string_length(\n\t string );\n\n#if defined( HAVE_WIDE_SYSTEM_CHARACTER )\n\tresult = libclocale_codepage_copy_from_string_wide(\n\t &( info_handle->ascii_codepage ),\n\t string,\n\t string_length,\n\t feature_flags,\n\t error );\n#else\n\tresult = libclocale_codepage_copy_from_string(\n\t &( info_handle->ascii_codepage ),\n\t string,\n\t string_length,\n\t feature_flags,\n\t error );\n#endif\n\tif( result == -1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to determine ASCII codepage.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\treturn( result );\n}\n\n/* Sets the event log type from the filename\n * Returns 1 if successful or -1 on error\n */\nint info_handle_set_event_log_type_from_filename(\n info_handle_t *info_handle,\n const system_character_t *filename,\n libcerror_error_t **error )\n{\n\tstatic char *function = \"info_handle_set_event_log_type_from_filename\";\n\tint result = 0;\n\n\tif( info_handle == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid info handle.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tresult = evtxinput_determine_event_log_type_from_filename(\n\t filename,\n\t &( info_handle->event_log_type ),\n\t error );\n\n\tif( result == -1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to determine event log type from filename.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\treturn( result );\n}\n\n/* Opens the info handle\n * Returns 1 if successful or -1 on error\n */\nint info_handle_open(\n info_handle_t *info_handle,\n const system_character_t *filename,\n libcerror_error_t **error )\n{\n\tstatic char *function = \"info_handle_open\";\n\n\tif( info_handle == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid info handle.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( libevtx_file_set_ascii_codepage(\n\t info_handle->input_file,\n\t info_handle->ascii_codepage,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_SET_FAILED,\n\t\t \"%s: unable to set ASCII codepage in input file.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n#if defined( HAVE_WIDE_SYSTEM_CHARACTER )\n\tif( libevtx_file_open_wide(\n\t info_handle->input_file,\n\t filename,\n\t LIBEVTX_OPEN_READ,\n\t error ) != 1 )\n#else\n\tif( libevtx_file_open(\n\t info_handle->input_file,\n\t filename,\n\t LIBEVTX_OPEN_READ,\n\t error ) != 1 )\n#endif\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_IO,\n\t\t LIBCERROR_IO_ERROR_OPEN_FAILED,\n\t\t \"%s: unable to open input file.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\treturn( 1 );\n}\n\n/* Closes the info handle\n * Returns the 0 if succesful or -1 on error\n */\nint info_handle_close(\n info_handle_t *info_handle,\n libcerror_error_t **error )\n{\n\tstatic char *function = \"info_handle_close\";\n\n\tif( info_handle == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid info handle.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( libevtx_file_close(\n\t info_handle->input_file,\n\t error ) != 0 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_IO,\n\t\t LIBCERROR_IO_ERROR_CLOSE_FAILED,\n\t\t \"%s: unable to close input file.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\treturn( 0 );\n}\n\n/* Prints the file information to a stream\n * Returns 1 if successful or -1 on error\n */\nint info_handle_file_fprint(\n info_handle_t *info_handle,\n libcerror_error_t **error )\n{\n\tconst system_character_t *event_log_type = NULL;\n\tstatic char *function = \"evtxinfo_file_info_fprint\";\n\tuint32_t flags = 0;\n\tuint16_t major_version = 0;\n\tuint16_t minor_version = 0;\n\tint is_corrupted = 0;\n\tint number_of_recovered_records = 0;\n\tint number_of_records = 0;\n\n\tif( info_handle == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid info handle.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( libevtx_file_get_format_version(\n\t info_handle->input_file,\n\t &major_version,\n\t &minor_version,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to retrieve format version.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( libevtx_file_get_flags(\n\t info_handle->input_file,\n\t &flags,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to retrieve flags.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tis_corrupted = libevtx_file_is_corrupted(\n\t info_handle->input_file,\n\t error );\n\n\tif( is_corrupted == -1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to determine if file is corrupted.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( libevtx_file_get_number_of_records(\n\t info_handle->input_file,\n\t &number_of_records,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to retrieve number of records.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( libevtx_file_get_number_of_recovered_records(\n\t info_handle->input_file,\n\t &number_of_recovered_records,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to retrieve number of recovered records.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tfprintf(\n\t info_handle->notify_stream,\n\t \"Windows Event Viewer Log (EVTX) information:\\n\" );\n\n\tfprintf(\n\t info_handle->notify_stream,\n\t \"\\tVersion\\t\\t\\t\\t: %\" PRIu32 \".%\" PRIu32 \"\\n\",\n\t major_version,\n\t minor_version );\n\n\tfprintf(\n\t info_handle->notify_stream,\n\t \"\\tNumber of records\\t\\t: %d\\n\",\n\t number_of_records );\n\n\tfprintf(\n\t info_handle->notify_stream,\n\t \"\\tNumber of recovered records\\t: %d\\n\",\n\t number_of_recovered_records );\n\n\tswitch( info_handle->event_log_type )\n\t{\n\t\tcase EVTXTOOLS_EVENT_LOG_TYPE_APPLICATION:\n\t\t\tevent_log_type = _SYSTEM_STRING( \"Application\" );\n\t\t\tbreak;\n\n\t\tcase EVTXTOOLS_EVENT_LOG_TYPE_DFS_REPLICATION:\n\t\t\tevent_log_type = _SYSTEM_STRING( \"DFS Replication\" );\n\t\t\tbreak;\n\n\t\tcase EVTXTOOLS_EVENT_LOG_TYPE_HARDWARE_EVENTS:\n\t\t\tevent_log_type = _SYSTEM_STRING( \"Hardware Events\" );\n\t\t\tbreak;\n\n\t\tcase EVTXTOOLS_EVENT_LOG_TYPE_INTERNET_EXPLORER:\n\t\t\tevent_log_type = _SYSTEM_STRING( \"Internet Explorer\" );\n\t\t\tbreak;\n\n\t\tcase EVTXTOOLS_EVENT_LOG_TYPE_KEY_MANAGEMENT_SERVICE:\n\t\t\tevent_log_type = _SYSTEM_STRING( \"Key Management Service\" );\n\t\t\tbreak;\n\n\t\tcase EVTXTOOLS_EVENT_LOG_TYPE_MEDIA_CENTER:\n\t\t\tevent_log_type = _SYSTEM_STRING( \"Media Center\" );\n\t\t\tbreak;\n\n\t\tcase EVTXTOOLS_EVENT_LOG_TYPE_SECURITY:\n\t\t\tevent_log_type = _SYSTEM_STRING( \"Security\" );\n\t\t\tbreak;\n\n\t\tcase EVTXTOOLS_EVENT_LOG_TYPE_SYSTEM:\n\t\t\tevent_log_type = _SYSTEM_STRING( \"System\" );\n\t\t\tbreak;\n\t}\n\tif( event_log_type != NULL )\n\t{\n\t\tfprintf(\n\t\t info_handle->notify_stream,\n\t\t \"\\tLog type\\t\\t\\t: %\" PRIs_SYSTEM \"\\n\",\n\t\t event_log_type );\n\t}\n\tif( is_corrupted != 0 )\n\t{\n\t\tfprintf(\n\t\t info_handle->notify_stream,\n\t\t \"\\tIs corrupted\\n\" );\n\t}\n\tif( flags != 0 )\n\t{\n\t\tfprintf(\n\t\t info_handle->notify_stream,\n\t\t \"\\tFlags:\\n\" );\n\n\t\tif( ( flags & LIBEVTX_FILE_FLAG_IS_DIRTY ) != 0 )\n\t\t{\n\t\t\tfprintf(\n\t\t\t info_handle->notify_stream,\n\t\t\t \"\\t\\tIs dirty\\n\" );\n\t\t}\n\t\tif( ( flags & LIBEVTX_FILE_FLAG_IS_FULL ) != 0 )\n\t\t{\n\t\t\tfprintf(\n\t\t\t info_handle->notify_stream,\n\t\t\t \"\\t\\tIs full\\n\" );\n\t\t}\n\t}\n\tfprintf(\n\t info_handle->notify_stream,\n\t \"\\n\" );\n\n\treturn( 1 );\n}\n\n" }, { "path": "evtxtools/info_handle.h", "content": "/*\n * Info handle\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#if !defined( _INFO_HANDLE_H )\n#define _INFO_HANDLE_H\n\n#include \n#include \n#include \n\n#include \"evtxtools_libevtx.h\"\n#include \"evtxtools_libcerror.h\"\n\n#if defined( __cplusplus )\nextern \"C\" {\n#endif\n\ntypedef struct info_handle info_handle_t;\n\nstruct info_handle\n{\n\t/* The libevtx input file\n\t */\n\tlibevtx_file_t *input_file;\n\n\t/* The event log type\n\t */\n\tint event_log_type;\n\n\t/* The ascii codepage\n\t */\n\tint ascii_codepage;\n\n\t/* The notification output stream\n\t */\n\tFILE *notify_stream;\n\n\t/* Value to indicate if abort was signalled\n\t */\n\tint abort;\n};\n\nint info_handle_initialize(\n info_handle_t **info_handle,\n libcerror_error_t **error );\n\nint info_handle_free(\n info_handle_t **info_handle,\n libcerror_error_t **error );\n\nint info_handle_signal_abort(\n info_handle_t *info_handle,\n libcerror_error_t **error );\n\nint info_handle_set_ascii_codepage(\n info_handle_t *info_handle,\n const system_character_t *string,\n libcerror_error_t **error );\n\nint info_handle_set_event_log_type_from_filename(\n info_handle_t *info_handle,\n const system_character_t *filename,\n libcerror_error_t **error );\n\nint info_handle_open(\n info_handle_t *info_handle,\n const system_character_t *filename,\n libcerror_error_t **error );\n\nint info_handle_close(\n info_handle_t *info_handle,\n libcerror_error_t **error );\n\nint info_handle_file_fprint(\n info_handle_t *info_handle,\n libcerror_error_t **error );\n\n#if defined( __cplusplus )\n}\n#endif\n\n#endif /* !defined( _INFO_HANDLE_H ) */\n\n" }, { "path": "evtxtools/log_handle.c", "content": "/*\n * Log handle\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#include \n#include \n#include \n#include \n#include \n\n#if defined( HAVE_STDARG_H ) || defined( WINAPI )\n#include \n#elif defined( HAVE_VARARGS_H )\n#include \n#else\n#error Missing headers stdarg.h and varargs.h\n#endif\n\n#include \"evtxtools_libcerror.h\"\n#include \"log_handle.h\"\n\n/* Creates a log handle\n * Make sure the value log_handle is referencing, is set to NULL\n * Returns 1 if successful or -1 on error\n */\nint log_handle_initialize(\n log_handle_t **log_handle,\n libcerror_error_t **error )\n{\n\tstatic char *function = \"log_handle_initialize\";\n\n\tif( log_handle == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid log handle.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( *log_handle != NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_VALUE_ALREADY_SET,\n\t\t \"%s: invalid log handle value already set.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\t*log_handle = memory_allocate_structure(\n\t log_handle_t );\n\n\tif( *log_handle == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_MEMORY,\n\t\t LIBCERROR_MEMORY_ERROR_INSUFFICIENT,\n\t\t \"%s: unable to create log handle.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tif( memory_set(\n\t *log_handle,\n\t 0,\n\t sizeof( log_handle_t ) ) == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_MEMORY,\n\t\t LIBCERROR_MEMORY_ERROR_SET_FAILED,\n\t\t \"%s: unable to clear log handle.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\treturn( 1 );\n\non_error:\n\tif( *log_handle != NULL )\n\t{\n\t\tmemory_free(\n\t\t *log_handle );\n\n\t\t*log_handle = NULL;\n\t}\n\treturn( -1 );\n}\n\n/* Frees a log handle\n * Returns 1 if successful or -1 on error\n */\nint log_handle_free(\n log_handle_t **log_handle,\n libcerror_error_t **error )\n{\n\tstatic char *function = \"log_handle_free\";\n\n\tif( log_handle == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid log handle.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( *log_handle != NULL )\n\t{\n\t\tmemory_free(\n\t\t *log_handle );\n\n\t\t*log_handle = NULL;\n\t}\n\treturn( 1 );\n}\n\n/* Opens the log handle\n * Returns 1 if successful or -1 on error\n */\nint log_handle_open(\n log_handle_t *log_handle,\n const system_character_t *filename,\n libcerror_error_t **error )\n{\n\tstatic char *function = \"log_handle_open\";\n\n\tif( log_handle == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid log handle.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( filename != NULL )\n\t{\n#if defined( HAVE_WIDE_SYSTEM_CHARACTER )\n\t\tlog_handle->log_stream = file_stream_open_wide(\n\t\t filename,\n\t\t _SYSTEM_STRING( FILE_STREAM_OPEN_APPEND ) );\n#else\n\t\tlog_handle->log_stream = file_stream_open(\n\t\t filename,\n\t\t FILE_STREAM_OPEN_APPEND );\n#endif\n\t\tif( log_handle->log_stream == NULL )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_IO,\n\t\t\t LIBCERROR_IO_ERROR_OPEN_FAILED,\n\t\t\t \"%s: unable to open file.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t}\n\treturn( 1 );\n}\n\n/* Closes the log handle\n * Returns the 0 if succesful or -1 on error\n */\nint log_handle_close(\n log_handle_t *log_handle,\n libcerror_error_t **error )\n{\n\tstatic char *function = \"log_handle_close\";\n\n\tif( log_handle == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid log handle.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( log_handle->log_stream != NULL )\n\t{\n\t\tif( file_stream_close(\n\t\t log_handle->log_stream ) != 0 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_IO,\n\t\t\t LIBCERROR_IO_ERROR_CLOSE_FAILED,\n\t\t\t \"%s: unable to close log stream.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\tlog_handle->log_stream = NULL;\n\t}\n\treturn( 0 );\n}\n\n#if defined( HAVE_STDARG_H ) || defined( WINAPI )\n#define VARARGS( function, type, argument ) \\\n\tfunction( log_handle_t *log_handle, type argument, ... )\n#define VASTART( argument_list, type, name ) \\\n\tva_start( argument_list, name )\n#define VAEND( argument_list ) \\\n\tva_end( argument_list )\n\n#elif defined( HAVE_VARARGS_H )\n#define VARARGS( function, type, argument ) \\\n\tfunction( log_handle_t *log_handle, va_alist ) va_dcl\n#define VASTART( argument_list, type, name ) \\\n\t{ type name; va_start( argument_list ); name = va_arg( argument_list, type )\n#define VAEND( argument_list ) \\\n\tva_end( argument_list ); }\n\n#endif\n\n/* Print a formatted string on the notify stream\n */\nvoid VARARGS(\n log_handle_printf,\n char *,\n format )\n{\n\tva_list argument_list;\n\n\tif( ( log_handle != NULL )\n\t && ( log_handle->log_stream != NULL ) )\n\t{\n\t\tVASTART(\n\t\t argument_list,\n\t\t char *,\n\t\t format );\n\n\t\tvfprintf(\n\t\t log_handle->log_stream,\n\t\t format,\n\t\t argument_list );\n\n\t\tVAEND(\n\t\t argument_list );\n\t}\n}\n\n#undef VARARGS\n#undef VASTART\n#undef VAEND\n\n" }, { "path": "evtxtools/log_handle.h", "content": "/*\n * Log handle\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#if !defined( _LOG_HANDLE_H )\n#define _LOG_HANDLE_H\n\n#include \n#include \n#include \n\n#include \"evtxtools_libcerror.h\"\n\n#if defined( __cplusplus )\nextern \"C\" {\n#endif\n\ntypedef struct log_handle log_handle_t;\n\nstruct log_handle\n{\n\t/* The log stream\n\t */\n\tFILE *log_stream;\n};\n\nint log_handle_initialize(\n log_handle_t **log_handle,\n libcerror_error_t **error );\n\nint log_handle_free(\n log_handle_t **log_handle,\n libcerror_error_t **error );\n\nint log_handle_open(\n log_handle_t *log_handle,\n const system_character_t *filename,\n libcerror_error_t **error );\n\nint log_handle_close(\n log_handle_t *log_handle,\n libcerror_error_t **error );\n\nvoid log_handle_printf(\n log_handle_t *log_handle,\n char *format,\n ... );\n\n#if defined( __cplusplus )\n}\n#endif\n\n#endif /* !defined( _LOG_HANDLE_H ) */\n\n" }, { "path": "evtxtools/message_handle.c", "content": "/*\n * Message handle\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#include \n#include \n#include \n#include \n#include \n#include \n\n#include \"evtxtools_libcdirectory.h\"\n#include \"evtxtools_libcerror.h\"\n#include \"evtxtools_libcpath.h\"\n#include \"evtxtools_libcsplit.h\"\n#include \"evtxtools_libevtx.h\"\n#include \"evtxtools_libfcache.h\"\n#include \"evtxtools_libfwevt.h\"\n#include \"evtxtools_libregf.h\"\n#include \"evtxtools_system_split_string.h\"\n#include \"evtxtools_wide_string.h\"\n#include \"message_handle.h\"\n#include \"message_string.h\"\n#include \"path_handle.h\"\n#include \"registry_file.h\"\n#include \"resource_file.h\"\n\n/* Creates a message handle\n * Make sure the value message_handle is referencing, is set to NULL\n * Returns 1 if successful or -1 on error\n */\nint message_handle_initialize(\n message_handle_t **message_handle,\n libcerror_error_t **error )\n{\n\tstatic char *function = \"message_handle_initialize\";\n\n\tif( message_handle == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid message handle.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( *message_handle != NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_VALUE_ALREADY_SET,\n\t\t \"%s: invalid message handle value already set.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\t*message_handle = memory_allocate_structure(\n\t message_handle_t );\n\n\tif( *message_handle == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_MEMORY,\n\t\t LIBCERROR_MEMORY_ERROR_INSUFFICIENT,\n\t\t \"%s: unable to create message handle.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tif( memory_set(\n\t *message_handle,\n\t 0,\n\t sizeof( message_handle_t ) ) == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_MEMORY,\n\t\t LIBCERROR_MEMORY_ERROR_SET_FAILED,\n\t\t \"%s: unable to clear message handle.\",\n\t\t function );\n\n\t\tmemory_free(\n\t\t *message_handle );\n\n\t\t*message_handle = NULL;\n\n\t\treturn( -1 );\n\t}\n\tif( path_handle_initialize(\n\t &( ( *message_handle )->path_handle ),\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_INITIALIZE_FAILED,\n\t\t \"%s: unable to create path handle.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tif( libfcache_cache_initialize(\n\t &( ( *message_handle )->resource_file_cache ),\n\t 16,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_INITIALIZE_FAILED,\n\t\t \"%s: unable to create resource file cache.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tif( libfcache_cache_initialize(\n\t &( ( *message_handle )->mui_resource_file_cache ),\n\t 16,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_INITIALIZE_FAILED,\n\t\t \"%s: unable to create MUI resource file cache.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\t( *message_handle )->ascii_codepage = LIBREGF_CODEPAGE_WINDOWS_1252;\n\t( *message_handle )->preferred_language_identifier = 0x00000409UL;\n\n\treturn( 1 );\n\non_error:\n\tif( *message_handle != NULL )\n\t{\n\t\tif( ( *message_handle )->resource_file_cache != NULL )\n\t\t{\n\t\t\tlibfcache_cache_free(\n\t\t\t &( ( *message_handle )->resource_file_cache ),\n\t\t\t NULL );\n\t\t}\n\t\tif( ( *message_handle )->path_handle != NULL )\n\t\t{\n\t\t\tpath_handle_free(\n\t\t\t &( ( *message_handle )->path_handle ),\n\t\t\t NULL );\n\t\t}\n\t\tmemory_free(\n\t\t *message_handle );\n\n\t\t*message_handle = NULL;\n\t}\n\treturn( -1 );\n}\n\n/* Frees a message handle\n * Returns 1 if successful or -1 on error\n */\nint message_handle_free(\n message_handle_t **message_handle,\n libcerror_error_t **error )\n{\n\tstatic char *function = \"message_handle_free\";\n\tint result = 1;\n\n\tif( message_handle == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid message handle.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( *message_handle != NULL )\n\t{\n\t\tif( ( *message_handle )->software_registry_filename != NULL )\n\t\t{\n\t\t\tmemory_free(\n\t\t\t ( *message_handle )->software_registry_filename );\n\t\t}\n\t\tif( ( *message_handle )->system_registry_filename != NULL )\n\t\t{\n\t\t\tmemory_free(\n\t\t\t ( *message_handle )->system_registry_filename );\n\t\t}\n\t\tif( ( *message_handle )->registry_directory_name != NULL )\n\t\t{\n\t\t\tmemory_free(\n\t\t\t ( *message_handle )->registry_directory_name );\n\t\t}\n\t\tif( ( *message_handle )->software_registry_file != NULL )\n\t\t{\n\t\t\tif( registry_file_free(\n\t\t\t &( ( *message_handle )->software_registry_file ),\n\t\t\t error ) != 1 )\n\t\t\t{\n\t\t\t\tlibcerror_error_set(\n\t\t\t\t error,\n\t\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t\t LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED,\n\t\t\t\t \"%s: unable to free software registry file.\",\n\t\t\t\t function );\n\n\t\t\t\tresult = -1;\n\t\t\t}\n\t\t}\n\t\tif( ( *message_handle )->system_root_path != NULL )\n\t\t{\n\t\t\tmemory_free(\n\t\t\t ( *message_handle )->system_root_path );\n\t\t}\n\t\tif( ( *message_handle )->windows_directory_path != NULL )\n\t\t{\n\t\t\tmemory_free(\n\t\t\t ( *message_handle )->windows_directory_path );\n\t\t}\n\t\tif( ( *message_handle )->system_registry_file != NULL )\n\t\t{\n\t\t\tif( registry_file_free(\n\t\t\t &( ( *message_handle )->system_registry_file ),\n\t\t\t error ) != 1 )\n\t\t\t{\n\t\t\t\tlibcerror_error_set(\n\t\t\t\t error,\n\t\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t\t LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED,\n\t\t\t\t \"%s: unable to free system registry file.\",\n\t\t\t\t function );\n\n\t\t\t\tresult = -1;\n\t\t\t}\n\t\t}\n\t\tif( path_handle_free(\n\t\t &( ( *message_handle )->path_handle ),\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED,\n\t\t\t \"%s: unable to free path handle.\",\n\t\t\t function );\n\n\t\t\tresult = -1;\n\t\t}\n\t\tif( libfcache_cache_free(\n\t\t &( ( *message_handle )->resource_file_cache ),\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED,\n\t\t\t \"%s: unable to free resource file cache.\",\n\t\t\t function );\n\n\t\t\tresult = -1;\n\t\t}\n\t\tif( libfcache_cache_free(\n\t\t &( ( *message_handle )->mui_resource_file_cache ),\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED,\n\t\t\t \"%s: unable to free MUI resource file cache.\",\n\t\t\t function );\n\n\t\t\tresult = -1;\n\t\t}\n\t\tif( ( *message_handle )->winevt_publishers_key != NULL )\n\t\t{\n\t\t\tif( libregf_key_free(\n\t\t\t &( ( *message_handle )->winevt_publishers_key ),\n\t\t\t NULL ) != 1 )\n\t\t\t{\n\t\t\t\tlibcerror_error_set(\n\t\t\t\t error,\n\t\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t\t LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED,\n\t\t\t\t \"%s: unable to free winevt publishers key.\",\n\t\t\t\t function );\n\n\t\t\t\tresult = -1;\n\t\t\t}\n\t\t}\n\t\tif( ( *message_handle )->control_set_1_eventlog_services_key != NULL )\n\t\t{\n\t\t\tif( libregf_key_free(\n\t\t\t &( ( *message_handle )->control_set_1_eventlog_services_key ),\n\t\t\t NULL ) != 1 )\n\t\t\t{\n\t\t\t\tlibcerror_error_set(\n\t\t\t\t error,\n\t\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t\t LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED,\n\t\t\t\t \"%s: unable to free control set 1 eventlog services key.\",\n\t\t\t\t function );\n\n\t\t\t\tresult = -1;\n\t\t\t}\n\t\t}\n\t\tif( ( *message_handle )->control_set_2_eventlog_services_key != NULL )\n\t\t{\n\t\t\tif( libregf_key_free(\n\t\t\t &( ( *message_handle )->control_set_2_eventlog_services_key ),\n\t\t\t NULL ) != 1 )\n\t\t\t{\n\t\t\t\tlibcerror_error_set(\n\t\t\t\t error,\n\t\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t\t LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED,\n\t\t\t\t \"%s: unable to free control set 2 key.\",\n\t\t\t\t function );\n\n\t\t\t\tresult = -1;\n\t\t\t}\n\t\t}\n\t\tmemory_free(\n\t\t *message_handle );\n\n\t\t*message_handle = NULL;\n\t}\n\treturn( result );\n}\n\n/* Signals the message handle to abort\n * Returns 1 if successful or -1 on error\n */\nint message_handle_signal_abort(\n message_handle_t *message_handle,\n libcerror_error_t **error )\n{\n\tstatic char *function = \"message_handle_signal_abort\";\n\n\tif( message_handle == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid message handle.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( message_handle->software_registry_file != NULL )\n\t{\n\t\tif( registry_file_signal_abort(\n\t\t message_handle->software_registry_file,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_SET_FAILED,\n\t\t\t \"%s: unable to signal software registry file to abort.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t}\n\tif( message_handle->system_registry_file != NULL )\n\t{\n\t\tif( registry_file_signal_abort(\n\t\t message_handle->system_registry_file,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_SET_FAILED,\n\t\t\t \"%s: unable to signal system registry file to abort.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t}\n\treturn( 1 );\n}\n\n/* Sets the ascii codepage\n * Returns 1 if successful or -1 on error\n */\nint message_handle_set_ascii_codepage(\n message_handle_t *message_handle,\n int ascii_codepage,\n libcerror_error_t **error )\n{\n\tstatic char *function = \"message_handle_set_ascii_codepage\";\n\n\tif( message_handle == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid message handle.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tmessage_handle->ascii_codepage = ascii_codepage;\n\n\treturn( 1 );\n}\n\n/* Sets the preferred language identifier\n * Returns 1 if successful or -1 on error\n */\nint message_handle_set_preferred_language_identifier(\n message_handle_t *message_handle,\n uint32_t preferred_language_identifier,\n libcerror_error_t **error )\n{\n\tstatic char *function = \"message_handle_set_preferred_language_identifier\";\n\n\tif( message_handle == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid message handle.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tmessage_handle->preferred_language_identifier = preferred_language_identifier;\n\n\treturn( 1 );\n}\n\n/* Sets the name of the software registry file\n * Returns 1 if successful or -1 error\n */\nint message_handle_set_software_registry_filename(\n message_handle_t *message_handle,\n const system_character_t *filename,\n libcerror_error_t **error )\n{\n\tstatic char *function = \"message_handle_set_software_registry_filename\";\n\tsize_t filename_length = 0;\n\n\tif( message_handle == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid message handle.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( filename == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid filename.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tfilename_length = system_string_length(\n\t filename );\n\n\tif( filename_length > (size_t) SSIZE_MAX )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,\n\t\t \"%s: invalid filename length value out of bounds.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tif( message_handle->software_registry_filename != NULL )\n\t{\n\t\tmemory_free(\n\t\t message_handle->software_registry_filename );\n\n\t\tmessage_handle->software_registry_filename = NULL;\n\t}\n\tmessage_handle->software_registry_filename_size = filename_length + 1;\n\n\tmessage_handle->software_registry_filename = system_string_allocate(\n\t message_handle->software_registry_filename_size );\n\n\tif( message_handle->software_registry_filename == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_MEMORY,\n\t\t LIBCERROR_MEMORY_ERROR_INSUFFICIENT,\n\t\t \"%s: unable to create software registry filename.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tif( system_string_copy(\n\t message_handle->software_registry_filename,\n\t filename,\n\t filename_length ) == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_COPY_FAILED,\n\t\t \"%s: unable to copy software registry filename.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\t( message_handle->software_registry_filename )[ filename_length ] = 0;\n\n\treturn( 1 );\n\non_error:\n\tif( message_handle->software_registry_filename != NULL )\n\t{\n\t\tmemory_free(\n\t\t message_handle->software_registry_filename );\n\n\t\tmessage_handle->software_registry_filename = NULL;\n\t}\n\tmessage_handle->software_registry_filename_size = 0;\n\n\treturn( -1 );\n}\n\n/* Sets the name of the system registry file\n * Returns 1 if successful or -1 error\n */\nint message_handle_set_system_registry_filename(\n message_handle_t *message_handle,\n const system_character_t *filename,\n libcerror_error_t **error )\n{\n\tstatic char *function = \"message_handle_set_system_registry_filename\";\n\tsize_t filename_length = 0;\n\n\tif( message_handle == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid message handle.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( filename == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid filename.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tfilename_length = system_string_length(\n\t filename );\n\n\tif( filename_length > (size_t) SSIZE_MAX )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,\n\t\t \"%s: invalid filename length value out of bounds.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tif( message_handle->system_registry_filename != NULL )\n\t{\n\t\tmemory_free(\n\t\t message_handle->system_registry_filename );\n\n\t\tmessage_handle->system_registry_filename = NULL;\n\t}\n\tmessage_handle->system_registry_filename_size = filename_length + 1;\n\n\tmessage_handle->system_registry_filename = system_string_allocate(\n\t message_handle->system_registry_filename_size );\n\n\tif( message_handle->system_registry_filename == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_MEMORY,\n\t\t LIBCERROR_MEMORY_ERROR_INSUFFICIENT,\n\t\t \"%s: unable to create system registry filename.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tif( system_string_copy(\n\t message_handle->system_registry_filename,\n\t filename,\n\t filename_length ) == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_COPY_FAILED,\n\t\t \"%s: unable to copy system registry filename.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\t( message_handle->system_registry_filename )[ filename_length ] = 0;\n\n\treturn( 1 );\n\non_error:\n\tif( message_handle->system_registry_filename != NULL )\n\t{\n\t\tmemory_free(\n\t\t message_handle->system_registry_filename );\n\n\t\tmessage_handle->system_registry_filename = NULL;\n\t}\n\tmessage_handle->system_registry_filename_size = 0;\n\n\treturn( -1 );\n}\n\n/* Sets the name of the directory containing the software and system registry file\n * Returns 1 if successful or -1 error\n */\nint message_handle_set_registry_directory_name(\n message_handle_t *message_handle,\n const system_character_t *name,\n libcerror_error_t **error )\n{\n\tstatic char *function = \"message_handle_set_registry_directory_name\";\n\tsize_t name_length = 0;\n\n\tif( message_handle == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid message handle.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( name == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid name.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tname_length = system_string_length(\n\t name );\n\n\tif( name_length > (size_t) SSIZE_MAX )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,\n\t\t \"%s: invalid name length value out of bounds.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tif( message_handle->registry_directory_name != NULL )\n\t{\n\t\tmemory_free(\n\t\t message_handle->registry_directory_name );\n\n\t\tmessage_handle->registry_directory_name = NULL;\n\t}\n\tmessage_handle->registry_directory_name_size = name_length + 1;\n\n\tmessage_handle->registry_directory_name = system_string_allocate(\n\t message_handle->registry_directory_name_size );\n\n\tif( message_handle->registry_directory_name == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_MEMORY,\n\t\t LIBCERROR_MEMORY_ERROR_INSUFFICIENT,\n\t\t \"%s: unable to create registry directory name.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tif( system_string_copy(\n\t message_handle->registry_directory_name,\n\t name,\n\t name_length ) == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_COPY_FAILED,\n\t\t \"%s: unable to copy registry directory name.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\t( message_handle->registry_directory_name )[ name_length ] = 0;\n\n\treturn( 1 );\n\non_error:\n\tif( message_handle->registry_directory_name != NULL )\n\t{\n\t\tmemory_free(\n\t\t message_handle->registry_directory_name );\n\n\t\tmessage_handle->registry_directory_name = NULL;\n\t}\n\tmessage_handle->registry_directory_name_size = 0;\n\n\treturn( -1 );\n}\n\n/* Sets the resource files (search) path\n * Returns 1 if successful or -1 error\n */\nint message_handle_set_resource_files_path(\n message_handle_t *message_handle,\n const system_character_t *path,\n libcerror_error_t **error )\n{\n\tstatic char *function = \"message_handle_set_resource_files_path\";\n\n\tif( message_handle == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid message handle.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( path == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid path.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tmessage_handle->resource_files_path = path;\n\n\treturn( 1 );\n}\n\n/* Opens the software registry file\n * Returns 1 if successful, 0 if not available or -1 on error\n */\nint message_handle_open_software_registry_file(\n message_handle_t *message_handle,\n libcerror_error_t **error )\n{\n\tsystem_character_t *key_path = NULL;\n\tsystem_character_t *software_filename = NULL;\n\tlibregf_key_t *sub_key = NULL;\n\tlibregf_value_t *value = NULL;\n\tconst char *sub_key_path = NULL;\n\tconst char *value_name = NULL;\n\tstatic char *function = \"message_handle_open_software_registry_file\";\n\tsize_t key_path_length = 0;\n\tsize_t value_name_length = 0;\n\tint result = 0;\n\n\tif( message_handle == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid message handle.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( ( message_handle->software_registry_filename == NULL )\n\t && ( message_handle->registry_directory_name != NULL ) )\n\t{\n\t\tsoftware_filename = system_string_allocate(\n\t\t 9 );\n\n\t\tif( software_filename == NULL )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_MEMORY,\n\t\t\t LIBCERROR_MEMORY_ERROR_INSUFFICIENT,\n\t\t\t \"%s: unable to create software filename.\",\n\t\t\t function );\n\n\t\t\tgoto on_error;\n\t\t}\n\t\tif( system_string_copy(\n\t\t software_filename,\n\t\t _SYSTEM_STRING( \"SOFTWARE\" ),\n\t\t 8 ) == NULL )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_COPY_FAILED,\n\t\t\t \"%s: unable to set software filename.\",\n\t\t\t function );\n\n\t\t\tgoto on_error;\n\t\t}\n\t\tsoftware_filename[ 8 ] = 0;\n\n\t\tresult = path_handle_get_directory_entry_name_by_name_no_case(\n\t\t message_handle->path_handle,\n\t\t\t message_handle->registry_directory_name,\n\t\t\t message_handle->registry_directory_name_size - 1,\n\t\t\t software_filename,\n\t\t\t 9,\n\t\t LIBCDIRECTORY_ENTRY_TYPE_FILE,\n\t\t error );\n\n\t\tif( result == -1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_IO,\n\t\t\t LIBCERROR_IO_ERROR_GENERIC,\n\t\t\t \"%s: unable to determine if directory has entry: %\" PRIs_SYSTEM \".\",\n\t\t\t function,\n\t\t\t software_filename );\n\n\t\t\tgoto on_error;\n\t\t}\n#if defined( HAVE_WIDE_SYSTEM_CHARACTER )\n\t\tresult = libcpath_path_join_wide(\n\t\t\t &( message_handle->software_registry_filename ),\n\t\t\t &( message_handle->software_registry_filename_size ),\n\t\t\t message_handle->registry_directory_name,\n\t\t\t message_handle->registry_directory_name_size - 1,\n\t\t\t software_filename,\n\t\t\t 8,\n\t\t\t error );\n#else\n\t\tresult = libcpath_path_join(\n\t\t\t &( message_handle->software_registry_filename ),\n\t\t\t &( message_handle->software_registry_filename_size ),\n\t\t\t message_handle->registry_directory_name,\n\t\t\t message_handle->registry_directory_name_size - 1,\n\t\t\t software_filename,\n\t\t\t 8,\n\t\t\t error );\n#endif\n\t\tif( result != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_INITIALIZE_FAILED,\n\t\t\t \"%s: unable create software registry filename.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\tmemory_free(\n\t\t software_filename );\n\n\t\tsoftware_filename = NULL;\n\t}\n\tif( message_handle->software_registry_filename != NULL )\n\t{\n\t\tif( registry_file_initialize(\n\t\t &( message_handle->software_registry_file ),\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_INITIALIZE_FAILED,\n\t\t\t \"%s: unable to initialize software registry file.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\tif( registry_file_set_ascii_codepage(\n\t\t message_handle->software_registry_file,\n\t\t message_handle->ascii_codepage,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_SET_FAILED,\n\t\t\t \"%s: unable to set ASCII codepage in software registry file.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\tif( registry_file_open(\n\t\t message_handle->software_registry_file,\n\t\t message_handle->software_registry_filename,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_IO,\n\t\t\t LIBCERROR_IO_ERROR_OPEN_FAILED,\n\t\t\t \"%s: unable to open software registry file.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\t/* Get the value of %SystemRoot% from:\n\t\t * SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SystemRoot\n\t\t */\n\t\tkey_path = _SYSTEM_STRING( \"Microsoft\\\\Windows NT\\\\CurrentVersion\" );\n\n\t\tkey_path_length = system_string_length(\n\t\t key_path );\n\n\t\tresult = registry_file_get_key_by_path(\n\t\t\t message_handle->software_registry_file,\n\t\t\t key_path,\n\t\t\t key_path_length,\n\t\t\t &sub_key,\n\t\t\t error );\n\n\t\tif( result == -1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve sub key: %\" PRIs_SYSTEM \".\",\n\t\t\t function,\n\t\t\t sub_key_path );\n\n\t\t\tgoto on_error;\n\t\t}\n\t\telse if( result != 0 )\n\t\t{\n\t\t\tvalue_name = \"SystemRoot\";\n\n\t\t\tvalue_name_length = narrow_string_length(\n\t\t\t value_name );\n\n\t\t\tresult = libregf_key_get_value_by_utf8_name(\n\t\t\t\t sub_key,\n\t\t\t\t (uint8_t *) value_name,\n\t\t\t\t value_name_length,\n\t\t\t\t &value,\n\t\t\t\t error );\n\n\t\t\tif( result == -1 )\n\t\t\t{\n\t\t\t\tlibcerror_error_set(\n\t\t\t\t error,\n\t\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t\t \"%s: unable to retrieve value: %s.\",\n\t\t\t\t function,\n\t\t\t\t value_name );\n\n\t\t\t\tgoto on_error;\n\t\t\t}\n\t\t\telse if( result != 0 )\n\t\t\t{\n#if defined( HAVE_WIDE_SYSTEM_CHARACTER )\n\t\t\t\tresult = libregf_value_get_value_utf16_string_size(\n\t\t\t\t\t value,\n\t\t\t\t\t &( message_handle->system_root_path_size ),\n\t\t\t\t\t error );\n#else\n\t\t\t\tresult = libregf_value_get_value_utf8_string_size(\n\t\t\t\t\t value,\n\t\t\t\t\t &( message_handle->system_root_path_size ),\n\t\t\t\t\t error );\n#endif\n\t\t\t\tif( result == -1 )\n\t\t\t\t{\n\t\t\t\t\tlibcerror_error_set(\n\t\t\t\t\t error,\n\t\t\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t\t\t \"%s: unable to retrieve value: %s string size.\",\n\t\t\t\t\t function,\n\t\t\t\t\t value_name );\n\n\t\t\t\t\tgoto on_error;\n\t\t\t\t}\n\t\t\t\tif( ( result != 0 )\n\t\t\t\t && ( message_handle->system_root_path_size > 0 ) )\n\t\t\t\t{\n\t\t\t\t\tif( ( message_handle->system_root_path_size > (size_t) SSIZE_MAX )\n\t\t\t\t\t || ( ( sizeof( system_character_t ) * message_handle->system_root_path_size ) > (size_t) SSIZE_MAX ) )\n\t\t\t\t\t{\n\t\t\t\t\t\tlibcerror_error_set(\n\t\t\t\t\t\t error,\n\t\t\t\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t\t\t\t LIBCERROR_RUNTIME_ERROR_VALUE_EXCEEDS_MAXIMUM,\n\t\t\t\t\t\t \"%s: invalid system root path string size value exceeds maximum.\",\n\t\t\t\t\t\t function );\n\n\t\t\t\t\t\tgoto on_error;\n\t\t\t\t\t}\n\t\t\t\t\tmessage_handle->system_root_path = system_string_allocate(\n\t\t\t\t\t\t message_handle->system_root_path_size );\n\n\t\t\t\t\tif( message_handle->system_root_path == NULL )\n\t\t\t\t\t{\n\t\t\t\t\t\tlibcerror_error_set(\n\t\t\t\t\t\t error,\n\t\t\t\t\t\t LIBCERROR_ERROR_DOMAIN_MEMORY,\n\t\t\t\t\t\t LIBCERROR_MEMORY_ERROR_INSUFFICIENT,\n\t\t\t\t\t\t \"%s: unable to create system root path string.\",\n\t\t\t\t\t\t function );\n\n\t\t\t\t\t\tgoto on_error;\n\t\t\t\t\t}\n#if defined( HAVE_WIDE_SYSTEM_CHARACTER )\n\t\t\t\t\tresult = libregf_value_get_value_utf16_string(\n\t\t\t\t\t\t value,\n\t\t\t\t\t\t (uint16_t *) message_handle->system_root_path,\n\t\t\t\t\t\t message_handle->system_root_path_size,\n\t\t\t\t\t\t error );\n#else\n\t\t\t\t\tresult = libregf_value_get_value_utf8_string(\n\t\t\t\t\t\t value,\n\t\t\t\t\t\t (uint8_t *) message_handle->system_root_path,\n\t\t\t\t\t\t message_handle->system_root_path_size,\n\t\t\t\t\t\t error );\n#endif\n\t\t\t\t\tif( result != 1 )\n\t\t\t\t\t{\n\t\t\t\t\t\tlibcerror_error_set(\n\t\t\t\t\t\t error,\n\t\t\t\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t\t\t\t \"%s: unable to retrieve value: %s string.\",\n\t\t\t\t\t\t function,\n\t\t\t\t\t\t value_name );\n\n\t\t\t\t\t\tmemory_free(\n\t\t\t\t\t\t message_handle->system_root_path );\n\n\t\t\t\t\t\tmessage_handle->system_root_path = NULL;\n\t\t\t\t\t\tmessage_handle->system_root_path_size = 0;\n\n\t\t\t\t\t\tgoto on_error;\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t\tif( libregf_value_free(\n\t\t\t\t &value,\n\t\t\t\t error ) != 1 )\n\t\t\t\t{\n\t\t\t\t\tlibcerror_error_set(\n\t\t\t\t\t error,\n\t\t\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t\t\t LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED,\n\t\t\t\t\t \"%s: unable to free value.\",\n\t\t\t\t\t function );\n\n\t\t\t\t\tgoto on_error;\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t\tif( libregf_key_free(\n\t\t &sub_key,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED,\n\t\t\t \"%s: unable to free sub key.\",\n\t\t\t function );\n\n\t\t\tgoto on_error;\n\t\t}\n\t}\n\t/* Check if %SystemRoot% contains a sane value\n\t */\n/* TODO what if system root constists of multiple paths */\n\tif( message_handle->system_root_path != NULL )\n\t{\n\t\tif( ( message_handle->system_root_path_size < 4 )\n\t\t || ( ( message_handle->system_root_path )[ 1 ] != (system_character_t) ':' )\n\t\t || ( ( message_handle->system_root_path )[ 2 ] != (system_character_t) '\\\\' ) )\n\t\t{\n\t\t\tmemory_free(\n\t\t\t message_handle->system_root_path );\n\n\t\t\tmessage_handle->system_root_path = NULL;\n\t\t\tmessage_handle->system_root_path_size = 0;\n\t\t}\n\t}\n\t/* If no usable %SystemRoot% was found use the default: C:\\Windows\n\t */\n\tif( message_handle->system_root_path == NULL )\n\t{\n\t\tmessage_handle->system_root_path_size = 11;\n\n\t\tmessage_handle->system_root_path = system_string_allocate(\n\t\t message_handle->system_root_path_size );\n\n\t\tif( message_handle->system_root_path == NULL )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_MEMORY,\n\t\t\t LIBCERROR_MEMORY_ERROR_INSUFFICIENT,\n\t\t\t \"%s: unable to create system root path string.\",\n\t\t\t function );\n\n\t\t\tgoto on_error;\n\t\t}\n\t\tif( system_string_copy(\n\t\t message_handle->system_root_path,\n\t\t _SYSTEM_STRING( \"C:\\\\Windows\" ),\n\t\t 10 ) == NULL )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_COPY_FAILED,\n\t\t\t \"%s: unable to copy default value to system root path string.\",\n\t\t\t function );\n\n\t\t\tmemory_free(\n\t\t\t message_handle->system_root_path );\n\n\t\t\tmessage_handle->system_root_path = NULL;\n\t\t\tmessage_handle->system_root_path_size = 0;\n\n\t\t\tgoto on_error;\n\t\t}\n\t\t( message_handle->system_root_path )[ 10 ] = 0;\n\t}\n/* TODO for now %WinDir% is a copy of %SystemRoot% */\n\tif( message_handle->windows_directory_path == NULL )\n\t{\n\t\tmessage_handle->windows_directory_path_size = message_handle->system_root_path_size;\n\n\t\tmessage_handle->windows_directory_path = system_string_allocate(\n\t\t message_handle->windows_directory_path_size );\n\n\t\tif( message_handle->windows_directory_path == NULL )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_MEMORY,\n\t\t\t LIBCERROR_MEMORY_ERROR_INSUFFICIENT,\n\t\t\t \"%s: unable to create windows directory path string.\",\n\t\t\t function );\n\n\t\t\tgoto on_error;\n\t\t}\n\t\tif( system_string_copy(\n\t\t message_handle->windows_directory_path,\n\t\t message_handle->system_root_path,\n\t\t message_handle->windows_directory_path_size - 1 ) == NULL )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_COPY_FAILED,\n\t\t\t \"%s: unable to copy default value to windows directory path string.\",\n\t\t\t function );\n\n\t\t\tmemory_free(\n\t\t\t message_handle->windows_directory_path );\n\n\t\t\tmessage_handle->windows_directory_path = NULL;\n\t\t\tmessage_handle->windows_directory_path_size = 0;\n\n\t\t\tgoto on_error;\n\t\t}\n\t\t( message_handle->windows_directory_path )[ message_handle->windows_directory_path_size - 1 ] = 0;\n\t}\n\treturn( 1 );\n\non_error:\n\tif( value != NULL )\n\t{\n\t\tlibregf_value_free(\n\t\t &value,\n\t\t NULL );\n\t}\n\tif( sub_key != NULL )\n\t{\n\t\tlibregf_key_free(\n\t\t &sub_key,\n\t\t NULL );\n\t}\n\tif( software_filename != NULL )\n\t{\n\t\tmemory_free(\n\t\t software_filename );\n\t}\n\treturn( -1 );\n}\n\n/* Opens the system registry file\n * Returns 1 if successful, 0 if not available or -1 on error\n */\nint message_handle_open_system_registry_file(\n message_handle_t *message_handle,\n const char *eventlog_key_name,\n libcerror_error_t **error )\n{\n\tlibregf_key_t *sub_key = NULL;\n\tsystem_character_t *key_path = NULL;\n\tsystem_character_t *system_filename = NULL;\n\tstatic char *function = \"message_handle_open_system_registry_file\";\n\tsize_t eventlog_key_name_length = 0;\n\tsize_t key_path_length = 0;\n\tint result = 0;\n\n\tif( message_handle == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid message handle.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( eventlog_key_name == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid eventlog key name.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\teventlog_key_name_length = narrow_string_length(\n\t eventlog_key_name );\n\n\tif( ( message_handle->system_registry_filename == NULL )\n\t && ( message_handle->registry_directory_name != NULL ) )\n\t{\n\t\tsystem_filename = system_string_allocate(\n\t\t 7 );\n\n\t\tif( system_filename == NULL )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_MEMORY,\n\t\t\t LIBCERROR_MEMORY_ERROR_INSUFFICIENT,\n\t\t\t \"%s: unable to create system filename.\",\n\t\t\t function );\n\n\t\t\tgoto on_error;\n\t\t}\n\t\tif( system_string_copy(\n\t\t system_filename,\n\t\t _SYSTEM_STRING( \"SYSTEM\" ),\n\t\t 6 ) == NULL )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_COPY_FAILED,\n\t\t\t \"%s: unable to set system filename.\",\n\t\t\t function );\n\n\t\t\tgoto on_error;\n\t\t}\n\t\tsystem_filename[ 6 ] = 0;\n\n\t\tresult = path_handle_get_directory_entry_name_by_name_no_case(\n\t\t message_handle->path_handle,\n\t\t\t message_handle->registry_directory_name,\n\t\t\t message_handle->registry_directory_name_size - 1,\n\t\t\t system_filename,\n\t\t\t 7,\n\t\t LIBCDIRECTORY_ENTRY_TYPE_FILE,\n\t\t error );\n\n\t\tif( result == -1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_IO,\n\t\t\t LIBCERROR_IO_ERROR_GENERIC,\n\t\t\t \"%s: unable to determine if directory has entry: %\" PRIs_SYSTEM \".\",\n\t\t\t function,\n\t\t\t system_filename );\n\n\t\t\tgoto on_error;\n\t\t}\n#if defined( HAVE_WIDE_SYSTEM_CHARACTER )\n\t\tresult = libcpath_path_join_wide(\n\t\t\t &( message_handle->system_registry_filename ),\n\t\t\t &( message_handle->system_registry_filename_size ),\n\t\t\t message_handle->registry_directory_name,\n\t\t\t message_handle->registry_directory_name_size - 1,\n\t\t\t system_filename,\n\t\t\t 6,\n\t\t\t error );\n#else\n\t\tresult = libcpath_path_join(\n\t\t\t &( message_handle->system_registry_filename ),\n\t\t\t &( message_handle->system_registry_filename_size ),\n\t\t\t message_handle->registry_directory_name,\n\t\t\t message_handle->registry_directory_name_size - 1,\n\t\t\t system_filename,\n\t\t\t 6,\n\t\t\t error );\n#endif\n\t\tif( result != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_INITIALIZE_FAILED,\n\t\t\t \"%s: unable create system registry filename.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\tmemory_free(\n\t\t system_filename );\n\n\t\tsystem_filename = NULL;\n\t}\n\tif( message_handle->system_registry_filename == NULL )\n\t{\n\t\treturn( 0 );\n\t}\n\tif( registry_file_initialize(\n\t &( message_handle->system_registry_file ),\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_INITIALIZE_FAILED,\n\t\t \"%s: unable to initialize system registry file.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( registry_file_set_ascii_codepage(\n\t message_handle->system_registry_file,\n\t message_handle->ascii_codepage,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_SET_FAILED,\n\t\t \"%s: unable to set ASCII codepage in system registry file.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( registry_file_open(\n\t message_handle->system_registry_file,\n\t message_handle->system_registry_filename,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_IO,\n\t\t LIBCERROR_IO_ERROR_OPEN_FAILED,\n\t\t \"%s: unable to open system registry file.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\t/* Get the winevt providers key\n\t * SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WINEVT\\Publishers\n\t */\n\tkey_path = _SYSTEM_STRING( \"Microsoft\\\\Windows\\\\CurrentVersion\\\\WINEVT\\\\Publishers\" );\n\n\tkey_path_length = system_string_length(\n\t key_path );\n\n\tresult = registry_file_get_key_by_path(\n\t\t message_handle->software_registry_file,\n\t\t key_path,\n\t\t key_path_length,\n\t &( message_handle->winevt_publishers_key ),\n\t\t error );\n\n\tif( result == -1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to retrieve sub key: %\" PRIs_SYSTEM \".\",\n\t\t function,\n\t\t key_path );\n\n\t\tgoto on_error;\n\t}\n\t/* Get the control set 1 eventlog services key:\n\t * SYSTEM\\ControlSet001\\Services\\Eventlog\n\t */\n\tkey_path = _SYSTEM_STRING( \"ControlSet001\\\\Services\\\\Eventlog\" );\n\n\tkey_path_length = system_string_length(\n\t key_path );\n\n\tresult = registry_file_get_key_by_path(\n\t\t message_handle->system_registry_file,\n\t\t key_path,\n\t\t key_path_length,\n\t\t &sub_key,\n\t\t error );\n\n\tif( result == -1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to retrieve sub key: %\" PRIs_SYSTEM \".\",\n\t\t function,\n\t\t key_path );\n\n\t\tgoto on_error;\n\t}\n\telse if( result != 0 )\n\t{\n\t\tresult = libregf_key_get_sub_key_by_utf8_name(\n\t\t\t sub_key,\n\t\t\t (uint8_t *) eventlog_key_name,\n\t\t\t eventlog_key_name_length,\n\t\t\t &( message_handle->control_set_1_eventlog_services_key ),\n\t\t\t error );\n\n\t\tif( result == -1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve sub key: %s.\",\n\t\t\t function,\n\t\t\t eventlog_key_name );\n\n\t\t\tgoto on_error;\n\t\t}\n\t}\n\tif( libregf_key_free(\n\t &sub_key,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED,\n\t\t \"%s: unable to free sub key.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\t/* Get the control set 2 eventlog services key:\n\t * SYSTEM\\ControlSet002\\Services\\Eventlog\n\t */\n\tkey_path = _SYSTEM_STRING( \"ControlSet002\\\\Services\\\\Eventlog\" );\n\n\tkey_path_length = system_string_length(\n\t key_path );\n\n\tresult = registry_file_get_key_by_path(\n\t\t message_handle->system_registry_file,\n\t\t key_path,\n\t\t key_path_length,\n\t\t &sub_key,\n\t\t error );\n\n\tif( result == -1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to retrieve sub key: %\" PRIs_SYSTEM \".\",\n\t\t function,\n\t\t key_path );\n\n\t\tgoto on_error;\n\t}\n\telse if( result != 0 )\n\t{\n\t\tresult = libregf_key_get_sub_key_by_utf8_name(\n\t\t\t sub_key,\n\t\t\t (uint8_t *) eventlog_key_name,\n\t\t\t eventlog_key_name_length,\n\t\t\t &( message_handle->control_set_2_eventlog_services_key ),\n\t\t\t error );\n\n\t\tif( result == -1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve sub key: %s.\",\n\t\t\t function,\n\t\t\t eventlog_key_name );\n\n\t\t\tgoto on_error;\n\t\t}\n\t}\n\tif( libregf_key_free(\n\t &sub_key,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED,\n\t\t \"%s: unable to free sub key.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\treturn( 1 );\n\non_error:\n\tif( sub_key != NULL )\n\t{\n\t\tlibregf_key_free(\n\t\t &sub_key,\n\t\t NULL );\n\t}\n\tif( system_filename != NULL )\n\t{\n\t\tmemory_free(\n\t\t system_filename );\n\t}\n\treturn( -1 );\n}\n\n/* Opens the input\n * Returns 1 if successful or -1 on error\n */\nint message_handle_open_input(\n message_handle_t *message_handle,\n const char *eventlog_key_name,\n libcerror_error_t **error )\n{\n\tstatic char *function = \"message_handle_open_input\";\n\tint result = 0;\n\n\tif( message_handle == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid message handle.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tresult = message_handle_open_software_registry_file(\n\t message_handle,\n\t error );\n\n\tif( result == -1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_IO,\n\t\t LIBCERROR_IO_ERROR_OPEN_FAILED,\n\t\t \"%s: unable to open software registry file.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tresult = message_handle_open_system_registry_file(\n\t message_handle,\n\t eventlog_key_name,\n\t error );\n\n\tif( result == -1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_IO,\n\t\t LIBCERROR_IO_ERROR_OPEN_FAILED,\n\t\t \"%s: unable to open system registry file.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\treturn( 1 );\n}\n\n/* Closes the input\n * Returns the 0 if succesful or -1 on error\n */\nint message_handle_close_input(\n message_handle_t *message_handle,\n libcerror_error_t **error )\n{\n\tstatic char *function = \"message_handle_close_input\";\n\tint result = 0;\n\n\tif( message_handle == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid message handle.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( message_handle->software_registry_file != NULL )\n\t{\n\t\tif( registry_file_close(\n\t\t message_handle->software_registry_file,\n\t\t error ) != 0 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_IO,\n\t\t\t LIBCERROR_IO_ERROR_CLOSE_FAILED,\n\t\t\t \"%s: unable to close software registry file.\",\n\t\t\t function );\n\n\t\t\tresult = -1;\n\t\t}\n\t}\n\tif( message_handle->system_registry_file != NULL )\n\t{\n\t\tif( registry_file_close(\n\t\t message_handle->system_registry_file,\n\t\t error ) != 0 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_IO,\n\t\t\t LIBCERROR_IO_ERROR_CLOSE_FAILED,\n\t\t\t \"%s: unable to close system registry file.\",\n\t\t\t function );\n\n\t\t\tresult = -1;\n\t\t}\n\t}\n\tif( libfcache_cache_empty(\n\t message_handle->resource_file_cache,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED,\n\t\t \"%s: unable to empty resource file cache.\",\n\t\t function );\n\n\t\tresult = -1;\n\t}\n\tif( libfcache_cache_empty(\n\t message_handle->mui_resource_file_cache,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED,\n\t\t \"%s: unable to empty MUI resource file cache.\",\n\t\t function );\n\n\t\tresult = -1;\n\t}\n\treturn( result );\n}\n\n/* Retrieves a value for a specific event source\n * The value is retrieved from the event source key in the SYSTEM Windows Registry File if available\n * Returns 1 if successful, 0 if such event source or -1 error\n */\nint message_handle_get_value_by_event_source(\n message_handle_t *message_handle,\n const system_character_t *event_source,\n size_t event_source_length,\n const system_character_t *value_name,\n size_t value_name_length,\n system_character_t **value_string,\n size_t *value_string_size,\n libcerror_error_t **error )\n{\n\tlibregf_key_t *key = NULL;\n\tlibregf_value_t *value = NULL;\n\tstatic char *function = \"message_handle_get_value_by_event_source\";\n\tint result = 0;\n\n\tif( message_handle == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid message handle.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( value_string == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid value string.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( *value_string != NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_VALUE_ALREADY_SET,\n\t\t \"%s: invalid value string value already set.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( value_string_size == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid value string size.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( message_handle->control_set_1_eventlog_services_key != NULL )\n\t{\n#if defined( HAVE_WIDE_SYSTEM_CHARACTER )\n\t\tresult = libregf_key_get_sub_key_by_utf16_name(\n\t\t\t message_handle->control_set_1_eventlog_services_key,\n\t\t\t (uint16_t *) event_source,\n\t\t\t event_source_length,\n\t\t\t &key,\n\t\t\t error );\n#else\n\t\tresult = libregf_key_get_sub_key_by_utf8_name(\n\t\t\t message_handle->control_set_1_eventlog_services_key,\n\t\t\t (uint8_t *) event_source,\n\t\t\t event_source_length,\n\t\t\t &key,\n\t\t\t error );\n#endif\n\t\tif( result == -1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve sub key: %\" PRIs_SYSTEM \".\",\n\t\t\t function,\n\t\t\t event_source );\n\n\t\t\tgoto on_error;\n\t\t}\n\t}\n\tif( result == 0 )\n\t{\n\t\tif( message_handle->control_set_2_eventlog_services_key != NULL )\n\t\t{\n#if defined( HAVE_WIDE_SYSTEM_CHARACTER )\n\t\t\tresult = libregf_key_get_sub_key_by_utf16_name(\n\t\t\t\t message_handle->control_set_2_eventlog_services_key,\n\t\t\t\t (uint16_t *) event_source,\n\t\t\t\t event_source_length,\n\t\t\t\t &key,\n\t\t\t\t error );\n#else\n\t\t\tresult = libregf_key_get_sub_key_by_utf8_name(\n\t\t\t\t message_handle->control_set_2_eventlog_services_key,\n\t\t\t\t (uint8_t *) event_source,\n\t\t\t\t event_source_length,\n\t\t\t\t &key,\n\t\t\t\t error );\n#endif\n\t\t\tif( result == -1 )\n\t\t\t{\n\t\t\t\tlibcerror_error_set(\n\t\t\t\t error,\n\t\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t\t \"%s: unable to retrieve sub key: %\" PRIs_SYSTEM \".\",\n\t\t\t\t function,\n\t\t\t\t event_source );\n\n\t\t\t\tgoto on_error;\n\t\t\t}\n\t\t}\n\t}\n\tif( result != 0 )\n\t{\n\t\tresult = libregf_key_get_value_by_utf8_name(\n\t\t\t key,\n\t\t\t (uint8_t *) value_name,\n\t\t\t value_name_length,\n\t\t\t &value,\n\t\t\t error );\n\n\t\tif( result == -1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve value: %\" PRIs_SYSTEM \".\",\n\t\t\t function,\n\t\t\t value_name );\n\n\t\t\tgoto on_error;\n\t\t}\n\t\telse if( result != 0 )\n\t\t{\n#if defined( HAVE_WIDE_SYSTEM_CHARACTER )\n\t\t\tresult = libregf_value_get_value_utf16_string_size(\n\t\t\t value,\n\t\t\t value_string_size,\n\t\t\t error );\n#else\n\t\t\tresult = libregf_value_get_value_utf8_string_size(\n\t\t\t value,\n\t\t\t value_string_size,\n\t\t\t error );\n#endif\n\t\t\tif( result != 1 )\n\t\t\t{\n\t\t\t\tlibcerror_error_set(\n\t\t\t\t error,\n\t\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t\t \"%s: unable to retrieve value string size.\",\n\t\t\t\t function );\n\n\t\t\t\tgoto on_error;\n\t\t\t}\n\t\t\tif( *value_string_size == 0 )\n\t\t\t{\n\t\t\t\tlibcerror_error_set(\n\t\t\t\t error,\n\t\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t\t LIBCERROR_RUNTIME_ERROR_VALUE_MISSING,\n\t\t\t\t \"%s: missing value string.\",\n\t\t\t\t function );\n\n\t\t\t\tgoto on_error;\n\t\t\t}\n\t\t\t*value_string = system_string_allocate(\n\t\t\t\t\t *value_string_size );\n\n\t\t\tif( value_string == NULL )\n\t\t\t{\n\t\t\t\tlibcerror_error_set(\n\t\t\t\t error,\n\t\t\t\t LIBCERROR_ERROR_DOMAIN_MEMORY,\n\t\t\t\t LIBCERROR_MEMORY_ERROR_INSUFFICIENT,\n\t\t\t\t \"%s: unable to create value string.\",\n\t\t\t\t function );\n\n\t\t\t\tgoto on_error;\n\t\t\t}\n#if defined( HAVE_WIDE_SYSTEM_CHARACTER )\n\t\t\tresult = libregf_value_get_value_utf16_string(\n\t\t\t\t value,\n\t\t\t\t (uint16_t *) *value_string,\n\t\t\t\t *value_string_size,\n\t\t\t\t error );\n#else\n\t\t\tresult = libregf_value_get_value_utf8_string(\n\t\t\t\t value,\n\t\t\t\t (uint8_t *) *value_string,\n\t\t\t\t *value_string_size,\n\t\t\t\t error );\n#endif\n\t\t\tif( result != 1 )\n\t\t\t{\n\t\t\t\tlibcerror_error_set(\n\t\t\t\t error,\n\t\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t\t \"%s: unable to retrieve value string.\",\n\t\t\t\t function );\n\n\t\t\t\tgoto on_error;\n\t\t\t}\n\t\t\tif( libregf_value_free(\n\t\t\t &value,\n\t\t\t error ) != 1 )\n\t\t\t{\n\t\t\t\tlibcerror_error_set(\n\t\t\t\t error,\n\t\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t\t LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED,\n\t\t\t\t \"%s: unable to free value.\",\n\t\t\t\t function );\n\n\t\t\t\tgoto on_error;\n\t\t\t}\n\t\t}\n\t\tif( libregf_key_free(\n\t\t &key,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED,\n\t\t\t \"%s: unable to free key.\",\n\t\t\t function );\n\n\t\t\tgoto on_error;\n\t\t}\n\t}\n\treturn( result );\n\non_error:\n\tif( value != NULL )\n\t{\n\t\tlibregf_value_free(\n\t\t &value,\n\t\t NULL );\n\t}\n\tif( key != NULL )\n\t{\n\t\tlibregf_key_free(\n\t\t &key,\n\t\t NULL );\n\t}\n\tif( *value_string != NULL )\n\t{\n\t\tmemory_free(\n\t\t *value_string );\n\n\t\t*value_string = NULL;\n\t}\n\t*value_string_size = 0;\n\n\treturn( -1 );\n}\n\n/* Retrieves a value for a specific provider identifier\n * The value is retrieved from the WINEVT provider key in the SOFTWARE Windows Registry File if available\n * Returns 1 if successful, 0 if such event source or -1 error\n */\nint message_handle_get_value_by_provider_identifier(\n message_handle_t *message_handle,\n const system_character_t *provider_identifier,\n size_t provider_identifier_length,\n const system_character_t *value_name,\n size_t value_name_length,\n system_character_t **value_string,\n size_t *value_string_size,\n libcerror_error_t **error )\n{\n\tlibregf_key_t *key = NULL;\n\tlibregf_value_t *value = NULL;\n\tstatic char *function = \"message_handle_get_value_by_provider_identifier\";\n\tint result = 0;\n\n\tif( message_handle == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid message handle.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( value_string == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid value string.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( *value_string != NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_VALUE_ALREADY_SET,\n\t\t \"%s: invalid value string value already set.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( value_string_size == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid value string size.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( message_handle->winevt_publishers_key != NULL )\n\t{\n#if defined( HAVE_WIDE_SYSTEM_CHARACTER )\n\t\tresult = libregf_key_get_sub_key_by_utf16_name(\n\t\t\t message_handle->winevt_publishers_key,\n\t\t\t (uint16_t *) provider_identifier,\n\t\t\t provider_identifier_length,\n\t\t\t &key,\n\t\t\t error );\n#else\n\t\tresult = libregf_key_get_sub_key_by_utf8_name(\n\t\t\t message_handle->winevt_publishers_key,\n\t\t\t (uint8_t *) provider_identifier,\n\t\t\t provider_identifier_length,\n\t\t\t &key,\n\t\t\t error );\n#endif\n\t\tif( result == -1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve sub key: %\" PRIs_SYSTEM \".\",\n\t\t\t function,\n\t\t\t provider_identifier );\n\n\t\t\tgoto on_error;\n\t\t}\n\t}\n\tif( result != 0 )\n\t{\n\t\tresult = libregf_key_get_value_by_utf8_name(\n\t\t\t key,\n\t\t\t (uint8_t *) value_name,\n\t\t\t value_name_length,\n\t\t\t &value,\n\t\t\t error );\n\n\t\tif( result == -1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve value: %\" PRIs_SYSTEM \".\",\n\t\t\t function,\n\t\t\t value_name );\n\n\t\t\tgoto on_error;\n\t\t}\n\t\telse if( result != 0 )\n\t\t{\n#if defined( HAVE_WIDE_SYSTEM_CHARACTER )\n\t\t\tresult = libregf_value_get_value_utf16_string_size(\n\t\t\t value,\n\t\t\t value_string_size,\n\t\t\t error );\n#else\n\t\t\tresult = libregf_value_get_value_utf8_string_size(\n\t\t\t value,\n\t\t\t value_string_size,\n\t\t\t error );\n#endif\n\t\t\tif( result != 1 )\n\t\t\t{\n\t\t\t\tlibcerror_error_set(\n\t\t\t\t error,\n\t\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t\t \"%s: unable to retrieve value string size.\",\n\t\t\t\t function );\n\n\t\t\t\tgoto on_error;\n\t\t\t}\n\t\t\tif( *value_string_size == 0 )\n\t\t\t{\n\t\t\t\tlibcerror_error_set(\n\t\t\t\t error,\n\t\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t\t LIBCERROR_RUNTIME_ERROR_VALUE_MISSING,\n\t\t\t\t \"%s: missing value string.\",\n\t\t\t\t function );\n\n\t\t\t\tgoto on_error;\n\t\t\t}\n\t\t\t*value_string = system_string_allocate(\n\t\t\t *value_string_size );\n\n\t\t\tif( value_string == NULL )\n\t\t\t{\n\t\t\t\tlibcerror_error_set(\n\t\t\t\t error,\n\t\t\t\t LIBCERROR_ERROR_DOMAIN_MEMORY,\n\t\t\t\t LIBCERROR_MEMORY_ERROR_INSUFFICIENT,\n\t\t\t\t \"%s: unable to create value string.\",\n\t\t\t\t function );\n\n\t\t\t\tgoto on_error;\n\t\t\t}\n#if defined( HAVE_WIDE_SYSTEM_CHARACTER )\n\t\t\tresult = libregf_value_get_value_utf16_string(\n\t\t\t\t value,\n\t\t\t\t (uint16_t *) *value_string,\n\t\t\t\t *value_string_size,\n\t\t\t\t error );\n#else\n\t\t\tresult = libregf_value_get_value_utf8_string(\n\t\t\t\t value,\n\t\t\t\t (uint8_t *) *value_string,\n\t\t\t\t *value_string_size,\n\t\t\t\t error );\n#endif\n\t\t\tif( result != 1 )\n\t\t\t{\n\t\t\t\tlibcerror_error_set(\n\t\t\t\t error,\n\t\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t\t \"%s: unable to retrieve value string.\",\n\t\t\t\t function );\n\n\t\t\t\tgoto on_error;\n\t\t\t}\n\t\t\tif( libregf_value_free(\n\t\t\t &value,\n\t\t\t error ) != 1 )\n\t\t\t{\n\t\t\t\tlibcerror_error_set(\n\t\t\t\t error,\n\t\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t\t LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED,\n\t\t\t\t \"%s: unable to free value.\",\n\t\t\t\t function );\n\n\t\t\t\tgoto on_error;\n\t\t\t}\n\t\t}\n\t\tif( libregf_key_free(\n\t\t &key,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED,\n\t\t\t \"%s: unable to free key.\",\n\t\t\t function );\n\n\t\t\tgoto on_error;\n\t\t}\n\t}\n\treturn( result );\n\non_error:\n\tif( value != NULL )\n\t{\n\t\tlibregf_value_free(\n\t\t &value,\n\t\t NULL );\n\t}\n\tif( key != NULL )\n\t{\n\t\tlibregf_key_free(\n\t\t &key,\n\t\t NULL );\n\t}\n\tif( *value_string != NULL )\n\t{\n\t\tmemory_free(\n\t\t *value_string );\n\n\t\t*value_string = NULL;\n\t}\n\t*value_string_size = 0;\n\n\treturn( -1 );\n}\n\n/* Retrieves the path of the resource file based on the resource filename\n * Returns 1 if successful, 0 if not available or -1 error\n */\nint message_handle_get_resource_file_path(\n message_handle_t *message_handle,\n const system_character_t *resource_filename,\n size_t resource_filename_length,\n const system_character_t *language_string,\n size_t language_string_length,\n system_character_t **resource_file_path,\n size_t *resource_file_path_size,\n libcerror_error_t **error )\n{\n\tsystem_character_t *mui_string = NULL;\n\tsystem_character_t *resource_filename_string_segment = NULL;\n\tsystem_split_string_t *resource_filename_split_string = NULL;\n\tstatic char *function = \"message_handle_get_resource_file_path\";\n\tsize_t mui_string_size = 0;\n\tsize_t resource_file_path_index = 0;\n\tsize_t resource_filename_directory_name_index = 0;\n\tsize_t resource_filename_string_segment_size = 0;\n\tsize_t resource_files_path_length = 0;\n\tuint8_t directory_entry_type = 0;\n\tint resource_filename_number_of_segments = 0;\n\tint resource_filename_segment_index = 0;\n\tint result = 0;\n\n#if defined( WINAPI )\n\tconst system_character_t *volume_letter = NULL;\n#endif\n\n\tif( message_handle == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid message handle.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( message_handle->system_root_path == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_VALUE_MISSING,\n\t\t \"%s: invalid message handle - missing system root path.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tif( ( message_handle->system_root_path_size < 4 )\n\t || ( message_handle->system_root_path_size > (size_t) SSIZE_MAX ) )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_VALUE_OUT_OF_BOUNDS,\n\t\t \"%s: invalid message handle - system root path size value out of bounds.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( resource_filename == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid resource filename.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( resource_filename_length == 0 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_VALUE_ZERO_OR_LESS,\n\t\t \"%s: invalid resource filename length is zero.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( resource_filename_length > (size_t) SSIZE_MAX )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_VALUE_EXCEEDS_MAXIMUM,\n\t\t \"%s: invalid resource filename length value exceeds maximum.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( language_string != NULL )\n\t{\n\t\tif( language_string_length > (size_t) SSIZE_MAX )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t\t LIBCERROR_ARGUMENT_ERROR_VALUE_EXCEEDS_MAXIMUM,\n\t\t\t \"%s: invalid language string length value exceeds maximum.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t}\n\tif( resource_file_path == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid resource file path.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( *resource_file_path != NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_VALUE_ALREADY_SET,\n\t\t \"%s: invalid resource file path value already set.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( resource_file_path_size == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid resource file path size.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( resource_filename_length > 2 )\n\t{\n\t\t/* Check if the resource filename starts with a volume letter\n\t\t */\n\t\tif( ( resource_filename[ 1 ] == (system_character_t) ':' )\n\t\t && ( ( ( resource_filename[ 0 ] >= (system_character_t) 'A' )\n\t\t && ( resource_filename[ 0 ] <= (system_character_t) 'Z' ) )\n\t\t || ( ( resource_filename[ 0 ] >= (system_character_t) 'a' )\n\t\t && ( resource_filename[ 0 ] <= (system_character_t) 'z' ) ) ) )\n\t\t{\n\t\t\tresource_filename_directory_name_index = 2;\n\n\t\t\tif( ( resource_filename_length >= 3 )\n\t\t\t && ( resource_filename[ 2 ] == (system_character_t) '\\\\' ) )\n\t\t\t{\n\t\t\t\tresource_filename_directory_name_index += 1;\n\t\t\t}\n#if defined( WINAPI )\n\t\t\tvolume_letter = resource_filename;\n#endif\n\t\t}\n\t}\n\tif( system_string_split(\n\t &( resource_filename[ resource_filename_directory_name_index ] ),\n\t resource_filename_length - resource_filename_directory_name_index + 1,\n\t (system_character_t) '\\\\',\n\t &resource_filename_split_string,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_INITIALIZE_FAILED,\n\t\t \"%s: unable to split resource filename.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tif( system_split_string_get_number_of_segments(\n\t resource_filename_split_string,\n\t &resource_filename_number_of_segments,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to retrieve number of resource filename string segments.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\t*resource_file_path_size = 0;\n\n\tfor( resource_filename_segment_index = 0;\n\t resource_filename_segment_index < resource_filename_number_of_segments;\n\t resource_filename_segment_index++ )\n\t{\n\t\tif( system_split_string_get_segment_by_index(\n\t\t resource_filename_split_string,\n\t\t resource_filename_segment_index,\n\t\t &resource_filename_string_segment,\n\t\t &resource_filename_string_segment_size,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve resource filename string segment: %d.\",\n\t\t\t function,\n\t\t\t resource_filename_segment_index );\n\n\t\t\tgoto on_error;\n\t\t}\n\t\tif( resource_filename_string_segment == NULL )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_VALUE_MISSING,\n\t\t\t \"%s: missing resource filename string segment: %d.\",\n\t\t\t function,\n\t\t\t resource_filename_segment_index );\n\n\t\t\tgoto on_error;\n\t\t}\n\t\tif( resource_filename_string_segment_size == 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_UNSUPPORTED_VALUE,\n\t\t\t \"%s: unsupported empty resource filename string segment: %d.\",\n\t\t\t function,\n\t\t\t resource_filename_segment_index );\n\n\t\t\tgoto on_error;\n\t\t}\n\t\telse if( ( resource_filename_string_segment_size == 2 )\n\t\t && ( resource_filename_string_segment[ 0 ] == (system_character_t) '.' ) )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_UNSUPPORTED_VALUE,\n\t\t\t \"%s: unsupported relative path in resource filename string segment: %d.\",\n\t\t\t function,\n\t\t\t resource_filename_segment_index );\n\n\t\t\tgoto on_error;\n\t\t}\n\t\telse if( ( resource_filename_string_segment_size == 3 )\n\t\t && ( resource_filename_string_segment[ 0 ] == (system_character_t) '.' )\n\t\t && ( resource_filename_string_segment[ 1 ] == (system_character_t) '.' ) )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_UNSUPPORTED_VALUE,\n\t\t\t \"%s: unsupported relative path in resource filename string segment: %d.\",\n\t\t\t function,\n\t\t\t resource_filename_segment_index );\n\n\t\t\tgoto on_error;\n\t\t}\n\t\telse if( ( resource_filename_string_segment[ 0 ] == (system_character_t) '%' )\n\t\t && ( resource_filename_string_segment[ resource_filename_string_segment_size - 2 ] == (system_character_t) '%' ) )\n\t\t{\n\t\t\tif( resource_filename_string_segment_size == 9 )\n\t\t\t{\n\t\t\t\t/* Expand %WinDir% to WINDOWS\n\t\t\t\t */\n\t\t\t\tif( system_string_compare_no_case(\n\t\t\t\t resource_filename_string_segment,\n\t\t\t\t _SYSTEM_STRING( \"%WinDir%\" ),\n\t\t\t\t 8 ) == 0 )\n\t\t\t\t{\n\t\t\t\t\tresource_filename_string_segment_size = 8;\n#if defined( WINAPI )\n\t\t\t\t\tvolume_letter = message_handle->windows_directory_path;\n#endif\n\t\t\t\t}\n\t\t\t}\n\t\t\telse if( resource_filename_string_segment_size == 13 )\n\t\t\t{\n\t\t\t\t/* Expand %SystemRoot%\n\t\t\t\t */\n\t\t\t\tif( system_string_compare_no_case(\n\t\t\t\t resource_filename_string_segment,\n\t\t\t\t _SYSTEM_STRING( \"%SystemRoot%\" ),\n\t\t\t\t 12 ) == 0 )\n\t\t\t\t{\n\t\t\t\t\tresource_filename_string_segment_size = message_handle->system_root_path_size - 3;\n#if defined( WINAPI )\n\t\t\t\t\tvolume_letter = message_handle->system_root_path;\n#endif\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t\t*resource_file_path_size += resource_filename_string_segment_size;\n\t}\n\tif( language_string != NULL )\n\t{\n\t\t/* Add: /.mui\n\t\t */\n\t\t*resource_file_path_size += language_string_length + 5;\n\t}\n\tif( message_handle->resource_files_path != NULL )\n\t{\n\t\tresource_files_path_length = system_string_length(\n\t\t message_handle->resource_files_path );\n\t}\n\tif( ( message_handle->resource_files_path != NULL )\n\t && ( resource_files_path_length > 0 ) )\n\t{\n\t\t*resource_file_path_size += resource_files_path_length;\n\n\t\tif( message_handle->resource_files_path[ resource_files_path_length - 1 ] != (system_character_t) LIBCPATH_SEPARATOR )\n\t\t{\n\t\t\t*resource_file_path_size += 1;\n\t\t}\n\t}\n#if defined( WINAPI )\n\telse if( volume_letter != NULL )\n\t{\n\t\t*resource_file_path_size += 3;\n\t}\n#endif\n\telse\n\t{\n\t\t*resource_file_path_size += 2;\n\t}\n\t*resource_file_path_size += 1;\n\n\t*resource_file_path = system_string_allocate(\n\t *resource_file_path_size );\n\n\tif( *resource_file_path == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_MEMORY,\n\t\t LIBCERROR_MEMORY_ERROR_INSUFFICIENT,\n\t\t \"%s: unable to create resource file path.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tresource_file_path_index = 0;\n\n\tif( ( message_handle->resource_files_path != NULL )\n\t && ( resource_files_path_length > 0 ) )\n\t{\n\t\tif( system_string_copy(\n\t\t &( ( *resource_file_path )[ resource_file_path_index ] ),\n\t\t message_handle->resource_files_path,\n\t\t resource_files_path_length ) == NULL )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_COPY_FAILED,\n\t\t\t \"%s: unable to copy resource files path to resource file path.\",\n\t\t\t function );\n\n\t\t\tgoto on_error;\n\t\t}\n\t\tresource_file_path_index += resource_files_path_length;\n\n\t\tif( message_handle->resource_files_path[ resource_files_path_length - 1 ] != (system_character_t) LIBCPATH_SEPARATOR )\n\t\t{\n\t\t\t( *resource_file_path )[ resource_file_path_index++ ] = (system_character_t) LIBCPATH_SEPARATOR;\n\t\t}\n\t}\n#if defined( WINAPI )\n\telse if( volume_letter != NULL )\n\t{\n\t\t( *resource_file_path )[ resource_file_path_index++ ] = volume_letter[ 0 ];\n\t\t( *resource_file_path )[ resource_file_path_index++ ] = (system_character_t) ':';\n\t\t( *resource_file_path )[ resource_file_path_index++ ] = (system_character_t) LIBCPATH_SEPARATOR;\n\t}\n#endif\n\telse\n\t{\n\t\t( *resource_file_path )[ resource_file_path_index++ ] = (system_character_t) '.';\n\t\t( *resource_file_path )[ resource_file_path_index++ ] = (system_character_t) LIBCPATH_SEPARATOR;\n\t}\n\tfor( resource_filename_segment_index = 0;\n\t resource_filename_segment_index < resource_filename_number_of_segments;\n\t resource_filename_segment_index++ )\n\t{\n\t\tif( ( language_string != NULL )\n\t\t && ( resource_filename_segment_index == ( resource_filename_number_of_segments - 1 ) ) )\n\t\t{\n\t\t\t/* Make a copy of the language string so it can be written to\n\t\t\t */\n\t\t\tmui_string_size = language_string_length + 1;\n\n\t\t\tmui_string = system_string_allocate(\n\t\t\t mui_string_size );\n\n\t\t\tif( mui_string == NULL )\n\t\t\t{\n\t\t\t\tlibcerror_error_set(\n\t\t\t\t error,\n\t\t\t\t LIBCERROR_ERROR_DOMAIN_MEMORY,\n\t\t\t\t LIBCERROR_MEMORY_ERROR_INSUFFICIENT,\n\t\t\t\t \"%s: unable to create MUI language string.\",\n\t\t\t\t function );\n\n\t\t\t\tgoto on_error;\n\t\t\t}\n\t\t\tif( system_string_copy(\n\t\t\t mui_string,\n\t\t\t language_string,\n\t\t\t language_string_length ) == NULL )\n\t\t\t{\n\t\t\t\tlibcerror_error_set(\n\t\t\t\t error,\n\t\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t\t LIBCERROR_RUNTIME_ERROR_COPY_FAILED,\n\t\t\t\t \"%s: unable to copy MUI language string.\",\n\t\t\t\t function );\n\n\t\t\t\tgoto on_error;\n\t\t\t}\n\t\t\tmui_string[ language_string_length ] = 0;\n\n\t\t\t( *resource_file_path )[ resource_file_path_index ] = 0;\n\n\t\t\tresult = path_handle_get_directory_entry_name_by_name_no_case(\n\t\t\t\t message_handle->path_handle,\n\t\t\t\t *resource_file_path,\n\t\t\t\t resource_file_path_index + 1,\n\t\t\t\t mui_string,\n\t\t\t\t mui_string_size,\n\t\t\t\t LIBCDIRECTORY_ENTRY_TYPE_DIRECTORY,\n\t\t\t\t error );\n\n\t\t\tif( result == -1 )\n\t\t\t{\n\t\t\t\tlibcerror_error_set(\n\t\t\t\t error,\n\t\t\t\t LIBCERROR_ERROR_DOMAIN_IO,\n\t\t\t\t LIBCERROR_IO_ERROR_GENERIC,\n\t\t\t\t \"%s: unable to determine if directory has entry: %\" PRIs_SYSTEM \".\",\n\t\t\t\t function,\n\t\t\t\t mui_string );\n\n\t\t\t\tgoto on_error;\n\t\t\t}\n\t\t\telse if( result != 0 )\n\t\t\t{\n\t\t\t\tif( system_string_copy(\n\t\t\t\t &( ( *resource_file_path )[ resource_file_path_index ] ),\n\t\t\t\t mui_string,\n\t\t\t\t language_string_length ) == NULL )\n\t\t\t\t{\n\t\t\t\t\tlibcerror_error_set(\n\t\t\t\t\t error,\n\t\t\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t\t\t LIBCERROR_RUNTIME_ERROR_SET_FAILED,\n\t\t\t\t\t \"%s: unable to set MUI language string in resource file path.\",\n\t\t\t\t\t function );\n\n\t\t\t\t\tgoto on_error;\n\t\t\t\t}\n\t\t\t\tresource_file_path_index += language_string_length;\n\n\t\t\t\t( *resource_file_path )[ resource_file_path_index++ ] = (system_character_t) LIBCPATH_SEPARATOR;\n\t\t\t}\n\t\t\tmemory_free(\n\t\t\t mui_string );\n\n\t\t\tmui_string = NULL;\n\n\t\t\tif( result == 0 )\n\t\t\t{\n\t\t\t\tbreak;\n\t\t\t}\n\t\t}\n\t\tif( system_split_string_get_segment_by_index(\n\t\t resource_filename_split_string,\n\t\t resource_filename_segment_index,\n\t\t &resource_filename_string_segment,\n\t\t &resource_filename_string_segment_size,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve resource filename string segment: %d.\",\n\t\t\t function,\n\t\t\t resource_filename_segment_index );\n\n\t\t\tgoto on_error;\n\t\t}\n\t\tif( resource_filename_string_segment == NULL )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_VALUE_MISSING,\n\t\t\t \"%s: missing resource filename string segment: %d.\",\n\t\t\t function,\n\t\t\t resource_filename_segment_index );\n\n\t\t\tgoto on_error;\n\t\t}\n\t\tif( ( resource_filename_string_segment[ 0 ] == (system_character_t) '%' )\n\t\t && ( resource_filename_string_segment[ resource_filename_string_segment_size - 2 ] == (system_character_t) '%' ) )\n\t\t{\n\t\t\tif( resource_filename_string_segment_size == 9 )\n\t\t\t{\n\t\t\t\t/* Expand %WinDir%\n\t\t\t\t */\n\t\t\t\tif( system_string_compare_no_case(\n\t\t\t\t resource_filename_string_segment,\n\t\t\t\t _SYSTEM_STRING( \"%WinDir%\" ),\n\t\t\t\t 8 ) == 0 )\n\t\t\t\t{\n\t\t\t\t\tresource_filename_string_segment = &( ( message_handle->windows_directory_path )[ 3 ] );\n\t\t\t\t\tresource_filename_string_segment_size = message_handle->windows_directory_path_size - 3;\n\t\t\t\t}\n\t\t\t}\n\t\t\telse if( resource_filename_string_segment_size == 13 )\n\t\t\t{\n\t\t\t\t/* Expand %SystemRoot%\n\t\t\t\t */\n\t\t\t\tif( system_string_compare_no_case(\n\t\t\t\t resource_filename_string_segment,\n\t\t\t\t _SYSTEM_STRING( \"%SystemRoot%\" ),\n\t\t\t\t 12 ) == 0 )\n\t\t\t\t{\n\t\t\t\t\tresource_filename_string_segment = &( ( message_handle->system_root_path )[ 3 ] );\n\t\t\t\t\tresource_filename_string_segment_size = message_handle->system_root_path_size - 3;\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t\tif( resource_filename_segment_index < ( resource_filename_number_of_segments - 1 ) )\n\t\t{\n\t\t\tdirectory_entry_type = LIBCDIRECTORY_ENTRY_TYPE_DIRECTORY;\n\t\t}\n\t\telse\n\t\t{\n\t\t\tif( language_string != NULL )\n\t\t\t{\n\t\t\t\t/* Add .mui to the filename\n\t\t\t \t */\n\t\t\t\tmui_string = system_string_allocate(\n\t\t\t\t\t resource_filename_string_segment_size + 4 );\n\n\t\t\t\tif( mui_string == NULL )\n\t\t\t\t{\n\t\t\t\t\tlibcerror_error_set(\n\t\t\t\t\t error,\n\t\t\t\t\t LIBCERROR_ERROR_DOMAIN_MEMORY,\n\t\t\t\t\t LIBCERROR_MEMORY_ERROR_INSUFFICIENT,\n\t\t\t\t\t \"%s: unable to create MUI resource filename string.\",\n\t\t\t\t\t function );\n\n\t\t\t\t\tgoto on_error;\n\t\t\t\t}\n\t\t\t\tresource_filename_string_segment_size--;\n\n\t\t\t\tif( system_string_copy(\n\t\t\t\t mui_string,\n\t\t\t\t resource_filename_string_segment,\n\t\t\t\t resource_filename_string_segment_size ) == NULL )\n\t\t\t\t{\n\t\t\t\t\tlibcerror_error_set(\n\t\t\t\t\t error,\n\t\t\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t\t\t LIBCERROR_RUNTIME_ERROR_COPY_FAILED,\n\t\t\t\t\t \"%s: unable to copy MUI resource filename string.\",\n\t\t\t\t\t function );\n\n\t\t\t\t\tgoto on_error;\n\t\t\t\t}\n\t\t\t\tmui_string[ resource_filename_string_segment_size++ ] = (system_character_t) '.';\n\t\t\t\tmui_string[ resource_filename_string_segment_size++ ] = (system_character_t) 'm';\n\t\t\t\tmui_string[ resource_filename_string_segment_size++ ] = (system_character_t) 'u';\n\t\t\t\tmui_string[ resource_filename_string_segment_size++ ] = (system_character_t) 'i';\n\t\t\t\tmui_string[ resource_filename_string_segment_size++ ] = 0;\n\n\t\t\t\tresource_filename_string_segment = mui_string;\n\t\t\t}\n\t\t\tdirectory_entry_type = LIBCDIRECTORY_ENTRY_TYPE_FILE;\n\t\t}\n\t\t( *resource_file_path )[ resource_file_path_index ] = 0;\n\n\t\tresult = path_handle_get_directory_entry_name_by_name_no_case(\n\t\t message_handle->path_handle,\n\t\t *resource_file_path,\n\t\t resource_file_path_index + 1,\n\t\t\t resource_filename_string_segment,\n\t\t\t resource_filename_string_segment_size,\n\t\t directory_entry_type,\n\t\t error );\n\n\t\tif( result == -1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_IO,\n\t\t\t LIBCERROR_IO_ERROR_GENERIC,\n\t\t\t \"%s: unable to determine if directory has entry: %\" PRIs_SYSTEM \".\",\n\t\t\t function,\n\t\t\t resource_filename_string_segment );\n\n\t\t\tgoto on_error;\n\t\t}\n\t\telse if( result != 0 )\n\t\t{\n\t\t\tif( system_string_copy(\n\t\t\t &( ( *resource_file_path )[ resource_file_path_index ] ),\n\t\t\t resource_filename_string_segment,\n\t\t\t resource_filename_string_segment_size - 1 ) == NULL )\n\t\t\t{\n\t\t\t\tlibcerror_error_set(\n\t\t\t\t error,\n\t\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t\t LIBCERROR_RUNTIME_ERROR_SET_FAILED,\n\t\t\t\t \"%s: unable to set resource filename string segment: %d in resource file path.\",\n\t\t\t\t function,\n\t\t\t\t resource_filename_segment_index );\n\n\t\t\t\tgoto on_error;\n\t\t\t}\n\t\t\tresource_file_path_index += resource_filename_string_segment_size - 1;\n\n\t\t\t( *resource_file_path )[ resource_file_path_index++ ] = (system_character_t) LIBCPATH_SEPARATOR;\n\t\t}\n\t\tif( mui_string != NULL )\n\t\t{\n\t\t\tmemory_free(\n\t\t\t mui_string );\n\n\t\t\tmui_string = NULL;\n\t\t}\n\t\tif( result == 0 )\n\t\t{\n\t\t\tbreak;\n\t\t}\n\t}\n\t( *resource_file_path )[ resource_file_path_index - 1 ] = 0;\n\n\tif( system_split_string_free(\n\t &resource_filename_split_string,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED,\n\t\t \"%s: unable to free resource filename split string.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\treturn( result );\n\non_error:\n\tif( mui_string != NULL )\n\t{\n\t\tmemory_free(\n\t\t mui_string );\n\t}\n\tif( resource_filename_split_string != NULL )\n\t{\n\t\tsystem_split_string_free(\n\t\t &resource_filename_split_string,\n\t\t NULL );\n\t}\n\tif( *resource_file_path != NULL )\n\t{\n\t\tmemory_free(\n\t\t *resource_file_path );\n\n\t\t*resource_file_path = NULL;\n\t}\n\t*resource_file_path_size = 0;\n\n\treturn( -1 );\n}\n\n/* Retrieves a specific resource file and adds it to the cache\n * Returns 1 if successful, 0 if resource file was not found or -1 error\n */\nint message_handle_get_resource_file(\n message_handle_t *message_handle,\n const system_character_t *resource_filename,\n size_t resource_filename_length,\n const system_character_t *resource_file_path,\n resource_file_t **resource_file,\n libcerror_error_t **error )\n{\n\tstatic char *function = \"message_handle_get_resource_file\";\n\tint64_t timestamp = 0;\n\n\tif( message_handle == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid message handle.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( resource_file == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid resource file.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( resource_file_initialize(\n\t resource_file,\n\t message_handle->preferred_language_identifier,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_INITIALIZE_FAILED,\n\t\t \"%s: unable to create resource file.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tif( resource_file_set_name(\n\t *resource_file,\n\t resource_filename,\n\t resource_filename_length,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_SET_FAILED,\n\t\t \"%s: unable to set name in resource file.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tif( resource_file_open(\n\t *resource_file,\n\t resource_file_path,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_IO,\n\t\t LIBCERROR_IO_ERROR_OPEN_FAILED,\n\t\t \"%s: unable to open resource file: %\" PRIs_SYSTEM \".\",\n\t\t function,\n\t\t resource_file_path );\n\n\t\tgoto on_error;\n\t}\n\tif( libfcache_date_time_get_timestamp(\n\t ×tamp,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to retrieve cache timestamp.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( libfcache_cache_set_value_by_index(\n\t message_handle->resource_file_cache,\n\t message_handle->next_resource_file_cache_index,\n\t 0,\n\t message_handle->next_resource_file_cache_index,\n\t timestamp,\n\t (intptr_t *) *resource_file,\n\t (int (*)(intptr_t **, libcerror_error_t **)) &resource_file_free,\n\t LIBFCACHE_CACHE_VALUE_FLAG_MANAGED,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_SET_FAILED,\n\t\t \"%s: unable to set resource file in cache entry: %d.\",\n\t\t function,\n\t\t message_handle->next_resource_file_cache_index );\n\n\t\tgoto on_error;\n\t}\n\tmessage_handle->next_resource_file_cache_index++;\n\n\tif( message_handle->next_resource_file_cache_index == 16 )\n\t{\n\t\tmessage_handle->next_resource_file_cache_index = 0;\n\t}\n\treturn( 1 );\n\non_error:\n\tif( *resource_file != NULL )\n\t{\n\t\tresource_file_free(\n\t\t resource_file,\n\t\t NULL );\n\t}\n\treturn( -1 );\n}\n\n/* Retrieves a specific resource file from the cache\n * Returns 1 if successful, 0 if not available or -1 error\n */\nint message_handle_get_resource_file_from_cache(\n message_handle_t *message_handle,\n const system_character_t *resource_filename,\n size_t resource_filename_length,\n resource_file_t **resource_file,\n libcerror_error_t **error )\n{\n\tlibfcache_cache_value_t *cache_value = NULL;\n\tstatic char *function = \"message_handle_get_resource_file_from_cache\";\n\tint cache_index = 0;\n\tint result = 0;\n\n\tif( message_handle == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid message handle.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( resource_file == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid resource file.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tfor( cache_index = 0;\n\t cache_index < 16;\n\t cache_index++ )\n\t{\n\t\tif( libfcache_cache_get_value_by_index(\n\t\t message_handle->resource_file_cache,\n\t\t cache_index,\n\t\t &cache_value,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve cache value: %d.\",\n\t\t\t function,\n\t\t\t cache_index );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\tif( cache_value != NULL )\n\t\t{\n\t\t\tif( libfcache_cache_value_get_value(\n\t\t\t cache_value,\n\t\t\t (intptr_t **) resource_file,\n\t\t\t error ) != 1 )\n\t\t\t{\n\t\t\t\tlibcerror_error_set(\n\t\t\t\t error,\n\t\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t\t \"%s: unable to retrieve resource file from cache value: %d.\",\n\t\t\t\t function,\n\t\t\t\t cache_index );\n\n\t\t\t\treturn( -1 );\n\t\t\t}\n\t\t}\n\t\tif( *resource_file != NULL )\n\t\t{\n\t\t\tif( ( resource_filename_length + 1 ) != ( *resource_file )->name_size )\n\t\t\t{\n\t\t\t\t*resource_file = NULL;\n\t\t\t}\n\t\t\telse if( system_string_compare(\n\t\t\t\t resource_filename,\n\t\t\t\t ( *resource_file )->name,\n\t\t\t\t resource_filename_length ) != 0 )\n\t\t\t{\n\t\t\t\t*resource_file = NULL;\n\t\t\t}\n\t\t}\n\t\tif( *resource_file != NULL )\n\t\t{\n\t\t\tresult = 1;\n\n\t\t\tbreak;\n\t\t}\n\t}\n\tif( result == 0 )\n\t{\n\t\t*resource_file = NULL;\n\t}\n\treturn( result );\n}\n\n/* Retrieves a specific MUI resource file and adds it to the cache\n * Returns 1 if successful, 0 if resource file was not found or -1 error\n */\nint message_handle_get_mui_resource_file(\n message_handle_t *message_handle,\n const system_character_t *resource_filename,\n size_t resource_filename_length,\n const system_character_t *resource_file_path,\n resource_file_t **resource_file,\n libcerror_error_t **error )\n{\n\tstatic char *function = \"message_handle_get_mui_resource_file\";\n\tint64_t timestamp = 0;\n\n\tif( message_handle == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid message handle.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( resource_file == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid resource file.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( resource_file_initialize(\n\t resource_file,\n\t message_handle->preferred_language_identifier,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_INITIALIZE_FAILED,\n\t\t \"%s: unable to create resource file.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tif( resource_file_set_name(\n\t *resource_file,\n\t resource_filename,\n\t resource_filename_length,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_SET_FAILED,\n\t\t \"%s: unable to set name in resource file.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tif( resource_file_open(\n\t *resource_file,\n\t resource_file_path,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_IO,\n\t\t LIBCERROR_IO_ERROR_OPEN_FAILED,\n\t\t \"%s: unable to open resource file: %\" PRIs_SYSTEM \".\",\n\t\t function,\n\t\t resource_file_path );\n\n\t\tgoto on_error;\n\t}\n\tif( libfcache_date_time_get_timestamp(\n\t ×tamp,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to retrieve cache timestamp.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( libfcache_cache_set_value_by_index(\n\t message_handle->mui_resource_file_cache,\n\t message_handle->next_mui_resource_file_cache_index,\n\t 0,\n\t message_handle->next_mui_resource_file_cache_index,\n\t timestamp,\n\t (intptr_t *) *resource_file,\n\t (int (*)(intptr_t **, libcerror_error_t **)) &resource_file_free,\n\t LIBFCACHE_CACHE_VALUE_FLAG_MANAGED,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_SET_FAILED,\n\t\t \"%s: unable to set resource file in cache entry: %d.\",\n\t\t function,\n\t\t message_handle->next_mui_resource_file_cache_index );\n\n\t\tgoto on_error;\n\t}\n\tmessage_handle->next_mui_resource_file_cache_index++;\n\n\tif( message_handle->next_mui_resource_file_cache_index == 16 )\n\t{\n\t\tmessage_handle->next_mui_resource_file_cache_index = 0;\n\t}\n\treturn( 1 );\n\non_error:\n\tif( resource_file != NULL )\n\t{\n\t\tresource_file_free(\n\t\t resource_file,\n\t\t NULL );\n\t}\n\treturn( -1 );\n}\n\n/* Retrieves a specific MUI resource file from the cache\n * Returns 1 if successful, 0 if resource file was not found or -1 error\n */\nint message_handle_get_mui_resource_file_from_cache(\n message_handle_t *message_handle,\n const system_character_t *resource_filename,\n size_t resource_filename_length,\n resource_file_t **resource_file,\n libcerror_error_t **error )\n{\n\tlibfcache_cache_value_t *cache_value = NULL;\n\tstatic char *function = \"message_handle_get_mui_resource_file_from_cache\";\n\tint cache_index = 0;\n\tint result = 0;\n\n\tif( message_handle == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid message handle.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( resource_file == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid resource file.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tfor( cache_index = 0;\n\t cache_index < 16;\n\t cache_index++ )\n\t{\n\t\tif( libfcache_cache_get_value_by_index(\n\t\t message_handle->mui_resource_file_cache,\n\t\t cache_index,\n\t\t &cache_value,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve cache value: %d.\",\n\t\t\t function,\n\t\t\t cache_index );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\tif( cache_value != NULL )\n\t\t{\n\t\t\tif( libfcache_cache_value_get_value(\n\t\t\t cache_value,\n\t\t\t (intptr_t **) resource_file,\n\t\t\t error ) != 1 )\n\t\t\t{\n\t\t\t\tlibcerror_error_set(\n\t\t\t\t error,\n\t\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t\t \"%s: unable to retrieve resource file from cache value: %d.\",\n\t\t\t\t function,\n\t\t\t\t cache_index );\n\n\t\t\t\treturn( -1 );\n\t\t\t}\n\t\t}\n\t\tif( *resource_file != NULL )\n\t\t{\n\t\t\tif( ( resource_filename_length + 1 ) != ( *resource_file )->name_size )\n\t\t\t{\n\t\t\t\t*resource_file = NULL;\n\t\t\t}\n\t\t\telse if( system_string_compare(\n\t\t\t\t resource_filename,\n\t\t\t\t ( *resource_file )->name,\n\t\t\t\t resource_filename_length ) != 0 )\n\t\t\t{\n\t\t\t\t*resource_file = NULL;\n\t\t\t}\n\t\t}\n\t\tif( *resource_file != NULL )\n\t\t{\n\t\t\tresult = 1;\n\n\t\t\tbreak;\n\t\t}\n\t}\n\treturn( result );\n}\n\n/* Retrieves the message string from a specific resource file\n * Returns 1 if successful, 0 if not available or -1 error\n */\nint message_handle_get_message_string_from_resource_file(\n message_handle_t *message_handle,\n const system_character_t *resource_filename,\n size_t resource_filename_length,\n uint32_t message_identifier,\n message_string_t **message_string,\n libcerror_error_t **error )\n{\n\tsystem_character_t *resource_file_path = NULL;\n\tsystem_character_t *mui_resource_file_path = NULL;\n\tresource_file_t *resource_file = NULL;\n\tstatic char *function = \"message_handle_get_message_string_from_resource_file\";\n\tsize_t resource_file_path_size = 0;\n\tsize_t mui_resource_file_path_size = 0;\n\tuint32_t mui_file_type = 0;\n\tint result = 0;\n\n\tif( message_handle == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid message handle.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( resource_filename == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid resource filename.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( ( resource_filename_length == 0 )\n\t || ( resource_filename_length > (size_t) SSIZE_MAX ) )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_VALUE_OUT_OF_BOUNDS,\n\t\t \"%s: invalid resource filename length value out of bounds.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( message_string == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid message string.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tresult = message_handle_get_resource_file_from_cache(\n\t\t message_handle,\n\t\t resource_filename,\n\t\t resource_filename_length,\n\t\t &resource_file,\n\t\t error );\n\n\tif( result == -1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to retrieve resource file from cache.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tif( result == 0 )\n\t{\n\t\tresult = message_handle_get_resource_file_path(\n\t\t message_handle,\n\t\t resource_filename,\n\t\t resource_filename_length,\n\t\t NULL,\n\t\t 0,\n\t\t &resource_file_path,\n\t\t &resource_file_path_size,\n\t\t error );\n\n\t\tif( result == -1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve resource file path.\",\n\t\t\t function );\n\n\t\t\tgoto on_error;\n\t\t}\n\t\telse if( result != 0 )\n\t\t{\n\t\t\tif( message_handle_get_resource_file(\n\t\t\t message_handle,\n\t\t\t resource_filename,\n\t\t\t resource_filename_length,\n\t\t\t resource_file_path,\n\t\t\t &resource_file,\n\t\t\t error ) != 1 )\n\t\t\t{\n\t\t\t\tlibcerror_error_set(\n\t\t\t\t error,\n\t\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t\t \"%s: unable to retrieve resource file: %\" PRIs_SYSTEM \".\",\n\t\t\t\t function,\n\t\t\t\t resource_file_path );\n\n\t\t\t\tgoto on_error;\n\t\t\t}\n\t\t}\n\t}\n\tif( resource_file != NULL )\n\t{\n\t\tresult = resource_file_get_message_string(\n\t\t\t resource_file,\n\t\t\t message_identifier,\n\t\t\t message_string,\n\t\t\t error );\n\n\t\tif( result == -1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve message string: 0x%08\" PRIx32 \".\",\n\t\t\t function,\n\t\t\t message_identifier );\n\n\t\t\tgoto on_error;\n\t\t}\n\t\telse if( result == 0 )\n\t\t{\n\t\t\tresult = resource_file_get_mui_file_type(\n\t\t\t\t resource_file,\n\t\t\t\t &mui_file_type,\n\t\t\t\t error );\n\n\t\t\tif( result == -1 )\n\t\t\t{\n\t\t\t\tlibcerror_error_set(\n\t\t\t\t error,\n\t\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t\t \"%s: unable to retrieve MUI file type.\",\n\t\t\t\t function );\n\n\t\t\t\tgoto on_error;\n\t\t\t}\n\t\t\telse if( result != 0 )\n\t\t\t{\n\t\t\t\tif( mui_file_type != 0x00000011UL )\n\t\t\t\t{\n\t\t\t\t\tlibcerror_error_set(\n\t\t\t\t\t error,\n\t\t\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t\t\t LIBCERROR_RUNTIME_ERROR_UNSUPPORTED_VALUE,\n\t\t\t\t\t \"%s: unsupported MUI file type: 0x%08\" PRIx32 \".\",\n\t\t\t\t\t function,\n\t\t\t\t\t mui_file_type );\n\t\t\t\t}\n\t\t\t\tresource_file = NULL;\n\n\t\t\t\tresult = message_handle_get_mui_resource_file_from_cache(\n\t\t\t\t\t message_handle,\n\t\t\t\t\t resource_filename,\n\t\t\t\t\t resource_filename_length,\n\t\t\t\t\t &resource_file,\n\t\t\t\t\t error );\n\n\t\t\t\tif( result == -1 )\n\t\t\t\t{\n\t\t\t\t\tlibcerror_error_set(\n\t\t\t\t\t error,\n\t\t\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t\t\t \"%s: unable to retrieve MUI resource file from cache.\",\n\t\t\t\t\t function );\n\n\t\t\t\t\tgoto on_error;\n\t\t\t\t}\n\t\t\t\telse if( result == 0 )\n\t\t\t\t{\n/* TODO add support to determine language string */\n\t\t\t\t\t/* The MUI resource file path is: %PATH%/%LANGUAGE%/%FILENAME%.mui\n\t\t\t\t\t */\n\t\t\t\t\tresult = message_handle_get_resource_file_path(\n\t\t\t\t\t\t message_handle,\n\t\t\t\t\t resource_filename,\n\t\t\t\t\t resource_filename_length,\n\t\t\t\t\t _SYSTEM_STRING( \"en-US\" ),\n\t\t\t\t\t 5,\n\t\t\t\t\t\t &mui_resource_file_path,\n\t\t\t\t\t\t &mui_resource_file_path_size,\n\t\t\t\t\t\t error );\n\n\t\t\t\t\tif( result == -1 )\n\t\t\t\t\t{\n\t\t\t\t\t\tlibcerror_error_set(\n\t\t\t\t\t\t error,\n\t\t\t\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t\t\t\t \"%s: unable to retrieve MUI resource file path.\",\n\t\t\t\t\t\t function );\n\n\t\t\t\t\t\tgoto on_error;\n\t\t\t\t\t}\n\t\t\t\t\telse if( result != 0 )\n\t\t\t\t\t{\n\t\t\t\t\t\tif( message_handle_get_mui_resource_file(\n\t\t\t\t\t\t message_handle,\n\t\t\t\t\t\t resource_filename,\n\t\t\t\t\t\t resource_filename_length,\n\t\t\t\t\t\t mui_resource_file_path,\n\t\t\t\t\t\t &resource_file,\n\t\t\t\t\t\t error ) != 1 )\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\tlibcerror_error_set(\n\t\t\t\t\t\t\t error,\n\t\t\t\t\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t\t\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t\t\t\t\t \"%s: unable to retrieve MUI resource file: %\" PRIs_SYSTEM \".\",\n\t\t\t\t\t\t\t function,\n\t\t\t\t\t\t\t mui_resource_file_path );\n\n\t\t\t\t\t\t\tgoto on_error;\n\t\t\t\t\t\t}\n\t\t\t\t\t\tmemory_free(\n\t\t\t\t\t\t mui_resource_file_path );\n\n\t\t\t\t\t\tmui_resource_file_path = NULL;\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t\tif( resource_file != NULL )\n\t\t\t\t{\n\t\t\t\t\tresult = resource_file_get_message_string(\n\t\t\t\t\t\t resource_file,\n\t\t\t\t\t\t message_identifier,\n\t\t\t\t\t\t message_string,\n\t\t\t\t\t\t error );\n\n\t\t\t\t\tif( result == -1 )\n\t\t\t\t\t{\n\t\t\t\t\t\tlibcerror_error_set(\n\t\t\t\t\t\t error,\n\t\t\t\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t\t\t\t \"%s: unable to retrieve message string: 0x%08\" PRIx32 \".\",\n\t\t\t\t\t\t function,\n\t\t\t\t\t\t message_identifier );\n\n\t\t\t\t\t\tgoto on_error;\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t}\n\tif( resource_file_path != NULL )\n\t{\n\t\tmemory_free(\n\t\t resource_file_path );\n\n\t\tresource_file_path = NULL;\n\t}\n\treturn( result );\n\non_error:\n\tif( mui_resource_file_path != NULL )\n\t{\n\t\tmemory_free(\n\t\t mui_resource_file_path );\n\t}\n\tif( resource_file_path != NULL )\n\t{\n\t\tmemory_free(\n\t\t resource_file_path );\n\t}\n\tif( *message_string != NULL )\n\t{\n\t\tmessage_string_free(\n\t\t message_string,\n\t\t NULL );\n\t}\n\treturn( -1 );\n}\n\n/* Retrieves the message string from one or more specified resource files\n * Returns 1 if successful, 0 if not available or -1 error\n */\nint message_handle_get_message_string(\n message_handle_t *message_handle,\n const system_character_t *resource_filename,\n size_t resource_filename_length,\n uint32_t message_identifier,\n message_string_t **message_string,\n libcerror_error_t **error )\n{\n\tsystem_character_t *resource_filename_string_segment = NULL;\n\tsystem_split_string_t *resource_filename_split_string = NULL;\n\tstatic char *function = \"message_handle_get_message_string\";\n\tsize_t resource_filename_string_segment_size = 0;\n\tint resource_filename_number_of_segments = 0;\n\tint resource_filename_segment_index = 0;\n\tint result = 0;\n\n\tif( message_handle == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid message handle.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( message_string == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid message string.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\t/* The resource filename can contain multiple file names separated by ;\n\t */\n\tif( system_string_split(\n\t resource_filename,\n\t resource_filename_length + 1,\n\t (system_character_t) ';',\n\t &resource_filename_split_string,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_INITIALIZE_FAILED,\n\t\t \"%s: unable to split resource filename.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tif( system_split_string_get_number_of_segments(\n\t resource_filename_split_string,\n\t &resource_filename_number_of_segments,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to retrieve number of resource filename string segments.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tfor( resource_filename_segment_index = 0;\n\t resource_filename_segment_index < resource_filename_number_of_segments;\n\t resource_filename_segment_index++ )\n\t{\n\t\tif( system_split_string_get_segment_by_index(\n\t\t resource_filename_split_string,\n\t\t resource_filename_segment_index,\n\t\t &resource_filename_string_segment,\n\t\t &resource_filename_string_segment_size,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve resource filename string segment: %d.\",\n\t\t\t function,\n\t\t\t resource_filename_segment_index );\n\n\t\t\tgoto on_error;\n\t\t}\n\t\tif( resource_filename_string_segment == NULL )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_VALUE_MISSING,\n\t\t\t \"%s: missing resource filename string segment: %d.\",\n\t\t\t function,\n\t\t\t resource_filename_segment_index );\n\n\t\t\tgoto on_error;\n\t\t}\n\t\tresult = message_handle_get_message_string_from_resource_file(\n\t\t\t message_handle,\n\t\t\t resource_filename_string_segment,\n\t\t\t resource_filename_string_segment_size - 1,\n\t\t\t message_identifier,\n\t\t\t message_string,\n\t\t\t error );\n\n\t\tif( result == -1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve message string: 0x%08\" PRIx32 \" from: %\" PRIs_SYSTEM \".\",\n\t\t\t function,\n\t\t\t message_identifier,\n\t\t\t resource_filename_string_segment );\n\n\t\t\tgoto on_error;\n\t\t}\n\t\telse if( result != 0 )\n\t\t{\n\t\t\tbreak;\n\t\t}\n\t}\n\tif( system_split_string_free(\n\t &resource_filename_split_string,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED,\n\t\t \"%s: unable to free resource filename split string.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\treturn( result );\n\non_error:\n\tif( resource_filename_split_string != NULL )\n\t{\n\t\tsystem_split_string_free(\n\t\t &resource_filename_split_string,\n\t\t NULL );\n\t}\n\tif( *message_string != NULL )\n\t{\n\t\tmessage_string_free(\n\t\t message_string,\n\t\t NULL );\n\t}\n\treturn( -1 );\n}\n\n/* Retrieves a specific resource file by provider identifier\n * Returns 1 if successful, 0 if not available or -1 error\n */\nint message_handle_get_resource_file_by_provider_identifier(\n message_handle_t *message_handle,\n const system_character_t *resource_filename,\n size_t resource_filename_length,\n const uint8_t *provider_identifier,\n size_t provider_identifier_size,\n resource_file_t **resource_file,\n libcerror_error_t **error )\n{\n\tlibfwevt_provider_t *provider = NULL;\n\tsystem_character_t *resource_file_path = NULL;\n\tsystem_character_t *resource_filename_string_segment = NULL;\n\tsystem_split_string_t *resource_filename_split_string = NULL;\n\tstatic char *function = \"message_handle_get_resource_file_by_provider_identifier\";\n\tsize_t resource_file_path_size = 0;\n\tsize_t resource_filename_string_segment_size = 0;\n\tint resource_filename_number_of_segments = 0;\n\tint resource_filename_segment_index = 0;\n\tint result = 0;\n\n\tif( message_handle == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid message handle.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( resource_file == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid resource file.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\t/* The resource filename can contain multiple file names separated by ;\n\t */\n\tif( system_string_split(\n\t resource_filename,\n\t resource_filename_length + 1,\n\t (system_character_t) ';',\n\t &resource_filename_split_string,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_INITIALIZE_FAILED,\n\t\t \"%s: unable to split resource filename.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tif( system_split_string_get_number_of_segments(\n\t resource_filename_split_string,\n\t &resource_filename_number_of_segments,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to retrieve number of resource filename string segments.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tfor( resource_filename_segment_index = 0;\n\t resource_filename_segment_index < resource_filename_number_of_segments;\n\t resource_filename_segment_index++ )\n\t{\n\t\tif( system_split_string_get_segment_by_index(\n\t\t resource_filename_split_string,\n\t\t resource_filename_segment_index,\n\t\t &resource_filename_string_segment,\n\t\t &resource_filename_string_segment_size,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve resource filename string segment: %d.\",\n\t\t\t function,\n\t\t\t resource_filename_segment_index );\n\n\t\t\tgoto on_error;\n\t\t}\n\t\tresult = message_handle_get_resource_file_from_cache(\n\t\t\t message_handle,\n\t\t\t resource_filename_string_segment,\n\t\t\t resource_filename_string_segment_size - 1,\n\t\t\t resource_file,\n\t\t\t error );\n\n\t\tif( result == -1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve resource file: %d from cache.\",\n\t\t\t function,\n\t\t\t resource_filename_segment_index );\n\n\t\t\tgoto on_error;\n\t\t}\n\t\tif( result == 0 )\n\t\t{\n\t\t\tresult = message_handle_get_resource_file_path(\n\t\t\t\t message_handle,\n\t\t\t\t resource_filename_string_segment,\n\t\t\t\t resource_filename_string_segment_size - 1,\n\t\t\t\t NULL,\n\t\t\t\t 0,\n\t\t\t\t &resource_file_path,\n\t\t\t\t &resource_file_path_size,\n\t\t\t\t error );\n\n\t\t\tif( result == -1 )\n\t\t\t{\n\t\t\t\tlibcerror_error_set(\n\t\t\t\t error,\n\t\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t\t \"%s: unable to retrieve resource file path.\",\n\t\t\t\t function );\n\n\t\t\t\tgoto on_error;\n\t\t\t}\n\t\t\telse if( result != 0 )\n\t\t\t{\n\t\t\t\tif( message_handle_get_resource_file(\n\t\t\t\t message_handle,\n\t\t\t\t resource_filename,\n\t\t\t\t resource_filename_length,\n\t\t\t\t resource_file_path,\n\t\t\t\t resource_file,\n\t\t\t\t error ) != 1 )\n\t\t\t\t{\n\t\t\t\t\tlibcerror_error_set(\n\t\t\t\t\t error,\n\t\t\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t\t\t \"%s: unable to retrieve resource file: %\" PRIs_SYSTEM \".\",\n\t\t\t\t\t function,\n\t\t\t\t\t resource_file_path );\n\n\t\t\t\t\tgoto on_error;\n\t\t\t\t}\n\t\t\t\tmemory_free(\n\t\t\t\t resource_file_path );\n\n\t\t\t\tresource_file_path = NULL;\n\t\t\t}\n\t\t}\n\t\tif( resource_file != NULL )\n\t\t{\n\t\t\tresult = resource_file_get_provider(\n\t\t\t *resource_file,\n\t\t\t\t provider_identifier,\n\t\t\t\t provider_identifier_size,\n\t\t\t\t &provider,\n\t\t\t\t error );\n\n\t\t\tif( result == -1 )\n\t\t\t{\n\t\t\t\tlibcerror_error_set(\n\t\t\t\t error,\n\t\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t\t \"%s: unable to retrieve provider.\",\n\t\t\t\t function );\n\n\t\t\t\tgoto on_error;\n\t\t\t}\n\t\t\telse if( result != 0 )\n\t\t\t{\n\t\t\t\tif( libfwevt_provider_free(\n\t\t\t\t &provider,\n\t\t\t\t error ) != 1 )\n\t\t\t\t{\n\t\t\t\t\tlibcerror_error_set(\n\t\t\t\t\t error,\n\t\t\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t\t\t LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED,\n\t\t\t\t\t \"%s: unable to free provider.\",\n\t\t\t\t\t function );\n\n\t\t\t\t\tgoto on_error;\n\t\t\t\t}\n\t\t\t\tbreak;\n\t\t\t}\n\t\t}\n\t}\n\tif( system_split_string_free(\n\t &resource_filename_split_string,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED,\n\t\t \"%s: unable to free resource filename split string.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\treturn( result );\n\non_error:\n\tif( resource_file_path != NULL )\n\t{\n\t\tmemory_free(\n\t\t resource_file_path );\n\t}\n\tif( resource_filename_split_string != NULL )\n\t{\n\t\tsystem_split_string_free(\n\t\t &resource_filename_split_string,\n\t\t NULL );\n\t}\n\treturn( -1 );\n}\n\n" }, { "path": "evtxtools/message_handle.h", "content": "/*\n * Message handle\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#if !defined( _MESSAGE_HANDLE_H )\n#define _MESSAGE_HANDLE_H\n\n#include \n#include \n\n#include \"evtxtools_libcerror.h\"\n#include \"evtxtools_libfcache.h\"\n#include \"evtxtools_libregf.h\"\n#include \"message_string.h\"\n#include \"path_handle.h\"\n#include \"registry_file.h\"\n#include \"resource_file.h\"\n\n#if defined( __cplusplus )\nextern \"C\" {\n#endif\n\ntypedef struct message_handle message_handle_t;\n\nstruct message_handle\n{\n\t/* The SOFTWARE registry filename\n\t */\n\tsystem_character_t *software_registry_filename;\n\n\t/* The SOFTWARE registry filename size\n\t */\n\tsize_t software_registry_filename_size;\n\n\t/* The SYSTEM registry filename\n\t */\n\tsystem_character_t *system_registry_filename;\n\n\t/* The SYSTEM registry filename size\n\t */\n\tsize_t system_registry_filename_size;\n\n\t/* The name of the directory containing the SOFTWARE and SYSTEM registry filename\n\t */\n\tsystem_character_t *registry_directory_name;\n\n\t/* The size of the name of the directory containing the SOFTWARE and SYSTEM registry filename\n\t */\n\tsize_t registry_directory_name_size;\n\n\t/* The SOFTWARE registry file\n\t */\n\tregistry_file_t *software_registry_file;\n\n\t/* The %SystemRoot% path\n\t */\n\tsystem_character_t *system_root_path;\n\n\t/* The %SystemRoot% path size\n\t */\n\tsize_t system_root_path_size;\n\n\t/* The %WinDir% path\n\t */\n\tsystem_character_t *windows_directory_path;\n\n\t/* The %WinDir% path size\n\t */\n\tsize_t windows_directory_path_size;\n\n\t/* The SYSTEM registry file\n\t */\n\tregistry_file_t *system_registry_file;\n\n\t/* The path handle\n\t */\n\tpath_handle_t *path_handle;\n\n\t/* The current control set\n\t */\n\tuint32_t current_control_set;\n\n\t/* The SOFTWARE WinEvt publishers key\n\t */\n\tlibregf_key_t *winevt_publishers_key;\n\n\t/* The SYSTEM (control set 1) eventlog services key\n\t */\n\tlibregf_key_t *control_set_1_eventlog_services_key;\n\n\t/* The SYSTEM (control set 2) eventlog services key\n\t */\n\tlibregf_key_t *control_set_2_eventlog_services_key;\n\n\t/* The resource files path\n\t */\n\tconst system_character_t *resource_files_path;\n\n\t/* The resource file cache\n\t */\n\tlibfcache_cache_t *resource_file_cache;\n\n\t/* The next available resource file cache index\n\t */\n\tint next_resource_file_cache_index;\n\n\t/* The MUI resource file cache\n\t */\n\tlibfcache_cache_t *mui_resource_file_cache;\n\n\t/* The next available MUI resource file cache index\n\t */\n\tint next_mui_resource_file_cache_index;\n\n\t/* The ascii codepage\n\t */\n\tint ascii_codepage;\n\n\t/* The preferred language identifier\n\t */\n\tuint32_t preferred_language_identifier;\n};\n\nint message_handle_initialize(\n message_handle_t **message_handle,\n libcerror_error_t **error );\n\nint message_handle_free(\n message_handle_t **message_handle,\n libcerror_error_t **error );\n\nint message_handle_signal_abort(\n message_handle_t *message_handle,\n libcerror_error_t **error );\n\nint message_handle_set_ascii_codepage(\n message_handle_t *message_handle,\n int ascii_codepage,\n libcerror_error_t **error );\n\nint message_handle_set_preferred_language_identifier(\n message_handle_t *message_handle,\n uint32_t preferred_language_identifier,\n libcerror_error_t **error );\n\nint message_handle_set_event_log_type_from_filename(\n message_handle_t *message_handle,\n const system_character_t *filename,\n libcerror_error_t **error );\n\nint message_handle_set_software_registry_filename(\n message_handle_t *message_handle,\n const system_character_t *filename,\n libcerror_error_t **error );\n\nint message_handle_set_system_registry_filename(\n message_handle_t *message_handle,\n const system_character_t *filename,\n libcerror_error_t **error );\n\nint message_handle_set_registry_directory_name(\n message_handle_t *message_handle,\n const system_character_t *name,\n libcerror_error_t **error );\n\nint message_handle_set_resource_files_path(\n message_handle_t *message_handle,\n const system_character_t *path,\n libcerror_error_t **error );\n\nint message_handle_open_software_registry_file(\n message_handle_t *message_handle,\n libcerror_error_t **error );\n\nint message_handle_open_system_registry_file(\n message_handle_t *message_handle,\n const char *eventlog_key_name,\n libcerror_error_t **error );\n\nint message_handle_open_input(\n message_handle_t *message_handle,\n const char *eventlog_key_name,\n libcerror_error_t **error );\n\nint message_handle_close_input(\n message_handle_t *message_handle,\n libcerror_error_t **error );\n\nint message_handle_get_value_by_event_source(\n message_handle_t *message_handle,\n const system_character_t *event_source,\n size_t event_source_length,\n const system_character_t *value_name,\n size_t value_name_length,\n system_character_t **value_string,\n size_t *value_string_size,\n libcerror_error_t **error );\n\nint message_handle_get_value_by_provider_identifier(\n message_handle_t *message_handle,\n const system_character_t *provider_identifier,\n size_t provider_identifier_length,\n const system_character_t *value_name,\n size_t value_name_length,\n system_character_t **value_string,\n size_t *value_string_size,\n libcerror_error_t **error );\n\nint message_handle_get_resource_file_path(\n message_handle_t *message_handle,\n const system_character_t *resource_filename,\n size_t resource_filename_length,\n const system_character_t *language_string,\n size_t language_string_length,\n system_character_t **resource_file_path,\n size_t *resource_file_path_size,\n libcerror_error_t **error );\n\nint message_handle_get_resource_file(\n message_handle_t *message_handle,\n const system_character_t *resource_filename,\n size_t resource_filename_length,\n const system_character_t *resource_file_path,\n resource_file_t **resource_file,\n libcerror_error_t **error );\n\nint message_handle_get_resource_file_from_cache(\n message_handle_t *message_handle,\n const system_character_t *resource_filename,\n size_t resource_filename_length,\n resource_file_t **resource_file,\n libcerror_error_t **error );\n\nint message_handle_get_mui_resource_file_path(\n message_handle_t *message_handle,\n const system_character_t *resource_filename,\n size_t resource_filename_length,\n system_character_t **resource_file_path,\n size_t *resource_file_path_size,\n libcerror_error_t **error );\n\nint message_handle_get_mui_resource_file(\n message_handle_t *message_handle,\n const system_character_t *resource_filename,\n size_t resource_filename_length,\n const system_character_t *resource_file_path,\n resource_file_t **resource_file,\n libcerror_error_t **error );\n\nint message_handle_get_mui_resource_file_from_cache(\n message_handle_t *message_handle,\n const system_character_t *resource_filename,\n size_t resource_filename_length,\n resource_file_t **resource_file,\n libcerror_error_t **error );\n\nint message_handle_get_message_string_from_resource_file(\n message_handle_t *message_handle,\n const system_character_t *resource_filename,\n size_t resource_filename_length,\n uint32_t message_identifier,\n message_string_t **message_string,\n libcerror_error_t **error );\n\nint message_handle_get_message_string(\n message_handle_t *message_handle,\n const system_character_t *resource_filename,\n size_t resource_filename_length,\n uint32_t message_identifier,\n message_string_t **message_string,\n libcerror_error_t **error );\n\nint message_handle_get_resource_file_by_provider_identifier(\n message_handle_t *message_handle,\n const system_character_t *resource_filename,\n size_t resource_filename_length,\n const uint8_t *provider_identifier,\n size_t provider_identifier_size,\n resource_file_t **resource_file,\n libcerror_error_t **error );\n\n#if defined( __cplusplus )\n}\n#endif\n\n#endif /* !defined( _MESSAGE_HANDLE_H ) */\n\n" }, { "path": "evtxtools/message_string.c", "content": "/*\n * Message string\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#include \n#include \n#include \n#include \n#include \n#include \n#include \n\n#include \"evtxtools_libcerror.h\"\n#include \"evtxtools_libevtx.h\"\n#include \"evtxtools_libwrc.h\"\n#include \"message_string.h\"\n\n/* Creates a message string\n * Make sure the value message_string is referencing, is set to NULL\n * Returns 1 if successful or -1 on error\n */\nint message_string_initialize(\n message_string_t **message_string,\n uint32_t message_string_identifier,\n libcerror_error_t **error )\n{\n\tstatic char *function = \"message_string_initialize\";\n\n\tif( message_string == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid message string.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( *message_string != NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_VALUE_ALREADY_SET,\n\t\t \"%s: invalid message string value already set.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\t*message_string = memory_allocate_structure(\n\t message_string_t );\n\n\tif( *message_string == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_MEMORY,\n\t\t LIBCERROR_MEMORY_ERROR_INSUFFICIENT,\n\t\t \"%s: unable to create message string.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tif( memory_set(\n\t *message_string,\n\t 0,\n\t sizeof( message_string_t ) ) == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_MEMORY,\n\t\t LIBCERROR_MEMORY_ERROR_SET_FAILED,\n\t\t \"%s: unable to clear message string.\",\n\t\t function );\n\n\t\tmemory_free(\n\t\t *message_string );\n\n\t\t*message_string = NULL;\n\n\t\treturn( -1 );\n\t}\n\t( *message_string )->identifier = message_string_identifier;\n\n\treturn( 1 );\n\non_error:\n\tif( *message_string != NULL )\n\t{\n\t\tmemory_free(\n\t\t *message_string );\n\n\t\t*message_string = NULL;\n\t}\n\treturn( -1 );\n}\n\n/* Frees a message string\n * Returns 1 if successful or -1 on error\n */\nint message_string_free(\n message_string_t **message_string,\n libcerror_error_t **error )\n{\n\tstatic char *function = \"message_string_free\";\n\tint result = 1;\n\n\tif( message_string == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid message string.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( *message_string != NULL )\n\t{\n\t\tif( ( *message_string )->string != NULL )\n\t\t{\n\t\t\tmemory_free(\n\t\t\t ( *message_string )->string );\n\t\t}\n\t\tmemory_free(\n\t\t *message_string );\n\n\t\t*message_string = NULL;\n\t}\n\treturn( result );\n}\n\n/* Retrieve the message string from the message table resource\n * Returns 1 if successful, 0 if not available or -1 on error\n */\nint message_string_get_from_message_table_resource(\n message_string_t *message_string,\n libwrc_message_table_resource_t *message_table_resource,\n libcerror_error_t **error )\n{\n\tstatic char *function = \"message_string_get_from_message_table_resource\";\n\tint message_index = 0;\n\tint result = 0;\n\n\tif( message_string == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid message string.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( message_string->string != NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_VALUE_ALREADY_SET,\n\t\t \"%s: invalid message string - string value already set.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tresult = libwrc_message_table_resource_get_index_by_identifier(\n\t\t message_table_resource,\n\t\t message_string->identifier,\n\t\t &message_index,\n\t\t error );\n\n\tif( result == -1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to retrieve message index for identifier: 0x%08\" PRIx32 \".\",\n\t\t function,\n\t\t message_string->identifier );\n\n\t\tgoto on_error;\n\t}\n\telse if( result != 0 )\n\t{\n#if defined( HAVE_WIDE_SYSTEM_CHARACTER )\n\t\tresult = libwrc_message_table_resource_get_utf16_string_size(\n\t\t\t message_table_resource,\n\t\t\t message_index,\n\t\t\t &( message_string->string_size ),\n\t\t\t error );\n#else\n\t\tresult = libwrc_message_table_resource_get_utf8_string_size(\n\t\t\t message_table_resource,\n\t\t\t message_index,\n\t\t\t &( message_string->string_size ),\n\t\t\t error );\n#endif\n\t\tif( result != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve message: %d size.\",\n\t\t\t function,\n\t\t\t message_index );\n\n\t\t\tgoto on_error;\n\t\t}\n\t\tmessage_string->string = system_string_allocate(\n\t\t message_string->string_size );\n\n\t\tif( message_string->string == NULL )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_MEMORY,\n\t\t\t LIBCERROR_MEMORY_ERROR_INSUFFICIENT,\n\t\t\t \"%s: unable to create message string.\",\n\t\t\t function );\n\n\t\t\tgoto on_error;\n\t\t}\n#if defined( HAVE_WIDE_SYSTEM_CHARACTER )\n\t\tresult = libwrc_message_table_resource_get_utf16_string(\n\t\t\t message_table_resource,\n\t\t\t message_index,\n\t\t\t (uint16_t *) message_string->string,\n\t\t\t message_string->string_size,\n\t\t\t error );\n#else\n\t\tresult = libwrc_message_table_resource_get_utf8_string(\n\t\t\t message_table_resource,\n\t\t\t message_index,\n\t\t\t (uint8_t *) message_string->string,\n\t\t\t message_string->string_size,\n\t\t\t error );\n#endif\n\t\tif( result != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve message string: %d.\",\n\t\t\t function,\n\t\t\t message_index );\n\n\t\t\tgoto on_error;\n\t\t}\n\t}\n\treturn( result );\n\non_error:\n\tif( message_string->string != NULL )\n\t{\n\t\tmemory_free(\n\t\t message_string->string );\n\n\t\tmessage_string->string = NULL;\n\t}\n\tmessage_string->string_size = 0;\n\n\treturn( -1 );\n}\n\n/* Prints the message string to a FILE stream\n * Returns 1 if successful or -1 on error\n */\nint message_string_fprint(\n message_string_t *message_string,\n libevtx_record_t *record,\n FILE *stream,\n libcerror_error_t **error )\n{\n\tsystem_character_t *value_string = NULL;\n\tstatic char *function = \"message_string_fprint\";\n\tsize_t conversion_specifier_length = 0;\n\tsize_t message_string_length = 0;\n\tsize_t message_string_index = 0;\n\tsize_t value_string_size = 0;\n\tsystem_character_t last_character = 0;\n\tint number_of_strings = 0;\n\tint result = 0;\n\tint value_string_index = 0;\n\n\tif( message_string == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid message string.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( libevtx_record_get_number_of_strings(\n\t record,\n\t &number_of_strings,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to retrieve number of strings in record.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n#if defined( HAVE_DEBUG_OUTPUT )\n\tfprintf(\n\t stream,\n\t \"Message format string\\t\\t: %\" PRIs_SYSTEM \"\\n\",\n\t message_string->string );\n#endif\n\tfprintf(\n\t stream,\n\t \"Message string\\t\\t\\t: \" );\n\n\tmessage_string_length = message_string->string_size - 1;\n\tmessage_string_index = 0;\n\n\twhile( message_string_index < message_string_length )\n\t{\n\t\tif( ( ( message_string->string )[ message_string_index ] == (system_character_t) '%' )\n\t\t && ( ( message_string_index + 1 ) < message_string_length ) )\n\t\t{\n/* TODO add support for more conversion specifiers */\n\t\t\t/* Ignore %0 = end of string, %r = cariage return */\n\t\t\tif( ( ( message_string->string )[ message_string_index + 1 ] == (system_character_t) '0' )\n\t\t\t || ( ( message_string->string )[ message_string_index + 1 ] == (system_character_t) 'r' ) )\n\t\t\t{\n\t\t\t\tmessage_string_index += 2;\n\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\t/* Replace:\n\t\t\t * % = \n\t\t\t * %! = !\n\t\t\t * %% = %\n\t\t\t * %. = .\n\t\t\t */\n\t\t\tif( ( ( message_string->string )[ message_string_index + 1 ] == (system_character_t) ' ' )\n\t\t\t || ( ( message_string->string )[ message_string_index + 1 ] == (system_character_t) '!' )\n\t\t\t || ( ( message_string->string )[ message_string_index + 1 ] == (system_character_t) '%' )\n\t\t\t || ( ( message_string->string )[ message_string_index + 1 ] == (system_character_t) '.' ) )\n\t\t\t{\n\t\t\t\tlast_character = ( message_string->string )[ message_string_index + 1 ];\n\n\t\t\t\tfprintf(\n\t\t\t\t stream,\n\t\t\t\t \"%c\",\n\t\t\t\t last_character );\n\n\t\t\t\tmessage_string_index += 2;\n\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\t/* Replace %b = */\n\t\t\tif( ( message_string->string )[ message_string_index + 1 ] == (system_character_t) 'b' )\n\t\t\t{\n\t\t\t\tlast_character = (system_character_t) ' ';\n\n\t\t\t\tfprintf(\n\t\t\t\t stream,\n\t\t\t\t \"%c\",\n\t\t\t\t last_character );\n\n\t\t\t\tmessage_string_index += 2;\n\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\t/* Replace %n = */\n\t\t\tif( ( message_string->string )[ message_string_index + 1 ] == (system_character_t) 'n' )\n\t\t\t{\n\t\t\t\tif( last_character != (system_character_t) '\\n' )\n\t\t\t\t{\n\t\t\t\t\tlast_character = (system_character_t) '\\n';\n\n\t\t\t\t\tfprintf(\n\t\t\t\t\t stream,\n\t\t\t\t\t \"%c\",\n\t\t\t\t\t last_character );\n\t\t\t\t}\n\t\t\t\tmessage_string_index += 2;\n\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\t/* Replace %t = */\n\t\t\tif( ( message_string->string )[ message_string_index + 1 ] == (system_character_t) 't' )\n\t\t\t{\n\t\t\t\tlast_character = (system_character_t) '\\t';\n\n\t\t\t\tfprintf(\n\t\t\t\t stream,\n\t\t\t\t \"%c\",\n\t\t\t\t last_character );\n\n\t\t\t\tmessage_string_index += 2;\n\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tif( ( ( message_string->string )[ message_string_index + 1 ] < (system_character_t) '1' )\n\t\t\t || ( ( message_string->string )[ message_string_index + 1 ] > (system_character_t) '9' ) )\n\t\t\t{\n\t\t\t\tlibcerror_error_set(\n\t\t\t\t error,\n\t\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t\t LIBCERROR_RUNTIME_ERROR_UNSUPPORTED_VALUE,\n\t\t\t\t \"%s: unsupported conversion specifier: %\" PRIs_SYSTEM \".\",\n\t\t\t\t function,\n\t\t\t\t &( ( message_string->string )[ message_string_index ] ) );\n\n\t\t\t\tgoto on_error;\n\t\t\t}\n\t\t\tvalue_string_index = (int) ( message_string->string )[ message_string_index + 1 ] - (int) '0';\n\n\t\t\tconversion_specifier_length = 2;\n\n\t\t \tif( ( ( message_string_index + 3 ) < message_string_length )\n\t\t\t && ( ( message_string->string )[ message_string_index + 2 ] >= (system_character_t) '0' )\n\t\t\t && ( ( message_string->string )[ message_string_index + 2 ] <= (system_character_t) '9' ) )\n\t\t\t{\n\t\t\t\tvalue_string_index *= 10;\n\t\t\t\tvalue_string_index += (int) ( message_string->string )[ message_string_index + 2 ] - (int) '0';\n\n\t\t\t\tconversion_specifier_length += 1;\n\t\t\t}\n\t\t\tvalue_string_index -= 1;\n\n\t\t \tif( ( ( message_string_index + conversion_specifier_length + 3 ) < message_string_length )\n\t\t\t && ( ( message_string->string )[ message_string_index + conversion_specifier_length ] == (system_character_t) '!' ) )\n\t\t\t{\n\t\t\t\tif( ( ( message_string->string )[ message_string_index + conversion_specifier_length + 1 ] != (system_character_t) 's' )\n\t\t\t\t || ( ( message_string->string )[ message_string_index + conversion_specifier_length + 2 ] != (system_character_t) '!' ) )\n\t\t\t\t{\n\t\t\t\t\tlibcerror_error_set(\n\t\t\t\t\t error,\n\t\t\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t\t\t LIBCERROR_RUNTIME_ERROR_UNSUPPORTED_VALUE,\n\t\t\t\t\t \"%s: unsupported conversion specifier: %\" PRIs_SYSTEM \".\",\n\t\t\t\t\t function,\n\t\t\t\t\t &( ( message_string->string )[ message_string_index ] ) );\n\n\t\t\t\t\tgoto on_error;\n\t\t\t\t}\n\t\t\t\tconversion_specifier_length += 3;\n\t\t\t}\n/* TODO remove index check after user data support */\n\t\t\tif( value_string_index < number_of_strings )\n\t\t\t{\n#if defined( HAVE_WIDE_SYSTEM_CHARACTER )\n\t\t\t\tresult = libevtx_record_get_utf16_string_size(\n\t\t\t\t\t record,\n\t\t\t\t\t value_string_index,\n\t\t\t\t\t &value_string_size,\n\t\t\t\t\t error );\n#else\n\t\t\t\tresult = libevtx_record_get_utf8_string_size(\n\t\t\t\t\t record,\n\t\t\t\t\t value_string_index,\n\t\t\t\t\t &value_string_size,\n\t\t\t\t\t error );\n#endif\n\t\t\t\tif( result != 1 )\n\t\t\t\t{\n\t\t\t\t\tlibcerror_error_set(\n\t\t\t\t\t error,\n\t\t\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t\t\t \"%s: unable to retrieve string: %d size.\",\n\t\t\t\t\t function,\n\t\t\t\t\t value_string_index );\n\n\t\t\t\t\tgoto on_error;\n\t\t\t\t}\n\t\t\t\tif( value_string_size > 0 )\n\t\t\t\t{\n\t\t\t\t\tvalue_string = system_string_allocate(\n\t\t\t\t\t\t\tvalue_string_size );\n\n\t\t\t\t\tif( value_string == NULL )\n\t\t\t\t\t{\n\t\t\t\t\t\tlibcerror_error_set(\n\t\t\t\t\t\t error,\n\t\t\t\t\t\t LIBCERROR_ERROR_DOMAIN_MEMORY,\n\t\t\t\t\t\t LIBCERROR_MEMORY_ERROR_INSUFFICIENT,\n\t\t\t\t\t\t \"%s: unable to create value string.\",\n\t\t\t\t\t\t function );\n\n\t\t\t\t\t\tgoto on_error;\n\t\t\t\t\t}\n#if defined( HAVE_WIDE_SYSTEM_CHARACTER )\n\t\t\t\t\tresult = libevtx_record_get_utf16_string(\n\t\t\t\t\t\t record,\n\t\t\t\t\t\t value_string_index,\n\t\t\t\t\t\t (uint16_t *) value_string,\n\t\t\t\t\t\t value_string_size,\n\t\t\t\t\t\t error );\n#else\n\t\t\t\t\tresult = libevtx_record_get_utf8_string(\n\t\t\t\t\t\t record,\n\t\t\t\t\t\t value_string_index,\n\t\t\t\t\t\t (uint8_t *) value_string,\n\t\t\t\t\t\t value_string_size,\n\t\t\t\t\t\t error );\n#endif\n\t\t\t\t\tif( result != 1 )\n\t\t\t\t\t{\n\t\t\t\t\t\tlibcerror_error_set(\n\t\t\t\t\t\t error,\n\t\t\t\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t\t\t\t \"%s: unable to retrieve string: %d.\",\n\t\t\t\t\t\t function,\n\t\t\t\t\t\t value_string_index );\n\n\t\t\t\t\t\tgoto on_error;\n\t\t\t\t\t}\n\t\t\t\t\tfprintf(\n\t\t\t\t\t stream,\n\t\t\t\t\t \"%\" PRIs_SYSTEM \"\",\n\t\t\t\t\t value_string );\n\n\t\t\t\t\tmemory_free(\n\t\t\t\t\t value_string );\n\n\t\t\t\t\tvalue_string = NULL;\n\t\t\t\t}\n\t\t\t\tmessage_string_index += conversion_specifier_length;\n\t\t\t}\n\t\t\telse\n\t\t\t{\n\t\t\t\tdo\n\t\t\t\t{\n\t\t\t\t\tfprintf(\n\t\t\t\t\t stream,\n\t\t\t\t\t \"%\" PRIc_SYSTEM \"\",\n\t\t\t\t\t ( message_string->string )[ message_string_index++ ] );\n\n\t\t\t\t\tconversion_specifier_length--;\n\t\t\t\t}\n\t\t\t\twhile( conversion_specifier_length > 0 );\n\n\t\t\t\tlast_character = ( message_string->string )[ message_string_index ];\n\t\t\t}\n\t\t}\n\t\telse\n\t\t{\n\t\t\tif( ( message_string->string )[ message_string_index ] != 0 )\n\t\t\t{\n\t\t\t\tif( ( message_string->string )[ message_string_index ] == (system_character_t) '\\r' )\n\t\t\t\t{\n\t\t\t\t\t/* Ignore \\r characters */\n\t\t\t\t}\n\t\t\t\telse if( ( ( message_string->string )[ message_string_index ] == (system_character_t) '\\n' )\n\t\t\t\t && ( last_character == (system_character_t) '\\n' ) )\n\t\t\t\t{\n\t\t\t\t\t/* Ignore multiple \\n characters */\n\t\t\t\t}\n\t\t\t\telse\n\t\t\t\t{\n\t\t\t\t\tfprintf(\n\t\t\t\t\t stream,\n\t\t\t\t\t \"%\" PRIc_SYSTEM \"\",\n\t\t\t\t\t ( message_string->string )[ message_string_index ] );\n\n\t\t\t\t\tlast_character = ( message_string->string )[ message_string_index ];\n\t\t\t\t}\n\t\t\t}\n\t\t\tmessage_string_index += 1;\n\t\t}\n\t}\n\tfprintf(\n\t stream,\n\t \"\\n\" );\n\n\treturn( 1 );\n\non_error:\n\tif( value_string != NULL )\n\t{\n\t\tmemory_free(\n\t\t value_string );\n\t}\n\treturn( -1 );\n}\n\n" }, { "path": "evtxtools/message_string.h", "content": "/*\n * Message string\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#if !defined( _MESSAGE_STRING_H )\n#define _MESSAGE_STRING_H\n\n#include \n#include \n#include \n\n#include \"evtxtools_libcerror.h\"\n#include \"evtxtools_libevtx.h\"\n#include \"evtxtools_libwrc.h\"\n\n#if defined( __cplusplus )\nextern \"C\" {\n#endif\n\ntypedef struct message_string message_string_t;\n\nstruct message_string\n{\n\t/* The identifier\n\t */\n\tuint32_t identifier;\n\n\t/* The string\n\t */\n\tsystem_character_t *string;\n\n\t/* The string size\n\t */\n\tsize_t string_size;\n};\n\nint message_string_initialize(\n message_string_t **message_string,\n uint32_t message_string_identifier,\n libcerror_error_t **error );\n\nint message_string_free(\n message_string_t **message_string,\n libcerror_error_t **error );\n\nint message_string_get_from_message_table_resource(\n message_string_t *message_string,\n libwrc_message_table_resource_t *message_table_resource,\n libcerror_error_t **error );\n\nint message_string_fprint(\n message_string_t *message_string,\n libevtx_record_t *record,\n FILE *stream,\n libcerror_error_t **error );\n\n#if defined( __cplusplus )\n}\n#endif\n\n#endif /* !defined( _MESSAGE_STRING_H ) */\n\n" }, { "path": "evtxtools/path_handle.c", "content": "/*\n * Path handle\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#include \n#include \n#include \n#include \n#include \n#include \n\n#include \"evtxtools_libcdirectory.h\"\n#include \"evtxtools_libcerror.h\"\n#include \"path_handle.h\"\n\n/* Creates a path handle\n * Make sure the value path_handle is referencing, is set to NULL\n * Returns 1 if successful or -1 on error\n */\nint path_handle_initialize(\n path_handle_t **path_handle,\n libcerror_error_t **error )\n{\n\tstatic char *function = \"path_handle_initialize\";\n\n\tif( path_handle == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid path handle.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( *path_handle != NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_VALUE_ALREADY_SET,\n\t\t \"%s: invalid path handle value already set.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\t*path_handle = memory_allocate_structure(\n\t path_handle_t );\n\n\tif( *path_handle == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_MEMORY,\n\t\t LIBCERROR_MEMORY_ERROR_INSUFFICIENT,\n\t\t \"%s: unable to create path handle.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tif( memory_set(\n\t *path_handle,\n\t 0,\n\t sizeof( path_handle_t ) ) == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_MEMORY,\n\t\t LIBCERROR_MEMORY_ERROR_SET_FAILED,\n\t\t \"%s: unable to clear path handle.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\treturn( 1 );\n\non_error:\n\tif( *path_handle != NULL )\n\t{\n\t\tmemory_free(\n\t\t *path_handle );\n\n\t\t*path_handle = NULL;\n\t}\n\treturn( -1 );\n}\n\n/* Frees a path handle\n * Returns 1 if successful or -1 on error\n */\nint path_handle_free(\n path_handle_t **path_handle,\n libcerror_error_t **error )\n{\n\tstatic char *function = \"path_handle_free\";\n\tint result = 1;\n\n\tif( path_handle == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid path handle.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( *path_handle != NULL )\n\t{\n\t\tif( ( *path_handle )->system_root_path != NULL )\n\t\t{\n\t\t\tmemory_free(\n\t\t\t ( *path_handle )->system_root_path );\n\t\t}\n\t\tmemory_free(\n\t\t *path_handle );\n\n\t\t*path_handle = NULL;\n\t}\n\treturn( result );\n}\n\n/* Retrieves the name of a directory entry by name ignoring case\n * If a corresponding entry is found entry name is update\n * This function is needed to find case insensitive directory entries on a case sensitive system\n * Return 1 if successful, 0 if no corresponding entry was found or -1 on error\n */\nint path_handle_get_directory_entry_name_by_name_no_case(\n path_handle_t *path_handle,\n const system_character_t *path,\n size_t path_length,\n system_character_t *entry_name,\n size_t entry_name_size,\n uint8_t entry_type,\n libcerror_error_t **error )\n{\n\tlibcdirectory_directory_t *directory = NULL;\n\tlibcdirectory_directory_entry_t *directory_entry = NULL;\n\tsystem_character_t *directory_entry_name = NULL;\n\tstatic char *function = \"path_handle_get_directory_entry_name_by_name_no_case\";\n\tsize_t directory_entry_name_length = 0;\n\tint result = 0;\n\n\tif( path_handle == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid path handle.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( path_length > (size_t) SSIZE_MAX )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_VALUE_EXCEEDS_MAXIMUM,\n\t\t \"%s: invalid path length value exceeds maximum.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( entry_name == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid entry name.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( entry_name_size > (size_t) SSIZE_MAX )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_VALUE_EXCEEDS_MAXIMUM,\n\t\t \"%s: invalid entry name size value exceeds maximum.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( entry_name == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid entry name.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( libcdirectory_directory_initialize(\n\t &directory,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_INITIALIZE_FAILED,\n\t\t \"%s: unable to create directory.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n#if defined( HAVE_WIDE_SYSTEM_CHARACTER )\n\tresult = libcdirectory_directory_open_wide(\n\t\t directory,\n\t\t path,\n\t\t error );\n#else\n\tresult = libcdirectory_directory_open(\n\t\t directory,\n\t\t path,\n\t\t error );\n#endif\n\tif( result != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_IO,\n\t\t LIBCERROR_IO_ERROR_OPEN_FAILED,\n\t\t \"%s: unable to open directory: %\" PRIs_SYSTEM \".\",\n\t\t function,\n\t\t path );\n\n\t\tgoto on_error;\n\t}\n\tif( libcdirectory_directory_entry_initialize(\n\t &directory_entry,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_INITIALIZE_FAILED,\n\t\t \"%s: unable to create directory entry.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n#if defined( HAVE_WIDE_SYSTEM_CHARACTER )\n\tresult = libcdirectory_directory_has_entry_wide(\n\t\t directory,\n\t\t directory_entry,\n\t\t entry_name,\n\t\t entry_name_size - 1,\n\t\t entry_type,\n\t\t LIBCDIRECTORY_COMPARE_FLAG_NO_CASE,\n\t\t error );\n#else\n\tresult = libcdirectory_directory_has_entry(\n\t\t directory,\n\t\t directory_entry,\n\t\t entry_name,\n\t\t entry_name_size - 1,\n\t\t entry_type,\n\t\t LIBCDIRECTORY_COMPARE_FLAG_NO_CASE,\n\t\t error );\n#endif\n\tif( result == -1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_IO,\n\t\t LIBCERROR_IO_ERROR_GENERIC,\n\t\t \"%s: unable to determine if directory has entry: %\" PRIs_SYSTEM \".\",\n\t\t function,\n\t\t entry_name );\n\n\t\tgoto on_error;\n\t}\n\telse if( result != 0 )\n\t{\n#if defined( HAVE_WIDE_SYSTEM_CHARACTER )\n\t\tresult = libcdirectory_directory_entry_get_name_wide(\n\t\t\t directory_entry,\n\t\t\t (wchar_t **) &directory_entry_name,\n\t\t\t error );\n#else\n\t\tresult = libcdirectory_directory_entry_get_name(\n\t\t\t directory_entry,\n\t\t\t (char **) &directory_entry_name,\n\t\t\t error );\n#endif\n\t\tif( result != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve directory entry name.\",\n\t\t\t function );\n\n\t\t\tgoto on_error;\n\t\t}\n\t\tdirectory_entry_name_length = system_string_length(\n\t\t\t\t\t directory_entry_name );\n\n\t\tif( ( directory_entry_name_length + 1 ) != entry_name_size )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,\n\t\t\t \"%s: entry name length value out of bounds.\",\n\t\t\t function );\n\n\t\t\tgoto on_error;\n\t\t}\n\t\tif( system_string_copy(\n\t\t entry_name,\n\t\t directory_entry_name,\n\t\t directory_entry_name_length ) == NULL )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_SET_FAILED,\n\t\t\t \"%s: unable to set entry name.\",\n\t\t\t function );\n\n\t\t\tgoto on_error;\n\t\t}\n\t}\n\tif( libcdirectory_directory_entry_free(\n\t &directory_entry,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED,\n\t\t \"%s: unable to free directory entry.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tif( libcdirectory_directory_close(\n\t directory,\n\t error ) != 0 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_IO,\n\t\t LIBCERROR_IO_ERROR_CLOSE_FAILED,\n\t\t \"%s: unable to close directory.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tif( libcdirectory_directory_free(\n\t &directory,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED,\n\t\t \"%s: unable to free directory.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\treturn( result );\n\non_error:\n\tif( directory_entry != NULL )\n\t{\n\t\tlibcdirectory_directory_entry_free(\n\t\t &directory_entry,\n\t\t NULL );\n\t}\n\tif( directory != NULL )\n\t{\n\t\tlibcdirectory_directory_free(\n\t\t &directory,\n\t\t NULL );\n\t}\n\treturn( -1 );\n}\n\n" }, { "path": "evtxtools/path_handle.h", "content": "/*\n * Path handle\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#if !defined( _PATH_HANDLE_H )\n#define _PATH_HANDLE_H\n\n#include \n#include \n\n#include \"evtxtools_libcerror.h\"\n\n#if defined( __cplusplus )\nextern \"C\" {\n#endif\n\ntypedef struct path_handle path_handle_t;\n\nstruct path_handle\n{\n\t/* The %SystemRoot% path\n\t */\n\tsystem_character_t *system_root_path;\n\n\t/* The %SystemRoot% path size\n\t */\n\tsize_t system_root_path_size;\n};\n\nint path_handle_initialize(\n path_handle_t **path_handle,\n libcerror_error_t **error );\n\nint path_handle_free(\n path_handle_t **path_handle,\n libcerror_error_t **error );\n\nint path_handle_get_directory_entry_name_by_name_no_case(\n path_handle_t *path_handle,\n const system_character_t *path,\n size_t path_length,\n system_character_t *entry_name,\n size_t entry_name_size,\n uint8_t entry_type,\n libcerror_error_t **error );\n\n#if defined( __cplusplus )\n}\n#endif\n\n#endif /* !defined( _PATH_HANDLE_H ) */\n\n" }, { "path": "evtxtools/registry_file.c", "content": "/*\n * Registry file\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#include \n#include \n#include \n#include \n#include \n#include \n\n#include \"evtxtools_libcerror.h\"\n#include \"evtxtools_libregf.h\"\n#include \"evtxtools_wide_string.h\"\n#include \"registry_file.h\"\n\n/* Creates a registry file\n * Make sure the value registry_file is referencing, is set to NULL\n * Returns 1 if successful or -1 on error\n */\nint registry_file_initialize(\n registry_file_t **registry_file,\n libcerror_error_t **error )\n{\n\tstatic char *function = \"registry_file_initialize\";\n\n\tif( registry_file == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid registry file.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( *registry_file != NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_VALUE_ALREADY_SET,\n\t\t \"%s: invalid registry file value already set.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\t*registry_file = memory_allocate_structure(\n\t registry_file_t );\n\n\tif( *registry_file == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_MEMORY,\n\t\t LIBCERROR_MEMORY_ERROR_INSUFFICIENT,\n\t\t \"%s: unable to create registry file.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tif( memory_set(\n\t *registry_file,\n\t 0,\n\t sizeof( registry_file_t ) ) == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_MEMORY,\n\t\t LIBCERROR_MEMORY_ERROR_SET_FAILED,\n\t\t \"%s: unable to clear registry file.\",\n\t\t function );\n\n\t\tmemory_free(\n\t\t *registry_file );\n\n\t\t*registry_file = NULL;\n\n\t\treturn( -1 );\n\t}\n\tif( libregf_file_initialize(\n\t &( ( *registry_file )->regf_file ),\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_INITIALIZE_FAILED,\n\t\t \"%s: unable to initialize REGF file.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\treturn( 1 );\n\non_error:\n\tif( *registry_file != NULL )\n\t{\n\t\tmemory_free(\n\t\t *registry_file );\n\n\t\t*registry_file = NULL;\n\t}\n\treturn( -1 );\n}\n\n/* Frees a registry file\n * Returns 1 if successful or -1 on error\n */\nint registry_file_free(\n registry_file_t **registry_file,\n libcerror_error_t **error )\n{\n\tstatic char *function = \"registry_file_free\";\n\tint result = 1;\n\n\tif( registry_file == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid registry file.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( *registry_file != NULL )\n\t{\n\t\tif( ( *registry_file )->is_open != 0 )\n\t\t{\n\t\t\tif( registry_file_close(\n\t\t\t *registry_file,\n\t\t\t error ) != 0 )\n\t\t\t{\n\t\t\t\tlibcerror_error_set(\n\t\t\t\t error,\n\t\t\t\t LIBCERROR_ERROR_DOMAIN_IO,\n\t\t\t\t LIBCERROR_IO_ERROR_CLOSE_FAILED,\n\t\t\t\t \"%s: unable to close registry file.\",\n\t\t\t\t function );\n\n\t\t\t\tresult = -1;\n\t\t\t}\n\t\t}\n\t\tif( libregf_file_free(\n\t\t &( ( *registry_file )->regf_file ),\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED,\n\t\t\t \"%s: unable to free REGF file.\",\n\t\t\t function );\n\n\t\t\tresult = -1;\n\t\t}\n\t\tmemory_free(\n\t\t *registry_file );\n\n\t\t*registry_file = NULL;\n\t}\n\treturn( result );\n}\n\n/* Signals the registry file to abort\n * Returns 1 if successful or -1 on error\n */\nint registry_file_signal_abort(\n registry_file_t *registry_file,\n libcerror_error_t **error )\n{\n\tstatic char *function = \"registry_file_signal_abort\";\n\n\tif( registry_file == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid registry file.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( registry_file->regf_file != NULL )\n\t{\n\t\tif( libregf_file_signal_abort(\n\t\t registry_file->regf_file,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_SET_FAILED,\n\t\t\t \"%s: unable to signal REGF file to abort.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t}\n\treturn( 1 );\n}\n\n/* Sets the ascii codepage\n * Returns 1 if successful or -1 on error\n */\nint registry_file_set_ascii_codepage(\n registry_file_t *registry_file,\n int ascii_codepage,\n libcerror_error_t **error )\n{\n\tstatic char *function = \"registry_file_set_ascii_codepage\";\n\n\tif( registry_file == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid registry file.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( libregf_file_set_ascii_codepage(\n\t registry_file->regf_file,\n\t ascii_codepage,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_SET_FAILED,\n\t\t \"%s: unable to set ASCII codepage in REGF file.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\treturn( 1 );\n}\n\n/* Opens the registry file\n * Returns 1 if successful or -1 on error\n */\nint registry_file_open(\n registry_file_t *registry_file,\n const system_character_t *filename,\n libcerror_error_t **error )\n{\n\tlibregf_key_t *sub_key = NULL;\n\tlibregf_value_t *value = NULL;\n\tsystem_character_t *name = NULL;\n\tstatic char *function = \"registry_file_open\";\n\tconst char *sub_key_path = NULL;\n\tconst char *value_name = NULL;\n\tsize_t name_size = 0;\n\tsize_t sub_key_path_length = 0;\n\tsize_t value_name_length = 0;\n\tint number_of_sub_keys = 0;\n\tint result = 0;\n\n\tif( registry_file == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid registry file.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( registry_file->is_open != 0 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_VALUE_ALREADY_SET,\n\t\t \"%s: invalid registry file already open.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n#if defined( HAVE_WIDE_SYSTEM_CHARACTER )\n\tif( libregf_file_open_wide(\n\t registry_file->regf_file,\n\t filename,\n\t LIBREGF_OPEN_READ,\n\t error ) != 1 )\n#else\n\tif( libregf_file_open(\n\t registry_file->regf_file,\n\t filename,\n\t LIBREGF_OPEN_READ,\n\t error ) != 1 )\n#endif\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_IO,\n\t\t LIBCERROR_IO_ERROR_OPEN_FAILED,\n\t\t \"%s: unable to open REGF file.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tif( libregf_file_get_root_key(\n\t registry_file->regf_file,\n\t &( registry_file->root_key ),\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to retrieve root key.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tif( libregf_key_get_number_of_sub_keys(\n\t registry_file->root_key,\n\t &number_of_sub_keys,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to retrieve number of sub keys.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tif( number_of_sub_keys == 1 )\n\t{\n#if defined( HAVE_WIDE_SYSTEM_CHARACTER )\n\t\tresult = libregf_key_get_utf16_name_size(\n\t\t registry_file->root_key,\n\t\t &name_size,\n\t\t error );\n#else\n\t\tresult = libregf_key_get_utf8_name_size(\n\t\t registry_file->root_key,\n\t\t &name_size,\n\t\t error );\n#endif\n\t\tif( result != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve root key name size.\",\n\t\t\t function );\n\n\t\t\tgoto on_error;\n\t\t}\n\t\tif( ( result != 0 )\n\t\t && ( name_size > 0 ) )\n\t\t{\n\t\t\tif( ( name_size > (size_t) SSIZE_MAX )\n\t\t\t || ( ( sizeof( system_character_t ) * name_size ) > (size_t) SSIZE_MAX ) )\n\t\t\t{\n\t\t\t\tlibcerror_error_set(\n\t\t\t\t error,\n\t\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t\t LIBCERROR_RUNTIME_ERROR_VALUE_EXCEEDS_MAXIMUM,\n\t\t\t\t \"%s: invalid name size value exceeds maximum.\",\n\t\t\t\t function );\n\n\t\t\t\tgoto on_error;\n\t\t\t}\n\t\t\tname = system_string_allocate(\n\t\t\t\tname_size );\n\n\t\t\tif( name == NULL )\n\t\t\t{\n\t\t\t\tlibcerror_error_set(\n\t\t\t\t error,\n\t\t\t\t LIBCERROR_ERROR_DOMAIN_MEMORY,\n\t\t\t\t LIBCERROR_MEMORY_ERROR_INSUFFICIENT,\n\t\t\t\t \"%s: unable to create name string.\",\n\t\t\t\t function );\n\n\t\t\t\tgoto on_error;\n\t\t\t}\n#if defined( HAVE_WIDE_SYSTEM_CHARACTER )\n\t\t\tresult = libregf_key_get_utf16_name(\n\t\t\t\t registry_file->root_key,\n\t\t\t\t (uint16_t *) name,\n\t\t\t\t name_size,\n\t\t\t\t error );\n#else\n\t\t\tresult = libregf_key_get_utf8_name(\n\t\t\t\t registry_file->root_key,\n\t\t\t\t (uint8_t *) name,\n\t\t\t\t name_size,\n\t\t\t\t error );\n#endif\n\t\t\tif( result != 1 )\n\t\t\t{\n\t\t\t\tlibcerror_error_set(\n\t\t\t\t error,\n\t\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t\t \"%s: unable to retrieve root key name.\",\n\t\t\t\t function );\n\n\t\t\t\tgoto on_error;\n\t\t\t}\n\t\t\tresult = 0;\n\n/* TODO what about Windows NT4 */\n\t\t\tif( name_size == 13 )\n\t\t\t{\n\t\t\t\t/* Root key used by Windows 2000, XP, 2003\n\t\t\t\t */\n\t\t\t\tif( system_string_compare_no_case(\n\t\t\t\t name,\n\t\t\t\t _SYSTEM_STRING( \"$$$PROTO.HIV\" ),\n\t\t\t\t 12 ) == 0 )\n\t\t\t\t{\n\t\t\t\t\tresult = 1;\n\t\t\t\t}\n\t\t\t}\n\t\t\telse if( name_size == 53 )\n\t\t\t{\n\t\t\t\t/* Root key used by Windows Vista, 2008, 7\n\t\t\t\t */\n\t\t\t\tif( system_string_compare_no_case(\n\t\t\t\t name,\n\t\t\t\t _SYSTEM_STRING( \"CMI-CreateHive{\" ),\n\t\t\t\t 15 ) == 0 )\n\t\t\t\t{\n\t\t\t\t\tif( name[ 51 ] == (system_character_t) '}' )\n\t\t\t\t\t{\n\t\t\t\t\t\tresult = 1;\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\t\telse if( name_size == 58 )\n\t\t\t{\n\t\t\t\t/* Root key used by Windows 8\n\t\t\t\t */\n\t\t\t\tif( system_string_compare_no_case(\n\t\t\t\t name,\n\t\t\t\t _SYSTEM_STRING( \"CsiTool-CreateHive-{\" ),\n\t\t\t\t 20 ) == 0 )\n\t\t\t\t{\n\t\t\t\t\tif( name[ 56 ] == (system_character_t) '}' )\n\t\t\t\t\t{\n\t\t\t\t\t\tresult = 1;\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\t\tmemory_free(\n\t\t\t name );\n\n\t\t\tname = NULL;\n\t\t}\n\t\tif( result != 0 )\n\t\t{\n\t\t\tif( libregf_key_get_sub_key(\n\t\t\t registry_file->root_key,\n\t\t\t 0,\n\t\t\t &( registry_file->base_key ),\n\t\t\t error ) != 1 )\n\t\t\t{\n\t\t\t\tlibcerror_error_set(\n\t\t\t\t error,\n\t\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t\t \"%s: unable to retrieve base key.\",\n\t\t\t\t function );\n\n\t\t\t\tgoto on_error;\n\t\t\t}\n\t\t}\n\t}\n\telse if( number_of_sub_keys > 1 )\n\t{\n\t\tregistry_file->base_key = registry_file->root_key;\n\t}\n\tif( libregf_key_get_number_of_sub_keys(\n\t registry_file->base_key,\n\t &number_of_sub_keys,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to retrieve number of sub keys.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\t/* Get the current control set from:\n\t * SYSTEM\\Select\\Current\n\t */\n\tsub_key_path = \"Select\";\n\n\tsub_key_path_length = narrow_string_length(\n\t sub_key_path );\n\n\tresult = libregf_key_get_sub_key_by_utf8_path(\n\t\t registry_file->base_key,\n\t\t (uint8_t *) sub_key_path,\n\t\t sub_key_path_length,\n\t\t &sub_key,\n\t\t error );\n\n\tif( result == -1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to retrieve sub key: %s.\",\n\t\t function,\n\t\t sub_key_path );\n\n\t\tgoto on_error;\n\t}\n\telse if( result != 0 )\n\t{\n\t\tvalue_name = \"Current\";\n\n\t\tvalue_name_length = narrow_string_length(\n\t\t value_name );\n\n\t\tresult = libregf_key_get_value_by_utf8_name(\n\t\t\t sub_key,\n\t\t\t (uint8_t *) value_name,\n\t\t\t value_name_length,\n\t\t\t &value,\n\t\t\t error );\n\n\t\tif( result == -1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve value: %s.\",\n\t\t\t function,\n\t\t\t value_name );\n\n\t\t\tgoto on_error;\n\t\t}\n\t\telse if( result != 0 )\n\t\t{\n\t\t\tif( libregf_value_get_value_32bit(\n\t\t\t value,\n\t\t\t &( registry_file->current_control_set ),\n\t\t\t error ) != 1 )\n\t\t\t{\n\t\t\t\tlibcerror_error_set(\n\t\t\t\t error,\n\t\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t\t \"%s: unable to retrieve 32-bit value: %s.\",\n\t\t\t\t function,\n\t\t\t\t value_name );\n\n\t\t\t\tgoto on_error;\n\t\t\t}\n\t\t\tif( libregf_value_free(\n\t\t\t &value,\n\t\t\t error ) != 1 )\n\t\t\t{\n\t\t\t\tlibcerror_error_set(\n\t\t\t\t error,\n\t\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t\t LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED,\n\t\t\t\t \"%s: unable to free value.\",\n\t\t\t\t function );\n\n\t\t\t\tgoto on_error;\n\t\t\t}\n\t\t}\n\t}\n\tif( libregf_key_free(\n\t &sub_key,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED,\n\t\t \"%s: unable to free sub key.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\t/* Retrieve the control set 1 key: SYSTEM\\ControlSet001\n\t */\n\tsub_key_path = \"ControlSet001\";\n\n\tsub_key_path_length = narrow_string_length(\n\t sub_key_path );\n\n\tresult = libregf_key_get_sub_key_by_utf8_path(\n\t\t registry_file->base_key,\n\t\t (uint8_t *) sub_key_path,\n\t\t sub_key_path_length,\n\t\t &( registry_file->control_set1_key ),\n\t\t error );\n\n\tif( result == -1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to retrieve sub key: %s.\",\n\t\t function,\n\t\t sub_key_path );\n\n\t\tgoto on_error;\n\t}\n\t/* Retrieve the control set 2 key: SYSTEM\\ControlSet002\n\t */\n\tsub_key_path = \"ControlSet002\";\n\n\tsub_key_path_length = narrow_string_length(\n\t sub_key_path );\n\n\tresult = libregf_key_get_sub_key_by_utf8_path(\n\t\t registry_file->base_key,\n\t\t (uint8_t *) sub_key_path,\n\t\t sub_key_path_length,\n\t\t &( registry_file->control_set2_key ),\n\t\t error );\n\n\tif( result == -1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to retrieve sub key: %s.\",\n\t\t function,\n\t\t sub_key_path );\n\n\t\tgoto on_error;\n\t}\n\tif( ( registry_file->current_control_set != 0 )\n\t || ( registry_file->control_set1_key != NULL )\n\t || ( registry_file->control_set2_key != NULL ) )\n\t{\n\t\tif( ( registry_file->current_control_set != 1 )\n\t\t && ( registry_file->current_control_set != 2 ) )\n\t\t{\n/* TODO print debug notification */\n\t\t\tregistry_file->current_control_set = 1;\n\t\t}\n\t\tif( ( registry_file->current_control_set == 1 )\n\t\t && ( registry_file->control_set1_key != NULL ) )\n\t\t{\n\t\t\tregistry_file->current_control_set_key = registry_file->control_set1_key;\n\t\t}\n\t\telse if( ( registry_file->current_control_set == 2 )\n\t\t && ( registry_file->control_set2_key != NULL ) )\n\t\t{\n\t\t\tregistry_file->current_control_set_key = registry_file->control_set2_key;\n\t\t}\n\t}\n\tregistry_file->is_open = 1;\n\n\treturn( 1 );\n\non_error:\n\tif( value != NULL )\n\t{\n\t\tlibregf_value_free(\n\t\t &value,\n\t\t NULL );\n\t}\n\tif( sub_key != NULL )\n\t{\n\t\tlibregf_key_free(\n\t\t &sub_key,\n\t\t NULL );\n\t}\n\tif( registry_file->control_set2_key != NULL )\n\t{\n\t\tlibregf_key_free(\n\t\t &( registry_file->control_set2_key ),\n\t\t NULL );\n\t}\n\tif( registry_file->control_set1_key != NULL )\n\t{\n\t\tlibregf_key_free(\n\t\t &( registry_file->control_set1_key ),\n\t\t NULL );\n\t}\n\tif( ( registry_file->base_key != NULL )\n\t && ( registry_file->base_key != registry_file->root_key ) )\n\t{\n\t\tlibregf_key_free(\n\t\t &( registry_file->base_key ),\n\t\t NULL );\n\t}\n\tif( name != NULL )\n\t{\n\t\tmemory_free(\n\t\t name );\n\t}\n\tif( registry_file->root_key != NULL )\n\t{\n\t\tlibregf_key_free(\n\t\t &( registry_file->root_key ),\n\t\t NULL );\n\t}\n\tlibregf_file_close(\n\t registry_file->regf_file,\n\t NULL );\n\n\treturn( -1 );\n}\n\n/* Closes the registry file\n * Returns the 0 if succesful or -1 on error\n */\nint registry_file_close(\n registry_file_t *registry_file,\n libcerror_error_t **error )\n{\n\tstatic char *function = \"registry_file_close\";\n\tint result = 0;\n\n\tif( registry_file == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid registry file.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( registry_file->is_open != 0 )\n\t{\n\t\tif( registry_file->control_set2_key != NULL )\n\t\t{\n\t\t\tif( libregf_key_free(\n\t\t\t &( registry_file->control_set2_key ),\n\t\t\t error ) != 1 )\n\t\t\t{\n\t\t\t\tlibcerror_error_set(\n\t\t\t\t error,\n\t\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t\t LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED,\n\t\t\t\t \"%s: unable to free control set 2 key.\",\n\t\t\t\t function );\n\n\t\t\t\tresult = -1;\n\t\t\t}\n\t\t}\n\t\tif( registry_file->control_set1_key != NULL )\n\t\t{\n\t\t\tif( libregf_key_free(\n\t\t\t &( registry_file->control_set1_key ),\n\t\t\t error ) != 1 )\n\t\t\t{\n\t\t\t\tlibcerror_error_set(\n\t\t\t\t error,\n\t\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t\t LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED,\n\t\t\t\t \"%s: unable to free control set 1 key.\",\n\t\t\t\t function );\n\n\t\t\t\tresult = -1;\n\t\t\t}\n\t\t}\n\t\tif( ( registry_file->base_key != NULL )\n\t\t && ( registry_file->base_key != registry_file->root_key ) )\n\t\t{\n\t\t\tif( libregf_key_free(\n\t\t\t &( registry_file->base_key ),\n\t\t\t error ) != 1 )\n\t\t\t{\n\t\t\t\tlibcerror_error_set(\n\t\t\t\t error,\n\t\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t\t LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED,\n\t\t\t\t \"%s: unable to free base key.\",\n\t\t\t\t function );\n\n\t\t\t\tresult = -1;\n\t\t\t}\n\t\t}\n\t\tif( registry_file->root_key != NULL )\n\t\t{\n\t\t\tif( libregf_key_free(\n\t\t\t &( registry_file->root_key ),\n\t\t\t error ) != 1 )\n\t\t\t{\n\t\t\t\tlibcerror_error_set(\n\t\t\t\t error,\n\t\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t\t LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED,\n\t\t\t\t \"%s: unable to free root key.\",\n\t\t\t\t function );\n\n\t\t\t\tresult = -1;\n\t\t\t}\n\t\t}\n\t\tif( libregf_file_close(\n\t\t registry_file->regf_file,\n\t\t error ) != 0 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_IO,\n\t\t\t LIBCERROR_IO_ERROR_CLOSE_FAILED,\n\t\t\t \"%s: unable to close REGF file.\",\n\t\t\t function );\n\n\t\t\tresult = -1;\n\t\t}\n\t\tregistry_file->is_open = 0;\n\t}\n\treturn( result );\n}\n\n/* Retrieves the key specified by the path\n * Returns 1 if successful or -1 on error\n */\nint registry_file_get_key_by_path(\n registry_file_t *registry_file,\n const system_character_t *key_path,\n size_t key_path_length,\n libregf_key_t **key,\n libcerror_error_t **error )\n{\n\tstatic char *function = \"registry_file_get_key_by_path\";\n\tint result = 0;\n\n\tif( registry_file == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid registry file.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n#if defined( HAVE_WIDE_SYSTEM_CHARACTER )\n\tresult = libregf_key_get_sub_key_by_utf16_path(\n\t registry_file->base_key,\n\t (uint16_t *) key_path,\n\t key_path_length,\n\t key,\n\t error );\n#else\n\tresult = libregf_key_get_sub_key_by_utf8_path(\n\t registry_file->base_key,\n\t (uint8_t *) key_path,\n\t key_path_length,\n\t key,\n\t error );\n#endif\n\tif( result == -1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to retrieve key by path: %\" PRIs_SYSTEM \".\",\n\t\t function,\n\t\t key_path );\n\n\t\treturn( -1 );\n\t}\n\treturn( result );\n}\n\n" }, { "path": "evtxtools/registry_file.h", "content": "/*\n * Registry file\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#if !defined( _REGISTRY_FILE_H )\n#define _REGISTRY_FILE_H\n\n#include \n#include \n\n#include \"evtxtools_libcerror.h\"\n#include \"evtxtools_libregf.h\"\n\n#if defined( __cplusplus )\nextern \"C\" {\n#endif\n\n/* TODO add more types */\nenum REGISTRY_FILE_TYPES\n{\n\tREGISTRY_FILE_TYPE_NTUSER_DAT,\n\tREGISTRY_FILE_TYPE_SAM,\n\tREGISTRY_FILE_TYPE_SECURITY,\n\tREGISTRY_FILE_TYPE_SOFTWARE,\n\tREGISTRY_FILE_TYPE_SYSTEM\n};\n\ntypedef struct registry_file registry_file_t;\n\nstruct registry_file\n{\n\t/* The libregf file\n\t */\n\tlibregf_file_t *regf_file;\n\n\t/* The registry file type\n\t */\n\tuint8_t type;\n\n\t/* The libregf root key\n\t */\n\tlibregf_key_t *root_key;\n\n\t/* The libregf base key\n\t */\n\tlibregf_key_t *base_key;\n\n\t/* The current control set\n\t */\n\tuint32_t current_control_set;\n\n\t/* The current control set key\n\t */\n\tlibregf_key_t *current_control_set_key;\n\n\t/* The control set 1 key\n\t */\n\tlibregf_key_t *control_set1_key;\n\n\t/* The control set 2 key\n\t */\n\tlibregf_key_t *control_set2_key;\n\n\t/* Value to indicate if the message file is open\n\t */\n\tint is_open;\n};\n\nint registry_file_initialize(\n registry_file_t **registry_file,\n libcerror_error_t **error );\n\nint registry_file_free(\n registry_file_t **registry_file,\n libcerror_error_t **error );\n\nint registry_file_signal_abort(\n registry_file_t *registry_file,\n libcerror_error_t **error );\n\nint registry_file_set_ascii_codepage(\n registry_file_t *registry_file,\n int ascii_codepage,\n libcerror_error_t **error );\n\nint registry_file_open(\n registry_file_t *registry_file,\n const system_character_t *filename,\n libcerror_error_t **error );\n\nint registry_file_close(\n registry_file_t *registry_file,\n libcerror_error_t **error );\n\nint registry_file_get_key_by_path(\n registry_file_t *registry_file,\n const system_character_t *key_path,\n size_t key_path_length,\n libregf_key_t **key,\n libcerror_error_t **error );\n\n#if defined( __cplusplus )\n}\n#endif\n\n#endif /* !defined( _REGISTRY_FILE_H ) */\n\n" }, { "path": "evtxtools/resource_file.c", "content": "/*\n * Resource file\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#include \n#include \n#include \n#include \n#include \n#include \n\n#include \"evtxtools_libbfio.h\"\n#include \"evtxtools_libcerror.h\"\n#include \"evtxtools_libcnotify.h\"\n#include \"evtxtools_libexe.h\"\n#include \"evtxtools_libfcache.h\"\n#include \"evtxtools_libfwevt.h\"\n#include \"evtxtools_libwrc.h\"\n#include \"message_string.h\"\n#include \"resource_file.h\"\n\n/* Creates a resource file\n * Make sure the value resource_file is referencing, is set to NULL\n * Returns 1 if successful or -1 on error\n */\nint resource_file_initialize(\n resource_file_t **resource_file,\n uint32_t preferred_language_identifier,\n libcerror_error_t **error )\n{\n\tstatic char *function = \"resource_file_initialize\";\n\n\tif( resource_file == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid resource file.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( *resource_file != NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_VALUE_ALREADY_SET,\n\t\t \"%s: invalid resource file value already set.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\t*resource_file = memory_allocate_structure(\n\t resource_file_t );\n\n\tif( *resource_file == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_MEMORY,\n\t\t LIBCERROR_MEMORY_ERROR_INSUFFICIENT,\n\t\t \"%s: unable to create resource file.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tif( memory_set(\n\t *resource_file,\n\t 0,\n\t sizeof( resource_file_t ) ) == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_MEMORY,\n\t\t LIBCERROR_MEMORY_ERROR_SET_FAILED,\n\t\t \"%s: unable to clear resource file.\",\n\t\t function );\n\n\t\tmemory_free(\n\t\t *resource_file );\n\n\t\t*resource_file = NULL;\n\n\t\treturn( -1 );\n\t}\n\tif( libexe_file_initialize(\n\t &( ( *resource_file )->exe_file ),\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_INITIALIZE_FAILED,\n\t\t \"%s: unable to create EXE file.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tif( libwrc_stream_initialize(\n\t &( ( *resource_file )->resource_stream ),\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_INITIALIZE_FAILED,\n\t\t \"%s: unable to create resource stream.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tif( libfcache_cache_initialize(\n\t &( ( *resource_file )->message_string_cache ),\n\t 16,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_INITIALIZE_FAILED,\n\t\t \"%s: unable to create message string cache.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\t( *resource_file )->preferred_language_identifier = preferred_language_identifier;\n\n\treturn( 1 );\n\non_error:\n\tif( *resource_file != NULL )\n\t{\n\t\tif( ( *resource_file )->resource_stream != NULL )\n\t\t{\n\t\t\tlibwrc_stream_free(\n\t\t\t &( ( *resource_file )->resource_stream ),\n\t\t\t NULL );\n\t\t}\n\t\tif( ( *resource_file )->exe_file != NULL )\n\t\t{\n\t\t\tlibexe_file_free(\n\t\t\t &( ( *resource_file )->exe_file ),\n\t\t\t NULL );\n\t\t}\n\t\tmemory_free(\n\t\t *resource_file );\n\n\t\t*resource_file = NULL;\n\t}\n\treturn( -1 );\n}\n\n/* Frees a resource file\n * Returns 1 if successful or -1 on error\n */\nint resource_file_free(\n resource_file_t **resource_file,\n libcerror_error_t **error )\n{\n\tstatic char *function = \"resource_file_free\";\n\tint result = 1;\n\n\tif( resource_file == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid resource file.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( *resource_file != NULL )\n\t{\n\t\tif( ( *resource_file )->is_open != 0 )\n\t\t{\n\t\t\tif( resource_file_close(\n\t\t\t *resource_file,\n\t\t\t error ) != 0 )\n\t\t\t{\n\t\t\t\tlibcerror_error_set(\n\t\t\t\t error,\n\t\t\t\t LIBCERROR_ERROR_DOMAIN_IO,\n\t\t\t\t LIBCERROR_IO_ERROR_CLOSE_FAILED,\n\t\t\t\t \"%s: unable to close resource file.\",\n\t\t\t\t function );\n\n\t\t\t\tresult = -1;\n\t\t\t}\n\t\t}\n\t\tif( libfcache_cache_free(\n\t\t &( ( *resource_file )->message_string_cache ),\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED,\n\t\t\t \"%s: unable to free message string cache.\",\n\t\t\t function );\n\n\t\t\tresult = -1;\n\t\t}\n\t\tif( libwrc_stream_free(\n\t\t &( ( *resource_file )->resource_stream ),\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED,\n\t\t\t \"%s: unable to free resource stream.\",\n\t\t\t function );\n\n\t\t\tresult = -1;\n\t\t}\n\t\tif( libexe_file_free(\n\t\t &( ( *resource_file )->exe_file ),\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED,\n\t\t\t \"%s: unable to free EXE file.\",\n\t\t\t function );\n\n\t\t\tresult = -1;\n\t\t}\n\t\tif( ( *resource_file )->name != NULL )\n\t\t{\n\t\t\tmemory_free(\n\t\t\t ( *resource_file )->name );\n\t\t}\n\t\tmemory_free(\n\t\t *resource_file );\n\n\t\t*resource_file = NULL;\n\t}\n\treturn( result );\n}\n\n/* Opens the resource file\n * Returns 1 if successful or -1 on error\n */\nint resource_file_open(\n resource_file_t *resource_file,\n const system_character_t *filename,\n libcerror_error_t **error )\n{\n\tstatic char *function = \"resource_file_open\";\n\tuint32_t virtual_address = 0;\n\n\tif( resource_file == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid resource file.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( resource_file->is_open != 0 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_VALUE_ALREADY_SET,\n\t\t \"%s: invalid resource file already open.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n#if defined( HAVE_WIDE_SYSTEM_CHARACTER )\n\tif( libexe_file_open_wide(\n\t resource_file->exe_file,\n\t filename,\n\t LIBEXE_OPEN_READ,\n\t error ) != 1 )\n#else\n\tif( libexe_file_open(\n\t resource_file->exe_file,\n\t filename,\n\t LIBEXE_OPEN_READ,\n\t error ) != 1 )\n#endif\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_IO,\n\t\t LIBCERROR_IO_ERROR_OPEN_FAILED,\n\t\t \"%s: unable to open EXE file.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tif( libexe_file_get_section_by_name(\n\t resource_file->exe_file,\n\t \".rsrc\",\n\t 5,\n\t &( resource_file->resource_section ),\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to retrieve resource section.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tif( libexe_section_get_virtual_address(\n\t resource_file->resource_section,\n\t &virtual_address,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to retrieve resource section virtual adress.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tif( libexe_section_get_data_file_io_handle(\n\t resource_file->resource_section,\n\t &( resource_file->resource_section_file_io_handle ),\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to retrieve resource section file IO handle.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tif( libwrc_stream_set_virtual_address(\n\t resource_file->resource_stream,\n\t virtual_address,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_SET_FAILED,\n\t\t \"%s: unable to set resource stream virtual adress.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tif( libwrc_stream_open_file_io_handle(\n\t resource_file->resource_stream,\n\t resource_file->resource_section_file_io_handle,\n\t LIBWRC_OPEN_READ,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_IO,\n\t\t LIBCERROR_IO_ERROR_OPEN_FAILED,\n\t\t \"%s: unable to open resource stream.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tresource_file->is_open = 1;\n\n\treturn( 1 );\n\non_error:\n\tif( resource_file->resource_section_file_io_handle != NULL )\n\t{\n\t\tlibbfio_handle_free(\n\t\t &( resource_file->resource_section_file_io_handle ),\n\t\t NULL );\n\t}\n\tif( resource_file->resource_section != NULL )\n\t{\n\t\tlibexe_section_free(\n\t\t &( resource_file->resource_section ),\n\t\t NULL );\n\t}\n\tlibexe_file_close(\n\t resource_file->exe_file,\n\t NULL );\n\n\treturn( -1 );\n}\n\n/* Closes the resource file\n * Returns the 0 if succesful or -1 on error\n */\nint resource_file_close(\n resource_file_t *resource_file,\n libcerror_error_t **error )\n{\n\tstatic char *function = \"resource_file_close\";\n\tint result = 0;\n\n\tif( resource_file == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid resource file.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( resource_file->is_open != 0 )\n\t{\n\t\tif( libfcache_cache_empty(\n\t\t resource_file->message_string_cache,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED,\n\t\t\t \"%s: unable to empty message string cache.\",\n\t\t\t function );\n\n\t\t\tresult = -1;\n\t\t}\n\t\tif( resource_file->message_table_resource != NULL )\n\t\t{\n\t\t\tif( libwrc_message_table_resource_free(\n\t\t\t &( resource_file->message_table_resource ),\n\t\t\t error ) != 1 )\n\t\t\t{\n\t\t\t\tlibcerror_error_set(\n\t\t\t\t error,\n\t\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t\t LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED,\n\t\t\t\t \"%s: unable to free message table resource.\",\n\t\t\t\t function );\n\n\t\t\t\tresult = -1;\n\t\t\t}\n\t\t}\n\t\tif( resource_file->mui_resource != NULL )\n\t\t{\n\t\t\tif( libwrc_mui_resource_free(\n\t\t\t &( resource_file->mui_resource ),\n\t\t\t error ) != 1 )\n\t\t\t{\n\t\t\t\tlibcerror_error_set(\n\t\t\t\t error,\n\t\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t\t LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED,\n\t\t\t\t \"%s: unable to free MUI resource.\",\n\t\t\t\t function );\n\n\t\t\t\tresult = -1;\n\t\t\t}\n\t\t}\n\t\tif( resource_file->wevt_manifest != NULL )\n\t\t{\n\t\t\tif( libfwevt_manifest_free(\n\t\t\t &( resource_file->wevt_manifest ),\n\t\t\t error ) != 1 )\n\t\t\t{\n\t\t\t\tlibcerror_error_set(\n\t\t\t\t error,\n\t\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t\t LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED,\n\t\t\t\t \"%s: unable to free WEVT manifest.\",\n\t\t\t\t function );\n\n\t\t\t\tresult = -1;\n\t\t\t}\n\t\t}\n\t\tif( libwrc_stream_close(\n\t\t resource_file->resource_stream,\n\t\t error ) != 0 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_IO,\n\t\t\t LIBCERROR_IO_ERROR_CLOSE_FAILED,\n\t\t\t \"%s: unable to close resource stream.\",\n\t\t\t function );\n\n\t\t\tresult = -1;\n\t\t}\n\t\tif( resource_file->resource_section_file_io_handle != NULL )\n\t\t{\n\t\t\tif( libbfio_handle_free(\n\t\t\t &( resource_file->resource_section_file_io_handle ),\n\t\t\t error ) != 1 )\n\t\t\t{\n\t\t\t\tlibcerror_error_set(\n\t\t\t\t error,\n\t\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t\t LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED,\n\t\t\t\t \"%s: unable to free resource section file IO handle.\",\n\t\t\t\t function );\n\n\t\t\t\tresult = -1;\n\t\t\t}\n\t\t}\n\t\tif( resource_file->resource_section != NULL )\n\t\t{\n\t\t\tif( libexe_section_free(\n\t\t\t &( resource_file->resource_section ),\n\t\t\t error ) != 1 )\n\t\t\t{\n\t\t\t\tlibcerror_error_set(\n\t\t\t\t error,\n\t\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t\t LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED,\n\t\t\t\t \"%s: unable to free resource section.\",\n\t\t\t\t function );\n\n\t\t\t\tresult = -1;\n\t\t\t}\n\t\t}\n\t\tif( libexe_file_close(\n\t\t resource_file->exe_file,\n\t\t error ) != 0 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_IO,\n\t\t\t LIBCERROR_IO_ERROR_CLOSE_FAILED,\n\t\t\t \"%s: unable to close EXE file.\",\n\t\t\t function );\n\n\t\t\tresult = -1;\n\t\t}\n\t\tresource_file->is_open = 0;\n\t}\n\treturn( result );\n}\n\n/* Sets the name\n * Returns 1 if successful or -1 error\n */\nint resource_file_set_name(\n resource_file_t *resource_file,\n const system_character_t *name,\n size_t name_length,\n libcerror_error_t **error )\n{\n\tstatic char *function = \"resource_file_set_name\";\n\n\tif( resource_file == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid resource file.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( resource_file->is_open != 0 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_VALUE_ALREADY_SET,\n\t\t \"%s: invalid resource file already open.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( name == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid name.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( name_length > (size_t) SSIZE_MAX )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_VALUE_EXCEEDS_MAXIMUM,\n\t\t \"%s: invalid name length value exceeds maximum.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( resource_file->name != NULL )\n\t{\n\t\tmemory_free(\n\t\t resource_file->name );\n\n\t\tresource_file->name = NULL;\n\t}\n\tresource_file->name_size = name_length + 1;\n\n\tresource_file->name = system_string_allocate(\n\t resource_file->name_size );\n\n\tif( resource_file->name == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_MEMORY,\n\t\t LIBCERROR_MEMORY_ERROR_INSUFFICIENT,\n\t\t \"%s: unable to create name.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tif( system_string_copy(\n\t resource_file->name,\n\t name,\n\t name_length ) == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_COPY_FAILED,\n\t\t \"%s: unable to copy name.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\t( resource_file->name )[ name_length ] = 0;\n\n\treturn( 1 );\n\non_error:\n\tif( resource_file->name != NULL )\n\t{\n\t\tmemory_free(\n\t\t resource_file->name );\n\n\t\tresource_file->name = NULL;\n\t}\n\tresource_file->name_size = 0;\n\n\treturn( -1 );\n}\n\n/* Retrieves a message table resource\n * Returns 1 if successful, 0 if not available or -1 error\n */\nint resource_file_get_message_table_resource(\n resource_file_t *resource_file,\n libwrc_message_table_resource_t **message_table_resource,\n libcerror_error_t **error )\n{\n\tlibwrc_message_table_resource_t *safe_message_table_resource = NULL;\n\tlibwrc_resource_t *resource = NULL;\n\tlibwrc_resource_item_t *resource_item = NULL;\n\tlibwrc_resource_item_t *resource_sub_item = NULL;\n\tuint8_t *resource_data = NULL;\n\tstatic char *function = \"resource_file_get_message_table_resource\";\n\tuint32_t preferred_language_identifier = 0;\n\tuint32_t resource_data_size = 0;\n\tuint32_t resource_identifier = 0;\n\tint number_of_resource_items = 0;\n\tint number_of_resource_sub_items = 0;\n\tint resource_sub_item_index = 0;\n\tint result = 0;\n\n\tif( resource_file == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid resource file.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( message_table_resource == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid message table resource.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tresult = libwrc_stream_get_resource_by_type(\n\t resource_file->resource_stream,\n\t LIBWRC_RESOURCE_TYPE_MESSAGE_TABLE,\n\t &resource,\n\t error );\n\n\tif( result == -1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to retrieve message table resource.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\telse if( result == 0 )\n\t{\n\t\treturn( 0 );\n\t}\n\tif( libwrc_resource_get_number_of_items(\n\t resource,\n\t &number_of_resource_items,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to retrieve number of resource items.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tif( number_of_resource_items == 0 )\n\t{\n\t\tif( libwrc_resource_free(\n\t\t &resource,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED,\n\t\t\t \"%s: unable to free resource.\",\n\t\t\t function );\n\n\t\t\tgoto on_error;\n\t\t}\n\t\treturn( 0 );\n\t}\n#if defined( HAVE_DEBUG_OUTPUT )\n\tif( number_of_resource_items != 1 )\n\t{\n\t\tlibcnotify_printf(\n\t\t \"%s: found more than 1 resource item.\" );\n\t}\n#endif\n\tif( libwrc_resource_get_item_by_index(\n\t resource,\n\t 0,\n\t &resource_item,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to retrieve resource item: 0.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tif( libwrc_resource_item_get_number_of_sub_items(\n\t resource_item,\n\t &number_of_resource_sub_items,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to retrieve number of resource sub items.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tif( number_of_resource_sub_items < 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_UNSUPPORTED_VALUE,\n\t\t \"%s: unsupported number of resource sub items.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tpreferred_language_identifier = resource_file->preferred_language_identifier & 0x000003ffUL;\n\n\tfor( resource_sub_item_index = 0;\n\t resource_sub_item_index < number_of_resource_sub_items;\n\t resource_sub_item_index++ )\n\t{\n\t\tif( libwrc_resource_item_get_sub_item_by_index(\n\t\t resource_item,\n\t\t resource_sub_item_index,\n\t\t &resource_sub_item,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve resource sub item: %d.\",\n\t\t\t function,\n\t\t\t resource_sub_item_index );\n\n\t\t\tgoto on_error;\n\t\t}\n\t\tif( libwrc_resource_item_get_identifier(\n\t\t resource_sub_item,\n\t\t &resource_identifier,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve resource sub item: %d identifier.\",\n\t\t\t function,\n\t\t\t resource_sub_item_index );\n\n\t\t\tgoto on_error;\n\t\t}\n\t\tif( ( resource_identifier & 0x000003ffUL ) == preferred_language_identifier )\n\t\t{\n\t\t\tbreak;\n\t\t}\n\t\tif( libwrc_resource_item_free(\n\t\t &resource_sub_item,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED,\n\t\t\t \"%s: unable to free resource sub item: %d.\",\n\t\t\t function,\n\t\t\t resource_sub_item_index );\n\n\t\t\tgoto on_error;\n\t\t}\n\t}\n\tif( resource_sub_item == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_VALUE_MISSING,\n\t\t \"%s: unable to retrieve instrumentation manifest from resource.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tif( libwrc_resource_item_get_size(\n\t resource_sub_item,\n\t &resource_data_size,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to retrieve resource sub item: %d size.\",\n\t\t function,\n\t\t resource_sub_item_index );\n\n\t\tgoto on_error;\n\t}\n\tif( ( resource_data_size == 0 )\n\t || ( resource_data_size > MEMORY_MAXIMUM_ALLOCATION_SIZE ) )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,\n\t\t \"%s: invalid resource sub item: %d size value out of bounds.\",\n\t\t function,\n\t\t resource_sub_item_index );\n\n\t\tgoto on_error;\n\t}\n\tresource_data = (uint8_t *) memory_allocate(\n\t sizeof( uint8_t ) * resource_data_size );\n\n\tif( resource_data == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_MEMORY,\n\t\t LIBCERROR_MEMORY_ERROR_INSUFFICIENT,\n\t\t \"%s: unable to create resource data.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tif( libwrc_resource_item_read_buffer(\n\t resource_sub_item,\n\t resource_data,\n\t (size_t) resource_data_size,\n\t error ) != (ssize_t) resource_data_size )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to read data from resource sub item: %d.\",\n\t\t function,\n\t\t resource_sub_item_index );\n\n\t\tgoto on_error;\n\t}\n\tif( libwrc_message_table_resource_initialize(\n\t &safe_message_table_resource,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_INITIALIZE_FAILED,\n\t\t \"%s: unable to create message table resource.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n/* TODO add support for ascii codepage */\n\tif( libwrc_message_table_resource_read(\n\t safe_message_table_resource,\n\t resource_data,\n\t (size_t) resource_data_size,\n\t LIBEVTX_CODEPAGE_WINDOWS_1252,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_IO,\n\t\t LIBCERROR_IO_ERROR_READ_FAILED,\n\t\t \"%s: unable to read message table resource.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tmemory_free(\n\t resource_data );\n\n\tresource_data = NULL;\n\n\tif( libwrc_resource_item_free(\n\t &resource_sub_item,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED,\n\t\t \"%s: unable to free resource sub item: %d.\",\n\t\t function,\n\t\t resource_sub_item_index );\n\n\t\tgoto on_error;\n\t}\n\tif( libwrc_resource_item_free(\n\t &resource_item,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED,\n\t\t \"%s: unable to free resource item: 0.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tif( libwrc_resource_free(\n\t &resource,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED,\n\t\t \"%s: unable to free resource.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\t*message_table_resource = safe_message_table_resource;\n\n\treturn( 1 );\n\non_error:\n\tif( safe_message_table_resource != NULL )\n\t{\n\t\tlibwrc_message_table_resource_free(\n\t\t &safe_message_table_resource,\n\t\t NULL );\n\t}\n\tif( resource_data != NULL )\n\t{\n\t\tmemory_free(\n\t\t resource_data );\n\t}\n\tif( resource_sub_item != NULL )\n\t{\n\t\tlibwrc_resource_item_free(\n\t\t &resource_sub_item,\n\t\t NULL );\n\t}\n\tif( resource_item != NULL )\n\t{\n\t\tlibwrc_resource_item_free(\n\t\t &resource_item,\n\t\t NULL );\n\t}\n\tif( resource != NULL )\n\t{\n\t\tlibwrc_resource_free(\n\t\t &resource,\n\t\t NULL );\n\t}\n\treturn( -1 );\n}\n\n/* Retrieves a message string from the cache\n * Returns 1 if successful, 0 if not available or -1 error\n */\nint resource_file_get_message_string_from_cache(\n resource_file_t *resource_file,\n uint32_t message_string_identifier,\n message_string_t **message_string,\n libcerror_error_t **error )\n{\n\tlibfcache_cache_value_t *cache_value = NULL;\n\tstatic char *function = \"resource_file_get_message_string_from_cache\";\n\tint cache_index = 0;\n\tint result = 0;\n\n\tif( resource_file == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid resource file.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( message_string == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid message string.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tfor( cache_index = 0;\n\t cache_index < 16;\n\t cache_index++ )\n\t{\n\t\tif( libfcache_cache_get_value_by_index(\n\t\t resource_file->message_string_cache,\n\t\t cache_index,\n\t\t &cache_value,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve cache value: %d.\",\n\t\t\t function,\n\t\t\t cache_index );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\tif( cache_value != NULL )\n\t\t{\n\t\t\tif( libfcache_cache_value_get_value(\n\t\t\t cache_value,\n\t\t\t (intptr_t **) message_string,\n\t\t\t error ) != 1 )\n\t\t\t{\n\t\t\t\tlibcerror_error_set(\n\t\t\t\t error,\n\t\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t\t \"%s: unable to retrieve message string from cache value: %d.\",\n\t\t\t\t function,\n\t\t\t\t cache_index );\n\n\t\t\t\treturn( -1 );\n\t\t\t}\n\t\t}\n\t\tif( ( *message_string != NULL )\n\t\t && ( message_string_identifier == ( *message_string )->identifier ) )\n\t\t{\n\t\t\tresult = 1;\n\n\t\t\tbreak;\n\t\t}\n\t}\n\tif( result == 0 )\n\t{\n\t\t*message_string = NULL;\n\t}\n\treturn( result );\n}\n\n/* Retrieves a specific message string\n * Returns 1 if successful, 0 if no such message string or -1 error\n */\nint resource_file_get_message_string(\n resource_file_t *resource_file,\n uint32_t message_string_identifier,\n message_string_t **message_string,\n libcerror_error_t **error )\n{\n\tmessage_string_t *safe_message_string = NULL;\n\tstatic char *function = \"resource_file_get_message_string\";\n\tint64_t timestamp = 0;\n\tint result = 0;\n\n\tif( resource_file == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid resource file.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( message_string == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid message string.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( resource_file->message_table_resource == NULL )\n\t{\n\t\tresult = resource_file_get_message_table_resource(\n\t\t resource_file,\n\t\t &( resource_file->message_table_resource ),\n\t\t error );\n\n\t\tif( result == -1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve message table resource.\",\n\t\t\t function );\n\n\t\t\tgoto on_error;\n\t\t}\n\t\telse if( result == 0 )\n\t\t{\n\t\t\treturn( 0 );\n\t\t}\n\t}\n\tresult = resource_file_get_message_string_from_cache(\n\t resource_file,\n\t message_string_identifier,\n\t message_string,\n\t error );\n\n\tif( result == -1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to retrieve message string from cache.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\telse if( result == 0 )\n\t{\n\t\tif( message_string_initialize(\n\t\t &safe_message_string,\n\t\t message_string_identifier,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_INITIALIZE_FAILED,\n\t\t\t \"%s: unable to create message string.\",\n\t\t\t function );\n\n\t\t\tgoto on_error;\n\t\t}\n\t\tresult = message_string_get_from_message_table_resource(\n\t\t safe_message_string,\n\t\t resource_file->message_table_resource,\n\t\t error );\n\n\t\tif( result == -1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve message string: 0x%08\" PRIx32 \".\",\n\t\t\t function,\n\t\t\t message_string_identifier );\n\n\t\t\tgoto on_error;\n\t\t}\n\t\telse if( result != 0 )\n\t\t{\n\t\t\tif( libfcache_date_time_get_timestamp(\n\t\t\t ×tamp,\n\t\t\t error ) != 1 )\n\t\t\t{\n\t\t\t\tlibcerror_error_set(\n\t\t\t\t error,\n\t\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t\t \"%s: unable to retrieve cache timestamp.\",\n\t\t\t\t function );\n\n\t\t\t\tgoto on_error;\n\t\t\t}\n\t\t\tif( libfcache_cache_set_value_by_index(\n\t\t\t resource_file->message_string_cache,\n\t\t\t resource_file->next_message_string_cache_index,\n\t\t\t 0,\n\t\t\t resource_file->next_message_string_cache_index,\n\t\t\t timestamp,\n\t\t\t (intptr_t *) safe_message_string,\n\t\t\t (int (*)(intptr_t **, libcerror_error_t **)) &message_string_free,\n\t\t\t LIBFCACHE_CACHE_VALUE_FLAG_MANAGED,\n\t\t\t error ) != 1 )\n\t\t\t{\n\t\t\t\tlibcerror_error_set(\n\t\t\t\t error,\n\t\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t\t LIBCERROR_RUNTIME_ERROR_SET_FAILED,\n\t\t\t\t \"%s: unable to set message string in cache entry: %d.\",\n\t\t\t\t function,\n\t\t\t\t resource_file->next_message_string_cache_index );\n\n\t\t\t\tgoto on_error;\n\t\t\t}\n\t\t\tresource_file->next_message_string_cache_index++;\n\n\t\t\tif( resource_file->next_message_string_cache_index == 16 )\n\t\t\t{\n\t\t\t\tresource_file->next_message_string_cache_index = 0;\n\t\t\t}\n\t\t\t*message_string = safe_message_string;\n\t\t\tsafe_message_string = NULL;\n\t\t}\n\t\tif( safe_message_string != NULL )\n\t\t{\n\t\t\tif( message_string_free(\n\t\t\t &safe_message_string,\n\t\t\t error ) != 1 )\n\t\t\t{\n\t\t\t\tlibcerror_error_set(\n\t\t\t\t error,\n\t\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t\t LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED,\n\t\t\t\t \"%s: unable to free message string.\",\n\t\t\t\t function );\n\n\t\t\t\tgoto on_error;\n\t\t\t}\n\t\t}\n\t}\n\treturn( result );\n\non_error:\n\tif( safe_message_string != NULL )\n\t{\n\t\tmessage_string_free(\n\t\t &safe_message_string,\n\t\t NULL );\n\t}\n\treturn( -1 );\n}\n\n/* Retrieves a MUI resource\n * Returns 1 if successful, 0 if not available or -1 error\n */\nint resource_file_get_mui_resource(\n resource_file_t *resource_file,\n libwrc_mui_resource_t **mui_resource,\n libcerror_error_t **error )\n{\n\tlibwrc_mui_resource_t *safe_mui_resource = NULL;\n\tlibwrc_resource_t *resource = NULL;\n\tlibwrc_resource_item_t *resource_item = NULL;\n\tlibwrc_resource_item_t *resource_sub_item = NULL;\n\tuint8_t *resource_data = NULL;\n\tstatic char *function = \"resource_file_get_mui_resource\";\n\tuint32_t preferred_language_identifier = 0;\n\tuint32_t resource_data_size = 0;\n\tuint32_t resource_identifier = 0;\n\tint number_of_resource_items = 0;\n\tint number_of_resource_sub_items = 0;\n\tint resource_sub_item_index = 0;\n\tint result = 0;\n\n\tif( resource_file == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid resource file.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( mui_resource == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid MUI resource.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tresult = libwrc_stream_get_resource_by_utf8_name(\n\t resource_file->resource_stream,\n\t (uint8_t *) \"MUI\",\n\t 3,\n\t &resource,\n\t error );\n\n\tif( result == -1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to retrieve MUI resource.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\telse if( result == 0 )\n\t{\n\t\treturn( 0 );\n\t}\n\tif( libwrc_resource_get_number_of_items(\n\t resource,\n\t &number_of_resource_items,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to retrieve number of resource items.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tif( number_of_resource_items == 0 )\n\t{\n\t\tif( libwrc_resource_free(\n\t\t &resource,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED,\n\t\t\t \"%s: unable to free resource.\",\n\t\t\t function );\n\n\t\t\tgoto on_error;\n\t\t}\n\t\treturn( 0 );\n\t}\n#if defined( HAVE_DEBUG_OUTPUT )\n\tif( number_of_resource_items != 1 )\n\t{\n\t\tlibcnotify_printf(\n\t\t \"%s: found more than 1 resource item.\" );\n\t}\n#endif\n\tif( libwrc_resource_get_item_by_index(\n\t resource,\n\t 0,\n\t &resource_item,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to retrieve resource item: 0.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tif( libwrc_resource_item_get_number_of_sub_items(\n\t resource_item,\n\t &number_of_resource_sub_items,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to retrieve number of resource sub items.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tif( number_of_resource_sub_items < 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_UNSUPPORTED_VALUE,\n\t\t \"%s: unsupported number of resource sub items.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tpreferred_language_identifier = resource_file->preferred_language_identifier & 0x000003ffUL;\n\n\tfor( resource_sub_item_index = 0;\n\t resource_sub_item_index < number_of_resource_sub_items;\n\t resource_sub_item_index++ )\n\t{\n\t\tif( libwrc_resource_item_get_sub_item_by_index(\n\t\t resource_item,\n\t\t resource_sub_item_index,\n\t\t &resource_sub_item,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve resource sub item: %d.\",\n\t\t\t function,\n\t\t\t resource_sub_item_index );\n\n\t\t\tgoto on_error;\n\t\t}\n\t\tif( libwrc_resource_item_get_identifier(\n\t\t resource_sub_item,\n\t\t &resource_identifier,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve resource sub item: %d identifier.\",\n\t\t\t function,\n\t\t\t resource_sub_item_index );\n\n\t\t\tgoto on_error;\n\t\t}\n\t\tif( ( resource_identifier & 0x000003ffUL ) == preferred_language_identifier )\n\t\t{\n\t\t\tbreak;\n\t\t}\n\t\tif( libwrc_resource_item_free(\n\t\t &resource_sub_item,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED,\n\t\t\t \"%s: unable to free resource sub item: %d.\",\n\t\t\t function,\n\t\t\t resource_sub_item_index );\n\n\t\t\tgoto on_error;\n\t\t}\n\t}\n\tif( resource_sub_item == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_VALUE_MISSING,\n\t\t \"%s: unable to retrieve instrumentation manifest from resource.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tif( libwrc_resource_item_get_size(\n\t resource_sub_item,\n\t &resource_data_size,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to retrieve resource sub item: %d size.\",\n\t\t function,\n\t\t resource_sub_item_index );\n\n\t\tgoto on_error;\n\t}\n\tif( ( resource_data_size == 0 )\n\t || ( resource_data_size > MEMORY_MAXIMUM_ALLOCATION_SIZE ) )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,\n\t\t \"%s: invalid resource sub item: %d size value out of bounds.\",\n\t\t function,\n\t\t resource_sub_item_index );\n\n\t\tgoto on_error;\n\t}\n\tresource_data = (uint8_t *) memory_allocate(\n\t sizeof( uint8_t ) * resource_data_size );\n\n\tif( resource_data == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_MEMORY,\n\t\t LIBCERROR_MEMORY_ERROR_INSUFFICIENT,\n\t\t \"%s: unable to create resource data.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tif( libwrc_resource_item_read_buffer(\n\t resource_sub_item,\n\t resource_data,\n\t (size_t) resource_data_size,\n\t error ) != (ssize_t) resource_data_size )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to read data from resource sub item: %d.\",\n\t\t function,\n\t\t resource_sub_item_index );\n\n\t\tgoto on_error;\n\t}\n\tif( libwrc_mui_resource_initialize(\n\t &safe_mui_resource,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_INITIALIZE_FAILED,\n\t\t \"%s: unable to create MUI resource.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tif( libwrc_mui_resource_read(\n\t safe_mui_resource,\n\t resource_data,\n\t (size_t) resource_data_size,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_IO,\n\t\t LIBCERROR_IO_ERROR_READ_FAILED,\n\t\t \"%s: unable to read MUI resource.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tmemory_free(\n\t resource_data );\n\n\tresource_data = NULL;\n\n\tif( libwrc_resource_item_free(\n\t &resource_sub_item,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED,\n\t\t \"%s: unable to free resource sub item: %d.\",\n\t\t function,\n\t\t resource_sub_item_index );\n\n\t\tgoto on_error;\n\t}\n\tif( libwrc_resource_item_free(\n\t &resource_item,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED,\n\t\t \"%s: unable to free resource item: 0.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tif( libwrc_resource_free(\n\t &resource,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED,\n\t\t \"%s: unable to free resource.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\t*mui_resource = safe_mui_resource;\n\n\treturn( 1 );\n\non_error:\n\tif( safe_mui_resource != NULL )\n\t{\n\t\tlibwrc_mui_resource_free(\n\t\t &safe_mui_resource,\n\t\t NULL );\n\t}\n\tif( resource_data != NULL )\n\t{\n\t\tmemory_free(\n\t\t resource_data );\n\t}\n\tif( resource_sub_item != NULL )\n\t{\n\t\tlibwrc_resource_item_free(\n\t\t &resource_sub_item,\n\t\t NULL );\n\t}\n\tif( resource_item != NULL )\n\t{\n\t\tlibwrc_resource_item_free(\n\t\t &resource_item,\n\t\t NULL );\n\t}\n\tif( resource != NULL )\n\t{\n\t\tlibwrc_resource_free(\n\t\t &resource,\n\t\t NULL );\n\t}\n\treturn( -1 );\n}\n\n/* Retrieves the MUI file type\n * Returns 1 if successful, 0 if not available or -1 error\n */\nint resource_file_get_mui_file_type(\n resource_file_t *resource_file,\n uint32_t *file_type,\n libcerror_error_t **error )\n{\n\tstatic char *function = \"resource_file_get_mui_file_type\";\n\tint result = 0;\n\n\tif( resource_file == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid resource file.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( resource_file->mui_resource == NULL )\n\t{\n\t\tresult = resource_file_get_mui_resource(\n\t\t resource_file,\n\t\t &( resource_file->mui_resource ),\n\t\t error );\n\n\t\tif( result == -1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve MUI resource.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\telse if( result == 0 )\n\t\t{\n\t\t\treturn( 0 );\n\t\t}\n\t}\n\tif( libwrc_mui_resource_get_file_type(\n\t resource_file->mui_resource,\n\t file_type,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to retrieve file type.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\treturn( 1 );\n}\n\n/* Retrieves the WEVT instrumentation manifest from a WEVT_TEMPLATE resource\n * Returns 1 if successful, 0 if not available or -1 error\n */\nint resource_file_get_wevt_manifest(\n resource_file_t *resource_file,\n libfwevt_manifest_t **wevt_manifest,\n libcerror_error_t **error )\n{\n\tlibfwevt_manifest_t *safe_wevt_manifest = NULL;\n\tlibwrc_resource_t *resource = NULL;\n\tlibwrc_resource_item_t *resource_item = NULL;\n\tlibwrc_resource_item_t *resource_sub_item = NULL;\n\tuint8_t *resource_data = NULL;\n\tstatic char *function = \"resource_file_get_wevt_manifest\";\n\tuint32_t preferred_language_identifier = 0;\n\tuint32_t resource_data_size = 0;\n\tuint32_t resource_identifier = 0;\n\tint number_of_resource_items = 0;\n\tint number_of_resource_sub_items = 0;\n\tint resource_sub_item_index = 0;\n\tint result = 0;\n\n\tif( resource_file == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid resource file.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( wevt_manifest == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid WEVT manifest.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tresult = libwrc_stream_get_resource_by_utf8_name(\n\t resource_file->resource_stream,\n\t (uint8_t *) \"WEVT_TEMPLATE\",\n\t 13,\n\t &resource,\n\t error );\n\n\tif( result == -1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to retrieve WEVT_TEMPLATE resource.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\telse if( result == 0 )\n\t{\n\t\treturn( 0 );\n\t}\n\tif( libwrc_resource_get_number_of_items(\n\t resource,\n\t &number_of_resource_items,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to retrieve number of resource items.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tif( number_of_resource_items == 0 )\n\t{\n\t\tif( libwrc_resource_free(\n\t\t &resource,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED,\n\t\t\t \"%s: unable to free resource.\",\n\t\t\t function );\n\n\t\t\tgoto on_error;\n\t\t}\n\t\treturn( 0 );\n\t}\n#if defined( HAVE_DEBUG_OUTPUT )\n\tif( number_of_resource_items != 1 )\n\t{\n\t\tlibcnotify_printf(\n\t\t \"%s: found more than 1 resource item.\" );\n\t}\n#endif\n\tif( libwrc_resource_get_item_by_index(\n\t resource,\n\t 0,\n\t &resource_item,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to retrieve resource item: 0.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tif( libwrc_resource_item_get_number_of_sub_items(\n\t resource_item,\n\t &number_of_resource_sub_items,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to retrieve number of resource sub items.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tif( number_of_resource_sub_items < 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_UNSUPPORTED_VALUE,\n\t\t \"%s: unsupported number of resource sub items.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tpreferred_language_identifier = resource_file->preferred_language_identifier & 0x000003ffUL;\n\n\tfor( resource_sub_item_index = 0;\n\t resource_sub_item_index < number_of_resource_sub_items;\n\t resource_sub_item_index++ )\n\t{\n\t\tif( libwrc_resource_item_get_sub_item_by_index(\n\t\t resource_item,\n\t\t resource_sub_item_index,\n\t\t &resource_sub_item,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve resource sub item: %d.\",\n\t\t\t function,\n\t\t\t resource_sub_item_index );\n\n\t\t\tgoto on_error;\n\t\t}\n\t\tif( libwrc_resource_item_get_identifier(\n\t\t resource_sub_item,\n\t\t &resource_identifier,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve resource sub item: %d identifier.\",\n\t\t\t function,\n\t\t\t resource_sub_item_index );\n\n\t\t\tgoto on_error;\n\t\t}\n\t\tif( ( resource_identifier & 0x000003ffUL ) == preferred_language_identifier )\n\t\t{\n\t\t\tbreak;\n\t\t}\n\t\tif( libwrc_resource_item_free(\n\t\t &resource_sub_item,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED,\n\t\t\t \"%s: unable to free resource sub item: %d.\",\n\t\t\t function,\n\t\t\t resource_sub_item_index );\n\n\t\t\tgoto on_error;\n\t\t}\n\t}\n\tif( resource_sub_item == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_VALUE_MISSING,\n\t\t \"%s: unable to retrieve instrumentation manifest from resource.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tif( libwrc_resource_item_get_size(\n\t resource_sub_item,\n\t &resource_data_size,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to retrieve resource sub item: %d size.\",\n\t\t function,\n\t\t resource_sub_item_index );\n\n\t\tgoto on_error;\n\t}\n\tif( ( resource_data_size == 0 )\n\t || ( resource_data_size > MEMORY_MAXIMUM_ALLOCATION_SIZE ) )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,\n\t\t \"%s: invalid resource sub item: %d size value out of bounds.\",\n\t\t function,\n\t\t resource_sub_item_index );\n\n\t\tgoto on_error;\n\t}\n\tresource_data = (uint8_t *) memory_allocate(\n\t sizeof( uint8_t ) * resource_data_size );\n\n\tif( resource_data == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_MEMORY,\n\t\t LIBCERROR_MEMORY_ERROR_INSUFFICIENT,\n\t\t \"%s: unable to create resource data.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tif( libwrc_resource_item_read_buffer(\n\t resource_sub_item,\n\t resource_data,\n\t (size_t) resource_data_size,\n\t error ) != (ssize_t) resource_data_size )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to read data from resource sub item: %d.\",\n\t\t function,\n\t\t resource_sub_item_index );\n\n\t\tgoto on_error;\n\t}\n\tif( libfwevt_manifest_initialize(\n\t &safe_wevt_manifest,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_INITIALIZE_FAILED,\n\t\t \"%s: unable to create WEVT manifest.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tif( libfwevt_manifest_read(\n\t safe_wevt_manifest,\n\t resource_data,\n\t (size_t) resource_data_size,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_IO,\n\t\t LIBCERROR_IO_ERROR_READ_FAILED,\n\t\t \"%s: unable to read WEVT manifest.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tmemory_free(\n\t resource_data );\n\n\tresource_data = NULL;\n\n\tif( libwrc_resource_item_free(\n\t &resource_sub_item,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED,\n\t\t \"%s: unable to free resource sub item: %d.\",\n\t\t function,\n\t\t resource_sub_item_index );\n\n\t\tgoto on_error;\n\t}\n\tif( libwrc_resource_item_free(\n\t &resource_item,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED,\n\t\t \"%s: unable to free resource item: 0.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tif( libwrc_resource_free(\n\t &resource,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED,\n\t\t \"%s: unable to free resource.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\t*wevt_manifest = safe_wevt_manifest;\n\n\treturn( 1 );\n\non_error:\n\tif( safe_wevt_manifest != NULL )\n\t{\n\t\tlibfwevt_manifest_free(\n\t\t &safe_wevt_manifest,\n\t\t NULL );\n\t}\n\tif( resource_data != NULL )\n\t{\n\t\tmemory_free(\n\t\t resource_data );\n\t}\n\tif( resource_sub_item != NULL )\n\t{\n\t\tlibwrc_resource_item_free(\n\t\t &resource_sub_item,\n\t\t NULL );\n\t}\n\tif( resource_item != NULL )\n\t{\n\t\tlibwrc_resource_item_free(\n\t\t &resource_item,\n\t\t NULL );\n\t}\n\tif( resource != NULL )\n\t{\n\t\tlibwrc_resource_free(\n\t\t &resource,\n\t\t NULL );\n\t}\n\treturn( -1 );\n}\n\n/* Retrieves a specific provider from the WEVT_TEMPLATE resource\n * Returns 1 if successful, 0 if not available or -1 error\n */\nint resource_file_get_provider(\n resource_file_t *resource_file,\n const uint8_t *provider_identifier,\n size_t provider_identifier_size,\n libfwevt_provider_t **provider,\n libcerror_error_t **error )\n{\n\tstatic char *function = \"resource_file_get_provider\";\n\tint result = 0;\n\n\tif( resource_file == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid resource file.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( resource_file->wevt_manifest == NULL )\n\t{\n\t\tresult = resource_file_get_wevt_manifest(\n\t\t resource_file,\n\t\t &( resource_file->wevt_manifest ),\n\t\t error );\n\n\t\tif( result == -1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve WEVT manifest.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\telse if( result == 0 )\n\t\t{\n\t\t\treturn( 0 );\n\t\t}\n\t}\n\tresult = libfwevt_manifest_get_provider_by_identifier(\n\t resource_file->wevt_manifest,\n\t provider_identifier,\n\t provider_identifier_size,\n\t provider,\n\t error );\n\n\tif( result == -1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to retrieve provider from WEVT manifest.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\treturn( result );\n}\n\n/* Retrieves a specific event from a a specific provider from the WEVT_TEMPLATE resource\n * Returns 1 if successful, 0 if not available or -1 error\n */\nint resource_file_get_event(\n resource_file_t *resource_file,\n const uint8_t *provider_identifier,\n size_t provider_identifier_size,\n uint32_t event_identifier,\n libfwevt_provider_t **provider,\n libfwevt_event_t **event,\n libcerror_error_t **error )\n{\n\tstatic char *function = \"resource_file_get_event_message_identifier\";\n\tint result = 0;\n\n\tif( resource_file == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid resource file.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( provider == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid provider.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tresult = resource_file_get_provider(\n\t resource_file,\n\t provider_identifier,\n\t provider_identifier_size,\n\t provider,\n\t error );\n\n\tif( result == -1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to retrieve provider.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\telse if( result != 0 )\n\t{\n\t\tresult = libfwevt_provider_get_event_by_identifier(\n\t\t\t *provider,\n\t\t\t event_identifier,\n\t\t\t event,\n\t\t\t error );\n\n\t\tif( result == -1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve event.\",\n\t\t\t function );\n\n\t\t\tgoto on_error;\n\t\t}\n\t}\n\treturn( result );\n\non_error:\n\tif( *provider != NULL )\n\t{\n\t\tlibfwevt_provider_free(\n\t\t provider,\n\t\t NULL );\n\t}\n\treturn( -1 );\n}\n\n/* Retrieves the template definition from a specific event from a a specific provider from the WEVT_TEMPLATE resource\n * Returns 1 if successful, 0 if not available or -1 error\n */\nint resource_file_get_template_definition(\n resource_file_t *resource_file,\n const uint8_t *provider_identifier,\n size_t provider_identifier_size,\n uint32_t event_identifier,\n libfwevt_provider_t **provider,\n libfwevt_event_t **event,\n libfwevt_template_t **template_definition,\n libcerror_error_t **error )\n{\n\tlibfwevt_event_t *safe_event = NULL;\n\tlibfwevt_provider_t *safe_provider = NULL;\n\tstatic char *function = \"resource_file_get_template_definition\";\n\tuint32_t template_offset = 0;\n\tint result = 0;\n\n\tif( resource_file == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid resource file.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( provider == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid provider.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( event == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid event.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tresult = resource_file_get_event(\n\t resource_file,\n\t provider_identifier,\n\t provider_identifier_size,\n\t event_identifier,\n\t &safe_provider,\n\t &safe_event,\n\t error );\n\n\tif( result == -1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to retrieve event.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\telse if( result == 0 )\n\t{\n\t\treturn( 0 );\n\t}\n\tif( libfwevt_event_get_template_offset(\n\t safe_event,\n\t &template_offset,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to retrieve template offset.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tresult = 0;\n\n\tif( template_offset != 0 )\n\t{\n\t\tresult = libfwevt_provider_get_template_by_offset(\n\t\t\t safe_provider,\n\t\t\t template_offset,\n\t\t\t template_definition,\n\t\t\t error );\n\n\t\tif( result == -1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve template by offset.\",\n\t\t\t function );\n\n\t\t\tgoto on_error;\n\t\t}\n\t\telse if( result != 0 )\n\t\t{\n\t\t\t*provider = safe_provider;\n\t\t\t*event = safe_event;\n\t\t}\n\t}\n\tif( result == 0 )\n\t{\n\t\tif( libfwevt_event_free(\n\t\t &safe_event,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED,\n\t\t\t \"%s: unable to free event.\",\n\t\t\t function );\n\n\t\t\tgoto on_error;\n\t\t}\n\t\tif( libfwevt_provider_free(\n\t\t &safe_provider,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED,\n\t\t\t \"%s: unable to free provider.\",\n\t\t\t function );\n\n\t\t\tgoto on_error;\n\t\t}\n\t}\n\treturn( result );\n\non_error:\n\tif( safe_event != NULL )\n\t{\n\t\tlibfwevt_event_free(\n\t\t &safe_event,\n\t\t NULL );\n\t}\n\tif( safe_provider != NULL )\n\t{\n\t\tlibfwevt_provider_free(\n\t\t &safe_provider,\n\t\t NULL );\n\t}\n\treturn( -1 );\n}\n\n/* Retrieves the message identifier from a specific event from a a specific provider from the WEVT_TEMPLATE resource\n * Returns 1 if successful, 0 if not available or -1 error\n */\nint resource_file_get_event_message_identifier(\n resource_file_t *resource_file,\n const uint8_t *provider_identifier,\n size_t provider_identifier_size,\n uint32_t event_identifier,\n uint32_t *message_identifier,\n libcerror_error_t **error )\n{\n\tlibfwevt_event_t *event = NULL;\n\tlibfwevt_provider_t *provider = NULL;\n\tstatic char *function = \"resource_file_get_event_message_identifier\";\n\tint result = 0;\n\n\tif( resource_file == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid resource file.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tresult = resource_file_get_event(\n\t resource_file,\n\t provider_identifier,\n\t provider_identifier_size,\n\t event_identifier,\n\t &provider,\n\t &event,\n\t error );\n\n\tif( result == -1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to retrieve event.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\telse if( result != 0 )\n\t{\n\t\tif( libfwevt_event_get_message_identifier(\n\t\t event,\n\t\t message_identifier,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve message identifier.\",\n\t\t\t function );\n\n\t\t\tgoto on_error;\n\t\t}\n\t\tif( libfwevt_event_free(\n\t\t &event,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED,\n\t\t\t \"%s: unable to free event.\",\n\t\t\t function );\n\n\t\t\tgoto on_error;\n\t\t}\n\t\tif( libfwevt_provider_free(\n\t\t &provider,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED,\n\t\t\t \"%s: unable to free provider.\",\n\t\t\t function );\n\n\t\t\tgoto on_error;\n\t\t}\n\t}\n\treturn( result );\n\non_error:\n\tif( event != NULL )\n\t{\n\t\tlibfwevt_event_free(\n\t\t &event,\n\t\t NULL );\n\t}\n\tif( provider != NULL )\n\t{\n\t\tlibfwevt_provider_free(\n\t\t &provider,\n\t\t NULL );\n\t}\n\treturn( -1 );\n}\n\n" }, { "path": "evtxtools/resource_file.h", "content": "/*\n * Resource file\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#if !defined( _RESOURCE_FILE_H )\n#define _RESOURCE_FILE_H\n\n#include \n#include \n\n#include \"evtxtools_libbfio.h\"\n#include \"evtxtools_libcerror.h\"\n#include \"evtxtools_libexe.h\"\n#include \"evtxtools_libfcache.h\"\n#include \"evtxtools_libfwevt.h\"\n#include \"evtxtools_libwrc.h\"\n#include \"message_string.h\"\n\n#if defined( __cplusplus )\nextern \"C\" {\n#endif\n\ntypedef struct resource_file resource_file_t;\n\nstruct resource_file\n{\n\t/* The name\n\t */\n\tsystem_character_t *name;\n\n\t/* The name size\n\t */\n\tsize_t name_size;\n\n\t/* The libexe file\n\t */\n\tlibexe_file_t *exe_file;\n\n\t/* The libexe resource (.rsrc) section\n\t */\n\tlibexe_section_t *resource_section;\n\n\t/* The resource (.rsrc) section file IO handle\n\t */\n\tlibbfio_handle_t *resource_section_file_io_handle;\n\n\t/* The libwrc resource stream\n\t */\n\tlibwrc_stream_t *resource_stream;\n\n\t/* The preferred language identifier\n\t */\n\tuint32_t preferred_language_identifier;\n\n\t/* The message table resource\n\t */\n\tlibwrc_message_table_resource_t *message_table_resource;\n\n\t/* The MUI resource\n\t */\n\tlibwrc_mui_resource_t *mui_resource;\n\n\t/* The instrumentation manifest stored in a WEVT_TEMPLATE resource\n\t */\n\tlibfwevt_manifest_t *wevt_manifest;\n\n\t/* The message string cache\n\t */\n\tlibfcache_cache_t *message_string_cache;\n\n\t/* The next available message string cache index\n\t */\n\tint next_message_string_cache_index;\n\n\t/* Value to indicate if the message file is open\n\t */\n\tint is_open;\n};\n\nint resource_file_initialize(\n resource_file_t **resource_file,\n uint32_t preferred_language_identifier,\n libcerror_error_t **error );\n\nint resource_file_free(\n resource_file_t **resource_file,\n libcerror_error_t **error );\n\nint resource_file_open(\n resource_file_t *resource_file,\n const system_character_t *filename,\n libcerror_error_t **error );\n\nint resource_file_close(\n resource_file_t *resource_file,\n libcerror_error_t **error );\n\nint resource_file_set_name(\n resource_file_t *resource_file,\n const system_character_t *name,\n size_t name_length,\n libcerror_error_t **error );\n\nint resource_file_get_message_table_resource(\n resource_file_t *resource_file,\n libwrc_message_table_resource_t **message_table_resource,\n libcerror_error_t **error );\n\nint resource_file_get_message_string_from_cache(\n resource_file_t *resource_file,\n uint32_t message_string_identifier,\n message_string_t **message_string,\n libcerror_error_t **error );\n\nint resource_file_get_message_string(\n resource_file_t *resource_file,\n uint32_t message_string_identifier,\n message_string_t **message_string,\n libcerror_error_t **error );\n\nint resource_file_get_mui_resource(\n resource_file_t *resource_file,\n libwrc_mui_resource_t **mui_resource,\n libcerror_error_t **error );\n\nint resource_file_get_mui_file_type(\n resource_file_t *resource_file,\n uint32_t *file_type,\n libcerror_error_t **error );\n\nint resource_file_get_wevt_manifest(\n resource_file_t *resource_file,\n libfwevt_manifest_t **wevt_manifest,\n libcerror_error_t **error );\n\nint resource_file_get_provider(\n resource_file_t *resource_file,\n const uint8_t *provider_identifier,\n size_t provider_identifier_size,\n libfwevt_provider_t **provider,\n libcerror_error_t **error );\n\nint resource_file_get_event(\n resource_file_t *resource_file,\n const uint8_t *provider_identifier,\n size_t provider_identifier_size,\n uint32_t event_identifier,\n libfwevt_provider_t **provider,\n libfwevt_event_t **event,\n libcerror_error_t **error );\n\nint resource_file_get_template_definition(\n resource_file_t *resource_file,\n const uint8_t *provider_identifier,\n size_t provider_identifier_size,\n uint32_t event_identifier,\n libfwevt_provider_t **provider,\n libfwevt_event_t **event,\n libfwevt_template_t **template_definition,\n libcerror_error_t **error );\n\nint resource_file_get_event_message_identifier(\n resource_file_t *resource_file,\n const uint8_t *provider_identifier,\n size_t provider_identifier_size,\n uint32_t event_identifier,\n uint32_t *message_identifier,\n libcerror_error_t **error );\n\n#if defined( __cplusplus )\n}\n#endif\n\n#endif /* !defined( _RESOURCE_FILE_H ) */\n\n" }, { "path": "include/Makefile.am", "content": "include_HEADERS = \\\n\tlibevtx.h\n\npkginclude_HEADERS = \\\n\tlibevtx/codepage.h \\\n\tlibevtx/definitions.h \\\n\tlibevtx/error.h \\\n\tlibevtx/extern.h \\\n\tlibevtx/features.h \\\n\tlibevtx/types.h\n\nEXTRA_DIST = \\\n\tlibevtx.h.in \\\n\tlibevtx/definitions.h.in \\\n\tlibevtx/features.h.in \\\n\tlibevtx/types.h.in\n\nDISTCLEANFILES = \\\n\tlibevtx.h \\\n\tlibevtx/definitions.h \\\n\tlibevtx/features.h \\\n\tlibevtx/types.h \\\n\tMakefile \\\n\tMakefile.in\n\n" }, { "path": "include/libevtx/codepage.h", "content": "/*\n * Codepage definitions for libevtx\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#if !defined( _LIBEVTX_CODEPAGE_H )\n#define _LIBEVTX_CODEPAGE_H\n\n#include \n\n#if defined( __cplusplus )\nextern \"C\" {\n#endif\n\n/* The codepage definitions\n */\nenum LIBEVTX_CODEPAGES\n{\n\tLIBEVTX_CODEPAGE_ASCII\t\t\t\t= 20127,\n\n\tLIBEVTX_CODEPAGE_ISO_8859_1\t\t\t= 28591,\n\tLIBEVTX_CODEPAGE_ISO_8859_2\t\t\t= 28592,\n\tLIBEVTX_CODEPAGE_ISO_8859_3\t\t\t= 28593,\n\tLIBEVTX_CODEPAGE_ISO_8859_4\t\t\t= 28594,\n\tLIBEVTX_CODEPAGE_ISO_8859_5\t\t\t= 28595,\n\tLIBEVTX_CODEPAGE_ISO_8859_6\t\t\t= 28596,\n\tLIBEVTX_CODEPAGE_ISO_8859_7\t\t\t= 28597,\n\tLIBEVTX_CODEPAGE_ISO_8859_8\t\t\t= 28598,\n\tLIBEVTX_CODEPAGE_ISO_8859_9\t\t\t= 28599,\n\tLIBEVTX_CODEPAGE_ISO_8859_10\t\t\t= 28600,\n\tLIBEVTX_CODEPAGE_ISO_8859_11\t\t\t= 28601,\n\tLIBEVTX_CODEPAGE_ISO_8859_13\t\t\t= 28603,\n\tLIBEVTX_CODEPAGE_ISO_8859_14\t\t\t= 28604,\n\tLIBEVTX_CODEPAGE_ISO_8859_15\t\t\t= 28605,\n\tLIBEVTX_CODEPAGE_ISO_8859_16\t\t\t= 28606,\n\n\tLIBEVTX_CODEPAGE_KOI8_R\t\t\t\t= 20866,\n\tLIBEVTX_CODEPAGE_KOI8_U\t\t\t\t= 21866,\n\n\tLIBEVTX_CODEPAGE_WINDOWS_874\t\t\t= 874,\n\tLIBEVTX_CODEPAGE_WINDOWS_932\t\t\t= 932,\n\tLIBEVTX_CODEPAGE_WINDOWS_936\t\t\t= 936,\n\tLIBEVTX_CODEPAGE_WINDOWS_949\t\t\t= 949,\n\tLIBEVTX_CODEPAGE_WINDOWS_950\t\t\t= 950,\n\tLIBEVTX_CODEPAGE_WINDOWS_1250\t\t\t= 1250,\n\tLIBEVTX_CODEPAGE_WINDOWS_1251\t\t\t= 1251,\n\tLIBEVTX_CODEPAGE_WINDOWS_1252\t\t\t= 1252,\n\tLIBEVTX_CODEPAGE_WINDOWS_1253\t\t\t= 1253,\n\tLIBEVTX_CODEPAGE_WINDOWS_1254\t\t\t= 1254,\n\tLIBEVTX_CODEPAGE_WINDOWS_1255\t\t\t= 1255,\n\tLIBEVTX_CODEPAGE_WINDOWS_1256\t\t\t= 1256,\n\tLIBEVTX_CODEPAGE_WINDOWS_1257\t\t\t= 1257,\n\tLIBEVTX_CODEPAGE_WINDOWS_1258\t\t\t= 1258\n};\n\n#define LIBEVTX_CODEPAGE_US_ASCII\t\t\tLIBEVTX_CODEPAGE_ASCII\n\n#define LIBEVTX_CODEPAGE_ISO_WESTERN_EUROPEAN\t\tLIBEVTX_CODEPAGE_ISO_8859_1\n#define LIBEVTX_CODEPAGE_ISO_CENTRAL_EUROPEAN\t\tLIBEVTX_CODEPAGE_ISO_8859_2\n#define LIBEVTX_CODEPAGE_ISO_SOUTH_EUROPEAN\t\tLIBEVTX_CODEPAGE_ISO_8859_3\n#define LIBEVTX_CODEPAGE_ISO_NORTH_EUROPEAN\t\tLIBEVTX_CODEPAGE_ISO_8859_4\n#define LIBEVTX_CODEPAGE_ISO_CYRILLIC\t\t\tLIBEVTX_CODEPAGE_ISO_8859_5\n#define LIBEVTX_CODEPAGE_ISO_ARABIC\t\t\tLIBEVTX_CODEPAGE_ISO_8859_6\n#define LIBEVTX_CODEPAGE_ISO_GREEK\t\t\tLIBEVTX_CODEPAGE_ISO_8859_7\n#define LIBEVTX_CODEPAGE_ISO_HEBREW\t\t\tLIBEVTX_CODEPAGE_ISO_8859_8\n#define LIBEVTX_CODEPAGE_ISO_TURKISH\t\t\tLIBEVTX_CODEPAGE_ISO_8859_9\n#define LIBEVTX_CODEPAGE_ISO_NORDIC\t\t\tLIBEVTX_CODEPAGE_ISO_8859_10\n#define LIBEVTX_CODEPAGE_ISO_THAI\t\t\tLIBEVTX_CODEPAGE_ISO_8859_11\n#define LIBEVTX_CODEPAGE_ISO_BALTIC\t\t\tLIBEVTX_CODEPAGE_ISO_8859_13\n#define LIBEVTX_CODEPAGE_ISO_CELTIC\t\t\tLIBEVTX_CODEPAGE_ISO_8859_14\n\n#define LIBEVTX_CODEPAGE_ISO_LATIN_1\t\t\tLIBEVTX_CODEPAGE_ISO_8859_1\n#define LIBEVTX_CODEPAGE_ISO_LATIN_2\t\t\tLIBEVTX_CODEPAGE_ISO_8859_2\n#define LIBEVTX_CODEPAGE_ISO_LATIN_3\t\t\tLIBEVTX_CODEPAGE_ISO_8859_3\n#define LIBEVTX_CODEPAGE_ISO_LATIN_4\t\t\tLIBEVTX_CODEPAGE_ISO_8859_4\n#define LIBEVTX_CODEPAGE_ISO_LATIN_5\t\t\tLIBEVTX_CODEPAGE_ISO_8859_9\n#define LIBEVTX_CODEPAGE_ISO_LATIN_6\t\t\tLIBEVTX_CODEPAGE_ISO_8859_10\n#define LIBEVTX_CODEPAGE_ISO_LATIN_7\t\t\tLIBEVTX_CODEPAGE_ISO_8859_13\n#define LIBEVTX_CODEPAGE_ISO_LATIN_8\t\t\tLIBEVTX_CODEPAGE_ISO_8859_14\n#define LIBEVTX_CODEPAGE_ISO_LATIN_9\t\t\tLIBEVTX_CODEPAGE_ISO_8859_15\n#define LIBEVTX_CODEPAGE_ISO_LATIN_10\t\t\tLIBEVTX_CODEPAGE_ISO_8859_16\n\n#define LIBEVTX_CODEPAGE_KOI8_RUSSIAN\t\t\tLIBEVTX_CODEPAGE_KOI8_R\n#define LIBEVTX_CODEPAGE_KOI8_UKRAINIAN\t\t\tLIBEVTX_CODEPAGE_KOI8_U\n\n#define LIBEVTX_CODEPAGE_WINDOWS_THAI\t\t\tLIBEVTX_CODEPAGE_WINDOWS_874\n#define LIBEVTX_CODEPAGE_WINDOWS_JAPANESE\t\tLIBEVTX_CODEPAGE_WINDOWS_932\n#define LIBEVTX_CODEPAGE_WINDOWS_CHINESE_SIMPLIFIED\tLIBEVTX_CODEPAGE_WINDOWS_936\n#define LIBEVTX_CODEPAGE_WINDOWS_KOREAN\t\t\tLIBEVTX_CODEPAGE_WINDOWS_949\n#define LIBEVTX_CODEPAGE_WINDOWS_CHINESE_TRADITIONAL\tLIBEVTX_CODEPAGE_WINDOWS_950\n#define LIBEVTX_CODEPAGE_WINDOWS_CENTRAL_EUROPEAN\tLIBEVTX_CODEPAGE_WINDOWS_1250\n#define LIBEVTX_CODEPAGE_WINDOWS_CYRILLIC\t\tLIBEVTX_CODEPAGE_WINDOWS_1251\n#define LIBEVTX_CODEPAGE_WINDOWS_WESTERN_EUROPEAN\tLIBEVTX_CODEPAGE_WINDOWS_1252\n#define LIBEVTX_CODEPAGE_WINDOWS_GREEK\t\t\tLIBEVTX_CODEPAGE_WINDOWS_1253\n#define LIBEVTX_CODEPAGE_WINDOWS_TURKISH\t\tLIBEVTX_CODEPAGE_WINDOWS_1254\n#define LIBEVTX_CODEPAGE_WINDOWS_HEBREW\t\t\tLIBEVTX_CODEPAGE_WINDOWS_1255\n#define LIBEVTX_CODEPAGE_WINDOWS_ARABIC\t\t\tLIBEVTX_CODEPAGE_WINDOWS_1256\n#define LIBEVTX_CODEPAGE_WINDOWS_BALTIC\t\t\tLIBEVTX_CODEPAGE_WINDOWS_1257\n#define LIBEVTX_CODEPAGE_WINDOWS_VIETNAMESE\t\tLIBEVTX_CODEPAGE_WINDOWS_1258\n\n#if defined( __cplusplus )\n}\n#endif\n\n#endif /* !defined( _LIBEVTX_CODEPAGE_H ) */\n\n" }, { "path": "include/libevtx/definitions.h.in", "content": "/*\n * Definitions for libevtx\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#if !defined( _LIBEVTX_DEFINITIONS_H )\n#define _LIBEVTX_DEFINITIONS_H\n\n#include \n\n#define LIBEVTX_VERSION\t\t\t@VERSION@\n\n/* The version string\n */\n#define LIBEVTX_VERSION_STRING\t\t\"@VERSION@\"\n\n/* The access flags definitions\n * bit 1 set to 1 for read access\n * bit 2 set to 1 for write access\n * bit 3-8 not used\n */\nenum LIBEVTX_ACCESS_FLAGS\n{\n\tLIBEVTX_ACCESS_FLAG_READ\t= 0x01,\n/* Reserved: not supported yet */\n\tLIBEVTX_ACCESS_FLAG_WRITE\t= 0x02\n};\n\n/* The file access macros\n */\n#define LIBEVTX_OPEN_READ\t\t( LIBEVTX_ACCESS_FLAG_READ )\n/* Reserved: not supported yet */\n#define LIBEVTX_OPEN_WRITE\t\t( LIBEVTX_ACCESS_FLAG_WRITE )\n/* Reserved: not supported yet */\n#define LIBEVTX_OPEN_READ_WRITE\t\t( LIBEVTX_ACCESS_FLAG_READ | LIBEVTX_ACCESS_FLAG_WRITE )\n\n/* The event level definitions\n */\nenum LIBEVTX_EVENT_LEVELS\n{\n\tLIBEVTX_EVENT_LEVEL_CRITICAL\t= 1,\n\tLIBEVTX_EVENT_LEVEL_ERROR\t= 2,\n\tLIBEVTX_EVENT_LEVEL_WARNING\t= 3,\n\tLIBEVTX_EVENT_LEVEL_INFORMATION\t= 4,\n\tLIBEVTX_EVENT_LEVEL_VERBOSE\t= 5,\n};\n\n/* The event file flags\n */\nenum LIBEVTX_FILE_FLAGS\n{\n\tLIBEVTX_FILE_FLAG_IS_DIRTY\t= 0x00000001UL,\n\tLIBEVTX_FILE_FLAG_IS_FULL\t= 0x00000002UL,\n};\n\n#endif /* !defined( _LIBEVTX_DEFINITIONS_H ) */\n\n" }, { "path": "include/libevtx/error.h", "content": "/*\n * The error code definitions for libevtx\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#if !defined( _LIBEVTX_ERROR_H )\n#define _LIBEVTX_ERROR_H\n\n#include \n\n/* External error type definition hides internal structure\n */\ntypedef intptr_t libevtx_error_t;\n\n/* The error domains\n */\nenum LIBEVTX_ERROR_DOMAINS\n{\n\tLIBEVTX_ERROR_DOMAIN_ARGUMENTS\t\t\t= (int) 'a',\n\tLIBEVTX_ERROR_DOMAIN_CONVERSION\t\t\t= (int) 'c',\n\tLIBEVTX_ERROR_DOMAIN_COMPRESSION\t\t= (int) 'C',\n\tLIBEVTX_ERROR_DOMAIN_IO\t\t\t\t= (int) 'I',\n\tLIBEVTX_ERROR_DOMAIN_INPUT\t\t\t= (int) 'i',\n\tLIBEVTX_ERROR_DOMAIN_MEMORY\t\t\t= (int) 'm',\n\tLIBEVTX_ERROR_DOMAIN_OUTPUT\t\t\t= (int) 'o',\n\tLIBEVTX_ERROR_DOMAIN_RUNTIME\t\t\t= (int) 'r'\n};\n\n/* The argument error codes\n * to signify errors regarding arguments passed to a function\n */\nenum LIBEVTX_ARGUMENT_ERROR\n{\n\tLIBEVTX_ARGUMENT_ERROR_GENERIC\t\t\t= 0,\n\n\t/* The argument contains an invalid value\n\t */\n\tLIBEVTX_ARGUMENT_ERROR_INVALID_VALUE\t\t= 1,\n\n\t/* The argument contains a value less than zero\n\t */\n\tLIBEVTX_ARGUMENT_ERROR_VALUE_LESS_THAN_ZERO\t= 2,\n\n\t/* The argument contains a value zero or less\n\t */\n\tLIBEVTX_ARGUMENT_ERROR_VALUE_ZERO_OR_LESS\t= 3,\n\n\t/* The argument contains a value that exceeds the maximum\n\t * for the specific type\n\t */\n\tLIBEVTX_ARGUMENT_ERROR_VALUE_EXCEEDS_MAXIMUM\t= 4,\n\n\t/* The argument contains a value that is too small\n\t */\n\tLIBEVTX_ARGUMENT_ERROR_VALUE_TOO_SMALL\t\t= 5,\n\n\t/* The argument contains a value that is too large\n\t */\n\tLIBEVTX_ARGUMENT_ERROR_VALUE_TOO_LARGE\t\t= 6,\n\n\t/* The argument contains a value that is out of bounds\n\t */\n\tLIBEVTX_ARGUMENT_ERROR_VALUE_OUT_OF_BOUNDS\t= 7,\n\n\t/* The argument contains a value that is not supported\n\t */\n\tLIBEVTX_ARGUMENT_ERROR_UNSUPPORTED_VALUE\t= 8,\n\n\t/* The argument contains a value that conficts with another argument\n\t */\n\tLIBEVTX_ARGUMENT_ERROR_CONFLICTING_VALUE\t= 9\n};\n\n/* The conversion error codes\n * to signify errors regarding conversions\n */\nenum LIBEVTX_CONVERSION_ERROR\n{\n\tLIBEVTX_CONVERSION_ERROR_GENERIC\t\t= 0,\n\n\t/* The conversion failed on the input\n\t */\n\tLIBEVTX_CONVERSION_ERROR_INPUT_FAILED\t\t= 1,\n\n\t/* The conversion failed on the output\n\t */\n\tLIBEVTX_CONVERSION_ERROR_OUTPUT_FAILED\t\t= 2\n};\n\n/* The compression error codes\n * to signify errors regarding compression\n */\nenum LIBEVTX_COMPRESSION_ERROR\n{\n\tLIBEVTX_COMPRESSION_ERROR_GENERIC\t\t= 0,\n\n\t/* The compression failed\n\t */\n\tLIBEVTX_COMPRESSION_ERROR_COMPRESS_FAILED\t= 1,\n\n\t/* The decompression failed\n\t */\n\tLIBEVTX_COMPRESSION_ERROR_DECOMPRESS_FAILED\t= 2\n};\n\n/* The input/output error codes\n * to signify errors regarding input/output\n */\nenum LIBEVTX_IO_ERROR\n{\n\tLIBEVTX_IO_ERROR_GENERIC\t\t\t= 0,\n\n\t/* The open failed\n\t */\n\tLIBEVTX_IO_ERROR_OPEN_FAILED\t\t\t= 1,\n\n\t/* The close failed\n\t */\n\tLIBEVTX_IO_ERROR_CLOSE_FAILED\t\t\t= 2,\n\n\t/* The seek failed\n\t */\n\tLIBEVTX_IO_ERROR_SEEK_FAILED\t\t\t= 3,\n\n\t/* The read failed\n\t */\n\tLIBEVTX_IO_ERROR_READ_FAILED\t\t\t= 4,\n\n\t/* The write failed\n\t */\n\tLIBEVTX_IO_ERROR_WRITE_FAILED\t\t\t= 5,\n\n\t/* Access denied\n\t */\n\tLIBEVTX_IO_ERROR_ACCESS_DENIED\t\t\t= 6,\n\n\t/* The resource is invalid i.e. a missing file\n\t */\n\tLIBEVTX_IO_ERROR_INVALID_RESOURCE\t\t= 7,\n\n\t/* The ioctl failed\n\t */\n\tLIBEVTX_IO_ERROR_IOCTL_FAILED\t\t\t= 8,\n\n\t/* The unlink failed\n\t */\n\tLIBEVTX_IO_ERROR_UNLINK_FAILED\t\t\t= 9\n};\n\n/* The input error codes\n * to signify errors regarding handing input data\n */\nenum LIBEVTX_INPUT_ERROR\n{\n\tLIBEVTX_INPUT_ERROR_GENERIC\t\t\t= 0,\n\n\t/* The input contains invalid data\n\t */\n\tLIBEVTX_INPUT_ERROR_INVALID_DATA\t\t= 1,\n\n\t/* The input contains an unsupported signature\n\t */\n\tLIBEVTX_INPUT_ERROR_SIGNATURE_MISMATCH\t\t= 2,\n\n\t/* A checksum in the input did not match\n\t */\n\tLIBEVTX_INPUT_ERROR_CHECKSUM_MISMATCH\t\t= 3,\n\n\t/* A value in the input did not match a previously\n\t * read value or calculated value\n\t */\n\tLIBEVTX_INPUT_ERROR_VALUE_MISMATCH\t\t= 4\n};\n\n/* The memory error codes\n * to signify errors regarding memory\n */\nenum LIBEVTX_MEMORY_ERROR\n{\n\tLIBEVTX_MEMORY_ERROR_GENERIC\t\t\t= 0,\n\n\t/* There is insufficient memory available\n\t */\n\tLIBEVTX_MEMORY_ERROR_INSUFFICIENT\t\t= 1,\n\n\t/* The memory failed to be copied\n\t */\n\tLIBEVTX_MEMORY_ERROR_COPY_FAILED\t\t= 2,\n\n\t/* The memory failed to be set\n\t */\n\tLIBEVTX_MEMORY_ERROR_SET_FAILED\t\t\t= 3\n};\n\n/* The output error codes\n */\nenum LIBEVTX_OUTPUT_ERROR\n{\n\tLIBEVTX_OUTPUT_ERROR_GENERIC\t\t\t= 0,\n\n\t/* There is insuficient space to write the output\n\t */\n\tLIBEVTX_OUTPUT_ERROR_INSUFFICIENT_SPACE\t\t= 1\n};\n\n/* The runtime error codes\n * to signify errors regarding runtime processing\n */\nenum LIBEVTX_RUNTIME_ERROR\n{\n\tLIBEVTX_RUNTIME_ERROR_GENERIC\t\t\t= 0,\n\n\t/* The value is missing\n\t */\n\tLIBEVTX_RUNTIME_ERROR_VALUE_MISSING\t\t= 1,\n\n\t/* The value was already set\n\t */\n\tLIBEVTX_RUNTIME_ERROR_VALUE_ALREADY_SET\t\t= 2,\n\n\t/* The creation and/or initialization of an internal structure failed\n\t */\n\tLIBEVTX_RUNTIME_ERROR_INITIALIZE_FAILED\t\t= 3,\n\n\t/* The resize of an internal structure failed\n\t */\n\tLIBEVTX_RUNTIME_ERROR_RESIZE_FAILED\t\t= 4,\n\n\t/* The free and/or finalization of an internal structure failed\n\t */\n\tLIBEVTX_RUNTIME_ERROR_FINALIZE_FAILED\t\t= 5,\n\n\t/* The value could not be determined\n\t */\n\tLIBEVTX_RUNTIME_ERROR_GET_FAILED\t\t= 6,\n\n\t/* The value could not be set\n\t */\n\tLIBEVTX_RUNTIME_ERROR_SET_FAILED\t\t= 7,\n\n\t/* The value could not be appended/prepended\n\t */\n\tLIBEVTX_RUNTIME_ERROR_APPEND_FAILED\t\t= 8,\n\n\t/* The value could not be copied\n\t */\n\tLIBEVTX_RUNTIME_ERROR_COPY_FAILED\t\t= 9,\n\n\t/* The value could not be removed\n\t */\n\tLIBEVTX_RUNTIME_ERROR_REMOVE_FAILED\t\t= 10,\n\n\t/* The value could not be printed\n\t */\n\tLIBEVTX_RUNTIME_ERROR_PRINT_FAILED\t\t= 11,\n\n\t/* The value was out of bounds\n\t */\n\tLIBEVTX_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS\t= 12,\n\n\t/* The value exceeds the maximum for its specific type\n\t */\n\tLIBEVTX_RUNTIME_ERROR_VALUE_EXCEEDS_MAXIMUM\t= 13,\n\n\t/* The value is unsupported\n\t */\n\tLIBEVTX_RUNTIME_ERROR_UNSUPPORTED_VALUE\t\t= 14,\n\n\t/* An abort was requested\n\t */\n\tLIBEVTX_RUNTIME_ERROR_ABORT_REQUESTED\t\t= 15\n};\n\n#endif /* !defined( _LIBEVTX_ERROR_H ) */\n\n" }, { "path": "include/libevtx/extern.h", "content": "/*\n * The extern definition\n *\n * This header should be included in header files that export or import\n * library functions\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#if !defined( _LIBEVTX_EXTERN_H )\n#define _LIBEVTX_EXTERN_H\n\n/* To export functions from the libevtx DLL define LIBEVTX_DLL_EXPORT\n * To import functions from the libevtx DLL define LIBEVTX_DLL_IMPORT\n * Otherwise use default extern statement\n */\n#if defined( LIBEVTX_DLL_EXPORT )\n#define LIBEVTX_EXTERN __declspec(dllexport)\n\n#elif defined( LIBEVTX_DLL_IMPORT )\n#define LIBEVTX_EXTERN extern __declspec(dllimport)\n\n#else\n#define LIBEVTX_EXTERN extern\n\n#endif\n\n#endif /* !defined( _LIBEVTX_EXTERN_H ) */\n\n" }, { "path": "include/libevtx/features.h.in", "content": "/*\n * Features of libevtx\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#if !defined( _LIBEVTX_FEATURES_H )\n#define _LIBEVTX_FEATURES_H\n\n/* The libevtx type support features\n */\n#if defined( WINAPI ) || @HAVE_WIDE_CHARACTER_TYPE@\n#define LIBEVTX_HAVE_WIDE_CHARACTER_TYPE\t1\n#endif\n\n#if defined( WINAPI ) || @HAVE_MULTI_THREAD_SUPPORT@\n#define LIBEVTX_HAVE_MULTI_THREAD_SUPPORT\t1\n#endif\n\n#if defined( HAVE_LIBBFIO ) || ( !defined( WINAPI ) && @HAVE_LIBBFIO@ )\n#define LIBEVTX_HAVE_BFIO\t\t\t1\n#endif\n\n#if !defined( LIBEVTX_DEPRECATED )\n#if defined( __GNUC__ ) && __GNUC__ >= 3\n#define LIBEVTX_DEPRECATED\t__attribute__ ((__deprecated__))\n#elif defined( _MSC_VER )\n#define LIBEVTX_DEPRECATED\t__declspec(deprecated)\n#else\n#define LIBEVTX_DEPRECATED\n#endif\n#endif\n\n#endif /* !defined( _LIBEVTX_FEATURES_H ) */\n\n" }, { "path": "include/libevtx/types.h.in", "content": "/*\n * Type definitions for libevtx\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#if !defined( _LIBEVTX_TYPES_H )\n#define _LIBEVTX_TYPES_H\n\n#include \n\n/* Integer type definitions\n */\n#if ( defined( _MSC_VER ) && ( _MSC_VER < 1600 ) ) || ( defined( __BORLANDC__ ) && ( __BORLANDC__ <= 0x0560 ) )\n\n#ifdef __cplusplus\nextern \"C\" {\n#endif\n\n/* Microsoft Visual Studio C++ before Visual Studio 2010 or earlier versions of the Borland C++ Builder\n * do not support the (u)int#_t type definitions but have __int# definitions instead\n */\n#if !defined( HAVE_INT8_T )\n#define HAVE_INT8_T\ntypedef __int8 int8_t;\n#endif\n\n#if !defined( HAVE_UINT8_T )\n#define HAVE_UINT8_T\ntypedef unsigned __int8 uint8_t;\n#endif\n\n#if !defined( HAVE_INT16_T )\n#define HAVE_INT16_T\ntypedef __int16 int16_t;\n#endif\n\n#if !defined( HAVE_UINT16_T )\n#define HAVE_UINT16_T\ntypedef unsigned __int16 uint16_t;\n#endif\n\n#if !defined( HAVE_INT32_T )\n#define HAVE_INT32_T\ntypedef __int32 int32_t;\n#endif\n\n#if !defined( HAVE_UINT32_T )\n#define HAVE_UINT32_T\ntypedef unsigned __int32 uint32_t;\n#endif\n\n#if !defined( HAVE_INT64_T )\n#define HAVE_INT64_T\ntypedef __int64 int64_t;\n#endif\n\n#if !defined( HAVE_UINT64_T )\n#define HAVE_UINT64_T\ntypedef unsigned __int64 uint64_t;\n#endif\n\n#ifdef __cplusplus\n}\n#endif\n\n#elif defined( _MSC_VER ) || defined( __BORLANDC__ )\n\n/* Later versions of Microsoft Visual Studio C++ and Borland C/C++ define the types in \n */\n#include \n\n#else\n\n#if @HAVE_SYS_TYPES_H@ || defined( HAVE_SYS_TYPES_H )\n#include \n\n#else\n#error Missing system type definitions (sys/types.h)\n#endif\n\n/* Type definitions for compilers that have access to\n * or \n */\n#if @HAVE_INTTYPES_H@ || defined( HAVE_INTTYPES_H )\n#include \n\n#elif @HAVE_STDINT_H@ || defined( HAVE_STDINT_H )\n#include \n\n#else\n#error Missing integer type definitions (inttypes.h, stdint.h)\n#endif\n\n#endif\n\n#ifdef __cplusplus\nextern \"C\" {\n#endif\n\n#if defined( _MSC_VER ) || ( defined( __BORLANDC__ ) && ( __BORLANDC__ <= 0x0560 ) )\n\n/* Microsoft Visual Studio C++ or earlier versions of the Borland C++ Builder\n * do not support the ssize_t type definition\n */\n#if !defined( HAVE_SSIZE_T )\n#define HAVE_SSIZE_T\n\n#if defined( _WIN64 )\ntypedef __int64 ssize_t;\n#else\ntypedef __int32 ssize_t;\n#endif\n\n#endif /* !defined( HAVE_SSIZE_T ) */\n\n#endif /* defined( _MSC_VER ) || ( defined( __BORLANDC__ ) && ( __BORLANDC__ <= 0x0560 ) ) */\n\n#if defined( __BORLANDC__ ) && ( __BORLANDC__ <= 0x0560 )\n\n/* Earlier versions of Borland C++ Builder do not support the intptr_t type definition\n */\n#if !defined( HAVE_INTPTR_T )\n#define HAVE_INTPTR_T\n\n#if defined( _WIN64 )\ntypedef __int64\tintptr_t;\n#else\ntypedef __int32\tintptr_t;\n#endif\n\n#endif /* !defined( HAVE_INTPTR_T ) */\n\n#endif /* defined( __BORLANDC__ ) && ( __BORLANDC__ <= 0x0560 ) */\n\n#if ( !defined( HAVE_SIZE32_T ) && ! @HAVE_SIZE32_T@ ) || HAVE_SIZE32_T == 0\n#define HAVE_SIZE32_T\t1\ntypedef uint32_t size32_t;\n#endif\n\n#if ( !defined( HAVE_SSIZE32_T ) && ! @HAVE_SSIZE32_T@ ) || HAVE_SSIZE32_T == 0\n#define HAVE_SSIZE32_T\t1\ntypedef int32_t ssize32_t;\n#endif\n\n#if ( !defined( HAVE_SIZE64_T ) && ! @HAVE_SIZE64_T@ ) || HAVE_SIZE64_T == 0\n#define HAVE_SIZE64_T\t1\ntypedef uint64_t size64_t;\n#endif\n\n#if ( !defined( HAVE_SSIZE64_T ) && ! @HAVE_SSIZE64_T@ ) || HAVE_SSIZE64_T == 0\n#define HAVE_SSIZE64_T\t1\ntypedef int64_t ssize64_t;\n#endif\n\n#if ( !defined( HAVE_OFF64_T ) && ! @HAVE_OFF64_T@ ) || HAVE_OFF64_T == 0\n#define HAVE_OFF64_T\t1\ntypedef int64_t off64_t;\n#endif\n\n/* Wide character definition\n */\n#if defined( __BORLANDC__ ) && ( __BORLANDC__ <= 0x0520 )\n#include \n\n#elif defined( WINAPI )\n#include \n\n#elif @HAVE_WCHAR_H@ || defined( HAVE_WCHAR_H )\n\n/* __USE_UNIX98 is required to add swprintf definition\n */\n#if !defined( __USE_UNIX98 )\n#define __USE_UNIX98\n#define LIBEVTX_DEFINITION_UNIX98\n#endif\n\n#include \n\n#if defined( LIBEVTX_DEFINITION_UNIX98 )\n#undef __USE_UNIX98\n#undef LIBEVTX_DEFINITION_UNIX98\n#endif\n\n#endif\n\n/* The following type definitions hide internal data structures\n */\ntypedef intptr_t libevtx_file_t;\ntypedef intptr_t libevtx_record_t;\ntypedef intptr_t libevtx_template_definition_t;\n\n#ifdef __cplusplus\n}\n#endif\n\n#endif /* !defined( _LIBEVTX_TYPES_H ) */\n\n" }, { "path": "include/libevtx.h.in", "content": "/*\n * Library to access the Windows XML Event Log (EVTX) format\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#if !defined( _LIBEVTX_H )\n#define _LIBEVTX_H\n\n#include \n#include \n#include \n#include \n#include \n#include \n\n#include \n\n#if defined( LIBEVTX_HAVE_BFIO )\n#include \n#endif\n\n#if defined( __cplusplus )\nextern \"C\" {\n#endif\n\n/* -------------------------------------------------------------------------\n * Support functions\n * ------------------------------------------------------------------------- */\n\n/* Returns the library version\n */\nLIBEVTX_EXTERN \\\nconst char *libevtx_get_version(\n void );\n\n/* Returns the access flags for reading\n */\nLIBEVTX_EXTERN \\\nint libevtx_get_access_flags_read(\n void );\n\n/* Retrieves the narrow system string codepage\n * A value of 0 represents no codepage, UTF-8 encoding is used instead\n * Returns 1 if successful or -1 on error\n */\nLIBEVTX_EXTERN \\\nint libevtx_get_codepage(\n int *codepage,\n libevtx_error_t **error );\n\n/* Sets the narrow system string codepage\n * A value of 0 represents no codepage, UTF-8 encoding is used instead\n * Returns 1 if successful or -1 on error\n */\nLIBEVTX_EXTERN \\\nint libevtx_set_codepage(\n int codepage,\n libevtx_error_t **error );\n\n/* Determines if a file contains an EVTX file signature\n * Returns 1 if true, 0 if not or -1 on error\n */\nLIBEVTX_EXTERN \\\nint libevtx_check_file_signature(\n const char *filename,\n libevtx_error_t **error );\n\n#if defined( LIBEVTX_HAVE_WIDE_CHARACTER_TYPE )\n\n/* Determines if a file contains an EVTX file signature\n * Returns 1 if true, 0 if not or -1 on error\n */\nLIBEVTX_EXTERN \\\nint libevtx_check_file_signature_wide(\n const wchar_t *filename,\n libevtx_error_t **error );\n\n#endif /* defined( LIBEVTX_HAVE_WIDE_CHARACTER_TYPE ) */\n\n#if defined( LIBEVTX_HAVE_BFIO )\n\n/* Determines if a file contains an EVTX file signature using a Basic File IO (bfio) handle\n * Returns 1 if true, 0 if not or -1 on error\n */\nLIBEVTX_EXTERN \\\nint libevtx_check_file_signature_file_io_handle(\n libbfio_handle_t *bfio_handle,\n libevtx_error_t **error );\n\n#endif /* defined( LIBEVTX_HAVE_BFIO ) */\n\n/* -------------------------------------------------------------------------\n * Notify functions\n * ------------------------------------------------------------------------- */\n\n/* Sets the verbose notification\n */\nLIBEVTX_EXTERN \\\nvoid libevtx_notify_set_verbose(\n int verbose );\n\n/* Sets the notification stream\n * Returns 1 if successful or -1 on error\n */\nLIBEVTX_EXTERN \\\nint libevtx_notify_set_stream(\n FILE *stream,\n libevtx_error_t **error );\n\n/* Opens the notification stream using a filename\n * The stream is opened in append mode\n * Returns 1 if successful or -1 on error\n */\nLIBEVTX_EXTERN \\\nint libevtx_notify_stream_open(\n const char *filename,\n libevtx_error_t **error );\n\n/* Closes the notification stream if opened using a filename\n * Returns 0 if successful or -1 on error\n */\nLIBEVTX_EXTERN \\\nint libevtx_notify_stream_close(\n libevtx_error_t **error );\n\n/* -------------------------------------------------------------------------\n * Error functions\n * ------------------------------------------------------------------------- */\n\n/* Frees an error\n */\nLIBEVTX_EXTERN \\\nvoid libevtx_error_free(\n libevtx_error_t **error );\n\n/* Prints a descriptive string of the error to the stream\n * Returns the number of printed characters if successful or -1 on error\n */\nLIBEVTX_EXTERN \\\nint libevtx_error_fprint(\n libevtx_error_t *error,\n FILE *stream );\n\n/* Prints a descriptive string of the error to the string\n * The end-of-string character is not included in the return value\n * Returns the number of printed characters if successful or -1 on error\n */\nLIBEVTX_EXTERN \\\nint libevtx_error_sprint(\n libevtx_error_t *error,\n char *string,\n size_t size );\n\n/* Prints a backtrace of the error to the stream\n * Returns the number of printed characters if successful or -1 on error\n */\nLIBEVTX_EXTERN \\\nint libevtx_error_backtrace_fprint(\n libevtx_error_t *error,\n FILE *stream );\n\n/* Prints a backtrace of the error to the string\n * The end-of-string character is not included in the return value\n * Returns the number of printed characters if successful or -1 on error\n */\nLIBEVTX_EXTERN \\\nint libevtx_error_backtrace_sprint(\n libevtx_error_t *error,\n char *string,\n size_t size );\n\n/* -------------------------------------------------------------------------\n * File functions\n * ------------------------------------------------------------------------- */\n\n/* Creates a file\n * Make sure the value file is referencing, is set to NULL\n * Returns 1 if successful or -1 on error\n */\nLIBEVTX_EXTERN \\\nint libevtx_file_initialize(\n libevtx_file_t **file,\n libevtx_error_t **error );\n\n/* Frees a file\n * Returns 1 if successful or -1 on error\n */\nLIBEVTX_EXTERN \\\nint libevtx_file_free(\n libevtx_file_t **file,\n libevtx_error_t **error );\n\n/* Signals a file to abort its current activity\n * Returns 1 if successful or -1 on error\n */\nLIBEVTX_EXTERN \\\nint libevtx_file_signal_abort(\n libevtx_file_t *file,\n libevtx_error_t **error );\n\n/* Opens a file\n * Returns 1 if successful or -1 on error\n */\nLIBEVTX_EXTERN \\\nint libevtx_file_open(\n libevtx_file_t *file,\n const char *filename,\n int access_flags,\n libevtx_error_t **error );\n\n#if defined( LIBEVTX_HAVE_WIDE_CHARACTER_TYPE )\n\n/* Opens a file\n * Returns 1 if successful or -1 on error\n */\nLIBEVTX_EXTERN \\\nint libevtx_file_open_wide(\n libevtx_file_t *file,\n const wchar_t *filename,\n int access_flags,\n libevtx_error_t **error );\n\n#endif /* defined( LIBEVTX_HAVE_WIDE_CHARACTER_TYPE ) */\n\n#if defined( LIBEVTX_HAVE_BFIO )\n\n/* Opens a file using a Basic File IO (bfio) handle\n * Returns 1 if successful or -1 on error\n */\nLIBEVTX_EXTERN \\\nint libevtx_file_open_file_io_handle(\n libevtx_file_t *file,\n libbfio_handle_t *file_io_handle,\n int access_flags,\n libevtx_error_t **error );\n\n#endif /* defined( LIBEVTX_HAVE_BFIO ) */\n\n/* Closes a file\n * Returns 0 if successful or -1 on error\n */\nLIBEVTX_EXTERN \\\nint libevtx_file_close(\n libevtx_file_t *file,\n libevtx_error_t **error );\n\n/* Determine if the file corrupted\n * Returns 1 if corrupted, 0 if not or -1 on error\n */\nLIBEVTX_EXTERN \\\nint libevtx_file_is_corrupted(\n libevtx_file_t *file,\n libevtx_error_t **error );\n\n/* Retrieves the file ASCII codepage\n * Returns 1 if successful or -1 on error\n */\nLIBEVTX_EXTERN \\\nint libevtx_file_get_ascii_codepage(\n libevtx_file_t *file,\n int *ascii_codepage,\n libevtx_error_t **error );\n\n/* Sets the file ASCII codepage\n * Returns 1 if successful or -1 on error\n */\nLIBEVTX_EXTERN \\\nint libevtx_file_set_ascii_codepage(\n libevtx_file_t *file,\n int ascii_codepage,\n libevtx_error_t **error );\n\n/* Retrieves the format version\n * Returns 1 if successful or -1 on error\n */\nLIBEVTX_EXTERN \\\nint libevtx_file_get_format_version(\n libevtx_file_t *file,\n uint16_t *major_version,\n uint16_t *minor_version,\n libevtx_error_t **error );\n\n/* Retrieves the flags\n * Returns 1 if successful or -1 on error\n */\nLIBEVTX_EXTERN \\\nint libevtx_file_get_flags(\n libevtx_file_t *file,\n uint32_t *flags,\n libevtx_error_t **error );\n\n/* Retrieves the number of records\n * Returns 1 if successful or -1 on error\n */\nLIBEVTX_EXTERN \\\nint libevtx_file_get_number_of_records(\n libevtx_file_t *file,\n int *number_of_records,\n libevtx_error_t **error );\n\n/* Retrieves a specific record\n * Returns 1 if successful or -1 on error\n */\nLIBEVTX_EXTERN \\\nint libevtx_file_get_record_by_index(\n libevtx_file_t *file,\n int record_index,\n libevtx_record_t **record,\n libevtx_error_t **error );\n\n/* Retrieves the number of recovered records\n * Returns 1 if successful or -1 on error\n */\nLIBEVTX_EXTERN \\\nint libevtx_file_get_number_of_recovered_records(\n libevtx_file_t *file,\n int *number_of_records,\n libevtx_error_t **error );\n\n/* Retrieves a specific recovered record\n * Returns 1 if successful or -1 on error\n */\nLIBEVTX_EXTERN \\\nint libevtx_file_get_recovered_record_by_index(\n libevtx_file_t *file,\n int record_index,\n libevtx_record_t **record,\n libevtx_error_t **error );\n\n/* -------------------------------------------------------------------------\n * File functions - deprecated\n * ------------------------------------------------------------------------- */\n\n/* Retrieves the version\n *\n * This function deprecated use libevtx_file_get_format_version instead\n *\n * Returns 1 if successful or -1 on error\n */\nLIBEVTX_DEPRECATED \\\nLIBEVTX_EXTERN \\\nint libevtx_file_get_version(\n libevtx_file_t *file,\n uint16_t *major_version,\n uint16_t *minor_version,\n libevtx_error_t **error );\n\n/* Retrieves a specific record\n *\n * This function deprecated use libevtx_file_get_record_by_index instead\n *\n * Returns 1 if successful or -1 on error\n */\nLIBEVTX_DEPRECATED \\\nLIBEVTX_EXTERN \\\nint libevtx_file_get_record(\n libevtx_file_t *file,\n int record_index,\n libevtx_record_t **record,\n libevtx_error_t **error );\n\n/* Retrieves a specific recovered record\n *\n * This function deprecated use libevtx_file_get_recovered_record_by_index instead\n *\n * Returns 1 if successful or -1 on error\n */\nLIBEVTX_DEPRECATED \\\nLIBEVTX_EXTERN \\\nint libevtx_file_get_recovered_record(\n libevtx_file_t *file,\n int record_index,\n libevtx_record_t **record,\n libevtx_error_t **error );\n\n/* -------------------------------------------------------------------------\n * Record functions\n * ------------------------------------------------------------------------- */\n\n/* Frees a record\n * Returns 1 if successful or -1 on error\n */\nLIBEVTX_EXTERN \\\nint libevtx_record_free(\n libevtx_record_t **record,\n libevtx_error_t **error );\n\n/* Retrieves the offset\n * Returns 1 if successful or -1 on error\n */\nLIBEVTX_EXTERN \\\nint libevtx_record_get_offset(\n libevtx_record_t *record,\n off64_t *offset,\n libevtx_error_t **error );\n\n/* Retrieves the identifier (record number)\n * Returns 1 if successful or -1 on error\n */\nLIBEVTX_EXTERN \\\nint libevtx_record_get_identifier(\n libevtx_record_t *record,\n uint64_t *identifier,\n libevtx_error_t **error );\n\n/* Retrieves the 64-bit FILETIME value containing the creation time from the binary XML\n * Returns 1 if successful, 0 if not available or -1 on error\n */\nLIBEVTX_EXTERN \\\nint libevtx_record_get_creation_time(\n libevtx_record_t *record,\n uint64_t *filetime,\n libevtx_error_t **error );\n\n/* Retrieves the 64-bit FILETIME value containing the written time from the event record header\n * Returns 1 if successful or -1 on error\n */\nLIBEVTX_EXTERN \\\nint libevtx_record_get_written_time(\n libevtx_record_t *record,\n uint64_t *filetime,\n libevtx_error_t **error );\n\n/* Retrieves the event identifier\n * Returns 1 if successful or -1 on error\n */\nLIBEVTX_EXTERN \\\nint libevtx_record_get_event_identifier(\n libevtx_record_t *record,\n uint32_t *event_identifier,\n libevtx_error_t **error );\n\n/* Retrieves the event identifier qualifiers\n * Returns 1 if successful, 0 if not available or -1 on error\n */\nLIBEVTX_EXTERN \\\nint libevtx_record_get_event_identifier_qualifiers(\n libevtx_record_t *record,\n uint32_t *event_identifier_qualifiers,\n libevtx_error_t **error );\n\n/* Retrieves the event version\n * Returns 1 if successful, 0 if not available or -1 on error\n */\nLIBEVTX_EXTERN \\\nint libevtx_record_get_event_version(\n libevtx_record_t *record,\n uint8_t *event_version,\n libevtx_error_t **error );\n\n/* Retrieves the event level\n * Returns 1 if successful or -1 on error\n */\nLIBEVTX_EXTERN \\\nint libevtx_record_get_event_level(\n libevtx_record_t *record,\n uint8_t *event_level,\n libevtx_error_t **error );\n\n/* Retrieves the size of the UTF-8 encoded provider identifier\n * The returned size includes the end of string character\n * Returns 1 if successful, 0 if not available or -1 on error\n */\nLIBEVTX_EXTERN \\\nint libevtx_record_get_utf8_provider_identifier_size(\n libevtx_record_t *record,\n size_t *utf8_string_size,\n libevtx_error_t **error );\n\n/* Retrieves the UTF-8 encoded provider identifier\n * The size should include the end of string character\n * Returns 1 if successful, 0 if not available or -1 on error\n */\nLIBEVTX_EXTERN \\\nint libevtx_record_get_utf8_provider_identifier(\n libevtx_record_t *record,\n uint8_t *utf8_string,\n size_t utf8_string_size,\n libevtx_error_t **error );\n\n/* Retrieves the size of the UTF-16 encoded provider identifier\n * The returned size includes the end of string character\n * Returns 1 if successful, 0 if not available or -1 on error\n */\nLIBEVTX_EXTERN \\\nint libevtx_record_get_utf16_provider_identifier_size(\n libevtx_record_t *record,\n size_t *utf16_string_size,\n libevtx_error_t **error );\n\n/* Retrieves the UTF-16 encoded provider identifier\n * The size should include the end of string character\n * Returns 1 if successful, 0 if not available or -1 on error\n */\nLIBEVTX_EXTERN \\\nint libevtx_record_get_utf16_provider_identifier(\n libevtx_record_t *record,\n uint16_t *utf16_string,\n size_t utf16_string_size,\n libevtx_error_t **error );\n\n/* Retrieves the size of the UTF-8 encoded source name\n * The returned size includes the end of string character\n * Returns 1 if successful, 0 if not available or -1 on error\n */\nLIBEVTX_EXTERN \\\nint libevtx_record_get_utf8_source_name_size(\n libevtx_record_t *record,\n size_t *utf8_string_size,\n libevtx_error_t **error );\n\n/* Retrieves the UTF-8 encoded source name\n * The size should include the end of string character\n * Returns 1 if successful, 0 if not available or -1 on error\n */\nLIBEVTX_EXTERN \\\nint libevtx_record_get_utf8_source_name(\n libevtx_record_t *record,\n uint8_t *utf8_string,\n size_t utf8_string_size,\n libevtx_error_t **error );\n\n/* Retrieves the size of the UTF-16 encoded source name\n * The returned size includes the end of string character\n * Returns 1 if successful, 0 if not available or -1 on error\n */\nLIBEVTX_EXTERN \\\nint libevtx_record_get_utf16_source_name_size(\n libevtx_record_t *record,\n size_t *utf16_string_size,\n libevtx_error_t **error );\n\n/* Retrieves the UTF-16 encoded source name\n * The size should include the end of string character\n * Returns 1 if successful, 0 if not available or -1 on error\n */\nLIBEVTX_EXTERN \\\nint libevtx_record_get_utf16_source_name(\n libevtx_record_t *record,\n uint16_t *utf16_string,\n size_t utf16_string_size,\n libevtx_error_t **error );\n\n/* Retrieves the size of the UTF-8 encoded channel name\n * The returned size includes the end of string character\n * Returns 1 if successful, 0 if not available or -1 on error\n */\nLIBEVTX_EXTERN \\\nint libevtx_record_get_utf8_channel_name_size(\n libevtx_record_t *record,\n size_t *utf8_string_size,\n libevtx_error_t **error );\n\n/* Retrieves the UTF-8 encoded channel name\n * The size should include the end of string character\n * Returns 1 if successful, 0 if not available or -1 on error\n */\nLIBEVTX_EXTERN \\\nint libevtx_record_get_utf8_channel_name(\n libevtx_record_t *record,\n uint8_t *utf8_string,\n size_t utf8_string_size,\n libevtx_error_t **error );\n\n/* Retrieves the size of the UTF-16 encoded channel name\n * The returned size includes the end of string character\n * Returns 1 if successful, 0 if not available or -1 on error\n */\nLIBEVTX_EXTERN \\\nint libevtx_record_get_utf16_channel_name_size(\n libevtx_record_t *record,\n size_t *utf16_string_size,\n libevtx_error_t **error );\n\n/* Retrieves the UTF-16 encoded channel name\n * The size should include the end of string character\n * Returns 1 if successful, 0 if not available or -1 on error\n */\nLIBEVTX_EXTERN \\\nint libevtx_record_get_utf16_channel_name(\n libevtx_record_t *record,\n uint16_t *utf16_string,\n size_t utf16_string_size,\n libevtx_error_t **error );\n\n/* Retrieves the size of the UTF-8 encoded computer name\n * The returned size includes the end of string character\n * Returns 1 if successful, 0 if not available or -1 on error\n */\nLIBEVTX_EXTERN \\\nint libevtx_record_get_utf8_computer_name_size(\n libevtx_record_t *record,\n size_t *utf8_string_size,\n libevtx_error_t **error );\n\n/* Retrieves the UTF-8 encoded computer name\n * The size should include the end of string character\n * Returns 1 if successful, 0 if not available or -1 on error\n */\nLIBEVTX_EXTERN \\\nint libevtx_record_get_utf8_computer_name(\n libevtx_record_t *record,\n uint8_t *utf8_string,\n size_t utf8_string_size,\n libevtx_error_t **error );\n\n/* Retrieves the size of the UTF-16 encoded computer name\n * The returned size includes the end of string character\n * Returns 1 if successful, 0 if not available or -1 on error\n */\nLIBEVTX_EXTERN \\\nint libevtx_record_get_utf16_computer_name_size(\n libevtx_record_t *record,\n size_t *utf16_string_size,\n libevtx_error_t **error );\n\n/* Retrieves the UTF-16 encoded computer name\n * The size should include the end of string character\n * Returns 1 if successful, 0 if not available or -1 on error\n */\nLIBEVTX_EXTERN \\\nint libevtx_record_get_utf16_computer_name(\n libevtx_record_t *record,\n uint16_t *utf16_string,\n size_t utf16_string_size,\n libevtx_error_t **error );\n\n/* Retrieves the size of the UTF-8 encoded user security identifier (SID)\n * The returned size includes the end of string character\n * Returns 1 if successful, 0 if not available or -1 on error\n */\nLIBEVTX_EXTERN \\\nint libevtx_record_get_utf8_user_security_identifier_size(\n libevtx_record_t *record,\n size_t *utf8_string_size,\n libevtx_error_t **error );\n\n/* Retrieves the UTF-8 encoded user security identifier (SID)\n * The size should include the end of string character\n * Returns 1 if successful, 0 if not available or -1 on error\n */\nLIBEVTX_EXTERN \\\nint libevtx_record_get_utf8_user_security_identifier(\n libevtx_record_t *record,\n uint8_t *utf8_string,\n size_t utf8_string_size,\n libevtx_error_t **error );\n\n/* Retrieves the size of the UTF-16 encoded user security identifier (SID)\n * The returned size includes the end of string character\n * Returns 1 if successful, 0 if not available or -1 on error\n */\nLIBEVTX_EXTERN \\\nint libevtx_record_get_utf16_user_security_identifier_size(\n libevtx_record_t *record,\n size_t *utf16_string_size,\n libevtx_error_t **error );\n\n/* Retrieves the UTF-16 encoded user security identifier (SID)\n * The size should include the end of string character\n * Returns 1 if successful, 0 if not available or -1 on error\n */\nLIBEVTX_EXTERN \\\nint libevtx_record_get_utf16_user_security_identifier(\n libevtx_record_t *record,\n uint16_t *utf16_string,\n size_t utf16_string_size,\n libevtx_error_t **error );\n\n/* Parses the record data with a template definition\n * This function needs to be called before accessing the strings otherwise\n * the record data will be parsed without a template definition by default\n * Returns 1 if successful, 0 if data could not be parsed or -1 on error\n */\nLIBEVTX_EXTERN \\\nint libevtx_record_parse_data_with_template_definition(\n libevtx_record_t *record,\n libevtx_template_definition_t *template_definition,\n libevtx_error_t **error );\n\n/* Retrieves the number of strings\n * Returns 1 if successful or -1 on error\n */\nLIBEVTX_EXTERN \\\nint libevtx_record_get_number_of_strings(\n libevtx_record_t *record,\n int *number_of_strings,\n libevtx_error_t **error );\n\n/* Retrieves the size of a specific UTF-8 encoded string\n * The returned size includes the end of string character\n * Returns 1 if successful or -1 on error\n */\nLIBEVTX_EXTERN \\\nint libevtx_record_get_utf8_string_size(\n libevtx_record_t *record,\n int string_index,\n size_t *utf8_string_size,\n libevtx_error_t **error );\n\n/* Retrieves a specific UTF-8 encoded string\n * The size should include the end of string character\n * Returns 1 if successful or -1 on error\n */\nLIBEVTX_EXTERN \\\nint libevtx_record_get_utf8_string(\n libevtx_record_t *record,\n int string_index,\n uint8_t *utf8_string,\n size_t utf8_string_size,\n libevtx_error_t **error );\n\n/* Retrieves the size of a specific UTF-16 encoded string\n * The returned size includes the end of string character\n * Returns 1 if successful or -1 on error\n */\nLIBEVTX_EXTERN \\\nint libevtx_record_get_utf16_string_size(\n libevtx_record_t *record,\n int string_index,\n size_t *utf16_string_size,\n libevtx_error_t **error );\n\n/* Retrieves a specific UTF-16 encoded string\n * The size should include the end of string character\n * Returns 1 if successful or -1 on error\n */\nLIBEVTX_EXTERN \\\nint libevtx_record_get_utf16_string(\n libevtx_record_t *record,\n int string_index,\n uint16_t *utf16_string,\n size_t utf16_string_size,\n libevtx_error_t **error );\n\n/* Retrieves the size of the data\n * Returns 1 if successful, 0 if not available or -1 on error\n */\nLIBEVTX_EXTERN \\\nint libevtx_record_get_data_size(\n libevtx_record_t *record,\n size_t *data_size,\n libevtx_error_t **error );\n\n/* Retrieves the data\n * Returns 1 if successful, 0 if not available or -1 on error\n */\nLIBEVTX_EXTERN \\\nint libevtx_record_get_data(\n libevtx_record_t *record,\n uint8_t *data,\n size_t data_size,\n libevtx_error_t **error );\n\n/* Retrieves the size of the UTF-8 encoded XML string\n * The returned size includes the end of string character\n * Returns 1 if successful or -1 on error\n */\nLIBEVTX_EXTERN \\\nint libevtx_record_get_utf8_xml_string_size(\n libevtx_record_t *record,\n size_t *utf8_string_size,\n libevtx_error_t **error );\n\n/* Retrieves the UTF-8 encoded XML string\n * The size should include the end of string character\n * Returns 1 if successful or -1 on error\n */\nLIBEVTX_EXTERN \\\nint libevtx_record_get_utf8_xml_string(\n libevtx_record_t *record,\n uint8_t *utf8_string,\n size_t utf8_string_size,\n libevtx_error_t **error );\n\n/* Retrieves the size of the UTF-16 encoded XML string\n * The returned size includes the end of string character\n * Returns 1 if successful or -1 on error\n */\nLIBEVTX_EXTERN \\\nint libevtx_record_get_utf16_xml_string_size(\n libevtx_record_t *record,\n size_t *utf16_string_size,\n libevtx_error_t **error );\n\n/* Retrieves the UTF-16 encoded XML string\n * The size should include the end of string character\n * Returns 1 if successful or -1 on error\n */\nLIBEVTX_EXTERN \\\nint libevtx_record_get_utf16_xml_string(\n libevtx_record_t *record,\n uint16_t *utf16_string,\n size_t utf16_string_size,\n libevtx_error_t **error );\n\n/* -------------------------------------------------------------------------\n * Record functions - deprecated\n * ------------------------------------------------------------------------- */\n\n/* Parses the record data\n * Returns 1 if successful, 0 if data could not be parsed or -1 on error\n *\n * This function deprecated use there is no need to call this function anymore.\n * If you want to parse the record data with a template definition use:\n * libevtx_record_parse_data_with_template_definition\n */\nLIBEVTX_DEPRECATED \\\nLIBEVTX_EXTERN \\\nint libevtx_record_parse_data(\n libevtx_record_t *record,\n libevtx_template_definition_t *template_definition,\n libevtx_error_t **error );\n\n/* -------------------------------------------------------------------------\n * Template definition functions\n * ------------------------------------------------------------------------- */\n\n/* Creates a template definition\n * Make sure the value template_definition is referencing, is set to NULL\n * Returns 1 if successful or -1 on error\n */\nLIBEVTX_EXTERN \\\nint libevtx_template_definition_initialize(\n libevtx_template_definition_t **template_definition,\n libevtx_error_t **error );\n\n/* Frees a template definition\n * Returns 1 if successful or -1 on error\n */\nLIBEVTX_EXTERN \\\nint libevtx_template_definition_free(\n libevtx_template_definition_t **template_definition,\n libevtx_error_t **error );\n\n/* Sets the data\n * Returns 1 if successful or -1 on error\n */\nLIBEVTX_EXTERN \\\nint libevtx_template_definition_set_data(\n libevtx_template_definition_t *template_definition,\n const uint8_t *data,\n size_t data_size,\n uint32_t data_offset,\n libevtx_error_t **error );\n\n#if defined( __cplusplus )\n}\n#endif\n\n#endif /* !defined( _LIBEVTX_H ) */\n\n" }, { "path": "libevtx/Makefile.am", "content": "AM_CPPFLAGS = \\\n\t-DLOCALEDIR=\\\"$(datadir)/locale\\\" \\\n\t-I../include -I$(top_srcdir)/include \\\n\t-I../common -I$(top_srcdir)/common \\\n\t@LIBCERROR_CPPFLAGS@ \\\n\t@LIBCTHREADS_CPPFLAGS@ \\\n\t@LIBCDATA_CPPFLAGS@ \\\n\t@LIBCLOCALE_CPPFLAGS@ \\\n\t@LIBCNOTIFY_CPPFLAGS@ \\\n\t@LIBCSPLIT_CPPFLAGS@ \\\n\t@LIBUNA_CPPFLAGS@ \\\n\t@LIBCFILE_CPPFLAGS@ \\\n\t@LIBCPATH_CPPFLAGS@ \\\n\t@LIBBFIO_CPPFLAGS@ \\\n\t@LIBFCACHE_CPPFLAGS@ \\\n\t@LIBFDATA_CPPFLAGS@ \\\n\t@LIBFDATETIME_CPPFLAGS@ \\\n\t@LIBFGUID_CPPFLAGS@ \\\n\t@LIBFVALUE_CPPFLAGS@ \\\n\t@LIBFWEVT_CPPFLAGS@ \\\n\t@LIBFWNT_CPPFLAGS@ \\\n\t@PTHREAD_CPPFLAGS@ \\\n\t@LIBEVTX_DLL_EXPORT@\n\nlib_LTLIBRARIES = libevtx.la\n\nlibevtx_la_SOURCES = \\\n\tevtx_chunk.h \\\n\tevtx_event_record.h \\\n\tevtx_file_header.h \\\n\tlibevtx.c \\\n\tlibevtx_byte_stream.c libevtx_byte_stream.h \\\n\tlibevtx_checksum.c libevtx_checksum.h \\\n\tlibevtx_chunk.c libevtx_chunk.h \\\n\tlibevtx_chunks_table.c libevtx_chunks_table.h \\\n\tlibevtx_codepage.c libevtx_codepage.h \\\n\tlibevtx_debug.c libevtx_debug.h \\\n\tlibevtx_definitions.h \\\n\tlibevtx_error.c libevtx_error.h \\\n\tlibevtx_extern.h \\\n\tlibevtx_file.c libevtx_file.h \\\n\tlibevtx_i18n.c libevtx_i18n.h \\\n\tlibevtx_io_handle.c libevtx_io_handle.h \\\n\tlibevtx_libbfio.h \\\n\tlibevtx_libcdata.h \\\n\tlibevtx_libcerror.h \\\n\tlibevtx_libclocale.h \\\n\tlibevtx_libcnotify.h \\\n\tlibevtx_libfcache.h \\\n\tlibevtx_libfdata.h \\\n\tlibevtx_libfdatetime.h \\\n\tlibevtx_libfguid.h \\\n\tlibevtx_libfwevt.h \\\n\tlibevtx_libuna.h \\\n\tlibevtx_notify.c libevtx_notify.h \\\n\tlibevtx_record.c libevtx_record.h \\\n\tlibevtx_record_values.c libevtx_record_values.h \\\n\tlibevtx_support.c libevtx_support.h \\\n\tlibevtx_template_definition.c libevtx_template_definition.h \\\n\tlibevtx_types.h \\\n\tlibevtx_unused.h\n\nlibevtx_la_LIBADD = \\\n\t@LIBCERROR_LIBADD@ \\\n\t@LIBCTHREADS_LIBADD@ \\\n\t@LIBCDATA_LIBADD@ \\\n\t@LIBCLOCALE_LIBADD@ \\\n\t@LIBCNOTIFY_LIBADD@ \\\n\t@LIBCSPLIT_LIBADD@ \\\n\t@LIBUNA_LIBADD@ \\\n\t@LIBCFILE_LIBADD@ \\\n\t@LIBCPATH_LIBADD@ \\\n\t@LIBBFIO_LIBADD@ \\\n\t@LIBFCACHE_LIBADD@ \\\n\t@LIBFDATA_LIBADD@ \\\n\t@LIBFDATETIME_LIBADD@ \\\n\t@LIBFGUID_LIBADD@ \\\n\t@LIBFWEVT_LIBADD@ \\\n\t@LIBFWNT_LIBADD@ \\\n\t@LIBFVALUE_LIBADD@ \\\n\t@PTHREAD_LIBADD@\n\nlibevtx_la_LDFLAGS = -no-undefined -version-info 1:0:0\n\nEXTRA_DIST = \\\n\tlibevtx_definitions.h.in \\\n\tlibevtx.rc \\\n\tlibevtx.rc.in\n\nDISTCLEANFILES = \\\n\tlibevtx_definitions.h \\\n\tlibevtx.rc \\\n\tMakefile \\\n\tMakefile.in\n\nsources-local: $(BUILT_SOURCES)\n\nsplint-local:\n\t@echo \"Running splint on libevtx ...\"\n\t-splint -preproc -redef $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(libevtx_la_SOURCES)\n\n" }, { "path": "libevtx/evtx_chunk.h", "content": "/*\n * The chunk definition of a Windows XML Event Log (EVTX) file\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#if !defined( _EVTX_CHUNK_H )\n#define _EVTX_CHUNK_H\n\n#include \n#include \n\n#if defined( __cplusplus )\nextern \"C\" {\n#endif\n\ntypedef struct evtx_chunk_header evtx_chunk_header_t;\n\nstruct evtx_chunk_header\n{\n\t/* The file signature\n\t * Consists of 8 bytes\n\t * Consists of: \"ElfChnk\\x00\"\n\t */\n\tuint8_t signature[ 8 ];\n\n\t/* The first event record number\n\t * Consists of 8 bytes\n\t */\n\tuint8_t first_event_record_number[ 8 ];\n\n\t/* The last event record number\n\t * Consists of 8 bytes\n\t */\n\tuint8_t last_event_record_number[ 8 ];\n\n\t/* The first event record identifier\n\t * Consists of 8 bytes\n\t */\n\tuint8_t first_event_record_identifier[ 8 ];\n\n\t/* The last event record identifier\n\t * Consists of 8 bytes\n\t */\n\tuint8_t last_event_record_identifier[ 8 ];\n\n\t/* The header size\n\t * Consists of 4 bytes\n\t */\n\tuint8_t header_size[ 4 ];\n\n\t/* The last event record offset\n\t * Consists 4 bytes\n\t */\n\tuint8_t last_event_record_offset[ 4 ];\n\n\t/* The free space offset\n\t * Consists 4 bytes\n\t */\n\tuint8_t free_space_offset[ 4 ];\n\n\t/* Event records checksum\n\t * Consists 4 bytes\n\t */\n\tuint8_t event_records_checksum[ 4 ];\n\n\t/* Unknown\n\t * Consists 64 bytes\n\t */\n\tuint8_t unknown1[ 64 ];\n\n\t/* Unknown\n\t * Consists 4 bytes\n\t */\n\tuint8_t unknown2[ 4 ];\n\n\t/* Checksum\n\t * Consists of 4 bytes\n\t * Contains a CRC32 of bytes 0 to 120 and 128 to 512\n\t */\n\tuint8_t checksum[ 4 ];\n};\n\n#if defined( __cplusplus )\n}\n#endif\n\n#endif /* !defined( _EVTX_CHUNK_H ) */\n\n" }, { "path": "libevtx/evtx_event_record.h", "content": "/*\n * The event record definition of a Windows XML Event Log (EVTX) file\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#if !defined( _EVTX_EVENT_RECORD_H )\n#define _EVTX_EVENT_RECORD_H\n\n#include \n#include \n\n#if defined( __cplusplus )\nextern \"C\" {\n#endif\n\ntypedef struct evtx_event_record_header evtx_event_record_header_t;\n\nstruct evtx_event_record_header\n{\n\t/* The file signature\n\t * Consists of 4 bytes\n\t * Consists of: \"\\x2a\\x2a\\x00\\x00\"\n\t */\n\tuint8_t signature[ 4 ];\n\n\t/* The size\n\t * Consists 4 bytes\n\t */\n\tuint8_t size[ 4 ];\n\n\t/* The identifier\n\t * Consists 8 bytes\n\t */\n\tuint8_t identifier[ 8 ];\n\n\t/* The written time\n\t * Consists 8 bytes\n\t * Contains a filetime\n\t */\n\tuint8_t written_time[ 8 ];\n};\n\n#if defined( __cplusplus )\n}\n#endif\n\n#endif /* !defined( _EVTX_EVENT_RECORD_H ) */\n\n" }, { "path": "libevtx/evtx_file_header.h", "content": "/*\n * The file header definition of a Windows XML Event Log (EVTX) file\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#if !defined( _EVTX_FILE_HEADER_H )\n#define _EVTX_FILE_HEADER_H\n\n#include \n#include \n\n#if defined( __cplusplus )\nextern \"C\" {\n#endif\n\ntypedef struct evtx_file_header evtx_file_header_t;\n\nstruct evtx_file_header\n{\n\t/* The file signature\n\t * Consists of 8 bytes\n\t * Consists of: \"ElfFile\\x00\"\n\t */\n\tuint8_t signature[ 8 ];\n\n\t/* The first chunk number\n\t * Consists of 8 bytes\n\t */\n\tuint8_t first_chunk_number[ 8 ];\n\n\t/* The last chunk number\n\t * Consists of 8 bytes\n\t */\n\tuint8_t last_chunk_number[ 8 ];\n\n\t/* The next record identifier\n\t * Consists of 8 bytes\n\t */\n\tuint8_t next_record_identifier[ 8 ];\n\n\t/* The header size\n\t * Consists of 4 bytes\n\t */\n\tuint8_t header_size[ 4 ];\n\n\t/* The minor version\n\t * Consists of 2 bytes\n\t */\n\tuint8_t minor_version[ 2 ];\n\n\t/* The major version\n\t * Consists of 2 bytes\n\t */\n\tuint8_t major_version[ 2 ];\n\n\t/* The header block size\n\t * Consists of 2 bytes\n\t */\n\tuint8_t header_block_size[ 2 ];\n\n\t/* The number of chunks\n\t * Consists of 2 bytes\n\t */\n\tuint8_t number_of_chunks[ 2 ];\n\n\t/* Unknown\n\t * Consists 76 bytes\n\t */\n\tuint8_t unknown1[ 76 ];\n\n\t/* The file flags\n\t * Consists of 4 bytes\n\t */\n\tuint8_t file_flags[ 4 ];\n\n\t/* Checksum\n\t * Consists of 4 bytes\n\t * Contains a CRC32 of bytes 0 to 120\n\t */\n\tuint8_t checksum[ 4 ];\n};\n\n#if defined( __cplusplus )\n}\n#endif\n\n#endif /* !defined( _EVTX_FILE_HEADER_H ) */\n\n" }, { "path": "libevtx/libevtx.c", "content": "/*\n * Library to access the Windows XML Event Log (EVTX) format\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#include \n\n#if defined( WINAPI )\n#include \n#endif\n\n#include \"libevtx_unused.h\"\n\n/* Define HAVE_LOCAL_LIBEVTX for local use of libevtx\n */\n#if !defined( HAVE_LOCAL_LIBEVTX )\n\n#if defined( WINAPI ) && defined( HAVE_DLLMAIN )\n\n#if defined( _MANAGED )\n#pragma managed( push, off )\n#endif\n\n/* Defines the entry point for the DLL\n */\nBOOL WINAPI DllMain(\n HINSTANCE hinstDLL,\n DWORD fdwReason,\n LPVOID lpvReserved )\n{\n\tLIBEVTX_UNREFERENCED_PARAMETER( lpvReserved )\n\n\tswitch( fdwReason )\n\t{\n\t\tcase DLL_PROCESS_ATTACH:\n\t\t\tDisableThreadLibraryCalls(\n\t\t\t hinstDLL );\n\t\t\tbreak;\n\n\t\tcase DLL_THREAD_ATTACH:\n\t\t\tbreak;\n\n\t\tcase DLL_THREAD_DETACH:\n\t\t\tbreak;\n\n\t\tcase DLL_PROCESS_DETACH:\n\t\t\tbreak;\n\t}\n\treturn( TRUE );\n}\n\n/* Function that indicates the library is a DLL\n * Returns 1\n */\nint libevtx_is_dll(\n void )\n{\n\treturn( 1 );\n}\n\n#endif /* defined( WINAPI ) && defined( HAVE_DLLMAIN ) */\n\n#endif /* !defined( HAVE_LOCAL_LIBEVTX ) */\n\n" }, { "path": "libevtx/libevtx.rc.in", "content": "#include \r\n\r\n#ifdef GCC_WINDRES\r\nVS_VERSION_INFO\t\t\t\tVERSIONINFO\r\n#else\r\nVS_VERSION_INFO\t\t\t\tVERSIONINFO\tMOVEABLE IMPURE LOADONCALL DISCARDABLE\r\n#endif\r\n FILEVERSION\t\t\t\t1,0,0,0\r\n PRODUCTVERSION\t\t\t1,0,0,0\r\n FILEFLAGSMASK\t\t\t\tVS_FFI_FILEFLAGSMASK\r\n#ifdef _DEBUG\r\n FILEFLAGS\t\t\t\t0x1L\r\n#else\r\n FILEFLAGS\t\t\t\t0x0L\r\n#endif\r\n FILEOS\t\t\t\tVOS__WINDOWS32\r\n FILETYPE\t\t\t\tVFT_DLL\r\n FILESUBTYPE\t\t\t\t0x0L\r\nBEGIN\r\n BLOCK \"StringFileInfo\"\r\n BEGIN\r\n BLOCK \"040904E4\"\r\n BEGIN\r\n VALUE \"FileDescription\",\t\t\"Library to access the Windows XML Event Log (EVTX) format\\0\"\r\n VALUE \"FileVersion\",\t\t\"@VERSION@\" \"\\0\"\r\n VALUE \"InternalName\",\t\t\"libevtx.dll\\0\"\r\n VALUE \"LegalCopyright\",\t\t\"(C) 2011-2025, Joachim Metz \\0\"\r\n VALUE \"OriginalFilename\",\t\t\"libevtx.dll\\0\"\r\n VALUE \"ProductName\",\t\t\"libevtx\\0\"\r\n VALUE \"ProductVersion\",\t\t\"@VERSION@\" \"\\0\"\r\n VALUE \"Comments\",\t\t\t\"For more information visit https://github.com/libyal/libevtx/\\0\"\r\n END\r\n END\r\n BLOCK \"VarFileInfo\"\r\n BEGIN\r\n VALUE \"Translation\", 0x0409, 1200\r\n END\r\nEND\r\n" }, { "path": "libevtx/libevtx_byte_stream.c", "content": "/*\n * Byte stream functions\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#include \n#include \n\n#include \"libevtx_byte_stream.h\"\n#include \"libevtx_libcerror.h\"\n#include \"libevtx_types.h\"\n\n/* Checks if a byte stream is filled with 0-byte values\n * Returns 1 if true, 0 if not or -1 on error\n */\nint libevtx_byte_stream_check_for_zero_byte_fill(\n const uint8_t *byte_stream,\n size_t byte_stream_size,\n libcerror_error_t **error )\n{\n\tlibevtx_aligned_t *aligned_byte_stream_index = NULL;\n\tuint8_t *byte_stream_index = NULL;\n\tstatic char *function = \"libevtx_byte_stream_check_for_zero_byte_fill\";\n\n\tif( byte_stream == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid byte stream.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( byte_stream_size > (size_t) SSIZE_MAX )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_VALUE_EXCEEDS_MAXIMUM,\n\t\t \"%s: invalid byte stream size value exceeds maximum.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tbyte_stream_index = (uint8_t *) byte_stream;\n\n\t/* Only optimize for byte stream larger than the alignment\n\t */\n\tif( byte_stream_size > ( 2 * sizeof( libevtx_aligned_t ) ) )\n\t{\n\t\t/* Align the byte stream index\n\t\t */\n\t\twhile( ( (intptr_t) byte_stream_index % sizeof( libevtx_aligned_t ) ) != 0 )\n\t\t{\n\t\t\tif( *byte_stream_index != 0 )\n\t\t\t{\n\t\t\t\treturn( 0 );\n\t\t\t}\n\t\t\tbyte_stream_index += 1;\n\t\t\tbyte_stream_size -= 1;\n\t\t}\n\t\taligned_byte_stream_index = (libevtx_aligned_t *) byte_stream_index;\n\n\t\twhile( byte_stream_size > sizeof( libevtx_aligned_t ) )\n\t\t{\n\t\t\tif( *aligned_byte_stream_index != 0 )\n\t\t\t{\n\t\t\t\treturn( 0 );\n\t\t\t}\n\t\t\taligned_byte_stream_index += 1;\n\t\t\tbyte_stream_size -= sizeof( libevtx_aligned_t );\n\t\t}\n\t\tbyte_stream_index = (uint8_t *) aligned_byte_stream_index;\n\t}\n\twhile( byte_stream_size != 0 )\n\t{\n\t\tif( *byte_stream_index != 0 )\n\t\t{\n\t\t\treturn( 0 );\n\t\t}\n\t\tbyte_stream_index += 1;\n\t\tbyte_stream_size -= 1;\n\t}\n\treturn( 1 );\n}\n\n" }, { "path": "libevtx/libevtx_byte_stream.h", "content": "/*\n * Byte stream functions\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#if !defined( _LIBEVTX_BYTE_STREAM_H )\n#define _LIBEVTX_BYTE_STREAM_H\n\n#include \n#include \n\n#include \"libevtx_libcerror.h\"\n\n#if defined( __cplusplus )\nextern \"C\" {\n#endif\n\nint libevtx_byte_stream_check_for_zero_byte_fill(\n const uint8_t *data,\n size_t data_size,\n libcerror_error_t **error );\n\n#if defined( __cplusplus )\n}\n#endif\n\n#endif /* !defined( _LIBEVTX_BYTE_STREAM_H ) */\n\n" }, { "path": "libevtx/libevtx_checksum.c", "content": "/*\n * Checksum functions\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#include \n#include \n\n#include \"libevtx_libcerror.h\"\n\n/* Table of CRC-32 values of 8-bit values\n */\nuint32_t libevtx_checksum_crc32_table[ 256 ];\n\n/* Value to indicate the CRC-32 table been computed\n */\nint libevtx_checksum_crc32_table_computed = 0;\n\n/* Initializes the internal CRC-32 table\n * The table speeds up the CRC-32 calculation\n */\nvoid libevtx_checksum_initialize_crc32_table(\n void )\n{\n\tuint32_t crc32 = 0;\n\tuint32_t crc32_table_index = 0;\n\tuint8_t bit_iterator = 0;\n\n\tfor( crc32_table_index = 0;\n\t crc32_table_index < 256;\n\t crc32_table_index++ )\n\t{\n\t\tcrc32 = (uint32_t) crc32_table_index;\n\n\t\tfor( bit_iterator = 0;\n\t\t bit_iterator < 8;\n\t\t bit_iterator++ )\n\t\t{\n\t\t\tif( crc32 & 1 )\n\t\t\t{\n\t\t\t\tcrc32 = (uint32_t) 0xedb88320UL ^ ( crc32 >> 1 );\n\t\t\t}\n\t\t\telse\n\t\t\t{\n\t\t\t\tcrc32 = crc32 >> 1;\n\t\t\t}\n\t\t}\n\t\tlibevtx_checksum_crc32_table[ crc32_table_index ] = crc32;\n\t}\n\tlibevtx_checksum_crc32_table_computed = 1;\n}\n\n/* Calculates the CRC-32 of a buffer\n * Based on RFC 1952\n * Returns 1 if successful or -1 on error\n */\nint libevtx_checksum_calculate_little_endian_crc32(\n uint32_t *crc32,\n uint8_t *buffer,\n size_t size,\n uint32_t initial_value,\n libcerror_error_t **error )\n{\n\tstatic char *function = \"libevtx_checksum_calculate_little_endian_crc32\";\n\tsize_t buffer_offset = 0;\n\tuint32_t crc32_table_index = 0;\n\n\tif( crc32 == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid CRC-32.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( buffer == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid buffer.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( size > (size_t) SSIZE_MAX )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_VALUE_EXCEEDS_MAXIMUM,\n\t\t \"%s: invalid size value exceeds maximum.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\t*crc32 = initial_value ^ (uint32_t) 0xffffffffUL;\n\n if( libevtx_checksum_crc32_table_computed == 0 )\n\t{\n\t\tlibevtx_checksum_initialize_crc32_table();\n\t}\n for( buffer_offset = 0;\n\t buffer_offset < size;\n\t buffer_offset++ )\n\t{\n\t\tcrc32_table_index = ( *crc32 ^ buffer[ buffer_offset ] ) & 0x000000ffUL;\n\n\t\t*crc32 = libevtx_checksum_crc32_table[ crc32_table_index ] ^ ( *crc32 >> 8 );\n }\n *crc32 ^= 0xffffffffUL;\n\n\treturn( 1 );\n}\n\n/* Calculates the weak CRC-32 of a buffer\n * Based on RFC 1952, without initial and final XOR operation\n * Returns 1 if successful or -1 on error\n */\nint libevtx_checksum_calculate_little_endian_weak_crc32(\n uint32_t *crc32,\n uint8_t *buffer,\n size_t size,\n uint32_t initial_value,\n libcerror_error_t **error )\n{\n\tstatic char *function = \"libevtx_checksum_calculate_little_endian_weak_crc32\";\n\tsize_t buffer_offset = 0;\n\tuint32_t crc32_table_index = 0;\n\n\tif( crc32 == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid CRC-32.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( buffer == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid buffer.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( size > (size_t) SSIZE_MAX )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_VALUE_EXCEEDS_MAXIMUM,\n\t\t \"%s: invalid size value exceeds maximum.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\t*crc32 = initial_value;\n\n if( libevtx_checksum_crc32_table_computed == 0 )\n\t{\n\t\tlibevtx_checksum_initialize_crc32_table();\n\t}\n for( buffer_offset = 0;\n\t buffer_offset < size;\n\t buffer_offset++ )\n\t{\n\t\tcrc32_table_index = ( *crc32 ^ buffer[ buffer_offset ] ) & 0x000000ffUL;\n\n\t\t*crc32 = libevtx_checksum_crc32_table[ crc32_table_index ] ^ ( *crc32 >> 8 );\n }\n return( 1 );\n}\n\n" }, { "path": "libevtx/libevtx_checksum.h", "content": "/*\n * Checksum functions\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#if !defined( _LIBEVTX_CHECKSUM_H )\n#define _LIBEVTX_CHECKSUM_H\n\n#include \n#include \n\n#include \"libevtx_libcerror.h\"\n\n#if defined( __cplusplus )\nextern \"C\" {\n#endif\n\nvoid libevtx_checksum_initialize_crc32_table(\n void );\n\nint libevtx_checksum_calculate_little_endian_crc32(\n uint32_t *crc32,\n uint8_t *buffer,\n size_t size,\n uint32_t initial_value,\n libcerror_error_t **error );\n\nint libevtx_checksum_calculate_little_endian_weak_crc32(\n uint32_t *crc32,\n uint8_t *buffer,\n size_t size,\n uint32_t initial_value,\n libcerror_error_t **error );\n\n#if defined( __cplusplus )\n}\n#endif\n\n#endif /* !defined( _LIBEVTX_CHECKSUM_H ) */\n\n" }, { "path": "libevtx/libevtx_chunk.c", "content": "/*\n * Chunk functions\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#include \n#include \n#include \n\n#include \"libevtx_byte_stream.h\"\n#include \"libevtx_checksum.h\"\n#include \"libevtx_chunk.h\"\n#include \"libevtx_definitions.h\"\n#include \"libevtx_io_handle.h\"\n#include \"libevtx_libbfio.h\"\n#include \"libevtx_libcdata.h\"\n#include \"libevtx_libcerror.h\"\n#include \"libevtx_libcnotify.h\"\n#include \"libevtx_record_values.h\"\n\n#include \"evtx_chunk.h\"\n#include \"evtx_event_record.h\"\n\nconst uint8_t *evtx_chunk_signature = (uint8_t *) \"ElfChnk\";\n\n/* Creates a chunk\n * Make sure the value chunk is referencing, is set to NULL\n * Returns 1 if successful or -1 on error\n */\nint libevtx_chunk_initialize(\n libevtx_chunk_t **chunk,\n libcerror_error_t **error )\n{\n\tstatic char *function = \"libevtx_chunk_initialize\";\n\n\tif( chunk == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid chunk.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( *chunk != NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_VALUE_ALREADY_SET,\n\t\t \"%s: invalid chunk value already set.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\t*chunk = memory_allocate_structure(\n\t libevtx_chunk_t );\n\n\tif( *chunk == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_MEMORY,\n\t\t LIBCERROR_MEMORY_ERROR_INSUFFICIENT,\n\t\t \"%s: unable to create chunk.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tif( memory_set(\n\t *chunk,\n\t 0,\n\t sizeof( libevtx_chunk_t ) ) == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_MEMORY,\n\t\t LIBCERROR_MEMORY_ERROR_SET_FAILED,\n\t\t \"%s: unable to clear chunk.\",\n\t\t function );\n\n\t\tmemory_free(\n\t\t *chunk );\n\n\t\t*chunk = NULL;\n\n\t\treturn( -1 );\n\t}\n\tif( libcdata_array_initialize(\n\t &( ( *chunk )->records_array ),\n\t 0,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_INITIALIZE_FAILED,\n\t\t \"%s: unable to create chunk records array.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tif( libcdata_array_initialize(\n\t &( ( *chunk )->recovered_records_array ),\n\t 0,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_INITIALIZE_FAILED,\n\t\t \"%s: unable to create chunk recovered records array.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\treturn( 1 );\n\non_error:\n\tif( *chunk != NULL )\n\t{\n\t\tif( ( *chunk )->records_array != NULL )\n\t\t{\n\t\t\tlibcdata_array_free(\n\t\t\t &( ( *chunk )->records_array ),\n\t\t\t NULL,\n\t\t\t NULL );\n\t\t}\n\t\tmemory_free(\n\t\t *chunk );\n\n\t\t*chunk = NULL;\n\t}\n\treturn( -1 );\n}\n\n/* Frees a chunk\n * Returns 1 if successful or -1 on error\n */\nint libevtx_chunk_free(\n libevtx_chunk_t **chunk,\n libcerror_error_t **error )\n{\n\tstatic char *function = \"libevtx_chunk_free\";\n\tint result = 1;\n\n\tif( chunk == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid chunk.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( *chunk != NULL )\n\t{\n\t\tif( libcdata_array_free(\n\t\t &( ( *chunk )->recovered_records_array ),\n\t\t (int (*)(intptr_t **, libcerror_error_t **)) &libevtx_record_values_free,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED,\n\t\t\t \"%s: unable to free the chunk recovered records array.\",\n\t\t\t function );\n\n\t\t\tresult = -1;\n\t\t}\n\t\tif( libcdata_array_free(\n\t\t &( ( *chunk )->records_array ),\n\t\t (int (*)(intptr_t **, libcerror_error_t **)) &libevtx_record_values_free,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED,\n\t\t\t \"%s: unable to free the chunk records array.\",\n\t\t\t function );\n\n\t\t\tresult = -1;\n\t\t}\n\t\tif( ( *chunk )->data != NULL )\n\t\t{\n\t\t\tmemory_free(\n\t\t\t ( *chunk )->data );\n\t\t}\n\t\tmemory_free(\n\t\t *chunk );\n\n\t\t*chunk = NULL;\n\t}\n\treturn( result );\n}\n\n/* Reads the chunk\n * Returns 1 if successful, 0 if the chunk is 0-byte filled or -1 on error\n */\nint libevtx_chunk_read(\n libevtx_chunk_t *chunk,\n libevtx_io_handle_t *io_handle,\n libbfio_handle_t *file_io_handle,\n off64_t file_offset,\n libcerror_error_t **error )\n{\n\tlibevtx_record_values_t *record_values = NULL;\n\tuint8_t *chunk_data = NULL;\n\tstatic char *function = \"libevtx_chunk_read\";\n\tsize_t chunk_data_offset = 0;\n\tsize_t chunk_data_size = 0;\n\tsize_t xml_data_offset = 0;\n\tsize_t xml_data_size = 0;\n\tssize_t read_count = 0;\n\tuint64_t calculated_number_of_event_records = 0;\n\tuint64_t first_event_record_identifier = 0;\n\tuint64_t first_event_record_number = 0;\n\tuint64_t last_event_record_identifier = 0;\n\tuint64_t last_event_record_number = 0;\n\tuint64_t number_of_event_records = 0;\n\tuint32_t calculated_checksum = 0;\n\tuint32_t event_records_checksum = 0;\n\tuint32_t free_space_offset = 0;\n\tuint32_t header_size = 0;\n\tuint32_t last_event_record_offset = 0;\n\tuint32_t stored_checksum = 0;\n\tint entry_index = 0;\n\tint result = 0;\n\n#if defined( HAVE_DEBUG_OUTPUT ) || defined( HAVE_VERBOSE_OUTPUT )\n\tuint64_t calculated_chunk_number = 0;\n#endif\n#if defined( HAVE_DEBUG_OUTPUT )\n\tssize_t free_space_size = 0;\n\tuint32_t value_32bit = 0;\n#endif\n\n\tif( chunk == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid chunk.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( chunk->data != NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_VALUE_ALREADY_SET,\n\t\t \"%s: invalid chunk data already set.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( io_handle == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid IO handle.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( ( io_handle->chunk_size < 4 )\n\t || ( io_handle->chunk_size > (size_t) MEMORY_MAXIMUM_ALLOCATION_SIZE ) )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,\n\t\t \"%s: invalid IO handle - invalid chunk size value out of bounds.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n#if defined( HAVE_DEBUG_OUTPUT ) || defined( HAVE_VERBOSE_OUTPUT )\n\tcalculated_chunk_number = (uint64_t) ( ( file_offset - io_handle->chunk_size ) / io_handle->chunk_size );\n#endif\n\tchunk->file_offset = file_offset;\n\n\tchunk->data = (uint8_t *) memory_allocate(\n\t (size_t) io_handle->chunk_size );\n\n\tif( chunk->data == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_MEMORY,\n\t\t LIBCERROR_MEMORY_ERROR_INSUFFICIENT,\n\t\t \"%s: unable to create chunk data.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tchunk->data_size = (size_t) io_handle->chunk_size;\n\n#if defined( HAVE_DEBUG_OUTPUT )\n\tif( libcnotify_verbose != 0 )\n\t{\n\t\tlibcnotify_printf(\n\t\t \"%s: reading chunk: %\" PRIu64 \" at offset: %\" PRIi64 \" (0x%08\" PRIx64 \")\\n\",\n\t\t function,\n\t\t calculated_chunk_number,\n\t\t file_offset,\n\t\t file_offset );\n\t}\n#endif\n\tread_count = libbfio_handle_read_buffer_at_offset(\n\t file_io_handle,\n\t chunk->data,\n\t chunk->data_size,\n\t file_offset,\n\t error );\n\n\tif( read_count != (ssize_t) chunk->data_size )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_IO,\n\t\t LIBCERROR_IO_ERROR_READ_FAILED,\n\t\t \"%s: unable to read chunk data at offset: %\" PRIi64 \" (0x%08\" PRIx64 \").\",\n\t\t function,\n\t\t file_offset,\n\t\t file_offset );\n\n\t\tgoto on_error;\n\t}\n\tchunk_data = chunk->data;\n\tchunk_data_size = chunk->data_size;\n\n#if defined( HAVE_DEBUG_OUTPUT )\n\tif( libcnotify_verbose != 0 )\n\t{\n\t\tlibcnotify_printf(\n\t\t \"%s: chunk header data:\\n\",\n\t\t function );\n\t\tlibcnotify_print_data(\n\t\t chunk_data,\n\t\t sizeof( evtx_chunk_header_t ),\n\t\t LIBCNOTIFY_PRINT_DATA_FLAG_GROUP_DATA );\n\t}\n#endif\n\tresult = libevtx_byte_stream_check_for_zero_byte_fill(\n\t chunk_data,\n\t chunk_data_size,\n\t error );\n\n\tif( result == -1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to determine of chunk is 0-byte filled.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\telse if( result != 0 )\n\t{\n\t\treturn( 0 );\n\t}\n\tif( memory_compare(\n\t ( (evtx_chunk_header_t *) chunk_data )->signature,\n\t evtx_chunk_signature,\n\t 8 ) != 0 )\n\t{\n#if defined( HAVE_VERBOSE_OUTPUT )\n\t\tif( libcnotify_verbose != 0 )\n\t\t{\n\t\t\tlibcnotify_printf(\n\t\t\t \"%s: unsupported chunk signature.\\n\",\n\t\t\t function );\n\t\t}\n#endif\n\t\tchunk->flags |= LIBEVTX_CHUNK_FLAG_IS_CORRUPTED;\n\t}\n\telse\n\t{\n\t\tbyte_stream_copy_to_uint64_little_endian(\n\t\t ( (evtx_chunk_header_t *) chunk_data )->first_event_record_number,\n\t\t first_event_record_number );\n\n\t\tbyte_stream_copy_to_uint64_little_endian(\n\t\t ( (evtx_chunk_header_t *) chunk_data )->last_event_record_number,\n\t\t last_event_record_number );\n\n\t\tbyte_stream_copy_to_uint64_little_endian(\n\t\t ( (evtx_chunk_header_t *) chunk_data )->first_event_record_identifier,\n\t\t first_event_record_identifier );\n\n\t\tbyte_stream_copy_to_uint64_little_endian(\n\t\t ( (evtx_chunk_header_t *) chunk_data )->last_event_record_identifier,\n\t\t last_event_record_identifier );\n\n\t\tbyte_stream_copy_to_uint32_little_endian(\n\t\t ( (evtx_chunk_header_t *) chunk_data )->header_size,\n\t\t header_size );\n\n\t\tbyte_stream_copy_to_uint32_little_endian(\n\t\t ( (evtx_chunk_header_t *) chunk_data )->last_event_record_offset,\n\t\t last_event_record_offset );\n\n\t\tbyte_stream_copy_to_uint32_little_endian(\n\t\t ( (evtx_chunk_header_t *) chunk_data )->free_space_offset,\n\t\t free_space_offset );\n\n\t\tbyte_stream_copy_to_uint32_little_endian(\n\t\t ( (evtx_chunk_header_t *) chunk_data )->event_records_checksum,\n\t\t event_records_checksum );\n\n\t\tbyte_stream_copy_to_uint32_little_endian(\n\t\t ( (evtx_chunk_header_t *) chunk_data )->checksum,\n\t\t stored_checksum );\n\n#if defined( HAVE_DEBUG_OUTPUT )\n\t\tif( libcnotify_verbose != 0 )\n\t\t{\n\t\t\tlibcnotify_printf(\n\t\t\t \"%s: signature\\t\\t\\t\\t\\t\\t: %c%c%c%c%c%c%c\\\\x%02x\\n\",\n\t\t\t function,\n\t\t\t ( (evtx_chunk_header_t *) chunk_data )->signature[ 0 ],\n\t\t\t ( (evtx_chunk_header_t *) chunk_data )->signature[ 1 ],\n\t\t\t ( (evtx_chunk_header_t *) chunk_data )->signature[ 2 ],\n\t\t\t ( (evtx_chunk_header_t *) chunk_data )->signature[ 3 ],\n\t\t\t ( (evtx_chunk_header_t *) chunk_data )->signature[ 4 ],\n\t\t\t ( (evtx_chunk_header_t *) chunk_data )->signature[ 5 ] ,\n\t\t\t ( (evtx_chunk_header_t *) chunk_data )->signature[ 6 ],\n\t\t\t ( (evtx_chunk_header_t *) chunk_data )->signature[ 7 ] );\n\n\t\t\tlibcnotify_printf(\n\t\t\t \"%s: first event record number\\t\\t\\t\\t: %\" PRIu64 \"\\n\",\n\t\t\t function,\n\t\t\t first_event_record_number );\n\n\t\t\tlibcnotify_printf(\n\t\t\t \"%s: last event record number\\t\\t\\t\\t: %\" PRIu64 \"\\n\",\n\t\t\t function,\n\t\t\t last_event_record_number );\n\n\t\t\tlibcnotify_printf(\n\t\t\t \"%s: first event record identifier\\t\\t\\t: %\" PRIu64 \"\\n\",\n\t\t\t function,\n\t\t\t first_event_record_identifier );\n\n\t\t\tlibcnotify_printf(\n\t\t\t \"%s: last event record identifier\\t\\t\\t: %\" PRIu64 \"\\n\",\n\t\t\t function,\n\t\t\t last_event_record_identifier );\n\n\t\t\tlibcnotify_printf(\n\t\t\t \"%s: header size\\t\\t\\t\\t\\t\\t: %\" PRIu32 \"\\n\",\n\t\t\t function,\n\t\t\t header_size );\n\n\t\t\tlibcnotify_printf(\n\t\t\t \"%s: last event record offset\\t\\t\\t\\t: 0x%08\" PRIx32 \"\\n\",\n\t\t\t function,\n\t\t\t last_event_record_offset );\n\n\t\t\tlibcnotify_printf(\n\t\t\t \"%s: free space offset\\t\\t\\t\\t\\t: 0x%08\" PRIx32 \"\\n\",\n\t\t\t function,\n\t\t\t free_space_offset );\n\n\t\t\tlibcnotify_printf(\n\t\t\t \"%s: event records checksum\\t\\t\\t\\t: 0x%08\" PRIx32 \"\\n\",\n\t\t\t function,\n\t\t\t event_records_checksum );\n\n\t\t\tlibcnotify_printf(\n\t\t\t \"%s: unknown1:\\n\",\n\t\t\t function );\n\t\t\tlibcnotify_print_data(\n\t\t\t ( (evtx_chunk_header_t *) chunk_data )->unknown1,\n\t\t\t 64,\n\t\t\t LIBCNOTIFY_PRINT_DATA_FLAG_GROUP_DATA );\n\n\t\t\tbyte_stream_copy_to_uint32_little_endian(\n\t\t\t ( (evtx_chunk_header_t *) chunk_data )->unknown2,\n\t\t\t value_32bit );\n\t\t\tlibcnotify_printf(\n\t\t\t \"%s: unknown2\\t\\t\\t\\t\\t\\t: 0x%08\" PRIx32 \"\\n\",\n\t\t\t function,\n\t\t\t value_32bit );\n\n\t\t\tlibcnotify_printf(\n\t\t\t \"%s: checksum\\t\\t\\t\\t\\t\\t: 0x%08\" PRIx32 \"\\n\",\n\t\t\t function,\n\t\t\t stored_checksum );\n\n\t\t\tlibcnotify_printf(\n\t\t\t \"\\n\" );\n\t\t}\n#endif /* defined( HAVE_DEBUG_OUTPUT ) */\n\n\t\tif( header_size != 128 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_UNSUPPORTED_VALUE,\n\t\t\t \"%s: unsupported header size: %\" PRIu32 \".\",\n\t\t\t function,\n\t\t\t header_size );\n\n\t\t\tgoto on_error;\n\t\t}\n\t\tif( libevtx_checksum_calculate_little_endian_crc32(\n\t\t &calculated_checksum,\n\t\t chunk_data,\n\t\t 120,\n\t\t 0,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to calculate CRC-32 checksum.\",\n\t\t\t function );\n\n\t\t\tgoto on_error;\n\t\t}\n\t\tif( libevtx_checksum_calculate_little_endian_crc32(\n\t\t &calculated_checksum,\n\t\t &( chunk_data[ 128 ] ),\n\t\t 384,\n\t\t calculated_checksum,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to calculate CRC-32 checksum.\",\n\t\t\t function );\n\n\t\t\tgoto on_error;\n\t\t}\n\t\tif( stored_checksum != calculated_checksum )\n\t\t{\n#if defined( HAVE_VERBOSE_OUTPUT )\n\t\t\tif( libcnotify_verbose != 0 )\n\t\t\t{\n\t\t\t\tlibcnotify_printf(\n\t\t\t\t \"%s: mismatch in chunk: %\" PRIu64 \" header CRC-32 checksum ( 0x%08\" PRIx32 \" != 0x%08\" PRIx32 \" ).\\n\",\n\t\t\t\t function,\n\t\t\t\t calculated_chunk_number,\n\t\t\t\t stored_checksum,\n\t\t\t\t calculated_checksum );\n\t\t\t}\n#endif\n\t\t\tchunk->flags |= LIBEVTX_CHUNK_FLAG_IS_CORRUPTED;\n\t\t}\n\t\tchunk_data_offset = sizeof( evtx_chunk_header_t );\n\n#if defined( HAVE_DEBUG_OUTPUT )\n\t\tif( libcnotify_verbose != 0 )\n\t\t{\n\t\t\tlibcnotify_printf(\n\t\t\t \"%s: chunk table data:\\n\",\n\t\t\t function );\n\t\t\tlibcnotify_print_data(\n\t\t\t &( chunk_data[ chunk_data_offset ] ),\n\t\t\t 384,\n\t\t\t LIBCNOTIFY_PRINT_DATA_FLAG_GROUP_DATA );\n\t\t}\n#endif\n\t\tchunk_data_offset += 384;\n/* TODO can free_space_offset be 0 ? */\n\n\t\tif( ( free_space_offset < chunk_data_offset )\n\t\t || ( free_space_offset > chunk_data_size ) )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t\t LIBCERROR_ARGUMENT_ERROR_VALUE_OUT_OF_BOUNDS,\n\t\t\t \"%s: invalid free space offset value out of bounds.\",\n\t\t\t function );\n\n\t\t\tgoto on_error;\n\t\t}\n\t\tif( libevtx_checksum_calculate_little_endian_crc32(\n\t\t &calculated_checksum,\n\t\t &( chunk_data[ 512 ] ),\n\t\t free_space_offset - chunk_data_offset,\n\t\t 0,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to calculate CRC-32 checksum.\",\n\t\t\t function );\n\n\t\t\tgoto on_error;\n\t\t}\n\t\tif( event_records_checksum != calculated_checksum )\n\t\t{\n#if defined( HAVE_VERBOSE_OUTPUT )\n\t\t\tif( libcnotify_verbose != 0 )\n\t\t\t{\n\t\t\t\tlibcnotify_printf(\n\t\t\t\t \"%s: mismatch in chunk: %\" PRIu64 \" event records CRC-32 checksum ( 0x%08\" PRIx32 \" != 0x%08\" PRIx32 \" ).\\n\",\n\t\t\t\t function,\n\t\t\t\t calculated_chunk_number,\n\t\t\t\t event_records_checksum,\n\t\t\t\t calculated_checksum );\n\t\t\t}\n#endif\n\t\t\tchunk->flags |= LIBEVTX_CHUNK_FLAG_IS_CORRUPTED;\n\t\t}\n\t\twhile( chunk_data_offset <= last_event_record_offset )\n\t\t{\n\t\t\tif( libevtx_record_values_initialize(\n\t\t\t &record_values,\n\t\t\t error ) != 1 )\n\t\t\t{\n\t\t\t\tlibcerror_error_set(\n\t\t\t\t error,\n\t\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t\t LIBCERROR_RUNTIME_ERROR_INITIALIZE_FAILED,\n\t\t\t\t \"%s: unable to create record values.\",\n\t\t\t\t function );\n\n\t\t\t\tgoto on_error;\n\t\t\t}\n#if defined( HAVE_DEBUG_OUTPUT )\n\t\t\tif( libcnotify_verbose != 0 )\n\t\t\t{\n\t\t\t\tlibcnotify_printf(\n\t\t\t\t \"%s: reading record at offset: %\" PRIi64 \" (0x%08\" PRIx64 \")\\n\",\n\t\t\t\t function,\n\t\t\t\t file_offset + chunk_data_offset,\n\t\t\t\t file_offset + chunk_data_offset );\n\t\t\t}\n#endif\n\t\t\tresult = libevtx_record_values_read_header(\n\t\t\t\t record_values,\n\t\t\t\t io_handle,\n\t\t\t\t chunk_data,\n\t\t\t\t chunk_data_size,\n\t\t\t\t chunk_data_offset,\n\t\t\t\t error );\n\n\t\t\tif( result == -1 )\n\t\t\t{\n\t\t\t\tlibcerror_error_set(\n\t\t\t\t error,\n\t\t\t\t LIBCERROR_ERROR_DOMAIN_IO,\n\t\t\t\t LIBCERROR_IO_ERROR_READ_FAILED,\n\t\t\t\t \"%s: unable to read record values header at offset: %\" PRIi64 \".\",\n\t\t\t\t function,\n\t\t\t\t file_offset + chunk_data_offset );\n\n#if defined( HAVE_DEBUG_OUTPUT )\n\t\t\t\tif( libcnotify_verbose != 0 )\n\t\t\t\t{\n\t\t\t\t\tif( ( error != NULL )\n\t\t\t\t\t && ( *error != NULL ) )\n\t\t\t\t\t{\n\t\t\t\t\t\tlibcnotify_print_error_backtrace(\n\t\t\t\t\t\t *error );\n\t\t\t\t\t}\n\t\t\t\t}\n#endif\n\t\t\t\tlibcerror_error_free(\n\t\t\t\t error );\n\t\t\t}\n\t\t\tif( result != 1 )\n\t\t\t{\n\t\t\t\tbreak;\n\t\t\t}\n\t\t\tchunk_data_offset += record_values->data_size;\n\n\t\t\tif( libcdata_array_append_entry(\n\t\t\t chunk->records_array,\n\t\t\t &entry_index,\n\t\t\t (intptr_t *) record_values,\n\t\t\t error ) != 1 )\n\t\t\t{\n\t\t\t\tlibcerror_error_set(\n\t\t\t\t error,\n\t\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t\t LIBCERROR_RUNTIME_ERROR_APPEND_FAILED,\n\t\t\t\t \"%s: unable to append record values to records array.\",\n\t\t\t\t function );\n\n\t\t\t\tgoto on_error;\n\t\t\t}\n\t\t\trecord_values = NULL;\n\n\t\t\tnumber_of_event_records++;\n\t\t}\n\t\tif( first_event_record_number > last_event_record_number )\n\t\t{\n#if defined( HAVE_VERBOSE_OUTPUT )\n\t\t\tif( libcnotify_verbose != 0 )\n\t\t\t{\n\t\t\t\tlibcnotify_printf(\n\t\t\t\t \"%s: invalid chunk: %\" PRIu64 \" first event record number: %\" PRIu64 \" exceeds last event record number: %\" PRIu64 \".\\n\",\n\t\t\t\t function,\n\t\t\t\t calculated_chunk_number,\n\t\t\t\t first_event_record_number,\n\t\t\t\t last_event_record_number );\n\t\t\t}\n#endif\n\t\t\tchunk->flags |= LIBEVTX_CHUNK_FLAG_IS_CORRUPTED;\n\t\t}\n\t\telse if( result == 1 )\n\t\t{\n\t\t\tcalculated_number_of_event_records = last_event_record_number - first_event_record_number + 1;\n\n#if defined( HAVE_DEBUG_OUTPUT )\n\t\t\tif( libcnotify_verbose != 0 )\n\t\t\t{\n\t\t\t\tlibcnotify_printf(\n\t\t\t\t \"%s: calculated number of records\\t\\t\\t: %\" PRIu64 \"\\n\",\n\t\t\t\t function,\n\t\t\t\t calculated_number_of_event_records );\n\t\t\t}\n#endif\n\t\t\tif( number_of_event_records != calculated_number_of_event_records )\n\t\t\t{\n#if defined( HAVE_VERBOSE_OUTPUT )\n\t\t\t\tif( libcnotify_verbose != 0 )\n\t\t\t\t{\n\t\t\t\t\tlibcnotify_printf(\n\t\t\t\t\t \"%s: mismatch in chunk: %\" PRIu64 \" number of event records ( %\" PRIu64 \" != %\" PRIu64 \" ).\\n\",\n\t\t\t\t\t function,\n\t\t\t\t\t calculated_chunk_number,\n\t\t\t\t\t number_of_event_records,\n\t\t\t\t\t calculated_number_of_event_records );\n\t\t\t\t}\n#endif\n\t\t\t\tchunk->flags |= LIBEVTX_CHUNK_FLAG_IS_CORRUPTED;\n\t\t\t}\n\t\t}\n\t\tif( first_event_record_identifier > last_event_record_identifier )\n\t\t{\n#if defined( HAVE_VERBOSE_OUTPUT )\n\t\t\tif( libcnotify_verbose != 0 )\n\t\t\t{\n\t\t\t\tlibcnotify_printf(\n\t\t\t\t \"%s: in chunk: %\" PRIu64 \" first event record identifier: %\" PRIu64 \" exceeds last event record identifier: %\" PRIu64 \".\\n\",\n\t\t\t\t function,\n\t\t\t\t calculated_chunk_number,\n\t\t\t\t first_event_record_identifier,\n\t\t\t\t last_event_record_identifier );\n\t\t\t}\n#endif\n\t\t\t/* TODO mark this as corruption ? */\n\t\t}\n\t}\n\tif( chunk_data_offset < chunk_data_size )\n\t{\n#if defined( HAVE_DEBUG_OUTPUT )\n\t\tfree_space_size = chunk_data_size - chunk_data_offset;\n\n\t\tif( libcnotify_verbose != 0 )\n\t\t{\n\t\t\tlibcnotify_printf(\n\t\t\t \"%s: free space data:\\n\",\n\t\t\t function );\n\t\t\tlibcnotify_print_data(\n\t\t\t &( chunk_data[ chunk_data_offset ] ),\n\t\t\t free_space_size,\n\t\t\t LIBCNOTIFY_PRINT_DATA_FLAG_GROUP_DATA );\n\t\t}\n#endif\n\t\twhile( chunk_data_offset < ( chunk_data_size - 4 ) )\n\t\t{\n/* TODO optimize scan ? */\n\t\t\tif( memory_compare(\n\t\t\t &( chunk_data[ chunk_data_offset ] ),\n\t\t\t evtx_event_record_signature,\n\t\t\t 4 ) == 0 )\n\t\t\t{\n\t\t\t\tif( record_values == NULL )\n\t\t\t\t{\n\t\t\t\t\tif( libevtx_record_values_initialize(\n\t\t\t\t\t &record_values,\n\t\t\t\t\t error ) != 1 )\n\t\t\t\t\t{\n\t\t\t\t\t\tlibcerror_error_set(\n\t\t\t\t\t\t error,\n\t\t\t\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t\t\t\t LIBCERROR_RUNTIME_ERROR_INITIALIZE_FAILED,\n\t\t\t\t\t\t \"%s: unable to create record values.\",\n\t\t\t\t\t\t function );\n\n\t\t\t\t\t\tgoto on_error;\n\t\t\t\t\t}\n\t\t\t\t}\n#if defined( HAVE_DEBUG_OUTPUT )\n\t\t\t\tif( libcnotify_verbose != 0 )\n\t\t\t\t{\n\t\t\t\t\tlibcnotify_printf(\n\t\t\t\t\t \"%s: reading recovered record at offset: %\" PRIi64 \" (0x%08\" PRIx64 \")\\n\",\n\t\t\t\t\t function,\n\t\t\t\t\t file_offset + chunk_data_offset,\n\t\t\t\t\t file_offset + chunk_data_offset );\n\t\t\t\t}\n#endif\n\t\t\t\tif( libevtx_record_values_read_header(\n\t\t\t\t record_values,\n\t\t\t\t io_handle,\n\t\t\t\t chunk_data,\n\t\t\t\t chunk_data_size,\n\t\t\t\t chunk_data_offset,\n\t\t\t\t error ) != 1 )\n\t\t\t\t{\n\t\t\t\t\tlibcerror_error_set(\n\t\t\t\t\t error,\n\t\t\t\t\t LIBCERROR_ERROR_DOMAIN_IO,\n\t\t\t\t\t LIBCERROR_IO_ERROR_READ_FAILED,\n\t\t\t\t\t \"%s: unable to read record values header at offset: %\" PRIi64 \".\",\n\t\t\t\t\t function,\n\t\t\t\t\t file_offset + chunk_data_offset );\n\n#if defined( HAVE_DEBUG_OUTPUT )\n\t\t\t\t\tif( libcnotify_verbose != 0 )\n\t\t\t\t\t{\n\t\t\t\t\t\tif( ( error != NULL )\n\t\t\t\t\t\t && ( *error != NULL ) )\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\tlibcnotify_print_error_backtrace(\n\t\t\t\t\t\t\t *error );\n\t\t\t\t\t\t}\n\t\t\t\t\t}\n#endif\n\t\t\t\t\tlibcerror_error_free(\n\t\t\t\t\t error );\n\t\t\t\t}\n\t\t\t\telse\n\t\t\t\t{\n\t\t\t\t\txml_data_offset = chunk_data_offset + sizeof( evtx_event_record_header_t );\n\t\t\t\t\txml_data_size = 0;\n\n\t\t\t\t\tif( record_values->data_size > ( sizeof( evtx_event_record_header_t ) + 4 ) )\n\t\t\t\t\t{\n\t\t\t\t\t\txml_data_size = record_values->data_size - ( sizeof( evtx_event_record_header_t ) + 4 );\n\t\t\t\t\t}\n\t\t\t\t\tresult = 0;\n\n\t\t\t\t\tif( xml_data_size > 0 )\n\t\t\t\t\t{\n\t\t\t\t\t\tif( ( xml_data_size >= 5 )\n\t\t\t\t\t\t && ( chunk_data[ xml_data_offset ] == 0x0a ) )\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\tresult = 1;\n\t\t\t\t\t\t}\n\t\t\t\t\t\telse if( ( xml_data_size >= 4 )\n\t\t\t\t\t\t && ( chunk_data[ xml_data_offset ] == 0x0f )\n\t\t\t\t\t\t && ( chunk_data[ xml_data_offset + 1 ] == 0x01 )\n\t\t\t\t\t\t && ( chunk_data[ xml_data_offset + 2 ] == 0x01 )\n\t\t\t\t\t\t && ( chunk_data[ xml_data_offset + 3 ] == 0x00 ) )\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\tresult = 1;\n\t\t\t\t\t\t}\n/* TODO what about 0x00 allow it ? */\n\t\t\t\t\t}\n\t\t\t\t\tif( result != 0 )\n\t\t\t\t\t{\n\t\t\t\t\t\tchunk_data_offset += record_values->data_size - 4;\n\n\t\t\t\t\t\tif( libcdata_array_append_entry(\n\t\t\t\t\t\t chunk->recovered_records_array,\n\t\t\t\t\t\t &entry_index,\n\t\t\t\t\t\t (intptr_t *) record_values,\n\t\t\t\t\t\t error ) != 1 )\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\tlibcerror_error_set(\n\t\t\t\t\t\t\t error,\n\t\t\t\t\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t\t\t\t\t LIBCERROR_RUNTIME_ERROR_APPEND_FAILED,\n\t\t\t\t\t\t\t \"%s: unable to append record values to recovered records array.\",\n\t\t\t\t\t\t\t function );\n\n\t\t\t\t\t\t\tgoto on_error;\n\t\t\t\t\t\t}\n\t\t\t\t\t\trecord_values = NULL;\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\t\tchunk_data_offset += 4;\n\t\t}\n\t\tif( record_values != NULL )\n\t\t{\n\t\t\tif( libevtx_record_values_free(\n\t\t\t &record_values,\n\t\t\t error ) != 1 )\n\t\t\t{\n\t\t\t\tlibcerror_error_set(\n\t\t\t\t error,\n\t\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t\t LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED,\n\t\t\t\t \"%s: unable to free record values.\",\n\t\t\t\t function );\n\n\t\t\t\tgoto on_error;\n\t\t\t}\n\t\t}\n\t}\n\treturn( 1 );\n\non_error:\n\tif( record_values != NULL )\n\t{\n\t\tlibevtx_record_values_free(\n\t\t &record_values,\n\t\t NULL );\n\t}\n\tif( chunk->data != NULL )\n\t{\n\t\tmemory_free(\n\t\t chunk->data );\n\n\t\tchunk->data = NULL;\n\t}\n\treturn( -1 );\n}\n\n/* Retrieves the number of records\n * Returns 1 if successful or -1 on error\n */\nint libevtx_chunk_get_number_of_records(\n libevtx_chunk_t *chunk,\n uint16_t *number_of_records,\n libcerror_error_t **error )\n{\n\tstatic char *function = \"libevtx_chunk_get_number_of_records\";\n\tint chunk_number_of_records = 0;\n\n\tif( chunk == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid chunk.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( number_of_records == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid number of records.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( libcdata_array_get_number_of_entries(\n\t chunk->records_array,\n\t &chunk_number_of_records,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to retrieve number of records.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( chunk_number_of_records > (int) UINT16_MAX )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_VALUE_EXCEEDS_MAXIMUM,\n\t\t \"%s: invalid number of chunk records value exceeds maximum.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\t*number_of_records = (uint16_t) chunk_number_of_records;\n\n\treturn( 1 );\n}\n\n/* Retrieves the record at the index\n * Returns 1 if successful or -1 on error\n */\nint libevtx_chunk_get_record(\n libevtx_chunk_t *chunk,\n uint16_t record_index,\n libevtx_record_values_t **record_values,\n libcerror_error_t **error )\n{\n\tstatic char *function = \"libevtx_chunk_get_record\";\n\n\tif( chunk == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid chunk.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( libcdata_array_get_entry_by_index(\n\t chunk->records_array,\n\t (int) record_index,\n\t (intptr_t **) record_values,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to retrieve record: %\" PRIu16 \".\",\n\t\t function,\n\t\t record_index );\n\n\t\treturn( -1 );\n\t}\n\treturn( 1 );\n}\n\n/* Retrieves the number of recovered records\n * Returns 1 if successful or -1 on error\n */\nint libevtx_chunk_get_number_of_recovered_records(\n libevtx_chunk_t *chunk,\n uint16_t *number_of_records,\n libcerror_error_t **error )\n{\n\tstatic char *function = \"libevtx_chunk_get_number_of_recovered_records\";\n\tint chunk_number_of_records = 0;\n\n\tif( chunk == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid chunk.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( number_of_records == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid number of records.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( libcdata_array_get_number_of_entries(\n\t chunk->recovered_records_array,\n\t &chunk_number_of_records,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to retrieve number of records.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( chunk_number_of_records > (int) UINT16_MAX )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_VALUE_EXCEEDS_MAXIMUM,\n\t\t \"%s: invalid number of chunk records value exceeds maximum.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\t*number_of_records = (uint16_t) chunk_number_of_records;\n\n\treturn( 1 );\n}\n\n/* Retrieves the recovered record at the index\n * Returns 1 if successful or -1 on error\n */\nint libevtx_chunk_get_recovered_record(\n libevtx_chunk_t *chunk,\n uint16_t record_index,\n libevtx_record_values_t **record_values,\n libcerror_error_t **error )\n{\n\tstatic char *function = \"libevtx_chunk_get_recovered_record\";\n\n\tif( chunk == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid chunk.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( libcdata_array_get_entry_by_index(\n\t chunk->recovered_records_array,\n\t (int) record_index,\n\t (intptr_t **) record_values,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to retrieve record: %\" PRIu16 \".\",\n\t\t function,\n\t\t record_index );\n\n\t\treturn( -1 );\n\t}\n\treturn( 1 );\n}\n\n" }, { "path": "libevtx/libevtx_chunk.h", "content": "/*\n * Chunk functions\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#if !defined( _LIBEVTX_CHUNK_H )\n#define _LIBEVTX_CHUNK_H\n\n#include \n#include \n\n#include \"libevtx_io_handle.h\"\n#include \"libevtx_libbfio.h\"\n#include \"libevtx_libcdata.h\"\n#include \"libevtx_libcerror.h\"\n#include \"libevtx_record_values.h\"\n\n#if defined( __cplusplus )\nextern \"C\" {\n#endif\n\ntypedef struct libevtx_chunk libevtx_chunk_t;\n\nstruct libevtx_chunk\n{\n\t/* The chunk data\n\t */\n\tuint8_t *data;\n\n\t/* The chunk data size\n\t */\n\tsize_t data_size;\n\n\t/* The (chunk) file offset\n\t */\n\toff64_t file_offset;\n\n\t/* The records array\n\t */\n\tlibcdata_array_t *records_array;\n\n\t/* The recovered records array\n\t */\n\tlibcdata_array_t *recovered_records_array;\n\n\t/* Various flags\n\t */\n\tuint8_t flags;\n};\n\nint libevtx_chunk_initialize(\n libevtx_chunk_t **chunk,\n libcerror_error_t **error );\n\nint libevtx_chunk_free(\n libevtx_chunk_t **chunk,\n libcerror_error_t **error );\n\nint libevtx_chunk_read(\n libevtx_chunk_t *chunk,\n libevtx_io_handle_t *io_handle,\n libbfio_handle_t *file_io_handle,\n off64_t file_offset,\n libcerror_error_t **error );\n\nint libevtx_chunk_get_number_of_records(\n libevtx_chunk_t *chunk,\n uint16_t *number_of_records,\n libcerror_error_t **error );\n\nint libevtx_chunk_get_record(\n libevtx_chunk_t *chunk,\n uint16_t record_index,\n libevtx_record_values_t **record_values,\n libcerror_error_t **error );\n\nint libevtx_chunk_get_number_of_recovered_records(\n libevtx_chunk_t *chunk,\n uint16_t *number_of_records,\n libcerror_error_t **error );\n\nint libevtx_chunk_get_recovered_record(\n libevtx_chunk_t *chunk,\n uint16_t record_index,\n libevtx_record_values_t **record_values,\n libcerror_error_t **error );\n\n#if defined( __cplusplus )\n}\n#endif\n\n#endif /* !defined( _LIBEVTX_CHUNK_H ) */\n\n" }, { "path": "libevtx/libevtx_chunks_table.c", "content": "/*\n * Chunks table functions\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#include \n#include \n#include \n\n#include \"libevtx_chunk.h\"\n#include \"libevtx_chunks_table.h\"\n#include \"libevtx_io_handle.h\"\n#include \"libevtx_libbfio.h\"\n#include \"libevtx_libcerror.h\"\n#include \"libevtx_libfcache.h\"\n#include \"libevtx_libfdata.h\"\n#include \"libevtx_record_values.h\"\n#include \"libevtx_unused.h\"\n\n/* Creates a chunks table\n * Make sure the value chunks_table is referencing, is set to NULL\n * Returns 1 if successful or -1 on error\n */\nint libevtx_chunks_table_initialize(\n libevtx_chunks_table_t **chunks_table,\n libevtx_io_handle_t *io_handle,\n libfdata_vector_t *chunks_vector,\n libfcache_cache_t *chunks_cache,\n libcerror_error_t **error )\n{\n\tstatic char *function = \"libevtx_chunks_table_initialize\";\n\n\tif( chunks_table == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid chunks table.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( *chunks_table != NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_VALUE_ALREADY_SET,\n\t\t \"%s: invalid chunks table value already set.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( io_handle == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid IO handle.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\t*chunks_table = memory_allocate_structure(\n\t libevtx_chunks_table_t );\n\n\tif( *chunks_table == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_MEMORY,\n\t\t LIBCERROR_MEMORY_ERROR_INSUFFICIENT,\n\t\t \"%s: unable to create chunks table.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tif( memory_set(\n\t *chunks_table,\n\t 0,\n\t sizeof( libevtx_chunks_table_t ) ) == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_MEMORY,\n\t\t LIBCERROR_MEMORY_ERROR_SET_FAILED,\n\t\t \"%s: unable to clear chunks table.\",\n\t\t function );\n\n\n\t\tgoto on_error;\n\t}\n\t( *chunks_table )->io_handle = io_handle;\n\t( *chunks_table )->chunks_vector = chunks_vector;\n\t( *chunks_table )->chunks_cache = chunks_cache;\n\n\treturn( 1 );\n\non_error:\n\tif( *chunks_table != NULL )\n\t{\n\t\tmemory_free(\n\t\t *chunks_table );\n\n\t\t*chunks_table = NULL;\n\t}\n\treturn( -1 );\n}\n\n/* Frees a chunks table\n * Returns 1 if successful or -1 on error\n */\nint libevtx_chunks_table_free(\n libevtx_chunks_table_t **chunks_table,\n libcerror_error_t **error )\n{\n\tstatic char *function = \"libevtx_chunks_table_free\";\n\tint result = 1;\n\n\tif( chunks_table == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid chunks table.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( *chunks_table != NULL )\n\t{\n\t\tmemory_free(\n\t\t *chunks_table );\n\n\t\t*chunks_table = NULL;\n\t}\n\treturn( result );\n}\n\n/* Reads a chunk\n * Callback function for the chunk vector\n * Returns 1 if successful or -1 on error\n */\nint libevtx_chunks_table_read_record(\n intptr_t *io_handle,\n libbfio_handle_t *file_io_handle,\n libfdata_list_element_t *list_element,\n libfdata_cache_t *cache,\n int data_range_file_index LIBEVTX_ATTRIBUTE_UNUSED,\n off64_t data_range_offset,\n size64_t data_range_size,\n uint32_t data_range_flags LIBEVTX_ATTRIBUTE_UNUSED,\n uint8_t read_flags LIBEVTX_ATTRIBUTE_UNUSED,\n libcerror_error_t **error )\n{\n\tlibevtx_chunk_t *chunk = NULL;\n\tlibevtx_chunks_table_t *chunks_table = NULL;\n\tlibevtx_record_values_t *chunk_record_values = NULL;\n\tlibevtx_record_values_t *record_values = NULL;\n\tstatic char *function = \"libevtx_io_handle_read_chunk\";\n\tsize_t calculated_chunk_data_offset = 0;\n\tsize_t chunk_data_offset = 0;\n\tuint16_t number_of_records = 0;\n\tuint16_t record_index = 0;\n\n\tLIBEVTX_UNREFERENCED_PARAMETER( data_range_file_index );\n\tLIBEVTX_UNREFERENCED_PARAMETER( data_range_flags );\n\tLIBEVTX_UNREFERENCED_PARAMETER( read_flags );\n\n\tif( io_handle == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid IO handle.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tchunks_table = (libevtx_chunks_table_t *) io_handle;\n\n\t/* The chunk index is stored in the data range size\n\t*/\n\tif( data_range_size > (uint64_t) UINT16_MAX )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_VALUE_OUT_OF_BOUNDS,\n\t\t \"%s: invalid data range size value out of bounds.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tif( libfdata_vector_get_element_value_by_index(\n\t chunks_table->chunks_vector,\n\t (intptr_t *) file_io_handle,\n\t (libfdata_cache_t *) chunks_table->chunks_cache,\n\t (uint16_t) data_range_size,\n\t (intptr_t **) &chunk,\n\t 0,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to retrieve chunk: %\" PRIu64 \".\",\n\t\t function,\n\t\t data_range_size );\n\n\t\tgoto on_error;\n\t}\n\tif( chunk == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_VALUE_MISSING,\n\t\t \"%s: missing chunk: %\" PRIu64 \".\",\n\t\t function,\n\t\t data_range_size );\n\n\t\tgoto on_error;\n\t}\n\tif( ( data_range_offset < chunk->file_offset )\n\t || ( data_range_offset >= (off64_t) ( chunk->file_offset + chunk->data_size ) ) )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_VALUE_OUT_OF_BOUNDS,\n\t\t \"%s: invalid chunk file offset value out of bounds.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tcalculated_chunk_data_offset = (size_t) ( data_range_offset - chunk->file_offset );\n\n\tif( libevtx_chunk_get_number_of_records(\n\t chunk,\n\t &number_of_records,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to retrieve number of records from chunk.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n/* TODO optimize determining the corresponding record */\n\tfor( record_index = 0;\n\t record_index < number_of_records;\n\t record_index++ )\n\t{\n\t\tif( libevtx_chunk_get_record(\n\t\t chunk,\n\t\t record_index,\n\t\t &chunk_record_values,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve record: %\" PRIu16 \" from chunk.\",\n\t\t\t function,\n\t\t\t record_index );\n\n\t\t\tgoto on_error;\n\t\t}\n\t\tif( chunk_record_values == NULL )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_VALUE_MISSING,\n\t\t\t \"%s: missing record: %\" PRIu16 \".\",\n\t\t\t function,\n\t\t\t record_index );\n\n\t\t\tgoto on_error;\n\t\t}\n\t\tchunk_data_offset = chunk_record_values->chunk_data_offset;\n\n\t\tif( calculated_chunk_data_offset == chunk_data_offset )\n\t\t{\n\t\t\tbreak;\n\t\t}\n\t}\n/* TODO allow to control look up in normal vs recovered */\n\tif( calculated_chunk_data_offset != chunk_data_offset )\n\t{\n\t\tif( libevtx_chunk_get_number_of_recovered_records(\n\t\t chunk,\n\t\t &number_of_records,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve number of recovered records from chunk.\",\n\t\t\t function );\n\n\t\t\tgoto on_error;\n\t\t}\n\t\tfor( record_index = 0;\n\t\t record_index < number_of_records;\n\t\t record_index++ )\n\t\t{\n\t\t\tif( libevtx_chunk_get_recovered_record(\n\t\t\t chunk,\n\t\t\t record_index,\n\t\t\t &chunk_record_values,\n\t\t\t error ) != 1 )\n\t\t\t{\n\t\t\t\tlibcerror_error_set(\n\t\t\t\t error,\n\t\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t\t \"%s: unable to retrieve recovered record: %\" PRIu16 \" from chunk.\",\n\t\t\t\t function,\n\t\t\t\t record_index );\n\n\t\t\t\tgoto on_error;\n\t\t\t}\n\t\t\tif( chunk_record_values == NULL )\n\t\t\t{\n\t\t\t\tlibcerror_error_set(\n\t\t\t\t error,\n\t\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t\t LIBCERROR_RUNTIME_ERROR_VALUE_MISSING,\n\t\t\t\t \"%s: missing recovered record: %\" PRIu16 \".\",\n\t\t\t\t function,\n\t\t\t\t record_index );\n\n\t\t\t\tgoto on_error;\n\t\t\t}\n\t\t\tchunk_data_offset = chunk_record_values->chunk_data_offset;\n\n\t\t\tif( calculated_chunk_data_offset == chunk_data_offset )\n\t\t\t{\n\t\t\t\tbreak;\n\t\t\t}\n\t\t}\n\t}\n\tif( calculated_chunk_data_offset != chunk_data_offset )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_VALUE_MISSING,\n\t\t \"%s: no record found at offset: %\" PRIi64 \".\",\n\t\t function,\n\t\t data_range_offset );\n\n\t\tgoto on_error;\n\t}\n\t/* The record values are managed by the chunk and freed after usage\n\t * A copy is created to make sure that the records values that are passed\n\t * to the records list can be managed by the list\n\t */\n\tif( libevtx_record_values_clone(\n\t &record_values,\n\t chunk_record_values,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_INITIALIZE_FAILED,\n\t\t \"%s: unable to create record values.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tif( libevtx_record_values_read_xml_document(\n\t record_values,\n\t chunks_table->io_handle,\n\t chunk->data,\n\t chunk->data_size,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_IO,\n\t\t LIBCERROR_IO_ERROR_READ_FAILED,\n\t\t \"%s: unable to read record values XML document.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tif( libfdata_list_element_set_element_value(\n\t list_element,\n\t (intptr_t *) file_io_handle,\n\t cache,\n\t (intptr_t *) record_values,\n\t (int (*)(intptr_t **, libcerror_error_t **)) &libevtx_record_values_free,\n\t LIBFDATA_LIST_ELEMENT_VALUE_FLAG_MANAGED,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_SET_FAILED,\n\t\t \"%s: unable to set record values as element value.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\treturn( 1 );\n\non_error:\n\tif( record_values != NULL )\n\t{\n\t\tlibevtx_record_values_free(\n\t\t &record_values,\n\t\t NULL );\n\t}\n\treturn( -1 );\n}\n\n" }, { "path": "libevtx/libevtx_chunks_table.h", "content": "/*\n * Chunks table functions\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#if !defined( _LIBEVTX_CHUNKS_TABLE_H )\n#define _LIBEVTX_CHUNKS_TABLE_H\n\n#include \n#include \n\n#include \"libevtx_io_handle.h\"\n#include \"libevtx_libbfio.h\"\n#include \"libevtx_libcerror.h\"\n#include \"libevtx_libfcache.h\"\n#include \"libevtx_libfdata.h\"\n\n#if defined( __cplusplus )\nextern \"C\" {\n#endif\n\ntypedef struct libevtx_chunks_table libevtx_chunks_table_t;\n\nstruct libevtx_chunks_table\n{\n\t/* The IO handle\n\t */\n\tlibevtx_io_handle_t *io_handle;\n\n\t/* The chunks vector\n\t */\n\tlibfdata_vector_t *chunks_vector;\n\n\t/* The chunks cache\n\t */\n\tlibfcache_cache_t *chunks_cache;\n};\n\nint libevtx_chunks_table_initialize(\n libevtx_chunks_table_t **chunks_table,\n libevtx_io_handle_t *io_handle,\n libfdata_vector_t *chunks_vector,\n libfcache_cache_t *chunks_cache,\n libcerror_error_t **error );\n\nint libevtx_chunks_table_free(\n libevtx_chunks_table_t **chunks_table,\n libcerror_error_t **error );\n\nint libevtx_chunks_table_read_record(\n intptr_t *io_handle,\n libbfio_handle_t *file_io_handle,\n libfdata_list_element_t *list_element,\n libfdata_cache_t *cache,\n int data_range_file_index,\n off64_t data_range_offset,\n size64_t data_range_size,\n uint32_t data_range_flags,\n uint8_t read_flags,\n libcerror_error_t **error );\n\n#if defined( __cplusplus )\n}\n#endif\n\n#endif /* !defined( _LIBEVTX_CHUNKS_TABLE_H ) */\n\n" }, { "path": "libevtx/libevtx_codepage.c", "content": "/*\n * Codepage functions\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#include \n#include \n\n#include \"libevtx_codepage.h\"\n\n#if defined( HAVE_DEBUG_OUTPUT )\n\nlibevtx_codepage_t libevtx_codepages[ ] = {\n\t{ 874,\t\t\"windows-874\",\t\t\"Thai\" },\n\t{ 932,\t\t\"iso-2022-jp\",\t\t\"Japanese (Shift-JIS)\" },\n\t{ 936,\t\t\"gb2312\",\t\t\"Chinese Simplified\" },\n\t{ 949,\t\t\"ks_c_5601-1987\",\t\"Korean\" },\n\t{ 950,\t\t\"big5\",\t\t\t\"Chinese Traditional\" },\n\t{ 1200,\t\t\"unicode\",\t\t\"Unicode\" },\n\t{ 1250,\t\t\"windows-1250\",\t\t\"Central European\" },\n\t{ 1251,\t\t\"windows-1251\",\t\t\"Cyrillic\" },\n\t{ 1252,\t\t\"windows-1252\",\t\t\"Western European\" },\n\t{ 1253,\t\t\"windows-1253\",\t\t\"Greek\" },\n\t{ 1254,\t\t\"windows-1254\",\t\t\"Turkish\" },\n\t{ 1255,\t\t\"windows-1255\",\t\t\"Hebrew\" },\n\t{ 1256,\t\t\"windows-1256\",\t\t\"Arabic\" },\n\t{ 1257,\t\t\"windows-1257\",\t\t\"Baltic\" },\n\t{ 1258,\t\t\"windows-1258\",\t\t\"Vietnamese\" },\n\t{ 20127,\t\"us-ascii\",\t\t\"7-bit American Standard Code for Information Interchange (ASCII)\" },\n\t{ 20866,\t\"koi8-r\",\t\t\"Cyrillic\" },\n\t{ 21866,\t\"koi8-u\",\t\t\"Cyrillic\" },\n\t{ 28591,\t\"iso-8859-1\",\t\t\"Western European\" },\n\t{ 28592,\t\"iso-8859-2\",\t\t\"Central European\" },\n\t{ 28593,\t\"iso-8859-3\",\t\t\"Latin 3 \" },\n\t{ 28594,\t\"iso-8859-4\",\t\t\"Baltic\" },\n\t{ 28595,\t\"iso-8859-5\",\t\t\"Cyrillic\" },\n\t{ 28596,\t\"iso-8859-6\",\t\t\"Arabic\" },\n\t{ 28597,\t\"iso-8859-7\",\t\t\"Greek\" },\n\t{ 28598,\t\"iso-8859-8-i\",\t\t\"Hebrew\" },\n\t{ 28599,\t\"iso-8859-7\",\t\t\"Turkish\" },\n\t{ 28605,\t\"iso-8859-15\",\t\t\"Latin 9 \" },\n\t{ 50220,\t\"iso-2022-jp\",\t\t\"Japanese (JIS)\" },\n\t{ 50221,\t\"csISO2022JP\",\t\t\"Japanese (JIS-Allow 1 byte Kana)\" },\n\t{ 51932,\t\"euc-jp\",\t\t\"Japanese\" },\n\t{ 51949,\t\"euc-kr\",\t\t\"Korean\" },\n\t{ 52936,\t\"hz-gb-2312\",\t\t\"Chinese Simplified\" },\n\t{ 65000,\t\"utf-7\",\t\t\"7-bit Unicode Transformation Format (UTF-7)\" },\n\t{ 65001,\t\"utf-8\",\t\t\"8-bit Unicode Transformation Format (UTF-8)\" },\n\n\t{ (uint32_t) -1, \"_UNKNOWN_\", \"Unknown\" } };\n\n/* Retrieves a string containing the codepage identifier\n */\nconst char *libevtx_codepage_get_identifier(\n uint32_t codepage )\n{\n\tint iterator = 0;\n\n\twhile( ( libevtx_codepages[ iterator ] ).codepage != (uint32_t) -1 )\n\t{\n\t\tif( ( libevtx_codepages[ iterator ] ).codepage == codepage )\n\t\t{\n\t\t\tbreak;\n\t\t}\n\t\titerator++;\n\t}\n\treturn(\n\t ( libevtx_codepages[ iterator ] ).identifier );\n}\n\n/* Retrieves a string containing the codepage description\n */\nconst char *libevtx_codepage_get_description(\n uint32_t codepage )\n{\n\tint iterator = 0;\n\n\twhile( ( libevtx_codepages[ iterator ] ).codepage != (uint32_t) -1 )\n\t{\n\t\tif( ( libevtx_codepages[ iterator ] ).codepage == codepage )\n\t\t{\n\t\t\tbreak;\n\t\t}\n\t\titerator++;\n\t}\n\treturn(\n\t ( libevtx_codepages[ iterator ] ).description );\n}\n\n#endif /* defined( HAVE_DEBUG_OUTPUT ) */\n\n" }, { "path": "libevtx/libevtx_codepage.h", "content": "/*\n * Codepage functions\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#if !defined( _LIBEVTX_INTERNAL_CODEPAGE_H )\n#define _LIBEVTX_INTERNAL_CODEPAGE_H\n\n#include \n#include \n\n#if defined( __cplusplus )\nextern \"C\" {\n#endif\n\n/* Define HAVE_LOCAL_LIBEVTX for local use of libevtx\n * The definitions in are copied here\n * for local use of libevtx\n */\n#if !defined( HAVE_LOCAL_LIBEVTX )\n\n#include \n\n#else\n\n/* The codepage definitions\n */\nenum LIBEVTX_CODEPAGES\n{\n\tLIBEVTX_CODEPAGE_ASCII\t\t= 20127,\n\n\tLIBEVTX_CODEPAGE_ISO_8859_1\t= 28591,\n\tLIBEVTX_CODEPAGE_ISO_8859_2\t= 28592,\n\tLIBEVTX_CODEPAGE_ISO_8859_3\t= 28593,\n\tLIBEVTX_CODEPAGE_ISO_8859_4\t= 28594,\n\tLIBEVTX_CODEPAGE_ISO_8859_5\t= 28595,\n\tLIBEVTX_CODEPAGE_ISO_8859_6\t= 28596,\n\tLIBEVTX_CODEPAGE_ISO_8859_7\t= 28597,\n\tLIBEVTX_CODEPAGE_ISO_8859_8\t= 28598,\n\tLIBEVTX_CODEPAGE_ISO_8859_9\t= 28599,\n\tLIBEVTX_CODEPAGE_ISO_8859_10\t= 28600,\n\tLIBEVTX_CODEPAGE_ISO_8859_11\t= 28601,\n\tLIBEVTX_CODEPAGE_ISO_8859_13\t= 28603,\n\tLIBEVTX_CODEPAGE_ISO_8859_14\t= 28604,\n\tLIBEVTX_CODEPAGE_ISO_8859_15\t= 28605,\n\tLIBEVTX_CODEPAGE_ISO_8859_16\t= 28606,\n\n\tLIBEVTX_CODEPAGE_KOI8_R\t\t= 20866,\n\tLIBEVTX_CODEPAGE_KOI8_U\t\t= 21866,\n\n\tLIBEVTX_CODEPAGE_WINDOWS_874\t= 874,\n\tLIBEVTX_CODEPAGE_WINDOWS_932\t= 932,\n\tLIBEVTX_CODEPAGE_WINDOWS_936\t= 936,\n\tLIBEVTX_CODEPAGE_WINDOWS_949\t= 949,\n\tLIBEVTX_CODEPAGE_WINDOWS_950\t= 950,\n\tLIBEVTX_CODEPAGE_WINDOWS_1250\t= 1250,\n\tLIBEVTX_CODEPAGE_WINDOWS_1251\t= 1251,\n\tLIBEVTX_CODEPAGE_WINDOWS_1252\t= 1252,\n\tLIBEVTX_CODEPAGE_WINDOWS_1253\t= 1253,\n\tLIBEVTX_CODEPAGE_WINDOWS_1254\t= 1254,\n\tLIBEVTX_CODEPAGE_WINDOWS_1255\t= 1255,\n\tLIBEVTX_CODEPAGE_WINDOWS_1256\t= 1256,\n\tLIBEVTX_CODEPAGE_WINDOWS_1257\t= 1257,\n\tLIBEVTX_CODEPAGE_WINDOWS_1258\t= 1258\n};\n\n#endif /* !defined( HAVE_LOCAL_LIBEVTX ) */\n\n#if defined( HAVE_DEBUG_OUTPUT )\n\ntypedef struct libevtx_codepage libevtx_codepage_t;\n\nstruct libevtx_codepage\n{\n\t/* The codepage\n\t */\n\tuint32_t codepage;\n\n\t/* The identifier\n\t */\n\tconst char *identifier;\n\n\t/* The description\n\t */\n\tconst char *description;\n};\nconst char *libevtx_codepage_get_identifier(\n uint32_t codepage );\n\nconst char *libevtx_codepage_get_description(\n uint32_t codepage );\n\n#endif /* defined( HAVE_DEBUG_OUTPUT ) */\n\n#if defined( __cplusplus )\n}\n#endif\n\n#endif /* !defined( _LIBEVTX_INTERNAL_CODEPAGE_H ) */\n\n" }, { "path": "libevtx/libevtx_debug.c", "content": "/*\n * Debug functions\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#include \n#include \n\n#include \"libevtx_debug.h\"\n#include \"libevtx_definitions.h\"\n#include \"libevtx_libbfio.h\"\n#include \"libevtx_libcerror.h\"\n#include \"libevtx_libcnotify.h\"\n\n#if defined( HAVE_DEBUG_OUTPUT )\n\n/* Prints the file flags\n */\nvoid libevtx_debug_print_file_flags(\n uint32_t file_flags )\n{\n\tif( ( file_flags & LIBEVTX_FILE_FLAG_IS_DIRTY ) != 0 )\n\t{\n\t\tlibcnotify_printf(\n\t\t \"Is dirty\\n\" );\n\t}\n\tif( ( file_flags & LIBEVTX_FILE_FLAG_IS_FULL ) != 0 )\n\t{\n\t\tlibcnotify_printf(\n\t\t \"Is full\\n\" );\n\t}\n}\n\n/* Prints the value type\n */\nvoid libevtx_debug_print_value_type(\n uint8_t value_type )\n{\n\tswitch( value_type & 0x7f )\n\t{\n\t\tcase LIBEVTX_VALUE_TYPE_NULL:\n\t\t\tlibcnotify_printf(\n\t\t\t \"NULL\" );\n\t\t\tbreak;\n\n\t\tcase LIBEVTX_VALUE_TYPE_STRING_UTF16:\n\t\t\tlibcnotify_printf(\n\t\t\t \"UTF-16 string\" );\n\t\t\tbreak;\n\n\t\tcase LIBEVTX_VALUE_TYPE_STRING_BYTE_STREAM:\n\t\t\tlibcnotify_printf(\n\t\t\t \"Byte stream string\" );\n\t\t\tbreak;\n\n\t\tcase LIBEVTX_VALUE_TYPE_INTEGER_8BIT:\n\t\t\tlibcnotify_printf(\n\t\t\t \"Integer 8-bit signed\" );\n\t\t\tbreak;\n\n\t\tcase LIBEVTX_VALUE_TYPE_UNSIGNED_INTEGER_8BIT:\n\t\t\tlibcnotify_printf(\n\t\t\t \"Integer 8-bit unsigned\" );\n\t\t\tbreak;\n\n\t\tcase LIBEVTX_VALUE_TYPE_INTEGER_16BIT:\n\t\t\tlibcnotify_printf(\n\t\t\t \"Integer 16-bit signed\" );\n\t\t\tbreak;\n\n\t\tcase LIBEVTX_VALUE_TYPE_UNSIGNED_INTEGER_16BIT:\n\t\t\tlibcnotify_printf(\n\t\t\t \"Integer 16-bit unsigned\" );\n\t\t\tbreak;\n\n\t\tcase LIBEVTX_VALUE_TYPE_INTEGER_32BIT:\n\t\t\tlibcnotify_printf(\n\t\t\t \"Integer 32-bit signed\" );\n\t\t\tbreak;\n\n\t\tcase LIBEVTX_VALUE_TYPE_UNSIGNED_INTEGER_32BIT:\n\t\t\tlibcnotify_printf(\n\t\t\t \"Integer 32-bit unsigned\" );\n\t\t\tbreak;\n\n\t\tcase LIBEVTX_VALUE_TYPE_INTEGER_64BIT:\n\t\t\tlibcnotify_printf(\n\t\t\t \"Integer 64-bit signed\" );\n\t\t\tbreak;\n\n\t\tcase LIBEVTX_VALUE_TYPE_UNSIGNED_INTEGER_64BIT:\n\t\t\tlibcnotify_printf(\n\t\t\t \"Integer 64-bit unsigned\" );\n\t\t\tbreak;\n\n\t\tcase LIBEVTX_VALUE_TYPE_FLOATING_POINT_32BIT:\n\t\t\tlibcnotify_printf(\n\t\t\t \"Floating point 32-bit (single precision)\" );\n\t\t\tbreak;\n\n\t\tcase LIBEVTX_VALUE_TYPE_FLOATING_POINT_64BIT:\n\t\t\tlibcnotify_printf(\n\t\t\t \"Floating point 64-bit (double precision)\" );\n\t\t\tbreak;\n\n\t\tcase LIBEVTX_VALUE_TYPE_BOOLEAN:\n\t\t\tlibcnotify_printf(\n\t\t\t \"Boolean\" );\n\t\t\tbreak;\n\n\t\tcase LIBEVTX_VALUE_TYPE_BINARY_DATA:\n\t\t\tlibcnotify_printf(\n\t\t\t \"Binary data\" );\n\t\t\tbreak;\n\n\t\tcase LIBEVTX_VALUE_TYPE_GUID:\n\t\t\tlibcnotify_printf(\n\t\t\t \"GUID\" );\n\t\t\tbreak;\n\n\t\tcase LIBEVTX_VALUE_TYPE_SIZE:\n\t\t\tlibcnotify_printf(\n\t\t\t \"Size\" );\n\t\t\tbreak;\n\n\t\tcase LIBEVTX_VALUE_TYPE_FILETIME:\n\t\t\tlibcnotify_printf(\n\t\t\t \"Filetime\" );\n\t\t\tbreak;\n\n\t\tcase LIBEVTX_VALUE_TYPE_SYSTEMTIME:\n\t\t\tlibcnotify_printf(\n\t\t\t \"Systemtime\" );\n\t\t\tbreak;\n\n\t\tcase LIBEVTX_VALUE_TYPE_NT_SECURITY_IDENTIFIER:\n\t\t\tlibcnotify_printf(\n\t\t\t \"NT Security Identifier (SID)\" );\n\t\t\tbreak;\n\n\t\tcase LIBEVTX_VALUE_TYPE_HEXADECIMAL_INTEGER_32BIT:\n\t\t\tlibcnotify_printf(\n\t\t\t \"Hexadecimal integer 32-bit\" );\n\t\t\tbreak;\n\n\t\tcase LIBEVTX_VALUE_TYPE_HEXADECIMAL_INTEGER_64BIT:\n\t\t\tlibcnotify_printf(\n\t\t\t \"Hexadecimal integer 64-bit\" );\n\t\t\tbreak;\n\n\t\tcase LIBEVTX_VALUE_TYPE_BINARY_XML:\n\t\t\tlibcnotify_printf(\n\t\t\t \"Binary XML\" );\n\t\t\tbreak;\n\n\t\tdefault:\n\t\t\tlibcnotify_printf(\n\t\t\t \"UNKNOWN\" );\n\t\t\tbreak;\n\t}\n}\n\n/* Prints the read offsets\n * Returns 1 if successful or -1 on error\n */\nint libevtx_debug_print_read_offsets(\n libbfio_handle_t *file_io_handle,\n libcerror_error_t **error )\n{\n\tstatic char *function = \"libevtx_debug_print_read_offsets\";\n\toff64_t offset = 0;\n\tsize64_t size = 0;\n\tint number_of_offsets = 0;\n\tint offset_iterator = 0;\n\n\tif( file_io_handle == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid file IO handle.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( libbfio_handle_get_number_of_offsets_read(\n\t file_io_handle,\n\t &number_of_offsets,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to retrieve number of offsets read.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tlibcnotify_printf(\n\t \"Offsets read:\\n\" );\n\n\tfor( offset_iterator = 0;\n\t offset_iterator < number_of_offsets;\n\t offset_iterator++ )\n\t{\n\t\tif( libbfio_handle_get_offset_read(\n\t\t file_io_handle,\n\t\t offset_iterator,\n\t\t &offset,\n\t\t &size,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve offset: %d.\",\n\t\t\t function,\n\t\t\t offset_iterator );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\tlibcnotify_printf(\n\t\t \"%08\" PRIi64 \" ( 0x%08\" PRIx64 \" ) - %08\" PRIi64 \" ( 0x%08\" PRIx64 \" ) size: %\" PRIi64 \"\\n\",\n\t\t offset,\n\t\t offset,\n\t\t offset + (off64_t) size,\n\t\t offset + (off64_t) size,\n\t\t size );\n\t}\n\tlibcnotify_printf(\n\t \"\\n\" );\n\n\treturn( 1 );\n}\n\n#endif /* defined( HAVE_DEBUG_OUTPUT ) */\n\n" }, { "path": "libevtx/libevtx_debug.h", "content": "/*\n * Debug functions\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#if !defined( _LIBEVTX_DEBUG_H )\n#define _LIBEVTX_DEBUG_H\n\n#include \n#include \n\n#include \"libevtx_libcerror.h\"\n\n#include \"libevtx_libbfio.h\"\n\n#if defined( __cplusplus )\nextern \"C\" {\n#endif\n\n#if defined( HAVE_DEBUG_OUTPUT )\n\nvoid libevtx_debug_print_file_flags(\n uint32_t file_flags );\n\nvoid libevtx_debug_print_value_type(\n uint8_t value_type );\n\nint libevtx_debug_print_read_offsets(\n libbfio_handle_t *file_io_handle,\n libcerror_error_t **error );\n\n#endif /* defined( HAVE_DEBUG_OUTPUT ) */\n\n#if defined( __cplusplus )\n}\n#endif\n\n#endif /* !defined( _LIBEVTX_DEBUG_H ) */\n\n" }, { "path": "libevtx/libevtx_definitions.h.in", "content": "/*\n * The internal definitions\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#if !defined( _LIBEVTX_INTERNAL_DEFINITIONS_H )\n#define _LIBEVTX_INTERNAL_DEFINITIONS_H\n\n#include \n#include \n\n#define LIBEVTX_ENDIAN_BIG\t\t\t\t_BYTE_STREAM_ENDIAN_BIG\n#define LIBEVTX_ENDIAN_LITTLE\t\t\t\t_BYTE_STREAM_ENDIAN_LITTLE\n\n/* Define HAVE_LOCAL_LIBEVTX for local use of libevtx\n */\n#if !defined( HAVE_LOCAL_LIBEVTX )\n#include \n\n/* The definitions in are copied here\n * for local use of libevtx\n */\n#else\n#define LIBEVTX_VERSION\t\t\t\t\t\t@VERSION@\n\n/* The version string\n */\n#define LIBEVTX_VERSION_STRING\t\t\t\t\t\"@VERSION@\"\n\n/* The access flags definitions\n * bit 1 set to 1 for read access\n * bit 2 set to 1 for write access\n * bit 3-8 not used\n */\nenum LIBEVTX_ACCESS_FLAGS\n{\n\tLIBEVTX_ACCESS_FLAG_READ\t\t\t\t= 0x01,\n/* Reserved: not supported yet */\n\tLIBEVTX_ACCESS_FLAG_WRITE\t\t\t\t= 0x02\n};\n\n/* The file access macros\n */\n#define LIBEVTX_OPEN_READ\t\t\t\t\t( LIBEVTX_ACCESS_FLAG_READ )\n/* Reserved: not supported yet */\n#define LIBEVTX_OPEN_WRITE\t\t\t\t\t( LIBEVTX_ACCESS_FLAG_WRITE )\n/* Reserved: not supported yet */\n#define LIBEVTX_OPEN_READ_WRITE\t\t\t\t\t( LIBEVTX_ACCESS_FLAG_READ | LIBEVTX_ACCESS_FLAG_WRITE )\n\n/* The event level definitions\n */\nenum LIBEVTX_EVENT_LEVELS\n{\n\tLIBEVTX_EVENT_LEVEL_CRITICAL\t\t\t\t= 1,\n\tLIBEVTX_EVENT_LEVEL_ERROR\t\t\t\t= 2,\n\tLIBEVTX_EVENT_LEVEL_WARNING\t\t\t\t= 3,\n\tLIBEVTX_EVENT_LEVEL_INFORMATION\t\t\t\t= 4,\n\tLIBEVTX_EVENT_LEVEL_VERBOSE\t\t\t\t= 5,\n};\n\n/* The event file flags\n */\nenum LIBEVTX_FILE_FLAGS\n{\n\tLIBEVTX_FILE_FLAG_IS_DIRTY\t\t\t\t= 0x00000001UL,\n\tLIBEVTX_FILE_FLAG_IS_FULL\t\t\t\t= 0x00000002UL,\n};\n\n#endif /* !defined( HAVE_LOCAL_LIBEVTX ) */\n\n/* The IO handle flags\n */\nenum LIBEVTX_IO_HANDLE_FLAGS\n{\n\t/* The file is corrupted\n\t */\n\tLIBEVTX_IO_HANDLE_FLAG_IS_CORRUPTED\t\t\t= 0x01\n};\n\n/* The chunk flags\n */\nenum LIBEVTX_CHUNK_FLAGS\n{\n\t/* The chunk is corrupted\n\t */\n\tLIBEVTX_CHUNK_FLAG_IS_CORRUPTED\t\t\t\t= 0x01\n};\n\n/* The binary XML token definitions\n */\nenum LIBEVTX_BINARY_XML_TOKENS\n{\n\tLIBEVTX_BINARY_XML_TOKEN_END_OF_FILE\t\t\t= 0x00,\n\tLIBEVTX_BINARY_XML_TOKEN_OPEN_START_ELEMENT_TAG\t\t= 0x01,\n\tLIBEVTX_BINARY_XML_TOKEN_CLOSE_START_ELEMENT_TAG\t= 0x02,\n\tLIBEVTX_BINARY_XML_TOKEN_CLOSE_EMPTY_ELEMENT_TAG\t= 0x03,\n\tLIBEVTX_BINARY_XML_TOKEN_END_ELEMENT_TAG\t\t= 0x04,\n\tLIBEVTX_BINARY_XML_TOKEN_VALUE\t\t\t\t= 0x05,\n\tLIBEVTX_BINARY_XML_TOKEN_ATTRIBUTE\t\t\t= 0x06,\n\tLIBEVTX_BINARY_XML_TOKEN_CDATA_SECTION\t\t\t= 0x07,\n\tLIBEVTX_BINARY_XML_TOKEN_CHARACTER_REFERENCE\t\t= 0x08,\n\tLIBEVTX_BINARY_XML_TOKEN_ENTITY_REFERENCE\t\t= 0x09,\n\tLIBEVTX_BINARY_XML_TOKEN_PI_TARGET\t\t\t= 0x0a,\n\tLIBEVTX_BINARY_XML_TOKEN_PI_DATA\t\t\t= 0x0b,\n\tLIBEVTX_BINARY_XML_TOKEN_TEMPLATE_INSTANCE\t\t= 0x0c,\n\tLIBEVTX_BINARY_XML_TOKEN_NORMAL_SUBSTITUTION\t\t= 0x0d,\n\tLIBEVTX_BINARY_XML_TOKEN_OPTIONAL_SUBSTITUTION\t\t= 0x0e,\n\tLIBEVTX_BINARY_XML_TOKEN_FRAGMENT_HEADER\t\t= 0x0f\n};\n\n#define LIBEVTX_BINARY_XML_TOKEN_FLAG_HAS_MORE_DATA\t\t0x40\n\n/* The value type definitions\n */\nenum LIBEVTX_VALUE_TYPES\n{\n\tLIBEVTX_VALUE_TYPE_NULL\t\t\t\t\t= 0x00,\n\tLIBEVTX_VALUE_TYPE_STRING_UTF16\t\t\t\t= 0x01,\n\tLIBEVTX_VALUE_TYPE_STRING_BYTE_STREAM\t\t\t= 0x02,\n\tLIBEVTX_VALUE_TYPE_INTEGER_8BIT\t\t\t\t= 0x03,\n\tLIBEVTX_VALUE_TYPE_UNSIGNED_INTEGER_8BIT\t\t= 0x04,\n\tLIBEVTX_VALUE_TYPE_INTEGER_16BIT\t\t\t= 0x05,\n\tLIBEVTX_VALUE_TYPE_UNSIGNED_INTEGER_16BIT\t\t= 0x06,\n\tLIBEVTX_VALUE_TYPE_INTEGER_32BIT\t\t\t= 0x07,\n\tLIBEVTX_VALUE_TYPE_UNSIGNED_INTEGER_32BIT\t\t= 0x08,\n\tLIBEVTX_VALUE_TYPE_INTEGER_64BIT\t\t\t= 0x09,\n\tLIBEVTX_VALUE_TYPE_UNSIGNED_INTEGER_64BIT\t\t= 0x0a,\n\tLIBEVTX_VALUE_TYPE_FLOATING_POINT_32BIT\t\t\t= 0x0b,\n\tLIBEVTX_VALUE_TYPE_FLOATING_POINT_64BIT\t\t\t= 0x0c,\n\tLIBEVTX_VALUE_TYPE_BOOLEAN\t\t\t\t= 0x0d,\n\tLIBEVTX_VALUE_TYPE_BINARY_DATA\t\t\t\t= 0x0e,\n\tLIBEVTX_VALUE_TYPE_GUID\t\t\t\t\t= 0x0f,\n\tLIBEVTX_VALUE_TYPE_SIZE\t\t\t\t\t= 0x10,\n\tLIBEVTX_VALUE_TYPE_FILETIME\t\t\t\t= 0x11,\n\tLIBEVTX_VALUE_TYPE_SYSTEMTIME\t\t\t\t= 0x12,\n\tLIBEVTX_VALUE_TYPE_NT_SECURITY_IDENTIFIER\t\t= 0x13,\n\tLIBEVTX_VALUE_TYPE_HEXADECIMAL_INTEGER_32BIT\t\t= 0x14,\n\tLIBEVTX_VALUE_TYPE_HEXADECIMAL_INTEGER_64BIT\t\t= 0x15,\n\n\tLIBEVTX_VALUE_TYPE_BINARY_XML\t\t\t\t= 0x21,\n\n\tLIBEVTX_VALUE_TYPE_ARRAY_OF_STRING_UTF16\t\t= 0x81,\n\tLIBEVTX_VALUE_TYPE_ARRAY_OF_STRING_BYTE_STREAM\t\t= 0x82,\n\tLIBEVTX_VALUE_TYPE_ARRAY_OF_INTEGER_8BIT\t\t= 0x83,\n\tLIBEVTX_VALUE_TYPE_ARRAY_OF_UNSIGNED_INTEGER_8BIT\t= 0x84,\n\tLIBEVTX_VALUE_TYPE_ARRAY_OF_INTEGER_16BIT\t\t= 0x85,\n\tLIBEVTX_VALUE_TYPE_ARRAY_OF_UNSIGNED_INTEGER_16BIT\t= 0x86,\n\tLIBEVTX_VALUE_TYPE_ARRAY_OF_INTEGER_32BIT\t\t= 0x87,\n\tLIBEVTX_VALUE_TYPE_ARRAY_OF_UNSIGNED_INTEGER_32BIT\t= 0x88,\n\tLIBEVTX_VALUE_TYPE_ARRAY_OF_INTEGER_64BIT\t\t= 0x89,\n\tLIBEVTX_VALUE_TYPE_ARRAY_OF_UNSIGNED_INTEGER_64BIT\t= 0x8a,\n\tLIBEVTX_VALUE_TYPE_ARRAY_OF_FLOATING_POINT_32BIT\t= 0x8b,\n\tLIBEVTX_VALUE_TYPE_ARRAY_OF_FLOATING_POINT_64BIT\t= 0x8c,\n\n\tLIBEVTX_VALUE_TYPE_ARRAY_OF_GUID\t\t\t= 0x8f,\n\tLIBEVTX_VALUE_TYPE_ARRAY_OF_SIZE\t\t\t= 0x90,\n\tLIBEVTX_VALUE_TYPE_ARRAY_OF_FILETIME\t\t\t= 0x91,\n\tLIBEVTX_VALUE_TYPE_ARRAY_OF_SYSTEMTIME\t\t\t= 0x92,\n\tLIBEVTX_VALUE_TYPE_ARRAY_OF_NT_SECURITY_IDENTIFIER\t= 0x93,\n\tLIBEVTX_VALUE_TYPE_ARRAY_OF_HEXADECIMAL_INTEGER_32BIT\t= 0x94,\n\tLIBEVTX_VALUE_TYPE_ARRAY_OF_HEXADECIMAL_INTEGER_64BIT\t= 0x95,\n};\n\n#define LIBEVTX_VALUE_TYPE_ARRAY\t\t\t\t0x80\n\n/* The record flags\n */\nenum LIBEVTX_RECORD_FLAGS\n{\n\tLIBEVTX_RECORD_FLAG_NON_MANAGED_FILE_IO_HANDLE\t\t= 0x00,\n\tLIBEVTX_RECORD_FLAG_MANAGED_FILE_IO_HANDLE\t\t= 0x01,\n};\n\n#define LIBEVTX_RECORD_FLAGS_DEFAULT\t\t\t\tLIBEVTX_RECORD_FLAG_NON_MANAGED_FILE_IO_HANDLE\n\n/* The XML tag type definitions\n */\nenum LIBEVTX_XML_TAG_TYPES\n{\n\tLIBEVTX_XML_TAG_TYPE_NODE,\n\tLIBEVTX_XML_TAG_TYPE_CDATA,\n\tLIBEVTX_XML_TAG_TYPE_PI\n};\n\n/* The maximum number of cache entries definitions\n */\n#define LIBEVTX_MAXIMUM_CACHE_ENTRIES_CHUNKS\t\t\t16\n#define LIBEVTX_MAXIMUM_CACHE_ENTRIES_RECORDS\t\t\t64\n\n#endif /* !defined( _LIBEVTX_INTERNAL_DEFINITIONS_H ) */\n\n" }, { "path": "libevtx/libevtx_error.c", "content": "/*\n * Error functions\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#include \n#include \n#include \n\n#include \"libevtx_error.h\"\n#include \"libevtx_libcerror.h\"\n\n#if !defined( HAVE_LOCAL_LIBEVTX )\n\n/* Free an error and its elements\n */\nvoid libevtx_error_free(\n libevtx_error_t **error )\n{\n\tlibcerror_error_free(\n\t (libcerror_error_t **) error );\n}\n\n/* Prints a descriptive string of the error to the stream\n * Returns the number of printed characters if successful or -1 on error\n */\nint libevtx_error_fprint(\n libevtx_error_t *error,\n FILE *stream )\n{\n\tint print_count = 0;\n\n\tprint_count = libcerror_error_fprint(\n\t (libcerror_error_t *) error,\n\t stream );\n\n\treturn( print_count );\n}\n\n/* Prints a descriptive string of the error to the string\n * The end-of-string character is not included in the return value\n * Returns the number of printed characters if successful or -1 on error\n */\nint libevtx_error_sprint(\n libevtx_error_t *error,\n char *string,\n size_t size )\n{\n\tint print_count = 0;\n\n\tprint_count = libcerror_error_sprint(\n\t (libcerror_error_t *) error,\n\t string,\n\t size );\n\n\treturn( print_count );\n}\n\n/* Prints a backtrace of the error to the stream\n * Returns the number of printed characters if successful or -1 on error\n */\nint libevtx_error_backtrace_fprint(\n libevtx_error_t *error,\n FILE *stream )\n{\n\tint print_count = 0;\n\n\tprint_count = libcerror_error_backtrace_fprint(\n\t (libcerror_error_t *) error,\n\t stream );\n\n\treturn( print_count );\n}\n\n/* Prints a backtrace of the error to the string\n * The end-of-string character is not included in the return value\n * Returns the number of printed characters if successful or -1 on error\n */\nint libevtx_error_backtrace_sprint(\n libevtx_error_t *error,\n char *string,\n size_t size )\n{\n\tint print_count = 0;\n\n\tprint_count = libcerror_error_backtrace_sprint(\n\t (libcerror_error_t *) error,\n\t string,\n\t size );\n\n\treturn( print_count );\n}\n\n#endif /* !defined( HAVE_LOCAL_LIBEVTX ) */\n\n" }, { "path": "libevtx/libevtx_error.h", "content": "/*\n * Error functions\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#if !defined( _LIBEVTX_INTERNAL_ERROR_H )\n#define _LIBEVTX_INTERNAL_ERROR_H\n\n#include \n#include \n#include \n\n#if !defined( HAVE_LOCAL_LIBEVTX )\n#include \n#endif\n\n#include \"libevtx_extern.h\"\n\n#if defined( __cplusplus )\nextern \"C\" {\n#endif\n\n#if !defined( HAVE_LOCAL_LIBEVTX )\n\nLIBEVTX_EXTERN \\\nvoid libevtx_error_free(\n libevtx_error_t **error );\n\nLIBEVTX_EXTERN \\\nint libevtx_error_fprint(\n libevtx_error_t *error,\n FILE *stream );\n\nLIBEVTX_EXTERN \\\nint libevtx_error_sprint(\n libevtx_error_t *error,\n char *string,\n size_t size );\n\nLIBEVTX_EXTERN \\\nint libevtx_error_backtrace_fprint(\n libevtx_error_t *error,\n FILE *stream );\n\nLIBEVTX_EXTERN \\\nint libevtx_error_backtrace_sprint(\n libevtx_error_t *error,\n char *string,\n size_t size );\n\n#endif /* !defined( HAVE_LOCAL_LIBEVTX ) */\n\n#if defined( __cplusplus )\n}\n#endif\n\n#endif /* !defined( _LIBEVTX_INTERNAL_ERROR_H ) */\n\n" }, { "path": "libevtx/libevtx_extern.h", "content": "/*\n * The internal extern definition\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#if !defined( _LIBEVTX_INTERNAL_EXTERN_H )\n#define _LIBEVTX_INTERNAL_EXTERN_H\n\n#include \n\n/* Define HAVE_LOCAL_LIBEVTX for local use of libevtx\n */\n#if !defined( HAVE_LOCAL_LIBEVTX )\n\n#include \n\n#if defined( __CYGWIN__ ) || defined( __MINGW32__ )\n#define LIBEVTX_EXTERN_VARIABLE\textern\n#else\n#define LIBEVTX_EXTERN_VARIABLE\tLIBEVTX_EXTERN\n#endif\n\n#else\n#define LIBEVTX_EXTERN\t\t/* extern */\n#define LIBEVTX_EXTERN_VARIABLE\textern\n\n#endif /* !defined( HAVE_LOCAL_LIBEVTX ) */\n\n#endif /* !defined( _LIBEVTX_INTERNAL_EXTERN_H ) */\n\n" }, { "path": "libevtx/libevtx_file.c", "content": "/*\n * File functions\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#include \n#include \n#include \n#include \n#include \n\n#include \"libevtx_chunks_table.h\"\n#include \"libevtx_codepage.h\"\n#include \"libevtx_chunk.h\"\n#include \"libevtx_debug.h\"\n#include \"libevtx_definitions.h\"\n#include \"libevtx_i18n.h\"\n#include \"libevtx_io_handle.h\"\n#include \"libevtx_file.h\"\n#include \"libevtx_libbfio.h\"\n#include \"libevtx_libcerror.h\"\n#include \"libevtx_libcnotify.h\"\n#include \"libevtx_libfcache.h\"\n#include \"libevtx_libfdata.h\"\n#include \"libevtx_record.h\"\n#include \"libevtx_record_values.h\"\n\n/* Creates a file\n * Make sure the value file is referencing, is set to NULL\n * Returns 1 if successful or -1 on error\n */\nint libevtx_file_initialize(\n libevtx_file_t **file,\n libcerror_error_t **error )\n{\n\tlibevtx_internal_file_t *internal_file = NULL;\n\tstatic char *function = \"libevtx_file_initialize\";\n\n\tif( file == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid file.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( *file != NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_VALUE_ALREADY_SET,\n\t\t \"%s: invalid file value already set.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tinternal_file = memory_allocate_structure(\n\t libevtx_internal_file_t );\n\n\tif( internal_file == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_MEMORY,\n\t\t LIBCERROR_MEMORY_ERROR_INSUFFICIENT,\n\t\t \"%s: unable to create file.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tif( memory_set(\n\t internal_file,\n\t 0,\n\t sizeof( libevtx_internal_file_t ) ) == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_MEMORY,\n\t\t LIBCERROR_MEMORY_ERROR_SET_FAILED,\n\t\t \"%s: unable to clear file.\",\n\t\t function );\n\n\t\tmemory_free(\n\t\t internal_file );\n\n\t\treturn( -1 );\n\t}\n\tif( libevtx_io_handle_initialize(\n\t &( internal_file->io_handle ),\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_INITIALIZE_FAILED,\n\t\t \"%s: unable to create IO handle.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tif( libevtx_i18n_initialize(\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_INITIALIZE_FAILED,\n\t\t \"%s: unable to initalize internationalization (i18n).\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\t*file = (libevtx_file_t *) internal_file;\n\n\treturn( 1 );\n\non_error:\n\tif( internal_file != NULL )\n\t{\n\t\tif( internal_file->io_handle != NULL )\n\t\t{\n\t\t\tlibevtx_io_handle_free(\n\t\t\t &( internal_file->io_handle ),\n\t\t\t NULL );\n\t\t}\n\t\tmemory_free(\n\t\t internal_file );\n\t}\n\treturn( -1 );\n}\n\n/* Frees a file\n * Returns 1 if successful or -1 on error\n */\nint libevtx_file_free(\n libevtx_file_t **file,\n libcerror_error_t **error )\n{\n\tlibevtx_internal_file_t *internal_file = NULL;\n\tstatic char *function = \"libevtx_file_free\";\n\tint result = 1;\n\n\tif( file == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid file.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( *file != NULL )\n\t{\n\t\tinternal_file = (libevtx_internal_file_t *) *file;\n\n\t\tif( internal_file->file_io_handle != NULL )\n\t\t{\n\t\t\tif( libevtx_file_close(\n\t\t\t *file,\n\t\t\t error ) != 0 )\n\t\t\t{\n\t\t\t\tlibcerror_error_set(\n\t\t\t\t error,\n\t\t\t\t LIBCERROR_ERROR_DOMAIN_IO,\n\t\t\t\t LIBCERROR_IO_ERROR_CLOSE_FAILED,\n\t\t\t\t \"%s: unable to close file.\",\n\t\t\t\t function );\n\n\t\t\t\tresult = -1;\n\t\t\t}\n\t\t}\n\t\t*file = NULL;\n\n\t\tif( libevtx_io_handle_free(\n\t\t &( internal_file->io_handle ),\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED,\n\t\t\t \"%s: unable to free IO handle.\",\n\t\t\t function );\n\n\t\t\tresult = -1;\n\t\t}\n\t\tmemory_free(\n\t\t internal_file );\n\t}\n\treturn( result );\n}\n\n/* Signals a file to abort its current activity\n * Returns 1 if successful or -1 on error\n */\nint libevtx_file_signal_abort(\n libevtx_file_t *file,\n libcerror_error_t **error )\n{\n\tlibevtx_internal_file_t *internal_file = NULL;\n\tstatic char *function = \"libevtx_file_signal_abort\";\n\n\tif( file == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid file.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tinternal_file = (libevtx_internal_file_t *) file;\n\n\tif( internal_file->io_handle == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_VALUE_MISSING,\n\t\t \"%s: invalid file - missing IO handle.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tinternal_file->io_handle->abort = 1;\n\n\treturn( 1 );\n}\n\n/* Opens a file\n * Returns 1 if successful or -1 on error\n */\nint libevtx_file_open(\n libevtx_file_t *file,\n const char *filename,\n int access_flags,\n libcerror_error_t **error )\n{\n\tlibbfio_handle_t *file_io_handle = NULL;\n\tlibevtx_internal_file_t *internal_file = NULL;\n\tstatic char *function = \"libevtx_file_open\";\n\tsize_t filename_length = 0;\n\n\tif( file == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid file.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tinternal_file = (libevtx_internal_file_t *) file;\n\n\tif( filename == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid filename.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( ( ( access_flags & LIBEVTX_ACCESS_FLAG_READ ) == 0 )\n\t && ( ( access_flags & LIBEVTX_ACCESS_FLAG_WRITE ) == 0 ) )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_UNSUPPORTED_VALUE,\n\t\t \"%s: unsupported access flags.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( ( access_flags & LIBEVTX_ACCESS_FLAG_WRITE ) != 0 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_UNSUPPORTED_VALUE,\n\t\t \"%s: write access currently not supported.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( libbfio_file_initialize(\n\t &file_io_handle,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_INITIALIZE_FAILED,\n\t\t \"%s: unable to create file IO handle.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n#if defined( HAVE_DEBUG_OUTPUT )\n\tif( libbfio_handle_set_track_offsets_read(\n\t file_io_handle,\n\t 1,\n\t error ) != 1 )\n\t{\n libcerror_error_set(\n error,\n LIBCERROR_ERROR_DOMAIN_RUNTIME,\n LIBCERROR_RUNTIME_ERROR_SET_FAILED,\n \"%s: unable to set track offsets read in file IO handle.\",\n function );\n\n\t\tgoto on_error;\n\t}\n#endif\n\tfilename_length = narrow_string_length(\n\t filename );\n\n\tif( libbfio_file_set_name(\n\t file_io_handle,\n\t filename,\n\t filename_length + 1,\n\t error ) != 1 )\n\t{\n libcerror_error_set(\n error,\n LIBCERROR_ERROR_DOMAIN_RUNTIME,\n LIBCERROR_RUNTIME_ERROR_SET_FAILED,\n \"%s: unable to set filename in file IO handle.\",\n function );\n\n\t\tgoto on_error;\n\t}\n\tif( libevtx_file_open_file_io_handle(\n\t file,\n\t file_io_handle,\n\t access_flags,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_IO,\n\t\t LIBCERROR_IO_ERROR_OPEN_FAILED,\n\t\t \"%s: unable to open file: %s.\",\n\t\t function,\n\t\t filename );\n\n\t\tgoto on_error;\n\t}\n\tinternal_file->file_io_handle_created_in_library = 1;\n\n\treturn( 1 );\n\non_error:\n\tif( file_io_handle != NULL )\n\t{\n\t\tlibbfio_handle_free(\n\t\t &file_io_handle,\n\t\t NULL );\n\t}\n\treturn( -1 );\n}\n\n#if defined( HAVE_WIDE_CHARACTER_TYPE )\n\n/* Opens a file\n * Returns 1 if successful or -1 on error\n */\nint libevtx_file_open_wide(\n libevtx_file_t *file,\n const wchar_t *filename,\n int access_flags,\n libcerror_error_t **error )\n{\n\tlibbfio_handle_t *file_io_handle = NULL;\n\tlibevtx_internal_file_t *internal_file = NULL;\n\tstatic char *function = \"libevtx_file_open_wide\";\n\tsize_t filename_length = 0;\n\n\tif( file == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid file.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tinternal_file = (libevtx_internal_file_t *) file;\n\n\tif( filename == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid filename.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( ( ( access_flags & LIBEVTX_ACCESS_FLAG_READ ) == 0 )\n\t && ( ( access_flags & LIBEVTX_ACCESS_FLAG_WRITE ) == 0 ) )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_UNSUPPORTED_VALUE,\n\t\t \"%s: unsupported access flags.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( ( access_flags & LIBEVTX_ACCESS_FLAG_WRITE ) != 0 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_UNSUPPORTED_VALUE,\n\t\t \"%s: write access currently not supported.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( libbfio_file_initialize(\n\t &file_io_handle,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_INITIALIZE_FAILED,\n\t\t \"%s: unable to create file IO handle.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n#if defined( HAVE_DEBUG_OUTPUT )\n\tif( libbfio_handle_set_track_offsets_read(\n\t file_io_handle,\n\t 1,\n\t error ) != 1 )\n\t{\n libcerror_error_set(\n error,\n LIBCERROR_ERROR_DOMAIN_RUNTIME,\n LIBCERROR_RUNTIME_ERROR_SET_FAILED,\n \"%s: unable to set track offsets read in file IO handle.\",\n function );\n\n\t\tgoto on_error;\n\t}\n#endif\n\tfilename_length = wide_string_length(\n\t filename );\n\n\tif( libbfio_file_set_name_wide(\n\t file_io_handle,\n\t filename,\n\t filename_length + 1,\n\t error ) != 1 )\n\t{\n libcerror_error_set(\n error,\n LIBCERROR_ERROR_DOMAIN_RUNTIME,\n LIBCERROR_RUNTIME_ERROR_SET_FAILED,\n \"%s: unable to set filename in file IO handle.\",\n function );\n\n\t\tgoto on_error;\n\t}\n\tif( libevtx_file_open_file_io_handle(\n\t file,\n\t file_io_handle,\n\t access_flags,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_IO,\n\t\t LIBCERROR_IO_ERROR_OPEN_FAILED,\n\t\t \"%s: unable to open file: %ls.\",\n\t\t function,\n\t\t filename );\n\n\t\tgoto on_error;\n\t}\n\tinternal_file->file_io_handle_created_in_library = 1;\n\n\treturn( 1 );\n\non_error:\n\tif( file_io_handle != NULL )\n\t{\n\t\tlibbfio_handle_free(\n\t\t &file_io_handle,\n\t\t NULL );\n\t}\n\treturn( -1 );\n}\n\n#endif /* defined( HAVE_WIDE_CHARACTER_TYPE ) */\n\n/* Opens a file using a Basic File IO (bfio) handle\n * Returns 1 if successful or -1 on error\n */\nint libevtx_file_open_file_io_handle(\n libevtx_file_t *file,\n libbfio_handle_t *file_io_handle,\n int access_flags,\n libcerror_error_t **error )\n{\n\tlibevtx_internal_file_t *internal_file = NULL;\n\tstatic char *function = \"libevtx_file_open_file_io_handle\";\n\tuint8_t file_io_handle_opened_in_library = 0;\n\tint bfio_access_flags = 0;\n\tint file_io_handle_is_open = 0;\n\n\tif( file == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid file.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tinternal_file = (libevtx_internal_file_t *) file;\n\n\tif( internal_file->file_io_handle != NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_VALUE_ALREADY_SET,\n\t\t \"%s: invalid file - file IO handle already set.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( file_io_handle == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid file IO handle.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( ( ( access_flags & LIBEVTX_ACCESS_FLAG_READ ) == 0 )\n\t && ( ( access_flags & LIBEVTX_ACCESS_FLAG_WRITE ) == 0 ) )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_UNSUPPORTED_VALUE,\n\t\t \"%s: unsupported access flags.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( ( access_flags & LIBEVTX_ACCESS_FLAG_WRITE ) != 0 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_UNSUPPORTED_VALUE,\n\t\t \"%s: write access currently not supported.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( ( access_flags & LIBEVTX_ACCESS_FLAG_READ ) != 0 )\n\t{\n\t\tbfio_access_flags = LIBBFIO_ACCESS_FLAG_READ;\n\t}\n\tfile_io_handle_is_open = libbfio_handle_is_open(\n\t file_io_handle,\n\t error );\n\n\tif( file_io_handle_is_open == -1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_IO,\n\t\t LIBCERROR_IO_ERROR_OPEN_FAILED,\n\t\t \"%s: unable to open file.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\telse if( file_io_handle_is_open == 0 )\n\t{\n\t\tif( libbfio_handle_open(\n\t\t file_io_handle,\n\t\t bfio_access_flags,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_IO,\n\t\t\t LIBCERROR_IO_ERROR_OPEN_FAILED,\n\t\t\t \"%s: unable to open file IO handle.\",\n\t\t\t function );\n\n\t\t\tgoto on_error;\n\t\t}\n\t\tfile_io_handle_opened_in_library = 1;\n\t}\n\tif( libevtx_file_open_read(\n\t internal_file,\n\t file_io_handle,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_IO,\n\t\t LIBCERROR_IO_ERROR_READ_FAILED,\n\t\t \"%s: unable to read from file handle.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tinternal_file->file_io_handle = file_io_handle;\n\tinternal_file->file_io_handle_opened_in_library = file_io_handle_opened_in_library;\n\n\treturn( 1 );\n\non_error:\n\tif( file_io_handle_opened_in_library != 0 )\n\t{\n\t\tlibbfio_handle_close(\n\t\t file_io_handle,\n\t\t error );\n\t}\n\treturn( -1 );\n}\n\n/* Closes a file\n * Returns 0 if successful or -1 on error\n */\nint libevtx_file_close(\n libevtx_file_t *file,\n libcerror_error_t **error )\n{\n\tlibevtx_internal_file_t *internal_file = NULL;\n\tstatic char *function = \"libevtx_file_close\";\n\tint result = 0;\n\n\tif( file == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid file.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tinternal_file = (libevtx_internal_file_t *) file;\n\n\tif( internal_file->file_io_handle == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_VALUE_MISSING,\n\t\t \"%s: invalid file - missing file IO handle.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n#if defined( HAVE_DEBUG_OUTPUT )\n\tif( libcnotify_verbose != 0 )\n\t{\n\t\tif( internal_file->file_io_handle_created_in_library != 0 )\n\t\t{\n\t\t\tif( libevtx_debug_print_read_offsets(\n\t\t\t internal_file->file_io_handle,\n\t\t\t error ) != 1 )\n\t\t\t{\n\t\t\t\tlibcerror_error_set(\n\t\t\t\t error,\n\t\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t\t LIBCERROR_RUNTIME_ERROR_PRINT_FAILED,\n\t\t\t\t \"%s: unable to print the read offsets.\",\n\t\t\t\t function );\n\n\t\t\t\tresult = -1;\n\t\t\t}\n\t\t}\n\t}\n#endif\n\tif( internal_file->file_io_handle_opened_in_library != 0 )\n\t{\n\t\tif( libbfio_handle_close(\n\t\t internal_file->file_io_handle,\n\t\t error ) != 0 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_IO,\n\t\t\t LIBCERROR_IO_ERROR_CLOSE_FAILED,\n\t\t\t \"%s: unable to close file IO handle.\",\n\t\t\t function );\n\n\t\t\tresult = -1;\n\t\t}\n\t\tinternal_file->file_io_handle_opened_in_library = 0;\n\t}\n\tif( internal_file->file_io_handle_created_in_library != 0 )\n\t{\n\t\tif( libbfio_handle_free(\n\t\t &( internal_file->file_io_handle ),\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED,\n\t\t\t \"%s: unable to free file IO handle.\",\n\t\t\t function );\n\n\t\t\tresult = -1;\n\t\t}\n\t\tinternal_file->file_io_handle_created_in_library = 0;\n\t}\n\tinternal_file->file_io_handle = NULL;\n\n\tif( libevtx_io_handle_clear(\n\t internal_file->io_handle,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED,\n\t\t \"%s: unable to clear IO handle.\",\n\t\t function );\n\n\t\tresult = -1;\n\t}\n\tif( libfdata_list_free(\n\t &( internal_file->recovered_records_list ),\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED,\n\t\t \"%s: unable to free recovered records list.\",\n\t\t function );\n\n\t\tresult = -1;\n\t}\n\tif( libfdata_list_free(\n\t &( internal_file->records_list ),\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED,\n\t\t \"%s: unable to free records list.\",\n\t\t function );\n\n\t\tresult = -1;\n\t}\n\tif( libfcache_cache_free(\n\t &( internal_file->records_cache ),\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED,\n\t\t \"%s: unable to free records cache.\",\n\t\t function );\n\n\t\tresult = -1;\n\t}\n\tif( libfdata_vector_free(\n\t &( internal_file->chunks_vector ),\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED,\n\t\t \"%s: unable to free chunks vector.\",\n\t\t function );\n\n\t\tresult = -1;\n\t}\n\tif( libfcache_cache_free(\n\t &( internal_file->chunks_cache ),\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED,\n\t\t \"%s: unable to free chunks cache.\",\n\t\t function );\n\n\t\tresult = -1;\n\t}\n\treturn( result );\n}\n\n/* Opens a file for reading\n * Returns 1 if successful or -1 on error\n */\nint libevtx_file_open_read(\n libevtx_internal_file_t *internal_file,\n libbfio_handle_t *file_io_handle,\n libcerror_error_t **error )\n{\n\tlibevtx_chunk_t *chunk = NULL;\n\tlibevtx_record_values_t *record_values = NULL;\n\tlibevtx_chunks_table_t *chunks_table = NULL;\n\tstatic char *function = \"libevtx_file_open_read\";\n\toff64_t file_offset = 0;\n\tsize64_t file_size = 0;\n\tuint16_t chunk_index = 0;\n\tuint16_t number_of_chunks = 0;\n\tuint16_t number_of_records = 0;\n\tuint16_t record_index = 0;\n\tint element_index = 0;\n\tint result = 0;\n\tint segment_index = 0;\n\n#if defined( HAVE_VERBOSE_OUTPUT )\n\tuint64_t previous_record_identifier = 0;\n#endif\n#if defined( HAVE_DEBUG_OUTPUT )\n\tuint8_t *trailing_data = NULL;\n\tsize_t trailing_data_size = 0;\n\tssize_t read_count = 0;\n#endif\n\n\tif( internal_file == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid file.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( internal_file->io_handle == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_VALUE_MISSING,\n\t\t \"%s: invalid file - missing IO handle.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( internal_file->chunks_vector != NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_VALUE_ALREADY_SET,\n\t\t \"%s: invalid file - chunks vector already set.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( internal_file->chunks_cache != NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_VALUE_ALREADY_SET,\n\t\t \"%s: invalid file - chunks cache already set.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( internal_file->records_list != NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_VALUE_ALREADY_SET,\n\t\t \"%s: invalid file - records list already set.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( internal_file->recovered_records_list != NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_VALUE_ALREADY_SET,\n\t\t \"%s: invalid file - recovered records list already set.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( internal_file->records_cache != NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_VALUE_ALREADY_SET,\n\t\t \"%s: invalid file - records cache already set.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( libbfio_handle_get_size(\n\t file_io_handle,\n\t &file_size,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to retrieve file size.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n#if defined( HAVE_DEBUG_OUTPUT )\n\tif( libcnotify_verbose != 0 )\n\t{\n\t\tlibcnotify_printf(\n\t\t \"Reading file header:\\n\" );\n\t}\n#endif\n\tif( libevtx_io_handle_read_file_header(\n\t internal_file->io_handle,\n\t file_io_handle,\n\t 0,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_IO,\n\t\t LIBCERROR_IO_ERROR_READ_FAILED,\n\t\t \"%s: unable to read file header.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tinternal_file->io_handle->chunks_data_size = file_size\n\t - internal_file->io_handle->chunks_data_offset;\n\n/* TODO clone function ? */\n\tif( libfdata_vector_initialize(\n\t &( internal_file->chunks_vector ),\n\t (size64_t) internal_file->io_handle->chunk_size,\n\t (intptr_t *) internal_file->io_handle,\n\t NULL,\n\t NULL,\n\t (int (*)(intptr_t *, intptr_t *, libfdata_vector_t *, libfdata_cache_t *, int, int, off64_t, size64_t, uint32_t, uint8_t, libcerror_error_t **)) &libevtx_io_handle_read_chunk,\n\t NULL,\n\t LIBFDATA_DATA_HANDLE_FLAG_NON_MANAGED,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_INITIALIZE_FAILED,\n\t\t \"%s: unable to create chunks vector.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tif( libfdata_vector_append_segment(\n\t internal_file->chunks_vector,\n\t &segment_index,\n\t 0,\n\t internal_file->io_handle->chunks_data_offset,\n\t internal_file->io_handle->chunks_data_size,\n\t 0,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_APPEND_FAILED,\n\t\t \"%s: unable to append segment to chunks vector.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tif( libfcache_cache_initialize(\n\t &( internal_file->chunks_cache ),\n\t LIBEVTX_MAXIMUM_CACHE_ENTRIES_CHUNKS,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_INITIALIZE_FAILED,\n\t\t \"%s: unable to create chunks cache.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n#if defined( HAVE_DEBUG_OUTPUT )\n\tif( libcnotify_verbose != 0 )\n\t{\n\t\tlibcnotify_printf(\n\t\t \"Reading chunks:\\n\" );\n\t}\n#endif\n\tif( libevtx_chunks_table_initialize(\n\t &chunks_table,\n\t internal_file->io_handle,\n\t internal_file->chunks_vector,\n\t internal_file->chunks_cache,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_INITIALIZE_FAILED,\n\t\t \"%s: unable to create chunks table.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n/* TODO clone function ? */\n\tif( libfdata_list_initialize(\n\t &( internal_file->records_list ),\n\t (intptr_t *) chunks_table,\n\t (int (*)(intptr_t **, libcerror_error_t **)) &libevtx_chunks_table_free,\n\t NULL,\n\t (int (*)(intptr_t *, intptr_t *, libfdata_list_element_t *, libfdata_cache_t *, int, off64_t, size64_t, uint32_t, uint8_t, libcerror_error_t **)) &libevtx_chunks_table_read_record,\n\t NULL,\n\t LIBFDATA_DATA_HANDLE_FLAG_MANAGED,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_INITIALIZE_FAILED,\n\t\t \"%s: unable to create records list.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\t/* The chunks_table is managed by the list */\n\n\tif( libfdata_list_initialize(\n\t &( internal_file->recovered_records_list ),\n\t (intptr_t *) chunks_table,\n\t NULL,\n\t NULL,\n\t (int (*)(intptr_t *, intptr_t *, libfdata_list_element_t *, libfdata_cache_t *, int, off64_t, size64_t, uint32_t, uint8_t, libcerror_error_t **)) &libevtx_chunks_table_read_record,\n\t NULL,\n\t LIBFDATA_DATA_HANDLE_FLAG_NON_MANAGED,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_INITIALIZE_FAILED,\n\t\t \"%s: unable to create recovered records list.\",\n\t\t function );\n\n\t\tchunks_table = NULL;\n\n\t\tgoto on_error;\n\t}\n\tchunks_table = NULL;\n\n\tif( libfcache_cache_initialize(\n\t &( internal_file->records_cache ),\n\t LIBEVTX_MAXIMUM_CACHE_ENTRIES_RECORDS,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_INITIALIZE_FAILED,\n\t\t \"%s: unable to create records cache.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tfile_offset = internal_file->io_handle->chunks_data_offset;\n\n\twhile( ( file_offset + internal_file->io_handle->chunk_size ) <= (off64_t) file_size )\n\t{\n\t\tif( libevtx_chunk_initialize(\n\t\t &chunk,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_INITIALIZE_FAILED,\n\t\t\t \"%s: unable to create chunk: %\" PRIu16 \".\",\n\t\t\t function,\n\t\t\t chunk_index );\n\n\t\t\tgoto on_error;\n\t\t}\n\t\tresult = libevtx_chunk_read(\n\t\t chunk,\n\t\t internal_file->io_handle,\n\t\t file_io_handle,\n\t\t file_offset,\n\t\t error );\n\n\t\tif( result == -1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_IO,\n\t\t\t LIBCERROR_IO_ERROR_READ_FAILED,\n\t\t\t \"%s: unable to read chunk: %\" PRIu16 \".\",\n\t\t\t function,\n\t\t\t chunk_index );\n\n\t\t\tgoto on_error;\n\t\t}\n\t\telse if( result == 0 )\n\t\t{\n\t\t\tif( chunk_index < internal_file->io_handle->number_of_chunks )\n\t\t\t{\n#if defined( HAVE_VERBOSE_OUTPUT )\n\t\t\t\tif( libcnotify_verbose != 0 )\n\t\t\t\t{\n\t\t\t\t\tlibcnotify_printf(\n\t\t\t\t\t \"%s: corruption detected in chunk: %\" PRIu16 \".\\n\",\n\t\t\t\t\t function,\n\t\t\t\t\t chunk_index );\n\t\t\t\t}\n#endif\n\t\t\t\tinternal_file->io_handle->flags |= LIBEVTX_IO_HANDLE_FLAG_IS_CORRUPTED;\n\t\t\t}\n\t\t}\n\t\telse\n\t\t{\n\t\t\tif( ( chunk->flags & LIBEVTX_CHUNK_FLAG_IS_CORRUPTED ) != 0 )\n\t\t\t{\n#if defined( HAVE_VERBOSE_OUTPUT )\n\t\t\t\tif( libcnotify_verbose != 0 )\n\t\t\t\t{\n\t\t\t\t\tlibcnotify_printf(\n\t\t\t\t\t \"%s: corruption detected in chunk: %\" PRIu16 \".\\n\",\n\t\t\t\t\t function,\n\t\t\t\t\t chunk_index );\n\t\t\t\t}\n#endif\n\t\t\t\tif( chunk_index < internal_file->io_handle->number_of_chunks )\n\t\t\t\t{\n\t\t\t\t\tinternal_file->io_handle->flags |= LIBEVTX_IO_HANDLE_FLAG_IS_CORRUPTED;\n\t\t\t\t}\n\t\t\t}\n\t\t\tif( ( chunk_index < internal_file->io_handle->number_of_chunks )\n\t\t\t || ( ( chunk->flags & LIBEVTX_CHUNK_FLAG_IS_CORRUPTED ) == 0 ) )\n\t\t\t{\n\t\t\t\tnumber_of_chunks++;\n\t\t\t}\n\t\t\tif( libevtx_chunk_get_number_of_records(\n\t\t\t chunk,\n\t\t\t &number_of_records,\n\t\t\t error ) != 1 )\n\t\t\t{\n\t\t\t\tlibcerror_error_set(\n\t\t\t\t error,\n\t\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t\t \"%s: unable to retrieve chunk: %\" PRIu16 \" number of records.\",\n\t\t\t\t function,\n\t\t\t\t chunk_index );\n\n\t\t\t\tgoto on_error;\n\t\t\t}\n\t\t\tfor( record_index = 0;\n\t\t\t record_index < number_of_records;\n\t\t\t record_index++ )\n\t\t\t{\n\t\t\t\tif( libevtx_chunk_get_record(\n\t\t\t\t chunk,\n\t\t\t\t record_index,\n\t\t\t\t &record_values,\n\t\t\t\t error ) != 1 )\n\t\t\t\t{\n\t\t\t\t\tlibcerror_error_set(\n\t\t\t\t\t error,\n\t\t\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t\t\t \"%s: unable to retrieve chunk: %\" PRIu16 \" record: %\" PRIu16 \".\",\n\t\t\t\t\t function,\n\t\t\t\t\t chunk_index,\n\t\t\t\t\t record_index );\n\n\t\t\t\t\tgoto on_error;\n\t\t\t\t}\n\t\t\t\tif( record_values == NULL )\n\t\t\t\t{\n\t\t\t\t\tlibcerror_error_set(\n\t\t\t\t\t error,\n\t\t\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t\t\t LIBCERROR_RUNTIME_ERROR_VALUE_MISSING,\n\t\t\t\t\t \"%s: missing chunk: %\" PRIu16 \" record: %\" PRIu16 \".\",\n\t\t\t\t\t function,\n\t\t\t\t\t chunk_index,\n\t\t\t\t\t record_index );\n\n\t\t\t\t\tgoto on_error;\n\t\t\t\t}\n\t\t\t\tif( record_values->identifier < internal_file->io_handle->first_record_identifier )\n\t\t\t\t{\n\t\t\t\t\tinternal_file->io_handle->first_record_identifier = record_values->identifier;\n\t\t\t\t}\n\t\t\t\tif( record_values->identifier > internal_file->io_handle->last_record_identifier )\n\t\t\t\t{\n\t\t\t\t\tinternal_file->io_handle->last_record_identifier = record_values->identifier;\n\t\t\t\t}\n#if defined( HAVE_VERBOSE_OUTPUT )\n\t\t\t\tif( ( chunk_index == 0 )\n\t\t\t\t && ( record_index == 0 ) )\n\t\t\t\t{\n\t\t\t\t\tprevious_record_identifier = record_values->identifier;\n\t\t\t\t}\n\t\t\t\telse\n\t\t\t\t{\n\t\t\t\t\tprevious_record_identifier++;\n\n\t\t\t\t\tif( record_values->identifier != previous_record_identifier )\n\t\t\t\t\t{\n\t\t\t\t\t\tif( libcnotify_verbose != 0 )\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\tlibcnotify_printf(\n\t\t\t\t\t\t\t \"%s: detected gap in record identifier ( %\" PRIu64 \" != %\" PRIu64 \" ).\\n\",\n\t\t\t\t\t\t\t function,\n\t\t\t\t\t\t\t previous_record_identifier,\n\t\t\t\t\t\t\t record_values->identifier );\n\t\t\t\t\t\t}\n\t\t\t\t\t\tprevious_record_identifier = record_values->identifier;\n\t\t\t\t\t}\n\t\t\t\t}\n#endif\n\t\t\t\t/* The chunk index is stored in the element data size\n\t\t\t\t */\n\t\t\t\tif( ( chunk_index < internal_file->io_handle->number_of_chunks )\n\t\t\t\t || ( ( internal_file->io_handle->file_flags & LIBEVTX_FILE_FLAG_IS_DIRTY ) != 0 ) )\n\t\t\t\t{\n\t\t\t\t\tif( libfdata_list_append_element(\n\t\t\t\t\t internal_file->records_list,\n\t\t\t\t\t &element_index,\n\t\t\t\t\t 0,\n\t\t\t\t\t file_offset + record_values->chunk_data_offset,\n\t\t\t\t\t (size64_t) chunk_index,\n\t\t\t\t\t 0,\n\t\t\t\t\t error ) != 1 )\n\t\t\t\t\t{\n\t\t\t\t\t\tlibcerror_error_set(\n\t\t\t\t\t\t error,\n\t\t\t\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t\t\t\t LIBCERROR_RUNTIME_ERROR_APPEND_FAILED,\n\t\t\t\t\t\t \"%s: unable to append element to records list.\",\n\t\t\t\t\t\t function );\n\n\t\t\t\t\t\tgoto on_error;\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t\telse\n\t\t\t\t{\n\t\t\t\t\t/* If the file is not dirty, records found in chunks outside the indicated\n\t\t\t\t\t * range are considered recovered\n\t\t\t\t\t */\n\t\t\t\t\tif( libfdata_list_append_element(\n\t\t\t\t\t internal_file->recovered_records_list,\n\t\t\t\t\t &element_index,\n\t\t\t\t\t 0,\n\t\t\t\t\t file_offset + record_values->chunk_data_offset,\n\t\t\t\t\t (size64_t) chunk_index,\n\t\t\t\t\t 0,\n\t\t\t\t\t error ) != 1 )\n\t\t\t\t\t{\n\t\t\t\t\t\tlibcerror_error_set(\n\t\t\t\t\t\t error,\n\t\t\t\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t\t\t\t LIBCERROR_RUNTIME_ERROR_APPEND_FAILED,\n\t\t\t\t\t\t \"%s: unable to append element to recovered records list.\",\n\t\t\t\t\t\t function );\n\n\t\t\t\t\t\tgoto on_error;\n\t\t\t\t\t}\n\t\t\t\t}\n/* TODO cache record values ? */\n\t\t\t}\n\t\t\tif( libevtx_chunk_get_number_of_recovered_records(\n\t\t\t chunk,\n\t\t\t &number_of_records,\n\t\t\t error ) != 1 )\n\t\t\t{\n\t\t\t\tlibcerror_error_set(\n\t\t\t\t error,\n\t\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t\t \"%s: unable to retrieve chunk: %\" PRIu16 \" number of recovered records.\",\n\t\t\t\t function,\n\t\t\t\t chunk_index );\n\n\t\t\t\tgoto on_error;\n\t\t\t}\n\t\t\tfor( record_index = 0;\n\t\t\t record_index < number_of_records;\n\t\t\t record_index++ )\n\t\t\t{\n\t\t\t\tif( libevtx_chunk_get_recovered_record(\n\t\t\t\t chunk,\n\t\t\t\t record_index,\n\t\t\t\t &record_values,\n\t\t\t\t error ) != 1 )\n\t\t\t\t{\n\t\t\t\t\tlibcerror_error_set(\n\t\t\t\t\t error,\n\t\t\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t\t\t \"%s: unable to retrieve chunk: %\" PRIu16 \" recovered record: %\" PRIu16 \".\",\n\t\t\t\t\t function,\n\t\t\t\t\t chunk_index,\n\t\t\t\t\t record_index );\n\n\t\t\t\t\tgoto on_error;\n\t\t\t\t}\n\t\t\t\tif( record_values == NULL )\n\t\t\t\t{\n\t\t\t\t\tlibcerror_error_set(\n\t\t\t\t\t error,\n\t\t\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t\t\t LIBCERROR_RUNTIME_ERROR_VALUE_MISSING,\n\t\t\t\t\t \"%s: missing chunk: %\" PRIu16 \" recovered record: %\" PRIu16 \".\",\n\t\t\t\t\t function,\n\t\t\t\t\t chunk_index,\n\t\t\t\t\t record_index );\n\n\t\t\t\t\tgoto on_error;\n\t\t\t\t}\n/* TODO check for and remove duplicate identifiers ? */\n\t\t\t\t/* The chunk index is stored in the element data size\n\t\t\t\t */\n\t\t\t\tif( libfdata_list_append_element(\n\t\t\t\t internal_file->recovered_records_list,\n\t\t\t\t &element_index,\n\t\t\t\t 0,\n\t\t\t\t file_offset + record_values->chunk_data_offset,\n\t\t\t\t (size64_t) chunk_index,\n\t\t\t\t 0,\n\t\t\t\t error ) != 1 )\n\t\t\t\t{\n\t\t\t\t\tlibcerror_error_set(\n\t\t\t\t\t error,\n\t\t\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t\t\t LIBCERROR_RUNTIME_ERROR_APPEND_FAILED,\n\t\t\t\t\t \"%s: unable to append element to recovered records list.\",\n\t\t\t\t\t function );\n\n\t\t\t\t\tgoto on_error;\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t\tfile_offset += chunk->data_size;\n\n\t\tif( libevtx_chunk_free(\n\t\t &chunk,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED,\n\t\t\t \"%s: unable to free chunk: %\" PRIu16 \".\",\n\t\t\t function,\n\t\t\t chunk_index );\n\n\t\t\tgoto on_error;\n\t\t}\n\t\tchunk_index++;\n\t}\n\tinternal_file->io_handle->chunks_data_size = file_offset\n\t - internal_file->io_handle->chunks_data_offset;\n\n\tif( number_of_chunks != internal_file->io_handle->number_of_chunks )\n\t{\n#if defined( HAVE_VERBOSE_OUTPUT )\n\t\tif( libcnotify_verbose != 0 )\n\t\t{\n\t\t\tlibcnotify_printf(\n\t\t\t \"%s: mismatch in number of chunks ( %\" PRIu16 \" != %\" PRIu16 \" ).\\n\",\n\t\t\t function,\n\t\t\t internal_file->io_handle->number_of_chunks,\n\t\t\t chunk_index );\n\t\t}\n#endif\n\t\tinternal_file->io_handle->flags |= LIBEVTX_IO_HANDLE_FLAG_IS_CORRUPTED;\n\t}\n#if defined( HAVE_DEBUG_OUTPUT )\n\tif( libcnotify_verbose != 0 )\n\t{\n\t\tif( file_offset < (off64_t) file_size )\n\t\t{\n\t\t\ttrailing_data_size = (size_t) ( file_size - file_offset );\n\n\t\t\tif( trailing_data_size > (size_t) MEMORY_MAXIMUM_ALLOCATION_SIZE )\n\t\t\t{\n\t\t\t\tlibcerror_error_set(\n\t\t\t\t error,\n\t\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t\t LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,\n\t\t\t\t \"%s: invalid trailing data size value exceeds maximum allocation size.\",\n\t\t\t\t function );\n\n\t\t\t\tgoto on_error;\n\t\t\t}\n\t\t\ttrailing_data = (uint8_t *) memory_allocate(\n\t\t\t sizeof( uint8_t ) * trailing_data_size );\n\n\t\t\tif( trailing_data == NULL )\n\t\t\t{\n\t\t\t\tlibcerror_error_set(\n\t\t\t\t error,\n\t\t\t\t LIBCERROR_ERROR_DOMAIN_MEMORY,\n\t\t\t\t LIBCERROR_MEMORY_ERROR_INSUFFICIENT,\n\t\t\t\t \"%s: unable to create trailing data.\",\n\t\t\t\t function );\n\n\t\t\t\tgoto on_error;\n\t\t\t}\n\t\t\tread_count = libbfio_handle_read_buffer(\n\t\t\t\t file_io_handle,\n\t\t\t\t trailing_data,\n\t\t\t\t trailing_data_size,\n\t\t\t\t error );\n\n\t\t\tif( read_count != (ssize_t) trailing_data_size )\n\t\t\t{\n\t\t\t\tlibcerror_error_set(\n\t\t\t\t error,\n\t\t\t\t LIBCERROR_ERROR_DOMAIN_IO,\n\t\t\t\t LIBCERROR_IO_ERROR_READ_FAILED,\n\t\t\t\t \"%s: unable to read trailing data.\",\n\t\t\t\t function );\n\n\t\t\t\tgoto on_error;\n\t\t\t}\n\t\t\tfile_offset += read_count;\n\n\t\t\tlibcnotify_printf(\n\t\t\t \"%s: trailing data:\\n\",\n\t\t\t function );\n\t\t\tlibcnotify_print_data(\n\t\t\t trailing_data,\n\t\t\t trailing_data_size,\n\t\t\t LIBCNOTIFY_PRINT_DATA_FLAG_GROUP_DATA );\n\n\t\t\tmemory_free(\n\t\t\t trailing_data );\n\n\t\t\ttrailing_data = NULL;\n\t\t}\n\t}\n#endif /* defined( HAVE_DEBUG_OUTPUT ) */\n\n\treturn( 1 );\n\non_error:\n#if defined( HAVE_DEBUG_OUTPUT )\n\tif( trailing_data != NULL )\n\t{\n\t\tmemory_free(\n\t\t trailing_data );\n\t}\n#endif\n\tif( chunk != NULL )\n\t{\n\t\tlibevtx_chunk_free(\n\t\t &chunk,\n\t\t NULL );\n\t}\n\tif( internal_file->records_cache != NULL )\n\t{\n\t\tlibfcache_cache_free(\n\t\t &( internal_file->records_cache ),\n\t\t NULL );\n\t}\n\tif( internal_file->recovered_records_list != NULL )\n\t{\n\t\tlibfdata_list_free(\n\t\t &( internal_file->recovered_records_list ),\n\t\t NULL );\n\t}\n\tif( internal_file->records_list != NULL )\n\t{\n\t\tlibfdata_list_free(\n\t\t &( internal_file->records_list ),\n\t\t NULL );\n\t}\n\tif( chunks_table != NULL )\n\t{\n\t\tlibevtx_chunks_table_free(\n\t\t &chunks_table,\n\t\t NULL );\n\t}\n\tif( internal_file->chunks_cache != NULL )\n\t{\n\t\tlibfcache_cache_free(\n\t\t &( internal_file->chunks_cache ),\n\t\t NULL );\n\t}\n\tif( internal_file->chunks_vector != NULL )\n\t{\n\t\tlibfdata_vector_free(\n\t\t &( internal_file->chunks_vector ),\n\t\t NULL );\n\t}\n\treturn( -1 );\n}\n\n/* Determine if the file corrupted\n * Returns 1 if corrupted, 0 if not or -1 on error\n */\nint libevtx_file_is_corrupted(\n libevtx_file_t *file,\n libcerror_error_t **error )\n{\n\tlibevtx_internal_file_t *internal_file = NULL;\n\tstatic char *function = \"libevtx_file_is_corrupted\";\n\n\tif( file == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid file.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tinternal_file = (libevtx_internal_file_t *) file;\n\n\tif( internal_file->io_handle == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_VALUE_MISSING,\n\t\t \"%s: invalid file - missing IO handle.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( ( internal_file->io_handle->flags & LIBEVTX_IO_HANDLE_FLAG_IS_CORRUPTED ) != 0 )\n\t{\n\t\treturn( 1 );\n\t}\n\treturn( 0 );\n}\n\n/* Retrieves the file ASCII codepage\n * Returns 1 if successful or -1 on error\n */\nint libevtx_file_get_ascii_codepage(\n libevtx_file_t *file,\n int *ascii_codepage,\n libcerror_error_t **error )\n{\n\tlibevtx_internal_file_t *internal_file = NULL;\n\tstatic char *function = \"libevtx_file_get_ascii_codepage\";\n\n\tif( file == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid file.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tinternal_file = (libevtx_internal_file_t *) file;\n\n\tif( internal_file->io_handle == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_VALUE_MISSING,\n\t\t \"%s: invalid file - missing IO handle.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( ascii_codepage == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid ASCII codepage.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\t*ascii_codepage = internal_file->io_handle->ascii_codepage;\n\n\treturn( 1 );\n}\n\n/* Sets the file ASCII codepage\n * Returns 1 if successful or -1 on error\n */\nint libevtx_file_set_ascii_codepage(\n libevtx_file_t *file,\n int ascii_codepage,\n libcerror_error_t **error )\n{\n\tlibevtx_internal_file_t *internal_file = NULL;\n\tstatic char *function = \"libevtx_file_set_ascii_codepage\";\n\n\tif( file == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid file.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tinternal_file = (libevtx_internal_file_t *) file;\n\n\tif( internal_file->io_handle == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_VALUE_MISSING,\n\t\t \"%s: invalid file - missing IO handle.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( ( ascii_codepage != LIBEVTX_CODEPAGE_ASCII )\n\t && ( ascii_codepage != LIBEVTX_CODEPAGE_WINDOWS_874 )\n\t && ( ascii_codepage != LIBEVTX_CODEPAGE_WINDOWS_932 )\n\t && ( ascii_codepage != LIBEVTX_CODEPAGE_WINDOWS_936 )\n\t && ( ascii_codepage != LIBEVTX_CODEPAGE_WINDOWS_949 )\n\t && ( ascii_codepage != LIBEVTX_CODEPAGE_WINDOWS_950 )\n\t && ( ascii_codepage != LIBEVTX_CODEPAGE_WINDOWS_1250 )\n\t && ( ascii_codepage != LIBEVTX_CODEPAGE_WINDOWS_1251 )\n\t && ( ascii_codepage != LIBEVTX_CODEPAGE_WINDOWS_1252 )\n\t && ( ascii_codepage != LIBEVTX_CODEPAGE_WINDOWS_1253 )\n\t && ( ascii_codepage != LIBEVTX_CODEPAGE_WINDOWS_1254 )\n\t && ( ascii_codepage != LIBEVTX_CODEPAGE_WINDOWS_1255 )\n\t && ( ascii_codepage != LIBEVTX_CODEPAGE_WINDOWS_1256 )\n\t && ( ascii_codepage != LIBEVTX_CODEPAGE_WINDOWS_1257 )\n\t && ( ascii_codepage != LIBEVTX_CODEPAGE_WINDOWS_1258 ) )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_UNSUPPORTED_VALUE,\n\t\t \"%s: unsupported ASCII codepage.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tinternal_file->io_handle->ascii_codepage = ascii_codepage;\n\n\treturn( 1 );\n}\n\n/* Retrieves the format version\n * Returns 1 if successful or -1 on error\n */\nint libevtx_file_get_format_version(\n libevtx_file_t *file,\n uint16_t *major_version,\n uint16_t *minor_version,\n libcerror_error_t **error )\n{\n\tlibevtx_internal_file_t *internal_file = NULL;\n\tstatic char *function = \"libevtx_file_get_format_version\";\n\n\tif( file == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid file.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tinternal_file = (libevtx_internal_file_t *) file;\n\n\tif( internal_file->io_handle == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_VALUE_MISSING,\n\t\t \"%s: invalid file - missing IO handle.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( major_version == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid major version.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( minor_version == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid minor version.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\t*major_version = internal_file->io_handle->major_version;\n\t*minor_version = internal_file->io_handle->minor_version;\n\n\treturn( 1 );\n}\n\n/* Retrieves the file version\n * Returns 1 if successful or -1 on error\n */\nint libevtx_file_get_version(\n libevtx_file_t *file,\n uint16_t *major_version,\n uint16_t *minor_version,\n libcerror_error_t **error )\n{\n\tlibevtx_internal_file_t *internal_file = NULL;\n\tstatic char *function = \"libevtx_file_get_version\";\n\n\tif( file == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid file.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tinternal_file = (libevtx_internal_file_t *) file;\n\n\tif( internal_file->io_handle == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_VALUE_MISSING,\n\t\t \"%s: invalid file - missing IO handle.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( major_version == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid major version.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( minor_version == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid minor version.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\t*major_version = internal_file->io_handle->major_version;\n\t*minor_version = internal_file->io_handle->minor_version;\n\n\treturn( 1 );\n}\n\n/* Retrieves the flags\n * Returns 1 if successful or -1 on error\n */\nint libevtx_file_get_flags(\n libevtx_file_t *file,\n uint32_t *flags,\n libcerror_error_t **error )\n{\n\tlibevtx_internal_file_t *internal_file = NULL;\n\tstatic char *function = \"libevtx_file_get_flags\";\n\n\tif( file == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid file.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tinternal_file = (libevtx_internal_file_t *) file;\n\n\tif( internal_file->io_handle == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_VALUE_MISSING,\n\t\t \"%s: invalid file - missing IO handle.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( flags == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid flags.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\t*flags = internal_file->io_handle->file_flags;\n\n\treturn( 1 );\n}\n\n/* Retrieves the number of records\n * Returns 1 if successful or -1 on error\n */\nint libevtx_file_get_number_of_records(\n libevtx_file_t *file,\n int *number_of_records,\n libcerror_error_t **error )\n{\n\tlibevtx_internal_file_t *internal_file = NULL;\n\tstatic char *function = \"libevtx_file_get_number_of_records\";\n\n\tif( file == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid file.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tinternal_file = (libevtx_internal_file_t *) file;\n\n\tif( libfdata_list_get_number_of_elements(\n\t internal_file->records_list,\n\t number_of_records,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to retrieve number of records.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\treturn( 1 );\n}\n\n/* Retrieves a specific record\n * Returns 1 if successful or -1 on error\n */\nint libevtx_file_get_record(\n libevtx_file_t *file,\n int record_index,\n libevtx_record_t **record,\n libcerror_error_t **error )\n{\n\tlibevtx_internal_file_t *internal_file = NULL;\n\tlibevtx_record_values_t *record_values = NULL;\n\tstatic char *function = \"libevtx_file_get_record\";\n\n\tif( file == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid file.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tinternal_file = (libevtx_internal_file_t *) file;\n\n\tif( record == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid record.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( libfdata_list_get_element_value_by_index(\n\t internal_file->records_list,\n\t (intptr_t *) internal_file->file_io_handle,\n\t (libfdata_cache_t *) internal_file->records_cache,\n\t record_index,\n\t (intptr_t **) &record_values,\n\t 0,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to retrieve record values: %d.\",\n\t\t function,\n\t\t record_index );\n\n\t\treturn( -1 );\n\t}\n\tif( libevtx_record_initialize(\n\t record,\n\t internal_file->io_handle,\n\t internal_file->file_io_handle,\n\t record_values,\n\t LIBEVTX_RECORD_FLAGS_DEFAULT,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_INITIALIZE_FAILED,\n\t\t \"%s: unable to create record.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\treturn( 1 );\n}\n\n/* Retrieves a specific record\n * Returns 1 if successful or -1 on error\n */\nint libevtx_file_get_record_by_index(\n libevtx_file_t *file,\n int record_index,\n libevtx_record_t **record,\n libcerror_error_t **error )\n{\n\tlibevtx_internal_file_t *internal_file = NULL;\n\tlibevtx_record_values_t *record_values = NULL;\n\tstatic char *function = \"libevtx_file_get_record_by_index\";\n\n\tif( file == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid file.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tinternal_file = (libevtx_internal_file_t *) file;\n\n\tif( record == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid record.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( libfdata_list_get_element_value_by_index(\n\t internal_file->records_list,\n\t (intptr_t *) internal_file->file_io_handle,\n\t (libfdata_cache_t *) internal_file->records_cache,\n\t record_index,\n\t (intptr_t **) &record_values,\n\t 0,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to retrieve record values: %d.\",\n\t\t function,\n\t\t record_index );\n\n\t\treturn( -1 );\n\t}\n\tif( libevtx_record_initialize(\n\t record,\n\t internal_file->io_handle,\n\t internal_file->file_io_handle,\n\t record_values,\n\t LIBEVTX_RECORD_FLAGS_DEFAULT,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_INITIALIZE_FAILED,\n\t\t \"%s: unable to create record.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\treturn( 1 );\n}\n\n/* Retrieves the number of recovered records\n * Returns 1 if successful or -1 on error\n */\nint libevtx_file_get_number_of_recovered_records(\n libevtx_file_t *file,\n int *number_of_records,\n libcerror_error_t **error )\n{\n\tlibevtx_internal_file_t *internal_file = NULL;\n\tstatic char *function = \"libevtx_file_get_number_of_recovered_records\";\n\n\tif( file == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid file.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tinternal_file = (libevtx_internal_file_t *) file;\n\n\tif( libfdata_list_get_number_of_elements(\n\t internal_file->recovered_records_list,\n\t number_of_records,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to retrieve number of records.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\treturn( 1 );\n}\n\n/* Retrieves a specific recovered record\n * Returns 1 if successful or -1 on error\n */\nint libevtx_file_get_recovered_record(\n libevtx_file_t *file,\n int record_index,\n libevtx_record_t **record,\n libcerror_error_t **error )\n{\n\tlibevtx_internal_file_t *internal_file = NULL;\n\tlibevtx_record_values_t *record_values = NULL;\n\tstatic char *function = \"libevtx_file_get_recovered_record\";\n\n\tif( file == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid file.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tinternal_file = (libevtx_internal_file_t *) file;\n\n\tif( record == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid record.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( libfdata_list_get_element_value_by_index(\n\t internal_file->recovered_records_list,\n\t (intptr_t *) internal_file->file_io_handle,\n\t (libfdata_cache_t *) internal_file->records_cache,\n\t record_index,\n\t (intptr_t **) &record_values,\n\t 0,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to retrieve record values: %d.\",\n\t\t function,\n\t\t record_index );\n\n\t\treturn( -1 );\n\t}\n\tif( libevtx_record_initialize(\n\t record,\n\t internal_file->io_handle,\n\t internal_file->file_io_handle,\n\t record_values,\n\t LIBEVTX_RECORD_FLAGS_DEFAULT,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_INITIALIZE_FAILED,\n\t\t \"%s: unable to create record.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\treturn( 1 );\n}\n\n/* Retrieves a specific recovered record\n * Returns 1 if successful or -1 on error\n */\nint libevtx_file_get_recovered_record_by_index(\n libevtx_file_t *file,\n int record_index,\n libevtx_record_t **record,\n libcerror_error_t **error )\n{\n\tlibevtx_internal_file_t *internal_file = NULL;\n\tlibevtx_record_values_t *record_values = NULL;\n\tstatic char *function = \"libevtx_file_get_recovered_record_by_index\";\n\n\tif( file == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid file.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tinternal_file = (libevtx_internal_file_t *) file;\n\n\tif( record == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid record.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( libfdata_list_get_element_value_by_index(\n\t internal_file->recovered_records_list,\n\t (intptr_t *) internal_file->file_io_handle,\n\t (libfdata_cache_t *) internal_file->records_cache,\n\t record_index,\n\t (intptr_t **) &record_values,\n\t 0,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to retrieve record values: %d.\",\n\t\t function,\n\t\t record_index );\n\n\t\treturn( -1 );\n\t}\n\tif( libevtx_record_initialize(\n\t record,\n\t internal_file->io_handle,\n\t internal_file->file_io_handle,\n\t record_values,\n\t LIBEVTX_RECORD_FLAGS_DEFAULT,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_INITIALIZE_FAILED,\n\t\t \"%s: unable to create record.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\treturn( 1 );\n}\n\n" }, { "path": "libevtx/libevtx_file.h", "content": "/*\n * File functions\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#if !defined( _LIBEVTX_INTERNAL_FILE_H )\n#define _LIBEVTX_INTERNAL_FILE_H\n\n#include \n#include \n\n#include \"libevtx_extern.h\"\n#include \"libevtx_io_handle.h\"\n#include \"libevtx_libbfio.h\"\n#include \"libevtx_libcerror.h\"\n#include \"libevtx_libfcache.h\"\n#include \"libevtx_libfdata.h\"\n\n#if defined( __cplusplus )\nextern \"C\" {\n#endif\n\ntypedef struct libevtx_internal_file libevtx_internal_file_t;\n\nstruct libevtx_internal_file\n{\n\t/* The IO handle\n\t */\n\tlibevtx_io_handle_t *io_handle;\n\n\t/* The file IO handle\n\t */\n\tlibbfio_handle_t *file_io_handle;\n\n\t/* Value to indicate if the file IO handle was created inside the library\n\t */\n\tuint8_t file_io_handle_created_in_library;\n\n\t/* Value to indicate if the file IO handle was opened inside the library\n\t */\n\tuint8_t file_io_handle_opened_in_library;\n\n\t/* The chunks vector\n\t */\n\tlibfdata_vector_t *chunks_vector;\n\n\t/* The chunks cache\n\t */\n\tlibfcache_cache_t *chunks_cache;\n\n\t/* The records list\n\t */\n\tlibfdata_list_t *records_list;\n\n\t/* The recovered records list\n\t */\n\tlibfdata_list_t *recovered_records_list;\n\n\t/* The records cache\n\t */\n\tlibfcache_cache_t *records_cache;\n};\n\nLIBEVTX_EXTERN \\\nint libevtx_file_initialize(\n libevtx_file_t **file,\n libcerror_error_t **error );\n\nLIBEVTX_EXTERN \\\nint libevtx_file_free(\n libevtx_file_t **file,\n libcerror_error_t **error );\n\nLIBEVTX_EXTERN \\\nint libevtx_file_signal_abort(\n libevtx_file_t *file,\n libcerror_error_t **error );\n\nLIBEVTX_EXTERN \\\nint libevtx_file_open(\n libevtx_file_t *file,\n const char *filename,\n int access_flags,\n libcerror_error_t **error );\n\n#if defined( HAVE_WIDE_CHARACTER_TYPE )\n\nLIBEVTX_EXTERN \\\nint libevtx_file_open_wide(\n libevtx_file_t *file,\n const wchar_t *filename,\n int access_flags,\n libcerror_error_t **error );\n\n#endif /* defined( HAVE_WIDE_CHARACTER_TYPE ) */\n\nLIBEVTX_EXTERN \\\nint libevtx_file_open_file_io_handle(\n libevtx_file_t *file,\n libbfio_handle_t *file_io_handle,\n int access_flags,\n libcerror_error_t **error );\n\nLIBEVTX_EXTERN \\\nint libevtx_file_close(\n libevtx_file_t *file,\n libcerror_error_t **error );\n\nint libevtx_file_open_read(\n libevtx_internal_file_t *internal_file,\n libbfio_handle_t *file_io_handle,\n libcerror_error_t **error );\n\nLIBEVTX_EXTERN \\\nint libevtx_file_is_corrupted(\n libevtx_file_t *file,\n libcerror_error_t **error );\n\nLIBEVTX_EXTERN \\\nint libevtx_file_get_ascii_codepage(\n libevtx_file_t *file,\n int *ascii_codepage,\n libcerror_error_t **error );\n\nLIBEVTX_EXTERN \\\nint libevtx_file_set_ascii_codepage(\n libevtx_file_t *file,\n int ascii_codepage,\n libcerror_error_t **error );\n\nLIBEVTX_EXTERN \\\nint libevtx_file_get_format_version(\n libevtx_file_t *file,\n uint16_t *major_version,\n uint16_t *minor_version,\n libcerror_error_t **error );\n\nLIBEVTX_EXTERN \\\nint libevtx_file_get_version(\n libevtx_file_t *file,\n uint16_t *major_version,\n uint16_t *minor_version,\n libcerror_error_t **error );\n\nLIBEVTX_EXTERN \\\nint libevtx_file_get_flags(\n libevtx_file_t *file,\n uint32_t *flags,\n libcerror_error_t **error );\n\nLIBEVTX_EXTERN \\\nint libevtx_file_get_number_of_records(\n libevtx_file_t *file,\n int *number_of_records,\n libcerror_error_t **error );\n\nLIBEVTX_EXTERN \\\nint libevtx_file_get_record(\n libevtx_file_t *file,\n int record_index,\n libevtx_record_t **record,\n libcerror_error_t **error );\n\nLIBEVTX_EXTERN \\\nint libevtx_file_get_record_by_index(\n libevtx_file_t *file,\n int record_index,\n libevtx_record_t **record,\n libcerror_error_t **error );\n\nLIBEVTX_EXTERN \\\nint libevtx_file_get_number_of_recovered_records(\n libevtx_file_t *file,\n int *number_of_records,\n libcerror_error_t **error );\n\nLIBEVTX_EXTERN \\\nint libevtx_file_get_recovered_record(\n libevtx_file_t *file,\n int record_index,\n libevtx_record_t **record,\n libcerror_error_t **error );\n\nLIBEVTX_EXTERN \\\nint libevtx_file_get_recovered_record_by_index(\n libevtx_file_t *file,\n int record_index,\n libevtx_record_t **record,\n libcerror_error_t **error );\n\n#if defined( __cplusplus )\n}\n#endif\n\n#endif /* !defined( _LIBEVTX_INTERNAL_FILE_H ) */\n\n" }, { "path": "libevtx/libevtx_i18n.c", "content": "/*\n * Internationalization (i18n) functions\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#include \n#include \n\n#if defined( HAVE_LIBINTL_H ) && defined( ENABLE_NLS )\n#include \n#endif\n\n#include \"libevtx_i18n.h\"\n#include \"libevtx_libcerror.h\"\n\nstatic int libevtx_i18n_initialized = 0;\n\n/* Initializes library internationalization functions\n */\nint libevtx_i18n_initialize(\n libcerror_error_t **error )\n{\n\tstatic char *function = \"libevtx_i18n_initialize\";\n\n\tif( libevtx_i18n_initialized == 0 )\n\t{\n#if defined( HAVE_BINDTEXTDOMAIN ) && defined( LOCALEDIR )\n\t\tif( bindtextdomain(\n\t\t \"libevtx\",\n\t\t LOCALEDIR ) == NULL )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_SET_FAILED,\n\t\t\t \"%s: unable to bind text domain.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n#endif /* defined( HAVE_BINDTEXTDOMAIN ) && defined( LOCALEDIR ) */\n\n\t\tlibevtx_i18n_initialized = 1;\n\t}\n\treturn( 1 );\n}\n\n" }, { "path": "libevtx/libevtx_i18n.h", "content": "/*\n * Internationalization (i18n) functions\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#if !defined( _LIBEVTX_I18N_H )\n#define _LIBEVTX_I18N_H\n\n#include \n#include \n\n#if defined( HAVE_LIBINTL_H ) && defined( ENABLE_NLS )\n#include \n#endif\n\n#include \"libevtx_libcerror.h\"\n\n/* TODO\n#include \n\n#define\t_( string ) \\\n\tdgettext( \"libevtx\", string )\n*/\n#define\t_( string ) \\\n\tstring\n\n#if defined( __cplusplus )\nextern \"C\" {\n#endif\n\nint libevtx_i18n_initialize(\n libcerror_error_t **error );\n\n#if defined( __cplusplus )\n}\n#endif\n\n#endif /* !defined( _LIBEVTX_I18N_H ) */\n\n" }, { "path": "libevtx/libevtx_io_handle.c", "content": "/*\n * Input/Output (IO) handle functions\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#include \n#include \n#include \n#include \n\n#include \"libevtx_checksum.h\"\n#include \"libevtx_chunk.h\"\n#include \"libevtx_codepage.h\"\n#include \"libevtx_debug.h\"\n#include \"libevtx_definitions.h\"\n#include \"libevtx_io_handle.h\"\n#include \"libevtx_libbfio.h\"\n#include \"libevtx_libcerror.h\"\n#include \"libevtx_libcnotify.h\"\n#include \"libevtx_libfdata.h\"\n#include \"libevtx_unused.h\"\n\n#include \"evtx_file_header.h\"\n\nconst uint8_t *evtx_file_signature = (uint8_t *) \"ElfFile\";\n\n/* Creates an IO handle\n * Make sure the value io_handle is referencing, is set to NULL\n * Returns 1 if successful or -1 on error\n */\nint libevtx_io_handle_initialize(\n libevtx_io_handle_t **io_handle,\n libcerror_error_t **error )\n{\n\tstatic char *function = \"libevtx_io_handle_initialize\";\n\n\tif( io_handle == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid IO handle.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( *io_handle != NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_VALUE_ALREADY_SET,\n\t\t \"%s: invalid IO handle value already set.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\t*io_handle = memory_allocate_structure(\n\t libevtx_io_handle_t );\n\n\tif( *io_handle == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_MEMORY,\n\t\t LIBCERROR_MEMORY_ERROR_INSUFFICIENT,\n\t\t \"%s: unable to create IO handle.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tif( memory_set(\n\t *io_handle,\n\t 0,\n\t sizeof( libevtx_io_handle_t ) ) == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_MEMORY,\n\t\t LIBCERROR_MEMORY_ERROR_SET_FAILED,\n\t\t \"%s: unable to clear IO handle.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\t( *io_handle )->chunk_size = 0x00010000UL;\n\t( *io_handle )->ascii_codepage = LIBEVTX_CODEPAGE_WINDOWS_1252;\n\n\treturn( 1 );\n\non_error:\n\tif( *io_handle != NULL )\n\t{\n\t\tmemory_free(\n\t\t *io_handle );\n\n\t\t*io_handle = NULL;\n\t}\n\treturn( -1 );\n}\n\n/* Frees an IO handle\n * Returns 1 if successful or -1 on error\n */\nint libevtx_io_handle_free(\n libevtx_io_handle_t **io_handle,\n libcerror_error_t **error )\n{\n\tstatic char *function = \"libevtx_io_handle_free\";\n\tint result = 1;\n\n\tif( io_handle == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid IO handle.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( *io_handle != NULL )\n\t{\n\t\tmemory_free(\n\t\t *io_handle );\n\n\t\t*io_handle = NULL;\n\t}\n\treturn( result );\n}\n\n/* Clears the IO handle\n * Returns 1 if successful or -1 on error\n */\nint libevtx_io_handle_clear(\n libevtx_io_handle_t *io_handle,\n libcerror_error_t **error )\n{\n\tstatic char *function = \"libevtx_io_handle_clear\";\n\n\tif( io_handle == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid IO handle.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( memory_set(\n\t io_handle,\n\t 0,\n\t sizeof( libevtx_io_handle_t ) ) == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_MEMORY,\n\t\t LIBCERROR_MEMORY_ERROR_SET_FAILED,\n\t\t \"%s: unable to clear IO handle.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tio_handle->chunk_size = 0x00010000UL;\n\tio_handle->ascii_codepage = LIBEVTX_CODEPAGE_WINDOWS_1252;\n\n\treturn( 1 );\n}\n\n/* Reads the file (or database) header\n * Returns 1 if successful or -1 on error\n */\nint libevtx_io_handle_read_file_header(\n libevtx_io_handle_t *io_handle,\n libbfio_handle_t *file_io_handle,\n off64_t file_offset,\n libcerror_error_t **error )\n{\n\tuint8_t *file_header_data = NULL;\n\tstatic char *function = \"libevtx_io_handle_read_file_header\";\n\tsize_t read_size = 4096;\n\tssize_t read_count = 0;\n\tuint32_t calculated_checksum = 0;\n\tuint32_t stored_checksum = 0;\n\tuint16_t first_chunk_number = 0;\n\tuint16_t last_chunk_number = 0;\n\n#if defined( HAVE_DEBUG_OUTPUT )\n\tuint64_t value_64bit = 0;\n\tuint32_t value_32bit = 0;\n#endif\n\n\tif( io_handle == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid IO handle.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tfile_header_data = (uint8_t *) memory_allocate(\n\t sizeof( uint8_t ) * read_size );\n\n\tif( file_header_data == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_MEMORY,\n\t\t LIBCERROR_MEMORY_ERROR_INSUFFICIENT,\n\t\t \"%s: unable to create file header data.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n#if defined( HAVE_DEBUG_OUTPUT )\n\tif( libcnotify_verbose != 0 )\n\t{\n\t\tlibcnotify_printf(\n\t\t \"%s: reading file header at offset: %\" PRIi64 \" (0x%08\" PRIx64 \")\\n\",\n\t\t function,\n\t\t file_offset,\n\t\t file_offset );\n\t}\n#endif\n\tread_count = libbfio_handle_read_buffer_at_offset(\n\t file_io_handle,\n\t file_header_data,\n\t read_size,\n\t file_offset,\n\t error );\n\n\tif( read_count != (ssize_t) read_size )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_IO,\n\t\t LIBCERROR_IO_ERROR_READ_FAILED,\n\t\t \"%s: unable to read file header at offset: %\" PRIi64 \" (0x%08\" PRIx64 \").\",\n\t\t function,\n\t\t file_offset,\n\t\t file_offset );\n\n\t\tgoto on_error;\n\t}\n#if defined( HAVE_DEBUG_OUTPUT )\n\tif( libcnotify_verbose != 0 )\n\t{\n\t\tlibcnotify_printf(\n\t\t \"%s: file header data:\\n\",\n\t\t function );\n\t\tlibcnotify_print_data(\n\t\t file_header_data,\n\t\t sizeof( evtx_file_header_t ),\n\t\t LIBCNOTIFY_PRINT_DATA_FLAG_GROUP_DATA );\n\t}\n#endif\n\tif( memory_compare(\n\t ( (evtx_file_header_t *) file_header_data )->signature,\n\t evtx_file_signature,\n\t 8 ) != 0 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_UNSUPPORTED_VALUE,\n\t\t \"%s: unsupported file signature.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tbyte_stream_copy_to_uint64_little_endian(\n\t ( (evtx_file_header_t *) file_header_data )->first_chunk_number,\n\t first_chunk_number );\n\n\tbyte_stream_copy_to_uint64_little_endian(\n\t ( (evtx_file_header_t *) file_header_data )->last_chunk_number,\n\t last_chunk_number );\n\n\tbyte_stream_copy_to_uint16_little_endian(\n\t ( (evtx_file_header_t *) file_header_data )->minor_version,\n\t io_handle->minor_version );\n\n\tbyte_stream_copy_to_uint16_little_endian(\n\t ( (evtx_file_header_t *) file_header_data )->major_version,\n\t io_handle->major_version );\n\n\tbyte_stream_copy_to_uint16_little_endian(\n\t ( (evtx_file_header_t *) file_header_data )->header_block_size,\n\t io_handle->chunks_data_offset );\n\n\tbyte_stream_copy_to_uint16_little_endian(\n\t ( (evtx_file_header_t *) file_header_data )->number_of_chunks,\n\t io_handle->number_of_chunks );\n\n\tbyte_stream_copy_to_uint32_little_endian(\n\t ( (evtx_file_header_t *) file_header_data )->file_flags,\n\t io_handle->file_flags );\n\n\tbyte_stream_copy_to_uint32_little_endian(\n\t ( (evtx_file_header_t *) file_header_data )->checksum,\n\t stored_checksum );\n\n#if defined( HAVE_DEBUG_OUTPUT )\n\tif( libcnotify_verbose != 0 )\n\t{\n\t\tlibcnotify_printf(\n\t\t \"%s: signature\\t\\t\\t\\t: %c%c%c%c%c%c%c\\\\x%02x\\n\",\n\t\t function,\n\t\t ( (evtx_file_header_t *) file_header_data )->signature[ 0 ],\n\t\t ( (evtx_file_header_t *) file_header_data )->signature[ 1 ],\n\t\t ( (evtx_file_header_t *) file_header_data )->signature[ 2 ],\n\t\t ( (evtx_file_header_t *) file_header_data )->signature[ 3 ],\n\t\t ( (evtx_file_header_t *) file_header_data )->signature[ 4 ],\n\t\t ( (evtx_file_header_t *) file_header_data )->signature[ 5 ] ,\n\t\t ( (evtx_file_header_t *) file_header_data )->signature[ 6 ] ,\n\t\t ( (evtx_file_header_t *) file_header_data )->signature[ 7 ] );\n\n\t\tlibcnotify_printf(\n\t\t \"%s: first chunk number\\t\\t\\t: %\" PRIu64 \"\\n\",\n\t\t function,\n\t\t first_chunk_number );\n\n\t\tlibcnotify_printf(\n\t\t \"%s: last chunk number\\t\\t\\t: %\" PRIu64 \"\\n\",\n\t\t function,\n\t\t last_chunk_number );\n\n\t\tbyte_stream_copy_to_uint64_little_endian(\n\t\t ( (evtx_file_header_t *) file_header_data )->next_record_identifier,\n\t\t value_64bit );\n\t\tlibcnotify_printf(\n\t\t \"%s: next record identifier\\t\\t: %\" PRIu64 \"\\n\",\n\t\t function,\n\t\t value_64bit );\n\n\t\tbyte_stream_copy_to_uint32_little_endian(\n\t\t ( (evtx_file_header_t *) file_header_data )->header_size,\n\t\t value_32bit );\n\t\tlibcnotify_printf(\n\t\t \"%s: header size\\t\\t\\t\\t: %\" PRIu32 \"\\n\",\n\t\t function,\n\t\t value_32bit );\n\n\t\tlibcnotify_printf(\n\t\t \"%s: minor version\\t\\t\\t: %\" PRIu16 \"\\n\",\n\t\t function,\n\t\t io_handle->minor_version );\n\n\t\tlibcnotify_printf(\n\t\t \"%s: major version\\t\\t\\t: %\" PRIu16 \"\\n\",\n\t\t function,\n\t\t io_handle->major_version );\n\n\t\tlibcnotify_printf(\n\t\t \"%s: header block size\\t\\t\\t: %\" PRIi64 \"\\n\",\n\t\t function,\n\t\t io_handle->chunks_data_offset );\n\n\t\tlibcnotify_printf(\n\t\t \"%s: number of chunks\\t\\t\\t: %\" PRIu16 \"\\n\",\n\t\t function,\n\t\t io_handle->number_of_chunks );\n\n\t\tlibcnotify_printf(\n\t\t \"%s: unknown1:\\n\",\n\t\t function );\n\t\tlibcnotify_print_data(\n\t\t ( (evtx_file_header_t *) file_header_data )->unknown1,\n\t\t 76,\n\t\t LIBCNOTIFY_PRINT_DATA_FLAG_GROUP_DATA );\n\n\t\tlibcnotify_printf(\n\t\t \"%s: file flags\\t\\t\\t\\t: 0x%08\" PRIx32 \"\\n\",\n\t\t function,\n\t\t io_handle->file_flags );\n\t\tlibevtx_debug_print_file_flags(\n\t\t io_handle->file_flags );\n\t\tlibcnotify_printf(\n\t\t \"\\n\" );\n\n\t\tlibcnotify_printf(\n\t\t \"%s: checksum\\t\\t\\t\\t: 0x%08\" PRIx32 \"\\n\",\n\t\t function,\n\t\t stored_checksum );\n\n\t\tlibcnotify_printf(\n\t\t \"\\n\" );\n\t}\n#endif /* defined( HAVE_DEBUG_OUTPUT ) */\n\n\tif( libevtx_checksum_calculate_little_endian_crc32(\n\t &calculated_checksum,\n\t file_header_data,\n\t 120,\n\t 0,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to calculate CRC-32 checksum.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tif( stored_checksum != calculated_checksum )\n\t{\n#if defined( HAVE_VERBOSE_OUTPUT )\n\t\tif( libcnotify_verbose != 0 )\n\t\t{\n\t\t\tlibcnotify_printf(\n\t\t\t \"%s: mismatch in file header CRC-32 checksum ( 0x%08\" PRIx32 \" != 0x%08\" PRIx32 \" ).\\n\",\n\t\t\t function,\n\t\t\t stored_checksum,\n\t\t\t calculated_checksum );\n\t\t}\n#endif\n\t\tio_handle->flags |= LIBEVTX_IO_HANDLE_FLAG_IS_CORRUPTED;\n\t}\n#if defined( HAVE_DEBUG_OUTPUT )\n\tif( libcnotify_verbose != 0 )\n\t{\n\t\tlibcnotify_printf(\n\t\t \"%s: trailing data:\\n\",\n\t\t function );\n\t\tlibcnotify_print_data(\n\t\t &( file_header_data[ sizeof( evtx_file_header_t ) ] ),\n\t\t read_size - sizeof( evtx_file_header_t ),\n\t\t LIBCNOTIFY_PRINT_DATA_FLAG_GROUP_DATA );\n\t}\n#endif\n\tif( first_chunk_number > last_chunk_number )\n\t{\n#if defined( HAVE_VERBOSE_OUTPUT )\n\t\tif( libcnotify_verbose != 0 )\n\t\t{\n\t\t\tlibcnotify_printf(\n\t\t\t \"%s: first chunk number: %\" PRIu16 \" exceeds last chunk number: %\" PRIu16 \".\\n\",\n\t\t\t function,\n\t\t\t first_chunk_number,\n\t\t\t last_chunk_number );\n\t\t}\n#endif\n\t\tio_handle->flags |= LIBEVTX_IO_HANDLE_FLAG_IS_CORRUPTED;\n\t}\n\telse if( io_handle->number_of_chunks != ( last_chunk_number - first_chunk_number + 1 ) )\n\t{\n#if defined( HAVE_VERBOSE_OUTPUT )\n\t\tif( libcnotify_verbose != 0 )\n\t\t{\n\t\t\tlibcnotify_printf(\n\t\t\t \"%s: mismatch in number of chunks ( %\" PRIu16 \" != %\" PRIu16 \" ).\\n\",\n\t\t\t function,\n\t\t\t io_handle->number_of_chunks,\n\t\t\t last_chunk_number - first_chunk_number + 1 );\n\t\t}\n#endif\n\t\tio_handle->flags |= LIBEVTX_IO_HANDLE_FLAG_IS_CORRUPTED;\n\t}\n\tmemory_free(\n\t file_header_data );\n\n\tfile_header_data = NULL;\n\n\treturn( 1 );\n\non_error:\n\tif( file_header_data != NULL )\n\t{\n\t\tmemory_free(\n\t\t file_header_data );\n\t}\n\treturn( -1 );\n}\n\n/* Reads a chunk\n * Callback function for the chunk vector\n * Returns 1 if successful or -1 on error\n */\nint libevtx_io_handle_read_chunk(\n libevtx_io_handle_t *io_handle,\n libbfio_handle_t *file_io_handle,\n libfdata_vector_t *vector,\n libfdata_cache_t *cache,\n int element_index,\n int element_data_file_index LIBEVTX_ATTRIBUTE_UNUSED,\n off64_t element_data_offset,\n size64_t element_data_size LIBEVTX_ATTRIBUTE_UNUSED,\n uint32_t element_data_flags LIBEVTX_ATTRIBUTE_UNUSED,\n uint8_t read_flags LIBEVTX_ATTRIBUTE_UNUSED,\n libcerror_error_t **error )\n{\n\tlibevtx_chunk_t *chunk = NULL;\n\tstatic char *function = \"libevtx_io_handle_read_chunk\";\n\n\tLIBEVTX_UNREFERENCED_PARAMETER( element_data_file_index );\n\tLIBEVTX_UNREFERENCED_PARAMETER( element_data_size );\n\tLIBEVTX_UNREFERENCED_PARAMETER( element_data_flags );\n\tLIBEVTX_UNREFERENCED_PARAMETER( read_flags );\n\n\tif( libevtx_chunk_initialize(\n\t &chunk,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_INITIALIZE_FAILED,\n\t\t \"%s: unable to create chunk.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tif( libevtx_chunk_read(\n\t chunk,\n\t io_handle,\n\t file_io_handle,\n\t element_data_offset,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_IO,\n\t\t LIBCERROR_IO_ERROR_READ_FAILED,\n\t\t \"%s: unable to read chunk.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tif( libfdata_vector_set_element_value_by_index(\n\t vector,\n\t (intptr_t *) file_io_handle,\n\t cache,\n\t element_index,\n\t (intptr_t *) chunk,\n\t (int (*)(intptr_t **, libcerror_error_t **)) &libevtx_chunk_free,\n\t LIBFDATA_LIST_ELEMENT_VALUE_FLAG_MANAGED,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_SET_FAILED,\n\t\t \"%s: unable to set chunk as element value.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\treturn( 1 );\n\non_error:\n\tif( chunk != NULL )\n\t{\n\t\tlibevtx_chunk_free(\n\t\t &chunk,\n\t\t NULL );\n\t}\n\treturn( -1 );\n}\n\n" }, { "path": "libevtx/libevtx_io_handle.h", "content": "/*\n * Input/Output (IO) handle functions\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#if !defined( _LIBEVTX_IO_HANDLE_H )\n#define _LIBEVTX_IO_HANDLE_H\n\n#include \n#include \n\n#include \"libevtx_libbfio.h\"\n#include \"libevtx_libcerror.h\"\n#include \"libevtx_libfdata.h\"\n\n#if defined( __cplusplus )\nextern \"C\" {\n#endif\n\nextern const uint8_t *evtx_file_signature;\n\ntypedef struct libevtx_io_handle libevtx_io_handle_t;\n\nstruct libevtx_io_handle\n{\n\t/* The major version\n\t */\n\tuint16_t major_version;\n\n\t/* The minor version\n\t */\n\tuint16_t minor_version;\n\n\t/* The number of chunks\n\t */\n\tuint16_t number_of_chunks;\n\n\t/* The chunks data offset\n\t */\n\toff64_t chunks_data_offset;\n\n\t/* The chunks data size\n\t */\n\tsize64_t chunks_data_size;\n\n\t/* The file flags\n\t */\n\tuint32_t file_flags;\n\n\t/* The chunk size\n\t */\n\tuint32_t chunk_size;\n\n\t/* Various flags\n\t */\n\tuint8_t flags;\n\n\t/* The first record identifier\n\t */\n\tuint64_t first_record_identifier;\n\n\t/* The last record identifier\n\t */\n\tuint64_t last_record_identifier;\n\n\t/* The codepage of the ASCII strings\n\t */\n\tint ascii_codepage;\n\n\t/* Value to indicate if abort was signalled\n\t */\n\tint abort;\n};\n\nint libevtx_io_handle_initialize(\n libevtx_io_handle_t **io_handle,\n libcerror_error_t **error );\n\nint libevtx_io_handle_free(\n libevtx_io_handle_t **io_handle,\n libcerror_error_t **error );\n\nint libevtx_io_handle_clear(\n libevtx_io_handle_t *io_handle,\n libcerror_error_t **error );\n\nint libevtx_io_handle_read_file_header(\n libevtx_io_handle_t *io_handle,\n libbfio_handle_t *file_io_handle,\n off64_t file_offset,\n libcerror_error_t **error );\n\nint libevtx_io_handle_read_chunk(\n libevtx_io_handle_t *io_handle,\n libbfio_handle_t *file_io_handle,\n libfdata_vector_t *vector,\n libfdata_cache_t *cache,\n int element_index,\n int element_data_file_index,\n off64_t element_data_offset,\n size64_t element_data_size,\n uint32_t element_data_flags,\n uint8_t read_flags,\n libcerror_error_t **error );\n\n#if defined( __cplusplus )\n}\n#endif\n\n#endif /* !defined( _LIBEVTX_IO_HANDLE_H ) */\n\n" }, { "path": "libevtx/libevtx_libbfio.h", "content": "/*\n * The libbfio header wrapper\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#if !defined( _LIBEVTX_LIBBFIO_H )\n#define _LIBEVTX_LIBBFIO_H\n\n#include \n\n/* Define HAVE_LOCAL_LIBBFIO for local use of libbfio\n */\n#if defined( HAVE_LOCAL_LIBBFIO )\n\n#include \n#include \n#include \n#include \n#include \n#include \n#include \n#include \n\n#else\n\n/* If libtool DLL support is enabled set LIBBFIO_DLL_IMPORT\n * before including libbfio.h\n */\n#if defined( _WIN32 ) && defined( DLL_IMPORT )\n#define LIBBFIO_DLL_IMPORT\n#endif\n\n#include \n\n#if defined( HAVE_MULTI_THREAD_SUPPORT ) && !defined( LIBBFIO_HAVE_MULTI_THREAD_SUPPORT )\n#error Multi-threading support requires libbfio with multi-threading support\n#endif\n\n#endif /* defined( HAVE_LOCAL_LIBBFIO ) */\n\n#endif /* !defined( _LIBEVTX_LIBBFIO_H ) */\n\n" }, { "path": "libevtx/libevtx_libcdata.h", "content": "/*\n * The libcdata header wrapper\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#if !defined( _LIBEVTX_LIBCDATA_H )\n#define _LIBEVTX_LIBCDATA_H\n\n#include \n\n/* Define HAVE_LOCAL_LIBCDATA for local use of libcdata\n */\n#if defined( HAVE_LOCAL_LIBCDATA )\n\n#include \n#include \n#include \n#include \n#include \n#include \n#include \n#include \n\n#else\n\n/* If libtool DLL support is enabled set LIBCDATA_DLL_IMPORT\n * before including libcdata.h\n */\n#if defined( _WIN32 ) && defined( DLL_IMPORT )\n#define LIBCDATA_DLL_IMPORT\n#endif\n\n#include \n\n#endif /* defined( HAVE_LOCAL_LIBCDATA ) */\n\n#endif /* !defined( _LIBEVTX_LIBCDATA_H ) */\n\n" }, { "path": "libevtx/libevtx_libcerror.h", "content": "/*\n * The libcerror header wrapper\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#if !defined( _LIBEVTX_LIBCERROR_H )\n#define _LIBEVTX_LIBCERROR_H\n\n#include \n\n/* Define HAVE_LOCAL_LIBCERROR for local use of libcerror\n */\n#if defined( HAVE_LOCAL_LIBCERROR )\n\n#include \n#include \n#include \n#include \n\n#else\n\n/* If libtool DLL support is enabled set LIBCERROR_DLL_IMPORT\n * before including libcerror.h\n */\n#if defined( _WIN32 ) && defined( DLL_IMPORT )\n#define LIBCERROR_DLL_IMPORT\n#endif\n\n#include \n\n#endif /* defined( HAVE_LOCAL_LIBCERROR ) */\n\n#endif /* !defined( _LIBEVTX_LIBCERROR_H ) */\n\n" }, { "path": "libevtx/libevtx_libclocale.h", "content": "/*\n * The libclocale header wrapper\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#if !defined( _LIBEVTX_LIBCLOCALE_H )\n#define _LIBEVTX_LIBCLOCALE_H\n\n#include \n\n/* Define HAVE_LOCAL_LIBCLOCALE for local use of libclocale\n */\n#if defined( HAVE_LOCAL_LIBCLOCALE )\n\n#include \n#include \n#include \n#include \n\n#else\n\n/* If libtool DLL support is enabled set LIBCLOCALE_DLL_IMPORT\n * before including libclocale.h\n */\n#if defined( _WIN32 ) && defined( DLL_IMPORT )\n#define LIBCLOCALE_DLL_IMPORT\n#endif\n\n#include \n\n#endif /* defined( HAVE_LOCAL_LIBCLOCALE ) */\n\n#endif /* !defined( _LIBEVTX_LIBCLOCALE_H ) */\n\n" }, { "path": "libevtx/libevtx_libcnotify.h", "content": "/*\n * The libcnotify header wrapper\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#if !defined( _LIBEVTX_LIBCNOTIFY_H )\n#define _LIBEVTX_LIBCNOTIFY_H\n\n#include \n\n/* Define HAVE_LOCAL_LIBCNOTIFY for local use of libcnotify\n */\n#if defined( HAVE_LOCAL_LIBCNOTIFY )\n\n#include \n#include \n#include \n#include \n\n#else\n\n/* If libtool DLL support is enabled set LIBCNOTIFY_DLL_IMPORT\n * before including libcnotify.h\n */\n#if defined( _WIN32 ) && defined( DLL_IMPORT )\n#define LIBCNOTIFY_DLL_IMPORT\n#endif\n\n#include \n\n#endif /* defined( HAVE_LOCAL_LIBCNOTIFY ) */\n\n#endif /* !defined( _LIBEVTX_LIBCNOTIFY_H ) */\n\n" }, { "path": "libevtx/libevtx_libfcache.h", "content": "/*\n * The libfcache header wrapper\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#if !defined( _LIBEVTX_LIBFCACHE_H )\n#define _LIBEVTX_LIBFCACHE_H\n\n#include \n\n/* Define HAVE_LOCAL_LIBFCACHE for local use of libfcache\n */\n#if defined( HAVE_LOCAL_LIBFCACHE )\n\n#include \n#include \n#include \n#include \n\n#else\n\n/* If libtool DLL support is enabled set LIBFCACHE_DLL_IMPORT\n * before including libfcache.h\n */\n#if defined( _WIN32 ) && defined( DLL_IMPORT )\n#define LIBFCACHE_DLL_IMPORT\n#endif\n\n#include \n\n#endif /* defined( HAVE_LOCAL_LIBFCACHE ) */\n\n#endif /* !defined( _LIBEVTX_LIBFCACHE_H ) */\n\n" }, { "path": "libevtx/libevtx_libfdata.h", "content": "/*\n * The libfdata header wrapper\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#if !defined( _LIBEVTX_LIBFDATA_H )\n#define _LIBEVTX_LIBFDATA_H\n\n#include \n\n/* Define HAVE_LOCAL_LIBFDATA for local use of libfdata\n */\n#if defined( HAVE_LOCAL_LIBFDATA )\n\n#include \n#include \n#include \n#include \n#include \n#include \n#include \n#include \n\n#else\n\n/* If libtool DLL support is enabled set LIBFDATA_DLL_IMPORT\n * before including libfdata.h\n */\n#if defined( _WIN32 ) && defined( DLL_IMPORT )\n#define LIBFDATA_DLL_IMPORT\n#endif\n\n#include \n\n#endif /* defined( HAVE_LOCAL_LIBFDATA ) */\n\n#endif /* !defined( _LIBEVTX_LIBFDATA_H ) */\n\n" }, { "path": "libevtx/libevtx_libfdatetime.h", "content": "/*\n * The libfdatetime header wrapper\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#if !defined( _LIBEVTX_LIBFDATETIME_H )\n#define _LIBEVTX_LIBFDATETIME_H\n\n#include \n\n/* Define HAVE_LOCAL_LIBFDATETIME for local use of libfdatetime\n */\n#if defined( HAVE_LOCAL_LIBFDATETIME )\n\n#include \n#include \n#include \n#include \n#include \n#include \n#include \n#include \n#include \n#include \n\n#else\n\n/* If libtool DLL support is enabled set LIBFDATETIME_DLL_IMPORT\n * before including libfdatetime.h\n */\n#if defined( _WIN32 ) && defined( DLL_IMPORT )\n#define LIBFDATETIME_DLL_IMPORT\n#endif\n\n#include \n\n#endif /* defined( HAVE_LOCAL_LIBFDATETIME ) */\n\n#endif /* !defined( _LIBEVTX_LIBFDATETIME_H ) */\n\n" }, { "path": "libevtx/libevtx_libfguid.h", "content": "/*\n * The libfguid header wrapper\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#if !defined( _LIBEVTX_LIBFGUID_H )\n#define _LIBEVTX_LIBFGUID_H\n\n#include \n\n/* Define HAVE_LOCAL_LIBFGUID for local use of libfguid\n */\n#if defined( HAVE_LOCAL_LIBFGUID )\n\n#include \n#include \n#include \n\n#else\n\n/* If libtool DLL support is enabled set LIBFGUID_DLL_IMPORT\n * before including libfguid.h\n */\n#if defined( _WIN32 ) && defined( DLL_IMPORT )\n#define LIBFGUID_DLL_IMPORT\n#endif\n\n#include \n\n#endif /* defined( HAVE_LOCAL_LIBFGUID ) */\n\n#endif /* !defined( _LIBEVTX_LIBFGUID_H ) */\n\n" }, { "path": "libevtx/libevtx_libfwevt.h", "content": "/*\n * The libfwevt header wrapper\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#if !defined( _LIBEVTX_LIBFWEVT_H )\n#define _LIBEVTX_LIBFWEVT_H\n\n#include \n\n/* Define HAVE_LOCAL_LIBFWEVT for local use of libfwevt\n */\n#if defined( HAVE_LOCAL_LIBFWEVT )\n\n#include \n#include \n#include \n#include \n#include \n#include \n#include \n#include \n#include \n#include \n#include \n#include \n#include \n#include \n#include \n#include \n\n#else\n\n/* If libtool DLL support is enabled set LIBFWEVT_DLL_IMPORT\n * before including libfwevt.h\n */\n#if defined( _WIN32 ) && defined( DLL_IMPORT )\n#define LIBFWEVT_DLL_IMPORT\n#endif\n\n#include \n\n#endif /* defined( HAVE_LOCAL_LIBFWEVT ) */\n\n#endif /* !defined( _LIBEVTX_LIBFWEVT_H ) */\n\n" }, { "path": "libevtx/libevtx_libuna.h", "content": "/*\n * The libuna header wrapper\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#if !defined( _LIBEVTX_LIBUNA_H )\n#define _LIBEVTX_LIBUNA_H\n\n#include \n\n/* Define HAVE_LOCAL_LIBUNA for local use of libuna\n */\n#if defined( HAVE_LOCAL_LIBUNA )\n\n#include \n#include \n#include \n#include \n#include \n#include \n#include \n#include \n#include \n#include \n#include \n#include \n#include \n#include \n\n#else\n\n/* If libtool DLL support is enabled set LIBUNA_DLL_IMPORT\n * before including libuna.h\n */\n#if defined( _WIN32 ) && defined( DLL_IMPORT )\n#define LIBUNA_DLL_IMPORT\n#endif\n\n#include \n\n#endif /* defined( HAVE_LOCAL_LIBUNA ) */\n\n#endif /* !defined( _LIBEVTX_LIBUNA_H ) */\n\n" }, { "path": "libevtx/libevtx_notify.c", "content": "/*\n * Notification functions\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#include \n#include \n#include \n\n#if defined( HAVE_STDLIB_H ) || defined( WINAPI )\n#include \n#endif\n\n#include \"libevtx_libcerror.h\"\n#include \"libevtx_libcnotify.h\"\n#include \"libevtx_notify.h\"\n\n#if !defined( HAVE_LOCAL_LIBEVTX )\n\n/* Sets the verbose notification\n */\nvoid libevtx_notify_set_verbose(\n int verbose )\n{\n\tlibcnotify_verbose_set(\n\t verbose );\n}\n\n/* Sets the notification stream\n * Returns 1 if successful or -1 on error\n */\nint libevtx_notify_set_stream(\n FILE *stream,\n libcerror_error_t **error )\n{\n\tstatic char *function = \"libevtx_notify_set_stream\";\n\n\tif( libcnotify_stream_set(\n\t stream,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_SET_FAILED,\n\t\t \"%s: unable to set stream.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\treturn( 1 );\n}\n\n/* Opens the notification stream using a filename\n * The stream is opened in append mode\n * Returns 1 if successful or -1 on error\n */\nint libevtx_notify_stream_open(\n const char *filename,\n libcerror_error_t **error )\n{\n\tstatic char *function = \"libevtx_notify_stream_open\";\n\n\tif( libcnotify_stream_open(\n\t filename,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_IO,\n\t\t LIBCERROR_IO_ERROR_OPEN_FAILED,\n\t\t \"%s: unable to open stream.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\treturn( 1 );\n}\n\n/* Closes the notification stream if opened using a filename\n * Returns 0 if successful or -1 on error\n */\nint libevtx_notify_stream_close(\n libcerror_error_t **error )\n{\n\tstatic char *function = \"libevtx_notify_stream_close\";\n\n\tif( libcnotify_stream_close(\n\t error ) != 0 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_IO,\n\t\t LIBCERROR_IO_ERROR_OPEN_FAILED,\n\t\t \"%s: unable to open stream.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\treturn( 0 );\n}\n\n#endif /* !defined( HAVE_LOCAL_LIBEVTX ) */\n\n" }, { "path": "libevtx/libevtx_notify.h", "content": "/*\n * Notification functions\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#if !defined( _LIBEVTX_NOTIFY_H )\n#define _LIBEVTX_NOTIFY_H\n\n#include \n#include \n#include \n\n#include \"libevtx_extern.h\"\n#include \"libevtx_libcerror.h\"\n\n#if defined( __cplusplus )\nextern \"C\" {\n#endif\n\n#if !defined( HAVE_LOCAL_LIBEVTX )\n\nLIBEVTX_EXTERN \\\nvoid libevtx_notify_set_verbose(\n int verbose );\n\nLIBEVTX_EXTERN \\\nint libevtx_notify_set_stream(\n FILE *stream,\n libcerror_error_t **error );\n\nLIBEVTX_EXTERN \\\nint libevtx_notify_stream_open(\n const char *filename,\n libcerror_error_t **error );\n\nLIBEVTX_EXTERN \\\nint libevtx_notify_stream_close(\n libcerror_error_t **error );\n\n#endif /* !defined( HAVE_LOCAL_LIBEVTX ) */\n\n#if defined( __cplusplus )\n}\n#endif\n\n#endif /* !defined( _LIBEVTX_NOTIFY_H ) */\n\n" }, { "path": "libevtx/libevtx_record.c", "content": "/*\n * Record functions\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#include \n#include \n#include \n\n#include \"libevtx_definitions.h\"\n#include \"libevtx_io_handle.h\"\n#include \"libevtx_libbfio.h\"\n#include \"libevtx_libcerror.h\"\n#include \"libevtx_record.h\"\n#include \"libevtx_record_values.h\"\n\n/* Creates a record\n * Make sure the value record is referencing, is set to NULL\n * Returns 1 if successful or -1 on error\n */\nint libevtx_record_initialize(\n libevtx_record_t **record,\n libevtx_io_handle_t *io_handle,\n libbfio_handle_t *file_io_handle,\n libevtx_record_values_t *record_values,\n uint8_t flags,\n libcerror_error_t **error )\n{\n\tlibevtx_internal_record_t *internal_record = NULL;\n\tstatic char *function = \"libevtx_record_initialize\";\n\n\tif( record == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid record.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( *record != NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_VALUE_ALREADY_SET,\n\t\t \"%s: invalid record value already set.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( record_values == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid record values.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( ( flags & ~( LIBEVTX_RECORD_FLAG_MANAGED_FILE_IO_HANDLE ) ) != 0 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_UNSUPPORTED_VALUE,\n\t\t \"%s: unsupported flags: 0x%02\" PRIx8 \".\",\n\t\t function,\n\t\t flags );\n\n\t\treturn( -1 );\n\t}\n\tinternal_record = memory_allocate_structure(\n\t libevtx_internal_record_t );\n\n\tif( internal_record == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_MEMORY,\n\t\t LIBCERROR_MEMORY_ERROR_INSUFFICIENT,\n\t\t \"%s: unable to create internal record.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tif( memory_set(\n\t internal_record,\n\t 0,\n\t sizeof( libevtx_internal_record_t ) ) == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_MEMORY,\n\t\t LIBCERROR_MEMORY_ERROR_SET_FAILED,\n\t\t \"%s: unable to clear internal record.\",\n\t\t function );\n\n\t\tmemory_free(\n\t\t internal_record );\n\n\t\treturn( -1 );\n\t}\n\tif( ( flags & LIBEVTX_RECORD_FLAG_MANAGED_FILE_IO_HANDLE ) == 0 )\n\t{\n\t\tinternal_record->file_io_handle = file_io_handle;\n\t}\n\telse\n\t{\n\t\tif( libbfio_handle_clone(\n\t\t &( internal_record->file_io_handle ),\n\t\t file_io_handle,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_COPY_FAILED,\n\t\t\t \"%s: unable to copy file IO handle.\",\n\t\t\t function );\n\n\t\t\tgoto on_error;\n\t\t}\n\t\tif( libbfio_handle_set_open_on_demand(\n\t\t internal_record->file_io_handle,\n\t\t 1,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_COPY_FAILED,\n\t\t\t \"%s: unable to set open on demand in file IO handle.\",\n\t\t\t function );\n\n\t\t\tgoto on_error;\n\t\t}\n\t}\n\tinternal_record->io_handle = io_handle;\n\tinternal_record->record_values = record_values;\n\tinternal_record->flags = flags;\n\n\t*record = (libevtx_record_t *) internal_record;\n\n\treturn( 1 );\n\non_error:\n\tif( internal_record != NULL )\n\t{\n\t\tif( ( flags & LIBEVTX_RECORD_FLAG_MANAGED_FILE_IO_HANDLE ) != 0 )\n\t\t{\n\t\t\tif( internal_record->file_io_handle != NULL )\n\t\t\t{\n\t\t\t\tlibbfio_handle_free(\n\t\t\t\t &( internal_record->file_io_handle ),\n\t\t\t\t NULL );\n\t\t\t}\n\t\t}\n\t\tmemory_free(\n\t\t internal_record );\n\t}\n\treturn( -1 );\n}\n\n/* Frees a record\n * Returns 1 if successful or -1 on error\n */\nint libevtx_record_free(\n libevtx_record_t **record,\n libcerror_error_t **error )\n{\n\tlibevtx_internal_record_t *internal_record = NULL;\n\tstatic char *function = \"libevtx_record_free\";\n\n\tif( record == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid record.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( *record != NULL )\n\t{\n\t\tinternal_record = (libevtx_internal_record_t *) *record;\n\t\t*record = NULL;\n\n\t\t/* The io_handle and record_values references are freed elsewhere\n\t\t */\n\t\tif( ( internal_record->flags & LIBEVTX_RECORD_FLAG_MANAGED_FILE_IO_HANDLE ) != 0 )\n\t\t{\n\t\t\tif( internal_record->file_io_handle != NULL )\n\t\t\t{\n\t\t\t\tif( libbfio_handle_close(\n\t\t\t\t internal_record->file_io_handle,\n\t\t\t\t error ) != 0 )\n\t\t\t\t{\n\t\t\t\t\tlibcerror_error_set(\n\t\t\t\t\t error,\n\t\t\t\t\t LIBCERROR_ERROR_DOMAIN_IO,\n\t\t\t\t\t LIBCERROR_IO_ERROR_CLOSE_FAILED,\n\t\t\t\t\t \"%s: unable to close file IO handle.\",\n\t\t\t\t\t function );\n\n\t\t\t\t\treturn( -1 );\n\t\t\t\t}\n\t\t\t\tif( libbfio_handle_free(\n\t\t\t\t &( internal_record->file_io_handle ),\n\t\t\t\t error ) != 1 )\n\t\t\t\t{\n\t\t\t\t\tlibcerror_error_set(\n\t\t\t\t\t error,\n\t\t\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t\t\t LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED,\n\t\t\t\t\t \"%s: unable to free file IO handle.\",\n\t\t\t\t\t function );\n\n\t\t\t\t\treturn( -1 );\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t\tmemory_free(\n\t\t internal_record );\n\t}\n\treturn( 1 );\n}\n\n/* Retrieves the offset\n * Returns 1 if successful or -1 on error\n */\nint libevtx_record_get_offset(\n libevtx_record_t *record,\n off64_t *offset,\n libcerror_error_t **error )\n{\n\tlibevtx_internal_record_t *internal_record = NULL;\n\tstatic char *function = \"libevtx_record_get_offset\";\n\n\tif( record == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid record.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tinternal_record = (libevtx_internal_record_t *) record;\n\n\tif( internal_record->record_values == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_VALUE_MISSING,\n\t\t \"%s: invalid record - missing record values.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( offset == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid offset.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\t*offset = internal_record->record_values->offset;\n\n\treturn( 1 );\n}\n\n/* Retrieves the identifier (record number)\n * Returns 1 if successful or -1 on error\n */\nint libevtx_record_get_identifier(\n libevtx_record_t *record,\n uint64_t *identifier,\n libcerror_error_t **error )\n{\n\tlibevtx_internal_record_t *internal_record = NULL;\n\tstatic char *function = \"libevtx_record_get_identifier\";\n\n\tif( record == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid record.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tinternal_record = (libevtx_internal_record_t *) record;\n\n\tif( internal_record->record_values == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_VALUE_MISSING,\n\t\t \"%s: invalid record - missing record values.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( identifier == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid identifier.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\t*identifier = internal_record->record_values->identifier;\n\n\treturn( 1 );\n}\n\n/* Retrieves the 64-bit FILETIME value containing the creation time from the binary XML\n * Returns 1 if successful, 0 if not available or -1 on error\n */\nint libevtx_record_get_creation_time(\n libevtx_record_t *record,\n uint64_t *filetime,\n libcerror_error_t **error )\n{\n\tlibevtx_internal_record_t *internal_record = NULL;\n\tstatic char *function = \"libevtx_record_get_creation_time\";\n\tint result = 0;\n\n\tif( record == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid record.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tinternal_record = (libevtx_internal_record_t *) record;\n\n\tresult = libevtx_record_values_get_creation_time(\n\t internal_record->record_values,\n\t filetime,\n\t error );\n\n\tif( result == -1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to retrieve creation time from record values.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\treturn( result );\n}\n\n/* Retrieves the 64-bit FILETIME value containing the written time from the event record header\n * Returns 1 if successful or -1 on error\n */\nint libevtx_record_get_written_time(\n libevtx_record_t *record,\n uint64_t *filetime,\n libcerror_error_t **error )\n{\n\tlibevtx_internal_record_t *internal_record = NULL;\n\tstatic char *function = \"libevtx_record_get_written_time\";\n\n\tif( record == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid record.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tinternal_record = (libevtx_internal_record_t *) record;\n\n\tif( libevtx_record_values_get_written_time(\n\t internal_record->record_values,\n\t filetime,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to retrieve written time from record values.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\treturn( 1 );\n}\n\n/* Retrieves the event identifier\n * Returns 1 if successful or -1 on error\n */\nint libevtx_record_get_event_identifier(\n libevtx_record_t *record,\n uint32_t *event_identifier,\n libcerror_error_t **error )\n{\n\tlibevtx_internal_record_t *internal_record = NULL;\n\tstatic char *function = \"libevtx_record_get_event_identifier\";\n\n\tif( record == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid record.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tinternal_record = (libevtx_internal_record_t *) record;\n\n\tif( libevtx_record_values_get_event_identifier(\n\t internal_record->record_values,\n\t event_identifier,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to retrieve event identifier from record values.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\treturn( 1 );\n}\n\n/* Retrieves the event identifier qualifiers\n * Returns 1 if successful, 0 if not available or -1 on error\n */\nint libevtx_record_get_event_identifier_qualifiers(\n libevtx_record_t *record,\n uint32_t *event_identifier_qualifiers,\n libcerror_error_t **error )\n{\n\tlibevtx_internal_record_t *internal_record = NULL;\n\tstatic char *function = \"libevtx_record_get_event_identifier_qualifiers\";\n\tint result = 0;\n\n\tif( record == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid record.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tinternal_record = (libevtx_internal_record_t *) record;\n\n\tresult = libevtx_record_values_get_event_identifier_qualifiers(\n\t internal_record->record_values,\n\t event_identifier_qualifiers,\n\t error );\n\n\tif( result == -1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to retrieve event identifier qualifiers from record values.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\treturn( result );\n}\n\n/* Retrieves the event version\n * Returns 1 if successful, 0 if not available or -1 on error\n */\nint libevtx_record_get_event_version(\n libevtx_record_t *record,\n uint8_t *event_version,\n libcerror_error_t **error )\n{\n\tlibevtx_internal_record_t *internal_record = NULL;\n\tstatic char *function = \"libevtx_record_get_event_version\";\n\tint result = 0;\n\n\tif( record == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid record.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tinternal_record = (libevtx_internal_record_t *) record;\n\n\tresult = libevtx_record_values_get_event_version(\n\t internal_record->record_values,\n\t event_version,\n\t error );\n\n\tif( result == -1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to retrieve event version from record values.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\treturn( result );\n}\n\n/* Retrieves the event level\n * Returns 1 if successful or -1 on error\n */\nint libevtx_record_get_event_level(\n libevtx_record_t *record,\n uint8_t *event_level,\n libcerror_error_t **error )\n{\n\tlibevtx_internal_record_t *internal_record = NULL;\n\tstatic char *function = \"libevtx_record_get_event_level\";\n\n\tif( record == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid record.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tinternal_record = (libevtx_internal_record_t *) record;\n\n\tif( libevtx_record_values_get_event_level(\n\t internal_record->record_values,\n\t event_level,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to retrieve event level from record values.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\treturn( 1 );\n}\n\n/* Retrieves the size of the UTF-8 encoded provider identifier\n * The returned size includes the end of string character\n * Returns 1 if successful, 0 if not available or -1 on error\n */\nint libevtx_record_get_utf8_provider_identifier_size(\n libevtx_record_t *record,\n size_t *utf8_string_size,\n libcerror_error_t **error )\n{\n\tlibevtx_internal_record_t *internal_record = NULL;\n\tstatic char *function = \"libevtx_record_get_utf8_provider_identifier_size\";\n\tint result = 0;\n\n\tif( record == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid record.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tinternal_record = (libevtx_internal_record_t *) record;\n\n\tresult = libevtx_record_values_get_utf8_provider_identifier_size(\n\t internal_record->record_values,\n\t utf8_string_size,\n\t error );\n\n\tif( result == -1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to retrieve UTF-8 string size of provider identifier.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\treturn( result );\n}\n\n/* Retrieves the UTF-8 encoded provider identifier\n * The size should include the end of string character\n * Returns 1 if successful, 0 if not available or -1 on error\n */\nint libevtx_record_get_utf8_provider_identifier(\n libevtx_record_t *record,\n uint8_t *utf8_string,\n size_t utf8_string_size,\n libcerror_error_t **error )\n{\n\tlibevtx_internal_record_t *internal_record = NULL;\n\tstatic char *function = \"libevtx_record_get_utf8_provider_identifier\";\n\tint result = 0;\n\n\tif( record == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid record.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tinternal_record = (libevtx_internal_record_t *) record;\n\n\tresult = libevtx_record_values_get_utf8_provider_identifier(\n\t internal_record->record_values,\n\t utf8_string,\n\t utf8_string_size,\n\t error );\n\n\tif( result == -1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_COPY_FAILED,\n\t\t \"%s: unable to copy provider identifier to UTF-8 string.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\treturn( result );\n}\n\n/* Retrieves the size of the UTF-16 encoded provider identifier\n * The returned size includes the end of string character\n * Returns 1 if successful, 0 if not available or -1 on error\n */\nint libevtx_record_get_utf16_provider_identifier_size(\n libevtx_record_t *record,\n size_t *utf16_string_size,\n libcerror_error_t **error )\n{\n\tlibevtx_internal_record_t *internal_record = NULL;\n\tstatic char *function = \"libevtx_record_get_utf16_provider_identifier_size\";\n\tint result = 0;\n\n\tif( record == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid record.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tinternal_record = (libevtx_internal_record_t *) record;\n\n\tresult = libevtx_record_values_get_utf16_provider_identifier_size(\n\t internal_record->record_values,\n\t utf16_string_size,\n\t error );\n\n\tif( result == -1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to retrieve UTF-16 string size of provider identifier.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\treturn( result );\n}\n\n/* Retrieves the UTF-16 encoded provider identifier\n * The size should include the end of string character\n * Returns 1 if successful, 0 if not available or -1 on error\n */\nint libevtx_record_get_utf16_provider_identifier(\n libevtx_record_t *record,\n uint16_t *utf16_string,\n size_t utf16_string_size,\n libcerror_error_t **error )\n{\n\tlibevtx_internal_record_t *internal_record = NULL;\n\tstatic char *function = \"libevtx_record_get_utf16_provider_identifier\";\n\tint result = 0;\n\n\tif( record == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid record.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tinternal_record = (libevtx_internal_record_t *) record;\n\n\tresult = libevtx_record_values_get_utf16_provider_identifier(\n\t internal_record->record_values,\n\t utf16_string,\n\t utf16_string_size,\n\t error );\n\n\tif( result == -1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_COPY_FAILED,\n\t\t \"%s: unable to copy provider identifier to UTF-16 string.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\treturn( result );\n}\n\n/* Retrieves the size of the UTF-8 encoded source name\n * The returned size includes the end of string character\n * Returns 1 if successful, 0 if not available or -1 on error\n */\nint libevtx_record_get_utf8_source_name_size(\n libevtx_record_t *record,\n size_t *utf8_string_size,\n libcerror_error_t **error )\n{\n\tlibevtx_internal_record_t *internal_record = NULL;\n\tstatic char *function = \"libevtx_record_get_utf8_source_name_size\";\n\tint result = 0;\n\n\tif( record == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid record.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tinternal_record = (libevtx_internal_record_t *) record;\n\n\tresult = libevtx_record_values_get_utf8_source_name_size(\n\t internal_record->record_values,\n\t utf8_string_size,\n\t error );\n\n\tif( result == -1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to retrieve UTF-8 string size of source name.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\treturn( result );\n}\n\n/* Retrieves the UTF-8 encoded source name\n * The size should include the end of string character\n * Returns 1 if successful, 0 if not available or -1 on error\n */\nint libevtx_record_get_utf8_source_name(\n libevtx_record_t *record,\n uint8_t *utf8_string,\n size_t utf8_string_size,\n libcerror_error_t **error )\n{\n\tlibevtx_internal_record_t *internal_record = NULL;\n\tstatic char *function = \"libevtx_record_get_utf8_source_name\";\n\tint result = 0;\n\n\tif( record == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid record.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tinternal_record = (libevtx_internal_record_t *) record;\n\n\tresult = libevtx_record_values_get_utf8_source_name(\n\t internal_record->record_values,\n\t utf8_string,\n\t utf8_string_size,\n\t error );\n\n\tif( result == -1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_COPY_FAILED,\n\t\t \"%s: unable to copy source name to UTF-8 string.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\treturn( result );\n}\n\n/* Retrieves the size of the UTF-16 encoded source name\n * The returned size includes the end of string character\n * Returns 1 if successful, 0 if not available or -1 on error\n */\nint libevtx_record_get_utf16_source_name_size(\n libevtx_record_t *record,\n size_t *utf16_string_size,\n libcerror_error_t **error )\n{\n\tlibevtx_internal_record_t *internal_record = NULL;\n\tstatic char *function = \"libevtx_record_get_utf16_source_name_size\";\n\tint result = 0;\n\n\tif( record == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid record.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tinternal_record = (libevtx_internal_record_t *) record;\n\n\tresult = libevtx_record_values_get_utf16_source_name_size(\n\t internal_record->record_values,\n\t utf16_string_size,\n\t error );\n\n\tif( result == -1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to retrieve UTF-16 string size of source name.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\treturn( result );\n}\n\n/* Retrieves the UTF-16 encoded source name\n * The size should include the end of string character\n * Returns 1 if successful, 0 if not available or -1 on error\n */\nint libevtx_record_get_utf16_source_name(\n libevtx_record_t *record,\n uint16_t *utf16_string,\n size_t utf16_string_size,\n libcerror_error_t **error )\n{\n\tlibevtx_internal_record_t *internal_record = NULL;\n\tstatic char *function = \"libevtx_record_get_utf16_source_name\";\n\tint result = 0;\n\n\tif( record == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid record.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tinternal_record = (libevtx_internal_record_t *) record;\n\n\tresult = libevtx_record_values_get_utf16_source_name(\n\t internal_record->record_values,\n\t utf16_string,\n\t utf16_string_size,\n\t error );\n\n\tif( result == -1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_COPY_FAILED,\n\t\t \"%s: unable to copy source name to UTF-16 string.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\treturn( result );\n}\n\n/* Retrieves the size of the UTF-8 encoded channel name\n * The returned size includes the end of string character\n * Returns 1 if successful, 0 if not available or -1 on error\n */\nint libevtx_record_get_utf8_channel_name_size(\n libevtx_record_t *record,\n size_t *utf8_string_size,\n libcerror_error_t **error )\n{\n\tlibevtx_internal_record_t *internal_record = NULL;\n\tstatic char *function = \"libevtx_record_get_utf8_channel_name_size\";\n\tint result = 0;\n\n\tif( record == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid record.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tinternal_record = (libevtx_internal_record_t *) record;\n\n\tresult = libevtx_record_values_get_utf8_channel_name_size(\n\t internal_record->record_values,\n\t utf8_string_size,\n\t error );\n\n\tif( result == -1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to retrieve UTF-8 string size of channel name.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\treturn( result );\n}\n\n/* Retrieves the UTF-8 encoded channel name\n * The size should include the end of string character\n * Returns 1 if successful, 0 if not available or -1 on error\n */\nint libevtx_record_get_utf8_channel_name(\n libevtx_record_t *record,\n uint8_t *utf8_string,\n size_t utf8_string_size,\n libcerror_error_t **error )\n{\n\tlibevtx_internal_record_t *internal_record = NULL;\n\tstatic char *function = \"libevtx_record_get_utf8_channel_name\";\n\tint result = 0;\n\n\tif( record == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid record.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tinternal_record = (libevtx_internal_record_t *) record;\n\n\tresult = libevtx_record_values_get_utf8_channel_name(\n\t internal_record->record_values,\n\t utf8_string,\n\t utf8_string_size,\n\t error );\n\n\tif( result == -1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_COPY_FAILED,\n\t\t \"%s: unable to copy channel name to UTF-8 string.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\treturn( result );\n}\n\n/* Retrieves the size of the UTF-16 encoded channel name\n * The returned size includes the end of string character\n * Returns 1 if successful, 0 if not available or -1 on error\n */\nint libevtx_record_get_utf16_channel_name_size(\n libevtx_record_t *record,\n size_t *utf16_string_size,\n libcerror_error_t **error )\n{\n\tlibevtx_internal_record_t *internal_record = NULL;\n\tstatic char *function = \"libevtx_record_get_utf16_channel_name_size\";\n\tint result = 0;\n\n\tif( record == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid record.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tinternal_record = (libevtx_internal_record_t *) record;\n\n\tresult = libevtx_record_values_get_utf16_channel_name_size(\n\t internal_record->record_values,\n\t utf16_string_size,\n\t error );\n\n\tif( result == -1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to retrieve UTF-16 string size of channel name.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\treturn( result );\n}\n\n/* Retrieves the UTF-16 encoded channel name\n * The size should include the end of string character\n * Returns 1 if successful, 0 if not available or -1 on error\n */\nint libevtx_record_get_utf16_channel_name(\n libevtx_record_t *record,\n uint16_t *utf16_string,\n size_t utf16_string_size,\n libcerror_error_t **error )\n{\n\tlibevtx_internal_record_t *internal_record = NULL;\n\tstatic char *function = \"libevtx_record_get_utf16_channel_name\";\n\tint result = 0;\n\n\tif( record == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid record.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tinternal_record = (libevtx_internal_record_t *) record;\n\n\tresult = libevtx_record_values_get_utf16_channel_name(\n\t internal_record->record_values,\n\t utf16_string,\n\t utf16_string_size,\n\t error );\n\n\tif( result == -1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_COPY_FAILED,\n\t\t \"%s: unable to copy channel name to UTF-16 string.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\treturn( result );\n}\n\n/* Retrieves the size of the UTF-8 encoded computer name\n * The returned size includes the end of string character\n * Returns 1 if successful, 0 if not available or -1 on error\n */\nint libevtx_record_get_utf8_computer_name_size(\n libevtx_record_t *record,\n size_t *utf8_string_size,\n libcerror_error_t **error )\n{\n\tlibevtx_internal_record_t *internal_record = NULL;\n\tstatic char *function = \"libevtx_record_get_utf8_computer_name_size\";\n\tint result = 0;\n\n\tif( record == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid record.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tinternal_record = (libevtx_internal_record_t *) record;\n\n\tresult = libevtx_record_values_get_utf8_computer_name_size(\n\t internal_record->record_values,\n\t utf8_string_size,\n\t error );\n\n\tif( result == -1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to retrieve UTF-8 string size of computer name.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\treturn( result );\n}\n\n/* Retrieves the UTF-8 encoded computer name\n * The size should include the end of string character\n * Returns 1 if successful, 0 if not available or -1 on error\n */\nint libevtx_record_get_utf8_computer_name(\n libevtx_record_t *record,\n uint8_t *utf8_string,\n size_t utf8_string_size,\n libcerror_error_t **error )\n{\n\tlibevtx_internal_record_t *internal_record = NULL;\n\tstatic char *function = \"libevtx_record_get_utf8_computer_name\";\n\tint result = 0;\n\n\tif( record == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid record.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tinternal_record = (libevtx_internal_record_t *) record;\n\n\tresult = libevtx_record_values_get_utf8_computer_name(\n\t internal_record->record_values,\n\t utf8_string,\n\t utf8_string_size,\n\t error );\n\n\tif( result == -1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_COPY_FAILED,\n\t\t \"%s: unable to copy computer name to UTF-8 string.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\treturn( result );\n}\n\n/* Retrieves the size of the UTF-16 encoded computer name\n * The returned size includes the end of string character\n * Returns 1 if successful, 0 if not available or -1 on error\n */\nint libevtx_record_get_utf16_computer_name_size(\n libevtx_record_t *record,\n size_t *utf16_string_size,\n libcerror_error_t **error )\n{\n\tlibevtx_internal_record_t *internal_record = NULL;\n\tstatic char *function = \"libevtx_record_get_utf16_computer_name_size\";\n\tint result = 0;\n\n\tif( record == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid record.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tinternal_record = (libevtx_internal_record_t *) record;\n\n\tresult = libevtx_record_values_get_utf16_computer_name_size(\n\t internal_record->record_values,\n\t utf16_string_size,\n\t error );\n\n\tif( result == -1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to retrieve UTF-16 string size of computer name.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\treturn( result );\n}\n\n/* Retrieves the UTF-16 encoded computer name\n * The size should include the end of string character\n * Returns 1 if successful, 0 if not available or -1 on error\n */\nint libevtx_record_get_utf16_computer_name(\n libevtx_record_t *record,\n uint16_t *utf16_string,\n size_t utf16_string_size,\n libcerror_error_t **error )\n{\n\tlibevtx_internal_record_t *internal_record = NULL;\n\tstatic char *function = \"libevtx_record_get_utf16_computer_name\";\n\tint result = 0;\n\n\tif( record == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid record.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tinternal_record = (libevtx_internal_record_t *) record;\n\n\tresult = libevtx_record_values_get_utf16_computer_name(\n\t internal_record->record_values,\n\t utf16_string,\n\t utf16_string_size,\n\t error );\n\n\tif( result == -1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_COPY_FAILED,\n\t\t \"%s: unable to copy computer name to UTF-16 string.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\treturn( result );\n}\n\n/* Retrieves the size of the UTF-8 encoded user security identifier\n * The returned size includes the end of string character\n * Returns 1 if successful, 0 if not available or -1 on error\n */\nint libevtx_record_get_utf8_user_security_identifier_size(\n libevtx_record_t *record,\n size_t *utf8_string_size,\n libcerror_error_t **error )\n{\n\tlibevtx_internal_record_t *internal_record = NULL;\n\tstatic char *function = \"libevtx_record_get_utf8_user_security_identifier_size\";\n\tint result = 0;\n\n\tif( record == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid record.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tinternal_record = (libevtx_internal_record_t *) record;\n\n\tresult = libevtx_record_values_get_utf8_user_security_identifier_size(\n\t internal_record->record_values,\n\t utf8_string_size,\n\t error );\n\n\tif( result == -1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to retrieve UTF-8 string size of user security identifier.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\treturn( result );\n}\n\n/* Retrieves the UTF-8 encoded user security identifier\n * The size should include the end of string character\n * Returns 1 if successful, 0 if not available or -1 on error\n */\nint libevtx_record_get_utf8_user_security_identifier(\n libevtx_record_t *record,\n uint8_t *utf8_string,\n size_t utf8_string_size,\n libcerror_error_t **error )\n{\n\tlibevtx_internal_record_t *internal_record = NULL;\n\tstatic char *function = \"libevtx_record_get_utf8_user_security_identifier\";\n\tint result = 0;\n\n\tif( record == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid record.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tinternal_record = (libevtx_internal_record_t *) record;\n\n\tresult = libevtx_record_values_get_utf8_user_security_identifier(\n\t internal_record->record_values,\n\t utf8_string,\n\t utf8_string_size,\n\t error );\n\n\tif( result == -1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_COPY_FAILED,\n\t\t \"%s: unable to copy user security identifier to UTF-8 string.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\treturn( result );\n}\n\n/* Retrieves the size of the UTF-16 encoded user security identifier\n * The returned size includes the end of string character\n * Returns 1 if successful, 0 if not available or -1 on error\n */\nint libevtx_record_get_utf16_user_security_identifier_size(\n libevtx_record_t *record,\n size_t *utf16_string_size,\n libcerror_error_t **error )\n{\n\tlibevtx_internal_record_t *internal_record = NULL;\n\tstatic char *function = \"libevtx_record_get_utf16_user_security_identifier_size\";\n\tint result = 0;\n\n\tif( record == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid record.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tinternal_record = (libevtx_internal_record_t *) record;\n\n\tresult = libevtx_record_values_get_utf16_user_security_identifier_size(\n\t internal_record->record_values,\n\t utf16_string_size,\n\t error );\n\n\tif( result == -1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to retrieve UTF-16 string size of user security identifier.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\treturn( result );\n}\n\n/* Retrieves the UTF-16 encoded user security identifier\n * The size should include the end of string character\n * Returns 1 if successful, 0 if not available or -1 on error\n */\nint libevtx_record_get_utf16_user_security_identifier(\n libevtx_record_t *record,\n uint16_t *utf16_string,\n size_t utf16_string_size,\n libcerror_error_t **error )\n{\n\tlibevtx_internal_record_t *internal_record = NULL;\n\tstatic char *function = \"libevtx_record_get_utf16_user_security_identifier\";\n\tint result = 0;\n\n\tif( record == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid record.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tinternal_record = (libevtx_internal_record_t *) record;\n\n\tresult = libevtx_record_values_get_utf16_user_security_identifier(\n\t internal_record->record_values,\n\t utf16_string,\n\t utf16_string_size,\n\t error );\n\n\tif( result == -1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_COPY_FAILED,\n\t\t \"%s: unable to copy user security identifier to UTF-16 string.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\treturn( result );\n}\n\n/* Parses the record data with a template definition\n * This function needs to be called before accessing the strings otherwise\n * the record data will be parsed without a template definition by default\n * Returns 1 if successful, 0 if data could not be parsed or -1 on error\n */\nint libevtx_record_parse_data_with_template_definition(\n libevtx_record_t *record,\n libevtx_template_definition_t *template_definition,\n libcerror_error_t **error )\n{\n\tlibevtx_internal_record_t *internal_record = NULL;\n\tstatic char *function = \"libevtx_record_parse_data_with_template_definition\";\n\tint result = 0;\n\n\tif( record == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid record.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tinternal_record = (libevtx_internal_record_t *) record;\n\n\tif( template_definition == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid template definition.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tresult = libevtx_record_values_parse_data(\n\t internal_record->record_values,\n\t internal_record->io_handle,\n\t (libevtx_internal_template_definition_t *) template_definition,\n\t error );\n\n\tif( result == -1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GENERIC,\n\t\t \"%s: unable to parse data.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\treturn( result );\n}\n\n/* Retrieves the number of strings\n * Returns 1 if successful or -1 on error\n */\nint libevtx_record_get_number_of_strings(\n libevtx_record_t *record,\n int *number_of_strings,\n libcerror_error_t **error )\n{\n\tlibevtx_internal_record_t *internal_record = NULL;\n\tstatic char *function = \"libevtx_record_get_number_of_strings\";\n\n\tif( record == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid record.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tinternal_record = (libevtx_internal_record_t *) record;\n\n\tif( libevtx_record_values_get_number_of_strings(\n\t internal_record->record_values,\n\t internal_record->io_handle,\n\t number_of_strings,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_COPY_FAILED,\n\t\t \"%s: unable to retrieve number of strings.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\treturn( 1 );\n}\n\n/* Retrieves the size of a specific UTF-8 encoded string\n * The returned size includes the end of string character\n * Returns 1 if successful or -1 on error\n */\nint libevtx_record_get_utf8_string_size(\n libevtx_record_t *record,\n int string_index,\n size_t *utf8_string_size,\n libcerror_error_t **error )\n{\n\tlibevtx_internal_record_t *internal_record = NULL;\n\tstatic char *function = \"libevtx_record_get_utf8_string_size\";\n\n\tif( record == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid record.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tinternal_record = (libevtx_internal_record_t *) record;\n\n\tif( libevtx_record_values_get_utf8_string_size(\n\t internal_record->record_values,\n\t internal_record->io_handle,\n\t string_index,\n\t utf8_string_size,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_COPY_FAILED,\n\t\t \"%s: unable to retrieve size of UTF-8 string: %d.\",\n\t\t function,\n\t\t string_index );\n\n\t\treturn( -1 );\n\t}\n\treturn( 1 );\n}\n\n/* Retrieves a specific UTF-8 encoded string\n * The size should include the end of string character\n * Returns 1 if successful or -1 on error\n */\nint libevtx_record_get_utf8_string(\n libevtx_record_t *record,\n int string_index,\n uint8_t *utf8_string,\n size_t utf8_string_size,\n libcerror_error_t **error )\n{\n\tlibevtx_internal_record_t *internal_record = NULL;\n\tstatic char *function = \"libevtx_record_get_utf8_string\";\n\n\tif( record == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid record.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tinternal_record = (libevtx_internal_record_t *) record;\n\n\tif( libevtx_record_values_get_utf8_string(\n\t internal_record->record_values,\n\t internal_record->io_handle,\n\t string_index,\n\t utf8_string,\n\t utf8_string_size,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_COPY_FAILED,\n\t\t \"%s: unable to retrieve UTF-8 string: %d.\",\n\t\t function,\n\t\t string_index );\n\n\t\treturn( -1 );\n\t}\n\treturn( 1 );\n}\n\n/* Retrieves the size of a specific UTF-16 encoded string\n * The returned size includes the end of string character\n * Returns 1 if successful or -1 on error\n */\nint libevtx_record_get_utf16_string_size(\n libevtx_record_t *record,\n int string_index,\n size_t *utf16_string_size,\n libcerror_error_t **error )\n{\n\tlibevtx_internal_record_t *internal_record = NULL;\n\tstatic char *function = \"libevtx_record_get_utf16_string_size\";\n\n\tif( record == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid record.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tinternal_record = (libevtx_internal_record_t *) record;\n\n\tif( libevtx_record_values_get_utf16_string_size(\n\t internal_record->record_values,\n\t internal_record->io_handle,\n\t string_index,\n\t utf16_string_size,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_COPY_FAILED,\n\t\t \"%s: unable to retrieve size of UTF-16 string: %d.\",\n\t\t function,\n\t\t string_index );\n\n\t\treturn( -1 );\n\t}\n\treturn( 1 );\n}\n\n/* Retrieves a specific UTF-16 encoded string\n * The size should include the end of string character\n * Returns 1 if successful or -1 on error\n */\nint libevtx_record_get_utf16_string(\n libevtx_record_t *record,\n int string_index,\n uint16_t *utf16_string,\n size_t utf16_string_size,\n libcerror_error_t **error )\n{\n\tlibevtx_internal_record_t *internal_record = NULL;\n\tstatic char *function = \"libevtx_record_get_utf16_string\";\n\n\tif( record == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid record.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tinternal_record = (libevtx_internal_record_t *) record;\n\n\tif( libevtx_record_values_get_utf16_string(\n\t internal_record->record_values,\n\t internal_record->io_handle,\n\t string_index,\n\t utf16_string,\n\t utf16_string_size,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_COPY_FAILED,\n\t\t \"%s: unable to retrieve UTF-16 string: %d.\",\n\t\t function,\n\t\t string_index );\n\n\t\treturn( -1 );\n\t}\n\treturn( 1 );\n}\n\n/* Retrieves the size of the data\n * Returns 1 if successful, 0 if not available or -1 on error\n */\nint libevtx_record_get_data_size(\n libevtx_record_t *record,\n size_t *data_size,\n libcerror_error_t **error )\n{\n\tlibevtx_internal_record_t *internal_record = NULL;\n\tstatic char *function = \"libevtx_record_get_data_size\";\n\tint result = 0;\n\n\tif( record == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid record.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tinternal_record = (libevtx_internal_record_t *) record;\n\n\tresult = libevtx_record_values_get_data_size(\n\t internal_record->record_values,\n\t internal_record->io_handle,\n\t data_size,\n\t error );\n\n\tif( result == -1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_COPY_FAILED,\n\t\t \"%s: unable to retrieve data size.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\treturn( result );\n}\n\n/* Retrieves the data\n * Returns 1 if successful, 0 if not available or -1 on error\n */\nint libevtx_record_get_data(\n libevtx_record_t *record,\n uint8_t *data,\n size_t data_size,\n libcerror_error_t **error )\n{\n\tlibevtx_internal_record_t *internal_record = NULL;\n\tstatic char *function = \"libevtx_record_get_data\";\n\tint result = 0;\n\n\tif( record == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid record.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tinternal_record = (libevtx_internal_record_t *) record;\n\n\tresult = libevtx_record_values_get_data(\n\t internal_record->record_values,\n\t internal_record->io_handle,\n\t data,\n\t data_size,\n\t error );\n\n\tif( result == -1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_COPY_FAILED,\n\t\t \"%s: unable to retrieve data.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\treturn( result );\n}\n\n/* Retrieves the size of the UTF-8 encoded XML string\n * The returned size includes the end of string character\n * Returns 1 if successful or -1 on error\n */\nint libevtx_record_get_utf8_xml_string_size(\n libevtx_record_t *record,\n size_t *utf8_string_size,\n libcerror_error_t **error )\n{\n\tlibevtx_internal_record_t *internal_record = NULL;\n\tstatic char *function = \"libevtx_record_get_utf8_xml_string_size\";\n\n\tif( record == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid record.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tinternal_record = (libevtx_internal_record_t *) record;\n\n\tif( libevtx_record_values_get_utf8_xml_string_size(\n\t internal_record->record_values,\n\t utf8_string_size,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to retrieve UTF-8 string size of event XML.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\treturn( 1 );\n}\n\n/* Retrieves the UTF-8 encoded XML string\n * The size should include the end of string character\n * Returns 1 if successful or -1 on error\n */\nint libevtx_record_get_utf8_xml_string(\n libevtx_record_t *record,\n uint8_t *utf8_string,\n size_t utf8_string_size,\n libcerror_error_t **error )\n{\n\tlibevtx_internal_record_t *internal_record = NULL;\n\tstatic char *function = \"libevtx_record_get_utf8_xml_string\";\n\n\tif( record == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid record.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tinternal_record = (libevtx_internal_record_t *) record;\n\n\tif( libevtx_record_values_get_utf8_xml_string(\n\t internal_record->record_values,\n\t utf8_string,\n\t utf8_string_size,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_COPY_FAILED,\n\t\t \"%s: unable to copy event XML to UTF-8 string.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\treturn( 1 );\n}\n\n/* Retrieves the size of the UTF-16 encoded XML string\n * The returned size includes the end of string character\n * Returns 1 if successful or -1 on error\n */\nint libevtx_record_get_utf16_xml_string_size(\n libevtx_record_t *record,\n size_t *utf16_string_size,\n libcerror_error_t **error )\n{\n\tlibevtx_internal_record_t *internal_record = NULL;\n\tstatic char *function = \"libevtx_record_get_utf16_xml_string_size\";\n\n\tif( record == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid record.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tinternal_record = (libevtx_internal_record_t *) record;\n\n\tif( libevtx_record_values_get_utf16_xml_string_size(\n\t internal_record->record_values,\n\t utf16_string_size,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to retrieve UTF-16 string size of event XML.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\treturn( 1 );\n}\n\n/* Retrieves the UTF-16 encoded XML string\n * The size should include the end of string character\n * Returns 1 if successful or -1 on error\n */\nint libevtx_record_get_utf16_xml_string(\n libevtx_record_t *record,\n uint16_t *utf16_string,\n size_t utf16_string_size,\n libcerror_error_t **error )\n{\n\tlibevtx_internal_record_t *internal_record = NULL;\n\tstatic char *function = \"libevtx_record_get_utf16_xml_string\";\n\n\tif( record == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid record.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tinternal_record = (libevtx_internal_record_t *) record;\n\n\tif( libevtx_record_values_get_utf16_xml_string(\n\t internal_record->record_values,\n\t utf16_string,\n\t utf16_string_size,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_COPY_FAILED,\n\t\t \"%s: unable to copy event XML to UTF-16 string.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\treturn( 1 );\n}\n\n" }, { "path": "libevtx/libevtx_record.h", "content": "/*\n * Record functions\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#if !defined( _LIBEVTX_INTERNAL_RECORD_H )\n#define _LIBEVTX_INTERNAL_RECORD_H\n\n#include \n#include \n\n#include \"libevtx_extern.h\"\n#include \"libevtx_io_handle.h\"\n#include \"libevtx_libbfio.h\"\n#include \"libevtx_libcerror.h\"\n#include \"libevtx_record_values.h\"\n#include \"libevtx_types.h\"\n\n#if defined( __cplusplus )\nextern \"C\" {\n#endif\n\ntypedef struct libevtx_internal_record libevtx_internal_record_t;\n\nstruct libevtx_internal_record\n{\n\t/* The IO handle\n\t */\n\tlibevtx_io_handle_t *io_handle;\n\n\t/* The file IO handle\n\t */\n\tlibbfio_handle_t *file_io_handle;\n\n\t/* The (event) record values\n\t */\n\tlibevtx_record_values_t *record_values;\n\n\t/* The flags\n\t */\n\tuint8_t flags;\n};\n\nint libevtx_record_initialize(\n libevtx_record_t **record,\n libevtx_io_handle_t *io_handle,\n libbfio_handle_t *file_io_handle,\n libevtx_record_values_t *record_values,\n uint8_t flags,\n libcerror_error_t **error );\n\nLIBEVTX_EXTERN \\\nint libevtx_record_free(\n libevtx_record_t **record,\n libcerror_error_t **error );\n\nLIBEVTX_EXTERN \\\nint libevtx_record_get_offset(\n libevtx_record_t *record,\n off64_t *offset,\n libcerror_error_t **error );\n\nLIBEVTX_EXTERN \\\nint libevtx_record_get_identifier(\n libevtx_record_t *record,\n uint64_t *identifier,\n libcerror_error_t **error );\n\nLIBEVTX_EXTERN \\\nint libevtx_record_get_creation_time(\n libevtx_record_t *record,\n uint64_t *filetime,\n libcerror_error_t **error );\n\nLIBEVTX_EXTERN \\\nint libevtx_record_get_written_time(\n libevtx_record_t *record,\n uint64_t *filetime,\n libcerror_error_t **error );\n\nLIBEVTX_EXTERN \\\nint libevtx_record_get_event_identifier(\n libevtx_record_t *record,\n uint32_t *event_identifier,\n libcerror_error_t **error );\n\nLIBEVTX_EXTERN \\\nint libevtx_record_get_event_identifier_qualifiers(\n libevtx_record_t *record,\n uint32_t *event_identifier_qualifiers,\n libcerror_error_t **error );\n\nLIBEVTX_EXTERN \\\nint libevtx_record_get_event_version(\n libevtx_record_t *record,\n uint8_t *event_version,\n libcerror_error_t **error );\n\nLIBEVTX_EXTERN \\\nint libevtx_record_get_event_level(\n libevtx_record_t *record,\n uint8_t *event_level,\n libcerror_error_t **error );\n\nLIBEVTX_EXTERN \\\nint libevtx_record_get_utf8_provider_identifier_size(\n libevtx_record_t *record,\n size_t *utf8_string_size,\n libcerror_error_t **error );\n\nLIBEVTX_EXTERN \\\nint libevtx_record_get_utf8_provider_identifier(\n libevtx_record_t *record,\n uint8_t *utf8_string,\n size_t utf8_string_size,\n libcerror_error_t **error );\n\nLIBEVTX_EXTERN \\\nint libevtx_record_get_utf16_provider_identifier_size(\n libevtx_record_t *record,\n size_t *utf16_string_size,\n libcerror_error_t **error );\n\nLIBEVTX_EXTERN \\\nint libevtx_record_get_utf16_provider_identifier(\n libevtx_record_t *record,\n uint16_t *utf16_string,\n size_t utf16_string_size,\n libcerror_error_t **error );\n\nLIBEVTX_EXTERN \\\nint libevtx_record_get_utf8_source_name_size(\n libevtx_record_t *record,\n size_t *utf8_string_size,\n libcerror_error_t **error );\n\nLIBEVTX_EXTERN \\\nint libevtx_record_get_utf8_source_name(\n libevtx_record_t *record,\n uint8_t *utf8_string,\n size_t utf8_string_size,\n libcerror_error_t **error );\n\nLIBEVTX_EXTERN \\\nint libevtx_record_get_utf16_source_name_size(\n libevtx_record_t *record,\n size_t *utf16_string_size,\n libcerror_error_t **error );\n\nLIBEVTX_EXTERN \\\nint libevtx_record_get_utf16_source_name(\n libevtx_record_t *record,\n uint16_t *utf16_string,\n size_t utf16_string_size,\n libcerror_error_t **error );\n\nLIBEVTX_EXTERN \\\nint libevtx_record_get_utf8_channel_name_size(\n libevtx_record_t *record,\n size_t *utf8_string_size,\n libcerror_error_t **error );\n\nLIBEVTX_EXTERN \\\nint libevtx_record_get_utf8_channel_name(\n libevtx_record_t *record,\n uint8_t *utf8_string,\n size_t utf8_string_size,\n libcerror_error_t **error );\n\nLIBEVTX_EXTERN \\\nint libevtx_record_get_utf16_channel_name_size(\n libevtx_record_t *record,\n size_t *utf16_string_size,\n libcerror_error_t **error );\n\nLIBEVTX_EXTERN \\\nint libevtx_record_get_utf16_channel_name(\n libevtx_record_t *record,\n uint16_t *utf16_string,\n size_t utf16_string_size,\n libcerror_error_t **error );\n\nLIBEVTX_EXTERN \\\nint libevtx_record_get_utf8_computer_name_size(\n libevtx_record_t *record,\n size_t *utf8_string_size,\n libcerror_error_t **error );\n\nLIBEVTX_EXTERN \\\nint libevtx_record_get_utf8_computer_name(\n libevtx_record_t *record,\n uint8_t *utf8_string,\n size_t utf8_string_size,\n libcerror_error_t **error );\n\nLIBEVTX_EXTERN \\\nint libevtx_record_get_utf16_computer_name_size(\n libevtx_record_t *record,\n size_t *utf16_string_size,\n libcerror_error_t **error );\n\nLIBEVTX_EXTERN \\\nint libevtx_record_get_utf16_computer_name(\n libevtx_record_t *record,\n uint16_t *utf16_string,\n size_t utf16_string_size,\n libcerror_error_t **error );\n\nLIBEVTX_EXTERN \\\nint libevtx_record_get_utf8_user_security_identifier_size(\n libevtx_record_t *record,\n size_t *utf8_string_size,\n libcerror_error_t **error );\n\nLIBEVTX_EXTERN \\\nint libevtx_record_get_utf8_user_security_identifier(\n libevtx_record_t *record,\n uint8_t *utf8_string,\n size_t utf8_string_size,\n libcerror_error_t **error );\n\nLIBEVTX_EXTERN \\\nint libevtx_record_get_utf16_user_security_identifier_size(\n libevtx_record_t *record,\n size_t *utf16_string_size,\n libcerror_error_t **error );\n\nLIBEVTX_EXTERN \\\nint libevtx_record_get_utf16_user_security_identifier(\n libevtx_record_t *record,\n uint16_t *utf16_string,\n size_t utf16_string_size,\n libcerror_error_t **error );\n\nLIBEVTX_EXTERN \\\nint libevtx_record_parse_data_with_template_definition(\n libevtx_record_t *record,\n libevtx_template_definition_t *template_definition,\n libcerror_error_t **error );\n\nLIBEVTX_EXTERN \\\nint libevtx_record_get_number_of_strings(\n libevtx_record_t *record,\n int *number_of_strings,\n libcerror_error_t **error );\n\nLIBEVTX_EXTERN \\\nint libevtx_record_get_utf8_string_size(\n libevtx_record_t *record,\n int string_index,\n size_t *utf8_string_size,\n libcerror_error_t **error );\n\nLIBEVTX_EXTERN \\\nint libevtx_record_get_utf8_string(\n libevtx_record_t *record,\n int string_index,\n uint8_t *utf8_string,\n size_t utf8_string_size,\n libcerror_error_t **error );\n\nLIBEVTX_EXTERN \\\nint libevtx_record_get_utf16_string_size(\n libevtx_record_t *record,\n int string_index,\n size_t *utf16_string_size,\n libcerror_error_t **error );\n\nLIBEVTX_EXTERN \\\nint libevtx_record_get_utf16_string(\n libevtx_record_t *record,\n int string_index,\n uint16_t *utf16_string,\n size_t utf16_string_size,\n libcerror_error_t **error );\n\nLIBEVTX_EXTERN \\\nint libevtx_record_get_data_size(\n libevtx_record_t *record,\n size_t *data_size,\n libcerror_error_t **error );\n\nLIBEVTX_EXTERN \\\nint libevtx_record_get_data(\n libevtx_record_t *record,\n uint8_t *data,\n size_t data_size,\n libcerror_error_t **error );\n\nLIBEVTX_EXTERN \\\nint libevtx_record_get_utf8_xml_string_size(\n libevtx_record_t *record,\n size_t *utf8_string_size,\n libcerror_error_t **error );\n\nLIBEVTX_EXTERN \\\nint libevtx_record_get_utf8_xml_string(\n libevtx_record_t *record,\n uint8_t *utf8_string,\n size_t utf8_string_size,\n libcerror_error_t **error );\n\nLIBEVTX_EXTERN \\\nint libevtx_record_get_utf16_xml_string_size(\n libevtx_record_t *record,\n size_t *utf16_string_size,\n libcerror_error_t **error );\n\nLIBEVTX_EXTERN \\\nint libevtx_record_get_utf16_xml_string(\n libevtx_record_t *record,\n uint16_t *utf16_string,\n size_t utf16_string_size,\n libcerror_error_t **error );\n\n#if defined( __cplusplus )\n}\n#endif\n\n#endif /* !defined( _LIBEVTX_INTERNAL_RECORD_H ) */\n\n" }, { "path": "libevtx/libevtx_record_values.c", "content": "/*\n * Record values functions\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#include \n#include \n#include \n#include \n#include \n\n#include \"libevtx_byte_stream.h\"\n#include \"libevtx_io_handle.h\"\n#include \"libevtx_libcerror.h\"\n#include \"libevtx_libcnotify.h\"\n#include \"libevtx_libfdatetime.h\"\n#include \"libevtx_libfwevt.h\"\n#include \"libevtx_record_values.h\"\n#include \"libevtx_template_definition.h\"\n\n#include \"evtx_event_record.h\"\n\nconst uint8_t evtx_event_record_signature[ 4 ] = { 0x2a, 0x2a, 0x00, 0x00 };\n\n/* Creates record values\n * Make sure the value record_values is referencing, is set to NULL\n * Returns 1 if successful or -1 on error\n */\nint libevtx_record_values_initialize(\n libevtx_record_values_t **record_values,\n libcerror_error_t **error )\n{\n\tstatic char *function = \"libevtx_record_values_initialize\";\n\n\tif( record_values == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid record values.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( *record_values != NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_VALUE_ALREADY_SET,\n\t\t \"%s: invalid record values value already set.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\t*record_values = memory_allocate_structure(\n\t libevtx_record_values_t );\n\n\tif( *record_values == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_MEMORY,\n\t\t LIBCERROR_MEMORY_ERROR_INSUFFICIENT,\n\t\t \"%s: unable to create record values.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tif( memory_set(\n\t *record_values,\n\t 0,\n\t sizeof( libevtx_record_values_t ) ) == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_MEMORY,\n\t\t LIBCERROR_MEMORY_ERROR_SET_FAILED,\n\t\t \"%s: unable to clear record values.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\treturn( 1 );\n\non_error:\n\tif( *record_values != NULL )\n\t{\n\t\tmemory_free(\n\t\t *record_values );\n\n\t\t*record_values = NULL;\n\t}\n\treturn( -1 );\n}\n\n/* Frees record values\n * Returns 1 if successful or -1 on error\n */\nint libevtx_record_values_free(\n libevtx_record_values_t **record_values,\n libcerror_error_t **error )\n{\n\tstatic char *function = \"libevtx_record_values_free\";\n\tint result = 1;\n\n\tif( record_values == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid record values.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( *record_values != NULL )\n\t{\n\t\tif( ( *record_values )->string_identifiers_array != NULL )\n\t\t{\n\t\t\tif( libcdata_array_free(\n\t\t\t &( ( *record_values )->string_identifiers_array ),\n\t\t\t NULL,\n\t\t\t error ) != 1 )\n\t\t\t{\n\t\t\t\tlibcerror_error_set(\n\t\t\t\t error,\n\t\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t\t LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED,\n\t\t\t\t \"%s: unable to free the string identifiers array.\",\n\t\t\t\t function );\n\n\t\t\t\tresult = -1;\n\t\t\t}\n\t\t}\n\t\tif( ( *record_values )->strings_array != NULL )\n\t\t{\n\t\t\tif( libcdata_array_free(\n\t\t\t &( ( *record_values )->strings_array ),\n\t\t\t NULL,\n\t\t\t error ) != 1 )\n\t\t\t{\n\t\t\t\tlibcerror_error_set(\n\t\t\t\t error,\n\t\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t\t LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED,\n\t\t\t\t \"%s: unable to free the strings array.\",\n\t\t\t\t function );\n\n\t\t\t\tresult = -1;\n\t\t\t}\n\t\t}\n\t\tif( ( *record_values )->xml_document != NULL )\n\t\t{\n\t\t\tif( libfwevt_xml_document_free(\n\t\t\t &( ( *record_values )->xml_document ),\n\t\t\t error ) != 1 )\n\t\t\t{\n\t\t\t\tlibcerror_error_set(\n\t\t\t\t error,\n\t\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t\t LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED,\n\t\t\t\t \"%s: unable to free XML document.\",\n\t\t\t\t function );\n\n\t\t\t\tresult = -1;\n\t\t\t}\n\t\t}\n\t\tmemory_free(\n\t\t *record_values );\n\n\t\t*record_values = NULL;\n\t}\n\treturn( result );\n}\n\n/* Clones the record values\n * Returns 1 if successful or -1 on error\n */\nint libevtx_record_values_clone(\n libevtx_record_values_t **destination_record_values,\n libevtx_record_values_t *source_record_values,\n libcerror_error_t **error )\n{\n\tstatic char *function = \"libevtx_record_values_free\";\n\n\tif( destination_record_values == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid destination record values.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( *destination_record_values != NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_VALUE_ALREADY_SET,\n\t\t \"%s: invalid destination record values value already set.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( source_record_values == NULL )\n\t{\n\t\t*destination_record_values = NULL;\n\n\t\treturn( 1 );\n\t}\n\tif( source_record_values->xml_document != NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_VALUE_ALREADY_SET,\n\t\t \"%s: invalid source record values - XML document value already set.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\t*destination_record_values = memory_allocate_structure(\n\t libevtx_record_values_t );\n\n\tif( *destination_record_values == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_MEMORY,\n\t\t LIBCERROR_MEMORY_ERROR_INSUFFICIENT,\n\t\t \"%s: unable to create destination record values.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tif( memory_copy(\n\t *destination_record_values,\n\t source_record_values,\n\t sizeof( libevtx_record_values_t ) ) == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_MEMORY,\n\t\t LIBCERROR_MEMORY_ERROR_COPY_FAILED,\n\t\t \"%s: unable to copy record values.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\t( *destination_record_values )->xml_document = NULL;\n\n\treturn( 1 );\n\non_error:\n\tif( *destination_record_values != NULL )\n\t{\n\t\tmemory_free(\n\t\t *destination_record_values );\n\n\t\t*destination_record_values = NULL;\n\t}\n\treturn( -1 );\n}\n\n/* Reads the record values header\n * Returns 1 if successful, 0 if not or -1 on error\n */\nint libevtx_record_values_read_header(\n libevtx_record_values_t *record_values,\n libevtx_io_handle_t *io_handle,\n const uint8_t *chunk_data,\n size_t chunk_data_size,\n size_t chunk_data_offset,\n libcerror_error_t **error )\n{\n\tconst uint8_t *event_record_data = NULL;\n\tstatic char *function = \"libevtx_record_values_read_header\";\n\tsize_t event_record_data_size = 0;\n\tuint32_t size_copy = 0;\n\tint result = 0;\n\n#if defined( HAVE_DEBUG_OUTPUT )\n\tsystem_character_t filetime_string[ 32 ];\n\n\tlibfdatetime_filetime_t *filetime = NULL;\n#endif\n\n\tif( record_values == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid record values.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( io_handle == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid IO handle.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( chunk_data == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid chunk data.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( chunk_data_size > (size_t) SSIZE_MAX )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_VALUE_EXCEEDS_MAXIMUM,\n\t\t \"%s: invalid chunk data size value exceeds maximum.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tif( chunk_data_offset >= chunk_data_size )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_VALUE_OUT_OF_BOUNDS,\n\t\t \"%s: invalid chunk data offset value out of bounds.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tevent_record_data = &( chunk_data[ chunk_data_offset ] );\n\tevent_record_data_size = chunk_data_size - chunk_data_offset;\n\n\tif( event_record_data_size < ( sizeof( evtx_event_record_header_t ) + 4 ) )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,\n\t\t \"%s: invalid event record data size value too small.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n#if defined( HAVE_DEBUG_OUTPUT )\n\tif( libcnotify_verbose != 0 )\n\t{\n\t\tlibcnotify_printf(\n\t\t \"%s: event record header data:\\n\",\n\t\t function );\n\t\tlibcnotify_print_data(\n\t\t event_record_data,\n\t\t sizeof( evtx_event_record_header_t ),\n\t\t 0 );\n\t}\n#endif\n\tresult = libevtx_byte_stream_check_for_zero_byte_fill(\n\t event_record_data,\n\t sizeof( evtx_event_record_header_t ),\n\t error );\n\n\tif( result == -1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to determine of event record header is 0-byte filled.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\telse if( result != 0 )\n\t{\n\t\treturn( 0 );\n\t}\n\tif( memory_compare(\n\t ( (evtx_event_record_header_t *) event_record_data )->signature,\n\t evtx_event_record_signature,\n\t 4 ) != 0 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_UNSUPPORTED_VALUE,\n\t\t \"%s: unsupported event record signature.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\trecord_values->chunk_data_offset = chunk_data_offset;\n\n\tbyte_stream_copy_to_uint32_little_endian(\n\t ( (evtx_event_record_header_t *) event_record_data )->size,\n\t record_values->data_size );\n\n\tbyte_stream_copy_to_uint64_little_endian(\n\t ( (evtx_event_record_header_t *) event_record_data )->identifier,\n\t record_values->identifier );\n\n\tbyte_stream_copy_to_uint64_little_endian(\n\t ( (evtx_event_record_header_t *) event_record_data )->written_time,\n\t record_values->written_time );\n\n#if defined( HAVE_DEBUG_OUTPUT )\n\tif( libcnotify_verbose != 0 )\n\t{\n\t\tlibcnotify_printf(\n\t\t \"%s: signature\\t\\t\\t\\t: \\\\x%02x\\\\x%02x\\\\x%02x\\\\x%02x\\n\",\n\t\t function,\n\t\t ( (evtx_event_record_header_t *) event_record_data )->signature[ 0 ],\n\t\t ( (evtx_event_record_header_t *) event_record_data )->signature[ 1 ],\n\t\t ( (evtx_event_record_header_t *) event_record_data )->signature[ 2 ] ,\n\t\t ( (evtx_event_record_header_t *) event_record_data )->signature[ 3 ] );\n\n\t\tlibcnotify_printf(\n\t\t \"%s: size\\t\\t\\t\\t\\t: %\" PRIu32 \"\\n\",\n\t\t function,\n\t\t record_values->data_size );\n\n\t\tlibcnotify_printf(\n\t\t \"%s: identifier\\t\\t\\t\\t: %\" PRIu64 \"\\n\",\n\t\t function,\n\t\t record_values->identifier );\n\n\t\tif( libfdatetime_filetime_initialize(\n\t\t &filetime,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_INITIALIZE_FAILED,\n\t\t\t \"%s: unable to create file time.\",\n\t\t\t function );\n\n\t\t\tgoto on_error;\n\t\t}\n\t\tif( libfdatetime_filetime_copy_from_byte_stream(\n\t\t filetime,\n\t\t ( (evtx_event_record_header_t *) event_record_data )->written_time,\n\t\t 8,\n\t\t LIBFDATETIME_ENDIAN_LITTLE,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_SET_FAILED,\n\t\t\t \"%s: unable to copy file time from byte stream.\",\n\t\t\t function );\n\n\t\t\tgoto on_error;\n\t\t}\n#if defined( HAVE_WIDE_SYSTEM_CHARACTER )\n\t\tresult = libfdatetime_filetime_copy_to_utf16_string(\n\t\t\t filetime,\n\t\t\t (uint16_t *) filetime_string,\n\t\t\t 32,\n\t\t\t LIBFDATETIME_STRING_FORMAT_TYPE_CTIME | LIBFDATETIME_STRING_FORMAT_FLAG_DATE_TIME_NANO_SECONDS,\n\t\t\t error );\n#else\n\t\tresult = libfdatetime_filetime_copy_to_utf8_string(\n\t\t\t filetime,\n\t\t\t (uint8_t *) filetime_string,\n\t\t\t 32,\n\t\t\t LIBFDATETIME_STRING_FORMAT_TYPE_CTIME | LIBFDATETIME_STRING_FORMAT_FLAG_DATE_TIME_NANO_SECONDS,\n\t\t\t error );\n#endif\n\t\tif( result != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_SET_FAILED,\n\t\t\t \"%s: unable to copy file time to string.\",\n\t\t\t function );\n\n\t\t\tgoto on_error;\n\t\t}\n\t\tlibcnotify_printf(\n\t\t \"%s: written time\\t\\t\\t\\t: %\" PRIs_SYSTEM \" UTC\\n\",\n\t\t function,\n\t\t filetime_string );\n\n\t\tif( libfdatetime_filetime_free(\n\t\t &filetime,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED,\n\t\t\t \"%s: unable to free file time.\",\n\t\t\t function );\n\n\t\t\tgoto on_error;\n\t\t}\n\t}\n#endif\n\tif( ( record_values->data_size < sizeof( evtx_event_record_header_t ) )\n\t || ( record_values->data_size > ( event_record_data_size - 4 ) ) )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,\n\t\t \"%s: invalid event record data size value out of bounds.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tbyte_stream_copy_to_uint32_little_endian(\n\t &( event_record_data[ record_values->data_size - 4 ] ),\n\t size_copy );\n\n#if defined( HAVE_DEBUG_OUTPUT )\n\tif( libcnotify_verbose != 0 )\n\t{\n\t\tlibcnotify_printf(\n\t\t \"%s: size copy\\t\\t\\t\\t: %\" PRIu32 \"\\n\",\n\t\t function,\n\t\t size_copy );\n\n\t\tlibcnotify_printf(\n\t\t \"\\n\" );\n\t}\n#endif\n\tif( record_values->data_size != size_copy )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_INPUT,\n\t\t LIBCERROR_INPUT_ERROR_VALUE_MISMATCH,\n\t\t \"%s: value mismatch for size and size copy.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\treturn( 1 );\n\non_error:\n#if defined( HAVE_DEBUG_OUTPUT )\n\tif( filetime != NULL )\n\t{\n\t\tlibfdatetime_filetime_free(\n\t\t &filetime,\n\t\t NULL );\n\t}\n#endif\n\treturn( -1 );\n}\n\n/* Reads the record values XML document\n * Returns 1 if successful or -1 on error\n */\nint libevtx_record_values_read_xml_document(\n libevtx_record_values_t *record_values,\n libevtx_io_handle_t *io_handle,\n const uint8_t *chunk_data,\n size_t chunk_data_size,\n libcerror_error_t **error )\n{\n\tstatic char *function = \"libevtx_record_values_read_xml_document\";\n\tsize_t chunk_data_offset = 0;\n\tsize_t event_record_data_size = 0;\n\tuint8_t flags = 0;\n\n\tif( record_values == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid record values.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( record_values->xml_document != NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_VALUE_ALREADY_SET,\n\t\t \"%s: invalid record values - XML document already set.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( io_handle == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid IO handle.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( chunk_data == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid chunk data.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( chunk_data_size > (size_t) SSIZE_MAX )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_VALUE_EXCEEDS_MAXIMUM,\n\t\t \"%s: invalid chunk data size value exceeds maximum.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tif( record_values->chunk_data_offset >= chunk_data_size )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_VALUE_OUT_OF_BOUNDS,\n\t\t \"%s: invalid record values - chunk data offset value out of bounds.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tchunk_data_offset = record_values->chunk_data_offset\n\t + sizeof( evtx_event_record_header_t );\n\tevent_record_data_size = record_values->data_size\n\t - ( sizeof( evtx_event_record_header_t ) + 4 );\n\n\tif( chunk_data_offset >= chunk_data_size )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_VALUE_OUT_OF_BOUNDS,\n\t\t \"%s: invalid chunk data offset value out of bounds.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tif( ( chunk_data_offset + event_record_data_size ) > chunk_data_size )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_VALUE_OUT_OF_BOUNDS,\n\t\t \"%s: invalid event record data size value out of bounds.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tif( libfwevt_xml_document_initialize(\n\t &( record_values->xml_document ),\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_INITIALIZE_FAILED,\n\t\t \"%s: unable to create XML document.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n#if defined( HAVE_DEBUG_OUTPUT )\n\tif( libcnotify_verbose != 0 )\n\t{\n\t\tlibcnotify_printf(\n\t\t \"%s: event record data:\\n\",\n\t\t function );\n\t\tlibcnotify_print_data(\n\t\t &( chunk_data[ chunk_data_offset ] ),\n\t\t event_record_data_size,\n\t\t 0 );\n\t}\n#endif\n\tflags = LIBFWEVT_XML_DOCUMENT_READ_FLAG_HAS_DATA_OFFSETS\n\t | LIBFWEVT_XML_DOCUMENT_READ_FLAG_HAS_DEPENDENCY_IDENTIFIERS;\n\n\tif( libfwevt_xml_document_read(\n\t record_values->xml_document,\n\t chunk_data,\n\t chunk_data_size,\n\t chunk_data_offset,\n\t io_handle->ascii_codepage,\n\t flags,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_IO,\n\t\t LIBCERROR_IO_ERROR_READ_FAILED,\n\t\t \"%s: unable to read binary XML document.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n#if defined( HAVE_DEBUG_OUTPUT )\n\tif( libcnotify_verbose != 0 )\n\t{\n\t\tlibcnotify_printf(\n\t\t \"%s: XML document:\\n\",\n\t\t function );\n\n\t\tif( libfwevt_xml_document_debug_print(\n\t\t record_values->xml_document,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_PRINT_FAILED,\n\t\t\t \"%s: unable to print XML document.\",\n\t\t\t function );\n\n\t\t\tgoto on_error;\n\t\t}\n\t}\n#endif\n\treturn( 1 );\n\non_error:\n\tif( record_values->xml_document != NULL )\n\t{\n\t\tlibfwevt_xml_document_free(\n\t\t &( record_values->xml_document ),\n\t\t NULL );\n\t}\n\treturn( -1 );\n}\n\n/* Retrieves the event identifier\n * Returns 1 if successful or -1 on error\n */\nint libevtx_record_values_get_event_identifier(\n libevtx_record_values_t *record_values,\n uint32_t *event_identifier,\n libcerror_error_t **error )\n{\n\tlibfwevt_xml_tag_t *root_xml_tag = NULL;\n\tlibfwevt_xml_tag_t *system_xml_tag = NULL;\n\tlibfwevt_xml_value_t *event_identifier_value = NULL;\n\tstatic char *function = \"libevtx_record_values_get_event_identifier\";\n\n\tif( record_values == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid record values.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( record_values->xml_document == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_VALUE_MISSING,\n\t\t \"%s: invalid record values - missing XML document.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( record_values->event_identifier_xml_tag == NULL )\n\t{\n\t\tif( libfwevt_xml_document_get_root_xml_tag(\n\t\t record_values->xml_document,\n\t\t &root_xml_tag,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve root XML element.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\tif( libfwevt_xml_tag_get_element_by_utf8_name(\n\t\t root_xml_tag,\n\t\t (uint8_t *) \"System\",\n\t\t 6,\n\t\t &system_xml_tag,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve System XML element.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\tif( libfwevt_xml_tag_get_element_by_utf8_name(\n\t\t system_xml_tag,\n\t\t (uint8_t *) \"EventID\",\n\t\t 7,\n\t\t &( record_values->event_identifier_xml_tag ),\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve EventID XML element.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t}\n\tif( libfwevt_xml_tag_get_value(\n\t record_values->event_identifier_xml_tag,\n\t &event_identifier_value,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to retrieve EventID XML element value.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( libfwevt_value_get_data_as_32bit_integer(\n\t event_identifier_value,\n\t event_identifier,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_COPY_FAILED,\n\t\t \"%s: unable to copy value to event identifier.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\treturn( 1 );\n}\n\n/* Retrieves the event identifier qualifiers\n * Returns 1 if successful, 0 if not available or -1 on error\n */\nint libevtx_record_values_get_event_identifier_qualifiers(\n libevtx_record_values_t *record_values,\n uint32_t *event_identifier_qualifiers,\n libcerror_error_t **error )\n{\n\tlibfwevt_xml_tag_t *qualifiers_xml_tag = NULL;\n\tlibfwevt_xml_tag_t *root_xml_tag = NULL;\n\tlibfwevt_xml_tag_t *system_xml_tag = NULL;\n\tlibfwevt_xml_value_t *qualifiers_value = NULL;\n\tstatic char *function = \"libevtx_record_values_get_event_identifier_qualifiers\";\n\tint result = 0;\n\n\tif( record_values == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid record values.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( record_values->xml_document == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_VALUE_MISSING,\n\t\t \"%s: invalid record values - missing XML document.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( record_values->event_identifier_xml_tag == NULL )\n\t{\n\t\tif( libfwevt_xml_document_get_root_xml_tag(\n\t\t record_values->xml_document,\n\t\t &root_xml_tag,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve root XML element.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\tif( libfwevt_xml_tag_get_element_by_utf8_name(\n\t\t root_xml_tag,\n\t\t (uint8_t *) \"System\",\n\t\t 6,\n\t\t &system_xml_tag,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve System XML element.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\tif( libfwevt_xml_tag_get_element_by_utf8_name(\n\t\t system_xml_tag,\n\t\t (uint8_t *) \"EventID\",\n\t\t 7,\n\t\t &( record_values->event_identifier_xml_tag ),\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve EventID XML element.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t}\n\tresult = libfwevt_xml_tag_get_attribute_by_utf8_name(\n\t record_values->event_identifier_xml_tag,\n\t (uint8_t *) \"Qualifiers\",\n\t 10,\n\t &qualifiers_xml_tag,\n\t error );\n\n\tif( result == -1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to retrieve Qualifiers XML attribute.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\telse if( result != 0 )\n\t{\n\t\tif( libfwevt_xml_tag_get_value(\n\t\t qualifiers_xml_tag,\n\t\t &qualifiers_value,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve Qualifiers XML element value.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\tif( qualifiers_value == NULL )\n\t\t{\n\t\t\tresult = 0;\n\t\t}\n\t\telse if( libfwevt_value_get_data_as_32bit_integer(\n\t\t qualifiers_value,\n\t\t event_identifier_qualifiers,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_COPY_FAILED,\n\t\t\t \"%s: unable to copy value to qualifiers.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t}\n\treturn( result );\n}\n\n/* Retrieves the event version\n * Returns 1 if successful, 0 if not available or -1 on error\n */\nint libevtx_record_values_get_event_version(\n libevtx_record_values_t *record_values,\n uint8_t *event_version,\n libcerror_error_t **error )\n{\n\tlibfwevt_xml_tag_t *root_xml_tag = NULL;\n\tlibfwevt_xml_tag_t *system_xml_tag = NULL;\n\tlibfwevt_xml_tag_t *version_xml_tag = NULL;\n\tstatic char *function = \"libevtx_record_values_get_event_version\";\n\tint result = 0;\n\n\tif( record_values == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid record values.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( record_values->xml_document == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_VALUE_MISSING,\n\t\t \"%s: invalid record values - missing XML document.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( record_values->version_value == NULL )\n\t{\n\t\tif( libfwevt_xml_document_get_root_xml_tag(\n\t\t record_values->xml_document,\n\t\t &root_xml_tag,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve root XML element.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\tif( libfwevt_xml_tag_get_element_by_utf8_name(\n\t\t root_xml_tag,\n\t\t (uint8_t *) \"System\",\n\t\t 6,\n\t\t &system_xml_tag,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve System XML element.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\tresult = libfwevt_xml_tag_get_element_by_utf8_name(\n\t\t system_xml_tag,\n\t\t (uint8_t *) \"Version\",\n\t\t 7,\n\t\t &version_xml_tag,\n\t\t error );\n\n\t\tif( result == -1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve Version XML element.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\telse if( result != 0 )\n\t\t{\n\t\t\tif( libfwevt_xml_tag_get_value(\n\t\t\t version_xml_tag,\n\t\t\t &( record_values->version_value ),\n\t\t\t error ) != 1 )\n\t\t\t{\n\t\t\t\tlibcerror_error_set(\n\t\t\t\t error,\n\t\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t\t \"%s: unable to retrieve Version XML element value.\",\n\t\t\t\t function );\n\n\t\t\t\treturn( -1 );\n\t\t\t}\n\t\t}\n\t}\n\tif( record_values->version_value == NULL )\n\t{\n\t\tresult = 0;\n\t}\n\telse\n\t{\n\t\tif( libfwevt_value_get_data_as_8bit_integer(\n\t\t record_values->version_value,\n\t\t event_version,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_COPY_FAILED,\n\t\t\t \"%s: unable to copy value to event version.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\tresult = 1;\n\t}\n\treturn( result );\n}\n\n/* Retrieves the 64-bit FILETIME value containing the creation time from the binary XML\n * Returns 1 if successful, 0 if not available or -1 on error\n */\nint libevtx_record_values_get_creation_time(\n libevtx_record_values_t *record_values,\n uint64_t *filetime,\n libcerror_error_t **error )\n{\n\tlibfwevt_xml_tag_t *root_xml_tag = NULL;\n\tlibfwevt_xml_tag_t *system_time_xml_tag = NULL;\n\tlibfwevt_xml_tag_t *system_xml_tag = NULL;\n\tlibfwevt_xml_tag_t *time_created_xml_tag = NULL;\n\tstatic char *function = \"libevtx_record_values_get_creation_time\";\n\tint result = 0;\n\n\tif( record_values == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid record values.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( record_values->xml_document == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_VALUE_MISSING,\n\t\t \"%s: invalid record values - missing XML document.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( record_values->time_created_value == NULL )\n\t{\n\t\tif( libfwevt_xml_document_get_root_xml_tag(\n\t\t record_values->xml_document,\n\t\t &root_xml_tag,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve root XML element.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\tresult = libfwevt_xml_tag_get_element_by_utf8_name(\n\t\t root_xml_tag,\n\t\t (uint8_t *) \"System\",\n\t\t 6,\n\t\t &system_xml_tag,\n\t\t error );\n\n\t\tif( result == -1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve System XML element.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\telse if( result == 0 )\n\t\t{\n\t\t\treturn( 0 );\n\t\t}\n\t\tresult = libfwevt_xml_tag_get_element_by_utf8_name(\n\t\t system_xml_tag,\n\t\t (uint8_t *) \"TimeCreated\",\n\t\t 11,\n\t\t &time_created_xml_tag,\n\t\t error );\n\n\t\tif( result == -1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve TimeCreated XML element.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\telse if( result == 0 )\n\t\t{\n\t\t\treturn( 0 );\n\t\t}\n\t\tresult = libfwevt_xml_tag_get_attribute_by_utf8_name(\n\t\t time_created_xml_tag,\n\t\t (uint8_t *) \"SystemTime\",\n\t\t 10,\n\t\t &system_time_xml_tag,\n\t\t error );\n\n\t\tif( result == -1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve SystemTime XML attribute.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\tif( result == 0 )\n\t\t{\n\t\t\treturn( 0 );\n\t\t}\n\t\tif( libfwevt_xml_tag_get_value(\n\t\t system_time_xml_tag,\n\t\t &( record_values->time_created_value ),\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve provider TimeCreated XML element value.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t}\n\tif( record_values->time_created_value == NULL )\n\t{\n\t\tresult = 0;\n\t}\n\telse\n\t{\n\t\tif( libfwevt_value_get_data_as_filetime(\n\t\t record_values->time_created_value,\n\t\t filetime,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_COPY_FAILED,\n\t\t\t \"%s: unable to copy TimeCreated value to FILETIME timestamp.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\tresult = 1;\n\t}\n\treturn( result );\n}\n\n/* Retrieves the 64-bit FILETIME value containing the written time from the event record header\n * Returns 1 if successful or -1 on error\n */\nint libevtx_record_values_get_written_time(\n libevtx_record_values_t *record_values,\n uint64_t *filetime,\n libcerror_error_t **error )\n{\n\tstatic char *function = \"libevtx_record_values_get_written_time\";\n\n\tif( record_values == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid record values.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( record_values->xml_document == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_VALUE_MISSING,\n\t\t \"%s: invalid record values - missing XML document.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( filetime == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid FILETIME timestamp.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\t*filetime = record_values->written_time;\n\n\treturn( 1 );\n}\n\n/* Retrieves the event level\n * Returns 1 if successful or -1 on error\n */\nint libevtx_record_values_get_event_level(\n libevtx_record_values_t *record_values,\n uint8_t *event_level,\n libcerror_error_t **error )\n{\n\tlibfwevt_xml_tag_t *level_xml_tag = NULL;\n\tlibfwevt_xml_tag_t *root_xml_tag = NULL;\n\tlibfwevt_xml_tag_t *system_xml_tag = NULL;\n\tstatic char *function = \"libevtx_record_values_get_event_level\";\n\n\tif( record_values == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid record values.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( record_values->xml_document == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_VALUE_MISSING,\n\t\t \"%s: invalid record values - missing XML document.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( record_values->level_value == NULL )\n\t{\n\t\tif( libfwevt_xml_document_get_root_xml_tag(\n\t\t record_values->xml_document,\n\t\t &root_xml_tag,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve root XML element.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\tif( libfwevt_xml_tag_get_element_by_utf8_name(\n\t\t root_xml_tag,\n\t\t (uint8_t *) \"System\",\n\t\t 6,\n\t\t &system_xml_tag,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve System XML element.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\tif( libfwevt_xml_tag_get_element_by_utf8_name(\n\t\t system_xml_tag,\n\t\t (uint8_t *) \"Level\",\n\t\t 5,\n\t\t &level_xml_tag,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve Level XML element.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\tif( libfwevt_xml_tag_get_value(\n\t\t level_xml_tag,\n\t\t &( record_values->level_value ),\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve Level XML element value.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t}\n\tif( libfwevt_value_get_data_as_8bit_integer(\n\t record_values->level_value,\n\t event_level,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_COPY_FAILED,\n\t\t \"%s: unable to copy value to event level.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\treturn( 1 );\n}\n\n/* Retrieves the size of the UTF-8 encoded provider identifier\n * The returned size includes the end of string character\n * Returns 1 if successful, 0 if not available or -1 on error\n */\nint libevtx_record_values_get_utf8_provider_identifier_size(\n libevtx_record_values_t *record_values,\n size_t *utf8_string_size,\n libcerror_error_t **error )\n{\n\tlibfwevt_xml_tag_t *provider_identifier_xml_tag = NULL;\n\tlibfwevt_xml_tag_t *root_xml_tag = NULL;\n\tlibfwevt_xml_tag_t *system_xml_tag = NULL;\n\tstatic char *function = \"libevtx_record_values_get_utf8_provider_identifier_size\";\n\tint result = 0;\n\n\tif( record_values == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid record values.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( record_values->xml_document == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_VALUE_MISSING,\n\t\t \"%s: invalid record values - missing XML document.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( record_values->provider_xml_tag == NULL )\n\t{\n\t\tif( libfwevt_xml_document_get_root_xml_tag(\n\t\t record_values->xml_document,\n\t\t &root_xml_tag,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve root XML element.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\tresult = libfwevt_xml_tag_get_element_by_utf8_name(\n\t\t root_xml_tag,\n\t\t (uint8_t *) \"System\",\n\t\t 6,\n\t\t &system_xml_tag,\n\t\t error );\n\n\t\tif( result == -1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve System XML element.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\telse if( result == 0 )\n\t\t{\n\t\t\treturn( 0 );\n\t\t}\n\t\tresult = libfwevt_xml_tag_get_element_by_utf8_name(\n\t\t system_xml_tag,\n\t\t (uint8_t *) \"Provider\",\n\t\t 8,\n\t\t &( record_values->provider_xml_tag ),\n\t\t error );\n\n\t\tif( result == -1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve Provider XML element.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\telse if( result == 0 )\n\t\t{\n\t\t\treturn( 0 );\n\t\t}\n\t}\n\tif( record_values->provider_name_value == NULL )\n\t{\n\t\tresult = libfwevt_xml_tag_get_attribute_by_utf8_name(\n\t\t record_values->provider_xml_tag,\n\t\t (uint8_t *) \"Guid\",\n\t\t 4,\n\t\t &provider_identifier_xml_tag,\n\t\t error );\n\n\t\tif( result == -1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve Guid XML attribute.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\tif( result == 0 )\n\t\t{\n\t\t\treturn( 0 );\n\t\t}\n\t\tif( libfwevt_xml_tag_get_value(\n\t\t provider_identifier_xml_tag,\n\t\t &( record_values->provider_identifier_value ),\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve provider GUID XML element value.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t}\n\tif( record_values->provider_identifier_value == NULL )\n\t{\n\t\tresult = 0;\n\t}\n\telse\n\t{\n\t\tif( libfwevt_xml_value_get_utf8_string_size(\n\t\t record_values->provider_identifier_value,\n\t\t utf8_string_size,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve UTF-8 string size of provider identifier.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\tresult = 1;\n\t}\n\treturn( result );\n}\n\n/* Retrieves the UTF-8 encoded provider identifier\n * The size should include the end of string character\n * Returns 1 if successful, 0 if not available or -1 on error\n */\nint libevtx_record_values_get_utf8_provider_identifier(\n libevtx_record_values_t *record_values,\n uint8_t *utf8_string,\n size_t utf8_string_size,\n libcerror_error_t **error )\n{\n\tlibfwevt_xml_tag_t *provider_identifier_xml_tag = NULL;\n\tlibfwevt_xml_tag_t *root_xml_tag = NULL;\n\tlibfwevt_xml_tag_t *system_xml_tag = NULL;\n\tstatic char *function = \"libevtx_record_values_get_utf8_provider_identifier\";\n\tint result = 0;\n\n\tif( record_values == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid record values.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( record_values->xml_document == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_VALUE_MISSING,\n\t\t \"%s: invalid record values - missing XML document.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( record_values->provider_xml_tag == NULL )\n\t{\n\t\tif( libfwevt_xml_document_get_root_xml_tag(\n\t\t record_values->xml_document,\n\t\t &root_xml_tag,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve root XML element.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\tresult = libfwevt_xml_tag_get_element_by_utf8_name(\n\t\t root_xml_tag,\n\t\t (uint8_t *) \"System\",\n\t\t 6,\n\t\t &system_xml_tag,\n\t\t error );\n\n\t\tif( result == -1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve System XML element.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\telse if( result == 0 )\n\t\t{\n\t\t\treturn( 0 );\n\t\t}\n\t\tresult = libfwevt_xml_tag_get_element_by_utf8_name(\n\t\t system_xml_tag,\n\t\t (uint8_t *) \"Provider\",\n\t\t 8,\n\t\t &( record_values->provider_xml_tag ),\n\t\t error );\n\n\t\tif( result == -1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve Provider XML element.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\telse if( result == 0 )\n\t\t{\n\t\t\treturn( 0 );\n\t\t}\n\t}\n\tif( record_values->provider_name_value == NULL )\n\t{\n\t\tresult = libfwevt_xml_tag_get_attribute_by_utf8_name(\n\t\t record_values->provider_xml_tag,\n\t\t (uint8_t *) \"Guid\",\n\t\t 4,\n\t\t &provider_identifier_xml_tag,\n\t\t error );\n\n\t\tif( result == -1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve Guid XML attribute.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\tif( result == 0 )\n\t\t{\n\t\t\treturn( 0 );\n\t\t}\n\t\tif( libfwevt_xml_tag_get_value(\n\t\t provider_identifier_xml_tag,\n\t\t &( record_values->provider_identifier_value ),\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve provider GUID XML element value.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t}\n\tif( record_values->provider_identifier_value == NULL )\n\t{\n\t\tresult = 0;\n\t}\n\telse\n\t{\n\t\tif( libfwevt_xml_value_copy_to_utf8_string(\n\t\t record_values->provider_identifier_value,\n\t\t utf8_string,\n\t\t utf8_string_size,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_COPY_FAILED,\n\t\t\t \"%s: unable to copy provider identifier to UTF-8 string.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\tresult = 1;\n\t}\n\treturn( result );\n}\n\n/* Retrieves the size of the UTF-16 encoded provider identifier\n * The returned size includes the end of string character\n * Returns 1 if successful, 0 if not available or -1 on error\n */\nint libevtx_record_values_get_utf16_provider_identifier_size(\n libevtx_record_values_t *record_values,\n size_t *utf16_string_size,\n libcerror_error_t **error )\n{\n\tlibfwevt_xml_tag_t *provider_identifier_xml_tag = NULL;\n\tlibfwevt_xml_tag_t *root_xml_tag = NULL;\n\tlibfwevt_xml_tag_t *system_xml_tag = NULL;\n\tstatic char *function = \"libevtx_record_values_get_utf16_provider_identifier_size\";\n\tint result = 0;\n\n\tif( record_values == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid record values.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( record_values->xml_document == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_VALUE_MISSING,\n\t\t \"%s: invalid record values - missing XML document.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( record_values->provider_xml_tag == NULL )\n\t{\n\t\tif( libfwevt_xml_document_get_root_xml_tag(\n\t\t record_values->xml_document,\n\t\t &root_xml_tag,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve root XML element.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\tresult = libfwevt_xml_tag_get_element_by_utf8_name(\n\t\t root_xml_tag,\n\t\t (uint8_t *) \"System\",\n\t\t 6,\n\t\t &system_xml_tag,\n\t\t error );\n\n\t\tif( result == -1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve System XML element.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\telse if( result == 0 )\n\t\t{\n\t\t\treturn( 0 );\n\t\t}\n\t\tresult = libfwevt_xml_tag_get_element_by_utf8_name(\n\t\t system_xml_tag,\n\t\t (uint8_t *) \"Provider\",\n\t\t 8,\n\t\t &( record_values->provider_xml_tag ),\n\t\t error );\n\n\t\tif( result == -1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve Provider XML element.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\telse if( result == 0 )\n\t\t{\n\t\t\treturn( 0 );\n\t\t}\n\t}\n\tif( record_values->provider_name_value == NULL )\n\t{\n\t\tresult = libfwevt_xml_tag_get_attribute_by_utf8_name(\n\t\t record_values->provider_xml_tag,\n\t\t (uint8_t *) \"Guid\",\n\t\t 4,\n\t\t &provider_identifier_xml_tag,\n\t\t error );\n\n\t\tif( result == -1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve Guid XML attribute.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\tif( result == 0 )\n\t\t{\n\t\t\treturn( 0 );\n\t\t}\n\t\tif( libfwevt_xml_tag_get_value(\n\t\t provider_identifier_xml_tag,\n\t\t &( record_values->provider_identifier_value ),\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve provider GUID XML element value.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t}\n\tif( record_values->provider_identifier_value == NULL )\n\t{\n\t\tresult = 0;\n\t}\n\telse\n\t{\n\t\tif( libfwevt_xml_value_get_utf16_string_size(\n\t\t record_values->provider_identifier_value,\n\t\t utf16_string_size,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve UTF-16 string size of provider identifier.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\tresult = 1;\n\t}\n\treturn( result );\n}\n\n/* Retrieves the UTF-16 encoded provider identifier\n * The size should include the end of string character\n * Returns 1 if successful, 0 if not available or -1 on error\n */\nint libevtx_record_values_get_utf16_provider_identifier(\n libevtx_record_values_t *record_values,\n uint16_t *utf16_string,\n size_t utf16_string_size,\n libcerror_error_t **error )\n{\n\tlibfwevt_xml_tag_t *provider_identifier_xml_tag = NULL;\n\tlibfwevt_xml_tag_t *root_xml_tag = NULL;\n\tlibfwevt_xml_tag_t *system_xml_tag = NULL;\n\tstatic char *function = \"libevtx_record_values_get_utf16_provider_identifier\";\n\tint result = 0;\n\n\tif( record_values == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid record values.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( record_values->xml_document == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_VALUE_MISSING,\n\t\t \"%s: invalid record values - missing XML document.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( record_values->provider_xml_tag == NULL )\n\t{\n\t\tif( libfwevt_xml_document_get_root_xml_tag(\n\t\t record_values->xml_document,\n\t\t &root_xml_tag,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve root XML element.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\tresult = libfwevt_xml_tag_get_element_by_utf8_name(\n\t\t root_xml_tag,\n\t\t (uint8_t *) \"System\",\n\t\t 6,\n\t\t &system_xml_tag,\n\t\t error );\n\n\t\tif( result == -1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve System XML element.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\telse if( result == 0 )\n\t\t{\n\t\t\treturn( 0 );\n\t\t}\n\t\tresult = libfwevt_xml_tag_get_element_by_utf8_name(\n\t\t system_xml_tag,\n\t\t (uint8_t *) \"Provider\",\n\t\t 8,\n\t\t &( record_values->provider_xml_tag ),\n\t\t error );\n\n\t\tif( result == -1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve Provider XML element.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\telse if( result == 0 )\n\t\t{\n\t\t\treturn( 0 );\n\t\t}\n\t}\n\tif( record_values->provider_name_value == NULL )\n\t{\n\t\tresult = libfwevt_xml_tag_get_attribute_by_utf8_name(\n\t\t record_values->provider_xml_tag,\n\t\t (uint8_t *) \"Guid\",\n\t\t 4,\n\t\t &provider_identifier_xml_tag,\n\t\t error );\n\n\t\tif( result == -1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve Guid XML attribute.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\tif( result == 0 )\n\t\t{\n\t\t\treturn( 0 );\n\t\t}\n\t\tif( libfwevt_xml_tag_get_value(\n\t\t provider_identifier_xml_tag,\n\t\t &( record_values->provider_identifier_value ),\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve provider GUID XML element value.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t}\n\tif( record_values->provider_identifier_value == NULL )\n\t{\n\t\tresult = 0;\n\t}\n\telse\n\t{\n\t\tif( libfwevt_xml_value_copy_to_utf16_string(\n\t\t record_values->provider_identifier_value,\n\t\t utf16_string,\n\t\t utf16_string_size,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_COPY_FAILED,\n\t\t\t \"%s: unable to copy provider identifier to UTF-16 string.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\tresult = 1;\n\t}\n\treturn( result );\n}\n\n/* Retrieves the size of the UTF-8 encoded source name\n * The returned size includes the end of string character\n * Returns 1 if successful, 0 if not available or -1 on error\n */\nint libevtx_record_values_get_utf8_source_name_size(\n libevtx_record_values_t *record_values,\n size_t *utf8_string_size,\n libcerror_error_t **error )\n{\n\tlibfwevt_xml_tag_t *provider_name_xml_tag = NULL;\n\tlibfwevt_xml_tag_t *root_xml_tag = NULL;\n\tlibfwevt_xml_tag_t *system_xml_tag = NULL;\n\tstatic char *function = \"libevtx_record_values_get_utf8_source_name_size\";\n\tint result = 0;\n\n\tif( record_values == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid record values.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( record_values->xml_document == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_VALUE_MISSING,\n\t\t \"%s: invalid record values - missing XML document.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( record_values->provider_xml_tag == NULL )\n\t{\n\t\tif( libfwevt_xml_document_get_root_xml_tag(\n\t\t record_values->xml_document,\n\t\t &root_xml_tag,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve root XML element.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\tresult = libfwevt_xml_tag_get_element_by_utf8_name(\n\t\t root_xml_tag,\n\t\t (uint8_t *) \"System\",\n\t\t 6,\n\t\t &system_xml_tag,\n\t\t error );\n\n\t\tif( result == -1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve System XML element.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\telse if( result == 0 )\n\t\t{\n\t\t\treturn( 0 );\n\t\t}\n\t\tresult = libfwevt_xml_tag_get_element_by_utf8_name(\n\t\t system_xml_tag,\n\t\t (uint8_t *) \"Provider\",\n\t\t 8,\n\t\t &( record_values->provider_xml_tag ),\n\t\t error );\n\n\t\tif( result == -1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve Provider XML element.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\telse if( result == 0 )\n\t\t{\n\t\t\treturn( 0 );\n\t\t}\n\t}\n\tif( record_values->provider_name_value == NULL )\n\t{\n\t\tresult = libfwevt_xml_tag_get_attribute_by_utf8_name(\n\t\t record_values->provider_xml_tag,\n\t\t (uint8_t *) \"EventSourceName\",\n\t\t 15,\n\t\t &provider_name_xml_tag,\n\t\t error );\n\n\t\tif( result == -1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve EventSourceName XML attribute.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\telse if( result == 0 )\n\t\t{\n\t\t\tresult = libfwevt_xml_tag_get_attribute_by_utf8_name(\n\t\t\t\t record_values->provider_xml_tag,\n\t\t\t\t (uint8_t *) \"Name\",\n\t\t\t\t 4,\n\t\t\t\t &provider_name_xml_tag,\n\t\t\t\t error );\n\n\t\t\tif( result == -1 )\n\t\t\t{\n\t\t\t\tlibcerror_error_set(\n\t\t\t\t error,\n\t\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t\t \"%s: unable to retrieve Name XML attribute.\",\n\t\t\t\t function );\n\n\t\t\t\treturn( -1 );\n\t\t\t}\n\t\t}\n\t\tif( result == 0 )\n\t\t{\n\t\t\treturn( 0 );\n\t\t}\n\t\tif( libfwevt_xml_tag_get_value(\n\t\t provider_name_xml_tag,\n\t\t &( record_values->provider_name_value ),\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve provider name XML element value.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t}\n\tif( record_values->provider_name_value == NULL )\n\t{\n\t\tresult = 0;\n\t}\n\telse\n\t{\n\t\tif( libfwevt_xml_value_get_utf8_string_size(\n\t\t record_values->provider_name_value,\n\t\t utf8_string_size,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve UTF-8 string size of provider name.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\tresult = 1;\n\t}\n\treturn( result );\n}\n\n/* Retrieves the UTF-8 encoded source name\n * The size should include the end of string character\n * Returns 1 if successful, 0 if not available or -1 on error\n */\nint libevtx_record_values_get_utf8_source_name(\n libevtx_record_values_t *record_values,\n uint8_t *utf8_string,\n size_t utf8_string_size,\n libcerror_error_t **error )\n{\n\tlibfwevt_xml_tag_t *provider_name_xml_tag = NULL;\n\tlibfwevt_xml_tag_t *root_xml_tag = NULL;\n\tlibfwevt_xml_tag_t *system_xml_tag = NULL;\n\tstatic char *function = \"libevtx_record_values_get_utf8_source_name\";\n\tint result = 0;\n\n\tif( record_values == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid record values.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( record_values->xml_document == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_VALUE_MISSING,\n\t\t \"%s: invalid record values - missing XML document.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( record_values->provider_xml_tag == NULL )\n\t{\n\t\tif( libfwevt_xml_document_get_root_xml_tag(\n\t\t record_values->xml_document,\n\t\t &root_xml_tag,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve root XML element.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\tresult = libfwevt_xml_tag_get_element_by_utf8_name(\n\t\t root_xml_tag,\n\t\t (uint8_t *) \"System\",\n\t\t 6,\n\t\t &system_xml_tag,\n\t\t error );\n\n\t\tif( result == -1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve System XML element.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\telse if( result == 0 )\n\t\t{\n\t\t\treturn( 0 );\n\t\t}\n\t\tresult = libfwevt_xml_tag_get_element_by_utf8_name(\n\t\t system_xml_tag,\n\t\t (uint8_t *) \"Provider\",\n\t\t 8,\n\t\t &( record_values->provider_xml_tag ),\n\t\t error );\n\n\t\tif( result == -1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve Provider XML element.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\telse if( result == 0 )\n\t\t{\n\t\t\treturn( 0 );\n\t\t}\n\t}\n\tif( record_values->provider_name_value == NULL )\n\t{\n\t\tresult = libfwevt_xml_tag_get_attribute_by_utf8_name(\n\t\t record_values->provider_xml_tag,\n\t\t (uint8_t *) \"EventSourceName\",\n\t\t 15,\n\t\t &provider_name_xml_tag,\n\t\t error );\n\n\t\tif( result == -1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve EventSourceName XML attribute.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\telse if( result == 0 )\n\t\t{\n\t\t\tresult = libfwevt_xml_tag_get_attribute_by_utf8_name(\n\t\t\t\t record_values->provider_xml_tag,\n\t\t\t\t (uint8_t *) \"Name\",\n\t\t\t\t 4,\n\t\t\t\t &provider_name_xml_tag,\n\t\t\t\t error );\n\n\t\t\tif( result == -1 )\n\t\t\t{\n\t\t\t\tlibcerror_error_set(\n\t\t\t\t error,\n\t\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t\t \"%s: unable to retrieve Name XML attribute.\",\n\t\t\t\t function );\n\n\t\t\t\treturn( -1 );\n\t\t\t}\n\t\t}\n\t\tif( result == 0 )\n\t\t{\n\t\t\treturn( 0 );\n\t\t}\n\t\tif( libfwevt_xml_tag_get_value(\n\t\t provider_name_xml_tag,\n\t\t &( record_values->provider_name_value ),\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve provider name XML element value.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t}\n\tif( record_values->provider_name_value == NULL )\n\t{\n\t\tresult = 0;\n\t}\n\telse\n\t{\n\t\tif( libfwevt_xml_value_copy_to_utf8_string(\n\t\t record_values->provider_name_value,\n\t\t utf8_string,\n\t\t utf8_string_size,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_COPY_FAILED,\n\t\t\t \"%s: unable to copy provider name to UTF-8 string.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\tresult = 1;\n\t}\n\treturn( result );\n}\n\n/* Retrieves the size of the UTF-16 encoded source name\n * The returned size includes the end of string character\n * Returns 1 if successful, 0 if not available or -1 on error\n */\nint libevtx_record_values_get_utf16_source_name_size(\n libevtx_record_values_t *record_values,\n size_t *utf16_string_size,\n libcerror_error_t **error )\n{\n\tlibfwevt_xml_tag_t *provider_name_xml_tag = NULL;\n\tlibfwevt_xml_tag_t *root_xml_tag = NULL;\n\tlibfwevt_xml_tag_t *system_xml_tag = NULL;\n\tstatic char *function = \"libevtx_record_values_get_utf16_source_name_size\";\n\tint result = 0;\n\n\tif( record_values == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid record values.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( record_values->xml_document == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_VALUE_MISSING,\n\t\t \"%s: invalid record values - missing XML document.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( record_values->provider_xml_tag == NULL )\n\t{\n\t\tif( libfwevt_xml_document_get_root_xml_tag(\n\t\t record_values->xml_document,\n\t\t &root_xml_tag,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve root XML element.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\tresult = libfwevt_xml_tag_get_element_by_utf8_name(\n\t\t root_xml_tag,\n\t\t (uint8_t *) \"System\",\n\t\t 6,\n\t\t &system_xml_tag,\n\t\t error );\n\n\t\tif( result == -1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve System XML element.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\telse if( result == 0 )\n\t\t{\n\t\t\treturn( 0 );\n\t\t}\n\t\tresult = libfwevt_xml_tag_get_element_by_utf8_name(\n\t\t system_xml_tag,\n\t\t (uint8_t *) \"Provider\",\n\t\t 8,\n\t\t &( record_values->provider_xml_tag ),\n\t\t error );\n\n\t\tif( result == -1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve Provider XML element.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\telse if( result == 0 )\n\t\t{\n\t\t\treturn( 0 );\n\t\t}\n\t}\n\tif( record_values->provider_name_value == NULL )\n\t{\n\t\tresult = libfwevt_xml_tag_get_attribute_by_utf8_name(\n\t\t record_values->provider_xml_tag,\n\t\t (uint8_t *) \"EventSourceName\",\n\t\t 15,\n\t\t &provider_name_xml_tag,\n\t\t error );\n\n\t\tif( result == -1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve EventSourceName XML attribute.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\telse if( result == 0 )\n\t\t{\n\t\t\tresult = libfwevt_xml_tag_get_attribute_by_utf8_name(\n\t\t\t\t record_values->provider_xml_tag,\n\t\t\t\t (uint8_t *) \"Name\",\n\t\t\t\t 4,\n\t\t\t\t &provider_name_xml_tag,\n\t\t\t\t error );\n\n\t\t\tif( result == -1 )\n\t\t\t{\n\t\t\t\tlibcerror_error_set(\n\t\t\t\t error,\n\t\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t\t \"%s: unable to retrieve Name XML attribute.\",\n\t\t\t\t function );\n\n\t\t\t\treturn( -1 );\n\t\t\t}\n\t\t}\n\t\tif( result == 0 )\n\t\t{\n\t\t\treturn( 0 );\n\t\t}\n\t\tif( libfwevt_xml_tag_get_value(\n\t\t provider_name_xml_tag,\n\t\t &( record_values->provider_name_value ),\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve provider name XML element value.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t}\n\tif( record_values->provider_name_value == NULL )\n\t{\n\t\tresult = 0;\n\t}\n\telse\n\t{\n\t\tif( libfwevt_xml_value_get_utf16_string_size(\n\t\t record_values->provider_name_value,\n\t\t utf16_string_size,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve UTF-16 string size of provider name.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\tresult = 1;\n\t}\n\treturn( result );\n}\n\n/* Retrieves the UTF-16 encoded source name\n * The size should include the end of string character\n * Returns 1 if successful, 0 if not available or -1 on error\n */\nint libevtx_record_values_get_utf16_source_name(\n libevtx_record_values_t *record_values,\n uint16_t *utf16_string,\n size_t utf16_string_size,\n libcerror_error_t **error )\n{\n\tlibfwevt_xml_tag_t *provider_name_xml_tag = NULL;\n\tlibfwevt_xml_tag_t *root_xml_tag = NULL;\n\tlibfwevt_xml_tag_t *system_xml_tag = NULL;\n\tstatic char *function = \"libevtx_record_values_get_utf16_source_name\";\n\tint result = 0;\n\n\tif( record_values == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid record values.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( record_values->xml_document == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_VALUE_MISSING,\n\t\t \"%s: invalid record values - missing XML document.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( record_values->provider_xml_tag == NULL )\n\t{\n\t\tif( libfwevt_xml_document_get_root_xml_tag(\n\t\t record_values->xml_document,\n\t\t &root_xml_tag,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve root XML element.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\tresult = libfwevt_xml_tag_get_element_by_utf8_name(\n\t\t root_xml_tag,\n\t\t (uint8_t *) \"System\",\n\t\t 6,\n\t\t &system_xml_tag,\n\t\t error );\n\n\t\tif( result == -1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve System XML element.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\telse if( result == 0 )\n\t\t{\n\t\t\treturn( 0 );\n\t\t}\n\t\tresult = libfwevt_xml_tag_get_element_by_utf8_name(\n\t\t system_xml_tag,\n\t\t (uint8_t *) \"Provider\",\n\t\t 8,\n\t\t &( record_values->provider_xml_tag ),\n\t\t error );\n\n\t\tif( result == -1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve Provider XML element.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\telse if( result == 0 )\n\t\t{\n\t\t\treturn( 0 );\n\t\t}\n\t}\n\tif( record_values->provider_name_value == NULL )\n\t{\n\t\tresult = libfwevt_xml_tag_get_attribute_by_utf8_name(\n\t\t record_values->provider_xml_tag,\n\t\t (uint8_t *) \"EventSourceName\",\n\t\t 15,\n\t\t &provider_name_xml_tag,\n\t\t error );\n\n\t\tif( result == -1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve EventSourceName XML attribute.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\telse if( result == 0 )\n\t\t{\n\t\t\tresult = libfwevt_xml_tag_get_attribute_by_utf8_name(\n\t\t\t\t record_values->provider_xml_tag,\n\t\t\t\t (uint8_t *) \"Name\",\n\t\t\t\t 4,\n\t\t\t\t &provider_name_xml_tag,\n\t\t\t\t error );\n\n\t\t\tif( result == -1 )\n\t\t\t{\n\t\t\t\tlibcerror_error_set(\n\t\t\t\t error,\n\t\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t\t \"%s: unable to retrieve Name XML attribute.\",\n\t\t\t\t function );\n\n\t\t\t\treturn( -1 );\n\t\t\t}\n\t\t}\n\t\tif( result == 0 )\n\t\t{\n\t\t\treturn( 0 );\n\t\t}\n\t\tif( libfwevt_xml_tag_get_value(\n\t\t provider_name_xml_tag,\n\t\t &( record_values->provider_name_value ),\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve provider name XML element value.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t}\n\tif( record_values->provider_name_value == NULL )\n\t{\n\t\tresult = 0;\n\t}\n\telse\n\t{\n\t\tif( libfwevt_xml_value_copy_to_utf16_string(\n\t\t record_values->provider_name_value,\n\t\t utf16_string,\n\t\t utf16_string_size,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_COPY_FAILED,\n\t\t\t \"%s: unable to copy provider name to UTF-16 string.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\tresult = 1;\n\t}\n\treturn( result );\n}\n\n/* Retrieves the size of the UTF-8 encoded channel name\n * The returned size includes the end of string character\n * Returns 1 if successful, 0 if not available or -1 on error\n */\nint libevtx_record_values_get_utf8_channel_name_size(\n libevtx_record_values_t *record_values,\n size_t *utf8_string_size,\n libcerror_error_t **error )\n{\n\tlibfwevt_xml_tag_t *channel_xml_tag = NULL;\n\tlibfwevt_xml_tag_t *root_xml_tag = NULL;\n\tlibfwevt_xml_tag_t *system_xml_tag = NULL;\n\tstatic char *function = \"libevtx_record_values_get_utf8_channel_name_size\";\n\tint result = 0;\n\n\tif( record_values == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid record values.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( record_values->xml_document == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_VALUE_MISSING,\n\t\t \"%s: invalid record values - missing XML document.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( record_values->channel_value == NULL )\n\t{\n\t\tif( libfwevt_xml_document_get_root_xml_tag(\n\t\t record_values->xml_document,\n\t\t &root_xml_tag,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve root XML element.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\tresult = libfwevt_xml_tag_get_element_by_utf8_name(\n\t\t root_xml_tag,\n\t\t (uint8_t *) \"System\",\n\t\t 6,\n\t\t &system_xml_tag,\n\t\t error );\n\n\t\tif( result == -1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve System XML element.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\telse if( result == 0 )\n\t\t{\n\t\t\treturn( 0 );\n\t\t}\n\t\tresult = libfwevt_xml_tag_get_element_by_utf8_name(\n\t\t system_xml_tag,\n\t\t (uint8_t *) \"Channel\",\n\t\t 7,\n\t\t &channel_xml_tag,\n\t\t error );\n\n\t\tif( result == -1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve Channel XML element.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\telse if( result == 0 )\n\t\t{\n\t\t\treturn( 0 );\n\t\t}\n\t\tif( libfwevt_xml_tag_get_value(\n\t\t channel_xml_tag,\n\t\t &( record_values->channel_value ),\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve Channel XML element value.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t}\n\tif( record_values->channel_value == NULL )\n\t{\n\t\tresult = 0;\n\t}\n\telse\n\t{\n\t\tif( libfwevt_xml_value_get_utf8_string_size(\n\t\t record_values->channel_value,\n\t\t utf8_string_size,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve UTF-8 string size of channel name.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\tresult = 1;\n\t}\n\treturn( result );\n}\n\n/* Retrieves the UTF-8 encoded channel name\n * The size should include the end of string character\n * Returns 1 if successful, 0 if not available or -1 on error\n */\nint libevtx_record_values_get_utf8_channel_name(\n libevtx_record_values_t *record_values,\n uint8_t *utf8_string,\n size_t utf8_string_size,\n libcerror_error_t **error )\n{\n\tlibfwevt_xml_tag_t *channel_xml_tag = NULL;\n\tlibfwevt_xml_tag_t *root_xml_tag = NULL;\n\tlibfwevt_xml_tag_t *system_xml_tag = NULL;\n\tstatic char *function = \"libevtx_record_values_get_utf8_channel_name\";\n\tint result = 0;\n\n\tif( record_values == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid record values.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( record_values->xml_document == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_VALUE_MISSING,\n\t\t \"%s: invalid record values - missing XML document.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( record_values->channel_value == NULL )\n\t{\n\t\tif( libfwevt_xml_document_get_root_xml_tag(\n\t\t record_values->xml_document,\n\t\t &root_xml_tag,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve root XML element.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\tresult = libfwevt_xml_tag_get_element_by_utf8_name(\n\t\t root_xml_tag,\n\t\t (uint8_t *) \"System\",\n\t\t 6,\n\t\t &system_xml_tag,\n\t\t error );\n\n\t\tif( result == -1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve System XML element.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\telse if( result == 0 )\n\t\t{\n\t\t\treturn( 0 );\n\t\t}\n\t\tresult = libfwevt_xml_tag_get_element_by_utf8_name(\n\t\t system_xml_tag,\n\t\t (uint8_t *) \"Channel\",\n\t\t 7,\n\t\t &channel_xml_tag,\n\t\t error );\n\n\t\tif( result == -1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve Channel XML element.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\telse if( result == 0 )\n\t\t{\n\t\t\treturn( 0 );\n\t\t}\n\t\tif( libfwevt_xml_tag_get_value(\n\t\t channel_xml_tag,\n\t\t &( record_values->channel_value ),\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve Channel XML element value.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t}\n\tif( record_values->channel_value == NULL )\n\t{\n\t\tresult = 0;\n\t}\n\telse\n\t{\n\t\tif( libfwevt_xml_value_copy_to_utf8_string(\n\t\t record_values->channel_value,\n\t\t utf8_string,\n\t\t utf8_string_size,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_COPY_FAILED,\n\t\t\t \"%s: unable to copy channel name to UTF-8 string.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\tresult = 1;\n\t}\n\treturn( result );\n}\n\n/* Retrieves the size of the UTF-16 encoded channel name\n * The returned size includes the end of string character\n * Returns 1 if successful, 0 if not available or -1 on error\n */\nint libevtx_record_values_get_utf16_channel_name_size(\n libevtx_record_values_t *record_values,\n size_t *utf16_string_size,\n libcerror_error_t **error )\n{\n\tlibfwevt_xml_tag_t *channel_xml_tag = NULL;\n\tlibfwevt_xml_tag_t *root_xml_tag = NULL;\n\tlibfwevt_xml_tag_t *system_xml_tag = NULL;\n\tstatic char *function = \"libevtx_record_values_get_utf16_channel_name_size\";\n\tint result = 0;\n\n\tif( record_values == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid record values.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( record_values->xml_document == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_VALUE_MISSING,\n\t\t \"%s: invalid record values - missing XML document.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( record_values->channel_value == NULL )\n\t{\n\t\tif( libfwevt_xml_document_get_root_xml_tag(\n\t\t record_values->xml_document,\n\t\t &root_xml_tag,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve root XML element.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\tresult = libfwevt_xml_tag_get_element_by_utf8_name(\n\t\t root_xml_tag,\n\t\t (uint8_t *) \"System\",\n\t\t 6,\n\t\t &system_xml_tag,\n\t\t error );\n\n\t\tif( result == -1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve System XML element.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\telse if( result == 0 )\n\t\t{\n\t\t\treturn( 0 );\n\t\t}\n\t\tresult = libfwevt_xml_tag_get_element_by_utf8_name(\n\t\t system_xml_tag,\n\t\t (uint8_t *) \"Channel\",\n\t\t 7,\n\t\t &channel_xml_tag,\n\t\t error );\n\n\t\tif( result == -1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve Channel XML element.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\telse if( result == 0 )\n\t\t{\n\t\t\treturn( 0 );\n\t\t}\n\t\tif( libfwevt_xml_tag_get_value(\n\t\t channel_xml_tag,\n\t\t &( record_values->channel_value ),\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve Channel XML element value.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t}\n\tif( record_values->channel_value == NULL )\n\t{\n\t\tresult = 0;\n\t}\n\telse\n\t{\n\t\tif( libfwevt_xml_value_get_utf16_string_size(\n\t\t record_values->channel_value,\n\t\t utf16_string_size,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve UTF-16 string size of channel name.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\tresult = 1;\n\t}\n\treturn( result );\n}\n\n/* Retrieves the UTF-16 encoded channel name\n * The size should include the end of string character\n * Returns 1 if successful, 0 if not available or -1 on error\n */\nint libevtx_record_values_get_utf16_channel_name(\n libevtx_record_values_t *record_values,\n uint16_t *utf16_string,\n size_t utf16_string_size,\n libcerror_error_t **error )\n{\n\tlibfwevt_xml_tag_t *channel_xml_tag = NULL;\n\tlibfwevt_xml_tag_t *root_xml_tag = NULL;\n\tlibfwevt_xml_tag_t *system_xml_tag = NULL;\n\tstatic char *function = \"libevtx_record_values_get_utf16_channel_name\";\n\tint result = 0;\n\n\tif( record_values == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid record values.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( record_values->xml_document == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_VALUE_MISSING,\n\t\t \"%s: invalid record values - missing XML document.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( record_values->channel_value == NULL )\n\t{\n\t\tif( libfwevt_xml_document_get_root_xml_tag(\n\t\t record_values->xml_document,\n\t\t &root_xml_tag,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve root XML element.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\tresult = libfwevt_xml_tag_get_element_by_utf8_name(\n\t\t root_xml_tag,\n\t\t (uint8_t *) \"System\",\n\t\t 6,\n\t\t &system_xml_tag,\n\t\t error );\n\n\t\tif( result == -1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve System XML element.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\telse if( result == 0 )\n\t\t{\n\t\t\treturn( 0 );\n\t\t}\n\t\tresult = libfwevt_xml_tag_get_element_by_utf8_name(\n\t\t system_xml_tag,\n\t\t (uint8_t *) \"Channel\",\n\t\t 7,\n\t\t &channel_xml_tag,\n\t\t error );\n\n\t\tif( result == -1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve Channel XML element.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\telse if( result == 0 )\n\t\t{\n\t\t\treturn( 0 );\n\t\t}\n\t\tif( libfwevt_xml_tag_get_value(\n\t\t channel_xml_tag,\n\t\t &( record_values->channel_value ),\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve Channel XML element value.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t}\n\tif( record_values->channel_value == NULL )\n\t{\n\t\tresult = 0;\n\t}\n\telse\n\t{\n\t\tif( libfwevt_xml_value_copy_to_utf16_string(\n\t\t record_values->channel_value,\n\t\t utf16_string,\n\t\t utf16_string_size,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_COPY_FAILED,\n\t\t\t \"%s: unable to copy channel name to UTF-16 string.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\tresult = 1;\n\t}\n\treturn( result );\n}\n\n/* Retrieves the size of the UTF-8 encoded computer name\n * The returned size includes the end of string character\n * Returns 1 if successful, 0 if not available or -1 on error\n */\nint libevtx_record_values_get_utf8_computer_name_size(\n libevtx_record_values_t *record_values,\n size_t *utf8_string_size,\n libcerror_error_t **error )\n{\n\tlibfwevt_xml_tag_t *computer_xml_tag = NULL;\n\tlibfwevt_xml_tag_t *root_xml_tag = NULL;\n\tlibfwevt_xml_tag_t *system_xml_tag = NULL;\n\tstatic char *function = \"libevtx_record_values_get_utf8_computer_name_size\";\n\tint result = 0;\n\n\tif( record_values == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid record values.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( record_values->xml_document == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_VALUE_MISSING,\n\t\t \"%s: invalid record values - missing XML document.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( record_values->computer_value == NULL )\n\t{\n\t\tif( libfwevt_xml_document_get_root_xml_tag(\n\t\t record_values->xml_document,\n\t\t &root_xml_tag,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve root XML element.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\tresult = libfwevt_xml_tag_get_element_by_utf8_name(\n\t\t root_xml_tag,\n\t\t (uint8_t *) \"System\",\n\t\t 6,\n\t\t &system_xml_tag,\n\t\t error );\n\n\t\tif( result == -1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve System XML element.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\telse if( result == 0 )\n\t\t{\n\t\t\treturn( 0 );\n\t\t}\n\t\tresult = libfwevt_xml_tag_get_element_by_utf8_name(\n\t\t system_xml_tag,\n\t\t (uint8_t *) \"Computer\",\n\t\t 8,\n\t\t &computer_xml_tag,\n\t\t error );\n\n\t\tif( result == -1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve Computer XML element.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\telse if( result == 0 )\n\t\t{\n\t\t\treturn( 0 );\n\t\t}\n\t\tif( libfwevt_xml_tag_get_value(\n\t\t computer_xml_tag,\n\t\t &( record_values->computer_value ),\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve Computer XML element value.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t}\n\tif( record_values->computer_value == NULL )\n\t{\n\t\tresult = 0;\n\t}\n\telse\n\t{\n\t\tif( libfwevt_xml_value_get_utf8_string_size(\n\t\t record_values->computer_value,\n\t\t utf8_string_size,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve UTF-8 string size of computer name.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\tresult = 1;\n\t}\n\treturn( result );\n}\n\n/* Retrieves the UTF-8 encoded computer name\n * The size should include the end of string character\n * Returns 1 if successful, 0 if not available or -1 on error\n */\nint libevtx_record_values_get_utf8_computer_name(\n libevtx_record_values_t *record_values,\n uint8_t *utf8_string,\n size_t utf8_string_size,\n libcerror_error_t **error )\n{\n\tlibfwevt_xml_tag_t *computer_xml_tag = NULL;\n\tlibfwevt_xml_tag_t *root_xml_tag = NULL;\n\tlibfwevt_xml_tag_t *system_xml_tag = NULL;\n\tstatic char *function = \"libevtx_record_values_get_utf8_computer_name\";\n\tint result = 0;\n\n\tif( record_values == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid record values.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( record_values->xml_document == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_VALUE_MISSING,\n\t\t \"%s: invalid record values - missing XML document.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( record_values->computer_value == NULL )\n\t{\n\t\tif( libfwevt_xml_document_get_root_xml_tag(\n\t\t record_values->xml_document,\n\t\t &root_xml_tag,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve root XML element.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\tresult = libfwevt_xml_tag_get_element_by_utf8_name(\n\t\t root_xml_tag,\n\t\t (uint8_t *) \"System\",\n\t\t 6,\n\t\t &system_xml_tag,\n\t\t error );\n\n\t\tif( result == -1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve System XML element.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\telse if( result == 0 )\n\t\t{\n\t\t\treturn( 0 );\n\t\t}\n\t\tresult = libfwevt_xml_tag_get_element_by_utf8_name(\n\t\t system_xml_tag,\n\t\t (uint8_t *) \"Computer\",\n\t\t 8,\n\t\t &computer_xml_tag,\n\t\t error );\n\n\t\tif( result == -1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve Computer XML element.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\telse if( result == 0 )\n\t\t{\n\t\t\treturn( 0 );\n\t\t}\n\t\tif( libfwevt_xml_tag_get_value(\n\t\t computer_xml_tag,\n\t\t &( record_values->computer_value ),\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve Computer XML element value.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t}\n\tif( record_values->computer_value == NULL )\n\t{\n\t\tresult = 0;\n\t}\n\telse\n\t{\n\t\tif( libfwevt_xml_value_copy_to_utf8_string(\n\t\t record_values->computer_value,\n\t\t utf8_string,\n\t\t utf8_string_size,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_COPY_FAILED,\n\t\t\t \"%s: unable to copy computer name to UTF-8 string.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\tresult = 1;\n\t}\n\treturn( result );\n}\n\n/* Retrieves the size of the UTF-16 encoded computer name\n * The returned size includes the end of string character\n * Returns 1 if successful, 0 if not available or -1 on error\n */\nint libevtx_record_values_get_utf16_computer_name_size(\n libevtx_record_values_t *record_values,\n size_t *utf16_string_size,\n libcerror_error_t **error )\n{\n\tlibfwevt_xml_tag_t *computer_xml_tag = NULL;\n\tlibfwevt_xml_tag_t *root_xml_tag = NULL;\n\tlibfwevt_xml_tag_t *system_xml_tag = NULL;\n\tstatic char *function = \"libevtx_record_values_get_utf16_computer_name_size\";\n\tint result = 0;\n\n\tif( record_values == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid record values.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( record_values->xml_document == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_VALUE_MISSING,\n\t\t \"%s: invalid record values - missing XML document.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( record_values->computer_value == NULL )\n\t{\n\t\tif( libfwevt_xml_document_get_root_xml_tag(\n\t\t record_values->xml_document,\n\t\t &root_xml_tag,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve root XML element.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\tresult = libfwevt_xml_tag_get_element_by_utf8_name(\n\t\t root_xml_tag,\n\t\t (uint8_t *) \"System\",\n\t\t 6,\n\t\t &system_xml_tag,\n\t\t error );\n\n\t\tif( result == -1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve System XML element.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\telse if( result == 0 )\n\t\t{\n\t\t\treturn( 0 );\n\t\t}\n\t\tresult = libfwevt_xml_tag_get_element_by_utf8_name(\n\t\t system_xml_tag,\n\t\t (uint8_t *) \"Computer\",\n\t\t 8,\n\t\t &computer_xml_tag,\n\t\t error );\n\n\t\tif( result == -1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve Computer XML element.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\telse if( result == 0 )\n\t\t{\n\t\t\treturn( 0 );\n\t\t}\n\t\tif( libfwevt_xml_tag_get_value(\n\t\t computer_xml_tag,\n\t\t &( record_values->computer_value ),\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve Computer XML element value.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t}\n\tif( record_values->computer_value == NULL )\n\t{\n\t\tresult = 0;\n\t}\n\telse\n\t{\n\t\tif( libfwevt_xml_value_get_utf16_string_size(\n\t\t record_values->computer_value,\n\t\t utf16_string_size,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve UTF-16 string size of computer name.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\tresult = 1;\n\t}\n\treturn( result );\n}\n\n/* Retrieves the UTF-16 encoded computer name\n * The size should include the end of string character\n * Returns 1 if successful, 0 if not available or -1 on error\n */\nint libevtx_record_values_get_utf16_computer_name(\n libevtx_record_values_t *record_values,\n uint16_t *utf16_string,\n size_t utf16_string_size,\n libcerror_error_t **error )\n{\n\tlibfwevt_xml_tag_t *computer_xml_tag = NULL;\n\tlibfwevt_xml_tag_t *root_xml_tag = NULL;\n\tlibfwevt_xml_tag_t *system_xml_tag = NULL;\n\tstatic char *function = \"libevtx_record_values_get_utf16_computer_name\";\n\tint result = 0;\n\n\tif( record_values == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid record values.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( record_values->xml_document == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_VALUE_MISSING,\n\t\t \"%s: invalid record values - missing XML document.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( record_values->computer_value == NULL )\n\t{\n\t\tif( libfwevt_xml_document_get_root_xml_tag(\n\t\t record_values->xml_document,\n\t\t &root_xml_tag,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve root XML element.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\tresult = libfwevt_xml_tag_get_element_by_utf8_name(\n\t\t root_xml_tag,\n\t\t (uint8_t *) \"System\",\n\t\t 6,\n\t\t &system_xml_tag,\n\t\t error );\n\n\t\tif( result == -1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve System XML element.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\telse if( result == 0 )\n\t\t{\n\t\t\treturn( 0 );\n\t\t}\n\t\tresult = libfwevt_xml_tag_get_element_by_utf8_name(\n\t\t system_xml_tag,\n\t\t (uint8_t *) \"Computer\",\n\t\t 8,\n\t\t &computer_xml_tag,\n\t\t error );\n\n\t\tif( result == -1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve Computer XML element.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\telse if( result == 0 )\n\t\t{\n\t\t\treturn( 0 );\n\t\t}\n\t\tif( libfwevt_xml_tag_get_value(\n\t\t computer_xml_tag,\n\t\t &( record_values->computer_value ),\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve Computer XML element value.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t}\n\tif( record_values->computer_value == NULL )\n\t{\n\t\tresult = 0;\n\t}\n\telse\n\t{\n\t\tif( libfwevt_xml_value_copy_to_utf16_string(\n\t\t record_values->computer_value,\n\t\t utf16_string,\n\t\t utf16_string_size,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_COPY_FAILED,\n\t\t\t \"%s: unable to copy computer name to UTF-16 string.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\tresult = 1;\n\t}\n\treturn( result );\n}\n\n/* Retrieves the size of the UTF-8 encoded user security identifier\n * The returned size includes the end of string character\n * Returns 1 if successful, 0 if not available or -1 on error\n */\nint libevtx_record_values_get_utf8_user_security_identifier_size(\n libevtx_record_values_t *record_values,\n size_t *utf8_string_size,\n libcerror_error_t **error )\n{\n\tlibfwevt_xml_tag_t *root_xml_tag = NULL;\n\tlibfwevt_xml_tag_t *security_xml_tag = NULL;\n\tlibfwevt_xml_tag_t *system_xml_tag = NULL;\n\tlibfwevt_xml_tag_t *user_id_xml_tag = NULL;\n\tstatic char *function = \"libevtx_record_values_get_utf8_user_security_identifier_size\";\n\tint result = 0;\n\n\tif( record_values == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid record values.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( record_values->xml_document == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_VALUE_MISSING,\n\t\t \"%s: invalid record values - missing XML document.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( record_values->user_security_identifier_value == NULL )\n\t{\n\t\tif( libfwevt_xml_document_get_root_xml_tag(\n\t\t record_values->xml_document,\n\t\t &root_xml_tag,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve root XML element.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\tresult = libfwevt_xml_tag_get_element_by_utf8_name(\n\t\t root_xml_tag,\n\t\t (uint8_t *) \"System\",\n\t\t 6,\n\t\t &system_xml_tag,\n\t\t error );\n\n\t\tif( result == -1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve System XML element.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\telse if( result == 0 )\n\t\t{\n\t\t\treturn( 0 );\n\t\t}\n\t\tresult = libfwevt_xml_tag_get_element_by_utf8_name(\n\t\t system_xml_tag,\n\t\t (uint8_t *) \"Security\",\n\t\t 8,\n\t\t &security_xml_tag,\n\t\t error );\n\n\t\tif( result == -1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve Security XML element.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\telse if( result == 0 )\n\t\t{\n\t\t\treturn( 0 );\n\t\t}\n\t\tresult = libfwevt_xml_tag_get_attribute_by_utf8_name(\n\t\t security_xml_tag,\n\t\t (uint8_t *) \"UserID\",\n\t\t 6,\n\t\t &user_id_xml_tag,\n\t\t error );\n\n\t\tif( result == -1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve UserID XML attribute.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\telse if( result == 0 )\n\t\t{\n\t\t\treturn( 0 );\n\t\t}\n\t\tif( libfwevt_xml_tag_get_value(\n\t\t user_id_xml_tag,\n\t\t &( record_values->user_security_identifier_value ),\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve user identifier XML element value.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t}\n\tif( record_values->user_security_identifier_value == NULL )\n\t{\n\t\tresult = 0;\n\t}\n\telse\n\t{\n\t\tif( libfwevt_xml_value_get_utf8_string_size(\n\t\t record_values->user_security_identifier_value,\n\t\t utf8_string_size,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve UTF-8 string size of user security identifier.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\tresult = 1;\n\t}\n\treturn( result );\n}\n\n/* Retrieves the UTF-8 encoded user security identifier\n * The size should include the end of string character\n * Returns 1 if successful, 0 if not available or -1 on error\n */\nint libevtx_record_values_get_utf8_user_security_identifier(\n libevtx_record_values_t *record_values,\n uint8_t *utf8_string,\n size_t utf8_string_size,\n libcerror_error_t **error )\n{\n\tlibfwevt_xml_tag_t *root_xml_tag = NULL;\n\tlibfwevt_xml_tag_t *security_xml_tag = NULL;\n\tlibfwevt_xml_tag_t *system_xml_tag = NULL;\n\tlibfwevt_xml_tag_t *user_id_xml_tag = NULL;\n\tstatic char *function = \"libevtx_record_values_get_utf8_user_security_identifier\";\n\tint result = 0;\n\n\tif( record_values == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid record values.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( record_values->xml_document == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_VALUE_MISSING,\n\t\t \"%s: invalid record values - missing XML document.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( record_values->user_security_identifier_value == NULL )\n\t{\n\t\tif( libfwevt_xml_document_get_root_xml_tag(\n\t\t record_values->xml_document,\n\t\t &root_xml_tag,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve root XML element.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\tresult = libfwevt_xml_tag_get_element_by_utf8_name(\n\t\t root_xml_tag,\n\t\t (uint8_t *) \"System\",\n\t\t 6,\n\t\t &system_xml_tag,\n\t\t error );\n\n\t\tif( result == -1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve System XML element.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\telse if( result == 0 )\n\t\t{\n\t\t\treturn( 0 );\n\t\t}\n\t\tresult = libfwevt_xml_tag_get_element_by_utf8_name(\n\t\t system_xml_tag,\n\t\t (uint8_t *) \"Security\",\n\t\t 8,\n\t\t &security_xml_tag,\n\t\t error );\n\n\t\tif( result == -1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve Security XML element.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\telse if( result == 0 )\n\t\t{\n\t\t\treturn( 0 );\n\t\t}\n\t\tresult = libfwevt_xml_tag_get_attribute_by_utf8_name(\n\t\t security_xml_tag,\n\t\t (uint8_t *) \"UserID\",\n\t\t 6,\n\t\t &user_id_xml_tag,\n\t\t error );\n\n\t\tif( result == -1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve UserID XML attribute.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\telse if( result == 0 )\n\t\t{\n\t\t\treturn( 0 );\n\t\t}\n\t\tif( libfwevt_xml_tag_get_value(\n\t\t user_id_xml_tag,\n\t\t &( record_values->user_security_identifier_value ),\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve user identifier XML element value.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t}\n\tif( record_values->user_security_identifier_value == NULL )\n\t{\n\t\tresult = 0;\n\t}\n\telse\n\t{\n\t\tif( libfwevt_xml_value_copy_to_utf8_string(\n\t\t record_values->user_security_identifier_value,\n\t\t utf8_string,\n\t\t utf8_string_size,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_COPY_FAILED,\n\t\t\t \"%s: unable to copy user security identifier to UTF-8 string.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\tresult = 1;\n\t}\n\treturn( result );\n}\n\n/* Retrieves the size of the UTF-16 encoded user security identifier\n * The returned size includes the end of string character\n * Returns 1 if successful, 0 if not available or -1 on error\n */\nint libevtx_record_values_get_utf16_user_security_identifier_size(\n libevtx_record_values_t *record_values,\n size_t *utf16_string_size,\n libcerror_error_t **error )\n{\n\tlibfwevt_xml_tag_t *root_xml_tag = NULL;\n\tlibfwevt_xml_tag_t *security_xml_tag = NULL;\n\tlibfwevt_xml_tag_t *system_xml_tag = NULL;\n\tlibfwevt_xml_tag_t *user_id_xml_tag = NULL;\n\tstatic char *function = \"libevtx_record_values_get_utf16_user_security_identifier_size\";\n\tint result = 0;\n\n\tif( record_values == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid record values.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( record_values->xml_document == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_VALUE_MISSING,\n\t\t \"%s: invalid record values - missing XML document.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( record_values->user_security_identifier_value == NULL )\n\t{\n\t\tif( libfwevt_xml_document_get_root_xml_tag(\n\t\t record_values->xml_document,\n\t\t &root_xml_tag,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve root XML element.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\tresult = libfwevt_xml_tag_get_element_by_utf8_name(\n\t\t root_xml_tag,\n\t\t (uint8_t *) \"System\",\n\t\t 6,\n\t\t &system_xml_tag,\n\t\t error );\n\n\t\tif( result == -1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve System XML element.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\telse if( result == 0 )\n\t\t{\n\t\t\treturn( 0 );\n\t\t}\n\t\tresult = libfwevt_xml_tag_get_element_by_utf8_name(\n\t\t system_xml_tag,\n\t\t (uint8_t *) \"Security\",\n\t\t 8,\n\t\t &security_xml_tag,\n\t\t error );\n\n\t\tif( result == -1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve Security XML element.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\telse if( result == 0 )\n\t\t{\n\t\t\treturn( 0 );\n\t\t}\n\t\tresult = libfwevt_xml_tag_get_attribute_by_utf8_name(\n\t\t security_xml_tag,\n\t\t (uint8_t *) \"UserID\",\n\t\t 6,\n\t\t &user_id_xml_tag,\n\t\t error );\n\n\t\tif( result == -1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve UserID XML attribute.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\telse if( result == 0 )\n\t\t{\n\t\t\treturn( 0 );\n\t\t}\n\t\tif( libfwevt_xml_tag_get_value(\n\t\t user_id_xml_tag,\n\t\t &( record_values->user_security_identifier_value ),\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve user identifier XML element value.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t}\n\tif( record_values->user_security_identifier_value == NULL )\n\t{\n\t\tresult = 0;\n\t}\n\telse\n\t{\n\t\tif( libfwevt_xml_value_get_utf16_string_size(\n\t\t record_values->user_security_identifier_value,\n\t\t utf16_string_size,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve UTF-16 string size of user security identifier.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\tresult = 1;\n\t}\n\treturn( result );\n}\n\n/* Retrieves the UTF-16 encoded user security identifier\n * The size should include the end of string character\n * Returns 1 if successful, 0 if not available or -1 on error\n */\nint libevtx_record_values_get_utf16_user_security_identifier(\n libevtx_record_values_t *record_values,\n uint16_t *utf16_string,\n size_t utf16_string_size,\n libcerror_error_t **error )\n{\n\tlibfwevt_xml_tag_t *root_xml_tag = NULL;\n\tlibfwevt_xml_tag_t *security_xml_tag = NULL;\n\tlibfwevt_xml_tag_t *system_xml_tag = NULL;\n\tlibfwevt_xml_tag_t *user_id_xml_tag = NULL;\n\tstatic char *function = \"libevtx_record_values_get_utf16_user_security_identifier\";\n\tint result = 0;\n\n\tif( record_values == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid record values.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( record_values->xml_document == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_VALUE_MISSING,\n\t\t \"%s: invalid record values - missing XML document.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( record_values->user_security_identifier_value == NULL )\n\t{\n\t\tif( libfwevt_xml_document_get_root_xml_tag(\n\t\t record_values->xml_document,\n\t\t &root_xml_tag,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve root XML element.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\tresult = libfwevt_xml_tag_get_element_by_utf8_name(\n\t\t root_xml_tag,\n\t\t (uint8_t *) \"System\",\n\t\t 6,\n\t\t &system_xml_tag,\n\t\t error );\n\n\t\tif( result == -1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve System XML element.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\telse if( result == 0 )\n\t\t{\n\t\t\treturn( 0 );\n\t\t}\n\t\tresult = libfwevt_xml_tag_get_element_by_utf8_name(\n\t\t system_xml_tag,\n\t\t (uint8_t *) \"Security\",\n\t\t 8,\n\t\t &security_xml_tag,\n\t\t error );\n\n\t\tif( result == -1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve Security XML element.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\telse if( result == 0 )\n\t\t{\n\t\t\treturn( 0 );\n\t\t}\n\t\tresult = libfwevt_xml_tag_get_attribute_by_utf8_name(\n\t\t security_xml_tag,\n\t\t (uint8_t *) \"UserID\",\n\t\t 6,\n\t\t &user_id_xml_tag,\n\t\t error );\n\n\t\tif( result == -1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve UserID XML attribute.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\telse if( result == 0 )\n\t\t{\n\t\t\treturn( 0 );\n\t\t}\n\t\tif( libfwevt_xml_tag_get_value(\n\t\t user_id_xml_tag,\n\t\t &( record_values->user_security_identifier_value ),\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve user identifier XML element value.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t}\n\tif( record_values->user_security_identifier_value == NULL )\n\t{\n\t\tresult = 0;\n\t}\n\telse\n\t{\n\t\tif( libfwevt_xml_value_copy_to_utf16_string(\n\t\t record_values->user_security_identifier_value,\n\t\t utf16_string,\n\t\t utf16_string_size,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_COPY_FAILED,\n\t\t\t \"%s: unable to copy user security identifier to UTF-16 string.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\tresult = 1;\n\t}\n\treturn( result );\n}\n\n/* Parses a data XML tag for the record values using the template\n * Returns 1 if successful, 0 if data could not be parsed or -1 on error\n */\nint libevtx_record_values_parse_data_xml_tag_by_template(\n libevtx_record_values_t *record_values,\n libfwevt_xml_tag_t *data_xml_tag,\n libfwevt_xml_tag_t *template_xml_tag,\n libcerror_error_t **error )\n{\n\tlibfwevt_xml_tag_t *sub_data_xml_tag = NULL;\n\tlibfwevt_xml_tag_t *sub_template_xml_tag = NULL;\n\tuint8_t *data_name = NULL;\n\tuint8_t *template_name = NULL;\n\tstatic char *function = \"libevtx_record_values_parse_data_xml_tag_by_template\";\n\tsize_t data_name_size = 0;\n\tsize_t template_name_size = 0;\n\tuint8_t template_xml_tag_flags = 0;\n\tint attribute_index = 0;\n\tint entry_index = 0;\n\tint sub_element_index = 0;\n\tint number_of_data_attributes = 0;\n\tint number_of_data_elements = 0;\n\tint number_of_template_attributes = 0;\n\tint number_of_template_elements = 0;\n\tint result = 0;\n\n\tif( record_values == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid record values.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( libfwevt_xml_tag_get_number_of_attributes(\n\t data_xml_tag,\n\t &number_of_data_attributes,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to retrieve number of data attributes.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tif( template_xml_tag != NULL )\n\t{\n\t\tif( libfwevt_xml_tag_get_number_of_attributes(\n\t\t template_xml_tag,\n\t\t &number_of_template_attributes,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve number of template attributes.\",\n\t\t\t function );\n\n\t\t\tgoto on_error;\n\t\t}\n\t\tif( number_of_data_attributes != number_of_template_attributes )\n\t\t{\n\t\t\treturn( 0 );\n\t\t}\n\t}\n\tif( libfwevt_xml_tag_get_number_of_elements(\n\t data_xml_tag,\n\t &number_of_data_elements,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to retrieve number of data elements.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tif( template_xml_tag != NULL )\n\t{\n\t\tif( libfwevt_xml_tag_get_number_of_elements(\n\t\t template_xml_tag,\n\t\t &number_of_template_elements,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve number of template elements.\",\n\t\t\t function );\n\n\t\t\tgoto on_error;\n\t\t}\n\t\tif( number_of_data_elements != number_of_template_elements )\n\t\t{\n\t\t\treturn( 0 );\n\t\t}\n\t}\n\tif( template_xml_tag != NULL )\n\t{\n\t\tif( libfwevt_xml_tag_get_utf8_name_size(\n\t\t data_xml_tag,\n\t\t &data_name_size,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve data element name size.\",\n\t\t\t function );\n\n\t\t\tgoto on_error;\n\t\t}\n\t\tif( libfwevt_xml_tag_get_utf8_name_size(\n\t\t template_xml_tag,\n\t\t &template_name_size,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve template element name size.\",\n\t\t\t function );\n\n\t\t\tgoto on_error;\n\t\t}\n\t\tif( data_name_size != template_name_size )\n\t\t{\n\t\t\treturn( 0 );\n\t\t}\n\t\tif( ( data_name_size == 0 )\n\t\t || ( data_name_size > (size_t) MEMORY_MAXIMUM_ALLOCATION_SIZE ) )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,\n\t\t\t \"%s: invalid data name size value out of bounds.\",\n\t\t\t function );\n\n\t\t\tgoto on_error;\n\t\t}\n\t\tdata_name = (uint8_t *) memory_allocate(\n\t\t sizeof( uint8_t ) * data_name_size );\n\n\t\tif( data_name == NULL )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_MEMORY,\n\t\t\t LIBCERROR_MEMORY_ERROR_INSUFFICIENT,\n\t\t\t \"%s: unable to create data name.\",\n\t\t\t function );\n\n\t\t\tgoto on_error;\n\t\t}\n\t\ttemplate_name = (uint8_t *) memory_allocate(\n\t\t sizeof( uint8_t ) * template_name_size );\n\n\t\tif( template_name == NULL )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_MEMORY,\n\t\t\t LIBCERROR_MEMORY_ERROR_INSUFFICIENT,\n\t\t\t \"%s: unable to create template name.\",\n\t\t\t function );\n\n\t\t\tgoto on_error;\n\t\t}\n\t\tif( libfwevt_xml_tag_get_utf8_name(\n\t\t data_xml_tag,\n\t\t data_name,\n\t\t data_name_size,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve data element name.\",\n\t\t\t function );\n\n\t\t\tgoto on_error;\n\t\t}\n\t\tif( libfwevt_xml_tag_get_utf8_name(\n\t\t template_xml_tag,\n\t\t template_name,\n\t\t template_name_size,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve template element name.\",\n\t\t\t function );\n\n\t\t\tgoto on_error;\n\t\t}\n\t\tresult = memory_compare(\n\t\t\t data_name,\n\t\t\t template_name,\n\t\t\t sizeof( uint8_t ) * template_name_size );\n\n\t\tmemory_free(\n\t\t template_name );\n\n\t\ttemplate_name = NULL;\n\n\t\tmemory_free(\n\t\t data_name );\n\n\t\tdata_name = NULL;\n\n\t\tif( result != 0 )\n\t\t{\n\t\t\treturn( 0 );\n\t\t}\n\t}\n\tfor( attribute_index = 0;\n\t attribute_index < number_of_data_attributes;\n\t attribute_index++ )\n\t{\n\t\tif( libfwevt_xml_tag_get_attribute_by_index(\n\t\t data_xml_tag,\n\t\t attribute_index,\n\t\t &sub_data_xml_tag,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve data attribute: %d.\",\n\t\t\t function,\n\t\t\t attribute_index );\n\n\t\t\tgoto on_error;\n\t\t}\n\t\tif( template_xml_tag != NULL )\n\t\t{\n\t\t\tif( libfwevt_xml_tag_get_attribute_by_index(\n\t\t\t template_xml_tag,\n\t\t\t attribute_index,\n\t\t\t &sub_template_xml_tag,\n\t\t\t error ) != 1 )\n\t\t\t{\n\t\t\t\tlibcerror_error_set(\n\t\t\t\t error,\n\t\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t\t \"%s: unable to retrieve template attribute: %d.\",\n\t\t\t\t function,\n\t\t\t\t attribute_index );\n\n\t\t\t\tgoto on_error;\n\t\t\t}\n\t\t}\n\t\tresult = libevtx_record_values_parse_data_xml_tag_by_template(\n\t\t record_values,\n\t\t sub_data_xml_tag,\n\t\t sub_template_xml_tag,\n\t\t error );\n\n\t\tif( result == -1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to parse event data attribute: %d XML tag.\",\n\t\t\t function,\n\t\t\t attribute_index );\n\n\t\t\tgoto on_error;\n\t\t}\n\t}\n\tif( number_of_data_elements == 0 )\n\t{\n\t\tif( template_xml_tag != NULL )\n\t\t{\n\t\t\tif( libfwevt_xml_tag_get_flags(\n\t\t\t template_xml_tag,\n\t\t\t &template_xml_tag_flags,\n\t\t\t error ) != 1 )\n\t\t\t{\n\t\t\t\tlibcerror_error_set(\n\t\t\t\t error,\n\t\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t\t \"%s: unable to retrieve template XML tag flags.\",\n\t\t\t\t function );\n\n\t\t\t\tgoto on_error;\n\t\t\t}\n\t\t}\n\t\telse\n\t\t{\n\t\t\tif( libfwevt_xml_tag_get_flags(\n\t\t\t data_xml_tag,\n\t\t\t &template_xml_tag_flags,\n\t\t\t error ) != 1 )\n\t\t\t{\n\t\t\t\tlibcerror_error_set(\n\t\t\t\t error,\n\t\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t\t \"%s: unable to retrieve element XML tag flags.\",\n\t\t\t\t function );\n\n\t\t\t\tgoto on_error;\n\t\t\t}\n\t\t}\n\t\tif( template_xml_tag_flags == LIBFWEVT_XML_TAG_FLAG_IS_TEMPLATE_DEFINITION )\n\t\t{\n\t\t\tif( libcdata_array_append_entry(\n\t\t\t record_values->string_identifiers_array,\n\t\t\t &entry_index,\n\t\t\t (intptr_t *) template_xml_tag,\n\t\t\t error ) != 1 )\n\t\t\t{\n\t\t\t\tlibcerror_error_set(\n\t\t\t\t error,\n\t\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t\t LIBCERROR_RUNTIME_ERROR_APPEND_FAILED,\n\t\t\t\t \"%s: unable to append template XML tag to string identifiers array.\",\n\t\t\t\t function );\n\n\t\t\t\tgoto on_error;\n\t\t\t}\n\t\t\tif( libcdata_array_append_entry(\n\t\t\t record_values->strings_array,\n\t\t\t &entry_index,\n\t\t\t (intptr_t *) data_xml_tag,\n\t\t\t error ) != 1 )\n\t\t\t{\n\t\t\t\tlibcerror_error_set(\n\t\t\t\t error,\n\t\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t\t LIBCERROR_RUNTIME_ERROR_APPEND_FAILED,\n\t\t\t\t \"%s: unable to append data XML tag to strings array.\",\n\t\t\t\t function );\n\n\t\t\t\tgoto on_error;\n\t\t\t}\n\t\t}\n\t}\n\telse for( sub_element_index = 0;\n\t sub_element_index < number_of_data_elements;\n\t sub_element_index++ )\n\t{\n\t\tif( libfwevt_xml_tag_get_element_by_index(\n\t\t data_xml_tag,\n\t\t sub_element_index,\n\t\t &sub_data_xml_tag,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve data sub element: %d.\",\n\t\t\t function,\n\t\t\t sub_element_index );\n\n\t\t\tgoto on_error;\n\t\t}\n\t\tif( template_xml_tag != NULL )\n\t\t{\n\t\t\tif( libfwevt_xml_tag_get_element_by_index(\n\t\t\t template_xml_tag,\n\t\t\t sub_element_index,\n\t\t\t &sub_template_xml_tag,\n\t\t\t error ) != 1 )\n\t\t\t{\n\t\t\t\tlibcerror_error_set(\n\t\t\t\t error,\n\t\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t\t \"%s: unable to retrieve template sub element: %d.\",\n\t\t\t\t function,\n\t\t\t\t sub_element_index );\n\n\t\t\t\tgoto on_error;\n\t\t\t}\n\t\t}\n\t\tresult = libevtx_record_values_parse_data_xml_tag_by_template(\n\t\t record_values,\n\t\t sub_data_xml_tag,\n\t\t sub_template_xml_tag,\n\t\t error );\n\n\t\tif( result == -1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to parse event data sub element: %d XML tag.\",\n\t\t\t function,\n\t\t\t sub_element_index );\n\n\t\t\tgoto on_error;\n\t\t}\n\t}\n\treturn( 1 );\n\non_error:\n\tif( template_name != NULL )\n\t{\n\t\tmemory_free(\n\t\t template_name );\n\t}\n\tif( data_name != NULL )\n\t{\n\t\tmemory_free(\n\t\t data_name );\n\t}\n\treturn( -1 );\n}\n\n/* Parses the record values data\n * Returns 1 if successful, 0 if data could not be parsed or -1 on error\n */\nint libevtx_record_values_parse_data(\n libevtx_record_values_t *record_values,\n libevtx_io_handle_t *io_handle,\n libevtx_internal_template_definition_t *internal_template_definition,\n libcerror_error_t **error )\n{\n\tlibfwevt_xml_tag_t *element_xml_tag = NULL;\n\tlibfwevt_xml_tag_t *event_data_xml_tag = NULL;\n\tlibfwevt_xml_tag_t *root_xml_tag = NULL;\n\tlibfwevt_xml_tag_t *template_root_xml_tag = NULL;\n\tlibfwevt_xml_tag_t *user_data_xml_tag = NULL;\n\tstatic char *function = \"libevtx_record_values_parse_data\";\n\tint number_of_elements = 0;\n\tint result = 0;\n\n\tif( record_values == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid record values.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( record_values->data_parsed != 0 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_VALUE_ALREADY_SET,\n\t\t \"%s: invalid record values - data already parsed.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( record_values->string_identifiers_array != NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_VALUE_ALREADY_SET,\n\t\t \"%s: invalid record values - string identifiers array value already set.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( record_values->strings_array != NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_VALUE_ALREADY_SET,\n\t\t \"%s: invalid record values - strings array value already set.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( libcdata_array_initialize(\n\t &( record_values->string_identifiers_array ),\n\t 0,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_INITIALIZE_FAILED,\n\t\t \"%s: unable to create string identifiers array.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tif( libcdata_array_initialize(\n\t &( record_values->strings_array ),\n\t 0,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_INITIALIZE_FAILED,\n\t\t \"%s: unable to create strings array.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tif( internal_template_definition != NULL )\n\t{\n\t\tif( internal_template_definition->xml_document == NULL )\n\t\t{\n\t\t\tif( libevtx_template_definition_read(\n\t\t\t internal_template_definition,\n\t\t\t io_handle,\n\t\t\t error ) != 1 )\n\t\t\t{\n\t\t\t\tlibcerror_error_set(\n\t\t\t\t error,\n\t\t\t\t LIBCERROR_ERROR_DOMAIN_IO,\n\t\t\t\t LIBCERROR_IO_ERROR_READ_FAILED,\n\t\t\t\t \"%s: unable to read template definition.\",\n\t\t\t\t function );\n\n\t\t\t\tgoto on_error;\n\t\t\t}\n\t\t}\n\t\tif( libfwevt_xml_document_get_root_xml_tag(\n\t\t internal_template_definition->xml_document,\n\t\t &template_root_xml_tag,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve template root XML element.\",\n\t\t\t function );\n\n\t\t\tgoto on_error;\n\t\t}\n\t}\n\tif( libfwevt_xml_document_get_root_xml_tag(\n\t record_values->xml_document,\n\t &root_xml_tag,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to retrieve root XML element.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tresult = libfwevt_xml_tag_get_element_by_utf8_name(\n\t\t root_xml_tag,\n\t\t (uint8_t *) \"EventData\",\n\t\t 9,\n\t\t &event_data_xml_tag,\n\t\t error );\n\n\tif( result == -1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to retrieve EventData XML element.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\telse if( result == 0 )\n\t{\n\t\tresult = libfwevt_xml_tag_get_element_by_utf8_name(\n\t\t\t root_xml_tag,\n\t\t\t (uint8_t *) \"ProcessingErrorData\",\n\t\t\t 19,\n\t\t\t &event_data_xml_tag,\n\t\t\t error );\n\n\t\tif( result == -1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve ProcessingErrorData XML element.\",\n\t\t\t function );\n\n\t\t\tgoto on_error;\n\t\t}\n\t}\n\tif( result != 0 )\n\t{\n\t\t/* The EventData templates start with the EventData or ProcessingErrorData\n\t\t */\n\t\tresult = libevtx_record_values_parse_data_xml_tag_by_template(\n\t\t\t record_values,\n\t\t\t event_data_xml_tag,\n\t\t\t template_root_xml_tag,\n\t\t\t error );\n\n\t\tif( result == -1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to parse event data root element.\",\n\t\t\t function );\n\n\t\t\tgoto on_error;\n\t\t}\n\t}\n\telse\n\t{\n\t\tresult = libfwevt_xml_tag_get_element_by_utf8_name(\n\t\t\t root_xml_tag,\n\t\t\t (uint8_t *) \"UserData\",\n\t\t\t 8,\n\t\t\t &user_data_xml_tag,\n\t\t\t error );\n\n\t\tif( result == -1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve UserData XML element.\",\n\t\t\t function );\n\n\t\t\tgoto on_error;\n\t\t}\n\t\telse if( result != 0 )\n\t\t{\n\t\t\tresult = 0;\n\n\t\t\t/* The UserData templates start with the EventXML tag\n\t\t\t */\n\t\t\tif( libfwevt_xml_tag_get_number_of_elements(\n\t\t\t user_data_xml_tag,\n\t\t\t &number_of_elements,\n\t\t\t error ) != 1 )\n\t\t\t{\n\t\t\t\tlibcerror_error_set(\n\t\t\t\t error,\n\t\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t\t \"%s: unable to retrieve number of user data elements.\",\n\t\t\t\t function );\n\n\t\t\t\tgoto on_error;\n\t\t\t}\n\t\t\tif( number_of_elements == 1 )\n\t\t\t{\n\t\t\t\tif( libfwevt_xml_tag_get_element_by_index(\n\t\t\t\t user_data_xml_tag,\n\t\t\t\t 0,\n\t\t\t\t &element_xml_tag,\n\t\t\t\t error ) != 1 )\n\t\t\t\t{\n\t\t\t\t\tlibcerror_error_set(\n\t\t\t\t\t error,\n\t\t\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t\t\t \"%s: unable to retrieve user data element: 0.\",\n\t\t\t\t\t function );\n\n\t\t\t\t\tgoto on_error;\n\t\t\t\t}\n\t\t\t\tresult = libevtx_record_values_parse_data_xml_tag_by_template(\n\t\t\t\t\t record_values,\n\t\t\t\t\t element_xml_tag,\n\t\t\t\t\t template_root_xml_tag,\n\t\t\t\t\t error );\n\n\t\t\t\tif( result == -1 )\n\t\t\t\t{\n\t\t\t\t\tlibcerror_error_set(\n\t\t\t\t\t error,\n\t\t\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t\t\t \"%s: unable to parse user data element: 0.\",\n\t\t\t\t\t function );\n\n\t\t\t\t\tgoto on_error;\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t}\n\trecord_values->data_parsed = 1;\n\n\treturn( result );\n\non_error:\n\tif( record_values->strings_array != NULL )\n\t{\n\t\tlibcdata_array_free(\n\t\t &( record_values->strings_array ),\n\t\t NULL,\n\t\t NULL );\n\t}\n\tif( record_values->string_identifiers_array != NULL )\n\t{\n\t\tlibcdata_array_free(\n\t\t &( record_values->string_identifiers_array ),\n\t\t NULL,\n\t\t NULL );\n\t}\n\treturn( -1 );\n}\n\n/* Retrieves the number of strings\n * Returns 1 if successful or -1 on error\n */\nint libevtx_record_values_get_number_of_strings(\n libevtx_record_values_t *record_values,\n libevtx_io_handle_t *io_handle,\n int *number_of_strings,\n libcerror_error_t **error )\n{\n\tstatic char *function = \"libevtx_record_values_get_number_of_strings\";\n\n\tif( record_values == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid record values.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( record_values->xml_document == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_VALUE_MISSING,\n\t\t \"%s: invalid record values - missing XML document.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( record_values->data_parsed == 0 )\n\t{\n\t\tif( libevtx_record_values_parse_data(\n\t\t record_values,\n\t\t io_handle,\n\t\t NULL,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GENERIC,\n\t\t\t \"%s: unable to parse data.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t}\n\tif( libcdata_array_get_number_of_entries(\n\t record_values->strings_array,\n\t number_of_strings,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to retrieve number of strings.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\treturn( 1 );\n}\n\n/* Retrieves the size of a specific UTF-8 encoded string\n * The returned size includes the end of string character\n * Returns 1 if successful or -1 on error\n */\nint libevtx_record_values_get_utf8_string_size(\n libevtx_record_values_t *record_values,\n libevtx_io_handle_t *io_handle,\n int string_index,\n size_t *utf8_string_size,\n libcerror_error_t **error )\n{\n\tlibfwevt_xml_tag_t *string_xml_tag = NULL;\n\tlibfwevt_xml_value_t *string_xml_value = NULL;\n\tstatic char *function = \"libevtx_record_values_get_utf8_string_size\";\n\n\tif( record_values == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid record values.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( record_values->xml_document == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_VALUE_MISSING,\n\t\t \"%s: invalid record values - missing XML document.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( record_values->data_parsed == 0 )\n\t{\n\t\tif( libevtx_record_values_parse_data(\n\t\t record_values,\n\t\t io_handle,\n\t\t NULL,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GENERIC,\n\t\t\t \"%s: unable to parse data.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t}\n\tif( libcdata_array_get_entry_by_index(\n\t record_values->strings_array,\n\t string_index,\n\t (intptr_t **) &string_xml_tag,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to retrieve string: %d.\",\n\t\t function,\n\t\t string_index );\n\n\t\treturn( -1 );\n\t}\n\tif( libfwevt_xml_tag_get_value(\n\t string_xml_tag,\n\t &string_xml_value,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to retrieve string: %d value.\",\n\t\t function,\n\t\t string_index );\n\n\t\treturn( -1 );\n\t}\n/* TODO if string_xml_value == NULL return 0 */\n\tif( libfwevt_xml_value_get_utf8_string_size(\n\t string_xml_value,\n\t utf8_string_size,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to retrieve string: %d value size.\",\n\t\t function,\n\t\t string_index );\n\n\t\treturn( -1 );\n\t}\n\treturn( 1 );\n}\n\n/* Retrieves a specific UTF-8 encoded string\n * The size should include the end of string character\n * Returns 1 if successful or -1 on error\n */\nint libevtx_record_values_get_utf8_string(\n libevtx_record_values_t *record_values,\n libevtx_io_handle_t *io_handle,\n int string_index,\n uint8_t *utf8_string,\n size_t utf8_string_size,\n libcerror_error_t **error )\n{\n\tlibfwevt_xml_tag_t *string_xml_tag = NULL;\n\tlibfwevt_xml_value_t *string_xml_value = NULL;\n\tstatic char *function = \"libevtx_record_values_get_utf8_string\";\n\n\tif( record_values == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid record values.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( record_values->xml_document == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_VALUE_MISSING,\n\t\t \"%s: invalid record values - missing XML document.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( record_values->data_parsed == 0 )\n\t{\n\t\tif( libevtx_record_values_parse_data(\n\t\t record_values,\n\t\t io_handle,\n\t\t NULL,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GENERIC,\n\t\t\t \"%s: unable to parse data.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t}\n\tif( libcdata_array_get_entry_by_index(\n\t record_values->strings_array,\n\t string_index,\n\t (intptr_t **) &string_xml_tag,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to retrieve string: %d.\",\n\t\t function,\n\t\t string_index );\n\n\t\treturn( -1 );\n\t}\n\tif( libfwevt_xml_tag_get_value(\n\t string_xml_tag,\n\t &string_xml_value,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to retrieve string: %d value.\",\n\t\t function,\n\t\t string_index );\n\n\t\treturn( -1 );\n\t}\n\tif( libfwevt_xml_value_copy_to_utf8_string(\n\t string_xml_value,\n\t utf8_string,\n\t utf8_string_size,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to retrieve string: %d value.\",\n\t\t function,\n\t\t string_index );\n\n\t\treturn( -1 );\n\t}\n\treturn( 1 );\n}\n\n/* Retrieves the size of a specific UTF-16 encoded string\n * The returned size includes the end of string character\n * Returns 1 if successful or -1 on error\n */\nint libevtx_record_values_get_utf16_string_size(\n libevtx_record_values_t *record_values,\n libevtx_io_handle_t *io_handle,\n int string_index,\n size_t *utf16_string_size,\n libcerror_error_t **error )\n{\n\tlibfwevt_xml_tag_t *string_xml_tag = NULL;\n\tlibfwevt_xml_value_t *string_xml_value = NULL;\n\tstatic char *function = \"libevtx_record_values_get_utf16_string_size\";\n\n\tif( record_values == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid record values.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( record_values->xml_document == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_VALUE_MISSING,\n\t\t \"%s: invalid record values - missing XML document.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( record_values->data_parsed == 0 )\n\t{\n\t\tif( libevtx_record_values_parse_data(\n\t\t record_values,\n\t\t io_handle,\n\t\t NULL,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GENERIC,\n\t\t\t \"%s: unable to parse data.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t}\n\tif( libcdata_array_get_entry_by_index(\n\t record_values->strings_array,\n\t string_index,\n\t (intptr_t **) &string_xml_tag,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to retrieve string: %d.\",\n\t\t function,\n\t\t string_index );\n\n\t\treturn( -1 );\n\t}\n\tif( libfwevt_xml_tag_get_value(\n\t string_xml_tag,\n\t &string_xml_value,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to retrieve string: %d value.\",\n\t\t function,\n\t\t string_index );\n\n\t\treturn( -1 );\n\t}\n/* TODO if string_xml_value == NULL return 0 */\n\tif( libfwevt_xml_value_get_utf16_string_size(\n\t string_xml_value,\n\t utf16_string_size,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to retrieve string: %d value size.\",\n\t\t function,\n\t\t string_index );\n\n\t\treturn( -1 );\n\t}\n\treturn( 1 );\n}\n\n/* Retrieves a specific UTF-16 encoded string\n * The size should include the end of string character\n * Returns 1 if successful or -1 on error\n */\nint libevtx_record_values_get_utf16_string(\n libevtx_record_values_t *record_values,\n libevtx_io_handle_t *io_handle,\n int string_index,\n uint16_t *utf16_string,\n size_t utf16_string_size,\n libcerror_error_t **error )\n{\n\tlibfwevt_xml_tag_t *string_xml_tag = NULL;\n\tlibfwevt_xml_value_t *string_xml_value = NULL;\n\tstatic char *function = \"libevtx_record_values_get_utf16_string\";\n\n\tif( record_values == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid record values.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( record_values->xml_document == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_VALUE_MISSING,\n\t\t \"%s: invalid record values - missing XML document.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( record_values->data_parsed == 0 )\n\t{\n\t\tif( libevtx_record_values_parse_data(\n\t\t record_values,\n\t\t io_handle,\n\t\t NULL,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GENERIC,\n\t\t\t \"%s: unable to parse data.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t}\n\tif( libcdata_array_get_entry_by_index(\n\t record_values->strings_array,\n\t string_index,\n\t (intptr_t **) &string_xml_tag,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to retrieve string: %d.\",\n\t\t function,\n\t\t string_index );\n\n\t\treturn( -1 );\n\t}\n\tif( libfwevt_xml_tag_get_value(\n\t string_xml_tag,\n\t &string_xml_value,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to retrieve string: %d value.\",\n\t\t function,\n\t\t string_index );\n\n\t\treturn( -1 );\n\t}\n\tif( libfwevt_xml_value_copy_to_utf16_string(\n\t string_xml_value,\n\t utf16_string,\n\t utf16_string_size,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to retrieve string: %d value.\",\n\t\t function,\n\t\t string_index );\n\n\t\treturn( -1 );\n\t}\n\treturn( 1 );\n}\n\n/* Retrieves the size of the data\n * Returns 1 if successful, 0 if not available or -1 on error\n */\nint libevtx_record_values_get_data_size(\n libevtx_record_values_t *record_values,\n libevtx_io_handle_t *io_handle,\n size_t *data_size,\n libcerror_error_t **error )\n{\n\tlibfwevt_xml_tag_t *binary_data_tag = NULL;\n\tlibfwevt_xml_tag_t *event_data_xml_tag = NULL;\n\tlibfwevt_xml_tag_t *root_xml_tag = NULL;\n\tstatic char *function = \"libevtx_record_values_get_data_size\";\n\tint result = 0;\n\n\tif( record_values == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid record values.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( record_values->xml_document == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_VALUE_MISSING,\n\t\t \"%s: invalid record values - missing XML document.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( record_values->data_parsed == 0 )\n\t{\n\t\tif( libevtx_record_values_parse_data(\n\t\t record_values,\n\t\t io_handle,\n\t\t NULL,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GENERIC,\n\t\t\t \"%s: unable to parse data.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t}\n\tif( record_values->binary_data_value == NULL )\n\t{\n\t\tif( libfwevt_xml_document_get_root_xml_tag(\n\t\t record_values->xml_document,\n\t\t &root_xml_tag,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve root XML element.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\tresult = libfwevt_xml_tag_get_element_by_utf8_name(\n\t\t\t root_xml_tag,\n\t\t\t (uint8_t *) \"EventData\",\n\t\t\t 9,\n\t\t\t &event_data_xml_tag,\n\t\t\t error );\n\n\t\tif( result == -1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve EventData XML element.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\telse if( result == 0 )\n\t\t{\n\t\t\treturn( 0 );\n\t\t}\n\t\tresult = libfwevt_xml_tag_get_element_by_utf8_name(\n\t\t\t event_data_xml_tag,\n\t\t\t (uint8_t *) \"BinaryData\",\n\t\t\t 10,\n\t\t\t &binary_data_tag,\n\t\t\t error );\n\n\t\tif( result == -1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve BinaryData XML element.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\telse if( result == 0 )\n\t\t{\n\t\t\treturn( 0 );\n\t\t}\n\t\tif( libfwevt_xml_tag_get_value(\n\t\t binary_data_tag,\n\t\t &( record_values->binary_data_value ),\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve BinaryData XML element value.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t}\n\tif( record_values->binary_data_value == NULL )\n\t{\n\t\tresult = 0;\n\t}\n\telse\n\t{\n\t\tif( libfwevt_xml_value_get_data_size(\n\t\t record_values->binary_data_value,\n\t\t data_size,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve size of binary data.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\tresult = 1;\n\t}\n\treturn( result );\n}\n\n/* Retrieves the data\n * Returns 1 if successful, 0 if not available or -1 on error\n */\nint libevtx_record_values_get_data(\n libevtx_record_values_t *record_values,\n libevtx_io_handle_t *io_handle,\n uint8_t *data,\n size_t data_size,\n libcerror_error_t **error )\n{\n\tlibfwevt_xml_tag_t *binary_data_tag = NULL;\n\tlibfwevt_xml_tag_t *event_data_xml_tag = NULL;\n\tlibfwevt_xml_tag_t *root_xml_tag = NULL;\n\tstatic char *function = \"libevtx_record_values_get_data\";\n\tint result = 0;\n\n\tif( record_values == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid record values.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( record_values->xml_document == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_VALUE_MISSING,\n\t\t \"%s: invalid record values - missing XML document.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( record_values->data_parsed == 0 )\n\t{\n\t\tif( libevtx_record_values_parse_data(\n\t\t record_values,\n\t\t io_handle,\n\t\t NULL,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GENERIC,\n\t\t\t \"%s: unable to parse data.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t}\n\tif( record_values->binary_data_value == NULL )\n\t{\n\t\tif( libfwevt_xml_document_get_root_xml_tag(\n\t\t record_values->xml_document,\n\t\t &root_xml_tag,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve root XML element.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\tresult = libfwevt_xml_tag_get_element_by_utf8_name(\n\t\t\t root_xml_tag,\n\t\t\t (uint8_t *) \"EventData\",\n\t\t\t 9,\n\t\t\t &event_data_xml_tag,\n\t\t\t error );\n\n\t\tif( result == -1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve EventData XML element.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\telse if( result == 0 )\n\t\t{\n\t\t\treturn( 0 );\n\t\t}\n\t\tresult = libfwevt_xml_tag_get_element_by_utf8_name(\n\t\t\t event_data_xml_tag,\n\t\t\t (uint8_t *) \"BinaryData\",\n\t\t\t 10,\n\t\t\t &binary_data_tag,\n\t\t\t error );\n\n\t\tif( result == -1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve BinaryData XML element.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\telse if( result == 0 )\n\t\t{\n\t\t\treturn( 0 );\n\t\t}\n\t\tif( libfwevt_xml_tag_get_value(\n\t\t binary_data_tag,\n\t\t &( record_values->binary_data_value ),\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve BinaryData XML element value.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t}\n\tif( record_values->binary_data_value == NULL )\n\t{\n\t\tresult = 0;\n\t}\n\telse\n\t{\n\t\tif( libfwevt_xml_value_copy_data(\n\t\t record_values->binary_data_value,\n\t\t data,\n\t\t data_size,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_COPY_FAILED,\n\t\t\t \"%s: unable to copy binary data.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\tresult = 1;\n\t}\n\treturn( result );\n}\n\n/* Retrieves the size of the UTF-8 encoded XML string\n * The returned size includes the end of string character\n * Returns 1 if successful or -1 on error\n */\nint libevtx_record_values_get_utf8_xml_string_size(\n libevtx_record_values_t *record_values,\n size_t *utf8_string_size,\n libcerror_error_t **error )\n{\n\tstatic char *function = \"libevtx_record_values_get_utf8_xml_string_size\";\n\n\tif( record_values == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid record values.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( libfwevt_xml_document_get_utf8_xml_string_size(\n\t record_values->xml_document,\n\t utf8_string_size,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to retrieve UTF-8 string size of XML document.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\treturn( 1 );\n}\n\n/* Retrieves the UTF-8 encoded XML string\n * The size should include the end of string character\n * Returns 1 if successful or -1 on error\n */\nint libevtx_record_values_get_utf8_xml_string(\n libevtx_record_values_t *record_values,\n uint8_t *utf8_string,\n size_t utf8_string_size,\n libcerror_error_t **error )\n{\n\tstatic char *function = \"libevtx_record_values_get_utf8_xml_string\";\n\n\tif( record_values == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid record values.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( libfwevt_xml_document_get_utf8_xml_string(\n\t record_values->xml_document,\n\t utf8_string,\n\t utf8_string_size,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to retrieve UTF-8 string of XML document.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\treturn( 1 );\n}\n\n/* Retrieves the size of the UTF-16 encoded XML string\n * The returned size includes the end of string character\n * Returns 1 if successful or -1 on error\n */\nint libevtx_record_values_get_utf16_xml_string_size(\n libevtx_record_values_t *record_values,\n size_t *utf16_string_size,\n libcerror_error_t **error )\n{\n\tstatic char *function = \"libevtx_record_values_get_utf16_xml_string_size\";\n\n\tif( record_values == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid record values.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( libfwevt_xml_document_get_utf16_xml_string_size(\n\t record_values->xml_document,\n\t utf16_string_size,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to retrieve UTF-16 string size of XML document.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\treturn( 1 );\n}\n\n/* Retrieves the UTF-16 encoded XML string\n * The size should include the end of string character\n * Returns 1 if successful or -1 on error\n */\nint libevtx_record_values_get_utf16_xml_string(\n libevtx_record_values_t *record_values,\n uint16_t *utf16_string,\n size_t utf16_string_size,\n libcerror_error_t **error )\n{\n\tstatic char *function = \"libevtx_record_values_get_utf16_xml_string\";\n\n\tif( record_values == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid record values.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( libfwevt_xml_document_get_utf16_xml_string(\n\t record_values->xml_document,\n\t utf16_string,\n\t utf16_string_size,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to retrieve UTF-16 string of XML document.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\treturn( 1 );\n}\n\n" }, { "path": "libevtx/libevtx_record_values.h", "content": "/*\n * Record values functions\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#if !defined( _LIBEVTX_RECORD_VALUES_H )\n#define _LIBEVTX_RECORD_VALUES_H\n\n#include \n#include \n\n#include \"libevtx_io_handle.h\"\n#include \"libevtx_libcdata.h\"\n#include \"libevtx_libcerror.h\"\n#include \"libevtx_libfwevt.h\"\n#include \"libevtx_template_definition.h\"\n#include \"libevtx_types.h\"\n\n#if defined( __cplusplus )\nextern \"C\" {\n#endif\n\nextern const uint8_t evtx_event_record_signature[ 4 ];\n\ntypedef struct libevtx_record_values libevtx_record_values_t;\n\nstruct libevtx_record_values\n{\n\t/* The offset\n\t */\n\toff64_t offset;\n\n\t/* The data size\n\t */\n\tuint32_t data_size;\n\n\t/* The chunk data offset\n\t */\n\tsize_t chunk_data_offset;\n\n\t/* The identifier\n\t */\n\tuint64_t identifier;\n\n\t/* The written time\n\t */\n\tuint64_t written_time;\n\n\t/* The XML document\n\t */\n\tlibfwevt_xml_document_t *xml_document;\n\n\t/* Reference to the provider XML tag\n\t */\n\tlibfwevt_xml_tag_t *provider_xml_tag;\n\n\t/* Reference to the provider identifier value\n\t */\n\tlibfwevt_xml_value_t *provider_identifier_value;\n\n\t/* Reference to the provider name value\n\t */\n\tlibfwevt_xml_value_t *provider_name_value;\n\n\t/* Reference to the version value\n\t */\n\tlibfwevt_xml_value_t *version_value;\n\n\t/* Reference to the event identifier XML tag\n\t */\n\tlibfwevt_xml_tag_t *event_identifier_xml_tag;\n\n\t/* Reference to the time created value\n\t */\n\tlibfwevt_xml_value_t *time_created_value;\n\n\t/* Reference to the level value\n\t */\n\tlibfwevt_xml_value_t *level_value;\n\n\t/* Reference to the task value\n\t */\n\tlibfwevt_xml_value_t *task_value;\n\n\t/* Reference to the oppcode value\n\t */\n\tlibfwevt_xml_value_t *oppcode_value;\n\n\t/* Reference to the keywords value\n\t */\n\tlibfwevt_xml_value_t *keywords_value;\n\n\t/* Reference to the channel value\n\t */\n\tlibfwevt_xml_value_t *channel_value;\n\n\t/* Reference to the computer value\n\t */\n\tlibfwevt_xml_value_t *computer_value;\n\n\t/* Reference to the user security identifier (SID) value\n\t */\n\tlibfwevt_xml_value_t *user_security_identifier_value;\n\n\t/* The string identifiers array\n\t */\n\tlibcdata_array_t *string_identifiers_array;\n\n\t/* The strings array\n\t */\n\tlibcdata_array_t *strings_array;\n\n\t/* Reference to the BinaryData value\n\t */\n\tlibfwevt_xml_value_t *binary_data_value;\n\n\t/* Value to indicate the data was parsed\n\t */\n\tuint8_t data_parsed;\n};\n\nint libevtx_record_values_initialize(\n libevtx_record_values_t **record_values,\n libcerror_error_t **error );\n\nint libevtx_record_values_free(\n libevtx_record_values_t **record_values,\n libcerror_error_t **error );\n\nint libevtx_record_values_clone(\n libevtx_record_values_t **destination_record_values,\n libevtx_record_values_t *source_record_values,\n libcerror_error_t **error );\n\nint libevtx_record_values_read_header(\n libevtx_record_values_t *record_values,\n libevtx_io_handle_t *io_handle,\n const uint8_t *chunk_data,\n size_t chunk_data_size,\n size_t chunk_data_offset,\n libcerror_error_t **error );\n\nint libevtx_record_values_read_xml_document(\n libevtx_record_values_t *record_values,\n libevtx_io_handle_t *io_handle,\n const uint8_t *chunk_data,\n size_t chunk_data_size,\n libcerror_error_t **error );\n\nint libevtx_record_values_get_event_identifier(\n libevtx_record_values_t *record_values,\n uint32_t *event_identifier,\n libcerror_error_t **error );\n\nint libevtx_record_values_get_event_identifier_qualifiers(\n libevtx_record_values_t *record_values,\n uint32_t *event_identifier_qualifiers,\n libcerror_error_t **error );\n\nint libevtx_record_values_get_event_version(\n libevtx_record_values_t *record_values,\n uint8_t *event_version,\n libcerror_error_t **error );\n\nint libevtx_record_values_get_creation_time(\n libevtx_record_values_t *record_values,\n uint64_t *filetime,\n libcerror_error_t **error );\n\nint libevtx_record_values_get_written_time(\n libevtx_record_values_t *record_values,\n uint64_t *filetime,\n libcerror_error_t **error );\n\nint libevtx_record_values_get_event_level(\n libevtx_record_values_t *record_values,\n uint8_t *event_level,\n libcerror_error_t **error );\n\nint libevtx_record_values_get_utf8_provider_identifier_size(\n libevtx_record_values_t *record_values,\n size_t *utf8_string_size,\n libcerror_error_t **error );\n\nint libevtx_record_values_get_utf8_provider_identifier(\n libevtx_record_values_t *record_values,\n uint8_t *utf8_string,\n size_t utf8_string_size,\n libcerror_error_t **error );\n\nint libevtx_record_values_get_utf16_provider_identifier_size(\n libevtx_record_values_t *record_values,\n size_t *utf16_string_size,\n libcerror_error_t **error );\n\nint libevtx_record_values_get_utf16_provider_identifier(\n libevtx_record_values_t *record_values,\n uint16_t *utf16_string,\n size_t utf16_string_size,\n libcerror_error_t **error );\n\nint libevtx_record_values_get_utf8_source_name_size(\n libevtx_record_values_t *record_values,\n size_t *utf8_string_size,\n libcerror_error_t **error );\n\nint libevtx_record_values_get_utf8_source_name(\n libevtx_record_values_t *record_values,\n uint8_t *utf8_string,\n size_t utf8_string_size,\n libcerror_error_t **error );\n\nint libevtx_record_values_get_utf16_source_name_size(\n libevtx_record_values_t *record_values,\n size_t *utf16_string_size,\n libcerror_error_t **error );\n\nint libevtx_record_values_get_utf16_source_name(\n libevtx_record_values_t *record_values,\n uint16_t *utf16_string,\n size_t utf16_string_size,\n libcerror_error_t **error );\n\nint libevtx_record_values_get_utf8_channel_name_size(\n libevtx_record_values_t *record_values,\n size_t *utf8_string_size,\n libcerror_error_t **error );\n\nint libevtx_record_values_get_utf8_channel_name(\n libevtx_record_values_t *record_values,\n uint8_t *utf8_string,\n size_t utf8_string_size,\n libcerror_error_t **error );\n\nint libevtx_record_values_get_utf16_channel_name_size(\n libevtx_record_values_t *record_values,\n size_t *utf16_string_size,\n libcerror_error_t **error );\n\nint libevtx_record_values_get_utf16_channel_name(\n libevtx_record_values_t *record_values,\n uint16_t *utf16_string,\n size_t utf16_string_size,\n libcerror_error_t **error );\n\nint libevtx_record_values_get_utf8_computer_name_size(\n libevtx_record_values_t *record_values,\n size_t *utf8_string_size,\n libcerror_error_t **error );\n\nint libevtx_record_values_get_utf8_computer_name(\n libevtx_record_values_t *record_values,\n uint8_t *utf8_string,\n size_t utf8_string_size,\n libcerror_error_t **error );\n\nint libevtx_record_values_get_utf16_computer_name_size(\n libevtx_record_values_t *record_values,\n size_t *utf16_string_size,\n libcerror_error_t **error );\n\nint libevtx_record_values_get_utf16_computer_name(\n libevtx_record_values_t *record_values,\n uint16_t *utf16_string,\n size_t utf16_string_size,\n libcerror_error_t **error );\n\nint libevtx_record_values_get_utf8_user_security_identifier_size(\n libevtx_record_values_t *record_values,\n size_t *utf8_string_size,\n libcerror_error_t **error );\n\nint libevtx_record_values_get_utf8_user_security_identifier(\n libevtx_record_values_t *record_values,\n uint8_t *utf8_string,\n size_t utf8_string_size,\n libcerror_error_t **error );\n\nint libevtx_record_values_get_utf16_user_security_identifier_size(\n libevtx_record_values_t *record_values,\n size_t *utf16_string_size,\n libcerror_error_t **error );\n\nint libevtx_record_values_get_utf16_user_security_identifier(\n libevtx_record_values_t *record_values,\n uint16_t *utf16_string,\n size_t utf16_string_size,\n libcerror_error_t **error );\n\nint libevtx_record_values_parse_data(\n libevtx_record_values_t *record_values,\n libevtx_io_handle_t *io_handle,\n libevtx_internal_template_definition_t *internal_template_definition,\n libcerror_error_t **error );\n\nint libevtx_record_values_get_number_of_strings(\n libevtx_record_values_t *record_values,\n libevtx_io_handle_t *io_handle,\n int *number_of_strings,\n libcerror_error_t **error );\n\nint libevtx_record_values_get_utf8_string_size(\n libevtx_record_values_t *record_values,\n libevtx_io_handle_t *io_handle,\n int string_index,\n size_t *utf8_string_size,\n libcerror_error_t **error );\n\nint libevtx_record_values_get_utf8_string(\n libevtx_record_values_t *record_values,\n libevtx_io_handle_t *io_handle,\n int string_index,\n uint8_t *utf8_string,\n size_t utf8_string_size,\n libcerror_error_t **error );\n\nint libevtx_record_values_get_utf16_string_size(\n libevtx_record_values_t *record_values,\n libevtx_io_handle_t *io_handle,\n int string_index,\n size_t *utf16_string_size,\n libcerror_error_t **error );\n\nint libevtx_record_values_get_utf16_string(\n libevtx_record_values_t *record_values,\n libevtx_io_handle_t *io_handle,\n int string_index,\n uint16_t *utf16_string,\n size_t utf16_string_size,\n libcerror_error_t **error );\n\nint libevtx_record_values_get_data_size(\n libevtx_record_values_t *record_values,\n libevtx_io_handle_t *io_handle,\n size_t *data_size,\n libcerror_error_t **error );\n\nint libevtx_record_values_get_data(\n libevtx_record_values_t *record_values,\n libevtx_io_handle_t *io_handle,\n uint8_t *data,\n size_t data_size,\n libcerror_error_t **error );\n\nint libevtx_record_values_get_utf8_xml_string_size(\n libevtx_record_values_t *record_values,\n size_t *utf8_string_size,\n libcerror_error_t **error );\n\nint libevtx_record_values_get_utf8_xml_string(\n libevtx_record_values_t *record_values,\n uint8_t *utf8_string,\n size_t utf8_string_size,\n libcerror_error_t **error );\n\nint libevtx_record_values_get_utf16_xml_string_size(\n libevtx_record_values_t *record_values,\n size_t *utf16_string_size,\n libcerror_error_t **error );\n\nint libevtx_record_values_get_utf16_xml_string(\n libevtx_record_values_t *record_values,\n uint16_t *utf16_string,\n size_t utf16_string_size,\n libcerror_error_t **error );\n\n#if defined( __cplusplus )\n}\n#endif\n\n#endif /* !defined( _LIBEVTX_RECORD_VALUES_H ) */\n\n" }, { "path": "libevtx/libevtx_support.c", "content": "/*\n * Support functions\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#include \n#include \n#include \n#include \n#include \n\n#include \"libevtx_definitions.h\"\n#include \"libevtx_io_handle.h\"\n#include \"libevtx_libbfio.h\"\n#include \"libevtx_libcerror.h\"\n#include \"libevtx_libclocale.h\"\n#include \"libevtx_support.h\"\n\n#if !defined( HAVE_LOCAL_LIBEVTX )\n\n/* Returns the library version\n */\nconst char *libevtx_get_version(\n void )\n{\n\treturn( (const char *) LIBEVTX_VERSION_STRING );\n}\n\n/* Returns the access flags for reading\n */\nint libevtx_get_access_flags_read(\n void )\n{\n\treturn( (uint8_t) LIBEVTX_ACCESS_FLAG_READ );\n}\n\n/* Retrieves the narrow system string codepage\n * A value of 0 represents no codepage, UTF-8 encoding is used instead\n * Returns 1 if successful or -1 on error\n */\nint libevtx_get_codepage(\n int *codepage,\n libcerror_error_t **error )\n{\n\tstatic char *function = \"libevtx_get_codepage\";\n\n\tif( libclocale_codepage_get(\n\t codepage,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to retrieve codepage.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\treturn( 1 );\n}\n\n/* Sets the narrow system string codepage\n * A value of 0 represents no codepage, UTF-8 encoding is used instead\n * Returns 1 if successful or -1 on error\n */\nint libevtx_set_codepage(\n int codepage,\n libcerror_error_t **error )\n{\n\tstatic char *function = \"libevtx_set_codepage\";\n\n\tif( libclocale_codepage_set(\n\t codepage,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_SET_FAILED,\n\t\t \"%s: unable to set codepage.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\treturn( 1 );\n}\n\n#endif /* !defined( HAVE_LOCAL_LIBEVTX ) */\n\n/* Determines if a file contains an EVTX file signature\n * Returns 1 if true, 0 if not or -1 on error\n */\nint libevtx_check_file_signature(\n const char *filename,\n libcerror_error_t **error )\n{\n\tlibbfio_handle_t *file_io_handle = NULL;\n\tstatic char *function = \"libevtx_check_file_signature\";\n\tsize_t filename_length = 0;\n\tint result = 0;\n\n\tif( filename == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid filename.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tfilename_length = narrow_string_length(\n\t filename );\n\n\tif( filename_length == 0 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid filename.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tif( libbfio_file_initialize(\n\t &file_io_handle,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_INITIALIZE_FAILED,\n\t\t \"%s: unable to create file IO handle.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tif( libbfio_file_set_name(\n\t file_io_handle,\n\t filename,\n\t filename_length,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_SET_FAILED,\n\t\t \"%s: unable to set filename in file IO handle.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tresult = libevtx_check_file_signature_file_io_handle(\n\t file_io_handle,\n\t error );\n\n\tif( result == -1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to check file signature using a file handle.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tif( libbfio_handle_free(\n\t &file_io_handle,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_INITIALIZE_FAILED,\n\t\t \"%s: unable to free file IO handle.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\treturn( result );\n\non_error:\n\tif( file_io_handle != NULL )\n\t{\n\t\tlibbfio_handle_free(\n\t\t &file_io_handle,\n\t\t NULL );\n\t}\n\treturn( -1 );\n}\n\n#if defined( HAVE_WIDE_CHARACTER_TYPE )\n\n/* Determines if a file contains an EVTX file signature\n * Returns 1 if true, 0 if not or -1 on error\n */\nint libevtx_check_file_signature_wide(\n const wchar_t *filename,\n libcerror_error_t **error )\n{\n\tlibbfio_handle_t *file_io_handle = NULL;\n\tstatic char *function = \"libevtx_check_file_signature_wide\";\n\tsize_t filename_length = 0;\n\tint result = 0;\n\n\tif( filename == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid filename.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tfilename_length = wide_string_length(\n\t filename );\n\n\tif( filename_length == 0 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid filename.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( libbfio_file_initialize(\n\t &file_io_handle,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_INITIALIZE_FAILED,\n\t\t \"%s: unable to create file IO handle.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tif( libbfio_file_set_name_wide(\n\t file_io_handle,\n\t filename,\n\t filename_length,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_SET_FAILED,\n\t\t \"%s: unable to set filename in file IO handle.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tresult = libevtx_check_file_signature_file_io_handle(\n\t file_io_handle,\n\t error );\n\n\tif( result == -1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to check file signature using a file handle.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tif( libbfio_handle_free(\n\t &file_io_handle,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_INITIALIZE_FAILED,\n\t\t \"%s: unable to free file IO handle.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\treturn( result );\n\non_error:\n\tif( file_io_handle != NULL )\n\t{\n\t\tlibbfio_handle_free(\n\t\t &file_io_handle,\n\t\t NULL );\n\t}\n\treturn( -1 );\n}\n\n#endif /* defined( HAVE_WIDE_CHARACTER_TYPE ) */\n\n/* Determines if a file contains an EVTX file signature using a Basic File IO (bfio) handle\n * Returns 1 if true, 0 if not or -1 on error\n */\nint libevtx_check_file_signature_file_io_handle(\n libbfio_handle_t *file_io_handle,\n libcerror_error_t **error )\n{\n\tuint8_t signature[ 8 ];\n\n\tstatic char *function = \"libevtx_check_file_signature_file_io_handle\";\n\tssize_t read_count = 0;\n\tint file_io_handle_is_open = 0;\n\n\tif( file_io_handle == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid file IO handle.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tfile_io_handle_is_open = libbfio_handle_is_open(\n\t file_io_handle,\n\t error );\n\n\tif( file_io_handle_is_open == -1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_IO,\n\t\t LIBCERROR_IO_ERROR_OPEN_FAILED,\n\t\t \"%s: unable to open file.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\telse if( file_io_handle_is_open == 0 )\n\t{\n\t\tif( libbfio_handle_open(\n\t\t file_io_handle,\n\t\t LIBBFIO_OPEN_READ,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_IO,\n\t\t\t LIBCERROR_IO_ERROR_OPEN_FAILED,\n\t\t\t \"%s: unable to open file.\",\n\t\t\t function );\n\n\t\t\tgoto on_error;\n\t\t}\n\t}\n\tread_count = libbfio_handle_read_buffer_at_offset(\n\t file_io_handle,\n\t signature,\n\t 8,\n\t 0,\n\t error );\n\n\tif( read_count != 8 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_IO,\n\t\t LIBCERROR_IO_ERROR_READ_FAILED,\n\t\t \"%s: unable to read signature at offset: 0 (0x00000000).\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tif( file_io_handle_is_open == 0 )\n\t{\n\t\tif( libbfio_handle_close(\n\t\t file_io_handle,\n\t\t error ) != 0 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_IO,\n\t\t\t LIBCERROR_IO_ERROR_CLOSE_FAILED,\n\t\t\t \"%s: unable to close file.\",\n\t\t\t function );\n\n\t\t\tgoto on_error;\n\t\t}\n\t}\n\tif( memory_compare(\n\t evtx_file_signature,\n\t signature,\n\t 8 ) == 0 )\n\t{\n\t\treturn( 1 );\n\t}\n\treturn( 0 );\n\non_error:\n\tif( file_io_handle_is_open == 0 )\n\t{\n\t\tlibbfio_handle_close(\n\t\t file_io_handle,\n\t\t NULL );\n\t}\n\treturn( -1 );\n}\n\n" }, { "path": "libevtx/libevtx_support.h", "content": "/*\n * Support functions\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#if !defined( _LIBEVTX_SUPPORT_H )\n#define _LIBEVTX_SUPPORT_H\n\n#include \n#include \n\n#include \"libevtx_extern.h\"\n#include \"libevtx_libbfio.h\"\n#include \"libevtx_libcerror.h\"\n\n#if defined( __cplusplus )\nextern \"C\" {\n#endif\n\n#if !defined( HAVE_LOCAL_LIBEVTX )\n\nLIBEVTX_EXTERN \\\nconst char *libevtx_get_version(\n void );\n\nLIBEVTX_EXTERN \\\nint libevtx_get_access_flags_read(\n void );\n\nLIBEVTX_EXTERN \\\nint libevtx_get_codepage(\n int *codepage,\n libcerror_error_t **error );\n\nLIBEVTX_EXTERN \\\nint libevtx_set_codepage(\n int codepage,\n libcerror_error_t **error );\n\n#endif /* !defined( HAVE_LOCAL_LIBEVTX ) */\n\nLIBEVTX_EXTERN \\\nint libevtx_check_file_signature(\n const char *filename,\n libcerror_error_t **error );\n\n#if defined( HAVE_WIDE_CHARACTER_TYPE )\n\nLIBEVTX_EXTERN \\\nint libevtx_check_file_signature_wide(\n const wchar_t *filename,\n libcerror_error_t **error );\n\n#endif /* defined( HAVE_WIDE_CHARACTER_TYPE ) */\n\nLIBEVTX_EXTERN \\\nint libevtx_check_file_signature_file_io_handle(\n libbfio_handle_t *bfio_handle,\n libcerror_error_t **error );\n\n#if defined( __cplusplus )\n}\n#endif\n\n#endif /* !defined( _LIBEVTX_SUPPORT_H ) */\n\n" }, { "path": "libevtx/libevtx_template_definition.c", "content": "/*\n * Template definition functions\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#include \n#include \n#include \n\n#include \"libevtx_io_handle.h\"\n#include \"libevtx_libcdata.h\"\n#include \"libevtx_libcerror.h\"\n#include \"libevtx_libcnotify.h\"\n#include \"libevtx_libfwevt.h\"\n#include \"libevtx_template_definition.h\"\n\n/* Creates a template definition\n * Make sure the value template_definition is referencing, is set to NULL\n * Returns 1 if successful or -1 on error\n */\nint libevtx_template_definition_initialize(\n libevtx_template_definition_t **template_definition,\n libcerror_error_t **error )\n{\n\tlibevtx_internal_template_definition_t *internal_template_definition = NULL;\n\tstatic char *function = \"libevtx_template_definition_initialize\";\n\n\tif( template_definition == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid template definition.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( *template_definition != NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_VALUE_ALREADY_SET,\n\t\t \"%s: invalid template definition value already set.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tinternal_template_definition = memory_allocate_structure(\n\t libevtx_internal_template_definition_t );\n\n\tif( internal_template_definition == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_MEMORY,\n\t\t LIBCERROR_MEMORY_ERROR_INSUFFICIENT,\n\t\t \"%s: unable to create template definition.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tif( memory_set(\n\t internal_template_definition,\n\t 0,\n\t sizeof( libevtx_internal_template_definition_t ) ) == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_MEMORY,\n\t\t LIBCERROR_MEMORY_ERROR_SET_FAILED,\n\t\t \"%s: unable to clear template definition.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tif( libfwevt_template_initialize(\n\t &( internal_template_definition->wevt_template ),\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_INITIALIZE_FAILED,\n\t\t \"%s: unable to create WEVT template.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\t*template_definition = (libevtx_template_definition_t *) internal_template_definition;\n\n\treturn( 1 );\n\non_error:\n\tif( internal_template_definition != NULL )\n\t{\n\t\tmemory_free(\n\t\t internal_template_definition );\n\t}\n\treturn( -1 );\n}\n\n/* Frees a template definition\n * Returns 1 if successful or -1 on error\n */\nint libevtx_template_definition_free(\n libevtx_template_definition_t **template_definition,\n libcerror_error_t **error )\n{\n\tlibevtx_internal_template_definition_t *internal_template_definition = NULL;\n\tstatic char *function = \"libevtx_template_definition_free\";\n\tint result = 1;\n\n\tif( template_definition == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid template.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( *template_definition != NULL )\n\t{\n\t\tinternal_template_definition = (libevtx_internal_template_definition_t *) *template_definition;\n\t\t*template_definition = NULL;\n\n\t\tif( libfwevt_template_free(\n\t\t &( internal_template_definition->wevt_template ),\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED,\n\t\t\t \"%s: unable to free WEVT template.\",\n\t\t\t function );\n\n\t\t\tresult = -1;\n\t\t}\n\t\tif( internal_template_definition->xml_document != NULL )\n\t\t{\n\t\t\tif( libfwevt_xml_document_free(\n\t\t\t &( internal_template_definition->xml_document ),\n\t\t\t error ) != 1 )\n\t\t\t{\n\t\t\t\tlibcerror_error_set(\n\t\t\t\t error,\n\t\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t\t LIBCERROR_RUNTIME_ERROR_INITIALIZE_FAILED,\n\t\t\t\t \"%s: unable to free XML document.\",\n\t\t\t\t function );\n\n\t\t\t\tresult = -1;\n\t\t\t}\n\t\t}\n\t\tmemory_free(\n\t\t internal_template_definition );\n\t}\n\treturn( result );\n}\n\n/* Sets the data\n * Returns 1 if successful or -1 on error\n */\nint libevtx_template_definition_set_data(\n libevtx_template_definition_t *template_definition,\n const uint8_t *data,\n size_t data_size,\n uint32_t data_offset,\n libcerror_error_t **error )\n{\n\tlibevtx_internal_template_definition_t *internal_template_definition = NULL;\n\tstatic char *function = \"libevtx_template_definition_set_data\";\n\n\tif( template_definition == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid template definition.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tinternal_template_definition = (libevtx_internal_template_definition_t *) template_definition;\n\n\tif( libfwevt_template_set_offset(\n\t internal_template_definition->wevt_template,\n\t data_offset,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_SET_FAILED,\n\t\t \"%s: unable to set template offset.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( libfwevt_template_set_data(\n\t internal_template_definition->wevt_template,\n\t data,\n\t data_size,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_SET_FAILED,\n\t\t \"%s: unable to set template data.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\treturn( 1 );\n}\n\n/* Reads the template\n * Returns 1 if successful or -1 on error\n */\nint libevtx_template_definition_read(\n libevtx_internal_template_definition_t *internal_template_definition,\n libevtx_io_handle_t *io_handle,\n libcerror_error_t **error )\n{\n\tstatic char *function = \"libevtx_template_definition_read\";\n\n\tif( internal_template_definition == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid template definition.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( internal_template_definition->xml_document != NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_VALUE_ALREADY_SET,\n\t\t \"%s: invalid template definition - XML document already set.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( io_handle == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid IO handle.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( libfwevt_template_set_ascii_codepage(\n\t internal_template_definition->wevt_template,\n\t io_handle->ascii_codepage,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_SET_FAILED,\n\t\t \"%s: unable to set ASCII codepage in template.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tif( libfwevt_xml_document_initialize(\n\t &( internal_template_definition->xml_document ),\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_INITIALIZE_FAILED,\n\t\t \"%s: unable to create XML document.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tif( libfwevt_template_read_xml_document(\n\t internal_template_definition->wevt_template,\n\t internal_template_definition->xml_document,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_IO,\n\t\t LIBCERROR_IO_ERROR_READ_FAILED,\n\t\t \"%s: unable to read XML document from template.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n#if defined( HAVE_DEBUG_OUTPUT )\n\tif( libcnotify_verbose != 0 )\n\t{\n\t\tlibcnotify_printf(\n\t\t \"%s: XML document:\\n\",\n\t\t function );\n\n\t\tif( libfwevt_xml_document_debug_print(\n\t\t internal_template_definition->xml_document,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_PRINT_FAILED,\n\t\t\t \"%s: unable to print XML document.\",\n\t\t\t function );\n\n\t\t\tgoto on_error;\n\t\t}\n\t\tlibcnotify_printf(\n\t\t \"\\n\" );\n\t}\n#endif\n\treturn( 1 );\n\non_error:\t\n\tif( internal_template_definition->xml_document != NULL )\n\t{\n\t\tlibfwevt_xml_document_free(\n\t\t &( internal_template_definition->xml_document ),\n\t\t NULL );\n\t}\n\treturn( -1 );\n}\n\n" }, { "path": "libevtx/libevtx_template_definition.h", "content": "/*\n * Template definition functions\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#if !defined( _LIBEVTX_INTERNAL_TEMPLATE_DEFINITION_H )\n#define _LIBEVTX_INTERNAL_TEMPLATE_DEFINITION_H\n\n#include \n#include \n\n#include \"libevtx_extern.h\"\n#include \"libevtx_io_handle.h\"\n#include \"libevtx_libcdata.h\"\n#include \"libevtx_libcerror.h\"\n#include \"libevtx_libfwevt.h\"\n#include \"libevtx_types.h\"\n\n#if defined( __cplusplus )\nextern \"C\" {\n#endif\n\ntypedef struct libevtx_internal_template_definition libevtx_internal_template_definition_t;\n\nstruct libevtx_internal_template_definition\n{\n\t/* The WEVT template\n\t */\n\tlibfwevt_template_t *wevt_template;\n\n\t/* The XML document\n\t */\n\tlibfwevt_xml_document_t *xml_document;\n};\n\nLIBEVTX_EXTERN \\\nint libevtx_template_definition_initialize(\n libevtx_template_definition_t **template_definition,\n libcerror_error_t **error );\n\nLIBEVTX_EXTERN \\\nint libevtx_template_definition_free(\n libevtx_template_definition_t **template_definition,\n libcerror_error_t **error );\n\nLIBEVTX_EXTERN \\\nint libevtx_template_definition_set_data(\n libevtx_template_definition_t *template_definition,\n const uint8_t *data,\n size_t data_size,\n uint32_t data_offset,\n libcerror_error_t **error );\n\nint libevtx_template_definition_read(\n libevtx_internal_template_definition_t *internal_template_definition,\n libevtx_io_handle_t *io_handle,\n libcerror_error_t **error );\n\n#if defined( __cplusplus )\n}\n#endif\n\n#endif /* !defined( _LIBEVTX_INTERNAL_TEMPLATE_DEFINITION_H ) */\n\n" }, { "path": "libevtx/libevtx_types.h", "content": "/*\n * The internal type definitions\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#if !defined( _LIBEVTX_INTERNAL_TYPES_H )\n#define _LIBEVTX_INTERNAL_TYPES_H\n\n#include \n#include \n\n/* Define HAVE_LOCAL_LIBEVTX for local use of libevtx\n * The definitions in are copied here\n * for local use of libevtx\n */\n#if defined( HAVE_LOCAL_LIBEVTX )\n\n/* The following type definitions hide internal data structures\n */\n#if defined( HAVE_DEBUG_OUTPUT ) && !defined( WINAPI )\ntypedef struct libevtx_file {}\t\t\tlibevtx_file_t;\ntypedef struct libevtx_record {}\t\tlibevtx_record_t;\ntypedef struct libevtx_template_definition {}\tlibevtx_template_definition_t;\n\n#else\ntypedef intptr_t libevtx_file_t;\ntypedef intptr_t libevtx_record_t;\ntypedef intptr_t libevtx_template_definition_t;\n\n#endif /* defined( HAVE_DEBUG_OUTPUT ) && !defined( WINAPI ) */\n\n#endif /* defined( HAVE_LOCAL_LIBEVTX ) */\n\n/* The largest primary (or scalar) available\n * supported by a single load and store instruction\n */\ntypedef unsigned long int libevtx_aligned_t;\n\n#endif /* !defined( _LIBEVTX_INTERNAL_TYPES_H ) */\n\n" }, { "path": "libevtx/libevtx_unused.h", "content": "/*\n * Definitions to silence compiler warnings about unused function attributes/parameters.\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#if !defined( _LIBEVTX_UNUSED_H )\n#define _LIBEVTX_UNUSED_H\n\n#include \n\n#if !defined( LIBEVTX_ATTRIBUTE_UNUSED )\n#if defined( __GNUC__ ) && __GNUC__ >= 3\n#define LIBEVTX_ATTRIBUTE_UNUSED\t__attribute__ ((__unused__))\n#else\n#define LIBEVTX_ATTRIBUTE_UNUSED\n#endif\n#endif\n\n#if defined( _MSC_VER )\n#define LIBEVTX_UNREFERENCED_PARAMETER( parameter ) \\\n\tUNREFERENCED_PARAMETER( parameter );\n#else\n#define LIBEVTX_UNREFERENCED_PARAMETER( parameter ) \\\n\t/* parameter */\n#endif\n\n#endif /* !defined( _LIBEVTX_UNUSED_H ) */\n\n" }, { "path": "libevtx.ini", "content": "[project]\nname: \"libevtx\"\nstatus: \"alpha\"\nyear_of_creation: \"2011\"\ndata_format: \"Windows XML Event Log (EVTX)\"\ndocumentation_url: \"https://github.com/libyal/libevtx/tree/main/documentation\"\nfeatures: [\"debug_output\", \"ossfuzz\", \"python_bindings\", \"tools\"]\n\n[dtFabric]\ndata_types: {\n \"file_header\": {\n \"__options__\": [\"file_io_handle\"],\n \"signature\": {},\n \"first_chunk_number\": {\"usage\": \"in_function\"},\n \"last_chunk_number\": {\"usage\": \"in_function\"},\n \"next_record_identifier\": {},\n \"header_size\": {},\n \"minor_version\": {\"usage\": \"in_struct\"},\n \"major_version\": {\"usage\": \"in_struct\"},\n \"header_block_size\": {\"usage\": \"in_struct\"},\n \"number_of_chunks\": {\"usage\": \"in_struct\"},\n \"unknown1\": {},\n \"file_flags\": {\"usage\": \"in_struct\"},\n \"checksum\": {\"usage\": \"in_function\"}\n }}\n\n[library]\nfeatures: [\"pthread\", \"wide_character_type\"]\npublic_types: [\"file\", \"record\", \"template_definition\"]\n\n[tools]\ndescription: \"Several tools for reading Windows XML Event Log (EVTX) files\"\nnames: [\"evtxexport\", \"evtxinfo\"]\n\n[troubleshooting]\nexample: \"evtxinfo Application.Evtx\"\n\n[development]\nmain_object: \"file\"\nmain_object_filename: \"Application.Evtx\"\n\n[tests]\nprofiles: [\"libevtx\", \"pyevtx\", \"evtxinfo\", \"evtxexport\", \"evtxexport_xml\"]\ninfo_tool_options_per_profile: [\"\"]\ninfo_tool_profiles: [\"evtxinfo\"]\nexample_filename1: \"System.Evtx\"\nexample_filename2: \"Application.Evtx\"\n\n" }, { "path": "libevtx.pc.in", "content": "prefix=@prefix@\nexec_prefix=@exec_prefix@\nlibdir=@libdir@\nincludedir=@includedir@\n\nName: libevtx\nDescription: Library to access the Windows XML Event Log (EVTX) format\nVersion: @VERSION@\nLibs: -L${libdir} -levtx\nLibs.private: @ax_libbfio_pc_libs_private@ @ax_libcdata_pc_libs_private@ @ax_libcerror_pc_libs_private@ @ax_libcfile_pc_libs_private@ @ax_libclocale_pc_libs_private@ @ax_libcnotify_pc_libs_private@ @ax_libcpath_pc_libs_private@ @ax_libcsplit_pc_libs_private@ @ax_libcthreads_pc_libs_private@ @ax_libfcache_pc_libs_private@ @ax_libfdata_pc_libs_private@ @ax_libfdatetime_pc_libs_private@ @ax_libfguid_pc_libs_private@ @ax_libfvalue_pc_libs_private@ @ax_libfwevt_pc_libs_private@ @ax_libfwnt_pc_libs_private@ @ax_libuna_pc_libs_private@ @ax_pthread_pc_libs_private@\nCflags: -I${includedir}\n\n" }, { "path": "libevtx.spec.in", "content": "Name: libevtx\nVersion: @VERSION@\nRelease: 1\nSummary: Library to access the Windows XML Event Log (EVTX) format\nGroup: System Environment/Libraries\nLicense: LGPL-3.0-or-later\nSource: %{name}-%{version}.tar.gz\nURL: https://github.com/libyal/libevtx\n@libevtx_spec_requires@ @ax_libbfio_spec_requires@ @ax_libcdata_spec_requires@ @ax_libcerror_spec_requires@ @ax_libcfile_spec_requires@ @ax_libclocale_spec_requires@ @ax_libcnotify_spec_requires@ @ax_libcpath_spec_requires@ @ax_libcsplit_spec_requires@ @ax_libcthreads_spec_requires@ @ax_libfcache_spec_requires@ @ax_libfdata_spec_requires@ @ax_libfdatetime_spec_requires@ @ax_libfguid_spec_requires@ @ax_libfvalue_spec_requires@ @ax_libfwevt_spec_requires@ @ax_libfwnt_spec_requires@ @ax_libuna_spec_requires@\nBuildRequires: gcc @ax_libbfio_spec_build_requires@ @ax_libcdata_spec_build_requires@ @ax_libcerror_spec_build_requires@ @ax_libcfile_spec_build_requires@ @ax_libclocale_spec_build_requires@ @ax_libcnotify_spec_build_requires@ @ax_libcpath_spec_build_requires@ @ax_libcsplit_spec_build_requires@ @ax_libcthreads_spec_build_requires@ @ax_libfcache_spec_build_requires@ @ax_libfdata_spec_build_requires@ @ax_libfdatetime_spec_build_requires@ @ax_libfguid_spec_build_requires@ @ax_libfvalue_spec_build_requires@ @ax_libfwevt_spec_build_requires@ @ax_libfwnt_spec_build_requires@ @ax_libuna_spec_build_requires@\n\n%description -n libevtx\nLibrary to access the Windows XML Event Log (EVTX) format\n\n%package -n libevtx-static\nSummary: Library to access the Windows XML Event Log (EVTX) format\nGroup: Development/Libraries\nRequires: libevtx = %{version}-%{release}\n\n%description -n libevtx-static\nStatic library version of libevtx.\n\n%package -n libevtx-devel\nSummary: Header files and libraries for developing applications for libevtx\nGroup: Development/Libraries\nRequires: libevtx = %{version}-%{release}\n\n%description -n libevtx-devel\nHeader files and libraries for developing applications for libevtx.\n\n%package -n libevtx-python3\nSummary: Python 3 bindings for libevtx\nGroup: System Environment/Libraries\nRequires: libevtx = %{version}-%{release} python3\nBuildRequires: python3-devel python3-setuptools\n\n%description -n libevtx-python3\nPython 3 bindings for libevtx\n\n%package -n libevtx-tools\nSummary: Several tools for reading Windows XML Event Log (EVTX) files\nGroup: Applications/System\nRequires: libevtx = %{version}-%{release} @ax_libcdirectory_spec_requires@ @ax_libexe_spec_requires@ @ax_libregf_spec_requires@ @ax_libwrc_spec_requires@\n@libevtx_spec_tools_build_requires@ @ax_libcdirectory_spec_build_requires@ @ax_libexe_spec_build_requires@ @ax_libregf_spec_build_requires@ @ax_libwrc_spec_build_requires@\n\n%description -n libevtx-tools\nSeveral tools for reading Windows XML Event Log (EVTX) files\n\n%prep\n%setup -q\n\n%build\n%configure --prefix=/usr --libdir=%{_libdir} --mandir=%{_mandir} --enable-python\nmake %{?_smp_mflags}\n\n%install\nrm -rf %{buildroot}\n%make_install\n\n%clean\nrm -rf %{buildroot}\n\n%post -p /sbin/ldconfig\n\n%postun -p /sbin/ldconfig\n\n%files -n libevtx\n%license COPYING COPYING.LESSER\n%doc AUTHORS README\n%{_libdir}/*.so.*\n\n%files -n libevtx-static\n%license COPYING COPYING.LESSER\n%doc AUTHORS README\n%{_libdir}/*.a\n\n%files -n libevtx-devel\n%license COPYING COPYING.LESSER\n%doc AUTHORS README\n%{_libdir}/*.so\n%{_libdir}/pkgconfig/libevtx.pc\n%{_includedir}/*\n%{_mandir}/man3/*\n\n%files -n libevtx-python3\n%license COPYING COPYING.LESSER\n%doc AUTHORS README\n%{_libdir}/python3*/site-packages/*.a\n%{_libdir}/python3*/site-packages/*.so\n\n%files -n libevtx-tools\n%license COPYING COPYING.LESSER\n%doc AUTHORS README\n%{_bindir}/*\n%{_mandir}/man1/*\n\n%changelog\n* @SPEC_DATE@ Joachim Metz @VERSION@-1\n- Auto-generated\n\n" }, { "path": "m4/common.m4", "content": "dnl Checks for common headers and functions\ndnl\ndnl Version: 20241013\n\ndnl Function to test if a certain feature was disabled\nAC_DEFUN([AX_COMMON_ARG_DISABLE],\n [AC_ARG_ENABLE(\n [$1],\n [AS_HELP_STRING(\n [--disable-$1],\n [$3])],\n [ac_cv_enable_$2=$enableval],\n [ac_cv_enable_$2=\"yes\"])dnl\n\n AC_CACHE_CHECK(\n [whether to disable $3],\n [ac_cv_enable_$2],\n [ac_cv_enable_$2=\"yes\"])dnl\n ])\n\ndnl Function to test if a certain feature was enabled\nAC_DEFUN([AX_COMMON_ARG_ENABLE],\n [AC_ARG_ENABLE(\n [$1],\n [AS_HELP_STRING(\n [--enable-$1],\n [$3 @<:@default=$4@:>@])],\n [ac_cv_enable_$2=$enableval],\n [ac_cv_enable_$2=$4])dnl\n\n AC_CACHE_CHECK(\n [whether to enable $3],\n [ac_cv_enable_$2],\n [ac_cv_enable_$2=$4])dnl\n ])\n\ndnl Function to test if the location of a certain feature was provided\nAC_DEFUN([AX_COMMON_ARG_WITH],\n [AC_ARG_WITH(\n [$1],\n [AS_HELP_STRING(\n [--with-$1[[=$5]]],\n [$3 @<:@default=$4@:>@])],\n [ac_cv_with_$2=$withval],\n [ac_cv_with_$2=$4])dnl\n\n AC_CACHE_CHECK(\n [whether to use $3],\n [ac_cv_with_$2],\n [ac_cv_with_$2=$4])dnl\n ])\n\ndnl Function to detect whether shared library support should be disabled\nAC_DEFUN([AX_COMMON_CHECK_DISABLE_SHARED_LIBS],\n [AX_COMMON_ARG_DISABLE(\n [shared-libs],\n [shared_libs],\n [disable shared library support])\n ])\n\ndnl Function to detect whether debug output should be enabled\nAC_DEFUN([AX_COMMON_CHECK_ENABLE_DEBUG_OUTPUT],\n [AX_COMMON_ARG_ENABLE(\n [debug-output],\n [debug_output],\n [enable debug output],\n [no])\n\n AS_IF(\n [test \"x$ac_cv_enable_debug_output\" != xno ],\n [AC_DEFINE(\n [HAVE_DEBUG_OUTPUT],\n [1],\n [Define to 1 if debug output should be used.])\n\n ac_cv_enable_debug_output=yes])\n ])\n\ndnl Function to detect whether static executables support should be enabled\nAC_DEFUN([AX_COMMON_CHECK_ENABLE_STATIC_EXECUTABLES],\n [AX_COMMON_ARG_ENABLE(\n [static-executables],\n [static_executables],\n [build static executables (binaries)],\n [no])\n\n AS_IF(\n [test \"x$ac_cv_enable_static_executables\" != xno],\n [STATIC_LDFLAGS=\"-all-static\";\n\n AC_SUBST(\n [STATIC_LDFLAGS])\n\n ac_cv_enable_static_executables=yes\n enable_shared=no])\n ])\n\ndnl Function to detect whether verbose output should be enabled\nAC_DEFUN([AX_COMMON_CHECK_ENABLE_VERBOSE_OUTPUT],\n [AX_COMMON_ARG_ENABLE(\n [verbose-output],\n [verbose_output],\n [enable verbose output],\n [no])\n\n AS_IF(\n [test \"x$ac_cv_enable_verbose_output\" != xno ],\n [AC_DEFINE(\n [HAVE_VERBOSE_OUTPUT],\n [1],\n [Define to 1 if verbose output should be used.])\n\n ac_cv_enable_verbose_output=yes])\n ])\n\ndnl Function to detect whether wide character type support should be enabled\nAC_DEFUN([AX_COMMON_CHECK_ENABLE_WIDE_CHARACTER_TYPE],\n [AX_COMMON_ARG_ENABLE(\n [wide-character-type],\n [wide_character_type],\n [enable wide character type support],\n [no])\n ])\n\ndnl Function to detect whether WINAPI support should be enabled\nAC_DEFUN([AX_COMMON_CHECK_ENABLE_WINAPI],\n [AX_COMMON_ARG_ENABLE(\n [winapi],\n [winapi],\n [enable WINAPI support for cross-compilation],\n [auto-detect])\n\n AS_IF(\n [test \"x$ac_cv_enable_winapi\" = xauto-detect],\n [ac_common_check_winapi_target_string=\"$target\"\n\n AS_IF(\n [test \"x$ac_common_check_winapi_target_string\" = x],\n [ac_common_check_winapi_target_string=\"$host\"])\n\n AS_CASE(\n [$ac_common_check_winapi_target_string],\n [*mingw*],[AC_MSG_NOTICE(\n [detected MinGW enabling WINAPI support for cross-compilation])\n ac_cv_enable_winapi=yes],\n [*msys*],[AC_MSG_NOTICE(\n [detected MSYS enabling WINAPI support for cross-compilation])\n ac_cv_enable_winapi=yes],\n [*],[ac_cv_enable_winapi=no])\n ])\n ])\n\ndnl Function to detect whether printf conversion specifier \"%jd\" is available\nAC_DEFUN([AX_COMMON_CHECK_FUNC_PRINTF_JD],\n [AC_MSG_CHECKING(\n [whether printf supports the conversion specifier \"%jd\"])\n\n SAVE_CFLAGS=\"$CFLAGS\"\n CFLAGS=\"$CFLAGS -Wall -Werror\"\n AC_LANG_PUSH(C)\n\n dnl First try to see if compilation and linkage without a parameter succeeds\n AC_LINK_IFELSE(\n [AC_LANG_PROGRAM(\n [[#include ]],\n [[printf( \"%jd\" ); ]] )],\n [ac_cv_cv_have_printf_jd=no],\n [ac_cv_cv_have_printf_jd=yes])\n\n dnl Second try to see if compilation and linkage with a parameter succeeds\n AS_IF(\n [test \"x$ac_cv_cv_have_printf_jd\" = xyes],\n [AC_LINK_IFELSE(\n [AC_LANG_PROGRAM(\n [[#include \n#include ]],\n [[printf( \"%jd\", (off_t) 10 ); ]] )],\n [ac_cv_cv_have_printf_jd=yes],\n [ac_cv_cv_have_printf_jd=no])\n ])\n\n dnl Third try to see if the program runs correctly\n AS_IF(\n [test \"x$ac_cv_cv_have_printf_jd\" = xyes],\n [AC_RUN_IFELSE(\n [AC_LANG_PROGRAM(\n [[#include \n#include ]],\n [[char string[ 3 ];\nif( snprintf( string, 3, \"%jd\", (off_t) 10 ) < 0 ) return( 1 );\nif( ( string[ 0 ] != '1' ) || ( string[ 1 ] != '0' ) ) return( 1 ); ]] )],\n [ac_cv_cv_have_printf_jd=yes],\n [ac_cv_cv_have_printf_jd=no],\n [ac_cv_cv_have_printf_jd=undetermined])\n ])\n\n AC_LANG_POP(C)\n CFLAGS=\"$SAVE_CFLAGS\"\n\n AS_IF(\n [test \"x$ac_cv_cv_have_printf_jd\" = xyes],\n [AC_MSG_RESULT(\n [yes])\n AC_DEFINE(\n [HAVE_PRINTF_JD],\n [1],\n [Define to 1 whether printf supports the conversion specifier \"%jd\".]) ],\n [AC_MSG_RESULT(\n [$ac_cv_cv_have_printf_jd])\n ])\n ])\n\ndnl Function to detect whether printf conversion specifier \"%zd\" is available\nAC_DEFUN([AX_COMMON_CHECK_FUNC_PRINTF_ZD],\n [AC_MSG_CHECKING(\n [whether printf supports the conversion specifier \"%zd\"])\n\n SAVE_CFLAGS=\"$CFLAGS\"\n CFLAGS=\"$CFLAGS -Wall -Werror\"\n AC_LANG_PUSH(C)\n\n dnl First try to see if compilation and linkage without a parameter succeeds\n AC_LINK_IFELSE(\n [AC_LANG_PROGRAM(\n [[#include ]],\n [[printf( \"%zd\" ); ]] )],\n [ac_cv_cv_have_printf_zd=no],\n [ac_cv_cv_have_printf_zd=yes])\n\n dnl Second try to see if compilation and linkage with a parameter succeeds\n AS_IF(\n [test \"x$ac_cv_cv_have_printf_zd\" = xyes],\n [AC_LINK_IFELSE(\n [AC_LANG_PROGRAM(\n [[#include \n#include ]],\n [[printf( \"%zd\", (size_t) 10 ); ]] )],\n [ac_cv_cv_have_printf_zd=yes],\n [ac_cv_cv_have_printf_zd=no])\n ])\n\n dnl Third try to see if the program runs correctly\n AS_IF(\n [test \"x$ac_cv_cv_have_printf_zd\" = xyes],\n [AC_RUN_IFELSE(\n [AC_LANG_PROGRAM(\n [[#include \n#include ]],\n [[char string[ 3 ];\nif( snprintf( string, 3, \"%zd\", (size_t) 10 ) < 0 ) return( 1 );\nif( ( string[ 0 ] != '1' ) || ( string[ 1 ] != '0' ) ) return( 1 ); ]] )],\n [ac_cv_cv_have_printf_zd=yes],\n [ac_cv_cv_have_printf_zd=no],\n [ac_cv_cv_have_printf_zd=undetermined])\n ])\n\n AC_LANG_POP(C)\n CFLAGS=\"$SAVE_CFLAGS\"\n\n AS_IF(\n [test \"x$ac_cv_cv_have_printf_zd\" = xyes],\n [AC_MSG_RESULT(\n [yes])\n AC_DEFINE(\n [HAVE_PRINTF_ZD],\n [1],\n [Define to 1 whether printf supports the conversion specifier \"%zd\".]) ],\n [AC_MSG_RESULT(\n [$ac_cv_cv_have_printf_zd])\n ])\n ])\n\ndnl Function to detect if common dependencies are available\nAC_DEFUN([AX_COMMON_CHECK_LOCAL],\n [dnl Headers included in common/common.h\n AS_IF(\n [test \"x$ac_cv_enable_winapi\" = xyes],\n [AC_CHECK_HEADERS([windows.h])\n\n AS_IF(\n [test \"x$ac_cv_header_windows_h\" = xno],\n [AC_MSG_FAILURE(\n [Missing header: windows.h header is required to compile with winapi support],\n [1])\n ])\n ])\n\n AS_IF(\n [test \"x$ac_cv_enable_winapi\" = xno],\n [AC_CHECK_HEADERS([libintl.h])\n ])\n\n dnl Headers included in common/types.h\n AC_CHECK_HEADERS([limits.h])\n\n dnl Headers included in common/memory.h and common/narrow_string.h\n AC_CHECK_HEADERS([stdlib.h string.h])\n\n dnl Headers included in common/wide_string.h\n AC_CHECK_HEADERS([wchar.h wctype.h])\n\n dnl File stream functions used in common/file_stream.h\n AC_CHECK_FUNCS([fclose feof fgets fopen fread fseeko fseeko64 fwrite vfprintf])\n\n AS_IF(\n [test \"x$ac_cv_func_fclose\" != xyes],\n [AC_MSG_FAILURE(\n [Missing function: fclose],\n [1])\n ])\n\n AS_IF(\n [test \"x$ac_cv_func_feof\" != xyes],\n [AC_MSG_FAILURE(\n [Missing function: feof],\n [1])\n ])\n\n AS_IF(\n [test \"x$ac_cv_func_fgets\" != xyes],\n [AC_MSG_FAILURE(\n [Missing function: fgets],\n [1])\n ])\n\n AS_IF(\n [test \"x$ac_cv_func_fopen\" != xyes],\n [AC_MSG_FAILURE(\n [Missing function: fopen],\n [1])\n ])\n\n AS_IF(\n [test \"x$ac_cv_func_fread\" != xyes],\n [AC_MSG_FAILURE(\n [Missing function: fread],\n [1])\n ])\n\n AS_IF(\n [test \"x$ac_cv_func_fseeko\" != xyes && test \"x$ac_cv_func_fseeko64\" != xyes],\n [AC_MSG_FAILURE(\n [Missing function: fseeko and fseeko64],\n [1])\n ])\n\n AS_IF(\n [test \"x$ac_cv_func_fwrite\" != xyes],\n [AC_MSG_FAILURE(\n [Missing function: fwrite],\n [1])\n ])\n\n AS_IF(\n [test \"x$ac_cv_func_vfprintf\" != xyes],\n [AC_MSG_FAILURE(\n [Missing function: vfprintf],\n [1])\n ])\n\n AS_IF(\n [test \"x$ac_cv_enable_wide_character_type\" != xno],\n [AC_CHECK_FUNCS([fgetws])\n\n AS_IF(\n [test \"x$ac_cv_func_fgetws\" != xyes],\n [AC_MSG_FAILURE(\n [Missing function: fgetws],\n [1])\n ])\n ])\n\n dnl Memory functions used in common/memory.h\n AC_CHECK_FUNCS([free malloc memcmp memcpy memset realloc])\n\n AS_IF(\n [test \"x$ac_cv_func_free\" != xyes],\n [AC_MSG_FAILURE(\n [Missing function: free],\n [1])\n ])\n\n AS_IF(\n [test \"x$ac_cv_func_malloc\" != xyes],\n [AC_MSG_FAILURE(\n [Missing function: malloc],\n [1])\n ])\n\n AS_IF(\n [test \"x$ac_cv_func_memcmp\" != xyes],\n [AC_MSG_FAILURE(\n [Missing function: memcmp],\n [1])\n ])\n\n AS_IF(\n [test \"x$ac_cv_func_memcpy\" != xyes],\n [AC_MSG_FAILURE(\n [Missing function: memcpy],\n [1])\n ])\n\n AS_IF(\n [test \"x$ac_cv_func_memset\" != xyes],\n [AC_MSG_FAILURE(\n [Missing function: memset],\n [1])\n ])\n\n AS_IF(\n [test \"x$ac_cv_func_realloc\" != xyes],\n [AC_MSG_FAILURE(\n [Missing function: realloc],\n [1])\n ])\n\n dnl Narrow character string functions used in common/narrow_string.h\n AC_CHECK_FUNCS([memchr memrchr snprintf sscanf strcasecmp strchr strlen strncasecmp strncmp strncpy strnicmp strrchr strstr vsnprintf])\n\n AS_IF(\n [test \"x$ac_cv_func_memchr\" != xyes && test \"x$ac_cv_func_strchr\" != xyes],\n [AC_MSG_FAILURE(\n [Missing functions: memchr and strchr],\n [1])\n ])\n\n AS_IF(\n [test \"x$ac_cv_func_memcmp\" != xyes && test \"x$ac_cv_func_strncmp\" != xyes],\n [AC_MSG_FAILURE(\n [Missing functions: memcmp and strncmp],\n [1])\n ])\n\n AS_IF(\n [test \"x$ac_cv_func_memcpy\" != xyes && test \"x$ac_cv_func_strncpy\" != xyes],\n [AC_MSG_FAILURE(\n [Missing functions: memcpy and strncpy],\n [1])\n ])\n\n AS_IF(\n [test \"x$ac_cv_func_memrchr\" = xyes],\n [AC_CHECK_DECLS([memrchr])\n\n AS_IF(\n [test \"x$ac_cv_decl_memrchr\" != xyes],\n [ac_cv_func_memrchr=no])\n ])\n\n AS_IF(\n [test \"x$ac_cv_func_memrchr\" != xyes && test \"x$ac_cv_func_strrchr\" != xyes],\n [AC_MSG_FAILURE(\n [Missing functions: strrchr and memrchr],\n [1])\n ])\n\n AS_IF(\n [test \"x$ac_cv_func_snprintf\" != xyes],\n [AC_MSG_FAILURE(\n [Missing function: snprintf],\n [1])\n ])\n\n AS_IF(\n [test \"x$ac_cv_func_sscanf\" != xyes],\n [AC_MSG_FAILURE(\n [Missing function: sscanf],\n [1])\n ])\n\n AS_IF(\n [test \"x$ac_cv_func_strlen\" != xyes],\n [AC_MSG_FAILURE(\n [Missing function: strlen],\n [1])\n ])\n\n AS_IF(\n [test \"x$ac_cv_func_strcasecmp\" != xyes && test \"x$ac_cv_func_strncasecmp\" != xyes && test \"x$ac_cv_func_strnicmp\" != xyes],\n [AC_MSG_FAILURE(\n [Missing functions: strncasecmp, strcasecmp and strnicmp],\n [1])\n ])\n\n AS_IF(\n [test \"x$ac_cv_func_strstr\" != xyes],\n [AC_MSG_FAILURE(\n [Missing function: strstr],\n [1])\n ])\n\n AS_IF(\n [test \"x$ac_cv_func_vsnprintf\" != xyes],\n [AC_MSG_FAILURE(\n [Missing function: vsnprintf],\n [1])\n ])\n\n dnl Wide character string functions used in common/wide_string.h\n AS_IF(\n [test \"x$ac_cv_enable_wide_character_type\" != xno],\n [AC_CHECK_FUNCS([swprintf towlower wcscasecmp wcschr wcslen wcsncasecmp wcsncmp wcsncpy wcsnicmp wcsrchr wcsstr wmemchr wmemcmp wmemcpy wmemrchr])\n\n AS_IF(\n [test \"x$ac_cv_func_swprintf\" != xyes],\n [AC_MSG_FAILURE(\n [Missing function: swprintf],\n [1])\n ])\n\n AS_IF(\n [test \"x$ac_cv_func_wmemchr\" != xyes && test \"x$ac_cv_func_wcschr\" != xyes],\n [AC_MSG_FAILURE(\n [Missing functions: wmemchr and wcschr],\n [1])\n ])\n\n AS_IF(\n [test \"x$ac_cv_func_wmemcmp\" != xyes && test \"x$ac_cv_func_wcsncmp\" != xyes],\n [AC_MSG_FAILURE(\n [Missing functions: wmemcmp and wcsncmp],\n [1])\n ])\n\n AS_IF(\n [test \"x$ac_cv_func_wmemcpy\" != xyes && test \"x$ac_cv_func_wcsncpy\" != xyes],\n [AC_MSG_FAILURE(\n [Missing functions: wmemcpy and wcsncpy],\n [1])\n ])\n\n AS_IF(\n [test \"x$ac_cv_func_wmemrchr\" != xyes && test \"x$ac_cv_func_wcsrchr\" != xyes],\n [AC_MSG_FAILURE(\n [Missing functions: wmemrchr and wcsrchr],\n [1])\n ])\n\n AS_IF(\n [test \"x$ac_cv_func_wcslen\" != xyes],\n [AC_MSG_FAILURE(\n [Missing function: wcslen],\n [1])\n ])\n\n AS_IF(\n [test \"x$ac_cv_func_wcsncasecmp\" != xyes && test \"x$ac_cv_func_wcscasecmp\" != xyes && test \"x$ac_cv_func_wcsnicmp\" != xyes && test \"x$ac_cv_func_towlower\" != xyes],\n [AC_MSG_FAILURE(\n [Missing functions: wcsncasecmp, wcscasecmp, wcsnicmp and towlower],\n [1])\n ])\n\n AS_IF(\n [test \"x$ac_cv_func_wcsstr\" != xyes],\n [AC_MSG_FAILURE(\n [Missing function: wcsstr],\n [1])\n ])\n ])\n\n dnl Check for printf conversion specifier support\n AX_COMMON_CHECK_FUNC_PRINTF_JD\n AX_COMMON_CHECK_FUNC_PRINTF_ZD\n ])\n\ndnl Function to test if a library with a specific definition is available\nAC_DEFUN([AX_CHECK_LIB_DEFINITION],\n [AC_CACHE_CHECK(\n [if `$2' is defined],\n [ac_cv_$1_definition_$2],\n [AC_LANG_PUSH(C)\n AC_LINK_IFELSE(\n [AC_LANG_PROGRAM(\n [[#include <$1.h>]],\n [[int test = $2;\n\nreturn( 0 ); ]]\n )],\n [ac_cv_$1_definition_$2=yes],\n [ac_cv_$1_definition_$2=no])\n AC_LANG_POP(C)])\n\n AS_IF(\n [test \"x$ac_cv_$1_definition_$2\" != xyes],\n [ac_cv_$1=no])\n ])\n\ndnl Function to test if a library with specific definitions is available\nAC_DEFUN([AX_CHECK_LIB_DEFINITIONS],\n [m4_foreach(\n [definition],\n [$2],\n [AX_CHECK_LIB_DEFINITION(\n [$1],\n [definition])\n ])\n ])\n\ndnl Function to test if a library with specific functions is available\nAC_DEFUN([AX_CHECK_LIB_FUNCTIONS],\n [m4_foreach(\n [function],\n [$3],\n [AC_CHECK_LIB(\n [$2],\n [function],\n [ac_cv_$1_dummy=yes],\n [ac_cv_$1=no])\n ])\n ])\n\ndnl Function to check if an user specified library directory exists\nAC_DEFUN([AX_CHECK_LIB_DIRECTORY_EXISTS],\n [AS_IF(\n [test -d \"$ac_cv_with_$1\"],\n [CFLAGS=\"$CFLAGS -I${ac_cv_with_$1}/include\"\n LDFLAGS=\"$LDFLAGS -L${ac_cv_with_$1}/lib\"],\n [AC_MSG_FAILURE(\n [no such directory: $ac_cv_with_$1],\n [1])\n ])\n ])\n\ndnl Function to warn if no supported library was found in an user specified directory\nAC_DEFUN([AX_CHECK_LIB_DIRECTORY_MSG_ON_FAILURE],\n [AS_IF(\n [test \"x$ac_cv_$1\" != xyes && test \"x$ac_cv_with_$1\" != x && test \"x$ac_cv_with_$1\" != xauto-detect && test \"x$ac_cv_with_$1\" != xyes],\n [AC_MSG_FAILURE(\n [unable to find supported $1 in directory: $ac_cv_with_$1],\n [1])\n ])\n ])\n\n" }, { "path": "m4/libbfio.m4", "content": "dnl Checks for libbfio required headers and functions\ndnl\ndnl Version: 20240518\n\ndnl Function to detect if libbfio is available\ndnl ac_libbfio_dummy is used to prevent AC_CHECK_LIB adding unnecessary -l arguments\nAC_DEFUN([AX_LIBBFIO_CHECK_LIB],\n [AS_IF(\n [test \"x$ac_cv_enable_shared_libs\" = xno || test \"x$ac_cv_with_libbfio\" = xno],\n [ac_cv_libbfio=no],\n [ac_cv_libbfio=check\n dnl Check if the directory provided as parameter exists\n dnl For both --with-libbfio which returns \"yes\" and --with-libbfio= which returns \"\"\n dnl treat them as auto-detection.\n AS_IF(\n [test \"x$ac_cv_with_libbfio\" != x && test \"x$ac_cv_with_libbfio\" != xauto-detect && test \"x$ac_cv_with_libbfio\" != xyes],\n [AX_CHECK_LIB_DIRECTORY_EXISTS([libbfio])],\n [dnl Check for a pkg-config file\n AS_IF(\n [test \"x$cross_compiling\" != \"xyes\" && test \"x$PKGCONFIG\" != \"x\"],\n [PKG_CHECK_MODULES(\n [libbfio],\n [libbfio >= 20201125],\n [ac_cv_libbfio=yes],\n [ac_cv_libbfio=check])\n ])\n AS_IF(\n [test \"x$ac_cv_libbfio\" = xyes && test \"x$ac_cv_enable_wide_character_type\" != xno],\n [AC_CACHE_CHECK(\n [whether libbfio/features.h defines LIBBFIO_HAVE_WIDE_CHARACTER_TYPE as 1],\n [ac_cv_header_libbfio_features_h_have_wide_character_type],\n [AC_LANG_PUSH(C)\n AC_COMPILE_IFELSE(\n [AC_LANG_PROGRAM(\n [[#include ]],\n [[#if !defined( LIBBFIO_HAVE_WIDE_CHARACTER_TYPE ) || ( LIBBFIO_HAVE_WIDE_CHARACTER_TYPE != 1 )\n#error LIBBFIO_HAVE_WIDE_CHARACTER_TYPE not defined\n#endif]] )],\n [ac_cv_header_libbfio_features_h_have_wide_character_type=yes],\n [ac_cv_header_libbfio_features_h_have_wide_character_type=no])\n AC_LANG_POP(C)],\n [ac_cv_header_libbfio_features_h_have_wide_character_type=no])\n\n AS_IF(\n [test \"x$ac_cv_header_libbfio_features_h_have_wide_character_type\" = xno],\n [ac_cv_libbfio=no])\n ])\n AS_IF(\n [test \"x$ac_cv_libbfio\" = xyes],\n [ac_cv_libbfio_CPPFLAGS=\"$pkg_cv_libbfio_CFLAGS\"\n ac_cv_libbfio_LIBADD=\"$pkg_cv_libbfio_LIBS\"])\n ])\n\n AS_IF(\n [test \"x$ac_cv_libbfio\" = xcheck],\n [dnl Check for headers\n AC_CHECK_HEADERS([libbfio.h])\n\n AS_IF(\n [test \"x$ac_cv_header_libbfio_h\" = xno],\n [ac_cv_libbfio=no],\n [ac_cv_libbfio=yes\n\n AX_CHECK_LIB_FUNCTIONS(\n [libbfio],\n [bfio],\n [[libbfio_get_version],\n [libbfio_handle_free],\n [libbfio_handle_open],\n [libbfio_handle_close],\n [libbfio_handle_exists],\n [libbfio_handle_read_buffer],\n [libbfio_handle_read_buffer_at_offset],\n [libbfio_handle_write_buffer],\n [libbfio_handle_write_buffer_at_offset],\n [libbfio_handle_seek_offset],\n [libbfio_handle_is_open],\n [libbfio_handle_get_offset],\n [libbfio_handle_get_size],\n [libbfio_handle_set_track_offsets_read],\n [libbfio_handle_get_number_of_offsets_read],\n [libbfio_handle_get_offset_read],\n [libbfio_file_initialize],\n [libbfio_file_get_name_size],\n [libbfio_file_get_name],\n [libbfio_file_set_name],\n [libbfio_pool_initialize],\n [libbfio_pool_free],\n [libbfio_pool_clone],\n [libbfio_pool_get_number_of_handles],\n [libbfio_pool_get_handle],\n [libbfio_pool_set_handle],\n [libbfio_pool_append_handle],\n [libbfio_pool_remove_handle],\n [libbfio_pool_get_maximum_number_of_open_handles],\n [libbfio_pool_set_maximum_number_of_open_handles],\n [libbfio_pool_open],\n [libbfio_pool_reopen],\n [libbfio_pool_close],\n [libbfio_pool_close_all],\n [libbfio_pool_read_buffer],\n [libbfio_pool_read_buffer_at_offset],\n [libbfio_pool_write_buffer],\n [libbfio_pool_write_buffer_at_offset],\n [libbfio_pool_seek_offset],\n [libbfio_pool_get_offset],\n [libbfio_pool_get_size],\n [libbfio_file_pool_open]])\n\n AS_IF(\n [test \"x$ac_cv_enable_wide_character_type\" != xno],\n [AX_CHECK_LIB_FUNCTIONS(\n [libbfio],\n [bfio],\n [[libbfio_file_get_name_size_wide],\n [libbfio_file_get_name_wide],\n [libbfio_file_set_name_wide],\n [libbfio_file_pool_open_wide]])\n ])\n\n ac_cv_libbfio_LIBADD=\"-lbfio\"])\n ])\n\n AX_CHECK_LIB_DIRECTORY_MSG_ON_FAILURE([libbfio])\n ])\n\n AS_IF(\n [test \"x$ac_cv_libbfio\" = xyes],\n [AC_DEFINE(\n [HAVE_LIBBFIO],\n [1],\n [Define to 1 if you have the `bfio' library (-lbfio).])\n ])\n\n AS_IF(\n [test \"x$ac_cv_libbfio\" = xyes],\n [AC_SUBST(\n [HAVE_LIBBFIO],\n [1]) ],\n [AC_SUBST(\n [HAVE_LIBBFIO],\n [0])\n ])\n ])\n\ndnl Function to detect if libbfio dependencies are available\nAC_DEFUN([AX_LIBBFIO_CHECK_LOCAL],\n [dnl No additional checks.\n\n ac_cv_libbfio_CPPFLAGS=\"-I../libbfio -I\\$(top_srcdir)/libbfio\";\n ac_cv_libbfio_LIBADD=\"../libbfio/libbfio.la\";\n\n ac_cv_libbfio=local\n ])\n\ndnl Function to detect how to enable libbfio\nAC_DEFUN([AX_LIBBFIO_CHECK_ENABLE],\n [AX_COMMON_ARG_WITH(\n [libbfio],\n [libbfio],\n [search for libbfio in includedir and libdir or in the specified DIR, or no if to use local version],\n [auto-detect],\n [DIR])\n\n dnl Check for a shared library version\n AX_LIBBFIO_CHECK_LIB\n\n dnl Check if the dependencies for the local library version\n AS_IF(\n [test \"x$ac_cv_libbfio\" != xyes],\n [AX_LIBBFIO_CHECK_LOCAL\n\n AC_DEFINE(\n [HAVE_LOCAL_LIBBFIO],\n [1],\n [Define to 1 if the local version of libbfio is used.])\n AC_SUBST(\n [HAVE_LOCAL_LIBBFIO],\n [1])\n ])\n\n AM_CONDITIONAL(\n [HAVE_LOCAL_LIBBFIO],\n [test \"x$ac_cv_libbfio\" = xlocal])\n AS_IF(\n [test \"x$ac_cv_libbfio_CPPFLAGS\" != \"x\"],\n [AC_SUBST(\n [LIBBFIO_CPPFLAGS],\n [$ac_cv_libbfio_CPPFLAGS])\n ])\n AS_IF(\n [test \"x$ac_cv_libbfio_LIBADD\" != \"x\"],\n [AC_SUBST(\n [LIBBFIO_LIBADD],\n [$ac_cv_libbfio_LIBADD])\n ])\n\n AS_IF(\n [test \"x$ac_cv_libbfio\" = xyes],\n [AC_SUBST(\n [ax_libbfio_pc_libs_private],\n [-lbfio])\n ])\n\n AS_IF(\n [test \"x$ac_cv_libbfio\" = xyes],\n [AC_SUBST(\n [ax_libbfio_spec_requires],\n [libbfio])\n AC_SUBST(\n [ax_libbfio_spec_build_requires],\n [libbfio-devel])\n ])\n ])\n\n" }, { "path": "m4/libcdata.m4", "content": "dnl Checks for libcdata required headers and functions\ndnl\ndnl Version: 20240514\n\ndnl Function to detect if libcdata is available\ndnl ac_libcdata_dummy is used to prevent AC_CHECK_LIB adding unnecessary -l arguments\nAC_DEFUN([AX_LIBCDATA_CHECK_LIB],\n [AS_IF(\n [test \"x$ac_cv_enable_shared_libs\" = xno || test \"x$ac_cv_with_libcdata\" = xno],\n [ac_cv_libcdata=no],\n [ac_cv_libcdata=check\n dnl Check if the directory provided as parameter exists\n dnl For both --with-libcdata which returns \"yes\" and --with-libcdata= which returns \"\"\n dnl treat them as auto-detection.\n AS_IF(\n [test \"x$ac_cv_with_libcdata\" != x && test \"x$ac_cv_with_libcdata\" != xauto-detect && test \"x$ac_cv_with_libcdata\" != xyes],\n [AX_CHECK_LIB_DIRECTORY_EXISTS([libcdata])],\n [dnl Check for a pkg-config file\n AS_IF(\n [test \"x$cross_compiling\" != \"xyes\" && test \"x$PKGCONFIG\" != \"x\"],\n [PKG_CHECK_MODULES(\n [libcdata],\n [libcdata >= 20230108],\n [ac_cv_libcdata=yes],\n [ac_cv_libcdata=check])\n ])\n AS_IF(\n [test \"x$ac_cv_libcdata\" = xyes],\n [ac_cv_libcdata_CPPFLAGS=\"$pkg_cv_libcdata_CFLAGS\"\n ac_cv_libcdata_LIBADD=\"$pkg_cv_libcdata_LIBS\"])\n ])\n\n AS_IF(\n [test \"x$ac_cv_libcdata\" = xcheck],\n [dnl Check for headers\n AC_CHECK_HEADERS([libcdata.h])\n\n AS_IF(\n [test \"x$ac_cv_header_libcdata_h\" = xno],\n [ac_cv_libcdata=no],\n [ac_cv_libcdata=yes\n\n AX_CHECK_LIB_FUNCTIONS(\n [libcdata],\n [cdata],\n [[libcdata_get_version],\n [libcdata_array_initialize],\n [libcdata_array_free],\n [libcdata_array_empty],\n [libcdata_array_clone],\n [libcdata_array_resize],\n [libcdata_array_reverse],\n [libcdata_array_get_number_of_entries],\n [libcdata_array_get_entry_by_index],\n [libcdata_array_get_entry_by_value],\n [libcdata_array_set_entry_by_index],\n [libcdata_array_prepend_entry],\n [libcdata_array_append_entry],\n [libcdata_array_insert_entry],\n [libcdata_array_remove_entry],\n [libcdata_btree_initialize],\n [libcdata_btree_free],\n [libcdata_btree_get_number_of_values],\n [libcdata_btree_get_value_by_index],\n [libcdata_btree_get_value_by_value],\n [libcdata_btree_insert_value],\n [libcdata_btree_replace_value],\n [libcdata_btree_remove_value],\n [libcdata_list_initialize],\n [libcdata_list_free],\n [libcdata_list_empty],\n [libcdata_list_clone],\n [libcdata_list_get_number_of_elements],\n [libcdata_list_get_first_element],\n [libcdata_list_get_last_element],\n [libcdata_list_get_element_by_index],\n [libcdata_list_get_value_by_index],\n [libcdata_list_prepend_element],\n [libcdata_list_prepend_value],\n [libcdata_list_append_element],\n [libcdata_list_append_value],\n [libcdata_list_insert_element],\n [libcdata_list_insert_element_with_existing],\n [libcdata_list_insert_value],\n [libcdata_list_insert_value_with_existing],\n [libcdata_list_remove_element],\n [libcdata_list_element_initialize],\n [libcdata_list_element_free],\n [libcdata_list_element_get_value],\n [libcdata_list_element_set_value],\n [libcdata_list_element_get_previous_element],\n [libcdata_list_element_set_previous_element],\n [libcdata_list_element_get_next_element],\n [libcdata_list_element_get_elements],\n [libcdata_list_element_set_elements],\n [libcdata_range_list_initialize],\n [libcdata_range_list_free],\n [libcdata_range_list_empty],\n [libcdata_range_list_clone],\n [libcdata_range_list_get_number_of_elements],\n [libcdata_range_list_insert_range],\n [libcdata_range_list_insert_range_list],\n [libcdata_range_list_remove_range],\n [libcdata_range_list_get_range_by_index],\n [libcdata_range_list_get_range_at_offset],\n [libcdata_range_list_range_is_present],\n [libcdata_range_list_range_has_overlapping_range],\n [libcdata_range_list_get_spanning_range],\n [libcdata_tree_node_initialize],\n [libcdata_tree_node_free],\n [libcdata_tree_node_empty],\n [libcdata_tree_node_clone],\n [libcdata_tree_node_get_value],\n [libcdata_tree_node_set_value],\n [libcdata_tree_node_get_parent_node],\n [libcdata_tree_node_set_parent_node],\n [libcdata_tree_node_get_previous_node],\n [libcdata_tree_node_set_previous_node],\n [libcdata_tree_node_get_next_node],\n [libcdata_tree_node_set_next_node],\n [libcdata_tree_node_get_nodes],\n [libcdata_tree_node_set_nodes],\n [libcdata_tree_node_append_node],\n [libcdata_tree_node_append_value],\n [libcdata_tree_node_insert_node],\n [libcdata_tree_node_insert_value],\n [libcdata_tree_node_replace_node],\n [libcdata_tree_node_remove_node],\n [libcdata_tree_node_get_number_of_sub_nodes],\n [libcdata_tree_node_get_sub_node_by_index],\n [libcdata_tree_node_get_leaf_node_list]])\n\n ac_cv_libcdata_LIBADD=\"-lcdata\"])\n ])\n\n AX_CHECK_LIB_DIRECTORY_MSG_ON_FAILURE([libcdata])\n ])\n\n AS_IF(\n [test \"x$ac_cv_libcdata\" = xyes],\n [AC_DEFINE(\n [HAVE_LIBCDATA],\n [1],\n [Define to 1 if you have the `cdata' library (-lcdata).])\n ])\n\n AS_IF(\n [test \"x$ac_cv_libcdata\" = xyes],\n [AC_SUBST(\n [HAVE_LIBCDATA],\n [1]) ],\n [AC_SUBST(\n [HAVE_LIBCDATA],\n [0])\n ])\n ])\n\ndnl Function to detect if libcdata dependencies are available\nAC_DEFUN([AX_LIBCDATA_CHECK_LOCAL],\n [dnl No additional checks.\n\n ac_cv_libcdata_CPPFLAGS=\"-I../libcdata -I\\$(top_srcdir)/libcdata\";\n ac_cv_libcdata_LIBADD=\"../libcdata/libcdata.la\";\n\n ac_cv_libcdata=local\n ])\n\ndnl Function to detect how to enable libcdata\nAC_DEFUN([AX_LIBCDATA_CHECK_ENABLE],\n [AX_COMMON_ARG_WITH(\n [libcdata],\n [libcdata],\n [search for libcdata in includedir and libdir or in the specified DIR, or no if to use local version],\n [auto-detect],\n [DIR])\n\n dnl Check for a shared library version\n AX_LIBCDATA_CHECK_LIB\n\n dnl Check if the dependencies for the local library version\n AS_IF(\n [test \"x$ac_cv_libcdata\" != xyes],\n [AX_LIBCDATA_CHECK_LOCAL\n\n AC_DEFINE(\n [HAVE_LOCAL_LIBCDATA],\n [1],\n [Define to 1 if the local version of libcdata is used.])\n AC_SUBST(\n [HAVE_LOCAL_LIBCDATA],\n [1])\n ])\n\n AM_CONDITIONAL(\n [HAVE_LOCAL_LIBCDATA],\n [test \"x$ac_cv_libcdata\" = xlocal])\n AS_IF(\n [test \"x$ac_cv_libcdata_CPPFLAGS\" != \"x\"],\n [AC_SUBST(\n [LIBCDATA_CPPFLAGS],\n [$ac_cv_libcdata_CPPFLAGS])\n ])\n AS_IF(\n [test \"x$ac_cv_libcdata_LIBADD\" != \"x\"],\n [AC_SUBST(\n [LIBCDATA_LIBADD],\n [$ac_cv_libcdata_LIBADD])\n ])\n\n AS_IF(\n [test \"x$ac_cv_libcdata\" = xyes],\n [AC_SUBST(\n [ax_libcdata_pc_libs_private],\n [-lcdata])\n ])\n\n AS_IF(\n [test \"x$ac_cv_libcdata\" = xyes],\n [AC_SUBST(\n [ax_libcdata_spec_requires],\n [libcdata])\n AC_SUBST(\n [ax_libcdata_spec_build_requires],\n [libcdata-devel])\n ])\n ])\n\n" }, { "path": "m4/libcdirectory.m4", "content": "dnl Checks for libcdirectory required headers and functions\ndnl\ndnl Version: 20240525\n\ndnl Function to detect if libcdirectory is available\ndnl ac_libcdirectory_dummy is used to prevent AC_CHECK_LIB adding unnecessary -l arguments\nAC_DEFUN([AX_LIBCDIRECTORY_CHECK_LIB],\n [AS_IF(\n [test \"x$ac_cv_enable_shared_libs\" = xno || test \"x$ac_cv_with_libcdirectory\" = xno],\n [ac_cv_libcdirectory=no],\n [ac_cv_libcdirectory=check\n dnl Check if the directory provided as parameter exists\n dnl For both --with-libcdirectory which returns \"yes\" and --with-libcdirectory= which returns \"\"\n dnl treat them as auto-detection.\n AS_IF(\n [test \"x$ac_cv_with_libcdirectory\" != x && test \"x$ac_cv_with_libcdirectory\" != xauto-detect && test \"x$ac_cv_with_libcdirectory\" != xyes],\n [AX_CHECK_LIB_DIRECTORY_EXISTS([libcdirectory])],\n [dnl Check for a pkg-config file\n AS_IF(\n [test \"x$cross_compiling\" != \"xyes\" && test \"x$PKGCONFIG\" != \"x\"],\n [PKG_CHECK_MODULES(\n [libcdirectory],\n [libcdirectory >= 20120423],\n [ac_cv_libcdirectory=yes],\n [ac_cv_libcdirectory=check])\n ])\n AS_IF(\n [test \"x$ac_cv_libcdirectory\" = xyes && test \"x$ac_cv_enable_wide_character_type\" != xno],\n [AC_CACHE_CHECK(\n [whether libcdirectory/features.h defines LIBCDIRECTORY_HAVE_WIDE_CHARACTER_TYPE as 1],\n [ac_cv_header_libcdirectory_features_h_have_wide_character_type],\n [AC_LANG_PUSH(C)\n AC_COMPILE_IFELSE(\n [AC_LANG_PROGRAM(\n [[#include ]],\n [[#if !defined( LIBCDIRECTORY_HAVE_WIDE_CHARACTER_TYPE ) || ( LIBCDIRECTORY_HAVE_WIDE_CHARACTER_TYPE != 1 )\n#error LIBCDIRECTORY_HAVE_WIDE_CHARACTER_TYPE not defined\n#endif]] )],\n [ac_cv_header_libcdirectory_features_h_have_wide_character_type=yes],\n [ac_cv_header_libcdirectory_features_h_have_wide_character_type=no])\n AC_LANG_POP(C)],\n [ac_cv_header_libcdirectory_features_h_have_wide_character_type=no])\n\n AS_IF(\n [test \"x$ac_cv_header_libcdirectory_features_h_have_wide_character_type\" = xno],\n [ac_cv_libcdirectory=no])\n ])\n AS_IF(\n [test \"x$ac_cv_libcdirectory\" = xyes],\n [ac_cv_libcdirectory_CPPFLAGS=\"$pkg_cv_libcdirectory_CFLAGS\"\n ac_cv_libcdirectory_LIBADD=\"$pkg_cv_libcdirectory_LIBS\"])\n ])\n\n AS_IF(\n [test \"x$ac_cv_libcdirectory\" = xcheck],\n [dnl Check for headers\n AC_CHECK_HEADERS([libcdirectory.h])\n\n AS_IF(\n [test \"x$ac_cv_header_libcdirectory_h\" = xno],\n [ac_cv_libcdirectory=no],\n [ac_cv_libcdirectory=yes\n\n AX_CHECK_LIB_FUNCTIONS(\n [libcdirectory],\n [cdirectory],\n [[libcdirectory_get_version],\n [libcdirectory_directory_initialize],\n [libcdirectory_directory_free],\n [libcdirectory_directory_open],\n [libcdirectory_directory_close],\n [libcdirectory_directory_read_entry],\n [libcdirectory_directory_has_entry],\n [libcdirectory_directory_entry_initialize],\n [libcdirectory_directory_entry_free],\n [libcdirectory_directory_entry_get_type],\n [libcdirectory_directory_entry_get_name]])\n\n AS_IF(\n [test \"x$ac_cv_enable_wide_character_type\" != xno],\n [AX_CHECK_LIB_FUNCTIONS(\n [libcdirectory],\n [cdirectory],\n [[libcdirectory_get_version],\n [libcdirectory_directory_open_wide],\n [libcdirectory_directory_has_entry_wide],\n [libcdirectory_directory_entry_get_name_wide]])\n ])\n\n ac_cv_libcdirectory_LIBADD=\"-lcdirectory\"])\n ])\n\n AX_CHECK_LIB_DIRECTORY_MSG_ON_FAILURE([libcdirectory])\n ])\n\n AS_IF(\n [test \"x$ac_cv_libcdirectory\" = xyes],\n [AC_DEFINE(\n [HAVE_LIBCDIRECTORY],\n [1],\n [Define to 1 if you have the `cdirectory' library (-lcdirectory).])\n ])\n\n AS_IF(\n [test \"x$ac_cv_libcdirectory\" = xyes],\n [AC_SUBST(\n [HAVE_LIBCDIRECTORY],\n [1]) ],\n [AC_SUBST(\n [HAVE_LIBCDIRECTORY],\n [0])\n ])\n ])\n\ndnl Function to detect if libcdirectory dependencies are available\nAC_DEFUN([AX_LIBCDIRECTORY_CHECK_LOCAL],\n [AS_IF(\n [test \"x$ac_cv_enable_winapi\" = xno],\n [dnl Headers included in libcdirectory/libcdirectory_directory.h\n AC_CHECK_HEADERS([dirent.h errno.h sys/stat.h])\n\n dnl Directory functions used in libcdirectory/libcdirectory_directory.h\n AC_CHECK_FUNCS([closedir opendir readdir_r])\n\n AS_IF(\n [test \"x$ac_cv_func_closedir\" != xyes],\n [AC_MSG_FAILURE(\n [Missing functions: closedir],\n [1])\n ])\n\n AS_IF(\n [test \"x$ac_cv_func_opendir\" != xyes],\n [AC_MSG_FAILURE(\n [Missing functions: opendir],\n [1])\n ])\n\n AS_IF(\n [test \"x$ac_cv_func_readdir_r\" != xyes],\n [AC_MSG_FAILURE(\n [Missing functions: readdir_r],\n [1])\n ])\n ])\n\n ac_cv_libcdirectory_CPPFLAGS=\"-I../libcdirectory -I\\$(top_srcdir)/libcdirectory\";\n ac_cv_libcdirectory_LIBADD=\"../libcdirectory/libcdirectory.la\";\n\n ac_cv_libcdirectory=local\n ])\n\ndnl Function to detect how to enable libcdirectory\nAC_DEFUN([AX_LIBCDIRECTORY_CHECK_ENABLE],\n [AX_COMMON_ARG_WITH(\n [libcdirectory],\n [libcdirectory],\n [search for libcdirectory in includedir and libdir or in the specified DIR, or no if to use local version],\n [auto-detect],\n [DIR])\n\n dnl Check for a shared library version\n AX_LIBCDIRECTORY_CHECK_LIB\n\n dnl Check if the dependencies for the local library version\n AS_IF(\n [test \"x$ac_cv_libcdirectory\" != xyes],\n [AX_LIBCDIRECTORY_CHECK_LOCAL\n\n AC_DEFINE(\n [HAVE_LOCAL_LIBCDIRECTORY],\n [1],\n [Define to 1 if the local version of libcdirectory is used.])\n AC_SUBST(\n [HAVE_LOCAL_LIBCDIRECTORY],\n [1])\n ])\n\n AM_CONDITIONAL(\n [HAVE_LOCAL_LIBCDIRECTORY],\n [test \"x$ac_cv_libcdirectory\" = xlocal])\n AS_IF(\n [test \"x$ac_cv_libcdirectory_CPPFLAGS\" != \"x\"],\n [AC_SUBST(\n [LIBCDIRECTORY_CPPFLAGS],\n [$ac_cv_libcdirectory_CPPFLAGS])\n ])\n AS_IF(\n [test \"x$ac_cv_libcdirectory_LIBADD\" != \"x\"],\n [AC_SUBST(\n [LIBCDIRECTORY_LIBADD],\n [$ac_cv_libcdirectory_LIBADD])\n ])\n\n AS_IF(\n [test \"x$ac_cv_libcdirectory\" = xyes],\n [AC_SUBST(\n [ax_libcdirectory_pc_libs_private],\n [-lstring])\n ])\n\n AS_IF(\n [test \"x$ac_cv_libcdirectory\" = xyes],\n [AC_SUBST(\n [ax_libcdirectory_spec_requires],\n [libcdirectory])\n AC_SUBST(\n [ax_libcdirectory_spec_build_requires],\n [libcdirectory-devel])\n ])\n ])\n\n" }, { "path": "m4/libcerror.m4", "content": "dnl Checks for libcerror required headers and functions\ndnl\ndnl Version: 20240513\n\ndnl Function to detect if libcerror is available\ndnl ac_libcerror_dummy is used to prevent AC_CHECK_LIB adding unnecessary -l arguments\nAC_DEFUN([AX_LIBCERROR_CHECK_LIB],\n [AS_IF(\n [test \"x$ac_cv_enable_shared_libs\" = xno || test \"x$ac_cv_with_libcerror\" = xno],\n [ac_cv_libcerror=no],\n [ac_cv_libcerror=check\n dnl Check if the directory provided as parameter exists\n dnl For both --with-libcerror which returns \"yes\" and --with-libcerror= which returns \"\"\n dnl treat them as auto-detection.\n AS_IF(\n [test \"x$ac_cv_with_libcerror\" != x && test \"x$ac_cv_with_libcerror\" != xauto-detect && test \"x$ac_cv_with_libcerror\" != xyes],\n [AX_CHECK_LIB_DIRECTORY_EXISTS([libcerror])],\n [dnl Check for a pkg-config file\n AS_IF(\n [test \"x$cross_compiling\" != \"xyes\" && test \"x$PKGCONFIG\" != \"x\"],\n [PKG_CHECK_MODULES(\n [libcerror],\n [libcerror >= 20120425],\n [ac_cv_libcerror=yes],\n [ac_cv_libcerror=check])\n ])\n AS_IF(\n [test \"x$ac_cv_libcerror\" = xyes],\n [ac_cv_libcerror_CPPFLAGS=\"$pkg_cv_libcerror_CFLAGS\"\n ac_cv_libcerror_LIBADD=\"$pkg_cv_libcerror_LIBS\"])\n ])\n\n AS_IF(\n [test \"x$ac_cv_libcerror\" = xcheck],\n [dnl Check for headers\n AC_CHECK_HEADERS([libcerror.h])\n\n AS_IF(\n [test \"x$ac_cv_header_libcerror_h\" = xno],\n [ac_cv_libcerror=no],\n [ac_cv_libcerror=yes\n\n AX_CHECK_LIB_FUNCTIONS(\n [libcerror],\n [cerror],\n [[libcerror_get_version],\n [libcerror_error_free],\n [libcerror_error_set],\n [libcerror_error_matches],\n [libcerror_error_fprint],\n [libcerror_error_sprint],\n [libcerror_error_backtrace_fprint],\n [libcerror_error_backtrace_sprint],\n [libcerror_system_set_error]])\n\n ac_cv_libcerror_LIBADD=\"-lcerror\"])\n ])\n\n AX_CHECK_LIB_DIRECTORY_MSG_ON_FAILURE([libcerror])\n ])\n\n AS_IF(\n [test \"x$ac_cv_libcerror\" = xyes],\n [AC_DEFINE(\n [HAVE_LIBCERROR],\n [1],\n [Define to 1 if you have the `cerror' library (-lcerror).])\n ])\n\n AS_IF(\n [test \"x$ac_cv_libcerror\" = xyes],\n [AC_SUBST(\n [HAVE_LIBCERROR],\n [1]) ],\n [AC_SUBST(\n [HAVE_LIBCERROR],\n [0])\n ])\n ])\n\ndnl Function to detect if libcerror dependencies are available\nAC_DEFUN([AX_LIBCERROR_CHECK_LOCAL],\n [dnl Headers included in libcerror/libcerror_error.c\n AC_CHECK_HEADERS([stdarg.h varargs.h])\n\n AS_IF(\n [test \"x$ac_cv_header_stdarg_h\" != xyes && test \"x$ac_cv_header_varargs_h\" != xyes],\n [AC_MSG_FAILURE(\n [Missing headers: stdarg.h and varargs.h],\n [1])\n ])\n\n dnl Wide character string functions used in libcerror/libcerror_error.c\n AS_IF(\n [test \"x$ac_cv_enable_wide_character_type\" != xno],\n [AC_CHECK_FUNCS([wcstombs])\n\n AS_IF(\n [test \"x$ac_cv_func_wcstombs\" != xyes],\n [AC_MSG_FAILURE(\n [Missing function: wcstombs],\n [1])\n ])\n ])\n\n dnl Check for error string functions used in libcerror/libcerror_system.c\n AC_FUNC_STRERROR_R()\n\n AS_IF(\n [test \"x$ac_cv_have_decl_strerror_r\" != xyes],\n [AC_CHECK_FUNCS([strerror])\n\n AS_IF(\n [test \"x$ac_cv_func_strerror\" != xyes],\n [AC_MSG_FAILURE(\n [Missing functions: strerror_r and strerror],\n [1])\n ])\n ])\n\n ac_cv_libcerror_CPPFLAGS=\"-I../libcerror -I\\$(top_srcdir)/libcerror\";\n ac_cv_libcerror_LIBADD=\"../libcerror/libcerror.la\";\n\n ac_cv_libcerror=local\n ])\n\ndnl Function to detect how to enable libcerror\nAC_DEFUN([AX_LIBCERROR_CHECK_ENABLE],\n [AX_COMMON_ARG_WITH(\n [libcerror],\n [libcerror],\n [search for libcerror in includedir and libdir or in the specified DIR, or no if to use local version],\n [auto-detect],\n [DIR])\n\n dnl Check for a shared library version\n AX_LIBCERROR_CHECK_LIB\n\n dnl Check if the dependencies for the local library version\n AS_IF(\n [test \"x$ac_cv_libcerror\" != xyes],\n [AX_LIBCERROR_CHECK_LOCAL\n\n AC_DEFINE(\n [HAVE_LOCAL_LIBCERROR],\n [1],\n [Define to 1 if the local version of libcerror is used.])\n AC_SUBST(\n [HAVE_LOCAL_LIBCERROR],\n [1])\n ])\n\n AM_CONDITIONAL(\n [HAVE_LOCAL_LIBCERROR],\n [test \"x$ac_cv_libcerror\" = xlocal])\n AS_IF(\n [test \"x$ac_cv_libcerror_CPPFLAGS\" != \"x\"],\n [AC_SUBST(\n [LIBCERROR_CPPFLAGS],\n [$ac_cv_libcerror_CPPFLAGS])\n ])\n AS_IF(\n [test \"x$ac_cv_libcerror_LIBADD\" != \"x\"],\n [AC_SUBST(\n [LIBCERROR_LIBADD],\n [$ac_cv_libcerror_LIBADD])\n ])\n\n AS_IF(\n [test \"x$ac_cv_libcerror\" = xyes],\n [AC_SUBST(\n [ax_libcerror_pc_libs_private],\n [-lcerror])\n ])\n\n AS_IF(\n [test \"x$ac_cv_libcerror\" = xyes],\n [AC_SUBST(\n [ax_libcerror_spec_requires],\n [libcerror])\n AC_SUBST(\n [ax_libcerror_spec_build_requires],\n [libcerror-devel])\n ])\n ])\n\n" }, { "path": "m4/libcfile.m4", "content": "dnl Checks for libcfile required headers and functions\ndnl\ndnl Version: 20240514\n\ndnl Function to detect if libcfile is available\ndnl ac_libcfile_dummy is used to prevent AC_CHECK_LIB adding unnecessary -l arguments\nAC_DEFUN([AX_LIBCFILE_CHECK_LIB],\n [AS_IF(\n [test \"x$ac_cv_enable_shared_libs\" = xno || test \"x$ac_cv_with_libcfile\" = xno],\n [ac_cv_libcfile=no],\n [ac_cv_libcfile=check\n dnl Check if the directory provided as parameter exists\n dnl For both --with-libcfile which returns \"yes\" and --with-libcfile= which returns \"\"\n dnl treat them as auto-detection.\n AS_IF(\n [test \"x$ac_cv_with_libcfile\" != x && test \"x$ac_cv_with_libcfile\" != xauto-detect && test \"x$ac_cv_with_libcfile\" != xyes],\n [AX_CHECK_LIB_DIRECTORY_EXISTS([libcfile])],\n [dnl Check for a pkg-config file\n AS_IF(\n [test \"x$cross_compiling\" != \"xyes\" && test \"x$PKGCONFIG\" != \"x\"],\n [PKG_CHECK_MODULES(\n [libcfile],\n [libcfile >= 20160409],\n [ac_cv_libcfile=yes],\n [ac_cv_libcfile=check])\n ])\n AS_IF(\n [test \"x$ac_cv_libcfile\" = xyes && test \"x$ac_cv_enable_wide_character_type\" != xno],\n [AC_CACHE_CHECK(\n [whether libcfile/features.h defines LIBCFILE_HAVE_WIDE_CHARACTER_TYPE as 1],\n [ac_cv_header_libcfile_features_h_have_wide_character_type],\n [AC_LANG_PUSH(C)\n AC_COMPILE_IFELSE(\n [AC_LANG_PROGRAM(\n [[#include ]],\n [[#if !defined( LIBCFILE_HAVE_WIDE_CHARACTER_TYPE ) || ( LIBCFILE_HAVE_WIDE_CHARACTER_TYPE != 1 )\n#error LIBCFILE_HAVE_WIDE_CHARACTER_TYPE not defined\n#endif]] )],\n [ac_cv_header_libcfile_features_h_have_wide_character_type=yes],\n [ac_cv_header_libcfile_features_h_have_wide_character_type=no])\n AC_LANG_POP(C)],\n [ac_cv_header_libcfile_features_h_have_wide_character_type=no])\n\n AS_IF(\n [test \"x$ac_cv_header_libcfile_features_h_have_wide_character_type\" = xno],\n [ac_cv_libcfile=no])\n ])\n AS_IF(\n [test \"x$ac_cv_libcfile\" = xyes],\n [ac_cv_libcfile_CPPFLAGS=\"$pkg_cv_libcfile_CFLAGS\"\n ac_cv_libcfile_LIBADD=\"$pkg_cv_libcfile_LIBS\"])\n ])\n\n AS_IF(\n [test \"x$ac_cv_libcfile\" = xcheck],\n [dnl Check for headers\n AC_CHECK_HEADERS([libcfile.h])\n\n AS_IF(\n [test \"x$ac_cv_header_libcfile_h\" = xno],\n [ac_cv_libcfile=no],\n [ac_cv_libcfile=yes\n\n AX_CHECK_LIB_FUNCTIONS(\n [libcfile],\n [cfile],\n [[libcfile_get_version],\n [libcfile_file_initialize],\n [libcfile_file_free],\n [libcfile_file_open],\n [libcfile_file_open_with_error_code],\n [libcfile_file_close],\n [libcfile_file_read_buffer],\n [libcfile_file_read_buffer_with_error_code],\n [libcfile_file_write_buffer],\n [libcfile_file_write_buffer_with_error_code],\n [libcfile_file_seek_offset],\n [libcfile_file_resize],\n [libcfile_file_is_open],\n [libcfile_file_get_offset],\n [libcfile_file_get_size],\n [libcfile_file_is_device],\n [libcfile_file_io_control_read],\n [libcfile_file_io_control_read_with_error_code],\n [libcfile_file_exists],\n [libcfile_file_remove]])\n\n AS_IF(\n [test \"x$ac_cv_enable_wide_character_type\" != xno],\n [AX_CHECK_LIB_FUNCTIONS(\n [libcfile],\n [cfile],\n [[libcfile_file_open_wide],\n [libcfile_file_open_wide_with_error_code],\n [libcfile_file_exists_wide],\n [libcfile_file_remove_wide]])\n ])\n\n ac_cv_libcfile_LIBADD=\"-lcfile\"])\n ])\n\n AX_CHECK_LIB_DIRECTORY_MSG_ON_FAILURE([libcfile])\n ])\n\n AS_IF(\n [test \"x$ac_cv_libcfile\" = xyes],\n [AC_DEFINE(\n [HAVE_LIBCFILE],\n [1],\n [Define to 1 if you have the `cfile' library (-lcfile).])\n ])\n\n AS_IF(\n [test \"x$ac_cv_libcfile\" = xyes],\n [AC_SUBST(\n [HAVE_LIBCFILE],\n [1]) ],\n [AC_SUBST(\n [HAVE_LIBCFILE],\n [0])\n ])\n ])\n\ndnl Function to detect if posix_fadvise is available\nAC_DEFUN([AX_LIBCFILE_CHECK_FUNC_POSIX_FADVISE],\n [AC_CHECK_FUNCS([posix_fadvise])\n\n AS_IF(\n [test \"x$ac_cv_func_posix_fadvise\" = xyes],\n [AC_MSG_CHECKING(\n [whether posix_fadvise can be linked])\n\n SAVE_CFLAGS=\"$CFLAGS\"\n CFLAGS=\"$CFLAGS -Wall -Werror\"\n AC_LANG_PUSH(C)\n\n AC_LINK_IFELSE(\n [AC_LANG_PROGRAM(\n [[#include ]],\n [[#if !defined( POSIX_FADV_SEQUENTIAL )\n#define POSIX_FADV_SEQUENTIAL 2\n#endif\nposix_fadvise( 0, 0, 0, POSIX_FADV_SEQUENTIAL )]] )],\n [ac_cv_func_posix_fadvise=yes],\n [ac_cv_func_posix_fadvise=no])\n\n AC_LANG_POP(C)\n CFLAGS=\"$SAVE_CFLAGS\"\n\n AS_IF(\n [test \"x$ac_cv_func_posix_fadvise\" = xyes],\n [AC_MSG_RESULT(\n [yes])\n AC_DEFINE(\n [HAVE_POSIX_FADVISE],\n [1],\n [Define to 1 if you have the posix_fadvise function.]) ],\n [AC_MSG_RESULT(\n [no]) ])\n ])\n ])\n\ndnl Function to detect if libcfile dependencies are available\nAC_DEFUN([AX_LIBCFILE_CHECK_LOCAL],\n [dnl Headers included in libcfile/libcfile_file.c and libcfile/libcfile_support.c\n AC_CHECK_HEADERS([errno.h stdio.h sys/stat.h])\n\n dnl Headers included in libcfile/libcfile_file.c\n AC_CHECK_HEADERS([cygwin/fs.h fcntl.h linux/fs.h sys/disk.h sys/disklabel.h sys/ioctl.h unistd.h])\n\n dnl File input/output functions used in libcfile/libcfile_file.c\n AC_CHECK_FUNCS([close fstat ftruncate ioctl lseek open read write])\n\n AS_IF(\n [test \"x$ac_cv_func_close\" != xyes],\n [AC_MSG_FAILURE(\n [Missing function: close],\n [1])\n ])\n\n AX_LIBCFILE_CHECK_FUNC_POSIX_FADVISE\n\n AS_IF(\n [test \"x$ac_cv_func_fstat\" != xyes],\n [AC_MSG_FAILURE(\n [Missing function: fstat],\n [1])\n ])\n\n AS_IF(\n [test \"x$ac_cv_func_ftruncate\" != xyes],\n [AC_MSG_FAILURE(\n [Missing function: ftruncate],\n [1])\n ])\n\n AS_IF(\n [test x\"$ac_cv_enable_winapi\" = xno],\n [AS_IF(\n [test \"x$ac_cv_func_ioctl\" != xyes],\n [AC_MSG_FAILURE(\n [Missing function: ioctl],\n [1])\n ])\n ])\n\n AS_IF(\n [test \"x$ac_cv_func_lseek\" != xyes],\n [AC_MSG_FAILURE(\n [Missing function: lseek],\n [1])\n ])\n\n AS_IF(\n [test \"x$ac_cv_func_open\" != xyes],\n [AC_MSG_FAILURE(\n [Missing function: open],\n [1])\n ])\n\n AS_IF(\n [test \"x$ac_cv_func_read\" != xyes],\n [AC_MSG_FAILURE(\n [Missing function: read],\n [1])\n ])\n\n AS_IF(\n [test \"x$ac_cv_func_write\" != xyes],\n [AC_MSG_FAILURE(\n [Missing function: write],\n [1])\n ])\n\n dnl File input/output functions used in libcfile/libcfile_support.c\n AC_CHECK_FUNCS([stat unlink])\n\n AS_IF(\n [test \"x$ac_cv_func_stat\" != xyes],\n [AC_MSG_FAILURE(\n [Missing function: stat],\n [1])\n ])\n\n AS_IF(\n [test \"x$ac_cv_func_unlink\" != xyes],\n [AC_MSG_FAILURE(\n [Missing function: unlink],\n [1])\n ])\n\n ac_cv_libcfile_CPPFLAGS=\"-I../libcfile -I\\$(top_srcdir)/libcfile\";\n ac_cv_libcfile_LIBADD=\"../libcfile/libcfile.la\";\n\n ac_cv_libcfile=local\n ])\n\ndnl Function to detect how to enable libcfile\nAC_DEFUN([AX_LIBCFILE_CHECK_ENABLE],\n [AX_COMMON_ARG_WITH(\n [libcfile],\n [libcfile],\n [search for libcfile in includedir and libdir or in the specified DIR, or no if to use local version],\n [auto-detect],\n [DIR])\n\n dnl Check for a shared library version\n AX_LIBCFILE_CHECK_LIB\n\n dnl Check if the dependencies for the local library version\n AS_IF(\n [test \"x$ac_cv_libcfile\" != xyes],\n [AX_LIBCFILE_CHECK_LOCAL\n\n AC_DEFINE(\n [HAVE_LOCAL_LIBCFILE],\n [1],\n [Define to 1 if the local version of libcfile is used.])\n AC_SUBST(\n [HAVE_LOCAL_LIBCFILE],\n [1])\n ])\n\n AM_CONDITIONAL(\n [HAVE_LOCAL_LIBCFILE],\n [test \"x$ac_cv_libcfile\" = xlocal])\n AS_IF(\n [test \"x$ac_cv_libcfile_CPPFLAGS\" != \"x\"],\n [AC_SUBST(\n [LIBCFILE_CPPFLAGS],\n [$ac_cv_libcfile_CPPFLAGS])\n ])\n AS_IF(\n [test \"x$ac_cv_libcfile_LIBADD\" != \"x\"],\n [AC_SUBST(\n [LIBCFILE_LIBADD],\n [$ac_cv_libcfile_LIBADD])\n ])\n\n AS_IF(\n [test \"x$ac_cv_libcfile\" = xyes],\n [AC_SUBST(\n [ax_libcfile_pc_libs_private],\n [-lcfile])\n ])\n\n AS_IF(\n [test \"x$ac_cv_libcfile\" = xyes],\n [AC_SUBST(\n [ax_libcfile_spec_requires],\n [libcfile])\n AC_SUBST(\n [ax_libcfile_spec_build_requires],\n [libcfile-devel])\n ])\n ])\n\n" }, { "path": "m4/libclocale.m4", "content": "dnl Checks for libclocale required headers and functions\ndnl\ndnl Version: 20240513\n\ndnl Function to detect if libclocale is available\ndnl ac_libclocale_dummy is used to prevent AC_CHECK_LIB adding unnecessary -l arguments\nAC_DEFUN([AX_LIBCLOCALE_CHECK_LIB],\n [AS_IF(\n [test \"x$ac_cv_enable_shared_libs\" = xno || test \"x$ac_cv_with_libclocale\" = xno],\n [ac_cv_libclocale=no],\n [ac_cv_libclocale=check\n dnl Check if the directory provided as parameter exists\n dnl For both --with-libclocale which returns \"yes\" and --with-libclocale= which returns \"\"\n dnl treat them as auto-detection.\n AS_IF(\n [test \"x$ac_cv_with_libclocale\" != x && test \"x$ac_cv_with_libclocale\" != xauto-detect && test \"x$ac_cv_with_libclocale\" != xyes],\n [AX_CHECK_LIB_DIRECTORY_EXISTS([libclocale])],\n [dnl Check for a pkg-config file\n AS_IF(\n [test \"x$cross_compiling\" != \"xyes\" && test \"x$PKGCONFIG\" != \"x\"],\n [PKG_CHECK_MODULES(\n [libclocale],\n [libclocale >= 20120425],\n [ac_cv_libclocale=yes],\n [ac_cv_libclocale=check])\n ])\n AS_IF(\n [test \"x$ac_cv_libclocale\" = xyes && test \"x$ac_cv_enable_wide_character_type\" != xno],\n [AC_CACHE_CHECK(\n [whether libclocale/features.h defines LIBCLOCALE_HAVE_WIDE_CHARACTER_TYPE as 1],\n [ac_cv_header_libclocale_features_h_have_wide_character_type],\n [AC_LANG_PUSH(C)\n AC_COMPILE_IFELSE(\n [AC_LANG_PROGRAM(\n [[#include ]],\n [[#if !defined( LIBCLOCALE_HAVE_WIDE_CHARACTER_TYPE ) || ( LIBCLOCALE_HAVE_WIDE_CHARACTER_TYPE != 1 )\n#error LIBCLOCALE_HAVE_WIDE_CHARACTER_TYPE not defined\n#endif]] )],\n [ac_cv_header_libclocale_features_h_have_wide_character_type=yes],\n [ac_cv_header_libclocale_features_h_have_wide_character_type=no])\n AC_LANG_POP(C)],\n [ac_cv_header_libclocale_features_h_have_wide_character_type=no])\n\n AS_IF(\n [test \"x$ac_cv_header_libclocale_features_h_have_wide_character_type\" = xno],\n [ac_cv_libclocale=no])\n ])\n AS_IF(\n [test \"x$ac_cv_libclocale\" = xyes],\n [ac_cv_libclocale_CPPFLAGS=\"$pkg_cv_libclocale_CFLAGS\"\n ac_cv_libclocale_LIBADD=\"$pkg_cv_libclocale_LIBS\"])\n ])\n\n AS_IF(\n [test \"x$ac_cv_libclocale\" = xcheck],\n [dnl Check for headers\n AC_CHECK_HEADERS([libclocale.h])\n\n AS_IF(\n [test \"x$ac_cv_header_libclocale_h\" = xno],\n [ac_cv_libclocale=no],\n [ac_cv_libclocale=yes\n\n AX_CHECK_LIB_FUNCTIONS(\n [libclocale],\n [clocale],\n [[libclocale_get_version],\n [libclocale_codepage],\n [libclocale_codepage_get],\n [libclocale_codepage_set],\n [libclocale_codepage_copy_from_string],\n [libclocale_locale_get_codepage],\n [libclocale_locale_get_decimal_point],\n [libclocale_initialize]])\n\n AS_IF(\n [test \"x$ac_cv_enable_wide_character_type\" != xno],\n [AC_CHECK_LIB(\n clocale,\n libclocale_codepage_copy_from_string_wide,\n [ac_cv_libclocale_dummy=yes],\n [ac_cv_libclocale=no])\n ])\n\n ac_cv_libclocale_LIBADD=\"-lclocale\"])\n ])\n\n AX_CHECK_LIB_DIRECTORY_MSG_ON_FAILURE([libclocale])\n ])\n\n AS_IF(\n [test \"x$ac_cv_libclocale\" = xyes],\n [AC_DEFINE(\n [HAVE_LIBCLOCALE],\n [1],\n [Define to 1 if you have the `clocale' library (-lclocale).])\n ])\n\n AS_IF(\n [test \"x$ac_cv_libclocale\" = xyes],\n [AC_SUBST(\n [HAVE_LIBCLOCALE],\n [1]) ],\n [AC_SUBST(\n [HAVE_LIBCLOCALE],\n [0])\n ])\n ])\n\ndnl Function to detect whether nl_langinfo supports CODESET\nAC_DEFUN([AX_LIBCLOCALE_CHECK_FUNC_LANGINFO_CODESET],\n [AC_CHECK_FUNCS([nl_langinfo])\n\n AS_IF(\n [test \"x$ac_cv_func_nl_langinfo\" = xyes],\n [AC_CACHE_CHECK(\n [for nl_langinfo CODESET support],\n [ac_cv_cv_langinfo_codeset],\n [AC_LANG_PUSH(C)\n AC_LINK_IFELSE(\n [AC_LANG_PROGRAM(\n [[#include ]],\n [[char* charset = nl_langinfo( CODESET );]] )],\n [ac_cv_cv_langinfo_codeset=yes],\n [ac_cv_cv_langinfo_codeset=no])\n AC_LANG_POP(C) ]) ],\n [ac_cv_cv_langinfo_codeset=no])\n\n AS_IF(\n [test \"x$ac_cv_cv_langinfo_codeset\" = xyes],\n [AC_DEFINE(\n [HAVE_LANGINFO_CODESET],\n [1],\n [Define if nl_langinfo has CODESET support.])\n ])\n ])\n\ndnl Function to detect if libclocale dependencies are available\nAC_DEFUN([AX_LIBCLOCALE_CHECK_LOCAL],\n [dnl Headers included in libclocale/libclocale_locale.c\n AC_CHECK_HEADERS([langinfo.h locale.h])\n\n dnl Check for environment functions in libclocale/libclocale_locale.c\n AC_CHECK_FUNCS([getenv])\n\n AS_IF(\n [test \"x$ac_cv_func_getenv\" != xyes],\n [AC_MSG_FAILURE(\n [Missing function: getenv],\n [1])\n ])\n\n dnl Check for localization functions in libclocale/libclocale_locale.c\n AS_IF(\n [test \"x$ac_cv_enable_winapi\" = xno],\n [AC_CHECK_FUNCS([localeconv])\n\n AS_IF(\n [test \"x$ac_cv_func_localeconv\" != xyes],\n [AC_MSG_FAILURE(\n [Missing function: localeconv],\n [1])\n ])\n ])\n\n AC_CHECK_FUNCS([setlocale])\n\n AS_IF(\n [test \"x$ac_cv_func_setlocale\" != xyes],\n [AC_MSG_FAILURE(\n [Missing function: setlocale],\n [1])\n ])\n\n AX_LIBCLOCALE_CHECK_FUNC_LANGINFO_CODESET\n\n ac_cv_libclocale_CPPFLAGS=\"-I../libclocale -I\\$(top_srcdir)/libclocale\";\n ac_cv_libclocale_LIBADD=\"../libclocale/libclocale.la\";\n\n ac_cv_libclocale=local\n ])\n\ndnl Function to detect how to enable libclocale\nAC_DEFUN([AX_LIBCLOCALE_CHECK_ENABLE],\n [AX_COMMON_ARG_WITH(\n [libclocale],\n [libclocale],\n [search for libclocale in includedir and libdir or in the specified DIR, or no if to use local version],\n [auto-detect],\n [DIR])\n\n dnl Check for a shared library version\n AX_LIBCLOCALE_CHECK_LIB\n\n dnl Check if the dependencies for the local library version\n AS_IF(\n [test \"x$ac_cv_libclocale\" != xyes],\n [AX_LIBCLOCALE_CHECK_LOCAL\n\n AC_DEFINE(\n [HAVE_LOCAL_LIBCLOCALE],\n [1],\n [Define to 1 if the local version of libclocale is used.])\n AC_SUBST(\n [HAVE_LOCAL_LIBCLOCALE],\n [1])\n ])\n\n AM_CONDITIONAL(\n [HAVE_LOCAL_LIBCLOCALE],\n [test \"x$ac_cv_libclocale\" = xlocal])\n AS_IF(\n [test \"x$ac_cv_libclocale_CPPFLAGS\" != \"x\"],\n [AC_SUBST(\n [LIBCLOCALE_CPPFLAGS],\n [$ac_cv_libclocale_CPPFLAGS])\n ])\n AS_IF(\n [test \"x$ac_cv_libclocale_LIBADD\" != \"x\"],\n [AC_SUBST(\n [LIBCLOCALE_LIBADD],\n [$ac_cv_libclocale_LIBADD])\n ])\n\n AS_IF(\n [test \"x$ac_cv_libclocale\" = xyes],\n [AC_SUBST(\n [ax_libclocale_pc_libs_private],\n [-lclocale])\n ])\n\n AS_IF(\n [test \"x$ac_cv_libclocale\" = xyes],\n [AC_SUBST(\n [ax_libclocale_spec_requires],\n [libclocale])\n AC_SUBST(\n [ax_libclocale_spec_build_requires],\n [libclocale-devel])\n ])\n ])\n\n" }, { "path": "m4/libcnotify.m4", "content": "dnl Checks for libcnotify required headers and functions\ndnl\ndnl Version: 20240513\n\ndnl Function to detect if libcnotify is available\ndnl ac_libcnotify_dummy is used to prevent AC_CHECK_LIB adding unnecessary -l arguments\nAC_DEFUN([AX_LIBCNOTIFY_CHECK_LIB],\n [AS_IF(\n [test \"x$ac_cv_enable_shared_libs\" = xno || test \"x$ac_cv_with_libcnotify\" = xno],\n [ac_cv_libcnotify=no],\n [ac_cv_libcnotify=check\n dnl Check if the directory provided as parameter exists\n dnl For both --with-libcnotify which returns \"yes\" and --with-libcnotify= which returns \"\"\n dnl treat them as auto-detection.\n AS_IF(\n [test \"x$ac_cv_with_libcnotify\" != x && test \"x$ac_cv_with_libcnotify\" != xauto-detect && test \"x$ac_cv_with_libcnotify\" != xyes],\n [AX_CHECK_LIB_DIRECTORY_EXISTS([libcnotify])],\n [dnl Check for a pkg-config file\n AS_IF(\n [test \"x$cross_compiling\" != \"xyes\" && test \"x$PKGCONFIG\" != \"x\"],\n [PKG_CHECK_MODULES(\n [libcnotify],\n [libcnotify >= 20120425],\n [ac_cv_libcnotify=yes],\n [ac_cv_libcnotify=check])\n ])\n AS_IF(\n [test \"x$ac_cv_libcnotify\" = xyes],\n [ac_cv_libcnotify_CPPFLAGS=\"$pkg_cv_libcnotify_CFLAGS\"\n ac_cv_libcnotify_LIBADD=\"$pkg_cv_libcnotify_LIBS\"])\n ])\n\n AS_IF(\n [test \"x$ac_cv_libcnotify\" = xcheck],\n [dnl Check for headers\n AC_CHECK_HEADERS([libcnotify.h])\n\n AS_IF(\n [test \"x$ac_cv_header_libcnotify_h\" = xno],\n [ac_cv_libcnotify=no],\n [ac_cv_libcnotify=yes\n\n AX_CHECK_LIB_FUNCTIONS(\n [libcnotify],\n [cnotify],\n [[libcnotify_get_version],\n [libcnotify_printf],\n [libcnotify_print_data],\n [libcnotify_print_error_backtrace],\n [libcnotify_stream_set],\n [libcnotify_stream_open],\n [libcnotify_stream_close],\n [libcnotify_verbose_set]])\n\n ac_cv_libcnotify_LIBADD=\"-lcnotify\"])\n ])\n\n AX_CHECK_LIB_DIRECTORY_MSG_ON_FAILURE([libcnotify])\n ])\n\n AS_IF(\n [test \"x$ac_cv_libcnotify\" = xyes],\n [AC_DEFINE(\n [HAVE_LIBCNOTIFY],\n [1],\n [Define to 1 if you have the `cnotify' library (-lcnotify).])\n ])\n\n AS_IF(\n [test \"x$ac_cv_libcnotify\" = xyes],\n [AC_SUBST(\n [HAVE_LIBCNOTIFY],\n [1]) ],\n [AC_SUBST(\n [HAVE_LIBCNOTIFY],\n [0])\n ])\n ])\n\ndnl Function to detect if libcnotify dependencies are available\nAC_DEFUN([AX_LIBCNOTIFY_CHECK_LOCAL],\n [dnl Headers included in libcnotify/libcnotify_print.c\n AC_CHECK_HEADERS([stdarg.h varargs.h])\n\n AS_IF(\n [test \"x$ac_cv_header_stdarg_h\" != xyes && test \"x$ac_cv_header_varargs_h\" != xyes],\n [AC_MSG_FAILURE(\n [Missing headers: stdarg.h and varargs.h],\n [1])\n ])\n\n dnl Headers included in libcnotify/libcnotify_stream.c\n AC_CHECK_HEADERS([errno.h])\n\n ac_cv_libcnotify_CPPFLAGS=\"-I../libcnotify -I\\$(top_srcdir)/libcnotify\";\n ac_cv_libcnotify_LIBADD=\"../libcnotify/libcnotify.la\";\n\n ac_cv_libcnotify=local\n ])\n\ndnl Function to detect how to enable libcnotify\nAC_DEFUN([AX_LIBCNOTIFY_CHECK_ENABLE],\n [AX_COMMON_ARG_WITH(\n [libcnotify],\n [libcnotify],\n [search for libcnotify in includedir and libdir or in the specified DIR, or no if to use local version],\n [auto-detect],\n [DIR])\n\n dnl Check for a shared library version\n AX_LIBCNOTIFY_CHECK_LIB\n\n dnl Check if the dependencies for the local library version\n AS_IF(\n [test \"x$ac_cv_libcnotify\" != xyes],\n [AX_LIBCNOTIFY_CHECK_LOCAL\n\n AC_DEFINE(\n [HAVE_LOCAL_LIBCNOTIFY],\n [1],\n [Define to 1 if the local version of libcnotify is used.])\n AC_SUBST(\n [HAVE_LOCAL_LIBCNOTIFY],\n [1])\n ])\n\n AM_CONDITIONAL(\n [HAVE_LOCAL_LIBCNOTIFY],\n [test \"x$ac_cv_libcnotify\" = xlocal])\n AS_IF(\n [test \"x$ac_cv_libcnotify_CPPFLAGS\" != \"x\"],\n [AC_SUBST(\n [LIBCNOTIFY_CPPFLAGS],\n [$ac_cv_libcnotify_CPPFLAGS])\n ])\n AS_IF(\n [test \"x$ac_cv_libcnotify_LIBADD\" != \"x\"],\n [AC_SUBST(\n [LIBCNOTIFY_LIBADD],\n [$ac_cv_libcnotify_LIBADD])\n ])\n\n AS_IF(\n [test \"x$ac_cv_libcnotify\" = xyes],\n [AC_SUBST(\n [ax_libcnotify_pc_libs_private],\n [-lcnotify])\n ])\n\n AS_IF(\n [test \"x$ac_cv_libcnotify\" = xyes],\n [AC_SUBST(\n [ax_libcnotify_spec_requires],\n [libcnotify])\n AC_SUBST(\n [ax_libcnotify_spec_build_requires],\n [libcnotify-devel])\n ])\n ])\n\n" }, { "path": "m4/libcpath.m4", "content": "dnl Checks for libcpath required headers and functions\ndnl\ndnl Version: 20240518\n\ndnl Function to detect if libcpath is available\ndnl ac_libcpath_dummy is used to prevent AC_CHECK_LIB adding unnecessary -l arguments\nAC_DEFUN([AX_LIBCPATH_CHECK_LIB],\n [AS_IF(\n [test \"x$ac_cv_enable_shared_libs\" = xno || test \"x$ac_cv_with_libcpath\" = xno],\n [ac_cv_libcpath=no],\n [ac_cv_libcpath=check\n dnl Check if the directory provided as parameter exists\n dnl For both --with-libcpath which returns \"yes\" and --with-libcpath= which returns \"\"\n dnl treat them as auto-detection.\n AS_IF(\n [test \"x$ac_cv_with_libcpath\" != x && test \"x$ac_cv_with_libcpath\" != xauto-detect && test \"x$ac_cv_with_libcpath\" != xyes],\n [AX_CHECK_LIB_DIRECTORY_EXISTS([libcpath])],\n [dnl Check for a pkg-config file\n AS_IF(\n [test \"x$cross_compiling\" != \"xyes\" && test \"x$PKGCONFIG\" != \"x\"],\n [PKG_CHECK_MODULES(\n [libcpath],\n [libcpath >= 20180716],\n [ac_cv_libcpath=yes],\n [ac_cv_libcpath=check])\n ])\n AS_IF(\n [test \"x$ac_cv_libcpath\" = xyes && test \"x$ac_cv_enable_wide_character_type\" != xno],\n [AC_CACHE_CHECK(\n [whether libcpath/features.h defines LIBCPATH_HAVE_WIDE_CHARACTER_TYPE as 1],\n [ac_cv_header_libcpath_features_h_have_wide_character_type],\n [AC_LANG_PUSH(C)\n AC_COMPILE_IFELSE(\n [AC_LANG_PROGRAM(\n [[#include ]],\n [[#if !defined( LIBCPATH_HAVE_WIDE_CHARACTER_TYPE ) || ( LIBCPATH_HAVE_WIDE_CHARACTER_TYPE != 1 )\n#error LIBCPATH_HAVE_WIDE_CHARACTER_TYPE not defined\n#endif]] )],\n [ac_cv_header_libcpath_features_h_have_wide_character_type=yes],\n [ac_cv_header_libcpath_features_h_have_wide_character_type=no])\n AC_LANG_POP(C)],\n [ac_cv_header_libcpath_features_h_have_wide_character_type=no])\n\n AS_IF(\n [test \"x$ac_cv_header_libcpath_features_h_have_wide_character_type\" = xno],\n [ac_cv_libcpath=no])\n ])\n AS_IF(\n [test \"x$ac_cv_libcpath\" = xyes],\n [ac_cv_libcpath_CPPFLAGS=\"$pkg_cv_libcpath_CFLAGS\"\n ac_cv_libcpath_LIBADD=\"$pkg_cv_libcpath_LIBS\"])\n ])\n\n AS_IF(\n [test \"x$ac_cv_libcpath\" = xcheck],\n [dnl Check for headers\n AC_CHECK_HEADERS([libcpath.h])\n\n AS_IF(\n [test \"x$ac_cv_header_libcpath_h\" = xno],\n [ac_cv_libcpath=no],\n [ac_cv_libcpath=yes\n\n AX_CHECK_LIB_FUNCTIONS(\n [libcpath],\n [cpath],\n [[libcpath_get_version],\n [libcpath_path_change_directory],\n [libcpath_path_get_current_working_directory],\n [libcpath_path_get_full_path],\n [libcpath_path_get_sanitized_filename],\n [libcpath_path_get_sanitized_path],\n [libcpath_path_join],\n [libcpath_path_make_directory]])\n\n AS_IF(\n [test \"x$ac_cv_enable_wide_character_type\" != xno],\n [AX_CHECK_LIB_FUNCTIONS(\n [libcpath],\n [cpath],\n [[libcpath_path_change_directory_wide],\n [libcpath_path_get_current_working_directory_wide],\n [libcpath_path_get_full_path_wide],\n [libcpath_path_get_sanitized_filename_wide],\n [libcpath_path_get_sanitized_path_wide],\n [libcpath_path_join_wide],\n [libcpath_path_make_directory_wide]])\n ])\n\n ac_cv_libcpath_LIBADD=\"-lcpath\"])\n ])\n\n AX_CHECK_LIB_DIRECTORY_MSG_ON_FAILURE([libcpath])\n ])\n\n AS_IF(\n [test \"x$ac_cv_libcpath\" = xyes],\n [AC_DEFINE(\n [HAVE_LIBCPATH],\n [1],\n [Define to 1 if you have the `cpath' library (-lcpath).])\n ])\n\n AS_IF(\n [test \"x$ac_cv_libcpath\" = xyes],\n [AC_SUBST(\n [HAVE_LIBCPATH],\n [1]) ],\n [AC_SUBST(\n [HAVE_LIBCPATH],\n [0])\n ])\n ])\n\ndnl Function to detect if mkdir is available\ndnl Also checks how to use mkdir\nAC_DEFUN([AX_LIBCPATH_CHECK_FUNC_MKDIR],\n [AC_CHECK_FUNCS([mkdir])\n\n AS_IF(\n [test \"x$ac_cv_func_mkdir\" = xyes],\n [AC_MSG_CHECKING(\n [how to use mkdir])\n\n SAVE_CFLAGS=\"$CFLAGS\"\n CFLAGS=\"$CFLAGS -Wall -Werror\"\n AC_LANG_PUSH(C)\n\n AC_LINK_IFELSE(\n [AC_LANG_PROGRAM(\n [[#include \n#include ]],\n [[mkdir( \"\", 0 )]] )],\n [AC_MSG_RESULT(\n [with additional mode argument])\n ac_cv_cv_mkdir_mode=yes],\n [ac_cv_cv_mkdir_mode=no])\n\n AS_IF(\n [test \"x$ac_cv_cv_mkdir_mode\" = xno],\n [AC_LINK_IFELSE(\n [AC_LANG_PROGRAM(\n [[#include ]],\n [[mkdir( \"\" )]] )],\n [AC_MSG_RESULT(\n [with single argument])\n ac_cv_cv_mkdir=yes],\n [ac_cv_cv_mkdir=no])\n ])\n\n AC_LANG_POP(C)\n CFLAGS=\"$SAVE_CFLAGS\"\n\n AS_IF(\n [test \"x$ac_cv_cv_mkdir_mode\" = xno && test \"x$ac_cv_cv_mkdir\" = xno],\n [AC_MSG_WARN(\n [unknown])\n ac_cv_func_mkdir=no])\n\n AS_IF(\n [test \"x$ac_cv_func_mkdir\" = xyes],\n [AC_DEFINE(\n [HAVE_MKDIR],\n [1],\n [Define to 1 if you have the mkdir function.])\n ])\n\n AS_IF(\n [test \"x$ac_cv_cv_mkdir_mode\" = xyes],\n [AC_DEFINE(\n [HAVE_MKDIR_MODE],\n [1],\n [Define to 1 if you have the mkdir function with a second mode argument.])\n ])\n ])\n\n AS_IF(\n [test \"x$ac_cv_func_mkdir\" = xno],\n [AC_MSG_FAILURE(\n [Missing function: mkdir],\n [1])\n ])\n ])\n\ndnl Function to detect if libcpath dependencies are available\nAC_DEFUN([AX_LIBCPATH_CHECK_LOCAL],\n [dnl Headers included in libcpath/libcpath_path.h\n AC_CHECK_HEADERS([errno.h sys/stat.h sys/syslimits.h])\n\n dnl Path functions used in libcpath/libcpath_path.h\n AC_CHECK_FUNCS([chdir getcwd])\n\n AS_IF(\n [test \"x$ac_cv_func_chdir\" != xyes],\n [AC_MSG_FAILURE(\n [Missing functions: chdir],\n [1])\n ])\n\n AS_IF(\n [test \"x$ac_cv_func_getcwd\" != xyes],\n [AC_MSG_FAILURE(\n [Missing functions: getcwd],\n [1])\n ])\n\n AX_LIBCPATH_CHECK_FUNC_MKDIR\n\n ac_cv_libcpath_CPPFLAGS=\"-I../libcpath -I\\$(top_srcdir)/libcpath\";\n ac_cv_libcpath_LIBADD=\"../libcpath/libcpath.la\";\n\n ac_cv_libcpath=local\n ])\n\ndnl Function to detect how to enable libcpath\nAC_DEFUN([AX_LIBCPATH_CHECK_ENABLE],\n [AX_COMMON_ARG_WITH(\n [libcpath],\n [libcpath],\n [search for libcpath in includedir and libdir or in the specified DIR, or no if to use local version],\n [auto-detect],\n [DIR])\n\n dnl Check for a shared library version\n AX_LIBCPATH_CHECK_LIB\n\n dnl Check if the dependencies for the local library version\n AS_IF(\n [test \"x$ac_cv_libcpath\" != xyes],\n [AX_LIBCPATH_CHECK_LOCAL\n\n AC_DEFINE(\n [HAVE_LOCAL_LIBCPATH],\n [1],\n [Define to 1 if the local version of libcpath is used.])\n AC_SUBST(\n [HAVE_LOCAL_LIBCPATH],\n [1])\n ])\n\n AM_CONDITIONAL(\n [HAVE_LOCAL_LIBCPATH],\n [test \"x$ac_cv_libcpath\" = xlocal])\n AS_IF(\n [test \"x$ac_cv_libcpath_CPPFLAGS\" != \"x\"],\n [AC_SUBST(\n [LIBCPATH_CPPFLAGS],\n [$ac_cv_libcpath_CPPFLAGS])\n ])\n AS_IF(\n [test \"x$ac_cv_libcpath_LIBADD\" != \"x\"],\n [AC_SUBST(\n [LIBCPATH_LIBADD],\n [$ac_cv_libcpath_LIBADD])\n ])\n\n AS_IF(\n [test \"x$ac_cv_libcpath\" = xyes],\n [AC_SUBST(\n [ax_libcpath_pc_libs_private],\n [-lcpath])\n ])\n\n AS_IF(\n [test \"x$ac_cv_libcpath\" = xyes],\n [AC_SUBST(\n [ax_libcpath_spec_requires],\n [libcpath])\n AC_SUBST(\n [ax_libcpath_spec_build_requires],\n [libcpath-devel])\n ])\n ])\n\n" }, { "path": "m4/libcsplit.m4", "content": "dnl Checks for libcsplit required headers and functions\ndnl\ndnl Version: 20240513\n\ndnl Function to detect if libcsplit is available\ndnl ac_libcsplit_dummy is used to prevent AC_CHECK_LIB adding unnecessary -l arguments\nAC_DEFUN([AX_LIBCSPLIT_CHECK_LIB],\n [AS_IF(\n [test \"x$ac_cv_enable_shared_libs\" = xno || test \"x$ac_cv_with_libcsplit\" = xno],\n [ac_cv_libcsplit=no],\n [ac_cv_libcsplit=check\n dnl Check if the directory provided as parameter exists\n dnl For both --with-libcsplit which returns \"yes\" and --with-libcsplit= which returns \"\"\n dnl treat them as auto-detection.\n AS_IF(\n [test \"x$ac_cv_with_libcsplit\" != x && test \"x$ac_cv_with_libcsplit\" != xauto-detect && test \"x$ac_cv_with_libcsplit\" != xyes],\n [AX_CHECK_LIB_DIRECTORY_EXISTS([libcsplit])],\n [dnl Check for a pkg-config file\n AS_IF(\n [test \"x$cross_compiling\" != \"xyes\" && test \"x$PKGCONFIG\" != \"x\"],\n [PKG_CHECK_MODULES(\n [libcsplit],\n [libcsplit >= 20120701],\n [ac_cv_libcsplit=yes],\n [ac_cv_libcsplit=check])\n ])\n AS_IF(\n [test \"x$ac_cv_libcsplit\" = xyes && test \"x$ac_cv_enable_wide_character_type\" != xno],\n [AC_CACHE_CHECK(\n [whether libcsplit/features.h defines LIBCSPLIT_HAVE_WIDE_CHARACTER_TYPE as 1],\n [ac_cv_header_libcsplit_features_h_have_wide_character_type],\n [AC_LANG_PUSH(C)\n AC_COMPILE_IFELSE(\n [AC_LANG_PROGRAM(\n [[#include ]],\n [[#if !defined( LIBCSPLIT_HAVE_WIDE_CHARACTER_TYPE ) || ( LIBCSPLIT_HAVE_WIDE_CHARACTER_TYPE != 1 )\n#error LIBCSPLIT_HAVE_WIDE_CHARACTER_TYPE not defined\n#endif]] )],\n [ac_cv_header_libcsplit_features_h_have_wide_character_type=yes],\n [ac_cv_header_libcsplit_features_h_have_wide_character_type=no])\n AC_LANG_POP(C)],\n [ac_cv_header_libcsplit_features_h_have_wide_character_type=no])\n\n AS_IF(\n [test \"x$ac_cv_header_libcsplit_features_h_have_wide_character_type\" = xno],\n [ac_cv_libcsplit=no])\n ])\n AS_IF(\n [test \"x$ac_cv_libcsplit\" = xyes],\n [ac_cv_libcsplit_CPPFLAGS=\"$pkg_cv_libcsplit_CFLAGS\"\n ac_cv_libcsplit_LIBADD=\"$pkg_cv_libcsplit_LIBS\"])\n ])\n\n AS_IF(\n [test \"x$ac_cv_libcsplit\" = xcheck],\n [dnl Check for headers\n AC_CHECK_HEADERS([libcsplit.h])\n\n AS_IF(\n [test \"x$ac_cv_header_libcsplit_h\" = xno],\n [ac_cv_libcsplit=no],\n [ac_cv_libcsplit=yes\n\n AX_CHECK_LIB_FUNCTIONS(\n [libcsplit],\n [csplit],\n [[libcsplit_get_version],\n [libcsplit_narrow_string_split],\n [libcsplit_narrow_split_string_free],\n [libcsplit_narrow_split_string_get_string],\n [libcsplit_narrow_split_string_get_number_of_segments],\n [libcsplit_narrow_split_string_get_segment_by_index],\n [libcsplit_narrow_split_string_set_segment_by_index]])\n\n dnl Wide string functions\n AS_IF(\n [test \"x$ac_cv_enable_wide_character_type\" != xno],\n [AX_CHECK_LIB_FUNCTIONS(\n [libcsplit],\n [csplit],\n [[libcsplit_wide_string_split],\n [libcsplit_wide_split_string_free],\n [libcsplit_wide_split_string_get_string],\n [libcsplit_wide_split_string_get_number_of_segments],\n [libcsplit_wide_split_string_get_segment_by_index],\n [libcsplit_wide_split_string_set_segment_by_index]])\n ])\n\n ac_cv_libcsplit_LIBADD=\"-lcsplit\"])\n ])\n\n AX_CHECK_LIB_DIRECTORY_MSG_ON_FAILURE([libcsplit])\n ])\n\n AS_IF(\n [test \"x$ac_cv_libcsplit\" = xyes],\n [AC_DEFINE(\n [HAVE_LIBCSPLIT],\n [1],\n [Define to 1 if you have the `csplit' library (-lcsplit).])\n ])\n\n AS_IF(\n [test \"x$ac_cv_libcsplit\" = xyes],\n [AC_SUBST(\n [HAVE_LIBCSPLIT],\n [1]) ],\n [AC_SUBST(\n [HAVE_LIBCSPLIT],\n [0])\n ])\n ])\n\ndnl Function to detect if libcsplit dependencies are available\nAC_DEFUN([AX_LIBCSPLIT_CHECK_LOCAL],\n [dnl No additional checks.\n\n ac_cv_libcsplit_CPPFLAGS=\"-I../libcsplit -I\\$(top_srcdir)/libcsplit\";\n ac_cv_libcsplit_LIBADD=\"../libcsplit/libcsplit.la\";\n\n ac_cv_libcsplit=local\n ])\n\ndnl Function to detect how to enable libcsplit\nAC_DEFUN([AX_LIBCSPLIT_CHECK_ENABLE],\n [AX_COMMON_ARG_WITH(\n [libcsplit],\n [libcsplit],\n [search for libcsplit in includedir and libdir or in the specified DIR, or no if to use local version],\n [auto-detect],\n [DIR])\n\n dnl Check for a shared library version\n AX_LIBCSPLIT_CHECK_LIB\n\n dnl Check if the dependencies for the local library version\n AS_IF(\n [test \"x$ac_cv_libcsplit\" != xyes],\n [AX_LIBCSPLIT_CHECK_LOCAL\n\n AC_DEFINE(\n [HAVE_LOCAL_LIBCSPLIT],\n [1],\n [Define to 1 if the local version of libcsplit is used.])\n AC_SUBST(\n [HAVE_LOCAL_LIBCSPLIT],\n [1])\n ])\n\n AM_CONDITIONAL(\n [HAVE_LOCAL_LIBCSPLIT],\n [test \"x$ac_cv_libcsplit\" = xlocal])\n AS_IF(\n [test \"x$ac_cv_libcsplit_CPPFLAGS\" != \"x\"],\n [AC_SUBST(\n [LIBCSPLIT_CPPFLAGS],\n [$ac_cv_libcsplit_CPPFLAGS])\n ])\n AS_IF(\n [test \"x$ac_cv_libcsplit_LIBADD\" != \"x\"],\n [AC_SUBST(\n [LIBCSPLIT_LIBADD],\n [$ac_cv_libcsplit_LIBADD])\n ])\n\n AS_IF(\n [test \"x$ac_cv_libcsplit\" = xyes],\n [AC_SUBST(\n [ax_libcsplit_pc_libs_private],\n [-lcsplit])\n ])\n\n AS_IF(\n [test \"x$ac_cv_libcsplit\" = xyes],\n [AC_SUBST(\n [ax_libcsplit_spec_requires],\n [libcsplit])\n AC_SUBST(\n [ax_libcsplit_spec_build_requires],\n [libcsplit-devel])\n ])\n ])\n\n" }, { "path": "m4/libcthreads.m4", "content": "dnl Checks for libcthreads required headers and functions\ndnl\ndnl Version: 20240513\n\ndnl Function to detect if libcthreads is available\ndnl ac_libcthreads_dummy is used to prevent AC_CHECK_LIB adding unnecessary -l arguments\nAC_DEFUN([AX_LIBCTHREADS_CHECK_LIB],\n [AS_IF(\n [test \"x$ac_cv_enable_shared_libs\" = xno || test \"x$ac_cv_with_libcthreads\" = xno],\n [ac_cv_libcthreads=no],\n [ac_cv_libcthreads=check\n dnl Check if the directory provided as parameter exists\n dnl For both --with-libcthreads which returns \"yes\" and --with-libcthreads= which returns \"\"\n dnl treat them as auto-detection.\n AS_IF(\n [test \"x$ac_cv_with_libcthreads\" != x && test \"x$ac_cv_with_libcthreads\" != xauto-detect && test \"x$ac_cv_with_libcthreads\" != xyes],\n [AX_CHECK_LIB_DIRECTORY_EXISTS([libcthreads])],\n [dnl Check for a pkg-config file\n AS_IF(\n [test \"x$cross_compiling\" != \"xyes\" && test \"x$PKGCONFIG\" != \"x\"],\n [PKG_CHECK_MODULES(\n [libcthreads],\n [libcthreads >= 20160404],\n [ac_cv_libcthreads=yes],\n [ac_cv_libcthreads=check])\n ])\n AS_IF(\n [test \"x$ac_cv_libcthreads\" = xyes],\n [ac_cv_libcthreads_CPPFLAGS=\"$pkg_cv_libcthreads_CFLAGS\"\n ac_cv_libcthreads_LIBADD=\"$pkg_cv_libcthreads_LIBS\"])\n ])\n\n AS_IF(\n [test \"x$ac_cv_libcthreads\" = xcheck],\n [dnl Check for headers\n AC_CHECK_HEADERS([libcthreads.h])\n\n AS_IF(\n [test \"x$ac_cv_header_libcthreads_h\" = xno],\n [ac_cv_libcthreads=no],\n [ac_cv_libcthreads=yes\n\n AX_CHECK_LIB_FUNCTIONS(\n [libcthreads],\n [cthreads],\n [[libcthreads_get_version],\n [libcthreads_thread_create],\n [libcthreads_thread_join],\n [libcthreads_thread_attributes_initialize],\n [libcthreads_thread_attributes_free],\n [libcthreads_condition_initialize],\n [libcthreads_condition_free],\n [libcthreads_condition_broadcast],\n [libcthreads_condition_signal],\n [libcthreads_condition_wait],\n [libcthreads_lock_initialize],\n [libcthreads_lock_free],\n [libcthreads_lock_grab],\n [libcthreads_lock_release],\n [libcthreads_mutex_initialize],\n [libcthreads_mutex_free],\n [libcthreads_mutex_grab],\n [libcthreads_mutex_try_grab],\n [libcthreads_mutex_release],\n [libcthreads_read_write_lock_initialize],\n [libcthreads_read_write_lock_free],\n [libcthreads_read_write_lock_grab_for_read],\n [libcthreads_read_write_lock_grab_for_write],\n [libcthreads_read_write_lock_release_for_read],\n [libcthreads_read_write_lock_release_for_write],\n [libcthreads_queue_initialize],\n [libcthreads_queue_free],\n [libcthreads_queue_type_pop],\n [libcthreads_queue_pop],\n [libcthreads_queue_try_push],\n [libcthreads_queue_push],\n [libcthreads_queue_push_sorted],\n [libcthreads_thread_pool_create],\n [libcthreads_thread_pool_push],\n [libcthreads_thread_pool_push_sorted],\n [libcthreads_thread_pool_join]])\n\n ac_cv_libcthreads_LIBADD=\"-lcthreads\"])\n ])\n\n AX_CHECK_LIB_DIRECTORY_MSG_ON_FAILURE([libcthreads])\n ])\n\n AS_IF(\n [test \"x$ac_cv_libcthreads\" = xyes],\n [AC_DEFINE(\n [HAVE_LIBCTHREADS],\n [1],\n [Define to 1 if you have the `cthreads' library (-lcthreads).])\n ])\n\n AS_IF(\n [test \"x$ac_cv_libcthreads\" = xyes],\n [ac_cv_libcthreads_multi_threading=libcthreads],\n [ac_cv_libcthreads_multi_threading=no])\n\n AS_IF(\n [test \"x$ac_cv_libcthreads\" = xyes],\n [AC_SUBST(\n [HAVE_LIBCTHREADS],\n [1]) ],\n [AC_SUBST(\n [HAVE_LIBCTHREADS],\n [0])\n ])\n ])\n\ndnl Function to detect if libcthreads dependencies are available\nAC_DEFUN([AX_LIBCTHREADS_CHECK_LOCAL],\n [AS_IF(\n [test \"x$ac_cv_enable_winapi\" = xno],\n [dnl Check for enabling pthread support\n AX_PTHREAD_CHECK_ENABLE\n ac_cv_libcthreads_multi_threading=$ac_cv_pthread],\n [ac_cv_libcthreads_multi_threading=\"winapi\"])\n\n AS_IF(\n [test \"x$ac_cv_libcthreads_multi_threading\" != xno],\n [ac_cv_libcthreads_CPPFLAGS=\"-I../libcthreads -I\\$(top_srcdir)/libcthreads\";\n ac_cv_libcthreads_LIBADD=\"../libcthreads/libcthreads.la\";\n\n ac_cv_libcthreads=local],\n [ac_cv_libcthreads=no])\n ])\n\ndnl Function to detect how to enable libcthreads\nAC_DEFUN([AX_LIBCTHREADS_CHECK_ENABLE],\n [AX_COMMON_ARG_ENABLE(\n [multi-threading-support],\n [multi_threading_support],\n [enable multi-threading support],\n [yes])\n AX_COMMON_ARG_WITH(\n [libcthreads],\n [libcthreads],\n [search for libcthreads in includedir and libdir or in the specified DIR, or no if to use local version],\n [auto-detect],\n [DIR])\n\n AS_IF(\n [test \"x$ac_cv_enable_multi_threading_support\" = xno],\n [ac_cv_libcthreads=\"no\"\n ac_cv_libcthreads_multi_threading=\"no\"],\n [dnl Check for a shared library version\n AX_LIBCTHREADS_CHECK_LIB\n\n dnl Check if the dependencies for the local library version\n AS_IF(\n [test \"x$ac_cv_libcthreads\" != xyes],\n [AX_LIBCTHREADS_CHECK_LOCAL\n\n AC_DEFINE(\n [HAVE_LOCAL_LIBCTHREADS],\n [1],\n [Define to 1 if the local version of libcthreads is used.])\n AC_SUBST(\n [HAVE_LOCAL_LIBCTHREADS],\n [1])\n ])\n ])\n\n AM_CONDITIONAL(\n [HAVE_LOCAL_LIBCTHREADS],\n [test \"x$ac_cv_libcthreads\" = xlocal])\n AS_IF(\n [test \"x$ac_cv_libcthreads_CPPFLAGS\" != \"x\"],\n [AC_SUBST(\n [LIBCTHREADS_CPPFLAGS],\n [$ac_cv_libcthreads_CPPFLAGS])\n ])\n AS_IF(\n [test \"x$ac_cv_libcthreads_LIBADD\" != \"x\"],\n [AC_SUBST(\n [LIBCTHREADS_LIBADD],\n [$ac_cv_libcthreads_LIBADD])\n ])\n\n AS_IF(\n [test \"x$ac_cv_libcthreads\" != xno],\n [AC_DEFINE(\n [HAVE_MULTI_THREAD_SUPPORT],\n [1],\n [Define to 1 if multi thread support should be used.])\n AC_SUBST(\n [HAVE_MULTI_THREAD_SUPPORT],\n [1]) ],\n [AC_SUBST(\n [HAVE_MULTI_THREAD_SUPPORT],\n [0])\n ])\n\n AS_IF(\n [test \"x$ac_cv_libcthreads\" = xyes],\n [AC_SUBST(\n [ax_libcthreads_pc_libs_private],\n [-lcthreads])\n ])\n\n AS_IF(\n [test \"x$ac_cv_libcthreads\" = xyes],\n [AC_SUBST(\n [ax_libcthreads_spec_requires],\n [libcthreads])\n AC_SUBST(\n [ax_libcthreads_spec_build_requires],\n [libcthreads-devel])\n ])\n ])\n\n" }, { "path": "m4/libexe.m4", "content": "dnl Checks for libexe required headers and functions\ndnl\ndnl Version: 20240601\n\ndnl Function to detect if libexe is available\ndnl ac_libexe_dummy is used to prevent AC_CHECK_LIB adding unnecessary -l arguments\nAC_DEFUN([AX_LIBEXE_CHECK_LIB],\n [AS_IF(\n [test \"x$ac_cv_enable_shared_libs\" = xno || test \"x$ac_cv_with_libexe\" = xno],\n [ac_cv_libexe=no],\n [ac_cv_libexe=check\n dnl Check if the directory provided as parameter exists\n dnl For both --with-libexe which returns \"yes\" and --with-libexe= which returns \"\"\n dnl treat them as auto-detection.\n AS_IF(\n [test \"x$ac_cv_with_libexe\" != x && test \"x$ac_cv_with_libexe\" != xauto-detect && test \"x$ac_cv_with_libexe\" != xyes],\n [AX_CHECK_LIB_DIRECTORY_EXISTS([libexe])],\n [dnl Check for a pkg-config file\n AS_IF(\n [test \"x$cross_compiling\" != \"xyes\" && test \"x$PKGCONFIG\" != \"x\"],\n [PKG_CHECK_MODULES(\n [libexe],\n [libexe >= 20120405],\n [ac_cv_libexe=yes],\n [ac_cv_libexe=check])\n ])\n AS_IF(\n [test \"x$ac_cv_libexe\" = xyes && test \"x$ac_cv_enable_wide_character_type\" != xno],\n [AC_CACHE_CHECK(\n [whether libexe/features.h defines LIBEXE_HAVE_WIDE_CHARACTER_TYPE as 1],\n [ac_cv_header_libexe_features_h_have_wide_character_type],\n [AC_LANG_PUSH(C)\n AC_COMPILE_IFELSE(\n [AC_LANG_PROGRAM(\n [[#include ]],\n [[#if !defined( LIBEXE_HAVE_WIDE_CHARACTER_TYPE ) || ( LIBEXE_HAVE_WIDE_CHARACTER_TYPE != 1 )\n#error LIBEXE_HAVE_WIDE_CHARACTER_TYPE not defined\n#endif]] )],\n [ac_cv_header_libexe_features_h_have_wide_character_type=yes],\n [ac_cv_header_libexe_features_h_have_wide_character_type=no])\n AC_LANG_POP(C)],\n [ac_cv_header_libexe_features_h_have_wide_character_type=no])\n\n AS_IF(\n [test \"x$ac_cv_header_libexe_features_h_have_wide_character_type\" = xno],\n [ac_cv_libexe=no])\n ])\n AS_IF(\n [test \"x$ac_cv_libexe\" = xyes],\n [ac_cv_libexe_CPPFLAGS=\"$pkg_cv_libexe_CFLAGS\"\n ac_cv_libexe_LIBADD=\"$pkg_cv_libexe_LIBS\"])\n ])\n\n AS_IF(\n [test \"x$ac_cv_libexe\" = xcheck],\n [dnl Check for headers\n AC_CHECK_HEADERS([libexe.h])\n\n AS_IF(\n [test \"x$ac_cv_header_libexe_h\" = xno],\n [ac_cv_libexe=no],\n [ac_cv_libexe=yes\n\n AX_CHECK_LIB_FUNCTIONS(\n [libexe],\n [exe],\n [[libexe_get_version],\n [libexe_file_initialize],\n [libexe_file_free],\n [libexe_file_signal_abort],\n [libexe_file_open],\n [libexe_file_close]])\n\n AS_IF(\n [test \"x$ac_cv_enable_wide_character_type\" != xno],\n [AX_CHECK_LIB_FUNCTIONS(\n [libexe],\n [exe],\n [[libexe_file_open_wide]])\n ])\n\n dnl TODO add functions\n\n ac_cv_libexe_LIBADD=\"-lexe\"])\n ])\n\n AX_CHECK_LIB_DIRECTORY_MSG_ON_FAILURE([libexe])\n ])\n\n AS_IF(\n [test \"x$ac_cv_libexe\" = xyes],\n [AC_DEFINE(\n [HAVE_LIBEXE],\n [1],\n [Define to 1 if you have the `exe' library (-lexe).])\n ])\n\n AS_IF(\n [test \"x$ac_cv_libexe\" = xyes],\n [AC_SUBST(\n [HAVE_LIBEXE],\n [1]) ],\n [AC_SUBST(\n [HAVE_LIBEXE],\n [0])\n ])\n ])\n\ndnl Function to detect if libexe dependencies are available\nAC_DEFUN([AX_LIBEXE_CHECK_LOCAL],\n [ac_cv_libexe_CPPFLAGS=\"-I../libexe -I\\$(top_srcdir)/libexe\";\n ac_cv_libexe_LIBADD=\"../libexe/libexe.la\";\n\n ac_cv_libexe=local\n ])\n\ndnl Function to detect how to enable libexe\nAC_DEFUN([AX_LIBEXE_CHECK_ENABLE],\n [AX_COMMON_ARG_WITH(\n [libexe],\n [libexe],\n [search for libexe in includedir and libdir or in the specified DIR, or no if to use local version],\n [auto-detect],\n [DIR])\n\n dnl Check for a shared library version\n AX_LIBEXE_CHECK_LIB\n\n dnl Check if the dependencies for the local library version\n AS_IF(\n [test \"x$ac_cv_libexe\" != xyes],\n [AX_LIBEXE_CHECK_LOCAL\n\n AC_DEFINE(\n [HAVE_LOCAL_LIBEXE],\n [1],\n [Define to 1 if the local version of libexe is used.])\n AC_SUBST(\n [HAVE_LOCAL_LIBEXE],\n [1])\n ])\n\n AM_CONDITIONAL(\n [HAVE_LOCAL_LIBEXE],\n [test \"x$ac_cv_libexe\" = xlocal])\n AS_IF(\n [test \"x$ac_cv_libexe_CPPFLAGS\" != \"x\"],\n [AC_SUBST(\n [LIBEXE_CPPFLAGS],\n [$ac_cv_libexe_CPPFLAGS])\n ])\n AS_IF(\n [test \"x$ac_cv_libexe_LIBADD\" != \"x\"],\n [AC_SUBST(\n [LIBEXE_LIBADD],\n [$ac_cv_libexe_LIBADD])\n ])\n\n AS_IF(\n [test \"x$ac_cv_libexe\" = xyes],\n [AC_SUBST(\n [ax_libexe_pc_libs_private],\n [-lexe])\n ])\n\n AS_IF(\n [test \"x$ac_cv_libexe\" = xyes],\n [AC_SUBST(\n [ax_libexe_spec_requires],\n [libexe])\n AC_SUBST(\n [ax_libexe_spec_build_requires],\n [libexe-devel])\n ])\n ])\n" }, { "path": "m4/libfcache.m4", "content": "dnl Checks for libfcache required headers and functions\ndnl\ndnl Version: 20240514\n\ndnl Function to detect if libfcache is available\ndnl ac_libfcache_dummy is used to prevent AC_CHECK_LIB adding unnecessary -l arguments\nAC_DEFUN([AX_LIBFCACHE_CHECK_LIB],\n [AS_IF(\n [test \"x$ac_cv_enable_shared_libs\" = xno || test \"x$ac_cv_with_libfcache\" = xno],\n [ac_cv_libfcache=no],\n [ac_cv_libfcache=check\n dnl Check if the directory provided as parameter exists\n dnl For both --with-libfcache which returns \"yes\" and --with-libfcache= which returns \"\"\n dnl treat them as auto-detection.\n AS_IF(\n [test \"x$ac_cv_with_libfcache\" != x && test \"x$ac_cv_with_libfcache\" != xauto-detect && test \"x$ac_cv_with_libfcache\" != xyes],\n [AX_CHECK_LIB_DIRECTORY_EXISTS([libfcache])],\n [dnl Check for a pkg-config file\n AS_IF(\n [test \"x$cross_compiling\" != \"xyes\" && test \"x$PKGCONFIG\" != \"x\"],\n [PKG_CHECK_MODULES(\n [libfcache],\n [libfcache >= 20191109],\n [ac_cv_libfcache=yes],\n [ac_cv_libfcache=check])\n ])\n AS_IF(\n [test \"x$ac_cv_libfcache\" = xyes],\n [ac_cv_libfcache_CPPFLAGS=\"$pkg_cv_libfcache_CFLAGS\"\n ac_cv_libfcache_LIBADD=\"$pkg_cv_libfcache_LIBS\"])\n ])\n\n AS_IF(\n [test \"x$ac_cv_libfcache\" = xcheck],\n [dnl Check for headers\n AC_CHECK_HEADERS([libfcache.h])\n\n AS_IF(\n [test \"x$ac_cv_header_libfcache_h\" = xno],\n [ac_cv_libfcache=no],\n [ac_cv_libfcache=yes\n\n AX_CHECK_LIB_FUNCTIONS(\n [libfcache],\n [fcache],\n [[libfcache_get_version],\n [libfcache_cache_initialize],\n [libfcache_cache_free],\n [libfcache_cache_clone],\n [libfcache_cache_clear],\n [libfcache_cache_get_number_of_entries],\n [libfcache_cache_get_number_of_cache_values],\n [libfcache_cache_clear_value_by_index],\n [libfcache_cache_get_value_by_identifier],\n [libfcache_cache_get_value_by_index],\n [libfcache_cache_set_value_by_identifier],\n [libfcache_cache_set_value_by_index],\n [libfcache_cache_value_free],\n [libfcache_cache_value_clear],\n [libfcache_cache_value_get_identifier],\n [libfcache_cache_value_set_identifier],\n [libfcache_cache_value_get_value],\n [libfcache_cache_value_set_value],\n [libfcache_date_time_get_timestamp]])\n\n ac_cv_libfcache_LIBADD=\"-lfcache\"])\n ])\n\n AX_CHECK_LIB_DIRECTORY_MSG_ON_FAILURE([libfcache])\n ])\n\n AS_IF(\n [test \"x$ac_cv_libfcache\" = xyes],\n [AC_DEFINE(\n [HAVE_LIBFCACHE],\n [1],\n [Define to 1 if you have the `fcache' library (-lfcache).])\n ])\n\n AS_IF(\n [test \"x$ac_cv_libfcache\" = xyes],\n [AC_SUBST(\n [HAVE_LIBFCACHE],\n [1]) ],\n [AC_SUBST(\n [HAVE_LIBFCACHE],\n [0])\n ])\n ])\n\ndnl Function to detect if libfcache dependencies are available\nAC_DEFUN([AX_LIBFCACHE_CHECK_LOCAL],\n [dnl Types used in libfcache/libfcache_date_time.h\n AC_STRUCT_TM\n\n dnl Headers included in libfcache/libfcache_date_time.h\n AC_CHECK_HEADERS([sys/time.h])\n\n dnl Date and time functions used in libfcache/libfcache_date_time.h\n AC_CHECK_FUNCS([clock_gettime time])\n\n AS_IF(\n [test \"x$ac_cv_func_time\" != xyes],\n [AC_MSG_FAILURE(\n [Missing function: time],\n [1])\n ])\n\n ac_cv_libfcache_CPPFLAGS=\"-I../libfcache -I\\$(top_srcdir)/libfcache\";\n ac_cv_libfcache_LIBADD=\"../libfcache/libfcache.la\";\n\n ac_cv_libfcache=local\n ])\n\ndnl Function to detect how to enable libfcache\nAC_DEFUN([AX_LIBFCACHE_CHECK_ENABLE],\n [AX_COMMON_ARG_WITH(\n [libfcache],\n [libfcache],\n [search for libfcache in includedir and libdir or in the specified DIR, or no if to use local version],\n [auto-detect],\n [DIR])\n\n dnl Check for a shared library version\n AX_LIBFCACHE_CHECK_LIB\n\n dnl Check if the dependencies for the local library version\n AS_IF(\n [test \"x$ac_cv_libfcache\" != xyes],\n [AX_LIBFCACHE_CHECK_LOCAL\n\n AC_DEFINE(\n [HAVE_LOCAL_LIBFCACHE],\n [1],\n [Define to 1 if the local version of libfcache is used.])\n AC_SUBST(\n [HAVE_LOCAL_LIBFCACHE],\n [1])\n ])\n\n AM_CONDITIONAL(\n [HAVE_LOCAL_LIBFCACHE],\n [test \"x$ac_cv_libfcache\" = xlocal])\n AS_IF(\n [test \"x$ac_cv_libfcache_CPPFLAGS\" != \"x\"],\n [AC_SUBST(\n [LIBFCACHE_CPPFLAGS],\n [$ac_cv_libfcache_CPPFLAGS])\n ])\n AS_IF(\n [test \"x$ac_cv_libfcache_LIBADD\" != \"x\"],\n [AC_SUBST(\n [LIBFCACHE_LIBADD],\n [$ac_cv_libfcache_LIBADD])\n ])\n\n AS_IF(\n [test \"x$ac_cv_libfcache\" = xyes],\n [AC_SUBST(\n [ax_libfcache_pc_libs_private],\n [-lfcache])\n ])\n\n AS_IF(\n [test \"x$ac_cv_libfcache\" = xyes],\n [AC_SUBST(\n [ax_libfcache_spec_requires],\n [libfcache])\n AC_SUBST(\n [ax_libfcache_spec_build_requires],\n [libfcache-devel])\n ])\n ])\n" }, { "path": "m4/libfdata.m4", "content": "dnl Functions for libfdata\ndnl\ndnl Version: 20240520\n\ndnl Function to detect if libfdata is available\ndnl ac_libfdata_dummy is used to prevent AC_CHECK_LIB adding unnecessary -l arguments\nAC_DEFUN([AX_LIBFDATA_CHECK_LIB],\n [AS_IF(\n [test \"x$ac_cv_enable_shared_libs\" = xno || test \"x$ac_cv_with_libfdata\" = xno],\n [ac_cv_libfdata=no],\n [ac_cv_libfdata=check\n dnl Check if the directory provided as parameter exists\n dnl For both --with-libfdata which returns \"yes\" and --with-libfdata= which returns \"\"\n dnl treat them as auto-detection.\n AS_IF(\n [test \"x$ac_cv_with_libfdata\" != x && test \"x$ac_cv_with_libfdata\" != xauto-detect && test \"x$ac_cv_with_libfdata\" != xyes],\n [AX_CHECK_LIB_DIRECTORY_EXISTS([libfdata])],\n [dnl Check for a pkg-config file\n AS_IF(\n [test \"x$cross_compiling\" != \"xyes\" && test \"x$PKGCONFIG\" != \"x\"],\n [PKG_CHECK_MODULES(\n [libfdata],\n [libfdata >= 20201129],\n [ac_cv_libfdata=yes],\n [ac_cv_libfdata=check])\n ])\n AS_IF(\n [test \"x$ac_cv_libfdata\" = xyes],\n [ac_cv_libfdata_CPPFLAGS=\"$pkg_cv_libfdata_CFLAGS\"\n ac_cv_libfdata_LIBADD=\"$pkg_cv_libfdata_LIBS\"])\n ])\n\n AS_IF(\n [test \"x$ac_cv_libfdata\" = xcheck],\n [dnl Check for headers\n AC_CHECK_HEADERS([libfdata.h])\n\n AS_IF(\n [test \"x$ac_cv_header_libfdata_h\" = xno],\n [ac_cv_libfdata=no],\n [ac_cv_libfdata=yes\n\n AX_CHECK_LIB_FUNCTIONS(\n [libfdata],\n [fdata],\n [[libfdata_get_version],\n [libfdata_area_initialize],\n [libfdata_area_free],\n [libfdata_area_clone],\n [libfdata_area_empty],\n [libfdata_area_resize],\n [libfdata_area_get_number_of_segments],\n [libfdata_area_get_segment_by_index],\n [libfdata_area_set_segment_by_index],\n [libfdata_area_prepend_segment],\n [libfdata_area_append_segment],\n [libfdata_area_get_element_data_size],\n [libfdata_area_get_element_value_at_offset],\n [libfdata_area_set_element_value_at_offset],\n [libfdata_area_get_size],\n [libfdata_list_initialize],\n [libfdata_list_free],\n [libfdata_list_clone],\n [libfdata_list_empty],\n [libfdata_list_resize],\n [libfdata_list_reverse],\n [libfdata_list_get_number_of_elements],\n [libfdata_list_get_list_element_by_index],\n [libfdata_list_get_element_by_index],\n [libfdata_list_set_element_by_index],\n [libfdata_list_prepend_element],\n [libfdata_list_append_element],\n [libfdata_list_append_list],\n [libfdata_list_is_element_set],\n [libfdata_list_get_element_mapped_range],\n [libfdata_list_get_mapped_offset],\n [libfdata_list_set_mapped_offset],\n [libfdata_list_get_mapped_size_by_index],\n [libfdata_list_set_mapped_size_by_index],\n [libfdata_list_get_element_by_index_with_mapped_size],\n [libfdata_list_set_element_by_index_with_mapped_size],\n [libfdata_list_append_element_with_mapped_size],\n [libfdata_list_get_element_index_at_offset],\n [libfdata_list_get_list_element_at_offset],\n [libfdata_list_get_element_at_offset],\n [libfdata_list_cache_element_value],\n [libfdata_list_get_element_value_by_index],\n [libfdata_list_get_element_value_at_offset],\n [libfdata_list_set_element_value_by_index],\n [libfdata_list_set_element_value_at_offset],\n [libfdata_list_get_size],\n [libfdata_list_element_get_mapped_size],\n [libfdata_list_element_set_mapped_size],\n [libfdata_list_element_get_element_value],\n [libfdata_list_element_set_element_value],\n [libfdata_list_element_get_mapped_size],\n [libfdata_list_element_set_mapped_size],\n [libfdata_list_element_get_element_value],\n [libfdata_list_element_set_element_value],\n [libfdata_stream_initialize],\n [libfdata_stream_free],\n [libfdata_stream_clone],\n [libfdata_stream_empty],\n [libfdata_stream_resize],\n [libfdata_stream_reverse],\n [libfdata_stream_get_number_of_segments],\n [libfdata_stream_get_segment_by_index],\n [libfdata_stream_set_segment_by_index],\n [libfdata_stream_prepend_segment],\n [libfdata_stream_append_segment],\n [libfdata_stream_set_mapped_size],\n [libfdata_stream_get_segment_mapped_range],\n [libfdata_stream_get_segment_index_at_offset],\n [libfdata_stream_get_segment_at_offset],\n [libfdata_stream_read_buffer],\n [libfdata_stream_read_buffer_at_offset],\n [libfdata_stream_write_buffer],\n [libfdata_stream_seek_offset],\n [libfdata_stream_get_offset],\n [libfdata_stream_get_size],\n [libfdata_range_list_initialize],\n [libfdata_range_list_free],\n [libfdata_range_list_clone],\n [libfdata_range_list_empty],\n [libfdata_range_list_get_list_element_at_offset],\n [libfdata_range_list_get_element_at_offset],\n [libfdata_range_list_insert_element],\n [libfdata_range_list_get_element_value_at_offset],\n [libfdata_range_list_set_element_value_at_offset],\n [libfdata_vector_initialize],\n [libfdata_vector_free],\n [libfdata_vector_clone],\n [libfdata_vector_empty],\n [libfdata_vector_resize],\n [libfdata_vector_get_number_of_segments],\n [libfdata_vector_get_segment_by_index],\n [libfdata_vector_set_segment_by_index],\n [libfdata_vector_prepend_segment],\n [libfdata_vector_append_segment],\n [libfdata_vector_get_element_data_size],\n [libfdata_vector_get_number_of_elements],\n [libfdata_vector_get_element_index_at_offset],\n [libfdata_vector_get_element_value_by_index],\n [libfdata_vector_get_element_value_at_offset],\n [libfdata_vector_set_element_value_by_index],\n [libfdata_vector_get_size]])\n\n ac_cv_libfdata_LIBADD=\"-lfdata\"])\n ])\n\n AX_CHECK_LIB_DIRECTORY_MSG_ON_FAILURE([libfdata])\n ])\n\n AS_IF(\n [test \"x$ac_cv_libfdata\" = xyes],\n [AC_DEFINE(\n [HAVE_LIBFDATA],\n [1],\n [Define to 1 if you have the `fdata' library (-lfdata).])\n ])\n\n AS_IF(\n [test \"x$ac_cv_libfdata\" = xyes],\n [AC_SUBST(\n [HAVE_LIBFDATA],\n [1]) ],\n [AC_SUBST(\n [HAVE_LIBFDATA],\n [0])\n ])\n ])\n\ndnl Function to detect if libfdata dependencies are available\nAC_DEFUN([AX_LIBFDATA_CHECK_LOCAL],\n [dnl No additional checks.\n\n ac_cv_libfdata_CPPFLAGS=\"-I../libfdata -I\\$(top_srcdir)/libfdata\";\n ac_cv_libfdata_LIBADD=\"../libfdata/libfdata.la\";\n\n ac_cv_libfdata=local\n ])\n\ndnl Function to detect how to enable libfdata\nAC_DEFUN([AX_LIBFDATA_CHECK_ENABLE],\n [AX_COMMON_ARG_WITH(\n [libfdata],\n [libfdata],\n [search for libfdata in includedir and libdir or in the specified DIR, or no if to use local version],\n [auto-detect],\n [DIR])\n\n dnl Check for a shared library version\n AX_LIBFDATA_CHECK_LIB\n\n dnl Check if the dependencies for the local library version\n AS_IF(\n [test \"x$ac_cv_libfdata\" != xyes],\n [AX_LIBFDATA_CHECK_LOCAL\n\n AC_DEFINE(\n [HAVE_LOCAL_LIBFDATA],\n [1],\n [Define to 1 if the local version of libfdata is used.])\n AC_SUBST(\n [HAVE_LOCAL_LIBFDATA],\n [1])\n ])\n\n AM_CONDITIONAL(\n [HAVE_LOCAL_LIBFDATA],\n [test \"x$ac_cv_libfdata\" = xlocal])\n AS_IF(\n [test \"x$ac_cv_libfdata_CPPFLAGS\" != \"x\"],\n [AC_SUBST(\n [LIBFDATA_CPPFLAGS],\n [$ac_cv_libfdata_CPPFLAGS])\n ])\n AS_IF(\n [test \"x$ac_cv_libfdata_LIBADD\" != \"x\"],\n [AC_SUBST(\n [LIBFDATA_LIBADD],\n [$ac_cv_libfdata_LIBADD])\n ])\n\n AS_IF(\n [test \"x$ac_cv_libfdata\" = xyes],\n [AC_SUBST(\n [ax_libfdata_pc_libs_private],\n [-lfdata])\n ])\n\n AS_IF(\n [test \"x$ac_cv_libfdata\" = xyes],\n [AC_SUBST(\n [ax_libfdata_spec_requires],\n [libfdata])\n AC_SUBST(\n [ax_libfdata_spec_build_requires],\n [libfdata-devel])\n ])\n ])\n" }, { "path": "m4/libfdatetime.m4", "content": "dnl Checks for libfdatetime required headers and functions\ndnl\ndnl Version: 20240518\n\ndnl Function to detect if libfdatetime is available\ndnl ac_libfdatetime_dummy is used to prevent AC_CHECK_LIB adding unnecessary -l arguments\nAC_DEFUN([AX_LIBFDATETIME_CHECK_LIB],\n [AS_IF(\n [test \"x$ac_cv_enable_shared_libs\" = xno || test \"x$ac_cv_with_libfdatetime\" = xno],\n [ac_cv_libfdatetime=no],\n [ac_cv_libfdatetime=check\n dnl Check if the directory provided as parameter exists\n dnl For both --with-libfdatetime which returns \"yes\" and --with-libfdatetime= which returns \"\"\n dnl treat them as auto-detection.\n AS_IF(\n [test \"x$ac_cv_with_libfdatetime\" != x && test \"x$ac_cv_with_libfdatetime\" != xauto-detect && test \"x$ac_cv_with_libfdatetime\" != xyes],\n [AX_CHECK_LIB_DIRECTORY_EXISTS([libfdatetime])],\n [dnl Check for a pkg-config file\n AS_IF(\n [test \"x$cross_compiling\" != \"xyes\" && test \"x$PKGCONFIG\" != \"x\"],\n [PKG_CHECK_MODULES(\n [libfdatetime],\n [libfdatetime >= 20180910],\n [ac_cv_libfdatetime=yes],\n [ac_cv_libfdatetime=check])\n ])\n AS_IF(\n [test \"x$ac_cv_libfdatetime\" = xyes],\n [ac_cv_libfdatetime_CPPFLAGS=\"$pkg_cv_libfdatetime_CFLAGS\"\n ac_cv_libfdatetime_LIBADD=\"$pkg_cv_libfdatetime_LIBS\"])\n ])\n\n AS_IF(\n [test \"x$ac_cv_libfdatetime\" = xcheck],\n [dnl Check for headers\n AC_CHECK_HEADERS([libfdatetime.h])\n\n AS_IF(\n [test \"x$ac_cv_header_libfdatetime_h\" = xno],\n [ac_cv_libfdatetime=no],\n [ac_cv_libfdatetime=yes\n\n AX_CHECK_LIB_FUNCTIONS(\n [libfdatetime],\n [fdatetime],\n [[libfdatetime_get_version],\n [libfdatetime_fat_date_time_initialize],\n [libfdatetime_fat_date_time_free],\n [libfdatetime_fat_date_time_copy_from_byte_stream],\n [libfdatetime_fat_date_time_copy_from_32bit],\n [libfdatetime_fat_date_time_copy_to_32bit],\n [libfdatetime_fat_date_time_copy_to_utf8_string],\n [libfdatetime_fat_date_time_copy_to_utf8_string_with_index],\n [libfdatetime_fat_date_time_copy_to_utf16_string],\n [libfdatetime_fat_date_time_copy_to_utf16_string_with_index],\n [libfdatetime_fat_date_time_copy_to_utf32_string],\n [libfdatetime_fat_date_time_copy_to_utf32_string_with_index],\n [libfdatetime_filetime_initialize],\n [libfdatetime_filetime_free],\n [libfdatetime_filetime_copy_from_byte_stream],\n [libfdatetime_filetime_copy_from_64bit],\n [libfdatetime_filetime_copy_to_64bit],\n [libfdatetime_filetime_copy_to_utf8_string],\n [libfdatetime_filetime_copy_to_utf8_string_with_index],\n [libfdatetime_filetime_copy_to_utf16_string],\n [libfdatetime_filetime_copy_to_utf16_string_with_index],\n [libfdatetime_filetime_copy_to_utf32_string],\n [libfdatetime_filetime_copy_to_utf32_string_with_index],\n [libfdatetime_filetime_add],\n [libfdatetime_floatingtime_initialize],\n [libfdatetime_floatingtime_free],\n [libfdatetime_floatingtime_copy_from_byte_stream],\n [libfdatetime_floatingtime_copy_from_64bit],\n [libfdatetime_floatingtime_copy_to_64bit],\n [libfdatetime_floatingtime_copy_to_utf8_string],\n [libfdatetime_floatingtime_copy_to_utf8_string_with_index],\n [libfdatetime_floatingtime_copy_to_utf16_string],\n [libfdatetime_floatingtime_copy_to_utf16_string_with_index],\n [libfdatetime_floatingtime_copy_to_utf32_string],\n [libfdatetime_floatingtime_copy_to_utf32_string_with_index],\n [libfdatetime_hfs_time_initialize],\n [libfdatetime_hfs_time_free],\n [libfdatetime_hfs_time_copy_from_byte_stream],\n [libfdatetime_hfs_time_copy_from_32bit],\n [libfdatetime_hfs_time_copy_to_32bit],\n [libfdatetime_hfs_time_copy_to_utf8_string],\n [libfdatetime_hfs_time_copy_to_utf8_string_with_index],\n [libfdatetime_hfs_time_copy_to_utf16_string],\n [libfdatetime_hfs_time_copy_to_utf16_string_with_index],\n [libfdatetime_hfs_time_copy_to_utf32_string],\n [libfdatetime_hfs_time_copy_to_utf32_string_with_index],\n [libfdatetime_nsf_timedate_initialize],\n [libfdatetime_nsf_timedate_free],\n [libfdatetime_nsf_timedate_copy_from_byte_stream],\n [libfdatetime_nsf_timedate_copy_from_64bit],\n [libfdatetime_nsf_timedate_copy_to_64bit],\n [libfdatetime_nsf_timedate_copy_to_utf8_string],\n [libfdatetime_nsf_timedate_copy_to_utf8_string_with_index],\n [libfdatetime_nsf_timedate_copy_to_utf16_string],\n [libfdatetime_nsf_timedate_copy_to_utf16_string_with_index],\n [libfdatetime_nsf_timedate_copy_to_utf32_string],\n [libfdatetime_nsf_timedate_copy_to_utf32_string_with_index],\n [libfdatetime_posix_time_initialize],\n [libfdatetime_posix_time_free],\n [libfdatetime_posix_time_copy_from_byte_stream],\n [libfdatetime_posix_time_copy_from_32bit],\n [libfdatetime_posix_time_copy_to_32bit],\n [libfdatetime_posix_time_copy_from_64bit],\n [libfdatetime_posix_time_copy_to_64bit],\n [libfdatetime_posix_time_copy_to_utf8_string],\n [libfdatetime_posix_time_copy_to_utf8_string_with_index],\n [libfdatetime_posix_time_copy_to_utf16_string],\n [libfdatetime_posix_time_copy_to_utf16_string_with_index],\n [libfdatetime_posix_time_copy_to_utf32_string],\n [libfdatetime_posix_time_copy_to_utf32_string_with_index],\n [libfdatetime_systemetime_initialize],\n [libfdatetime_systemetime_free],\n [libfdatetime_systemetime_copy_from_byte_stream],\n [libfdatetime_systemetime_copy_to_utf8_string],\n [libfdatetime_systemetime_copy_to_utf8_string_with_index],\n [libfdatetime_systemetime_copy_to_utf16_string],\n [libfdatetime_systemetime_copy_to_utf16_string_with_index],\n [libfdatetime_systemetime_copy_to_utf32_string],\n [libfdatetime_systemetime_copy_to_utf32_string_with_index]])\n\n ac_cv_libfdatetime_LIBADD=\"-lfdatetime\"])\n ])\n\n AX_CHECK_LIB_DIRECTORY_MSG_ON_FAILURE([libfdatetime])\n ])\n\n AS_IF(\n [test \"x$ac_cv_libfdatetime\" = xyes],\n [AC_DEFINE(\n [HAVE_LIBFDATETIME],\n [1],\n [Define to 1 if you have the `fdatetime' library (-lfdatetime).])\n ])\n\n AS_IF(\n [test \"x$ac_cv_libfdatetime\" = xyes],\n [AC_SUBST(\n [HAVE_LIBFDATETIME],\n [1]) ],\n [AC_SUBST(\n [HAVE_LIBFDATETIME],\n [0])\n ])\n ])\n\ndnl Function to detect if libfdatetime dependencies are available\nAC_DEFUN([AX_LIBFDATETIME_CHECK_LOCAL],\n [dnl No additional checks.\n\n ac_cv_libfdatetime_CPPFLAGS=\"-I../libfdatetime -I\\$(top_srcdir)/libfdatetime\";\n ac_cv_libfdatetime_LIBADD=\"../libfdatetime/libfdatetime.la\";\n\n ac_cv_libfdatetime=local\n ])\n\ndnl Function to detect how to enable libfdatetime\nAC_DEFUN([AX_LIBFDATETIME_CHECK_ENABLE],\n [AX_COMMON_ARG_WITH(\n [libfdatetime],\n [libfdatetime],\n [search for libfdatetime in includedir and libdir or in the specified DIR, or no if to use local version],\n [auto-detect],\n [DIR])\n\n AX_LIBFDATETIME_CHECK_LIB\n\n dnl Check if the dependencies for the local library version\n AS_IF(\n [test \"x$ac_cv_libfdatetime\" != xyes],\n [AX_LIBFDATETIME_CHECK_LOCAL\n\n AC_DEFINE(\n [HAVE_LOCAL_LIBFDATETIME],\n [1],\n [Define to 1 if the local version of libfdatetime is used.])\n AC_SUBST(\n [HAVE_LOCAL_LIBFDATETIME],\n [1])\n ])\n\n AM_CONDITIONAL(\n [HAVE_LOCAL_LIBFDATETIME],\n [test \"x$ac_cv_libfdatetime\" = xlocal])\n AS_IF(\n [test \"x$ac_cv_libfdatetime_CPPFLAGS\" != \"x\"],\n [AC_SUBST(\n [LIBFDATETIME_CPPFLAGS],\n [$ac_cv_libfdatetime_CPPFLAGS])\n ])\n AS_IF(\n [test \"x$ac_cv_libfdatetime_LIBADD\" != \"x\"],\n [AC_SUBST(\n [LIBFDATETIME_LIBADD],\n [$ac_cv_libfdatetime_LIBADD])\n ])\n\n AS_IF(\n [test \"x$ac_cv_libfdatetime\" = xyes],\n [AC_SUBST(\n [ax_libfdatetime_pc_libs_private],\n [-lfdatetime])\n ])\n\n AS_IF(\n [test \"x$ac_cv_libfdatetime\" = xyes],\n [AC_SUBST(\n [ax_libfdatetime_spec_requires],\n [libfdatetime])\n AC_SUBST(\n [ax_libfdatetime_spec_build_requires],\n [libfdatetime-devel])\n ])\n ])\n\n" }, { "path": "m4/libfguid.m4", "content": "dnl Checks for libfguid required headers and functions\ndnl\ndnl Version: 20240519\n\ndnl Function to detect if libfguid is available\ndnl ac_libfguid_dummy is used to prevent AC_CHECK_LIB adding unnecessary -l arguments\nAC_DEFUN([AX_LIBFGUID_CHECK_LIB],\n [AS_IF(\n [test \"x$ac_cv_enable_shared_libs\" = xno || test \"x$ac_cv_with_libfguid\" = xno],\n [ac_cv_libfguid=no],\n [ac_cv_libfguid=check\n dnl Check if the directory provided as parameter exists\n dnl For both --with-libfguid which returns \"yes\" and --with-libfguid= which returns \"\"\n dnl treat them as auto-detection.\n AS_IF(\n [test \"x$ac_cv_with_libfguid\" != x && test \"x$ac_cv_with_libfguid\" != xauto-detect && test \"x$ac_cv_with_libfguid\" != xyes],\n [AX_CHECK_LIB_DIRECTORY_EXISTS([libfguid])],\n [dnl Check for a pkg-config file\n AS_IF(\n [test \"x$cross_compiling\" != \"xyes\" && test \"x$PKGCONFIG\" != \"x\"],\n [PKG_CHECK_MODULES(\n [libfguid],\n [libfguid >= 20120426],\n [ac_cv_libfguid=yes],\n [ac_cv_libfguid=check])\n ])\n AS_IF(\n [test \"x$ac_cv_libfguid\" = xyes],\n [ac_cv_libfguid_CPPFLAGS=\"$pkg_cv_libfguid_CFLAGS\"\n ac_cv_libfguid_LIBADD=\"$pkg_cv_libfguid_LIBS\"])\n ])\n\n AS_IF(\n [test \"x$ac_cv_libfguid\" = xcheck],\n [dnl Check for headers\n AC_CHECK_HEADERS([libfguid.h])\n\n AS_IF(\n [test \"x$ac_cv_header_libfguid_h\" = xno],\n [ac_cv_libfguid=no],\n [ac_cv_libfguid=yes\n\n AX_CHECK_LIB_FUNCTIONS(\n [libfguid],\n [fguid],\n [[libfguid_get_version],\n [libfguid_identifier_initialize],\n [libfguid_identifier_free],\n [libfguid_identifier_copy_from_byte_stream],\n [libfguid_identifier_get_string_size],\n [libfguid_identifier_copy_to_utf8_string],\n [libfguid_identifier_copy_to_utf8_string_with_index],\n [libfguid_identifier_copy_to_utf16_string],\n [libfguid_identifier_copy_to_utf16_string_with_index],\n [libfguid_identifier_copy_to_utf32_string],\n [libfguid_identifier_copy_to_utf32_string_with_index]])\n\n ac_cv_libfguid_LIBADD=\"-lfguid\"])\n ])\n\n AX_CHECK_LIB_DIRECTORY_MSG_ON_FAILURE([libfguid])\n ])\n\n AS_IF(\n [test \"x$ac_cv_libfguid\" = xyes],\n [AC_DEFINE(\n [HAVE_LIBFGUID],\n [1],\n [Define to 1 if you have the `fguid' library (-lfguid).])\n ])\n\n AS_IF(\n [test \"x$ac_cv_libfguid\" = xyes],\n [AC_SUBST(\n [HAVE_LIBFGUID],\n [1]) ],\n [AC_SUBST(\n [HAVE_LIBFGUID],\n [0])\n ])\n ])\n\ndnl Function to detect if libfguid dependencies are available\nAC_DEFUN([AX_LIBFGUID_CHECK_LOCAL],\n [dnl No additional checks.\n\n ac_cv_libfguid_CPPFLAGS=\"-I../libfguid -I\\$(top_srcdir)/libfguid\";\n ac_cv_libfguid_LIBADD=\"../libfguid/libfguid.la\";\n\n ac_cv_libfguid=local\n ])\n\n\ndnl Function to detect how to enable libfguid\nAC_DEFUN([AX_LIBFGUID_CHECK_ENABLE],\n [AX_COMMON_ARG_WITH(\n [libfguid],\n [libfguid],\n [search for libfguid in includedir and libdir or in the specified DIR, or no if to use local version],\n [auto-detect],\n [DIR])\n\n dnl Check for a shared library version\n AX_LIBFGUID_CHECK_LIB\n\n dnl Check if the dependencies for the local library version\n AS_IF(\n [test \"x$ac_cv_libfguid\" != xyes],\n [AX_LIBFGUID_CHECK_LOCAL\n\n AC_DEFINE(\n [HAVE_LOCAL_LIBFGUID],\n [1],\n [Define to 1 if the local version of libfguid is used.])\n AC_SUBST(\n [HAVE_LOCAL_LIBFGUID],\n [1])\n ])\n\n AM_CONDITIONAL(\n [HAVE_LOCAL_LIBFGUID],\n [test \"x$ac_cv_libfguid\" = xlocal])\n AS_IF(\n [test \"x$ac_cv_libfguid_CPPFLAGS\" != \"x\"],\n [AC_SUBST(\n [LIBFGUID_CPPFLAGS],\n [$ac_cv_libfguid_CPPFLAGS])\n ])\n AS_IF(\n [test \"x$ac_cv_libfguid_LIBADD\" != \"x\"],\n [AC_SUBST(\n [LIBFGUID_LIBADD],\n [$ac_cv_libfguid_LIBADD])\n ])\n\n AS_IF(\n [test \"x$ac_cv_libfguid\" = xyes],\n [AC_SUBST(\n [ax_libfguid_pc_libs_private],\n [-lfguid])\n ])\n\n AS_IF(\n [test \"x$ac_cv_libfguid\" = xyes],\n [AC_SUBST(\n [ax_libfguid_spec_requires],\n [libfguid])\n AC_SUBST(\n [ax_libfguid_spec_build_requires],\n [libfguid-devel])\n ])\n ])\n\n" }, { "path": "m4/libfvalue.m4", "content": "dnl Checks for libfvalue required headers and functions\ndnl\ndnl Version: 20240519\n\ndnl Function to detect if libfvalue is available\ndnl ac_libfvalue_dummy is used to prevent AC_CHECK_LIB adding unnecessary -l arguments\nAC_DEFUN([AX_LIBFVALUE_CHECK_LIB],\n [AS_IF(\n [test \"x$ac_cv_enable_shared_libs\" = xno || test \"x$ac_cv_with_libfvalue\" = xno],\n [ac_cv_libfvalue=no],\n [ac_cv_libfvalue=check\n dnl Check if the directory provided as parameter exists\n dnl For both --with-libfvalue which returns \"yes\" and --with-libfvalue= which returns \"\"\n dnl treat them as auto-detection.\n AS_IF(\n [test \"x$ac_cv_with_libfvalue\" != x && test \"x$ac_cv_with_libfvalue\" != xauto-detect && test \"x$ac_cv_with_libfvalue\" != xyes],\n [AX_CHECK_LIB_DIRECTORY_EXISTS([libfvalue])],\n [dnl Check for a pkg-config file\n AS_IF(\n [test \"x$cross_compiling\" != \"xyes\" && test \"x$PKGCONFIG\" != \"x\"],\n [PKG_CHECK_MODULES(\n [libfvalue],\n [libfvalue >= 20200711],\n [ac_cv_libfvalue=yes],\n [ac_cv_libfvalue=check])\n ])\n AS_IF(\n [test \"x$ac_cv_libfvalue\" = xyes],\n [ac_cv_libfvalue_CPPFLAGS=\"$pkg_cv_libfvalue_CFLAGS\"\n ac_cv_libfvalue_LIBADD=\"$pkg_cv_libfvalue_LIBS\"])\n ])\n\n AS_IF(\n [test \"x$ac_cv_libfvalue\" = xcheck],\n [dnl Check for headers\n AC_CHECK_HEADERS([libfvalue.h])\n\n AS_IF(\n [test \"x$ac_cv_header_libfvalue_h\" = xno],\n [ac_cv_libfvalue=no],\n [ac_cv_libfvalue=yes\n\n AX_CHECK_LIB_FUNCTIONS(\n [libfvalue],\n [fvalue],\n [[libfvalue_get_version],\n [libfvalue_data_handle_initialize],\n [libfvalue_data_handle_free],\n [libfvalue_data_handle_clone],\n [libfvalue_data_handle_clear],\n [libfvalue_data_handle_get_data],\n [libfvalue_data_handle_set_data],\n [libfvalue_data_handle_get_data_flags],\n [libfvalue_data_handle_set_data_flags],\n [libfvalue_data_handle_get_number_of_value_entries],\n [libfvalue_data_handle_get_value_entry],\n [libfvalue_data_handle_set_value_entry],\n [libfvalue_data_handle_append_value_entry],\n [libfvalue_string_size_from_integer],\n [libfvalue_utf8_string_copy_from_integer],\n [libfvalue_utf8_string_with_index_copy_from_integer],\n [libfvalue_utf8_string_copy_to_integer],\n [libfvalue_utf8_string_with_index_copy_to_integer],\n [libfvalue_utf16_string_copy_from_integer],\n [libfvalue_utf16_string_with_index_copy_from_integer],\n [libfvalue_utf16_string_copy_to_integer],\n [libfvalue_utf16_string_with_index_copy_to_integer],\n [libfvalue_utf32_string_copy_from_integer],\n [libfvalue_utf32_string_with_index_copy_from_integer],\n [libfvalue_utf32_string_copy_to_integer],\n [libfvalue_utf32_string_with_index_copy_to_integer],\n [libfvalue_utf8_string_split],\n [libfvalue_utf16_string_split],\n [libfvalue_split_utf8_string_free],\n [libfvalue_split_utf8_string_get_string],\n [libfvalue_split_utf8_string_get_number_of_segments],\n [libfvalue_split_utf8_string_get_segment_by_index],\n [libfvalue_split_utf16_string_free],\n [libfvalue_split_utf16_string_get_string],\n [libfvalue_split_utf16_string_get_number_of_segments],\n [libfvalue_split_utf16_string_get_segment_by_index],\n [libfvalue_table_initialize],\n [libfvalue_table_free],\n [libfvalue_table_resize],\n [libfvalue_table_clone],\n [libfvalue_table_get_number_of_values],\n [libfvalue_table_get_index_by_identifier],\n [libfvalue_table_get_value_by_index],\n [libfvalue_table_get_value_by_identifier],\n [libfvalue_table_set_value_by_index],\n [libfvalue_table_set_value],\n [libfvalue_table_copy_from_utf8_xml_string],\n [libfvalue_value_initialize],\n [libfvalue_value_free],\n [libfvalue_value_clone],\n [libfvalue_value_clear],\n [libfvalue_value_get_type],\n [libfvalue_value_get_identifier],\n [libfvalue_value_set_identifier],\n [libfvalue_value_get_data_handle],\n [libfvalue_value_has_data],\n [libfvalue_value_get_data_size],\n [libfvalue_value_get_data],\n [libfvalue_value_set_data],\n [libfvalue_value_copy_data],\n [libfvalue_value_get_format_flags],\n [libfvalue_value_set_format_flags],\n [libfvalue_value_get_number_of_value_entries],\n [libfvalue_value_get_value_entry],\n [libfvalue_value_set_value_entry],\n [libfvalue_value_append_value_entry],\n [libfvalue_value_copy_from_boolean],\n [libfvalue_value_copy_to_boolean],\n [libfvalue_value_copy_from_8bit],\n [libfvalue_value_copy_to_8bit],\n [libfvalue_value_copy_from_16bit],\n [libfvalue_value_copy_to_16bit],\n [libfvalue_value_copy_from_32bit],\n [libfvalue_value_copy_to_32bit],\n [libfvalue_value_copy_from_64bit],\n [libfvalue_value_copy_to_64bit],\n [libfvalue_value_copy_from_float],\n [libfvalue_value_copy_to_float],\n [libfvalue_value_copy_from_double],\n [libfvalue_value_copy_to_double],\n [libfvalue_value_copy_from_utf8_string],\n [libfvalue_value_get_utf8_string_size],\n [libfvalue_value_copy_to_utf8_string],\n [libfvalue_value_copy_to_utf8_string_with_index],\n [libfvalue_value_copy_from_utf16_string],\n [libfvalue_value_get_utf16_string_size],\n [libfvalue_value_copy_to_utf16_string],\n [libfvalue_value_copy_to_utf16_string_with_index],\n [libfvalue_value_copy_from_utf32_string],\n [libfvalue_value_get_utf32_string_size],\n [libfvalue_value_copy_to_utf32_string],\n [libfvalue_value_copy_to_utf32_string_with_index],\n [libfvalue_value_read_from_file_stream],\n [libfvalue_value_write_to_file_stream],\n [libfvalue_value_type_initialize],\n [libfvalue_value_type_initialize_with_data_handle],\n [libfvalue_value_type_set_data_string],\n [libfvalue_value_type_append_data_string],\n [libfvalue_value_type_set_data_strings_array]])\n\n ac_cv_libfvalue_LIBADD=\"-lfvalue\"])\n ])\n\n AX_CHECK_LIB_DIRECTORY_MSG_ON_FAILURE([libfvalue])\n ])\n\n AS_IF(\n [test \"x$ac_cv_libfvalue\" = xyes],\n [AC_DEFINE(\n [HAVE_LIBFVALUE],\n [1],\n [Define to 1 if you have the `fvalue' library (-lfvalue).])\n ])\n\n AS_IF(\n [test \"x$ac_cv_libfvalue\" = xyes],\n [AC_SUBST(\n [HAVE_LIBFVALUE],\n [1]) ],\n [AC_SUBST(\n [HAVE_LIBFVALUE],\n [0])\n ])\n ])\n\ndnl Function to detect if libfvalue dependencies are available\nAC_DEFUN([AX_LIBFVALUE_CHECK_LOCAL],\n [dnl No additional checks.\n\n ac_cv_libfvalue_CPPFLAGS=\"-I../libfvalue -I\\$(top_srcdir)/libfvalue\";\n ac_cv_libfvalue_LIBADD=\"../libfvalue/libfvalue.la\";\n\n ac_cv_libfvalue=local\n ])\n\ndnl Function to detect how to enable libfvalue\nAC_DEFUN([AX_LIBFVALUE_CHECK_ENABLE],\n [AX_COMMON_ARG_WITH(\n [libfvalue],\n [libfvalue],\n [search for libfvalue in includedir and libdir or in the specified DIR, or no if to use local version],\n [auto-detect],\n [DIR])\n\n dnl Check for a shared library version\n AX_LIBFVALUE_CHECK_LIB\n\n dnl Check if the dependencies for the local library version\n AS_IF(\n [test \"x$ac_cv_libfvalue\" != xyes],\n [AX_LIBFVALUE_CHECK_LOCAL\n\n AC_DEFINE(\n [HAVE_LOCAL_LIBFVALUE],\n [1],\n [Define to 1 if the local version of libfvalue is used.])\n AC_SUBST(\n [HAVE_LOCAL_LIBFVALUE],\n [1])\n ])\n\n AM_CONDITIONAL(\n [HAVE_LOCAL_LIBFVALUE],\n [test \"x$ac_cv_libfvalue\" = xlocal])\n AS_IF(\n [test \"x$ac_cv_libfvalue_CPPFLAGS\" != \"x\"],\n [AC_SUBST(\n [LIBFVALUE_CPPFLAGS],\n [$ac_cv_libfvalue_CPPFLAGS])\n ])\n AS_IF(\n [test \"x$ac_cv_libfvalue_LIBADD\" != \"x\"],\n [AC_SUBST(\n [LIBFVALUE_LIBADD],\n [$ac_cv_libfvalue_LIBADD])\n ])\n\n AS_IF(\n [test \"x$ac_cv_libfvalue\" = xyes],\n [AC_SUBST(\n [ax_libfvalue_pc_libs_private],\n [-lfvalue])\n ])\n\n AS_IF(\n [test \"x$ac_cv_libfvalue\" = xyes],\n [AC_SUBST(\n [ax_libfvalue_spec_requires],\n [libfvalue])\n AC_SUBST(\n [ax_libfvalue_spec_build_requires],\n [libfvalue-devel])\n ])\n ])\n\n" }, { "path": "m4/libfwevt.m4", "content": "dnl Checks for libfwevt required headers and functions\ndnl\ndnl Version: 20240501\n\ndnl Function to detect if libfwevt is available\ndnl ac_libfwevt_dummy is used to prevent AC_CHECK_LIB adding unnecessary -l arguments\nAC_DEFUN([AX_LIBFWEVT_CHECK_LIB],\n [AS_IF(\n [test \"x$ac_cv_enable_shared_libs\" = xno || test \"x$ac_cv_with_libfwevt\" = xno],\n [ac_cv_libfwevt=no],\n [ac_cv_libfwevt=check\n dnl Check if the directory provided as parameter exists\n dnl For both --with-libfwevt which returns \"yes\" and --with-libfwevt= which returns \"\"\n dnl treat them as auto-detection.\n AS_IF(\n [test \"x$ac_cv_with_libfwevt\" != x && test \"x$ac_cv_with_libfwevt\" != xauto-detect && test \"x$ac_cv_with_libfwevt\" != xyes],\n [AS_IF(\n [test -d \"$ac_cv_with_libfwevt\"],\n [CFLAGS=\"$CFLAGS -I${ac_cv_with_libfwevt}/include\"\n LDFLAGS=\"$LDFLAGS -L${ac_cv_with_libfwevt}/lib\"],\n [AC_MSG_FAILURE(\n [no such directory: $ac_cv_with_libfwevt],\n [1])\n ])\n ],\n [dnl Check for a pkg-config file\n AS_IF(\n [test \"x$cross_compiling\" != \"xyes\" && test \"x$PKGCONFIG\" != \"x\"],\n [PKG_CHECK_MODULES(\n [libfwevt],\n [libfwevt >= 20240501],\n [ac_cv_libfwevt=yes],\n [ac_cv_libfwevt=check])\n ])\n AS_IF(\n [test \"x$ac_cv_libfwevt\" = xyes],\n [ac_cv_libfwevt_CPPFLAGS=\"$pkg_cv_libfwevt_CFLAGS\"\n ac_cv_libfwevt_LIBADD=\"$pkg_cv_libfwevt_LIBS\"])\n ])\n\n AS_IF(\n [test \"x$ac_cv_libfwevt\" = xcheck],\n [dnl Check for headers\n AC_CHECK_HEADERS([libfwevt.h])\n\n AS_IF(\n [test \"x$ac_cv_header_libfwevt_h\" = xno],\n [ac_cv_libfwevt=no],\n [dnl Check for the individual functions\n ac_cv_libfwevt=yes\n\n AC_CHECK_LIB(\n fwevt,\n libfwevt_get_version,\n [ac_cv_libfwevt_dummy=yes],\n [ac_cv_libfwevt=no])\n\n dnl Channel functions\n AC_CHECK_LIB(\n fwevt,\n libfwevt_channel_initialize,\n [ac_cv_libfwevt_dummy=yes],\n [ac_cv_libfwevt=no])\n AC_CHECK_LIB(\n fwevt,\n libfwevt_channel_free,\n [ac_cv_libfwevt_dummy=yes],\n [ac_cv_libfwevt=no])\n AC_CHECK_LIB(\n fwevt,\n libfwevt_channel_read,\n [ac_cv_libfwevt_dummy=yes],\n [ac_cv_libfwevt=no])\n\n dnl Event functions\n AC_CHECK_LIB(\n fwevt,\n libfwevt_event_initialize,\n [ac_cv_libfwevt_dummy=yes],\n [ac_cv_libfwevt=no])\n AC_CHECK_LIB(\n fwevt,\n libfwevt_event_free,\n [ac_cv_libfwevt_dummy=yes],\n [ac_cv_libfwevt=no])\n AC_CHECK_LIB(\n fwevt,\n libfwevt_event_read,\n [ac_cv_libfwevt_dummy=yes],\n [ac_cv_libfwevt=no])\n AC_CHECK_LIB(\n fwevt,\n libfwevt_event_get_identifier,\n [ac_cv_libfwevt_dummy=yes],\n [ac_cv_libfwevt=no])\n AC_CHECK_LIB(\n fwevt,\n libfwevt_event_get_message_identifier,\n [ac_cv_libfwevt_dummy=yes],\n [ac_cv_libfwevt=no])\n AC_CHECK_LIB(\n fwevt,\n libfwevt_event_get_template_offset,\n [ac_cv_libfwevt_dummy=yes],\n [ac_cv_libfwevt=no])\n\n dnl Keyword functions\n AC_CHECK_LIB(\n fwevt,\n libfwevt_keyword_initialize,\n [ac_cv_libfwevt_dummy=yes],\n [ac_cv_libfwevt=no])\n AC_CHECK_LIB(\n fwevt,\n libfwevt_keyword_free,\n [ac_cv_libfwevt_dummy=yes],\n [ac_cv_libfwevt=no])\n AC_CHECK_LIB(\n fwevt,\n libfwevt_keyword_read,\n [ac_cv_libfwevt_dummy=yes],\n [ac_cv_libfwevt=no])\n\n dnl Level functions\n AC_CHECK_LIB(\n fwevt,\n libfwevt_level_initialize,\n [ac_cv_libfwevt_dummy=yes],\n [ac_cv_libfwevt=no])\n AC_CHECK_LIB(\n fwevt,\n libfwevt_level_free,\n [ac_cv_libfwevt_dummy=yes],\n [ac_cv_libfwevt=no])\n AC_CHECK_LIB(\n fwevt,\n libfwevt_level_read,\n [ac_cv_libfwevt_dummy=yes],\n [ac_cv_libfwevt=no])\n\n dnl Manifest functions\n AC_CHECK_LIB(\n fwevt,\n libfwevt_manifest_initialize,\n [ac_cv_libfwevt_dummy=yes],\n [ac_cv_libfwevt=no])\n AC_CHECK_LIB(\n fwevt,\n libfwevt_manifest_free,\n [ac_cv_libfwevt_dummy=yes],\n [ac_cv_libfwevt=no])\n AC_CHECK_LIB(\n fwevt,\n libfwevt_manifest_read,\n [ac_cv_libfwevt_dummy=yes],\n [ac_cv_libfwevt=no])\n AC_CHECK_LIB(\n fwevt,\n libfwevt_manifest_get_number_of_providers,\n [ac_cv_libfwevt_dummy=yes],\n [ac_cv_libfwevt=no])\n AC_CHECK_LIB(\n fwevt,\n libfwevt_manifest_get_provider_by_index,\n [ac_cv_libfwevt_dummy=yes],\n [ac_cv_libfwevt=no])\n AC_CHECK_LIB(\n fwevt,\n libfwevt_manifest_get_provider_by_identifier,\n [ac_cv_libfwevt_dummy=yes],\n [ac_cv_libfwevt=no])\n\n dnl Map functions\n AC_CHECK_LIB(\n fwevt,\n libfwevt_map_initialize,\n [ac_cv_libfwevt_dummy=yes],\n [ac_cv_libfwevt=no])\n AC_CHECK_LIB(\n fwevt,\n libfwevt_map_free,\n [ac_cv_libfwevt_dummy=yes],\n [ac_cv_libfwevt=no])\n AC_CHECK_LIB(\n fwevt,\n libfwevt_map_read,\n [ac_cv_libfwevt_dummy=yes],\n [ac_cv_libfwevt=no])\n\n dnl Opcode functions\n AC_CHECK_LIB(\n fwevt,\n libfwevt_opcode_initialize,\n [ac_cv_libfwevt_dummy=yes],\n [ac_cv_libfwevt=no])\n AC_CHECK_LIB(\n fwevt,\n libfwevt_opcode_free,\n [ac_cv_libfwevt_dummy=yes],\n [ac_cv_libfwevt=no])\n AC_CHECK_LIB(\n fwevt,\n libfwevt_opcode_read,\n [ac_cv_libfwevt_dummy=yes],\n [ac_cv_libfwevt=no])\n\n dnl Provider functions\n AC_CHECK_LIB(\n fwevt,\n libfwevt_provider_initialize,\n [ac_cv_libfwevt_dummy=yes],\n [ac_cv_libfwevt=no])\n AC_CHECK_LIB(\n fwevt,\n libfwevt_provider_free,\n [ac_cv_libfwevt_dummy=yes],\n [ac_cv_libfwevt=no])\n AC_CHECK_LIB(\n fwevt,\n libfwevt_provider_read,\n [ac_cv_libfwevt_dummy=yes],\n [ac_cv_libfwevt=no])\n AC_CHECK_LIB(\n fwevt,\n libfwevt_provider_read_channels,\n [ac_cv_libfwevt_dummy=yes],\n [ac_cv_libfwevt=no])\n AC_CHECK_LIB(\n fwevt,\n libfwevt_provider_read_events,\n [ac_cv_libfwevt_dummy=yes],\n [ac_cv_libfwevt=no])\n AC_CHECK_LIB(\n fwevt,\n libfwevt_provider_read_keywords,\n [ac_cv_libfwevt_dummy=yes],\n [ac_cv_libfwevt=no])\n AC_CHECK_LIB(\n fwevt,\n libfwevt_provider_read_levels,\n [ac_cv_libfwevt_dummy=yes],\n [ac_cv_libfwevt=no])\n AC_CHECK_LIB(\n fwevt,\n libfwevt_provider_read_maps,\n [ac_cv_libfwevt_dummy=yes],\n [ac_cv_libfwevt=no])\n AC_CHECK_LIB(\n fwevt,\n libfwevt_provider_read_opcodes,\n [ac_cv_libfwevt_dummy=yes],\n [ac_cv_libfwevt=no])\n AC_CHECK_LIB(\n fwevt,\n libfwevt_provider_read_tasks,\n [ac_cv_libfwevt_dummy=yes],\n [ac_cv_libfwevt=no])\n AC_CHECK_LIB(\n fwevt,\n libfwevt_provider_read_templates,\n [ac_cv_libfwevt_dummy=yes],\n [ac_cv_libfwevt=no])\n AC_CHECK_LIB(\n fwevt,\n libfwevt_provider_compare_identifier,\n [ac_cv_libfwevt_dummy=yes],\n [ac_cv_libfwevt=no])\n AC_CHECK_LIB(\n fwevt,\n libfwevt_provider_get_number_of_channels,\n [ac_cv_libfwevt_dummy=yes],\n [ac_cv_libfwevt=no])\n AC_CHECK_LIB(\n fwevt,\n libfwevt_provider_get_channel,\n [ac_cv_libfwevt_dummy=yes],\n [ac_cv_libfwevt=no])\n AC_CHECK_LIB(\n fwevt,\n libfwevt_provider_get_number_of_events,\n [ac_cv_libfwevt_dummy=yes],\n [ac_cv_libfwevt=no])\n AC_CHECK_LIB(\n fwevt,\n libfwevt_provider_get_event,\n [ac_cv_libfwevt_dummy=yes],\n [ac_cv_libfwevt=no])\n AC_CHECK_LIB(\n fwevt,\n libfwevt_provider_get_event_by_identifier,\n [ac_cv_libfwevt_dummy=yes],\n [ac_cv_libfwevt=no])\n AC_CHECK_LIB(\n fwevt,\n libfwevt_provider_get_number_of_keywords,\n [ac_cv_libfwevt_dummy=yes],\n [ac_cv_libfwevt=no])\n AC_CHECK_LIB(\n fwevt,\n libfwevt_provider_get_keyword,\n [ac_cv_libfwevt_dummy=yes],\n [ac_cv_libfwevt=no])\n AC_CHECK_LIB(\n fwevt,\n libfwevt_provider_get_number_of_levels,\n [ac_cv_libfwevt_dummy=yes],\n [ac_cv_libfwevt=no])\n AC_CHECK_LIB(\n fwevt,\n libfwevt_provider_get_level,\n [ac_cv_libfwevt_dummy=yes],\n [ac_cv_libfwevt=no])\n AC_CHECK_LIB(\n fwevt,\n libfwevt_provider_get_number_of_maps,\n [ac_cv_libfwevt_dummy=yes],\n [ac_cv_libfwevt=no])\n AC_CHECK_LIB(\n fwevt,\n libfwevt_provider_get_map,\n [ac_cv_libfwevt_dummy=yes],\n [ac_cv_libfwevt=no])\n AC_CHECK_LIB(\n fwevt,\n libfwevt_provider_get_number_of_opcodes,\n [ac_cv_libfwevt_dummy=yes],\n [ac_cv_libfwevt=no])\n AC_CHECK_LIB(\n fwevt,\n libfwevt_provider_get_opcode,\n [ac_cv_libfwevt_dummy=yes],\n [ac_cv_libfwevt=no])\n AC_CHECK_LIB(\n fwevt,\n libfwevt_provider_get_number_of_tasks,\n [ac_cv_libfwevt_dummy=yes],\n [ac_cv_libfwevt=no])\n AC_CHECK_LIB(\n fwevt,\n libfwevt_provider_get_task,\n [ac_cv_libfwevt_dummy=yes],\n [ac_cv_libfwevt=no])\n AC_CHECK_LIB(\n fwevt,\n libfwevt_provider_get_number_of_templates,\n [ac_cv_libfwevt_dummy=yes],\n [ac_cv_libfwevt=no])\n AC_CHECK_LIB(\n fwevt,\n libfwevt_provider_get_template,\n [ac_cv_libfwevt_dummy=yes],\n [ac_cv_libfwevt=no])\n AC_CHECK_LIB(\n fwevt,\n libfwevt_provider_get_template_by_offset,\n [ac_cv_libfwevt_dummy=yes],\n [ac_cv_libfwevt=no])\n\n dnl Task functions\n AC_CHECK_LIB(\n fwevt,\n libfwevt_task_initialize,\n [ac_cv_libfwevt_dummy=yes],\n [ac_cv_libfwevt=no])\n AC_CHECK_LIB(\n fwevt,\n libfwevt_task_free,\n [ac_cv_libfwevt_dummy=yes],\n [ac_cv_libfwevt=no])\n AC_CHECK_LIB(\n fwevt,\n libfwevt_task_read,\n [ac_cv_libfwevt_dummy=yes],\n [ac_cv_libfwevt=no])\n\n dnl Template functions\n AC_CHECK_LIB(\n fwevt,\n libfwevt_template_initialize,\n [ac_cv_libfwevt_dummy=yes],\n [ac_cv_libfwevt=no])\n AC_CHECK_LIB(\n fwevt,\n libfwevt_template_free,\n [ac_cv_libfwevt_dummy=yes],\n [ac_cv_libfwevt=no])\n AC_CHECK_LIB(\n fwevt,\n libfwevt_template_read,\n [ac_cv_libfwevt_dummy=yes],\n [ac_cv_libfwevt=no])\n AC_CHECK_LIB(\n fwevt,\n libfwevt_template_read_xml_document,\n [ac_cv_libfwevt_dummy=yes],\n [ac_cv_libfwevt=no])\n AC_CHECK_LIB(\n fwevt,\n libfwevt_template_set_ascii_codepage,\n [ac_cv_libfwevt_dummy=yes],\n [ac_cv_libfwevt=no])\n AC_CHECK_LIB(\n fwevt,\n libfwevt_template_get_data,\n [ac_cv_libfwevt_dummy=yes],\n [ac_cv_libfwevt=no])\n AC_CHECK_LIB(\n fwevt,\n libfwevt_template_set_data\n [ac_cv_libfwevt_dummy=yes],\n [ac_cv_libfwevt=no])\n AC_CHECK_LIB(\n fwevt,\n libfwevt_template_get_offset\n [ac_cv_libfwevt_dummy=yes],\n [ac_cv_libfwevt=no])\n AC_CHECK_LIB(\n fwevt,\n libfwevt_template_set_offset\n [ac_cv_libfwevt_dummy=yes],\n [ac_cv_libfwevt=no])\n AC_CHECK_LIB(\n fwevt,\n libfwevt_template_get_size\n [ac_cv_libfwevt_dummy=yes],\n [ac_cv_libfwevt=no])\n\n dnl XML document functions\n AC_CHECK_LIB(\n fwevt,\n libfwevt_xml_document_initialize,\n [ac_cv_libfwevt_dummy=yes],\n [ac_cv_libfwevt=no])\n AC_CHECK_LIB(\n fwevt,\n libfwevt_xml_document_free,\n [ac_cv_libfwevt_dummy=yes],\n [ac_cv_libfwevt=no])\n AC_CHECK_LIB(\n fwevt,\n libfwevt_xml_document_clone,\n [ac_cv_libfwevt_dummy=yes],\n [ac_cv_libfwevt=no])\n AC_CHECK_LIB(\n fwevt,\n libfwevt_xml_document_get_root_xml_tag,\n [ac_cv_libfwevt_dummy=yes],\n [ac_cv_libfwevt=no])\n AC_CHECK_LIB(\n fwevt,\n libfwevt_xml_document_read,\n [ac_cv_libfwevt_dummy=yes],\n [ac_cv_libfwevt=no])\n AC_CHECK_LIB(\n fwevt,\n libfwevt_xml_document_get_utf8_xml_string_size,\n [ac_cv_libfwevt_dummy=yes],\n [ac_cv_libfwevt=no])\n AC_CHECK_LIB(\n fwevt,\n libfwevt_xml_document_get_utf8_xml_string,\n [ac_cv_libfwevt_dummy=yes],\n [ac_cv_libfwevt=no])\n AC_CHECK_LIB(\n fwevt,\n libfwevt_xml_document_get_utf16_xml_string_size,\n [ac_cv_libfwevt_dummy=yes],\n [ac_cv_libfwevt=no])\n AC_CHECK_LIB(\n fwevt,\n libfwevt_xml_document_get_utf16_xml_string,\n [ac_cv_libfwevt_dummy=yes],\n [ac_cv_libfwevt=no])\n\n dnl XML tag functions\n AC_CHECK_LIB(\n fwevt,\n libfwevt_xml_tag_free,\n [ac_cv_libfwevt_dummy=yes],\n [ac_cv_libfwevt=no])\n AC_CHECK_LIB(\n fwevt,\n libfwevt_xml_tag_get_utf8_name_size,\n [ac_cv_libfwevt_dummy=yes],\n [ac_cv_libfwevt=no])\n AC_CHECK_LIB(\n fwevt,\n libfwevt_xml_tag_get_utf8_name,\n [ac_cv_libfwevt_dummy=yes],\n [ac_cv_libfwevt=no])\n AC_CHECK_LIB(\n fwevt,\n libfwevt_xml_tag_get_utf16_name_size,\n [ac_cv_libfwevt_dummy=yes],\n [ac_cv_libfwevt=no])\n AC_CHECK_LIB(\n fwevt,\n libfwevt_xml_tag_get_utf16_name,\n [ac_cv_libfwevt_dummy=yes],\n [ac_cv_libfwevt=no])\n AC_CHECK_LIB(\n fwevt,\n libfwevt_xml_tag_get_value,\n [ac_cv_libfwevt_dummy=yes],\n [ac_cv_libfwevt=no])\n AC_CHECK_LIB(\n fwevt,\n libfwevt_xml_tag_get_number_of_attributes,\n [ac_cv_libfwevt_dummy=yes],\n [ac_cv_libfwevt=no])\n AC_CHECK_LIB(\n fwevt,\n libfwevt_xml_tag_get_attribute_by_index,\n [ac_cv_libfwevt_dummy=yes],\n [ac_cv_libfwevt=no])\n AC_CHECK_LIB(\n fwevt,\n libfwevt_xml_tag_get_attribute_by_utf8_name,\n [ac_cv_libfwevt_dummy=yes],\n [ac_cv_libfwevt=no])\n AC_CHECK_LIB(\n fwevt,\n libfwevt_xml_tag_get_attribute_by_utf16_name,\n [ac_cv_libfwevt_dummy=yes],\n [ac_cv_libfwevt=no])\n AC_CHECK_LIB(\n fwevt,\n libfwevt_xml_tag_get_number_of_elements,\n [ac_cv_libfwevt_dummy=yes],\n [ac_cv_libfwevt=no])\n AC_CHECK_LIB(\n fwevt,\n libfwevt_xml_tag_get_element_by_index,\n [ac_cv_libfwevt_dummy=yes],\n [ac_cv_libfwevt=no])\n AC_CHECK_LIB(\n fwevt,\n libfwevt_xml_tag_get_element_by_utf8_name,\n [ac_cv_libfwevt_dummy=yes],\n [ac_cv_libfwevt=no])\n AC_CHECK_LIB(\n fwevt,\n libfwevt_xml_tag_get_element_by_utf16_name,\n [ac_cv_libfwevt_dummy=yes],\n [ac_cv_libfwevt=no])\n AC_CHECK_LIB(\n fwevt,\n libfwevt_xml_tag_get_flags,\n [ac_cv_libfwevt_dummy=yes],\n [ac_cv_libfwevt=no])\n\n dnl XML value functions\n AC_CHECK_LIB(\n fwevt,\n libfwevt_xml_value_free,\n [ac_cv_libfwevt_dummy=yes],\n [ac_cv_libfwevt=no])\n AC_CHECK_LIB(\n fwevt,\n libfwevt_xml_value_get_data_size,\n [ac_cv_libfwevt_dummy=yes],\n [ac_cv_libfwevt=no])\n AC_CHECK_LIB(\n fwevt,\n libfwevt_xml_value_copy_data,\n [ac_cv_libfwevt_dummy=yes],\n [ac_cv_libfwevt=no])\n AC_CHECK_LIB(\n fwevt,\n libfwevt_value_get_data_as_8bit_integer,\n [ac_cv_libfwevt_dummy=yes],\n [ac_cv_libfwevt=no])\n AC_CHECK_LIB(\n fwevt,\n libfwevt_value_get_data_as_32bit_integer,\n [ac_cv_libfwevt_dummy=yes],\n [ac_cv_libfwevt=no])\n AC_CHECK_LIB(\n fwevt,\n libfwevt_value_get_data_as_64bit_integer,\n [ac_cv_libfwevt_dummy=yes],\n [ac_cv_libfwevt=no])\n AC_CHECK_LIB(\n fwevt,\n libfwevt_value_get_data_as_filetime,\n [ac_cv_libfwevt_dummy=yes],\n [ac_cv_libfwevt=no])\n AC_CHECK_LIB(\n fwevt,\n libfwevt_xml_value_get_utf8_string_size,\n [ac_cv_libfwevt_dummy=yes],\n [ac_cv_libfwevt=no])\n AC_CHECK_LIB(\n fwevt,\n libfwevt_xml_value_copy_to_utf8_string,\n [ac_cv_libfwevt_dummy=yes],\n [ac_cv_libfwevt=no])\n AC_CHECK_LIB(\n fwevt,\n libfwevt_xml_value_get_utf16_string_size,\n [ac_cv_libfwevt_dummy=yes],\n [ac_cv_libfwevt=no])\n AC_CHECK_LIB(\n fwevt,\n libfwevt_xml_value_copy_to_utf16_string,\n [ac_cv_libfwevt_dummy=yes],\n [ac_cv_libfwevt=no])\n\n ac_cv_libfwevt_LIBADD=\"-lfwevt\"])\n ])\n\n AS_IF(\n [test \"x$ac_cv_libfwevt\" != xyes && test \"x$ac_cv_with_libfwevt\" != x && test \"x$ac_cv_with_libfwevt\" != xauto-detect && test \"x$ac_cv_with_libfwevt\" != xyes],\n [AC_MSG_FAILURE(\n [unable to find supported libfwevt in directory: $ac_cv_with_libfwevt],\n [1])\n ])\n ])\n\n AS_IF(\n [test \"x$ac_cv_libfwevt\" = xyes],\n [AC_DEFINE(\n [HAVE_LIBFWEVT],\n [1],\n [Define to 1 if you have the `fwevt' library (-lfwevt).])\n ])\n\n AS_IF(\n [test \"x$ac_cv_libfwevt\" = xyes],\n [AC_SUBST(\n [HAVE_LIBFWEVT],\n [1]) ],\n [AC_SUBST(\n [HAVE_LIBFWEVT],\n [0])\n ])\n ])\n\ndnl Function to detect if libfwevt dependencies are available\nAC_DEFUN([AX_LIBFWEVT_CHECK_LOCAL],\n [dnl No additional checks.\n\n ac_cv_libfwevt_CPPFLAGS=\"-I../libfwevt -I\\$(top_srcdir)/libfwevt\";\n ac_cv_libfwevt_LIBADD=\"../libfwevt/libfwevt.la\";\n\n ac_cv_libfwevt=local\n ])\n\ndnl Function to detect how to enable libfwevt\nAC_DEFUN([AX_LIBFWEVT_CHECK_ENABLE],\n [AX_COMMON_ARG_WITH(\n [libfwevt],\n [libfwevt],\n [search for libfwevt in includedir and libdir or in the specified DIR, or no if to use local version],\n [auto-detect],\n [DIR])\n\n dnl Check for a shared library version\n AX_LIBFWEVT_CHECK_LIB\n\n dnl Check if the dependencies for the local library version\n AS_IF(\n [test \"x$ac_cv_libfwevt\" != xyes],\n [AX_LIBFWEVT_CHECK_LOCAL\n\n AC_DEFINE(\n [HAVE_LOCAL_LIBFWEVT],\n [1],\n [Define to 1 if the local version of libfwevt is used.])\n AC_SUBST(\n [HAVE_LOCAL_LIBFWEVT],\n [1])\n ])\n\n AM_CONDITIONAL(\n [HAVE_LOCAL_LIBFWEVT],\n [test \"x$ac_cv_libfwevt\" = xlocal])\n AS_IF(\n [test \"x$ac_cv_libfwevt_CPPFLAGS\" != \"x\"],\n [AC_SUBST(\n [LIBFWEVT_CPPFLAGS],\n [$ac_cv_libfwevt_CPPFLAGS])\n ])\n AS_IF(\n [test \"x$ac_cv_libfwevt_LIBADD\" != \"x\"],\n [AC_SUBST(\n [LIBFWEVT_LIBADD],\n [$ac_cv_libfwevt_LIBADD])\n ])\n\n AS_IF(\n [test \"x$ac_cv_libfwevt\" = xyes],\n [AC_SUBST(\n [ax_libfwevt_pc_libs_private],\n [-lfwevt])\n ])\n\n AS_IF(\n [test \"x$ac_cv_libfwevt\" = xyes],\n [AC_SUBST(\n [ax_libfwevt_spec_requires],\n [libfwevt])\n AC_SUBST(\n [ax_libfwevt_spec_build_requires],\n [libfwevt-devel])\n ])\n ])\n\n" }, { "path": "m4/libfwnt.m4", "content": "dnl Checks for libfwnt required headers and functions\ndnl\ndnl Version: 20240519\n\ndnl Function to detect if libfwnt is available\ndnl ac_libfwnt_dummy is used to prevent AC_CHECK_LIB adding unnecessary -l arguments\nAC_DEFUN([AX_LIBFWNT_CHECK_LIB],\n [AS_IF(\n [test \"x$ac_cv_enable_shared_libs\" = xno || test \"x$ac_cv_with_libfwnt\" = xno],\n [ac_cv_libfwnt=no],\n [ac_cv_libfwnt=check\n dnl Check if the directory provided as parameter exists\n dnl For both --with-libfwnt which returns \"yes\" and --with-libfwnt= which returns \"\"\n dnl treat them as auto-detection.\n AS_IF(\n [test \"x$ac_cv_with_libfwnt\" != x && test \"x$ac_cv_with_libfwnt\" != xauto-detect && test \"x$ac_cv_with_libfwnt\" != xyes],\n [AX_CHECK_LIB_DIRECTORY_EXISTS([libfwnt])],\n [dnl Check for a pkg-config file\n AS_IF(\n [test \"x$cross_compiling\" != \"xyes\" && test \"x$PKGCONFIG\" != \"x\"],\n [PKG_CHECK_MODULES(\n [libfwnt],\n [libfwnt >= 20191217],\n [ac_cv_libfwnt=yes],\n [ac_cv_libfwnt=check])\n ])\n AS_IF(\n [test \"x$ac_cv_libfwnt\" = xyes],\n [ac_cv_libfwnt_CPPFLAGS=\"$pkg_cv_libfwnt_CFLAGS\"\n ac_cv_libfwnt_LIBADD=\"$pkg_cv_libfwnt_LIBS\"])\n ])\n\n AS_IF(\n [test \"x$ac_cv_libfwnt\" = xcheck],\n [dnl Check for headers\n AC_CHECK_HEADERS([libfwnt.h])\n\n AS_IF(\n [test \"x$ac_cv_header_libfwnt_h\" = xno],\n [ac_cv_libfwnt=no],\n [ac_cv_libfwnt=yes\n\n AX_CHECK_LIB_FUNCTIONS(\n [libfwnt],\n [fwnt],\n [[libfwnt_get_version],\n [libfwnt_array_initialize],\n [libfwnt_security_descriptor_initialize],\n [libfwnt_security_descriptor_free],\n [libfwnt_security_descriptor_copy_from_byte_stream],\n [libfwnt_security_descriptor_get_owner],\n [libfwnt_security_descriptor_get_group],\n [libfwnt_security_descriptor_get_discretionary_acl],\n [libfwnt_security_descriptor_get_system_acl],\n [libfwnt_security_identifier_initialize],\n [libfwnt_security_identifier_free],\n [libfwnt_security_identifier_copy_from_byte_stream],\n [libfwnt_security_identifier_get_string_size],\n [libfwnt_security_identifier_copy_to_utf8_string],\n [libfwnt_security_identifier_copy_to_utf8_string_with_index],\n [libfwnt_security_identifier_copy_to_utf16_string],\n [libfwnt_security_identifier_copy_to_utf16_string_with_index],\n [libfwnt_security_identifier_copy_to_utf32_string],\n [libfwnt_security_identifier_copy_to_utf32_string_with_index],\n [libfwnt_access_control_list_free],\n [libfwnt_access_control_list_get_number_of_entries],\n [libfwnt_access_control_list_get_entry_by_index],\n [libfwnt_access_control_entry_free],\n [libfwnt_access_control_entry_get_type],\n [libfwnt_access_control_entry_get_flags],\n [libfwnt_access_control_entry_get_access_mask],\n [libfwnt_access_control_entry_get_security_identifier],\n [libfwnt_lznt1_decompress],\n [libfwnt_lzx_decompress],\n [libfwnt_lzxpress_decompress],\n [libfwnt_lzxpress_huffman_decompress]])\n\n ac_cv_libfwnt_LIBADD=\"-lfwnt\"])\n ])\n\n AX_CHECK_LIB_DIRECTORY_MSG_ON_FAILURE([libfwnt])\n ])\n\n AS_IF(\n [test \"x$ac_cv_libfwnt\" = xyes],\n [AC_DEFINE(\n [HAVE_LIBFWNT],\n [1],\n [Define to 1 if you have the `fwnt' library (-lfwnt).])\n ])\n\n AS_IF(\n [test \"x$ac_cv_libfwnt\" = xyes],\n [AC_SUBST(\n [HAVE_LIBFWNT],\n [1]) ],\n [AC_SUBST(\n [HAVE_LIBFWNT],\n [0])\n ])\n ])\n\ndnl Function to detect if libfwnt dependencies are available\nAC_DEFUN([AX_LIBFWNT_CHECK_LOCAL],\n [dnl No additional checks.\n\n ac_cv_libfwnt_CPPFLAGS=\"-I../libfwnt -I\\$(top_srcdir)/libfwnt\";\n ac_cv_libfwnt_LIBADD=\"../libfwnt/libfwnt.la\";\n\n ac_cv_libfwnt=local\n ])\n\ndnl Function to detect how to enable libfwnt\nAC_DEFUN([AX_LIBFWNT_CHECK_ENABLE],\n [AX_COMMON_ARG_WITH(\n [libfwnt],\n [libfwnt],\n [search for libfwnt in includedir and libdir or in the specified DIR, or no if to use local version],\n [auto-detect],\n [DIR])\n\n dnl Check for a shared library version\n AX_LIBFWNT_CHECK_LIB\n\n dnl Check if the dependencies for the local library version\n AS_IF(\n [test \"x$ac_cv_libfwnt\" != xyes],\n [AX_LIBFWNT_CHECK_LOCAL\n\n AC_DEFINE(\n [HAVE_LOCAL_LIBFWNT],\n [1],\n [Define to 1 if the local version of libfwnt is used.])\n AC_SUBST(\n [HAVE_LOCAL_LIBFWNT],\n [1])\n ])\n\n AM_CONDITIONAL(\n [HAVE_LOCAL_LIBFWNT],\n [test \"x$ac_cv_libfwnt\" = xlocal])\n AS_IF(\n [test \"x$ac_cv_libfwnt_CPPFLAGS\" != \"x\"],\n [AC_SUBST(\n [LIBFWNT_CPPFLAGS],\n [$ac_cv_libfwnt_CPPFLAGS])\n ])\n AS_IF(\n [test \"x$ac_cv_libfwnt_LIBADD\" != \"x\"],\n [AC_SUBST(\n [LIBFWNT_LIBADD],\n [$ac_cv_libfwnt_LIBADD])\n ])\n\n AS_IF(\n [test \"x$ac_cv_libfwnt\" = xyes],\n [AC_SUBST(\n [ax_libfwnt_pc_libs_private],\n [-lfwnt])\n ])\n\n AS_IF(\n [test \"x$ac_cv_libfwnt\" = xyes],\n [AC_SUBST(\n [ax_libfwnt_spec_requires],\n [libfwnt])\n AC_SUBST(\n [ax_libfwnt_spec_build_requires],\n [libfwnt-devel])\n ])\n ])\n\n" }, { "path": "m4/libregf.m4", "content": "dnl Checks for libregf required headers and functions\ndnl\ndnl Version: 20240601\n\ndnl Function to detect if libregf is available\ndnl ac_libregf_dummy is used to prevent AC_CHECK_LIB adding unnecessary -l arguments\nAC_DEFUN([AX_LIBREGF_CHECK_LIB],\n [AS_IF(\n [test \"x$ac_cv_enable_shared_libs\" = xno || test \"x$ac_cv_with_libregf\" = xno],\n [ac_cv_libregf=no],\n [ac_cv_libregf=check\n dnl Check if the directory provided as parameter exists\n dnl For both --with-libregf which returns \"yes\" and --with-libregf= which returns \"\"\n dnl treat them as auto-detection.\n AS_IF(\n [test \"x$ac_cv_with_libregf\" != x && test \"x$ac_cv_with_libregf\" != xauto-detect && test \"x$ac_cv_with_libregf\" != xyes],\n [AX_CHECK_LIB_DIRECTORY_EXISTS([libregf])],\n [dnl Check for a pkg-config file\n AS_IF(\n [test \"x$cross_compiling\" != \"xyes\" && test \"x$PKGCONFIG\" != \"x\"],\n [PKG_CHECK_MODULES(\n [libregf],\n [libregf >= 20120405],\n [ac_cv_libregf=yes],\n [ac_cv_libregf=check])\n ])\n AS_IF(\n [test \"x$ac_cv_libregf\" = xyes],\n [ac_cv_libregf_CPPFLAGS=\"$pkg_cv_libregf_CFLAGS\"\n ac_cv_libregf_LIBADD=\"$pkg_cv_libregf_LIBS\"])\n ])\n\n AS_IF(\n [test \"x$ac_cv_libregf\" = xcheck],\n [dnl Check for headers\n AC_CHECK_HEADERS([libregf.h])\n\n AS_IF(\n [test \"x$ac_cv_header_libregf_h\" = xno],\n [ac_cv_libregf=no],\n [ac_cv_libregf=yes\n\n AX_CHECK_LIB_FUNCTIONS(\n [libregf],\n [regf],\n [[libregf_get_version]])\n\n dnl TODO add functions\n\n ac_cv_libregf_LIBADD=\"-lregf\"])\n ])\n\n AX_CHECK_LIB_DIRECTORY_MSG_ON_FAILURE([libregf])\n ])\n\n AS_IF(\n [test \"x$ac_cv_libregf\" = xyes],\n [AC_DEFINE(\n [HAVE_LIBREGF],\n [1],\n [Define to 1 if you have the `regf' library (-lregf).])\n ])\n\n AS_IF(\n [test \"x$ac_cv_libregf\" = xyes],\n [AC_SUBST(\n [HAVE_LIBREGF],\n [1]) ],\n [AC_SUBST(\n [HAVE_LIBREGF],\n [0])\n ])\n ])\n\ndnl Function to detect if libregf dependencies are available\nAC_DEFUN([AX_LIBREGF_CHECK_LOCAL],\n [dnl Headers included in libregf/libregf_file.h, libregf/libregf_key.h\n dnl libregf/libregf_key_item_values.h and libregf/libregf_value_item_values.h\n AC_CHECK_HEADERS([wctype.h])\n\n dnl Functions used in libregf/libregf_file.h, libregf/libregf_key.h\n dnl libregf/libregf_key_item_values.h and libregf/libregf_value_item_values.h\n AC_CHECK_FUNCS([towupper])\n\n AS_IF(\n [test \"x$ac_cv_func_towupper\" != xyes],\n [AC_MSG_FAILURE(\n [Missing function: towupper],\n [1])\n ])\n\n ac_cv_libregf_CPPFLAGS=\"-I../libregf -I\\$(top_srcdir)/libregf\";\n ac_cv_libregf_LIBADD=\"../libregf/libregf.la\";\n\n ac_cv_libregf=local\n ])\n\ndnl Function to detect how to enable libregf\nAC_DEFUN([AX_LIBREGF_CHECK_ENABLE],\n [AX_COMMON_ARG_WITH(\n [libregf],\n [libregf],\n [search for libregf in includedir and libdir or in the specified DIR, or no if to use local version],\n [auto-detect],\n [DIR])\n\n dnl Check for a shared library version\n AX_LIBREGF_CHECK_LIB\n\n dnl Check if the dependencies for the local library version\n AS_IF(\n [test \"x$ac_cv_libregf\" != xyes],\n [AX_LIBREGF_CHECK_LOCAL\n\n AC_DEFINE(\n [HAVE_LOCAL_LIBREGF],\n [1],\n [Define to 1 if the local version of libregf is used.])\n AC_SUBST(\n [HAVE_LOCAL_LIBREGF],\n [1])\n ])\n\n AM_CONDITIONAL(\n [HAVE_LOCAL_LIBREGF],\n [test \"x$ac_cv_libregf\" = xlocal])\n AS_IF(\n [test \"x$ac_cv_libregf_CPPFLAGS\" != \"x\"],\n [AC_SUBST(\n [LIBREGF_CPPFLAGS],\n [$ac_cv_libregf_CPPFLAGS])\n ])\n AS_IF(\n [test \"x$ac_cv_libregf_LIBADD\" != \"x\"],\n [AC_SUBST(\n [LIBREGF_LIBADD],\n [$ac_cv_libregf_LIBADD])\n ])\n\n AS_IF(\n [test \"x$ac_cv_libregf\" = xyes],\n [AC_SUBST(\n [ax_libregf_pc_libs_private],\n [-lregf])\n ])\n\n AS_IF(\n [test \"x$ac_cv_libregf\" = xyes],\n [AC_SUBST(\n [ax_libregf_spec_requires],\n [libregf])\n AC_SUBST(\n [ax_libregf_spec_build_requires],\n [libregf-devel])\n ])\n ])\n" }, { "path": "m4/libuna.m4", "content": "dnl Checks for libuna or required headers and functions\ndnl\ndnl Version: 20240513\n\ndnl Function to detect if libuna is available\ndnl ac_libuna_dummy is used to prevent AC_CHECK_LIB adding unnecessary -l arguments\nAC_DEFUN([AX_LIBUNA_CHECK_LIB],\n [AS_IF(\n [test \"x$ac_cv_enable_shared_libs\" = xno || test \"x$ac_cv_with_libuna\" = xno],\n [ac_cv_libuna=no],\n [ac_cv_libuna=check\n dnl Check if the directory provided as parameter exists\n dnl For both --with-libuna which returns \"yes\" and --with-libuna= which returns \"\"\n dnl treat them as auto-detection.\n AS_IF(\n [test \"x$ac_cv_with_libuna\" != x && test \"x$ac_cv_with_libuna\" != xauto-detect && test \"x$ac_cv_with_libuna\" != xyes],\n [AX_CHECK_LIB_DIRECTORY_EXISTS([libuna])],\n [dnl Check for a pkg-config file\n AS_IF(\n [test \"x$cross_compiling\" != \"xyes\" && test \"x$PKGCONFIG\" != \"x\"],\n [PKG_CHECK_MODULES(\n [libuna],\n [libuna >= 20230702],\n [ac_cv_libuna=yes],\n [ac_cv_libuna=check])\n ])\n AS_IF(\n [test \"x$ac_cv_libuna\" = xyes],\n [ac_cv_libuna_CPPFLAGS=\"$pkg_cv_libuna_CFLAGS\"\n ac_cv_libuna_LIBADD=\"$pkg_cv_libuna_LIBS\"])\n ])\n\n AS_IF(\n [test \"x$ac_cv_libuna\" = xcheck],\n [dnl Check for headers\n AC_CHECK_HEADERS([libuna.h])\n\n AS_IF(\n [test \"x$ac_cv_header_libuna_h\" = xno],\n [ac_cv_libuna=no],\n [ac_cv_libuna=yes\n\n AX_CHECK_LIB_FUNCTIONS(\n [libuna],\n [una],\n [[libuna_get_version],\n [libuna_base16_stream_size_to_byte_stream],\n [libuna_base16_stream_copy_to_byte_stream],\n [libuna_base16_stream_size_from_byte_stream],\n [libuna_base16_stream_copy_from_byte_stream],\n [libuna_base16_stream_with_index_copy_from_byte_stream],\n [libuna_base32_quintuplet_copy_from_base32_stream],\n [libuna_base32_quintuplet_copy_to_base32_stream],\n [libuna_base32_quintuplet_copy_from_byte_stream],\n [libuna_base32_quintuplet_copy_to_byte_stream],\n [libuna_base32_stream_size_to_byte_stream],\n [libuna_base32_stream_copy_to_byte_stream],\n [libuna_base32_stream_size_from_byte_stream],\n [libuna_base32_stream_copy_from_byte_stream],\n [libuna_base32_stream_with_index_copy_from_byte_stream],\n [libuna_base64_triplet_copy_from_base64_stream],\n [libuna_base64_triplet_copy_to_base64_stream],\n [libuna_base64_triplet_copy_from_byte_stream],\n [libuna_base64_triplet_copy_to_byte_stream],\n [libuna_base64_stream_size_to_byte_stream],\n [libuna_base64_stream_copy_to_byte_stream],\n [libuna_base64_stream_size_from_byte_stream],\n [libuna_base64_stream_copy_from_byte_stream],\n [libuna_base64_stream_with_index_copy_from_byte_stream],\n [libuna_byte_stream_size_from_utf8],\n [libuna_byte_stream_copy_from_utf8],\n [libuna_byte_stream_size_from_utf16],\n [libuna_byte_stream_copy_from_utf16],\n [libuna_byte_stream_size_from_utf32],\n [libuna_byte_stream_copy_from_utf32],\n [libuna_unicode_character_size_to_byte_stream],\n [libuna_unicode_character_copy_from_byte_stream],\n [libuna_unicode_character_copy_to_byte_stream],\n [libuna_unicode_character_size_to_ucs2],\n [libuna_unicode_character_copy_from_ucs2],\n [libuna_unicode_character_copy_to_ucs2],\n [libuna_unicode_character_size_to_ucs4],\n [libuna_unicode_character_copy_from_ucs4],\n [libuna_unicode_character_copy_to_ucs4],\n [libuna_unicode_character_copy_from_utf7_stream],\n [libuna_unicode_character_copy_to_utf7_stream],\n [libuna_unicode_character_size_to_utf8],\n [libuna_unicode_character_copy_from_utf8],\n [libuna_unicode_character_copy_to_utf8],\n [libuna_unicode_character_size_to_utf8_rfc2279],\n [libuna_unicode_character_copy_from_utf8_rfc2279],\n [libuna_unicode_character_copy_to_utf8_rfc2279],\n [libuna_unicode_character_size_to_utf16],\n [libuna_unicode_character_copy_from_utf16],\n [libuna_unicode_character_copy_to_utf16],\n [libuna_unicode_character_copy_from_utf16_stream],\n [libuna_unicode_character_copy_to_utf16_stream],\n [libuna_unicode_character_copy_from_utf32],\n [libuna_unicode_character_copy_to_utf32],\n [libuna_unicode_character_copy_from_utf32_stream],\n [libuna_unicode_character_copy_to_utf32_stream],\n [libuna_utf8_stream_size_from_utf8],\n [libuna_utf8_stream_copy_from_utf8],\n [libuna_utf8_stream_size_from_utf16],\n [libuna_utf8_stream_copy_from_utf16],\n [libuna_utf8_stream_size_from_utf32],\n [libuna_utf8_stream_copy_from_utf32],\n [libuna_utf16_stream_size_from_utf8],\n [libuna_utf16_stream_copy_from_utf8],\n [libuna_utf16_stream_size_from_utf16],\n [libuna_utf16_stream_copy_from_utf16],\n [libuna_utf16_stream_size_from_utf32],\n [libuna_utf16_stream_copy_from_utf32],\n [libuna_utf32_stream_size_from_utf8],\n [libuna_utf32_stream_copy_from_utf8],\n [libuna_utf32_stream_size_from_utf16],\n [libuna_utf32_stream_copy_from_utf16],\n [libuna_utf32_stream_size_from_utf32],\n [libuna_utf32_stream_copy_from_utf32],\n [libuna_utf8_string_size_from_byte_stream],\n [libuna_utf8_string_copy_from_byte_stream],\n [libuna_utf8_string_with_index_copy_from_byte_stream],\n [libuna_utf8_string_compare_with_byte_stream],\n [libuna_utf8_string_size_from_utf7_stream],\n [libuna_utf8_string_copy_from_utf7_stream],\n [libuna_utf8_string_with_index_copy_from_utf7_stream],\n [libuna_utf8_string_compare_with_utf7_stream],\n [libuna_utf8_string_size_from_utf8_stream],\n [libuna_utf8_string_copy_from_utf8_stream],\n [libuna_utf8_string_with_index_copy_from_utf8_stream],\n [libuna_utf8_string_compare_with_utf8_stream],\n [libuna_utf8_string_size_from_utf16],\n [libuna_utf8_string_copy_from_utf16],\n [libuna_utf8_string_with_index_copy_from_utf16],\n [libuna_utf8_string_compare_with_utf16],\n [libuna_utf8_string_size_from_utf16_stream],\n [libuna_utf8_string_copy_from_utf16_stream],\n [libuna_utf8_string_with_index_copy_from_utf16_stream],\n [libuna_utf8_string_compare_with_utf16_stream],\n [libuna_utf8_string_size_from_utf32],\n [libuna_utf8_string_copy_from_utf32],\n [libuna_utf8_string_with_index_copy_from_utf32],\n [libuna_utf8_string_compare_with_utf32],\n [libuna_utf8_string_size_from_utf32_stream],\n [libuna_utf8_string_copy_from_utf32_stream],\n [libuna_utf8_string_with_index_copy_from_utf32_stream],\n [libuna_utf8_string_compare_with_utf32_stream],\n [libuna_utf8_string_size_from_scsu_stream],\n [libuna_utf8_string_copy_from_scsu_stream],\n [libuna_utf8_string_with_index_copy_from_scsu_stream],\n [libuna_utf16_string_size_from_byte_stream],\n [libuna_utf16_string_copy_from_byte_stream],\n [libuna_utf16_string_with_index_copy_from_byte_stream],\n [libuna_utf16_string_compare_with_byte_stream],\n [libuna_utf16_string_size_from_utf7_stream],\n [libuna_utf16_string_copy_from_utf7_stream],\n [libuna_utf16_string_with_index_copy_from_utf7_stream],\n [libuna_utf16_string_compare_with_utf7_stream],\n [libuna_utf16_string_size_from_utf8],\n [libuna_utf16_string_copy_from_utf8],\n [libuna_utf16_string_with_index_copy_from_utf8],\n [libuna_utf16_string_size_from_utf8_stream],\n [libuna_utf16_string_copy_from_utf8_stream],\n [libuna_utf16_string_with_index_copy_from_utf8_stream],\n [libuna_utf16_string_compare_with_utf8_stream],\n [libuna_utf16_string_size_from_utf16_stream],\n [libuna_utf16_string_copy_from_utf16_stream],\n [libuna_utf16_string_with_index_copy_from_utf16_stream],\n [libuna_utf16_string_compare_with_utf16_stream],\n [libuna_utf16_string_size_from_utf32],\n [libuna_utf16_string_copy_from_utf32],\n [libuna_utf16_string_with_index_copy_from_utf32],\n [libuna_utf16_string_compare_with_utf32],\n [libuna_utf16_string_size_from_utf32_stream],\n [libuna_utf16_string_copy_from_utf32_stream],\n [libuna_utf16_string_with_index_copy_from_utf32_stream],\n [libuna_utf16_string_compare_with_utf32_stream],\n [libuna_utf16_string_size_from_scsu_stream],\n [libuna_utf16_string_copy_from_scsu_stream],\n [libuna_utf16_string_with_index_copy_from_scsu_stream],\n [libuna_utf32_string_size_from_byte_stream],\n [libuna_utf32_string_copy_from_byte_stream],\n [libuna_utf32_string_with_index_copy_from_byte_stream],\n [libuna_utf32_string_compare_with_byte_stream],\n [libuna_utf32_string_size_from_utf7_stream],\n [libuna_utf32_string_copy_from_utf7_stream],\n [libuna_utf32_string_with_index_copy_from_utf7_stream],\n [libuna_utf32_string_compare_with_utf7_stream],\n [libuna_utf32_string_size_from_utf8_stream],\n [libuna_utf32_string_size_from_utf8],\n [libuna_utf32_string_copy_from_utf8],\n [libuna_utf32_string_copy_from_utf8_stream],\n [libuna_utf32_string_with_index_copy_from_utf8_stream],\n [libuna_utf32_string_compare_with_utf8_stream],\n [libuna_utf32_string_size_from_utf16],\n [libuna_utf32_string_copy_from_utf16],\n [libuna_utf32_string_with_index_copy_from_utf16],\n [libuna_utf32_string_size_from_utf16_stream],\n [libuna_utf32_string_copy_from_utf16_stream],\n [libuna_utf32_string_with_index_copy_from_utf16_stream],\n [libuna_utf32_string_compare_with_utf16_stream],\n [libuna_utf32_string_size_from_utf32_stream],\n [libuna_utf32_string_copy_from_utf32_stream],\n [libuna_utf32_string_with_index_copy_from_utf32_stream],\n [libuna_utf32_string_compare_with_utf32_stream],\n [libuna_utf32_string_size_from_scsu_stream],\n [libuna_utf32_string_copy_from_scsu_stream],\n [libuna_utf32_string_with_index_copy_from_scsu_stream]])\n\n AX_CHECK_LIB_DEFINITIONS(\n [libuna],\n [[LIBUNA_COMPARE_LESS],\n [LIBUNA_COMPARE_EQUAL],\n [LIBUNA_COMPARE_GREATER],\n [LIBUNA_UTF16_STREAM_ALLOW_UNPAIRED_SURROGATE]])\n\n ac_cv_libuna_LIBADD=\"-luna\"])\n ])\n\n AX_CHECK_LIB_DIRECTORY_MSG_ON_FAILURE([libuna])\n ])\n\n AS_IF(\n [test \"x$ac_cv_libuna\" = xyes],\n [AC_DEFINE(\n [HAVE_LIBUNA],\n [1],\n [Define to 1 if you have the `una' library (-luna).])\n ])\n\n AS_IF(\n [test \"x$ac_cv_libuna\" = xyes],\n [AC_SUBST(\n [HAVE_LIBUNA],\n [1]) ],\n [AC_SUBST(\n [HAVE_LIBUNA],\n [0])\n ])\n ])\n\ndnl Function to detect if libuna dependencies are available\nAC_DEFUN([AX_LIBUNA_CHECK_LOCAL],\n [dnl No additional checks.\n\n ac_cv_libuna_CPPFLAGS=\"-I../libuna -I\\$(top_srcdir)/libuna\";\n ac_cv_libuna_LIBADD=\"../libuna/libuna.la\";\n\n ac_cv_libuna=local\n ])\n\ndnl Function to detect how to enable libuna\nAC_DEFUN([AX_LIBUNA_CHECK_ENABLE],\n [AX_COMMON_ARG_WITH(\n [libuna],\n [libuna],\n [search for libuna in includedir and libdir or in the specified DIR, or no if to use local version],\n [auto-detect],\n [DIR])\n\n dnl Check for a shared library version\n AX_LIBUNA_CHECK_LIB\n\n dnl Check if the dependencies for the local library version\n AS_IF(\n [test \"x$ac_cv_libuna\" != xyes],\n [AX_LIBUNA_CHECK_LOCAL\n\n AC_DEFINE(\n [HAVE_LOCAL_LIBUNA],\n [1],\n [Define to 1 if the local version of libuna is used.])\n AC_SUBST(\n [HAVE_LOCAL_LIBUNA],\n [1])\n ])\n\n AM_CONDITIONAL(\n [HAVE_LOCAL_LIBUNA],\n [test \"x$ac_cv_libuna\" = xlocal])\n AS_IF(\n [test \"x$ac_cv_libuna_CPPFLAGS\" != \"x\"],\n [AC_SUBST(\n [LIBUNA_CPPFLAGS],\n [$ac_cv_libuna_CPPFLAGS])\n ])\n AS_IF(\n [test \"x$ac_cv_libuna_LIBADD\" != \"x\"],\n [AC_SUBST(\n [LIBUNA_LIBADD],\n [$ac_cv_libuna_LIBADD])\n ])\n\n AS_IF(\n [test \"x$ac_cv_libuna\" = xyes],\n [AC_SUBST(\n [ax_libuna_pc_libs_private],\n [-luna])\n ])\n\n AS_IF(\n [test \"x$ac_cv_libuna\" = xyes],\n [AC_SUBST(\n [ax_libuna_spec_requires],\n [libuna])\n AC_SUBST(\n [ax_libuna_spec_build_requires],\n [libuna-devel])\n ])\n ])\n\n" }, { "path": "m4/libwrc.m4", "content": "dnl Checks for libwrc required headers and functions\ndnl\ndnl Version: 20240601\n\ndnl Function to detect if libwrc is available\ndnl ac_libwrc_dummy is used to prevent AC_CHECK_LIB adding unnecessary -l arguments\nAC_DEFUN([AX_LIBWRC_CHECK_LIB],\n [AS_IF(\n [test \"x$ac_cv_enable_shared_libs\" = xno || test \"x$ac_cv_with_libwrc\" = xno],\n [ac_cv_libwrc=no],\n [ac_cv_libwrc=check\n dnl Check if the directory provided as parameter exists\n dnl For both --with-libwrc which returns \"yes\" and --with-libwrc= which returns \"\"\n dnl treat them as auto-detection.\n AS_IF(\n [test \"x$ac_cv_with_libwrc\" != x && test \"x$ac_cv_with_libwrc\" != xauto-detect && test \"x$ac_cv_with_libwrc\" != xyes],\n [AX_CHECK_LIB_DIRECTORY_EXISTS([libwrc])],\n [dnl Check for a pkg-config file\n AS_IF(\n [test \"x$cross_compiling\" != \"xyes\" && test \"x$PKGCONFIG\" != \"x\"],\n [PKG_CHECK_MODULES(\n [libwrc],\n [libwrc >= 20211231],\n [ac_cv_libwrc=yes],\n [ac_cv_libwrc=check])\n ])\n AS_IF(\n [test \"x$ac_cv_libwrc\" = xyes],\n [ac_cv_libwrc_CPPFLAGS=\"$pkg_cv_libwrc_CFLAGS\"\n ac_cv_libwrc_LIBADD=\"$pkg_cv_libwrc_LIBS\"])\n ])\n\n AS_IF(\n [test \"x$ac_cv_libwrc\" = xcheck],\n [dnl Check for headers\n AC_CHECK_HEADERS([libwrc.h])\n\n AS_IF(\n [test \"x$ac_cv_header_libwrc_h\" = xno],\n [ac_cv_libwrc=no],\n [ac_cv_libwrc=yes\n\n AX_CHECK_LIB_FUNCTIONS(\n [libwrc],\n [wrc],\n [[libwrc_get_version],\n [libwrc_stream_initialize],\n [libwrc_stream_free],\n [libwrc_stream_signal_abort],\n [libwrc_stream_open],\n [libwrc_stream_close],\n [libwrc_stream_set_ascii_codepage],\n [libwrc_stream_get_virtual_address],\n [libwrc_stream_set_virtual_address],\n [libwrc_stream_get_number_of_resources],\n [libwrc_stream_get_resource_by_index],\n [libwrc_stream_get_resource_by_identifier],\n [libwrc_stream_get_resource_by_type],\n [libwrc_stream_get_resource_by_utf8_name],\n [libwrc_stream_get_resource_by_utf16_name],\n [libwrc_resource_free],\n [libwrc_resource_get_identifier],\n [libwrc_resource_get_utf8_name_size],\n [libwrc_resource_get_utf8_name],\n [libwrc_resource_get_utf16_name_size],\n [libwrc_resource_get_utf16_name],\n [libwrc_resource_get_type],\n [libwrc_resource_get_number_of_languages],\n [libwrc_resource_get_language_identifier],\n [libwrc_resource_get_number_of_items],\n [libwrc_resource_get_item_by_index],\n [libwrc_resource_item_free],\n [libwrc_resource_item_get_identifier],\n [libwrc_resource_item_get_utf8_name_size],\n [libwrc_resource_item_get_utf8_name],\n [libwrc_resource_item_get_utf16_name_size],\n [libwrc_resource_item_get_utf16_name],\n [libwrc_resource_item_read_buffer],\n [libwrc_resource_item_read_buffer_at_offset],\n [libwrc_resource_item_seek_offset],\n [libwrc_resource_item_get_offset],\n [libwrc_resource_item_get_size],\n [libwrc_resource_item_get_number_of_sub_items],\n [libwrc_resource_item_get_sub_item_by_index],\n [libwrc_message_table_resource_initialize],\n [libwrc_message_table_resource_free],\n [libwrc_message_table_resource_read],\n [libwrc_message_table_resource_get_number_of_messages],\n [libwrc_message_table_resource_get_identifier],\n [libwrc_message_table_resource_get_index_by_identifier],\n [libwrc_message_table_resource_get_utf8_string_size],\n [libwrc_message_table_resource_get_utf8_string],\n [libwrc_message_table_resource_get_utf16_string_size],\n [libwrc_message_table_resource_get_utf16_string],\n [libwrc_mui_resource_initialize],\n [libwrc_mui_resource_free],\n [libwrc_mui_resource_read],\n [libwrc_mui_resource_get_file_type],\n [libwrc_mui_resource_get_utf8_main_name_size],\n [libwrc_mui_resource_get_utf8_main_name],\n [libwrc_mui_resource_get_utf16_main_name_size],\n [libwrc_mui_resource_get_utf16_main_name],\n [libwrc_mui_resource_get_utf8_mui_name_size],\n [libwrc_mui_resource_get_utf8_mui_name],\n [libwrc_mui_resource_get_utf16_mui_name_size],\n [libwrc_mui_resource_get_utf16_mui_name],\n [libwrc_mui_resource_get_utf8_language_size],\n [libwrc_mui_resource_get_utf8_language],\n [libwrc_mui_resource_get_utf16_language_size],\n [libwrc_mui_resource_get_utf16_language],\n [libwrc_mui_resource_get_utf8_fallback_language_size],\n [libwrc_mui_resource_get_utf8_fallback_language],\n [libwrc_mui_resource_get_utf16_fallback_language_size],\n [libwrc_mui_resource_get_utf16_fallback_language]])\n\n AS_IF(\n [test \"x$ac_cv_enable_wide_character_type\" != xno],\n [AX_CHECK_LIB_FUNCTIONS(\n [libwrc],\n [wrc],\n [[libwrc_stream_open_wide]])\n ])\n\n dnl TODO add functions\n\n ac_cv_libwrc_LIBADD=\"-lwrc\"])\n ])\n\n AX_CHECK_LIB_DIRECTORY_MSG_ON_FAILURE([libwrc])\n ])\n\n AS_IF(\n [test \"x$ac_cv_libwrc\" = xyes],\n [AC_DEFINE(\n [HAVE_LIBWRC],\n [1],\n [Define to 1 if you have the `wrc' library (-lwrc).])\n ])\n\n AS_IF(\n [test \"x$ac_cv_libwrc\" = xyes],\n [AC_SUBST(\n [HAVE_LIBWRC],\n [1]) ],\n [AC_SUBST(\n [HAVE_LIBWRC],\n [0])\n ])\n ])\n\ndnl Function to detect if libwrc dependencies are available\nAC_DEFUN([AX_LIBWRC_CHECK_LOCAL],\n [ac_cv_libwrc_CPPFLAGS=\"-I../libwrc -I\\$(top_srcdir)/libwrc\";\n ac_cv_libwrc_LIBADD=\"../libwrc/libwrc.la\";\n\n ac_cv_libwrc=local\n ])\n\ndnl Function to detect how to enable libwrc\nAC_DEFUN([AX_LIBWRC_CHECK_ENABLE],\n [AX_COMMON_ARG_WITH(\n [libwrc],\n [libwrc],\n [search for libwrc in includedir and libdir or in the specified DIR, or no if to use local version],\n [auto-detect],\n [DIR])\n\n dnl Check for a shared library version\n AX_LIBWRC_CHECK_LIB\n\n dnl Check if the dependencies for the local library version\n AS_IF(\n [test \"x$ac_cv_libwrc\" != xyes],\n [AX_LIBWRC_CHECK_LOCAL\n\n AC_DEFINE(\n [HAVE_LOCAL_LIBWRC],\n [1],\n [Define to 1 if the local version of libwrc is used.])\n AC_SUBST(\n [HAVE_LOCAL_LIBWRC],\n [1])\n ])\n\n AM_CONDITIONAL(\n [HAVE_LOCAL_LIBWRC],\n [test \"x$ac_cv_libwrc\" = xlocal])\n AS_IF(\n [test \"x$ac_cv_libwrc_CPPFLAGS\" != \"x\"],\n [AC_SUBST(\n [LIBWRC_CPPFLAGS],\n [$ac_cv_libwrc_CPPFLAGS])\n ])\n AS_IF(\n [test \"x$ac_cv_libwrc_LIBADD\" != \"x\"],\n [AC_SUBST(\n [LIBWRC_LIBADD],\n [$ac_cv_libwrc_LIBADD])\n ])\n\n AS_IF(\n [test \"x$ac_cv_libwrc\" = xyes],\n [AC_SUBST(\n [ax_libwrc_pc_libs_private],\n [-lwrc])\n ])\n\n AS_IF(\n [test \"x$ac_cv_libwrc\" = xyes],\n [AC_SUBST(\n [ax_libwrc_spec_requires],\n [libwrc])\n AC_SUBST(\n [ax_libwrc_spec_build_requires],\n [libwrc-devel])\n ])\n ])\n" }, { "path": "m4/pthread.m4", "content": "dnl Functions for pthread\ndnl\ndnl Version: 20240513\n\ndnl Function to detect if pthread is available\nAC_DEFUN([AX_PTHREAD_CHECK_LIB],\n [AS_IF(\n [test \"x$ac_cv_enable_shared_libs\" = xno || test \"x$ac_cv_with_pthread\" = xno],\n [ac_cv_pthread=no],\n [ac_cv_pthread=check\n dnl Check if parameters were provided\n dnl For both --with-pthread which returns \"yes\" and --with-pthread= which returns \"\"\n dnl treat them as auto-detection.\n AS_IF(\n [test \"x$ac_cv_with_pthread\" != x && test \"x$ac_cv_with_pthread\" != xauto-detect && test \"x$ac_cv_with_pthread\" != xyes],\n [AX_CHECK_LIB_DIRECTORY_EXISTS([pthread])])\n ])\n\n AS_IF(\n [test \"x$ac_cv_pthread\" = xcheck],\n [dnl Check for headers\n AC_CHECK_HEADERS([pthread.h])\n\n AS_IF(\n [test \"x$ac_cv_header_pthread_h\" = xno],\n [ac_cv_pthread=no],\n [ac_cv_pthread=yes\n\n AX_CHECK_LIB_FUNCTIONS(\n [pthread],\n [pthread],\n [[pthread_create],\n [pthread_exit],\n [pthread_join],\n [pthread_cond_init],\n [pthread_cond_destroy],\n [pthread_cond_broadcast],\n [pthread_cond_signal],\n [pthread_cond_wait],\n [pthread_mutex_init],\n [pthread_mutex_destroy],\n [pthread_mutex_lock],\n [pthread_mutex_trylock],\n [pthread_mutex_unlock],\n [pthread_rwlock_init],\n [pthread_rwlock_destroy],\n [pthread_rwlock_rdlock],\n [pthread_rwlock_wrlock],\n [pthread_rwlock_unlock]])\n\n ac_cv_pthread_LIBADD=\"-lpthread\"\n ])\n\n AX_CHECK_LIB_DIRECTORY_MSG_ON_FAILURE([pthread])\n ])\n\n AS_IF(\n [test \"x$ac_cv_pthread\" = xpthread],\n [AC_DEFINE(\n [HAVE_PTHREAD],\n [1],\n [Define to 1 if you have the 'pthread' library (-lpthread).])\n ])\n\n AS_IF(\n [test \"x$ac_cv_pthread\" != xno],\n [AC_SUBST(\n [HAVE_PTHREAD],\n [1]) ],\n [AC_SUBST(\n [HAVE_PTHREAD],\n [0])\n ])\n ])\n\ndnl Function to detect how to enable pthread\nAC_DEFUN([AX_PTHREAD_CHECK_ENABLE],\n [AX_COMMON_ARG_WITH(\n [pthread],\n [pthread],\n [search for pthread in includedir and libdir or in the specified DIR, or no if not to use pthread],\n [auto-detect],\n [DIR])\n\n dnl Check for a shared library version\n AX_PTHREAD_CHECK_LIB\n\n AS_IF(\n [test \"x$ac_cv_pthread_CPPFLAGS\" != \"x\"],\n [AC_SUBST(\n [PTHREAD_CPPFLAGS],\n [$ac_cv_pthread_CPPFLAGS])\n ])\n AS_IF(\n [test \"x$ac_cv_pthread_LIBADD\" != \"x\"],\n [AC_SUBST(\n [PTHREAD_LIBADD],\n [$ac_cv_pthread_LIBADD])\n ])\n\n AS_IF(\n [test \"x$ac_cv_pthread\" = xpthread],\n [AC_SUBST(\n [ax_pthread_pc_libs_private],\n [-lpthread])\n ])\n ])\n\n" }, { "path": "m4/python.m4", "content": "dnl Functions for Python bindings\ndnl\ndnl Version: 20251125\n\ndnl Function to check if the python binary is available\ndnl \"python${PYTHON_VERSION} python python# python#.#\"\nAC_DEFUN([AX_PROG_PYTHON],\n [AS_IF(\n [test \"x${PYTHON_VERSION}\" != x],\n [ax_python_progs=\"python${PYTHON_VERSION}\"],\n [ax_python_progs=\"python python3 python3.15 python3.14 python3.14 python3.12 python3.11 python3.10 python3.9 python3.8 python3.7 python3.6 python3.5 python3.4 python3.3 python3.2 python3.1 python3.0 python2 python2.7 python2.6 python2.5\"])\n AC_CHECK_PROGS(\n [PYTHON],\n [$ax_python_progs])\n AS_IF(\n [test \"x${PYTHON}\" != x],\n [ax_prog_python_version=`${PYTHON} -c \"import sys; sys.stdout.write('%d.%d' % (sys.version_info[[0]], sys.version_info[[1]]))\" 2>/dev/null`;\n ax_prog_python_platform=`${PYTHON} -c \"import sys; sys.stdout.write(sys.platform)\" 2>/dev/null`;\n AC_SUBST(\n [PYTHON_PLATFORM],\n [$ax_prog_python_platform])\n ],\n [AC_MSG_ERROR(\n [Unable to find python])\n ])\n AC_SUBST(\n [PYTHON],\n [$PYTHON])\n ])\n\ndnl Function to check if the python-config binary is available\ndnl \"python${PYTHON_VERSION}-config python-config\"\nAC_DEFUN([AX_PROG_PYTHON_CONFIG],\n [AS_IF(\n [test \"x${PYTHON_CONFIG}\" = x && test \"x${PYTHON_VERSION}\" != x],\n [AC_CHECK_PROGS(\n [PYTHON_CONFIG],\n [python${PYTHON_VERSION}-config])\n ])\n AS_IF(\n [test \"x${PYTHON_CONFIG}\" = x],\n [AC_CHECK_PROGS(\n [PYTHON_CONFIG],\n [python-config python3-config python3.12-config python3.11-config python3.10-config python3.9-config python3.8-config python3.7-config python3.6-config python3.5-config python3.4-config python3.3-config python3.2-config python3.1-config python3.0-config python2-config python2.7-config python2.6-config python2.5-config])\n ])\n AS_IF(\n [test \"x${PYTHON_CONFIG}\" = x],\n [AC_MSG_ERROR(\n [Unable to find python-config])\n ])\n AC_SUBST(\n [PYTHON_CONFIG],\n [$PYTHON_CONFIG])\n ])\n\ndnl Function to detect if a Python build environment is available\nAC_DEFUN([AX_PYTHON_CHECK],\n [AX_PROG_PYTHON\n AX_PROG_PYTHON_CONFIG\n\n AS_IF(\n [test \"x${PYTHON_CONFIG}\" != x],\n [dnl Check for Python includes\n PYTHON_INCLUDES=`${PYTHON_CONFIG} --includes 2>/dev/null`;\n\n AC_MSG_CHECKING(\n [for Python includes])\n AC_MSG_RESULT(\n [$PYTHON_INCLUDES])\n\n dnl Check for Python libraries\n PYTHON_LDFLAGS=`${PYTHON_CONFIG} --ldflags 2>/dev/null`;\n\n AC_MSG_CHECKING(\n [for Python libraries])\n AC_MSG_RESULT(\n [$PYTHON_LDFLAGS])\n\n dnl For CygWin and MinGW add the -no-undefined linker flag\n AS_CASE(\n [$build],\n [*-*-cygwin*],[PYTHON_LDFLAGS=\"${PYTHON_LDFLAGS} -no-undefined\"],\n [*-*-mingw*],[PYTHON_LDFLAGS=\"${PYTHON_LDFLAGS} -no-undefined\"],\n [*-*-msys*],[PYTHON_LDFLAGS=\"${PYTHON_LDFLAGS} -no-undefined\"],\n [*],[])\n\n dnl Check for the existence of Python.h\n BACKUP_CPPFLAGS=\"${CPPFLAGS}\"\n CPPFLAGS=\"${CPPFLAGS} ${PYTHON_INCLUDES}\"\n\n AC_CHECK_HEADERS(\n [Python.h],\n [ac_cv_header_python_h=yes],\n [ac_cv_header_python_h=no])\n\n CPPFLAGS=\"${BACKUP_CPPFLAGS}\"\n ])\n\n AS_IF(\n [test \"x${ac_cv_header_python_h}\" != xyes],\n [ac_cv_enable_python=no],\n [ac_cv_enable_python=${ax_prog_python_version}\n AC_SUBST(\n [PYTHON_CPPFLAGS],\n [$PYTHON_INCLUDES])\n\n AC_SUBST(\n [PYTHON_LDFLAGS],\n [$PYTHON_LDFLAGS])\n\n dnl Check for Python prefix\n AS_IF(\n [test \"x${ac_cv_with_pyprefix}\" = x || test \"x${ac_cv_with_pyprefix}\" = xno],\n [ax_python_prefix=\"\\${prefix}\"],\n [ax_python_prefix=`${PYTHON_CONFIG} --prefix 2>/dev/null`])\n\n AC_SUBST(\n [PYTHON_PREFIX],\n [$ax_python_prefix])\n\n dnl Check for Python exec-prefix\n AS_IF(\n [test \"x${ac_cv_with_pyprefix}\" = x || test \"x${ac_cv_with_pyprefix}\" = xno],\n [ax_python_exec_prefix=\"\\${exec_prefix}\"],\n [ax_python_exec_prefix=`${PYTHON_CONFIG} --exec-prefix 2>/dev/null`])\n\n AC_SUBST(\n [PYTHON_EXEC_PREFIX],\n [$ax_python_exec_prefix])\n\n dnl Check for Python library directory\n ax_python_pythondir_suffix=`${PYTHON} -c \"import sys; import distutils.sysconfig; sys.stdout.write(distutils.sysconfig.get_python_lib(0, 0, prefix=''))\" 2>/dev/null`;\n\n AS_IF(\n [test \"x${ac_cv_with_pythondir}\" = x || test \"x${ac_cv_with_pythondir}\" = xno],\n [AS_IF(\n [test \"x${ac_cv_with_pyprefix}\" = x || test \"x${ac_cv_with_pyprefix}\" = xno],\n [ax_python_pythondir=\"${ax_python_prefix}/${ax_python_pythondir_suffix}\"],\n [ax_python_pythondir=`${PYTHON} -c \"import sys; import distutils.sysconfig; sys.stdout.write(distutils.sysconfig.get_python_lib()) \" 2>/dev/null`])],\n [ax_python_pythondir=$ac_cv_with_pythondir])\n\n AC_SUBST(\n [pythondir],\n [$ax_python_pythondir])\n\n dnl Check for Python platform specific library directory\n ax_python_pyexecdir_suffix=`${PYTHON} -c \"import sys; import distutils.sysconfig; sys.stdout.write(distutils.sysconfig.get_python_lib(1, 0, prefix=''))\" 2>/dev/null`;\n ax_python_library_dir=`${PYTHON} -c \"import sys; import distutils.sysconfig; sys.stdout.write(distutils.sysconfig.get_python_lib(True)) \" 2>/dev/null`;\n\n AS_IF(\n [test \"x${ac_cv_with_pyprefix}\" = x || test \"x${ac_cv_with_pyprefix}\" = xno],\n [ax_python_pyexecdir=\"${ax_python_exec_prefix}/${ax_python_pyexecdir_suffix}\"],\n [ax_python_pyexecdir=$ax_python_library_dir])\n\n AC_SUBST(\n [pyexecdir],\n [$ax_python_pyexecdir])\n\n AC_SUBST(\n [PYTHON_LIBRARY_DIR],\n [$ax_python_pyexecdir_suffix])\n\n AC_SUBST(\n [PYTHON_PACKAGE_DIR],\n [$ax_python_library_dir])\n ])\n ])\n\ndnl Function to determine the prefix of pythondir\nAC_DEFUN([AX_PYTHON_CHECK_PYPREFIX],\n [AX_COMMON_ARG_WITH(\n [pyprefix],\n [pyprefix],\n [use `python-config --prefix' to determine the prefix of pythondir instead of --prefix],\n [no],\n [no])\n])\n\ndnl Function to detect if to enable Python\nAC_DEFUN([AX_PYTHON_CHECK_ENABLE],\n [AX_PYTHON_CHECK_PYPREFIX\n\n AX_COMMON_ARG_ENABLE(\n [python],\n [python],\n [build Python bindings],\n [no])\n AX_COMMON_ARG_WITH(\n [pythondir],\n [pythondir],\n [use to specify the Python directory (pythondir)],\n [no],\n [no])\n\n AS_IF(\n [test \"x${ac_cv_enable_python}\" != xno],\n [AX_PYTHON_CHECK])\n\n AM_CONDITIONAL(\n HAVE_PYTHON,\n [test \"x${ac_cv_enable_python}\" != xno])\n\n AM_CONDITIONAL(\n HAVE_PYTHON_TESTS,\n [test \"x${ac_cv_enable_python}\" != xno])\n ])\n])\n\n" }, { "path": "m4/tests.m4", "content": "dnl Functions for testing\ndnl\ndnl Version: 20200712\n\ndnl Function to detect if tests dependencies are available\nAC_DEFUN([AX_TESTS_CHECK_LOCAL],\n [AC_CHECK_HEADERS([dlfcn.h])\n\n AC_CHECK_FUNCS([fmemopen getopt mkstemp setenv tzset unlink])\n\n AC_CHECK_LIB(\n dl,\n dlsym)\n\n AS_IF(\n [test \"x$lt_cv_prog_gnu_ld\" = xyes && test \"x$ac_cv_lib_dl_dlsym\" = xyes],\n [AC_DEFINE(\n [HAVE_GNU_DL_DLSYM],\n [1],\n [Define to 1 if dlsym function is available in GNU dl.])\n ])\n])\n\ndnl Function to detect if OSS-Fuzz build environment is available\nAC_DEFUN([AX_TESTS_CHECK_OSSFUZZ],\n [AM_CONDITIONAL(\n HAVE_LIB_FUZZING_ENGINE,\n [test \"x${LIB_FUZZING_ENGINE}\" != x])\n AC_SUBST(\n [LIB_FUZZING_ENGINE],\n [\"${LIB_FUZZING_ENGINE}\"])\n])\n\n" }, { "path": "m4/types.m4", "content": "dnl Functions for type definitions\ndnl\ndnl Version: 20180727\n\ndnl Function to detect if type definitions are available\nAC_DEFUN([AX_TYPES_CHECK_LOCAL],\n [AS_IF(\n [test \"x$ac_cv_enable_winapi\" = xyes],\n [ac_cv_enable_wide_character_type=yes])\n\n AS_IF(\n [test \"x$ac_cv_enable_wide_character_type\" = xyes],\n [AC_DEFINE(\n [HAVE_WIDE_CHARACTER_TYPE],\n [1],\n [Define to 1 if wide character type should be used.])\n AC_SUBST(\n [HAVE_WIDE_CHARACTER_TYPE],\n [1]) ],\n [AC_SUBST(\n [HAVE_WIDE_CHARACTER_TYPE],\n [0])\n ])\n\n AC_CHECK_HEADERS([sys/types.h inttypes.h stdint.h wchar.h])\n\n AS_IF(\n [test \"x$ac_cv_header_sys_types_h\" = xyes],\n [AC_SUBST(\n [HAVE_SYS_TYPES_H],\n [1])],\n [AC_SUBST(\n [HAVE_SYS_TYPES_H],\n [0])\n ])\n\n AS_IF(\n [test \"x$ac_cv_header_inttypes_h\" = xyes],\n [AC_SUBST(\n [HAVE_INTTYPES_H],\n [1])],\n [AC_SUBST(\n [HAVE_INTTYPES_H],\n [0])\n ])\n\n AS_IF(\n [test \"x$ac_cv_header_stdint_h\" = xyes],\n [AC_SUBST(\n [HAVE_STDINT_H],\n [1])],\n [AC_SUBST(\n [HAVE_STDINT_H],\n [0])\n ])\n\n AS_IF(\n [test \"x$ac_cv_header_wchar_h\" = xyes],\n [AC_SUBST(\n [HAVE_WCHAR_H],\n [1]) ],\n [AC_SUBST(\n [HAVE_WCHAR_H],\n [0])\n ])\n\n AC_TYPE_MODE_T\n AC_TYPE_OFF_T\n AC_TYPE_SIZE_T\n\n AC_CHECK_TYPE(\n [size32_t],\n [AC_SUBST(\n [HAVE_SIZE32_T],\n [1])],\n [AC_SUBST(\n [HAVE_SIZE32_T],\n [0])\n ])\n\n AC_CHECK_TYPE(\n [ssize32_t],\n [AC_SUBST(\n [HAVE_SSIZE32_T],\n [1])],\n [AC_SUBST(\n [HAVE_SSIZE32_T],\n [0])\n ])\n\n AC_CHECK_TYPE(\n [size64_t],\n [AC_SUBST(\n [HAVE_SIZE64_T],\n [1])],\n [AC_SUBST(\n [HAVE_SIZE64_T],\n [0])\n ])\n\n AC_CHECK_TYPE(\n [ssize64_t],\n [AC_SUBST(\n [HAVE_SSIZE64_T],\n [1])],\n [AC_SUBST(\n [HAVE_SSIZE64_T],\n [0])\n ])\n\n AC_CHECK_TYPE(\n [off64_t],\n [AC_SUBST(\n [HAVE_OFF64_T],\n [1])],\n [AC_SUBST(\n [HAVE_OFF64_T],\n [0])\n ])\n\n AC_CHECK_TYPE([ssize_t])\n AC_CHECK_TYPE([u64])\n\n AC_CHECK_SIZEOF([int])\n AC_CHECK_SIZEOF([long])\n AC_CHECK_SIZEOF([off_t])\n AC_CHECK_SIZEOF([size_t])\n\n AS_IF(\n [test \"x$ac_cv_header_wchar_h\" = xyes],\n [AC_CHECK_SIZEOF([wchar_t])])\n ])\n\n" }, { "path": "manuals/Makefile.am", "content": "man_MANS = \\\n\tevtxexport.1 \\\n\tevtxinfo.1 \\\n\tlibevtx.3\n\nEXTRA_DIST = \\\n\tevtxexport.1 \\\n\tevtxinfo.1 \\\n\tlibevtx.3\n\nDISTCLEANFILES = \\\n\tMakefile \\\n\tMakefile.in\n\n" }, { "path": "manuals/evtxexport.1", "content": ".Dd April 14, 2019\n.Dt evtxexport\n.Os libevtx\n.Sh NAME\n.Nm evtxexport\n.Nd exports items stored in a Windows XML EventViewer Log (EVTX) file\n.Sh SYNOPSIS\n.Nm evtxexport\n.Op Fl c Ar codepage\n.Op Fl f Ar format\n.Op Fl l Ar log_file\n.Op Fl m Ar mode\n.Op Fl p Ar message_files_path\n.Op Fl r Ar registy_files_path\n.Op Fl s Ar system_file\n.Op Fl S Ar software_file\n.Op Fl t Ar event_log_type\n.Op Fl hTvV\n.Ar source\n.Sh DESCRIPTION\n.Nm evtxexport\nis a utility to export items stored in a Windows XML EventViewer Log (EVTX) file\n.Pp\n.Nm evtxexport\nis part of the\n.Nm libevtx\npackage.\n.Nm libevtx\nis a library to access the Windows XML EventViewer Log (EVTX) file\n.Pp\n.Ar source\nis the source file.\n.Pp\nThe options are as follows:\n.Bl -tag -width Ds\n.It Fl c Ar codepage\nspecify the codepage of ASCII strings, options: ascii, windows-874, windows-932, windows-936, windows-949, windows-950, windows-1250, windows-1251, windows-1252 (default), windows-1253, windows-1254, windows-1255, windows-1256, windows-1257 or windows-1258\n.It Fl f Ar format\noutput format, options: xml, text (default)\n.It Fl h\nshows this help\n.It Fl l Ar log_file\nspecify the file in which to log information about the exported items\n.It Fl m Ar mode\nexport mode, option: all, items (default), recovered 'all' exports the (allocated) items and recovered items, 'items' exports the (allocated) items and 'recovered' exports the recovered items\n.It Fl p Ar message_files_path\nsearch PATH for the resource files (default is the current working directory)\n.It Fl r Ar registy_files_path\nname of the directory containing the SOFTWARE and SYSTEM (Windows) Registry file\n.It Fl s Ar system_file\nfilename of the SYSTEM (Windows) Registry file\nThis option overrides the path provided by \\-r\n.It Fl S Ar software_file\nfilename of the SOFTWARE (Windows) Registry file\nThis option overrides the path provided by \\-r\n.It Fl t Ar event_log_type\nevent log type, options: application, security, system if not specified the event log type is determined based on the filename.\n.It Fl T\nuse event template definitions to parse the event record data\n.It Fl v\nverbose output to stderr\n.It Fl V\nprint version\n.El\n.Sh ENVIRONMENT\nNone\n.Sh FILES\nNone\n.Sh EXAMPLES\n.Bd -literal\n# evtxexport evtxexport -p c/ -r c/Windows/System32/config/ c/Windows/System32/winevt/Logs/Apllication.Evtx\nevtxexport 20120910\n.sp\n.Dl ...\n.sp\n.Ed\n.Sh DIAGNOSTICS\nErrors, verbose and debug output are printed to stderr when verbose output \\-v is enabled.\nVerbose and debug output are only printed when enabled at compilation.\n.Sh BUGS\nPlease report bugs of any kind to or on the project website:\nhttps://github.com/libyal/libevtx/\n.Sh AUTHOR\nThese man pages were written by Joachim Metz.\n.Sh COPYRIGHT\nCopyright (C) 2011-2025, Joachim Metz .\nThis is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.\n.Sh SEE ALSO\n.Xr evtxinfo 1\n" }, { "path": "manuals/evtxinfo.1", "content": ".Dd April 14, 2019\n.Dt evtxinfo\n.Os libevtx\n.Sh NAME\n.Nm evtxinfo\n.Nd determines information about a Windows XML EventViewer Log (EVTX) file\n.Sh SYNOPSIS\n.Nm evtxinfo\n.Op Fl c Ar codepage\n.Op Fl hvV\n.Ar source\n.Sh DESCRIPTION\n.Nm evtxinfo\nis a utility to determine information about a Windows XML EventViewer Log (EVTX) file\n.Pp\n.Nm evtxinfo\nis part of the\n.Nm libevtx\npackage.\n.Nm libevtx\nis a library to accesss the Windows XML EventViewer Log (EVTX) format\n.Pp\n.Ar source\nis the source file.\n.Pp\nThe options are as follows:\n.Bl -tag -width Ds\n.It Fl c Ar codepage\nspecify the codepage of ASCII strings, options: ascii, windows-874, windows-932, windows-936, windows-949, windows-950, windows-1250, windows-1251, windows-1252 (default), windows-1253, windows-1254, windows-1255, windows-1256, windows-1257 or windows-1258\n.It Fl h\nshows this help\n.It Fl v\nverbose output to stderr\n.It Fl V\nprint version\n.El\n.Sh ENVIRONMENT\nNone\n.Sh FILES\nNone\n.Sh EXAMPLES\n.Bd -literal\n.Dl ...\n.sp\n.Ed\n.Sh DIAGNOSTICS\nErrors, verbose and debug output are printed to stderr when verbose output \\-v is enabled.\nVerbose and debug output are only printed when enabled at compilation.\n.Sh BUGS\nPlease report bugs of any kind to or on the project website:\nhttps://github.com/libyal/libevtx/\n.Sh AUTHOR\nThese man pages were written by Joachim Metz.\n.Sh COPYRIGHT\nCopyright (C) 2011-2025, Joachim Metz .\n.Sh SEE ALSO\n" }, { "path": "manuals/libevtx.3", "content": ".Dd May 4, 2024\n.Dt libevtx 3\n.Os libevtx\n.Sh NAME\n.Nm libevtx.h\n.Nd Library to access the Windows XML Event Log (EVTX) format\n.Sh SYNOPSIS\n.In libevtx.h\n.Pp\nSupport functions\n.Ft const char *\n.Fn libevtx_get_version \"void\"\n.Ft int\n.Fn libevtx_get_access_flags_read \"void\"\n.Ft int\n.Fn libevtx_get_codepage \"int *codepage\" \"libevtx_error_t **error\"\n.Ft int\n.Fn libevtx_set_codepage \"int codepage\" \"libevtx_error_t **error\"\n.Ft int\n.Fn libevtx_check_file_signature \"const char *filename\" \"libevtx_error_t **error\"\n.Pp\nAvailable when compiled with wide character string support:\n.Ft int\n.Fn libevtx_check_file_signature_wide \"const wchar_t *filename\" \"libevtx_error_t **error\"\n.Pp\nAvailable when compiled with libbfio support:\n.Ft int\n.Fn libevtx_check_file_signature_file_io_handle \"libbfio_handle_t *bfio_handle\" \"libevtx_error_t **error\"\n.Pp\nNotify functions\n.Ft void\n.Fn libevtx_notify_set_verbose \"int verbose\"\n.Ft int\n.Fn libevtx_notify_set_stream \"FILE *stream\" \"libevtx_error_t **error\"\n.Ft int\n.Fn libevtx_notify_stream_open \"const char *filename\" \"libevtx_error_t **error\"\n.Ft int\n.Fn libevtx_notify_stream_close \"libevtx_error_t **error\"\n.Pp\nError functions\n.Ft void\n.Fn libevtx_error_free \"libevtx_error_t **error\"\n.Ft int\n.Fn libevtx_error_fprint \"libevtx_error_t *error\" \"FILE *stream\"\n.Ft int\n.Fn libevtx_error_sprint \"libevtx_error_t *error\" \"char *string\" \"size_t size\"\n.Ft int\n.Fn libevtx_error_backtrace_fprint \"libevtx_error_t *error\" \"FILE *stream\"\n.Ft int\n.Fn libevtx_error_backtrace_sprint \"libevtx_error_t *error\" \"char *string\" \"size_t size\"\n.Pp\nFile functions\n.Ft int\n.Fn libevtx_file_initialize \"libevtx_file_t **file\" \"libevtx_error_t **error\"\n.Ft int\n.Fn libevtx_file_free \"libevtx_file_t **file\" \"libevtx_error_t **error\"\n.Ft int\n.Fn libevtx_file_signal_abort \"libevtx_file_t *file\" \"libevtx_error_t **error\"\n.Ft int\n.Fn libevtx_file_open \"libevtx_file_t *file\" \"const char *filename\" \"int access_flags\" \"libevtx_error_t **error\"\n.Ft int\n.Fn libevtx_file_close \"libevtx_file_t *file\" \"libevtx_error_t **error\"\n.Ft int\n.Fn libevtx_file_is_corrupted \"libevtx_file_t *file\" \"libevtx_error_t **error\"\n.Ft int\n.Fn libevtx_file_get_ascii_codepage \"libevtx_file_t *file\" \"int *ascii_codepage\" \"libevtx_error_t **error\"\n.Ft int\n.Fn libevtx_file_set_ascii_codepage \"libevtx_file_t *file\" \"int ascii_codepage\" \"libevtx_error_t **error\"\n.Ft int\n.Fn libevtx_file_get_format_version \"libevtx_file_t *file\" \"uint16_t *major_version\" \"uint16_t *minor_version\" \"libevtx_error_t **error\"\n.Ft int\n.Fn libevtx_file_get_flags \"libevtx_file_t *file\" \"uint32_t *flags\" \"libevtx_error_t **error\"\n.Ft int\n.Fn libevtx_file_get_number_of_records \"libevtx_file_t *file\" \"int *number_of_records\" \"libevtx_error_t **error\"\n.Ft int\n.Fn libevtx_file_get_record_by_index \"libevtx_file_t *file\" \"int record_index\" \"libevtx_record_t **record\" \"libevtx_error_t **error\"\n.Ft int\n.Fn libevtx_file_get_number_of_recovered_records \"libevtx_file_t *file\" \"int *number_of_records\" \"libevtx_error_t **error\"\n.Ft int\n.Fn libevtx_file_get_recovered_record_by_index \"libevtx_file_t *file\" \"int record_index\" \"libevtx_record_t **record\" \"libevtx_error_t **error\"\n.Pp\nAvailable when compiled with wide character string support:\n.Ft int\n.Fn libevtx_file_open_wide \"libevtx_file_t *file\" \"const wchar_t *filename\" \"int access_flags\" \"libevtx_error_t **error\"\n.Pp\nAvailable when compiled with libbfio support:\n.Ft int\n.Fn libevtx_file_open_file_io_handle \"libevtx_file_t *file\" \"libbfio_handle_t *file_io_handle\" \"int access_flags\" \"libevtx_error_t **error\"\n.Pp\nRecord functions\n.Ft int\n.Fn libevtx_record_free \"libevtx_record_t **record\" \"libevtx_error_t **error\"\n.Ft int\n.Fn libevtx_record_get_offset \"libevtx_record_t *record\" \"off64_t *offset\" \"libevtx_error_t **error\"\n.Ft int\n.Fn libevtx_record_get_identifier \"libevtx_record_t *record\" \"uint64_t *identifier\" \"libevtx_error_t **error\"\n.Ft int\n.Fn libevtx_record_get_creation_time \"libevtx_record_t *record\" \"uint64_t *filetime\" \"libevtx_error_t **error\"\n.Ft int\n.Fn libevtx_record_get_written_time \"libevtx_record_t *record\" \"uint64_t *filetime\" \"libevtx_error_t **error\"\n.Ft int\n.Fn libevtx_record_get_event_identifier \"libevtx_record_t *record\" \"uint32_t *event_identifier\" \"libevtx_error_t **error\"\n.Ft int\n.Fn libevtx_record_get_event_identifier_qualifiers \"libevtx_record_t *record\" \"uint32_t *event_identifier_qualifiers\" \"libevtx_error_t **error\"\n.Ft int\n.Fn libevtx_record_get_event_version \"libevtx_record_t *record\" \"uint8_t *event_version\" \"libevtx_error_t **error\"\n.Ft int\n.Fn libevtx_record_get_event_level \"libevtx_record_t *record\" \"uint8_t *event_level\" \"libevtx_error_t **error\"\n.Ft int\n.Fn libevtx_record_get_utf8_provider_identifier_size \"libevtx_record_t *record\" \"size_t *utf8_string_size\" \"libevtx_error_t **error\"\n.Ft int\n.Fn libevtx_record_get_utf8_provider_identifier \"libevtx_record_t *record\" \"uint8_t *utf8_string\" \"size_t utf8_string_size\" \"libevtx_error_t **error\"\n.Ft int\n.Fn libevtx_record_get_utf16_provider_identifier_size \"libevtx_record_t *record\" \"size_t *utf16_string_size\" \"libevtx_error_t **error\"\n.Ft int\n.Fn libevtx_record_get_utf16_provider_identifier \"libevtx_record_t *record\" \"uint16_t *utf16_string\" \"size_t utf16_string_size\" \"libevtx_error_t **error\"\n.Ft int\n.Fn libevtx_record_get_utf8_source_name_size \"libevtx_record_t *record\" \"size_t *utf8_string_size\" \"libevtx_error_t **error\"\n.Ft int\n.Fn libevtx_record_get_utf8_source_name \"libevtx_record_t *record\" \"uint8_t *utf8_string\" \"size_t utf8_string_size\" \"libevtx_error_t **error\"\n.Ft int\n.Fn libevtx_record_get_utf16_source_name_size \"libevtx_record_t *record\" \"size_t *utf16_string_size\" \"libevtx_error_t **error\"\n.Ft int\n.Fn libevtx_record_get_utf16_source_name \"libevtx_record_t *record\" \"uint16_t *utf16_string\" \"size_t utf16_string_size\" \"libevtx_error_t **error\"\n.Ft int\n.Fn libevtx_record_get_utf8_channel_name_size \"libevtx_record_t *record\" \"size_t *utf8_string_size\" \"libevtx_error_t **error\"\n.Ft int\n.Fn libevtx_record_get_utf8_channel_name \"libevtx_record_t *record\" \"uint8_t *utf8_string\" \"size_t utf8_string_size\" \"libevtx_error_t **error\"\n.Ft int\n.Fn libevtx_record_get_utf16_channel_name_size \"libevtx_record_t *record\" \"size_t *utf16_string_size\" \"libevtx_error_t **error\"\n.Ft int\n.Fn libevtx_record_get_utf16_channel_name \"libevtx_record_t *record\" \"uint16_t *utf16_string\" \"size_t utf16_string_size\" \"libevtx_error_t **error\"\n.Ft int\n.Fn libevtx_record_get_utf8_computer_name_size \"libevtx_record_t *record\" \"size_t *utf8_string_size\" \"libevtx_error_t **error\"\n.Ft int\n.Fn libevtx_record_get_utf8_computer_name \"libevtx_record_t *record\" \"uint8_t *utf8_string\" \"size_t utf8_string_size\" \"libevtx_error_t **error\"\n.Ft int\n.Fn libevtx_record_get_utf16_computer_name_size \"libevtx_record_t *record\" \"size_t *utf16_string_size\" \"libevtx_error_t **error\"\n.Ft int\n.Fn libevtx_record_get_utf16_computer_name \"libevtx_record_t *record\" \"uint16_t *utf16_string\" \"size_t utf16_string_size\" \"libevtx_error_t **error\"\n.Ft int\n.Fn libevtx_record_get_utf8_user_security_identifier_size \"libevtx_record_t *record\" \"size_t *utf8_string_size\" \"libevtx_error_t **error\"\n.Ft int\n.Fn libevtx_record_get_utf8_user_security_identifier \"libevtx_record_t *record\" \"uint8_t *utf8_string\" \"size_t utf8_string_size\" \"libevtx_error_t **error\"\n.Ft int\n.Fn libevtx_record_get_utf16_user_security_identifier_size \"libevtx_record_t *record\" \"size_t *utf16_string_size\" \"libevtx_error_t **error\"\n.Ft int\n.Fn libevtx_record_get_utf16_user_security_identifier \"libevtx_record_t *record\" \"uint16_t *utf16_string\" \"size_t utf16_string_size\" \"libevtx_error_t **error\"\n.Ft int\n.Fn libevtx_record_parse_data_with_template_definition \"libevtx_record_t *record\" \"libevtx_template_definition_t *template_definition\" \"libevtx_error_t **error\"\n.Ft int\n.Fn libevtx_record_get_number_of_strings \"libevtx_record_t *record\" \"int *number_of_strings\" \"libevtx_error_t **error\"\n.Ft int\n.Fn libevtx_record_get_utf8_string_size \"libevtx_record_t *record\" \"int string_index\" \"size_t *utf8_string_size\" \"libevtx_error_t **error\"\n.Ft int\n.Fn libevtx_record_get_utf8_string \"libevtx_record_t *record\" \"int string_index\" \"uint8_t *utf8_string\" \"size_t utf8_string_size\" \"libevtx_error_t **error\"\n.Ft int\n.Fn libevtx_record_get_utf16_string_size \"libevtx_record_t *record\" \"int string_index\" \"size_t *utf16_string_size\" \"libevtx_error_t **error\"\n.Ft int\n.Fn libevtx_record_get_utf16_string \"libevtx_record_t *record\" \"int string_index\" \"uint16_t *utf16_string\" \"size_t utf16_string_size\" \"libevtx_error_t **error\"\n.Ft int\n.Fn libevtx_record_get_data_size \"libevtx_record_t *record\" \"size_t *data_size\" \"libevtx_error_t **error\"\n.Ft int\n.Fn libevtx_record_get_data \"libevtx_record_t *record\" \"uint8_t *data\" \"size_t data_size\" \"libevtx_error_t **error\"\n.Ft int\n.Fn libevtx_record_get_utf8_xml_string_size \"libevtx_record_t *record\" \"size_t *utf8_string_size\" \"libevtx_error_t **error\"\n.Ft int\n.Fn libevtx_record_get_utf8_xml_string \"libevtx_record_t *record\" \"uint8_t *utf8_string\" \"size_t utf8_string_size\" \"libevtx_error_t **error\"\n.Ft int\n.Fn libevtx_record_get_utf16_xml_string_size \"libevtx_record_t *record\" \"size_t *utf16_string_size\" \"libevtx_error_t **error\"\n.Ft int\n.Fn libevtx_record_get_utf16_xml_string \"libevtx_record_t *record\" \"uint16_t *utf16_string\" \"size_t utf16_string_size\" \"libevtx_error_t **error\"\n.Pp\nTemplate definition functions\n.Ft int\n.Fn libevtx_template_definition_initialize \"libevtx_template_definition_t **template_definition\" \"libevtx_error_t **error\"\n.Ft int\n.Fn libevtx_template_definition_free \"libevtx_template_definition_t **template_definition\" \"libevtx_error_t **error\"\n.Ft int\n.Fn libevtx_template_definition_set_data \"libevtx_template_definition_t *template_definition\" \"const uint8_t *data\" \"size_t data_size\" \"uint32_t data_offset\" \"libevtx_error_t **error\"\n.Sh DESCRIPTION\nThe\n.Fn libevtx_get_version\nfunction is used to retrieve the library version.\n.Sh RETURN VALUES\nMost of the functions return NULL or \\-1 on error, dependent on the return type.\nFor the actual return values see \"libevtx.h\".\n.Sh ENVIRONMENT\nNone\n.Sh FILES\nNone\n.Sh NOTES\nlibevtx can be compiled with wide character support (wchar_t).\n.sp\nTo compile libevtx with wide character support use:\n.Ar ./configure --enable-wide-character-type=yes\n or define:\n.Ar _UNICODE\n or\n.Ar UNICODE\n during compilation.\n.sp\n.Ar LIBEVTX_WIDE_CHARACTER_TYPE\n in libevtx/features.h can be used to determine if libevtx was compiled with wide character support.\n.Sh BUGS\nPlease report bugs of any kind on the project issue tracker: https://github.com/libyal/libevtx/issues\n.Sh AUTHOR\nThese man pages are generated from \"libevtx.h\".\n.Sh COPYRIGHT\nCopyright (C) 2011-2025, Joachim Metz .\n.sp\nThis is free software; see the source for copying conditions.\nThere is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.\n.Sh SEE ALSO\nthe libevtx.h include file\n" }, { "path": "msvscpp/Makefile.am", "content": "MSVSCPP_FILES = \\\n\tevtx_test_chunk/evtx_test_chunk.vcproj \\\n\tevtx_test_chunks_table/evtx_test_chunks_table.vcproj \\\n\tevtx_test_error/evtx_test_error.vcproj \\\n\tevtx_test_file/evtx_test_file.vcproj \\\n\tevtx_test_io_handle/evtx_test_io_handle.vcproj \\\n\tevtx_test_notify/evtx_test_notify.vcproj \\\n\tevtx_test_record/evtx_test_record.vcproj \\\n\tevtx_test_record_values/evtx_test_record_values.vcproj \\\n\tevtx_test_support/evtx_test_support.vcproj \\\n\tevtx_test_template_definition/evtx_test_template_definition.vcproj \\\n\tevtx_test_tools_info_handle/evtx_test_tools_info_handle.vcproj \\\n\tevtx_test_tools_message_handle/evtx_test_tools_message_handle.vcproj \\\n\tevtx_test_tools_message_string/evtx_test_tools_message_string.vcproj \\\n\tevtx_test_tools_output/evtx_test_tools_output.vcproj \\\n\tevtx_test_tools_path_handle/evtx_test_tools_path_handle.vcproj \\\n\tevtx_test_tools_registry_file/evtx_test_tools_registry_file.vcproj \\\n\tevtx_test_tools_resource_file/evtx_test_tools_resource_file.vcproj \\\n\tevtx_test_tools_signal/evtx_test_tools_signal.vcproj \\\n\tevtxexport/evtxexport.vcproj \\\n\tevtxinfo/evtxinfo.vcproj \\\n\tlibbfio/libbfio.vcproj \\\n\tlibcdata/libcdata.vcproj \\\n\tlibcdirectory/libcdirectory.vcproj \\\n\tlibcerror/libcerror.vcproj \\\n\tlibcfile/libcfile.vcproj \\\n\tlibclocale/libclocale.vcproj \\\n\tlibcnotify/libcnotify.vcproj \\\n\tlibcpath/libcpath.vcproj \\\n\tlibcsplit/libcsplit.vcproj \\\n\tlibcthreads/libcthreads.vcproj \\\n\tlibevtx/libevtx.vcproj \\\n\tlibexe/libexe.vcproj \\\n\tlibfcache/libfcache.vcproj \\\n\tlibfdata/libfdata.vcproj \\\n\tlibfdatetime/libfdatetime.vcproj \\\n\tlibfguid/libfguid.vcproj \\\n\tlibfvalue/libfvalue.vcproj \\\n\tlibfwevt/libfwevt.vcproj \\\n\tlibfwnt/libfwnt.vcproj \\\n\tlibregf/libregf.vcproj \\\n\tlibuna/libuna.vcproj \\\n\tlibwrc/libwrc.vcproj \\\n\tpyevtx/pyevtx.vcproj \\\n\tlibevtx.sln\n\nEXTRA_DIST = \\\n\t$(MSVSCPP_FILES)\n\nDISTCLEANFILES = \\\n\tMakefile \\\n\tMakefile.in\n\n" }, { "path": "msvscpp/evtx_test_chunk/evtx_test_chunk.vcproj", "content": "\r\n\r\n\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\r\n" }, { "path": "msvscpp/evtx_test_chunks_table/evtx_test_chunks_table.vcproj", "content": "\r\n\r\n\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\r\n" }, { "path": "msvscpp/evtx_test_error/evtx_test_error.vcproj", "content": "\r\n\r\n\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\r\n" }, { "path": "msvscpp/evtx_test_file/evtx_test_file.vcproj", "content": "\r\n\r\n\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\r\n" }, { "path": "msvscpp/evtx_test_io_handle/evtx_test_io_handle.vcproj", "content": "\r\n\r\n\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\r\n" }, { "path": "msvscpp/evtx_test_notify/evtx_test_notify.vcproj", "content": "\r\n\r\n\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\r\n" }, { "path": "msvscpp/evtx_test_record/evtx_test_record.vcproj", "content": "\r\n\r\n\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\r\n" }, { "path": "msvscpp/evtx_test_record_values/evtx_test_record_values.vcproj", "content": "\r\n\r\n\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\r\n" }, { "path": "msvscpp/evtx_test_support/evtx_test_support.vcproj", "content": "\r\n\r\n\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\r\n" }, { "path": "msvscpp/evtx_test_template_definition/evtx_test_template_definition.vcproj", "content": "\r\n\r\n\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\r\n" }, { "path": "msvscpp/evtx_test_tools_info_handle/evtx_test_tools_info_handle.vcproj", "content": "\r\n\r\n\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\r\n" }, { "path": "msvscpp/evtx_test_tools_message_handle/evtx_test_tools_message_handle.vcproj", "content": "\r\n\r\n\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\r\n" }, { "path": "msvscpp/evtx_test_tools_message_string/evtx_test_tools_message_string.vcproj", "content": "\r\n\r\n\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\r\n" }, { "path": "msvscpp/evtx_test_tools_output/evtx_test_tools_output.vcproj", "content": "\r\n\r\n\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\r\n" }, { "path": "msvscpp/evtx_test_tools_path_handle/evtx_test_tools_path_handle.vcproj", "content": "\r\n\r\n\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\r\n" }, { "path": "msvscpp/evtx_test_tools_registry_file/evtx_test_tools_registry_file.vcproj", "content": "\r\n\r\n\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\r\n" }, { "path": "msvscpp/evtx_test_tools_resource_file/evtx_test_tools_resource_file.vcproj", "content": "\r\n\r\n\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\r\n" }, { "path": "msvscpp/evtx_test_tools_signal/evtx_test_tools_signal.vcproj", "content": "\r\n\r\n\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\r\n" }, { "path": "msvscpp/evtxexport/evtxexport.vcproj", "content": "\r\n\r\n\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\r\n" }, { "path": "msvscpp/evtxinfo/evtxinfo.vcproj", "content": "\r\n\r\n\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\r\n" }, { "path": "msvscpp/libbfio/libbfio.vcproj", "content": "\r\n\r\n\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\r\n" }, { "path": "msvscpp/libcdata/libcdata.vcproj", "content": "\r\n\r\n\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\r\n" }, { "path": "msvscpp/libcdirectory/libcdirectory.vcproj", "content": "\r\n\r\n\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\r\n" }, { "path": "msvscpp/libcerror/libcerror.vcproj", "content": "\r\n\r\n\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\r\n" }, { "path": "msvscpp/libcfile/libcfile.vcproj", "content": "\r\n\r\n\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\r\n" }, { "path": "msvscpp/libclocale/libclocale.vcproj", "content": "\r\n\r\n\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\r\n" }, { "path": "msvscpp/libcnotify/libcnotify.vcproj", "content": "\r\n\r\n\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\r\n" }, { "path": "msvscpp/libcpath/libcpath.vcproj", "content": "\r\n\r\n\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\r\n" }, { "path": "msvscpp/libcsplit/libcsplit.vcproj", "content": "\r\n\r\n\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\r\n" }, { "path": "msvscpp/libcthreads/libcthreads.vcproj", "content": "\r\n\r\n\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\r\n" }, { "path": "msvscpp/libevtx/libevtx.vcproj", "content": "\r\n\r\n\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\r\n" }, { "path": "msvscpp/libevtx.sln", "content": "\r\nMicrosoft Visual Studio Solution File, Format Version 10.00\r\n# Visual C++ Express 2008\r\nProject(\"{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}\") = \"libfdata\", \"libfdata\\libfdata.vcproj\", \"{AABC80BB-79B3-49BA-8A90-9AAC2A3B404F}\"\r\n\tProjectSection(ProjectDependencies) = postProject\r\n\t\t{5299814A-9BDD-4F91-ADF9-723068B3B642} = {5299814A-9BDD-4F91-ADF9-723068B3B642}\r\n\t\t{48D8ABE8-71E3-4C29-A265-138C36783578} = {48D8ABE8-71E3-4C29-A265-138C36783578}\r\n\t\t{55652C23-9FE0-4E5B-930C-C3675C980351} = {55652C23-9FE0-4E5B-930C-C3675C980351}\r\n\t\t{E31E45A2-E02E-49E7-843B-F390127F1184} = {E31E45A2-E02E-49E7-843B-F390127F1184}\r\n\t\t{4B4599D2-DBF5-4E0A-9669-94032C1320A9} = {4B4599D2-DBF5-4E0A-9669-94032C1320A9}\r\n\tEndProjectSection\r\nEndProject\r\nProject(\"{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}\") = \"libexe\", \"libexe\\libexe.vcproj\", \"{D9D3120F-1242-4538-82CD-A99B1BC9A3DF}\"\r\n\tProjectSection(ProjectDependencies) = postProject\r\n\t\t{5299814A-9BDD-4F91-ADF9-723068B3B642} = {5299814A-9BDD-4F91-ADF9-723068B3B642}\r\n\t\t{48D8ABE8-71E3-4C29-A265-138C36783578} = {48D8ABE8-71E3-4C29-A265-138C36783578}\r\n\t\t{55652C23-9FE0-4E5B-930C-C3675C980351} = {55652C23-9FE0-4E5B-930C-C3675C980351}\r\n\t\t{754A36B3-E1DC-4975-89E4-EF0D82ACBC3B} = {754A36B3-E1DC-4975-89E4-EF0D82ACBC3B}\r\n\t\t{E31E45A2-E02E-49E7-843B-F390127F1184} = {E31E45A2-E02E-49E7-843B-F390127F1184}\r\n\t\t{A352758D-DD49-406B-81F3-FC8494D52B88} = {A352758D-DD49-406B-81F3-FC8494D52B88}\r\n\t\t{40BA88AF-9923-4FC6-8466-CB5833843AC4} = {40BA88AF-9923-4FC6-8466-CB5833843AC4}\r\n\t\t{3AF383AB-F184-4190-84DF-453ACE4CA89D} = {3AF383AB-F184-4190-84DF-453ACE4CA89D}\r\n\t\t{6FB36D12-30F9-49F5-B4B6-2E58C4390438} = {6FB36D12-30F9-49F5-B4B6-2E58C4390438}\r\n\t\t{7A4327FF-CA12-4A1A-A7CF-5328BDAA9942} = {7A4327FF-CA12-4A1A-A7CF-5328BDAA9942}\r\n\t\t{4B4599D2-DBF5-4E0A-9669-94032C1320A9} = {4B4599D2-DBF5-4E0A-9669-94032C1320A9}\r\n\t\t{AABC80BB-79B3-49BA-8A90-9AAC2A3B404F} = {AABC80BB-79B3-49BA-8A90-9AAC2A3B404F}\r\n\t\t{F6707C74-BCE0-40FC-9900-DDA579029FBA} = {F6707C74-BCE0-40FC-9900-DDA579029FBA}\r\n\tEndProjectSection\r\nEndProject\r\nProject(\"{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}\") = \"evtxexport\", \"evtxexport\\evtxexport.vcproj\", \"{4C0A33FC-0B42-4735-B5C9-EA49F17A9478}\"\r\n\tProjectSection(ProjectDependencies) = postProject\r\n\t\t{7F42F80A-6FE8-4634-8455-5D08A1E24BAA} = {7F42F80A-6FE8-4634-8455-5D08A1E24BAA}\r\n\t\t{B5E43F96-E790-4DBA-8891-4A14E7183D9A} = {B5E43F96-E790-4DBA-8891-4A14E7183D9A}\r\n\t\t{D9D3120F-1242-4538-82CD-A99B1BC9A3DF} = {D9D3120F-1242-4538-82CD-A99B1BC9A3DF}\r\n\t\t{35A5D4B4-775C-40E3-B364-19562437CD80} = {35A5D4B4-775C-40E3-B364-19562437CD80}\r\n\t\t{1D7A10ED-2939-4C11-BAA0-D37C2A8CD6F7} = {1D7A10ED-2939-4C11-BAA0-D37C2A8CD6F7}\r\n\t\t{C6DCD3D9-4397-466E-AC94-49A590DA0EC6} = {C6DCD3D9-4397-466E-AC94-49A590DA0EC6}\r\n\t\t{9C232121-5F91-4559-A4F5-AAFAB5BDE0FC} = {9C232121-5F91-4559-A4F5-AAFAB5BDE0FC}\r\n\t\t{F6707C74-BCE0-40FC-9900-DDA579029FBA} = {F6707C74-BCE0-40FC-9900-DDA579029FBA}\r\n\t\t{AABC80BB-79B3-49BA-8A90-9AAC2A3B404F} = {AABC80BB-79B3-49BA-8A90-9AAC2A3B404F}\r\n\t\t{4B4599D2-DBF5-4E0A-9669-94032C1320A9} = {4B4599D2-DBF5-4E0A-9669-94032C1320A9}\r\n\t\t{7A4327FF-CA12-4A1A-A7CF-5328BDAA9942} = {7A4327FF-CA12-4A1A-A7CF-5328BDAA9942}\r\n\t\t{6FB36D12-30F9-49F5-B4B6-2E58C4390438} = {6FB36D12-30F9-49F5-B4B6-2E58C4390438}\r\n\t\t{3AF383AB-F184-4190-84DF-453ACE4CA89D} = {3AF383AB-F184-4190-84DF-453ACE4CA89D}\r\n\t\t{62C67404-7985-4120-85BA-3C0424784434} = {62C67404-7985-4120-85BA-3C0424784434}\r\n\t\t{40BA88AF-9923-4FC6-8466-CB5833843AC4} = {40BA88AF-9923-4FC6-8466-CB5833843AC4}\r\n\t\t{A352758D-DD49-406B-81F3-FC8494D52B88} = {A352758D-DD49-406B-81F3-FC8494D52B88}\r\n\t\t{E31E45A2-E02E-49E7-843B-F390127F1184} = {E31E45A2-E02E-49E7-843B-F390127F1184}\r\n\t\t{754A36B3-E1DC-4975-89E4-EF0D82ACBC3B} = {754A36B3-E1DC-4975-89E4-EF0D82ACBC3B}\r\n\t\t{55652C23-9FE0-4E5B-930C-C3675C980351} = {55652C23-9FE0-4E5B-930C-C3675C980351}\r\n\t\t{91D35439-5C77-4084-B94A-45B055A97971} = {91D35439-5C77-4084-B94A-45B055A97971}\r\n\t\t{48D8ABE8-71E3-4C29-A265-138C36783578} = {48D8ABE8-71E3-4C29-A265-138C36783578}\r\n\t\t{5299814A-9BDD-4F91-ADF9-723068B3B642} = {5299814A-9BDD-4F91-ADF9-723068B3B642}\r\n\tEndProjectSection\r\nEndProject\r\nProject(\"{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}\") = \"evtxinfo\", \"evtxinfo\\evtxinfo.vcproj\", \"{0D975F50-1FE8-498E-B597-9960DFC995AC}\"\r\n\tProjectSection(ProjectDependencies) = postProject\r\n\t\t{40BA88AF-9923-4FC6-8466-CB5833843AC4} = {40BA88AF-9923-4FC6-8466-CB5833843AC4}\r\n\t\t{A352758D-DD49-406B-81F3-FC8494D52B88} = {A352758D-DD49-406B-81F3-FC8494D52B88}\r\n\t\t{E31E45A2-E02E-49E7-843B-F390127F1184} = {E31E45A2-E02E-49E7-843B-F390127F1184}\r\n\t\t{754A36B3-E1DC-4975-89E4-EF0D82ACBC3B} = {754A36B3-E1DC-4975-89E4-EF0D82ACBC3B}\r\n\t\t{91D35439-5C77-4084-B94A-45B055A97971} = {91D35439-5C77-4084-B94A-45B055A97971}\r\n\t\t{48D8ABE8-71E3-4C29-A265-138C36783578} = {48D8ABE8-71E3-4C29-A265-138C36783578}\r\n\t\t{5299814A-9BDD-4F91-ADF9-723068B3B642} = {5299814A-9BDD-4F91-ADF9-723068B3B642}\r\n\tEndProjectSection\r\nEndProject\r\nProject(\"{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}\") = \"pyevtx\", \"pyevtx\\pyevtx.vcproj\", \"{2D239718-8401-4E75-88FD-E81DF267543A}\"\r\n\tProjectSection(ProjectDependencies) = postProject\r\n\t\t{5299814A-9BDD-4F91-ADF9-723068B3B642} = {5299814A-9BDD-4F91-ADF9-723068B3B642}\r\n\t\t{91D35439-5C77-4084-B94A-45B055A97971} = {91D35439-5C77-4084-B94A-45B055A97971}\r\n\t\t{55652C23-9FE0-4E5B-930C-C3675C980351} = {55652C23-9FE0-4E5B-930C-C3675C980351}\r\n\t\t{754A36B3-E1DC-4975-89E4-EF0D82ACBC3B} = {754A36B3-E1DC-4975-89E4-EF0D82ACBC3B}\r\n\t\t{A352758D-DD49-406B-81F3-FC8494D52B88} = {A352758D-DD49-406B-81F3-FC8494D52B88}\r\n\t\t{40BA88AF-9923-4FC6-8466-CB5833843AC4} = {40BA88AF-9923-4FC6-8466-CB5833843AC4}\r\n\t\t{3AF383AB-F184-4190-84DF-453ACE4CA89D} = {3AF383AB-F184-4190-84DF-453ACE4CA89D}\r\n\t\t{6FB36D12-30F9-49F5-B4B6-2E58C4390438} = {6FB36D12-30F9-49F5-B4B6-2E58C4390438}\r\n\t\t{7A4327FF-CA12-4A1A-A7CF-5328BDAA9942} = {7A4327FF-CA12-4A1A-A7CF-5328BDAA9942}\r\n\tEndProjectSection\r\nEndProject\r\nProject(\"{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}\") = \"libregf\", \"libregf\\libregf.vcproj\", \"{7F42F80A-6FE8-4634-8455-5D08A1E24BAA}\"\r\n\tProjectSection(ProjectDependencies) = postProject\r\n\t\t{5299814A-9BDD-4F91-ADF9-723068B3B642} = {5299814A-9BDD-4F91-ADF9-723068B3B642}\r\n\t\t{48D8ABE8-71E3-4C29-A265-138C36783578} = {48D8ABE8-71E3-4C29-A265-138C36783578}\r\n\t\t{55652C23-9FE0-4E5B-930C-C3675C980351} = {55652C23-9FE0-4E5B-930C-C3675C980351}\r\n\t\t{754A36B3-E1DC-4975-89E4-EF0D82ACBC3B} = {754A36B3-E1DC-4975-89E4-EF0D82ACBC3B}\r\n\t\t{E31E45A2-E02E-49E7-843B-F390127F1184} = {E31E45A2-E02E-49E7-843B-F390127F1184}\r\n\t\t{A352758D-DD49-406B-81F3-FC8494D52B88} = {A352758D-DD49-406B-81F3-FC8494D52B88}\r\n\t\t{40BA88AF-9923-4FC6-8466-CB5833843AC4} = {40BA88AF-9923-4FC6-8466-CB5833843AC4}\r\n\t\t{3AF383AB-F184-4190-84DF-453ACE4CA89D} = {3AF383AB-F184-4190-84DF-453ACE4CA89D}\r\n\t\t{6FB36D12-30F9-49F5-B4B6-2E58C4390438} = {6FB36D12-30F9-49F5-B4B6-2E58C4390438}\r\n\t\t{7A4327FF-CA12-4A1A-A7CF-5328BDAA9942} = {7A4327FF-CA12-4A1A-A7CF-5328BDAA9942}\r\n\t\t{4B4599D2-DBF5-4E0A-9669-94032C1320A9} = {4B4599D2-DBF5-4E0A-9669-94032C1320A9}\r\n\t\t{AABC80BB-79B3-49BA-8A90-9AAC2A3B404F} = {AABC80BB-79B3-49BA-8A90-9AAC2A3B404F}\r\n\t\t{F6707C74-BCE0-40FC-9900-DDA579029FBA} = {F6707C74-BCE0-40FC-9900-DDA579029FBA}\r\n\t\t{1D7A10ED-2939-4C11-BAA0-D37C2A8CD6F7} = {1D7A10ED-2939-4C11-BAA0-D37C2A8CD6F7}\r\n\tEndProjectSection\r\nEndProject\r\nProject(\"{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}\") = \"libfguid\", \"libfguid\\libfguid.vcproj\", \"{9C232121-5F91-4559-A4F5-AAFAB5BDE0FC}\"\r\n\tProjectSection(ProjectDependencies) = postProject\r\n\t\t{5299814A-9BDD-4F91-ADF9-723068B3B642} = {5299814A-9BDD-4F91-ADF9-723068B3B642}\r\n\tEndProjectSection\r\nEndProject\r\nProject(\"{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}\") = \"libclocale\", \"libclocale\\libclocale.vcproj\", \"{754A36B3-E1DC-4975-89E4-EF0D82ACBC3B}\"\r\n\tProjectSection(ProjectDependencies) = postProject\r\n\t\t{5299814A-9BDD-4F91-ADF9-723068B3B642} = {5299814A-9BDD-4F91-ADF9-723068B3B642}\r\n\tEndProjectSection\r\nEndProject\r\nProject(\"{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}\") = \"libfcache\", \"libfcache\\libfcache.vcproj\", \"{4B4599D2-DBF5-4E0A-9669-94032C1320A9}\"\r\n\tProjectSection(ProjectDependencies) = postProject\r\n\t\t{5299814A-9BDD-4F91-ADF9-723068B3B642} = {5299814A-9BDD-4F91-ADF9-723068B3B642}\r\n\t\t{48D8ABE8-71E3-4C29-A265-138C36783578} = {48D8ABE8-71E3-4C29-A265-138C36783578}\r\n\t\t{55652C23-9FE0-4E5B-930C-C3675C980351} = {55652C23-9FE0-4E5B-930C-C3675C980351}\r\n\tEndProjectSection\r\nEndProject\r\nProject(\"{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}\") = \"libbfio\", \"libbfio\\libbfio.vcproj\", \"{7A4327FF-CA12-4A1A-A7CF-5328BDAA9942}\"\r\n\tProjectSection(ProjectDependencies) = postProject\r\n\t\t{5299814A-9BDD-4F91-ADF9-723068B3B642} = {5299814A-9BDD-4F91-ADF9-723068B3B642}\r\n\t\t{48D8ABE8-71E3-4C29-A265-138C36783578} = {48D8ABE8-71E3-4C29-A265-138C36783578}\r\n\t\t{754A36B3-E1DC-4975-89E4-EF0D82ACBC3B} = {754A36B3-E1DC-4975-89E4-EF0D82ACBC3B}\r\n\t\t{E31E45A2-E02E-49E7-843B-F390127F1184} = {E31E45A2-E02E-49E7-843B-F390127F1184}\r\n\t\t{55652C23-9FE0-4E5B-930C-C3675C980351} = {55652C23-9FE0-4E5B-930C-C3675C980351}\r\n\t\t{A352758D-DD49-406B-81F3-FC8494D52B88} = {A352758D-DD49-406B-81F3-FC8494D52B88}\r\n\t\t{3AF383AB-F184-4190-84DF-453ACE4CA89D} = {3AF383AB-F184-4190-84DF-453ACE4CA89D}\r\n\t\t{6FB36D12-30F9-49F5-B4B6-2E58C4390438} = {6FB36D12-30F9-49F5-B4B6-2E58C4390438}\r\n\t\t{40BA88AF-9923-4FC6-8466-CB5833843AC4} = {40BA88AF-9923-4FC6-8466-CB5833843AC4}\r\n\tEndProjectSection\r\nEndProject\r\nProject(\"{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}\") = \"libfwevt\", \"libfwevt\\libfwevt.vcproj\", \"{C6DCD3D9-4397-466E-AC94-49A590DA0EC6}\"\r\n\tProjectSection(ProjectDependencies) = postProject\r\n\t\t{5299814A-9BDD-4F91-ADF9-723068B3B642} = {5299814A-9BDD-4F91-ADF9-723068B3B642}\r\n\t\t{48D8ABE8-71E3-4C29-A265-138C36783578} = {48D8ABE8-71E3-4C29-A265-138C36783578}\r\n\t\t{55652C23-9FE0-4E5B-930C-C3675C980351} = {55652C23-9FE0-4E5B-930C-C3675C980351}\r\n\t\t{E31E45A2-E02E-49E7-843B-F390127F1184} = {E31E45A2-E02E-49E7-843B-F390127F1184}\r\n\t\t{F6707C74-BCE0-40FC-9900-DDA579029FBA} = {F6707C74-BCE0-40FC-9900-DDA579029FBA}\r\n\t\t{9C232121-5F91-4559-A4F5-AAFAB5BDE0FC} = {9C232121-5F91-4559-A4F5-AAFAB5BDE0FC}\r\n\t\t{35A5D4B4-775C-40E3-B364-19562437CD80} = {35A5D4B4-775C-40E3-B364-19562437CD80}\r\n\t\t{40BA88AF-9923-4FC6-8466-CB5833843AC4} = {40BA88AF-9923-4FC6-8466-CB5833843AC4}\r\n\tEndProjectSection\r\nEndProject\r\nProject(\"{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}\") = \"libcfile\", \"libcfile\\libcfile.vcproj\", \"{3AF383AB-F184-4190-84DF-453ACE4CA89D}\"\r\n\tProjectSection(ProjectDependencies) = postProject\r\n\t\t{5299814A-9BDD-4F91-ADF9-723068B3B642} = {5299814A-9BDD-4F91-ADF9-723068B3B642}\r\n\t\t{754A36B3-E1DC-4975-89E4-EF0D82ACBC3B} = {754A36B3-E1DC-4975-89E4-EF0D82ACBC3B}\r\n\t\t{E31E45A2-E02E-49E7-843B-F390127F1184} = {E31E45A2-E02E-49E7-843B-F390127F1184}\r\n\t\t{40BA88AF-9923-4FC6-8466-CB5833843AC4} = {40BA88AF-9923-4FC6-8466-CB5833843AC4}\r\n\tEndProjectSection\r\nEndProject\r\nProject(\"{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}\") = \"libwrc\", \"libwrc\\libwrc.vcproj\", \"{B5E43F96-E790-4DBA-8891-4A14E7183D9A}\"\r\n\tProjectSection(ProjectDependencies) = postProject\r\n\t\t{5299814A-9BDD-4F91-ADF9-723068B3B642} = {5299814A-9BDD-4F91-ADF9-723068B3B642}\r\n\t\t{48D8ABE8-71E3-4C29-A265-138C36783578} = {48D8ABE8-71E3-4C29-A265-138C36783578}\r\n\t\t{55652C23-9FE0-4E5B-930C-C3675C980351} = {55652C23-9FE0-4E5B-930C-C3675C980351}\r\n\t\t{754A36B3-E1DC-4975-89E4-EF0D82ACBC3B} = {754A36B3-E1DC-4975-89E4-EF0D82ACBC3B}\r\n\t\t{E31E45A2-E02E-49E7-843B-F390127F1184} = {E31E45A2-E02E-49E7-843B-F390127F1184}\r\n\t\t{A352758D-DD49-406B-81F3-FC8494D52B88} = {A352758D-DD49-406B-81F3-FC8494D52B88}\r\n\t\t{40BA88AF-9923-4FC6-8466-CB5833843AC4} = {40BA88AF-9923-4FC6-8466-CB5833843AC4}\r\n\t\t{3AF383AB-F184-4190-84DF-453ACE4CA89D} = {3AF383AB-F184-4190-84DF-453ACE4CA89D}\r\n\t\t{6FB36D12-30F9-49F5-B4B6-2E58C4390438} = {6FB36D12-30F9-49F5-B4B6-2E58C4390438}\r\n\t\t{7A4327FF-CA12-4A1A-A7CF-5328BDAA9942} = {7A4327FF-CA12-4A1A-A7CF-5328BDAA9942}\r\n\t\t{4B4599D2-DBF5-4E0A-9669-94032C1320A9} = {4B4599D2-DBF5-4E0A-9669-94032C1320A9}\r\n\t\t{AABC80BB-79B3-49BA-8A90-9AAC2A3B404F} = {AABC80BB-79B3-49BA-8A90-9AAC2A3B404F}\r\n\t\t{F6707C74-BCE0-40FC-9900-DDA579029FBA} = {F6707C74-BCE0-40FC-9900-DDA579029FBA}\r\n\t\t{9C232121-5F91-4559-A4F5-AAFAB5BDE0FC} = {9C232121-5F91-4559-A4F5-AAFAB5BDE0FC}\r\n\t\t{35A5D4B4-775C-40E3-B364-19562437CD80} = {35A5D4B4-775C-40E3-B364-19562437CD80}\r\n\t\t{1D7A10ED-2939-4C11-BAA0-D37C2A8CD6F7} = {1D7A10ED-2939-4C11-BAA0-D37C2A8CD6F7}\r\n\tEndProjectSection\r\nEndProject\r\nProject(\"{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}\") = \"libcdata\", \"libcdata\\libcdata.vcproj\", \"{55652C23-9FE0-4E5B-930C-C3675C980351}\"\r\n\tProjectSection(ProjectDependencies) = postProject\r\n\t\t{5299814A-9BDD-4F91-ADF9-723068B3B642} = {5299814A-9BDD-4F91-ADF9-723068B3B642}\r\n\t\t{48D8ABE8-71E3-4C29-A265-138C36783578} = {48D8ABE8-71E3-4C29-A265-138C36783578}\r\n\tEndProjectSection\r\nEndProject\r\nProject(\"{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}\") = \"libcthreads\", \"libcthreads\\libcthreads.vcproj\", \"{48D8ABE8-71E3-4C29-A265-138C36783578}\"\r\n\tProjectSection(ProjectDependencies) = postProject\r\n\t\t{5299814A-9BDD-4F91-ADF9-723068B3B642} = {5299814A-9BDD-4F91-ADF9-723068B3B642}\r\n\tEndProjectSection\r\nEndProject\r\nProject(\"{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}\") = \"libcpath\", \"libcpath\\libcpath.vcproj\", \"{6FB36D12-30F9-49F5-B4B6-2E58C4390438}\"\r\n\tProjectSection(ProjectDependencies) = postProject\r\n\t\t{5299814A-9BDD-4F91-ADF9-723068B3B642} = {5299814A-9BDD-4F91-ADF9-723068B3B642}\r\n\t\t{754A36B3-E1DC-4975-89E4-EF0D82ACBC3B} = {754A36B3-E1DC-4975-89E4-EF0D82ACBC3B}\r\n\t\t{A352758D-DD49-406B-81F3-FC8494D52B88} = {A352758D-DD49-406B-81F3-FC8494D52B88}\r\n\t\t{40BA88AF-9923-4FC6-8466-CB5833843AC4} = {40BA88AF-9923-4FC6-8466-CB5833843AC4}\r\n\tEndProjectSection\r\nEndProject\r\nProject(\"{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}\") = \"evtx_test_chunk\", \"evtx_test_chunk\\evtx_test_chunk.vcproj\", \"{D840C869-2266-4422-BD66-CAF20CED4832}\"\r\n\tProjectSection(ProjectDependencies) = postProject\r\n\t\t{91D35439-5C77-4084-B94A-45B055A97971} = {91D35439-5C77-4084-B94A-45B055A97971}\r\n\t\t{5299814A-9BDD-4F91-ADF9-723068B3B642} = {5299814A-9BDD-4F91-ADF9-723068B3B642}\r\n\tEndProjectSection\r\nEndProject\r\nProject(\"{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}\") = \"evtx_test_chunks_table\", \"evtx_test_chunks_table\\evtx_test_chunks_table.vcproj\", \"{2AE899E9-29D4-4921-9B34-470BD450ADDB}\"\r\n\tProjectSection(ProjectDependencies) = postProject\r\n\t\t{91D35439-5C77-4084-B94A-45B055A97971} = {91D35439-5C77-4084-B94A-45B055A97971}\r\n\t\t{5299814A-9BDD-4F91-ADF9-723068B3B642} = {5299814A-9BDD-4F91-ADF9-723068B3B642}\r\n\tEndProjectSection\r\nEndProject\r\nProject(\"{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}\") = \"evtx_test_error\", \"evtx_test_error\\evtx_test_error.vcproj\", \"{D5374706-39C2-43A0-BCEA-D4A5B3F7E452}\"\r\n\tProjectSection(ProjectDependencies) = postProject\r\n\t\t{91D35439-5C77-4084-B94A-45B055A97971} = {91D35439-5C77-4084-B94A-45B055A97971}\r\n\tEndProjectSection\r\nEndProject\r\nProject(\"{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}\") = \"evtx_test_file\", \"evtx_test_file\\evtx_test_file.vcproj\", \"{EE2C5CA8-AD6D-43FD-94F5-5711BA1007EB}\"\r\n\tProjectSection(ProjectDependencies) = postProject\r\n\t\t{7A4327FF-CA12-4A1A-A7CF-5328BDAA9942} = {7A4327FF-CA12-4A1A-A7CF-5328BDAA9942}\r\n\t\t{6FB36D12-30F9-49F5-B4B6-2E58C4390438} = {6FB36D12-30F9-49F5-B4B6-2E58C4390438}\r\n\t\t{3AF383AB-F184-4190-84DF-453ACE4CA89D} = {3AF383AB-F184-4190-84DF-453ACE4CA89D}\r\n\t\t{40BA88AF-9923-4FC6-8466-CB5833843AC4} = {40BA88AF-9923-4FC6-8466-CB5833843AC4}\r\n\t\t{A352758D-DD49-406B-81F3-FC8494D52B88} = {A352758D-DD49-406B-81F3-FC8494D52B88}\r\n\t\t{E31E45A2-E02E-49E7-843B-F390127F1184} = {E31E45A2-E02E-49E7-843B-F390127F1184}\r\n\t\t{754A36B3-E1DC-4975-89E4-EF0D82ACBC3B} = {754A36B3-E1DC-4975-89E4-EF0D82ACBC3B}\r\n\t\t{55652C23-9FE0-4E5B-930C-C3675C980351} = {55652C23-9FE0-4E5B-930C-C3675C980351}\r\n\t\t{91D35439-5C77-4084-B94A-45B055A97971} = {91D35439-5C77-4084-B94A-45B055A97971}\r\n\t\t{48D8ABE8-71E3-4C29-A265-138C36783578} = {48D8ABE8-71E3-4C29-A265-138C36783578}\r\n\t\t{5299814A-9BDD-4F91-ADF9-723068B3B642} = {5299814A-9BDD-4F91-ADF9-723068B3B642}\r\n\tEndProjectSection\r\nEndProject\r\nProject(\"{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}\") = \"evtx_test_io_handle\", \"evtx_test_io_handle\\evtx_test_io_handle.vcproj\", \"{6ECA82D7-4570-4B9E-AF48-D3C7312912C8}\"\r\n\tProjectSection(ProjectDependencies) = postProject\r\n\t\t{91D35439-5C77-4084-B94A-45B055A97971} = {91D35439-5C77-4084-B94A-45B055A97971}\r\n\t\t{5299814A-9BDD-4F91-ADF9-723068B3B642} = {5299814A-9BDD-4F91-ADF9-723068B3B642}\r\n\tEndProjectSection\r\nEndProject\r\nProject(\"{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}\") = \"evtx_test_notify\", \"evtx_test_notify\\evtx_test_notify.vcproj\", \"{817CFF30-C20D-4B97-B144-0957548613D4}\"\r\n\tProjectSection(ProjectDependencies) = postProject\r\n\t\t{91D35439-5C77-4084-B94A-45B055A97971} = {91D35439-5C77-4084-B94A-45B055A97971}\r\n\t\t{5299814A-9BDD-4F91-ADF9-723068B3B642} = {5299814A-9BDD-4F91-ADF9-723068B3B642}\r\n\tEndProjectSection\r\nEndProject\r\nProject(\"{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}\") = \"evtx_test_record\", \"evtx_test_record\\evtx_test_record.vcproj\", \"{51C5C6C4-684E-4B2E-A220-3F177CD5D139}\"\r\n\tProjectSection(ProjectDependencies) = postProject\r\n\t\t{91D35439-5C77-4084-B94A-45B055A97971} = {91D35439-5C77-4084-B94A-45B055A97971}\r\n\t\t{5299814A-9BDD-4F91-ADF9-723068B3B642} = {5299814A-9BDD-4F91-ADF9-723068B3B642}\r\n\tEndProjectSection\r\nEndProject\r\nProject(\"{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}\") = \"evtx_test_record_values\", \"evtx_test_record_values\\evtx_test_record_values.vcproj\", \"{A73C40E8-0224-41D6-8FB0-C46CC44215B0}\"\r\n\tProjectSection(ProjectDependencies) = postProject\r\n\t\t{91D35439-5C77-4084-B94A-45B055A97971} = {91D35439-5C77-4084-B94A-45B055A97971}\r\n\t\t{5299814A-9BDD-4F91-ADF9-723068B3B642} = {5299814A-9BDD-4F91-ADF9-723068B3B642}\r\n\tEndProjectSection\r\nEndProject\r\nProject(\"{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}\") = \"evtx_test_support\", \"evtx_test_support\\evtx_test_support.vcproj\", \"{98244676-8D2C-4900-A8CA-E7357EA78844}\"\r\n\tProjectSection(ProjectDependencies) = postProject\r\n\t\t{7A4327FF-CA12-4A1A-A7CF-5328BDAA9942} = {7A4327FF-CA12-4A1A-A7CF-5328BDAA9942}\r\n\t\t{6FB36D12-30F9-49F5-B4B6-2E58C4390438} = {6FB36D12-30F9-49F5-B4B6-2E58C4390438}\r\n\t\t{3AF383AB-F184-4190-84DF-453ACE4CA89D} = {3AF383AB-F184-4190-84DF-453ACE4CA89D}\r\n\t\t{40BA88AF-9923-4FC6-8466-CB5833843AC4} = {40BA88AF-9923-4FC6-8466-CB5833843AC4}\r\n\t\t{A352758D-DD49-406B-81F3-FC8494D52B88} = {A352758D-DD49-406B-81F3-FC8494D52B88}\r\n\t\t{E31E45A2-E02E-49E7-843B-F390127F1184} = {E31E45A2-E02E-49E7-843B-F390127F1184}\r\n\t\t{754A36B3-E1DC-4975-89E4-EF0D82ACBC3B} = {754A36B3-E1DC-4975-89E4-EF0D82ACBC3B}\r\n\t\t{55652C23-9FE0-4E5B-930C-C3675C980351} = {55652C23-9FE0-4E5B-930C-C3675C980351}\r\n\t\t{91D35439-5C77-4084-B94A-45B055A97971} = {91D35439-5C77-4084-B94A-45B055A97971}\r\n\t\t{5299814A-9BDD-4F91-ADF9-723068B3B642} = {5299814A-9BDD-4F91-ADF9-723068B3B642}\r\n\tEndProjectSection\r\nEndProject\r\nProject(\"{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}\") = \"evtx_test_template_definition\", \"evtx_test_template_definition\\evtx_test_template_definition.vcproj\", \"{F7453089-EA30-4F71-9C6E-630C02E37383}\"\r\n\tProjectSection(ProjectDependencies) = postProject\r\n\t\t{91D35439-5C77-4084-B94A-45B055A97971} = {91D35439-5C77-4084-B94A-45B055A97971}\r\n\t\t{5299814A-9BDD-4F91-ADF9-723068B3B642} = {5299814A-9BDD-4F91-ADF9-723068B3B642}\r\n\tEndProjectSection\r\nEndProject\r\nProject(\"{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}\") = \"evtx_test_tools_info_handle\", \"evtx_test_tools_info_handle\\evtx_test_tools_info_handle.vcproj\", \"{BE305497-DE84-4503-BCAF-80C8D5C3F730}\"\r\n\tProjectSection(ProjectDependencies) = postProject\r\n\t\t{754A36B3-E1DC-4975-89E4-EF0D82ACBC3B} = {754A36B3-E1DC-4975-89E4-EF0D82ACBC3B}\r\n\t\t{91D35439-5C77-4084-B94A-45B055A97971} = {91D35439-5C77-4084-B94A-45B055A97971}\r\n\t\t{5299814A-9BDD-4F91-ADF9-723068B3B642} = {5299814A-9BDD-4F91-ADF9-723068B3B642}\r\n\tEndProjectSection\r\nEndProject\r\nProject(\"{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}\") = \"evtx_test_tools_message_handle\", \"evtx_test_tools_message_handle\\evtx_test_tools_message_handle.vcproj\", \"{073D74D4-5B99-49FE-863B-9DE654277681}\"\r\n\tProjectSection(ProjectDependencies) = postProject\r\n\t\t{B5E43F96-E790-4DBA-8891-4A14E7183D9A} = {B5E43F96-E790-4DBA-8891-4A14E7183D9A}\r\n\t\t{7F42F80A-6FE8-4634-8455-5D08A1E24BAA} = {7F42F80A-6FE8-4634-8455-5D08A1E24BAA}\r\n\t\t{D9D3120F-1242-4538-82CD-A99B1BC9A3DF} = {D9D3120F-1242-4538-82CD-A99B1BC9A3DF}\r\n\t\t{C6DCD3D9-4397-466E-AC94-49A590DA0EC6} = {C6DCD3D9-4397-466E-AC94-49A590DA0EC6}\r\n\t\t{35A5D4B4-775C-40E3-B364-19562437CD80} = {35A5D4B4-775C-40E3-B364-19562437CD80}\r\n\t\t{1D7A10ED-2939-4C11-BAA0-D37C2A8CD6F7} = {1D7A10ED-2939-4C11-BAA0-D37C2A8CD6F7}\r\n\t\t{9C232121-5F91-4559-A4F5-AAFAB5BDE0FC} = {9C232121-5F91-4559-A4F5-AAFAB5BDE0FC}\r\n\t\t{F6707C74-BCE0-40FC-9900-DDA579029FBA} = {F6707C74-BCE0-40FC-9900-DDA579029FBA}\r\n\t\t{AABC80BB-79B3-49BA-8A90-9AAC2A3B404F} = {AABC80BB-79B3-49BA-8A90-9AAC2A3B404F}\r\n\t\t{4B4599D2-DBF5-4E0A-9669-94032C1320A9} = {4B4599D2-DBF5-4E0A-9669-94032C1320A9}\r\n\t\t{7A4327FF-CA12-4A1A-A7CF-5328BDAA9942} = {7A4327FF-CA12-4A1A-A7CF-5328BDAA9942}\r\n\t\t{6FB36D12-30F9-49F5-B4B6-2E58C4390438} = {6FB36D12-30F9-49F5-B4B6-2E58C4390438}\r\n\t\t{3AF383AB-F184-4190-84DF-453ACE4CA89D} = {3AF383AB-F184-4190-84DF-453ACE4CA89D}\r\n\t\t{62C67404-7985-4120-85BA-3C0424784434} = {62C67404-7985-4120-85BA-3C0424784434}\r\n\t\t{40BA88AF-9923-4FC6-8466-CB5833843AC4} = {40BA88AF-9923-4FC6-8466-CB5833843AC4}\r\n\t\t{A352758D-DD49-406B-81F3-FC8494D52B88} = {A352758D-DD49-406B-81F3-FC8494D52B88}\r\n\t\t{E31E45A2-E02E-49E7-843B-F390127F1184} = {E31E45A2-E02E-49E7-843B-F390127F1184}\r\n\t\t{754A36B3-E1DC-4975-89E4-EF0D82ACBC3B} = {754A36B3-E1DC-4975-89E4-EF0D82ACBC3B}\r\n\t\t{55652C23-9FE0-4E5B-930C-C3675C980351} = {55652C23-9FE0-4E5B-930C-C3675C980351}\r\n\t\t{91D35439-5C77-4084-B94A-45B055A97971} = {91D35439-5C77-4084-B94A-45B055A97971}\r\n\t\t{5299814A-9BDD-4F91-ADF9-723068B3B642} = {5299814A-9BDD-4F91-ADF9-723068B3B642}\r\n\tEndProjectSection\r\nEndProject\r\nProject(\"{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}\") = \"evtx_test_tools_message_string\", \"evtx_test_tools_message_string\\evtx_test_tools_message_string.vcproj\", \"{04AD9DCE-819D-44A3-8645-D9967D9CACFC}\"\r\n\tProjectSection(ProjectDependencies) = postProject\r\n\t\t{B5E43F96-E790-4DBA-8891-4A14E7183D9A} = {B5E43F96-E790-4DBA-8891-4A14E7183D9A}\r\n\t\t{D9D3120F-1242-4538-82CD-A99B1BC9A3DF} = {D9D3120F-1242-4538-82CD-A99B1BC9A3DF}\r\n\t\t{C6DCD3D9-4397-466E-AC94-49A590DA0EC6} = {C6DCD3D9-4397-466E-AC94-49A590DA0EC6}\r\n\t\t{35A5D4B4-775C-40E3-B364-19562437CD80} = {35A5D4B4-775C-40E3-B364-19562437CD80}\r\n\t\t{1D7A10ED-2939-4C11-BAA0-D37C2A8CD6F7} = {1D7A10ED-2939-4C11-BAA0-D37C2A8CD6F7}\r\n\t\t{9C232121-5F91-4559-A4F5-AAFAB5BDE0FC} = {9C232121-5F91-4559-A4F5-AAFAB5BDE0FC}\r\n\t\t{F6707C74-BCE0-40FC-9900-DDA579029FBA} = {F6707C74-BCE0-40FC-9900-DDA579029FBA}\r\n\t\t{AABC80BB-79B3-49BA-8A90-9AAC2A3B404F} = {AABC80BB-79B3-49BA-8A90-9AAC2A3B404F}\r\n\t\t{7A4327FF-CA12-4A1A-A7CF-5328BDAA9942} = {7A4327FF-CA12-4A1A-A7CF-5328BDAA9942}\r\n\t\t{6FB36D12-30F9-49F5-B4B6-2E58C4390438} = {6FB36D12-30F9-49F5-B4B6-2E58C4390438}\r\n\t\t{3AF383AB-F184-4190-84DF-453ACE4CA89D} = {3AF383AB-F184-4190-84DF-453ACE4CA89D}\r\n\t\t{40BA88AF-9923-4FC6-8466-CB5833843AC4} = {40BA88AF-9923-4FC6-8466-CB5833843AC4}\r\n\t\t{A352758D-DD49-406B-81F3-FC8494D52B88} = {A352758D-DD49-406B-81F3-FC8494D52B88}\r\n\t\t{E31E45A2-E02E-49E7-843B-F390127F1184} = {E31E45A2-E02E-49E7-843B-F390127F1184}\r\n\t\t{754A36B3-E1DC-4975-89E4-EF0D82ACBC3B} = {754A36B3-E1DC-4975-89E4-EF0D82ACBC3B}\r\n\t\t{55652C23-9FE0-4E5B-930C-C3675C980351} = {55652C23-9FE0-4E5B-930C-C3675C980351}\r\n\t\t{91D35439-5C77-4084-B94A-45B055A97971} = {91D35439-5C77-4084-B94A-45B055A97971}\r\n\t\t{5299814A-9BDD-4F91-ADF9-723068B3B642} = {5299814A-9BDD-4F91-ADF9-723068B3B642}\r\n\tEndProjectSection\r\nEndProject\r\nProject(\"{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}\") = \"evtx_test_tools_output\", \"evtx_test_tools_output\\evtx_test_tools_output.vcproj\", \"{1A14908D-59D7-4894-87AA-50712BA07F64}\"\r\n\tProjectSection(ProjectDependencies) = postProject\r\n\t\t{91D35439-5C77-4084-B94A-45B055A97971} = {91D35439-5C77-4084-B94A-45B055A97971}\r\n\t\t{5299814A-9BDD-4F91-ADF9-723068B3B642} = {5299814A-9BDD-4F91-ADF9-723068B3B642}\r\n\tEndProjectSection\r\nEndProject\r\nProject(\"{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}\") = \"evtx_test_tools_path_handle\", \"evtx_test_tools_path_handle\\evtx_test_tools_path_handle.vcproj\", \"{D02450B3-A0A7-4CFB-9828-F8532D853D9E}\"\r\n\tProjectSection(ProjectDependencies) = postProject\r\n\t\t{62C67404-7985-4120-85BA-3C0424784434} = {62C67404-7985-4120-85BA-3C0424784434}\r\n\t\t{40BA88AF-9923-4FC6-8466-CB5833843AC4} = {40BA88AF-9923-4FC6-8466-CB5833843AC4}\r\n\t\t{754A36B3-E1DC-4975-89E4-EF0D82ACBC3B} = {754A36B3-E1DC-4975-89E4-EF0D82ACBC3B}\r\n\t\t{55652C23-9FE0-4E5B-930C-C3675C980351} = {55652C23-9FE0-4E5B-930C-C3675C980351}\r\n\t\t{91D35439-5C77-4084-B94A-45B055A97971} = {91D35439-5C77-4084-B94A-45B055A97971}\r\n\t\t{5299814A-9BDD-4F91-ADF9-723068B3B642} = {5299814A-9BDD-4F91-ADF9-723068B3B642}\r\n\tEndProjectSection\r\nEndProject\r\nProject(\"{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}\") = \"evtx_test_tools_registry_file\", \"evtx_test_tools_registry_file\\evtx_test_tools_registry_file.vcproj\", \"{D390DD8D-C393-4CB0-B623-48FC41D092BB}\"\r\n\tProjectSection(ProjectDependencies) = postProject\r\n\t\t{7F42F80A-6FE8-4634-8455-5D08A1E24BAA} = {7F42F80A-6FE8-4634-8455-5D08A1E24BAA}\r\n\t\t{AABC80BB-79B3-49BA-8A90-9AAC2A3B404F} = {AABC80BB-79B3-49BA-8A90-9AAC2A3B404F}\r\n\t\t{4B4599D2-DBF5-4E0A-9669-94032C1320A9} = {4B4599D2-DBF5-4E0A-9669-94032C1320A9}\r\n\t\t{7A4327FF-CA12-4A1A-A7CF-5328BDAA9942} = {7A4327FF-CA12-4A1A-A7CF-5328BDAA9942}\r\n\t\t{6FB36D12-30F9-49F5-B4B6-2E58C4390438} = {6FB36D12-30F9-49F5-B4B6-2E58C4390438}\r\n\t\t{3AF383AB-F184-4190-84DF-453ACE4CA89D} = {3AF383AB-F184-4190-84DF-453ACE4CA89D}\r\n\t\t{62C67404-7985-4120-85BA-3C0424784434} = {62C67404-7985-4120-85BA-3C0424784434}\r\n\t\t{40BA88AF-9923-4FC6-8466-CB5833843AC4} = {40BA88AF-9923-4FC6-8466-CB5833843AC4}\r\n\t\t{A352758D-DD49-406B-81F3-FC8494D52B88} = {A352758D-DD49-406B-81F3-FC8494D52B88}\r\n\t\t{E31E45A2-E02E-49E7-843B-F390127F1184} = {E31E45A2-E02E-49E7-843B-F390127F1184}\r\n\t\t{754A36B3-E1DC-4975-89E4-EF0D82ACBC3B} = {754A36B3-E1DC-4975-89E4-EF0D82ACBC3B}\r\n\t\t{55652C23-9FE0-4E5B-930C-C3675C980351} = {55652C23-9FE0-4E5B-930C-C3675C980351}\r\n\t\t{91D35439-5C77-4084-B94A-45B055A97971} = {91D35439-5C77-4084-B94A-45B055A97971}\r\n\t\t{5299814A-9BDD-4F91-ADF9-723068B3B642} = {5299814A-9BDD-4F91-ADF9-723068B3B642}\r\n\tEndProjectSection\r\nEndProject\r\nProject(\"{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}\") = \"evtx_test_tools_resource_file\", \"evtx_test_tools_resource_file\\evtx_test_tools_resource_file.vcproj\", \"{10D3FA6F-88E6-409E-B210-44E8515F8BA1}\"\r\n\tProjectSection(ProjectDependencies) = postProject\r\n\t\t{B5E43F96-E790-4DBA-8891-4A14E7183D9A} = {B5E43F96-E790-4DBA-8891-4A14E7183D9A}\r\n\t\t{D9D3120F-1242-4538-82CD-A99B1BC9A3DF} = {D9D3120F-1242-4538-82CD-A99B1BC9A3DF}\r\n\t\t{C6DCD3D9-4397-466E-AC94-49A590DA0EC6} = {C6DCD3D9-4397-466E-AC94-49A590DA0EC6}\r\n\t\t{35A5D4B4-775C-40E3-B364-19562437CD80} = {35A5D4B4-775C-40E3-B364-19562437CD80}\r\n\t\t{1D7A10ED-2939-4C11-BAA0-D37C2A8CD6F7} = {1D7A10ED-2939-4C11-BAA0-D37C2A8CD6F7}\r\n\t\t{9C232121-5F91-4559-A4F5-AAFAB5BDE0FC} = {9C232121-5F91-4559-A4F5-AAFAB5BDE0FC}\r\n\t\t{F6707C74-BCE0-40FC-9900-DDA579029FBA} = {F6707C74-BCE0-40FC-9900-DDA579029FBA}\r\n\t\t{AABC80BB-79B3-49BA-8A90-9AAC2A3B404F} = {AABC80BB-79B3-49BA-8A90-9AAC2A3B404F}\r\n\t\t{4B4599D2-DBF5-4E0A-9669-94032C1320A9} = {4B4599D2-DBF5-4E0A-9669-94032C1320A9}\r\n\t\t{7A4327FF-CA12-4A1A-A7CF-5328BDAA9942} = {7A4327FF-CA12-4A1A-A7CF-5328BDAA9942}\r\n\t\t{6FB36D12-30F9-49F5-B4B6-2E58C4390438} = {6FB36D12-30F9-49F5-B4B6-2E58C4390438}\r\n\t\t{3AF383AB-F184-4190-84DF-453ACE4CA89D} = {3AF383AB-F184-4190-84DF-453ACE4CA89D}\r\n\t\t{40BA88AF-9923-4FC6-8466-CB5833843AC4} = {40BA88AF-9923-4FC6-8466-CB5833843AC4}\r\n\t\t{A352758D-DD49-406B-81F3-FC8494D52B88} = {A352758D-DD49-406B-81F3-FC8494D52B88}\r\n\t\t{E31E45A2-E02E-49E7-843B-F390127F1184} = {E31E45A2-E02E-49E7-843B-F390127F1184}\r\n\t\t{754A36B3-E1DC-4975-89E4-EF0D82ACBC3B} = {754A36B3-E1DC-4975-89E4-EF0D82ACBC3B}\r\n\t\t{55652C23-9FE0-4E5B-930C-C3675C980351} = {55652C23-9FE0-4E5B-930C-C3675C980351}\r\n\t\t{91D35439-5C77-4084-B94A-45B055A97971} = {91D35439-5C77-4084-B94A-45B055A97971}\r\n\t\t{5299814A-9BDD-4F91-ADF9-723068B3B642} = {5299814A-9BDD-4F91-ADF9-723068B3B642}\r\n\tEndProjectSection\r\nEndProject\r\nProject(\"{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}\") = \"evtx_test_tools_signal\", \"evtx_test_tools_signal\\evtx_test_tools_signal.vcproj\", \"{3FBC46FE-518B-4351-87DF-22B3F8DF6A35}\"\r\n\tProjectSection(ProjectDependencies) = postProject\r\n\t\t{91D35439-5C77-4084-B94A-45B055A97971} = {91D35439-5C77-4084-B94A-45B055A97971}\r\n\t\t{5299814A-9BDD-4F91-ADF9-723068B3B642} = {5299814A-9BDD-4F91-ADF9-723068B3B642}\r\n\tEndProjectSection\r\nEndProject\r\nProject(\"{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}\") = \"libfwnt\", \"libfwnt\\libfwnt.vcproj\", \"{1D7A10ED-2939-4C11-BAA0-D37C2A8CD6F7}\"\r\n\tProjectSection(ProjectDependencies) = postProject\r\n\t\t{5299814A-9BDD-4F91-ADF9-723068B3B642} = {5299814A-9BDD-4F91-ADF9-723068B3B642}\r\n\t\t{48D8ABE8-71E3-4C29-A265-138C36783578} = {48D8ABE8-71E3-4C29-A265-138C36783578}\r\n\t\t{55652C23-9FE0-4E5B-930C-C3675C980351} = {55652C23-9FE0-4E5B-930C-C3675C980351}\r\n\t\t{E31E45A2-E02E-49E7-843B-F390127F1184} = {E31E45A2-E02E-49E7-843B-F390127F1184}\r\n\tEndProjectSection\r\nEndProject\r\nProject(\"{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}\") = \"libevtx\", \"libevtx\\libevtx.vcproj\", \"{91D35439-5C77-4084-B94A-45B055A97971}\"\r\n\tProjectSection(ProjectDependencies) = postProject\r\n\t\t{5299814A-9BDD-4F91-ADF9-723068B3B642} = {5299814A-9BDD-4F91-ADF9-723068B3B642}\r\n\t\t{48D8ABE8-71E3-4C29-A265-138C36783578} = {48D8ABE8-71E3-4C29-A265-138C36783578}\r\n\t\t{55652C23-9FE0-4E5B-930C-C3675C980351} = {55652C23-9FE0-4E5B-930C-C3675C980351}\r\n\t\t{754A36B3-E1DC-4975-89E4-EF0D82ACBC3B} = {754A36B3-E1DC-4975-89E4-EF0D82ACBC3B}\r\n\t\t{E31E45A2-E02E-49E7-843B-F390127F1184} = {E31E45A2-E02E-49E7-843B-F390127F1184}\r\n\t\t{A352758D-DD49-406B-81F3-FC8494D52B88} = {A352758D-DD49-406B-81F3-FC8494D52B88}\r\n\t\t{40BA88AF-9923-4FC6-8466-CB5833843AC4} = {40BA88AF-9923-4FC6-8466-CB5833843AC4}\r\n\t\t{3AF383AB-F184-4190-84DF-453ACE4CA89D} = {3AF383AB-F184-4190-84DF-453ACE4CA89D}\r\n\t\t{6FB36D12-30F9-49F5-B4B6-2E58C4390438} = {6FB36D12-30F9-49F5-B4B6-2E58C4390438}\r\n\t\t{7A4327FF-CA12-4A1A-A7CF-5328BDAA9942} = {7A4327FF-CA12-4A1A-A7CF-5328BDAA9942}\r\n\t\t{4B4599D2-DBF5-4E0A-9669-94032C1320A9} = {4B4599D2-DBF5-4E0A-9669-94032C1320A9}\r\n\t\t{AABC80BB-79B3-49BA-8A90-9AAC2A3B404F} = {AABC80BB-79B3-49BA-8A90-9AAC2A3B404F}\r\n\t\t{F6707C74-BCE0-40FC-9900-DDA579029FBA} = {F6707C74-BCE0-40FC-9900-DDA579029FBA}\r\n\t\t{9C232121-5F91-4559-A4F5-AAFAB5BDE0FC} = {9C232121-5F91-4559-A4F5-AAFAB5BDE0FC}\r\n\t\t{C6DCD3D9-4397-466E-AC94-49A590DA0EC6} = {C6DCD3D9-4397-466E-AC94-49A590DA0EC6}\r\n\t\t{1D7A10ED-2939-4C11-BAA0-D37C2A8CD6F7} = {1D7A10ED-2939-4C11-BAA0-D37C2A8CD6F7}\r\n\t\t{35A5D4B4-775C-40E3-B364-19562437CD80} = {35A5D4B4-775C-40E3-B364-19562437CD80}\r\n\tEndProjectSection\r\nEndProject\r\nProject(\"{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}\") = \"libcsplit\", \"libcsplit\\libcsplit.vcproj\", \"{A352758D-DD49-406B-81F3-FC8494D52B88}\"\r\n\tProjectSection(ProjectDependencies) = postProject\r\n\t\t{5299814A-9BDD-4F91-ADF9-723068B3B642} = {5299814A-9BDD-4F91-ADF9-723068B3B642}\r\n\tEndProjectSection\r\nEndProject\r\nProject(\"{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}\") = \"libuna\", \"libuna\\libuna.vcproj\", \"{40BA88AF-9923-4FC6-8466-CB5833843AC4}\"\r\n\tProjectSection(ProjectDependencies) = postProject\r\n\t\t{5299814A-9BDD-4F91-ADF9-723068B3B642} = {5299814A-9BDD-4F91-ADF9-723068B3B642}\r\n\tEndProjectSection\r\nEndProject\r\nProject(\"{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}\") = \"libfvalue\", \"libfvalue\\libfvalue.vcproj\", \"{35A5D4B4-775C-40E3-B364-19562437CD80}\"\r\n\tProjectSection(ProjectDependencies) = postProject\r\n\t\t{5299814A-9BDD-4F91-ADF9-723068B3B642} = {5299814A-9BDD-4F91-ADF9-723068B3B642}\r\n\t\t{48D8ABE8-71E3-4C29-A265-138C36783578} = {48D8ABE8-71E3-4C29-A265-138C36783578}\r\n\t\t{55652C23-9FE0-4E5B-930C-C3675C980351} = {55652C23-9FE0-4E5B-930C-C3675C980351}\r\n\t\t{E31E45A2-E02E-49E7-843B-F390127F1184} = {E31E45A2-E02E-49E7-843B-F390127F1184}\r\n\t\t{40BA88AF-9923-4FC6-8466-CB5833843AC4} = {40BA88AF-9923-4FC6-8466-CB5833843AC4}\r\n\t\t{F6707C74-BCE0-40FC-9900-DDA579029FBA} = {F6707C74-BCE0-40FC-9900-DDA579029FBA}\r\n\t\t{9C232121-5F91-4559-A4F5-AAFAB5BDE0FC} = {9C232121-5F91-4559-A4F5-AAFAB5BDE0FC}\r\n\t\t{1D7A10ED-2939-4C11-BAA0-D37C2A8CD6F7} = {1D7A10ED-2939-4C11-BAA0-D37C2A8CD6F7}\r\n\tEndProjectSection\r\nEndProject\r\nProject(\"{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}\") = \"libcnotify\", \"libcnotify\\libcnotify.vcproj\", \"{E31E45A2-E02E-49E7-843B-F390127F1184}\"\r\n\tProjectSection(ProjectDependencies) = postProject\r\n\t\t{5299814A-9BDD-4F91-ADF9-723068B3B642} = {5299814A-9BDD-4F91-ADF9-723068B3B642}\r\n\tEndProjectSection\r\nEndProject\r\nProject(\"{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}\") = \"libcerror\", \"libcerror\\libcerror.vcproj\", \"{5299814A-9BDD-4F91-ADF9-723068B3B642}\"\r\nEndProject\r\nProject(\"{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}\") = \"libfdatetime\", \"libfdatetime\\libfdatetime.vcproj\", \"{F6707C74-BCE0-40FC-9900-DDA579029FBA}\"\r\n\tProjectSection(ProjectDependencies) = postProject\r\n\t\t{5299814A-9BDD-4F91-ADF9-723068B3B642} = {5299814A-9BDD-4F91-ADF9-723068B3B642}\r\n\tEndProjectSection\r\nEndProject\r\nProject(\"{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}\") = \"libcdirectory\", \"libcdirectory\\libcdirectory.vcproj\", \"{62C67404-7985-4120-85BA-3C0424784434}\"\r\n\tProjectSection(ProjectDependencies) = postProject\r\n\t\t{5299814A-9BDD-4F91-ADF9-723068B3B642} = {5299814A-9BDD-4F91-ADF9-723068B3B642}\r\n\t\t{754A36B3-E1DC-4975-89E4-EF0D82ACBC3B} = {754A36B3-E1DC-4975-89E4-EF0D82ACBC3B}\r\n\t\t{40BA88AF-9923-4FC6-8466-CB5833843AC4} = {40BA88AF-9923-4FC6-8466-CB5833843AC4}\r\n\tEndProjectSection\r\nEndProject\r\nGlobal\r\n\tGlobalSection(SolutionConfigurationPlatforms) = preSolution\r\n\t\tRelease|Win32 = Release|Win32\r\n\t\tVSDebug|Win32 = VSDebug|Win32\r\n\tEndGlobalSection\r\n\tGlobalSection(ProjectConfigurationPlatforms) = postSolution\r\n\t\t{AABC80BB-79B3-49BA-8A90-9AAC2A3B404F}.Release|Win32.ActiveCfg = Release|Win32\r\n\t\t{AABC80BB-79B3-49BA-8A90-9AAC2A3B404F}.Release|Win32.Build.0 = Release|Win32\r\n\t\t{AABC80BB-79B3-49BA-8A90-9AAC2A3B404F}.VSDebug|Win32.ActiveCfg = VSDebug|Win32\r\n\t\t{AABC80BB-79B3-49BA-8A90-9AAC2A3B404F}.VSDebug|Win32.Build.0 = VSDebug|Win32\r\n\t\t{D9D3120F-1242-4538-82CD-A99B1BC9A3DF}.Release|Win32.ActiveCfg = Release|Win32\r\n\t\t{D9D3120F-1242-4538-82CD-A99B1BC9A3DF}.Release|Win32.Build.0 = Release|Win32\r\n\t\t{D9D3120F-1242-4538-82CD-A99B1BC9A3DF}.VSDebug|Win32.ActiveCfg = VSDebug|Win32\r\n\t\t{D9D3120F-1242-4538-82CD-A99B1BC9A3DF}.VSDebug|Win32.Build.0 = VSDebug|Win32\r\n\t\t{4C0A33FC-0B42-4735-B5C9-EA49F17A9478}.Release|Win32.ActiveCfg = Release|Win32\r\n\t\t{4C0A33FC-0B42-4735-B5C9-EA49F17A9478}.Release|Win32.Build.0 = Release|Win32\r\n\t\t{4C0A33FC-0B42-4735-B5C9-EA49F17A9478}.VSDebug|Win32.ActiveCfg = VSDebug|Win32\r\n\t\t{4C0A33FC-0B42-4735-B5C9-EA49F17A9478}.VSDebug|Win32.Build.0 = VSDebug|Win32\r\n\t\t{0D975F50-1FE8-498E-B597-9960DFC995AC}.Release|Win32.ActiveCfg = Release|Win32\r\n\t\t{0D975F50-1FE8-498E-B597-9960DFC995AC}.Release|Win32.Build.0 = Release|Win32\r\n\t\t{0D975F50-1FE8-498E-B597-9960DFC995AC}.VSDebug|Win32.ActiveCfg = VSDebug|Win32\r\n\t\t{0D975F50-1FE8-498E-B597-9960DFC995AC}.VSDebug|Win32.Build.0 = VSDebug|Win32\r\n\t\t{2D239718-8401-4E75-88FD-E81DF267543A}.Release|Win32.ActiveCfg = Release|Win32\r\n\t\t{2D239718-8401-4E75-88FD-E81DF267543A}.Release|Win32.Build.0 = Release|Win32\r\n\t\t{2D239718-8401-4E75-88FD-E81DF267543A}.VSDebug|Win32.ActiveCfg = VSDebug|Win32\r\n\t\t{2D239718-8401-4E75-88FD-E81DF267543A}.VSDebug|Win32.Build.0 = VSDebug|Win32\r\n\t\t{7F42F80A-6FE8-4634-8455-5D08A1E24BAA}.Release|Win32.ActiveCfg = Release|Win32\r\n\t\t{7F42F80A-6FE8-4634-8455-5D08A1E24BAA}.Release|Win32.Build.0 = Release|Win32\r\n\t\t{7F42F80A-6FE8-4634-8455-5D08A1E24BAA}.VSDebug|Win32.ActiveCfg = VSDebug|Win32\r\n\t\t{7F42F80A-6FE8-4634-8455-5D08A1E24BAA}.VSDebug|Win32.Build.0 = VSDebug|Win32\r\n\t\t{9C232121-5F91-4559-A4F5-AAFAB5BDE0FC}.Release|Win32.ActiveCfg = Release|Win32\r\n\t\t{9C232121-5F91-4559-A4F5-AAFAB5BDE0FC}.Release|Win32.Build.0 = Release|Win32\r\n\t\t{9C232121-5F91-4559-A4F5-AAFAB5BDE0FC}.VSDebug|Win32.ActiveCfg = VSDebug|Win32\r\n\t\t{9C232121-5F91-4559-A4F5-AAFAB5BDE0FC}.VSDebug|Win32.Build.0 = VSDebug|Win32\r\n\t\t{754A36B3-E1DC-4975-89E4-EF0D82ACBC3B}.Release|Win32.ActiveCfg = Release|Win32\r\n\t\t{754A36B3-E1DC-4975-89E4-EF0D82ACBC3B}.Release|Win32.Build.0 = Release|Win32\r\n\t\t{754A36B3-E1DC-4975-89E4-EF0D82ACBC3B}.VSDebug|Win32.ActiveCfg = VSDebug|Win32\r\n\t\t{754A36B3-E1DC-4975-89E4-EF0D82ACBC3B}.VSDebug|Win32.Build.0 = VSDebug|Win32\r\n\t\t{4B4599D2-DBF5-4E0A-9669-94032C1320A9}.Release|Win32.ActiveCfg = Release|Win32\r\n\t\t{4B4599D2-DBF5-4E0A-9669-94032C1320A9}.Release|Win32.Build.0 = Release|Win32\r\n\t\t{4B4599D2-DBF5-4E0A-9669-94032C1320A9}.VSDebug|Win32.ActiveCfg = VSDebug|Win32\r\n\t\t{4B4599D2-DBF5-4E0A-9669-94032C1320A9}.VSDebug|Win32.Build.0 = VSDebug|Win32\r\n\t\t{7A4327FF-CA12-4A1A-A7CF-5328BDAA9942}.Release|Win32.ActiveCfg = Release|Win32\r\n\t\t{7A4327FF-CA12-4A1A-A7CF-5328BDAA9942}.Release|Win32.Build.0 = Release|Win32\r\n\t\t{7A4327FF-CA12-4A1A-A7CF-5328BDAA9942}.VSDebug|Win32.ActiveCfg = VSDebug|Win32\r\n\t\t{7A4327FF-CA12-4A1A-A7CF-5328BDAA9942}.VSDebug|Win32.Build.0 = VSDebug|Win32\r\n\t\t{C6DCD3D9-4397-466E-AC94-49A590DA0EC6}.Release|Win32.ActiveCfg = Release|Win32\r\n\t\t{C6DCD3D9-4397-466E-AC94-49A590DA0EC6}.Release|Win32.Build.0 = Release|Win32\r\n\t\t{C6DCD3D9-4397-466E-AC94-49A590DA0EC6}.VSDebug|Win32.ActiveCfg = VSDebug|Win32\r\n\t\t{C6DCD3D9-4397-466E-AC94-49A590DA0EC6}.VSDebug|Win32.Build.0 = VSDebug|Win32\r\n\t\t{3AF383AB-F184-4190-84DF-453ACE4CA89D}.Release|Win32.ActiveCfg = Release|Win32\r\n\t\t{3AF383AB-F184-4190-84DF-453ACE4CA89D}.Release|Win32.Build.0 = Release|Win32\r\n\t\t{3AF383AB-F184-4190-84DF-453ACE4CA89D}.VSDebug|Win32.ActiveCfg = VSDebug|Win32\r\n\t\t{3AF383AB-F184-4190-84DF-453ACE4CA89D}.VSDebug|Win32.Build.0 = VSDebug|Win32\r\n\t\t{B5E43F96-E790-4DBA-8891-4A14E7183D9A}.Release|Win32.ActiveCfg = Release|Win32\r\n\t\t{B5E43F96-E790-4DBA-8891-4A14E7183D9A}.Release|Win32.Build.0 = Release|Win32\r\n\t\t{B5E43F96-E790-4DBA-8891-4A14E7183D9A}.VSDebug|Win32.ActiveCfg = VSDebug|Win32\r\n\t\t{B5E43F96-E790-4DBA-8891-4A14E7183D9A}.VSDebug|Win32.Build.0 = VSDebug|Win32\r\n\t\t{55652C23-9FE0-4E5B-930C-C3675C980351}.Release|Win32.ActiveCfg = Release|Win32\r\n\t\t{55652C23-9FE0-4E5B-930C-C3675C980351}.Release|Win32.Build.0 = Release|Win32\r\n\t\t{55652C23-9FE0-4E5B-930C-C3675C980351}.VSDebug|Win32.ActiveCfg = VSDebug|Win32\r\n\t\t{55652C23-9FE0-4E5B-930C-C3675C980351}.VSDebug|Win32.Build.0 = VSDebug|Win32\r\n\t\t{48D8ABE8-71E3-4C29-A265-138C36783578}.Release|Win32.ActiveCfg = Release|Win32\r\n\t\t{48D8ABE8-71E3-4C29-A265-138C36783578}.Release|Win32.Build.0 = Release|Win32\r\n\t\t{48D8ABE8-71E3-4C29-A265-138C36783578}.VSDebug|Win32.ActiveCfg = VSDebug|Win32\r\n\t\t{48D8ABE8-71E3-4C29-A265-138C36783578}.VSDebug|Win32.Build.0 = VSDebug|Win32\r\n\t\t{6FB36D12-30F9-49F5-B4B6-2E58C4390438}.Release|Win32.ActiveCfg = Release|Win32\r\n\t\t{6FB36D12-30F9-49F5-B4B6-2E58C4390438}.Release|Win32.Build.0 = Release|Win32\r\n\t\t{6FB36D12-30F9-49F5-B4B6-2E58C4390438}.VSDebug|Win32.ActiveCfg = VSDebug|Win32\r\n\t\t{6FB36D12-30F9-49F5-B4B6-2E58C4390438}.VSDebug|Win32.Build.0 = VSDebug|Win32\r\n\t\t{D840C869-2266-4422-BD66-CAF20CED4832}.Release|Win32.ActiveCfg = Release|Win32\r\n\t\t{D840C869-2266-4422-BD66-CAF20CED4832}.Release|Win32.Build.0 = Release|Win32\r\n\t\t{D840C869-2266-4422-BD66-CAF20CED4832}.VSDebug|Win32.ActiveCfg = VSDebug|Win32\r\n\t\t{D840C869-2266-4422-BD66-CAF20CED4832}.VSDebug|Win32.Build.0 = VSDebug|Win32\r\n\t\t{2AE899E9-29D4-4921-9B34-470BD450ADDB}.Release|Win32.ActiveCfg = Release|Win32\r\n\t\t{2AE899E9-29D4-4921-9B34-470BD450ADDB}.Release|Win32.Build.0 = Release|Win32\r\n\t\t{2AE899E9-29D4-4921-9B34-470BD450ADDB}.VSDebug|Win32.ActiveCfg = VSDebug|Win32\r\n\t\t{2AE899E9-29D4-4921-9B34-470BD450ADDB}.VSDebug|Win32.Build.0 = VSDebug|Win32\r\n\t\t{D5374706-39C2-43A0-BCEA-D4A5B3F7E452}.Release|Win32.ActiveCfg = Release|Win32\r\n\t\t{D5374706-39C2-43A0-BCEA-D4A5B3F7E452}.Release|Win32.Build.0 = Release|Win32\r\n\t\t{D5374706-39C2-43A0-BCEA-D4A5B3F7E452}.VSDebug|Win32.ActiveCfg = VSDebug|Win32\r\n\t\t{D5374706-39C2-43A0-BCEA-D4A5B3F7E452}.VSDebug|Win32.Build.0 = VSDebug|Win32\r\n\t\t{EE2C5CA8-AD6D-43FD-94F5-5711BA1007EB}.Release|Win32.ActiveCfg = Release|Win32\r\n\t\t{EE2C5CA8-AD6D-43FD-94F5-5711BA1007EB}.Release|Win32.Build.0 = Release|Win32\r\n\t\t{EE2C5CA8-AD6D-43FD-94F5-5711BA1007EB}.VSDebug|Win32.ActiveCfg = VSDebug|Win32\r\n\t\t{EE2C5CA8-AD6D-43FD-94F5-5711BA1007EB}.VSDebug|Win32.Build.0 = VSDebug|Win32\r\n\t\t{6ECA82D7-4570-4B9E-AF48-D3C7312912C8}.Release|Win32.ActiveCfg = Release|Win32\r\n\t\t{6ECA82D7-4570-4B9E-AF48-D3C7312912C8}.Release|Win32.Build.0 = Release|Win32\r\n\t\t{6ECA82D7-4570-4B9E-AF48-D3C7312912C8}.VSDebug|Win32.ActiveCfg = VSDebug|Win32\r\n\t\t{6ECA82D7-4570-4B9E-AF48-D3C7312912C8}.VSDebug|Win32.Build.0 = VSDebug|Win32\r\n\t\t{817CFF30-C20D-4B97-B144-0957548613D4}.Release|Win32.ActiveCfg = Release|Win32\r\n\t\t{817CFF30-C20D-4B97-B144-0957548613D4}.Release|Win32.Build.0 = Release|Win32\r\n\t\t{817CFF30-C20D-4B97-B144-0957548613D4}.VSDebug|Win32.ActiveCfg = VSDebug|Win32\r\n\t\t{817CFF30-C20D-4B97-B144-0957548613D4}.VSDebug|Win32.Build.0 = VSDebug|Win32\r\n\t\t{51C5C6C4-684E-4B2E-A220-3F177CD5D139}.Release|Win32.ActiveCfg = Release|Win32\r\n\t\t{51C5C6C4-684E-4B2E-A220-3F177CD5D139}.Release|Win32.Build.0 = Release|Win32\r\n\t\t{51C5C6C4-684E-4B2E-A220-3F177CD5D139}.VSDebug|Win32.ActiveCfg = VSDebug|Win32\r\n\t\t{51C5C6C4-684E-4B2E-A220-3F177CD5D139}.VSDebug|Win32.Build.0 = VSDebug|Win32\r\n\t\t{A73C40E8-0224-41D6-8FB0-C46CC44215B0}.Release|Win32.ActiveCfg = Release|Win32\r\n\t\t{A73C40E8-0224-41D6-8FB0-C46CC44215B0}.Release|Win32.Build.0 = Release|Win32\r\n\t\t{A73C40E8-0224-41D6-8FB0-C46CC44215B0}.VSDebug|Win32.ActiveCfg = VSDebug|Win32\r\n\t\t{A73C40E8-0224-41D6-8FB0-C46CC44215B0}.VSDebug|Win32.Build.0 = VSDebug|Win32\r\n\t\t{98244676-8D2C-4900-A8CA-E7357EA78844}.Release|Win32.ActiveCfg = Release|Win32\r\n\t\t{98244676-8D2C-4900-A8CA-E7357EA78844}.Release|Win32.Build.0 = Release|Win32\r\n\t\t{98244676-8D2C-4900-A8CA-E7357EA78844}.VSDebug|Win32.ActiveCfg = VSDebug|Win32\r\n\t\t{98244676-8D2C-4900-A8CA-E7357EA78844}.VSDebug|Win32.Build.0 = VSDebug|Win32\r\n\t\t{F7453089-EA30-4F71-9C6E-630C02E37383}.Release|Win32.ActiveCfg = Release|Win32\r\n\t\t{F7453089-EA30-4F71-9C6E-630C02E37383}.Release|Win32.Build.0 = Release|Win32\r\n\t\t{F7453089-EA30-4F71-9C6E-630C02E37383}.VSDebug|Win32.ActiveCfg = VSDebug|Win32\r\n\t\t{F7453089-EA30-4F71-9C6E-630C02E37383}.VSDebug|Win32.Build.0 = VSDebug|Win32\r\n\t\t{BE305497-DE84-4503-BCAF-80C8D5C3F730}.Release|Win32.ActiveCfg = Release|Win32\r\n\t\t{BE305497-DE84-4503-BCAF-80C8D5C3F730}.Release|Win32.Build.0 = Release|Win32\r\n\t\t{BE305497-DE84-4503-BCAF-80C8D5C3F730}.VSDebug|Win32.ActiveCfg = VSDebug|Win32\r\n\t\t{BE305497-DE84-4503-BCAF-80C8D5C3F730}.VSDebug|Win32.Build.0 = VSDebug|Win32\r\n\t\t{073D74D4-5B99-49FE-863B-9DE654277681}.Release|Win32.ActiveCfg = Release|Win32\r\n\t\t{073D74D4-5B99-49FE-863B-9DE654277681}.Release|Win32.Build.0 = Release|Win32\r\n\t\t{073D74D4-5B99-49FE-863B-9DE654277681}.VSDebug|Win32.ActiveCfg = VSDebug|Win32\r\n\t\t{073D74D4-5B99-49FE-863B-9DE654277681}.VSDebug|Win32.Build.0 = VSDebug|Win32\r\n\t\t{04AD9DCE-819D-44A3-8645-D9967D9CACFC}.Release|Win32.ActiveCfg = Release|Win32\r\n\t\t{04AD9DCE-819D-44A3-8645-D9967D9CACFC}.Release|Win32.Build.0 = Release|Win32\r\n\t\t{04AD9DCE-819D-44A3-8645-D9967D9CACFC}.VSDebug|Win32.ActiveCfg = VSDebug|Win32\r\n\t\t{04AD9DCE-819D-44A3-8645-D9967D9CACFC}.VSDebug|Win32.Build.0 = VSDebug|Win32\r\n\t\t{1A14908D-59D7-4894-87AA-50712BA07F64}.Release|Win32.ActiveCfg = Release|Win32\r\n\t\t{1A14908D-59D7-4894-87AA-50712BA07F64}.Release|Win32.Build.0 = Release|Win32\r\n\t\t{1A14908D-59D7-4894-87AA-50712BA07F64}.VSDebug|Win32.ActiveCfg = VSDebug|Win32\r\n\t\t{1A14908D-59D7-4894-87AA-50712BA07F64}.VSDebug|Win32.Build.0 = VSDebug|Win32\r\n\t\t{D02450B3-A0A7-4CFB-9828-F8532D853D9E}.Release|Win32.ActiveCfg = Release|Win32\r\n\t\t{D02450B3-A0A7-4CFB-9828-F8532D853D9E}.Release|Win32.Build.0 = Release|Win32\r\n\t\t{D02450B3-A0A7-4CFB-9828-F8532D853D9E}.VSDebug|Win32.ActiveCfg = VSDebug|Win32\r\n\t\t{D02450B3-A0A7-4CFB-9828-F8532D853D9E}.VSDebug|Win32.Build.0 = VSDebug|Win32\r\n\t\t{D390DD8D-C393-4CB0-B623-48FC41D092BB}.Release|Win32.ActiveCfg = Release|Win32\r\n\t\t{D390DD8D-C393-4CB0-B623-48FC41D092BB}.Release|Win32.Build.0 = Release|Win32\r\n\t\t{D390DD8D-C393-4CB0-B623-48FC41D092BB}.VSDebug|Win32.ActiveCfg = VSDebug|Win32\r\n\t\t{D390DD8D-C393-4CB0-B623-48FC41D092BB}.VSDebug|Win32.Build.0 = VSDebug|Win32\r\n\t\t{10D3FA6F-88E6-409E-B210-44E8515F8BA1}.Release|Win32.ActiveCfg = Release|Win32\r\n\t\t{10D3FA6F-88E6-409E-B210-44E8515F8BA1}.Release|Win32.Build.0 = Release|Win32\r\n\t\t{10D3FA6F-88E6-409E-B210-44E8515F8BA1}.VSDebug|Win32.ActiveCfg = VSDebug|Win32\r\n\t\t{10D3FA6F-88E6-409E-B210-44E8515F8BA1}.VSDebug|Win32.Build.0 = VSDebug|Win32\r\n\t\t{3FBC46FE-518B-4351-87DF-22B3F8DF6A35}.Release|Win32.ActiveCfg = Release|Win32\r\n\t\t{3FBC46FE-518B-4351-87DF-22B3F8DF6A35}.Release|Win32.Build.0 = Release|Win32\r\n\t\t{3FBC46FE-518B-4351-87DF-22B3F8DF6A35}.VSDebug|Win32.ActiveCfg = VSDebug|Win32\r\n\t\t{3FBC46FE-518B-4351-87DF-22B3F8DF6A35}.VSDebug|Win32.Build.0 = VSDebug|Win32\r\n\t\t{1D7A10ED-2939-4C11-BAA0-D37C2A8CD6F7}.Release|Win32.ActiveCfg = Release|Win32\r\n\t\t{1D7A10ED-2939-4C11-BAA0-D37C2A8CD6F7}.Release|Win32.Build.0 = Release|Win32\r\n\t\t{1D7A10ED-2939-4C11-BAA0-D37C2A8CD6F7}.VSDebug|Win32.ActiveCfg = VSDebug|Win32\r\n\t\t{1D7A10ED-2939-4C11-BAA0-D37C2A8CD6F7}.VSDebug|Win32.Build.0 = VSDebug|Win32\r\n\t\t{91D35439-5C77-4084-B94A-45B055A97971}.Release|Win32.ActiveCfg = Release|Win32\r\n\t\t{91D35439-5C77-4084-B94A-45B055A97971}.Release|Win32.Build.0 = Release|Win32\r\n\t\t{91D35439-5C77-4084-B94A-45B055A97971}.VSDebug|Win32.ActiveCfg = VSDebug|Win32\r\n\t\t{91D35439-5C77-4084-B94A-45B055A97971}.VSDebug|Win32.Build.0 = VSDebug|Win32\r\n\t\t{A352758D-DD49-406B-81F3-FC8494D52B88}.Release|Win32.ActiveCfg = Release|Win32\r\n\t\t{A352758D-DD49-406B-81F3-FC8494D52B88}.Release|Win32.Build.0 = Release|Win32\r\n\t\t{A352758D-DD49-406B-81F3-FC8494D52B88}.VSDebug|Win32.ActiveCfg = VSDebug|Win32\r\n\t\t{A352758D-DD49-406B-81F3-FC8494D52B88}.VSDebug|Win32.Build.0 = VSDebug|Win32\r\n\t\t{40BA88AF-9923-4FC6-8466-CB5833843AC4}.Release|Win32.ActiveCfg = Release|Win32\r\n\t\t{40BA88AF-9923-4FC6-8466-CB5833843AC4}.Release|Win32.Build.0 = Release|Win32\r\n\t\t{40BA88AF-9923-4FC6-8466-CB5833843AC4}.VSDebug|Win32.ActiveCfg = VSDebug|Win32\r\n\t\t{40BA88AF-9923-4FC6-8466-CB5833843AC4}.VSDebug|Win32.Build.0 = VSDebug|Win32\r\n\t\t{35A5D4B4-775C-40E3-B364-19562437CD80}.Release|Win32.ActiveCfg = Release|Win32\r\n\t\t{35A5D4B4-775C-40E3-B364-19562437CD80}.Release|Win32.Build.0 = Release|Win32\r\n\t\t{35A5D4B4-775C-40E3-B364-19562437CD80}.VSDebug|Win32.ActiveCfg = VSDebug|Win32\r\n\t\t{35A5D4B4-775C-40E3-B364-19562437CD80}.VSDebug|Win32.Build.0 = VSDebug|Win32\r\n\t\t{E31E45A2-E02E-49E7-843B-F390127F1184}.Release|Win32.ActiveCfg = Release|Win32\r\n\t\t{E31E45A2-E02E-49E7-843B-F390127F1184}.Release|Win32.Build.0 = Release|Win32\r\n\t\t{E31E45A2-E02E-49E7-843B-F390127F1184}.VSDebug|Win32.ActiveCfg = VSDebug|Win32\r\n\t\t{E31E45A2-E02E-49E7-843B-F390127F1184}.VSDebug|Win32.Build.0 = VSDebug|Win32\r\n\t\t{5299814A-9BDD-4F91-ADF9-723068B3B642}.Release|Win32.ActiveCfg = Release|Win32\r\n\t\t{5299814A-9BDD-4F91-ADF9-723068B3B642}.Release|Win32.Build.0 = Release|Win32\r\n\t\t{5299814A-9BDD-4F91-ADF9-723068B3B642}.VSDebug|Win32.ActiveCfg = VSDebug|Win32\r\n\t\t{5299814A-9BDD-4F91-ADF9-723068B3B642}.VSDebug|Win32.Build.0 = VSDebug|Win32\r\n\t\t{F6707C74-BCE0-40FC-9900-DDA579029FBA}.Release|Win32.ActiveCfg = Release|Win32\r\n\t\t{F6707C74-BCE0-40FC-9900-DDA579029FBA}.Release|Win32.Build.0 = Release|Win32\r\n\t\t{F6707C74-BCE0-40FC-9900-DDA579029FBA}.VSDebug|Win32.ActiveCfg = VSDebug|Win32\r\n\t\t{F6707C74-BCE0-40FC-9900-DDA579029FBA}.VSDebug|Win32.Build.0 = VSDebug|Win32\r\n\t\t{62C67404-7985-4120-85BA-3C0424784434}.Release|Win32.ActiveCfg = Release|Win32\r\n\t\t{62C67404-7985-4120-85BA-3C0424784434}.Release|Win32.Build.0 = Release|Win32\r\n\t\t{62C67404-7985-4120-85BA-3C0424784434}.VSDebug|Win32.ActiveCfg = VSDebug|Win32\r\n\t\t{62C67404-7985-4120-85BA-3C0424784434}.VSDebug|Win32.Build.0 = VSDebug|Win32\r\n\tEndGlobalSection\r\n\tGlobalSection(SolutionProperties) = preSolution\r\n\t\tHideSolutionNode = FALSE\r\n\tEndGlobalSection\r\nEndGlobal\r\n" }, { "path": "msvscpp/libexe/libexe.vcproj", "content": "\r\n\r\n\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\r\n" }, { "path": "msvscpp/libfcache/libfcache.vcproj", "content": "\r\n\r\n\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\r\n" }, { "path": "msvscpp/libfdata/libfdata.vcproj", "content": "\r\n\r\n\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\r\n" }, { "path": "msvscpp/libfdatetime/libfdatetime.vcproj", "content": "\r\n\r\n\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\r\n" }, { "path": "msvscpp/libfguid/libfguid.vcproj", "content": "\r\n\r\n\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\r\n" }, { "path": "msvscpp/libfvalue/libfvalue.vcproj", "content": "\r\n\r\n\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\r\n" }, { "path": "msvscpp/libfwevt/libfwevt.vcproj", "content": "\r\n\r\n\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\r\n" }, { "path": "msvscpp/libfwnt/libfwnt.vcproj", "content": "\r\n\r\n\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\r\n" }, { "path": "msvscpp/libregf/libregf.vcproj", "content": "\r\n\r\n\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\r\n" }, { "path": "msvscpp/libuna/libuna.vcproj", "content": "\r\n\r\n\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\r\n" }, { "path": "msvscpp/libwrc/libwrc.vcproj", "content": "\r\n\r\n\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\r\n" }, { "path": "msvscpp/pyevtx/pyevtx.vcproj", "content": "\r\n\r\n\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t\r\n\t\t\r\n\t\t\r\n\t\t\r\n\t\r\n\t\r\n\t\r\n\r\n" }, { "path": "ossfuzz/Makefile.am", "content": "if HAVE_LIB_FUZZING_ENGINE\nAM_CPPFLAGS = \\\n\t-I../include -I$(top_srcdir)/include \\\n\t-I../common -I$(top_srcdir)/common \\\n\t@LIBCERROR_CPPFLAGS@ \\\n\t@LIBCDATA_CPPFLAGS@ \\\n\t@LIBCLOCALE_CPPFLAGS@ \\\n\t@LIBCNOTIFY_CPPFLAGS@ \\\n\t@LIBUNA_CPPFLAGS@ \\\n\t@LIBCFILE_CPPFLAGS@ \\\n\t@LIBCPATH_CPPFLAGS@ \\\n\t@LIBBFIO_CPPFLAGS@\n\nbin_PROGRAMS = \\\n\tfile_fuzzer \\\n\trecord_fuzzer\n\nfile_fuzzer_SOURCES = \\\n\tfile_fuzzer.cc \\\n\tossfuzz_libbfio.h \\\n\tossfuzz_libevtx.h\n\nfile_fuzzer_LDADD = \\\n\t@LIB_FUZZING_ENGINE@ \\\n\t@LIBBFIO_LIBADD@ \\\n\t@LIBCPATH_LIBADD@ \\\n\t@LIBCFILE_LIBADD@ \\\n\t@LIBUNA_LIBADD@ \\\n\t@LIBCDATA_LIBADD@ \\\n\t../libevtx/libevtx.la \\\n\t@LIBCNOTIFY_LIBADD@ \\\n\t@LIBCLOCALE_LIBADD@ \\\n\t@LIBCERROR_LIBADD@ \\\n\t@LIBINTL@\n\nrecord_fuzzer_SOURCES = \\\n\tossfuzz_libbfio.h \\\n\tossfuzz_libevtx.h \\\n\trecord_fuzzer.cc\n\nrecord_fuzzer_LDADD = \\\n\t@LIB_FUZZING_ENGINE@ \\\n\t@LIBBFIO_LIBADD@ \\\n\t@LIBCPATH_LIBADD@ \\\n\t@LIBCFILE_LIBADD@ \\\n\t@LIBUNA_LIBADD@ \\\n\t@LIBCDATA_LIBADD@ \\\n\t../libevtx/libevtx.la \\\n\t@LIBCNOTIFY_LIBADD@ \\\n\t@LIBCLOCALE_LIBADD@ \\\n\t@LIBCERROR_LIBADD@ \\\n\t@LIBINTL@\nendif\n\nDISTCLEANFILES = \\\n\tMakefile \\\n\tMakefile.in\n\nsplint-local:\n\t@echo \"Running splint on file_fuzzer ...\"\n\t-splint -preproc -redef $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(file_fuzzer_SOURCES)\n\t@echo \"Running splint on record_fuzzer ...\"\n\t-splint -preproc -redef $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(record_fuzzer_SOURCES)\n\n" }, { "path": "ossfuzz/file_fuzzer.cc", "content": "/*\n * OSS-Fuzz target for libevtx file type\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#include \n#include \n\n/* Note that some of the OSS-Fuzz engines use C++\n */\nextern \"C\" {\n\n#include \"ossfuzz_libbfio.h\"\n#include \"ossfuzz_libevtx.h\"\n\n#if !defined( LIBEVTX_HAVE_BFIO )\n\n/* Opens a file using a Basic File IO (bfio) handle\n * Returns 1 if successful or -1 on error\n */\nLIBEVTX_EXTERN \\\nint libevtx_file_open_file_io_handle(\n libevtx_file_t *file,\n libbfio_handle_t *file_io_handle,\n int access_flags,\n libevtx_error_t **error );\n\n#endif /* !defined( LIBEVTX_HAVE_BFIO ) */\n\nint LLVMFuzzerTestOneInput(\n const uint8_t *data,\n size_t size )\n{\n\tlibbfio_handle_t *file_io_handle = NULL;\n\tlibevtx_file_t *file = NULL;\n\n\tif( libbfio_memory_range_initialize(\n\t &file_io_handle,\n\t NULL ) != 1 )\n\t{\n\t\treturn( 0 );\n\t}\n\tif( libbfio_memory_range_set(\n\t file_io_handle,\n\t (uint8_t *) data,\n\t size,\n\t NULL ) != 1 )\n\t{\n\t\tgoto on_error_libbfio;\n\t}\n\tif( libevtx_file_initialize(\n\t &file,\n\t NULL ) != 1 )\n\t{\n\t\tgoto on_error_libbfio;\n\t}\n\tif( libevtx_file_open_file_io_handle(\n\t file,\n\t file_io_handle,\n\t LIBEVTX_OPEN_READ,\n\t NULL ) != 1 )\n\t{\n\t\tgoto on_error_libevtx;\n\t}\n\tlibevtx_file_close(\n\t file,\n\t NULL );\n\non_error_libevtx:\n\tlibevtx_file_free(\n\t &file,\n\t NULL );\n\non_error_libbfio:\n\tlibbfio_handle_free(\n\t &file_io_handle,\n\t NULL );\n\n\treturn( 0 );\n}\n\n} /* extern \"C\" */\n\n" }, { "path": "ossfuzz/ossfuzz_libbfio.h", "content": "/*\n * The libbfio header wrapper\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#if !defined( _OSSFUZZ_LIBBFIO_H )\n#define _OSSFUZZ_LIBBFIO_H\n\n#include \n\n/* Define HAVE_LOCAL_LIBBFIO for local use of libbfio\n */\n#if defined( HAVE_LOCAL_LIBBFIO )\n\n#include \n#include \n#include \n#include \n#include \n#include \n#include \n#include \n\n#else\n\n/* If libtool DLL support is enabled set LIBBFIO_DLL_IMPORT\n * before including libbfio.h\n */\n#if defined( _WIN32 ) && defined( DLL_IMPORT ) && !defined( HAVE_STATIC_EXECUTABLES )\n#define LIBBFIO_DLL_IMPORT\n#endif\n\n#include \n\n#if defined( HAVE_MULTI_THREAD_SUPPORT ) && !defined( LIBBFIO_HAVE_MULTI_THREAD_SUPPORT )\n#error Multi-threading support requires libbfio with multi-threading support\n#endif\n\n#endif /* defined( HAVE_LOCAL_LIBBFIO ) */\n\n#endif /* !defined( _OSSFUZZ_LIBBFIO_H ) */\n\n" }, { "path": "ossfuzz/ossfuzz_libevtx.h", "content": "/*\n * The libevtx header wrapper\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#if !defined( _OSSFUZZ_LIBEVTX_H )\n#define _OSSFUZZ_LIBEVTX_H\n\n#include \n\n#include \n\n#endif /* !defined( _OSSFUZZ_LIBEVTX_H ) */\n\n" }, { "path": "ossfuzz/record_fuzzer.cc", "content": "/*\n * OSS-Fuzz target for libevtx record type\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#include \n#include \n\n/* Note that some of the OSS-Fuzz engines use C++\n */\nextern \"C\" {\n\n#include \"ossfuzz_libbfio.h\"\n#include \"ossfuzz_libevtx.h\"\n\n#if !defined( LIBEVTX_HAVE_BFIO )\n\n/* Opens a file using a Basic File IO (bfio) handle\n * Returns 1 if successful or -1 on error\n */\nLIBEVTX_EXTERN \\\nint libevtx_file_open_file_io_handle(\n libevtx_file_t *file,\n libbfio_handle_t *file_io_handle,\n int access_flags,\n libevtx_error_t **error );\n\n#endif /* !defined( LIBEVTX_HAVE_BFIO ) */\n\nint LLVMFuzzerTestOneInput(\n const uint8_t *data,\n size_t size )\n{\n\tlibbfio_handle_t *file_io_handle = NULL;\n\tlibevtx_file_t *file = NULL;\n\tlibevtx_record_t *record = NULL;\n\tint number_of_records = 0;\n\n\tif( libbfio_memory_range_initialize(\n\t &file_io_handle,\n\t NULL ) != 1 )\n\t{\n\t\treturn( 0 );\n\t}\n\tif( libbfio_memory_range_set(\n\t file_io_handle,\n\t (uint8_t *) data,\n\t size,\n\t NULL ) != 1 )\n\t{\n\t\tgoto on_error_libbfio;\n\t}\n\tif( libevtx_file_initialize(\n\t &file,\n\t NULL ) != 1 )\n\t{\n\t\tgoto on_error_libbfio;\n\t}\n\tif( libevtx_file_open_file_io_handle(\n\t file,\n\t file_io_handle,\n\t LIBEVTX_OPEN_READ,\n\t NULL ) != 1 )\n\t{\n\t\tgoto on_error_libevtx_file;\n\t}\n\tif( libevtx_file_get_number_of_records(\n\t file,\n\t &number_of_records,\n\t NULL ) != 1 )\n\t{\n\t\tgoto on_error_libevtx_file;\n\t}\n\tif( number_of_records > 0 )\n\t{\n\t\tif( libevtx_file_get_record_by_index(\n\t\t file,\n\t\t 0,\n\t\t &record,\n\t\t NULL ) == 1 )\n\t\t{\n\t\t\tlibevtx_record_free(\n\t\t\t &record,\n\t\t\t NULL );\n\t\t}\n\t}\n\tlibevtx_file_close(\n\t file,\n\t NULL );\n\non_error_libevtx_file:\n\tlibevtx_file_free(\n\t &file,\n\t NULL );\n\non_error_libbfio:\n\tlibbfio_handle_free(\n\t &file_io_handle,\n\t NULL );\n\n\treturn( 0 );\n}\n\n} /* extern \"C\" */\n\n" }, { "path": "po/ChangeLog", "content": "2016-11-01 gettextize \n" }, { "path": "po/Makevars.in", "content": "# Makefile variables for PO directory in any package using GNU gettext.\n\n# Usually the message domain is the same as the package name.\nDOMAIN = @PACKAGE@\n\n# These two variables depend on the location of this directory.\nsubdir = po\ntop_builddir = ..\n\n# These options get passed to xgettext.\nXGETTEXT_OPTIONS = --keyword=_ --keyword=N_\n\n# This is the copyright holder that gets inserted into the header of the\n# $(DOMAIN).pot file. Set this to the copyright holder of the surrounding\n# package. (Note that the msgstr strings, extracted from the package's\n# sources, belong to the copyright holder of the package.) Translators are\n# expected to transfer the copyright for their translations to this person\n# or entity, or to disclaim their copyright. The empty string stands for\n# the public domain; in this case the translators are expected to disclaim\n# their copyright.\nCOPYRIGHT_HOLDER = Joachim Metz\n\n# This is the email address or URL to which the translators shall report\n# bugs in the untranslated strings:\n# - Strings which are not entire sentences, see the maintainer guidelines\n# in the GNU gettext documentation, section 'Preparing Strings'.\n# - Strings which use unclear terms or require additional context to be\n# understood.\n# - Strings which make invalid assumptions about notation of date, time or\n# money.\n# - Pluralisation problems.\n# - Incorrect English spelling.\n# - Incorrect formatting.\n# It can be your email address, or a mailing list address where translators\n# can write to without being subscribed, or the URL of a web page through\n# which the translators can contact you.\nMSGID_BUGS_ADDRESS = @PACKAGE_BUGREPORT@\n\n# This is the list of locale categories, beyond LC_MESSAGES, for which the\n# message catalogs shall be used. It is usually empty.\nEXTRA_LOCALE_CATEGORIES =\n\n# Additional make targets.\nsources splint:\n\n" }, { "path": "po/POTFILES.in", "content": "# List of source files which contain translatable strings.\n" }, { "path": "pyevtx/Makefile.am", "content": "if HAVE_PYTHON\nAM_CFLAGS = \\\n\t-I../include -I$(top_srcdir)/include \\\n\t-I../common -I$(top_srcdir)/common \\\n\t@LIBCERROR_CPPFLAGS@ \\\n\t@LIBCDATA_CPPFLAGS@ \\\n\t@LIBCLOCALE_CPPFLAGS@ \\\n\t@LIBCSPLIT_CPPFLAGS@ \\\n\t@LIBUNA_CPPFLAGS@ \\\n\t@LIBCFILE_CPPFLAGS@ \\\n\t@LIBCPATH_CPPFLAGS@ \\\n\t@LIBBFIO_CPPFLAGS@ \\\n\t@LIBEVTX_DLL_IMPORT@\n\npyexec_LTLIBRARIES = pyevtx.la\n\npyevtx_la_SOURCES = \\\n\tpyevtx.c pyevtx.h \\\n\tpyevtx_codepage.c pyevtx_codepage.h \\\n\tpyevtx_datetime.c pyevtx_datetime.h \\\n\tpyevtx_error.c pyevtx_error.h \\\n\tpyevtx_event_levels.c pyevtx_event_levels.h \\\n\tpyevtx_file.c pyevtx_file.h \\\n\tpyevtx_file_flags.c pyevtx_file_flags.h \\\n\tpyevtx_file_object_io_handle.c pyevtx_file_object_io_handle.h \\\n\tpyevtx_integer.c pyevtx_integer.h \\\n\tpyevtx_libbfio.h \\\n\tpyevtx_libcerror.h \\\n\tpyevtx_libclocale.h \\\n\tpyevtx_libevtx.h \\\n\tpyevtx_python.h \\\n\tpyevtx_record.c pyevtx_record.h \\\n\tpyevtx_records.c pyevtx_records.h \\\n\tpyevtx_strings.c pyevtx_strings.h \\\n\tpyevtx_unused.h\n\npyevtx_la_LIBADD = \\\n\t@LIBCERROR_LIBADD@ \\\n\t../libevtx/libevtx.la \\\n\t@LIBCDATA_LIBADD@ \\\n\t@LIBCLOCALE_LIBADD@ \\\n\t@LIBCSPLIT_LIBADD@ \\\n\t@LIBUNA_LIBADD@ \\\n\t@LIBCFILE_LIBADD@ \\\n\t@LIBCPATH_LIBADD@ \\\n\t@LIBBFIO_LIBADD@\n\npyevtx_la_CPPFLAGS = $(PYTHON_CPPFLAGS)\npyevtx_la_LDFLAGS = -module -avoid-version $(PYTHON_LDFLAGS)\n\nendif\n\nDISTCLEANFILES = \\\n\tMakefile \\\n\tMakefile.in\n\n" }, { "path": "pyevtx/pyevtx.c", "content": "/*\n * Python bindings module for libevtx (pyevtx)\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#include \n#include \n#include \n\n#if defined( HAVE_STDLIB_H ) || defined( HAVE_WINAPI )\n#include \n#endif\n\n#include \"pyevtx.h\"\n#include \"pyevtx_error.h\"\n#include \"pyevtx_event_levels.h\"\n#include \"pyevtx_file.h\"\n#include \"pyevtx_file_flags.h\"\n#include \"pyevtx_file_object_io_handle.h\"\n#include \"pyevtx_libbfio.h\"\n#include \"pyevtx_libcerror.h\"\n#include \"pyevtx_libevtx.h\"\n#include \"pyevtx_python.h\"\n#include \"pyevtx_record.h\"\n#include \"pyevtx_records.h\"\n#include \"pyevtx_strings.h\"\n#include \"pyevtx_unused.h\"\n\n#if !defined( LIBEVTX_HAVE_BFIO )\n\nLIBEVTX_EXTERN \\\nint libevtx_check_file_signature_file_io_handle(\n libbfio_handle_t *file_io_handle,\n libevtx_error_t **error );\n\n#endif /* !defined( LIBEVTX_HAVE_BFIO ) */\n\n/* The pyevtx module methods\n */\nPyMethodDef pyevtx_module_methods[] = {\n\t{ \"get_version\",\n\t (PyCFunction) pyevtx_get_version,\n\t METH_NOARGS,\n\t \"get_version() -> String\\n\"\n\t \"\\n\"\n\t \"Retrieves the version.\" },\n\n\t{ \"check_file_signature\",\n\t (PyCFunction) pyevtx_check_file_signature,\n\t METH_VARARGS | METH_KEYWORDS,\n\t \"check_file_signature(filename) -> Boolean\\n\"\n\t \"\\n\"\n\t \"Checks if a file has a Windows XML Event Log (EVTX) file signature.\" },\n\n\t{ \"check_file_signature_file_object\",\n\t (PyCFunction) pyevtx_check_file_signature_file_object,\n\t METH_VARARGS | METH_KEYWORDS,\n\t \"check_file_signature_file_object(file_object) -> Boolean\\n\"\n\t \"\\n\"\n\t \"Checks if a file has a Windows XML Event Log (EVTX) file signature using a file-like object.\" },\n\n\t{ \"open\",\n\t (PyCFunction) pyevtx_open_new_file,\n\t METH_VARARGS | METH_KEYWORDS,\n\t \"open(filename, mode='r') -> Object\\n\"\n\t \"\\n\"\n\t \"Opens a file.\" },\n\n\t{ \"open_file_object\",\n\t (PyCFunction) pyevtx_open_new_file_with_file_object,\n\t METH_VARARGS | METH_KEYWORDS,\n\t \"open_file_object(file_object, mode='r') -> Object\\n\"\n\t \"\\n\"\n\t \"Opens a file using a file-like object.\" },\n\n\t/* Sentinel */\n\t{ NULL, NULL, 0, NULL }\n};\n\n/* Retrieves the pyevtx/libevtx version\n * Returns a Python object if successful or NULL on error\n */\nPyObject *pyevtx_get_version(\n PyObject *self PYEVTX_ATTRIBUTE_UNUSED,\n PyObject *arguments PYEVTX_ATTRIBUTE_UNUSED )\n{\n\tconst char *version_string = NULL;\n\tsize_t version_string_length = 0;\n\n\tPYEVTX_UNREFERENCED_PARAMETER( self )\n\tPYEVTX_UNREFERENCED_PARAMETER( arguments )\n\n\tPy_BEGIN_ALLOW_THREADS\n\n\tversion_string = libevtx_get_version();\n\n\tPy_END_ALLOW_THREADS\n\n\tversion_string_length = narrow_string_length(\n\t version_string );\n\n\t/* Pass the string length to PyUnicode_DecodeUTF8\n\t * otherwise it makes the end of string character is part\n\t * of the string\n\t */\n\treturn( PyUnicode_DecodeUTF8(\n\t version_string,\n\t (Py_ssize_t) version_string_length,\n\t NULL ) );\n}\n\n/* Checks if a file has a Windows XML Event Log (EVTX) file signature\n * Returns a Python object if successful or NULL on error\n */\nPyObject *pyevtx_check_file_signature(\n PyObject *self PYEVTX_ATTRIBUTE_UNUSED,\n PyObject *arguments,\n PyObject *keywords )\n{\n\tPyObject *string_object = NULL;\n\tlibcerror_error_t *error = NULL;\n\tconst char *filename_narrow = NULL;\n\tstatic char *function = \"pyevtx_check_file_signature\";\n\tstatic char *keyword_list[] = { \"filename\", NULL };\n\tint result = 0;\n\n#if defined( HAVE_WIDE_SYSTEM_CHARACTER )\n\tconst wchar_t *filename_wide = NULL;\n#else\n\tPyObject *utf8_string_object = NULL;\n#endif\n\n\tPYEVTX_UNREFERENCED_PARAMETER( self )\n\n\t/* Note that PyArg_ParseTupleAndKeywords with \"s\" will force Unicode strings to be converted to narrow character string.\n\t * On Windows the narrow character strings contains an extended ASCII string with a codepage. Hence we get a conversion\n\t * exception. This will also fail if the default encoding is not set correctly. We cannot use \"u\" here either since that\n\t * does not allow us to pass non Unicode string objects and Python (at least 2.7) does not seems to automatically upcast them.\n\t */\n\tif( PyArg_ParseTupleAndKeywords(\n\t arguments,\n\t keywords,\n\t \"O|\",\n\t keyword_list,\n\t &string_object ) == 0 )\n\t{\n\t\treturn( NULL );\n\t}\n\tPyErr_Clear();\n\n\tresult = PyObject_IsInstance(\n\t string_object,\n\t (PyObject *) &PyUnicode_Type );\n\n\tif( result == -1 )\n\t{\n\t\tpyevtx_error_fetch_and_raise(\n\t\t PyExc_RuntimeError,\n\t\t \"%s: unable to determine if string object is of type Unicode.\",\n\t\t function );\n\n\t\treturn( NULL );\n\t}\n\telse if( result != 0 )\n\t{\n\t\tPyErr_Clear();\n\n#if defined( HAVE_WIDE_SYSTEM_CHARACTER )\n#if PY_MAJOR_VERSION >= 3 && PY_MINOR_VERSION >= 3\n\t\tfilename_wide = (wchar_t *) PyUnicode_AsWideCharString(\n\t\t string_object,\n\t\t NULL );\n#else\n\t\tfilename_wide = (wchar_t *) PyUnicode_AsUnicode(\n\t\t string_object );\n#endif\n\t\tPy_BEGIN_ALLOW_THREADS\n\n\t\tresult = libevtx_check_file_signature_wide(\n\t\t filename_wide,\n\t\t &error );\n\n\t\tPy_END_ALLOW_THREADS\n\n#if PY_MAJOR_VERSION >= 3 && PY_MINOR_VERSION >= 3\n\t\tPyMem_Free(\n\t\t filename_wide );\n#endif\n#else\n\t\tutf8_string_object = PyUnicode_AsUTF8String(\n\t\t string_object );\n\n\t\tif( utf8_string_object == NULL )\n\t\t{\n\t\t\tpyevtx_error_fetch_and_raise(\n\t\t\t PyExc_RuntimeError,\n\t\t\t \"%s: unable to convert Unicode string to UTF-8.\",\n\t\t\t function );\n\n\t\t\treturn( NULL );\n\t\t}\n#if PY_MAJOR_VERSION >= 3\n\t\tfilename_narrow = PyBytes_AsString(\n\t\t utf8_string_object );\n#else\n\t\tfilename_narrow = PyString_AsString(\n\t\t utf8_string_object );\n#endif\n\t\tPy_BEGIN_ALLOW_THREADS\n\n\t\tresult = libevtx_check_file_signature(\n\t\t filename_narrow,\n\t\t &error );\n\n\t\tPy_END_ALLOW_THREADS\n\n\t\tPy_DecRef(\n\t\t utf8_string_object );\n\n#endif /* defined( HAVE_WIDE_SYSTEM_CHARACTER ) */\n\n\t\tif( result == -1 )\n\t\t{\n\t\t\tpyevtx_error_raise(\n\t\t\t error,\n\t\t\t PyExc_IOError,\n\t\t\t \"%s: unable to check file signature.\",\n\t\t\t function );\n\n\t\t\tlibcerror_error_free(\n\t\t\t &error );\n\n\t\t\treturn( NULL );\n\t\t}\n\t\tif( result != 0 )\n\t\t{\n\t\t\tPy_IncRef(\n\t\t\t (PyObject *) Py_True );\n\n\t\t\treturn( Py_True );\n\t\t}\n\t\tPy_IncRef(\n\t\t (PyObject *) Py_False );\n\n\t\treturn( Py_False );\n\t}\n\tPyErr_Clear();\n\n#if PY_MAJOR_VERSION >= 3\n\tresult = PyObject_IsInstance(\n\t string_object,\n\t (PyObject *) &PyBytes_Type );\n#else\n\tresult = PyObject_IsInstance(\n\t string_object,\n\t (PyObject *) &PyString_Type );\n#endif\n\tif( result == -1 )\n\t{\n\t\tpyevtx_error_fetch_and_raise(\n\t\t PyExc_RuntimeError,\n\t\t \"%s: unable to determine if string object is of type string.\",\n\t\t function );\n\n\t\treturn( NULL );\n\t}\n\telse if( result != 0 )\n\t{\n\t\tPyErr_Clear();\n\n#if PY_MAJOR_VERSION >= 3\n\t\tfilename_narrow = PyBytes_AsString(\n\t\t string_object );\n#else\n\t\tfilename_narrow = PyString_AsString(\n\t\t string_object );\n#endif\n\t\tPy_BEGIN_ALLOW_THREADS\n\n\t\tresult = libevtx_check_file_signature(\n\t\t filename_narrow,\n\t\t &error );\n\n\t\tPy_END_ALLOW_THREADS\n\n\t\tif( result == -1 )\n\t\t{\n\t\t\tpyevtx_error_raise(\n\t\t\t error,\n\t\t\t PyExc_IOError,\n\t\t\t \"%s: unable to check file signature.\",\n\t\t\t function );\n\n\t\t\tlibcerror_error_free(\n\t\t\t &error );\n\n\t\t\treturn( NULL );\n\t\t}\n\t\tif( result != 0 )\n\t\t{\n\t\t\tPy_IncRef(\n\t\t\t (PyObject *) Py_True );\n\n\t\t\treturn( Py_True );\n\t\t}\n\t\tPy_IncRef(\n\t\t (PyObject *) Py_False );\n\n\t\treturn( Py_False );\n\t}\n\tPyErr_Format(\n\t PyExc_TypeError,\n\t \"%s: unsupported string object type.\",\n\t function );\n\n\treturn( NULL );\n}\n\n/* Checks if a file has a Windows XML Event Log (EVTX) file signature using a file-like object\n * Returns a Python object if successful or NULL on error\n */\nPyObject *pyevtx_check_file_signature_file_object(\n PyObject *self PYEVTX_ATTRIBUTE_UNUSED,\n PyObject *arguments,\n PyObject *keywords )\n{\n\tPyObject *file_object = NULL;\n\tlibbfio_handle_t *file_io_handle = NULL;\n\tlibcerror_error_t *error = NULL;\n\tstatic char *function = \"pyevtx_check_file_signature_file_object\";\n\tstatic char *keyword_list[] = { \"file_object\", NULL };\n\tint result = 0;\n\n\tPYEVTX_UNREFERENCED_PARAMETER( self )\n\n\tif( PyArg_ParseTupleAndKeywords(\n\t arguments,\n\t keywords,\n\t \"O|\",\n\t keyword_list,\n\t &file_object ) == 0 )\n\t{\n\t\treturn( NULL );\n\t}\n\tif( pyevtx_file_object_initialize(\n\t &file_io_handle,\n\t file_object,\n\t &error ) != 1 )\n\t{\n\t\tpyevtx_error_raise(\n\t\t error,\n\t\t PyExc_MemoryError,\n\t\t \"%s: unable to initialize file IO handle.\",\n\t\t function );\n\n\t\tlibcerror_error_free(\n\t\t &error );\n\n\t\tgoto on_error;\n\t}\n\tPy_BEGIN_ALLOW_THREADS\n\n\tresult = libevtx_check_file_signature_file_io_handle(\n\t file_io_handle,\n\t &error );\n\n\tPy_END_ALLOW_THREADS\n\n\tif( result == -1 )\n\t{\n\t\tpyevtx_error_raise(\n\t\t error,\n\t\t PyExc_IOError,\n\t\t \"%s: unable to check file signature.\",\n\t\t function );\n\n\t\tlibcerror_error_free(\n\t\t &error );\n\n\t\tgoto on_error;\n\t}\n\tif( libbfio_handle_free(\n\t &file_io_handle,\n\t &error ) != 1 )\n\t{\n\t\tpyevtx_error_raise(\n\t\t error,\n\t\t PyExc_MemoryError,\n\t\t \"%s: unable to free file IO handle.\",\n\t\t function );\n\n\t\tlibcerror_error_free(\n\t\t &error );\n\n\t\tgoto on_error;\n\t}\n\tif( result != 0 )\n\t{\n\t\tPy_IncRef(\n\t\t (PyObject *) Py_True );\n\n\t\treturn( Py_True );\n\t}\n\tPy_IncRef(\n\t (PyObject *) Py_False );\n\n\treturn( Py_False );\n\non_error:\n\tif( file_io_handle != NULL )\n\t{\n\t\tlibbfio_handle_free(\n\t\t &file_io_handle,\n\t\t NULL );\n\t}\n\treturn( NULL );\n}\n\n/* Creates a new file object and opens it\n * Returns a Python object if successful or NULL on error\n */\nPyObject *pyevtx_open_new_file(\n PyObject *self PYEVTX_ATTRIBUTE_UNUSED,\n PyObject *arguments,\n PyObject *keywords )\n{\n\tpyevtx_file_t *pyevtx_file = NULL;\n\tstatic char *function = \"pyevtx_open_new_file\";\n\n\tPYEVTX_UNREFERENCED_PARAMETER( self )\n\n\t/* PyObject_New does not invoke tp_init\n\t */\n\tpyevtx_file = PyObject_New(\n\t struct pyevtx_file,\n\t &pyevtx_file_type_object );\n\n\tif( pyevtx_file == NULL )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_MemoryError,\n\t\t \"%s: unable to create file.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tif( pyevtx_file_init(\n\t pyevtx_file ) != 0 )\n\t{\n\t\tgoto on_error;\n\t}\n\tif( pyevtx_file_open(\n\t pyevtx_file,\n\t arguments,\n\t keywords ) == NULL )\n\t{\n\t\tgoto on_error;\n\t}\n\treturn( (PyObject *) pyevtx_file );\n\non_error:\n\tif( pyevtx_file != NULL )\n\t{\n\t\tPy_DecRef(\n\t\t (PyObject *) pyevtx_file );\n\t}\n\treturn( NULL );\n}\n\n/* Creates a new file object and opens it using a file-like object\n * Returns a Python object if successful or NULL on error\n */\nPyObject *pyevtx_open_new_file_with_file_object(\n PyObject *self PYEVTX_ATTRIBUTE_UNUSED,\n PyObject *arguments,\n PyObject *keywords )\n{\n\tpyevtx_file_t *pyevtx_file = NULL;\n\tstatic char *function = \"pyevtx_open_new_file_with_file_object\";\n\n\tPYEVTX_UNREFERENCED_PARAMETER( self )\n\n\t/* PyObject_New does not invoke tp_init\n\t */\n\tpyevtx_file = PyObject_New(\n\t struct pyevtx_file,\n\t &pyevtx_file_type_object );\n\n\tif( pyevtx_file == NULL )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_MemoryError,\n\t\t \"%s: unable to create file.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tif( pyevtx_file_init(\n\t pyevtx_file ) != 0 )\n\t{\n\t\tgoto on_error;\n\t}\n\tif( pyevtx_file_open_file_object(\n\t pyevtx_file,\n\t arguments,\n\t keywords ) == NULL )\n\t{\n\t\tgoto on_error;\n\t}\n\treturn( (PyObject *) pyevtx_file );\n\non_error:\n\tif( pyevtx_file != NULL )\n\t{\n\t\tPy_DecRef(\n\t\t (PyObject *) pyevtx_file );\n\t}\n\treturn( NULL );\n}\n\n#if PY_MAJOR_VERSION >= 3\n\n/* The pyevtx module definition\n */\nPyModuleDef pyevtx_module_definition = {\n\tPyModuleDef_HEAD_INIT,\n\n\t/* m_name */\n\t\"pyevtx\",\n\t/* m_doc */\n\t\"Python libevtx module (pyevtx).\",\n\t/* m_size */\n\t-1,\n\t/* m_methods */\n\tpyevtx_module_methods,\n\t/* m_reload */\n\tNULL,\n\t/* m_traverse */\n\tNULL,\n\t/* m_clear */\n\tNULL,\n\t/* m_free */\n\tNULL,\n};\n\n#endif /* PY_MAJOR_VERSION >= 3 */\n\n/* Initializes the pyevtx module\n */\n#if PY_MAJOR_VERSION >= 3\nPyMODINIT_FUNC PyInit_pyevtx(\n void )\n#else\nPyMODINIT_FUNC initpyevtx(\n void )\n#endif\n{\n\tPyObject *module = NULL;\n\tPyGILState_STATE gil_state = 0;\n\n#if defined( HAVE_DEBUG_OUTPUT )\n\tlibevtx_notify_set_stream(\n\t stderr,\n\t NULL );\n\tlibevtx_notify_set_verbose(\n\t 1 );\n#endif\n\n\t/* Create the module\n\t * This function must be called before grabbing the GIL\n\t * otherwise the module will segfault on a version mismatch\n\t */\n#if PY_MAJOR_VERSION >= 3\n\tmodule = PyModule_Create(\n\t &pyevtx_module_definition );\n#else\n\tmodule = Py_InitModule3(\n\t \"pyevtx\",\n\t pyevtx_module_methods,\n\t \"Python libevtx module (pyevtx).\" );\n#endif\n\tif( module == NULL )\n\t{\n#if PY_MAJOR_VERSION >= 3\n\t\treturn( NULL );\n#else\n\t\treturn;\n#endif\n\t}\n#if PY_VERSION_HEX < 0x03070000\n\tPyEval_InitThreads();\n#endif\n\tgil_state = PyGILState_Ensure();\n\n\t/* Setup the event_levels type object\n\t */\n\tpyevtx_event_levels_type_object.tp_new = PyType_GenericNew;\n\n\tif( pyevtx_event_levels_init_type(\n\t &pyevtx_event_levels_type_object ) != 1 )\n\t{\n\t\tgoto on_error;\n\t}\n\tif( PyType_Ready(\n\t &pyevtx_event_levels_type_object ) < 0 )\n\t{\n\t\tgoto on_error;\n\t}\n\tPy_IncRef(\n\t (PyObject *) &pyevtx_event_levels_type_object );\n\n\tPyModule_AddObject(\n\t module,\n\t \"event_levels\",\n\t (PyObject *) &pyevtx_event_levels_type_object );\n\n\t/* Setup the file type object\n\t */\n\tpyevtx_file_type_object.tp_new = PyType_GenericNew;\n\n\tif( PyType_Ready(\n\t &pyevtx_file_type_object ) < 0 )\n\t{\n\t\tgoto on_error;\n\t}\n\tPy_IncRef(\n\t (PyObject *) &pyevtx_file_type_object );\n\n\tPyModule_AddObject(\n\t module,\n\t \"file\",\n\t (PyObject *) &pyevtx_file_type_object );\n\n\t/* Setup the file_flags type object\n\t */\n\tpyevtx_file_flags_type_object.tp_new = PyType_GenericNew;\n\n\tif( pyevtx_file_flags_init_type(\n\t &pyevtx_file_flags_type_object ) != 1 )\n\t{\n\t\tgoto on_error;\n\t}\n\tif( PyType_Ready(\n\t &pyevtx_file_flags_type_object ) < 0 )\n\t{\n\t\tgoto on_error;\n\t}\n\tPy_IncRef(\n\t (PyObject *) &pyevtx_file_flags_type_object );\n\n\tPyModule_AddObject(\n\t module,\n\t \"file_flags\",\n\t (PyObject *) &pyevtx_file_flags_type_object );\n\n\t/* Setup the record type object\n\t */\n\tpyevtx_record_type_object.tp_new = PyType_GenericNew;\n\n\tif( PyType_Ready(\n\t &pyevtx_record_type_object ) < 0 )\n\t{\n\t\tgoto on_error;\n\t}\n\tPy_IncRef(\n\t (PyObject *) &pyevtx_record_type_object );\n\n\tPyModule_AddObject(\n\t module,\n\t \"record\",\n\t (PyObject *) &pyevtx_record_type_object );\n\n\t/* Setup the records type object\n\t */\n\tpyevtx_records_type_object.tp_new = PyType_GenericNew;\n\n\tif( PyType_Ready(\n\t &pyevtx_records_type_object ) < 0 )\n\t{\n\t\tgoto on_error;\n\t}\n\tPy_IncRef(\n\t (PyObject *) &pyevtx_records_type_object );\n\n\tPyModule_AddObject(\n\t module,\n\t \"records\",\n\t (PyObject *) &pyevtx_records_type_object );\n\n\t/* Setup the strings type object\n\t */\n\tpyevtx_strings_type_object.tp_new = PyType_GenericNew;\n\n\tif( PyType_Ready(\n\t &pyevtx_strings_type_object ) < 0 )\n\t{\n\t\tgoto on_error;\n\t}\n\tPy_IncRef(\n\t (PyObject *) &pyevtx_strings_type_object );\n\n\tPyModule_AddObject(\n\t module,\n\t \"strings\",\n\t (PyObject *) &pyevtx_strings_type_object );\n\n\tPyGILState_Release(\n\t gil_state );\n\n#if PY_MAJOR_VERSION >= 3\n\treturn( module );\n#else\n\treturn;\n#endif\n\non_error:\n\tPyGILState_Release(\n\t gil_state );\n\n#if PY_MAJOR_VERSION >= 3\n\treturn( NULL );\n#else\n\treturn;\n#endif\n}\n\n" }, { "path": "pyevtx/pyevtx.h", "content": "/*\n * Python bindings module for libevtx (pyevtx)\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#if !defined( _PYEVTX_H )\n#define _PYEVTX_H\n\n#include \n#include \n\n#include \"pyevtx_python.h\"\n\n#if defined( __cplusplus )\nextern \"C\" {\n#endif\n\nPyObject *pyevtx_get_version(\n PyObject *self,\n PyObject *arguments );\n\nPyObject *pyevtx_check_file_signature(\n PyObject *self,\n PyObject *arguments,\n PyObject *keywords );\n\nPyObject *pyevtx_check_file_signature_file_object(\n PyObject *self,\n PyObject *arguments,\n PyObject *keywords );\n\nPyObject *pyevtx_open_new_file(\n PyObject *self,\n PyObject *arguments,\n PyObject *keywords );\n\nPyObject *pyevtx_open_new_file_with_file_object(\n PyObject *self,\n PyObject *arguments,\n PyObject *keywords );\n\n#if PY_MAJOR_VERSION >= 3\nPyMODINIT_FUNC PyInit_pyevtx(\n void );\n#else\nPyMODINIT_FUNC initpyevtx(\n void );\n#endif\n\n#if defined( __cplusplus )\n}\n#endif\n\n#endif /* !defined( _PYEVTX_H ) */\n\n" }, { "path": "pyevtx/pyevtx_codepage.c", "content": "/*\n * Codepage functions\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#include \n#include \n\n#include \"pyevtx_codepage.h\"\n#include \"pyevtx_libevtx.h\"\n\n/* Returns a string representation of the codepage\n * Codecs and aliases are defined: http://docs.python.org/library/codecs.html#standard-encodings\n * Returns 1 if successful or NULL if codepage is not supported\n */\nconst char *pyevtx_codepage_to_string(\n int codepage )\n{\n\tswitch( codepage )\n\t{\n\t\tcase LIBEVTX_CODEPAGE_ASCII:\n\t\t\treturn( \"ascii\" );\n\n\t\tcase LIBEVTX_CODEPAGE_ISO_8859_1:\n\t\t\treturn( \"iso-8859-1\" );\n\n\t\tcase LIBEVTX_CODEPAGE_ISO_8859_2:\n\t\t\treturn( \"iso-8859-2\" );\n\n\t\tcase LIBEVTX_CODEPAGE_ISO_8859_3:\n\t\t\treturn( \"iso-8859-3\" );\n\n\t\tcase LIBEVTX_CODEPAGE_ISO_8859_4:\n\t\t\treturn( \"iso-8859-4\" );\n\n\t\tcase LIBEVTX_CODEPAGE_ISO_8859_5:\n\t\t\treturn( \"iso-8859-5\" );\n\n\t\tcase LIBEVTX_CODEPAGE_ISO_8859_6:\n\t\t\treturn( \"iso-8859-6\" );\n\n\t\tcase LIBEVTX_CODEPAGE_ISO_8859_7:\n\t\t\treturn( \"iso-8859-7\" );\n\n\t\tcase LIBEVTX_CODEPAGE_ISO_8859_8:\n\t\t\treturn( \"iso-8859-8\" );\n\n\t\tcase LIBEVTX_CODEPAGE_ISO_8859_9:\n\t\t\treturn( \"iso-8859-9\" );\n\n\t\tcase LIBEVTX_CODEPAGE_ISO_8859_10:\n\t\t\treturn( \"iso-8859-10\" );\n\n\t\tcase LIBEVTX_CODEPAGE_ISO_8859_11:\n\t\t\treturn( \"iso-8859-11\" );\n\n\t\tcase LIBEVTX_CODEPAGE_ISO_8859_13:\n\t\t\treturn( \"iso-8859-13\" );\n\n\t\tcase LIBEVTX_CODEPAGE_ISO_8859_14:\n\t\t\treturn( \"iso-8859-14\" );\n\n\t\tcase LIBEVTX_CODEPAGE_ISO_8859_15:\n\t\t\treturn( \"iso-8859-15\" );\n\n\t\tcase LIBEVTX_CODEPAGE_ISO_8859_16:\n\t\t\treturn( \"iso-8859-16\" );\n\n\t\tcase LIBEVTX_CODEPAGE_KOI8_R:\n\t\t\treturn( \"koi8_r\" );\n\n\t\tcase LIBEVTX_CODEPAGE_KOI8_U:\n\t\t\treturn( \"koi8_u\" );\n\n\t\tcase LIBEVTX_CODEPAGE_WINDOWS_874:\n\t\t\treturn( \"cp874\" );\n\n\t\tcase LIBEVTX_CODEPAGE_WINDOWS_932:\n\t\t\treturn( \"cp932\" );\n\n\t\tcase LIBEVTX_CODEPAGE_WINDOWS_936:\n\t\t\treturn( \"cp936\" );\n\n\t\tcase LIBEVTX_CODEPAGE_WINDOWS_949:\n\t\t\treturn( \"cp949\" );\n\n\t\tcase LIBEVTX_CODEPAGE_WINDOWS_950:\n\t\t\treturn( \"cp950\" );\n\n\t\tcase LIBEVTX_CODEPAGE_WINDOWS_1250:\n\t\t\treturn( \"cp1250\" );\n\n\t\tcase LIBEVTX_CODEPAGE_WINDOWS_1251:\n\t\t\treturn( \"cp1251\" );\n\n\t\tcase LIBEVTX_CODEPAGE_WINDOWS_1252:\n\t\t\treturn( \"cp1252\" );\n\n\t\tcase LIBEVTX_CODEPAGE_WINDOWS_1253:\n\t\t\treturn( \"cp1253\" );\n\n\t\tcase LIBEVTX_CODEPAGE_WINDOWS_1254:\n\t\t\treturn( \"cp1254\" );\n\n\t\tcase LIBEVTX_CODEPAGE_WINDOWS_1255:\n\t\t\treturn( \"cp1255\" );\n\n\t\tcase LIBEVTX_CODEPAGE_WINDOWS_1256:\n\t\t\treturn( \"cp1256\" );\n\n\t\tcase LIBEVTX_CODEPAGE_WINDOWS_1257:\n\t\t\treturn( \"cp1257\" );\n\n\t\tcase LIBEVTX_CODEPAGE_WINDOWS_1258:\n\t\t\treturn( \"cp1258\" );\n\n\t\tdefault:\n\t\t\tbreak;\n\t}\n\treturn( NULL );\n}\n\n" }, { "path": "pyevtx/pyevtx_codepage.h", "content": "/*\n * Codepage functions\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#if !defined( _PYEVTX_CODEPAGE_H )\n#define _PYEVTX_CODEPAGE_H\n\n#include \n#include \n\n#if defined( __cplusplus )\nextern \"C\" {\n#endif\n\nconst char *pyevtx_codepage_to_string(\n int codepage );\n\n/* TODO add list function */\n\n#if defined( __cplusplus )\n}\n#endif\n\n#endif /* !defined( _PYEVTX_CODEPAGE_H ) */\n\n" }, { "path": "pyevtx/pyevtx_datetime.c", "content": "/*\n * Date and time functions\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#include \n#include \n#include \n\n#include \"pyevtx_datetime.h\"\n#include \"pyevtx_python.h\"\n\n#include \n\n/* Creates a new datetime object from date and time elements\n * Returns a Python object if successful or NULL on error\n */\nPyObject *pyevtx_datetime_new_from_time_elements(\n uint16_t year,\n uint64_t number_of_days,\n uint8_t hours,\n uint8_t minutes,\n uint8_t seconds,\n uint32_t micro_seconds )\n{\n\tPyObject *datetime_object = NULL;\n\tstatic char *function = \"pyevtx_datetime_new_from_time_elements\";\n\tuint32_t days_in_century = 0;\n\tuint16_t days_in_year = 0;\n\tuint8_t day_of_month = 0;\n\tuint8_t days_in_month = 0;\n\tuint8_t month = 0;\n\n\twhile( number_of_days > 0 )\n\t{\n\t\tif( ( year % 400 ) == 0 )\n\t\t{\n\t\t\tdays_in_century = 36525;\n\t\t}\n\t\telse\n\t\t{\n\t\t\tdays_in_century = 36524;\n\t\t}\n\t\tif( number_of_days <= days_in_century )\n\t\t{\n\t\t\tbreak;\n\t\t}\n\t\tnumber_of_days -= days_in_century;\n\n\t\tyear += 100;\n\t}\n\twhile( number_of_days > 0 )\n\t{\n\t\t/* Check for a leap year\n\t\t * The year is ( ( dividable by 4 ) and ( not dividable by 100 ) ) or ( dividable by 400 )\n\t\t */\n\t\tif( ( ( ( year % 4 ) == 0 )\n\t\t && ( ( year % 100 ) != 0 ) )\n\t\t || ( ( year % 400 ) == 0 ) )\n\t\t{\n\t\t\tdays_in_year = 366;\n\t\t}\n\t\telse\n\t\t{\n\t\t\tdays_in_year = 365;\n\t\t}\n\t\tif( number_of_days <= days_in_year )\n\t\t{\n\t\t\tbreak;\n\t\t}\n\t\tnumber_of_days -= days_in_year;\n\n\t\tyear += 1;\n\t}\n\t/* Determine the month correct the value to days within the month\n\t */\n\tmonth = 1;\n\n\twhile( number_of_days > 0 )\n\t{\n\t\t/* February (2)\n\t\t */\n\t\tif( month == 2 )\n\t\t{\n\t\t\tif( ( ( ( year % 4 ) == 0 )\n\t\t\t && ( ( year % 100 ) != 0 ) )\n\t\t\t || ( ( year % 400 ) == 0 ) )\n\t\t\t{\n\t\t\t\tdays_in_month = 29;\n\t\t\t}\n\t\t\telse\n\t\t\t{\n\t\t\t\tdays_in_month = 28;\n\t\t\t}\n\t\t}\n\t\t/* April (4), June (6), September (9), November (11)\n\t\t */\n\t\telse if( ( month == 4 )\n\t\t || ( month == 6 )\n\t\t || ( month == 9 )\n\t\t || ( month == 11 ) )\n\t\t{\n\t\t\tdays_in_month = 30;\n\t\t}\n\t\t/* January (1), March (3), May (5), July (7), August (8), October (10), December (12)\n\t\t */\n\t\telse if( ( month == 1 )\n\t\t || ( month == 3 )\n\t\t || ( month == 5 )\n\t\t || ( month == 7 )\n\t\t || ( month == 8 )\n\t\t || ( month == 10 )\n\t\t || ( month == 12 ) )\n\t\t{\n\t\t\tdays_in_month = 31;\n\t\t}\n\t\t/* This should never happen, but just in case\n\t\t */\n\t\telse\n\t\t{\n\t\t\tPyErr_Format(\n\t\t\t PyExc_IOError,\n\t\t\t \"%s: unsupported month: %\" PRIu8 \".\",\n\t\t\t function,\n\t\t\t month );\n\n\t\t\treturn( NULL );\n\t\t}\n\t\tif( number_of_days <= days_in_month )\n\t\t{\n\t\t\tbreak;\n\t\t}\n\t\tnumber_of_days -= days_in_month;\n\n\t\tmonth += 1;\n\t}\n\t/* Determine the day\n\t */\n\tday_of_month = (uint8_t) number_of_days;\n\n\tPyDateTime_IMPORT;\n\n\tdatetime_object = (PyObject *) PyDateTime_FromDateAndTime(\n\t (int) year,\n\t (int) month,\n\t (int) day_of_month,\n\t (int) hours,\n\t (int) minutes,\n\t (int) seconds,\n\t (int) micro_seconds );\n\n\treturn( datetime_object );\n}\n\n/* Creates a new datetime object from a FAT date time\n * Returns a Python object if successful or NULL on error\n */\nPyObject *pyevtx_datetime_new_from_fat_date_time(\n uint32_t fat_date_time )\n{\n\tPyObject *datetime_object = NULL;\n\tstatic char *function = \"pyevtx_datetime_new_from_fat_date_time\";\n\tuint16_t year = 0;\n\tuint8_t day_of_month = 0;\n\tuint8_t days_in_month = 0;\n\tuint8_t hours = 0;\n\tuint8_t minutes = 0;\n\tuint8_t month = 0;\n\tuint8_t seconds = 0;\n\n\t/* The day of month is stored in the next 5 bits\n\t */\n\tday_of_month = fat_date_time & 0x1f;\n\tfat_date_time >>= 5;\n\n\t/* The month is stored in the next 4 bits\n\t */\n\tmonth = fat_date_time & 0x0f;\n\tfat_date_time >>= 4;\n\n\t/* The year is stored in the next 7 bits starting at 1980\n\t */\n\tyear = 1980 + ( fat_date_time & 0x7f );\n\tfat_date_time >>= 7;\n\n\t/* The number of seconds are stored in the lower 5 bits\n\t * in intervals of 2 seconds\n\t */\n\tseconds = ( fat_date_time & 0x1f ) * 2;\n\tfat_date_time >>= 5;\n\n\t/* The number of minutes are stored in the next 6 bits\n\t */\n\tminutes = fat_date_time & 0x3f;\n\tfat_date_time >>= 6;\n\n\t/* The number of hours are stored in the next 5 bits\n\t */\n\thours = fat_date_time & 0x1f;\n\n\t/* February (2)\n\t */\n\tif( month == 2 )\n\t{\n\t\tif( ( ( ( year % 4 ) == 0 )\n\t\t && ( ( year % 100 ) != 0 ) )\n\t\t || ( ( year % 400 ) == 0 ) )\n\t\t{\n\t\t\tdays_in_month = 29;\n\t\t}\n\t\telse\n\t\t{\n\t\t\tdays_in_month = 28;\n\t\t}\n\t}\n\t/* April (4), June (6), September (9), November (11)\n\t */\n\telse if( ( month == 4 )\n\t || ( month == 6 )\n\t || ( month == 9 )\n\t || ( month == 11 ) )\n\t{\n\t\tdays_in_month = 30;\n\t}\n\t/* January (1), March (3), May (5), July (7), August (8), October (10), December (12)\n\t */\n\telse if( ( month == 1 )\n\t || ( month == 3 )\n\t || ( month == 5 )\n\t || ( month == 7 )\n\t || ( month == 8 )\n\t || ( month == 10 )\n\t || ( month == 12 ) )\n\t{\n\t\tdays_in_month = 31;\n\t}\n\telse\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_IOError,\n\t\t \"%s: unsupported month: %\" PRIu8 \".\",\n\t\t function,\n\t\t month );\n\n\t\treturn( NULL );\n\t}\n\tif( ( day_of_month == 0 )\n\t || ( day_of_month > days_in_month ) )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_IOError,\n\t\t \"%s: unsupported day of month: %\" PRIu8 \".\",\n\t\t function,\n\t\t day_of_month );\n\n\t\treturn( NULL );\n\t}\n\tPyDateTime_IMPORT;\n\n\tdatetime_object = (PyObject *) PyDateTime_FromDateAndTime(\n\t (int) year,\n\t (int) month,\n\t (int) day_of_month,\n\t (int) hours,\n\t (int) minutes,\n\t (int) seconds,\n\t 0 );\n\n\treturn( datetime_object );\n}\n\n/* Creates a new datetime object from a FILETIME\n * Returns a Python object if successful or NULL on error\n */\nPyObject *pyevtx_datetime_new_from_filetime(\n uint64_t filetime )\n{\n\tPyObject *datetime_object = NULL;\n\tuint32_t micro_seconds = 0;\n\tuint16_t year = 0;\n\tuint8_t hours = 0;\n\tuint8_t minutes = 0;\n\tuint8_t seconds = 0;\n\n\t/* The timestamp is in units of 100 nano seconds correct the value to seconds\n\t */\n\tmicro_seconds = (uint32_t) ( filetime % 10000000 ) / 10;\n\tfiletime /= 10000000;\n\n\t/* There are 60 seconds in a minute correct the value to minutes\n\t */\n\tseconds = (uint8_t) ( filetime % 60 );\n\tfiletime /= 60;\n\n\t/* There are 60 minutes in an hour correct the value to hours\n\t */\n\tminutes = (uint8_t) ( filetime % 60 );\n\tfiletime /= 60;\n\n\t/* There are 24 hours in a day correct the value to days\n\t */\n\thours = (uint8_t) ( filetime % 24 );\n\tfiletime /= 24;\n\n\t/* Add 1 day to compensate that Jan 1 1601 is represented as 0\n\t */\n\tfiletime += 1;\n\n\t/* Determine the number of years starting at '1 Jan 1601 00:00:00'\n\t * correct the value to days within the year\n\t */\n\tyear = 1601;\n\n\tif( filetime >= 36159 )\n\t{\n\t\tyear = 1700;\n\n\t\tfiletime -= 36159;\n\t}\n\tdatetime_object = pyevtx_datetime_new_from_time_elements(\n\t year,\n\t filetime,\n\t hours,\n\t minutes,\n\t seconds,\n\t micro_seconds );\n\n\treturn( datetime_object );\n}\n\n/* Creates a new datetime object from a floatingtime\n * Returns a Python object if successful or NULL on error\n */\nPyObject *pyevtx_datetime_new_from_floatingtime(\n uint64_t floatingtime )\n{\n\tbyte_stream_float64_t timestamp;\n\n\tPyObject *datetime_object = NULL;\n\tstatic char *function = \"pyevtx_datetime_new_from_floatingtime\";\n\tuint32_t days_in_century = 0;\n\tuint32_t micro_seconds = 0;\n\tuint16_t days_in_year = 0;\n\tuint16_t year = 0;\n\tuint8_t day_of_month = 0;\n\tuint8_t days_in_month = 0;\n\tuint8_t hours = 0;\n\tuint8_t minutes = 0;\n\tuint8_t month = 0;\n\tuint8_t seconds = 0;\n\n\ttimestamp.integer = floatingtime;\n\n\t/* Determine the number of years starting at '30 Dec 1899 00:00:00'\n\t * correct the value to days within the year\n\t */\n\tyear = 1899;\n\n\tif( timestamp.floating_point >= 2 )\n\t{\n\t\tyear = 1900;\n\n\t\ttimestamp.floating_point -= 2;\n\t}\n\twhile( timestamp.floating_point > 0 )\n\t{\n\t\tif( ( year % 400 ) == 0 )\n\t\t{\n\t\t\tdays_in_century = 36525;\n\t\t}\n\t\telse\n\t\t{\n\t\t\tdays_in_century = 36524;\n\t\t}\n\t\tif( timestamp.floating_point <= days_in_century )\n\t\t{\n\t\t\tbreak;\n\t\t}\n\t\ttimestamp.floating_point -= days_in_century;\n\n\t\tyear += 100;\n\t}\n\twhile( timestamp.floating_point > 0 )\n\t{\n\t\t/* Check for a leap year\n\t\t * The year is ( ( dividable by 4 ) and ( not dividable by 100 ) ) or ( dividable by 400 )\n\t\t */\n\t\tif( ( ( ( year % 4 ) == 0 )\n\t\t && ( ( year % 100 ) != 0 ) )\n\t\t || ( ( year % 400 ) == 0 ) )\n\t\t{\n\t\t\tdays_in_year = 366;\n\t\t}\n\t\telse\n\t\t{\n\t\t\tdays_in_year = 365;\n\t\t}\n\t\tif( timestamp.floating_point <= days_in_year )\n\t\t{\n\t\t\tbreak;\n\t\t}\n\t\ttimestamp.floating_point -= days_in_year;\n\n\t\tyear += 1;\n\t}\n\t/* Determine the month correct the value to days within the month\n\t */\n\tmonth = 1;\n\n\twhile( timestamp.floating_point > 0 )\n\t{\n\t\t/* February (2)\n\t\t */\n\t\tif( month == 2 )\n\t\t{\n\t\t\tif( ( ( ( year % 4 ) == 0 )\n\t\t\t && ( ( year % 100 ) != 0 ) )\n\t\t\t || ( ( year % 400 ) == 0 ) )\n\t\t\t{\n\t\t\t\tdays_in_month = 29;\n\t\t\t}\n\t\t\telse\n\t\t\t{\n\t\t\t\tdays_in_month = 28;\n\t\t\t}\n\t\t}\n\t\t/* April (4), June (6), September (9), November (11)\n\t\t */\n\t\telse if( ( month == 4 )\n\t\t || ( month == 6 )\n\t\t || ( month == 9 )\n\t\t || ( month == 11 ) )\n\t\t{\n\t\t\tdays_in_month = 30;\n\t\t}\n\t\t/* January (1), March (3), May (5), July (7), August (8), October (10), December (12)\n\t\t */\n\t\telse if( ( month == 1 )\n\t\t || ( month == 3 )\n\t\t || ( month == 5 )\n\t\t || ( month == 7 )\n\t\t || ( month == 8 )\n\t\t || ( month == 10 )\n\t\t || ( month == 12 ) )\n\t\t{\n\t\t\tdays_in_month = 31;\n\t\t}\n\t\t/* This should never happen, but just in case\n\t\t */\n\t\telse\n\t\t{\n\t\t\tPyErr_Format(\n\t\t\t PyExc_IOError,\n\t\t\t \"%s: unsupported month: %\" PRIu8 \".\",\n\t\t\t function,\n\t\t\t month );\n\n\t\t\treturn( NULL );\n\t\t}\n\t\tif( timestamp.floating_point <= days_in_month )\n\t\t{\n\t\t\tbreak;\n\t\t}\n\t\ttimestamp.floating_point -= days_in_month;\n\n\t\tmonth += 1;\n\t}\n\t/* Determine the day\n\t */\n\tday_of_month = (uint8_t) timestamp.floating_point;\n\ttimestamp.floating_point -= day_of_month;\n\n\t/* There are 24 hours in a day correct the value to hours\n\t */\n\ttimestamp.floating_point *= 24;\n\thours = (uint8_t) timestamp.floating_point;\n\ttimestamp.floating_point -= hours;\n\n\t/* There are 60 minutes in an hour correct the value to minutes\n\t */\n\ttimestamp.floating_point *= 60;\n\tminutes = (uint8_t) timestamp.floating_point;\n\ttimestamp.floating_point -= minutes;\n\n\t/* There are 60 seconds in a minute correct the value to seconds\n\t */\n\ttimestamp.floating_point *= 60;\n\tseconds = (uint8_t) timestamp.floating_point;\n\ttimestamp.floating_point -= seconds;\n\n\t/* There are 1000 micro seconds in a seconds correct the value to micro seconds\n\t */\n\ttimestamp.floating_point *= 1000000;\n\tmicro_seconds = (uint8_t) timestamp.floating_point;\n\ttimestamp.floating_point -= micro_seconds;\n\n\tPyDateTime_IMPORT;\n\n\tdatetime_object = (PyObject *) PyDateTime_FromDateAndTime(\n\t (int) year,\n\t (int) month,\n\t (int) day_of_month,\n\t (int) hours,\n\t (int) minutes,\n\t (int) seconds,\n\t (int) micro_seconds );\n\n\treturn( datetime_object );\n}\n\n/* Creates a new datetime object from a HFS time\n * Returns a Python object if successful or NULL on error\n */\nPyObject *pyevtx_datetime_new_from_hfs_time(\n uint32_t hfs_time )\n{\n\tPyObject *datetime_object = NULL;\n\tuint16_t year = 0;\n\tuint8_t hours = 0;\n\tuint8_t minutes = 0;\n\tuint8_t seconds = 0;\n\n\t/* There are 60 seconds in a minute correct the value to minutes\n\t */\n\tseconds = (uint8_t) ( hfs_time % 60 );\n\thfs_time /= 60;\n\n\t/* There are 60 minutes in an hour correct the value to hours\n\t */\n\tminutes = (uint8_t) ( hfs_time % 60 );\n\thfs_time /= 60;\n\n\t/* There are 24 hours in a day correct the value to days\n\t */\n\thours = (uint8_t) ( hfs_time % 24 );\n\thfs_time /= 24;\n\n\t/* Add 1 day to compensate that Jan 1 1904 is represented as 0\n\t */\n\thfs_time += 1;\n\n\t/* Determine the number of years starting at '1 Jan 1904 00:00:00'\n\t * correct the value to days within the year\n\t */\n\tyear = 1904;\n\n\tif( hfs_time >= 35064 )\n\t{\n\t\tyear = 2000;\n\n\t\thfs_time -= 35064;\n\t}\n\tdatetime_object = pyevtx_datetime_new_from_time_elements(\n\t year,\n\t (uint64_t) hfs_time,\n\t hours,\n\t minutes,\n\t seconds,\n\t 0 );\n\n\treturn( datetime_object );\n}\n\n/* Creates a new datetime object from a POSIX time\n * Returns a Python object if successful or NULL on error\n */\nPyObject *pyevtx_datetime_new_from_posix_time(\n int64_t posix_time )\n{\n\tPyObject *datetime_object = NULL;\n\tuint16_t year = 0;\n\tuint8_t hours = 0;\n\tuint8_t minutes = 0;\n\tuint8_t seconds = 0;\n\n\t/* There are 60 seconds in a minute correct the value to minutes\n\t */\n\tseconds = posix_time % 60;\n\tposix_time /= 60;\n\n\t/* There are 60 minutes in an hour correct the value to hours\n\t */\n\tminutes = posix_time % 60;\n\tposix_time /= 60;\n\n\t/* There are 24 hours in a day correct the value to days\n\t */\n\thours = posix_time % 24;\n\tposix_time /= 24;\n\n\t/* Add 1 day to compensate that Jan 1 1601 is represented as 0\n\t */\n\tposix_time += 1;\n\n\t/* Determine the number of years starting at '1 Jan 1970 00:00:00'\n\t * correct the value to days within the year\n\t */\n\tyear = 1970;\n\n\tif( posix_time >= 10957 )\n\t{\n\t\tyear = 2000;\n\n\t\tposix_time -= 10957;\n\t}\n\tdatetime_object = pyevtx_datetime_new_from_time_elements(\n\t year,\n\t (uint64_t) posix_time,\n\t hours,\n\t minutes,\n\t seconds,\n\t 0 );\n\n\treturn( datetime_object );\n}\n\n/* Creates a new datetime object from a POSIX time in micro seconds\n * Returns a Python object if successful or NULL on error\n */\nPyObject *pyevtx_datetime_new_from_posix_time_in_micro_seconds(\n int64_t posix_time )\n{\n\tPyObject *datetime_object = NULL;\n\tuint32_t micro_seconds = 0;\n\tuint16_t year = 0;\n\tuint8_t hours = 0;\n\tuint8_t minutes = 0;\n\tuint8_t seconds = 0;\n\n\t/* There are 1000000 micro seconds in a second correct the value to seconds\n\t */\n\tmicro_seconds = (uint32_t) ( posix_time % 1000000 );\n\tposix_time /= 1000000;\n\n\t/* There are 60 seconds in a minute correct the value to minutes\n\t */\n\tseconds = posix_time % 60;\n\tposix_time /= 60;\n\n\t/* There are 60 minutes in an hour correct the value to hours\n\t */\n\tminutes = posix_time % 60;\n\tposix_time /= 60;\n\n\t/* There are 24 hours in a day correct the value to days\n\t */\n\thours = posix_time % 24;\n\tposix_time /= 24;\n\n\t/* Add 1 day to compensate that Jan 1 1970 is represented as 0\n\t */\n\tposix_time += 1;\n\n\t/* Determine the number of years starting at '1 Jan 1970 00:00:00'\n\t * correct the value to days within the year\n\t */\n\tyear = 1970;\n\n\tif( posix_time >= 10957 )\n\t{\n\t\tyear = 2000;\n\n\t\tposix_time -= 10957;\n\t}\n\tdatetime_object = pyevtx_datetime_new_from_time_elements(\n\t year,\n\t (uint64_t) posix_time,\n\t hours,\n\t minutes,\n\t seconds,\n\t micro_seconds );\n\n\treturn( datetime_object );\n}\n\n" }, { "path": "pyevtx/pyevtx_datetime.h", "content": "/*\n * Date and time functions\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#if !defined( _PYEVTX_DATETIME_H )\n#define _PYEVTX_DATETIME_H\n\n#include \n#include \n\n#include \"pyevtx_python.h\"\n\n#if defined( __cplusplus )\nextern \"C\" {\n#endif\n\nPyObject *pyevtx_datetime_new_from_time_elements(\n uint16_t year,\n uint64_t number_of_days,\n uint8_t hours,\n uint8_t minutes,\n uint8_t seconds,\n uint32_t micro_seconds );\n\nPyObject *pyevtx_datetime_new_from_fat_date_time(\n uint32_t fat_date_time );\n\nPyObject *pyevtx_datetime_new_from_filetime(\n uint64_t filetime );\n\nPyObject *pyevtx_datetime_new_from_floatingtime(\n uint64_t floatingtime );\n\nPyObject *pyevtx_datetime_new_from_hfs_time(\n uint32_t hfs_time );\n\nPyObject *pyevtx_datetime_new_from_posix_time(\n int64_t posix_time );\n\nPyObject *pyevtx_datetime_new_from_posix_time_in_micro_seconds(\n int64_t posix_time );\n\n#if defined( __cplusplus )\n}\n#endif\n\n#endif /* !defined( _PYEVTX_DATETIME_H ) */\n\n" }, { "path": "pyevtx/pyevtx_error.c", "content": "/*\n * Error functions\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#include \n#include \n#include \n#include \n\n#if defined( HAVE_STDARG_H ) || defined( WINAPI )\n#include \n#elif defined( HAVE_VARARGS_H )\n#include \n#else\n#error Missing headers stdarg.h and varargs.h\n#endif\n\n#include \"pyevtx_error.h\"\n#include \"pyevtx_libcerror.h\"\n#include \"pyevtx_python.h\"\n\n#if defined( HAVE_STDARG_H ) || defined( WINAPI )\n#define VARARGS( function, error, error_domain, error_code, type, argument ) \\\n\tfunction( error, error_domain, error_code, type argument, ... )\n#define VASTART( argument_list, type, name ) \\\n\tva_start( argument_list, name )\n#define VAEND( argument_list ) \\\n\tva_end( argument_list )\n\n#elif defined( HAVE_VARARGS_H )\n#define VARARGS( function, error, error_domain, error_code, type, argument ) \\\n\tfunction( error, error_domain, error_code, va_alist ) va_dcl\n#define VASTART( argument_list, type, name ) \\\n\t{ type name; va_start( argument_list ); name = va_arg( argument_list, type )\n#define VAEND( argument_list ) \\\n\tva_end( argument_list ); }\n\n#endif\n\n/* Fetches an error\n */\nvoid VARARGS(\n pyevtx_error_fetch,\n libcerror_error_t **error,\n int error_domain,\n int error_code,\n const char *,\n format_string )\n{\n\tva_list argument_list;\n\n\tchar error_string[ PYEVTX_ERROR_STRING_SIZE ];\n\n PyObject *exception_traceback = NULL;\n PyObject *exception_type = NULL;\n PyObject *exception_value = NULL;\n PyObject *string_object = NULL;\n\tstatic char *function = \"pyevtx_error_fetch\";\n\tchar *exception_string = NULL;\n\tsize_t error_string_length = 0;\n\tint print_count = 0;\n\n#if PY_MAJOR_VERSION >= 3\n\tPyObject *utf8_string_object = NULL;\n#endif\n\n\tif( format_string == NULL )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_ValueError,\n\t\t \"%s: missing format string.\",\n\t\t function );\n\n\t\treturn;\n\t}\n\tVASTART(\n\t argument_list,\n\t const char *,\n\t format_string );\n\n\tprint_count = PyOS_vsnprintf(\n\t error_string,\n\t PYEVTX_ERROR_STRING_SIZE,\n\t format_string,\n\t argument_list );\n\n\tVAEND(\n\t argument_list );\n\n\tif( print_count < 0 )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_ValueError,\n\t\t \"%s: unable to format error string.\",\n\t\t function );\n\n\t\treturn;\n\t}\n\terror_string_length = narrow_string_length(\n\t error_string );\n\n\tif( ( error_string_length >= 1 )\n\t && ( error_string[ error_string_length - 1 ] == '.' ) )\n\t{\n\t\terror_string[ error_string_length - 1 ] = 0;\n\t}\n\tPyErr_Fetch(\n\t &exception_type,\n\t &exception_value,\n\t &exception_traceback );\n\n\tstring_object = PyObject_Repr(\n\t exception_value );\n\n#if PY_MAJOR_VERSION >= 3\n\tutf8_string_object = PyUnicode_AsUTF8String(\n\t string_object );\n\n\tif( utf8_string_object != NULL )\n\t{\n\t\texception_string = PyBytes_AsString(\n\t\t utf8_string_object );\n\t}\n#else\n\texception_string = PyString_AsString(\n\t string_object );\n#endif\n\tif( exception_string != NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t error_domain,\n\t\t error_code,\n\t\t \"%s with error: %s.\",\n\t\t error_string,\n\t\t exception_string );\n\t}\n\telse\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t error_domain,\n\t\t error_code,\n\t\t \"%s.\",\n\t\t error_string );\n\t}\n#if PY_MAJOR_VERSION >= 3\n\tif( utf8_string_object != NULL )\n\t{\n\t\tPy_DecRef(\n\t\t utf8_string_object );\n\t}\n#endif\n\tPy_DecRef(\n\t string_object );\n\n\treturn;\n}\n\n#undef VARARGS\n#undef VASTART\n#undef VAEND\n\n#if defined( HAVE_STDARG_H ) || defined( WINAPI )\n#define VARARGS( function, exception_object, type, argument ) \\\n\tfunction( exception_object, type argument, ... )\n#define VASTART( argument_list, type, name ) \\\n\tva_start( argument_list, name )\n#define VAEND( argument_list ) \\\n\tva_end( argument_list )\n\n#elif defined( HAVE_VARARGS_H )\n#define VARARGS( function, exception_object, type, argument ) \\\n\tfunction( exception_object, va_alist ) va_dcl\n#define VASTART( argument_list, type, name ) \\\n\t{ type name; va_start( argument_list ); name = va_arg( argument_list, type )\n#define VAEND( argument_list ) \\\n\tva_end( argument_list ); }\n\n#endif\n\n/* Fetches and raises an error\n */\nvoid VARARGS(\n pyevtx_error_fetch_and_raise,\n PyObject *exception_object,\n const char *,\n format_string )\n{\n\tva_list argument_list;\n\n\tchar error_string[ PYEVTX_ERROR_STRING_SIZE ];\n\n\tPyObject *exception_traceback = NULL;\n\tPyObject *exception_type = NULL;\n\tPyObject *exception_value = NULL;\n\tPyObject *string_object = NULL;\n\tstatic char *function = \"pyevtx_error_fetch_and_raise\";\n\tchar *exception_string = NULL;\n\tsize_t error_string_length = 0;\n\tint print_count = 0;\n\n#if PY_MAJOR_VERSION >= 3\n\tPyObject *utf8_string_object = NULL;\n#endif\n\n\tif( format_string == NULL )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_ValueError,\n\t\t \"%s: missing format string.\",\n\t\t function );\n\n\t\treturn;\n\t}\n\tVASTART(\n\t argument_list,\n\t const char *,\n\t format_string );\n\n\tprint_count = PyOS_vsnprintf(\n\t error_string,\n\t PYEVTX_ERROR_STRING_SIZE,\n\t format_string,\n\t argument_list );\n\n\tVAEND(\n\t argument_list );\n\n\tif( print_count < 0 )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_ValueError,\n\t\t \"%s: unable to format exception string.\",\n\t\t function );\n\n\t\treturn;\n\t}\n\terror_string_length = narrow_string_length(\n\t error_string );\n\n\tif( ( error_string_length >= 1 )\n\t && ( error_string[ error_string_length - 1 ] == '.' ) )\n\t{\n\t\terror_string[ error_string_length - 1 ] = 0;\n\t}\n\tPyErr_Fetch(\n\t &exception_type,\n\t &exception_value,\n\t &exception_traceback );\n\n\tstring_object = PyObject_Repr(\n\t exception_value );\n\n#if PY_MAJOR_VERSION >= 3\n\tutf8_string_object = PyUnicode_AsUTF8String(\n\t string_object );\n\n\tif( utf8_string_object != NULL )\n\t{\n\t\texception_string = PyBytes_AsString(\n\t\t utf8_string_object );\n\t}\n#else\n\texception_string = PyString_AsString(\n\t string_object );\n#endif\n\tif( exception_string != NULL )\n\t{\n\t\tPyErr_Format(\n\t\t exception_object,\n\t\t \"%s with error: %s.\",\n\t\t error_string,\n\t\t exception_string );\n\t}\n\telse\n\t{\n\t\tPyErr_Format(\n\t\t exception_object,\n\t\t \"%s.\",\n\t\t error_string );\n\t}\n\tPy_DecRef(\n\t string_object );\n\n\treturn;\n}\n\n#undef VARARGS\n#undef VASTART\n#undef VAEND\n\n#if defined( HAVE_STDARG_H ) || defined( WINAPI )\n#define VARARGS( function, error, exception_object, type, argument ) \\\n\tfunction( error, exception_object, type argument, ... )\n#define VASTART( argument_list, type, name ) \\\n\tva_start( argument_list, name )\n#define VAEND( argument_list ) \\\n\tva_end( argument_list )\n\n#elif defined( HAVE_VARARGS_H )\n#define VARARGS( function, error, exception_object, type, argument ) \\\n\tfunction( error, exception_object, va_alist ) va_dcl\n#define VASTART( argument_list, type, name ) \\\n\t{ type name; va_start( argument_list ); name = va_arg( argument_list, type )\n#define VAEND( argument_list ) \\\n\tva_end( argument_list ); }\n\n#endif\n\n/* Raises an error\n */\nvoid VARARGS(\n pyevtx_error_raise,\n libcerror_error_t *error,\n PyObject *exception_object,\n const char *,\n format_string )\n{\n\tva_list argument_list;\n\n\tchar error_string[ PYEVTX_ERROR_STRING_SIZE ];\n\tchar exception_string[ PYEVTX_ERROR_STRING_SIZE ];\n\n\tstatic char *function = \"pyevtx_error_raise\";\n\tsize_t error_string_index = 0;\n\tint print_count = 0;\n\n\tif( format_string == NULL )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_ValueError,\n\t\t \"%s: missing format string.\",\n\t\t function );\n\n\t\treturn;\n\t}\n\tVASTART(\n\t argument_list,\n\t const char *,\n\t format_string );\n\n\tprint_count = PyOS_vsnprintf(\n\t exception_string,\n\t PYEVTX_ERROR_STRING_SIZE,\n\t format_string,\n\t argument_list );\n\n\tVAEND(\n\t argument_list );\n\n\tif( print_count < 0 )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_ValueError,\n\t\t \"%s: unable to format exception string.\",\n\t\t function );\n\n\t\treturn;\n\t}\n\tif( error != NULL )\n\t{\n\t\tif( libcerror_error_backtrace_sprint(\n\t\t error,\n\t\t error_string,\n\t\t PYEVTX_ERROR_STRING_SIZE ) != -1 )\n\t\t{\n\t\t\twhile( error_string_index < PYEVTX_ERROR_STRING_SIZE )\n\t\t\t{\n\t\t\t\tif( error_string[ error_string_index ] == 0 )\n\t\t\t\t{\n\t\t\t\t\tbreak;\n\t\t\t\t}\n\t\t\t\tif( ( error_string[ error_string_index ] == '\\n' )\n\t\t\t\t || ( error_string[ error_string_index ] == '\\r' ) )\n\t\t\t\t{\n\t\t\t\t\terror_string[ error_string_index ] = ' ';\n\t\t\t\t}\n\t\t\t\terror_string_index++;\n\t\t\t}\n\t\t\tif( error_string_index >= PYEVTX_ERROR_STRING_SIZE )\n\t\t\t{\n\t\t\t\terror_string[ PYEVTX_ERROR_STRING_SIZE - 1 ] = 0;\n\t\t\t}\n\t\t\tPyErr_Format(\n\t\t\t exception_object,\n\t\t\t \"%s %s\",\n\t\t\t exception_string,\n\t\t\t error_string );\n\n\t\t\treturn;\n\t\t}\n\t}\n\tPyErr_Format(\n\t exception_object,\n\t \"%s\",\n\t exception_string );\n\n\treturn;\n}\n\n#undef VARARGS\n#undef VASTART\n#undef VAEND\n\n" }, { "path": "pyevtx/pyevtx_error.h", "content": "/*\n * Error functions\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#if !defined( _PYEVTX_ERROR_H )\n#define _PYEVTX_ERROR_H\n\n#include \n#include \n\n#include \"pyevtx_libcerror.h\"\n#include \"pyevtx_python.h\"\n\n#define PYEVTX_ERROR_STRING_SIZE\t2048\n\n#if defined( __cplusplus )\nextern \"C\" {\n#endif\n\nvoid pyevtx_error_fetch(\n libcerror_error_t **error,\n int error_domain,\n int error_code,\n const char *format_string,\n ... );\n\nvoid pyevtx_error_fetch_and_raise(\n PyObject *exception_object,\n const char *format_string,\n ... );\n\nvoid pyevtx_error_raise(\n libcerror_error_t *error,\n PyObject *exception_object,\n const char *format_string,\n ... );\n\n#if defined( __cplusplus )\n}\n#endif\n\n#endif /* !defined( _PYEVTX_ERROR_H ) */\n\n" }, { "path": "pyevtx/pyevtx_event_levels.c", "content": "/*\n * Python object definition of the libevtx event levels\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#include \n#include \n\n#if defined( HAVE_STDLIB_H ) || defined( HAVE_WINAPI )\n#include \n#endif\n\n#include \"pyevtx_event_levels.h\"\n#include \"pyevtx_libevtx.h\"\n#include \"pyevtx_python.h\"\n#include \"pyevtx_unused.h\"\n\nPyTypeObject pyevtx_event_levels_type_object = {\n\tPyVarObject_HEAD_INIT( NULL, 0 )\n\n\t/* tp_name */\n\t\"pyevtx.event_levels\",\n\t/* tp_basicsize */\n\tsizeof( pyevtx_event_levels_t ),\n\t/* tp_itemsize */\n\t0,\n\t/* tp_dealloc */\n\t(destructor) pyevtx_event_levels_free,\n\t/* tp_print */\n\t0,\n\t/* tp_getattr */\n\t0,\n\t/* tp_setattr */\n\t0,\n\t/* tp_compare */\n\t0,\n\t/* tp_repr */\n\t0,\n\t/* tp_as_number */\n\t0,\n\t/* tp_as_sequence */\n\t0,\n\t/* tp_as_mapping */\n\t0,\n\t/* tp_hash */\n\t0,\n\t/* tp_call */\n\t0,\n\t/* tp_str */\n\t0,\n\t/* tp_getattro */\n\t0,\n\t/* tp_setattro */\n\t0,\n\t/* tp_as_buffer */\n\t0,\n\t/* tp_flags */\n\tPy_TPFLAGS_DEFAULT,\n\t/* tp_doc */\n\t\"pyevtx event levels object (wraps LIBEVTX_EVENT_LEVELS)\",\n\t/* tp_traverse */\n\t0,\n\t/* tp_clear */\n\t0,\n\t/* tp_richcompare */\n\t0,\n\t/* tp_weaklistoffset */\n\t0,\n\t/* tp_iter */\n\t0,\n\t/* tp_iternext */\n\t0,\n\t/* tp_methods */\n\t0,\n\t/* tp_members */\n\t0,\n\t/* tp_getset */\n\t0,\n\t/* tp_base */\n\t0,\n\t/* tp_dict */\n\t0,\n\t/* tp_descr_get */\n\t0,\n\t/* tp_descr_set */\n\t0,\n\t/* tp_dictoffset */\n\t0,\n\t/* tp_init */\n\t(initproc) pyevtx_event_levels_init,\n\t/* tp_alloc */\n\t0,\n\t/* tp_new */\n\t0,\n\t/* tp_free */\n\t0,\n\t/* tp_is_gc */\n\t0,\n\t/* tp_bases */\n\tNULL,\n\t/* tp_mro */\n\tNULL,\n\t/* tp_cache */\n\tNULL,\n\t/* tp_subclasses */\n\tNULL,\n\t/* tp_weaklist */\n\tNULL,\n\t/* tp_del */\n\t0\n};\n\n/* Initializes the type object\n * Returns 1 if successful or -1 on error\n */\nint pyevtx_event_levels_init_type(\n PyTypeObject *type_object )\n{\n\tPyObject *value_object = NULL;\n\n\tif( type_object == NULL )\n\t{\n\t\treturn( -1 );\n\t}\n\ttype_object->tp_dict = PyDict_New();\n\n\tif( type_object->tp_dict == NULL )\n\t{\n\t\treturn( -1 );\n\t}\n#if PY_MAJOR_VERSION >= 3\n\tvalue_object = PyLong_FromLong(\n\t LIBEVTX_EVENT_LEVEL_CRITICAL );\n#else\n\tvalue_object = PyInt_FromLong(\n\t LIBEVTX_EVENT_LEVEL_CRITICAL );\n#endif\n\tif( PyDict_SetItemString(\n\t type_object->tp_dict,\n\t \"CRITICAL\",\n\t value_object ) != 0 )\n\t{\n\t\tgoto on_error;\n\t}\n#if PY_MAJOR_VERSION >= 3\n\tvalue_object = PyLong_FromLong(\n\t LIBEVTX_EVENT_LEVEL_ERROR );\n#else\n\tvalue_object = PyInt_FromLong(\n\t LIBEVTX_EVENT_LEVEL_ERROR );\n#endif\n\tif( PyDict_SetItemString(\n\t type_object->tp_dict,\n\t \"ERROR\",\n\t value_object ) != 0 )\n\t{\n\t\tgoto on_error;\n\t}\n#if PY_MAJOR_VERSION >= 3\n\tvalue_object = PyLong_FromLong(\n\t LIBEVTX_EVENT_LEVEL_WARNING );\n#else\n\tvalue_object = PyInt_FromLong(\n\t LIBEVTX_EVENT_LEVEL_WARNING );\n#endif\n\tif( PyDict_SetItemString(\n\t type_object->tp_dict,\n\t \"WARNING\",\n\t value_object ) != 0 )\n\t{\n\t\tgoto on_error;\n\t}\n#if PY_MAJOR_VERSION >= 3\n\tvalue_object = PyLong_FromLong(\n\t LIBEVTX_EVENT_LEVEL_INFORMATION );\n#else\n\tvalue_object = PyInt_FromLong(\n\t LIBEVTX_EVENT_LEVEL_INFORMATION );\n#endif\n\tif( PyDict_SetItemString(\n\t type_object->tp_dict,\n\t \"INFORMATION\",\n\t value_object ) != 0 )\n\t{\n\t\tgoto on_error;\n\t}\n#if PY_MAJOR_VERSION >= 3\n\tvalue_object = PyLong_FromLong(\n\t LIBEVTX_EVENT_LEVEL_VERBOSE );\n#else\n\tvalue_object = PyInt_FromLong(\n\t LIBEVTX_EVENT_LEVEL_VERBOSE );\n#endif\n\tif( PyDict_SetItemString(\n\t type_object->tp_dict,\n\t \"VERBOSE\",\n\t value_object ) != 0 )\n\t{\n\t\tgoto on_error;\n\t}\n\treturn( 1 );\n\non_error:\n\tif( type_object->tp_dict != NULL )\n\t{\n\t\tPy_DecRef(\n\t\t type_object->tp_dict );\n\n\t\ttype_object->tp_dict = NULL;\n\t}\n\treturn( -1 );\n}\n\n/* Creates a new event levels object\n * Returns a Python object if successful or NULL on error\n */\nPyObject *pyevtx_event_levels_new(\n void )\n{\n\tpyevtx_event_levels_t *definitions_object = NULL;\n\tstatic char *function = \"pyevtx_event_levels_new\";\n\n\tdefinitions_object = PyObject_New(\n\t struct pyevtx_event_levels,\n\t &pyevtx_event_levels_type_object );\n\n\tif( definitions_object == NULL )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_MemoryError,\n\t\t \"%s: unable to create definitions object.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tif( pyevtx_event_levels_init(\n\t definitions_object ) != 0 )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_MemoryError,\n\t\t \"%s: unable to initialize definitions object.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\treturn( (PyObject *) definitions_object );\n\non_error:\n\tif( definitions_object != NULL )\n\t{\n\t\tPy_DecRef(\n\t\t (PyObject *) definitions_object );\n\t}\n\treturn( NULL );\n}\n\n/* Initializes an event levels object\n * Returns 0 if successful or -1 on error\n */\nint pyevtx_event_levels_init(\n pyevtx_event_levels_t *definitions_object )\n{\n\tstatic char *function = \"pyevtx_event_levels_init\";\n\n\tif( definitions_object == NULL )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_TypeError,\n\t\t \"%s: invalid definitions object.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\treturn( 0 );\n}\n\n/* Frees an event levels object\n */\nvoid pyevtx_event_levels_free(\n pyevtx_event_levels_t *definitions_object )\n{\n\tstruct _typeobject *ob_type = NULL;\n\tstatic char *function = \"pyevtx_event_levels_free\";\n\n\tif( definitions_object == NULL )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_TypeError,\n\t\t \"%s: invalid definitions object.\",\n\t\t function );\n\n\t\treturn;\n\t}\n\tob_type = Py_TYPE(\n\t definitions_object );\n\n\tif( ob_type == NULL )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_ValueError,\n\t\t \"%s: missing ob_type.\",\n\t\t function );\n\n\t\treturn;\n\t}\n\tif( ob_type->tp_free == NULL )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_ValueError,\n\t\t \"%s: invalid ob_type - missing tp_free.\",\n\t\t function );\n\n\t\treturn;\n\t}\n\tob_type->tp_free(\n\t (PyObject*) definitions_object );\n}\n\n" }, { "path": "pyevtx/pyevtx_event_levels.h", "content": "/*\n * Python object definition of the libevtx event levels\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#if !defined( _PYEVTX_EVENT_LEVELS_H )\n#define _PYEVTX_EVENT_LEVELS_H\n\n#include \n#include \n\n#include \"pyevtx_libevtx.h\"\n#include \"pyevtx_python.h\"\n\n#if defined( __cplusplus )\nextern \"C\" {\n#endif\n\ntypedef struct pyevtx_event_levels pyevtx_event_levels_t;\n\nstruct pyevtx_event_levels\n{\n\t/* Python object initialization\n\t */\n\tPyObject_HEAD\n};\n\nextern PyTypeObject pyevtx_event_levels_type_object;\n\nint pyevtx_event_levels_init_type(\n PyTypeObject *type_object );\n\nPyObject *pyevtx_event_levels_new(\n void );\n\nint pyevtx_event_levels_init(\n pyevtx_event_levels_t *definitions_object );\n\nvoid pyevtx_event_levels_free(\n pyevtx_event_levels_t *definitions_object );\n\n#if defined( __cplusplus )\n}\n#endif\n\n#endif /* !defined( _PYEVTX_EVENT_LEVELS_H ) */\n\n" }, { "path": "pyevtx/pyevtx_file.c", "content": "/*\n * Python object wrapper of libevtx_file_t\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#include \n#include \n#include \n\n#if defined( HAVE_STDLIB_H ) || defined( HAVE_WINAPI )\n#include \n#endif\n\n#include \"pyevtx_codepage.h\"\n#include \"pyevtx_error.h\"\n#include \"pyevtx_file.h\"\n#include \"pyevtx_file_object_io_handle.h\"\n#include \"pyevtx_libbfio.h\"\n#include \"pyevtx_libcerror.h\"\n#include \"pyevtx_libclocale.h\"\n#include \"pyevtx_libevtx.h\"\n#include \"pyevtx_python.h\"\n#include \"pyevtx_record.h\"\n#include \"pyevtx_records.h\"\n#include \"pyevtx_unused.h\"\n\n#if !defined( LIBEVTX_HAVE_BFIO )\n\nLIBEVTX_EXTERN \\\nint libevtx_file_open_file_io_handle(\n libevtx_file_t *file,\n libbfio_handle_t *file_io_handle,\n int access_flags,\n libevtx_error_t **error );\n\n#endif /* !defined( LIBEVTX_HAVE_BFIO ) */\n\nPyMethodDef pyevtx_file_object_methods[] = {\n\n\t{ \"signal_abort\",\n\t (PyCFunction) pyevtx_file_signal_abort,\n\t METH_NOARGS,\n\t \"signal_abort() -> None\\n\"\n\t \"\\n\"\n\t \"Signals the file to abort the current activity.\" },\n\n\t{ \"open\",\n\t (PyCFunction) pyevtx_file_open,\n\t METH_VARARGS | METH_KEYWORDS,\n\t \"open(filename, mode='r') -> None\\n\"\n\t \"\\n\"\n\t \"Opens a file.\" },\n\n\t{ \"open_file_object\",\n\t (PyCFunction) pyevtx_file_open_file_object,\n\t METH_VARARGS | METH_KEYWORDS,\n\t \"open_file_object(file_object, mode='r') -> None\\n\"\n\t \"\\n\"\n\t \"Opens a file using a file-like object.\" },\n\n\t{ \"close\",\n\t (PyCFunction) pyevtx_file_close,\n\t METH_NOARGS,\n\t \"close() -> None\\n\"\n\t \"\\n\"\n\t \"Closes a file.\" },\n\n\t{ \"is_corrupted\",\n\t (PyCFunction) pyevtx_file_is_corrupted,\n\t METH_NOARGS,\n\t \"is_corrupted() -> Boolean\\n\"\n\t \"\\n\"\n\t \"Determines if the file is corrupted.\" },\n\n\t{ \"get_ascii_codepage\",\n\t (PyCFunction) pyevtx_file_get_ascii_codepage,\n\t METH_NOARGS,\n\t \"get_ascii_codepage() -> String\\n\"\n\t \"\\n\"\n\t \"Retrieves the codepage for ASCII strings used in the file.\" },\n\n\t{ \"set_ascii_codepage\",\n\t (PyCFunction) pyevtx_file_set_ascii_codepage,\n\t METH_VARARGS | METH_KEYWORDS,\n\t \"set_ascii_codepage(codepage) -> None\\n\"\n\t \"\\n\"\n\t \"Sets the codepage for ASCII strings used in the file.\\n\"\n\t \"Expects the codepage to be a string containing a Python codec definition.\" },\n\n\t{ \"get_format_version\",\n\t (PyCFunction) pyevtx_file_get_format_version,\n\t METH_NOARGS,\n\t \"get_format_version() -> Unicode string\\n\"\n\t \"\\n\"\n\t \"Retrieves the format version.\" },\n\n\t{ \"get_number_of_records\",\n\t (PyCFunction) pyevtx_file_get_number_of_records,\n\t METH_NOARGS,\n\t \"get_number_of_records() -> Integer\\n\"\n\t \"\\n\"\n\t \"Retrieves the number of records.\" },\n\n\t{ \"get_record\",\n\t (PyCFunction) pyevtx_file_get_record,\n\t METH_VARARGS | METH_KEYWORDS,\n\t \"get_record(record_index) -> Object\\n\"\n\t \"\\n\"\n\t \"Retrieves the record specified by the index.\" },\n\n\t{ \"get_number_of_recovered_records\",\n\t (PyCFunction) pyevtx_file_get_number_of_recovered_records,\n\t METH_NOARGS,\n\t \"get_number_of_recovered_records() -> Integer\\n\"\n\t \"\\n\"\n\t \"Retrieves the number of recovered records.\" },\n\n\t{ \"get_recovered_record\",\n\t (PyCFunction) pyevtx_file_get_recovered_record,\n\t METH_VARARGS | METH_KEYWORDS,\n\t \"get_recovered_record(record_index) -> Object\\n\"\n\t \"\\n\"\n\t \"Retrieves the recovered record specified by the index.\" },\n\n\t/* Sentinel */\n\t{ NULL, NULL, 0, NULL }\n};\n\nPyGetSetDef pyevtx_file_object_get_set_definitions[] = {\n\n\t{ \"ascii_codepage\",\n\t (getter) pyevtx_file_get_ascii_codepage,\n\t (setter) pyevtx_file_set_ascii_codepage_setter,\n\t \"The codepage used for ASCII strings in the file.\",\n\t NULL },\n\n\t{ \"format_version\",\n\t (getter) pyevtx_file_get_format_version,\n\t (setter) 0,\n\t \"The format version.\",\n\t NULL },\n\n\t{ \"number_of_records\",\n\t (getter) pyevtx_file_get_number_of_records,\n\t (setter) 0,\n\t \"The number of records.\",\n\t NULL },\n\n\t{ \"records\",\n\t (getter) pyevtx_file_get_records,\n\t (setter) 0,\n\t \"The records.\",\n\t NULL },\n\n\t{ \"number_of_recovered_records\",\n\t (getter) pyevtx_file_get_number_of_recovered_records,\n\t (setter) 0,\n\t \"The number of recovered records.\",\n\t NULL },\n\n\t{ \"recovered_records\",\n\t (getter) pyevtx_file_get_recovered_records,\n\t (setter) 0,\n\t \"The recovered records.\",\n\t NULL },\n\n\t/* Sentinel */\n\t{ NULL, NULL, NULL, NULL, NULL }\n};\n\nPyTypeObject pyevtx_file_type_object = {\n\tPyVarObject_HEAD_INIT( NULL, 0 )\n\n\t/* tp_name */\n\t\"pyevtx.file\",\n\t/* tp_basicsize */\n\tsizeof( pyevtx_file_t ),\n\t/* tp_itemsize */\n\t0,\n\t/* tp_dealloc */\n\t(destructor) pyevtx_file_free,\n\t/* tp_print */\n\t0,\n\t/* tp_getattr */\n\t0,\n\t/* tp_setattr */\n\t0,\n\t/* tp_compare */\n\t0,\n\t/* tp_repr */\n\t0,\n\t/* tp_as_number */\n\t0,\n\t/* tp_as_sequence */\n\t0,\n\t/* tp_as_mapping */\n\t0,\n\t/* tp_hash */\n\t0,\n\t/* tp_call */\n\t0,\n\t/* tp_str */\n\t0,\n\t/* tp_getattro */\n\t0,\n\t/* tp_setattro */\n\t0,\n\t/* tp_as_buffer */\n\t0,\n\t/* tp_flags */\n\tPy_TPFLAGS_DEFAULT,\n\t/* tp_doc */\n\t\"pyevtx file object (wraps libevtx_file_t)\",\n\t/* tp_traverse */\n\t0,\n\t/* tp_clear */\n\t0,\n\t/* tp_richcompare */\n\t0,\n\t/* tp_weaklistoffset */\n\t0,\n\t/* tp_iter */\n\t0,\n\t/* tp_iternext */\n\t0,\n\t/* tp_methods */\n\tpyevtx_file_object_methods,\n\t/* tp_members */\n\t0,\n\t/* tp_getset */\n\tpyevtx_file_object_get_set_definitions,\n\t/* tp_base */\n\t0,\n\t/* tp_dict */\n\t0,\n\t/* tp_descr_get */\n\t0,\n\t/* tp_descr_set */\n\t0,\n\t/* tp_dictoffset */\n\t0,\n\t/* tp_init */\n\t(initproc) pyevtx_file_init,\n\t/* tp_alloc */\n\t0,\n\t/* tp_new */\n\t0,\n\t/* tp_free */\n\t0,\n\t/* tp_is_gc */\n\t0,\n\t/* tp_bases */\n\tNULL,\n\t/* tp_mro */\n\tNULL,\n\t/* tp_cache */\n\tNULL,\n\t/* tp_subclasses */\n\tNULL,\n\t/* tp_weaklist */\n\tNULL,\n\t/* tp_del */\n\t0\n};\n\n/* Initializes a file object\n * Returns 0 if successful or -1 on error\n */\nint pyevtx_file_init(\n pyevtx_file_t *pyevtx_file )\n{\n\tlibcerror_error_t *error = NULL;\n\tstatic char *function = \"pyevtx_file_init\";\n\n\tif( pyevtx_file == NULL )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_ValueError,\n\t\t \"%s: invalid file.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\t/* Make sure libevtx file is set to NULL\n\t */\n\tpyevtx_file->file = NULL;\n\tpyevtx_file->file_io_handle = NULL;\n\n\tif( libevtx_file_initialize(\n\t &( pyevtx_file->file ),\n\t &error ) != 1 )\n\t{\n\t\tpyevtx_error_raise(\n\t\t error,\n\t\t PyExc_MemoryError,\n\t\t \"%s: unable to initialize file.\",\n\t\t function );\n\n\t\tlibcerror_error_free(\n\t\t &error );\n\n\t\treturn( -1 );\n\t}\n\treturn( 0 );\n}\n\n/* Frees a file object\n */\nvoid pyevtx_file_free(\n pyevtx_file_t *pyevtx_file )\n{\n\tstruct _typeobject *ob_type = NULL;\n\tlibcerror_error_t *error = NULL;\n\tstatic char *function = \"pyevtx_file_free\";\n\tint result = 0;\n\n\tif( pyevtx_file == NULL )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_ValueError,\n\t\t \"%s: invalid file.\",\n\t\t function );\n\n\t\treturn;\n\t}\n\tob_type = Py_TYPE(\n\t pyevtx_file );\n\n\tif( ob_type == NULL )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_ValueError,\n\t\t \"%s: missing ob_type.\",\n\t\t function );\n\n\t\treturn;\n\t}\n\tif( ob_type->tp_free == NULL )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_ValueError,\n\t\t \"%s: invalid ob_type - missing tp_free.\",\n\t\t function );\n\n\t\treturn;\n\t}\n\tif( pyevtx_file->file_io_handle != NULL )\n\t{\n\t\tif( pyevtx_file_close(\n\t\t pyevtx_file,\n\t\t NULL ) == NULL )\n\t\t{\n\t\t\treturn;\n\t\t}\n\t}\n\tif( pyevtx_file->file != NULL )\n\t{\n\t\tPy_BEGIN_ALLOW_THREADS\n\n\t\tresult = libevtx_file_free(\n\t\t &( pyevtx_file->file ),\n\t\t &error );\n\n\t\tPy_END_ALLOW_THREADS\n\n\t\tif( result != 1 )\n\t\t{\n\t\t\tpyevtx_error_raise(\n\t\t\t error,\n\t\t\t PyExc_MemoryError,\n\t\t\t \"%s: unable to free libevtx file.\",\n\t\t\t function );\n\n\t\t\tlibcerror_error_free(\n\t\t\t &error );\n\t\t}\n\t}\n\tob_type->tp_free(\n\t (PyObject*) pyevtx_file );\n}\n\n/* Signals the file to abort the current activity\n * Returns a Python object if successful or NULL on error\n */\nPyObject *pyevtx_file_signal_abort(\n pyevtx_file_t *pyevtx_file,\n PyObject *arguments PYEVTX_ATTRIBUTE_UNUSED )\n{\n\tlibcerror_error_t *error = NULL;\n\tstatic char *function = \"pyevtx_file_signal_abort\";\n\tint result = 0;\n\n\tPYEVTX_UNREFERENCED_PARAMETER( arguments )\n\n\tif( pyevtx_file == NULL )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_ValueError,\n\t\t \"%s: invalid file.\",\n\t\t function );\n\n\t\treturn( NULL );\n\t}\n\tPy_BEGIN_ALLOW_THREADS\n\n\tresult = libevtx_file_signal_abort(\n\t pyevtx_file->file,\n\t &error );\n\n\tPy_END_ALLOW_THREADS\n\n\tif( result != 1 )\n\t{\n\t\tpyevtx_error_raise(\n\t\t error,\n\t\t PyExc_IOError,\n\t\t \"%s: unable to signal abort.\",\n\t\t function );\n\n\t\tlibcerror_error_free(\n\t\t &error );\n\n\t\treturn( NULL );\n\t}\n\tPy_IncRef(\n\t Py_None );\n\n\treturn( Py_None );\n}\n\n/* Opens a file\n * Returns a Python object if successful or NULL on error\n */\nPyObject *pyevtx_file_open(\n pyevtx_file_t *pyevtx_file,\n PyObject *arguments,\n PyObject *keywords )\n{\n\tPyObject *string_object = NULL;\n\tlibcerror_error_t *error = NULL;\n\tconst char *filename_narrow = NULL;\n\tstatic char *function = \"pyevtx_file_open\";\n\tstatic char *keyword_list[] = { \"filename\", \"mode\", NULL };\n\tchar *mode = NULL;\n\tint result = 0;\n\n#if defined( HAVE_WIDE_SYSTEM_CHARACTER )\n\tconst wchar_t *filename_wide = NULL;\n#else\n\tPyObject *utf8_string_object = NULL;\n#endif\n\n\tif( pyevtx_file == NULL )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_ValueError,\n\t\t \"%s: invalid file.\",\n\t\t function );\n\n\t\treturn( NULL );\n\t}\n\t/* Note that PyArg_ParseTupleAndKeywords with \"s\" will force Unicode strings to be converted to narrow character string.\n\t * On Windows the narrow character strings contains an extended ASCII string with a codepage. Hence we get a conversion\n\t * exception. This will also fail if the default encoding is not set correctly. We cannot use \"u\" here either since that\n\t * does not allow us to pass non Unicode string objects and Python (at least 2.7) does not seems to automatically upcast them.\n\t */\n\tif( PyArg_ParseTupleAndKeywords(\n\t arguments,\n\t keywords,\n\t \"O|s\",\n\t keyword_list,\n\t &string_object,\n\t &mode ) == 0 )\n\t{\n\t\treturn( NULL );\n\t}\n\tif( ( mode != NULL )\n\t && ( mode[ 0 ] != 'r' ) )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_ValueError,\n\t\t \"%s: unsupported mode: %s.\",\n\t\t function,\n\t\t mode );\n\n\t\treturn( NULL );\n\t}\n\tPyErr_Clear();\n\n\tresult = PyObject_IsInstance(\n\t string_object,\n\t (PyObject *) &PyUnicode_Type );\n\n\tif( result == -1 )\n\t{\n\t\tpyevtx_error_fetch_and_raise(\n\t\t PyExc_RuntimeError,\n\t\t \"%s: unable to determine if string object is of type Unicode.\",\n\t\t function );\n\n\t\treturn( NULL );\n\t}\n\telse if( result != 0 )\n\t{\n\t\tPyErr_Clear();\n\n#if defined( HAVE_WIDE_SYSTEM_CHARACTER )\n#if PY_MAJOR_VERSION >= 3 && PY_MINOR_VERSION >= 3\n\t\tfilename_wide = (wchar_t *) PyUnicode_AsWideCharString(\n\t\t string_object,\n\t\t NULL );\n#else\n\t\tfilename_wide = (wchar_t *) PyUnicode_AsUnicode(\n\t\t string_object );\n#endif\n\t\tPy_BEGIN_ALLOW_THREADS\n\n\t\tresult = libevtx_file_open_wide(\n\t\t pyevtx_file->file,\n\t\t filename_wide,\n\t\t LIBEVTX_OPEN_READ,\n\t\t &error );\n\n\t\tPy_END_ALLOW_THREADS\n\n#if PY_MAJOR_VERSION >= 3 && PY_MINOR_VERSION >= 3\n\t\tPyMem_Free(\n\t\t filename_wide );\n#endif\n#else\n\t\tutf8_string_object = PyUnicode_AsUTF8String(\n\t\t string_object );\n\n\t\tif( utf8_string_object == NULL )\n\t\t{\n\t\t\tpyevtx_error_fetch_and_raise(\n\t\t\t PyExc_RuntimeError,\n\t\t\t \"%s: unable to convert Unicode string to UTF-8.\",\n\t\t\t function );\n\n\t\t\treturn( NULL );\n\t\t}\n#if PY_MAJOR_VERSION >= 3\n\t\tfilename_narrow = PyBytes_AsString(\n\t\t utf8_string_object );\n#else\n\t\tfilename_narrow = PyString_AsString(\n\t\t utf8_string_object );\n#endif\n\t\tPy_BEGIN_ALLOW_THREADS\n\n\t\tresult = libevtx_file_open(\n\t\t pyevtx_file->file,\n\t\t filename_narrow,\n\t\t LIBEVTX_OPEN_READ,\n\t\t &error );\n\n\t\tPy_END_ALLOW_THREADS\n\n\t\tPy_DecRef(\n\t\t utf8_string_object );\n#endif\n\t\tif( result != 1 )\n\t\t{\n\t\t\tpyevtx_error_raise(\n\t\t\t error,\n\t\t\t PyExc_IOError,\n\t\t\t \"%s: unable to open file.\",\n\t\t\t function );\n\n\t\t\tlibcerror_error_free(\n\t\t\t &error );\n\n\t\t\treturn( NULL );\n\t\t}\n\t\tPy_IncRef(\n\t\t Py_None );\n\n\t\treturn( Py_None );\n\t}\n\tPyErr_Clear();\n\n#if PY_MAJOR_VERSION >= 3\n\tresult = PyObject_IsInstance(\n\t string_object,\n\t (PyObject *) &PyBytes_Type );\n#else\n\tresult = PyObject_IsInstance(\n\t string_object,\n\t (PyObject *) &PyString_Type );\n#endif\n\tif( result == -1 )\n\t{\n\t\tpyevtx_error_fetch_and_raise(\n\t\t PyExc_RuntimeError,\n\t\t \"%s: unable to determine if string object is of type string.\",\n\t\t function );\n\n\t\treturn( NULL );\n\t}\n\telse if( result != 0 )\n\t{\n\t\tPyErr_Clear();\n\n#if PY_MAJOR_VERSION >= 3\n\t\tfilename_narrow = PyBytes_AsString(\n\t\t string_object );\n#else\n\t\tfilename_narrow = PyString_AsString(\n\t\t string_object );\n#endif\n\t\tPy_BEGIN_ALLOW_THREADS\n\n\t\tresult = libevtx_file_open(\n\t\t pyevtx_file->file,\n\t\t filename_narrow,\n\t\t LIBEVTX_OPEN_READ,\n\t\t &error );\n\n\t\tPy_END_ALLOW_THREADS\n\n\t\tif( result != 1 )\n\t\t{\n\t\t\tpyevtx_error_raise(\n\t\t\t error,\n\t\t\t PyExc_IOError,\n\t\t\t \"%s: unable to open file.\",\n\t\t\t function );\n\n\t\t\tlibcerror_error_free(\n\t\t\t &error );\n\n\t\t\treturn( NULL );\n\t\t}\n\t\tPy_IncRef(\n\t\t Py_None );\n\n\t\treturn( Py_None );\n\t}\n\tPyErr_Format(\n\t PyExc_TypeError,\n\t \"%s: unsupported string object type.\",\n\t function );\n\n\treturn( NULL );\n}\n\n/* Opens a file using a file-like object\n * Returns a Python object if successful or NULL on error\n */\nPyObject *pyevtx_file_open_file_object(\n pyevtx_file_t *pyevtx_file,\n PyObject *arguments,\n PyObject *keywords )\n{\n\tPyObject *file_object = NULL;\n\tlibcerror_error_t *error = NULL;\n\tstatic char *function = \"pyevtx_file_open_file_object\";\n\tstatic char *keyword_list[] = { \"file_object\", \"mode\", NULL };\n\tchar *mode = NULL;\n\tint result = 0;\n\n\tif( pyevtx_file == NULL )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_ValueError,\n\t\t \"%s: invalid file.\",\n\t\t function );\n\n\t\treturn( NULL );\n\t}\n\tif( PyArg_ParseTupleAndKeywords(\n\t arguments,\n\t keywords,\n\t \"O|s\",\n\t keyword_list,\n\t &file_object,\n\t &mode ) == 0 )\n\t{\n\t\treturn( NULL );\n\t}\n\tif( ( mode != NULL )\n\t && ( mode[ 0 ] != 'r' ) )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_ValueError,\n\t\t \"%s: unsupported mode: %s.\",\n\t\t function,\n\t\t mode );\n\n\t\treturn( NULL );\n\t}\n\tPyErr_Clear();\n\n\tresult = PyObject_HasAttrString(\n\t file_object,\n\t \"read\" );\n\n\tif( result != 1 )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_TypeError,\n\t\t \"%s: unsupported file object - missing read attribute.\",\n\t\t function );\n\n\t\treturn( NULL );\n\t}\n\tPyErr_Clear();\n\n\tresult = PyObject_HasAttrString(\n\t file_object,\n\t \"seek\" );\n\n\tif( result != 1 )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_TypeError,\n\t\t \"%s: unsupported file object - missing seek attribute.\",\n\t\t function );\n\n\t\treturn( NULL );\n\t}\n\tif( pyevtx_file->file_io_handle != NULL )\n\t{\n\t\tpyevtx_error_raise(\n\t\t error,\n\t\t PyExc_IOError,\n\t\t \"%s: invalid file - file IO handle already set.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tif( pyevtx_file_object_initialize(\n\t &( pyevtx_file->file_io_handle ),\n\t file_object,\n\t &error ) != 1 )\n\t{\n\t\tpyevtx_error_raise(\n\t\t error,\n\t\t PyExc_MemoryError,\n\t\t \"%s: unable to initialize file IO handle.\",\n\t\t function );\n\n\t\tlibcerror_error_free(\n\t\t &error );\n\n\t\tgoto on_error;\n\t}\n\tPy_BEGIN_ALLOW_THREADS\n\n\tresult = libevtx_file_open_file_io_handle(\n\t pyevtx_file->file,\n\t pyevtx_file->file_io_handle,\n\t LIBEVTX_OPEN_READ,\n\t &error );\n\n\tPy_END_ALLOW_THREADS\n\n\tif( result != 1 )\n\t{\n\t\tpyevtx_error_raise(\n\t\t error,\n\t\t PyExc_IOError,\n\t\t \"%s: unable to open file.\",\n\t\t function );\n\n\t\tlibcerror_error_free(\n\t\t &error );\n\n\t\tgoto on_error;\n\t}\n\tPy_IncRef(\n\t Py_None );\n\n\treturn( Py_None );\n\non_error:\n\tif( pyevtx_file->file_io_handle != NULL )\n\t{\n\t\tlibbfio_handle_free(\n\t\t &( pyevtx_file->file_io_handle ),\n\t\t NULL );\n\t}\n\treturn( NULL );\n}\n\n/* Closes a file\n * Returns a Python object if successful or NULL on error\n */\nPyObject *pyevtx_file_close(\n pyevtx_file_t *pyevtx_file,\n PyObject *arguments PYEVTX_ATTRIBUTE_UNUSED )\n{\n\tlibcerror_error_t *error = NULL;\n\tstatic char *function = \"pyevtx_file_close\";\n\tint result = 0;\n\n\tPYEVTX_UNREFERENCED_PARAMETER( arguments )\n\n\tif( pyevtx_file == NULL )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_ValueError,\n\t\t \"%s: invalid file.\",\n\t\t function );\n\n\t\treturn( NULL );\n\t}\n\tPy_BEGIN_ALLOW_THREADS\n\n\tresult = libevtx_file_close(\n\t pyevtx_file->file,\n\t &error );\n\n\tPy_END_ALLOW_THREADS\n\n\tif( result != 0 )\n\t{\n\t\tpyevtx_error_raise(\n\t\t error,\n\t\t PyExc_IOError,\n\t\t \"%s: unable to close file.\",\n\t\t function );\n\n\t\tlibcerror_error_free(\n\t\t &error );\n\n\t\treturn( NULL );\n\t}\n\tif( pyevtx_file->file_io_handle != NULL )\n\t{\n\t\tPy_BEGIN_ALLOW_THREADS\n\n\t\tresult = libbfio_handle_free(\n\t\t &( pyevtx_file->file_io_handle ),\n\t\t &error );\n\n\t\tPy_END_ALLOW_THREADS\n\n\t\tif( result != 1 )\n\t\t{\n\t\t\tpyevtx_error_raise(\n\t\t\t error,\n\t\t\t PyExc_MemoryError,\n\t\t\t \"%s: unable to free libbfio file IO handle.\",\n\t\t\t function );\n\n\t\t\tlibcerror_error_free(\n\t\t\t &error );\n\n\t\t\treturn( NULL );\n\t\t}\n\t}\n\tPy_IncRef(\n\t Py_None );\n\n\treturn( Py_None );\n}\n\n/* Determines if the file is corrupted\n * Returns a Python object if successful or NULL on error\n */\nPyObject *pyevtx_file_is_corrupted(\n pyevtx_file_t *pyevtx_file,\n PyObject *arguments PYEVTX_ATTRIBUTE_UNUSED )\n{\n\tlibcerror_error_t *error = NULL;\n\tstatic char *function = \"pyevtx_file_is_corrupted\";\n\tint result = 0;\n\n\tPYEVTX_UNREFERENCED_PARAMETER( arguments )\n\n\tif( pyevtx_file == NULL )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_ValueError,\n\t\t \"%s: invalid file.\",\n\t\t function );\n\n\t\treturn( NULL );\n\t}\n\tPy_BEGIN_ALLOW_THREADS\n\n\tresult = libevtx_file_is_corrupted(\n\t pyevtx_file->file,\n\t &error );\n\n\tPy_END_ALLOW_THREADS\n\n\tif( result == -1 )\n\t{\n\t\tpyevtx_error_raise(\n\t\t error,\n\t\t PyExc_IOError,\n\t\t \"%s: unable to determine if file is corrupted.\",\n\t\t function );\n\n\t\tlibcerror_error_free(\n\t\t &error );\n\n\t\treturn( NULL );\n\t}\n\tif( result != 0 )\n\t{\n\t\tPy_IncRef(\n\t\t (PyObject *) Py_True );\n\n\t\treturn( Py_True );\n\t}\n\tPy_IncRef(\n\t (PyObject *) Py_False );\n\n\treturn( Py_False );\n}\n\n/* Retrieves the codepage used for ASCII strings in the file\n * Returns a Python object if successful or NULL on error\n */\nPyObject *pyevtx_file_get_ascii_codepage(\n pyevtx_file_t *pyevtx_file,\n PyObject *arguments PYEVTX_ATTRIBUTE_UNUSED )\n{\n\tPyObject *string_object = NULL;\n\tlibcerror_error_t *error = NULL;\n\tconst char *codepage_string = NULL;\n\tstatic char *function = \"pyevtx_file_get_ascii_codepage\";\n\tint ascii_codepage = 0;\n\tint result = 0;\n\n\tPYEVTX_UNREFERENCED_PARAMETER( arguments )\n\n\tif( pyevtx_file == NULL )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_ValueError,\n\t\t \"%s: invalid file.\",\n\t\t function );\n\n\t\treturn( NULL );\n\t}\n\tPy_BEGIN_ALLOW_THREADS\n\n\tresult = libevtx_file_get_ascii_codepage(\n\t pyevtx_file->file,\n\t &ascii_codepage,\n\t &error );\n\n\tPy_END_ALLOW_THREADS\n\n\tif( result != 1 )\n\t{\n\t\tpyevtx_error_raise(\n\t\t error,\n\t\t PyExc_IOError,\n\t\t \"%s: unable to retrieve ASCII codepage.\",\n\t\t function );\n\n\t\tlibcerror_error_free(\n\t\t &error );\n\n\t\treturn( NULL );\n\t}\n\tcodepage_string = pyevtx_codepage_to_string(\n\t ascii_codepage );\n\n\tif( codepage_string == NULL )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_ValueError,\n\t\t \"%s: unsupported ASCII codepage: %d.\",\n\t\t function,\n\t\t ascii_codepage );\n\n\t\treturn( NULL );\n\t}\n#if PY_MAJOR_VERSION >= 3\n\tstring_object = PyBytes_FromString(\n\t codepage_string );\n#else\n\tstring_object = PyString_FromString(\n\t codepage_string );\n#endif\n\tif( string_object == NULL )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_IOError,\n\t\t \"%s: unable to convert codepage string into string object.\",\n\t\t function );\n\n\t\treturn( NULL );\n\t}\n\treturn( string_object );\n}\n\n/* Sets the codepage used for ASCII strings in the file\n * Returns 1 if successful or -1 on error\n */\nint pyevtx_file_set_ascii_codepage_from_string(\n pyevtx_file_t *pyevtx_file,\n const char *codepage_string )\n{\n\tlibcerror_error_t *error = NULL;\n\tstatic char *function = \"pyevtx_file_set_ascii_codepage_from_string\";\n\tsize_t codepage_string_length = 0;\n\tuint32_t feature_flags = 0;\n\tint ascii_codepage = 0;\n\tint result = 0;\n\n\tif( pyevtx_file == NULL )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_ValueError,\n\t\t \"%s: invalid file.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( codepage_string == NULL )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_ValueError,\n\t\t \"%s: invalid codepage string.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tcodepage_string_length = narrow_string_length(\n\t codepage_string );\n\n\tfeature_flags = LIBCLOCALE_CODEPAGE_FEATURE_FLAG_HAVE_WINDOWS;\n\n\tif( libclocale_codepage_copy_from_string(\n\t &ascii_codepage,\n\t codepage_string,\n\t codepage_string_length,\n\t feature_flags,\n\t &error ) != 1 )\n\t{\n\t\tpyevtx_error_raise(\n\t\t error,\n\t\t PyExc_RuntimeError,\n\t\t \"%s: unable to determine ASCII codepage.\",\n\t\t function );\n\n\t\tlibcerror_error_free(\n\t\t &error );\n\n\t\treturn( -1 );\n\t}\n\tPy_BEGIN_ALLOW_THREADS\n\n\tresult = libevtx_file_set_ascii_codepage(\n\t pyevtx_file->file,\n\t ascii_codepage,\n\t &error );\n\n\tPy_END_ALLOW_THREADS\n\n\tif( result != 1 )\n\t{\n\t\tpyevtx_error_raise(\n\t\t error,\n\t\t PyExc_IOError,\n\t\t \"%s: unable to set ASCII codepage.\",\n\t\t function );\n\n\t\tlibcerror_error_free(\n\t\t &error );\n\n\t\treturn( -1 );\n\t}\n\treturn( 1 );\n}\n\n/* Sets the codepage used for ASCII strings in the file\n * Returns a Python object if successful or NULL on error\n */\nPyObject *pyevtx_file_set_ascii_codepage(\n pyevtx_file_t *pyevtx_file,\n PyObject *arguments,\n PyObject *keywords )\n{\n\tchar *codepage_string = NULL;\n\tstatic char *keyword_list[] = { \"codepage\", NULL };\n\tint result = 0;\n\n\tif( PyArg_ParseTupleAndKeywords(\n\t arguments,\n\t keywords,\n\t \"s\",\n\t keyword_list,\n\t &codepage_string ) == 0 )\n\t{\n\t\treturn( NULL );\n\t}\n\tresult = pyevtx_file_set_ascii_codepage_from_string(\n\t pyevtx_file,\n\t codepage_string );\n\n\tif( result != 1 )\n\t{\n\t\treturn( NULL );\n\t}\n\tPy_IncRef(\n\t Py_None );\n\n\treturn( Py_None );\n}\n\n/* Sets the codepage used for ASCII strings in the file\n * Returns a Python object if successful or NULL on error\n */\nint pyevtx_file_set_ascii_codepage_setter(\n pyevtx_file_t *pyevtx_file,\n PyObject *string_object,\n void *closure PYEVTX_ATTRIBUTE_UNUSED )\n{\n\tPyObject *utf8_string_object = NULL;\n\tchar *codepage_string = NULL;\n\tstatic char *function = \"pyevtx_file_set_ascii_codepage_setter\";\n\tint result = 0;\n\n\tPYEVTX_UNREFERENCED_PARAMETER( closure )\n\n\tPyErr_Clear();\n\n\tresult = PyObject_IsInstance(\n\t string_object,\n\t (PyObject *) &PyUnicode_Type );\n\n\tif( result == -1 )\n\t{\n\t\tpyevtx_error_fetch_and_raise(\n\t\t PyExc_RuntimeError,\n\t\t \"%s: unable to determine if string object is of type Unicode.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\telse if( result != 0 )\n\t{\n\t\t/* The codepage string should only contain ASCII characters.\n\t\t */\n\t\tutf8_string_object = PyUnicode_AsUTF8String(\n\t\t string_object );\n\n\t\tif( utf8_string_object == NULL )\n\t\t{\n\t\t\tpyevtx_error_fetch_and_raise(\n\t\t\t PyExc_RuntimeError,\n\t\t\t \"%s: unable to convert Unicode string to UTF-8.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n#if PY_MAJOR_VERSION >= 3\n\t\tcodepage_string = PyBytes_AsString(\n\t\t utf8_string_object );\n#else\n\t\tcodepage_string = PyString_AsString(\n\t\t utf8_string_object );\n#endif\n\t\tif( codepage_string == NULL )\n\t\t{\n\t\t\treturn( -1 );\n\t\t}\n\t\tresult = pyevtx_file_set_ascii_codepage_from_string(\n\t\t pyevtx_file,\n\t\t codepage_string );\n\n\t\tif( result != 1 )\n\t\t{\n\t\t\treturn( -1 );\n\t\t}\n\t\treturn( 0 );\n\t}\n\tPyErr_Clear();\n\n#if PY_MAJOR_VERSION >= 3\n\tresult = PyObject_IsInstance(\n\t string_object,\n\t (PyObject *) &PyBytes_Type );\n#else\n\tresult = PyObject_IsInstance(\n\t string_object,\n\t (PyObject *) &PyString_Type );\n#endif\n\tif( result == -1 )\n\t{\n\t\tpyevtx_error_fetch_and_raise(\n\t\t PyExc_RuntimeError,\n\t\t \"%s: unable to determine if string object is of type string.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\telse if( result != 0 )\n\t{\n#if PY_MAJOR_VERSION >= 3\n\t\tcodepage_string = PyBytes_AsString(\n\t\t string_object );\n#else\n\t\tcodepage_string = PyString_AsString(\n\t\t string_object );\n#endif\n\t\tif( codepage_string == NULL )\n\t\t{\n\t\t\treturn( -1 );\n\t\t}\n\t\tresult = pyevtx_file_set_ascii_codepage_from_string(\n\t\t pyevtx_file,\n\t\t codepage_string );\n\n\t\tif( result != 1 )\n\t\t{\n\t\t\treturn( -1 );\n\t\t}\n\t\treturn( 0 );\n\t}\n\tPyErr_Format(\n\t PyExc_TypeError,\n\t \"%s: unsupported string object type.\",\n\t function );\n\n\treturn( -1 );\n}\n\n/* Retrieves the format version\n * Returns a Python object if successful or NULL on error\n */\nPyObject *pyevtx_file_get_format_version(\n pyevtx_file_t *pyevtx_file,\n PyObject *arguments PYEVTX_ATTRIBUTE_UNUSED )\n{\n\tchar utf8_string[ 4 ];\n\n\tPyObject *string_object = NULL;\n\tlibcerror_error_t *error = NULL;\n\tstatic char *function = \"pyevtx_file_get_format_version\";\n\tuint16_t major_version = 0;\n\tuint16_t minor_version = 0;\n\tint result = 0;\n\n\tPYEVTX_UNREFERENCED_PARAMETER( arguments )\n\n\tif( pyevtx_file == NULL )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_ValueError,\n\t\t \"%s: invalid file.\",\n\t\t function );\n\n\t\treturn( NULL );\n\t}\n\tPy_BEGIN_ALLOW_THREADS\n\n\tresult = libevtx_file_get_format_version(\n\t pyevtx_file->file,\n\t &major_version,\n\t &minor_version,\n\t &error );\n\n\tPy_END_ALLOW_THREADS\n\n\tif( result != 1 )\n\t{\n\t\tpyevtx_error_raise(\n\t\t error,\n\t\t PyExc_IOError,\n\t\t \"%s: unable to retrieve format version.\",\n\t\t function );\n\n\t\tlibcerror_error_free(\n\t\t &error );\n\n\t\treturn( NULL );\n\t}\n\tif( major_version > 9 )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_ValueError,\n\t\t \"%s: major version out of bounds.\",\n\t\t function );\n\n\t\treturn( NULL );\n\t}\n\tif( minor_version > 9 )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_ValueError,\n\t\t \"%s: minor version out of bounds.\",\n\t\t function );\n\n\t\treturn( NULL );\n\t}\n\tutf8_string[ 0 ] = '0' + (char) major_version;\n\tutf8_string[ 1 ] = '.';\n\tutf8_string[ 2 ] = '0' + (char) minor_version;\n\tutf8_string[ 3 ] = 0;\n\n\t/* Pass the string length to PyUnicode_DecodeUTF8 otherwise it makes\n\t * the end of string character is part of the string.\n\t */\n\tstring_object = PyUnicode_DecodeUTF8(\n\t utf8_string,\n\t (Py_ssize_t) 3,\n\t NULL );\n\n\tif( string_object == NULL )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_IOError,\n\t\t \"%s: unable to convert UTF-8 string into Unicode object.\",\n\t\t function );\n\n\t\treturn( NULL );\n\t}\n\treturn( string_object );\n}\n\n/* Retrieves the number of records\n * Returns a Python object if successful or NULL on error\n */\nPyObject *pyevtx_file_get_number_of_records(\n pyevtx_file_t *pyevtx_file,\n PyObject *arguments PYEVTX_ATTRIBUTE_UNUSED )\n{\n\tPyObject *integer_object = NULL;\n\tlibcerror_error_t *error = NULL;\n\tstatic char *function = \"pyevtx_file_get_number_of_records\";\n\tint number_of_records = 0;\n\tint result = 0;\n\n\tPYEVTX_UNREFERENCED_PARAMETER( arguments )\n\n\tif( pyevtx_file == NULL )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_ValueError,\n\t\t \"%s: invalid file.\",\n\t\t function );\n\n\t\treturn( NULL );\n\t}\n\tPy_BEGIN_ALLOW_THREADS\n\n\tresult = libevtx_file_get_number_of_records(\n\t pyevtx_file->file,\n\t &number_of_records,\n\t &error );\n\n\tPy_END_ALLOW_THREADS\n\n\tif( result != 1 )\n\t{\n\t\tpyevtx_error_raise(\n\t\t error,\n\t\t PyExc_IOError,\n\t\t \"%s: unable to retrieve number of records.\",\n\t\t function );\n\n\t\tlibcerror_error_free(\n\t\t &error );\n\n\t\treturn( NULL );\n\t}\n#if PY_MAJOR_VERSION >= 3\n\tinteger_object = PyLong_FromLong(\n\t (long) number_of_records );\n#else\n\tinteger_object = PyInt_FromLong(\n\t (long) number_of_records );\n#endif\n\treturn( integer_object );\n}\n\n/* Retrieves a specific record by index\n * Returns a Python object if successful or NULL on error\n */\nPyObject *pyevtx_file_get_record_by_index(\n PyObject *pyevtx_file,\n int record_index )\n{\n\tPyObject *record_object = NULL;\n\tlibcerror_error_t *error = NULL;\n\tlibevtx_record_t *record = NULL;\n\tstatic char *function = \"pyevtx_file_get_record_by_index\";\n\tint result = 0;\n\n\tif( pyevtx_file == NULL )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_ValueError,\n\t\t \"%s: invalid file.\",\n\t\t function );\n\n\t\treturn( NULL );\n\t}\n\tPy_BEGIN_ALLOW_THREADS\n\n\tresult = libevtx_file_get_record_by_index(\n\t ( (pyevtx_file_t *) pyevtx_file )->file,\n\t record_index,\n\t &record,\n\t &error );\n\n\tPy_END_ALLOW_THREADS\n\n\tif( result != 1 )\n\t{\n\t\tpyevtx_error_raise(\n\t\t error,\n\t\t PyExc_IOError,\n\t\t \"%s: unable to retrieve record: %d.\",\n\t\t function,\n\t\t record_index );\n\n\t\tlibcerror_error_free(\n\t\t &error );\n\n\t\tgoto on_error;\n\t}\n\trecord_object = pyevtx_record_new(\n\t record,\n\t pyevtx_file );\n\n\tif( record_object == NULL )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_MemoryError,\n\t\t \"%s: unable to create record object.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\treturn( record_object );\n\non_error:\n\tif( record != NULL )\n\t{\n\t\tlibevtx_record_free(\n\t\t &record,\n\t\t NULL );\n\t}\n\treturn( NULL );\n}\n\n/* Retrieves a specific record\n * Returns a Python object if successful or NULL on error\n */\nPyObject *pyevtx_file_get_record(\n pyevtx_file_t *pyevtx_file,\n PyObject *arguments,\n PyObject *keywords )\n{\n\tPyObject *record_object = NULL;\n\tstatic char *keyword_list[] = { \"record_index\", NULL };\n\tint record_index = 0;\n\n\tif( PyArg_ParseTupleAndKeywords(\n\t arguments,\n\t keywords,\n\t \"i\",\n\t keyword_list,\n\t &record_index ) == 0 )\n\t{\n\t\treturn( NULL );\n\t}\n\trecord_object = pyevtx_file_get_record_by_index(\n\t (PyObject *) pyevtx_file,\n\t record_index );\n\n\treturn( record_object );\n}\n\n/* Retrieves a sequence and iterator object for the records\n * Returns a Python object if successful or NULL on error\n */\nPyObject *pyevtx_file_get_records(\n pyevtx_file_t *pyevtx_file,\n PyObject *arguments PYEVTX_ATTRIBUTE_UNUSED )\n{\n\tPyObject *sequence_object = NULL;\n\tlibcerror_error_t *error = NULL;\n\tstatic char *function = \"pyevtx_file_get_records\";\n\tint number_of_records = 0;\n\tint result = 0;\n\n\tPYEVTX_UNREFERENCED_PARAMETER( arguments )\n\n\tif( pyevtx_file == NULL )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_ValueError,\n\t\t \"%s: invalid file.\",\n\t\t function );\n\n\t\treturn( NULL );\n\t}\n\tPy_BEGIN_ALLOW_THREADS\n\n\tresult = libevtx_file_get_number_of_records(\n\t pyevtx_file->file,\n\t &number_of_records,\n\t &error );\n\n\tPy_END_ALLOW_THREADS\n\n\tif( result != 1 )\n\t{\n\t\tpyevtx_error_raise(\n\t\t error,\n\t\t PyExc_IOError,\n\t\t \"%s: unable to retrieve number of records.\",\n\t\t function );\n\n\t\tlibcerror_error_free(\n\t\t &error );\n\n\t\treturn( NULL );\n\t}\n\tsequence_object = pyevtx_records_new(\n\t (PyObject *) pyevtx_file,\n\t &pyevtx_file_get_record_by_index,\n\t number_of_records );\n\n\tif( sequence_object == NULL )\n\t{\n\t\tpyevtx_error_raise(\n\t\t error,\n\t\t PyExc_MemoryError,\n\t\t \"%s: unable to create sequence object.\",\n\t\t function );\n\n\t\treturn( NULL );\n\t}\n\treturn( sequence_object );\n}\n\n/* Retrieves the number of recovered records\n * Returns a Python object if successful or NULL on error\n */\nPyObject *pyevtx_file_get_number_of_recovered_records(\n pyevtx_file_t *pyevtx_file,\n PyObject *arguments PYEVTX_ATTRIBUTE_UNUSED )\n{\n\tPyObject *integer_object = NULL;\n\tlibcerror_error_t *error = NULL;\n\tstatic char *function = \"pyevtx_file_get_number_of_recovered_records\";\n\tint number_of_records = 0;\n\tint result = 0;\n\n\tPYEVTX_UNREFERENCED_PARAMETER( arguments )\n\n\tif( pyevtx_file == NULL )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_ValueError,\n\t\t \"%s: invalid file.\",\n\t\t function );\n\n\t\treturn( NULL );\n\t}\n\tPy_BEGIN_ALLOW_THREADS\n\n\tresult = libevtx_file_get_number_of_recovered_records(\n\t pyevtx_file->file,\n\t &number_of_records,\n\t &error );\n\n\tPy_END_ALLOW_THREADS\n\n\tif( result != 1 )\n\t{\n\t\tpyevtx_error_raise(\n\t\t error,\n\t\t PyExc_IOError,\n\t\t \"%s: unable to retrieve number of recovered records.\",\n\t\t function );\n\n\t\tlibcerror_error_free(\n\t\t &error );\n\n\t\treturn( NULL );\n\t}\n#if PY_MAJOR_VERSION >= 3\n\tinteger_object = PyLong_FromLong(\n\t (long) number_of_records );\n#else\n\tinteger_object = PyInt_FromLong(\n\t (long) number_of_records );\n#endif\n\treturn( integer_object );\n}\n\n/* Retrieves a specific recovered record by index\n * Returns a Python object if successful or NULL on error\n */\nPyObject *pyevtx_file_get_recovered_record_by_index(\n PyObject *pyevtx_file,\n int record_index )\n{\n\tPyObject *record_object = NULL;\n\tlibcerror_error_t *error = NULL;\n\tlibevtx_record_t *record = NULL;\n\tstatic char *function = \"pyevtx_file_get_recovered_record_by_index\";\n\tint result = 0;\n\n\tif( pyevtx_file == NULL )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_ValueError,\n\t\t \"%s: invalid file.\",\n\t\t function );\n\n\t\treturn( NULL );\n\t}\n\tPy_BEGIN_ALLOW_THREADS\n\n\tresult = libevtx_file_get_recovered_record_by_index(\n\t ( (pyevtx_file_t *) pyevtx_file )->file,\n\t record_index,\n\t &record,\n\t &error );\n\n\tPy_END_ALLOW_THREADS\n\n\tif( result != 1 )\n\t{\n\t\tpyevtx_error_raise(\n\t\t error,\n\t\t PyExc_IOError,\n\t\t \"%s: unable to retrieve recovered record: %d.\",\n\t\t function,\n\t\t record_index );\n\n\t\tlibcerror_error_free(\n\t\t &error );\n\n\t\tgoto on_error;\n\t}\n\trecord_object = pyevtx_record_new(\n\t record,\n\t (PyObject *) pyevtx_file );\n\n\tif( record_object == NULL )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_MemoryError,\n\t\t \"%s: unable to create recovered record object.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\treturn( record_object );\n\non_error:\n\tif( record != NULL )\n\t{\n\t\tlibevtx_record_free(\n\t\t &record,\n\t\t NULL );\n\t}\n\treturn( NULL );\n}\n\n/* Retrieves a specific recovered record\n * Returns a Python object if successful or NULL on error\n */\nPyObject *pyevtx_file_get_recovered_record(\n pyevtx_file_t *pyevtx_file,\n PyObject *arguments,\n PyObject *keywords )\n{\n\tPyObject *record_object = NULL;\n\tstatic char *keyword_list[] = { \"record_index\", NULL };\n\tint record_index = 0;\n\n\tif( PyArg_ParseTupleAndKeywords(\n\t arguments,\n\t keywords,\n\t \"i\",\n\t keyword_list,\n\t &record_index ) == 0 )\n\t{\n\t\treturn( NULL );\n\t}\n\trecord_object = pyevtx_file_get_recovered_record_by_index(\n\t (PyObject *) pyevtx_file,\n\t record_index );\n\n\treturn( record_object );\n}\n\n/* Retrieves a sequence and iterator object for the recovered records\n * Returns a Python object if successful or NULL on error\n */\nPyObject *pyevtx_file_get_recovered_records(\n pyevtx_file_t *pyevtx_file,\n PyObject *arguments PYEVTX_ATTRIBUTE_UNUSED )\n{\n\tPyObject *sequence_object = NULL;\n\tlibcerror_error_t *error = NULL;\n\tstatic char *function = \"pyevtx_file_get_recovered_records\";\n\tint number_of_records = 0;\n\tint result = 0;\n\n\tPYEVTX_UNREFERENCED_PARAMETER( arguments )\n\n\tif( pyevtx_file == NULL )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_ValueError,\n\t\t \"%s: invalid file.\",\n\t\t function );\n\n\t\treturn( NULL );\n\t}\n\tPy_BEGIN_ALLOW_THREADS\n\n\tresult = libevtx_file_get_number_of_recovered_records(\n\t pyevtx_file->file,\n\t &number_of_records,\n\t &error );\n\n\tPy_END_ALLOW_THREADS\n\n\tif( result != 1 )\n\t{\n\t\tpyevtx_error_raise(\n\t\t error,\n\t\t PyExc_IOError,\n\t\t \"%s: unable to retrieve number of recovered records.\",\n\t\t function );\n\n\t\tlibcerror_error_free(\n\t\t &error );\n\n\t\treturn( NULL );\n\t}\n\tsequence_object = pyevtx_records_new(\n\t (PyObject *) pyevtx_file,\n\t &pyevtx_file_get_recovered_record_by_index,\n\t number_of_records );\n\n\tif( sequence_object == NULL )\n\t{\n\t\tpyevtx_error_raise(\n\t\t error,\n\t\t PyExc_MemoryError,\n\t\t \"%s: unable to create sequence object.\",\n\t\t function );\n\n\t\treturn( NULL );\n\t}\n\treturn( sequence_object );\n}\n\n" }, { "path": "pyevtx/pyevtx_file.h", "content": "/*\n * Python object wrapper of libevtx_file_t\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#if !defined( _PYEVTX_FILE_H )\n#define _PYEVTX_FILE_H\n\n#include \n#include \n\n#include \"pyevtx_libbfio.h\"\n#include \"pyevtx_libevtx.h\"\n#include \"pyevtx_python.h\"\n\n#if defined( __cplusplus )\nextern \"C\" {\n#endif\n\ntypedef struct pyevtx_file pyevtx_file_t;\n\nstruct pyevtx_file\n{\n\t/* Python object initialization\n\t */\n\tPyObject_HEAD\n\n\t/* The libevtx file\n\t */\n\tlibevtx_file_t *file;\n\n\t/* The libbfio file IO handle\n\t */\n\tlibbfio_handle_t *file_io_handle;\n};\n\nextern PyMethodDef pyevtx_file_object_methods[];\nextern PyTypeObject pyevtx_file_type_object;\n\nint pyevtx_file_init(\n pyevtx_file_t *pyevtx_file );\n\nvoid pyevtx_file_free(\n pyevtx_file_t *pyevtx_file );\n\nPyObject *pyevtx_file_signal_abort(\n pyevtx_file_t *pyevtx_file,\n PyObject *arguments );\n\nPyObject *pyevtx_file_open(\n pyevtx_file_t *pyevtx_file,\n PyObject *arguments,\n PyObject *keywords );\n\nPyObject *pyevtx_file_open_file_object(\n pyevtx_file_t *pyevtx_file,\n PyObject *arguments,\n PyObject *keywords );\n\nPyObject *pyevtx_file_close(\n pyevtx_file_t *pyevtx_file,\n PyObject *arguments );\n\nPyObject *pyevtx_file_is_corrupted(\n pyevtx_file_t *pyevtx_file,\n PyObject *arguments );\n\nPyObject *pyevtx_file_get_ascii_codepage(\n pyevtx_file_t *pyevtx_file,\n PyObject *arguments );\n\nint pyevtx_file_set_ascii_codepage_from_string(\n pyevtx_file_t *pyevtx_file,\n const char *codepage_string );\n\nPyObject *pyevtx_file_set_ascii_codepage(\n pyevtx_file_t *pyevtx_file,\n PyObject *arguments,\n PyObject *keywords );\n\nint pyevtx_file_set_ascii_codepage_setter(\n pyevtx_file_t *pyevtx_file,\n PyObject *string_object,\n void *closure );\n\nPyObject *pyevtx_file_get_format_version(\n pyevtx_file_t *pyevtx_file,\n PyObject *arguments );\n\nPyObject *pyevtx_file_get_number_of_records(\n pyevtx_file_t *pyevtx_file,\n PyObject *arguments );\n\nPyObject *pyevtx_file_get_record_by_index(\n PyObject *pyevtx_file,\n int record_index );\n\nPyObject *pyevtx_file_get_record(\n pyevtx_file_t *pyevtx_file,\n PyObject *arguments,\n PyObject *keywords );\n\nPyObject *pyevtx_file_get_records(\n pyevtx_file_t *pyevtx_file,\n PyObject *arguments );\n\nPyObject *pyevtx_file_get_number_of_recovered_records(\n pyevtx_file_t *pyevtx_file,\n PyObject *arguments );\n\nPyObject *pyevtx_file_get_recovered_record_by_index(\n PyObject *pyevtx_file,\n int record_index );\n\nPyObject *pyevtx_file_get_recovered_record(\n pyevtx_file_t *pyevtx_file,\n PyObject *arguments,\n PyObject *keywords );\n\nPyObject *pyevtx_file_get_recovered_records(\n pyevtx_file_t *pyevtx_file,\n PyObject *arguments );\n\n#if defined( __cplusplus )\n}\n#endif\n\n#endif /* !defined( _PYEVTX_FILE_H ) */\n\n" }, { "path": "pyevtx/pyevtx_file_flags.c", "content": "/*\n * Python object definition of the libevtx file flags\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#include \n#include \n\n#if defined( HAVE_STDLIB_H ) || defined( HAVE_WINAPI )\n#include \n#endif\n\n#include \"pyevtx_file_flags.h\"\n#include \"pyevtx_libevtx.h\"\n#include \"pyevtx_python.h\"\n#include \"pyevtx_unused.h\"\n\nPyTypeObject pyevtx_file_flags_type_object = {\n\tPyVarObject_HEAD_INIT( NULL, 0 )\n\n\t/* tp_name */\n\t\"pyevtx.file_flags\",\n\t/* tp_basicsize */\n\tsizeof( pyevtx_file_flags_t ),\n\t/* tp_itemsize */\n\t0,\n\t/* tp_dealloc */\n\t(destructor) pyevtx_file_flags_free,\n\t/* tp_print */\n\t0,\n\t/* tp_getattr */\n\t0,\n\t/* tp_setattr */\n\t0,\n\t/* tp_compare */\n\t0,\n\t/* tp_repr */\n\t0,\n\t/* tp_as_number */\n\t0,\n\t/* tp_as_sequence */\n\t0,\n\t/* tp_as_mapping */\n\t0,\n\t/* tp_hash */\n\t0,\n\t/* tp_call */\n\t0,\n\t/* tp_str */\n\t0,\n\t/* tp_getattro */\n\t0,\n\t/* tp_setattro */\n\t0,\n\t/* tp_as_buffer */\n\t0,\n\t/* tp_flags */\n\tPy_TPFLAGS_DEFAULT,\n\t/* tp_doc */\n\t\"pyevtx file flags object (wraps LIBEVTX_FILE_FLAGS)\",\n\t/* tp_traverse */\n\t0,\n\t/* tp_clear */\n\t0,\n\t/* tp_richcompare */\n\t0,\n\t/* tp_weaklistoffset */\n\t0,\n\t/* tp_iter */\n\t0,\n\t/* tp_iternext */\n\t0,\n\t/* tp_methods */\n\t0,\n\t/* tp_members */\n\t0,\n\t/* tp_getset */\n\t0,\n\t/* tp_base */\n\t0,\n\t/* tp_dict */\n\t0,\n\t/* tp_descr_get */\n\t0,\n\t/* tp_descr_set */\n\t0,\n\t/* tp_dictoffset */\n\t0,\n\t/* tp_init */\n\t(initproc) pyevtx_file_flags_init,\n\t/* tp_alloc */\n\t0,\n\t/* tp_new */\n\t0,\n\t/* tp_free */\n\t0,\n\t/* tp_is_gc */\n\t0,\n\t/* tp_bases */\n\tNULL,\n\t/* tp_mro */\n\tNULL,\n\t/* tp_cache */\n\tNULL,\n\t/* tp_subclasses */\n\tNULL,\n\t/* tp_weaklist */\n\tNULL,\n\t/* tp_del */\n\t0\n};\n\n/* Initializes the type object\n * Returns 1 if successful or -1 on error\n */\nint pyevtx_file_flags_init_type(\n PyTypeObject *type_object )\n{\n\tPyObject *value_object = NULL;\n\n\tif( type_object == NULL )\n\t{\n\t\treturn( -1 );\n\t}\n\ttype_object->tp_dict = PyDict_New();\n\n\tif( type_object->tp_dict == NULL )\n\t{\n\t\treturn( -1 );\n\t}\n#if PY_MAJOR_VERSION >= 3\n\tvalue_object = PyLong_FromLong(\n\t LIBEVTX_FILE_FLAG_IS_DIRTY );\n#else\n\tvalue_object = PyInt_FromLong(\n\t LIBEVTX_FILE_FLAG_IS_DIRTY );\n#endif\n\tif( PyDict_SetItemString(\n\t type_object->tp_dict,\n\t \"IS_DIRTY\",\n\t value_object ) != 0 )\n\t{\n\t\tgoto on_error;\n\t}\n#if PY_MAJOR_VERSION >= 3\n\tvalue_object = PyLong_FromLong(\n\t LIBEVTX_FILE_FLAG_IS_FULL );\n#else\n\tvalue_object = PyInt_FromLong(\n\t LIBEVTX_FILE_FLAG_IS_FULL );\n#endif\n\tif( PyDict_SetItemString(\n\t type_object->tp_dict,\n\t \"IS_FULL\",\n\t value_object ) != 0 )\n\t{\n\t\tgoto on_error;\n\t}\n\treturn( 1 );\n\non_error:\n\tif( type_object->tp_dict != NULL )\n\t{\n\t\tPy_DecRef(\n\t\t type_object->tp_dict );\n\n\t\ttype_object->tp_dict = NULL;\n\t}\n\treturn( -1 );\n}\n\n/* Creates a new file flags object\n * Returns a Python object if successful or NULL on error\n */\nPyObject *pyevtx_file_flags_new(\n void )\n{\n\tpyevtx_file_flags_t *definitions_object = NULL;\n\tstatic char *function = \"pyevtx_file_flags_new\";\n\n\tdefinitions_object = PyObject_New(\n\t struct pyevtx_file_flags,\n\t &pyevtx_file_flags_type_object );\n\n\tif( definitions_object == NULL )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_MemoryError,\n\t\t \"%s: unable to create definitions object.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tif( pyevtx_file_flags_init(\n\t definitions_object ) != 0 )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_MemoryError,\n\t\t \"%s: unable to initialize definitions object.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\treturn( (PyObject *) definitions_object );\n\non_error:\n\tif( definitions_object != NULL )\n\t{\n\t\tPy_DecRef(\n\t\t (PyObject *) definitions_object );\n\t}\n\treturn( NULL );\n}\n\n/* Initializes a file flags object\n * Returns 0 if successful or -1 on error\n */\nint pyevtx_file_flags_init(\n pyevtx_file_flags_t *definitions_object )\n{\n\tstatic char *function = \"pyevtx_file_flags_init\";\n\n\tif( definitions_object == NULL )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_TypeError,\n\t\t \"%s: invalid definitions object.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\treturn( 0 );\n}\n\n/* Frees a file flags object\n */\nvoid pyevtx_file_flags_free(\n pyevtx_file_flags_t *definitions_object )\n{\n\tstruct _typeobject *ob_type = NULL;\n\tstatic char *function = \"pyevtx_file_flags_free\";\n\n\tif( definitions_object == NULL )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_TypeError,\n\t\t \"%s: invalid definitions object.\",\n\t\t function );\n\n\t\treturn;\n\t}\n\tob_type = Py_TYPE(\n\t definitions_object );\n\n\tif( ob_type == NULL )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_ValueError,\n\t\t \"%s: missing ob_type.\",\n\t\t function );\n\n\t\treturn;\n\t}\n\tif( ob_type->tp_free == NULL )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_ValueError,\n\t\t \"%s: invalid ob_type - missing tp_free.\",\n\t\t function );\n\n\t\treturn;\n\t}\n\tob_type->tp_free(\n\t (PyObject*) definitions_object );\n}\n\n" }, { "path": "pyevtx/pyevtx_file_flags.h", "content": "/*\n * Python object definition of the libevtx file flags\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#if !defined( _PYEVTX_FILE_FLAGS_H )\n#define _PYEVTX_FILE_FLAGS_H\n\n#include \n#include \n\n#include \"pyevtx_libevtx.h\"\n#include \"pyevtx_python.h\"\n\n#if defined( __cplusplus )\nextern \"C\" {\n#endif\n\ntypedef struct pyevtx_file_flags pyevtx_file_flags_t;\n\nstruct pyevtx_file_flags\n{\n\t/* Python object initialization\n\t */\n\tPyObject_HEAD\n};\n\nextern PyTypeObject pyevtx_file_flags_type_object;\n\nint pyevtx_file_flags_init_type(\n PyTypeObject *type_object );\n\nPyObject *pyevtx_file_flags_new(\n void );\n\nint pyevtx_file_flags_init(\n pyevtx_file_flags_t *definitions_object );\n\nvoid pyevtx_file_flags_free(\n pyevtx_file_flags_t *definitions_object );\n\n#if defined( __cplusplus )\n}\n#endif\n\n#endif /* !defined( _PYEVTX_FILE_FLAGS_H ) */\n\n" }, { "path": "pyevtx/pyevtx_file_object_io_handle.c", "content": "/*\n * Python file object IO handle functions\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#include \n#include \n#include \n\n#include \"pyevtx_error.h\"\n#include \"pyevtx_file_object_io_handle.h\"\n#include \"pyevtx_integer.h\"\n#include \"pyevtx_libbfio.h\"\n#include \"pyevtx_libcerror.h\"\n#include \"pyevtx_python.h\"\n\n/* Creates a file object IO handle\n * Make sure the value file_object_io_handle is referencing, is set to NULL\n * Returns 1 if successful or -1 on error\n */\nint pyevtx_file_object_io_handle_initialize(\n pyevtx_file_object_io_handle_t **file_object_io_handle,\n PyObject *file_object,\n libcerror_error_t **error )\n{\n\tstatic char *function = \"pyevtx_file_object_io_handle_initialize\";\n\n\tif( file_object_io_handle == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid file object IO handle.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( *file_object_io_handle != NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_VALUE_ALREADY_SET,\n\t\t \"%s: invalid file object IO handle value already set.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( file_object == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid file object.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\t*file_object_io_handle = (pyevtx_file_object_io_handle_t *) PyMem_Malloc(\n\t sizeof( pyevtx_file_object_io_handle_t ) );\n\n\tif( *file_object_io_handle == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_MEMORY,\n\t\t LIBCERROR_MEMORY_ERROR_INSUFFICIENT,\n\t\t \"%s: unable to create file object IO handle.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tif( memory_set(\n\t *file_object_io_handle,\n\t 0,\n\t sizeof( pyevtx_file_object_io_handle_t ) ) == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_MEMORY,\n\t\t LIBCERROR_MEMORY_ERROR_SET_FAILED,\n\t\t \"%s: unable to clear file object IO handle.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\t( *file_object_io_handle )->file_object = file_object;\n\n\tPy_IncRef(\n\t ( *file_object_io_handle )->file_object );\n\n\treturn( 1 );\n\non_error:\n\tif( *file_object_io_handle != NULL )\n\t{\n\t\tPyMem_Free(\n\t\t *file_object_io_handle );\n\n\t\t*file_object_io_handle = NULL;\n\t}\n\treturn( -1 );\n}\n\n/* Initializes the file object IO handle\n * Returns 1 if successful or -1 on error\n */\nint pyevtx_file_object_initialize(\n libbfio_handle_t **handle,\n PyObject *file_object,\n libcerror_error_t **error )\n{\n\tpyevtx_file_object_io_handle_t *file_object_io_handle = NULL;\n\tstatic char *function = \"pyevtx_file_object_initialize\";\n\n\tif( handle == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid handle.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( *handle != NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_VALUE_ALREADY_SET,\n\t\t \"%s: invalid handle value already set.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( pyevtx_file_object_io_handle_initialize(\n\t &file_object_io_handle,\n\t file_object,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_INITIALIZE_FAILED,\n\t\t \"%s: unable to create file object IO handle.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tif( libbfio_handle_initialize(\n\t handle,\n\t (intptr_t *) file_object_io_handle,\n\t (int (*)(intptr_t **, libcerror_error_t **)) pyevtx_file_object_io_handle_free,\n\t (int (*)(intptr_t **, intptr_t *, libcerror_error_t **)) pyevtx_file_object_io_handle_clone,\n\t (int (*)(intptr_t *, int, libcerror_error_t **)) pyevtx_file_object_io_handle_open,\n\t (int (*)(intptr_t *, libcerror_error_t **)) pyevtx_file_object_io_handle_close,\n\t (ssize_t (*)(intptr_t *, uint8_t *, size_t, libcerror_error_t **)) pyevtx_file_object_io_handle_read,\n\t (ssize_t (*)(intptr_t *, const uint8_t *, size_t, libcerror_error_t **)) pyevtx_file_object_io_handle_write,\n\t (off64_t (*)(intptr_t *, off64_t, int, libcerror_error_t **)) pyevtx_file_object_io_handle_seek_offset,\n\t (int (*)(intptr_t *, libcerror_error_t **)) pyevtx_file_object_io_handle_exists,\n\t (int (*)(intptr_t *, libcerror_error_t **)) pyevtx_file_object_io_handle_is_open,\n\t (int (*)(intptr_t *, size64_t *, libcerror_error_t **)) pyevtx_file_object_io_handle_get_size,\n\t LIBBFIO_FLAG_IO_HANDLE_MANAGED | LIBBFIO_FLAG_IO_HANDLE_CLONE_BY_FUNCTION,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_INITIALIZE_FAILED,\n\t\t \"%s: unable to create handle.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\treturn( 1 );\n\non_error:\n\tif( file_object_io_handle != NULL )\n\t{\n\t\tpyevtx_file_object_io_handle_free(\n\t\t &file_object_io_handle,\n\t\t NULL );\n\t}\n\treturn( -1 );\n}\n\n/* Frees a file object IO handle\n * Returns 1 if succesful or -1 on error\n */\nint pyevtx_file_object_io_handle_free(\n pyevtx_file_object_io_handle_t **file_object_io_handle,\n libcerror_error_t **error )\n{\n\tstatic char *function = \"pyevtx_file_object_io_handle_free\";\n\tPyGILState_STATE gil_state = 0;\n\n\tif( file_object_io_handle == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid file object IO handle.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( *file_object_io_handle != NULL )\n\t{\n\t\tgil_state = PyGILState_Ensure();\n\n\t\tPy_DecRef(\n\t\t ( *file_object_io_handle )->file_object );\n\n\t\tPyMem_Free(\n\t\t *file_object_io_handle );\n\n\t\t*file_object_io_handle = NULL;\n\n\t\tPyGILState_Release(\n\t\t gil_state );\n\t}\n\treturn( 1 );\n}\n\n/* Clones (duplicates) the file object IO handle and its attributes\n * Returns 1 if succesful or -1 on error\n */\nint pyevtx_file_object_io_handle_clone(\n pyevtx_file_object_io_handle_t **destination_file_object_io_handle,\n pyevtx_file_object_io_handle_t *source_file_object_io_handle,\n libcerror_error_t **error )\n{\n\tstatic char *function = \"pyevtx_file_object_io_handle_clone\";\n\n\tif( destination_file_object_io_handle == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid destination file object IO handle.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( *destination_file_object_io_handle != NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_VALUE_ALREADY_SET,\n\t\t \"%s: destination file object IO handle already set.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( source_file_object_io_handle == NULL )\n\t{\n\t\t*destination_file_object_io_handle = NULL;\n\n\t\treturn( 1 );\n\t}\n\tif( pyevtx_file_object_io_handle_initialize(\n\t destination_file_object_io_handle,\n\t source_file_object_io_handle->file_object,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_INITIALIZE_FAILED,\n\t\t \"%s: unable to create file object IO handle.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( *destination_file_object_io_handle == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_VALUE_MISSING,\n\t\t \"%s: missing destination file object IO handle.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\treturn( 1 );\n}\n\n/* Opens the file object IO handle\n * Returns 1 if successful or -1 on error\n */\nint pyevtx_file_object_io_handle_open(\n pyevtx_file_object_io_handle_t *file_object_io_handle,\n int access_flags,\n libcerror_error_t **error )\n{\n\tstatic char *function = \"pyevtx_file_object_io_handle_open\";\n\n\tif( file_object_io_handle == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid file object IO handle.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( file_object_io_handle->file_object == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_VALUE_MISSING,\n\t\t \"%s: invalid file object IO handle - missing file object.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( ( ( access_flags & LIBBFIO_ACCESS_FLAG_READ ) != 0 )\n\t && ( ( access_flags & LIBBFIO_ACCESS_FLAG_WRITE ) != 0 ) )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_UNSUPPORTED_VALUE,\n\t\t \"%s: unsupported access flags.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( ( access_flags & LIBBFIO_ACCESS_FLAG_WRITE ) != 0 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_UNSUPPORTED_VALUE,\n\t\t \"%s: write access currently not supported.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\t/* No need to do anything here, because the file object is already open\n\t */\n\tfile_object_io_handle->access_flags = access_flags;\n\n\treturn( 1 );\n}\n\n/* Closes the file object IO handle\n * Returns 0 if successful or -1 on error\n */\nint pyevtx_file_object_io_handle_close(\n pyevtx_file_object_io_handle_t *file_object_io_handle,\n libcerror_error_t **error )\n{\n\tstatic char *function = \"pyevtx_file_object_io_handle_close\";\n\n\tif( file_object_io_handle == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid file object IO handle.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( file_object_io_handle->file_object == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_VALUE_MISSING,\n\t\t \"%s: invalid file object IO handle - missing file object.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\t/* Do not close the file object, have Python deal with it\n\t */\n\tfile_object_io_handle->access_flags = 0;\n\n\treturn( 0 );\n}\n\n/* Reads a buffer from the file object\n * Make sure to hold the GIL state before calling this function\n * Returns the number of bytes read if successful, or -1 on error\n */\nssize_t pyevtx_file_object_read_buffer(\n PyObject *file_object,\n uint8_t *buffer,\n size_t size,\n libcerror_error_t **error )\n{\n\tPyObject *argument_size = NULL;\n\tPyObject *method_name = NULL;\n\tPyObject *method_result = NULL;\n\tstatic char *function = \"pyevtx_file_object_read_buffer\";\n\tchar *safe_buffer = NULL;\n\tPy_ssize_t safe_read_count = 0;\n\tssize_t read_count = 0;\n\tint result = 0;\n\n\tif( file_object == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid file object.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( buffer == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid buffer.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( size > (size_t) SSIZE_MAX )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_VALUE_EXCEEDS_MAXIMUM,\n\t\t \"%s: invalid size value exceeds maximum.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( size > 0 )\n\t{\n#if PY_MAJOR_VERSION >= 3\n\t\tmethod_name = PyUnicode_FromString(\n\t\t\t \"read\" );\n#else\n\t\tmethod_name = PyString_FromString(\n\t\t\t \"read\" );\n#endif\n\t\targument_size = PyLong_FromSize_t(\n\t\t\t\t size );\n\n\t\tPyErr_Clear();\n\n\t\tmethod_result = PyObject_CallMethodObjArgs(\n\t\t\t\t file_object,\n\t\t\t\t method_name,\n\t\t\t\t argument_size,\n\t\t\t\t NULL );\n\n\t\tif( PyErr_Occurred() )\n\t\t{\n\t\t\tpyevtx_error_fetch(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_IO,\n\t\t\t LIBCERROR_IO_ERROR_READ_FAILED,\n\t\t\t \"%s: unable to read from file object.\",\n\t\t\t function );\n\n\t\t\tgoto on_error;\n\t\t}\n\t\tif( method_result == NULL )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_VALUE_MISSING,\n\t\t\t \"%s: missing method result.\",\n\t\t\t function );\n\n\t\t\tgoto on_error;\n\t\t}\n#if PY_MAJOR_VERSION >= 3\n\t\tresult = PyObject_IsInstance(\n\t\t method_result,\n\t\t (PyObject *) &PyBytes_Type );\n#else\n\t\tresult = PyObject_IsInstance(\n\t\t method_result,\n\t\t (PyObject *) &PyString_Type );\n#endif\n\t\tif( result == -1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to determine if method result is a binary string object.\",\n\t\t\t function );\n\n\t\t\tgoto on_error;\n\t\t}\n\t\telse if( result == 0 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_UNSUPPORTED_VALUE,\n\t\t\t \"%s: invalid method result value is not a binary string object.\",\n\t\t\t function );\n\n\t\t\tgoto on_error;\n\t\t}\n#if PY_MAJOR_VERSION >= 3\n\t\tresult = PyBytes_AsStringAndSize(\n\t\t\t method_result,\n\t\t\t &safe_buffer,\n\t\t\t &safe_read_count );\n#else\n\t\tresult = PyString_AsStringAndSize(\n\t\t\t method_result,\n\t\t\t &safe_buffer,\n\t\t\t &safe_read_count );\n#endif\n\t\tif( result == -1 )\n\t\t{\n\t\t\tpyevtx_error_fetch(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_IO,\n\t\t\t LIBCERROR_IO_ERROR_READ_FAILED,\n\t\t\t \"%s: unable to read from file object.\",\n\t\t\t function );\n\n\t\t\tgoto on_error;\n\t\t}\n\t\tif( safe_read_count > (Py_ssize_t) SSIZE_MAX )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_VALUE_EXCEEDS_MAXIMUM,\n\t\t\t \"%s: invalid read count value exceeds maximum.\",\n\t\t\t function );\n\n\t\t\tgoto on_error;\n\t\t}\n\t\tread_count = (ssize_t) safe_read_count;\n\n\t\tif( memory_copy(\n\t\t buffer,\n\t\t safe_buffer,\n\t\t read_count ) == NULL )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_MEMORY,\n\t\t\t LIBCERROR_MEMORY_ERROR_COPY_FAILED,\n\t\t\t \"%s: unable to copy data to buffer.\",\n\t\t\t function );\n\n\t\t\tgoto on_error;\n\t\t}\n\t\tPy_DecRef(\n\t\t method_result );\n\n\t\tPy_DecRef(\n\t\t argument_size );\n\n\t\tPy_DecRef(\n\t\t method_name );\n\t}\n\treturn( read_count );\n\non_error:\n\tif( method_result != NULL )\n\t{\n\t\tPy_DecRef(\n\t\t method_result );\n\t}\n\tif( argument_size != NULL )\n\t{\n\t\tPy_DecRef(\n\t\t argument_size );\n\t}\n\tif( method_name != NULL )\n\t{\n\t\tPy_DecRef(\n\t\t method_name );\n\t}\n\treturn( -1 );\n}\n\n/* Reads a buffer from the file object IO handle\n * Returns the number of bytes read if successful, or -1 on error\n */\nssize_t pyevtx_file_object_io_handle_read(\n pyevtx_file_object_io_handle_t *file_object_io_handle,\n uint8_t *buffer,\n size_t size,\n libcerror_error_t **error )\n{\n\tstatic char *function = \"pyevtx_file_object_io_handle_read\";\n\tPyGILState_STATE gil_state = 0;\n\tssize_t read_count = 0;\n\n\tif( file_object_io_handle == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid file object IO handle.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tgil_state = PyGILState_Ensure();\n\n\tread_count = pyevtx_file_object_read_buffer(\n\t file_object_io_handle->file_object,\n\t buffer,\n\t size,\n\t error );\n\n\tif( read_count == -1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_IO,\n\t\t LIBCERROR_IO_ERROR_READ_FAILED,\n\t\t \"%s: unable to read from file object.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tPyGILState_Release(\n\t gil_state );\n\n\treturn( read_count );\n\non_error:\n\tPyGILState_Release(\n\t gil_state );\n\n\treturn( -1 );\n}\n\n/* Writes a buffer to the file object\n * Make sure to hold the GIL state before calling this function\n * Returns the number of bytes written if successful, or -1 on error\n */\nssize_t pyevtx_file_object_write_buffer(\n PyObject *file_object,\n const uint8_t *buffer,\n size_t size,\n libcerror_error_t **error )\n{\n\tPyObject *argument_string = NULL;\n\tPyObject *method_name = NULL;\n\tPyObject *method_result = NULL;\n\tstatic char *function = \"pyevtx_file_object_write_buffer\";\n\n\tif( file_object == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid file object.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( buffer == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid buffer.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n#if SIZEOF_SIZE_T > SIZEOF_INT\n\tif( size > (size_t) INT_MAX )\n#else\n\tif( size > (size_t) SSIZE_MAX )\n#endif\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_VALUE_EXCEEDS_MAXIMUM,\n\t\t \"%s: invalid size value exceeds maximum.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( size > 0 )\n\t{\n#if PY_MAJOR_VERSION >= 3\n\t\tmethod_name = PyUnicode_FromString(\n\t\t\t \"write\" );\n#else\n\t\tmethod_name = PyString_FromString(\n\t\t\t \"write\" );\n#endif\n#if PY_MAJOR_VERSION >= 3\n\t\targument_string = PyBytes_FromStringAndSize(\n\t\t (char *) buffer,\n\t\t size );\n#else\n\t\targument_string = PyString_FromStringAndSize(\n\t\t (char *) buffer,\n\t\t size );\n#endif\n\t\tPyErr_Clear();\n\n\t\tmethod_result = PyObject_CallMethodObjArgs(\n\t\t\t\t file_object,\n\t\t\t\t method_name,\n\t\t\t\t argument_string,\n\t\t\t\t NULL );\n\n\t\tif( PyErr_Occurred() )\n\t\t{\n\t\t\tpyevtx_error_fetch(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_IO,\n\t\t\t LIBCERROR_IO_ERROR_WRITE_FAILED,\n\t\t\t \"%s: unable to write to file object.\",\n\t\t\t function );\n\n\t\t\tgoto on_error;\n\t\t}\n\t\tif( method_result == NULL )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_VALUE_MISSING,\n\t\t\t \"%s: missing method result.\",\n\t\t\t function );\n\n\t\t\tgoto on_error;\n\t\t}\n\t\tPy_DecRef(\n\t\t method_result );\n\n\t\tPy_DecRef(\n\t\t argument_string );\n\n\t\tPy_DecRef(\n\t\t method_name );\n\t}\n\treturn( (ssize_t) size );\n\non_error:\n\tif( method_result != NULL )\n\t{\n\t\tPy_DecRef(\n\t\t method_result );\n\t}\n\tif( argument_string != NULL )\n\t{\n\t\tPy_DecRef(\n\t\t argument_string );\n\t}\n\tif( method_name != NULL )\n\t{\n\t\tPy_DecRef(\n\t\t method_name );\n\t}\n\treturn( -1 );\n}\n\n/* Writes a buffer to the file object IO handle\n * Returns the number of bytes written if successful, or -1 on error\n */\nssize_t pyevtx_file_object_io_handle_write(\n pyevtx_file_object_io_handle_t *file_object_io_handle,\n const uint8_t *buffer,\n size_t size,\n libcerror_error_t **error )\n{\n\tstatic char *function = \"pyevtx_file_object_io_handle_write\";\n\tPyGILState_STATE gil_state = 0;\n\tssize_t write_count = 0;\n\n\tif( file_object_io_handle == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid file object IO handle.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tgil_state = PyGILState_Ensure();\n\n\twrite_count = pyevtx_file_object_write_buffer(\n\t file_object_io_handle->file_object,\n\t buffer,\n\t size,\n\t error );\n\n\tif( write_count == -1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_IO,\n\t\t LIBCERROR_IO_ERROR_WRITE_FAILED,\n\t\t \"%s: unable to write from file object.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tPyGILState_Release(\n\t gil_state );\n\n\treturn( write_count );\n\non_error:\n\tPyGILState_Release(\n\t gil_state );\n\n\treturn( -1 );\n}\n\n/* Seeks a certain offset within the file object\n * Make sure to hold the GIL state before calling this function\n * Returns 1 if successful or -1 on error\n */\nint pyevtx_file_object_seek_offset(\n PyObject *file_object,\n off64_t offset,\n int whence,\n libcerror_error_t **error )\n{\n\tPyObject *argument_offset = NULL;\n\tPyObject *argument_whence = NULL;\n\tPyObject *method_name = NULL;\n\tPyObject *method_result = NULL;\n\tstatic char *function = \"pyevtx_file_object_seek_offset\";\n\n\tif( file_object == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid file object.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n#if defined( HAVE_LONG_LONG )\n\tif( offset > (off64_t) INT64_MAX )\n#else\n\tif( offset > (off64_t) LONG_MAX )\n#endif\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_VALUE_EXCEEDS_MAXIMUM,\n\t\t \"%s: invalid offset value exceeds maximum.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( ( whence != SEEK_CUR )\n\t && ( whence != SEEK_END )\n\t && ( whence != SEEK_SET ) )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_UNSUPPORTED_VALUE,\n\t\t \"%s: unsupported whence.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n#if PY_MAJOR_VERSION >= 3\n\tmethod_name = PyUnicode_FromString(\n\t \"seek\" );\n#else\n\tmethod_name = PyString_FromString(\n\t \"seek\" );\n#endif\n#if defined( HAVE_LONG_LONG )\n\targument_offset = PyLong_FromLongLong(\n\t (PY_LONG_LONG) offset );\n#else\n\targument_offset = PyLong_FromLongLong(\n\t (long) offset );\n#endif\n#if PY_MAJOR_VERSION >= 3\n\targument_whence = PyLong_FromLong(\n\t (long) whence );\n#else\n\targument_whence = PyInt_FromLong(\n\t (long) whence );\n#endif\n\tPyErr_Clear();\n\n\tmethod_result = PyObject_CallMethodObjArgs(\n\t file_object,\n\t method_name,\n\t argument_offset,\n\t argument_whence,\n\t NULL );\n\n\tif( PyErr_Occurred() )\n\t{\n\t\tpyevtx_error_fetch(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_IO,\n\t\t LIBCERROR_IO_ERROR_SEEK_FAILED,\n\t\t \"%s: unable to seek in file object.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tif( method_result == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_VALUE_MISSING,\n\t\t \"%s: missing method result.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tPy_DecRef(\n\t method_result );\n\n\tPy_DecRef(\n\t argument_whence );\n\n\tPy_DecRef(\n\t argument_offset );\n\n\tPy_DecRef(\n\t method_name );\n\n\treturn( 1 );\n\non_error:\n\tif( method_result != NULL )\n\t{\n\t\tPy_DecRef(\n\t\t method_result );\n\t}\n\tif( argument_whence != NULL )\n\t{\n\t\tPy_DecRef(\n\t\t argument_whence );\n\t}\n\tif( argument_offset != NULL )\n\t{\n\t\tPy_DecRef(\n\t\t argument_offset );\n\t}\n\tif( method_name != NULL )\n\t{\n\t\tPy_DecRef(\n\t\t method_name );\n\t}\n\treturn( -1 );\n}\n\n/* Retrieves the current offset within the file object\n * Make sure to hold the GIL state before calling this function\n * Returns 1 if successful or -1 on error\n */\nint pyevtx_file_object_get_offset(\n PyObject *file_object,\n off64_t *offset,\n libcerror_error_t **error )\n{\n\tPyObject *method_name = NULL;\n\tPyObject *method_result = NULL;\n\tstatic char *function = \"pyevtx_file_object_get_offset\";\n\tint result = 0;\n\n\tif( file_object == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid file object.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( offset == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid offset.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n#if PY_MAJOR_VERSION >= 3\n\tmethod_name = PyUnicode_FromString(\n\t \"get_offset\" );\n#else\n\tmethod_name = PyString_FromString(\n\t \"get_offset\" );\n#endif\n\tPyErr_Clear();\n\n\t/* Determine if the file object has the get_offset method\n\t */\n\tresult = PyObject_HasAttr(\n\t file_object,\n\t method_name );\n\n\tif( result == 0 )\n\t{\n\t\tPy_DecRef(\n\t\t method_name );\n\n\t\t/* Fall back to the tell method\n\t\t */\n#if PY_MAJOR_VERSION >= 3\n\t\tmethod_name = PyUnicode_FromString(\n\t\t \"tell\" );\n#else\n\t\tmethod_name = PyString_FromString(\n\t\t \"tell\" );\n#endif\n\t}\n\tPyErr_Clear();\n\n\tmethod_result = PyObject_CallMethodObjArgs(\n\t file_object,\n\t method_name,\n\t NULL );\n\n\tif( PyErr_Occurred() )\n\t{\n\t\tpyevtx_error_fetch(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to retrieve current offset in file object.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tif( method_result == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_VALUE_MISSING,\n\t\t \"%s: missing method result.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tif( pyevtx_integer_signed_copy_to_64bit(\n\t method_result,\n\t offset,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to convert method result into current offset of file object.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tPy_DecRef(\n\t method_result );\n\n\tPy_DecRef(\n\t method_name );\n\n\treturn( 1 );\n\non_error:\n\tif( method_result != NULL )\n\t{\n\t\tPy_DecRef(\n\t\t method_result );\n\t}\n\tif( method_name != NULL )\n\t{\n\t\tPy_DecRef(\n\t\t method_name );\n\t}\n\treturn( -1 );\n}\n\n/* Seeks a certain offset within the file object IO handle\n * Returns the offset if the seek is successful or -1 on error\n */\noff64_t pyevtx_file_object_io_handle_seek_offset(\n pyevtx_file_object_io_handle_t *file_object_io_handle,\n off64_t offset,\n int whence,\n libcerror_error_t **error )\n{\n\tstatic char *function = \"pyevtx_file_object_io_handle_seek_offset\";\n\tPyGILState_STATE gil_state = 0;\n\n\tif( file_object_io_handle == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid file object IO handle.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tgil_state = PyGILState_Ensure();\n\n\tif( pyevtx_file_object_seek_offset(\n\t file_object_io_handle->file_object,\n\t offset,\n\t whence,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_IO,\n\t\t LIBCERROR_IO_ERROR_SEEK_FAILED,\n\t\t \"%s: unable to seek in file object.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tif( pyevtx_file_object_get_offset(\n\t file_object_io_handle->file_object,\n\t &offset,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_IO,\n\t\t LIBCERROR_IO_ERROR_SEEK_FAILED,\n\t\t \"%s: unable to retrieve current offset in file object.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tPyGILState_Release(\n\t gil_state );\n\n\treturn( offset );\n\non_error:\n\tPyGILState_Release(\n\t gil_state );\n\n\treturn( -1 );\n}\n\n/* Function to determine if a file exists\n * Returns 1 if file exists, 0 if not or -1 on error\n */\nint pyevtx_file_object_io_handle_exists(\n pyevtx_file_object_io_handle_t *file_object_io_handle,\n libcerror_error_t **error )\n{\n\tstatic char *function = \"pyevtx_file_object_io_handle_exists\";\n\n\tif( file_object_io_handle == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid file object IO handle.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( file_object_io_handle->file_object == NULL )\n\t{\n\t\treturn( 0 );\n\t}\n\treturn( 1 );\n}\n\n/* Check if the file is open\n * Returns 1 if open, 0 if not or -1 on error\n */\nint pyevtx_file_object_io_handle_is_open(\n pyevtx_file_object_io_handle_t *file_object_io_handle,\n libcerror_error_t **error )\n{\n\tstatic char *function = \"pyevtx_file_object_io_handle_is_open\";\n\n\tif( file_object_io_handle == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid file object IO handle.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( file_object_io_handle->file_object == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_VALUE_MISSING,\n\t\t \"%s: invalid file object IO handle - missing file object.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\t/* As far as BFIO is concerned the file object is always open\n\t */\n\treturn( 1 );\n}\n\n/* Retrieves the size of the file object\n * Make sure to hold the GIL state before calling this function\n * Returns 1 if successful or -1 on error\n */\nint pyevtx_file_object_get_size(\n PyObject *file_object,\n size64_t *size,\n libcerror_error_t **error )\n{\n\tPyObject *method_name = NULL;\n\tPyObject *method_result = NULL;\n\tstatic char *function = \"pyevtx_file_object_get_size\";\n\n\tif( file_object == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid file object.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( size == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid size.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n#if PY_MAJOR_VERSION >= 3\n\tmethod_name = PyUnicode_FromString(\n\t \"get_size\" );\n#else\n\tmethod_name = PyString_FromString(\n\t \"get_size\" );\n#endif\n\tPyErr_Clear();\n\n\tmethod_result = PyObject_CallMethodObjArgs(\n\t file_object,\n\t method_name,\n\t NULL );\n\n\tif( PyErr_Occurred() )\n\t{\n\t\tpyevtx_error_fetch(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to retrieve size of file object.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tif( method_result == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_VALUE_MISSING,\n\t\t \"%s: missing method result.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tif( pyevtx_integer_unsigned_copy_to_64bit(\n\t method_result,\n\t size,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to convert method result into size of file object.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tPy_DecRef(\n\t method_result );\n\n\tPy_DecRef(\n\t method_name );\n\n\treturn( 1 );\n\non_error:\n\tif( method_result != NULL )\n\t{\n\t\tPy_DecRef(\n\t\t method_result );\n\t}\n\tif( method_name != NULL )\n\t{\n\t\tPy_DecRef(\n\t\t method_name );\n\t}\n\treturn( -1 );\n}\n\n/* Retrieves the file size\n * Returns 1 if successful or -1 on error\n */\nint pyevtx_file_object_io_handle_get_size(\n pyevtx_file_object_io_handle_t *file_object_io_handle,\n size64_t *size,\n libcerror_error_t **error )\n{\n\tPyObject *method_name = NULL;\n\tstatic char *function = \"pyevtx_file_object_io_handle_get_size\";\n\tPyGILState_STATE gil_state = 0;\n\toff64_t current_offset = 0;\n\tint result = 0;\n\n\tif( file_object_io_handle == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid file object IO handle.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( file_object_io_handle->file_object == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_VALUE_MISSING,\n\t\t \"%s: invalid file object IO handle - missing file object.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tgil_state = PyGILState_Ensure();\n\n#if PY_MAJOR_VERSION >= 3\n\tmethod_name = PyUnicode_FromString(\n\t \"get_size\" );\n#else\n\tmethod_name = PyString_FromString(\n\t \"get_size\" );\n#endif\n\tPyErr_Clear();\n\n\t/* Determine if the file object has the get_size method\n\t */\n\tresult = PyObject_HasAttr(\n\t file_object_io_handle->file_object,\n\t method_name );\n\n\tif( result != 0 )\n\t{\n\t\tif( pyevtx_file_object_get_size(\n\t\t file_object_io_handle->file_object,\n\t\t size,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve size of file object.\",\n\t\t\t function );\n\n\t\t\tgoto on_error;\n\t\t}\n\t}\n\telse\n\t{\n\t\tif( pyevtx_file_object_get_offset(\n\t\t file_object_io_handle->file_object,\n\t\t ¤t_offset,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve current offset in file object.\",\n\t\t\t function );\n\n\t\t\tgoto on_error;\n\t\t}\n\t\tif( pyevtx_file_object_seek_offset(\n\t\t file_object_io_handle->file_object,\n\t\t 0,\n\t\t SEEK_END,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_IO,\n\t\t\t LIBCERROR_IO_ERROR_SEEK_FAILED,\n\t\t\t \"%s: unable to seek end of file object.\",\n\t\t\t function );\n\n\t\t\tgoto on_error;\n\t\t}\n\t\tif( pyevtx_file_object_get_offset(\n\t\t file_object_io_handle->file_object,\n\t\t (off64_t *) size,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to retrieve end offset in file object.\",\n\t\t\t function );\n\n\t\t\tpyevtx_file_object_seek_offset(\n\t\t\t file_object_io_handle->file_object,\n\t\t\t current_offset,\n\t\t\t SEEK_SET,\n\t\t\t NULL );\n\n\t\t\tgoto on_error;\n\t\t}\n\t\tif( pyevtx_file_object_seek_offset(\n\t\t file_object_io_handle->file_object,\n\t\t current_offset,\n\t\t SEEK_SET,\n\t\t error ) != 1 )\n\t\t{\n\t\t\tlibcerror_error_set(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_IO,\n\t\t\t LIBCERROR_IO_ERROR_SEEK_FAILED,\n\t\t\t \"%s: unable to seek current offset in file object.\",\n\t\t\t function );\n\n\t\t\tgoto on_error;\n\t\t}\n\t}\n\tPy_DecRef(\n\t method_name );\n\n\tPyGILState_Release(\n\t gil_state );\n\n\treturn( 1 );\n\non_error:\n\tif( method_name != NULL )\n\t{\n\t\tPy_DecRef(\n\t\t method_name );\n\t}\n\tPyGILState_Release(\n\t gil_state );\n\n\treturn( 1 );\n}\n\n" }, { "path": "pyevtx/pyevtx_file_object_io_handle.h", "content": "/*\n * Python file object IO handle functions\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#if !defined( _PYEVTX_FILE_OBJECT_IO_HANDLE_H )\n#define _PYEVTX_FILE_OBJECT_IO_HANDLE_H\n\n#include \n#include \n\n#include \"pyevtx_libbfio.h\"\n#include \"pyevtx_libcerror.h\"\n#include \"pyevtx_python.h\"\n\n#if defined( __cplusplus )\nextern \"C\" {\n#endif\n\ntypedef struct pyevtx_file_object_io_handle pyevtx_file_object_io_handle_t;\n\nstruct pyevtx_file_object_io_handle\n{\n\t/* The python file (like) object\n\t */\n\tPyObject *file_object;\n\n\t/* The access flags\n\t */\n\tint access_flags;\n};\n\nint pyevtx_file_object_io_handle_initialize(\n pyevtx_file_object_io_handle_t **file_object_io_handle,\n PyObject *file_object,\n libcerror_error_t **error );\n\nint pyevtx_file_object_initialize(\n libbfio_handle_t **handle,\n PyObject *file_object,\n libcerror_error_t **error );\n\nint pyevtx_file_object_io_handle_free(\n pyevtx_file_object_io_handle_t **file_object_io_handle,\n libcerror_error_t **error );\n\nint pyevtx_file_object_io_handle_clone(\n pyevtx_file_object_io_handle_t **destination_file_object_io_handle,\n pyevtx_file_object_io_handle_t *source_file_object_io_handle,\n libcerror_error_t **error );\n\nint pyevtx_file_object_io_handle_open(\n pyevtx_file_object_io_handle_t *file_object_io_handle,\n int access_flags,\n libcerror_error_t **error );\n\nint pyevtx_file_object_io_handle_close(\n pyevtx_file_object_io_handle_t *file_object_io_handle,\n libcerror_error_t **error );\n\nssize_t pyevtx_file_object_read_buffer(\n PyObject *file_object,\n uint8_t *buffer,\n size_t size,\n libcerror_error_t **error );\n\nssize_t pyevtx_file_object_io_handle_read(\n pyevtx_file_object_io_handle_t *file_object_io_handle,\n uint8_t *buffer,\n size_t size,\n libcerror_error_t **error );\n\nssize_t pyevtx_file_object_write_buffer(\n PyObject *file_object,\n const uint8_t *buffer,\n size_t size,\n libcerror_error_t **error );\n\nssize_t pyevtx_file_object_io_handle_write(\n pyevtx_file_object_io_handle_t *file_object_io_handle,\n const uint8_t *buffer,\n size_t size,\n libcerror_error_t **error );\n\nint pyevtx_file_object_seek_offset(\n PyObject *file_object,\n off64_t offset,\n int whence,\n libcerror_error_t **error );\n\nint pyevtx_file_object_get_offset(\n PyObject *file_object,\n off64_t *offset,\n libcerror_error_t **error );\n\noff64_t pyevtx_file_object_io_handle_seek_offset(\n pyevtx_file_object_io_handle_t *file_object_io_handle,\n off64_t offset,\n int whence,\n libcerror_error_t **error );\n\nint pyevtx_file_object_io_handle_exists(\n pyevtx_file_object_io_handle_t *file_object_io_handle,\n libcerror_error_t **error );\n\nint pyevtx_file_object_io_handle_is_open(\n pyevtx_file_object_io_handle_t *file_object_io_handle,\n libcerror_error_t **error );\n\nint pyevtx_file_object_get_size(\n PyObject *file_object,\n size64_t *size,\n libcerror_error_t **error );\n\nint pyevtx_file_object_io_handle_get_size(\n pyevtx_file_object_io_handle_t *file_object_io_handle,\n size64_t *size,\n libcerror_error_t **error );\n\n#if defined( __cplusplus )\n}\n#endif\n\n#endif /* !defined( _PYEVTX_FILE_OBJECT_IO_HANDLE_H ) */\n\n" }, { "path": "pyevtx/pyevtx_integer.c", "content": "/*\n * Integer functions\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#include \n#include \n\n#include \"pyevtx_error.h\"\n#include \"pyevtx_libcerror.h\"\n#include \"pyevtx_integer.h\"\n#include \"pyevtx_python.h\"\n\n/* Creates a new signed integer object from a 64-bit value\n * Returns a Python object if successful or NULL on error\n */\nPyObject *pyevtx_integer_signed_new_from_64bit(\n int64_t value_64bit )\n{\n\tPyObject *integer_object = NULL;\n\tstatic char *function = \"pyevtx_integer_signed_new_from_64bit\";\n\n#if defined( HAVE_LONG_LONG )\n\tif( ( value_64bit < (int64_t) LLONG_MIN )\n\t || ( value_64bit > (int64_t) LLONG_MAX ) )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_OverflowError,\n\t\t \"%s: 64-bit value out of bounds.\",\n\t\t function );\n\n\t\treturn( NULL );\n\t}\n\tinteger_object = PyLong_FromLongLong(\n\t (long long) value_64bit );\n#else\n\tif( current_offset > (off64_t) LONG_MAX )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_OverflowError,\n\t\t \"%s: 64-bit value out of bounds.\",\n\t\t function );\n\n\t\treturn( NULL );\n\t}\n\tinteger_object = PyLong_FromLong(\n\t (long) value_64bit );\n#endif\n\treturn( integer_object );\n}\n\n/* Creates a new unsigned integer object from a 64-bit value\n * Returns a Python object if successful or NULL on error\n */\nPyObject *pyevtx_integer_unsigned_new_from_64bit(\n uint64_t value_64bit )\n{\n\tPyObject *integer_object = NULL;\n\tstatic char *function = \"pyevtx_integer_unsigned_new_from_64bit\";\n\n#if defined( HAVE_LONG_LONG )\n\tif( value_64bit > (uint64_t) ULLONG_MAX )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_OverflowError,\n\t\t \"%s: 64-bit value exceeds maximum.\",\n\t\t function );\n\n\t\treturn( NULL );\n\t}\n\tinteger_object = PyLong_FromUnsignedLongLong(\n\t (long long) value_64bit );\n#else\n\tif( value_64bit > (uint64_t) ULONG_MAX )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_OverflowError,\n\t\t \"%s: 64-bit value exceeds maximum.\",\n\t\t function );\n\n\t\treturn( NULL );\n\t}\n\tinteger_object = PyLong_FromUnsignedLong(\n\t (long) value_64bit );\n#endif\n\treturn( integer_object );\n}\n\n/* Copies a Python int or long object to a signed 64-bit value\n * Returns 1 if successful or -1 on error\n */\nint pyevtx_integer_signed_copy_to_64bit(\n PyObject *integer_object,\n int64_t *value_64bit,\n libcerror_error_t **error )\n{\n\tstatic char *function = \"pyevtx_integer_signed_copy_to_64bit\";\n\tint result = 0;\n\n#if defined( HAVE_LONG_LONG )\n\tPY_LONG_LONG long_value = 0;\n#else\n\tlong long_value = 0;\n#endif\n\n\tif( integer_object == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid integer object.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tPyErr_Clear();\n\n\tresult = PyObject_IsInstance(\n\t integer_object,\n\t (PyObject *) &PyLong_Type );\n\n\tif( result == -1 )\n\t{\n\t\tpyevtx_error_fetch(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to determine if integer object is of type long.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\telse if( result != 0 )\n\t{\n\t\tPyErr_Clear();\n\n#if defined( HAVE_LONG_LONG )\n\t\tlong_value = PyLong_AsLongLong(\n\t\t integer_object );\n#else\n\t\tlong_value = PyLong_AsLong(\n\t\t integer_object );\n#endif\n\t}\n#if PY_MAJOR_VERSION < 3\n\tif( result == 0 )\n\t{\n\t\tPyErr_Clear();\n\n\t\tresult = PyObject_IsInstance(\n\t\t integer_object,\n\t\t (PyObject *) &PyInt_Type );\n\n\t\tif( result == -1 )\n\t\t{\n\t\t\tpyevtx_error_fetch(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to determine if integer object is of type int.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\telse if( result != 0 )\n\t\t{\n\t\t\tPyErr_Clear();\n\n\t\t\tlong_value = PyInt_AsLong(\n\t\t\t integer_object );\n\t\t}\n\t}\n#endif /* PY_MAJOR_VERSION < 3 */\n\n\tif( result == 0 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unsupported integer object type.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( PyErr_Occurred() )\n\t{\n\t\tpyevtx_error_fetch(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to convert integer object to long.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n#if defined( HAVE_LONG_LONG ) && ( SIZEOF_LONG_LONG > 8 )\n\tif( ( long_value < (PY_LONG_LONG) INT64_MIN )\n\t || ( long_value > (PY_LONG_LONG) INT64_MAX ) )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,\n\t\t \"%s: invalid long value out of bounds.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n#elif ( SIZEOF_LONG > 8 )\n\tif( ( long_value > (long) INT64_MIN )\n\t || ( long_value > (long) INT64_MAX ) )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,\n\t\t \"%s: invalid long value out of bounds.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n#endif\n\t*value_64bit = (int64_t) long_value;\n\n\treturn( 1 );\n}\n\n/* Copies a Python int or long object to an unsigned 64-bit value\n * Returns 1 if successful or -1 on error\n */\nint pyevtx_integer_unsigned_copy_to_64bit(\n PyObject *integer_object,\n uint64_t *value_64bit,\n libcerror_error_t **error )\n{\n\tstatic char *function = \"pyevtx_integer_unsigned_copy_to_64bit\";\n\tint result = 0;\n\n#if defined( HAVE_LONG_LONG )\n\tPY_LONG_LONG long_value = 0;\n#else\n\tlong long_value = 0;\n#endif\n\n\tif( integer_object == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid integer object.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tPyErr_Clear();\n\n\tresult = PyObject_IsInstance(\n\t integer_object,\n\t (PyObject *) &PyLong_Type );\n\n\tif( result == -1 )\n\t{\n\t\tpyevtx_error_fetch(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to determine if integer object is of type long.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\telse if( result != 0 )\n\t{\n\t\tPyErr_Clear();\n\n#if defined( HAVE_LONG_LONG )\n\t\tlong_value = PyLong_AsUnsignedLongLong(\n\t\t integer_object );\n#else\n\t\tlong_value = PyLong_AsUnsignedLong(\n\t\t integer_object );\n#endif\n\t}\n#if PY_MAJOR_VERSION < 3\n\tif( result == 0 )\n\t{\n\t\tPyErr_Clear();\n\n\t\tresult = PyObject_IsInstance(\n\t\t integer_object,\n\t\t (PyObject *) &PyInt_Type );\n\n\t\tif( result == -1 )\n\t\t{\n\t\t\tpyevtx_error_fetch(\n\t\t\t error,\n\t\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t\t \"%s: unable to determine if integer object is of type int.\",\n\t\t\t function );\n\n\t\t\treturn( -1 );\n\t\t}\n\t\telse if( result != 0 )\n\t\t{\n\t\t\tPyErr_Clear();\n\n#if defined( HAVE_LONG_LONG )\n\t\t\tlong_value = PyInt_AsUnsignedLongLongMask(\n\t\t\t\t integer_object );\n#else\n\t\t\tlong_value = PyInt_AsUnsignedLongMask(\n\t\t\t\t integer_object );\n#endif\n\t\t}\n\t}\n#endif /* PY_MAJOR_VERSION < 3 */\n\n\tif( result == 0 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unsupported integer object type.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( PyErr_Occurred() )\n\t{\n\t\tpyevtx_error_fetch(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_GET_FAILED,\n\t\t \"%s: unable to convert integer object to long.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n#if defined( HAVE_LONG_LONG )\n#if ( SIZEOF_LONG_LONG > 8 )\n\tif( ( long_value < (PY_LONG_LONG) 0 )\n\t || ( long_value > (PY_LONG_LONG) UINT64_MAX ) )\n#else\n\tif( long_value < (PY_LONG_LONG) 0 )\n#endif\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,\n\t\t \"%s: invalid long value out of bounds.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n#else\n#if ( SIZEOF_LONG > 8 )\n\tif( ( long_value < (long) 0 )\n\t || ( long_value > (long) UINT64_MAX ) )\n#else\n\tif( long_value < (PY_LONG_LONG) 0 )\n#endif\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,\n\t\t \"%s: invalid long value out of bounds.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n#endif\n\t*value_64bit = (uint64_t) long_value;\n\n\treturn( 1 );\n}\n\n" }, { "path": "pyevtx/pyevtx_integer.h", "content": "/*\n * Integer functions\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#if !defined( _PYEVTX_INTEGER_H )\n#define _PYEVTX_INTEGER_H\n\n#include \n#include \n\n#include \"pyevtx_libcerror.h\"\n#include \"pyevtx_python.h\"\n\n#if defined( __cplusplus )\nextern \"C\" {\n#endif\n\nPyObject *pyevtx_integer_signed_new_from_64bit(\n int64_t value_64bit );\n\nPyObject *pyevtx_integer_unsigned_new_from_64bit(\n uint64_t value_64bit );\n\nint pyevtx_integer_signed_copy_to_64bit(\n PyObject *integer_object,\n int64_t *value_64bit,\n libcerror_error_t **error );\n\nint pyevtx_integer_unsigned_copy_to_64bit(\n PyObject *integer_object,\n uint64_t *value_64bit,\n libcerror_error_t **error );\n\n#if defined( __cplusplus )\n}\n#endif\n\n#endif /* !defined( _PYEVTX_INTEGER_H ) */\n\n" }, { "path": "pyevtx/pyevtx_libbfio.h", "content": "/*\n * The libbfio header wrapper\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#if !defined( _PYEVTX_LIBBFIO_H )\n#define _PYEVTX_LIBBFIO_H\n\n#include \n\n/* Define HAVE_LOCAL_LIBBFIO for local use of libbfio\n */\n#if defined( HAVE_LOCAL_LIBBFIO )\n\n#include \n#include \n#include \n#include \n#include \n#include \n#include \n#include \n\n#else\n\n/* If libtool DLL support is enabled set LIBBFIO_DLL_IMPORT\n * before including libbfio.h\n */\n#if defined( _WIN32 ) && defined( DLL_IMPORT )\n#define LIBBFIO_DLL_IMPORT\n#endif\n\n#include \n\n#endif /* defined( HAVE_LOCAL_LIBBFIO ) */\n\n#endif /* !defined( _PYEVTX_LIBBFIO_H ) */\n\n" }, { "path": "pyevtx/pyevtx_libcerror.h", "content": "/*\n * The libcerror header wrapper\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#if !defined( _PYEVTX_LIBCERROR_H )\n#define _PYEVTX_LIBCERROR_H\n\n#include \n\n/* Define HAVE_LOCAL_LIBCERROR for local use of libcerror\n */\n#if defined( HAVE_LOCAL_LIBCERROR )\n\n#include \n#include \n#include \n#include \n\n#else\n\n/* If libtool DLL support is enabled set LIBCERROR_DLL_IMPORT\n * before including libcerror.h\n */\n#if defined( _WIN32 ) && defined( DLL_IMPORT )\n#define LIBCERROR_DLL_IMPORT\n#endif\n\n#include \n\n#endif /* defined( HAVE_LOCAL_LIBCERROR ) */\n\n#endif /* !defined( _PYEVTX_LIBCERROR_H ) */\n\n" }, { "path": "pyevtx/pyevtx_libclocale.h", "content": "/*\n * The libclocale header wrapper\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#if !defined( _PYEVTX_LIBCLOCALE_H )\n#define _PYEVTX_LIBCLOCALE_H\n\n#include \n\n/* Define HAVE_LOCAL_LIBCLOCALE for local use of libclocale\n */\n#if defined( HAVE_LOCAL_LIBCLOCALE )\n\n#include \n#include \n#include \n#include \n\n#else\n\n/* If libtool DLL support is enabled set LIBCLOCALE_DLL_IMPORT\n * before including libclocale.h\n */\n#if defined( _WIN32 ) && defined( DLL_IMPORT )\n#define LIBCLOCALE_DLL_IMPORT\n#endif\n\n#include \n\n#endif /* defined( HAVE_LOCAL_LIBCLOCALE ) */\n\n#endif /* !defined( _PYEVTX_LIBCLOCALE_H ) */\n\n" }, { "path": "pyevtx/pyevtx_libevtx.h", "content": "/*\n * The internal libevtx header\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#if !defined( _PYEVTX_LIBEVTX_H )\n#define _PYEVTX_LIBEVTX_H\n\n#include \n\n#include \n\n#endif /* !defined( _PYEVTX_LIBEVTX_H ) */\n\n" }, { "path": "pyevtx/pyevtx_libfwnt.h", "content": "/*\n * The libfwnt header wrapper\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#if !defined( _PYEVTX_LIBFWNT_H )\n#define _PYEVTX_LIBFWNT_H\n\n#include \n\n/* Define HAVE_LOCAL_LIBFWNT for local use of libfwnt\n */\n#if defined( HAVE_LOCAL_LIBFWNT )\n\n#include \n#include \n#include \n\n#else\n\n/* If libtool DLL support is enabled set LIBFWNT_DLL_IMPORT\n * before including libfwnt.h\n */\n#if defined( _WIN32 ) && defined( DLL_IMPORT )\n#define LIBFWNT_DLL_IMPORT\n#endif\n\n#include \n\n#endif\n\n#endif\n\n" }, { "path": "pyevtx/pyevtx_python.h", "content": "/*\n * The python header wrapper\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#if !defined( _PYEVTX_PYTHON_H )\n#define _PYEVTX_PYTHON_H\n\n#include \n\n#if PY_MAJOR_VERSION < 3\n\n/* Fix defines in pyconfig.h\n */\n#undef _POSIX_C_SOURCE\n#undef _XOPEN_SOURCE\n\n/* Fix defines in pyport.h\n */\n#undef HAVE_FSTAT\n#undef HAVE_STAT\n#undef HAVE_SSIZE_T\n#undef HAVE_INT32_T\n#undef HAVE_UINT32_T\n#undef HAVE_INT64_T\n#undef HAVE_UINT64_T\n\n#endif /* PY_MAJOR_VERSION < 3 */\n\n/* Define PY_SSIZE_T_CLEAN to silence:\n * DeprecationWarning: PY_SSIZE_T_CLEAN will be required for '#' formats\n *\n * PY_SSIZE_T_CLEAN was introduced in Python 2.5\n */\n#define PY_SSIZE_T_CLEAN\n\n#include \n\n/* Python compatibility macros\n */\n#if !defined( PyMODINIT_FUNC )\n#if PY_MAJOR_VERSION >= 3\n#define PyMODINIT_FUNC PyObject *\n#else\n#define PyMODINIT_FUNC void\n#endif\n#endif /* !defined( PyMODINIT_FUNC ) */\n\n#if !defined( PyVarObject_HEAD_INIT )\n#define PyVarObject_HEAD_INIT( type, size ) \\\n\tPyObject_HEAD_INIT( type ) \\\n\tsize,\n\n#endif /* !defined( PyVarObject_HEAD_INIT ) */\n\n#if PY_MAJOR_VERSION >= 3\n#define Py_TPFLAGS_HAVE_ITER\t\t0\n#endif\n\n#if !defined( Py_TYPE )\n#define Py_TYPE( object ) \\\n\t( ( (PyObject *) object )->ob_type )\n\n#endif /* !defined( Py_TYPE ) */\n\n#endif /* !defined( _PYEVTX_PYTHON_H ) */\n\n" }, { "path": "pyevtx/pyevtx_record.c", "content": "/*\n * Python object wrapper of libevtx_record_t\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#include \n#include \n\n#if defined( HAVE_STDLIB_H ) || defined( HAVE_WINAPI )\n#include \n#endif\n\n#include \"pyevtx_datetime.h\"\n#include \"pyevtx_error.h\"\n#include \"pyevtx_integer.h\"\n#include \"pyevtx_libcerror.h\"\n#include \"pyevtx_libevtx.h\"\n#include \"pyevtx_python.h\"\n#include \"pyevtx_record.h\"\n#include \"pyevtx_strings.h\"\n#include \"pyevtx_unused.h\"\n\nPyMethodDef pyevtx_record_object_methods[] = {\n\n\t{ \"get_offset\",\n\t (PyCFunction) pyevtx_record_get_offset,\n\t METH_NOARGS,\n\t \"get_offset() -> Integer or None\\n\"\n\t \"\\n\"\n\t \"Retrieves the offset.\" },\n\n\t{ \"get_identifier\",\n\t (PyCFunction) pyevtx_record_get_identifier,\n\t METH_NOARGS,\n\t \"get_identifier() -> Integer or None\\n\"\n\t \"\\n\"\n\t \"Retrieves the identifier.\" },\n\n\t{ \"get_creation_time\",\n\t (PyCFunction) pyevtx_record_get_creation_time,\n\t METH_NOARGS,\n\t \"get_creation_time() -> Datetime or None\\n\"\n\t \"\\n\"\n\t \"Retrieves the creation time.\" },\n\n\t{ \"get_creation_time_as_integer\",\n\t (PyCFunction) pyevtx_record_get_creation_time_as_integer,\n\t METH_NOARGS,\n\t \"get_creation_time_as_integer() -> Integer or None\\n\"\n\t \"\\n\"\n\t \"Retrieves the creation time as a 64-bit integer containing a FILETIME value.\" },\n\n\t{ \"get_written_time\",\n\t (PyCFunction) pyevtx_record_get_written_time,\n\t METH_NOARGS,\n\t \"get_written_time() -> Datetime or None\\n\"\n\t \"\\n\"\n\t \"Retrieves the written time.\" },\n\n\t{ \"get_written_time_as_integer\",\n\t (PyCFunction) pyevtx_record_get_written_time_as_integer,\n\t METH_NOARGS,\n\t \"get_written_time_as_integer() -> Integer or None\\n\"\n\t \"\\n\"\n\t \"Retrieves the written time as a 64-bit integer containing a FILETIME value.\" },\n\n\t{ \"get_event_identifier\",\n\t (PyCFunction) pyevtx_record_get_event_identifier,\n\t METH_NOARGS,\n\t \"get_event_identifier() -> Integer\\n\"\n\t \"\\n\"\n\t \"Retrieves the event identifier.\" },\n\n\t{ \"get_event_identifier_qualifiers\",\n\t (PyCFunction) pyevtx_record_get_event_identifier_qualifiers,\n\t METH_NOARGS,\n\t \"get_event_identifier_qualifiers() -> Integer or None\\n\"\n\t \"\\n\"\n\t \"Retrieves the event identifier qualifiers.\" },\n\n\t{ \"get_event_version\",\n\t (PyCFunction) pyevtx_record_get_event_version,\n\t METH_NOARGS,\n\t \"get_event_version() -> Integer or None\\n\"\n\t \"\\n\"\n\t \"Retrieves the event version.\" },\n\n\t{ \"get_event_level\",\n\t (PyCFunction) pyevtx_record_get_event_level,\n\t METH_NOARGS,\n\t \"get_event_level() -> Integer\\n\"\n\t \"\\n\"\n\t \"Retrieves the event level.\" },\n\n\t{ \"get_provider_identifier\",\n\t (PyCFunction) pyevtx_record_get_provider_identifier,\n\t METH_NOARGS,\n\t \"get_provider_identifier() -> Unicode string or None\\n\"\n\t \"\\n\"\n\t \"Retrieves the provider identifier.\" },\n\n\t{ \"get_source_name\",\n\t (PyCFunction) pyevtx_record_get_source_name,\n\t METH_NOARGS,\n\t \"get_source_name() -> Unicode string or None\\n\"\n\t \"\\n\"\n\t \"Retrieves the source name.\" },\n\n\t{ \"get_channel_name\",\n\t (PyCFunction) pyevtx_record_get_channel_name,\n\t METH_NOARGS,\n\t \"get_channel_name() -> Unicode string or None\\n\"\n\t \"\\n\"\n\t \"Retrieves the channel name.\" },\n\n\t{ \"get_computer_name\",\n\t (PyCFunction) pyevtx_record_get_computer_name,\n\t METH_NOARGS,\n\t \"get_computer_name() -> Unicode string or None\\n\"\n\t \"\\n\"\n\t \"Retrieves the computer name.\" },\n\n\t{ \"get_user_security_identifier\",\n\t (PyCFunction) pyevtx_record_get_user_security_identifier,\n\t METH_NOARGS,\n\t \"get_user_security_identifier() -> Unicode string or None\\n\"\n\t \"\\n\"\n\t \"Retrieves the user security identifier.\" },\n\n\t{ \"get_number_of_strings\",\n\t (PyCFunction) pyevtx_record_get_number_of_strings,\n\t METH_NOARGS,\n\t \"get_number_of_strings() -> Integer\\n\"\n\t \"\\n\"\n\t \"Retrieves the number of strings.\" },\n\n\t{ \"get_string\",\n\t (PyCFunction) pyevtx_record_get_string,\n\t METH_VARARGS | METH_KEYWORDS,\n\t \"get_string(string_index) -> Unicode string or None\\n\"\n\t \"\\n\"\n\t \"Retrieves the string specified by the index.\" },\n\n\t{ \"get_data\",\n\t (PyCFunction) pyevtx_record_get_data,\n\t METH_NOARGS,\n\t \"get_data()-> Bytes or None\\n\"\n\t \"\\n\"\n\t \"Retrieves the data.\" },\n\n\t{ \"get_xml_string\",\n\t (PyCFunction) pyevtx_record_get_xml_string,\n\t METH_NOARGS,\n\t \"get_xml_string() -> Unicode string or None\\n\"\n\t \"\\n\"\n\t \"Retrieves the XML string.\" },\n\n\t/* Sentinel */\n\t{ NULL, NULL, 0, NULL }\n};\n\nPyGetSetDef pyevtx_record_object_get_set_definitions[] = {\n\n\t{ \"offset\",\n\t (getter) pyevtx_record_get_offset,\n\t (setter) 0,\n\t \"The offset.\",\n\t NULL },\n\n\t{ \"identifier\",\n\t (getter) pyevtx_record_get_identifier,\n\t (setter) 0,\n\t \"The identifier.\",\n\t NULL },\n\n\t{ \"creation_time\",\n\t (getter) pyevtx_record_get_creation_time,\n\t (setter) 0,\n\t \"The creation time.\",\n\t NULL },\n\n\t{ \"written_time\",\n\t (getter) pyevtx_record_get_written_time,\n\t (setter) 0,\n\t \"The written time.\",\n\t NULL },\n\n\t{ \"event_identifier\",\n\t (getter) pyevtx_record_get_event_identifier,\n\t (setter) 0,\n\t \"The event identifier.\",\n\t NULL },\n\n\t{ \"event_identifier_qualifiers\",\n\t (getter) pyevtx_record_get_event_identifier_qualifiers,\n\t (setter) 0,\n\t \"The event identifier qualifiers.\",\n\t NULL },\n\n\t{ \"event_version\",\n\t (getter) pyevtx_record_get_event_version,\n\t (setter) 0,\n\t \"The event version.\",\n\t NULL },\n\n\t{ \"event_level\",\n\t (getter) pyevtx_record_get_event_level,\n\t (setter) 0,\n\t \"The event level.\",\n\t NULL },\n\n\t{ \"provider_identifier\",\n\t (getter) pyevtx_record_get_provider_identifier,\n\t (setter) 0,\n\t \"The provider identifier.\",\n\t NULL },\n\n\t{ \"source_name\",\n\t (getter) pyevtx_record_get_source_name,\n\t (setter) 0,\n\t \"The source name.\",\n\t NULL },\n\n\t{ \"channel_name\",\n\t (getter) pyevtx_record_get_channel_name,\n\t (setter) 0,\n\t \"The channel name.\",\n\t NULL },\n\n\t{ \"computer_name\",\n\t (getter) pyevtx_record_get_computer_name,\n\t (setter) 0,\n\t \"The computer name.\",\n\t NULL },\n\n\t{ \"user_security_identifier\",\n\t (getter) pyevtx_record_get_user_security_identifier,\n\t (setter) 0,\n\t \"The user security identifier.\",\n\t NULL },\n\n\t{ \"number_of_strings\",\n\t (getter) pyevtx_record_get_number_of_strings,\n\t (setter) 0,\n\t \"The number of strings.\",\n\t NULL },\n\n\t{ \"strings\",\n\t (getter) pyevtx_record_get_strings,\n\t (setter) 0,\n\t \"The strings.\",\n\t NULL },\n\n\t{ \"data\",\n\t (getter) pyevtx_record_get_data,\n\t (setter) 0,\n\t \"The data.\",\n\t NULL },\n\n\t{ \"xml_string\",\n\t (getter) pyevtx_record_get_xml_string,\n\t (setter) 0,\n\t \"The XML string.\",\n\t NULL },\n\n\t/* Sentinel */\n\t{ NULL, NULL, NULL, NULL, NULL }\n};\n\nPyTypeObject pyevtx_record_type_object = {\n\tPyVarObject_HEAD_INIT( NULL, 0 )\n\n\t/* tp_name */\n\t\"pyevtx.record\",\n\t/* tp_basicsize */\n\tsizeof( pyevtx_record_t ),\n\t/* tp_itemsize */\n\t0,\n\t/* tp_dealloc */\n\t(destructor) pyevtx_record_free,\n\t/* tp_print */\n\t0,\n\t/* tp_getattr */\n\t0,\n\t/* tp_setattr */\n\t0,\n\t/* tp_compare */\n\t0,\n\t/* tp_repr */\n\t0,\n\t/* tp_as_number */\n\t0,\n\t/* tp_as_sequence */\n\t0,\n\t/* tp_as_mapping */\n\t0,\n\t/* tp_hash */\n\t0,\n\t/* tp_call */\n\t0,\n\t/* tp_str */\n\t0,\n\t/* tp_getattro */\n\t0,\n\t/* tp_setattro */\n\t0,\n\t/* tp_as_buffer */\n\t0,\n\t/* tp_flags */\n\tPy_TPFLAGS_DEFAULT,\n\t/* tp_doc */\n\t\"pyevtx record object (wraps libevtx_record_t)\",\n\t/* tp_traverse */\n\t0,\n\t/* tp_clear */\n\t0,\n\t/* tp_richcompare */\n\t0,\n\t/* tp_weaklistoffset */\n\t0,\n\t/* tp_iter */\n\t0,\n\t/* tp_iternext */\n\t0,\n\t/* tp_methods */\n\tpyevtx_record_object_methods,\n\t/* tp_members */\n\t0,\n\t/* tp_getset */\n\tpyevtx_record_object_get_set_definitions,\n\t/* tp_base */\n\t0,\n\t/* tp_dict */\n\t0,\n\t/* tp_descr_get */\n\t0,\n\t/* tp_descr_set */\n\t0,\n\t/* tp_dictoffset */\n\t0,\n\t/* tp_init */\n\t(initproc) pyevtx_record_init,\n\t/* tp_alloc */\n\t0,\n\t/* tp_new */\n\t0,\n\t/* tp_free */\n\t0,\n\t/* tp_is_gc */\n\t0,\n\t/* tp_bases */\n\tNULL,\n\t/* tp_mro */\n\tNULL,\n\t/* tp_cache */\n\tNULL,\n\t/* tp_subclasses */\n\tNULL,\n\t/* tp_weaklist */\n\tNULL,\n\t/* tp_del */\n\t0\n};\n\n/* Creates a new record object\n * Returns a Python object if successful or NULL on error\n */\nPyObject *pyevtx_record_new(\n libevtx_record_t *record,\n PyObject *parent_object )\n{\n\tpyevtx_record_t *pyevtx_record = NULL;\n\tstatic char *function = \"pyevtx_record_new\";\n\n\tif( record == NULL )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_ValueError,\n\t\t \"%s: invalid record.\",\n\t\t function );\n\n\t\treturn( NULL );\n\t}\n\tpyevtx_record = PyObject_New(\n\t struct pyevtx_record,\n\t &pyevtx_record_type_object );\n\n\tif( pyevtx_record == NULL )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_MemoryError,\n\t\t \"%s: unable to initialize record.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tif( pyevtx_record_init(\n\t pyevtx_record ) != 0 )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_MemoryError,\n\t\t \"%s: unable to initialize record.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tpyevtx_record->record = record;\n\tpyevtx_record->parent_object = parent_object;\n\n\tPy_IncRef(\n\t (PyObject *) pyevtx_record->parent_object );\n\n\treturn( (PyObject *) pyevtx_record );\n\non_error:\n\tif( pyevtx_record != NULL )\n\t{\n\t\tPy_DecRef(\n\t\t (PyObject *) pyevtx_record );\n\t}\n\treturn( NULL );\n}\n\n/* Initializes a record object\n * Returns 0 if successful or -1 on error\n */\nint pyevtx_record_init(\n pyevtx_record_t *pyevtx_record )\n{\n\tstatic char *function = \"pyevtx_record_init\";\n\n\tif( pyevtx_record == NULL )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_ValueError,\n\t\t \"%s: invalid record.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\t/* Make sure libevtx record is set to NULL\n\t */\n\tpyevtx_record->record = NULL;\n\n\treturn( 0 );\n}\n\n/* Frees a record object\n */\nvoid pyevtx_record_free(\n pyevtx_record_t *pyevtx_record )\n{\n\tstruct _typeobject *ob_type = NULL;\n\tlibcerror_error_t *error = NULL;\n\tstatic char *function = \"pyevtx_record_free\";\n\tint result = 0;\n\n\tif( pyevtx_record == NULL )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_ValueError,\n\t\t \"%s: invalid record.\",\n\t\t function );\n\n\t\treturn;\n\t}\n\tif( pyevtx_record->record == NULL )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_ValueError,\n\t\t \"%s: invalid record - missing libevtx record.\",\n\t\t function );\n\n\t\treturn;\n\t}\n\tob_type = Py_TYPE(\n\t pyevtx_record );\n\n\tif( ob_type == NULL )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_ValueError,\n\t\t \"%s: missing ob_type.\",\n\t\t function );\n\n\t\treturn;\n\t}\n\tif( ob_type->tp_free == NULL )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_ValueError,\n\t\t \"%s: invalid ob_type - missing tp_free.\",\n\t\t function );\n\n\t\treturn;\n\t}\n\tPy_BEGIN_ALLOW_THREADS\n\n\tresult = libevtx_record_free(\n\t &( pyevtx_record->record ),\n\t &error );\n\n\tPy_END_ALLOW_THREADS\n\n\tif( result != 1 )\n\t{\n\t\tpyevtx_error_raise(\n\t\t error,\n\t\t PyExc_IOError,\n\t\t \"%s: unable to free libevtx record.\",\n\t\t function );\n\n\t\tlibcerror_error_free(\n\t\t &error );\n\t}\n\tif( pyevtx_record->parent_object != NULL )\n\t{\n\t\tPy_DecRef(\n\t\t (PyObject *) pyevtx_record->parent_object );\n\t}\n\tob_type->tp_free(\n\t (PyObject*) pyevtx_record );\n}\n\n/* Retrieves the offset\n * Returns a Python object if successful or NULL on error\n */\nPyObject *pyevtx_record_get_offset(\n pyevtx_record_t *pyevtx_record,\n PyObject *arguments PYEVTX_ATTRIBUTE_UNUSED )\n{\n\tPyObject *integer_object = NULL;\n\tlibcerror_error_t *error = NULL;\n\tstatic char *function = \"pyevtx_record_get_offset\";\n\toff64_t offset = 0;\n\tint result = 0;\n\n\tPYEVTX_UNREFERENCED_PARAMETER( arguments )\n\n\tif( pyevtx_record == NULL )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_ValueError,\n\t\t \"%s: invalid record.\",\n\t\t function );\n\n\t\treturn( NULL );\n\t}\n\tPy_BEGIN_ALLOW_THREADS\n\n\tresult = libevtx_record_get_offset(\n\t pyevtx_record->record,\n\t &offset,\n\t &error );\n\n\tPy_END_ALLOW_THREADS\n\n\tif( result == -1 )\n\t{\n\t\tpyevtx_error_raise(\n\t\t error,\n\t\t PyExc_IOError,\n\t\t \"%s: unable to retrieve offset.\",\n\t\t function );\n\n\t\tlibcerror_error_free(\n\t\t &error );\n\n\t\treturn( NULL );\n\t}\n\telse if( result == 0 )\n\t{\n\t\tPy_IncRef(\n\t\t Py_None );\n\n\t\treturn( Py_None );\n\t}\n\tinteger_object = pyevtx_integer_signed_new_from_64bit(\n\t (int64_t) offset );\n\n\treturn( integer_object );\n}\n\n/* Retrieves the identifier\n * Returns a Python object if successful or NULL on error\n */\nPyObject *pyevtx_record_get_identifier(\n pyevtx_record_t *pyevtx_record,\n PyObject *arguments PYEVTX_ATTRIBUTE_UNUSED )\n{\n\tPyObject *integer_object = NULL;\n\tlibcerror_error_t *error = NULL;\n\tstatic char *function = \"pyevtx_record_get_identifier\";\n\tuint64_t value_64bit = 0;\n\tint result = 0;\n\n\tPYEVTX_UNREFERENCED_PARAMETER( arguments )\n\n\tif( pyevtx_record == NULL )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_ValueError,\n\t\t \"%s: invalid record.\",\n\t\t function );\n\n\t\treturn( NULL );\n\t}\n\tPy_BEGIN_ALLOW_THREADS\n\n\tresult = libevtx_record_get_identifier(\n\t pyevtx_record->record,\n\t &value_64bit,\n\t &error );\n\n\tPy_END_ALLOW_THREADS\n\n\tif( result != 1 )\n\t{\n\t\tpyevtx_error_raise(\n\t\t error,\n\t\t PyExc_IOError,\n\t\t \"%s: unable to retrieve identifier.\",\n\t\t function );\n\n\t\tlibcerror_error_free(\n\t\t &error );\n\n\t\treturn( NULL );\n\t}\n\tinteger_object = pyevtx_integer_unsigned_new_from_64bit(\n\t (uint64_t) value_64bit );\n\n\treturn( integer_object );\n}\n\n/* Retrieves the creation time\n * Returns a Python object if successful or NULL on error\n */\nPyObject *pyevtx_record_get_creation_time(\n pyevtx_record_t *pyevtx_record,\n PyObject *arguments PYEVTX_ATTRIBUTE_UNUSED )\n{\n\tPyObject *datetime_object = NULL;\n\tlibcerror_error_t *error = NULL;\n\tstatic char *function = \"pyevtx_record_get_creation_time\";\n\tuint64_t filetime = 0;\n\tint result = 0;\n\n\tPYEVTX_UNREFERENCED_PARAMETER( arguments )\n\n\tif( pyevtx_record == NULL )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_ValueError,\n\t\t \"%s: invalid record.\",\n\t\t function );\n\n\t\treturn( NULL );\n\t}\n\tPy_BEGIN_ALLOW_THREADS\n\n\tresult = libevtx_record_get_creation_time(\n\t pyevtx_record->record,\n\t &filetime,\n\t &error );\n\n\tPy_END_ALLOW_THREADS\n\n\tif( result == -1 )\n\t{\n\t\tpyevtx_error_raise(\n\t\t error,\n\t\t PyExc_IOError,\n\t\t \"%s: unable to retrieve creation time.\",\n\t\t function );\n\n\t\tlibcerror_error_free(\n\t\t &error );\n\n\t\treturn( NULL );\n\t}\n\telse if( result == 0 )\n\t{\n\t\tPy_IncRef(\n\t\t Py_None );\n\n\t\treturn( Py_None );\n\t}\n\tdatetime_object = pyevtx_datetime_new_from_filetime(\n\t filetime );\n\n\treturn( datetime_object );\n}\n\n/* Retrieves the creation time as an integer\n * Returns a Python object if successful or NULL on error\n */\nPyObject *pyevtx_record_get_creation_time_as_integer(\n pyevtx_record_t *pyevtx_record,\n PyObject *arguments PYEVTX_ATTRIBUTE_UNUSED )\n{\n\tPyObject *integer_object = NULL;\n\tlibcerror_error_t *error = NULL;\n\tstatic char *function = \"pyevtx_record_get_creation_time_as_integer\";\n\tuint64_t filetime = 0;\n\tint result = 0;\n\n\tPYEVTX_UNREFERENCED_PARAMETER( arguments )\n\n\tif( pyevtx_record == NULL )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_ValueError,\n\t\t \"%s: invalid record.\",\n\t\t function );\n\n\t\treturn( NULL );\n\t}\n\tPy_BEGIN_ALLOW_THREADS\n\n\tresult = libevtx_record_get_creation_time(\n\t pyevtx_record->record,\n\t &filetime,\n\t &error );\n\n\tPy_END_ALLOW_THREADS\n\n\tif( result == -1 )\n\t{\n\t\tpyevtx_error_raise(\n\t\t error,\n\t\t PyExc_IOError,\n\t\t \"%s: unable to retrieve creation time.\",\n\t\t function );\n\n\t\tlibcerror_error_free(\n\t\t &error );\n\n\t\treturn( NULL );\n\t}\n\telse if( result == 0 )\n\t{\n\t\tPy_IncRef(\n\t\t Py_None );\n\n\t\treturn( Py_None );\n\t}\n\tinteger_object = pyevtx_integer_unsigned_new_from_64bit(\n\t (uint64_t) filetime );\n\n\treturn( integer_object );\n}\n\n/* Retrieves the written time\n * Returns a Python object if successful or NULL on error\n */\nPyObject *pyevtx_record_get_written_time(\n pyevtx_record_t *pyevtx_record,\n PyObject *arguments PYEVTX_ATTRIBUTE_UNUSED )\n{\n\tPyObject *datetime_object = NULL;\n\tlibcerror_error_t *error = NULL;\n\tstatic char *function = \"pyevtx_record_get_written_time\";\n\tuint64_t filetime = 0;\n\tint result = 0;\n\n\tPYEVTX_UNREFERENCED_PARAMETER( arguments )\n\n\tif( pyevtx_record == NULL )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_ValueError,\n\t\t \"%s: invalid record.\",\n\t\t function );\n\n\t\treturn( NULL );\n\t}\n\tPy_BEGIN_ALLOW_THREADS\n\n\tresult = libevtx_record_get_written_time(\n\t pyevtx_record->record,\n\t &filetime,\n\t &error );\n\n\tPy_END_ALLOW_THREADS\n\n\tif( result == -1 )\n\t{\n\t\tpyevtx_error_raise(\n\t\t error,\n\t\t PyExc_IOError,\n\t\t \"%s: unable to retrieve written time.\",\n\t\t function );\n\n\t\tlibcerror_error_free(\n\t\t &error );\n\n\t\treturn( NULL );\n\t}\n\telse if( result == 0 )\n\t{\n\t\tPy_IncRef(\n\t\t Py_None );\n\n\t\treturn( Py_None );\n\t}\n\tdatetime_object = pyevtx_datetime_new_from_filetime(\n\t filetime );\n\n\treturn( datetime_object );\n}\n\n/* Retrieves the written time as an integer\n * Returns a Python object if successful or NULL on error\n */\nPyObject *pyevtx_record_get_written_time_as_integer(\n pyevtx_record_t *pyevtx_record,\n PyObject *arguments PYEVTX_ATTRIBUTE_UNUSED )\n{\n\tPyObject *integer_object = NULL;\n\tlibcerror_error_t *error = NULL;\n\tstatic char *function = \"pyevtx_record_get_written_time_as_integer\";\n\tuint64_t filetime = 0;\n\tint result = 0;\n\n\tPYEVTX_UNREFERENCED_PARAMETER( arguments )\n\n\tif( pyevtx_record == NULL )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_ValueError,\n\t\t \"%s: invalid record.\",\n\t\t function );\n\n\t\treturn( NULL );\n\t}\n\tPy_BEGIN_ALLOW_THREADS\n\n\tresult = libevtx_record_get_written_time(\n\t pyevtx_record->record,\n\t &filetime,\n\t &error );\n\n\tPy_END_ALLOW_THREADS\n\n\tif( result == -1 )\n\t{\n\t\tpyevtx_error_raise(\n\t\t error,\n\t\t PyExc_IOError,\n\t\t \"%s: unable to retrieve written time.\",\n\t\t function );\n\n\t\tlibcerror_error_free(\n\t\t &error );\n\n\t\treturn( NULL );\n\t}\n\telse if( result == 0 )\n\t{\n\t\tPy_IncRef(\n\t\t Py_None );\n\n\t\treturn( Py_None );\n\t}\n\tinteger_object = pyevtx_integer_unsigned_new_from_64bit(\n\t (uint64_t) filetime );\n\n\treturn( integer_object );\n}\n\n/* Retrieves the event identifier\n * Returns a Python object if successful or NULL on error\n */\nPyObject *pyevtx_record_get_event_identifier(\n pyevtx_record_t *pyevtx_record,\n PyObject *arguments PYEVTX_ATTRIBUTE_UNUSED )\n{\n\tPyObject *integer_object = NULL;\n\tlibcerror_error_t *error = NULL;\n\tstatic char *function = \"pyevtx_record_get_event_identifier\";\n\tuint32_t value_32bit = 0;\n\tint result = 0;\n\n\tPYEVTX_UNREFERENCED_PARAMETER( arguments )\n\n\tif( pyevtx_record == NULL )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_ValueError,\n\t\t \"%s: invalid record.\",\n\t\t function );\n\n\t\treturn( NULL );\n\t}\n\tPy_BEGIN_ALLOW_THREADS\n\n\tresult = libevtx_record_get_event_identifier(\n\t pyevtx_record->record,\n\t &value_32bit,\n\t &error );\n\n\tPy_END_ALLOW_THREADS\n\n\tif( result != 1 )\n\t{\n\t\tpyevtx_error_raise(\n\t\t error,\n\t\t PyExc_IOError,\n\t\t \"%s: unable to retrieve event identifier.\",\n\t\t function );\n\n\t\tlibcerror_error_free(\n\t\t &error );\n\n\t\treturn( NULL );\n\t}\n\tinteger_object = PyLong_FromUnsignedLong(\n\t (unsigned long) value_32bit );\n\n\treturn( integer_object );\n}\n\n/* Retrieves the event identifier qualifiers\n * Returns a Python object if successful or NULL on error\n */\nPyObject *pyevtx_record_get_event_identifier_qualifiers(\n pyevtx_record_t *pyevtx_record,\n PyObject *arguments PYEVTX_ATTRIBUTE_UNUSED )\n{\n\tPyObject *integer_object = NULL;\n\tlibcerror_error_t *error = NULL;\n\tstatic char *function = \"pyevtx_record_get_event_identifier_qualifiers\";\n\tuint32_t value_32bit = 0;\n\tint result = 0;\n\n\tPYEVTX_UNREFERENCED_PARAMETER( arguments )\n\n\tif( pyevtx_record == NULL )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_ValueError,\n\t\t \"%s: invalid record.\",\n\t\t function );\n\n\t\treturn( NULL );\n\t}\n\tPy_BEGIN_ALLOW_THREADS\n\n\tresult = libevtx_record_get_event_identifier_qualifiers(\n\t pyevtx_record->record,\n\t &value_32bit,\n\t &error );\n\n\tPy_END_ALLOW_THREADS\n\n\tif( result == -1 )\n\t{\n\t\tpyevtx_error_raise(\n\t\t error,\n\t\t PyExc_IOError,\n\t\t \"%s: unable to retrieve event identifier qualifiers.\",\n\t\t function );\n\n\t\tlibcerror_error_free(\n\t\t &error );\n\n\t\treturn( NULL );\n\t}\n\telse if( result == 0 )\n\t{\n\t\tPy_IncRef(\n\t\t Py_None );\n\n\t\treturn( Py_None );\n\t}\n\tinteger_object = PyLong_FromUnsignedLong(\n\t (unsigned long) value_32bit );\n\n\treturn( integer_object );\n}\n\n/* Retrieves the event version\n * Returns a Python object if successful or NULL on error\n */\nPyObject *pyevtx_record_get_event_version(\n pyevtx_record_t *pyevtx_record,\n PyObject *arguments PYEVTX_ATTRIBUTE_UNUSED )\n{\n\tPyObject *integer_object = NULL;\n\tlibcerror_error_t *error = NULL;\n\tstatic char *function = \"pyevtx_record_get_event_version\";\n\tuint8_t event_version = 0;\n\tint result = 0;\n\n\tPYEVTX_UNREFERENCED_PARAMETER( arguments )\n\n\tif( pyevtx_record == NULL )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_ValueError,\n\t\t \"%s: invalid record.\",\n\t\t function );\n\n\t\treturn( NULL );\n\t}\n\tPy_BEGIN_ALLOW_THREADS\n\n\tresult = libevtx_record_get_event_version(\n\t pyevtx_record->record,\n\t &event_version,\n\t &error );\n\n\tPy_END_ALLOW_THREADS\n\n\tif( result == -1 )\n\t{\n\t\tpyevtx_error_raise(\n\t\t error,\n\t\t PyExc_IOError,\n\t\t \"%s: unable to retrieve event version.\",\n\t\t function );\n\n\t\tlibcerror_error_free(\n\t\t &error );\n\n\t\treturn( NULL );\n\t}\n\telse if( result == 0 )\n\t{\n\t\tPy_IncRef(\n\t\t Py_None );\n\n\t\treturn( Py_None );\n\t}\n#if PY_MAJOR_VERSION >= 3\n\tinteger_object = PyLong_FromLong(\n\t (long) event_version );\n#else\n\tinteger_object = PyInt_FromLong(\n\t (long) event_version );\n#endif\n\treturn( integer_object );\n}\n\n/* Retrieves the event level\n * Returns a Python object if successful or NULL on error\n */\nPyObject *pyevtx_record_get_event_level(\n pyevtx_record_t *pyevtx_record,\n PyObject *arguments PYEVTX_ATTRIBUTE_UNUSED )\n{\n\tPyObject *integer_object = NULL;\n\tlibcerror_error_t *error = NULL;\n\tstatic char *function = \"pyevtx_record_get_event_level\";\n\tuint8_t event_level = 0;\n\tint result = 0;\n\n\tPYEVTX_UNREFERENCED_PARAMETER( arguments )\n\n\tif( pyevtx_record == NULL )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_ValueError,\n\t\t \"%s: invalid record.\",\n\t\t function );\n\n\t\treturn( NULL );\n\t}\n\tPy_BEGIN_ALLOW_THREADS\n\n\tresult = libevtx_record_get_event_level(\n\t pyevtx_record->record,\n\t &event_level,\n\t &error );\n\n\tPy_END_ALLOW_THREADS\n\n\tif( result != 1 )\n\t{\n\t\tpyevtx_error_raise(\n\t\t error,\n\t\t PyExc_IOError,\n\t\t \"%s: unable to retrieve event level.\",\n\t\t function );\n\n\t\tlibcerror_error_free(\n\t\t &error );\n\n\t\treturn( NULL );\n\t}\n#if PY_MAJOR_VERSION >= 3\n\tinteger_object = PyLong_FromLong(\n\t (long) event_level );\n#else\n\tinteger_object = PyInt_FromLong(\n\t (long) event_level );\n#endif\n\treturn( integer_object );\n}\n\n/* Retrieves the provider identifier\n * Returns a Python object if successful or NULL on error\n */\nPyObject *pyevtx_record_get_provider_identifier(\n pyevtx_record_t *pyevtx_record,\n PyObject *arguments PYEVTX_ATTRIBUTE_UNUSED )\n{\n\tPyObject *string_object = NULL;\n\tlibcerror_error_t *error = NULL;\n\tstatic char *function = \"pyevtx_record_get_provider_identifier\";\n\tchar *utf8_string = NULL;\n\tsize_t utf8_string_size = 0;\n\tint result = 0;\n\n\tPYEVTX_UNREFERENCED_PARAMETER( arguments )\n\n\tif( pyevtx_record == NULL )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_ValueError,\n\t\t \"%s: invalid record.\",\n\t\t function );\n\n\t\treturn( NULL );\n\t}\n\tPy_BEGIN_ALLOW_THREADS\n\n\tresult = libevtx_record_get_utf8_provider_identifier_size(\n\t pyevtx_record->record,\n\t &utf8_string_size,\n\t &error );\n\n\tPy_END_ALLOW_THREADS\n\n\tif( result == -1 )\n\t{\n\t\tpyevtx_error_raise(\n\t\t error,\n\t\t PyExc_IOError,\n\t\t \"%s: unable to determine size of provider identifier as UTF-8 string.\",\n\t\t function );\n\n\t\tlibcerror_error_free(\n\t\t &error );\n\n\t\tgoto on_error;\n\t}\n\telse if( ( result == 0 )\n\t || ( utf8_string_size == 0 ) )\n\t{\n\t\tPy_IncRef(\n\t\t Py_None );\n\n\t\treturn( Py_None );\n\t}\n\tutf8_string = (char *) PyMem_Malloc(\n\t sizeof( char ) * utf8_string_size );\n\n\tif( utf8_string == NULL )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_MemoryError,\n\t\t \"%s: unable to create UTF-8 string.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tPy_BEGIN_ALLOW_THREADS\n\n\tresult = libevtx_record_get_utf8_provider_identifier(\n\t pyevtx_record->record,\n\t (uint8_t *) utf8_string,\n\t utf8_string_size,\n\t &error );\n\n\tPy_END_ALLOW_THREADS\n\n\tif( result != 1 )\n\t{\n\t\tpyevtx_error_raise(\n\t\t error,\n\t\t PyExc_IOError,\n\t\t \"%s: unable to retrieve provider identifier as UTF-8 string.\",\n\t\t function );\n\n\t\tlibcerror_error_free(\n\t\t &error );\n\n\t\tgoto on_error;\n\t}\n\t/* Pass the string length to PyUnicode_DecodeUTF8 otherwise it makes\n\t * the end of string character is part of the string\n\t */\n\tstring_object = PyUnicode_DecodeUTF8(\n\t utf8_string,\n\t (Py_ssize_t) utf8_string_size - 1,\n\t NULL );\n\n\tif( string_object == NULL )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_IOError,\n\t\t \"%s: unable to convert UTF-8 string into Unicode object.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tPyMem_Free(\n\t utf8_string );\n\n\treturn( string_object );\n\non_error:\n\tif( utf8_string != NULL )\n\t{\n\t\tPyMem_Free(\n\t\t utf8_string );\n\t}\n\treturn( NULL );\n}\n\n/* Retrieves the source name\n * Returns a Python object if successful or NULL on error\n */\nPyObject *pyevtx_record_get_source_name(\n pyevtx_record_t *pyevtx_record,\n PyObject *arguments PYEVTX_ATTRIBUTE_UNUSED )\n{\n\tPyObject *string_object = NULL;\n\tlibcerror_error_t *error = NULL;\n\tstatic char *function = \"pyevtx_record_get_source_name\";\n\tchar *utf8_string = NULL;\n\tsize_t utf8_string_size = 0;\n\tint result = 0;\n\n\tPYEVTX_UNREFERENCED_PARAMETER( arguments )\n\n\tif( pyevtx_record == NULL )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_ValueError,\n\t\t \"%s: invalid record.\",\n\t\t function );\n\n\t\treturn( NULL );\n\t}\n\tPy_BEGIN_ALLOW_THREADS\n\n\tresult = libevtx_record_get_utf8_source_name_size(\n\t pyevtx_record->record,\n\t &utf8_string_size,\n\t &error );\n\n\tPy_END_ALLOW_THREADS\n\n\tif( result == -1 )\n\t{\n\t\tpyevtx_error_raise(\n\t\t error,\n\t\t PyExc_IOError,\n\t\t \"%s: unable to determine size of source name as UTF-8 string.\",\n\t\t function );\n\n\t\tlibcerror_error_free(\n\t\t &error );\n\n\t\tgoto on_error;\n\t}\n\telse if( ( result == 0 )\n\t || ( utf8_string_size == 0 ) )\n\t{\n\t\tPy_IncRef(\n\t\t Py_None );\n\n\t\treturn( Py_None );\n\t}\n\tutf8_string = (char *) PyMem_Malloc(\n\t sizeof( char ) * utf8_string_size );\n\n\tif( utf8_string == NULL )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_MemoryError,\n\t\t \"%s: unable to create UTF-8 string.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tPy_BEGIN_ALLOW_THREADS\n\n\tresult = libevtx_record_get_utf8_source_name(\n\t pyevtx_record->record,\n\t (uint8_t *) utf8_string,\n\t utf8_string_size,\n\t &error );\n\n\tPy_END_ALLOW_THREADS\n\n\tif( result != 1 )\n\t{\n\t\tpyevtx_error_raise(\n\t\t error,\n\t\t PyExc_IOError,\n\t\t \"%s: unable to retrieve source name as UTF-8 string.\",\n\t\t function );\n\n\t\tlibcerror_error_free(\n\t\t &error );\n\n\t\tgoto on_error;\n\t}\n\t/* Pass the string length to PyUnicode_DecodeUTF8 otherwise it makes\n\t * the end of string character is part of the string\n\t */\n\tstring_object = PyUnicode_DecodeUTF8(\n\t utf8_string,\n\t (Py_ssize_t) utf8_string_size - 1,\n\t NULL );\n\n\tif( string_object == NULL )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_IOError,\n\t\t \"%s: unable to convert UTF-8 string into Unicode object.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tPyMem_Free(\n\t utf8_string );\n\n\treturn( string_object );\n\non_error:\n\tif( utf8_string != NULL )\n\t{\n\t\tPyMem_Free(\n\t\t utf8_string );\n\t}\n\treturn( NULL );\n}\n\n/* Retrieves the channel name\n * Returns a Python object if successful or NULL on error\n */\nPyObject *pyevtx_record_get_channel_name(\n pyevtx_record_t *pyevtx_record,\n PyObject *arguments PYEVTX_ATTRIBUTE_UNUSED )\n{\n\tPyObject *string_object = NULL;\n\tlibcerror_error_t *error = NULL;\n\tstatic char *function = \"pyevtx_record_get_channel_name\";\n\tchar *utf8_string = NULL;\n\tsize_t utf8_string_size = 0;\n\tint result = 0;\n\n\tPYEVTX_UNREFERENCED_PARAMETER( arguments )\n\n\tif( pyevtx_record == NULL )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_ValueError,\n\t\t \"%s: invalid record.\",\n\t\t function );\n\n\t\treturn( NULL );\n\t}\n\tPy_BEGIN_ALLOW_THREADS\n\n\tresult = libevtx_record_get_utf8_channel_name_size(\n\t pyevtx_record->record,\n\t &utf8_string_size,\n\t &error );\n\n\tPy_END_ALLOW_THREADS\n\n\tif( result == -1 )\n\t{\n\t\tpyevtx_error_raise(\n\t\t error,\n\t\t PyExc_IOError,\n\t\t \"%s: unable to determine size of channel name as UTF-8 string.\",\n\t\t function );\n\n\t\tlibcerror_error_free(\n\t\t &error );\n\n\t\tgoto on_error;\n\t}\n\telse if( ( result == 0 )\n\t || ( utf8_string_size == 0 ) )\n\t{\n\t\tPy_IncRef(\n\t\t Py_None );\n\n\t\treturn( Py_None );\n\t}\n\tutf8_string = (char *) PyMem_Malloc(\n\t sizeof( char ) * utf8_string_size );\n\n\tif( utf8_string == NULL )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_MemoryError,\n\t\t \"%s: unable to create UTF-8 string.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tPy_BEGIN_ALLOW_THREADS\n\n\tresult = libevtx_record_get_utf8_channel_name(\n\t pyevtx_record->record,\n\t (uint8_t *) utf8_string,\n\t utf8_string_size,\n\t &error );\n\n\tPy_END_ALLOW_THREADS\n\n\tif( result != 1 )\n\t{\n\t\tpyevtx_error_raise(\n\t\t error,\n\t\t PyExc_IOError,\n\t\t \"%s: unable to retrieve channel name as UTF-8 string.\",\n\t\t function );\n\n\t\tlibcerror_error_free(\n\t\t &error );\n\n\t\tgoto on_error;\n\t}\n\t/* Pass the string length to PyUnicode_DecodeUTF8 otherwise it makes\n\t * the end of string character is part of the string\n\t */\n\tstring_object = PyUnicode_DecodeUTF8(\n\t utf8_string,\n\t (Py_ssize_t) utf8_string_size - 1,\n\t NULL );\n\n\tif( string_object == NULL )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_IOError,\n\t\t \"%s: unable to convert UTF-8 string into Unicode object.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tPyMem_Free(\n\t utf8_string );\n\n\treturn( string_object );\n\non_error:\n\tif( utf8_string != NULL )\n\t{\n\t\tPyMem_Free(\n\t\t utf8_string );\n\t}\n\treturn( NULL );\n}\n\n/* Retrieves the computer name\n * Returns a Python object if successful or NULL on error\n */\nPyObject *pyevtx_record_get_computer_name(\n pyevtx_record_t *pyevtx_record,\n PyObject *arguments PYEVTX_ATTRIBUTE_UNUSED )\n{\n\tPyObject *string_object = NULL;\n\tlibcerror_error_t *error = NULL;\n\tstatic char *function = \"pyevtx_record_get_computer_name\";\n\tchar *utf8_string = NULL;\n\tsize_t utf8_string_size = 0;\n\tint result = 0;\n\n\tPYEVTX_UNREFERENCED_PARAMETER( arguments )\n\n\tif( pyevtx_record == NULL )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_ValueError,\n\t\t \"%s: invalid record.\",\n\t\t function );\n\n\t\treturn( NULL );\n\t}\n\tPy_BEGIN_ALLOW_THREADS\n\n\tresult = libevtx_record_get_utf8_computer_name_size(\n\t pyevtx_record->record,\n\t &utf8_string_size,\n\t &error );\n\n\tPy_END_ALLOW_THREADS\n\n\tif( result == -1 )\n\t{\n\t\tpyevtx_error_raise(\n\t\t error,\n\t\t PyExc_IOError,\n\t\t \"%s: unable to determine size of computer name as UTF-8 string.\",\n\t\t function );\n\n\t\tlibcerror_error_free(\n\t\t &error );\n\n\t\tgoto on_error;\n\t}\n\telse if( ( result == 0 )\n\t || ( utf8_string_size == 0 ) )\n\t{\n\t\tPy_IncRef(\n\t\t Py_None );\n\n\t\treturn( Py_None );\n\t}\n\tutf8_string = (char *) PyMem_Malloc(\n\t sizeof( char ) * utf8_string_size );\n\n\tif( utf8_string == NULL )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_MemoryError,\n\t\t \"%s: unable to create UTF-8 string.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tPy_BEGIN_ALLOW_THREADS\n\n\tresult = libevtx_record_get_utf8_computer_name(\n\t pyevtx_record->record,\n\t (uint8_t *) utf8_string,\n\t utf8_string_size,\n\t &error );\n\n\tPy_END_ALLOW_THREADS\n\n\tif( result != 1 )\n\t{\n\t\tpyevtx_error_raise(\n\t\t error,\n\t\t PyExc_IOError,\n\t\t \"%s: unable to retrieve computer name as UTF-8 string.\",\n\t\t function );\n\n\t\tlibcerror_error_free(\n\t\t &error );\n\n\t\tgoto on_error;\n\t}\n\t/* Pass the string length to PyUnicode_DecodeUTF8 otherwise it makes\n\t * the end of string character is part of the string\n\t */\n\tstring_object = PyUnicode_DecodeUTF8(\n\t utf8_string,\n\t (Py_ssize_t) utf8_string_size - 1,\n\t NULL );\n\n\tif( string_object == NULL )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_IOError,\n\t\t \"%s: unable to convert UTF-8 string into Unicode object.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tPyMem_Free(\n\t utf8_string );\n\n\treturn( string_object );\n\non_error:\n\tif( utf8_string != NULL )\n\t{\n\t\tPyMem_Free(\n\t\t utf8_string );\n\t}\n\treturn( NULL );\n}\n\n/* Retrieves the user security identifier\n * Returns a Python object if successful or NULL on error\n */\nPyObject *pyevtx_record_get_user_security_identifier(\n pyevtx_record_t *pyevtx_record,\n PyObject *arguments PYEVTX_ATTRIBUTE_UNUSED )\n{\n\tPyObject *string_object = NULL;\n\tlibcerror_error_t *error = NULL;\n\tstatic char *function = \"pyevtx_record_get_user_security_identifier\";\n\tchar *utf8_string = NULL;\n\tsize_t utf8_string_size = 0;\n\tint result = 0;\n\n\tPYEVTX_UNREFERENCED_PARAMETER( arguments )\n\n\tif( pyevtx_record == NULL )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_ValueError,\n\t\t \"%s: invalid record.\",\n\t\t function );\n\n\t\treturn( NULL );\n\t}\n\tPy_BEGIN_ALLOW_THREADS\n\n\tresult = libevtx_record_get_utf8_user_security_identifier_size(\n\t pyevtx_record->record,\n\t &utf8_string_size,\n\t &error );\n\n\tPy_END_ALLOW_THREADS\n\n\tif( result == -1 )\n\t{\n\t\tpyevtx_error_raise(\n\t\t error,\n\t\t PyExc_IOError,\n\t\t \"%s: unable to determine size of user security identifier as UTF-8 string.\",\n\t\t function );\n\n\t\tlibcerror_error_free(\n\t\t &error );\n\n\t\tgoto on_error;\n\t}\n\telse if( ( result == 0 )\n\t || ( utf8_string_size == 0 ) )\n\t{\n\t\tPy_IncRef(\n\t\t Py_None );\n\n\t\treturn( Py_None );\n\t}\n\tutf8_string = (char *) PyMem_Malloc(\n\t sizeof( char ) * utf8_string_size );\n\n\tif( utf8_string == NULL )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_MemoryError,\n\t\t \"%s: unable to create UTF-8 string.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tPy_BEGIN_ALLOW_THREADS\n\n\tresult = libevtx_record_get_utf8_user_security_identifier(\n\t pyevtx_record->record,\n\t (uint8_t *) utf8_string,\n\t utf8_string_size,\n\t &error );\n\n\tPy_END_ALLOW_THREADS\n\n\tif( result != 1 )\n\t{\n\t\tpyevtx_error_raise(\n\t\t error,\n\t\t PyExc_IOError,\n\t\t \"%s: unable to retrieve user security identifier as UTF-8 string.\",\n\t\t function );\n\n\t\tlibcerror_error_free(\n\t\t &error );\n\n\t\tgoto on_error;\n\t}\n\t/* Pass the string length to PyUnicode_DecodeUTF8 otherwise it makes\n\t * the end of string character is part of the string\n\t */\n\tstring_object = PyUnicode_DecodeUTF8(\n\t utf8_string,\n\t (Py_ssize_t) utf8_string_size - 1,\n\t NULL );\n\n\tif( string_object == NULL )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_IOError,\n\t\t \"%s: unable to convert UTF-8 string into Unicode object.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tPyMem_Free(\n\t utf8_string );\n\n\treturn( string_object );\n\non_error:\n\tif( utf8_string != NULL )\n\t{\n\t\tPyMem_Free(\n\t\t utf8_string );\n\t}\n\treturn( NULL );\n}\n\n/* Retrieves the number of strings\n * Returns a Python object if successful or NULL on error\n */\nPyObject *pyevtx_record_get_number_of_strings(\n pyevtx_record_t *pyevtx_record,\n PyObject *arguments PYEVTX_ATTRIBUTE_UNUSED )\n{\n\tPyObject *integer_object = NULL;\n\tlibcerror_error_t *error = NULL;\n\tstatic char *function = \"pyevtx_record_get_number_of_strings\";\n\tint number_of_strings = 0;\n\tint result = 0;\n\n\tPYEVTX_UNREFERENCED_PARAMETER( arguments )\n\n\tif( pyevtx_record == NULL )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_ValueError,\n\t\t \"%s: invalid record.\",\n\t\t function );\n\n\t\treturn( NULL );\n\t}\n\tPy_BEGIN_ALLOW_THREADS\n\n\tresult = libevtx_record_get_number_of_strings(\n\t pyevtx_record->record,\n\t &number_of_strings,\n\t &error );\n\n\tPy_END_ALLOW_THREADS\n\n\tif( result != 1 )\n\t{\n\t\tpyevtx_error_raise(\n\t\t error,\n\t\t PyExc_IOError,\n\t\t \"%s: unable to retrieve number of strings.\",\n\t\t function );\n\n\t\tlibcerror_error_free(\n\t\t &error );\n\n\t\treturn( NULL );\n\t}\n#if PY_MAJOR_VERSION >= 3\n\tinteger_object = PyLong_FromLong(\n\t (long) number_of_strings );\n#else\n\tinteger_object = PyInt_FromLong(\n\t (long) number_of_strings );\n#endif\n\treturn( integer_object );\n}\n\n/* Retrieves a specific string by index\n * Returns a Python object if successful or NULL on error\n */\nPyObject *pyevtx_record_get_string_by_index(\n PyObject *pyevtx_record,\n int string_index )\n{\n\tPyObject *string_object = NULL;\n\tlibcerror_error_t *error = NULL;\n\tuint8_t *utf8_string = NULL;\n\tstatic char *function = \"pyevtx_record_get_string_by_index\";\n\tsize_t utf8_string_size = 0;\n\tint result = 0;\n\n\tif( pyevtx_record == NULL )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_ValueError,\n\t\t \"%s: invalid record.\",\n\t\t function );\n\n\t\treturn( NULL );\n\t}\n\tPy_BEGIN_ALLOW_THREADS\n\n\tresult = libevtx_record_get_utf8_string_size(\n\t ( (pyevtx_record_t *) pyevtx_record )->record,\n\t string_index,\n\t &utf8_string_size,\n\t &error );\n\n\tPy_END_ALLOW_THREADS\n\n\tif( result == -1 )\n\t{\n\t\tpyevtx_error_raise(\n\t\t error,\n\t\t PyExc_IOError,\n\t\t \"%s: unable to determine size of string: %d as UTF-8 string.\",\n\t\t function,\n\t\t string_index );\n\n\t\tlibcerror_error_free(\n\t\t &error );\n\n\t\tgoto on_error;\n\t}\n\telse if( ( result == 0 )\n\t || ( utf8_string_size == 0 ) )\n\t{\n\t\tPy_IncRef(\n\t\t Py_None );\n\n\t\treturn( Py_None );\n\t}\n\tutf8_string = (uint8_t *) PyMem_Malloc(\n\t sizeof( uint8_t ) * utf8_string_size );\n\n\tif( utf8_string == NULL )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_MemoryError,\n\t\t \"%s: unable to create UTF-8 string.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tPy_BEGIN_ALLOW_THREADS\n\n\tresult = libevtx_record_get_utf8_string(\n\t ( (pyevtx_record_t *) pyevtx_record )->record,\n\t string_index,\n\t utf8_string,\n\t utf8_string_size,\n\t &error );\n\n\tPy_END_ALLOW_THREADS\n\n\tif( result != 1 )\n\t{\n\t\tpyevtx_error_raise(\n\t\t error,\n\t\t PyExc_IOError,\n\t\t \"%s: unable to retrieve string: %d as UTF-8 string.\",\n\t\t function,\n\t\t string_index );\n\n\t\tlibcerror_error_free(\n\t\t &error );\n\n\t\tgoto on_error;\n\t}\n\t/* Pass the string length to PyUnicode_DecodeUTF8 otherwise it makes\n\t * the end of string character is part of the string\n\t */\n\tstring_object = PyUnicode_DecodeUTF8(\n\t (char *) utf8_string,\n\t (Py_ssize_t) utf8_string_size - 1,\n\t NULL );\n\n\tif( string_object == NULL )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_IOError,\n\t\t \"%s: unable to convert UTF-8 string into Unicode object.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tPyMem_Free(\n\t utf8_string );\n\n\treturn( string_object );\n\non_error:\n\tif( utf8_string != NULL )\n\t{\n\t\tPyMem_Free(\n\t\t utf8_string );\n\t}\n\treturn( NULL );\n}\n\n/* Retrieves a specific string\n * Returns a Python object if successful or NULL on error\n */\nPyObject *pyevtx_record_get_string(\n pyevtx_record_t *pyevtx_record,\n PyObject *arguments,\n PyObject *keywords )\n{\n\tPyObject *string_object = NULL;\n\tstatic char *keyword_list[] = { \"string_index\", NULL };\n\tint string_index = 0;\n\n\tif( PyArg_ParseTupleAndKeywords(\n\t arguments,\n\t keywords,\n\t \"i\",\n\t keyword_list,\n\t &string_index ) == 0 )\n\t{\n\t\treturn( NULL );\n\t}\n\tstring_object = pyevtx_record_get_string_by_index(\n\t (PyObject *) pyevtx_record,\n\t string_index );\n\n\treturn( string_object );\n}\n\n/* Retrieves a sequence and iterator object for the strings\n * Returns a Python object if successful or NULL on error\n */\nPyObject *pyevtx_record_get_strings(\n pyevtx_record_t *pyevtx_record,\n PyObject *arguments PYEVTX_ATTRIBUTE_UNUSED )\n{\n\tPyObject *sequence_object = NULL;\n\tlibcerror_error_t *error = NULL;\n\tstatic char *function = \"pyevtx_record_get_strings\";\n\tint number_of_strings = 0;\n\tint result = 0;\n\n\tPYEVTX_UNREFERENCED_PARAMETER( arguments )\n\n\tif( pyevtx_record == NULL )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_ValueError,\n\t\t \"%s: invalid record.\",\n\t\t function );\n\n\t\treturn( NULL );\n\t}\n\tPy_BEGIN_ALLOW_THREADS\n\n\tresult = libevtx_record_get_number_of_strings(\n\t pyevtx_record->record,\n\t &number_of_strings,\n\t &error );\n\n\tPy_END_ALLOW_THREADS\n\n\tif( result != 1 )\n\t{\n\t\tpyevtx_error_raise(\n\t\t error,\n\t\t PyExc_IOError,\n\t\t \"%s: unable to retrieve number of strings.\",\n\t\t function );\n\n\t\tlibcerror_error_free(\n\t\t &error );\n\n\t\treturn( NULL );\n\t}\n\tsequence_object = pyevtx_strings_new(\n\t (PyObject *) pyevtx_record,\n\t &pyevtx_record_get_string_by_index,\n\t number_of_strings );\n\n\tif( sequence_object == NULL )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_MemoryError,\n\t\t \"%s: unable to create sequence object.\",\n\t\t function );\n\n\t\treturn( NULL );\n\t}\n\treturn( sequence_object );\n}\n\n/* Retrieves the data\n * Returns a Python object if successful or NULL on error\n */\nPyObject *pyevtx_record_get_data(\n pyevtx_record_t *pyevtx_record,\n PyObject *arguments PYEVTX_ATTRIBUTE_UNUSED )\n{\n\tPyObject *bytes_object = NULL;\n\tlibcerror_error_t *error = NULL;\n\tchar *data = NULL;\n\tstatic char *function = \"pyevtx_record_get_data\";\n\tsize_t data_size = 0;\n\tint result = 0;\n\n\tPYEVTX_UNREFERENCED_PARAMETER( arguments )\n\n\tif( pyevtx_record == NULL )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_ValueError,\n\t\t \"%s: invalid record.\",\n\t\t function );\n\n\t\treturn( NULL );\n\t}\n\tPy_BEGIN_ALLOW_THREADS\n\n\tresult = libevtx_record_get_data_size(\n\t pyevtx_record->record,\n\t &data_size,\n\t &error );\n\n\tPy_END_ALLOW_THREADS\n\n\tif( result == -1 )\n\t{\n\t\tpyevtx_error_raise(\n\t\t error,\n\t\t PyExc_IOError,\n\t\t \"%s: unable to retrieve data size.\",\n\t\t function );\n\n\t\tlibcerror_error_free(\n\t\t &error );\n\n\t\tgoto on_error;\n\t}\n\telse if( ( result == 0 )\n\t || ( data_size == 0 ) )\n\t{\n\t\tPy_IncRef(\n\t\t Py_None );\n\n\t\treturn( Py_None );\n\t}\n\tdata = (char *) PyMem_Malloc(\n\t sizeof( char ) * data_size );\n\n\tif( data == NULL )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_MemoryError,\n\t\t \"%s: unable to create data.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tPy_BEGIN_ALLOW_THREADS\n\n\tresult = libevtx_record_get_data(\n\t pyevtx_record->record,\n\t (uint8_t *) data,\n\t data_size,\n\t &error );\n\n\tPy_END_ALLOW_THREADS\n\n\tif( result != 1 )\n\t{\n\t\tpyevtx_error_raise(\n\t\t error,\n\t\t PyExc_IOError,\n\t\t \"%s: unable to retrieve data.\",\n\t\t function );\n\n\t\tlibcerror_error_free(\n\t\t &error );\n\n\t\tgoto on_error;\n\t}\n\t/* This is a binary string so include the full size\n\t */\n#if PY_MAJOR_VERSION >= 3\n\tbytes_object = PyBytes_FromStringAndSize(\n\t data,\n\t (Py_ssize_t) data_size );\n#else\n\tbytes_object = PyString_FromStringAndSize(\n\t data,\n\t (Py_ssize_t) data_size );\n#endif\n\tif( bytes_object == NULL )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_IOError,\n\t\t \"%s: unable to convert data into Bytes object.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tPyMem_Free(\n\t data );\n\n\treturn( bytes_object );\n\non_error:\n\tif( data != NULL )\n\t{\n\t\tPyMem_Free(\n\t\t data );\n\t}\n\treturn( NULL );\n}\n\n/* Retrieves the xml string\n * Returns a Python object if successful or NULL on error\n */\nPyObject *pyevtx_record_get_xml_string(\n pyevtx_record_t *pyevtx_record,\n PyObject *arguments PYEVTX_ATTRIBUTE_UNUSED )\n{\n\tPyObject *string_object = NULL;\n\tlibcerror_error_t *error = NULL;\n\tstatic char *function = \"pyevtx_record_get_xml_string\";\n\tchar *utf8_string = NULL;\n\tsize_t utf8_string_size = 0;\n\tint result = 0;\n\n\tPYEVTX_UNREFERENCED_PARAMETER( arguments )\n\n\tif( pyevtx_record == NULL )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_ValueError,\n\t\t \"%s: invalid record.\",\n\t\t function );\n\n\t\treturn( NULL );\n\t}\n\tPy_BEGIN_ALLOW_THREADS\n\n\tresult = libevtx_record_get_utf8_xml_string_size(\n\t pyevtx_record->record,\n\t &utf8_string_size,\n\t &error );\n\n\tPy_END_ALLOW_THREADS\n\n\tif( result == -1 )\n\t{\n\t\tpyevtx_error_raise(\n\t\t error,\n\t\t PyExc_IOError,\n\t\t \"%s: unable to determine size of xml string as UTF-8 string.\",\n\t\t function );\n\n\t\tlibcerror_error_free(\n\t\t &error );\n\n\t\tgoto on_error;\n\t}\n\telse if( ( result == 0 )\n\t || ( utf8_string_size == 0 ) )\n\t{\n\t\tPy_IncRef(\n\t\t Py_None );\n\n\t\treturn( Py_None );\n\t}\n\tutf8_string = (char *) PyMem_Malloc(\n\t sizeof( char ) * utf8_string_size );\n\n\tif( utf8_string == NULL )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_MemoryError,\n\t\t \"%s: unable to create UTF-8 string.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tPy_BEGIN_ALLOW_THREADS\n\n\tresult = libevtx_record_get_utf8_xml_string(\n\t pyevtx_record->record,\n\t (uint8_t *) utf8_string,\n\t utf8_string_size,\n\t &error );\n\n\tPy_END_ALLOW_THREADS\n\n\tif( result != 1 )\n\t{\n\t\tpyevtx_error_raise(\n\t\t error,\n\t\t PyExc_IOError,\n\t\t \"%s: unable to retrieve xml string as UTF-8 string.\",\n\t\t function );\n\n\t\tlibcerror_error_free(\n\t\t &error );\n\n\t\tgoto on_error;\n\t}\n\t/* Pass the string length to PyUnicode_DecodeUTF8 otherwise it makes\n\t * the end of string character is part of the string\n\t */\n\tstring_object = PyUnicode_DecodeUTF8(\n\t utf8_string,\n\t (Py_ssize_t) utf8_string_size - 1,\n\t NULL );\n\n\tif( string_object == NULL )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_IOError,\n\t\t \"%s: unable to convert UTF-8 string into Unicode object.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tPyMem_Free(\n\t utf8_string );\n\n\treturn( string_object );\n\non_error:\n\tif( utf8_string != NULL )\n\t{\n\t\tPyMem_Free(\n\t\t utf8_string );\n\t}\n\treturn( NULL );\n}\n\n" }, { "path": "pyevtx/pyevtx_record.h", "content": "/*\n * Python object wrapper of libevtx_record_t\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#if !defined( _PYEVTX_RECORD_H )\n#define _PYEVTX_RECORD_H\n\n#include \n#include \n\n#include \"pyevtx_libevtx.h\"\n#include \"pyevtx_python.h\"\n\n#if defined( __cplusplus )\nextern \"C\" {\n#endif\n\ntypedef struct pyevtx_record pyevtx_record_t;\n\nstruct pyevtx_record\n{\n\t/* Python object initialization\n\t */\n\tPyObject_HEAD\n\n\t/* The libevtx record\n\t */\n\tlibevtx_record_t *record;\n\n\t/* The parent object\n\t */\n\tPyObject *parent_object;\n};\n\nextern PyMethodDef pyevtx_record_object_methods[];\nextern PyTypeObject pyevtx_record_type_object;\n\nPyObject *pyevtx_record_new(\n libevtx_record_t *record,\n PyObject *parent_object );\n\nint pyevtx_record_init(\n pyevtx_record_t *pyevtx_record );\n\nvoid pyevtx_record_free(\n pyevtx_record_t *pyevtx_record );\n\nPyObject *pyevtx_record_get_offset(\n pyevtx_record_t *pyevtx_record,\n PyObject *arguments );\n\nPyObject *pyevtx_record_get_identifier(\n pyevtx_record_t *pyevtx_record,\n PyObject *arguments );\n\nPyObject *pyevtx_record_get_creation_time(\n pyevtx_record_t *pyevtx_record,\n PyObject *arguments );\n\nPyObject *pyevtx_record_get_creation_time_as_integer(\n pyevtx_record_t *pyevtx_record,\n PyObject *arguments );\n\nPyObject *pyevtx_record_get_written_time(\n pyevtx_record_t *pyevtx_record,\n PyObject *arguments );\n\nPyObject *pyevtx_record_get_written_time_as_integer(\n pyevtx_record_t *pyevtx_record,\n PyObject *arguments );\n\nPyObject *pyevtx_record_get_event_identifier(\n pyevtx_record_t *pyevtx_record,\n PyObject *arguments );\n\nPyObject *pyevtx_record_get_event_identifier_qualifiers(\n pyevtx_record_t *pyevtx_record,\n PyObject *arguments );\n\nPyObject *pyevtx_record_get_event_version(\n pyevtx_record_t *pyevtx_record,\n PyObject *arguments );\n\nPyObject *pyevtx_record_get_event_level(\n pyevtx_record_t *pyevtx_record,\n PyObject *arguments );\n\nPyObject *pyevtx_record_get_provider_identifier(\n pyevtx_record_t *pyevtx_record,\n PyObject *arguments );\n\nPyObject *pyevtx_record_get_source_name(\n pyevtx_record_t *pyevtx_record,\n PyObject *arguments );\n\nPyObject *pyevtx_record_get_channel_name(\n pyevtx_record_t *pyevtx_record,\n PyObject *arguments );\n\nPyObject *pyevtx_record_get_computer_name(\n pyevtx_record_t *pyevtx_record,\n PyObject *arguments );\n\nPyObject *pyevtx_record_get_user_security_identifier(\n pyevtx_record_t *pyevtx_record,\n PyObject *arguments );\n\nPyObject *pyevtx_record_get_number_of_strings(\n pyevtx_record_t *pyevtx_record,\n PyObject *arguments );\n\nPyObject *pyevtx_record_get_string_by_index(\n PyObject *pyevtx_record,\n int string_index );\n\nPyObject *pyevtx_record_get_string(\n pyevtx_record_t *pyevtx_record,\n PyObject *arguments,\n PyObject *keywords );\n\nPyObject *pyevtx_record_get_strings(\n pyevtx_record_t *pyevtx_record,\n PyObject *arguments );\n\nPyObject *pyevtx_record_get_data(\n pyevtx_record_t *pyevtx_record,\n PyObject *arguments );\n\nPyObject *pyevtx_record_get_xml_string(\n pyevtx_record_t *pyevtx_record,\n PyObject *arguments );\n\n#if defined( __cplusplus )\n}\n#endif\n\n#endif /* !defined( _PYEVTX_RECORD_H ) */\n\n" }, { "path": "pyevtx/pyevtx_records.c", "content": "/*\n * Python object definition of the sequence and iterator object of records\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#include \n#include \n\n#if defined( HAVE_STDLIB_H ) || defined( HAVE_WINAPI )\n#include \n#endif\n\n#include \"pyevtx_libcerror.h\"\n#include \"pyevtx_libevtx.h\"\n#include \"pyevtx_python.h\"\n#include \"pyevtx_record.h\"\n#include \"pyevtx_records.h\"\n\nPySequenceMethods pyevtx_records_sequence_methods = {\n\t/* sq_length */\n\t(lenfunc) pyevtx_records_len,\n\t/* sq_concat */\n\t0,\n\t/* sq_repeat */\n\t0,\n\t/* sq_item */\n\t(ssizeargfunc) pyevtx_records_getitem,\n\t/* sq_slice */\n\t0,\n\t/* sq_ass_item */\n\t0,\n\t/* sq_ass_slice */\n\t0,\n\t/* sq_contains */\n\t0,\n\t/* sq_inplace_concat */\n\t0,\n\t/* sq_inplace_repeat */\n\t0\n};\n\nPyTypeObject pyevtx_records_type_object = {\n\tPyVarObject_HEAD_INIT( NULL, 0 )\n\n\t/* tp_name */\n\t\"pyevtx.records\",\n\t/* tp_basicsize */\n\tsizeof( pyevtx_records_t ),\n\t/* tp_itemsize */\n\t0,\n\t/* tp_dealloc */\n\t(destructor) pyevtx_records_free,\n\t/* tp_print */\n\t0,\n\t/* tp_getattr */\n\t0,\n\t/* tp_setattr */\n\t0,\n\t/* tp_compare */\n\t0,\n\t/* tp_repr */\n\t0,\n\t/* tp_as_number */\n\t0,\n\t/* tp_as_sequence */\n\t&pyevtx_records_sequence_methods,\n\t/* tp_as_mapping */\n\t0,\n\t/* tp_hash */\n\t0,\n\t/* tp_call */\n\t0,\n\t/* tp_str */\n\t0,\n\t/* tp_getattro */\n\t0,\n\t/* tp_setattro */\n\t0,\n\t/* tp_as_buffer */\n\t0,\n\t/* tp_flags */\n\tPy_TPFLAGS_DEFAULT | Py_TPFLAGS_HAVE_ITER,\n\t/* tp_doc */\n\t\"pyevtx sequence and iterator object of records\",\n\t/* tp_traverse */\n\t0,\n\t/* tp_clear */\n\t0,\n\t/* tp_richcompare */\n\t0,\n\t/* tp_weaklistoffset */\n\t0,\n\t/* tp_iter */\n\t(getiterfunc) pyevtx_records_iter,\n\t/* tp_iternext */\n\t(iternextfunc) pyevtx_records_iternext,\n\t/* tp_methods */\n\t0,\n\t/* tp_members */\n\t0,\n\t/* tp_getset */\n\t0,\n\t/* tp_base */\n\t0,\n\t/* tp_dict */\n\t0,\n\t/* tp_descr_get */\n\t0,\n\t/* tp_descr_set */\n\t0,\n\t/* tp_dictoffset */\n\t0,\n\t/* tp_init */\n\t(initproc) pyevtx_records_init,\n\t/* tp_alloc */\n\t0,\n\t/* tp_new */\n\t0,\n\t/* tp_free */\n\t0,\n\t/* tp_is_gc */\n\t0,\n\t/* tp_bases */\n\tNULL,\n\t/* tp_mro */\n\tNULL,\n\t/* tp_cache */\n\tNULL,\n\t/* tp_subclasses */\n\tNULL,\n\t/* tp_weaklist */\n\tNULL,\n\t/* tp_del */\n\t0\n};\n\n/* Creates a new records sequence and iterator object\n * Returns a Python object if successful or NULL on error\n */\nPyObject *pyevtx_records_new(\n PyObject *parent_object,\n PyObject* (*get_item_by_index)(\n PyObject *parent_object,\n int index ),\n int number_of_items )\n{\n\tpyevtx_records_t *sequence_object = NULL;\n\tstatic char *function = \"pyevtx_records_new\";\n\n\tif( parent_object == NULL )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_ValueError,\n\t\t \"%s: invalid parent object.\",\n\t\t function );\n\n\t\treturn( NULL );\n\t}\n\tif( get_item_by_index == NULL )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_ValueError,\n\t\t \"%s: invalid get item by index function.\",\n\t\t function );\n\n\t\treturn( NULL );\n\t}\n\t/* Make sure the records values are initialized\n\t */\n\tsequence_object = PyObject_New(\n\t struct pyevtx_records,\n\t &pyevtx_records_type_object );\n\n\tif( sequence_object == NULL )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_MemoryError,\n\t\t \"%s: unable to create sequence object.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tsequence_object->parent_object = parent_object;\n\tsequence_object->get_item_by_index = get_item_by_index;\n\tsequence_object->current_index = 0;\n\tsequence_object->number_of_items = number_of_items;\n\n\tPy_IncRef(\n\t (PyObject *) sequence_object->parent_object );\n\n\treturn( (PyObject *) sequence_object );\n\non_error:\n\tif( sequence_object != NULL )\n\t{\n\t\tPy_DecRef(\n\t\t (PyObject *) sequence_object );\n\t}\n\treturn( NULL );\n}\n\n/* Initializes a records sequence and iterator object\n * Returns 0 if successful or -1 on error\n */\nint pyevtx_records_init(\n pyevtx_records_t *sequence_object )\n{\n\tstatic char *function = \"pyevtx_records_init\";\n\n\tif( sequence_object == NULL )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_ValueError,\n\t\t \"%s: invalid sequence object.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\t/* Make sure the records values are initialized\n\t */\n\tsequence_object->parent_object = NULL;\n\tsequence_object->get_item_by_index = NULL;\n\tsequence_object->current_index = 0;\n\tsequence_object->number_of_items = 0;\n\n\tPyErr_Format(\n\t PyExc_NotImplementedError,\n\t \"%s: initialize of records not supported.\",\n\t function );\n\n\treturn( -1 );\n}\n\n/* Frees a records sequence object\n */\nvoid pyevtx_records_free(\n pyevtx_records_t *sequence_object )\n{\n\tstruct _typeobject *ob_type = NULL;\n\tstatic char *function = \"pyevtx_records_free\";\n\n\tif( sequence_object == NULL )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_ValueError,\n\t\t \"%s: invalid sequence object.\",\n\t\t function );\n\n\t\treturn;\n\t}\n\tob_type = Py_TYPE(\n\t sequence_object );\n\n\tif( ob_type == NULL )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_ValueError,\n\t\t \"%s: missing ob_type.\",\n\t\t function );\n\n\t\treturn;\n\t}\n\tif( ob_type->tp_free == NULL )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_ValueError,\n\t\t \"%s: invalid ob_type - missing tp_free.\",\n\t\t function );\n\n\t\treturn;\n\t}\n\tif( sequence_object->parent_object != NULL )\n\t{\n\t\tPy_DecRef(\n\t\t (PyObject *) sequence_object->parent_object );\n\t}\n\tob_type->tp_free(\n\t (PyObject*) sequence_object );\n}\n\n/* The records len() function\n */\nPy_ssize_t pyevtx_records_len(\n pyevtx_records_t *sequence_object )\n{\n\tstatic char *function = \"pyevtx_records_len\";\n\n\tif( sequence_object == NULL )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_ValueError,\n\t\t \"%s: invalid sequence object.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\treturn( (Py_ssize_t) sequence_object->number_of_items );\n}\n\n/* The records getitem() function\n */\nPyObject *pyevtx_records_getitem(\n pyevtx_records_t *sequence_object,\n Py_ssize_t item_index )\n{\n\tPyObject *record_object = NULL;\n\tstatic char *function = \"pyevtx_records_getitem\";\n\n\tif( sequence_object == NULL )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_ValueError,\n\t\t \"%s: invalid sequence object.\",\n\t\t function );\n\n\t\treturn( NULL );\n\t}\n\tif( sequence_object->get_item_by_index == NULL )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_ValueError,\n\t\t \"%s: invalid sequence object - missing get item by index function.\",\n\t\t function );\n\n\t\treturn( NULL );\n\t}\n\tif( sequence_object->number_of_items < 0 )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_ValueError,\n\t\t \"%s: invalid sequence object - invalid number of items.\",\n\t\t function );\n\n\t\treturn( NULL );\n\t}\n\tif( ( item_index < 0 )\n\t || ( item_index >= (Py_ssize_t) sequence_object->number_of_items ) )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_ValueError,\n\t\t \"%s: invalid invalid item index value out of bounds.\",\n\t\t function );\n\n\t\treturn( NULL );\n\t}\n\trecord_object = sequence_object->get_item_by_index(\n\t sequence_object->parent_object,\n\t (int) item_index );\n\n\treturn( record_object );\n}\n\n/* The records iter() function\n */\nPyObject *pyevtx_records_iter(\n pyevtx_records_t *sequence_object )\n{\n\tstatic char *function = \"pyevtx_records_iter\";\n\n\tif( sequence_object == NULL )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_ValueError,\n\t\t \"%s: invalid sequence object.\",\n\t\t function );\n\n\t\treturn( NULL );\n\t}\n\tPy_IncRef(\n\t (PyObject *) sequence_object );\n\n\treturn( (PyObject *) sequence_object );\n}\n\n/* The records iternext() function\n */\nPyObject *pyevtx_records_iternext(\n pyevtx_records_t *sequence_object )\n{\n\tPyObject *record_object = NULL;\n\tstatic char *function = \"pyevtx_records_iternext\";\n\n\tif( sequence_object == NULL )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_ValueError,\n\t\t \"%s: invalid sequence object.\",\n\t\t function );\n\n\t\treturn( NULL );\n\t}\n\tif( sequence_object->get_item_by_index == NULL )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_ValueError,\n\t\t \"%s: invalid sequence object - missing get item by index function.\",\n\t\t function );\n\n\t\treturn( NULL );\n\t}\n\tif( sequence_object->current_index < 0 )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_ValueError,\n\t\t \"%s: invalid sequence object - invalid current index.\",\n\t\t function );\n\n\t\treturn( NULL );\n\t}\n\tif( sequence_object->number_of_items < 0 )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_ValueError,\n\t\t \"%s: invalid sequence object - invalid number of items.\",\n\t\t function );\n\n\t\treturn( NULL );\n\t}\n\tif( sequence_object->current_index >= sequence_object->number_of_items )\n\t{\n\t\tPyErr_SetNone(\n\t\t PyExc_StopIteration );\n\n\t\treturn( NULL );\n\t}\n\trecord_object = sequence_object->get_item_by_index(\n\t sequence_object->parent_object,\n\t sequence_object->current_index );\n\n\tif( record_object != NULL )\n\t{\n\t\tsequence_object->current_index++;\n\t}\n\treturn( record_object );\n}\n\n" }, { "path": "pyevtx/pyevtx_records.h", "content": "/*\n * Python object definition of the sequence and iterator object of records\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#if !defined( _PYEVTX_RECORDS_H )\n#define _PYEVTX_RECORDS_H\n\n#include \n#include \n\n#include \"pyevtx_libevtx.h\"\n#include \"pyevtx_python.h\"\n\n#if defined( __cplusplus )\nextern \"C\" {\n#endif\n\ntypedef struct pyevtx_records pyevtx_records_t;\n\nstruct pyevtx_records\n{\n\t/* Python object initialization\n\t */\n\tPyObject_HEAD\n\n\t/* The parent object\n\t */\n\tPyObject *parent_object;\n\n\t/* The get item by index callback function\n\t */\n\tPyObject* (*get_item_by_index)(\n\t PyObject *parent_object,\n\t int index );\n\n\t/* The current index\n\t */\n\tint current_index;\n\n\t/* The number of items\n\t */\n\tint number_of_items;\n};\n\nextern PyTypeObject pyevtx_records_type_object;\n\nPyObject *pyevtx_records_new(\n PyObject *parent_object,\n PyObject* (*get_item_by_index)(\n PyObject *parent_object,\n int index ),\n int number_of_items );\n\nint pyevtx_records_init(\n pyevtx_records_t *sequence_object );\n\nvoid pyevtx_records_free(\n pyevtx_records_t *sequence_object );\n\nPy_ssize_t pyevtx_records_len(\n pyevtx_records_t *sequence_object );\n\nPyObject *pyevtx_records_getitem(\n pyevtx_records_t *sequence_object,\n Py_ssize_t item_index );\n\nPyObject *pyevtx_records_iter(\n pyevtx_records_t *sequence_object );\n\nPyObject *pyevtx_records_iternext(\n pyevtx_records_t *sequence_object );\n\n#if defined( __cplusplus )\n}\n#endif\n\n#endif /* !defined( _PYEVTX_RECORDS_H ) */\n\n" }, { "path": "pyevtx/pyevtx_strings.c", "content": "/*\n * Python object definition of the sequence and iterator object of strings\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#include \n#include \n\n#if defined( HAVE_STDLIB_H ) || defined( HAVE_WINAPI )\n#include \n#endif\n\n#include \"pyevtx_libcerror.h\"\n#include \"pyevtx_libevtx.h\"\n#include \"pyevtx_python.h\"\n#include \"pyevtx_strings.h\"\n\nPySequenceMethods pyevtx_strings_sequence_methods = {\n\t/* sq_length */\n\t(lenfunc) pyevtx_strings_len,\n\t/* sq_concat */\n\t0,\n\t/* sq_repeat */\n\t0,\n\t/* sq_item */\n\t(ssizeargfunc) pyevtx_strings_getitem,\n\t/* sq_slice */\n\t0,\n\t/* sq_ass_item */\n\t0,\n\t/* sq_ass_slice */\n\t0,\n\t/* sq_contains */\n\t0,\n\t/* sq_inplace_concat */\n\t0,\n\t/* sq_inplace_repeat */\n\t0\n};\n\nPyTypeObject pyevtx_strings_type_object = {\n\tPyVarObject_HEAD_INIT( NULL, 0 )\n\n\t/* tp_name */\n\t\"pyevtx.strings\",\n\t/* tp_basicsize */\n\tsizeof( pyevtx_strings_t ),\n\t/* tp_itemsize */\n\t0,\n\t/* tp_dealloc */\n\t(destructor) pyevtx_strings_free,\n\t/* tp_print */\n\t0,\n\t/* tp_getattr */\n\t0,\n\t/* tp_setattr */\n\t0,\n\t/* tp_compare */\n\t0,\n\t/* tp_repr */\n\t0,\n\t/* tp_as_number */\n\t0,\n\t/* tp_as_sequence */\n\t&pyevtx_strings_sequence_methods,\n\t/* tp_as_mapping */\n\t0,\n\t/* tp_hash */\n\t0,\n\t/* tp_call */\n\t0,\n\t/* tp_str */\n\t0,\n\t/* tp_getattro */\n\t0,\n\t/* tp_setattro */\n\t0,\n\t/* tp_as_buffer */\n\t0,\n\t/* tp_flags */\n\tPy_TPFLAGS_DEFAULT | Py_TPFLAGS_HAVE_ITER,\n\t/* tp_doc */\n\t\"pyevtx sequence and iterator object of strings\",\n\t/* tp_traverse */\n\t0,\n\t/* tp_clear */\n\t0,\n\t/* tp_richcompare */\n\t0,\n\t/* tp_weaklistoffset */\n\t0,\n\t/* tp_iter */\n\t(getiterfunc) pyevtx_strings_iter,\n\t/* tp_iternext */\n\t(iternextfunc) pyevtx_strings_iternext,\n\t/* tp_methods */\n\t0,\n\t/* tp_members */\n\t0,\n\t/* tp_getset */\n\t0,\n\t/* tp_base */\n\t0,\n\t/* tp_dict */\n\t0,\n\t/* tp_descr_get */\n\t0,\n\t/* tp_descr_set */\n\t0,\n\t/* tp_dictoffset */\n\t0,\n\t/* tp_init */\n\t(initproc) pyevtx_strings_init,\n\t/* tp_alloc */\n\t0,\n\t/* tp_new */\n\t0,\n\t/* tp_free */\n\t0,\n\t/* tp_is_gc */\n\t0,\n\t/* tp_bases */\n\tNULL,\n\t/* tp_mro */\n\tNULL,\n\t/* tp_cache */\n\tNULL,\n\t/* tp_subclasses */\n\tNULL,\n\t/* tp_weaklist */\n\tNULL,\n\t/* tp_del */\n\t0\n};\n\n/* Creates a new strings sequence and iterator object\n * Returns a Python object if successful or NULL on error\n */\nPyObject *pyevtx_strings_new(\n PyObject *parent_object,\n PyObject* (*get_item_by_index)(\n PyObject *parent_object,\n int index ),\n int number_of_items )\n{\n\tpyevtx_strings_t *sequence_object = NULL;\n\tstatic char *function = \"pyevtx_strings_new\";\n\n\tif( parent_object == NULL )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_ValueError,\n\t\t \"%s: invalid parent object.\",\n\t\t function );\n\n\t\treturn( NULL );\n\t}\n\tif( get_item_by_index == NULL )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_ValueError,\n\t\t \"%s: invalid get item by index function.\",\n\t\t function );\n\n\t\treturn( NULL );\n\t}\n\t/* Make sure the strings values are initialized\n\t */\n\tsequence_object = PyObject_New(\n\t struct pyevtx_strings,\n\t &pyevtx_strings_type_object );\n\n\tif( sequence_object == NULL )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_MemoryError,\n\t\t \"%s: unable to create sequence object.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tsequence_object->parent_object = parent_object;\n\tsequence_object->get_item_by_index = get_item_by_index;\n\tsequence_object->current_index = 0;\n\tsequence_object->number_of_items = number_of_items;\n\n\tPy_IncRef(\n\t (PyObject *) sequence_object->parent_object );\n\n\treturn( (PyObject *) sequence_object );\n\non_error:\n\tif( sequence_object != NULL )\n\t{\n\t\tPy_DecRef(\n\t\t (PyObject *) sequence_object );\n\t}\n\treturn( NULL );\n}\n\n/* Initializes a strings sequence and iterator object\n * Returns 0 if successful or -1 on error\n */\nint pyevtx_strings_init(\n pyevtx_strings_t *sequence_object )\n{\n\tstatic char *function = \"pyevtx_strings_init\";\n\n\tif( sequence_object == NULL )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_ValueError,\n\t\t \"%s: invalid sequence object.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\t/* Make sure the strings values are initialized\n\t */\n\tsequence_object->parent_object = NULL;\n\tsequence_object->get_item_by_index = NULL;\n\tsequence_object->current_index = 0;\n\tsequence_object->number_of_items = 0;\n\n\tPyErr_Format(\n\t PyExc_NotImplementedError,\n\t \"%s: initialize of strings not supported.\",\n\t function );\n\n\treturn( -1 );\n}\n\n/* Frees a strings sequence object\n */\nvoid pyevtx_strings_free(\n pyevtx_strings_t *sequence_object )\n{\n\tstruct _typeobject *ob_type = NULL;\n\tstatic char *function = \"pyevtx_strings_free\";\n\n\tif( sequence_object == NULL )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_ValueError,\n\t\t \"%s: invalid sequence object.\",\n\t\t function );\n\n\t\treturn;\n\t}\n\tob_type = Py_TYPE(\n\t sequence_object );\n\n\tif( ob_type == NULL )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_ValueError,\n\t\t \"%s: missing ob_type.\",\n\t\t function );\n\n\t\treturn;\n\t}\n\tif( ob_type->tp_free == NULL )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_ValueError,\n\t\t \"%s: invalid ob_type - missing tp_free.\",\n\t\t function );\n\n\t\treturn;\n\t}\n\tif( sequence_object->parent_object != NULL )\n\t{\n\t\tPy_DecRef(\n\t\t (PyObject *) sequence_object->parent_object );\n\t}\n\tob_type->tp_free(\n\t (PyObject*) sequence_object );\n}\n\n/* The strings len() function\n */\nPy_ssize_t pyevtx_strings_len(\n pyevtx_strings_t *sequence_object )\n{\n\tstatic char *function = \"pyevtx_strings_len\";\n\n\tif( sequence_object == NULL )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_ValueError,\n\t\t \"%s: invalid sequence object.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\treturn( (Py_ssize_t) sequence_object->number_of_items );\n}\n\n/* The strings getitem() function\n */\nPyObject *pyevtx_strings_getitem(\n pyevtx_strings_t *sequence_object,\n Py_ssize_t item_index )\n{\n\tPyObject *string_object = NULL;\n\tstatic char *function = \"pyevtx_strings_getitem\";\n\n\tif( sequence_object == NULL )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_ValueError,\n\t\t \"%s: invalid sequence object.\",\n\t\t function );\n\n\t\treturn( NULL );\n\t}\n\tif( sequence_object->get_item_by_index == NULL )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_ValueError,\n\t\t \"%s: invalid sequence object - missing get item by index function.\",\n\t\t function );\n\n\t\treturn( NULL );\n\t}\n\tif( sequence_object->number_of_items < 0 )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_ValueError,\n\t\t \"%s: invalid sequence object - invalid number of items.\",\n\t\t function );\n\n\t\treturn( NULL );\n\t}\n\tif( ( item_index < 0 )\n\t || ( item_index >= (Py_ssize_t) sequence_object->number_of_items ) )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_ValueError,\n\t\t \"%s: invalid invalid item index value out of bounds.\",\n\t\t function );\n\n\t\treturn( NULL );\n\t}\n\tstring_object = sequence_object->get_item_by_index(\n\t sequence_object->parent_object,\n\t (int) item_index );\n\n\treturn( string_object );\n}\n\n/* The strings iter() function\n */\nPyObject *pyevtx_strings_iter(\n pyevtx_strings_t *sequence_object )\n{\n\tstatic char *function = \"pyevtx_strings_iter\";\n\n\tif( sequence_object == NULL )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_ValueError,\n\t\t \"%s: invalid sequence object.\",\n\t\t function );\n\n\t\treturn( NULL );\n\t}\n\tPy_IncRef(\n\t (PyObject *) sequence_object );\n\n\treturn( (PyObject *) sequence_object );\n}\n\n/* The strings iternext() function\n */\nPyObject *pyevtx_strings_iternext(\n pyevtx_strings_t *sequence_object )\n{\n\tPyObject *string_object = NULL;\n\tstatic char *function = \"pyevtx_strings_iternext\";\n\n\tif( sequence_object == NULL )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_ValueError,\n\t\t \"%s: invalid sequence object.\",\n\t\t function );\n\n\t\treturn( NULL );\n\t}\n\tif( sequence_object->get_item_by_index == NULL )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_ValueError,\n\t\t \"%s: invalid sequence object - missing get item by index function.\",\n\t\t function );\n\n\t\treturn( NULL );\n\t}\n\tif( sequence_object->current_index < 0 )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_ValueError,\n\t\t \"%s: invalid sequence object - invalid current index.\",\n\t\t function );\n\n\t\treturn( NULL );\n\t}\n\tif( sequence_object->number_of_items < 0 )\n\t{\n\t\tPyErr_Format(\n\t\t PyExc_ValueError,\n\t\t \"%s: invalid sequence object - invalid number of items.\",\n\t\t function );\n\n\t\treturn( NULL );\n\t}\n\tif( sequence_object->current_index >= sequence_object->number_of_items )\n\t{\n\t\tPyErr_SetNone(\n\t\t PyExc_StopIteration );\n\n\t\treturn( NULL );\n\t}\n\tstring_object = sequence_object->get_item_by_index(\n\t sequence_object->parent_object,\n\t sequence_object->current_index );\n\n\tif( string_object != NULL )\n\t{\n\t\tsequence_object->current_index++;\n\t}\n\treturn( string_object );\n}\n\n" }, { "path": "pyevtx/pyevtx_strings.h", "content": "/*\n * Python object definition of the sequence and iterator object of strings\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#if !defined( _PYEVTX_STRINGS_H )\n#define _PYEVTX_STRINGS_H\n\n#include \n#include \n\n#include \"pyevtx_libevtx.h\"\n#include \"pyevtx_python.h\"\n\n#if defined( __cplusplus )\nextern \"C\" {\n#endif\n\ntypedef struct pyevtx_strings pyevtx_strings_t;\n\nstruct pyevtx_strings\n{\n\t/* Python object initialization\n\t */\n\tPyObject_HEAD\n\n\t/* The parent object\n\t */\n\tPyObject *parent_object;\n\n\t/* The get item by index callback function\n\t */\n\tPyObject* (*get_item_by_index)(\n\t PyObject *parent_object,\n\t int index );\n\n\t/* The current index\n\t */\n\tint current_index;\n\n\t/* The number of items\n\t */\n\tint number_of_items;\n};\n\nextern PyTypeObject pyevtx_strings_type_object;\n\nPyObject *pyevtx_strings_new(\n PyObject *parent_object,\n PyObject* (*get_item_by_index)(\n PyObject *parent_object,\n int index ),\n int number_of_items );\n\nint pyevtx_strings_init(\n pyevtx_strings_t *sequence_object );\n\nvoid pyevtx_strings_free(\n pyevtx_strings_t *sequence_object );\n\nPy_ssize_t pyevtx_strings_len(\n pyevtx_strings_t *sequence_object );\n\nPyObject *pyevtx_strings_getitem(\n pyevtx_strings_t *sequence_object,\n Py_ssize_t item_index );\n\nPyObject *pyevtx_strings_iter(\n pyevtx_strings_t *sequence_object );\n\nPyObject *pyevtx_strings_iternext(\n pyevtx_strings_t *sequence_object );\n\n#if defined( __cplusplus )\n}\n#endif\n\n#endif /* !defined( _PYEVTX_STRINGS_H ) */\n\n" }, { "path": "pyevtx/pyevtx_unused.h", "content": "/*\n * Definitions to silence compiler warnings about unused function attributes/parameters.\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#if !defined( _PYEVTX_UNUSED_H )\n#define _PYEVTX_UNUSED_H\n\n#include \n\n#if !defined( PYEVTX_ATTRIBUTE_UNUSED )\n#if defined( __GNUC__ ) && __GNUC__ >= 3\n#define PYEVTX_ATTRIBUTE_UNUSED\t__attribute__ ((__unused__))\n#else\n#define PYEVTX_ATTRIBUTE_UNUSED\n#endif\n#endif\n\n#if defined( _MSC_VER )\n#define PYEVTX_UNREFERENCED_PARAMETER( parameter ) \\\n\tUNREFERENCED_PARAMETER( parameter );\n#else\n#define PYEVTX_UNREFERENCED_PARAMETER( parameter ) \\\n\t/* parameter */\n#endif\n\n#endif /* !defined( _PYEVTX_UNUSED_H ) */\n\n" }, { "path": "pyproject.toml", "content": "[build-system]\nrequires = [\"setuptools\", \"wheel\"]\nbuild-backend = \"setuptools.build_meta\"\n\n" }, { "path": "runtests.ps1", "content": "# Script that runs the tests\n#\n# Version: 20220103\n\n$ExitSuccess = 0\n$ExitFailure = 1\n$ExitIgnore = 77\n\nSet-Location -Path \"tests\"\n\n$Result = ${ExitSuccess}\n\n$Lines = Get-Content \"Makefile.am\"\n$InTests = $FALSE\n\nForeach (${Line} in ${Lines})\n{\n\tIf (${InTests})\n\t{\n\t\tIf (-Not ${Line})\n\t\t{\n\t\t\t${InTests} = $FALSE\n\n\t\t\tContinue\n\t\t}\n\t\t${Line} = ${Line}.TrimStart()\n\n\t\tIf (${Line}.EndsWith(\" \\\"))\n\t\t{\n\t\t\t${Line} = ${Line}.Substring(0, ${Line}.Length - 2)\n\t\t}\n\t\tIf (-Not (${Line}.EndsWith(\".sh\")))\n\t\t{\n\t\t\tContinue\n\t\t}\n\t\t${Line} = ${Line}.Substring(0, ${Line}.Length - 3)\n\t\t${Line} = \".\\${Line}.ps1\"\n\n\t\tTry\n\t\t{\n\t\t\tInvoke-Expression ${Line}\n\t\t}\n\t\tCatch\n\t\t{\n\t\t\t$LastExitCode = ${ExitIgnore}\n\t\t}\n\t\tIf (${LastExitCode} -eq ${ExitFailure})\n\t\t{\n\t\t\t$Result = ${ExitFailure}\n\t\t\tWrite-Host \"FAIL\" -foreground Red -nonewline\n\t\t}\n\t\tElseIf (${LastExitCode} -eq ${ExitIgnore})\n\t\t{\n\t\t\tWrite-Host \"SKIP\" -foreground Cyan -nonewline\n\t\t}\n\t\tElse\n\t\t{\n\t\t\tWrite-Host \"PASS\" -foreground Green -nonewline\n\t\t}\n\t\tWrite-Host \": ${Line}\"\n\t}\n\tElseIf (${Line}.StartsWith(\"TESTS = \"))\n\t{\n\t\t${InTests} = $TRUE\n\t}\n}\n\nSet-Location -Path \"..\"\n\nExit ${Result}\n" }, { "path": "runtests.sh", "content": "#!/usr/bin/env bash\n# Script that runs the tests\n#\n# Version: 20231119\n\nEXIT_SUCCESS=0;\nEXIT_FAILURE=1;\n\nrun_configure_make()\n{\n\tlocal CONFIGURE_OPTIONS=$@;\n\n\t./configure ${CONFIGURE_OPTIONS[@]};\n\tRESULT=$?;\n\n\tif test ${RESULT} -ne ${EXIT_SUCCESS};\n\tthen\n\t\techo \"Running: './configure' failed\";\n\n\t\treturn ${RESULT};\n\tfi\n\n\tmake clean > /dev/null;\n\tRESULT=$?;\n\n\tif test ${RESULT} -ne ${EXIT_SUCCESS};\n\tthen\n\t\techo \"Running: 'make clean' failed\";\n\n\t\treturn ${RESULT};\n\tfi\n\n\tmake > /dev/null;\n\tRESULT=$?;\n\n\tif test ${RESULT} -ne ${EXIT_SUCCESS};\n\tthen\n\t\techo \"Running: 'make' failed\";\n\n\t\treturn ${RESULT};\n\tfi\n\treturn ${EXIT_SUCCESS};\n}\n\nrun_configure_make_check()\n{\n\trun_configure_make $@;\n\tRESULT=$?;\n\n\tif test ${RESULT} -ne ${EXIT_SUCCESS};\n\tthen\n\t\treturn ${RESULT};\n\tfi\n\n\tmake check CHECK_WITH_STDERR=1;\n\tRESULT=$?;\n\n\tif test ${RESULT} -ne ${EXIT_SUCCESS};\n\tthen\n\t\techo \"Running: 'make check' failed\";\n\n\t\tif test -f tests/test-suite.log;\n\t\tthen\n\t\t\tcat tests/test-suite.log;\n\t\tfi\n\n\t\treturn ${RESULT};\n\tfi\n\treturn ${EXIT_SUCCESS};\n}\n\nrun_configure_make_check_with_asan()\n{\n\tlocal LDCONFIG=`which ldconfig 2> /dev/null`;\n\n\tif test -z ${LDCONFIG} || test ! -x ${LDCONFIG};\n\tthen\n\t\treturn ${EXIT_SUCCESS};\n\tfi\n\tlocal LIBASAN=`ldconfig -p | grep libasan | sed 's/^.* => //' | sort | tail -n 1`;\n\n\tif test -z ${LIBASAN} || test ! -f ${LIBASAN};\n\tthen\n\t\treturn ${EXIT_SUCCESS};\n\tfi\n\n\t# Using libasan is platform dependent.\n\texport CPPFLAGS=\"-DHAVE_ASAN\";\n\texport CFLAGS=\"-fno-omit-frame-pointer -fsanitize=address -g\";\n\texport LDFLAGS=\"-fsanitize=address -g\";\n\n\tif test -z ${CC} || test ${CC} != \"clang\";\n\tthen\n\t\tLDFLAGS=\"${LDFLAGS} -lasan\";\n\tfi\n\n\trun_configure_make $@;\n\tRESULT=$?;\n\n\texport CPPFLAGS=;\n\texport CFLAGS=;\n\texport LDFLAGS=;\n\n\tif test ${RESULT} -ne ${EXIT_SUCCESS};\n\tthen\n\t\treturn ${RESULT};\n\tfi\n\n\tmake check CHECK_WITH_ASAN=1 CHECK_WITH_STDERR=1;\n\tRESULT=$?;\n\n\tif test ${RESULT} -ne ${EXIT_SUCCESS};\n\tthen\n\t\techo \"Running: 'make check' failed\";\n\n\t\tif test -f tests/test-suite.log;\n\t\tthen\n\t\t\tcat tests/test-suite.log;\n\t\tfi\n\n\t\treturn ${RESULT};\n\tfi\n\treturn ${RESULT};\n}\n\nrun_configure_make_check_with_coverage()\n{\n\t# Disable optimization so we can hook malloc and realloc.\n\texport CPPFLAGS=\"-DOPTIMIZATION_DISABLED\";\n\texport CFLAGS=\"--coverage -O0\";\n\texport LDFLAGS=\"--coverage\";\n\n\t# Disable creating a shared library so we can hook memset.\n\trun_configure_make_check $@;\n\tRESULT=$?;\n\n\texport CPPFLAGS=;\n\texport CFLAGS=;\n\texport LDFLAGS=;\n\n\treturn ${RESULT};\n}\n\nrun_configure_make_check_python()\n{\n\trun_configure_make $@;\n\tRESULT=$?;\n\n\tif test ${RESULT} -ne ${EXIT_SUCCESS};\n\tthen\n\t\treturn ${RESULT};\n\tfi\n\n\tmake check CHECK_WITH_STDERR=1 SKIP_LIBRARY_TESTS=1 SKIP_TOOLS_TESTS=1;\n\tRESULT=$?;\n\n\tif test ${RESULT} -ne ${EXIT_SUCCESS};\n\tthen\n\t\techo \"Running: 'make check' failed\";\n\n\t\tif test -f tests/test-suite.log;\n\t\tthen\n\t\t\tcat tests/test-suite.log;\n\t\tfi\n\n\t\treturn ${RESULT};\n\tfi\n\treturn ${EXIT_SUCCESS};\n}\n\nrun_setup_py_tests()\n{\n\t# Skip this test when running Cygwin on AppVeyor.\n\tif test -n \"${APPVEYOR}\" && test ${TARGET} = \"cygwin\";\n\tthen\n\t\techo \"Running: 'setup.py build' skipped\";\n\n\t\treturn ${EXIT_SUCCESS};\n\tfi\n\tPYTHON=$1;\n\n\t${PYTHON} setup.py build;\n\tRESULT=$?;\n\n\tif test ${RESULT} -ne ${EXIT_SUCCESS};\n\tthen\n\t\techo \"Running: 'setup.py build' failed\";\n\n\t\treturn ${RESULT};\n\tfi\n\treturn ${EXIT_SUCCESS};\n}\n\nPROJECT_NAME=`basename $PWD`;\n\nCONFIGURE_HELP=`./configure --help`;\n\necho \"${CONFIGURE_HELP}\" | grep -- '--enable-wide-character-type' > /dev/null;\n\nHAVE_ENABLE_WIDE_CHARACTER_TYPE=$?;\n\necho \"${CONFIGURE_HELP}\" | grep -- '--enable-verbose-output' > /dev/null;\n\nHAVE_ENABLE_VERBOSE_OUTPUT=$?;\n\necho \"${CONFIGURE_HELP}\" | grep -- '--enable-debug-output' > /dev/null;\n\nHAVE_ENABLE_DEBUG_OUTPUT=$?;\n\necho \"${CONFIGURE_HELP}\" | grep -- '--with-bzip2' > /dev/null;\n\nHAVE_WITH_BZIP2=$?;\n\necho \"${CONFIGURE_HELP}\" | grep -- '--with-libfuse' > /dev/null;\n\nHAVE_WITH_LIBFUSE=$?;\n\necho \"${CONFIGURE_HELP}\" | grep -- '--with-lzma' > /dev/null;\n\nHAVE_WITH_LZMA=$?;\n\necho \"${CONFIGURE_HELP}\" | grep -- '--with-pthread' > /dev/null;\n\nHAVE_WITH_PTHREAD=$?;\n\necho \"${CONFIGURE_HELP}\" | grep -- '--with-openssl' > /dev/null;\n\nHAVE_WITH_OPENSSL=$?;\n\necho \"${CONFIGURE_HELP}\" | grep -- '--with-zlib' > /dev/null;\n\nHAVE_WITH_ZLIB=$?;\n\necho \"${CONFIGURE_HELP}\" | grep -- '--enable-python' > /dev/null;\n\nHAVE_ENABLE_PYTHON=$?;\n\necho \"${CONFIGURE_HELP}\" | grep -- '--enable-static-executables' > /dev/null;\n\nHAVE_ENABLE_STATIC_EXECUTABLES=$?;\n\nPYTHON_CONFIG=\"\";\n\nif test -x /usr/bin/whereis;\nthen\n\tPYTHON_CONFIG=`/usr/bin/whereis python-config | sed 's/^.*:[ ]*//' 2> /dev/null`;\nfi\n\n# Test \"./configure && make && make check\" without options.\n\nrun_configure_make_check;\nRESULT=$?;\n\nif test ${RESULT} -ne ${EXIT_SUCCESS};\nthen\n\texit ${EXIT_FAILURE};\nfi\n\nif test ${HAVE_ENABLE_VERBOSE_OUTPUT} -eq 0 && test ${HAVE_ENABLE_DEBUG_OUTPUT} -eq 0;\nthen\n\t# Test \"./configure && make && make check\" with verbose and debug output.\n\n\trun_configure_make_check \"--enable-verbose-output --enable-debug-output\";\n\tRESULT=$?;\n\n\tif test ${RESULT} -ne ${EXIT_SUCCESS};\n\tthen\n\t\texit ${EXIT_FAILURE};\n\tfi\nfi\n\nif test ${HAVE_WITH_PTHREAD} -eq 0 && test ${PROJECT_NAME} != \"libcthreads\";\nthen\n\t# Test \"./configure && make && make check\" without multi-threading support.\n\n\trun_configure_make_check \"--with-pthread=no\";\n\tRESULT=$?;\n\n\tif test ${RESULT} -ne ${EXIT_SUCCESS};\n\tthen\n\t\texit ${EXIT_FAILURE};\n\tfi\nfi\n\nif test ${HAVE_WITH_ZLIB} -eq 0;\nthen\n\t# Test \"./configure && make && make check\" with fallback zlib implementation.\n\n\trun_configure_make_check \"--with-zlib=no\";\n\tRESULT=$?;\n\n\tif test ${RESULT} -ne ${EXIT_SUCCESS};\n\tthen\n\t\texit ${EXIT_FAILURE};\n\tfi\nfi\n\nif test ${HAVE_WITH_OPENSSL} -eq 0;\nthen\n\t# Test \"./configure && make && make check\" with fallback crypto implementation.\n\n\trun_configure_make_check \"--with-openssl=no\";\n\tRESULT=$?;\n\n\tif test ${RESULT} -ne ${EXIT_SUCCESS};\n\tthen\n\t\texit ${EXIT_FAILURE};\n\tfi\n\n\t# Test \"./configure && make && make check\" with OpenSSL non-EVP implementation.\n\n\trun_configure_make_check \"--enable-openssl-evp-cipher=no --enable-openssl-evp-md=no\";\n\tRESULT=$?;\n\n\tif test ${RESULT} -ne ${EXIT_SUCCESS};\n\tthen\n\t\texit ${EXIT_FAILURE};\n\tfi\n\n\t# Test \"./configure && make && make check\" with OpenSSL EVP implementation.\n\n\trun_configure_make_check \"--enable-openssl-evp-cipher=yes --enable-openssl-evp-md=yes\";\n\tRESULT=$?;\n\n\tif test ${RESULT} -ne ${EXIT_SUCCESS};\n\tthen\n\t\texit ${EXIT_FAILURE};\n\tfi\nfi\n\nif test ${HAVE_ENABLE_PYTHON} -eq 0 && test -n \"${PYTHON_CONFIG}\";\nthen\n\trun_configure_make_check_python \"--enable-python\";\n\tRESULT=$?;\n\n\tif test ${RESULT} -ne ${EXIT_SUCCESS};\n\tthen\n\t\texit ${EXIT_FAILURE};\n\tfi\n\n\tPYTHON=`which python 2> /dev/null`;\n\n\tif test -f \"setup.py\" && ! run_setup_py_tests ${PYTHON};\n\tthen\n\t\texit ${EXIT_FAILURE};\n\tfi\nfi\n\nif test ${HAVE_ENABLE_STATIC_EXECUTABLES} -eq 0;\nthen\n\tCONFIGURE_OPTIONS=\"--enable-static-executables --enable-multi-threading-support=no\";\n\n\tif test ${HAVE_WITH_BZIP2} -eq 0;\n\tthen\n\t\tCONFIGURE_OPTIONS=\"${CONFIGURE_OPTIONS} --with-bzip2=no\";\n\tfi\n\tif test ${HAVE_WITH_LIBFUSE} -eq 0;\n\tthen\n\t\tCONFIGURE_OPTIONS=\"${CONFIGURE_OPTIONS} --with-libfuse=no\";\n\tfi\n\tif test ${HAVE_WITH_LZMA} -eq 0;\n\tthen\n\t\tCONFIGURE_OPTIONS=\"${CONFIGURE_OPTIONS} --with-lzma=no\";\n\tfi\n\tif test ${HAVE_WITH_OPENSSL} -eq 0;\n\tthen\n\t\tCONFIGURE_OPTIONS=\"${CONFIGURE_OPTIONS} --with-openssl=no\";\n\tfi\n\tif test ${HAVE_WITH_ZLIB} -eq 0;\n\tthen\n\t\tCONFIGURE_OPTIONS=\"${CONFIGURE_OPTIONS} --with-zlib=no\";\n\tfi\n\trun_configure_make_check ${CONFIGURE_OPTIONS};\n\tRESULT=$?;\n\n\tif test ${RESULT} -ne ${EXIT_SUCCESS};\n\tthen\n\t\texit ${EXIT_FAILURE};\n\tfi\nfi\n\n# Run tests with asan.\nCONFIGURE_OPTIONS=\"\";\n\nif test ${HAVE_ENABLE_WIDE_CHARACTER_TYPE} -eq 0;\nthen\n\tCONFIGURE_OPTIONS=\"${CONFIGURE_OPTIONS} --enable-wide-character-type\";\nfi\nif test ${HAVE_WITH_BZIP2} -eq 0;\nthen\n\tCONFIGURE_OPTIONS=\"${CONFIGURE_OPTIONS} --with-bzip2=no\";\nfi\nif test ${HAVE_WITH_LZMA} -eq 0;\nthen\n\tCONFIGURE_OPTIONS=\"${CONFIGURE_OPTIONS} --with-lzma=no\";\nfi\nif test ${HAVE_WITH_OPENSSL} -eq 0;\nthen\n\tCONFIGURE_OPTIONS=\"${CONFIGURE_OPTIONS} --with-openssl=no\";\nfi\nif test ${HAVE_WITH_ZLIB} -eq 0;\nthen\n\tCONFIGURE_OPTIONS=\"${CONFIGURE_OPTIONS} --with-zlib=no\";\nfi\nif test ${HAVE_ENABLE_PYTHON} -eq 0 && test -n \"${PYTHON_CONFIG}\";\nthen\n\t# Issue with running the python bindings with asan disabled for now.\n\t# CONFIGURE_OPTIONS=\"${CONFIGURE_OPTIONS} --enable-python\";\n\tCONFIGURE_OPTIONS=\"${CONFIGURE_OPTIONS}\";\nfi\n\nrun_configure_make_check_with_asan ${CONFIGURE_OPTIONS};\nRESULT=$?;\n\nif test ${RESULT} -ne ${EXIT_SUCCESS};\nthen\n\texit ${EXIT_FAILURE};\nfi\n\n# Run tests with coverage.\nCONFIGURE_OPTIONS=\"--enable-shared=no\";\n\nif test ${HAVE_ENABLE_WIDE_CHARACTER_TYPE} -eq 0;\nthen\n\tCONFIGURE_OPTIONS=\"${CONFIGURE_OPTIONS} --enable-wide-character-type\";\nfi\nif test ${HAVE_WITH_BZIP2} -eq 0;\nthen\n\tCONFIGURE_OPTIONS=\"${CONFIGURE_OPTIONS} --with-bzip2=no\";\nfi\nif test ${HAVE_WITH_LZMA} -eq 0;\nthen\n\tCONFIGURE_OPTIONS=\"${CONFIGURE_OPTIONS} --with-lzma=no\";\nfi\nif test ${HAVE_WITH_OPENSSL} -eq 0;\nthen\n\tCONFIGURE_OPTIONS=\"${CONFIGURE_OPTIONS} --with-openssl=no\";\nfi\nif test ${HAVE_WITH_ZLIB} -eq 0;\nthen\n\tCONFIGURE_OPTIONS=\"${CONFIGURE_OPTIONS} --with-zlib=no\";\nfi\n\nrun_configure_make_check_with_coverage ${CONFIGURE_OPTIONS};\nRESULT=$?;\n\nif test ${RESULT} -ne ${EXIT_SUCCESS};\nthen\n\texit ${EXIT_FAILURE};\nfi\n\nexit ${EXIT_SUCCESS};\n\n" }, { "path": "setup.cfg.in", "content": "[metadata]\nname = libevtx-python\nversion = @VERSION@\ndescription = Python bindings module for libevtx\nlong_description = Python bindings module for libevtx\nlong_description_content_type = text/plain\nauthor = Joachim Metz\nauthor_email = joachim.metz@gmail.com\nlicense = GNU Lesser General Public License v3 or later (LGPLv3+)\nlicense_files = COPYING*\nclassifiers =\n Development Status :: 3 - Alpha\n Programming Language :: Python\n\n[options]\npython_requires = >=3.10\n" }, { "path": "setup.py", "content": "#!/usr/bin/env python\n#\n# Script to build and install Python-bindings.\n# Version: 20251125\n\nimport copy\nimport datetime\nimport glob\nimport gzip\nimport platform\nimport os\nimport shlex\nimport shutil\nimport subprocess\nimport sys\nimport tarfile\nimport zipfile\n\nfrom setuptools import Extension\nfrom setuptools import setup\nfrom setuptools._distutils.ccompiler import new_compiler\nfrom setuptools.command.build_ext import build_ext\nfrom setuptools.command.sdist import sdist\n\n\nif (sys.version_info[0], sys.version_info[1]) < (3, 7):\n print((\"Unsupported Python version: {0:s}, version 3.7 or higher \"\n \"required.\").format(sys.version))\n sys.exit(1)\n\n\nclass custom_build_ext(build_ext):\n \"\"\"Custom handler for the build_ext command.\"\"\"\n\n def _RunCommand(self, command):\n \"\"\"Runs the command.\"\"\"\n arguments = shlex.split(command)\n process = subprocess.Popen(\n arguments, stderr=subprocess.PIPE, stdout=subprocess.PIPE,\n universal_newlines=True)\n if not process:\n raise RuntimeError(\"Running: {0:s} failed.\".format(command))\n\n output, error = process.communicate()\n if process.returncode != 0:\n error = \"\\n\".join(error.split(\"\\n\")[-5:])\n raise RuntimeError(\"Running: {0:s} failed with error:\\n{1:s}.\".format(\n command, error))\n\n return output\n\n def build_extensions(self):\n \"\"\"Set up the build extensions.\"\"\"\n # TODO: move build customization here?\n build_ext.build_extensions(self)\n\n def run(self):\n \"\"\"Runs the build extension.\"\"\"\n compiler = new_compiler(compiler=self.compiler)\n if compiler.compiler_type == \"msvc\":\n self.define = [\n (\"_CRT_SECURE_NO_WARNINGS\", \"\"),\n (\"UNICODE\", \"\"),\n ]\n\n else:\n command = \"sh configure --disable-nls --disable-shared-libs\"\n output = self._RunCommand(command)\n\n print_line = False\n for line in output.split(\"\\n\"):\n line = line.rstrip()\n if line == \"configure:\":\n print_line = True\n\n if print_line:\n print(line)\n\n self.define = [\n (\"HAVE_CONFIG_H\", \"\"),\n ]\n\n build_ext.run(self)\n\n\nclass custom_sdist(sdist):\n \"\"\"Custom handler for the sdist command.\"\"\"\n\n def run(self):\n \"\"\"Builds a source distribution (sdist) package.\"\"\"\n if self.formats != [\"gztar\"] and self.formats != [\"zip\"]:\n print(\"'setup.py sdist' unsupported format.\")\n sys.exit(1)\n\n if glob.glob(\"*.tar.gz\"):\n print(\"'setup.py sdist' remove existing *.tar.gz files from \"\n \"source directory.\")\n sys.exit(1)\n\n command = \"make dist\"\n exit_code = subprocess.call(command, shell=True)\n if exit_code != 0:\n raise RuntimeError(\"Running: {0:s} failed.\".format(command))\n\n if not os.path.exists(self.dist_dir):\n os.mkdir(self.dist_dir)\n\n source_package_file = glob.glob(\"*.tar.gz\")[0]\n source_package_prefix, _, source_package_suffix = (\n source_package_file.partition(\"-\"))\n sdist_package_file = \"{0:s}_python-{1:s}\".format(\n source_package_prefix, source_package_suffix)\n sdist_package_file = os.path.join(self.dist_dir, sdist_package_file)\n os.rename(source_package_file, sdist_package_file)\n\n # Create and add the PKG-INFO file to the source package.\n with gzip.open(sdist_package_file, \"rb\") as input_file:\n with open(sdist_package_file[:-3], \"wb\") as output_file:\n shutil.copyfileobj(input_file, output_file)\n os.remove(sdist_package_file)\n\n self.distribution.metadata.write_pkg_info(\".\")\n pkg_info_path = \"{0:s}-{1:s}/PKG-INFO\".format(\n source_package_prefix, source_package_suffix[:-7])\n with tarfile.open(sdist_package_file[:-3], \"a:\") as tar_file:\n tar_file.add(\"PKG-INFO\", arcname=pkg_info_path)\n os.remove(\"PKG-INFO\")\n\n with open(sdist_package_file[:-3], \"rb\") as input_file:\n with gzip.open(sdist_package_file, \"wb\") as output_file:\n shutil.copyfileobj(input_file, output_file)\n os.remove(sdist_package_file[:-3])\n\n # Convert the .tar.gz into a .zip\n if self.formats == [\"zip\"]:\n zip_sdist_package_file = \"{0:s}.zip\".format(sdist_package_file[:-7])\n\n with tarfile.open(sdist_package_file, \"r|gz\") as tar_file:\n with zipfile.ZipFile(\n zip_sdist_package_file, \"w\", zipfile.ZIP_DEFLATED) as zip_file:\n for tar_file_entry in tar_file:\n file_entry = tar_file.extractfile(tar_file_entry)\n if tar_file_entry.isfile():\n modification_time = datetime.datetime.fromtimestamp(\n tar_file_entry.mtime)\n zip_modification_time = (\n modification_time.year, modification_time.month,\n modification_time.day, modification_time.hour,\n modification_time.minute, modification_time.second)\n zip_info = zipfile.ZipInfo(\n date_time=zip_modification_time,\n filename=tar_file_entry.name)\n zip_info.external_attr = (tar_file_entry.mode & 0xff) << 16\n\n file_data = file_entry.read()\n zip_file.writestr(zip_info, file_data)\n\n os.remove(sdist_package_file)\n sdist_package_file = zip_sdist_package_file\n\n # Inform setuptools what files were created.\n dist_files = getattr(self.distribution, \"dist_files\", [])\n dist_files.append((\"sdist\", \"\", sdist_package_file))\n\n\nclass ProjectInformation(object):\n \"\"\"Project information.\"\"\"\n\n def __init__(self):\n \"\"\"Initializes project information.\"\"\"\n super(ProjectInformation, self).__init__()\n self.include_directories = []\n self.library_name = None\n self.library_names = []\n self.library_version = None\n\n self._ReadConfigureAc()\n self._ReadMakefileAm()\n\n @property\n def module_name(self):\n \"\"\"The Python module name.\"\"\"\n return \"py{0:s}\".format(self.library_name[3:])\n\n def _ReadConfigureAc(self):\n \"\"\"Reads configure.ac to initialize the project information.\"\"\"\n with open(\"configure.ac\", \"r\", encoding=\"utf-8\") as file_object:\n found_ac_init = False\n found_library_name = False\n for line in file_object.readlines():\n line = line.strip()\n if found_library_name:\n library_version = line[1:-2]\n self.library_version = library_version\n break\n\n elif found_ac_init:\n library_name = line[1:-2]\n self.library_name = library_name\n found_library_name = True\n\n elif line.startswith(\"AC_INIT\"):\n found_ac_init = True\n\n if not self.library_name or not self.library_version:\n raise RuntimeError(\n \"Unable to find library name and version in: configure.ac\")\n\n def _ReadMakefileAm(self):\n \"\"\"Reads Makefile.am to initialize the project information.\"\"\"\n if not self.library_name:\n raise RuntimeError(\"Missing library name\")\n\n with open(\"Makefile.am\", \"r\", encoding=\"utf-8\") as file_object:\n found_subdirs = False\n for line in file_object.readlines():\n line = line.strip()\n if found_subdirs:\n library_name, _, _ = line.partition(\" \")\n\n self.include_directories.append(library_name)\n\n if library_name.startswith(\"lib\"):\n self.library_names.append(library_name)\n\n if library_name == self.library_name:\n break\n\n elif line.startswith(\"SUBDIRS\"):\n found_subdirs = True\n\n if not self.include_directories or not self.library_names:\n raise RuntimeError(\n \"Unable to find include directories and library names in: \"\n \"Makefile.am\")\n\n\nproject_information = ProjectInformation()\n\nCMDCLASS = {\n \"build_ext\": custom_build_ext,\n \"sdist\": custom_sdist}\n\nSOURCES = []\n\n# TODO: replace by detection of MSC\nDEFINE_MACROS = []\nif platform.system() == \"Windows\":\n DEFINE_MACROS.append((\"WINVER\", \"0x0501\"))\n # TODO: determine how to handle third party DLLs.\n for library_name in project_information.library_names:\n if library_name != project_information.library_name:\n definition = \"HAVE_LOCAL_{0:s}\".format(library_name.upper())\n\n DEFINE_MACROS.append((definition, \"\"))\n\n# Put everything inside the Python module to prevent issues with finding\n# shared libaries since pip does not integrate well with the system package\n# management.\nfor library_name in project_information.library_names:\n for source_file in glob.glob(os.path.join(library_name, \"*.[ly]\")):\n generated_source_file = \"{0:s}.c\".format(source_file[:-2])\n if not os.path.exists(generated_source_file):\n raise RuntimeError(\"Missing generated source file: {0:s}\".format(\n generated_source_file))\n\n source_files = glob.glob(os.path.join(library_name, \"*.c\"))\n SOURCES.extend(source_files)\n\nsource_files = glob.glob(os.path.join(project_information.module_name, \"*.c\"))\nSOURCES.extend(source_files)\n\n# TODO: find a way to detect missing python.h\n# e.g. on Ubuntu python-dev is not installed by python-pip\n\nsetup_args = dict(\n cmdclass=CMDCLASS,\n ext_modules=[\n Extension(\n project_information.module_name,\n define_macros=DEFINE_MACROS,\n include_dirs=project_information.include_directories,\n libraries=[],\n library_dirs=[],\n sources=SOURCES\n )\n ]\n)\nsetup(**setup_args)\n\n" }, { "path": "synclibs.ps1", "content": "# Script that synchronizes the local library dependencies\n#\n# Version: 20180125\n\nParam (\n\t[switch]$UseHead = $false\n)\n\n$GitUrlPrefix = \"https://github.com/libyal\"\n$LocalLibs = \"libbfio libcdata libcdirectory libcerror libcfile libclocale libcnotify libcpath libcsplit libcthreads libexe libfcache libfdata libfdatetime libfguid libfvalue libfwevt libfwnt libregf libuna libwrc\"\n$LocalLibs = ${LocalLibs} -split \" \"\n\n$Git = \"git\"\n$WinFlex = \"..\\win_flex_bison\\win_flex.exe\"\n$WinBison = \"..\\win_flex_bison\\win_bison.exe\"\n\nForEach (${LocalLib} in ${LocalLibs})\n{\n\t# Split will return an array of a single empty string when LocalLibs is empty.\n\tIf (-Not (${LocalLib}))\n\t{\n\t\tContinue\n\t}\n\t$GitUrl = \"${GitUrlPrefix}/${LocalLib}.git\"\n\n\t# PowerShell will raise NativeCommandError if git writes to stdout or stderr\n\t# therefore 2>&1 is added and the output is stored in a variable.\n\t$Output = Invoke-Expression -Command \"${Git} clone ${GitUrl} ${LocalLib}-${pid} 2>&1\"\n\n\tPush-Location \"${LocalLib}-${pid}\"\n\n\tTry\n\t{\n\t\t$Output = Invoke-Expression -Command \"${Git} fetch --quiet --all --tags --prune 2>&1\"\n\n\t\t$LatestTag = Invoke-Expression -Command \"${Git} describe --tags --abbrev=0 2>&1\"\n\n\t\tIf (${LatestTag} -and -not ${UseHead})\n\t\t{\n\t\t\tWrite-Host \"Synchronizing: ${LocalLib} from ${GitUrl} tag ${LatestTag}\"\n\n\t\t\t$Output = Invoke-Expression -Command \"${Git} checkout --quiet tags/${LatestTag} 2>&1\"\n\t\t}\n\t\tElse\n\t\t{\n\t\t\tWrite-Host \"Synchronizing: ${LocalLib} from ${GitUrl} HEAD\"\n\t\t}\n\t}\n\tFinally\n\t{\n\t\tPop-Location\n\t}\n\tIf (Test-Path ${LocalLib}-${pid})\n\t{\n\t\t$LocalLibVersion = Get-Content -Path ${LocalLib}-${pid}\\configure.ac | select -skip 4 -first 1 | % { $_ -Replace \" \\[\",\"\" } | % { $_ -Replace \"\\],\",\"\" }\n\n\t\tIf (Test-Path ${LocalLib})\n\t\t{\n\t\t\tRemove-Item -Path ${LocalLib} -Force -Recurse\n\t\t}\n\t\tNew-Item -ItemType directory -Path ${LocalLib} -Force | Out-Null\n\n\t\tIf (Test-Path ${LocalLib})\n\t\t{\n\t\t\tCopy-Item -Path ${LocalLib}-${pid}\\${LocalLib}\\*.[chly] -Destination ${LocalLib}\\\n\t\t\tGet-Content -Path ${LocalLib}-${pid}\\${LocalLib}\\${LocalLib}_definitions.h.in | % { $_ -Replace \"@VERSION@\",${LocalLibVersion} } > ${LocalLib}\\${LocalLib}_definitions.h\n\t\t}\n\t\tRemove-Item -Path ${LocalLib}-${pid} -Force -Recurse\n\n\t\t$NamePrefix = \"\"\n\n\t\tForEach (${DirectoryElement} in Get-ChildItem -Path \"${LocalLib}\\*.l\")\n\t\t{\n\t\t\t$OutputFile = ${DirectoryElement} -Replace \".l$\",\".c\"\n\n\t\t\t$NamePrefix = Split-Path -path ${DirectoryElement} -leaf\n\t\t\t$NamePrefix = ${NamePrefix} -Replace \"^${LocalLib}_\",\"\"\n\t\t\t$NamePrefix = ${NamePrefix} -Replace \".l$\",\"_\"\n\n\t\t\t# PowerShell will raise NativeCommandError if win_flex writes to stdout or stderr\n\t\t\t# therefore 2>&1 is added and the output is stored in a variable.\n\t\t\t$Output = Invoke-Expression -Command \"& '${WinFlex}' -Cf ${DirectoryElement} 2>&1\"\n\t\t\tWrite-Host ${Output}\n\n\t\t\t# Moving manually sicne win_flex -o does not provide the expected behavior.\n\t\t\tMove-Item \"lex.yy.c\" ${OutputFile} -force\n\t\t}\n\n\t\tForEach (${DirectoryElement} in Get-ChildItem -Path \"${LocalLib}\\*.y\")\n\t\t{\n\t\t\t$OutputFile = ${DirectoryElement} -Replace \".y$\",\".c\"\n\n\t\t\t# PowerShell will raise NativeCommandError if win_bison writes to stdout or stderr\n\t\t\t# therefore 2>&1 is added and the output is stored in a variable.\n\t\t\t$Output = Invoke-Expression -Command \"& '${WinBison}' -d -v -l -p ${NamePrefix} -o ${OutputFile} ${DirectoryElement} 2>&1\"\n\t\t\tWrite-Host ${Output}\n\t\t}\n\t}\n}\n\n" }, { "path": "synclibs.sh", "content": "#!/bin/sh\n# Script that synchronizes the local library dependencies\n#\n# Version: 20240414\n\nEXIT_SUCCESS=0;\nEXIT_FAILURE=1;\n\nGIT_URL_PREFIX=\"https://github.com/libyal\";\nLOCAL_LIBS=\"libbfio libcdata libcdirectory libcerror libcfile libclocale libcnotify libcpath libcsplit libcthreads libexe libfcache libfdata libfdatetime libfguid libfvalue libfwevt libfwnt libregf libuna libwrc\";\n\nOLDIFS=$IFS;\nIFS=\" \";\n\nfor LOCAL_LIB in ${LOCAL_LIBS};\ndo\n\tGIT_URL=\"${GIT_URL_PREFIX}/${LOCAL_LIB}.git\";\n\n\tgit clone --quiet ${GIT_URL} ${LOCAL_LIB}-$$;\n\n\tif ! test -d ${LOCAL_LIB}-$$;\n\tthen\n\t\techo \"Unable to git clone: ${GIT_URL}\";\n\n\t\tIFS=$OLDIFS;\n\n\t\texit ${EXIT_FAILURE};\n\tfi\n\t(cd ${LOCAL_LIB}-$$ && git fetch --quiet --all --tags --prune)\n\n\tLATEST_TAG=`cd ${LOCAL_LIB}-$$ && git describe --tags --abbrev=0`;\n\n\tif test -n ${LATEST_TAG} && test \"$1\" != \"--use-head\";\n\tthen\n\t\techo \"Synchronizing: ${LOCAL_LIB} from ${GIT_URL} tag ${LATEST_TAG}\";\n\n\t\t(cd ${LOCAL_LIB}-$$ && git checkout --quiet tags/${LATEST_TAG});\n\telse\n\t\techo \"Synchronizing: ${LOCAL_LIB} from ${GIT_URL} HEAD\";\n\tfi\n\n\trm -rf ${LOCAL_LIB};\n\tmkdir ${LOCAL_LIB};\n\n\tif ! test -d ${LOCAL_LIB};\n\tthen\n\t\techo \"Missing directory: ${LOCAL_LIB}\";\n\n\t\tIFS=$OLDIFS;\n\n\t\texit ${EXIT_FAILURE};\n\tfi\n\n\tLOCAL_LIB_UPPER=`echo \"${LOCAL_LIB}\" | tr \"[a-z]\" \"[A-Z]\"`;\n\t# Note that sed on FreeBSD does not support \\s hence that we use [[:space:]] instead.\n\tLOCAL_LIB_VERSION=`grep -A 2 AC_INIT ${LOCAL_LIB}-$$/configure.ac | tail -n 1 | sed 's/^[[:space:]]*\\[\\([0-9]*\\)\\],[[:space:]]*$/\\1/'`;\n\tLOCAL_LIB_MAKEFILE_AM=\"${LOCAL_LIB}/Makefile.am\";\n\n\tcp ${LOCAL_LIB}-$$/${LOCAL_LIB}/*.[chly] ${LOCAL_LIB};\n\tcp ${LOCAL_LIB}-$$/${LOCAL_LIB_MAKEFILE_AM} ${LOCAL_LIB_MAKEFILE_AM};\n\n\t# Make the necessary changes to libyal/Makefile.am\n\nSED_SCRIPT=\"/AM_CPPFLAGS = / {\n\ti\\\\\nif HAVE_LOCAL_${LOCAL_LIB_UPPER}\n}\n\n/lib_LTLIBRARIES = / {\n\ts/lib_LTLIBRARIES/noinst_LTLIBRARIES/\n}\n\n/${LOCAL_LIB}\\.c/ {\n\td\n}\n\n/${LOCAL_LIB}_la_LIBADD/ {\n:loop1\n\t/${LOCAL_LIB}_la_LDFLAGS/ {\n\t\tN\n\t\ti\\\\\nendif\n\t\td\n\t}\n\t/${LOCAL_LIB}_la_LDFLAGS/ !{\n\t\tN\n\t\tb loop1\n\t}\n}\n\n/${LOCAL_LIB}_la_LDFLAGS/ {\n\tN\n\ti\\\\\nendif\n\td\n}\n\n/DISTCLEANFILES = / {\n\tn\n\t/${LOCAL_LIB}_definitions.h/ {\n\t\td\n\t}\n}\";\n\techo \"${SED_SCRIPT}\" >> ${LOCAL_LIB}-$$.sed;\n\tsed -i'~' -f ${LOCAL_LIB}-$$.sed ${LOCAL_LIB_MAKEFILE_AM};\n\trm -f ${LOCAL_LIB}-$$.sed;\n\n\tsed -i'~' \"/AM_CPPFLAGS = /,/noinst_LTLIBRARIES = / { N; s/\\\\\\\\\\\\n.@${LOCAL_LIB_UPPER}_DLL_EXPORT@//; P; D; }\" ${LOCAL_LIB_MAKEFILE_AM};\n\tsed -i'~' \"/${LOCAL_LIB}_definitions.h.in/d\" ${LOCAL_LIB_MAKEFILE_AM};\n\tsed -i'~' \"/${LOCAL_LIB}\\\\.rc/d\" ${LOCAL_LIB_MAKEFILE_AM};\n\n\tif test ${LOCAL_LIB} = \"libfplist\";\n\tthen\n\t\t# TODO: make this more generic to strip the last \\\\\n\t\tsed -i'~' '/EXTRA_DIST = /,/^$/s/libfplist_xml_scanner.c \\\\/libfplist_xml_scanner.c/' ${LOCAL_LIB_MAKEFILE_AM};\n\n\telif test ${LOCAL_LIB} = \"libodraw\";\n\tthen\n\t\t# TODO: make this more generic to strip the last \\\\\n\t\tsed -i'~' '/EXTRA_DIST = /,/^$/s/libodraw_cue_scanner.c \\\\/libodraw_cue_scanner.c/' ${LOCAL_LIB_MAKEFILE_AM};\n\n\telse\n\t\tsed -i'~' '/EXTRA_DIST = /,/^$/d' ${LOCAL_LIB_MAKEFILE_AM};\n\tfi\n\nSED_SCRIPT=\"/^$/ {\n\tx\n\tN\n\t/endif$/ {\n\t\ta\\\\\n\n\t\tD\n\t}\n}\";\n\techo \"${SED_SCRIPT}\" >> ${LOCAL_LIB}-$$.sed;\n\tsed -i'~' -f ${LOCAL_LIB}-$$.sed ${LOCAL_LIB_MAKEFILE_AM};\n\trm -f ${LOCAL_LIB}-$$.sed;\n\n\t# Make the necessary changes to libcfile/Makefile.am\n\tif test ${LOCAL_LIB} = \"libcfile\";\n\tthen\n\t\tif ! test -f \"m4/libuna.m4\";\n\t\tthen\n\t\t\tsed -i'~' 's?@LIBUNA_CPPFLAGS@?-I../libuna -I$(top_srcdir)/libuna?' ${LOCAL_LIB_MAKEFILE_AM};\n\t\tfi\n\tfi\n\n\t# Make the necessary changes to libfplist/Makefile.am\n\tif test ${LOCAL_LIB} = \"libfplist\";\n\tthen\n\t\tif test -f \"m4/libfdatetime.m4\";\n\t\tthen\n\t\t\tsed -i'~' '/@LIBFGUID_CPPFLAGS@/{h; s/FGUID/FDATETIME/; p; g;}' ${LOCAL_LIB_MAKEFILE_AM};\n\t\tfi\n\tfi\n\n\t# Make the necessary changes to libfvalue/Makefile.am\n\tif test ${LOCAL_LIB} = \"libfvalue\";\n\tthen\n\t\tif ! test -f \"m4/libfdatetime.m4\";\n\t\tthen\n\t\t\tsed -i'~' '/@LIBFDATETIME_CPPFLAGS@/d' ${LOCAL_LIB_MAKEFILE_AM};\n\t\tfi\n\t\tif ! test -f \"m4/libfguid.m4\";\n\t\tthen\n\t\t\tsed -i'~' '/@LIBFGUID_CPPFLAGS@/d' ${LOCAL_LIB_MAKEFILE_AM};\n\t\tfi\n\t\tif ! test -f \"m4/libfwnt.m4\";\n\t\tthen\n\t\t\tsed -i'~' '/@LIBFWNT_CPPFLAGS@/d' ${LOCAL_LIB_MAKEFILE_AM};\n\t\tfi\n\t\tif ! test -f \"m4/libuna.m4\";\n\t\tthen\n\t\t\tsed -i'~' '/@LIBUNA_CPPFLAGS@/d' ${LOCAL_LIB_MAKEFILE_AM};\n\t\tfi\n\tfi\n\n\t# Make the necessary changes to libsmraw/Makefile.am\n\tif test ${LOCAL_LIB} = \"libsmraw\";\n\tthen\n\t\tif test -f \"m4/libfdatetime.m4\";\n\t\tthen\n\t\t\tsed -i'~' '/@LIBFVALUE_CPPFLAGS@/{h; s/FVALUE/FDATETIME/; p; g;}' ${LOCAL_LIB_MAKEFILE_AM};\n\t\tfi\n\t\tif test -f \"m4/libfguid.m4\";\n\t\tthen\n\t\t\tsed -i'~' '/@LIBFVALUE_CPPFLAGS@/{h; s/FVALUE/FGUID/; p; g;}' ${LOCAL_LIB_MAKEFILE_AM};\n\t\tfi\n\tfi\n\n\t# Remove libyal/libyal.c\n\trm -f ${LOCAL_LIB}/${LOCAL_LIB}.c;\n\n\t# Make the necessary changes to libyal/libyal_defitions.h\n\tcp ${LOCAL_LIB}-$$/${LOCAL_LIB}/${LOCAL_LIB}_definitions.h.in ${LOCAL_LIB}/${LOCAL_LIB}_definitions.h;\n\tsed -i'~' \"s/@VERSION@/${LOCAL_LIB_VERSION}/\" ${LOCAL_LIB}/${LOCAL_LIB}_definitions.h;\n\n\trm -rf ${LOCAL_LIB}-$$;\ndone\n\nIFS=$OLDIFS;\n\nexit ${EXIT_SUCCESS};\n\n" }, { "path": "synctestdata.ps1", "content": "# Script that synchronizes the local test data\n#\n# Version: 20251208\n\n$TestSet = \"public\"\n$TestInputDirectory = \"tests/input\"\n$TestFiles = \"System.evtx\"\n\nIf (-Not (Test-Path ${TestInputDirectory}))\n{\n\tNew-Item -Name ${TestInputDirectory} -ItemType \"directory\" | Out-Null\n}\nIf (-Not (Test-Path \"${TestInputDirectory}\\${TestSet}\"))\n{\n\tNew-Item -Name \"${TestInputDirectory}\\${TestSet}\" -ItemType \"directory\" | Out-Null\n}\nForEach ($TestFile in ${TestFiles} -split \" \")\n{\n\t$Url = \"https://github.com/log2timeline/plaso/raw/refs/heads/main/test_data/${TestFile}\"\n\n\tInvoke-WebRequest -Uri ${Url} -OutFile \"${TestInputDirectory}\\${TestSet}\\${TestFile}\"\n}\n\n" }, { "path": "synctestdata.sh", "content": "#!/bin/sh\n# Script that synchronizes the local test data\n#\n# Version: 20251208\n\nTEST_SET=\"public\";\nTEST_INPUT_DIRECTORY=\"tests/input\";\nTEST_FILES=\"System.evtx\";\n\nmkdir -p \"${TEST_INPUT_DIRECTORY}/${TEST_SET}\";\n\nfor TEST_FILE in ${TEST_FILES};\ndo\n\tURL=\"https://github.com/log2timeline/plaso/raw/refs/heads/main/test_data/${TEST_FILE}\";\n\n\tcurl -L -o \"${TEST_INPUT_DIRECTORY}/${TEST_SET}/${TEST_FILE}\" ${URL};\ndone\n\n" }, { "path": "tests/Makefile.am", "content": "AUTOMAKE_OPTIONS = subdir-objects\n\nAM_CPPFLAGS = \\\n\t-I../include -I$(top_srcdir)/include \\\n\t-I../common -I$(top_srcdir)/common \\\n\t@LIBCERROR_CPPFLAGS@ \\\n\t@LIBCTHREADS_CPPFLAGS@ \\\n\t@LIBCDATA_CPPFLAGS@ \\\n\t@LIBCLOCALE_CPPFLAGS@ \\\n\t@LIBCNOTIFY_CPPFLAGS@ \\\n\t@LIBCSPLIT_CPPFLAGS@ \\\n\t@LIBUNA_CPPFLAGS@ \\\n\t@LIBCDIRECTORY_CPPFLAGS@ \\\n\t@LIBCFILE_CPPFLAGS@ \\\n\t@LIBCPATH_CPPFLAGS@ \\\n\t@LIBBFIO_CPPFLAGS@ \\\n\t@LIBFCACHE_CPPFLAGS@ \\\n\t@LIBFDATA_CPPFLAGS@ \\\n\t@LIBFDATETIME_CPPFLAGS@ \\\n\t@LIBFGUID_CPPFLAGS@ \\\n\t@LIBFVALUE_CPPFLAGS@ \\\n\t@LIBFWEVT_CPPFLAGS@ \\\n\t@LIBFWNT_CPPFLAGS@ \\\n\t@LIBEXE_CPPFLAGS@ \\\n\t@LIBREGF_CPPFLAGS@ \\\n\t@LIBWRC_CPPFLAGS@ \\\n\t@PTHREAD_CPPFLAGS@ \\\n\t@LIBEVTX_DLL_IMPORT@\n\nif HAVE_PYTHON_TESTS\nTESTS_PYEVTX = \\\n\ttest_python_module.sh\nendif\n\nTESTS = \\\n\ttest_library.sh \\\n\ttest_tools.sh \\\n\ttest_evtxinfo.sh \\\n\ttest_evtxexport.sh \\\n\t$(TESTS_PYEVTX)\n\ncheck_SCRIPTS = \\\n\tpyevtx_test_file.py \\\n\tpyevtx_test_support.py \\\n\ttest_evtxexport.sh \\\n\ttest_evtxinfo.sh \\\n\ttest_library.sh \\\n\ttest_manpage.sh \\\n\ttest_python_module.sh \\\n\ttest_runner.sh \\\n\ttest_tools.sh\n\nEXTRA_DIST = \\\n\t$(check_SCRIPTS)\n\ncheck_PROGRAMS = \\\n\tevtx_test_chunk \\\n\tevtx_test_chunks_table \\\n\tevtx_test_error \\\n\tevtx_test_file \\\n\tevtx_test_io_handle \\\n\tevtx_test_notify \\\n\tevtx_test_record \\\n\tevtx_test_record_values \\\n\tevtx_test_support \\\n\tevtx_test_template_definition \\\n\tevtx_test_tools_info_handle \\\n\tevtx_test_tools_message_handle \\\n\tevtx_test_tools_message_string \\\n\tevtx_test_tools_output \\\n\tevtx_test_tools_path_handle \\\n\tevtx_test_tools_registry_file \\\n\tevtx_test_tools_resource_file \\\n\tevtx_test_tools_signal\n\nevtx_test_chunk_SOURCES = \\\n\tevtx_test_chunk.c \\\n\tevtx_test_libcerror.h \\\n\tevtx_test_libevtx.h \\\n\tevtx_test_macros.h \\\n\tevtx_test_memory.c evtx_test_memory.h \\\n\tevtx_test_unused.h\n\nevtx_test_chunk_LDADD = \\\n\t../libevtx/libevtx.la \\\n\t@LIBCERROR_LIBADD@\n\nevtx_test_chunks_table_SOURCES = \\\n\tevtx_test_chunks_table.c \\\n\tevtx_test_libcerror.h \\\n\tevtx_test_libevtx.h \\\n\tevtx_test_macros.h \\\n\tevtx_test_memory.c evtx_test_memory.h \\\n\tevtx_test_unused.h\n\nevtx_test_chunks_table_LDADD = \\\n\t../libevtx/libevtx.la \\\n\t@LIBCERROR_LIBADD@\n\nevtx_test_error_SOURCES = \\\n\tevtx_test_error.c \\\n\tevtx_test_libevtx.h \\\n\tevtx_test_macros.h \\\n\tevtx_test_unused.h\n\nevtx_test_error_LDADD = \\\n\t../libevtx/libevtx.la\n\nevtx_test_file_SOURCES = \\\n\tevtx_test_file.c \\\n\tevtx_test_functions.c evtx_test_functions.h \\\n\tevtx_test_getopt.c evtx_test_getopt.h \\\n\tevtx_test_libbfio.h \\\n\tevtx_test_libcerror.h \\\n\tevtx_test_libclocale.h \\\n\tevtx_test_libcnotify.h \\\n\tevtx_test_libevtx.h \\\n\tevtx_test_libuna.h \\\n\tevtx_test_macros.h \\\n\tevtx_test_memory.c evtx_test_memory.h \\\n\tevtx_test_unused.h\n\nevtx_test_file_LDADD = \\\n\t@LIBBFIO_LIBADD@ \\\n\t@LIBCPATH_LIBADD@ \\\n\t@LIBCFILE_LIBADD@ \\\n\t@LIBUNA_LIBADD@ \\\n\t@LIBCSPLIT_LIBADD@ \\\n\t@LIBCNOTIFY_LIBADD@ \\\n\t@LIBCLOCALE_LIBADD@ \\\n\t@LIBCDATA_LIBADD@ \\\n\t../libevtx/libevtx.la \\\n\t@LIBCTHREADS_LIBADD@ \\\n\t@LIBCERROR_LIBADD@ \\\n\t@PTHREAD_LIBADD@\n\nevtx_test_io_handle_SOURCES = \\\n\tevtx_test_io_handle.c \\\n\tevtx_test_libcerror.h \\\n\tevtx_test_libevtx.h \\\n\tevtx_test_macros.h \\\n\tevtx_test_memory.c evtx_test_memory.h \\\n\tevtx_test_unused.h\n\nevtx_test_io_handle_LDADD = \\\n\t../libevtx/libevtx.la \\\n\t@LIBCERROR_LIBADD@\n\nevtx_test_notify_SOURCES = \\\n\tevtx_test_libcerror.h \\\n\tevtx_test_libevtx.h \\\n\tevtx_test_macros.h \\\n\tevtx_test_notify.c \\\n\tevtx_test_unused.h\n\nevtx_test_notify_LDADD = \\\n\t../libevtx/libevtx.la \\\n\t@LIBCERROR_LIBADD@\n\nevtx_test_record_SOURCES = \\\n\tevtx_test_libcerror.h \\\n\tevtx_test_libevtx.h \\\n\tevtx_test_macros.h \\\n\tevtx_test_memory.c evtx_test_memory.h \\\n\tevtx_test_record.c \\\n\tevtx_test_unused.h\n\nevtx_test_record_LDADD = \\\n\t../libevtx/libevtx.la \\\n\t@LIBCERROR_LIBADD@\n\nevtx_test_record_values_SOURCES = \\\n\tevtx_test_libcerror.h \\\n\tevtx_test_libevtx.h \\\n\tevtx_test_macros.h \\\n\tevtx_test_memory.c evtx_test_memory.h \\\n\tevtx_test_record_values.c \\\n\tevtx_test_unused.h\n\nevtx_test_record_values_LDADD = \\\n\t../libevtx/libevtx.la \\\n\t@LIBCERROR_LIBADD@\n\nevtx_test_support_SOURCES = \\\n\tevtx_test_functions.c evtx_test_functions.h \\\n\tevtx_test_getopt.c evtx_test_getopt.h \\\n\tevtx_test_libbfio.h \\\n\tevtx_test_libcerror.h \\\n\tevtx_test_libclocale.h \\\n\tevtx_test_libcnotify.h \\\n\tevtx_test_libevtx.h \\\n\tevtx_test_libuna.h \\\n\tevtx_test_macros.h \\\n\tevtx_test_memory.c evtx_test_memory.h \\\n\tevtx_test_support.c \\\n\tevtx_test_unused.h\n\nevtx_test_support_LDADD = \\\n\t@LIBBFIO_LIBADD@ \\\n\t@LIBCPATH_LIBADD@ \\\n\t@LIBCFILE_LIBADD@ \\\n\t@LIBUNA_LIBADD@ \\\n\t@LIBCSPLIT_LIBADD@ \\\n\t@LIBCNOTIFY_LIBADD@ \\\n\t@LIBCLOCALE_LIBADD@ \\\n\t@LIBCDATA_LIBADD@ \\\n\t../libevtx/libevtx.la \\\n\t@LIBCERROR_LIBADD@\n\nevtx_test_template_definition_SOURCES = \\\n\tevtx_test_libcerror.h \\\n\tevtx_test_libevtx.h \\\n\tevtx_test_macros.h \\\n\tevtx_test_memory.c evtx_test_memory.h \\\n\tevtx_test_template_definition.c \\\n\tevtx_test_unused.h\n\nevtx_test_template_definition_LDADD = \\\n\t../libevtx/libevtx.la \\\n\t@LIBCERROR_LIBADD@\n\nevtx_test_tools_info_handle_SOURCES = \\\n\t../evtxtools/evtxinput.c ../evtxtools/evtxinput.h \\\n\t../evtxtools/info_handle.c ../evtxtools/info_handle.h \\\n\tevtx_test_libcerror.h \\\n\tevtx_test_macros.h \\\n\tevtx_test_memory.c evtx_test_memory.h \\\n\tevtx_test_tools_info_handle.c \\\n\tevtx_test_unused.h\n\nevtx_test_tools_info_handle_LDADD = \\\n\t@LIBCLOCALE_LIBADD@ \\\n\t../libevtx/libevtx.la \\\n\t@LIBCERROR_LIBADD@\n\nevtx_test_tools_message_handle_SOURCES = \\\n\t../evtxtools/message_handle.c ../evtxtools/message_handle.h \\\n\t../evtxtools/message_string.c ../evtxtools/message_string.h \\\n\t../evtxtools/resource_file.c ../evtxtools/resource_file.h \\\n\t../evtxtools/path_handle.c ../evtxtools/path_handle.h \\\n\t../evtxtools/registry_file.c ../evtxtools/registry_file.h \\\n\tevtx_test_libcerror.h \\\n\tevtx_test_macros.h \\\n\tevtx_test_memory.c evtx_test_memory.h \\\n\tevtx_test_tools_message_handle.c \\\n\tevtx_test_unused.h\n\nevtx_test_tools_message_handle_LDADD = \\\n\t@LIBWRC_LIBADD@ \\\n\t@LIBREGF_LIBADD@ \\\n\t@LIBEXE_LIBADD@ \\\n\t@LIBFWEVT_LIBADD@ \\\n\t@LIBFVALUE_LIBADD@ \\\n\t@LIBFWNT_LIBADD@ \\\n\t@LIBFGUID_LIBADD@ \\\n\t@LIBFDATETIME_LIBADD@ \\\n\t@LIBFDATA_LIBADD@ \\\n\t@LIBFCACHE_LIBADD@ \\\n\t@LIBBFIO_LIBADD@ \\\n\t@LIBCPATH_LIBADD@ \\\n\t@LIBCFILE_LIBADD@ \\\n\t@LIBCDIRECTORY_LIBADD@ \\\n\t@LIBUNA_LIBADD@ \\\n\t@LIBCSPLIT_LIBADD@ \\\n\t@LIBCNOTIFY_LIBADD@ \\\n\t@LIBCLOCALE_LIBADD@ \\\n\t@LIBCDATA_LIBADD@ \\\n\t../libevtx/libevtx.la \\\n\t@LIBCERROR_LIBADD@\n\nevtx_test_tools_message_string_SOURCES = \\\n\t../evtxtools/message_string.c ../evtxtools/message_string.h \\\n\tevtx_test_libcerror.h \\\n\tevtx_test_macros.h \\\n\tevtx_test_memory.c evtx_test_memory.h \\\n\tevtx_test_tools_message_string.c \\\n\tevtx_test_unused.h\n\nevtx_test_tools_message_string_LDADD = \\\n\t@LIBWRC_LIBADD@ \\\n\t@LIBEXE_LIBADD@ \\\n\t@LIBFWEVT_LIBADD@ \\\n\t@LIBFVALUE_LIBADD@ \\\n\t@LIBFWNT_LIBADD@ \\\n\t@LIBFGUID_LIBADD@ \\\n\t@LIBFDATETIME_LIBADD@ \\\n\t@LIBFDATA_LIBADD@ \\\n\t@LIBBFIO_LIBADD@ \\\n\t@LIBCPATH_LIBADD@ \\\n\t@LIBCFILE_LIBADD@ \\\n\t@LIBUNA_LIBADD@ \\\n\t@LIBCSPLIT_LIBADD@ \\\n\t@LIBCNOTIFY_LIBADD@ \\\n\t@LIBCLOCALE_LIBADD@ \\\n\t@LIBCDATA_LIBADD@ \\\n\t../libevtx/libevtx.la \\\n\t@LIBCERROR_LIBADD@\n\nevtx_test_tools_output_SOURCES = \\\n\t../evtxtools/evtxtools_output.c ../evtxtools/evtxtools_output.h \\\n\tevtx_test_libcerror.h \\\n\tevtx_test_macros.h \\\n\tevtx_test_tools_output.c \\\n\tevtx_test_unused.h\n\nevtx_test_tools_output_LDADD = \\\n\t../libevtx/libevtx.la \\\n\t@LIBCERROR_LIBADD@\n\nevtx_test_tools_path_handle_SOURCES = \\\n\t../evtxtools/path_handle.c ../evtxtools/path_handle.h \\\n\tevtx_test_libcerror.h \\\n\tevtx_test_macros.h \\\n\tevtx_test_memory.c evtx_test_memory.h \\\n\tevtx_test_tools_path_handle.c \\\n\tevtx_test_unused.h\n\nevtx_test_tools_path_handle_LDADD = \\\n\t@LIBCDIRECTORY_LIBADD@ \\\n\t@LIBUNA_LIBADD@ \\\n\t@LIBCLOCALE_LIBADD@ \\\n\t@LIBCDATA_LIBADD@ \\\n\t../libevtx/libevtx.la \\\n\t@LIBCERROR_LIBADD@\n\nevtx_test_tools_registry_file_SOURCES = \\\n\t../evtxtools/registry_file.c ../evtxtools/registry_file.h \\\n\tevtx_test_libcerror.h \\\n\tevtx_test_macros.h \\\n\tevtx_test_memory.c evtx_test_memory.h \\\n\tevtx_test_tools_registry_file.c \\\n\tevtx_test_unused.h\n\nevtx_test_tools_registry_file_LDADD = \\\n\t@LIBREGF_LIBADD@ \\\n\t@LIBFDATA_LIBADD@ \\\n\t@LIBFCACHE_LIBADD@ \\\n\t@LIBBFIO_LIBADD@ \\\n\t@LIBCPATH_LIBADD@ \\\n\t@LIBCFILE_LIBADD@ \\\n\t@LIBCDIRECTORY_LIBADD@ \\\n\t@LIBUNA_LIBADD@ \\\n\t@LIBCSPLIT_LIBADD@ \\\n\t@LIBCNOTIFY_LIBADD@ \\\n\t@LIBCLOCALE_LIBADD@ \\\n\t@LIBCDATA_LIBADD@ \\\n\t../libevtx/libevtx.la \\\n\t@LIBCERROR_LIBADD@\n\nevtx_test_tools_resource_file_SOURCES = \\\n\t../evtxtools/message_string.c ../evtxtools/message_string.h \\\n\t../evtxtools/resource_file.c ../evtxtools/resource_file.h \\\n\tevtx_test_libcerror.h \\\n\tevtx_test_macros.h \\\n\tevtx_test_memory.c evtx_test_memory.h \\\n\tevtx_test_tools_resource_file.c \\\n\tevtx_test_unused.h\n\nevtx_test_tools_resource_file_LDADD = \\\n\t@LIBWRC_LIBADD@ \\\n\t@LIBEXE_LIBADD@ \\\n\t@LIBFWEVT_LIBADD@ \\\n\t@LIBFVALUE_LIBADD@ \\\n\t@LIBFWNT_LIBADD@ \\\n\t@LIBFGUID_LIBADD@ \\\n\t@LIBFDATETIME_LIBADD@ \\\n\t@LIBFDATA_LIBADD@ \\\n\t@LIBFCACHE_LIBADD@ \\\n\t@LIBBFIO_LIBADD@ \\\n\t@LIBCPATH_LIBADD@ \\\n\t@LIBCFILE_LIBADD@ \\\n\t@LIBUNA_LIBADD@ \\\n\t@LIBCSPLIT_LIBADD@ \\\n\t@LIBCNOTIFY_LIBADD@ \\\n\t@LIBCLOCALE_LIBADD@ \\\n\t@LIBCDATA_LIBADD@ \\\n\t../libevtx/libevtx.la \\\n\t@LIBCERROR_LIBADD@\n\nevtx_test_tools_signal_SOURCES = \\\n\t../evtxtools/evtxtools_signal.c ../evtxtools/evtxtools_signal.h \\\n\tevtx_test_libcerror.h \\\n\tevtx_test_macros.h \\\n\tevtx_test_tools_signal.c \\\n\tevtx_test_unused.h\n\nevtx_test_tools_signal_LDADD = \\\n\t../libevtx/libevtx.la \\\n\t@LIBCERROR_LIBADD@\n\nDISTCLEANFILES = \\\n\tMakefile \\\n\tMakefile.in \\\n\tnotify_stream.log\n\n" }, { "path": "tests/build.sh", "content": "#!/bin/sh\n# Script to build from source\n#\n# Version: 20201121\n\nset -e\n\n./synclibs.sh --use-head\n./autogen.sh\n./configure \"$@\"\nmake > /dev/null\n\n" }, { "path": "tests/evtx_test_chunk.c", "content": "/*\n * Library chunk type test program\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#include \n#include \n#include \n\n#if defined( HAVE_STDLIB_H ) || defined( WINAPI )\n#include \n#endif\n\n#include \"evtx_test_libcerror.h\"\n#include \"evtx_test_libevtx.h\"\n#include \"evtx_test_macros.h\"\n#include \"evtx_test_memory.h\"\n#include \"evtx_test_unused.h\"\n\n#include \"../libevtx/libevtx_chunk.h\"\n\n#if defined( __GNUC__ ) && !defined( LIBEVTX_DLL_IMPORT )\n\n/* Tests the libevtx_chunk_initialize function\n * Returns 1 if successful or 0 if not\n */\nint evtx_test_chunk_initialize(\n void )\n{\n\tlibcerror_error_t *error = NULL;\n\tlibevtx_chunk_t *chunk = NULL;\n\tint result = 0;\n\n#if defined( HAVE_EVTX_TEST_MEMORY )\n\tint number_of_malloc_fail_tests = 1;\n\tint number_of_memset_fail_tests = 1;\n\tint test_number = 0;\n#endif\n\n\t/* Test regular cases\n\t */\n\tresult = libevtx_chunk_initialize(\n\t &chunk,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"chunk\",\n\t chunk );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\tresult = libevtx_chunk_free(\n\t &chunk,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 1 );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"chunk\",\n\t chunk );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\t/* Test error cases\n\t */\n\tresult = libevtx_chunk_initialize(\n\t NULL,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"error\",\n\t error );\n\n\tlibcerror_error_free(\n\t &error );\n\n\tchunk = (libevtx_chunk_t *) 0x12345678UL;\n\n\tresult = libevtx_chunk_initialize(\n\t &chunk,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"error\",\n\t error );\n\n\tlibcerror_error_free(\n\t &error );\n\n\tchunk = NULL;\n\n#if defined( HAVE_EVTX_TEST_MEMORY )\n\n\tfor( test_number = 0;\n\t test_number < number_of_malloc_fail_tests;\n\t test_number++ )\n\t{\n\t\t/* Test libevtx_chunk_initialize with malloc failing\n\t\t */\n\t\tevtx_test_malloc_attempts_before_fail = test_number;\n\n\t\tresult = libevtx_chunk_initialize(\n\t\t &chunk,\n\t\t &error );\n\n\t\tif( evtx_test_malloc_attempts_before_fail != -1 )\n\t\t{\n\t\t\tevtx_test_malloc_attempts_before_fail = -1;\n\n\t\t\tif( chunk != NULL )\n\t\t\t{\n\t\t\t\tlibevtx_chunk_free(\n\t\t\t\t &chunk,\n\t\t\t\t NULL );\n\t\t\t}\n\t\t}\n\t\telse\n\t\t{\n\t\t\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t\t\t \"result\",\n\t\t\t result,\n\t\t\t -1 );\n\n\t\t\tEVTX_TEST_ASSERT_IS_NULL(\n\t\t\t \"chunk\",\n\t\t\t chunk );\n\n\t\t\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t\t\t \"error\",\n\t\t\t error );\n\n\t\t\tlibcerror_error_free(\n\t\t\t &error );\n\t\t}\n\t}\n\tfor( test_number = 0;\n\t test_number < number_of_memset_fail_tests;\n\t test_number++ )\n\t{\n\t\t/* Test libevtx_chunk_initialize with memset failing\n\t\t */\n\t\tevtx_test_memset_attempts_before_fail = test_number;\n\n\t\tresult = libevtx_chunk_initialize(\n\t\t &chunk,\n\t\t &error );\n\n\t\tif( evtx_test_memset_attempts_before_fail != -1 )\n\t\t{\n\t\t\tevtx_test_memset_attempts_before_fail = -1;\n\n\t\t\tif( chunk != NULL )\n\t\t\t{\n\t\t\t\tlibevtx_chunk_free(\n\t\t\t\t &chunk,\n\t\t\t\t NULL );\n\t\t\t}\n\t\t}\n\t\telse\n\t\t{\n\t\t\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t\t\t \"result\",\n\t\t\t result,\n\t\t\t -1 );\n\n\t\t\tEVTX_TEST_ASSERT_IS_NULL(\n\t\t\t \"chunk\",\n\t\t\t chunk );\n\n\t\t\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t\t\t \"error\",\n\t\t\t error );\n\n\t\t\tlibcerror_error_free(\n\t\t\t &error );\n\t\t}\n\t}\n#endif /* defined( HAVE_EVTX_TEST_MEMORY ) */\n\n\treturn( 1 );\n\non_error:\n\tif( error != NULL )\n\t{\n\t\tlibcerror_error_free(\n\t\t &error );\n\t}\n\tif( chunk != NULL )\n\t{\n\t\tlibevtx_chunk_free(\n\t\t &chunk,\n\t\t NULL );\n\t}\n\treturn( 0 );\n}\n\n/* Tests the libevtx_chunk_free function\n * Returns 1 if successful or 0 if not\n */\nint evtx_test_chunk_free(\n void )\n{\n\tlibcerror_error_t *error = NULL;\n\tint result = 0;\n\n\t/* Test error cases\n\t */\n\tresult = libevtx_chunk_free(\n\t NULL,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"error\",\n\t error );\n\n\tlibcerror_error_free(\n\t &error );\n\n\treturn( 1 );\n\non_error:\n\tif( error != NULL )\n\t{\n\t\tlibcerror_error_free(\n\t\t &error );\n\t}\n\treturn( 0 );\n}\n\n/* Tests the libevtx_chunk_get_number_of_records function\n * Returns 1 if successful or 0 if not\n */\nint evtx_test_chunk_get_number_of_records(\n void )\n{\n\tlibcerror_error_t *error = NULL;\n\tlibevtx_chunk_t *chunk = NULL;\n\tuint16_t number_of_records = 0;\n\tint number_of_records_is_set = 0;\n\tint result = 0;\n\n\t/* Initialize test\n\t */\n\tresult = libevtx_chunk_initialize(\n\t &chunk,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"chunk\",\n\t chunk );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\t/* Test regular cases\n\t */\n\tresult = libevtx_chunk_get_number_of_records(\n\t chunk,\n\t &number_of_records,\n\t &error );\n\n\tEVTX_TEST_ASSERT_NOT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\tnumber_of_records_is_set = result;\n\n\t/* Test error cases\n\t */\n\tresult = libevtx_chunk_get_number_of_records(\n\t NULL,\n\t &number_of_records,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"error\",\n\t error );\n\n\tlibcerror_error_free(\n\t &error );\n\n\tif( number_of_records_is_set != 0 )\n\t{\n\t\tresult = libevtx_chunk_get_number_of_records(\n\t\t chunk,\n\t\t NULL,\n\t\t &error );\n\n\t\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t\t \"result\",\n\t\t result,\n\t\t -1 );\n\n\t\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t\t \"error\",\n\t\t error );\n\n\t\tlibcerror_error_free(\n\t\t &error );\n\t}\n\t/* Clean up\n\t */\n\tresult = libevtx_chunk_free(\n\t &chunk,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 1 );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"chunk\",\n\t chunk );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\treturn( 1 );\n\non_error:\n\tif( error != NULL )\n\t{\n\t\tlibcerror_error_free(\n\t\t &error );\n\t}\n\tif( chunk != NULL )\n\t{\n\t\tlibevtx_chunk_free(\n\t\t &chunk,\n\t\t NULL );\n\t}\n\treturn( 0 );\n}\n\n/* Tests the libevtx_chunk_get_number_of_recovered_records function\n * Returns 1 if successful or 0 if not\n */\nint evtx_test_chunk_get_number_of_recovered_records(\n void )\n{\n\tlibcerror_error_t *error = NULL;\n\tlibevtx_chunk_t *chunk = NULL;\n\tuint16_t number_of_recovered_records = 0;\n\tint number_of_recovered_records_is_set = 0;\n\tint result = 0;\n\n\t/* Initialize test\n\t */\n\tresult = libevtx_chunk_initialize(\n\t &chunk,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"chunk\",\n\t chunk );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\t/* Test regular cases\n\t */\n\tresult = libevtx_chunk_get_number_of_recovered_records(\n\t chunk,\n\t &number_of_recovered_records,\n\t &error );\n\n\tEVTX_TEST_ASSERT_NOT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\tnumber_of_recovered_records_is_set = result;\n\n\t/* Test error cases\n\t */\n\tresult = libevtx_chunk_get_number_of_recovered_records(\n\t NULL,\n\t &number_of_recovered_records,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"error\",\n\t error );\n\n\tlibcerror_error_free(\n\t &error );\n\n\tif( number_of_recovered_records_is_set != 0 )\n\t{\n\t\tresult = libevtx_chunk_get_number_of_recovered_records(\n\t\t chunk,\n\t\t NULL,\n\t\t &error );\n\n\t\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t\t \"result\",\n\t\t result,\n\t\t -1 );\n\n\t\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t\t \"error\",\n\t\t error );\n\n\t\tlibcerror_error_free(\n\t\t &error );\n\t}\n\t/* Clean up\n\t */\n\tresult = libevtx_chunk_free(\n\t &chunk,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 1 );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"chunk\",\n\t chunk );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\treturn( 1 );\n\non_error:\n\tif( error != NULL )\n\t{\n\t\tlibcerror_error_free(\n\t\t &error );\n\t}\n\tif( chunk != NULL )\n\t{\n\t\tlibevtx_chunk_free(\n\t\t &chunk,\n\t\t NULL );\n\t}\n\treturn( 0 );\n}\n\n#endif /* defined( __GNUC__ ) && !defined( LIBEVTX_DLL_IMPORT ) */\n\n/* The main program\n */\n#if defined( HAVE_WIDE_SYSTEM_CHARACTER )\nint wmain(\n int argc EVTX_TEST_ATTRIBUTE_UNUSED,\n wchar_t * const argv[] EVTX_TEST_ATTRIBUTE_UNUSED )\n#else\nint main(\n int argc EVTX_TEST_ATTRIBUTE_UNUSED,\n char * const argv[] EVTX_TEST_ATTRIBUTE_UNUSED )\n#endif\n{\n\tEVTX_TEST_UNREFERENCED_PARAMETER( argc )\n\tEVTX_TEST_UNREFERENCED_PARAMETER( argv )\n\n#if defined( __GNUC__ ) && !defined( LIBEVTX_DLL_IMPORT )\n\n\tEVTX_TEST_RUN(\n\t \"libevtx_chunk_initialize\",\n\t evtx_test_chunk_initialize );\n\n\tEVTX_TEST_RUN(\n\t \"libevtx_chunk_free\",\n\t evtx_test_chunk_free );\n\n\t/* TODO: add tests for libevtx_chunk_read */\n\n\tEVTX_TEST_RUN(\n\t \"libevtx_chunk_get_number_of_records\",\n\t evtx_test_chunk_get_number_of_records );\n\n\t/* TODO: add tests for libevtx_chunk_get_record */\n\n\tEVTX_TEST_RUN(\n\t \"libevtx_chunk_get_number_of_recovered_records\",\n\t evtx_test_chunk_get_number_of_recovered_records );\n\n\t/* TODO: add tests for libevtx_chunk_get_recovered_record */\n\n#endif /* defined( __GNUC__ ) && !defined( LIBEVTX_DLL_IMPORT ) */\n\n\treturn( EXIT_SUCCESS );\n\non_error:\n\treturn( EXIT_FAILURE );\n}\n\n" }, { "path": "tests/evtx_test_chunks_table.c", "content": "/*\n * Library chunks_table type test program\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#include \n#include \n#include \n\n#if defined( HAVE_STDLIB_H ) || defined( WINAPI )\n#include \n#endif\n\n#include \"evtx_test_libcerror.h\"\n#include \"evtx_test_libevtx.h\"\n#include \"evtx_test_macros.h\"\n#include \"evtx_test_memory.h\"\n#include \"evtx_test_unused.h\"\n\n#include \"../libevtx/libevtx_chunks_table.h\"\n\n#if defined( __GNUC__ ) && !defined( LIBEVTX_DLL_IMPORT )\n\n/* Tests the libevtx_chunks_table_free function\n * Returns 1 if successful or 0 if not\n */\nint evtx_test_chunks_table_free(\n void )\n{\n\tlibcerror_error_t *error = NULL;\n\tint result = 0;\n\n\t/* Test error cases\n\t */\n\tresult = libevtx_chunks_table_free(\n\t NULL,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"error\",\n\t error );\n\n\tlibcerror_error_free(\n\t &error );\n\n\treturn( 1 );\n\non_error:\n\tif( error != NULL )\n\t{\n\t\tlibcerror_error_free(\n\t\t &error );\n\t}\n\treturn( 0 );\n}\n\n#endif /* defined( __GNUC__ ) && !defined( LIBEVTX_DLL_IMPORT ) */\n\n/* The main program\n */\n#if defined( HAVE_WIDE_SYSTEM_CHARACTER )\nint wmain(\n int argc EVTX_TEST_ATTRIBUTE_UNUSED,\n wchar_t * const argv[] EVTX_TEST_ATTRIBUTE_UNUSED )\n#else\nint main(\n int argc EVTX_TEST_ATTRIBUTE_UNUSED,\n char * const argv[] EVTX_TEST_ATTRIBUTE_UNUSED )\n#endif\n{\n\tEVTX_TEST_UNREFERENCED_PARAMETER( argc )\n\tEVTX_TEST_UNREFERENCED_PARAMETER( argv )\n\n#if defined( __GNUC__ ) && !defined( LIBEVTX_DLL_IMPORT )\n\n\t/* TODO: add tests for libevtx_chunks_table_initialize */\n\n\tEVTX_TEST_RUN(\n\t \"libevtx_chunks_table_free\",\n\t evtx_test_chunks_table_free );\n\n\t/* TODO: add tests for libevtx_chunks_table_read_record */\n\n#endif /* defined( __GNUC__ ) && !defined( LIBEVTX_DLL_IMPORT ) */\n\n\treturn( EXIT_SUCCESS );\n\non_error:\n\treturn( EXIT_FAILURE );\n}\n\n" }, { "path": "tests/evtx_test_error.c", "content": "/*\n * Library error functions test program\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#include \n#include \n#include \n\n#if defined( HAVE_STDLIB_H ) || defined( WINAPI )\n#include \n#endif\n\n#include \"evtx_test_libevtx.h\"\n#include \"evtx_test_macros.h\"\n#include \"evtx_test_unused.h\"\n\n/* Tests the libevtx_error_free function\n * Returns 1 if successful or 0 if not\n */\nint evtx_test_error_free(\n void )\n{\n\t/* Test invocation of function only\n\t */\n\tlibevtx_error_free(\n\t NULL );\n\n\treturn( 1 );\n}\n\n/* Tests the libevtx_error_fprint function\n * Returns 1 if successful or 0 if not\n */\nint evtx_test_error_fprint(\n void )\n{\n\t/* Test invocation of function only\n\t */\n\tlibevtx_error_fprint(\n\t NULL,\n\t NULL );\n\n\treturn( 1 );\n}\n\n/* Tests the libevtx_error_sprint function\n * Returns 1 if successful or 0 if not\n */\nint evtx_test_error_sprint(\n void )\n{\n\t/* Test invocation of function only\n\t */\n\tlibevtx_error_sprint(\n\t NULL,\n\t NULL,\n\t 0 );\n\n\treturn( 1 );\n}\n\n/* Tests the libevtx_error_backtrace_fprint function\n * Returns 1 if successful or 0 if not\n */\nint evtx_test_error_backtrace_fprint(\n void )\n{\n\t/* Test invocation of function only\n\t */\n\tlibevtx_error_backtrace_fprint(\n\t NULL,\n\t NULL );\n\n\treturn( 1 );\n}\n\n/* Tests the libevtx_error_backtrace_sprint function\n * Returns 1 if successful or 0 if not\n */\nint evtx_test_error_backtrace_sprint(\n void )\n{\n\t/* Test invocation of function only\n\t */\n\tlibevtx_error_backtrace_sprint(\n\t NULL,\n\t NULL,\n\t 0 );\n\n\treturn( 1 );\n}\n\n/* The main program\n */\n#if defined( HAVE_WIDE_SYSTEM_CHARACTER )\nint wmain(\n int argc EVTX_TEST_ATTRIBUTE_UNUSED,\n wchar_t * const argv[] EVTX_TEST_ATTRIBUTE_UNUSED )\n#else\nint main(\n int argc EVTX_TEST_ATTRIBUTE_UNUSED,\n char * const argv[] EVTX_TEST_ATTRIBUTE_UNUSED )\n#endif\n{\n\tEVTX_TEST_UNREFERENCED_PARAMETER( argc )\n\tEVTX_TEST_UNREFERENCED_PARAMETER( argv )\n\n\tEVTX_TEST_RUN(\n\t \"libevtx_error_free\",\n\t evtx_test_error_free );\n\n\tEVTX_TEST_RUN(\n\t \"libevtx_error_fprint\",\n\t evtx_test_error_fprint );\n\n\tEVTX_TEST_RUN(\n\t \"libevtx_error_sprint\",\n\t evtx_test_error_sprint );\n\n\tEVTX_TEST_RUN(\n\t \"libevtx_error_backtrace_fprint\",\n\t evtx_test_error_backtrace_fprint );\n\n\tEVTX_TEST_RUN(\n\t \"libevtx_error_backtrace_sprint\",\n\t evtx_test_error_backtrace_sprint );\n\n\treturn( EXIT_SUCCESS );\n\non_error:\n\treturn( EXIT_FAILURE );\n}\n\n" }, { "path": "tests/evtx_test_file.c", "content": "/*\n * Library file type test program\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#include \n#include \n#include \n#include \n#include \n#include \n\n#if defined( HAVE_STDLIB_H ) || defined( WINAPI )\n#include \n#endif\n\n#include \"evtx_test_functions.h\"\n#include \"evtx_test_getopt.h\"\n#include \"evtx_test_libbfio.h\"\n#include \"evtx_test_libcerror.h\"\n#include \"evtx_test_libevtx.h\"\n#include \"evtx_test_macros.h\"\n#include \"evtx_test_memory.h\"\n#include \"evtx_test_unused.h\"\n\n#include \"../libevtx/libevtx_file.h\"\n\n#if !defined( LIBEVTX_HAVE_BFIO )\n\nLIBEVTX_EXTERN \\\nint libevtx_check_file_signature_file_io_handle(\n libbfio_handle_t *file_io_handle,\n libcerror_error_t **error );\n\nLIBEVTX_EXTERN \\\nint libevtx_file_open_file_io_handle(\n libevtx_file_t *file,\n libbfio_handle_t *file_io_handle,\n int access_flags,\n libevtx_error_t **error );\n\n#endif /* !defined( LIBEVTX_HAVE_BFIO ) */\n\n#if defined( HAVE_WIDE_SYSTEM_CHARACTER ) && SIZEOF_WCHAR_T != 2 && SIZEOF_WCHAR_T != 4\n#error Unsupported size of wchar_t\n#endif\n\n/* Define to make evtx_test_file generate verbose output\n#define EVTX_TEST_FILE_VERBOSE\n */\n\n/* Creates and opens a source file\n * Returns 1 if successful or -1 on error\n */\nint evtx_test_file_open_source(\n libevtx_file_t **file,\n libbfio_handle_t *file_io_handle,\n libcerror_error_t **error )\n{\n\tstatic char *function = \"evtx_test_file_open_source\";\n\tint result = 0;\n\n\tif( file == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid file.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( file_io_handle == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid file IO handle.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( libevtx_file_initialize(\n\t file,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_INITIALIZE_FAILED,\n\t\t \"%s: unable to initialize file.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tresult = libevtx_file_open_file_io_handle(\n\t *file,\n\t file_io_handle,\n\t LIBEVTX_OPEN_READ,\n\t error );\n\n\tif( result != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_IO,\n\t\t LIBCERROR_IO_ERROR_OPEN_FAILED,\n\t\t \"%s: unable to open file.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\treturn( 1 );\n\non_error:\n\tif( *file != NULL )\n\t{\n\t\tlibevtx_file_free(\n\t\t file,\n\t\t NULL );\n\t}\n\treturn( -1 );\n}\n\n/* Closes and frees a source file\n * Returns 1 if successful or -1 on error\n */\nint evtx_test_file_close_source(\n libevtx_file_t **file,\n libcerror_error_t **error )\n{\n\tstatic char *function = \"evtx_test_file_close_source\";\n\tint result = 0;\n\n\tif( file == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid file.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( libevtx_file_close(\n\t *file,\n\t error ) != 0 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_IO,\n\t\t LIBCERROR_IO_ERROR_CLOSE_FAILED,\n\t\t \"%s: unable to close file.\",\n\t\t function );\n\n\t\tresult = -1;\n\t}\n\tif( libevtx_file_free(\n\t file,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED,\n\t\t \"%s: unable to free file.\",\n\t\t function );\n\n\t\tresult = -1;\n\t}\n\treturn( result );\n}\n\n/* Tests the libevtx_file_initialize function\n * Returns 1 if successful or 0 if not\n */\nint evtx_test_file_initialize(\n void )\n{\n\tlibcerror_error_t *error = NULL;\n\tlibevtx_file_t *file = NULL;\n\tint result = 0;\n\n#if defined( HAVE_EVTX_TEST_MEMORY )\n\tint number_of_malloc_fail_tests = 1;\n\tint number_of_memset_fail_tests = 1;\n\tint test_number = 0;\n#endif\n\n\t/* Test regular cases\n\t */\n\tresult = libevtx_file_initialize(\n\t &file,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"file\",\n\t file );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\tresult = libevtx_file_free(\n\t &file,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 1 );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"file\",\n\t file );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\t/* Test error cases\n\t */\n\tresult = libevtx_file_initialize(\n\t NULL,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"error\",\n\t error );\n\n\tlibcerror_error_free(\n\t &error );\n\n\tfile = (libevtx_file_t *) 0x12345678UL;\n\n\tresult = libevtx_file_initialize(\n\t &file,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"error\",\n\t error );\n\n\tlibcerror_error_free(\n\t &error );\n\n\tfile = NULL;\n\n#if defined( HAVE_EVTX_TEST_MEMORY )\n\n\tfor( test_number = 0;\n\t test_number < number_of_malloc_fail_tests;\n\t test_number++ )\n\t{\n\t\t/* Test libevtx_file_initialize with malloc failing\n\t\t */\n\t\tevtx_test_malloc_attempts_before_fail = test_number;\n\n\t\tresult = libevtx_file_initialize(\n\t\t &file,\n\t\t &error );\n\n\t\tif( evtx_test_malloc_attempts_before_fail != -1 )\n\t\t{\n\t\t\tevtx_test_malloc_attempts_before_fail = -1;\n\n\t\t\tif( file != NULL )\n\t\t\t{\n\t\t\t\tlibevtx_file_free(\n\t\t\t\t &file,\n\t\t\t\t NULL );\n\t\t\t}\n\t\t}\n\t\telse\n\t\t{\n\t\t\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t\t\t \"result\",\n\t\t\t result,\n\t\t\t -1 );\n\n\t\t\tEVTX_TEST_ASSERT_IS_NULL(\n\t\t\t \"file\",\n\t\t\t file );\n\n\t\t\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t\t\t \"error\",\n\t\t\t error );\n\n\t\t\tlibcerror_error_free(\n\t\t\t &error );\n\t\t}\n\t}\n\tfor( test_number = 0;\n\t test_number < number_of_memset_fail_tests;\n\t test_number++ )\n\t{\n\t\t/* Test libevtx_file_initialize with memset failing\n\t\t */\n\t\tevtx_test_memset_attempts_before_fail = test_number;\n\n\t\tresult = libevtx_file_initialize(\n\t\t &file,\n\t\t &error );\n\n\t\tif( evtx_test_memset_attempts_before_fail != -1 )\n\t\t{\n\t\t\tevtx_test_memset_attempts_before_fail = -1;\n\n\t\t\tif( file != NULL )\n\t\t\t{\n\t\t\t\tlibevtx_file_free(\n\t\t\t\t &file,\n\t\t\t\t NULL );\n\t\t\t}\n\t\t}\n\t\telse\n\t\t{\n\t\t\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t\t\t \"result\",\n\t\t\t result,\n\t\t\t -1 );\n\n\t\t\tEVTX_TEST_ASSERT_IS_NULL(\n\t\t\t \"file\",\n\t\t\t file );\n\n\t\t\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t\t\t \"error\",\n\t\t\t error );\n\n\t\t\tlibcerror_error_free(\n\t\t\t &error );\n\t\t}\n\t}\n#endif /* defined( HAVE_EVTX_TEST_MEMORY ) */\n\n\treturn( 1 );\n\non_error:\n\tif( error != NULL )\n\t{\n\t\tlibcerror_error_free(\n\t\t &error );\n\t}\n\tif( file != NULL )\n\t{\n\t\tlibevtx_file_free(\n\t\t &file,\n\t\t NULL );\n\t}\n\treturn( 0 );\n}\n\n/* Tests the libevtx_file_free function\n * Returns 1 if successful or 0 if not\n */\nint evtx_test_file_free(\n void )\n{\n\tlibcerror_error_t *error = NULL;\n\tint result = 0;\n\n\t/* Test error cases\n\t */\n\tresult = libevtx_file_free(\n\t NULL,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"error\",\n\t error );\n\n\tlibcerror_error_free(\n\t &error );\n\n\treturn( 1 );\n\non_error:\n\tif( error != NULL )\n\t{\n\t\tlibcerror_error_free(\n\t\t &error );\n\t}\n\treturn( 0 );\n}\n\n/* Tests the libevtx_file_open function\n * Returns 1 if successful or 0 if not\n */\nint evtx_test_file_open(\n const system_character_t *source )\n{\n\tchar narrow_source[ 256 ];\n\n\tlibcerror_error_t *error = NULL;\n\tlibevtx_file_t *file = NULL;\n\tint result = 0;\n\n\t/* Initialize test\n\t */\n\tresult = evtx_test_get_narrow_source(\n\t source,\n\t narrow_source,\n\t 256,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 1 );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\tresult = libevtx_file_initialize(\n\t &file,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"file\",\n\t file );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\t/* Test open\n\t */\n\tresult = libevtx_file_open(\n\t file,\n\t narrow_source,\n\t LIBEVTX_OPEN_READ,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 1 );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\t/* Test error cases\n\t */\n\tresult = libevtx_file_open(\n\t NULL,\n\t narrow_source,\n\t LIBEVTX_OPEN_READ,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"error\",\n\t error );\n\n\tlibcerror_error_free(\n\t &error );\n\n\tresult = libevtx_file_open(\n\t file,\n\t NULL,\n\t LIBEVTX_OPEN_READ,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"error\",\n\t error );\n\n\tlibcerror_error_free(\n\t &error );\n\n\tresult = libevtx_file_open(\n\t file,\n\t narrow_source,\n\t -1,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"error\",\n\t error );\n\n\tlibcerror_error_free(\n\t &error );\n\n\t/* Test open when already opened\n\t */\n\tresult = libevtx_file_open(\n\t file,\n\t narrow_source,\n\t LIBEVTX_OPEN_READ,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"error\",\n\t error );\n\n\tlibcerror_error_free(\n\t &error );\n\n\t/* Clean up\n\t */\n\tresult = libevtx_file_free(\n\t &file,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 1 );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"file\",\n\t file );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\treturn( 1 );\n\non_error:\n\tif( error != NULL )\n\t{\n\t\tlibcerror_error_free(\n\t\t &error );\n\t}\n\tif( file != NULL )\n\t{\n\t\tlibevtx_file_free(\n\t\t &file,\n\t\t NULL );\n\t}\n\treturn( 0 );\n}\n\n#if defined( HAVE_WIDE_CHARACTER_TYPE )\n\n/* Tests the libevtx_file_open_wide function\n * Returns 1 if successful or 0 if not\n */\nint evtx_test_file_open_wide(\n const system_character_t *source )\n{\n\twchar_t wide_source[ 256 ];\n\n\tlibcerror_error_t *error = NULL;\n\tlibevtx_file_t *file = NULL;\n\tint result = 0;\n\n\t/* Initialize test\n\t */\n\tresult = evtx_test_get_wide_source(\n\t source,\n\t wide_source,\n\t 256,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 1 );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\tresult = libevtx_file_initialize(\n\t &file,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"file\",\n\t file );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\t/* Test open\n\t */\n\tresult = libevtx_file_open_wide(\n\t file,\n\t wide_source,\n\t LIBEVTX_OPEN_READ,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 1 );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\t/* Test error cases\n\t */\n\tresult = libevtx_file_open_wide(\n\t NULL,\n\t wide_source,\n\t LIBEVTX_OPEN_READ,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"error\",\n\t error );\n\n\tlibcerror_error_free(\n\t &error );\n\n\tresult = libevtx_file_open_wide(\n\t file,\n\t NULL,\n\t LIBEVTX_OPEN_READ,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"error\",\n\t error );\n\n\tlibcerror_error_free(\n\t &error );\n\n\tresult = libevtx_file_open_wide(\n\t file,\n\t wide_source,\n\t -1,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"error\",\n\t error );\n\n\tlibcerror_error_free(\n\t &error );\n\n\t/* Test open when already opened\n\t */\n\tresult = libevtx_file_open_wide(\n\t file,\n\t wide_source,\n\t LIBEVTX_OPEN_READ,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"error\",\n\t error );\n\n\tlibcerror_error_free(\n\t &error );\n\n\t/* Clean up\n\t */\n\tresult = libevtx_file_free(\n\t &file,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 1 );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"file\",\n\t file );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\treturn( 1 );\n\non_error:\n\tif( error != NULL )\n\t{\n\t\tlibcerror_error_free(\n\t\t &error );\n\t}\n\tif( file != NULL )\n\t{\n\t\tlibevtx_file_free(\n\t\t &file,\n\t\t NULL );\n\t}\n\treturn( 0 );\n}\n\n#endif /* defined( HAVE_WIDE_CHARACTER_TYPE ) */\n\n/* Tests the libevtx_file_open_file_io_handle function\n * Returns 1 if successful or 0 if not\n */\nint evtx_test_file_open_file_io_handle(\n const system_character_t *source )\n{\n\tlibbfio_handle_t *file_io_handle = NULL;\n\tlibcerror_error_t *error = NULL;\n\tlibevtx_file_t *file = NULL;\n\tsize_t string_length = 0;\n\tint result = 0;\n\n\t/* Initialize test\n\t */\n\tresult = libbfio_file_initialize(\n\t &file_io_handle,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 1 );\n\n EVTX_TEST_ASSERT_IS_NOT_NULL(\n \"file_io_handle\",\n file_io_handle );\n\n EVTX_TEST_ASSERT_IS_NULL(\n \"error\",\n error );\n\n\tstring_length = system_string_length(\n\t source );\n\n#if defined( HAVE_WIDE_SYSTEM_CHARACTER )\n\tresult = libbfio_file_set_name_wide(\n\t file_io_handle,\n\t source,\n\t string_length,\n\t &error );\n#else\n\tresult = libbfio_file_set_name(\n\t file_io_handle,\n\t source,\n\t string_length,\n\t &error );\n#endif\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 1 );\n\n EVTX_TEST_ASSERT_IS_NULL(\n \"error\",\n error );\n\n\tresult = libevtx_file_initialize(\n\t &file,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"file\",\n\t file );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\t/* Test open\n\t */\n\tresult = libevtx_file_open_file_io_handle(\n\t file,\n\t file_io_handle,\n\t LIBEVTX_OPEN_READ,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 1 );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\t/* Test error cases\n\t */\n\tresult = libevtx_file_open_file_io_handle(\n\t NULL,\n\t file_io_handle,\n\t LIBEVTX_OPEN_READ,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"error\",\n\t error );\n\n\tlibcerror_error_free(\n\t &error );\n\n\tresult = libevtx_file_open_file_io_handle(\n\t file,\n\t NULL,\n\t LIBEVTX_OPEN_READ,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"error\",\n\t error );\n\n\tlibcerror_error_free(\n\t &error );\n\n\tresult = libevtx_file_open_file_io_handle(\n\t file,\n\t file_io_handle,\n\t -1,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"error\",\n\t error );\n\n\tlibcerror_error_free(\n\t &error );\n\n\t/* Test open when already opened\n\t */\n\tresult = libevtx_file_open_file_io_handle(\n\t file,\n\t file_io_handle,\n\t LIBEVTX_OPEN_READ,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"error\",\n\t error );\n\n\tlibcerror_error_free(\n\t &error );\n\n\t/* Clean up\n\t */\n\tresult = libevtx_file_free(\n\t &file,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 1 );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"file\",\n\t file );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\tresult = libbfio_handle_free(\n\t &file_io_handle,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 1 );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n \"file_io_handle\",\n file_io_handle );\n\n EVTX_TEST_ASSERT_IS_NULL(\n \"error\",\n error );\n\n\treturn( 1 );\n\non_error:\n\tif( error != NULL )\n\t{\n\t\tlibcerror_error_free(\n\t\t &error );\n\t}\n\tif( file != NULL )\n\t{\n\t\tlibevtx_file_free(\n\t\t &file,\n\t\t NULL );\n\t}\n\tif( file_io_handle != NULL )\n\t{\n\t\tlibbfio_handle_free(\n\t\t &file_io_handle,\n\t\t NULL );\n\t}\n\treturn( 0 );\n}\n\n/* Tests the libevtx_file_close function\n * Returns 1 if successful or 0 if not\n */\nint evtx_test_file_close(\n void )\n{\n\tlibcerror_error_t *error = NULL;\n\tint result = 0;\n\n\t/* Test error cases\n\t */\n\tresult = libevtx_file_close(\n\t NULL,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"error\",\n\t error );\n\n\tlibcerror_error_free(\n\t &error );\n\n\treturn( 1 );\n\non_error:\n\tif( error != NULL )\n\t{\n\t\tlibcerror_error_free(\n\t\t &error );\n\t}\n\treturn( 0 );\n}\n\n/* Tests the libevtx_file_open and libevtx_file_close functions\n * Returns 1 if successful or 0 if not\n */\nint evtx_test_file_open_close(\n const system_character_t *source )\n{\n\tlibcerror_error_t *error = NULL;\n\tlibevtx_file_t *file = NULL;\n\tint result = 0;\n\n\t/* Initialize test\n\t */\n\tresult = libevtx_file_initialize(\n\t &file,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"file\",\n\t file );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\t/* Test open and close\n\t */\n#if defined( HAVE_WIDE_SYSTEM_CHARACTER )\n\tresult = libevtx_file_open_wide(\n\t file,\n\t source,\n\t LIBEVTX_OPEN_READ,\n\t &error );\n#else\n\tresult = libevtx_file_open(\n\t file,\n\t source,\n\t LIBEVTX_OPEN_READ,\n\t &error );\n#endif\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 1 );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\tresult = libevtx_file_close(\n\t file,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 0 );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\t/* Test open and close a second time to validate clean up on close\n\t */\n#if defined( HAVE_WIDE_SYSTEM_CHARACTER )\n\tresult = libevtx_file_open_wide(\n\t file,\n\t source,\n\t LIBEVTX_OPEN_READ,\n\t &error );\n#else\n\tresult = libevtx_file_open(\n\t file,\n\t source,\n\t LIBEVTX_OPEN_READ,\n\t &error );\n#endif\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 1 );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\tresult = libevtx_file_close(\n\t file,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 0 );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\t/* Clean up\n\t */\n\tresult = libevtx_file_free(\n\t &file,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 1 );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"file\",\n\t file );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\treturn( 1 );\n\non_error:\n\tif( error != NULL )\n\t{\n\t\tlibcerror_error_free(\n\t\t &error );\n\t}\n\tif( file != NULL )\n\t{\n\t\tlibevtx_file_free(\n\t\t &file,\n\t\t NULL );\n\t}\n\treturn( 0 );\n}\n\n/* Tests the libevtx_file_signal_abort function\n * Returns 1 if successful or 0 if not\n */\nint evtx_test_file_signal_abort(\n libevtx_file_t *file )\n{\n\tlibcerror_error_t *error = NULL;\n\tint result = 0;\n\n\t/* Test regular cases\n\t */\n\tresult = libevtx_file_signal_abort(\n\t file,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 1 );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\t/* Test error cases\n\t */\n\tresult = libevtx_file_signal_abort(\n\t NULL,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"error\",\n\t error );\n\n\tlibcerror_error_free(\n\t &error );\n\n\treturn( 1 );\n\non_error:\n\tif( error != NULL )\n\t{\n\t\tlibcerror_error_free(\n\t\t &error );\n\t}\n\treturn( 0 );\n}\n\n/* Tests the libevtx_file_get_ascii_codepage function\n * Returns 1 if successful or 0 if not\n */\nint evtx_test_file_get_ascii_codepage(\n libevtx_file_t *file )\n{\n\tlibcerror_error_t *error = NULL;\n\tint ascii_codepage = 0;\n\tint result = 0;\n\n\t/* Test regular cases\n\t */\n\tresult = libevtx_file_get_ascii_codepage(\n\t file,\n\t &ascii_codepage,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 1 );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\t/* Test error cases\n\t */\n\tresult = libevtx_file_get_ascii_codepage(\n\t NULL,\n\t &ascii_codepage,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"error\",\n\t error );\n\n\tlibcerror_error_free(\n\t &error );\n\n\tresult = libevtx_file_get_ascii_codepage(\n\t file,\n\t NULL,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"error\",\n\t error );\n\n\tlibcerror_error_free(\n\t &error );\n\n\treturn( 1 );\n\non_error:\n\tif( error != NULL )\n\t{\n\t\tlibcerror_error_free(\n\t\t &error );\n\t}\n\treturn( 0 );\n}\n\n/* Tests the libevtx_file_set_ascii_codepage function\n * Returns 1 if successful or 0 if not\n */\nint evtx_test_file_set_ascii_codepage(\n libevtx_file_t *file )\n{\n\tint supported_codepages[ 15 ] = {\n\t\tLIBEVTX_CODEPAGE_ASCII,\n\t\tLIBEVTX_CODEPAGE_WINDOWS_874,\n\t\tLIBEVTX_CODEPAGE_WINDOWS_932,\n\t\tLIBEVTX_CODEPAGE_WINDOWS_936,\n\t\tLIBEVTX_CODEPAGE_WINDOWS_949,\n\t\tLIBEVTX_CODEPAGE_WINDOWS_950,\n\t\tLIBEVTX_CODEPAGE_WINDOWS_1250,\n\t\tLIBEVTX_CODEPAGE_WINDOWS_1251,\n\t\tLIBEVTX_CODEPAGE_WINDOWS_1252,\n\t\tLIBEVTX_CODEPAGE_WINDOWS_1253,\n\t\tLIBEVTX_CODEPAGE_WINDOWS_1254,\n\t\tLIBEVTX_CODEPAGE_WINDOWS_1255,\n\t\tLIBEVTX_CODEPAGE_WINDOWS_1256,\n\t\tLIBEVTX_CODEPAGE_WINDOWS_1257,\n\t\tLIBEVTX_CODEPAGE_WINDOWS_1258 };\n\n\tint unsupported_codepages[ 17 ] = {\n\t\tLIBEVTX_CODEPAGE_ISO_8859_1,\n\t\tLIBEVTX_CODEPAGE_ISO_8859_2,\n\t\tLIBEVTX_CODEPAGE_ISO_8859_3,\n\t\tLIBEVTX_CODEPAGE_ISO_8859_4,\n\t\tLIBEVTX_CODEPAGE_ISO_8859_5,\n\t\tLIBEVTX_CODEPAGE_ISO_8859_6,\n\t\tLIBEVTX_CODEPAGE_ISO_8859_7,\n\t\tLIBEVTX_CODEPAGE_ISO_8859_8,\n\t\tLIBEVTX_CODEPAGE_ISO_8859_9,\n\t\tLIBEVTX_CODEPAGE_ISO_8859_10,\n\t\tLIBEVTX_CODEPAGE_ISO_8859_11,\n\t\tLIBEVTX_CODEPAGE_ISO_8859_13,\n\t\tLIBEVTX_CODEPAGE_ISO_8859_14,\n\t\tLIBEVTX_CODEPAGE_ISO_8859_15,\n\t\tLIBEVTX_CODEPAGE_ISO_8859_16,\n\t\tLIBEVTX_CODEPAGE_KOI8_R,\n\t\tLIBEVTX_CODEPAGE_KOI8_U };\n\n\tlibcerror_error_t *error = NULL;\n\tint codepage = 0;\n\tint index = 0;\n\tint result = 0;\n\n\t/* Test set ASCII codepage\n\t */\n\tfor( index = 0;\n\t index < 15;\n\t index++ )\n\t{\n\t\tcodepage = supported_codepages[ index ];\n\n\t\tresult = libevtx_file_set_ascii_codepage(\n\t\t file,\n\t\t codepage,\n\t\t &error );\n\n\t\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t\t \"result\",\n\t\t result,\n\t\t 1 );\n\n\t\tEVTX_TEST_ASSERT_IS_NULL(\n\t\t \"error\",\n\t\t error );\n\t}\n\t/* Test error cases\n\t */\n\tresult = libevtx_file_set_ascii_codepage(\n\t NULL,\n\t LIBEVTX_CODEPAGE_ASCII,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"error\",\n\t error );\n\n\tlibcerror_error_free(\n\t &error );\n\n\tfor( index = 0;\n\t index < 17;\n\t index++ )\n\t{\n\t\tcodepage = unsupported_codepages[ index ];\n\n\t\tresult = libevtx_file_set_ascii_codepage(\n\t\t file,\n\t\t codepage,\n\t\t &error );\n\n\t\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t\t \"result\",\n\t\t result,\n\t\t -1 );\n\n\t\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t\t \"error\",\n\t\t error );\n\n\t\tlibcerror_error_free(\n\t\t &error );\n\t}\n\t/* Clean up\n\t */\n\tresult = libevtx_file_set_ascii_codepage(\n\t file,\n\t LIBEVTX_CODEPAGE_WINDOWS_1252,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 1 );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\treturn( 1 );\n\non_error:\n\tif( error != NULL )\n\t{\n\t\tlibcerror_error_free(\n\t\t &error );\n\t}\n\treturn( 0 );\n}\n\n/* Tests the libevtx_file_get_flags function\n * Returns 1 if successful or 0 if not\n */\nint evtx_test_file_get_flags(\n libevtx_file_t *file )\n{\n\tlibcerror_error_t *error = NULL;\n\tuint32_t flags = 0;\n\tint result = 0;\n\n\t/* Test regular cases\n\t */\n\tresult = libevtx_file_get_flags(\n\t file,\n\t &flags,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 1 );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\t/* Test error cases\n\t */\n\tresult = libevtx_file_get_flags(\n\t NULL,\n\t &flags,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"error\",\n\t error );\n\n\tlibcerror_error_free(\n\t &error );\n\n\tresult = libevtx_file_get_flags(\n\t file,\n\t NULL,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"error\",\n\t error );\n\n\tlibcerror_error_free(\n\t &error );\n\n\treturn( 1 );\n\non_error:\n\tif( error != NULL )\n\t{\n\t\tlibcerror_error_free(\n\t\t &error );\n\t}\n\treturn( 0 );\n}\n\n/* Tests the libevtx_file_get_number_of_records function\n * Returns 1 if successful or 0 if not\n */\nint evtx_test_file_get_number_of_records(\n libevtx_file_t *file )\n{\n\tlibcerror_error_t *error = NULL;\n\tint number_of_records = 0;\n\tint result = 0;\n\n\t/* Test regular cases\n\t */\n\tresult = libevtx_file_get_number_of_records(\n\t file,\n\t &number_of_records,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 1 );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\t/* Test error cases\n\t */\n\tresult = libevtx_file_get_number_of_records(\n\t NULL,\n\t &number_of_records,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"error\",\n\t error );\n\n\tlibcerror_error_free(\n\t &error );\n\n\tresult = libevtx_file_get_number_of_records(\n\t file,\n\t NULL,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"error\",\n\t error );\n\n\tlibcerror_error_free(\n\t &error );\n\n\treturn( 1 );\n\non_error:\n\tif( error != NULL )\n\t{\n\t\tlibcerror_error_free(\n\t\t &error );\n\t}\n\treturn( 0 );\n}\n\n/* Tests the libevtx_file_get_record_by_index function\n * Returns 1 if successful or 0 if not\n */\nint evtx_test_file_get_record_by_index(\n libevtx_file_t *file )\n{\n\tlibcerror_error_t *error = NULL;\n\tlibevtx_record_t *record = 0;\n\tint number_of_records = 0;\n\tint result = 0;\n\n\t/* Initialize test\n\t */\n\tresult = libevtx_file_get_number_of_records(\n\t file,\n\t &number_of_records,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 1 );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\tif( number_of_records == 0 )\n\t{\n\t\treturn( 1 );\n\t}\n\t/* Test regular cases\n\t */\n\tresult = libevtx_file_get_record_by_index(\n\t file,\n\t 0,\n\t &record,\n\t &error );\n\n\t/* TODO: remove after troubleshooting failing tests */\n\tEVTX_TEST_FPRINT_ERROR( error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 1 );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"record\",\n\t record );\n\n\tresult = libevtx_record_free(\n\t &record,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 1 );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\t/* Test error cases\n\t */\n\tresult = libevtx_file_get_record_by_index(\n\t NULL,\n\t 0,\n\t &record,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"record\",\n\t record );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"error\",\n\t error );\n\n\tlibcerror_error_free(\n\t &error );\n\n\tresult = libevtx_file_get_record_by_index(\n\t file,\n\t -1,\n\t &record,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"record\",\n\t record );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"error\",\n\t error );\n\n\tlibcerror_error_free(\n\t &error );\n\n\tresult = libevtx_file_get_record_by_index(\n\t file,\n\t 0,\n\t NULL,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"record\",\n\t record );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"error\",\n\t error );\n\n\tlibcerror_error_free(\n\t &error );\n\n\treturn( 1 );\n\non_error:\n\tif( error != NULL )\n\t{\n\t\tlibcerror_error_free(\n\t\t &error );\n\t}\n\treturn( 0 );\n}\n\n/* Tests the libevtx_file_get_number_of_recovered_records function\n * Returns 1 if successful or 0 if not\n */\nint evtx_test_file_get_number_of_recovered_records(\n libevtx_file_t *file )\n{\n\tlibcerror_error_t *error = NULL;\n\tint number_of_recovered_records = 0;\n\tint result = 0;\n\n\t/* Test regular cases\n\t */\n\tresult = libevtx_file_get_number_of_recovered_records(\n\t file,\n\t &number_of_recovered_records,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 1 );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\t/* Test error cases\n\t */\n\tresult = libevtx_file_get_number_of_recovered_records(\n\t NULL,\n\t &number_of_recovered_records,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"error\",\n\t error );\n\n\tlibcerror_error_free(\n\t &error );\n\n\tresult = libevtx_file_get_number_of_recovered_records(\n\t file,\n\t NULL,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"error\",\n\t error );\n\n\tlibcerror_error_free(\n\t &error );\n\n\treturn( 1 );\n\non_error:\n\tif( error != NULL )\n\t{\n\t\tlibcerror_error_free(\n\t\t &error );\n\t}\n\treturn( 0 );\n}\n\n/* Tests the libevtx_file_get_recovered_record_by_index function\n * Returns 1 if successful or 0 if not\n */\nint evtx_test_file_get_recovered_record_by_index(\n libevtx_file_t *file )\n{\n\tlibcerror_error_t *error = NULL;\n\tlibevtx_record_t *recovered_record = 0;\n\tint number_of_recovered_records = 0;\n\tint result = 0;\n\n\t/* Initialize test\n\t */\n\tresult = libevtx_file_get_number_of_recovered_records(\n\t file,\n\t &number_of_recovered_records,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 1 );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\tif( number_of_recovered_records == 0 )\n\t{\n\t\treturn( 1 );\n\t}\n\t/* Test regular cases\n\t */\n\tresult = libevtx_file_get_recovered_record_by_index(\n\t file,\n\t 0,\n\t &recovered_record,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 1 );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"recovered_record\",\n\t recovered_record );\n\n\tresult = libevtx_record_free(\n\t &recovered_record,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 1 );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\t/* Test error cases\n\t */\n\tresult = libevtx_file_get_recovered_record_by_index(\n\t NULL,\n\t 0,\n\t &recovered_record,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"recovered_record\",\n\t recovered_record );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"error\",\n\t error );\n\n\tlibcerror_error_free(\n\t &error );\n\n\tresult = libevtx_file_get_recovered_record_by_index(\n\t file,\n\t -1,\n\t &recovered_record,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"recovered_record\",\n\t recovered_record );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"error\",\n\t error );\n\n\tlibcerror_error_free(\n\t &error );\n\n\tresult = libevtx_file_get_recovered_record_by_index(\n\t file,\n\t 0,\n\t NULL,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"recovered_record\",\n\t recovered_record );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"error\",\n\t error );\n\n\tlibcerror_error_free(\n\t &error );\n\n\treturn( 1 );\n\non_error:\n\tif( error != NULL )\n\t{\n\t\tlibcerror_error_free(\n\t\t &error );\n\t}\n\treturn( 0 );\n}\n\n/* The main program\n */\n#if defined( HAVE_WIDE_SYSTEM_CHARACTER )\nint wmain(\n int argc,\n wchar_t * const argv[] )\n#else\nint main(\n int argc,\n char * const argv[] )\n#endif\n{\n\tlibbfio_handle_t *file_io_handle = NULL;\n\tlibcerror_error_t *error = NULL;\n\tlibevtx_file_t *file = NULL;\n\tsystem_character_t *source = NULL;\n\tsystem_integer_t option = 0;\n\tsize_t string_length = 0;\n\tint result = 0;\n\n\twhile( ( option = evtx_test_getopt(\n\t argc,\n\t argv,\n\t _SYSTEM_STRING( \"\" ) ) ) != (system_integer_t) -1 )\n\t{\n\t\tswitch( option )\n\t\t{\n\t\t\tcase (system_integer_t) '?':\n\t\t\tdefault:\n\t\t\t\tfprintf(\n\t\t\t\t stderr,\n\t\t\t\t \"Invalid argument: %\" PRIs_SYSTEM \".\\n\",\n\t\t\t\t argv[ optind - 1 ] );\n\n\t\t\t\treturn( EXIT_FAILURE );\n\t\t}\n\t}\n\tif( optind < argc )\n\t{\n\t\tsource = argv[ optind ];\n\t}\n#if defined( HAVE_DEBUG_OUTPUT ) && defined( EVTX_TEST_FILE_VERBOSE )\n\tlibevtx_notify_set_verbose(\n\t 1 );\n\tlibevtx_notify_set_stream(\n\t stderr,\n\t NULL );\n#endif\n\n\tEVTX_TEST_RUN(\n\t \"libevtx_file_initialize\",\n\t evtx_test_file_initialize );\n\n\tEVTX_TEST_RUN(\n\t \"libevtx_file_free\",\n\t evtx_test_file_free );\n\n#if !defined( __BORLANDC__ ) || ( __BORLANDC__ >= 0x0560 )\n\tif( source != NULL )\n\t{\n\t\tresult = libbfio_file_initialize(\n\t\t &file_io_handle,\n\t\t &error );\n\n\t\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t\t \"result\",\n\t\t result,\n\t\t 1 );\n\n\t EVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"file_io_handle\",\n\t file_io_handle );\n\n\t EVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\t\tstring_length = system_string_length(\n\t\t source );\n\n#if defined( HAVE_WIDE_SYSTEM_CHARACTER )\n\t\tresult = libbfio_file_set_name_wide(\n\t\t file_io_handle,\n\t\t source,\n\t\t string_length,\n\t\t &error );\n#else\n\t\tresult = libbfio_file_set_name(\n\t\t file_io_handle,\n\t\t source,\n\t\t string_length,\n\t\t &error );\n#endif\n\t\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t\t \"result\",\n\t\t result,\n\t\t 1 );\n\n\t EVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\t\tresult = libevtx_check_file_signature_file_io_handle(\n\t\t file_io_handle,\n\t\t &error );\n\n\t\tEVTX_TEST_ASSERT_NOT_EQUAL_INT(\n\t\t \"result\",\n\t\t result,\n\t\t -1 );\n\n\t\tEVTX_TEST_ASSERT_IS_NULL(\n\t\t \"error\",\n\t\t error );\n\t}\n\tif( result != 0 )\n\t{\n\t\tEVTX_TEST_RUN_WITH_ARGS(\n\t\t \"libevtx_file_open\",\n\t\t evtx_test_file_open,\n\t\t source );\n\n#if defined( HAVE_WIDE_CHARACTER_TYPE )\n\n\t\tEVTX_TEST_RUN_WITH_ARGS(\n\t\t \"libevtx_file_open_wide\",\n\t\t evtx_test_file_open_wide,\n\t\t source );\n\n#endif /* defined( HAVE_WIDE_CHARACTER_TYPE ) */\n\n\t\tEVTX_TEST_RUN_WITH_ARGS(\n\t\t \"libevtx_file_open_file_io_handle\",\n\t\t evtx_test_file_open_file_io_handle,\n\t\t source );\n\n\t\tEVTX_TEST_RUN(\n\t\t \"libevtx_file_close\",\n\t\t evtx_test_file_close );\n\n\t\tEVTX_TEST_RUN_WITH_ARGS(\n\t\t \"libevtx_file_open_close\",\n\t\t evtx_test_file_open_close,\n\t\t source );\n\n\t\t/* Initialize file for tests\n\t\t */\n\t\tresult = evtx_test_file_open_source(\n\t\t &file,\n\t\t file_io_handle,\n\t\t &error );\n\n\t\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t\t \"result\",\n\t\t result,\n\t\t 1 );\n\n\t\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t\t \"file\",\n\t\t file );\n\n\t\tEVTX_TEST_ASSERT_IS_NULL(\n\t\t \"error\",\n\t\t error );\n\n\t\tEVTX_TEST_RUN_WITH_ARGS(\n\t\t \"libevtx_file_signal_abort\",\n\t\t evtx_test_file_signal_abort,\n\t\t file );\n\n#if defined( __GNUC__ ) && !defined( LIBEVTX_DLL_IMPORT )\n\n\t\t/* TODO: add tests for libevtx_file_open_read */\n\n#endif /* defined( __GNUC__ ) && !defined( LIBEVTX_DLL_IMPORT ) */\n\n\t\t/* TODO: add tests for libevtx_file_is_corrupted */\n\n\t\tEVTX_TEST_RUN_WITH_ARGS(\n\t\t \"libevtx_file_get_ascii_codepage\",\n\t\t evtx_test_file_get_ascii_codepage,\n\t\t file );\n\n\t\tEVTX_TEST_RUN_WITH_ARGS(\n\t\t \"libevtx_file_set_ascii_codepage\",\n\t\t evtx_test_file_set_ascii_codepage,\n\t\t file );\n\n\t\t/* TODO: add tests for libevtx_file_get_format_version */\n\n\t\t/* TODO: add tests for libevtx_file_get_version */\n\n\t\tEVTX_TEST_RUN_WITH_ARGS(\n\t\t \"libevtx_file_get_flags\",\n\t\t evtx_test_file_get_flags,\n\t\t file );\n\n\t\tEVTX_TEST_RUN_WITH_ARGS(\n\t\t \"libevtx_file_get_number_of_records\",\n\t\t evtx_test_file_get_number_of_records,\n\t\t file );\n\n\t\tEVTX_TEST_RUN_WITH_ARGS(\n\t\t \"libevtx_file_get_record_by_index\",\n\t\t evtx_test_file_get_record_by_index,\n\t\t file );\n\n\t\tEVTX_TEST_RUN_WITH_ARGS(\n\t\t \"libevtx_file_get_number_of_recovered_records\",\n\t\t evtx_test_file_get_number_of_recovered_records,\n\t\t file );\n\n#if defined( TODO )\n\n\t\tEVTX_TEST_RUN_WITH_ARGS(\n\t\t \"libevtx_file_get_recovered_record_by_index\",\n\t\t evtx_test_file_get_recovered_record_by_index,\n\t\t file );\n\n#endif /* defined( TODO ) */\n\n\t\t/* Clean up\n\t\t */\n\t\tresult = evtx_test_file_close_source(\n\t\t &file,\n\t\t &error );\n\n\t\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t\t \"result\",\n\t\t result,\n\t\t 0 );\n\n\t\tEVTX_TEST_ASSERT_IS_NULL(\n\t\t \"file\",\n\t\t file );\n\n\t\tEVTX_TEST_ASSERT_IS_NULL(\n\t\t \"error\",\n\t\t error );\n\n\t\tresult = libbfio_handle_free(\n\t\t &file_io_handle,\n\t\t &error );\n\n\t\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t\t \"result\",\n\t\t result,\n\t\t 1 );\n\n\t\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"file_io_handle\",\n\t file_io_handle );\n\n\t EVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\t}\n#endif /* !defined( __BORLANDC__ ) || ( __BORLANDC__ >= 0x0560 ) */\n\n\treturn( EXIT_SUCCESS );\n\non_error:\n\tif( error != NULL )\n\t{\n\t\tlibcerror_error_free(\n\t\t &error );\n\t}\n\tif( file != NULL )\n\t{\n\t\tlibevtx_file_free(\n\t\t &file,\n\t\t NULL );\n\t}\n\tif( file_io_handle != NULL )\n\t{\n\t\tlibbfio_handle_free(\n\t\t &file_io_handle,\n\t\t NULL );\n\t}\n\treturn( EXIT_FAILURE );\n}\n\n" }, { "path": "tests/evtx_test_functions.c", "content": "/*\n * Functions for testing\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#include \n#include \n#include \n#include \n#include \n#include \n\n#if defined( HAVE_STDLIB_H ) || defined( WINAPI )\n#include \n#endif\n\n#include \"evtx_test_libbfio.h\"\n#include \"evtx_test_libcerror.h\"\n#include \"evtx_test_libclocale.h\"\n#include \"evtx_test_libuna.h\"\n\n/* Retrieves source as a narrow string\n * Returns 1 if successful or -1 on error\n */\nint evtx_test_get_narrow_source(\n const system_character_t *source,\n char *narrow_string,\n size_t narrow_string_size,\n libcerror_error_t **error )\n{\n\tstatic char *function = \"evtx_test_get_narrow_source\";\n\tsize_t narrow_source_size = 0;\n\tsize_t source_length = 0;\n\n#if defined( HAVE_WIDE_SYSTEM_CHARACTER )\n\tint result = 0;\n#endif\n\n\tif( source == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid source.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( narrow_string == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid narrow string.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( narrow_string_size > (size_t) SSIZE_MAX )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_VALUE_EXCEEDS_MAXIMUM,\n\t\t \"%s: invalid narrow string size value exceeds maximum.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tsource_length = system_string_length(\n\t source );\n\n\tif( source_length > (size_t) ( SSIZE_MAX - 1 ) )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,\n\t\t \"%s: invalid source length value out of bounds.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n#if defined( HAVE_WIDE_SYSTEM_CHARACTER )\n\tif( libclocale_codepage == 0 )\n\t{\n#if SIZEOF_WCHAR_T == 4\n\t\tresult = libuna_utf8_string_size_from_utf32(\n\t\t (libuna_utf32_character_t *) source,\n\t\t source_length + 1,\n\t\t &narrow_source_size,\n\t\t error );\n#elif SIZEOF_WCHAR_T == 2\n\t\tresult = libuna_utf8_string_size_from_utf16(\n\t\t (libuna_utf16_character_t *) source,\n\t\t source_length + 1,\n\t\t &narrow_source_size,\n\t\t error );\n#endif\n\t}\n\telse\n\t{\n#if SIZEOF_WCHAR_T == 4\n\t\tresult = libuna_byte_stream_size_from_utf32(\n\t\t (libuna_utf32_character_t *) source,\n\t\t source_length + 1,\n\t\t libclocale_codepage,\n\t\t &narrow_source_size,\n\t\t error );\n#elif SIZEOF_WCHAR_T == 2\n\t\tresult = libuna_byte_stream_size_from_utf16(\n\t\t (libuna_utf16_character_t *) source,\n\t\t source_length + 1,\n\t\t libclocale_codepage,\n\t\t &narrow_source_size,\n\t\t error );\n#endif\n\t}\n\tif( result != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_CONVERSION,\n\t\t LIBCERROR_CONVERSION_ERROR_GENERIC,\n\t\t \"%s: unable to determine narrow string size.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n#else\n\tnarrow_source_size = source_length + 1;\n\n#endif /* defined( HAVE_WIDE_SYSTEM_CHARACTER ) */\n\n\tif( narrow_string_size < narrow_source_size )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_VALUE_TOO_SMALL,\n\t\t \"%s: narrow string too small.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n#if defined( HAVE_WIDE_SYSTEM_CHARACTER )\n\tif( libclocale_codepage == 0 )\n\t{\n#if SIZEOF_WCHAR_T == 4\n\t\tresult = libuna_utf8_string_copy_from_utf32(\n\t\t (libuna_utf8_character_t *) narrow_string,\n\t\t narrow_string_size,\n\t\t (libuna_utf32_character_t *) source,\n\t\t source_length + 1,\n\t\t error );\n#elif SIZEOF_WCHAR_T == 2\n\t\tresult = libuna_utf8_string_copy_from_utf16(\n\t\t (libuna_utf8_character_t *) narrow_string,\n\t\t narrow_string_size,\n\t\t (libuna_utf16_character_t *) source,\n\t\t source_length + 1,\n\t\t error );\n#endif\n\t}\n\telse\n\t{\n#if SIZEOF_WCHAR_T == 4\n\t\tresult = libuna_byte_stream_copy_from_utf32(\n\t\t (uint8_t *) narrow_string,\n\t\t narrow_string_size,\n\t\t libclocale_codepage,\n\t\t (libuna_utf32_character_t *) source,\n\t\t source_length + 1,\n\t\t error );\n#elif SIZEOF_WCHAR_T == 2\n\t\tresult = libuna_byte_stream_copy_from_utf16(\n\t\t (uint8_t *) narrow_string,\n\t\t narrow_string_size,\n\t\t libclocale_codepage,\n\t\t (libuna_utf16_character_t *) source,\n\t\t source_length + 1,\n\t\t error );\n#endif\n\t}\n\tif( result != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_CONVERSION,\n\t\t LIBCERROR_CONVERSION_ERROR_GENERIC,\n\t\t \"%s: unable to set narrow string.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n#else\n\tif( system_string_copy(\n\t narrow_string,\n\t source,\n\t source_length ) == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_MEMORY,\n\t\t LIBCERROR_MEMORY_ERROR_COPY_FAILED,\n\t\t \"%s: unable to set narrow string.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tnarrow_string[ source_length ] = 0;\n\n#endif /* defined( HAVE_WIDE_SYSTEM_CHARACTER ) */\n\n\treturn( 1 );\n}\n\n#if defined( HAVE_WIDE_CHARACTER_TYPE )\n\n/* Retrieves source as a wide string\n * Returns 1 if successful or -1 on error\n */\nint evtx_test_get_wide_source(\n const system_character_t *source,\n wchar_t *wide_string,\n size_t wide_string_size,\n libcerror_error_t **error )\n{\n\tstatic char *function = \"evtx_test_get_wide_source\";\n\tsize_t wide_source_size = 0;\n\tsize_t source_length = 0;\n\n#if !defined( HAVE_WIDE_SYSTEM_CHARACTER )\n\tint result = 0;\n#endif\n\n\tif( source == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid source.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( wide_string == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid wide string.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( wide_string_size > (size_t) SSIZE_MAX )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_VALUE_EXCEEDS_MAXIMUM,\n\t\t \"%s: invalid wide string size value exceeds maximum.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tsource_length = system_string_length(\n\t source );\n\n\tif( source_length > (size_t) ( SSIZE_MAX - 1 ) )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,\n\t\t \"%s: invalid source length value out of bounds.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n#if defined( HAVE_WIDE_SYSTEM_CHARACTER )\n\twide_source_size = source_length + 1;\n#else\n\tif( libclocale_codepage == 0 )\n\t{\n#if SIZEOF_WCHAR_T == 4\n\t\tresult = libuna_utf32_string_size_from_utf8(\n\t\t (libuna_utf8_character_t *) source,\n\t\t source_length + 1,\n\t\t &wide_source_size,\n\t\t error );\n#elif SIZEOF_WCHAR_T == 2\n\t\tresult = libuna_utf16_string_size_from_utf8(\n\t\t (libuna_utf8_character_t *) source,\n\t\t source_length + 1,\n\t\t &wide_source_size,\n\t\t error );\n#endif\n\t}\n\telse\n\t{\n#if SIZEOF_WCHAR_T == 4\n\t\tresult = libuna_utf32_string_size_from_byte_stream(\n\t\t (uint8_t *) source,\n\t\t source_length + 1,\n\t\t libclocale_codepage,\n\t\t &wide_source_size,\n\t\t error );\n#elif SIZEOF_WCHAR_T == 2\n\t\tresult = libuna_utf16_string_size_from_byte_stream(\n\t\t (uint8_t *) source,\n\t\t source_length + 1,\n\t\t libclocale_codepage,\n\t\t &wide_source_size,\n\t\t error );\n#endif\n\t}\n\tif( result != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_CONVERSION,\n\t\t LIBCERROR_CONVERSION_ERROR_GENERIC,\n\t\t \"%s: unable to determine wide string size.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n#endif /* defined( HAVE_WIDE_SYSTEM_CHARACTER ) */\n\n\tif( wide_string_size < wide_source_size )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_VALUE_TOO_SMALL,\n\t\t \"%s: wide string too small.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n#if defined( HAVE_WIDE_SYSTEM_CHARACTER )\n\tif( system_string_copy(\n\t wide_string,\n\t source,\n\t source_length ) == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_MEMORY,\n\t\t LIBCERROR_MEMORY_ERROR_COPY_FAILED,\n\t\t \"%s: unable to set wide string.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\twide_string[ source_length ] = 0;\n#else\n\tif( libclocale_codepage == 0 )\n\t{\n#if SIZEOF_WCHAR_T == 4\n\t\tresult = libuna_utf32_string_copy_from_utf8(\n\t\t (libuna_utf32_character_t *) wide_string,\n\t\t wide_string_size,\n\t\t (uint8_t *) source,\n\t\t source_length + 1,\n\t\t error );\n#elif SIZEOF_WCHAR_T == 2\n\t\tresult = libuna_utf16_string_copy_from_utf8(\n\t\t (libuna_utf16_character_t *) wide_string,\n\t\t wide_string_size,\n\t\t (uint8_t *) source,\n\t\t source_length + 1,\n\t\t error );\n#endif\n\t}\n\telse\n\t{\n#if SIZEOF_WCHAR_T == 4\n\t\tresult = libuna_utf32_string_copy_from_byte_stream(\n\t\t (libuna_utf32_character_t *) wide_string,\n\t\t wide_string_size,\n\t\t (uint8_t *) source,\n\t\t source_length + 1,\n\t\t libclocale_codepage,\n\t\t error );\n#elif SIZEOF_WCHAR_T == 2\n\t\tresult = libuna_utf16_string_copy_from_byte_stream(\n\t\t (libuna_utf16_character_t *) wide_string,\n\t\t wide_string_size,\n\t\t (uint8_t *) source,\n\t\t source_length + 1,\n\t\t libclocale_codepage,\n\t\t error );\n#endif\n\t}\n\tif( result != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_CONVERSION,\n\t\t LIBCERROR_CONVERSION_ERROR_GENERIC,\n\t\t \"%s: unable to set wide string.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\n#endif /* defined( HAVE_WIDE_SYSTEM_CHARACTER ) */\n\n\treturn( 1 );\n}\n\n#endif /* defined( HAVE_WIDE_CHARACTER_TYPE ) */\n\n/* Creates a file IO handle for test data\n * Returns 1 if successful or -1 on error\n */\nint evtx_test_open_file_io_handle(\n libbfio_handle_t **file_io_handle,\n uint8_t *data,\n size_t data_size,\n libcerror_error_t **error )\n{\n\tstatic char *function = \"evtx_test_open_file_io_handle\";\n\n\tif( file_io_handle == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid file IO handle.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( libbfio_memory_range_initialize(\n\t file_io_handle,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_INITIALIZE_FAILED,\n\t\t \"%s: unable to create file IO handle.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tif( libbfio_memory_range_set(\n\t *file_io_handle,\n\t data,\n\t data_size,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_SET_FAILED,\n\t\t \"%s: unable to set memory range of file IO handle.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\tif( libbfio_handle_open(\n\t *file_io_handle,\n\t LIBBFIO_OPEN_READ,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_IO,\n\t\t LIBCERROR_IO_ERROR_OPEN_FAILED,\n\t\t \"%s: unable to open file IO handle.\",\n\t\t function );\n\n\t\tgoto on_error;\n\t}\n\treturn( 1 );\n\non_error:\n\tif( *file_io_handle != NULL )\n\t{\n\t\tlibbfio_handle_free(\n\t\t file_io_handle,\n\t\t NULL );\n\t}\n\treturn( -1 );\n}\n\n/* Closes a file IO handle for test data\n * Returns 0 if successful or -1 on error\n */\nint evtx_test_close_file_io_handle(\n libbfio_handle_t **file_io_handle,\n libcerror_error_t **error )\n{\n\tstatic char *function = \"evtx_test_close_file_io_handle\";\n\tint result = 0;\n\n\tif( file_io_handle == NULL )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_ARGUMENTS,\n\t\t LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,\n\t\t \"%s: invalid file IO handle.\",\n\t\t function );\n\n\t\treturn( -1 );\n\t}\n\tif( libbfio_handle_close(\n\t *file_io_handle,\n\t error ) != 0 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_IO,\n\t\t LIBCERROR_IO_ERROR_CLOSE_FAILED,\n\t\t \"%s: unable to close file IO handle.\",\n\t\t function );\n\n\t\tresult = -1;\n\t}\n\tif( libbfio_handle_free(\n\t file_io_handle,\n\t error ) != 1 )\n\t{\n\t\tlibcerror_error_set(\n\t\t error,\n\t\t LIBCERROR_ERROR_DOMAIN_RUNTIME,\n\t\t LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED,\n\t\t \"%s: unable to free file IO handle.\",\n\t\t function );\n\n\t\tresult = -1;\n\t}\n\treturn( result );\n}\n\n" }, { "path": "tests/evtx_test_functions.h", "content": "/*\n * Functions for testing\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#if !defined( _EVTX_TEST_FUNCTIONS_H )\n#define _EVTX_TEST_FUNCTIONS_H\n\n#include \n#include \n\n#include \"evtx_test_libbfio.h\"\n#include \"evtx_test_libcerror.h\"\n\n#if defined( __cplusplus )\nextern \"C\" {\n#endif\n\nint evtx_test_get_narrow_source(\n const system_character_t *source,\n char *narrow_string,\n size_t narrow_string_size,\n libcerror_error_t **error );\n\n#if defined( HAVE_WIDE_CHARACTER_TYPE )\n\nint evtx_test_get_wide_source(\n const system_character_t *source,\n wchar_t *wide_string,\n size_t wide_string_size,\n libcerror_error_t **error );\n\n#endif /* defined( HAVE_WIDE_CHARACTER_TYPE ) */\n\nint evtx_test_open_file_io_handle(\n libbfio_handle_t **file_io_handle,\n uint8_t *data,\n size_t data_size,\n libcerror_error_t **error );\n\nint evtx_test_close_file_io_handle(\n libbfio_handle_t **file_io_handle,\n libcerror_error_t **error );\n\n#if defined( __cplusplus )\n}\n#endif\n\n#endif /* !defined( _EVTX_TEST_FUNCTIONS_H ) */\n\n" }, { "path": "tests/evtx_test_getopt.c", "content": "/*\n * GetOpt functions\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#include \n#include \n#include \n#include \n#include \n\n#if defined( HAVE_STDLIB_H ) || defined( WINAPI )\n#include \n#endif\n\n#include \"evtx_test_getopt.h\"\n#include \"evtx_test_libcnotify.h\"\n\n#if !defined( HAVE_GETOPT )\n\n/* The option index\n * Start with argument 1 (argument 0 is the program name)\n */\nint optind = 1;\n\n/* The current option argument\n */\nsystem_character_t *optarg = NULL;\n\n/* Value to indicate the current option\n */\nsystem_integer_t optopt = 0;\n\n/* The next option in a group\n */\nsystem_character_t *next_option = NULL;\n\n/* Get the program options\n * Function for platforms that do not have the getopt function\n * Returns the option character processed, or -1 on error,\n * ? if the option was not in the options string, : if the option argument was missing\n */\nsystem_integer_t evtx_test_getopt(\n int argument_count,\n system_character_t * const argument_values[],\n const system_character_t *options_string )\n{\n\tsystem_character_t *argument_value = NULL;\n\tsystem_character_t *option_value = NULL;\n\tstatic char *function = \"evtx_test_getopt\";\n\tsize_t options_string_length = 0;\n\n\tif( next_option != NULL )\n\t{\n\t\targument_value = next_option;\n\t\tnext_option = NULL;\n\t}\n\telse if( optind >= argument_count )\n\t{\n\t\treturn( (system_integer_t) -1 );\n\t}\n\telse\n\t{\n\t\targument_value = argument_values[ optind ];\n\n\t\t/* Check if the argument value is not an empty string\n\t\t */\n\t\tif( *argument_value == (system_character_t) '\\0' )\n\t\t{\n\t\t\treturn( (system_integer_t) -1 );\n\t\t}\n\t\t/* Check if the first character is a option marker '-'\n\t\t */\n\t\tif( *argument_value != (system_character_t) '-' )\n\t\t{\n\t\t\treturn( (system_integer_t) -1 );\n\t\t}\n\t\targument_value++;\n\n\t\t/* Check if long options are provided '--'\n\t\t */\n\t\tif( *argument_value == (system_character_t) '-' )\n\t\t{\n\t\t\toptind++;\n\n\t\t\treturn( (system_integer_t) -1 );\n\t\t}\n\t}\n\toptions_string_length = system_string_length(\n\t options_string );\n\n\toptopt = *argument_value;\n\toption_value = system_string_search_character(\n\t options_string,\n\t optopt,\n\t options_string_length );\n\n\targument_value++;\n\n\t/* Check if an argument was specified or that the option was not found\n\t * in the option string\n\t */\n\tif( ( optopt == (system_integer_t) ':' )\n\t || ( option_value == NULL ) )\n\t{\n\t\tif( *argument_value == (system_character_t) '\\0' )\n\t\t{\n\t\t\toptind++;\n\t\t}\n\t\tif( ( *options_string != (system_character_t) ':' )\n\t\t && ( optopt != (system_integer_t) '?' ) )\n\t\t{\n\t\t\tlibcnotify_printf(\n\t\t\t \"%s: no such option: %\" PRIc_SYSTEM \".\\n\",\n\t\t\t function,\n\t\t\t optopt );\n\t\t}\n\t\treturn( (system_integer_t) '?' );\n\t}\n\toption_value++;\n\n\t/* Check if no option argument is required\n\t */\n\tif( *option_value != (system_character_t) ':' )\n\t{\n\t\toptarg = NULL;\n\n\t\tif( *argument_value == (system_character_t) '\\0' )\n\t\t{\n\t\t\toptind++;\n\t\t}\n\t\telse\n\t\t{\n\t\t\t/* Multiple options are grouped\n\t\t\t */\n\t\t\tnext_option = argument_value;\n\t\t}\n\t}\n\t/* Check if the argument is right after the option flag with no space in between\n\t */\n\telse if( *argument_value != (system_character_t) '\\0' )\n\t{\n\t\toptarg = argument_value;\n\n\t\toptind++;\n\t}\n\telse\n\t{\n\t\toptind++;\n\n\t\t/* Check if the argument was provided as the next argument value\n\t\t */\n\t\tif( argument_count <= optind )\n\t\t{\n\t\t\tif( *option_value == ':' )\n\t\t\t{\n\t\t\t\treturn( (system_integer_t) ':' );\n\t\t\t}\n\t\t\tlibcnotify_printf(\n\t\t\t \"%s: option: %\" PRIc_SYSTEM \" requires an argument.\\n\",\n\t\t\t function,\n\t\t\t optopt );\n\n\t\t\treturn( (system_integer_t) '?' );\n\t\t}\n\t\toptarg = argument_values[ optind ];\n\n\t\toptind++;\n\t}\n\treturn( optopt );\n}\n\n#endif /* !defined( HAVE_GETOPT ) */\n\n" }, { "path": "tests/evtx_test_getopt.h", "content": "/*\n * GetOpt functions\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#if !defined( _EVTX_TEST_GETOPT_H )\n#define _EVTX_TEST_GETOPT_H\n\n#include \n#include \n\n/* unistd.h is included here to export getopt, optarg, optind and optopt\n */\n#if defined( HAVE_UNISTD_H )\n#include \n#endif\n\n#if defined( __cplusplus )\nextern \"C\" {\n#endif\n\n#if defined( HAVE_GETOPT )\n#define evtx_test_getopt( argument_count, argument_values, options_string ) \\\n\tgetopt( argument_count, argument_values, options_string )\n\n#else\n\n#if !defined( __CYGWIN__ )\nextern int optind;\nextern system_character_t *optarg;\nextern system_integer_t optopt;\n\n#else\nint optind;\nsystem_character_t *optarg;\nsystem_integer_t optopt;\n\n#endif /* !defined( __CYGWIN__ ) */\n\nsystem_integer_t evtx_test_getopt(\n int argument_count,\n system_character_t * const argument_values[],\n const system_character_t *options_string );\n\n#endif /* defined( HAVE_GETOPT ) */\n\n#if defined( __cplusplus )\n}\n#endif\n\n#endif /* !defined( _EVTX_TEST_GETOPT_H ) */\n\n" }, { "path": "tests/evtx_test_io_handle.c", "content": "/*\n * Library io_handle type test program\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#include \n#include \n#include \n\n#if defined( HAVE_STDLIB_H ) || defined( WINAPI )\n#include \n#endif\n\n#include \"evtx_test_libcerror.h\"\n#include \"evtx_test_libevtx.h\"\n#include \"evtx_test_macros.h\"\n#include \"evtx_test_memory.h\"\n#include \"evtx_test_unused.h\"\n\n#include \"../libevtx/libevtx_io_handle.h\"\n\n#if defined( __GNUC__ ) && !defined( LIBEVTX_DLL_IMPORT )\n\n/* Tests the libevtx_io_handle_initialize function\n * Returns 1 if successful or 0 if not\n */\nint evtx_test_io_handle_initialize(\n void )\n{\n\tlibcerror_error_t *error = NULL;\n\tlibevtx_io_handle_t *io_handle = NULL;\n\tint result = 0;\n\n#if defined( HAVE_EVTX_TEST_MEMORY )\n\tint number_of_malloc_fail_tests = 1;\n\tint number_of_memset_fail_tests = 1;\n\tint test_number = 0;\n#endif\n\n\t/* Test regular cases\n\t */\n\tresult = libevtx_io_handle_initialize(\n\t &io_handle,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"io_handle\",\n\t io_handle );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\tresult = libevtx_io_handle_free(\n\t &io_handle,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 1 );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"io_handle\",\n\t io_handle );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\t/* Test error cases\n\t */\n\tresult = libevtx_io_handle_initialize(\n\t NULL,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"error\",\n\t error );\n\n\tlibcerror_error_free(\n\t &error );\n\n\tio_handle = (libevtx_io_handle_t *) 0x12345678UL;\n\n\tresult = libevtx_io_handle_initialize(\n\t &io_handle,\n\t &error );\n\n\tio_handle = NULL;\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"error\",\n\t error );\n\n\tlibcerror_error_free(\n\t &error );\n\n#if defined( HAVE_EVTX_TEST_MEMORY )\n\n\tfor( test_number = 0;\n\t test_number < number_of_malloc_fail_tests;\n\t test_number++ )\n\t{\n\t\t/* Test libevtx_io_handle_initialize with malloc failing\n\t\t */\n\t\tevtx_test_malloc_attempts_before_fail = test_number;\n\n\t\tresult = libevtx_io_handle_initialize(\n\t\t &io_handle,\n\t\t &error );\n\n\t\tif( evtx_test_malloc_attempts_before_fail != -1 )\n\t\t{\n\t\t\tevtx_test_malloc_attempts_before_fail = -1;\n\n\t\t\tif( io_handle != NULL )\n\t\t\t{\n\t\t\t\tlibevtx_io_handle_free(\n\t\t\t\t &io_handle,\n\t\t\t\t NULL );\n\t\t\t}\n\t\t}\n\t\telse\n\t\t{\n\t\t\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t\t\t \"result\",\n\t\t\t result,\n\t\t\t -1 );\n\n\t\t\tEVTX_TEST_ASSERT_IS_NULL(\n\t\t\t \"io_handle\",\n\t\t\t io_handle );\n\n\t\t\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t\t\t \"error\",\n\t\t\t error );\n\n\t\t\tlibcerror_error_free(\n\t\t\t &error );\n\t\t}\n\t}\n\tfor( test_number = 0;\n\t test_number < number_of_memset_fail_tests;\n\t test_number++ )\n\t{\n\t\t/* Test libevtx_io_handle_initialize with memset failing\n\t\t */\n\t\tevtx_test_memset_attempts_before_fail = test_number;\n\n\t\tresult = libevtx_io_handle_initialize(\n\t\t &io_handle,\n\t\t &error );\n\n\t\tif( evtx_test_memset_attempts_before_fail != -1 )\n\t\t{\n\t\t\tevtx_test_memset_attempts_before_fail = -1;\n\n\t\t\tif( io_handle != NULL )\n\t\t\t{\n\t\t\t\tlibevtx_io_handle_free(\n\t\t\t\t &io_handle,\n\t\t\t\t NULL );\n\t\t\t}\n\t\t}\n\t\telse\n\t\t{\n\t\t\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t\t\t \"result\",\n\t\t\t result,\n\t\t\t -1 );\n\n\t\t\tEVTX_TEST_ASSERT_IS_NULL(\n\t\t\t \"io_handle\",\n\t\t\t io_handle );\n\n\t\t\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t\t\t \"error\",\n\t\t\t error );\n\n\t\t\tlibcerror_error_free(\n\t\t\t &error );\n\t\t}\n\t}\n#endif /* defined( HAVE_EVTX_TEST_MEMORY ) */\n\n\treturn( 1 );\n\non_error:\n\tif( error != NULL )\n\t{\n\t\tlibcerror_error_free(\n\t\t &error );\n\t}\n\tif( io_handle != NULL )\n\t{\n\t\tlibevtx_io_handle_free(\n\t\t &io_handle,\n\t\t NULL );\n\t}\n\treturn( 0 );\n}\n\n/* Tests the libevtx_io_handle_free function\n * Returns 1 if successful or 0 if not\n */\nint evtx_test_io_handle_free(\n void )\n{\n\tlibcerror_error_t *error = NULL;\n\tint result = 0;\n\n\t/* Test error cases\n\t */\n\tresult = libevtx_io_handle_free(\n\t NULL,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"error\",\n\t error );\n\n\tlibcerror_error_free(\n\t &error );\n\n\treturn( 1 );\n\non_error:\n\tif( error != NULL )\n\t{\n\t\tlibcerror_error_free(\n\t\t &error );\n\t}\n\treturn( 0 );\n}\n\n/* Tests the libevtx_io_handle_clear function\n * Returns 1 if successful or 0 if not\n */\nint evtx_test_io_handle_clear(\n void )\n{\n\tlibcerror_error_t *error = NULL;\n\tlibevtx_io_handle_t *io_handle = NULL;\n\tint result = 0;\n\n\t/* Initialize test\n\t */\n\tresult = libevtx_io_handle_initialize(\n\t &io_handle,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"io_handle\",\n\t io_handle );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\t/* Test regular cases\n\t */\n\tresult = libevtx_io_handle_clear(\n\t io_handle,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 1 );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\t/* Test error cases\n\t */\n\tresult = libevtx_io_handle_clear(\n\t NULL,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"error\",\n\t error );\n\n\tlibcerror_error_free(\n\t &error );\n\n#if defined( HAVE_EVTX_TEST_MEMORY )\n\n\t/* Test libevtx_io_handle_clear with memset failing\n\t */\n\tevtx_test_memset_attempts_before_fail = 0;\n\n\tresult = libevtx_io_handle_clear(\n\t io_handle,\n\t &error );\n\n\tif( evtx_test_memset_attempts_before_fail != -1 )\n\t{\n\t\tevtx_test_memset_attempts_before_fail = -1;\n\t}\n\telse\n\t{\n\t\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t\t \"result\",\n\t\t result,\n\t\t -1 );\n\n\t\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t\t \"error\",\n\t\t error );\n\n\t\tlibcerror_error_free(\n\t\t &error );\n\t}\n#endif /* defined( HAVE_EVTX_TEST_MEMORY ) */\n\n\t/* Clean up\n\t */\n\tresult = libevtx_io_handle_free(\n\t &io_handle,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 1 );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"io_handle\",\n\t io_handle );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\treturn( 1 );\n\non_error:\n\tif( error != NULL )\n\t{\n\t\tlibcerror_error_free(\n\t\t &error );\n\t}\n\tif( io_handle != NULL )\n\t{\n\t\tlibevtx_io_handle_free(\n\t\t &io_handle,\n\t\t NULL );\n\t}\n\treturn( 0 );\n}\n\n#endif /* defined( __GNUC__ ) && !defined( LIBEVTX_DLL_IMPORT ) */\n\n/* The main program\n */\n#if defined( HAVE_WIDE_SYSTEM_CHARACTER )\nint wmain(\n int argc EVTX_TEST_ATTRIBUTE_UNUSED,\n wchar_t * const argv[] EVTX_TEST_ATTRIBUTE_UNUSED )\n#else\nint main(\n int argc EVTX_TEST_ATTRIBUTE_UNUSED,\n char * const argv[] EVTX_TEST_ATTRIBUTE_UNUSED )\n#endif\n{\n\tEVTX_TEST_UNREFERENCED_PARAMETER( argc )\n\tEVTX_TEST_UNREFERENCED_PARAMETER( argv )\n\n#if defined( __GNUC__ ) && !defined( LIBEVTX_DLL_IMPORT )\n\n\tEVTX_TEST_RUN(\n\t \"libevtx_io_handle_initialize\",\n\t evtx_test_io_handle_initialize );\n\n\tEVTX_TEST_RUN(\n\t \"libevtx_io_handle_free\",\n\t evtx_test_io_handle_free );\n\n\tEVTX_TEST_RUN(\n\t \"libevtx_io_handle_clear\",\n\t evtx_test_io_handle_clear );\n\n\t/* TODO: add tests for libevtx_io_handle_read_file_header */\n\n\t/* TODO: add tests for libevtx_io_handle_read_chunk */\n\n#endif /* defined( __GNUC__ ) && !defined( LIBEVTX_DLL_IMPORT ) */\n\n\treturn( EXIT_SUCCESS );\n\non_error:\n\treturn( EXIT_FAILURE );\n}\n\n" }, { "path": "tests/evtx_test_libbfio.h", "content": "/*\n * The libbfio header wrapper\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#if !defined( _EVTX_TEST_LIBBFIO_H )\n#define _EVTX_TEST_LIBBFIO_H\n\n#include \n\n/* Define HAVE_LOCAL_LIBBFIO for local use of libbfio\n */\n#if defined( HAVE_LOCAL_LIBBFIO )\n\n#include \n#include \n#include \n#include \n#include \n#include \n#include \n#include \n\n#else\n\n/* If libtool DLL support is enabled set LIBBFIO_DLL_IMPORT\n * before including libbfio.h\n */\n#if defined( _WIN32 ) && defined( DLL_IMPORT )\n#define LIBBFIO_DLL_IMPORT\n#endif\n\n#include \n\n#if defined( HAVE_MULTI_THREAD_SUPPORT ) && !defined( LIBBFIO_HAVE_MULTI_THREAD_SUPPORT )\n#error Multi-threading support requires libbfio with multi-threading support\n#endif\n\n#endif /* defined( HAVE_LOCAL_LIBBFIO ) */\n\n#endif /* !defined( _EVTX_TEST_LIBBFIO_H ) */\n\n" }, { "path": "tests/evtx_test_libcerror.h", "content": "/*\n * The libcerror header wrapper\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#if !defined( _EVTX_TEST_LIBCERROR_H )\n#define _EVTX_TEST_LIBCERROR_H\n\n#include \n\n/* Define HAVE_LOCAL_LIBCERROR for local use of libcerror\n */\n#if defined( HAVE_LOCAL_LIBCERROR )\n\n#include \n#include \n#include \n#include \n\n#else\n\n/* If libtool DLL support is enabled set LIBCERROR_DLL_IMPORT\n * before including libcerror.h\n */\n#if defined( _WIN32 ) && defined( DLL_IMPORT )\n#define LIBCERROR_DLL_IMPORT\n#endif\n\n#include \n\n#endif /* defined( HAVE_LOCAL_LIBCERROR ) */\n\n#endif /* !defined( _EVTX_TEST_LIBCERROR_H ) */\n\n" }, { "path": "tests/evtx_test_libclocale.h", "content": "/*\n * The libclocale header wrapper\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#if !defined( _EVTX_TEST_LIBCLOCALE_H )\n#define _EVTX_TEST_LIBCLOCALE_H\n\n#include \n\n/* Define HAVE_LOCAL_LIBCLOCALE for local use of libclocale\n */\n#if defined( HAVE_LOCAL_LIBCLOCALE )\n\n#include \n#include \n#include \n#include \n\n#else\n\n/* If libtool DLL support is enabled set LIBCLOCALE_DLL_IMPORT\n * before including libclocale.h\n */\n#if defined( _WIN32 ) && defined( DLL_IMPORT )\n#define LIBCLOCALE_DLL_IMPORT\n#endif\n\n#include \n\n#endif /* defined( HAVE_LOCAL_LIBCLOCALE ) */\n\n#endif /* !defined( _EVTX_TEST_LIBCLOCALE_H ) */\n\n" }, { "path": "tests/evtx_test_libcnotify.h", "content": "/*\n * The libcnotify header wrapper\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#if !defined( _EVTX_TEST_LIBCNOTIFY_H )\n#define _EVTX_TEST_LIBCNOTIFY_H\n\n#include \n\n/* Define HAVE_LOCAL_LIBCNOTIFY for local use of libcnotify\n */\n#if defined( HAVE_LOCAL_LIBCNOTIFY )\n\n#include \n#include \n#include \n#include \n\n#else\n\n/* If libtool DLL support is enabled set LIBCNOTIFY_DLL_IMPORT\n * before including libcnotify.h\n */\n#if defined( _WIN32 ) && defined( DLL_IMPORT )\n#define LIBCNOTIFY_DLL_IMPORT\n#endif\n\n#include \n\n#endif /* defined( HAVE_LOCAL_LIBCNOTIFY ) */\n\n#endif /* !defined( _EVTX_TEST_LIBCNOTIFY_H ) */\n\n" }, { "path": "tests/evtx_test_libevtx.h", "content": "/*\n * The libevtx header wrapper\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#if !defined( _EVTX_TEST_LIBEVTX_H )\n#define _EVTX_TEST_LIBEVTX_H\n\n#include \n\n#include \n\n#endif /* !defined( _EVTX_TEST_LIBEVTX_H ) */\n\n" }, { "path": "tests/evtx_test_libuna.h", "content": "/*\n * The libuna header wrapper\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#if !defined( _EVTX_TEST_LIBUNA_H )\n#define _EVTX_TEST_LIBUNA_H\n\n#include \n\n/* Define HAVE_LOCAL_LIBUNA for local use of libuna\n */\n#if defined( HAVE_LOCAL_LIBUNA )\n\n#include \n#include \n#include \n#include \n#include \n#include \n#include \n#include \n#include \n#include \n#include \n#include \n#include \n#include \n\n#else\n\n/* If libtool DLL support is enabled set LIBUNA_DLL_IMPORT\n * before including libuna.h\n */\n#if defined( _WIN32 ) && defined( DLL_IMPORT )\n#define LIBUNA_DLL_IMPORT\n#endif\n\n#include \n\n#endif /* defined( HAVE_LOCAL_LIBUNA ) */\n\n#endif /* !defined( _EVTX_TEST_LIBUNA_H ) */\n\n" }, { "path": "tests/evtx_test_macros.h", "content": "/*\n * Macros for testing\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#if !defined( _EVTX_TEST_MACROS_H )\n#define _EVTX_TEST_MACROS_H\n\n#include \n#include \n\n#if defined( HAVE_STDLIB_H ) || defined( WINAPI )\n#include \n#endif\n\n#define EVTX_TEST_ASSERT_EQUAL_INT( name, value, expected_value ) \\\n\tif( value != expected_value ) \\\n\t{ \\\n\t\tfprintf( stdout, \"%s:%d %s (%d) != %d\\n\", __FILE__, __LINE__, name, value, expected_value ); \\\n\t\tgoto on_error; \\\n\t}\n\n#define EVTX_TEST_ASSERT_NOT_EQUAL_INT( name, value, expected_value ) \\\n\tif( value == expected_value ) \\\n\t{ \\\n\t\tfprintf( stdout, \"%s:%d %s (%d) == %d\\n\", __FILE__, __LINE__, name, value, expected_value ); \\\n\t\tgoto on_error; \\\n\t}\n\n#define EVTX_TEST_ASSERT_GREATER_THAN_INT( name, value, expected_value ) \\\n\tif( value <= expected_value ) \\\n\t{ \\\n\t\tfprintf( stdout, \"%s:%d %s (%d) <= %d\\n\", __FILE__, __LINE__, name, value, expected_value ); \\\n\t\tgoto on_error; \\\n\t}\n\n#define EVTX_TEST_ASSERT_LESS_THAN_INT( name, value, expected_value ) \\\n\tif( value >= expected_value ) \\\n\t{ \\\n\t\tfprintf( stdout, \"%s:%d %s (%d) >= %d\\n\", __FILE__, __LINE__, name, value, expected_value ); \\\n\t\tgoto on_error; \\\n\t}\n\n#define EVTX_TEST_ASSERT_EQUAL_INTPTR( name, value, expected_value ) \\\n\tif( value != expected_value ) \\\n\t{ \\\n\t\tfprintf( stdout, \"%s:%d %s (0x%08x\" PRIjx \") != 0x%08x\" PRIjx \"\\n\", __FILE__, __LINE__, name, value, expected_value ); \\\n\t\tgoto on_error; \\\n\t}\n\n#define EVTX_TEST_ASSERT_NOT_EQUAL_INTPTR( name, value, expected_value ) \\\n\tif( value == expected_value ) \\\n\t{ \\\n\t\tfprintf( stdout, \"%s:%d %s (0x%08x\" PRIjx \") == 0x%08x\" PRIjx \"\\n\", __FILE__, __LINE__, name, value, expected_value ); \\\n\t\tgoto on_error; \\\n\t}\n\n#define EVTX_TEST_ASSERT_EQUAL_FLOAT( name, value, expected_value ) \\\n\tif( value != expected_value ) \\\n\t{ \\\n\t\tfprintf( stdout, \"%s:%d %s (%f) != %f\\n\", __FILE__, __LINE__, name, value, expected_value ); \\\n\t\tgoto on_error; \\\n\t}\n\n#define EVTX_TEST_ASSERT_NOT_EQUAL_FLOAT( name, value, expected_value ) \\\n\tif( value == expected_value ) \\\n\t{ \\\n\t\tfprintf( stdout, \"%s:%d %s (%f) == %f\\n\", __FILE__, __LINE__, name, value, expected_value ); \\\n\t\tgoto on_error; \\\n\t}\n\n#define EVTX_TEST_ASSERT_EQUAL_SIZE( name, value, expected_value ) \\\n\tif( value != expected_value ) \\\n\t{ \\\n\t\tfprintf( stdout, \"%s:%d %s (%\" PRIzd \") != %\" PRIzd \"\\n\", __FILE__, __LINE__, name, value, expected_value ); \\\n\t\tgoto on_error; \\\n\t}\n\n#define EVTX_TEST_ASSERT_EQUAL_SSIZE( name, value, expected_value ) \\\n\tif( value != expected_value ) \\\n\t{ \\\n\t\tfprintf( stdout, \"%s:%d %s (%\" PRIzd \") != %\" PRIzd \"\\n\", __FILE__, __LINE__, name, value, expected_value ); \\\n\t\tgoto on_error; \\\n\t}\n\n#define EVTX_TEST_ASSERT_NOT_EQUAL_SSIZE( name, value, expected_value ) \\\n\tif( value == expected_value ) \\\n\t{ \\\n\t\tfprintf( stdout, \"%s:%d %s (%\" PRIzd \") == %\" PRIzd \"\\n\", __FILE__, __LINE__, name, value, expected_value ); \\\n\t\tgoto on_error; \\\n\t}\n\n#define EVTX_TEST_ASSERT_EQUAL_INT8( name, value, expected_value ) \\\n\tif( value != expected_value ) \\\n\t{ \\\n\t\tfprintf( stdout, \"%s:%d %s (%\" PRIi8 \") != %\" PRIi8 \"\\n\", __FILE__, __LINE__, name, value, expected_value ); \\\n\t\tgoto on_error; \\\n\t}\n\n#define EVTX_TEST_ASSERT_NOT_EQUAL_INT8( name, value, expected_value ) \\\n\tif( value == expected_value ) \\\n\t{ \\\n\t\tfprintf( stdout, \"%s:%d %s (%\" PRIi8 \") == %\" PRIi8 \"\\n\", __FILE__, __LINE__, name, value, expected_value ); \\\n\t\tgoto on_error; \\\n\t}\n\n#define EVTX_TEST_ASSERT_EQUAL_UINT8( name, value, expected_value ) \\\n\tif( value != expected_value ) \\\n\t{ \\\n\t\tfprintf( stdout, \"%s:%d %s (%\" PRIi8 \") != %\" PRIu8 \"\\n\", __FILE__, __LINE__, name, value, expected_value ); \\\n\t\tgoto on_error; \\\n\t}\n\n#define EVTX_TEST_ASSERT_LESS_THAN_UINT8( name, value, expected_value ) \\\n\tif( value >= expected_value ) \\\n\t{ \\\n\t\tfprintf( stdout, \"%s:%d %s (%\" PRIi8 \") >= %\" PRIu8 \"\\n\", __FILE__, __LINE__, name, value, expected_value ); \\\n\t\tgoto on_error; \\\n\t}\n\n#define EVTX_TEST_ASSERT_EQUAL_INT16( name, value, expected_value ) \\\n\tif( value != expected_value ) \\\n\t{ \\\n\t\tfprintf( stdout, \"%s:%d %s (%\" PRIi16 \") != %\" PRIi16 \"\\n\", __FILE__, __LINE__, name, value, expected_value ); \\\n\t\tgoto on_error; \\\n\t}\n\n#define EVTX_TEST_ASSERT_NOT_EQUAL_INT16( name, value, expected_value ) \\\n\tif( value == expected_value ) \\\n\t{ \\\n\t\tfprintf( stdout, \"%s:%d %s (%\" PRIi16 \") == %\" PRIi16 \"\\n\", __FILE__, __LINE__, name, value, expected_value ); \\\n\t\tgoto on_error; \\\n\t}\n\n#define EVTX_TEST_ASSERT_EQUAL_UINT16( name, value, expected_value ) \\\n\tif( value != expected_value ) \\\n\t{ \\\n\t\tfprintf( stdout, \"%s:%d %s (%\" PRIi16 \") != %\" PRIu16 \"\\n\", __FILE__, __LINE__, name, value, expected_value ); \\\n\t\tgoto on_error; \\\n\t}\n\n#define EVTX_TEST_ASSERT_LESS_THAN_UINT16( name, value, expected_value ) \\\n\tif( value >= expected_value ) \\\n\t{ \\\n\t\tfprintf( stdout, \"%s:%d %s (%\" PRIi16 \") >= %\" PRIu16 \"\\n\", __FILE__, __LINE__, name, value, expected_value ); \\\n\t\tgoto on_error; \\\n\t}\n\n#define EVTX_TEST_ASSERT_EQUAL_INT32( name, value, expected_value ) \\\n\tif( value != expected_value ) \\\n\t{ \\\n\t\tfprintf( stdout, \"%s:%d %s (%\" PRIi32 \") != %\" PRIi32 \"\\n\", __FILE__, __LINE__, name, value, expected_value ); \\\n\t\tgoto on_error; \\\n\t}\n\n#define EVTX_TEST_ASSERT_NOT_EQUAL_INT32( name, value, expected_value ) \\\n\tif( value == expected_value ) \\\n\t{ \\\n\t\tfprintf( stdout, \"%s:%d %s (%\" PRIi32 \") == %\" PRIi32 \"\\n\", __FILE__, __LINE__, name, value, expected_value ); \\\n\t\tgoto on_error; \\\n\t}\n\n#define EVTX_TEST_ASSERT_EQUAL_UINT32( name, value, expected_value ) \\\n\tif( value != expected_value ) \\\n\t{ \\\n\t\tfprintf( stdout, \"%s:%d %s (%\" PRIu32 \") != %\" PRIu32 \"\\n\", __FILE__, __LINE__, name, value, expected_value ); \\\n\t\tgoto on_error; \\\n\t}\n\n#define EVTX_TEST_ASSERT_LESS_THAN_UINT32( name, value, expected_value ) \\\n\tif( value >= expected_value ) \\\n\t{ \\\n\t\tfprintf( stdout, \"%s:%d %s (%\" PRIu32 \") >= %\" PRIu32 \"\\n\", __FILE__, __LINE__, name, value, expected_value ); \\\n\t\tgoto on_error; \\\n\t}\n\n#define EVTX_TEST_ASSERT_EQUAL_INT64( name, value, expected_value ) \\\n\tif( value != expected_value ) \\\n\t{ \\\n\t\tfprintf( stdout, \"%s:%d %s (%\" PRIi64 \") != %\" PRIi64 \"\\n\", __FILE__, __LINE__, name, value, expected_value ); \\\n\t\tgoto on_error; \\\n\t}\n\n#define EVTX_TEST_ASSERT_NOT_EQUAL_INT64( name, value, expected_value ) \\\n\tif( value == expected_value ) \\\n\t{ \\\n\t\tfprintf( stdout, \"%s:%d %s (%\" PRIi64 \") == %\" PRIi64 \"\\n\", __FILE__, __LINE__, name, value, expected_value ); \\\n\t\tgoto on_error; \\\n\t}\n\n#define EVTX_TEST_ASSERT_EQUAL_UINT64( name, value, expected_value ) \\\n\tif( value != expected_value ) \\\n\t{ \\\n\t\tfprintf( stdout, \"%s:%d %s (%\" PRIu64 \") != %\" PRIu64 \"\\n\", __FILE__, __LINE__, name, value, expected_value ); \\\n\t\tgoto on_error; \\\n\t}\n\n#define EVTX_TEST_ASSERT_LESS_THAN_UINT64( name, value, expected_value ) \\\n\tif( value >= expected_value ) \\\n\t{ \\\n\t\tfprintf( stdout, \"%s:%d %s (%\" PRIu64 \") >= %\" PRIu64 \"\\n\", __FILE__, __LINE__, name, value, expected_value ); \\\n\t\tgoto on_error; \\\n\t}\n\n#define EVTX_TEST_ASSERT_IS_NOT_NULL( name, value ) \\\n\tif( value == NULL ) \\\n\t{ \\\n\t\tfprintf( stdout, \"%s:%d %s == NULL\\n\", __FILE__, __LINE__, name ); \\\n\t\tgoto on_error; \\\n\t}\n\n#define EVTX_TEST_ASSERT_IS_NULL( name, value ) \\\n\tif( value != NULL ) \\\n\t{ \\\n\t\tfprintf( stdout, \"%s:%d %s != NULL\\n\", __FILE__, __LINE__, name ); \\\n\t\tgoto on_error; \\\n\t}\n\n#define EVTX_TEST_RUN( name, function ) \\\n\tif( function() != 1 ) \\\n\t{ \\\n\t\tfprintf( stdout, \"Unable to run test: %s\\n\", name ); \\\n\t\tgoto on_error; \\\n\t}\n\n#if !defined( __BORLANDC__ ) || ( __BORLANDC__ >= 0x0560 )\n\n#define EVTX_TEST_RUN_WITH_ARGS( name, function, ... ) \\\n\tif( function( __VA_ARGS__ ) != 1 ) \\\n\t{ \\\n\t\tfprintf( stdout, \"Unable to run test: %s\\n\", name ); \\\n\t\tgoto on_error; \\\n\t}\n\n#endif /* !defined( __BORLANDC__ ) || ( __BORLANDC__ >= 0x0560 ) */\n\n#define EVTX_TEST_FPRINT_ERROR( error ) \\\n\tlibcerror_error_backtrace_fprint( error, stdout );\n\n#endif /* !defined( _EVTX_TEST_MACROS_H ) */\n\n" }, { "path": "tests/evtx_test_memory.c", "content": "/*\n * Memory allocation functions for testing\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#include \n\n#if defined( HAVE_STDLIB_H ) || defined( WINAPI )\n#include \n#endif\n\n#if defined( HAVE_GNU_DL_DLSYM ) && defined( __GNUC__ )\n#define __USE_GNU\n#include \n#undef __USE_GNU\n#endif\n\n#include \"evtx_test_memory.h\"\n\n#if defined( HAVE_EVTX_TEST_MEMORY )\n\nstatic void *(*evtx_test_real_malloc)(size_t) = NULL;\nstatic void *(*evtx_test_real_memcpy)(void *, const void *, size_t) = NULL;\nstatic void *(*evtx_test_real_memset)(void *, int, size_t) = NULL;\nstatic void *(*evtx_test_real_realloc)(void *, size_t) = NULL;\n\nint evtx_test_malloc_attempts_before_fail = -1;\nint evtx_test_memcpy_attempts_before_fail = -1;\nint evtx_test_memset_attempts_before_fail = -1;\nint evtx_test_realloc_attempts_before_fail = -1;\n\n/* Custom malloc for testing memory error cases\n * Note this function might fail if compiled with optimation\n * Returns a pointer to newly allocated data or NULL\n */\nvoid *malloc(\n size_t size )\n{\n\tvoid *ptr = NULL;\n\n\tif( evtx_test_real_malloc == NULL )\n\t{\n\t\tevtx_test_real_malloc = dlsym(\n\t\t RTLD_NEXT,\n\t\t \"malloc\" );\n\t}\n\tif( evtx_test_malloc_attempts_before_fail == 0 )\n\t{\n\t\tevtx_test_malloc_attempts_before_fail = -1;\n\n\t\treturn( NULL );\n\t}\n\telse if( evtx_test_malloc_attempts_before_fail > 0 )\n\t{\n\t\tevtx_test_malloc_attempts_before_fail--;\n\t}\n\tptr = evtx_test_real_malloc(\n\t size );\n\n\treturn( ptr );\n}\n\n/* Custom memcpy for testing memory error cases\n * Note this function might fail if compiled with optimation and as a shared libary\n * Returns a pointer to newly allocated data or NULL\n */\nvoid *memcpy(\n void *destination,\n const void *source,\n size_t size )\n{\n\tif( evtx_test_real_memcpy == NULL )\n\t{\n\t\tevtx_test_real_memcpy = dlsym(\n\t\t RTLD_NEXT,\n\t\t \"memcpy\" );\n\t}\n\tif( evtx_test_memcpy_attempts_before_fail == 0 )\n\t{\n\t\tevtx_test_memcpy_attempts_before_fail = -1;\n\n\t\treturn( NULL );\n\t}\n\telse if( evtx_test_memcpy_attempts_before_fail > 0 )\n\t{\n\t\tevtx_test_memcpy_attempts_before_fail--;\n\t}\n\tdestination = evtx_test_real_memcpy(\n\t destination,\n\t source,\n\t size );\n\n\treturn( destination );\n}\n\n/* Custom memset for testing memory error cases\n * Note this function might fail if compiled with optimation and as a shared libary\n * Returns a pointer to newly allocated data or NULL\n */\nvoid *memset(\n void *ptr,\n int constant,\n size_t size )\n{\n\tif( evtx_test_real_memset == NULL )\n\t{\n\t\tevtx_test_real_memset = dlsym(\n\t\t RTLD_NEXT,\n\t\t \"memset\" );\n\t}\n\tif( evtx_test_memset_attempts_before_fail == 0 )\n\t{\n\t\tevtx_test_memset_attempts_before_fail = -1;\n\n\t\treturn( NULL );\n\t}\n\telse if( evtx_test_memset_attempts_before_fail > 0 )\n\t{\n\t\tevtx_test_memset_attempts_before_fail--;\n\t}\n\tptr = evtx_test_real_memset(\n\t ptr,\n\t constant,\n\t size );\n\n\treturn( ptr );\n}\n\n/* Custom realloc for testing memory error cases\n * Note this function might fail if compiled with optimation\n * Returns a pointer to reallocated data or NULL\n */\nvoid *realloc(\n void *ptr,\n size_t size )\n{\n\tif( evtx_test_real_realloc == NULL )\n\t{\n\t\tevtx_test_real_realloc = dlsym(\n\t\t RTLD_NEXT,\n\t\t \"realloc\" );\n\t}\n\tif( evtx_test_realloc_attempts_before_fail == 0 )\n\t{\n\t\tevtx_test_realloc_attempts_before_fail = -1;\n\n\t\treturn( NULL );\n\t}\n\telse if( evtx_test_realloc_attempts_before_fail > 0 )\n\t{\n\t\tevtx_test_realloc_attempts_before_fail--;\n\t}\n\tptr = evtx_test_real_realloc(\n\t ptr,\n\t size );\n\n\treturn( ptr );\n}\n\n#endif /* defined( HAVE_EVTX_TEST_MEMORY ) */\n\n" }, { "path": "tests/evtx_test_memory.h", "content": "/*\n * Memory allocation functions for testing\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#if !defined( _EVTX_TEST_MEMORY_H )\n#define _EVTX_TEST_MEMORY_H\n\n#include \n\n#if defined( __cplusplus )\nextern \"C\" {\n#endif\n\n#if defined( HAVE_GNU_DL_DLSYM ) && defined( __GNUC__ ) && !defined( LIBEVTX_DLL_IMPORT ) && !defined( __arm__ ) && !defined( __clang__ ) && !defined( __CYGWIN__ ) && !defined( __hppa__ ) && !defined( __loongarch__ ) && !defined( __mips__ ) && !defined( __riscv ) && !defined( __sparc__ ) && !defined( HAVE_ASAN )\n#define HAVE_EVTX_TEST_MEMORY\t\t1\n#endif\n\n#if defined( HAVE_EVTX_TEST_MEMORY )\n\nextern int evtx_test_malloc_attempts_before_fail;\n\nextern int evtx_test_memcpy_attempts_before_fail;\n\nextern int evtx_test_memset_attempts_before_fail;\n\nextern int evtx_test_realloc_attempts_before_fail;\n\n#endif /* defined( HAVE_EVTX_TEST_MEMORY ) */\n\n#if defined( __cplusplus )\n}\n#endif\n\n#endif /* !defined( _EVTX_TEST_MEMORY_H ) */\n\n" }, { "path": "tests/evtx_test_notify.c", "content": "/*\n * Library notification functions test program\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#include \n#include \n#include \n\n#if defined( HAVE_STDLIB_H ) || defined( WINAPI )\n#include \n#endif\n\n#include \"evtx_test_libcerror.h\"\n#include \"evtx_test_libevtx.h\"\n#include \"evtx_test_macros.h\"\n#include \"evtx_test_unused.h\"\n\n/* Tests the libevtx_notify_set_verbose function\n * Returns 1 if successful or 0 if not\n */\nint evtx_test_notify_set_verbose(\n void )\n{\n\t/* Test invocation of function only\n\t */\n\tlibevtx_notify_set_verbose(\n\t 0 );\n\n\treturn( 1 );\n}\n\n/* Tests the libevtx_notify_set_stream function\n * Returns 1 if successful or 0 if not\n */\nint evtx_test_notify_set_stream(\n void )\n{\n\tlibcerror_error_t *error = NULL;\n\tint result = 0;\n\n\t/* Test regular cases\n\t */\n\tresult = libevtx_notify_set_stream(\n\t NULL,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 1 );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\t/* Test error cases\n\t */\n/* TODO test libcnotify_stream_set failure */\n\n\treturn( 1 );\n\non_error:\n\tif( error != NULL )\n\t{\n\t\tlibcerror_error_free(\n\t\t &error );\n\t}\n\treturn( 0 );\n}\n\n/* Tests the libevtx_notify_stream_open function\n * Returns 1 if successful or 0 if not\n */\nint evtx_test_notify_stream_open(\n void )\n{\n\tlibcerror_error_t *error = NULL;\n\tint result = 0;\n\n\t/* Test regular cases\n\t */\n\tresult = libevtx_notify_stream_open(\n\t \"notify_stream.log\",\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 1 );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\t/* Test error cases\n\t */\n\tresult = libevtx_notify_stream_open(\n\t NULL,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"error\",\n\t error );\n\n\tlibcerror_error_free(\n\t &error );\n\n\t/* Clean up\n\t */\n\tresult = libevtx_notify_stream_close(\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 0 );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\treturn( 1 );\n\non_error:\n\tif( error != NULL )\n\t{\n\t\tlibcerror_error_free(\n\t\t &error );\n\t}\n\treturn( 0 );\n}\n\n/* Tests the libevtx_notify_stream_close function\n * Returns 1 if successful or 0 if not\n */\nint evtx_test_notify_stream_close(\n void )\n{\n\tlibcerror_error_t *error = NULL;\n\tint result = 0;\n\n\t/* Test regular cases\n\t */\n\tresult = libevtx_notify_stream_close(\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 0 );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\t/* Test error cases\n\t */\n/* TODO test libcnotify_stream_close failure */\n\n\treturn( 1 );\n\non_error:\n\tif( error != NULL )\n\t{\n\t\tlibcerror_error_free(\n\t\t &error );\n\t}\n\treturn( 0 );\n}\n\n/* The main program\n */\n#if defined( HAVE_WIDE_SYSTEM_CHARACTER )\nint wmain(\n int argc EVTX_TEST_ATTRIBUTE_UNUSED,\n wchar_t * const argv[] EVTX_TEST_ATTRIBUTE_UNUSED )\n#else\nint main(\n int argc EVTX_TEST_ATTRIBUTE_UNUSED,\n char * const argv[] EVTX_TEST_ATTRIBUTE_UNUSED )\n#endif\n{\n\tEVTX_TEST_UNREFERENCED_PARAMETER( argc )\n\tEVTX_TEST_UNREFERENCED_PARAMETER( argv )\n\n\tEVTX_TEST_RUN(\n\t \"libevtx_notify_set_verbose\",\n\t evtx_test_notify_set_verbose )\n\n\tEVTX_TEST_RUN(\n\t \"libevtx_notify_set_stream\",\n\t evtx_test_notify_set_stream )\n\n\tEVTX_TEST_RUN(\n\t \"libevtx_notify_stream_open\",\n\t evtx_test_notify_stream_open )\n\n\tEVTX_TEST_RUN(\n\t \"libevtx_notify_stream_close\",\n\t evtx_test_notify_stream_close )\n\n\treturn( EXIT_SUCCESS );\n\non_error:\n\treturn( EXIT_FAILURE );\n}\n\n" }, { "path": "tests/evtx_test_record.c", "content": "/*\n * Library record type test program\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#include \n#include \n#include \n\n#if defined( HAVE_STDLIB_H ) || defined( WINAPI )\n#include \n#endif\n\n#include \"evtx_test_libcerror.h\"\n#include \"evtx_test_libevtx.h\"\n#include \"evtx_test_macros.h\"\n#include \"evtx_test_memory.h\"\n#include \"evtx_test_unused.h\"\n\n#include \"../libevtx/libevtx_record.h\"\n\n/* Tests the libevtx_record_free function\n * Returns 1 if successful or 0 if not\n */\nint evtx_test_record_free(\n void )\n{\n\tlibcerror_error_t *error = NULL;\n\tint result = 0;\n\n\t/* Test error cases\n\t */\n\tresult = libevtx_record_free(\n\t NULL,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"error\",\n\t error );\n\n\tlibcerror_error_free(\n\t &error );\n\n\treturn( 1 );\n\non_error:\n\tif( error != NULL )\n\t{\n\t\tlibcerror_error_free(\n\t\t &error );\n\t}\n\treturn( 0 );\n}\n\n/* The main program\n */\n#if defined( HAVE_WIDE_SYSTEM_CHARACTER )\nint wmain(\n int argc EVTX_TEST_ATTRIBUTE_UNUSED,\n wchar_t * const argv[] EVTX_TEST_ATTRIBUTE_UNUSED )\n#else\nint main(\n int argc EVTX_TEST_ATTRIBUTE_UNUSED,\n char * const argv[] EVTX_TEST_ATTRIBUTE_UNUSED )\n#endif\n{\n\tEVTX_TEST_UNREFERENCED_PARAMETER( argc )\n\tEVTX_TEST_UNREFERENCED_PARAMETER( argv )\n\n#if defined( __GNUC__ ) && !defined( LIBEVTX_DLL_IMPORT )\n\n\t/* TODO: add tests for libevtx_record_initialize */\n\n#endif /* defined( __GNUC__ ) && !defined( LIBEVTX_DLL_IMPORT ) */\n\n\tEVTX_TEST_RUN(\n\t \"libevtx_record_free\",\n\t evtx_test_record_free );\n\n#if defined( __GNUC__ ) && !defined( LIBEVTX_DLL_IMPORT )\n\n\t/* TODO: add tests for libevtx_record_get_offset */\n\n\t/* TODO: add tests for libevtx_record_get_identifier */\n\n\t/* TODO: add tests for libevtx_record_get_written_time */\n\n\t/* TODO: add tests for libevtx_record_get_event_identifier */\n\n\t/* TODO: add tests for libevtx_record_get_event_identifier_qualifiers */\n\n\t/* TODO: add tests for libevtx_record_get_event_level */\n\n\t/* TODO: add tests for libevtx_record_get_utf8_provider_identifier_size */\n\n\t/* TODO: add tests for libevtx_record_get_utf8_provider_identifier */\n\n\t/* TODO: add tests for libevtx_record_get_utf16_provider_identifier_size */\n\n\t/* TODO: add tests for libevtx_record_get_utf16_provider_identifier */\n\n\t/* TODO: add tests for libevtx_record_get_utf8_source_name_size */\n\n\t/* TODO: add tests for libevtx_record_get_utf8_source_name */\n\n\t/* TODO: add tests for libevtx_record_get_utf16_source_name_size */\n\n\t/* TODO: add tests for libevtx_record_get_utf16_source_name */\n\n\t/* TODO: add tests for libevtx_record_get_utf8_computer_name_size */\n\n\t/* TODO: add tests for libevtx_record_get_utf8_computer_name */\n\n\t/* TODO: add tests for libevtx_record_get_utf16_computer_name_size */\n\n\t/* TODO: add tests for libevtx_record_get_utf16_computer_name */\n\n\t/* TODO: add tests for libevtx_record_get_utf8_user_security_identifier_size */\n\n\t/* TODO: add tests for libevtx_record_get_utf8_user_security_identifier */\n\n\t/* TODO: add tests for libevtx_record_get_utf16_user_security_identifier_size */\n\n\t/* TODO: add tests for libevtx_record_get_utf16_user_security_identifier */\n\n\t/* TODO: add tests for libevtx_record_parse_data_with_template_definition */\n\n\t/* TODO: add tests for libevtx_record_get_number_of_strings */\n\n\t/* TODO: add tests for libevtx_record_get_utf8_string_size */\n\n\t/* TODO: add tests for libevtx_record_get_utf8_string */\n\n\t/* TODO: add tests for libevtx_record_get_utf16_string_size */\n\n\t/* TODO: add tests for libevtx_record_get_utf16_string */\n\n\t/* TODO: add tests for libevtx_record_get_data_size */\n\n\t/* TODO: add tests for libevtx_record_get_data */\n\n\t/* TODO: add tests for libevtx_record_get_utf8_xml_string_size */\n\n\t/* TODO: add tests for libevtx_record_get_utf8_xml_string */\n\n\t/* TODO: add tests for libevtx_record_get_utf16_xml_string_size */\n\n\t/* TODO: add tests for libevtx_record_get_utf16_xml_string */\n\n#endif /* defined( __GNUC__ ) && !defined( LIBEVTX_DLL_IMPORT ) */\n\n\treturn( EXIT_SUCCESS );\n\non_error:\n\treturn( EXIT_FAILURE );\n}\n\n" }, { "path": "tests/evtx_test_record_values.c", "content": "/*\n * Library record_values type test program\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#include \n#include \n#include \n\n#if defined( HAVE_STDLIB_H ) || defined( WINAPI )\n#include \n#endif\n\n#include \"evtx_test_libcerror.h\"\n#include \"evtx_test_libevtx.h\"\n#include \"evtx_test_macros.h\"\n#include \"evtx_test_memory.h\"\n#include \"evtx_test_unused.h\"\n\n#include \"../libevtx/libevtx_record_values.h\"\n\n#if defined( __GNUC__ ) && !defined( LIBEVTX_DLL_IMPORT )\n\n/* Tests the libevtx_record_values_initialize function\n * Returns 1 if successful or 0 if not\n */\nint evtx_test_record_values_initialize(\n void )\n{\n\tlibcerror_error_t *error = NULL;\n\tlibevtx_record_values_t *record_values = NULL;\n\tint result = 0;\n\n#if defined( HAVE_EVTX_TEST_MEMORY )\n\tint number_of_malloc_fail_tests = 1;\n\tint number_of_memset_fail_tests = 1;\n\tint test_number = 0;\n#endif\n\n\t/* Test regular cases\n\t */\n\tresult = libevtx_record_values_initialize(\n\t &record_values,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"record_values\",\n\t record_values );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\tresult = libevtx_record_values_free(\n\t &record_values,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 1 );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"record_values\",\n\t record_values );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\t/* Test error cases\n\t */\n\tresult = libevtx_record_values_initialize(\n\t NULL,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"error\",\n\t error );\n\n\tlibcerror_error_free(\n\t &error );\n\n\trecord_values = (libevtx_record_values_t *) 0x12345678UL;\n\n\tresult = libevtx_record_values_initialize(\n\t &record_values,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"error\",\n\t error );\n\n\tlibcerror_error_free(\n\t &error );\n\n\trecord_values = NULL;\n\n#if defined( HAVE_EVTX_TEST_MEMORY )\n\n\tfor( test_number = 0;\n\t test_number < number_of_malloc_fail_tests;\n\t test_number++ )\n\t{\n\t\t/* Test libevtx_record_values_initialize with malloc failing\n\t\t */\n\t\tevtx_test_malloc_attempts_before_fail = test_number;\n\n\t\tresult = libevtx_record_values_initialize(\n\t\t &record_values,\n\t\t &error );\n\n\t\tif( evtx_test_malloc_attempts_before_fail != -1 )\n\t\t{\n\t\t\tevtx_test_malloc_attempts_before_fail = -1;\n\n\t\t\tif( record_values != NULL )\n\t\t\t{\n\t\t\t\tlibevtx_record_values_free(\n\t\t\t\t &record_values,\n\t\t\t\t NULL );\n\t\t\t}\n\t\t}\n\t\telse\n\t\t{\n\t\t\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t\t\t \"result\",\n\t\t\t result,\n\t\t\t -1 );\n\n\t\t\tEVTX_TEST_ASSERT_IS_NULL(\n\t\t\t \"record_values\",\n\t\t\t record_values );\n\n\t\t\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t\t\t \"error\",\n\t\t\t error );\n\n\t\t\tlibcerror_error_free(\n\t\t\t &error );\n\t\t}\n\t}\n\tfor( test_number = 0;\n\t test_number < number_of_memset_fail_tests;\n\t test_number++ )\n\t{\n\t\t/* Test libevtx_record_values_initialize with memset failing\n\t\t */\n\t\tevtx_test_memset_attempts_before_fail = test_number;\n\n\t\tresult = libevtx_record_values_initialize(\n\t\t &record_values,\n\t\t &error );\n\n\t\tif( evtx_test_memset_attempts_before_fail != -1 )\n\t\t{\n\t\t\tevtx_test_memset_attempts_before_fail = -1;\n\n\t\t\tif( record_values != NULL )\n\t\t\t{\n\t\t\t\tlibevtx_record_values_free(\n\t\t\t\t &record_values,\n\t\t\t\t NULL );\n\t\t\t}\n\t\t}\n\t\telse\n\t\t{\n\t\t\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t\t\t \"result\",\n\t\t\t result,\n\t\t\t -1 );\n\n\t\t\tEVTX_TEST_ASSERT_IS_NULL(\n\t\t\t \"record_values\",\n\t\t\t record_values );\n\n\t\t\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t\t\t \"error\",\n\t\t\t error );\n\n\t\t\tlibcerror_error_free(\n\t\t\t &error );\n\t\t}\n\t}\n#endif /* defined( HAVE_EVTX_TEST_MEMORY ) */\n\n\treturn( 1 );\n\non_error:\n\tif( error != NULL )\n\t{\n\t\tlibcerror_error_free(\n\t\t &error );\n\t}\n\tif( record_values != NULL )\n\t{\n\t\tlibevtx_record_values_free(\n\t\t &record_values,\n\t\t NULL );\n\t}\n\treturn( 0 );\n}\n\n/* Tests the libevtx_record_values_free function\n * Returns 1 if successful or 0 if not\n */\nint evtx_test_record_values_free(\n void )\n{\n\tlibcerror_error_t *error = NULL;\n\tint result = 0;\n\n\t/* Test error cases\n\t */\n\tresult = libevtx_record_values_free(\n\t NULL,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"error\",\n\t error );\n\n\tlibcerror_error_free(\n\t &error );\n\n\treturn( 1 );\n\non_error:\n\tif( error != NULL )\n\t{\n\t\tlibcerror_error_free(\n\t\t &error );\n\t}\n\treturn( 0 );\n}\n\n/* Tests the libevtx_record_values_clone function\n * Returns 1 if successful or 0 if not\n */\nint evtx_test_record_values_clone(\n void )\n{\n\tlibcerror_error_t *error = NULL;\n\tlibevtx_record_values_t *destination_record_values = NULL;\n\tlibevtx_record_values_t *source_record_values = NULL;\n\tint result = 0;\n\n\t/* Initialize test\n\t */\n\tresult = libevtx_record_values_initialize(\n\t &source_record_values,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"source_record_values\",\n\t source_record_values );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\t/* Test regular cases\n\t */\n\tresult = libevtx_record_values_clone(\n\t &destination_record_values,\n\t source_record_values,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"destination_record_values\",\n\t destination_record_values );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\tresult = libevtx_record_values_free(\n\t &destination_record_values,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 1 );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"destination_record_values\",\n\t destination_record_values );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\tresult = libevtx_record_values_clone(\n\t &destination_record_values,\n\t NULL,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 1 );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"destination_record_values\",\n\t destination_record_values );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\t/* Test error cases\n\t */\n\tresult = libevtx_record_values_clone(\n\t NULL,\n\t source_record_values,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"error\",\n\t error );\n\n\tlibcerror_error_free(\n\t &error );\n\n\t/* Clean up\n\t */\n\tresult = libevtx_record_values_free(\n\t &source_record_values,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 1 );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"source_record_values\",\n\t source_record_values );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\treturn( 1 );\n\non_error:\n\tif( error != NULL )\n\t{\n\t\tlibcerror_error_free(\n\t\t &error );\n\t}\n\tif( destination_record_values != NULL )\n\t{\n\t\tlibevtx_record_values_free(\n\t\t &destination_record_values,\n\t\t NULL );\n\t}\n\tif( source_record_values != NULL )\n\t{\n\t\tlibevtx_record_values_free(\n\t\t &source_record_values,\n\t\t NULL );\n\t}\n\treturn( 0 );\n}\n\n/* Tests the libevtx_record_values_get_event_identifier function\n * Returns 1 if successful or 0 if not\n */\nint evtx_test_record_values_get_event_identifier(\n void )\n{\n\tlibcerror_error_t *error = NULL;\n\tlibevtx_record_values_t *record_values = NULL;\n\tuint32_t event_identifier = 0;\n\tint event_identifier_is_set = 0;\n\tint result = 0;\n\n\t/* Initialize test\n\t */\n\tresult = libevtx_record_values_initialize(\n\t &record_values,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"record_values\",\n\t record_values );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\t/* Test regular cases\n\t */\n\tresult = libevtx_record_values_get_event_identifier(\n\t record_values,\n\t &event_identifier,\n\t &error );\n\n\tEVTX_TEST_ASSERT_NOT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\tevent_identifier_is_set = result;\n\n\t/* Test error cases\n\t */\n\tresult = libevtx_record_values_get_event_identifier(\n\t NULL,\n\t &event_identifier,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"error\",\n\t error );\n\n\tlibcerror_error_free(\n\t &error );\n\n\tif( event_identifier_is_set != 0 )\n\t{\n\t\tresult = libevtx_record_values_get_event_identifier(\n\t\t record_values,\n\t\t NULL,\n\t\t &error );\n\n\t\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t\t \"result\",\n\t\t result,\n\t\t -1 );\n\n\t\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t\t \"error\",\n\t\t error );\n\n\t\tlibcerror_error_free(\n\t\t &error );\n\t}\n\t/* Clean up\n\t */\n\tresult = libevtx_record_values_free(\n\t &record_values,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 1 );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"record_values\",\n\t record_values );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\treturn( 1 );\n\non_error:\n\tif( error != NULL )\n\t{\n\t\tlibcerror_error_free(\n\t\t &error );\n\t}\n\tif( record_values != NULL )\n\t{\n\t\tlibevtx_record_values_free(\n\t\t &record_values,\n\t\t NULL );\n\t}\n\treturn( 0 );\n}\n\n/* Tests the libevtx_record_values_get_event_identifier_qualifiers function\n * Returns 1 if successful or 0 if not\n */\nint evtx_test_record_values_get_event_identifier_qualifiers(\n void )\n{\n\tlibcerror_error_t *error = NULL;\n\tlibevtx_record_values_t *record_values = NULL;\n\tuint32_t event_identifier_qualifiers = 0;\n\tint event_identifier_qualifiers_is_set = 0;\n\tint result = 0;\n\n\t/* Initialize test\n\t */\n\tresult = libevtx_record_values_initialize(\n\t &record_values,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"record_values\",\n\t record_values );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\t/* Test regular cases\n\t */\n\tresult = libevtx_record_values_get_event_identifier_qualifiers(\n\t record_values,\n\t &event_identifier_qualifiers,\n\t &error );\n\n\tEVTX_TEST_ASSERT_NOT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\tevent_identifier_qualifiers_is_set = result;\n\n\t/* Test error cases\n\t */\n\tresult = libevtx_record_values_get_event_identifier_qualifiers(\n\t NULL,\n\t &event_identifier_qualifiers,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"error\",\n\t error );\n\n\tlibcerror_error_free(\n\t &error );\n\n\tif( event_identifier_qualifiers_is_set != 0 )\n\t{\n\t\tresult = libevtx_record_values_get_event_identifier_qualifiers(\n\t\t record_values,\n\t\t NULL,\n\t\t &error );\n\n\t\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t\t \"result\",\n\t\t result,\n\t\t -1 );\n\n\t\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t\t \"error\",\n\t\t error );\n\n\t\tlibcerror_error_free(\n\t\t &error );\n\t}\n\t/* Clean up\n\t */\n\tresult = libevtx_record_values_free(\n\t &record_values,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 1 );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"record_values\",\n\t record_values );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\treturn( 1 );\n\non_error:\n\tif( error != NULL )\n\t{\n\t\tlibcerror_error_free(\n\t\t &error );\n\t}\n\tif( record_values != NULL )\n\t{\n\t\tlibevtx_record_values_free(\n\t\t &record_values,\n\t\t NULL );\n\t}\n\treturn( 0 );\n}\n\n/* Tests the libevtx_record_values_get_event_level function\n * Returns 1 if successful or 0 if not\n */\nint evtx_test_record_values_get_event_level(\n void )\n{\n\tlibcerror_error_t *error = NULL;\n\tlibevtx_record_values_t *record_values = NULL;\n\tuint8_t event_level = 0;\n\tint event_level_is_set = 0;\n\tint result = 0;\n\n\t/* Initialize test\n\t */\n\tresult = libevtx_record_values_initialize(\n\t &record_values,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"record_values\",\n\t record_values );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\t/* Test regular cases\n\t */\n\tresult = libevtx_record_values_get_event_level(\n\t record_values,\n\t &event_level,\n\t &error );\n\n\tEVTX_TEST_ASSERT_NOT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\tevent_level_is_set = result;\n\n\t/* Test error cases\n\t */\n\tresult = libevtx_record_values_get_event_level(\n\t NULL,\n\t &event_level,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"error\",\n\t error );\n\n\tlibcerror_error_free(\n\t &error );\n\n\tif( event_level_is_set != 0 )\n\t{\n\t\tresult = libevtx_record_values_get_event_level(\n\t\t record_values,\n\t\t NULL,\n\t\t &error );\n\n\t\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t\t \"result\",\n\t\t result,\n\t\t -1 );\n\n\t\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t\t \"error\",\n\t\t error );\n\n\t\tlibcerror_error_free(\n\t\t &error );\n\t}\n\t/* Clean up\n\t */\n\tresult = libevtx_record_values_free(\n\t &record_values,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 1 );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"record_values\",\n\t record_values );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\treturn( 1 );\n\non_error:\n\tif( error != NULL )\n\t{\n\t\tlibcerror_error_free(\n\t\t &error );\n\t}\n\tif( record_values != NULL )\n\t{\n\t\tlibevtx_record_values_free(\n\t\t &record_values,\n\t\t NULL );\n\t}\n\treturn( 0 );\n}\n\n/* Tests the libevtx_record_values_get_utf8_provider_identifier_size function\n * Returns 1 if successful or 0 if not\n */\nint evtx_test_record_values_get_utf8_provider_identifier_size(\n void )\n{\n\tlibcerror_error_t *error = NULL;\n\tlibevtx_record_values_t *record_values = NULL;\n\tsize_t utf8_provider_identifier_size = 0;\n\tint result = 0;\n\tint utf8_provider_identifier_size_is_set = 0;\n\n\t/* Initialize test\n\t */\n\tresult = libevtx_record_values_initialize(\n\t &record_values,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"record_values\",\n\t record_values );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\t/* Test regular cases\n\t */\n\tresult = libevtx_record_values_get_utf8_provider_identifier_size(\n\t record_values,\n\t &utf8_provider_identifier_size,\n\t &error );\n\n\tEVTX_TEST_ASSERT_NOT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\tutf8_provider_identifier_size_is_set = result;\n\n\t/* Test error cases\n\t */\n\tresult = libevtx_record_values_get_utf8_provider_identifier_size(\n\t NULL,\n\t &utf8_provider_identifier_size,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"error\",\n\t error );\n\n\tlibcerror_error_free(\n\t &error );\n\n\tif( utf8_provider_identifier_size_is_set != 0 )\n\t{\n\t\tresult = libevtx_record_values_get_utf8_provider_identifier_size(\n\t\t record_values,\n\t\t NULL,\n\t\t &error );\n\n\t\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t\t \"result\",\n\t\t result,\n\t\t -1 );\n\n\t\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t\t \"error\",\n\t\t error );\n\n\t\tlibcerror_error_free(\n\t\t &error );\n\t}\n\t/* Clean up\n\t */\n\tresult = libevtx_record_values_free(\n\t &record_values,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 1 );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"record_values\",\n\t record_values );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\treturn( 1 );\n\non_error:\n\tif( error != NULL )\n\t{\n\t\tlibcerror_error_free(\n\t\t &error );\n\t}\n\tif( record_values != NULL )\n\t{\n\t\tlibevtx_record_values_free(\n\t\t &record_values,\n\t\t NULL );\n\t}\n\treturn( 0 );\n}\n\n/* Tests the libevtx_record_values_get_utf8_provider_identifier function\n * Returns 1 if successful or 0 if not\n */\nint evtx_test_record_values_get_utf8_provider_identifier(\n void )\n{\n\tuint8_t utf8_provider_identifier[ 512 ];\n\n\tlibcerror_error_t *error = NULL;\n\tlibevtx_record_values_t *record_values = NULL;\n\tint result = 0;\n\tint utf8_provider_identifier_is_set = 0;\n\n\t/* Initialize test\n\t */\n\tresult = libevtx_record_values_initialize(\n\t &record_values,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"record_values\",\n\t record_values );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\t/* Test regular cases\n\t */\n\tresult = libevtx_record_values_get_utf8_provider_identifier(\n\t record_values,\n\t utf8_provider_identifier,\n\t 512,\n\t &error );\n\n\tEVTX_TEST_ASSERT_NOT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\tutf8_provider_identifier_is_set = result;\n\n\t/* Test error cases\n\t */\n\tresult = libevtx_record_values_get_utf8_provider_identifier(\n\t NULL,\n\t utf8_provider_identifier,\n\t 512,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"error\",\n\t error );\n\n\tlibcerror_error_free(\n\t &error );\n\n\tif( utf8_provider_identifier_is_set != 0 )\n\t{\n\t\tresult = libevtx_record_values_get_utf8_provider_identifier(\n\t\t record_values,\n\t\t NULL,\n\t\t 512,\n\t\t &error );\n\n\t\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t\t \"result\",\n\t\t result,\n\t\t -1 );\n\n\t\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t\t \"error\",\n\t\t error );\n\n\t\tlibcerror_error_free(\n\t\t &error );\n\n\t\tresult = libevtx_record_values_get_utf8_provider_identifier(\n\t\t record_values,\n\t\t utf8_provider_identifier,\n\t\t 0,\n\t\t &error );\n\n\t\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t\t \"result\",\n\t\t result,\n\t\t -1 );\n\n\t\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t\t \"error\",\n\t\t error );\n\n\t\tlibcerror_error_free(\n\t\t &error );\n\n\t\tresult = libevtx_record_values_get_utf8_provider_identifier(\n\t\t record_values,\n\t\t utf8_provider_identifier,\n\t\t (size_t) SSIZE_MAX + 1,\n\t\t &error );\n\n\t\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t\t \"result\",\n\t\t result,\n\t\t -1 );\n\n\t\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t\t \"error\",\n\t\t error );\n\n\t\tlibcerror_error_free(\n\t\t &error );\n\t}\n\t/* Clean up\n\t */\n\tresult = libevtx_record_values_free(\n\t &record_values,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 1 );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"record_values\",\n\t record_values );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\treturn( 1 );\n\non_error:\n\tif( error != NULL )\n\t{\n\t\tlibcerror_error_free(\n\t\t &error );\n\t}\n\tif( record_values != NULL )\n\t{\n\t\tlibevtx_record_values_free(\n\t\t &record_values,\n\t\t NULL );\n\t}\n\treturn( 0 );\n}\n\n/* Tests the libevtx_record_values_get_utf16_provider_identifier_size function\n * Returns 1 if successful or 0 if not\n */\nint evtx_test_record_values_get_utf16_provider_identifier_size(\n void )\n{\n\tlibcerror_error_t *error = NULL;\n\tlibevtx_record_values_t *record_values = NULL;\n\tsize_t utf16_provider_identifier_size = 0;\n\tint result = 0;\n\tint utf16_provider_identifier_size_is_set = 0;\n\n\t/* Initialize test\n\t */\n\tresult = libevtx_record_values_initialize(\n\t &record_values,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"record_values\",\n\t record_values );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\t/* Test regular cases\n\t */\n\tresult = libevtx_record_values_get_utf16_provider_identifier_size(\n\t record_values,\n\t &utf16_provider_identifier_size,\n\t &error );\n\n\tEVTX_TEST_ASSERT_NOT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\tutf16_provider_identifier_size_is_set = result;\n\n\t/* Test error cases\n\t */\n\tresult = libevtx_record_values_get_utf16_provider_identifier_size(\n\t NULL,\n\t &utf16_provider_identifier_size,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"error\",\n\t error );\n\n\tlibcerror_error_free(\n\t &error );\n\n\tif( utf16_provider_identifier_size_is_set != 0 )\n\t{\n\t\tresult = libevtx_record_values_get_utf16_provider_identifier_size(\n\t\t record_values,\n\t\t NULL,\n\t\t &error );\n\n\t\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t\t \"result\",\n\t\t result,\n\t\t -1 );\n\n\t\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t\t \"error\",\n\t\t error );\n\n\t\tlibcerror_error_free(\n\t\t &error );\n\t}\n\t/* Clean up\n\t */\n\tresult = libevtx_record_values_free(\n\t &record_values,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 1 );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"record_values\",\n\t record_values );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\treturn( 1 );\n\non_error:\n\tif( error != NULL )\n\t{\n\t\tlibcerror_error_free(\n\t\t &error );\n\t}\n\tif( record_values != NULL )\n\t{\n\t\tlibevtx_record_values_free(\n\t\t &record_values,\n\t\t NULL );\n\t}\n\treturn( 0 );\n}\n\n/* Tests the libevtx_record_values_get_utf16_provider_identifier function\n * Returns 1 if successful or 0 if not\n */\nint evtx_test_record_values_get_utf16_provider_identifier(\n void )\n{\n\tuint16_t utf16_provider_identifier[ 512 ];\n\n\tlibcerror_error_t *error = NULL;\n\tlibevtx_record_values_t *record_values = NULL;\n\tint result = 0;\n\tint utf16_provider_identifier_is_set = 0;\n\n\t/* Initialize test\n\t */\n\tresult = libevtx_record_values_initialize(\n\t &record_values,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"record_values\",\n\t record_values );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\t/* Test regular cases\n\t */\n\tresult = libevtx_record_values_get_utf16_provider_identifier(\n\t record_values,\n\t utf16_provider_identifier,\n\t 512,\n\t &error );\n\n\tEVTX_TEST_ASSERT_NOT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\tutf16_provider_identifier_is_set = result;\n\n\t/* Test error cases\n\t */\n\tresult = libevtx_record_values_get_utf16_provider_identifier(\n\t NULL,\n\t utf16_provider_identifier,\n\t 512,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"error\",\n\t error );\n\n\tlibcerror_error_free(\n\t &error );\n\n\tif( utf16_provider_identifier_is_set != 0 )\n\t{\n\t\tresult = libevtx_record_values_get_utf16_provider_identifier(\n\t\t record_values,\n\t\t NULL,\n\t\t 512,\n\t\t &error );\n\n\t\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t\t \"result\",\n\t\t result,\n\t\t -1 );\n\n\t\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t\t \"error\",\n\t\t error );\n\n\t\tlibcerror_error_free(\n\t\t &error );\n\n\t\tresult = libevtx_record_values_get_utf16_provider_identifier(\n\t\t record_values,\n\t\t utf16_provider_identifier,\n\t\t 0,\n\t\t &error );\n\n\t\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t\t \"result\",\n\t\t result,\n\t\t -1 );\n\n\t\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t\t \"error\",\n\t\t error );\n\n\t\tlibcerror_error_free(\n\t\t &error );\n\n\t\tresult = libevtx_record_values_get_utf16_provider_identifier(\n\t\t record_values,\n\t\t utf16_provider_identifier,\n\t\t (size_t) SSIZE_MAX + 1,\n\t\t &error );\n\n\t\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t\t \"result\",\n\t\t result,\n\t\t -1 );\n\n\t\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t\t \"error\",\n\t\t error );\n\n\t\tlibcerror_error_free(\n\t\t &error );\n\t}\n\t/* Clean up\n\t */\n\tresult = libevtx_record_values_free(\n\t &record_values,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 1 );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"record_values\",\n\t record_values );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\treturn( 1 );\n\non_error:\n\tif( error != NULL )\n\t{\n\t\tlibcerror_error_free(\n\t\t &error );\n\t}\n\tif( record_values != NULL )\n\t{\n\t\tlibevtx_record_values_free(\n\t\t &record_values,\n\t\t NULL );\n\t}\n\treturn( 0 );\n}\n\n/* Tests the libevtx_record_values_get_utf8_source_name_size function\n * Returns 1 if successful or 0 if not\n */\nint evtx_test_record_values_get_utf8_source_name_size(\n void )\n{\n\tlibcerror_error_t *error = NULL;\n\tlibevtx_record_values_t *record_values = NULL;\n\tsize_t utf8_source_name_size = 0;\n\tint result = 0;\n\tint utf8_source_name_size_is_set = 0;\n\n\t/* Initialize test\n\t */\n\tresult = libevtx_record_values_initialize(\n\t &record_values,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"record_values\",\n\t record_values );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\t/* Test regular cases\n\t */\n\tresult = libevtx_record_values_get_utf8_source_name_size(\n\t record_values,\n\t &utf8_source_name_size,\n\t &error );\n\n\tEVTX_TEST_ASSERT_NOT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\tutf8_source_name_size_is_set = result;\n\n\t/* Test error cases\n\t */\n\tresult = libevtx_record_values_get_utf8_source_name_size(\n\t NULL,\n\t &utf8_source_name_size,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"error\",\n\t error );\n\n\tlibcerror_error_free(\n\t &error );\n\n\tif( utf8_source_name_size_is_set != 0 )\n\t{\n\t\tresult = libevtx_record_values_get_utf8_source_name_size(\n\t\t record_values,\n\t\t NULL,\n\t\t &error );\n\n\t\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t\t \"result\",\n\t\t result,\n\t\t -1 );\n\n\t\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t\t \"error\",\n\t\t error );\n\n\t\tlibcerror_error_free(\n\t\t &error );\n\t}\n\t/* Clean up\n\t */\n\tresult = libevtx_record_values_free(\n\t &record_values,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 1 );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"record_values\",\n\t record_values );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\treturn( 1 );\n\non_error:\n\tif( error != NULL )\n\t{\n\t\tlibcerror_error_free(\n\t\t &error );\n\t}\n\tif( record_values != NULL )\n\t{\n\t\tlibevtx_record_values_free(\n\t\t &record_values,\n\t\t NULL );\n\t}\n\treturn( 0 );\n}\n\n/* Tests the libevtx_record_values_get_utf8_source_name function\n * Returns 1 if successful or 0 if not\n */\nint evtx_test_record_values_get_utf8_source_name(\n void )\n{\n\tuint8_t utf8_source_name[ 512 ];\n\n\tlibcerror_error_t *error = NULL;\n\tlibevtx_record_values_t *record_values = NULL;\n\tint result = 0;\n\tint utf8_source_name_is_set = 0;\n\n\t/* Initialize test\n\t */\n\tresult = libevtx_record_values_initialize(\n\t &record_values,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"record_values\",\n\t record_values );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\t/* Test regular cases\n\t */\n\tresult = libevtx_record_values_get_utf8_source_name(\n\t record_values,\n\t utf8_source_name,\n\t 512,\n\t &error );\n\n\tEVTX_TEST_ASSERT_NOT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\tutf8_source_name_is_set = result;\n\n\t/* Test error cases\n\t */\n\tresult = libevtx_record_values_get_utf8_source_name(\n\t NULL,\n\t utf8_source_name,\n\t 512,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"error\",\n\t error );\n\n\tlibcerror_error_free(\n\t &error );\n\n\tif( utf8_source_name_is_set != 0 )\n\t{\n\t\tresult = libevtx_record_values_get_utf8_source_name(\n\t\t record_values,\n\t\t NULL,\n\t\t 512,\n\t\t &error );\n\n\t\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t\t \"result\",\n\t\t result,\n\t\t -1 );\n\n\t\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t\t \"error\",\n\t\t error );\n\n\t\tlibcerror_error_free(\n\t\t &error );\n\n\t\tresult = libevtx_record_values_get_utf8_source_name(\n\t\t record_values,\n\t\t utf8_source_name,\n\t\t 0,\n\t\t &error );\n\n\t\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t\t \"result\",\n\t\t result,\n\t\t -1 );\n\n\t\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t\t \"error\",\n\t\t error );\n\n\t\tlibcerror_error_free(\n\t\t &error );\n\n\t\tresult = libevtx_record_values_get_utf8_source_name(\n\t\t record_values,\n\t\t utf8_source_name,\n\t\t (size_t) SSIZE_MAX + 1,\n\t\t &error );\n\n\t\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t\t \"result\",\n\t\t result,\n\t\t -1 );\n\n\t\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t\t \"error\",\n\t\t error );\n\n\t\tlibcerror_error_free(\n\t\t &error );\n\t}\n\t/* Clean up\n\t */\n\tresult = libevtx_record_values_free(\n\t &record_values,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 1 );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"record_values\",\n\t record_values );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\treturn( 1 );\n\non_error:\n\tif( error != NULL )\n\t{\n\t\tlibcerror_error_free(\n\t\t &error );\n\t}\n\tif( record_values != NULL )\n\t{\n\t\tlibevtx_record_values_free(\n\t\t &record_values,\n\t\t NULL );\n\t}\n\treturn( 0 );\n}\n\n/* Tests the libevtx_record_values_get_utf16_source_name_size function\n * Returns 1 if successful or 0 if not\n */\nint evtx_test_record_values_get_utf16_source_name_size(\n void )\n{\n\tlibcerror_error_t *error = NULL;\n\tlibevtx_record_values_t *record_values = NULL;\n\tsize_t utf16_source_name_size = 0;\n\tint result = 0;\n\tint utf16_source_name_size_is_set = 0;\n\n\t/* Initialize test\n\t */\n\tresult = libevtx_record_values_initialize(\n\t &record_values,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"record_values\",\n\t record_values );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\t/* Test regular cases\n\t */\n\tresult = libevtx_record_values_get_utf16_source_name_size(\n\t record_values,\n\t &utf16_source_name_size,\n\t &error );\n\n\tEVTX_TEST_ASSERT_NOT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\tutf16_source_name_size_is_set = result;\n\n\t/* Test error cases\n\t */\n\tresult = libevtx_record_values_get_utf16_source_name_size(\n\t NULL,\n\t &utf16_source_name_size,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"error\",\n\t error );\n\n\tlibcerror_error_free(\n\t &error );\n\n\tif( utf16_source_name_size_is_set != 0 )\n\t{\n\t\tresult = libevtx_record_values_get_utf16_source_name_size(\n\t\t record_values,\n\t\t NULL,\n\t\t &error );\n\n\t\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t\t \"result\",\n\t\t result,\n\t\t -1 );\n\n\t\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t\t \"error\",\n\t\t error );\n\n\t\tlibcerror_error_free(\n\t\t &error );\n\t}\n\t/* Clean up\n\t */\n\tresult = libevtx_record_values_free(\n\t &record_values,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 1 );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"record_values\",\n\t record_values );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\treturn( 1 );\n\non_error:\n\tif( error != NULL )\n\t{\n\t\tlibcerror_error_free(\n\t\t &error );\n\t}\n\tif( record_values != NULL )\n\t{\n\t\tlibevtx_record_values_free(\n\t\t &record_values,\n\t\t NULL );\n\t}\n\treturn( 0 );\n}\n\n/* Tests the libevtx_record_values_get_utf16_source_name function\n * Returns 1 if successful or 0 if not\n */\nint evtx_test_record_values_get_utf16_source_name(\n void )\n{\n\tuint16_t utf16_source_name[ 512 ];\n\n\tlibcerror_error_t *error = NULL;\n\tlibevtx_record_values_t *record_values = NULL;\n\tint result = 0;\n\tint utf16_source_name_is_set = 0;\n\n\t/* Initialize test\n\t */\n\tresult = libevtx_record_values_initialize(\n\t &record_values,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"record_values\",\n\t record_values );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\t/* Test regular cases\n\t */\n\tresult = libevtx_record_values_get_utf16_source_name(\n\t record_values,\n\t utf16_source_name,\n\t 512,\n\t &error );\n\n\tEVTX_TEST_ASSERT_NOT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\tutf16_source_name_is_set = result;\n\n\t/* Test error cases\n\t */\n\tresult = libevtx_record_values_get_utf16_source_name(\n\t NULL,\n\t utf16_source_name,\n\t 512,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"error\",\n\t error );\n\n\tlibcerror_error_free(\n\t &error );\n\n\tif( utf16_source_name_is_set != 0 )\n\t{\n\t\tresult = libevtx_record_values_get_utf16_source_name(\n\t\t record_values,\n\t\t NULL,\n\t\t 512,\n\t\t &error );\n\n\t\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t\t \"result\",\n\t\t result,\n\t\t -1 );\n\n\t\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t\t \"error\",\n\t\t error );\n\n\t\tlibcerror_error_free(\n\t\t &error );\n\n\t\tresult = libevtx_record_values_get_utf16_source_name(\n\t\t record_values,\n\t\t utf16_source_name,\n\t\t 0,\n\t\t &error );\n\n\t\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t\t \"result\",\n\t\t result,\n\t\t -1 );\n\n\t\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t\t \"error\",\n\t\t error );\n\n\t\tlibcerror_error_free(\n\t\t &error );\n\n\t\tresult = libevtx_record_values_get_utf16_source_name(\n\t\t record_values,\n\t\t utf16_source_name,\n\t\t (size_t) SSIZE_MAX + 1,\n\t\t &error );\n\n\t\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t\t \"result\",\n\t\t result,\n\t\t -1 );\n\n\t\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t\t \"error\",\n\t\t error );\n\n\t\tlibcerror_error_free(\n\t\t &error );\n\t}\n\t/* Clean up\n\t */\n\tresult = libevtx_record_values_free(\n\t &record_values,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 1 );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"record_values\",\n\t record_values );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\treturn( 1 );\n\non_error:\n\tif( error != NULL )\n\t{\n\t\tlibcerror_error_free(\n\t\t &error );\n\t}\n\tif( record_values != NULL )\n\t{\n\t\tlibevtx_record_values_free(\n\t\t &record_values,\n\t\t NULL );\n\t}\n\treturn( 0 );\n}\n\n/* Tests the libevtx_record_values_get_utf8_computer_name_size function\n * Returns 1 if successful or 0 if not\n */\nint evtx_test_record_values_get_utf8_computer_name_size(\n void )\n{\n\tlibcerror_error_t *error = NULL;\n\tlibevtx_record_values_t *record_values = NULL;\n\tsize_t utf8_computer_name_size = 0;\n\tint result = 0;\n\tint utf8_computer_name_size_is_set = 0;\n\n\t/* Initialize test\n\t */\n\tresult = libevtx_record_values_initialize(\n\t &record_values,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"record_values\",\n\t record_values );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\t/* Test regular cases\n\t */\n\tresult = libevtx_record_values_get_utf8_computer_name_size(\n\t record_values,\n\t &utf8_computer_name_size,\n\t &error );\n\n\tEVTX_TEST_ASSERT_NOT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\tutf8_computer_name_size_is_set = result;\n\n\t/* Test error cases\n\t */\n\tresult = libevtx_record_values_get_utf8_computer_name_size(\n\t NULL,\n\t &utf8_computer_name_size,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"error\",\n\t error );\n\n\tlibcerror_error_free(\n\t &error );\n\n\tif( utf8_computer_name_size_is_set != 0 )\n\t{\n\t\tresult = libevtx_record_values_get_utf8_computer_name_size(\n\t\t record_values,\n\t\t NULL,\n\t\t &error );\n\n\t\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t\t \"result\",\n\t\t result,\n\t\t -1 );\n\n\t\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t\t \"error\",\n\t\t error );\n\n\t\tlibcerror_error_free(\n\t\t &error );\n\t}\n\t/* Clean up\n\t */\n\tresult = libevtx_record_values_free(\n\t &record_values,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 1 );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"record_values\",\n\t record_values );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\treturn( 1 );\n\non_error:\n\tif( error != NULL )\n\t{\n\t\tlibcerror_error_free(\n\t\t &error );\n\t}\n\tif( record_values != NULL )\n\t{\n\t\tlibevtx_record_values_free(\n\t\t &record_values,\n\t\t NULL );\n\t}\n\treturn( 0 );\n}\n\n/* Tests the libevtx_record_values_get_utf8_computer_name function\n * Returns 1 if successful or 0 if not\n */\nint evtx_test_record_values_get_utf8_computer_name(\n void )\n{\n\tuint8_t utf8_computer_name[ 512 ];\n\n\tlibcerror_error_t *error = NULL;\n\tlibevtx_record_values_t *record_values = NULL;\n\tint result = 0;\n\tint utf8_computer_name_is_set = 0;\n\n\t/* Initialize test\n\t */\n\tresult = libevtx_record_values_initialize(\n\t &record_values,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"record_values\",\n\t record_values );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\t/* Test regular cases\n\t */\n\tresult = libevtx_record_values_get_utf8_computer_name(\n\t record_values,\n\t utf8_computer_name,\n\t 512,\n\t &error );\n\n\tEVTX_TEST_ASSERT_NOT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\tutf8_computer_name_is_set = result;\n\n\t/* Test error cases\n\t */\n\tresult = libevtx_record_values_get_utf8_computer_name(\n\t NULL,\n\t utf8_computer_name,\n\t 512,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"error\",\n\t error );\n\n\tlibcerror_error_free(\n\t &error );\n\n\tif( utf8_computer_name_is_set != 0 )\n\t{\n\t\tresult = libevtx_record_values_get_utf8_computer_name(\n\t\t record_values,\n\t\t NULL,\n\t\t 512,\n\t\t &error );\n\n\t\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t\t \"result\",\n\t\t result,\n\t\t -1 );\n\n\t\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t\t \"error\",\n\t\t error );\n\n\t\tlibcerror_error_free(\n\t\t &error );\n\n\t\tresult = libevtx_record_values_get_utf8_computer_name(\n\t\t record_values,\n\t\t utf8_computer_name,\n\t\t 0,\n\t\t &error );\n\n\t\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t\t \"result\",\n\t\t result,\n\t\t -1 );\n\n\t\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t\t \"error\",\n\t\t error );\n\n\t\tlibcerror_error_free(\n\t\t &error );\n\n\t\tresult = libevtx_record_values_get_utf8_computer_name(\n\t\t record_values,\n\t\t utf8_computer_name,\n\t\t (size_t) SSIZE_MAX + 1,\n\t\t &error );\n\n\t\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t\t \"result\",\n\t\t result,\n\t\t -1 );\n\n\t\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t\t \"error\",\n\t\t error );\n\n\t\tlibcerror_error_free(\n\t\t &error );\n\t}\n\t/* Clean up\n\t */\n\tresult = libevtx_record_values_free(\n\t &record_values,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 1 );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"record_values\",\n\t record_values );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\treturn( 1 );\n\non_error:\n\tif( error != NULL )\n\t{\n\t\tlibcerror_error_free(\n\t\t &error );\n\t}\n\tif( record_values != NULL )\n\t{\n\t\tlibevtx_record_values_free(\n\t\t &record_values,\n\t\t NULL );\n\t}\n\treturn( 0 );\n}\n\n/* Tests the libevtx_record_values_get_utf16_computer_name_size function\n * Returns 1 if successful or 0 if not\n */\nint evtx_test_record_values_get_utf16_computer_name_size(\n void )\n{\n\tlibcerror_error_t *error = NULL;\n\tlibevtx_record_values_t *record_values = NULL;\n\tsize_t utf16_computer_name_size = 0;\n\tint result = 0;\n\tint utf16_computer_name_size_is_set = 0;\n\n\t/* Initialize test\n\t */\n\tresult = libevtx_record_values_initialize(\n\t &record_values,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"record_values\",\n\t record_values );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\t/* Test regular cases\n\t */\n\tresult = libevtx_record_values_get_utf16_computer_name_size(\n\t record_values,\n\t &utf16_computer_name_size,\n\t &error );\n\n\tEVTX_TEST_ASSERT_NOT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\tutf16_computer_name_size_is_set = result;\n\n\t/* Test error cases\n\t */\n\tresult = libevtx_record_values_get_utf16_computer_name_size(\n\t NULL,\n\t &utf16_computer_name_size,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"error\",\n\t error );\n\n\tlibcerror_error_free(\n\t &error );\n\n\tif( utf16_computer_name_size_is_set != 0 )\n\t{\n\t\tresult = libevtx_record_values_get_utf16_computer_name_size(\n\t\t record_values,\n\t\t NULL,\n\t\t &error );\n\n\t\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t\t \"result\",\n\t\t result,\n\t\t -1 );\n\n\t\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t\t \"error\",\n\t\t error );\n\n\t\tlibcerror_error_free(\n\t\t &error );\n\t}\n\t/* Clean up\n\t */\n\tresult = libevtx_record_values_free(\n\t &record_values,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 1 );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"record_values\",\n\t record_values );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\treturn( 1 );\n\non_error:\n\tif( error != NULL )\n\t{\n\t\tlibcerror_error_free(\n\t\t &error );\n\t}\n\tif( record_values != NULL )\n\t{\n\t\tlibevtx_record_values_free(\n\t\t &record_values,\n\t\t NULL );\n\t}\n\treturn( 0 );\n}\n\n/* Tests the libevtx_record_values_get_utf16_computer_name function\n * Returns 1 if successful or 0 if not\n */\nint evtx_test_record_values_get_utf16_computer_name(\n void )\n{\n\tuint16_t utf16_computer_name[ 512 ];\n\n\tlibcerror_error_t *error = NULL;\n\tlibevtx_record_values_t *record_values = NULL;\n\tint result = 0;\n\tint utf16_computer_name_is_set = 0;\n\n\t/* Initialize test\n\t */\n\tresult = libevtx_record_values_initialize(\n\t &record_values,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"record_values\",\n\t record_values );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\t/* Test regular cases\n\t */\n\tresult = libevtx_record_values_get_utf16_computer_name(\n\t record_values,\n\t utf16_computer_name,\n\t 512,\n\t &error );\n\n\tEVTX_TEST_ASSERT_NOT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\tutf16_computer_name_is_set = result;\n\n\t/* Test error cases\n\t */\n\tresult = libevtx_record_values_get_utf16_computer_name(\n\t NULL,\n\t utf16_computer_name,\n\t 512,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"error\",\n\t error );\n\n\tlibcerror_error_free(\n\t &error );\n\n\tif( utf16_computer_name_is_set != 0 )\n\t{\n\t\tresult = libevtx_record_values_get_utf16_computer_name(\n\t\t record_values,\n\t\t NULL,\n\t\t 512,\n\t\t &error );\n\n\t\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t\t \"result\",\n\t\t result,\n\t\t -1 );\n\n\t\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t\t \"error\",\n\t\t error );\n\n\t\tlibcerror_error_free(\n\t\t &error );\n\n\t\tresult = libevtx_record_values_get_utf16_computer_name(\n\t\t record_values,\n\t\t utf16_computer_name,\n\t\t 0,\n\t\t &error );\n\n\t\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t\t \"result\",\n\t\t result,\n\t\t -1 );\n\n\t\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t\t \"error\",\n\t\t error );\n\n\t\tlibcerror_error_free(\n\t\t &error );\n\n\t\tresult = libevtx_record_values_get_utf16_computer_name(\n\t\t record_values,\n\t\t utf16_computer_name,\n\t\t (size_t) SSIZE_MAX + 1,\n\t\t &error );\n\n\t\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t\t \"result\",\n\t\t result,\n\t\t -1 );\n\n\t\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t\t \"error\",\n\t\t error );\n\n\t\tlibcerror_error_free(\n\t\t &error );\n\t}\n\t/* Clean up\n\t */\n\tresult = libevtx_record_values_free(\n\t &record_values,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 1 );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"record_values\",\n\t record_values );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\treturn( 1 );\n\non_error:\n\tif( error != NULL )\n\t{\n\t\tlibcerror_error_free(\n\t\t &error );\n\t}\n\tif( record_values != NULL )\n\t{\n\t\tlibevtx_record_values_free(\n\t\t &record_values,\n\t\t NULL );\n\t}\n\treturn( 0 );\n}\n\n/* Tests the libevtx_record_values_get_utf8_user_security_identifier_size function\n * Returns 1 if successful or 0 if not\n */\nint evtx_test_record_values_get_utf8_user_security_identifier_size(\n void )\n{\n\tlibcerror_error_t *error = NULL;\n\tlibevtx_record_values_t *record_values = NULL;\n\tsize_t utf8_user_security_identifier_size = 0;\n\tint result = 0;\n\tint utf8_user_security_identifier_size_is_set = 0;\n\n\t/* Initialize test\n\t */\n\tresult = libevtx_record_values_initialize(\n\t &record_values,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"record_values\",\n\t record_values );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\t/* Test regular cases\n\t */\n\tresult = libevtx_record_values_get_utf8_user_security_identifier_size(\n\t record_values,\n\t &utf8_user_security_identifier_size,\n\t &error );\n\n\tEVTX_TEST_ASSERT_NOT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\tutf8_user_security_identifier_size_is_set = result;\n\n\t/* Test error cases\n\t */\n\tresult = libevtx_record_values_get_utf8_user_security_identifier_size(\n\t NULL,\n\t &utf8_user_security_identifier_size,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"error\",\n\t error );\n\n\tlibcerror_error_free(\n\t &error );\n\n\tif( utf8_user_security_identifier_size_is_set != 0 )\n\t{\n\t\tresult = libevtx_record_values_get_utf8_user_security_identifier_size(\n\t\t record_values,\n\t\t NULL,\n\t\t &error );\n\n\t\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t\t \"result\",\n\t\t result,\n\t\t -1 );\n\n\t\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t\t \"error\",\n\t\t error );\n\n\t\tlibcerror_error_free(\n\t\t &error );\n\t}\n\t/* Clean up\n\t */\n\tresult = libevtx_record_values_free(\n\t &record_values,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 1 );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"record_values\",\n\t record_values );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\treturn( 1 );\n\non_error:\n\tif( error != NULL )\n\t{\n\t\tlibcerror_error_free(\n\t\t &error );\n\t}\n\tif( record_values != NULL )\n\t{\n\t\tlibevtx_record_values_free(\n\t\t &record_values,\n\t\t NULL );\n\t}\n\treturn( 0 );\n}\n\n/* Tests the libevtx_record_values_get_utf8_user_security_identifier function\n * Returns 1 if successful or 0 if not\n */\nint evtx_test_record_values_get_utf8_user_security_identifier(\n void )\n{\n\tuint8_t utf8_user_security_identifier[ 512 ];\n\n\tlibcerror_error_t *error = NULL;\n\tlibevtx_record_values_t *record_values = NULL;\n\tint result = 0;\n\tint utf8_user_security_identifier_is_set = 0;\n\n\t/* Initialize test\n\t */\n\tresult = libevtx_record_values_initialize(\n\t &record_values,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"record_values\",\n\t record_values );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\t/* Test regular cases\n\t */\n\tresult = libevtx_record_values_get_utf8_user_security_identifier(\n\t record_values,\n\t utf8_user_security_identifier,\n\t 512,\n\t &error );\n\n\tEVTX_TEST_ASSERT_NOT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\tutf8_user_security_identifier_is_set = result;\n\n\t/* Test error cases\n\t */\n\tresult = libevtx_record_values_get_utf8_user_security_identifier(\n\t NULL,\n\t utf8_user_security_identifier,\n\t 512,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"error\",\n\t error );\n\n\tlibcerror_error_free(\n\t &error );\n\n\tif( utf8_user_security_identifier_is_set != 0 )\n\t{\n\t\tresult = libevtx_record_values_get_utf8_user_security_identifier(\n\t\t record_values,\n\t\t NULL,\n\t\t 512,\n\t\t &error );\n\n\t\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t\t \"result\",\n\t\t result,\n\t\t -1 );\n\n\t\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t\t \"error\",\n\t\t error );\n\n\t\tlibcerror_error_free(\n\t\t &error );\n\n\t\tresult = libevtx_record_values_get_utf8_user_security_identifier(\n\t\t record_values,\n\t\t utf8_user_security_identifier,\n\t\t 0,\n\t\t &error );\n\n\t\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t\t \"result\",\n\t\t result,\n\t\t -1 );\n\n\t\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t\t \"error\",\n\t\t error );\n\n\t\tlibcerror_error_free(\n\t\t &error );\n\n\t\tresult = libevtx_record_values_get_utf8_user_security_identifier(\n\t\t record_values,\n\t\t utf8_user_security_identifier,\n\t\t (size_t) SSIZE_MAX + 1,\n\t\t &error );\n\n\t\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t\t \"result\",\n\t\t result,\n\t\t -1 );\n\n\t\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t\t \"error\",\n\t\t error );\n\n\t\tlibcerror_error_free(\n\t\t &error );\n\t}\n\t/* Clean up\n\t */\n\tresult = libevtx_record_values_free(\n\t &record_values,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 1 );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"record_values\",\n\t record_values );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\treturn( 1 );\n\non_error:\n\tif( error != NULL )\n\t{\n\t\tlibcerror_error_free(\n\t\t &error );\n\t}\n\tif( record_values != NULL )\n\t{\n\t\tlibevtx_record_values_free(\n\t\t &record_values,\n\t\t NULL );\n\t}\n\treturn( 0 );\n}\n\n/* Tests the libevtx_record_values_get_utf16_user_security_identifier_size function\n * Returns 1 if successful or 0 if not\n */\nint evtx_test_record_values_get_utf16_user_security_identifier_size(\n void )\n{\n\tlibcerror_error_t *error = NULL;\n\tlibevtx_record_values_t *record_values = NULL;\n\tsize_t utf16_user_security_identifier_size = 0;\n\tint result = 0;\n\tint utf16_user_security_identifier_size_is_set = 0;\n\n\t/* Initialize test\n\t */\n\tresult = libevtx_record_values_initialize(\n\t &record_values,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"record_values\",\n\t record_values );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\t/* Test regular cases\n\t */\n\tresult = libevtx_record_values_get_utf16_user_security_identifier_size(\n\t record_values,\n\t &utf16_user_security_identifier_size,\n\t &error );\n\n\tEVTX_TEST_ASSERT_NOT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\tutf16_user_security_identifier_size_is_set = result;\n\n\t/* Test error cases\n\t */\n\tresult = libevtx_record_values_get_utf16_user_security_identifier_size(\n\t NULL,\n\t &utf16_user_security_identifier_size,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"error\",\n\t error );\n\n\tlibcerror_error_free(\n\t &error );\n\n\tif( utf16_user_security_identifier_size_is_set != 0 )\n\t{\n\t\tresult = libevtx_record_values_get_utf16_user_security_identifier_size(\n\t\t record_values,\n\t\t NULL,\n\t\t &error );\n\n\t\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t\t \"result\",\n\t\t result,\n\t\t -1 );\n\n\t\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t\t \"error\",\n\t\t error );\n\n\t\tlibcerror_error_free(\n\t\t &error );\n\t}\n\t/* Clean up\n\t */\n\tresult = libevtx_record_values_free(\n\t &record_values,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 1 );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"record_values\",\n\t record_values );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\treturn( 1 );\n\non_error:\n\tif( error != NULL )\n\t{\n\t\tlibcerror_error_free(\n\t\t &error );\n\t}\n\tif( record_values != NULL )\n\t{\n\t\tlibevtx_record_values_free(\n\t\t &record_values,\n\t\t NULL );\n\t}\n\treturn( 0 );\n}\n\n/* Tests the libevtx_record_values_get_utf16_user_security_identifier function\n * Returns 1 if successful or 0 if not\n */\nint evtx_test_record_values_get_utf16_user_security_identifier(\n void )\n{\n\tuint16_t utf16_user_security_identifier[ 512 ];\n\n\tlibcerror_error_t *error = NULL;\n\tlibevtx_record_values_t *record_values = NULL;\n\tint result = 0;\n\tint utf16_user_security_identifier_is_set = 0;\n\n\t/* Initialize test\n\t */\n\tresult = libevtx_record_values_initialize(\n\t &record_values,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"record_values\",\n\t record_values );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\t/* Test regular cases\n\t */\n\tresult = libevtx_record_values_get_utf16_user_security_identifier(\n\t record_values,\n\t utf16_user_security_identifier,\n\t 512,\n\t &error );\n\n\tEVTX_TEST_ASSERT_NOT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\tutf16_user_security_identifier_is_set = result;\n\n\t/* Test error cases\n\t */\n\tresult = libevtx_record_values_get_utf16_user_security_identifier(\n\t NULL,\n\t utf16_user_security_identifier,\n\t 512,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"error\",\n\t error );\n\n\tlibcerror_error_free(\n\t &error );\n\n\tif( utf16_user_security_identifier_is_set != 0 )\n\t{\n\t\tresult = libevtx_record_values_get_utf16_user_security_identifier(\n\t\t record_values,\n\t\t NULL,\n\t\t 512,\n\t\t &error );\n\n\t\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t\t \"result\",\n\t\t result,\n\t\t -1 );\n\n\t\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t\t \"error\",\n\t\t error );\n\n\t\tlibcerror_error_free(\n\t\t &error );\n\n\t\tresult = libevtx_record_values_get_utf16_user_security_identifier(\n\t\t record_values,\n\t\t utf16_user_security_identifier,\n\t\t 0,\n\t\t &error );\n\n\t\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t\t \"result\",\n\t\t result,\n\t\t -1 );\n\n\t\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t\t \"error\",\n\t\t error );\n\n\t\tlibcerror_error_free(\n\t\t &error );\n\n\t\tresult = libevtx_record_values_get_utf16_user_security_identifier(\n\t\t record_values,\n\t\t utf16_user_security_identifier,\n\t\t (size_t) SSIZE_MAX + 1,\n\t\t &error );\n\n\t\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t\t \"result\",\n\t\t result,\n\t\t -1 );\n\n\t\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t\t \"error\",\n\t\t error );\n\n\t\tlibcerror_error_free(\n\t\t &error );\n\t}\n\t/* Clean up\n\t */\n\tresult = libevtx_record_values_free(\n\t &record_values,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 1 );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"record_values\",\n\t record_values );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\treturn( 1 );\n\non_error:\n\tif( error != NULL )\n\t{\n\t\tlibcerror_error_free(\n\t\t &error );\n\t}\n\tif( record_values != NULL )\n\t{\n\t\tlibevtx_record_values_free(\n\t\t &record_values,\n\t\t NULL );\n\t}\n\treturn( 0 );\n}\n\n/* Tests the libevtx_record_values_get_utf8_xml_string_size function\n * Returns 1 if successful or 0 if not\n */\nint evtx_test_record_values_get_utf8_xml_string_size(\n void )\n{\n\tlibcerror_error_t *error = NULL;\n\tlibevtx_record_values_t *record_values = NULL;\n\tsize_t utf8_xml_string_size = 0;\n\tint result = 0;\n\tint utf8_xml_string_size_is_set = 0;\n\n\t/* Initialize test\n\t */\n\tresult = libevtx_record_values_initialize(\n\t &record_values,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"record_values\",\n\t record_values );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\t/* Test regular cases\n\t */\n\tresult = libevtx_record_values_get_utf8_xml_string_size(\n\t record_values,\n\t &utf8_xml_string_size,\n\t &error );\n\n\tEVTX_TEST_ASSERT_NOT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\tutf8_xml_string_size_is_set = result;\n\n\t/* Test error cases\n\t */\n\tresult = libevtx_record_values_get_utf8_xml_string_size(\n\t NULL,\n\t &utf8_xml_string_size,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"error\",\n\t error );\n\n\tlibcerror_error_free(\n\t &error );\n\n\tif( utf8_xml_string_size_is_set != 0 )\n\t{\n\t\tresult = libevtx_record_values_get_utf8_xml_string_size(\n\t\t record_values,\n\t\t NULL,\n\t\t &error );\n\n\t\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t\t \"result\",\n\t\t result,\n\t\t -1 );\n\n\t\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t\t \"error\",\n\t\t error );\n\n\t\tlibcerror_error_free(\n\t\t &error );\n\t}\n\t/* Clean up\n\t */\n\tresult = libevtx_record_values_free(\n\t &record_values,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 1 );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"record_values\",\n\t record_values );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\treturn( 1 );\n\non_error:\n\tif( error != NULL )\n\t{\n\t\tlibcerror_error_free(\n\t\t &error );\n\t}\n\tif( record_values != NULL )\n\t{\n\t\tlibevtx_record_values_free(\n\t\t &record_values,\n\t\t NULL );\n\t}\n\treturn( 0 );\n}\n\n/* Tests the libevtx_record_values_get_utf8_xml_string function\n * Returns 1 if successful or 0 if not\n */\nint evtx_test_record_values_get_utf8_xml_string(\n void )\n{\n\tuint8_t utf8_xml_string[ 512 ];\n\n\tlibcerror_error_t *error = NULL;\n\tlibevtx_record_values_t *record_values = NULL;\n\tint result = 0;\n\tint utf8_xml_string_is_set = 0;\n\n\t/* Initialize test\n\t */\n\tresult = libevtx_record_values_initialize(\n\t &record_values,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"record_values\",\n\t record_values );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\t/* Test regular cases\n\t */\n\tresult = libevtx_record_values_get_utf8_xml_string(\n\t record_values,\n\t utf8_xml_string,\n\t 512,\n\t &error );\n\n\tEVTX_TEST_ASSERT_NOT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\tutf8_xml_string_is_set = result;\n\n\t/* Test error cases\n\t */\n\tresult = libevtx_record_values_get_utf8_xml_string(\n\t NULL,\n\t utf8_xml_string,\n\t 512,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"error\",\n\t error );\n\n\tlibcerror_error_free(\n\t &error );\n\n\tif( utf8_xml_string_is_set != 0 )\n\t{\n\t\tresult = libevtx_record_values_get_utf8_xml_string(\n\t\t record_values,\n\t\t NULL,\n\t\t 512,\n\t\t &error );\n\n\t\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t\t \"result\",\n\t\t result,\n\t\t -1 );\n\n\t\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t\t \"error\",\n\t\t error );\n\n\t\tlibcerror_error_free(\n\t\t &error );\n\n\t\tresult = libevtx_record_values_get_utf8_xml_string(\n\t\t record_values,\n\t\t utf8_xml_string,\n\t\t 0,\n\t\t &error );\n\n\t\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t\t \"result\",\n\t\t result,\n\t\t -1 );\n\n\t\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t\t \"error\",\n\t\t error );\n\n\t\tlibcerror_error_free(\n\t\t &error );\n\n\t\tresult = libevtx_record_values_get_utf8_xml_string(\n\t\t record_values,\n\t\t utf8_xml_string,\n\t\t (size_t) SSIZE_MAX + 1,\n\t\t &error );\n\n\t\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t\t \"result\",\n\t\t result,\n\t\t -1 );\n\n\t\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t\t \"error\",\n\t\t error );\n\n\t\tlibcerror_error_free(\n\t\t &error );\n\t}\n\t/* Clean up\n\t */\n\tresult = libevtx_record_values_free(\n\t &record_values,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 1 );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"record_values\",\n\t record_values );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\treturn( 1 );\n\non_error:\n\tif( error != NULL )\n\t{\n\t\tlibcerror_error_free(\n\t\t &error );\n\t}\n\tif( record_values != NULL )\n\t{\n\t\tlibevtx_record_values_free(\n\t\t &record_values,\n\t\t NULL );\n\t}\n\treturn( 0 );\n}\n\n/* Tests the libevtx_record_values_get_utf16_xml_string_size function\n * Returns 1 if successful or 0 if not\n */\nint evtx_test_record_values_get_utf16_xml_string_size(\n void )\n{\n\tlibcerror_error_t *error = NULL;\n\tlibevtx_record_values_t *record_values = NULL;\n\tsize_t utf16_xml_string_size = 0;\n\tint result = 0;\n\tint utf16_xml_string_size_is_set = 0;\n\n\t/* Initialize test\n\t */\n\tresult = libevtx_record_values_initialize(\n\t &record_values,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"record_values\",\n\t record_values );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\t/* Test regular cases\n\t */\n\tresult = libevtx_record_values_get_utf16_xml_string_size(\n\t record_values,\n\t &utf16_xml_string_size,\n\t &error );\n\n\tEVTX_TEST_ASSERT_NOT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\tutf16_xml_string_size_is_set = result;\n\n\t/* Test error cases\n\t */\n\tresult = libevtx_record_values_get_utf16_xml_string_size(\n\t NULL,\n\t &utf16_xml_string_size,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"error\",\n\t error );\n\n\tlibcerror_error_free(\n\t &error );\n\n\tif( utf16_xml_string_size_is_set != 0 )\n\t{\n\t\tresult = libevtx_record_values_get_utf16_xml_string_size(\n\t\t record_values,\n\t\t NULL,\n\t\t &error );\n\n\t\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t\t \"result\",\n\t\t result,\n\t\t -1 );\n\n\t\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t\t \"error\",\n\t\t error );\n\n\t\tlibcerror_error_free(\n\t\t &error );\n\t}\n\t/* Clean up\n\t */\n\tresult = libevtx_record_values_free(\n\t &record_values,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 1 );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"record_values\",\n\t record_values );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\treturn( 1 );\n\non_error:\n\tif( error != NULL )\n\t{\n\t\tlibcerror_error_free(\n\t\t &error );\n\t}\n\tif( record_values != NULL )\n\t{\n\t\tlibevtx_record_values_free(\n\t\t &record_values,\n\t\t NULL );\n\t}\n\treturn( 0 );\n}\n\n/* Tests the libevtx_record_values_get_utf16_xml_string function\n * Returns 1 if successful or 0 if not\n */\nint evtx_test_record_values_get_utf16_xml_string(\n void )\n{\n\tuint16_t utf16_xml_string[ 512 ];\n\n\tlibcerror_error_t *error = NULL;\n\tlibevtx_record_values_t *record_values = NULL;\n\tint result = 0;\n\tint utf16_xml_string_is_set = 0;\n\n\t/* Initialize test\n\t */\n\tresult = libevtx_record_values_initialize(\n\t &record_values,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"record_values\",\n\t record_values );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\t/* Test regular cases\n\t */\n\tresult = libevtx_record_values_get_utf16_xml_string(\n\t record_values,\n\t utf16_xml_string,\n\t 512,\n\t &error );\n\n\tEVTX_TEST_ASSERT_NOT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\tutf16_xml_string_is_set = result;\n\n\t/* Test error cases\n\t */\n\tresult = libevtx_record_values_get_utf16_xml_string(\n\t NULL,\n\t utf16_xml_string,\n\t 512,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"error\",\n\t error );\n\n\tlibcerror_error_free(\n\t &error );\n\n\tif( utf16_xml_string_is_set != 0 )\n\t{\n\t\tresult = libevtx_record_values_get_utf16_xml_string(\n\t\t record_values,\n\t\t NULL,\n\t\t 512,\n\t\t &error );\n\n\t\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t\t \"result\",\n\t\t result,\n\t\t -1 );\n\n\t\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t\t \"error\",\n\t\t error );\n\n\t\tlibcerror_error_free(\n\t\t &error );\n\n\t\tresult = libevtx_record_values_get_utf16_xml_string(\n\t\t record_values,\n\t\t utf16_xml_string,\n\t\t 0,\n\t\t &error );\n\n\t\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t\t \"result\",\n\t\t result,\n\t\t -1 );\n\n\t\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t\t \"error\",\n\t\t error );\n\n\t\tlibcerror_error_free(\n\t\t &error );\n\n\t\tresult = libevtx_record_values_get_utf16_xml_string(\n\t\t record_values,\n\t\t utf16_xml_string,\n\t\t (size_t) SSIZE_MAX + 1,\n\t\t &error );\n\n\t\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t\t \"result\",\n\t\t result,\n\t\t -1 );\n\n\t\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t\t \"error\",\n\t\t error );\n\n\t\tlibcerror_error_free(\n\t\t &error );\n\t}\n\t/* Clean up\n\t */\n\tresult = libevtx_record_values_free(\n\t &record_values,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 1 );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"record_values\",\n\t record_values );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\treturn( 1 );\n\non_error:\n\tif( error != NULL )\n\t{\n\t\tlibcerror_error_free(\n\t\t &error );\n\t}\n\tif( record_values != NULL )\n\t{\n\t\tlibevtx_record_values_free(\n\t\t &record_values,\n\t\t NULL );\n\t}\n\treturn( 0 );\n}\n\n#endif /* defined( __GNUC__ ) && !defined( LIBEVTX_DLL_IMPORT ) */\n\n/* The main program\n */\n#if defined( HAVE_WIDE_SYSTEM_CHARACTER )\nint wmain(\n int argc EVTX_TEST_ATTRIBUTE_UNUSED,\n wchar_t * const argv[] EVTX_TEST_ATTRIBUTE_UNUSED )\n#else\nint main(\n int argc EVTX_TEST_ATTRIBUTE_UNUSED,\n char * const argv[] EVTX_TEST_ATTRIBUTE_UNUSED )\n#endif\n{\n\tEVTX_TEST_UNREFERENCED_PARAMETER( argc )\n\tEVTX_TEST_UNREFERENCED_PARAMETER( argv )\n\n#if defined( __GNUC__ ) && !defined( LIBEVTX_DLL_IMPORT )\n\n\tEVTX_TEST_RUN(\n\t \"libevtx_record_values_initialize\",\n\t evtx_test_record_values_initialize );\n\n\tEVTX_TEST_RUN(\n\t \"libevtx_record_values_free\",\n\t evtx_test_record_values_free );\n\n\tEVTX_TEST_RUN(\n\t \"libevtx_record_values_clone\",\n\t evtx_test_record_values_clone );\n\n#if defined( TODO )\n\n\t/* TODO: add tests for libevtx_record_values_read_header */\n\n\t/* TODO: add tests for libevtx_record_values_read_xml_document */\n\n\tEVTX_TEST_RUN(\n\t \"libevtx_record_values_get_event_identifier\",\n\t evtx_test_record_values_get_event_identifier );\n\n\tEVTX_TEST_RUN(\n\t \"libevtx_record_values_get_event_identifier_qualifiers\",\n\t evtx_test_record_values_get_event_identifier_qualifiers );\n\n\tEVTX_TEST_RUN(\n\t \"libevtx_record_values_get_event_level\",\n\t evtx_test_record_values_get_event_level );\n\n\tEVTX_TEST_RUN(\n\t \"libevtx_record_values_get_utf8_provider_identifier_size\",\n\t evtx_test_record_values_get_utf8_provider_identifier_size );\n\n\tEVTX_TEST_RUN(\n\t \"libevtx_record_values_get_utf8_provider_identifier\",\n\t evtx_test_record_values_get_utf8_provider_identifier );\n\n\tEVTX_TEST_RUN(\n\t \"libevtx_record_values_get_utf16_provider_identifier_size\",\n\t evtx_test_record_values_get_utf16_provider_identifier_size );\n\n\tEVTX_TEST_RUN(\n\t \"libevtx_record_values_get_utf16_provider_identifier\",\n\t evtx_test_record_values_get_utf16_provider_identifier );\n\n\tEVTX_TEST_RUN(\n\t \"libevtx_record_values_get_utf8_source_name_size\",\n\t evtx_test_record_values_get_utf8_source_name_size );\n\n\tEVTX_TEST_RUN(\n\t \"libevtx_record_values_get_utf8_source_name\",\n\t evtx_test_record_values_get_utf8_source_name );\n\n\tEVTX_TEST_RUN(\n\t \"libevtx_record_values_get_utf16_source_name_size\",\n\t evtx_test_record_values_get_utf16_source_name_size );\n\n\tEVTX_TEST_RUN(\n\t \"libevtx_record_values_get_utf16_source_name\",\n\t evtx_test_record_values_get_utf16_source_name );\n\n\tEVTX_TEST_RUN(\n\t \"libevtx_record_values_get_utf8_computer_name_size\",\n\t evtx_test_record_values_get_utf8_computer_name_size );\n\n\tEVTX_TEST_RUN(\n\t \"libevtx_record_values_get_utf8_computer_name\",\n\t evtx_test_record_values_get_utf8_computer_name );\n\n\tEVTX_TEST_RUN(\n\t \"libevtx_record_values_get_utf16_computer_name_size\",\n\t evtx_test_record_values_get_utf16_computer_name_size );\n\n\tEVTX_TEST_RUN(\n\t \"libevtx_record_values_get_utf16_computer_name\",\n\t evtx_test_record_values_get_utf16_computer_name );\n\n\tEVTX_TEST_RUN(\n\t \"libevtx_record_values_get_utf8_user_security_identifier_size\",\n\t evtx_test_record_values_get_utf8_user_security_identifier_size );\n\n\tEVTX_TEST_RUN(\n\t \"libevtx_record_values_get_utf8_user_security_identifier\",\n\t evtx_test_record_values_get_utf8_user_security_identifier );\n\n\tEVTX_TEST_RUN(\n\t \"libevtx_record_values_get_utf16_user_security_identifier_size\",\n\t evtx_test_record_values_get_utf16_user_security_identifier_size );\n\n\tEVTX_TEST_RUN(\n\t \"libevtx_record_values_get_utf16_user_security_identifier\",\n\t evtx_test_record_values_get_utf16_user_security_identifier );\n\n\t/* TODO: add tests for libevtx_record_values_parse_data */\n\n\t/* TODO: add tests for libevtx_record_values_get_number_of_strings */\n\n\t/* TODO: add tests for libevtx_record_values_get_utf8_string_size */\n\n\t/* TODO: add tests for libevtx_record_values_get_utf8_string */\n\n\t/* TODO: add tests for libevtx_record_values_get_utf16_string_size */\n\n\t/* TODO: add tests for libevtx_record_values_get_utf16_string */\n\n\t/* TODO: add tests for libevtx_record_values_get_data_size */\n\n\t/* TODO: add tests for libevtx_record_values_get_data */\n\n\tEVTX_TEST_RUN(\n\t \"libevtx_record_values_get_utf8_xml_string_size\",\n\t evtx_test_record_values_get_utf8_xml_string_size );\n\n\tEVTX_TEST_RUN(\n\t \"libevtx_record_values_get_utf8_xml_string\",\n\t evtx_test_record_values_get_utf8_xml_string );\n\n\tEVTX_TEST_RUN(\n\t \"libevtx_record_values_get_utf16_xml_string_size\",\n\t evtx_test_record_values_get_utf16_xml_string_size );\n\n\tEVTX_TEST_RUN(\n\t \"libevtx_record_values_get_utf16_xml_string\",\n\t evtx_test_record_values_get_utf16_xml_string );\n\n#endif /* defined( TODO ) */\n\n#endif /* defined( __GNUC__ ) && !defined( LIBEVTX_DLL_IMPORT ) */\n\n\treturn( EXIT_SUCCESS );\n\non_error:\n\treturn( EXIT_FAILURE );\n}\n\n" }, { "path": "tests/evtx_test_support.c", "content": "/*\n * Library support functions test program\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#include \n#include \n#include \n#include \n#include \n#include \n\n#if defined( HAVE_STDLIB_H ) || defined( WINAPI )\n#include \n#endif\n\n#include \"evtx_test_functions.h\"\n#include \"evtx_test_getopt.h\"\n#include \"evtx_test_libbfio.h\"\n#include \"evtx_test_libcerror.h\"\n#include \"evtx_test_libevtx.h\"\n#include \"evtx_test_macros.h\"\n#include \"evtx_test_memory.h\"\n#include \"evtx_test_unused.h\"\n\n#if !defined( LIBEVTX_HAVE_BFIO )\n\nLIBEVTX_EXTERN \\\nint libevtx_check_file_signature_file_io_handle(\n libbfio_handle_t *file_io_handle,\n libcerror_error_t **error );\n\n#endif /* !defined( LIBEVTX_HAVE_BFIO ) */\n\n/* Tests the libevtx_get_version function\n * Returns 1 if successful or 0 if not\n */\nint evtx_test_get_version(\n void )\n{\n\tconst char *version_string = NULL;\n\tint result = 0;\n\n\tversion_string = libevtx_get_version();\n\n\tresult = narrow_string_compare(\n\t version_string,\n\t LIBEVTX_VERSION_STRING,\n\t 9 );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 0 );\n\n\treturn( 1 );\n\non_error:\n\treturn( 0 );\n}\n\n/* Tests the libevtx_get_access_flags_read function\n * Returns 1 if successful or 0 if not\n */\nint evtx_test_get_access_flags_read(\n void )\n{\n\tint access_flags = 0;\n\n\taccess_flags = libevtx_get_access_flags_read();\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"access_flags\",\n\t access_flags,\n\t LIBEVTX_ACCESS_FLAG_READ );\n\n\treturn( 1 );\n\non_error:\n\treturn( 0 );\n}\n\n/* Tests the libevtx_get_codepage function\n * Returns 1 if successful or 0 if not\n */\nint evtx_test_get_codepage(\n void )\n{\n\tlibcerror_error_t *error = NULL;\n\tint codepage = 0;\n\tint result = 0;\n\n\tresult = libevtx_get_codepage(\n\t &codepage,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 1 );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\t/* Test error cases\n\t */\n\tresult = libevtx_get_codepage(\n\t NULL,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"error\",\n\t error );\n\n\tlibcerror_error_free(\n\t &error );\n\n\treturn( 1 );\n\non_error:\n\tif( error != NULL )\n\t{\n\t\tlibcerror_error_free(\n\t\t &error );\n\t}\n\treturn( 0 );\n}\n\n/* Tests the libevtx_set_codepage function\n * Returns 1 if successful or 0 if not\n */\nint evtx_test_set_codepage(\n void )\n{\n\tlibcerror_error_t *error = NULL;\n\tint result = 0;\n\n\tresult = libevtx_set_codepage(\n\t 0,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 1 );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\t/* Test error cases\n\t */\n\tresult = libevtx_set_codepage(\n\t -1,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"error\",\n\t error );\n\n\tlibcerror_error_free(\n\t &error );\n\n\treturn( 1 );\n\non_error:\n\tif( error != NULL )\n\t{\n\t\tlibcerror_error_free(\n\t\t &error );\n\t}\n\treturn( 0 );\n}\n\n/* Tests the libevtx_check_file_signature function\n * Returns 1 if successful or 0 if not\n */\nint evtx_test_check_file_signature(\n const system_character_t *source )\n{\n\tchar narrow_source[ 256 ];\n\n\tlibcerror_error_t *error = NULL;\n\tint result = 0;\n\n\tif( source != NULL )\n\t{\n\t\t/* Initialize test\n\t\t */\n\t\tresult = evtx_test_get_narrow_source(\n\t\t source,\n\t\t narrow_source,\n\t\t 256,\n\t\t &error );\n\n\t\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t\t \"result\",\n\t\t result,\n\t\t 1 );\n\n\t\tEVTX_TEST_ASSERT_IS_NULL(\n\t\t \"error\",\n\t\t error );\n\n\t\t/* Test check file signature\n\t\t */\n\t\tresult = libevtx_check_file_signature(\n\t\t narrow_source,\n\t\t &error );\n\n\t\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t\t \"result\",\n\t\t result,\n\t\t 1 );\n\n\t\tEVTX_TEST_ASSERT_IS_NULL(\n\t\t \"error\",\n\t\t error );\n\t}\n\t/* Test error cases\n\t */\n\tresult = libevtx_check_file_signature(\n\t NULL,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"error\",\n\t error );\n\n\tlibcerror_error_free(\n\t &error );\n\n\tresult = libevtx_check_file_signature(\n\t \"\",\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"error\",\n\t error );\n\n\tlibcerror_error_free(\n\t &error );\n\n\tif( source != NULL )\n\t{\n#if defined( HAVE_EVTX_TEST_MEMORY )\n\n\t\t/* Test libevtx_check_file_signature with malloc failing in libbfio_file_initialize\n\t\t */\n\t\tevtx_test_malloc_attempts_before_fail = 0;\n\n\t\tresult = libevtx_check_file_signature(\n\t\t narrow_source,\n\t\t &error );\n\n\t\tif( evtx_test_malloc_attempts_before_fail != -1 )\n\t\t{\n\t\t\tevtx_test_malloc_attempts_before_fail = -1;\n\t\t}\n\t\telse\n\t\t{\n\t\t\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t\t\t \"result\",\n\t\t\t result,\n\t\t\t -1 );\n\n\t\t\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t\t\t \"error\",\n\t\t\t error );\n\n\t\t\tlibcerror_error_free(\n\t\t\t &error );\n\t\t}\n#endif /* defined( HAVE_EVTX_TEST_MEMORY ) */\n\t}\n\treturn( 1 );\n\non_error:\n\tif( error != NULL )\n\t{\n\t\tlibcerror_error_free(\n\t\t &error );\n\t}\n\treturn( 0 );\n}\n\n#if defined( HAVE_WIDE_CHARACTER_TYPE )\n\n/* Tests the libevtx_check_file_signature_wide function\n * Returns 1 if successful or 0 if not\n */\nint evtx_test_check_file_signature_wide(\n const system_character_t *source )\n{\n\twchar_t wide_source[ 256 ];\n\n\tlibcerror_error_t *error = NULL;\n\tint result = 0;\n\n\tif( source != NULL )\n\t{\n\t\t/* Initialize test\n\t\t */\n\t\tresult = evtx_test_get_wide_source(\n\t\t source,\n\t\t wide_source,\n\t\t 256,\n\t\t &error );\n\n\t\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t\t \"result\",\n\t\t result,\n\t\t 1 );\n\n\t\tEVTX_TEST_ASSERT_IS_NULL(\n\t\t \"error\",\n\t\t error );\n\n\t\t/* Test check file signature\n\t\t */\n\t\tresult = libevtx_check_file_signature_wide(\n\t\t wide_source,\n\t\t &error );\n\n\t\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t\t \"result\",\n\t\t result,\n\t\t 1 );\n\n\t\tEVTX_TEST_ASSERT_IS_NULL(\n\t\t \"error\",\n\t\t error );\n\t}\n\t/* Test error cases\n\t */\n\tresult = libevtx_check_file_signature_wide(\n\t NULL,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"error\",\n\t error );\n\n\tlibcerror_error_free(\n\t &error );\n\n\tresult = libevtx_check_file_signature_wide(\n\t L\"\",\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"error\",\n\t error );\n\n\tlibcerror_error_free(\n\t &error );\n\n\tif( source != NULL )\n\t{\n#if defined( HAVE_EVTX_TEST_MEMORY )\n\n\t\t/* Test libevtx_check_file_signature_wide with malloc failing in libbfio_file_initialize\n\t\t */\n\t\tevtx_test_malloc_attempts_before_fail = 0;\n\n\t\tresult = libevtx_check_file_signature_wide(\n\t\t wide_source,\n\t\t &error );\n\n\t\tif( evtx_test_malloc_attempts_before_fail != -1 )\n\t\t{\n\t\t\tevtx_test_malloc_attempts_before_fail = -1;\n\t\t}\n\t\telse\n\t\t{\n\t\t\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t\t\t \"result\",\n\t\t\t result,\n\t\t\t -1 );\n\n\t\t\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t\t\t \"error\",\n\t\t\t error );\n\n\t\t\tlibcerror_error_free(\n\t\t\t &error );\n\t\t}\n#endif /* defined( HAVE_EVTX_TEST_MEMORY ) */\n\t}\n\treturn( 1 );\n\non_error:\n\tif( error != NULL )\n\t{\n\t\tlibcerror_error_free(\n\t\t &error );\n\t}\n\treturn( 0 );\n}\n\n#endif /* defined( HAVE_WIDE_CHARACTER_TYPE ) */\n\n/* Tests the libevtx_check_file_signature_file_io_handle function\n * Returns 1 if successful or 0 if not\n */\nint evtx_test_check_file_signature_file_io_handle(\n const system_character_t *source )\n{\n\tuint8_t empty_block[ 8192 ];\n\n\tlibbfio_handle_t *file_io_handle = NULL;\n\tlibcerror_error_t *error = NULL;\n\tvoid *memset_result = NULL;\n\tsize_t source_length = 0;\n\tint result = 0;\n\n\t/* Initialize test\n\t */\n\tmemset_result = memory_set(\n\t empty_block,\n\t 0,\n\t sizeof( uint8_t ) * 8192 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"memset_result\",\n\t memset_result );\n\n\tif( source != NULL )\n\t{\n\t\t/* Initialize test\n\t\t */\n\t\tresult = libbfio_file_initialize(\n\t\t &file_io_handle,\n\t\t &error );\n\n\t\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t\t \"result\",\n\t\t result,\n\t\t 1 );\n\n\t\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t\t \"file_io_handle\",\n\t\t file_io_handle );\n\n\t\tEVTX_TEST_ASSERT_IS_NULL(\n\t\t \"error\",\n\t\t error );\n\n\t\tsource_length = system_string_length(\n\t\t source );\n\n#if defined( HAVE_WIDE_SYSTEM_CHARACTER )\n\t\tresult = libbfio_file_set_name_wide(\n\t\t file_io_handle,\n\t\t source,\n\t\t source_length,\n\t\t &error );\n#else\n\t\tresult = libbfio_file_set_name(\n\t\t file_io_handle,\n\t\t source,\n\t\t source_length,\n\t\t &error );\n#endif\n\t\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t\t \"result\",\n\t\t result,\n\t\t 1 );\n\n\t\tEVTX_TEST_ASSERT_IS_NULL(\n\t\t \"error\",\n\t\t error );\n\n\t\tresult = libbfio_handle_open(\n\t\t file_io_handle,\n\t\t LIBBFIO_OPEN_READ,\n\t\t &error );\n\n\t\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t\t \"result\",\n\t\t result,\n\t\t 1 );\n\n\t\tEVTX_TEST_ASSERT_IS_NULL(\n\t\t \"error\",\n\t\t error );\n\n\t\t/* Test check file signature\n\t\t */\n\t\tresult = libevtx_check_file_signature_file_io_handle(\n\t\t file_io_handle,\n\t\t &error );\n\n\t\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t\t \"result\",\n\t\t result,\n\t\t 1 );\n\n\t\tEVTX_TEST_ASSERT_IS_NULL(\n\t\t \"error\",\n\t\t error );\n\t}\n\t/* Test error cases\n\t */\n\tresult = libevtx_check_file_signature_file_io_handle(\n\t NULL,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"error\",\n\t error );\n\n\tlibcerror_error_free(\n\t &error );\n\n\t/* Clean up\n\t */\n\tif( source != NULL )\n\t{\n\t\tresult = libbfio_handle_close(\n\t\t file_io_handle,\n\t\t &error );\n\n\t\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t\t \"result\",\n\t\t result,\n\t\t 0 );\n\n\t\tEVTX_TEST_ASSERT_IS_NULL(\n\t\t \"error\",\n\t\t error );\n\n\t\tresult = libbfio_handle_free(\n\t\t &file_io_handle,\n\t\t &error );\n\n\t\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t\t \"result\",\n\t\t result,\n\t\t 1 );\n\n\t\tEVTX_TEST_ASSERT_IS_NULL(\n\t\t \"file_io_handle\",\n\t\t file_io_handle );\n\n\t\tEVTX_TEST_ASSERT_IS_NULL(\n\t\t \"error\",\n\t\t error );\n\t}\n\t/* Test check file signature with data too small\n\t */\n\tresult = evtx_test_open_file_io_handle(\n\t &file_io_handle,\n\t empty_block,\n\t sizeof( uint8_t ) * 1,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"file_io_handle\",\n\t file_io_handle );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\tresult = libevtx_check_file_signature_file_io_handle(\n\t file_io_handle,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"error\",\n\t error );\n\n\tlibcerror_error_free(\n\t &error );\n\n\tresult = evtx_test_close_file_io_handle(\n\t &file_io_handle,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 0 );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\t/* Test check file signature with empty block\n\t */\n\tresult = evtx_test_open_file_io_handle(\n\t &file_io_handle,\n\t empty_block,\n\t sizeof( uint8_t ) * 8192,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"file_io_handle\",\n\t file_io_handle );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\tresult = libevtx_check_file_signature_file_io_handle(\n\t file_io_handle,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 0 );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\tresult = evtx_test_close_file_io_handle(\n\t &file_io_handle,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 0 );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\treturn( 1 );\n\non_error:\n\tif( error != NULL )\n\t{\n\t\tlibcerror_error_free(\n\t\t &error );\n\t}\n\tif( file_io_handle != NULL )\n\t{\n\t\tlibbfio_handle_free(\n\t\t &file_io_handle,\n\t\t NULL );\n\t}\n\treturn( 0 );\n}\n\n/* The main program\n */\n#if defined( HAVE_WIDE_SYSTEM_CHARACTER )\nint wmain(\n int argc,\n wchar_t * const argv[] )\n#else\nint main(\n int argc,\n char * const argv[] )\n#endif\n{\n\tsystem_character_t *source = NULL;\n\tsystem_integer_t option = 0;\n\n\twhile( ( option = evtx_test_getopt(\n\t argc,\n\t argv,\n\t _SYSTEM_STRING( \"\" ) ) ) != (system_integer_t) -1 )\n\t{\n\t\tswitch( option )\n\t\t{\n\t\t\tcase (system_integer_t) '?':\n\t\t\tdefault:\n\t\t\t\tfprintf(\n\t\t\t\t stderr,\n\t\t\t\t \"Invalid argument: %\" PRIs_SYSTEM \".\\n\",\n\t\t\t\t argv[ optind - 1 ] );\n\n\t\t\t\treturn( EXIT_FAILURE );\n\t\t}\n\t}\n\tif( optind < argc )\n\t{\n\t\tsource = argv[ optind ];\n\t}\n\tEVTX_TEST_RUN(\n\t \"libevtx_get_version\",\n\t evtx_test_get_version );\n\n\tEVTX_TEST_RUN(\n\t \"libevtx_get_access_flags_read\",\n\t evtx_test_get_access_flags_read );\n\n\tEVTX_TEST_RUN(\n\t \"libevtx_get_codepage\",\n\t evtx_test_get_codepage );\n\n\tEVTX_TEST_RUN(\n\t \"libevtx_set_codepage\",\n\t evtx_test_set_codepage );\n\n#if !defined( __BORLANDC__ ) || ( __BORLANDC__ >= 0x0560 )\n\n\tEVTX_TEST_RUN_WITH_ARGS(\n\t \"libevtx_check_file_signature\",\n\t evtx_test_check_file_signature,\n\t source );\n\n#if defined( HAVE_WIDE_CHARACTER_TYPE )\n\n\tEVTX_TEST_RUN_WITH_ARGS(\n\t \"libevtx_check_file_signature_wide\",\n\t evtx_test_check_file_signature_wide,\n\t source );\n\n#endif /* defined( HAVE_WIDE_CHARACTER_TYPE ) */\n\n\tEVTX_TEST_RUN_WITH_ARGS(\n\t \"libevtx_check_file_signature_file_io_handle\",\n\t evtx_test_check_file_signature_file_io_handle,\n\t source );\n\n#endif /* !defined( __BORLANDC__ ) || ( __BORLANDC__ >= 0x0560 ) */\n\n\treturn( EXIT_SUCCESS );\n\non_error:\n\treturn( EXIT_FAILURE );\n}\n\n" }, { "path": "tests/evtx_test_template_definition.c", "content": "/*\n * Library template_definition type test program\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#include \n#include \n#include \n\n#if defined( HAVE_STDLIB_H ) || defined( WINAPI )\n#include \n#endif\n\n#include \"evtx_test_libcerror.h\"\n#include \"evtx_test_libevtx.h\"\n#include \"evtx_test_macros.h\"\n#include \"evtx_test_memory.h\"\n#include \"evtx_test_unused.h\"\n\n/* Tests the libevtx_template_definition_initialize function\n * Returns 1 if successful or 0 if not\n */\nint evtx_test_template_definition_initialize(\n void )\n{\n\tlibcerror_error_t *error = NULL;\n\tlibevtx_template_definition_t *template_definition = NULL;\n\tint result = 0;\n\n#if defined( HAVE_EVTX_TEST_MEMORY )\n\tint number_of_malloc_fail_tests = 1;\n\tint number_of_memset_fail_tests = 1;\n\tint test_number = 0;\n#endif\n\n\t/* Test regular cases\n\t */\n\tresult = libevtx_template_definition_initialize(\n\t &template_definition,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"template_definition\",\n\t template_definition );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\tresult = libevtx_template_definition_free(\n\t &template_definition,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 1 );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"template_definition\",\n\t template_definition );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\t/* Test error cases\n\t */\n\tresult = libevtx_template_definition_initialize(\n\t NULL,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"error\",\n\t error );\n\n\tlibcerror_error_free(\n\t &error );\n\n\ttemplate_definition = (libevtx_template_definition_t *) 0x12345678UL;\n\n\tresult = libevtx_template_definition_initialize(\n\t &template_definition,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"error\",\n\t error );\n\n\tlibcerror_error_free(\n\t &error );\n\n\ttemplate_definition = NULL;\n\n#if defined( HAVE_EVTX_TEST_MEMORY )\n\n\tfor( test_number = 0;\n\t test_number < number_of_malloc_fail_tests;\n\t test_number++ )\n\t{\n\t\t/* Test libevtx_template_definition_initialize with malloc failing\n\t\t */\n\t\tevtx_test_malloc_attempts_before_fail = test_number;\n\n\t\tresult = libevtx_template_definition_initialize(\n\t\t &template_definition,\n\t\t &error );\n\n\t\tif( evtx_test_malloc_attempts_before_fail != -1 )\n\t\t{\n\t\t\tevtx_test_malloc_attempts_before_fail = -1;\n\n\t\t\tif( template_definition != NULL )\n\t\t\t{\n\t\t\t\tlibevtx_template_definition_free(\n\t\t\t\t &template_definition,\n\t\t\t\t NULL );\n\t\t\t}\n\t\t}\n\t\telse\n\t\t{\n\t\t\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t\t\t \"result\",\n\t\t\t result,\n\t\t\t -1 );\n\n\t\t\tEVTX_TEST_ASSERT_IS_NULL(\n\t\t\t \"template_definition\",\n\t\t\t template_definition );\n\n\t\t\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t\t\t \"error\",\n\t\t\t error );\n\n\t\t\tlibcerror_error_free(\n\t\t\t &error );\n\t\t}\n\t}\n\tfor( test_number = 0;\n\t test_number < number_of_memset_fail_tests;\n\t test_number++ )\n\t{\n\t\t/* Test libevtx_template_definition_initialize with memset failing\n\t\t */\n\t\tevtx_test_memset_attempts_before_fail = test_number;\n\n\t\tresult = libevtx_template_definition_initialize(\n\t\t &template_definition,\n\t\t &error );\n\n\t\tif( evtx_test_memset_attempts_before_fail != -1 )\n\t\t{\n\t\t\tevtx_test_memset_attempts_before_fail = -1;\n\n\t\t\tif( template_definition != NULL )\n\t\t\t{\n\t\t\t\tlibevtx_template_definition_free(\n\t\t\t\t &template_definition,\n\t\t\t\t NULL );\n\t\t\t}\n\t\t}\n\t\telse\n\t\t{\n\t\t\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t\t\t \"result\",\n\t\t\t result,\n\t\t\t -1 );\n\n\t\t\tEVTX_TEST_ASSERT_IS_NULL(\n\t\t\t \"template_definition\",\n\t\t\t template_definition );\n\n\t\t\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t\t\t \"error\",\n\t\t\t error );\n\n\t\t\tlibcerror_error_free(\n\t\t\t &error );\n\t\t}\n\t}\n#endif /* defined( HAVE_EVTX_TEST_MEMORY ) */\n\n\treturn( 1 );\n\non_error:\n\tif( error != NULL )\n\t{\n\t\tlibcerror_error_free(\n\t\t &error );\n\t}\n\tif( template_definition != NULL )\n\t{\n\t\tlibevtx_template_definition_free(\n\t\t &template_definition,\n\t\t NULL );\n\t}\n\treturn( 0 );\n}\n\n/* Tests the libevtx_template_definition_free function\n * Returns 1 if successful or 0 if not\n */\nint evtx_test_template_definition_free(\n void )\n{\n\tlibcerror_error_t *error = NULL;\n\tint result = 0;\n\n\t/* Test error cases\n\t */\n\tresult = libevtx_template_definition_free(\n\t NULL,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"error\",\n\t error );\n\n\tlibcerror_error_free(\n\t &error );\n\n\treturn( 1 );\n\non_error:\n\tif( error != NULL )\n\t{\n\t\tlibcerror_error_free(\n\t\t &error );\n\t}\n\treturn( 0 );\n}\n\n/* The main program\n */\n#if defined( HAVE_WIDE_SYSTEM_CHARACTER )\nint wmain(\n int argc EVTX_TEST_ATTRIBUTE_UNUSED,\n wchar_t * const argv[] EVTX_TEST_ATTRIBUTE_UNUSED )\n#else\nint main(\n int argc EVTX_TEST_ATTRIBUTE_UNUSED,\n char * const argv[] EVTX_TEST_ATTRIBUTE_UNUSED )\n#endif\n{\n\tEVTX_TEST_UNREFERENCED_PARAMETER( argc )\n\tEVTX_TEST_UNREFERENCED_PARAMETER( argv )\n\n\tEVTX_TEST_RUN(\n\t \"libevtx_template_definition_initialize\",\n\t evtx_test_template_definition_initialize );\n\n\tEVTX_TEST_RUN(\n\t \"libevtx_template_definition_free\",\n\t evtx_test_template_definition_free );\n\n\t/* TODO: add tests for libevtx_template_definition_set_data */\n\n#if defined( __GNUC__ ) && !defined( LIBEVTX_DLL_IMPORT )\n\n\t/* TODO: add tests for libevtx_template_definition_read */\n\n#endif /* defined( __GNUC__ ) && !defined( LIBEVTX_DLL_IMPORT ) */\n\n\treturn( EXIT_SUCCESS );\n\non_error:\n\treturn( EXIT_FAILURE );\n}\n\n" }, { "path": "tests/evtx_test_tools_info_handle.c", "content": "/*\n * Tools info_handle type test program\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#include \n#include \n#include \n#include \n\n#if defined( HAVE_STDLIB_H ) || defined( WINAPI )\n#include \n#endif\n\n#include \"evtx_test_libcerror.h\"\n#include \"evtx_test_macros.h\"\n#include \"evtx_test_memory.h\"\n#include \"evtx_test_unused.h\"\n\n#include \"../evtxtools/info_handle.h\"\n\n/* Tests the info_handle_initialize function\n * Returns 1 if successful or 0 if not\n */\nint evtx_test_tools_info_handle_initialize(\n void )\n{\n\tinfo_handle_t *info_handle = NULL;\n\tlibcerror_error_t *error = NULL;\n\tint result = 0;\n\n#if defined( HAVE_EVTX_TEST_MEMORY )\n\tint number_of_malloc_fail_tests = 1;\n\tint number_of_memset_fail_tests = 1;\n\tint test_number = 0;\n#endif\n\n\t/* Test regular cases\n\t */\n\tresult = info_handle_initialize(\n\t &info_handle,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"info_handle\",\n\t info_handle );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\tresult = info_handle_free(\n\t &info_handle,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 1 );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"info_handle\",\n\t info_handle );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\t/* Test error cases\n\t */\n\tresult = info_handle_initialize(\n\t NULL,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"error\",\n\t error );\n\n\tlibcerror_error_free(\n\t &error );\n\n\tinfo_handle = (info_handle_t *) 0x12345678UL;\n\n\tresult = info_handle_initialize(\n\t &info_handle,\n\t &error );\n\n\tinfo_handle = NULL;\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"error\",\n\t error );\n\n\tlibcerror_error_free(\n\t &error );\n\n#if defined( HAVE_EVTX_TEST_MEMORY )\n\n\tfor( test_number = 0;\n\t test_number < number_of_malloc_fail_tests;\n\t test_number++ )\n\t{\n\t\t/* Test info_handle_initialize with malloc failing\n\t\t */\n\t\tevtx_test_malloc_attempts_before_fail = test_number;\n\n\t\tresult = info_handle_initialize(\n\t\t &info_handle,\n\t\t &error );\n\n\t\tif( evtx_test_malloc_attempts_before_fail != -1 )\n\t\t{\n\t\t\tevtx_test_malloc_attempts_before_fail = -1;\n\n\t\t\tif( info_handle != NULL )\n\t\t\t{\n\t\t\t\tinfo_handle_free(\n\t\t\t\t &info_handle,\n\t\t\t\t NULL );\n\t\t\t}\n\t\t}\n\t\telse\n\t\t{\n\t\t\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t\t\t \"result\",\n\t\t\t result,\n\t\t\t -1 );\n\n\t\t\tEVTX_TEST_ASSERT_IS_NULL(\n\t\t\t \"info_handle\",\n\t\t\t info_handle );\n\n\t\t\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t\t\t \"error\",\n\t\t\t error );\n\n\t\t\tlibcerror_error_free(\n\t\t\t &error );\n\t\t}\n\t}\n\tfor( test_number = 0;\n\t test_number < number_of_memset_fail_tests;\n\t test_number++ )\n\t{\n\t\t/* Test info_handle_initialize with memset failing\n\t\t */\n\t\tevtx_test_memset_attempts_before_fail = test_number;\n\n\t\tresult = info_handle_initialize(\n\t\t &info_handle,\n\t\t &error );\n\n\t\tif( evtx_test_memset_attempts_before_fail != -1 )\n\t\t{\n\t\t\tevtx_test_memset_attempts_before_fail = -1;\n\n\t\t\tif( info_handle != NULL )\n\t\t\t{\n\t\t\t\tinfo_handle_free(\n\t\t\t\t &info_handle,\n\t\t\t\t NULL );\n\t\t\t}\n\t\t}\n\t\telse\n\t\t{\n\t\t\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t\t\t \"result\",\n\t\t\t result,\n\t\t\t -1 );\n\n\t\t\tEVTX_TEST_ASSERT_IS_NULL(\n\t\t\t \"info_handle\",\n\t\t\t info_handle );\n\n\t\t\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t\t\t \"error\",\n\t\t\t error );\n\n\t\t\tlibcerror_error_free(\n\t\t\t &error );\n\t\t}\n\t}\n#endif /* defined( HAVE_EVTX_TEST_MEMORY ) */\n\n\treturn( 1 );\n\non_error:\n\tif( error != NULL )\n\t{\n\t\tlibcerror_error_free(\n\t\t &error );\n\t}\n\tif( info_handle != NULL )\n\t{\n\t\tinfo_handle_free(\n\t\t &info_handle,\n\t\t NULL );\n\t}\n\treturn( 0 );\n}\n\n/* Tests the info_handle_free function\n * Returns 1 if successful or 0 if not\n */\nint evtx_test_tools_info_handle_free(\n void )\n{\n\tlibcerror_error_t *error = NULL;\n\tint result = 0;\n\n\t/* Test error cases\n\t */\n\tresult = info_handle_free(\n\t NULL,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"error\",\n\t error );\n\n\tlibcerror_error_free(\n\t &error );\n\n\treturn( 1 );\n\non_error:\n\tif( error != NULL )\n\t{\n\t\tlibcerror_error_free(\n\t\t &error );\n\t}\n\treturn( 0 );\n}\n\n/* The main program\n */\n#if defined( HAVE_WIDE_SYSTEM_CHARACTER )\nint wmain(\n int argc EVTX_TEST_ATTRIBUTE_UNUSED,\n wchar_t * const argv[] EVTX_TEST_ATTRIBUTE_UNUSED )\n#else\nint main(\n int argc EVTX_TEST_ATTRIBUTE_UNUSED,\n char * const argv[] EVTX_TEST_ATTRIBUTE_UNUSED )\n#endif\n{\n\tEVTX_TEST_UNREFERENCED_PARAMETER( argc )\n\tEVTX_TEST_UNREFERENCED_PARAMETER( argv )\n\n\tEVTX_TEST_RUN(\n\t \"info_handle_initialize\",\n\t evtx_test_tools_info_handle_initialize );\n\n\tEVTX_TEST_RUN(\n\t \"info_handle_free\",\n\t evtx_test_tools_info_handle_free );\n\n\treturn( EXIT_SUCCESS );\n\non_error:\n\treturn( EXIT_FAILURE );\n}\n\n" }, { "path": "tests/evtx_test_tools_message_handle.c", "content": "/*\n * Tools message_handle type test program\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#include \n#include \n#include \n#include \n\n#if defined( HAVE_STDLIB_H ) || defined( WINAPI )\n#include \n#endif\n\n#include \"evtx_test_libcerror.h\"\n#include \"evtx_test_macros.h\"\n#include \"evtx_test_memory.h\"\n#include \"evtx_test_unused.h\"\n\n#include \"../evtxtools/message_handle.h\"\n\n/* Tests the message_handle_initialize function\n * Returns 1 if successful or 0 if not\n */\nint evtx_test_tools_message_handle_initialize(\n void )\n{\n\tlibcerror_error_t *error = NULL;\n\tmessage_handle_t *message_handle = NULL;\n\tint result = 0;\n\n#if defined( HAVE_EVTX_TEST_MEMORY )\n\tint number_of_malloc_fail_tests = 1;\n\tint number_of_memset_fail_tests = 1;\n\tint test_number = 0;\n#endif\n\n\t/* Test regular cases\n\t */\n\tresult = message_handle_initialize(\n\t &message_handle,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"message_handle\",\n\t message_handle );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\tresult = message_handle_free(\n\t &message_handle,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 1 );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"message_handle\",\n\t message_handle );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\t/* Test error cases\n\t */\n\tresult = message_handle_initialize(\n\t NULL,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"error\",\n\t error );\n\n\tlibcerror_error_free(\n\t &error );\n\n\tmessage_handle = (message_handle_t *) 0x12345678UL;\n\n\tresult = message_handle_initialize(\n\t &message_handle,\n\t &error );\n\n\tmessage_handle = NULL;\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"error\",\n\t error );\n\n\tlibcerror_error_free(\n\t &error );\n\n#if defined( HAVE_EVTX_TEST_MEMORY )\n\n\tfor( test_number = 0;\n\t test_number < number_of_malloc_fail_tests;\n\t test_number++ )\n\t{\n\t\t/* Test message_handle_initialize with malloc failing\n\t\t */\n\t\tevtx_test_malloc_attempts_before_fail = test_number;\n\n\t\tresult = message_handle_initialize(\n\t\t &message_handle,\n\t\t &error );\n\n\t\tif( evtx_test_malloc_attempts_before_fail != -1 )\n\t\t{\n\t\t\tevtx_test_malloc_attempts_before_fail = -1;\n\n\t\t\tif( message_handle != NULL )\n\t\t\t{\n\t\t\t\tmessage_handle_free(\n\t\t\t\t &message_handle,\n\t\t\t\t NULL );\n\t\t\t}\n\t\t}\n\t\telse\n\t\t{\n\t\t\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t\t\t \"result\",\n\t\t\t result,\n\t\t\t -1 );\n\n\t\t\tEVTX_TEST_ASSERT_IS_NULL(\n\t\t\t \"message_handle\",\n\t\t\t message_handle );\n\n\t\t\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t\t\t \"error\",\n\t\t\t error );\n\n\t\t\tlibcerror_error_free(\n\t\t\t &error );\n\t\t}\n\t}\n\tfor( test_number = 0;\n\t test_number < number_of_memset_fail_tests;\n\t test_number++ )\n\t{\n\t\t/* Test message_handle_initialize with memset failing\n\t\t */\n\t\tevtx_test_memset_attempts_before_fail = test_number;\n\n\t\tresult = message_handle_initialize(\n\t\t &message_handle,\n\t\t &error );\n\n\t\tif( evtx_test_memset_attempts_before_fail != -1 )\n\t\t{\n\t\t\tevtx_test_memset_attempts_before_fail = -1;\n\n\t\t\tif( message_handle != NULL )\n\t\t\t{\n\t\t\t\tmessage_handle_free(\n\t\t\t\t &message_handle,\n\t\t\t\t NULL );\n\t\t\t}\n\t\t}\n\t\telse\n\t\t{\n\t\t\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t\t\t \"result\",\n\t\t\t result,\n\t\t\t -1 );\n\n\t\t\tEVTX_TEST_ASSERT_IS_NULL(\n\t\t\t \"message_handle\",\n\t\t\t message_handle );\n\n\t\t\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t\t\t \"error\",\n\t\t\t error );\n\n\t\t\tlibcerror_error_free(\n\t\t\t &error );\n\t\t}\n\t}\n#endif /* defined( HAVE_EVTX_TEST_MEMORY ) */\n\n\treturn( 1 );\n\non_error:\n\tif( error != NULL )\n\t{\n\t\tlibcerror_error_free(\n\t\t &error );\n\t}\n\tif( message_handle != NULL )\n\t{\n\t\tmessage_handle_free(\n\t\t &message_handle,\n\t\t NULL );\n\t}\n\treturn( 0 );\n}\n\n/* Tests the message_handle_free function\n * Returns 1 if successful or 0 if not\n */\nint evtx_test_tools_message_handle_free(\n void )\n{\n\tlibcerror_error_t *error = NULL;\n\tint result = 0;\n\n\t/* Test error cases\n\t */\n\tresult = message_handle_free(\n\t NULL,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"error\",\n\t error );\n\n\tlibcerror_error_free(\n\t &error );\n\n\treturn( 1 );\n\non_error:\n\tif( error != NULL )\n\t{\n\t\tlibcerror_error_free(\n\t\t &error );\n\t}\n\treturn( 0 );\n}\n\n/* The main program\n */\n#if defined( HAVE_WIDE_SYSTEM_CHARACTER )\nint wmain(\n int argc EVTX_TEST_ATTRIBUTE_UNUSED,\n wchar_t * const argv[] EVTX_TEST_ATTRIBUTE_UNUSED )\n#else\nint main(\n int argc EVTX_TEST_ATTRIBUTE_UNUSED,\n char * const argv[] EVTX_TEST_ATTRIBUTE_UNUSED )\n#endif\n{\n\tEVTX_TEST_UNREFERENCED_PARAMETER( argc )\n\tEVTX_TEST_UNREFERENCED_PARAMETER( argv )\n\n\tEVTX_TEST_RUN(\n\t \"message_handle_initialize\",\n\t evtx_test_tools_message_handle_initialize );\n\n\tEVTX_TEST_RUN(\n\t \"message_handle_free\",\n\t evtx_test_tools_message_handle_free );\n\n\treturn( EXIT_SUCCESS );\n\non_error:\n\treturn( EXIT_FAILURE );\n}\n\n" }, { "path": "tests/evtx_test_tools_message_string.c", "content": "/*\n * Tools message_string type test program\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#include \n#include \n#include \n#include \n\n#if defined( HAVE_STDLIB_H ) || defined( WINAPI )\n#include \n#endif\n\n#include \"evtx_test_libcerror.h\"\n#include \"evtx_test_macros.h\"\n#include \"evtx_test_memory.h\"\n#include \"evtx_test_unused.h\"\n\n#include \"../evtxtools/message_string.h\"\n\n/* Tests the message_string_initialize function\n * Returns 1 if successful or 0 if not\n */\nint evtx_test_tools_message_string_initialize(\n void )\n{\n\tlibcerror_error_t *error = NULL;\n\tmessage_string_t *message_string = NULL;\n\tint result = 0;\n\n#if defined( HAVE_EVTX_TEST_MEMORY )\n\tint number_of_malloc_fail_tests = 1;\n\tint number_of_memset_fail_tests = 1;\n\tint test_number = 0;\n#endif\n\n\t/* Test regular cases\n\t */\n\tresult = message_string_initialize(\n\t &message_string,\n\t 1,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"message_string\",\n\t message_string );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\tresult = message_string_free(\n\t &message_string,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 1 );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"message_string\",\n\t message_string );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\t/* Test error cases\n\t */\n\tresult = message_string_initialize(\n\t NULL,\n\t 1,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"error\",\n\t error );\n\n\tlibcerror_error_free(\n\t &error );\n\n\tmessage_string = (message_string_t *) 0x12345678UL;\n\n\tresult = message_string_initialize(\n\t &message_string,\n\t 1,\n\t &error );\n\n\tmessage_string = NULL;\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"error\",\n\t error );\n\n\tlibcerror_error_free(\n\t &error );\n\n#if defined( HAVE_EVTX_TEST_MEMORY )\n\n\tfor( test_number = 0;\n\t test_number < number_of_malloc_fail_tests;\n\t test_number++ )\n\t{\n\t\t/* Test message_string_initialize with malloc failing\n\t\t */\n\t\tevtx_test_malloc_attempts_before_fail = test_number;\n\n\t\tresult = message_string_initialize(\n\t\t &message_string,\n\t\t 1,\n\t\t &error );\n\n\t\tif( evtx_test_malloc_attempts_before_fail != -1 )\n\t\t{\n\t\t\tevtx_test_malloc_attempts_before_fail = -1;\n\n\t\t\tif( message_string != NULL )\n\t\t\t{\n\t\t\t\tmessage_string_free(\n\t\t\t\t &message_string,\n\t\t\t\t NULL );\n\t\t\t}\n\t\t}\n\t\telse\n\t\t{\n\t\t\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t\t\t \"result\",\n\t\t\t result,\n\t\t\t -1 );\n\n\t\t\tEVTX_TEST_ASSERT_IS_NULL(\n\t\t\t \"message_string\",\n\t\t\t message_string );\n\n\t\t\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t\t\t \"error\",\n\t\t\t error );\n\n\t\t\tlibcerror_error_free(\n\t\t\t &error );\n\t\t}\n\t}\n\tfor( test_number = 0;\n\t test_number < number_of_memset_fail_tests;\n\t test_number++ )\n\t{\n\t\t/* Test message_string_initialize with memset failing\n\t\t */\n\t\tevtx_test_memset_attempts_before_fail = test_number;\n\n\t\tresult = message_string_initialize(\n\t\t &message_string,\n\t\t 1,\n\t\t &error );\n\n\t\tif( evtx_test_memset_attempts_before_fail != -1 )\n\t\t{\n\t\t\tevtx_test_memset_attempts_before_fail = -1;\n\n\t\t\tif( message_string != NULL )\n\t\t\t{\n\t\t\t\tmessage_string_free(\n\t\t\t\t &message_string,\n\t\t\t\t NULL );\n\t\t\t}\n\t\t}\n\t\telse\n\t\t{\n\t\t\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t\t\t \"result\",\n\t\t\t result,\n\t\t\t -1 );\n\n\t\t\tEVTX_TEST_ASSERT_IS_NULL(\n\t\t\t \"message_string\",\n\t\t\t message_string );\n\n\t\t\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t\t\t \"error\",\n\t\t\t error );\n\n\t\t\tlibcerror_error_free(\n\t\t\t &error );\n\t\t}\n\t}\n#endif /* defined( HAVE_EVTX_TEST_MEMORY ) */\n\n\treturn( 1 );\n\non_error:\n\tif( error != NULL )\n\t{\n\t\tlibcerror_error_free(\n\t\t &error );\n\t}\n\tif( message_string != NULL )\n\t{\n\t\tmessage_string_free(\n\t\t &message_string,\n\t\t NULL );\n\t}\n\treturn( 0 );\n}\n\n/* Tests the message_string_free function\n * Returns 1 if successful or 0 if not\n */\nint evtx_test_tools_message_string_free(\n void )\n{\n\tlibcerror_error_t *error = NULL;\n\tint result = 0;\n\n\t/* Test error cases\n\t */\n\tresult = message_string_free(\n\t NULL,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"error\",\n\t error );\n\n\tlibcerror_error_free(\n\t &error );\n\n\treturn( 1 );\n\non_error:\n\tif( error != NULL )\n\t{\n\t\tlibcerror_error_free(\n\t\t &error );\n\t}\n\treturn( 0 );\n}\n\n/* The main program\n */\n#if defined( HAVE_WIDE_SYSTEM_CHARACTER )\nint wmain(\n int argc EVTX_TEST_ATTRIBUTE_UNUSED,\n wchar_t * const argv[] EVTX_TEST_ATTRIBUTE_UNUSED )\n#else\nint main(\n int argc EVTX_TEST_ATTRIBUTE_UNUSED,\n char * const argv[] EVTX_TEST_ATTRIBUTE_UNUSED )\n#endif\n{\n\tEVTX_TEST_UNREFERENCED_PARAMETER( argc )\n\tEVTX_TEST_UNREFERENCED_PARAMETER( argv )\n\n\tEVTX_TEST_RUN(\n\t \"message_string_initialize\",\n\t evtx_test_tools_message_string_initialize );\n\n\tEVTX_TEST_RUN(\n\t \"message_string_free\",\n\t evtx_test_tools_message_string_free );\n\n\treturn( EXIT_SUCCESS );\n\non_error:\n\treturn( EXIT_FAILURE );\n}\n\n" }, { "path": "tests/evtx_test_tools_output.c", "content": "/*\n * Tools output functions test program\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#include \n#include \n#include \n\n#include \n\n#if defined( HAVE_IO_H ) || defined( WINAPI )\n#include \n#endif\n\n#if defined( HAVE_STDLIB_H ) || defined( WINAPI )\n#include \n#endif\n\n#include \"evtx_test_libcerror.h\"\n#include \"evtx_test_macros.h\"\n#include \"evtx_test_unused.h\"\n\n#include \"../evtxtools/evtxtools_output.h\"\n\n/* Tests the evtxtools_output_initialize function\n * Returns 1 if successful or 0 if not\n */\nint evtx_test_tools_output_initialize(\n void )\n{\n\tlibcerror_error_t *error = NULL;\n\tint result = 0;\n\n\tresult = evtxtools_output_initialize(\n\t _IONBF,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 1 );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\treturn( 1 );\n\non_error:\n\tif( error != NULL )\n\t{\n\t\tlibcerror_error_free(\n\t\t &error );\n\t}\n\treturn( 0 );\n}\n\n/* The main program\n */\n#if defined( HAVE_WIDE_SYSTEM_CHARACTER )\nint wmain(\n int argc EVTX_TEST_ATTRIBUTE_UNUSED,\n wchar_t * const argv[] EVTX_TEST_ATTRIBUTE_UNUSED )\n#else\nint main(\n int argc EVTX_TEST_ATTRIBUTE_UNUSED,\n char * const argv[] EVTX_TEST_ATTRIBUTE_UNUSED )\n#endif\n{\n\tEVTX_TEST_UNREFERENCED_PARAMETER( argc )\n\tEVTX_TEST_UNREFERENCED_PARAMETER( argv )\n\n\tEVTX_TEST_RUN(\n\t \"evtxtools_output_initialize\",\n\t evtx_test_tools_output_initialize )\n\n\t/* TODO add tests for evtxtools_output_copyright_fprint */\n\n\t/* TODO add tests for evtxtools_output_version_fprint */\n\n\t/* TODO add tests for evtxtools_output_version_detailed_fprint */\n\n\treturn( EXIT_SUCCESS );\n\non_error:\n\treturn( EXIT_FAILURE );\n}\n\n" }, { "path": "tests/evtx_test_tools_path_handle.c", "content": "/*\n * Tools path_handle type test program\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#include \n#include \n#include \n#include \n\n#if defined( HAVE_STDLIB_H ) || defined( WINAPI )\n#include \n#endif\n\n#include \"evtx_test_libcerror.h\"\n#include \"evtx_test_macros.h\"\n#include \"evtx_test_memory.h\"\n#include \"evtx_test_unused.h\"\n\n#include \"../evtxtools/path_handle.h\"\n\n/* Tests the path_handle_initialize function\n * Returns 1 if successful or 0 if not\n */\nint evtx_test_tools_path_handle_initialize(\n void )\n{\n\tlibcerror_error_t *error = NULL;\n\tpath_handle_t *path_handle = NULL;\n\tint result = 0;\n\n#if defined( HAVE_EVTX_TEST_MEMORY )\n\tint number_of_malloc_fail_tests = 1;\n\tint number_of_memset_fail_tests = 1;\n\tint test_number = 0;\n#endif\n\n\t/* Test regular cases\n\t */\n\tresult = path_handle_initialize(\n\t &path_handle,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"path_handle\",\n\t path_handle );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\tresult = path_handle_free(\n\t &path_handle,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 1 );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"path_handle\",\n\t path_handle );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\t/* Test error cases\n\t */\n\tresult = path_handle_initialize(\n\t NULL,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"error\",\n\t error );\n\n\tlibcerror_error_free(\n\t &error );\n\n\tpath_handle = (path_handle_t *) 0x12345678UL;\n\n\tresult = path_handle_initialize(\n\t &path_handle,\n\t &error );\n\n\tpath_handle = NULL;\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"error\",\n\t error );\n\n\tlibcerror_error_free(\n\t &error );\n\n#if defined( HAVE_EVTX_TEST_MEMORY )\n\n\tfor( test_number = 0;\n\t test_number < number_of_malloc_fail_tests;\n\t test_number++ )\n\t{\n\t\t/* Test path_handle_initialize with malloc failing\n\t\t */\n\t\tevtx_test_malloc_attempts_before_fail = test_number;\n\n\t\tresult = path_handle_initialize(\n\t\t &path_handle,\n\t\t &error );\n\n\t\tif( evtx_test_malloc_attempts_before_fail != -1 )\n\t\t{\n\t\t\tevtx_test_malloc_attempts_before_fail = -1;\n\n\t\t\tif( path_handle != NULL )\n\t\t\t{\n\t\t\t\tpath_handle_free(\n\t\t\t\t &path_handle,\n\t\t\t\t NULL );\n\t\t\t}\n\t\t}\n\t\telse\n\t\t{\n\t\t\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t\t\t \"result\",\n\t\t\t result,\n\t\t\t -1 );\n\n\t\t\tEVTX_TEST_ASSERT_IS_NULL(\n\t\t\t \"path_handle\",\n\t\t\t path_handle );\n\n\t\t\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t\t\t \"error\",\n\t\t\t error );\n\n\t\t\tlibcerror_error_free(\n\t\t\t &error );\n\t\t}\n\t}\n\tfor( test_number = 0;\n\t test_number < number_of_memset_fail_tests;\n\t test_number++ )\n\t{\n\t\t/* Test path_handle_initialize with memset failing\n\t\t */\n\t\tevtx_test_memset_attempts_before_fail = test_number;\n\n\t\tresult = path_handle_initialize(\n\t\t &path_handle,\n\t\t &error );\n\n\t\tif( evtx_test_memset_attempts_before_fail != -1 )\n\t\t{\n\t\t\tevtx_test_memset_attempts_before_fail = -1;\n\n\t\t\tif( path_handle != NULL )\n\t\t\t{\n\t\t\t\tpath_handle_free(\n\t\t\t\t &path_handle,\n\t\t\t\t NULL );\n\t\t\t}\n\t\t}\n\t\telse\n\t\t{\n\t\t\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t\t\t \"result\",\n\t\t\t result,\n\t\t\t -1 );\n\n\t\t\tEVTX_TEST_ASSERT_IS_NULL(\n\t\t\t \"path_handle\",\n\t\t\t path_handle );\n\n\t\t\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t\t\t \"error\",\n\t\t\t error );\n\n\t\t\tlibcerror_error_free(\n\t\t\t &error );\n\t\t}\n\t}\n#endif /* defined( HAVE_EVTX_TEST_MEMORY ) */\n\n\treturn( 1 );\n\non_error:\n\tif( error != NULL )\n\t{\n\t\tlibcerror_error_free(\n\t\t &error );\n\t}\n\tif( path_handle != NULL )\n\t{\n\t\tpath_handle_free(\n\t\t &path_handle,\n\t\t NULL );\n\t}\n\treturn( 0 );\n}\n\n/* Tests the path_handle_free function\n * Returns 1 if successful or 0 if not\n */\nint evtx_test_tools_path_handle_free(\n void )\n{\n\tlibcerror_error_t *error = NULL;\n\tint result = 0;\n\n\t/* Test error cases\n\t */\n\tresult = path_handle_free(\n\t NULL,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"error\",\n\t error );\n\n\tlibcerror_error_free(\n\t &error );\n\n\treturn( 1 );\n\non_error:\n\tif( error != NULL )\n\t{\n\t\tlibcerror_error_free(\n\t\t &error );\n\t}\n\treturn( 0 );\n}\n\n/* The main program\n */\n#if defined( HAVE_WIDE_SYSTEM_CHARACTER )\nint wmain(\n int argc EVTX_TEST_ATTRIBUTE_UNUSED,\n wchar_t * const argv[] EVTX_TEST_ATTRIBUTE_UNUSED )\n#else\nint main(\n int argc EVTX_TEST_ATTRIBUTE_UNUSED,\n char * const argv[] EVTX_TEST_ATTRIBUTE_UNUSED )\n#endif\n{\n\tEVTX_TEST_UNREFERENCED_PARAMETER( argc )\n\tEVTX_TEST_UNREFERENCED_PARAMETER( argv )\n\n\tEVTX_TEST_RUN(\n\t \"path_handle_initialize\",\n\t evtx_test_tools_path_handle_initialize );\n\n\tEVTX_TEST_RUN(\n\t \"path_handle_free\",\n\t evtx_test_tools_path_handle_free );\n\n\treturn( EXIT_SUCCESS );\n\non_error:\n\treturn( EXIT_FAILURE );\n}\n\n" }, { "path": "tests/evtx_test_tools_registry_file.c", "content": "/*\n * Tools registry_file type test program\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#include \n#include \n#include \n#include \n\n#if defined( HAVE_STDLIB_H ) || defined( WINAPI )\n#include \n#endif\n\n#include \"evtx_test_libcerror.h\"\n#include \"evtx_test_macros.h\"\n#include \"evtx_test_memory.h\"\n#include \"evtx_test_unused.h\"\n\n#include \"../evtxtools/registry_file.h\"\n\n/* Tests the registry_file_initialize function\n * Returns 1 if successful or 0 if not\n */\nint evtx_test_tools_registry_file_initialize(\n void )\n{\n\tlibcerror_error_t *error = NULL;\n\tregistry_file_t *registry_file = NULL;\n\tint result = 0;\n\n#if defined( HAVE_EVTX_TEST_MEMORY )\n\tint number_of_malloc_fail_tests = 1;\n\tint number_of_memset_fail_tests = 1;\n\tint test_number = 0;\n#endif\n\n\t/* Test regular cases\n\t */\n\tresult = registry_file_initialize(\n\t ®istry_file,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"registry_file\",\n\t registry_file );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\tresult = registry_file_free(\n\t ®istry_file,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 1 );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"registry_file\",\n\t registry_file );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\t/* Test error cases\n\t */\n\tresult = registry_file_initialize(\n\t NULL,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"error\",\n\t error );\n\n\tlibcerror_error_free(\n\t &error );\n\n\tregistry_file = (registry_file_t *) 0x12345678UL;\n\n\tresult = registry_file_initialize(\n\t ®istry_file,\n\t &error );\n\n\tregistry_file = NULL;\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"error\",\n\t error );\n\n\tlibcerror_error_free(\n\t &error );\n\n#if defined( HAVE_EVTX_TEST_MEMORY )\n\n\tfor( test_number = 0;\n\t test_number < number_of_malloc_fail_tests;\n\t test_number++ )\n\t{\n\t\t/* Test registry_file_initialize with malloc failing\n\t\t */\n\t\tevtx_test_malloc_attempts_before_fail = test_number;\n\n\t\tresult = registry_file_initialize(\n\t\t ®istry_file,\n\t\t &error );\n\n\t\tif( evtx_test_malloc_attempts_before_fail != -1 )\n\t\t{\n\t\t\tevtx_test_malloc_attempts_before_fail = -1;\n\n\t\t\tif( registry_file != NULL )\n\t\t\t{\n\t\t\t\tregistry_file_free(\n\t\t\t\t ®istry_file,\n\t\t\t\t NULL );\n\t\t\t}\n\t\t}\n\t\telse\n\t\t{\n\t\t\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t\t\t \"result\",\n\t\t\t result,\n\t\t\t -1 );\n\n\t\t\tEVTX_TEST_ASSERT_IS_NULL(\n\t\t\t \"registry_file\",\n\t\t\t registry_file );\n\n\t\t\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t\t\t \"error\",\n\t\t\t error );\n\n\t\t\tlibcerror_error_free(\n\t\t\t &error );\n\t\t}\n\t}\n\tfor( test_number = 0;\n\t test_number < number_of_memset_fail_tests;\n\t test_number++ )\n\t{\n\t\t/* Test registry_file_initialize with memset failing\n\t\t */\n\t\tevtx_test_memset_attempts_before_fail = test_number;\n\n\t\tresult = registry_file_initialize(\n\t\t ®istry_file,\n\t\t &error );\n\n\t\tif( evtx_test_memset_attempts_before_fail != -1 )\n\t\t{\n\t\t\tevtx_test_memset_attempts_before_fail = -1;\n\n\t\t\tif( registry_file != NULL )\n\t\t\t{\n\t\t\t\tregistry_file_free(\n\t\t\t\t ®istry_file,\n\t\t\t\t NULL );\n\t\t\t}\n\t\t}\n\t\telse\n\t\t{\n\t\t\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t\t\t \"result\",\n\t\t\t result,\n\t\t\t -1 );\n\n\t\t\tEVTX_TEST_ASSERT_IS_NULL(\n\t\t\t \"registry_file\",\n\t\t\t registry_file );\n\n\t\t\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t\t\t \"error\",\n\t\t\t error );\n\n\t\t\tlibcerror_error_free(\n\t\t\t &error );\n\t\t}\n\t}\n#endif /* defined( HAVE_EVTX_TEST_MEMORY ) */\n\n\treturn( 1 );\n\non_error:\n\tif( error != NULL )\n\t{\n\t\tlibcerror_error_free(\n\t\t &error );\n\t}\n\tif( registry_file != NULL )\n\t{\n\t\tregistry_file_free(\n\t\t ®istry_file,\n\t\t NULL );\n\t}\n\treturn( 0 );\n}\n\n/* Tests the registry_file_free function\n * Returns 1 if successful or 0 if not\n */\nint evtx_test_tools_registry_file_free(\n void )\n{\n\tlibcerror_error_t *error = NULL;\n\tint result = 0;\n\n\t/* Test error cases\n\t */\n\tresult = registry_file_free(\n\t NULL,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"error\",\n\t error );\n\n\tlibcerror_error_free(\n\t &error );\n\n\treturn( 1 );\n\non_error:\n\tif( error != NULL )\n\t{\n\t\tlibcerror_error_free(\n\t\t &error );\n\t}\n\treturn( 0 );\n}\n\n/* The main program\n */\n#if defined( HAVE_WIDE_SYSTEM_CHARACTER )\nint wmain(\n int argc EVTX_TEST_ATTRIBUTE_UNUSED,\n wchar_t * const argv[] EVTX_TEST_ATTRIBUTE_UNUSED )\n#else\nint main(\n int argc EVTX_TEST_ATTRIBUTE_UNUSED,\n char * const argv[] EVTX_TEST_ATTRIBUTE_UNUSED )\n#endif\n{\n\tEVTX_TEST_UNREFERENCED_PARAMETER( argc )\n\tEVTX_TEST_UNREFERENCED_PARAMETER( argv )\n\n\tEVTX_TEST_RUN(\n\t \"registry_file_initialize\",\n\t evtx_test_tools_registry_file_initialize );\n\n\tEVTX_TEST_RUN(\n\t \"registry_file_free\",\n\t evtx_test_tools_registry_file_free );\n\n\treturn( EXIT_SUCCESS );\n\non_error:\n\treturn( EXIT_FAILURE );\n}\n\n" }, { "path": "tests/evtx_test_tools_resource_file.c", "content": "/*\n * Tools resource_file type test program\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#include \n#include \n#include \n#include \n\n#if defined( HAVE_STDLIB_H ) || defined( WINAPI )\n#include \n#endif\n\n#include \"evtx_test_libcerror.h\"\n#include \"evtx_test_macros.h\"\n#include \"evtx_test_memory.h\"\n#include \"evtx_test_unused.h\"\n\n#include \"../evtxtools/resource_file.h\"\n\n/* Tests the resource_file_initialize function\n * Returns 1 if successful or 0 if not\n */\nint evtx_test_tools_resource_file_initialize(\n void )\n{\n\tlibcerror_error_t *error = NULL;\n\tresource_file_t *resource_file = NULL;\n\tint result = 0;\n\n#if defined( HAVE_EVTX_TEST_MEMORY )\n\tint number_of_malloc_fail_tests = 1;\n\tint number_of_memset_fail_tests = 1;\n\tint test_number = 0;\n#endif\n\n\t/* Test regular cases\n\t */\n\tresult = resource_file_initialize(\n\t &resource_file,\n\t 0x00000409UL,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"resource_file\",\n\t resource_file );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\tresult = resource_file_free(\n\t &resource_file,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 1 );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"resource_file\",\n\t resource_file );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\t/* Test error cases\n\t */\n\tresult = resource_file_initialize(\n\t NULL,\n\t 0x00000409UL,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"error\",\n\t error );\n\n\tlibcerror_error_free(\n\t &error );\n\n\tresource_file = (resource_file_t *) 0x12345678UL;\n\n\tresult = resource_file_initialize(\n\t &resource_file,\n\t 0x00000409UL,\n\t &error );\n\n\tresource_file = NULL;\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"error\",\n\t error );\n\n\tlibcerror_error_free(\n\t &error );\n\n#if defined( HAVE_EVTX_TEST_MEMORY )\n\n\tfor( test_number = 0;\n\t test_number < number_of_malloc_fail_tests;\n\t test_number++ )\n\t{\n\t\t/* Test resource_file_initialize with malloc failing\n\t\t */\n\t\tevtx_test_malloc_attempts_before_fail = test_number;\n\n\t\tresult = resource_file_initialize(\n\t\t &resource_file,\n\t\t 0x00000409UL,\n\t\t &error );\n\n\t\tif( evtx_test_malloc_attempts_before_fail != -1 )\n\t\t{\n\t\t\tevtx_test_malloc_attempts_before_fail = -1;\n\n\t\t\tif( resource_file != NULL )\n\t\t\t{\n\t\t\t\tresource_file_free(\n\t\t\t\t &resource_file,\n\t\t\t\t NULL );\n\t\t\t}\n\t\t}\n\t\telse\n\t\t{\n\t\t\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t\t\t \"result\",\n\t\t\t result,\n\t\t\t -1 );\n\n\t\t\tEVTX_TEST_ASSERT_IS_NULL(\n\t\t\t \"resource_file\",\n\t\t\t resource_file );\n\n\t\t\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t\t\t \"error\",\n\t\t\t error );\n\n\t\t\tlibcerror_error_free(\n\t\t\t &error );\n\t\t}\n\t}\n\tfor( test_number = 0;\n\t test_number < number_of_memset_fail_tests;\n\t test_number++ )\n\t{\n\t\t/* Test resource_file_initialize with memset failing\n\t\t */\n\t\tevtx_test_memset_attempts_before_fail = test_number;\n\n\t\tresult = resource_file_initialize(\n\t\t &resource_file,\n\t\t 0x00000409UL,\n\t\t &error );\n\n\t\tif( evtx_test_memset_attempts_before_fail != -1 )\n\t\t{\n\t\t\tevtx_test_memset_attempts_before_fail = -1;\n\n\t\t\tif( resource_file != NULL )\n\t\t\t{\n\t\t\t\tresource_file_free(\n\t\t\t\t &resource_file,\n\t\t\t\t NULL );\n\t\t\t}\n\t\t}\n\t\telse\n\t\t{\n\t\t\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t\t\t \"result\",\n\t\t\t result,\n\t\t\t -1 );\n\n\t\t\tEVTX_TEST_ASSERT_IS_NULL(\n\t\t\t \"resource_file\",\n\t\t\t resource_file );\n\n\t\t\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t\t\t \"error\",\n\t\t\t error );\n\n\t\t\tlibcerror_error_free(\n\t\t\t &error );\n\t\t}\n\t}\n#endif /* defined( HAVE_EVTX_TEST_MEMORY ) */\n\n\treturn( 1 );\n\non_error:\n\tif( error != NULL )\n\t{\n\t\tlibcerror_error_free(\n\t\t &error );\n\t}\n\tif( resource_file != NULL )\n\t{\n\t\tresource_file_free(\n\t\t &resource_file,\n\t\t NULL );\n\t}\n\treturn( 0 );\n}\n\n/* Tests the resource_file_free function\n * Returns 1 if successful or 0 if not\n */\nint evtx_test_tools_resource_file_free(\n void )\n{\n\tlibcerror_error_t *error = NULL;\n\tint result = 0;\n\n\t/* Test error cases\n\t */\n\tresult = resource_file_free(\n\t NULL,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"error\",\n\t error );\n\n\tlibcerror_error_free(\n\t &error );\n\n\treturn( 1 );\n\non_error:\n\tif( error != NULL )\n\t{\n\t\tlibcerror_error_free(\n\t\t &error );\n\t}\n\treturn( 0 );\n}\n\n/* The main program\n */\n#if defined( HAVE_WIDE_SYSTEM_CHARACTER )\nint wmain(\n int argc EVTX_TEST_ATTRIBUTE_UNUSED,\n wchar_t * const argv[] EVTX_TEST_ATTRIBUTE_UNUSED )\n#else\nint main(\n int argc EVTX_TEST_ATTRIBUTE_UNUSED,\n char * const argv[] EVTX_TEST_ATTRIBUTE_UNUSED )\n#endif\n{\n\tEVTX_TEST_UNREFERENCED_PARAMETER( argc )\n\tEVTX_TEST_UNREFERENCED_PARAMETER( argv )\n\n\tEVTX_TEST_RUN(\n\t \"resource_file_initialize\",\n\t evtx_test_tools_resource_file_initialize );\n\n\tEVTX_TEST_RUN(\n\t \"resource_file_free\",\n\t evtx_test_tools_resource_file_free );\n\n\treturn( EXIT_SUCCESS );\n\non_error:\n\treturn( EXIT_FAILURE );\n}\n\n" }, { "path": "tests/evtx_test_tools_signal.c", "content": "/*\n * Tools signal functions test program\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#include \n#include \n#include \n\n#if defined( HAVE_STDLIB_H ) || defined( WINAPI )\n#include \n#endif\n\n#include \"evtx_test_libcerror.h\"\n#include \"evtx_test_macros.h\"\n#include \"evtx_test_unused.h\"\n\n#include \"../evtxtools/evtxtools_signal.h\"\n\nvoid evtx_test_tools_signal_handler_function(\n evtxtools_signal_t signal EVTX_TEST_ATTRIBUTE_UNUSED )\n{\n\tEVTX_TEST_UNREFERENCED_PARAMETER( signal )\n}\n\n#if defined( WINAPI )\n\n/* Tests the evtxtools_signal_handler function\n * Returns 1 if successful or 0 if not\n */\nint evtx_test_tools_signal_handler(\n void )\n{\n\tBOOL result = 0;\n\n\t/* Test regular cases\n\t */\n\tresult = evtxtools_signal_handler(\n\t CTRL_C_EVENT );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t (int) TRUE );\n\n\tresult = evtxtools_signal_handler(\n\t CTRL_LOGOFF_EVENT );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t (int) FALSE );\n\n\treturn( 1 );\n\non_error:\n\treturn( 0 );\n}\n\n#if defined( _MSC_VER )\n\n\t/* TODO add tests for evtxtools_signal_initialize_memory_debug */\n\n#endif /* defined( _MSC_VER ) */\n\n#endif /* defined( WINAPI ) */\n\n/* Tests the evtxtools_signal_attach function\n * Returns 1 if successful or 0 if not\n */\nint evtx_test_tools_signal_attach(\n void )\n{\n\tlibcerror_error_t *error = NULL;\n\tint result = 0;\n\n\t/* Test regular cases\n\t */\n\tresult = evtxtools_signal_attach(\n\t evtx_test_tools_signal_handler_function,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 1 );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\t/* Test error cases\n\t */\n\tresult = evtxtools_signal_attach(\n\t NULL,\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t -1 );\n\n\tEVTX_TEST_ASSERT_IS_NOT_NULL(\n\t \"error\",\n\t error );\n\n\tlibcerror_error_free(\n\t &error );\n\n\treturn( 1 );\n\non_error:\n\tif( error != NULL )\n\t{\n\t\tlibcerror_error_free(\n\t\t &error );\n\t}\n\treturn( 0 );\n}\n\n/* Tests the evtxtools_signal_detach function\n * Returns 1 if successful or 0 if not\n */\nint evtx_test_tools_signal_detach(\n void )\n{\n\tlibcerror_error_t *error = NULL;\n\tint result = 0;\n\n\t/* Test regular cases\n\t */\n\tresult = evtxtools_signal_detach(\n\t &error );\n\n\tEVTX_TEST_ASSERT_EQUAL_INT(\n\t \"result\",\n\t result,\n\t 1 );\n\n\tEVTX_TEST_ASSERT_IS_NULL(\n\t \"error\",\n\t error );\n\n\treturn( 1 );\n\non_error:\n\tif( error != NULL )\n\t{\n\t\tlibcerror_error_free(\n\t\t &error );\n\t}\n\treturn( 0 );\n}\n\n/* The main program\n */\n#if defined( HAVE_WIDE_SYSTEM_CHARACTER )\nint wmain(\n int argc EVTX_TEST_ATTRIBUTE_UNUSED,\n wchar_t * const argv[] EVTX_TEST_ATTRIBUTE_UNUSED )\n#else\nint main(\n int argc EVTX_TEST_ATTRIBUTE_UNUSED,\n char * const argv[] EVTX_TEST_ATTRIBUTE_UNUSED )\n#endif\n{\n\tEVTX_TEST_UNREFERENCED_PARAMETER( argc )\n\tEVTX_TEST_UNREFERENCED_PARAMETER( argv )\n\n#if defined( WINAPI )\n\n\tEVTX_TEST_RUN(\n\t \"evtxtools_signal_handler\",\n\t evtx_test_tools_signal_handler )\n\n#if defined( _MSC_VER )\n\n\t/* TODO add tests for evtxtools_signal_initialize_memory_debug */\n\n#endif /* defined( _MSC_VER ) */\n\n#endif /* defined( WINAPI ) */\n\n\tEVTX_TEST_RUN(\n\t \"evtxtools_signal_attach\",\n\t evtx_test_tools_signal_attach )\n\n\tEVTX_TEST_RUN(\n\t \"evtxtools_signal_detach\",\n\t evtx_test_tools_signal_detach )\n\n\treturn( EXIT_SUCCESS );\n\non_error:\n\treturn( EXIT_FAILURE );\n}\n\n" }, { "path": "tests/evtx_test_unused.h", "content": "/*\n * Definitions to silence compiler warnings about unused function attributes/parameters.\n *\n * Copyright (C) 2011-2025, Joachim Metz \n *\n * Refer to AUTHORS for acknowledgements.\n *\n * This program is free software: you can redistribute it and/or modify\n * it under the terms of the GNU Lesser General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n *\n * This program is distributed in the hope that it will be useful,\n * but WITHOUT ANY WARRANTY; without even the implied warranty of\n * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n * GNU General Public License for more details.\n *\n * You should have received a copy of the GNU Lesser General Public License\n * along with this program. If not, see .\n */\n\n#if !defined( _EVTX_TEST_UNUSED_H )\n#define _EVTX_TEST_UNUSED_H\n\n#include \n\n#if !defined( EVTX_TEST_ATTRIBUTE_UNUSED )\n\n#if defined( __GNUC__ ) && __GNUC__ >= 3\n#define EVTX_TEST_ATTRIBUTE_UNUSED\t__attribute__ ((__unused__))\n\n#else\n#define EVTX_TEST_ATTRIBUTE_UNUSED\n\n#endif /* defined( __GNUC__ ) && __GNUC__ >= 3 */\n\n#endif /* !defined( EVTX_TEST_ATTRIBUTE_UNUSED ) */\n\n#if defined( _MSC_VER )\n#define EVTX_TEST_UNREFERENCED_PARAMETER( parameter ) \\\n\tUNREFERENCED_PARAMETER( parameter );\n\n#else\n#define EVTX_TEST_UNREFERENCED_PARAMETER( parameter ) \\\n\t/* parameter */\n\n#endif /* defined( _MSC_VER ) */\n\n#endif /* !defined( _EVTX_TEST_UNUSED_H ) */\n\n" }, { "path": "tests/lsan.suppressions", "content": "leak:/lib*/libpython*\n" }, { "path": "tests/pkgbuild.sh", "content": "#!/bin/sh\n# Script to build a MacOS pkg\n#\n# Version: 20241015\n\nset -e\n\nmake install DESTDIR=${PWD}/osx-pkg\nmkdir -p ${PWD}/osx-pkg/usr/share/doc/libevtx\ncp AUTHORS COPYING COPYING.LESSER NEWS README ${PWD}/osx-pkg/usr/share/doc/libevtx\n\nVERSION=`sed '5!d; s/^ \\[//;s/\\],$//' configure.ac`\npkgbuild --root osx-pkg --identifier com.github.libyal.libevtx --version ${VERSION} --ownership recommended ../libevtx-${VERSION}.pkg\n\n" }, { "path": "tests/pyevtx_test_file.py", "content": "#!/usr/bin/env python\n#\n# Python-bindings file type test script\n#\n# Copyright (C) 2011-2025, Joachim Metz \n#\n# Refer to AUTHORS for acknowledgements.\n#\n# This program is free software: you can redistribute it and/or modify\n# it under the terms of the GNU Lesser General Public License as published by\n# the Free Software Foundation, either version 3 of the License, or\n# (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU Lesser General Public License\n# along with this program. If not, see .\n\nimport argparse\nimport os\nimport sys\nimport unittest\n\nimport pyevtx\n\n\nclass FileTypeTests(unittest.TestCase):\n \"\"\"Tests the file type.\"\"\"\n\n def test_signal_abort(self):\n \"\"\"Tests the signal_abort function.\"\"\"\n evtx_file = pyevtx.file()\n\n evtx_file.signal_abort()\n\n def test_open(self):\n \"\"\"Tests the open function.\"\"\"\n test_source = getattr(unittest, \"source\", None)\n if not test_source:\n raise unittest.SkipTest(\"missing source\")\n\n evtx_file = pyevtx.file()\n\n evtx_file.open(test_source)\n\n with self.assertRaises(IOError):\n evtx_file.open(test_source)\n\n evtx_file.close()\n\n with self.assertRaises(TypeError):\n evtx_file.open(None)\n\n with self.assertRaises(ValueError):\n evtx_file.open(test_source, mode=\"w\")\n\n def test_open_file_object(self):\n \"\"\"Tests the open_file_object function.\"\"\"\n test_source = getattr(unittest, \"source\", None)\n if not test_source:\n raise unittest.SkipTest(\"missing source\")\n\n if not os.path.isfile(test_source):\n raise unittest.SkipTest(\"source not a regular file\")\n\n evtx_file = pyevtx.file()\n\n with open(test_source, \"rb\") as file_object:\n\n evtx_file.open_file_object(file_object)\n\n with self.assertRaises(IOError):\n evtx_file.open_file_object(file_object)\n\n evtx_file.close()\n\n with self.assertRaises(TypeError):\n evtx_file.open_file_object(None)\n\n with self.assertRaises(ValueError):\n evtx_file.open_file_object(file_object, mode=\"w\")\n\n def test_close(self):\n \"\"\"Tests the close function.\"\"\"\n test_source = getattr(unittest, \"source\", None)\n if not test_source:\n raise unittest.SkipTest(\"missing source\")\n\n evtx_file = pyevtx.file()\n\n with self.assertRaises(IOError):\n evtx_file.close()\n\n def test_open_close(self):\n \"\"\"Tests the open and close functions.\"\"\"\n test_source = getattr(unittest, \"source\", None)\n if not test_source:\n return\n\n evtx_file = pyevtx.file()\n\n # Test open and close.\n evtx_file.open(test_source)\n evtx_file.close()\n\n # Test open and close a second time to validate clean up on close.\n evtx_file.open(test_source)\n evtx_file.close()\n\n if os.path.isfile(test_source):\n with open(test_source, \"rb\") as file_object:\n\n # Test open_file_object and close.\n evtx_file.open_file_object(file_object)\n evtx_file.close()\n\n # Test open_file_object and close a second time to validate clean up on close.\n evtx_file.open_file_object(file_object)\n evtx_file.close()\n\n # Test open_file_object and close and dereferencing file_object.\n evtx_file.open_file_object(file_object)\n del file_object\n evtx_file.close()\n\n def test_set_ascii_codepage(self):\n \"\"\"Tests the set_ascii_codepage function.\"\"\"\n supported_codepages = (\n \"ascii\", \"cp874\", \"cp932\", \"cp936\", \"cp949\", \"cp950\", \"cp1250\",\n \"cp1251\", \"cp1252\", \"cp1253\", \"cp1254\", \"cp1255\", \"cp1256\", \"cp1257\",\n \"cp1258\")\n\n evtx_file = pyevtx.file()\n\n for codepage in supported_codepages:\n evtx_file.set_ascii_codepage(codepage)\n\n unsupported_codepages = (\n \"iso-8859-1\", \"iso-8859-2\", \"iso-8859-3\", \"iso-8859-4\", \"iso-8859-5\",\n \"iso-8859-6\", \"iso-8859-7\", \"iso-8859-8\", \"iso-8859-9\", \"iso-8859-10\",\n \"iso-8859-11\", \"iso-8859-13\", \"iso-8859-14\", \"iso-8859-15\",\n \"iso-8859-16\", \"koi8_r\", \"koi8_u\")\n\n for codepage in unsupported_codepages:\n with self.assertRaises(RuntimeError):\n evtx_file.set_ascii_codepage(codepage)\n\n def test_get_ascii_codepage(self):\n \"\"\"Tests the get_ascii_codepage function and ascii_codepage property.\"\"\"\n test_source = getattr(unittest, \"source\", None)\n if not test_source:\n raise unittest.SkipTest(\"missing source\")\n\n evtx_file = pyevtx.file()\n\n evtx_file.open(test_source)\n\n ascii_codepage = evtx_file.get_ascii_codepage()\n self.assertIsNotNone(ascii_codepage)\n\n self.assertIsNotNone(evtx_file.ascii_codepage)\n\n evtx_file.close()\n\n def test_get_number_of_records(self):\n \"\"\"Tests the get_number_of_records function and number_of_records property.\"\"\"\n test_source = getattr(unittest, \"source\", None)\n if not test_source:\n raise unittest.SkipTest(\"missing source\")\n\n evtx_file = pyevtx.file()\n\n evtx_file.open(test_source)\n\n number_of_records = evtx_file.get_number_of_records()\n self.assertIsNotNone(number_of_records)\n\n self.assertIsNotNone(evtx_file.number_of_records)\n\n evtx_file.close()\n\n def test_get_number_of_recovered_records(self):\n \"\"\"Tests the get_number_of_recovered_records function and number_of_recovered_records property.\"\"\"\n test_source = getattr(unittest, \"source\", None)\n if not test_source:\n raise unittest.SkipTest(\"missing source\")\n\n evtx_file = pyevtx.file()\n\n evtx_file.open(test_source)\n\n number_of_recovered_records = evtx_file.get_number_of_recovered_records()\n self.assertIsNotNone(number_of_recovered_records)\n\n self.assertIsNotNone(evtx_file.number_of_recovered_records)\n\n evtx_file.close()\n\n\nif __name__ == \"__main__\":\n argument_parser = argparse.ArgumentParser()\n\n argument_parser.add_argument(\n \"source\", nargs=\"?\", action=\"store\", metavar=\"PATH\",\n default=None, help=\"path of the source file.\")\n\n options, unknown_options = argument_parser.parse_known_args()\n unknown_options.insert(0, sys.argv[0])\n\n setattr(unittest, \"source\", options.source)\n\n unittest.main(argv=unknown_options, verbosity=2)\n" }, { "path": "tests/pyevtx_test_support.py", "content": "#!/usr/bin/env python\n#\n# Python-bindings support functions test script\n#\n# Copyright (C) 2011-2025, Joachim Metz \n#\n# Refer to AUTHORS for acknowledgements.\n#\n# This program is free software: you can redistribute it and/or modify\n# it under the terms of the GNU Lesser General Public License as published by\n# the Free Software Foundation, either version 3 of the License, or\n# (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU Lesser General Public License\n# along with this program. If not, see .\n\nimport argparse\nimport os\nimport sys\nimport unittest\n\nimport pyevtx\n\n\nclass SupportFunctionsTests(unittest.TestCase):\n \"\"\"Tests the support functions.\"\"\"\n\n def test_get_version(self):\n \"\"\"Tests the get_version function.\"\"\"\n version = pyevtx.get_version()\n self.assertIsNotNone(version)\n\n def test_check_file_signature(self):\n \"\"\"Tests the check_file_signature function.\"\"\"\n test_source = getattr(unittest, \"source\", None)\n if not test_source:\n raise unittest.SkipTest(\"missing source\")\n\n result = pyevtx.check_file_signature(test_source)\n self.assertTrue(result)\n\n def test_check_file_signature_file_object(self):\n \"\"\"Tests the check_file_signature_file_object function.\"\"\"\n test_source = getattr(unittest, \"source\", None)\n if not test_source:\n raise unittest.SkipTest(\"missing source\")\n\n if not os.path.isfile(test_source):\n raise unittest.SkipTest(\"source not a regular file\")\n\n with open(test_source, \"rb\") as file_object:\n result = pyevtx.check_file_signature_file_object(file_object)\n self.assertTrue(result)\n\n def test_open(self):\n \"\"\"Tests the open function.\"\"\"\n test_source = getattr(unittest, \"source\", None)\n if not test_source:\n raise unittest.SkipTest(\"missing source\")\n\n evtx_file = pyevtx.open(test_source)\n self.assertIsNotNone(evtx_file)\n\n evtx_file.close()\n\n with self.assertRaises(TypeError):\n pyevtx.open(None)\n\n with self.assertRaises(ValueError):\n pyevtx.open(test_source, mode=\"w\")\n\n def test_open_file_object(self):\n \"\"\"Tests the open_file_object function.\"\"\"\n test_source = getattr(unittest, \"source\", None)\n if not test_source:\n raise unittest.SkipTest(\"missing source\")\n\n if not os.path.isfile(test_source):\n raise unittest.SkipTest(\"source not a regular file\")\n\n with open(test_source, \"rb\") as file_object:\n evtx_file = pyevtx.open_file_object(file_object)\n self.assertIsNotNone(evtx_file)\n\n evtx_file.close()\n\n with self.assertRaises(TypeError):\n pyevtx.open_file_object(None)\n\n with self.assertRaises(ValueError):\n pyevtx.open_file_object(file_object, mode=\"w\")\n\n\nif __name__ == \"__main__\":\n argument_parser = argparse.ArgumentParser()\n\n argument_parser.add_argument(\n \"source\", nargs=\"?\", action=\"store\", metavar=\"PATH\",\n default=None, help=\"path of the source file.\")\n\n options, unknown_options = argument_parser.parse_known_args()\n unknown_options.insert(0, sys.argv[0])\n\n setattr(unittest, \"source\", options.source)\n\n unittest.main(argv=unknown_options, verbosity=2)\n" }, { "path": "tests/runtests.py", "content": "#!/usr/bin/env python\n#\n# Script to run Python test scripts.\n#\n# Version: 20231024\n\nimport glob\nimport os\nimport sys\nimport unittest\n\n\ntest_profile = \".pyevtx\"\ninput_glob = \"*\"\noption_sets = []\n\n\ndef ReadIgnoreList(test_profile):\n \"\"\"Reads the test profile ignore file if it exists.\n\n Args:\n test_profile (str): test profile.\n\n Returns:\n set[str]: ignore list.\n \"\"\"\n ignore_file_path = os.path.join(\"tests\", \"input\", test_profile, \"ignore\")\n if os.path.isfile(ignore_file_path):\n with open(ignore_file_path, \"r\", encoding=\"utf-8\") as file_object:\n return set([line.strip() for line in file_object.readlines()])\n\n return set()\n\n\nif __name__ == \"__main__\":\n print(f\"Using Python version {sys.version!s}\")\n\n test_loader = unittest.TestLoader()\n test_runner = unittest.TextTestRunner(verbosity=2)\n\n test_scripts = test_loader.discover(\"tests\", pattern=\"*.py\")\n\n ignore_list = ReadIgnoreList(test_profile)\n\n test_set = None\n source_file = None\n\n for test_set in glob.glob(os.path.join(\"tests\", \"input\", \"*\")):\n test_set = test_set.rsplit(os.path.sep, maxsplit=1)[-1]\n if not test_set or test_set[0] == '.' or test_set in ignore_list:\n continue\n\n source_files = glob.glob(os.path.join(\n \"tests\", \"input\", test_set, input_glob))\n if source_files:\n source_file = source_files[0]\n break\n\n setattr(unittest, \"source\", source_file)\n\n if source_file:\n for option_set in option_sets:\n test_file = os.path.basename(source_file)\n test_options_file_path = os.path.join(\n \"tests\", \"input\", test_profile, test_set,\n f\"{test_file:s}.{option_set:s}\")\n if os.path.isfile(test_options_file_path):\n with open(test_options_file_path, \"r\", encoding=\"utf-8\") as file_object:\n lines = [line.strip() for line in file_object.readlines()]\n if lines[0] == \"# libyal test data options\":\n for line in lines[1:]:\n key, value = line.split(\"=\", maxsplit=1)\n if key == 'offset':\n value = int(value)\n\n setattr(unittest, key, value)\n\n test_results = test_runner.run(test_scripts)\n if not test_results.wasSuccessful():\n sys.exit(1)\n" }, { "path": "tests/runtests.sh", "content": "#!/bin/sh\n# Script to run tests\n#\n# Version: 20201121\n\nif test -f ${PWD}/libevtx/.libs/libevtx.1.dylib && test -f ./pyevtx/.libs/pyevtx.so;\nthen\n\tinstall_name_tool -change /usr/local/lib/libevtx.1.dylib ${PWD}/libevtx/.libs/libevtx.1.dylib ./pyevtx/.libs/pyevtx.so;\nfi\n\nmake check CHECK_WITH_STDERR=1;\nRESULT=$?;\n\nif test ${RESULT} -ne 0 && test -f tests/test-suite.log;\nthen\n\tcat tests/test-suite.log;\nfi\nexit ${RESULT};\n\n" }, { "path": "tests/syncsharedlibs.sh", "content": "#!/bin/sh\n# Script that synchronizes the shared library dependencies\n#\n# Version: 20201121\n\nEXIT_SUCCESS=0;\nEXIT_FAILURE=1;\n\nGIT_URL_PREFIX=\"https://github.com/libyal\";\nSHARED_LIBS=\"libcerror libcthreads libcdata libclocale libcnotify libcsplit libuna libcfile libcpath libbfio libfcache libfdata libfdatetime libfguid libfwevt libfwnt libfvalue\";\n\nUSE_HEAD=\"\";\n\nif test \"$1\" = \"--use-head\";\nthen\n\tUSE_HEAD=\"--use-head\";\nfi\n\nOLDIFS=$IFS;\nIFS=\" \";\n\nfor SHARED_LIB in ${SHARED_LIBS};\ndo\n\tGIT_URL=\"${GIT_URL_PREFIX}/${SHARED_LIB}.git\";\n\n\tgit clone --quiet ${GIT_URL} ${SHARED_LIB}-$$;\n\n\tif ! test -d ${SHARED_LIB}-$$;\n\tthen\n\t\techo \"Unable to git clone: ${GIT_URL}\";\n\n\t\tIFS=$OLDIFS;\n\n\t\texit ${EXIT_FAILURE};\n\tfi\n\t(cd ${SHARED_LIB}-$$ && git fetch --quiet --all --tags --prune)\n\n\tLATEST_TAG=`cd ${SHARED_LIB}-$$ && git describe --tags --abbrev=0`;\n\n\tif test -n ${LATEST_TAG} && test -z ${USE_HEAD};\n\tthen\n\t\techo \"Synchronizing: ${SHARED_LIB} from ${GIT_URL} tag ${LATEST_TAG}\";\n\n\t\t(cd ${SHARED_LIB}-$$ && git checkout --quiet tags/${LATEST_TAG});\n\telse\n\t\techo \"Synchronizing: ${SHARED_LIB} from ${GIT_URL} HEAD\";\n\tfi\n\n\t(cd ${SHARED_LIB}-$$ && ./synclibs.sh ${USE_HEAD} && ./autogen.sh);\n\n\tCONFIGURE_OPTIONS=\"\";\n\n\t(cd ${SHARED_LIB}-$$ && ./configure --help | grep -- '--enable-wide-character-type' > /dev/null);\n\n\tif test $? -eq 0;\n\tthen\n\t\tCONFIGURE_OPTIONS=\"${CONFIGURE_OPTIONS} --enable-wide-character-type\";\n\tfi\n\n\t(cd ${SHARED_LIB}-$$ && ./configure --prefix=/usr ${CONFIGURE_OPTIONS} && make && sudo make install);\n\n\trm -rf ${SHARED_LIB}-$$;\ndone\n\nIFS=$OLDIFS;\n\nexit ${EXIT_SUCCESS};\n\n" }, { "path": "tests/test_evtxexport.sh", "content": "#!/usr/bin/env bash\n# Export tool testing script\n#\n# Version: 20240413\n\nEXIT_SUCCESS=0;\nEXIT_FAILURE=1;\nEXIT_IGNORE=77;\n\nPROFILES=(\"evtxexport\" \"evtxexport_xml\");\nOPTIONS_PER_PROFILE=(\"\" \"-fxml\");\nOPTION_SETS=();\n\nINPUT_GLOB=\"*\";\n\nif test -n \"${SKIP_TOOLS_TESTS}\" || test -n \"${SKIP_TOOLS_END_TO_END_TESTS}\";\nthen\n\texit ${EXIT_IGNORE};\nfi\n\nTEST_EXECUTABLE=\"../evtxtools/evtxexport\";\n\nif ! test -x \"${TEST_EXECUTABLE}\";\nthen\n\tTEST_EXECUTABLE=\"../evtxtools/evtxexport.exe\";\nfi\n\nif ! test -x \"${TEST_EXECUTABLE}\";\nthen\n\techo \"Missing test executable: ${TEST_EXECUTABLE}\";\n\n\texit ${EXIT_FAILURE};\nfi\n\nTEST_DIRECTORY=`dirname $0`;\n\nTEST_RUNNER=\"${TEST_DIRECTORY}/test_runner.sh\";\n\nif ! test -f \"${TEST_RUNNER}\";\nthen\n\techo \"Missing test runner: ${TEST_RUNNER}\";\n\n\texit ${EXIT_FAILURE};\nfi\n\nsource ${TEST_RUNNER};\n\nif ! test -d \"input\";\nthen\n\techo \"Test input directory not found.\";\n\n\texit ${EXIT_IGNORE};\nfi\nRESULT=`ls input/* | tr ' ' '\\n' | wc -l`;\n\nif test ${RESULT} -eq ${EXIT_SUCCESS};\nthen\n\techo \"No files or directories found in the test input directory\";\n\n\texit ${EXIT_IGNORE};\nfi\n\nfor PROFILE_INDEX in ${!PROFILES[*]};\ndo\n\tTEST_PROFILE=${PROFILES[${PROFILE_INDEX}]};\n\n\tTEST_PROFILE_DIRECTORY=$(get_test_profile_directory \"input\" \"${TEST_PROFILE}\");\n\n\tIGNORE_LIST=$(read_ignore_list \"${TEST_PROFILE_DIRECTORY}\");\n\n\tIFS=\" \" read -a PROFILE_OPTIONS <<< ${OPTIONS_PER_PROFILE[${PROFILE_INDEX}]};\n\n\tRESULT=${EXIT_SUCCESS};\n\n\tfor TEST_SET_INPUT_DIRECTORY in input/*;\n\tdo\n\t\tif ! test -d \"${TEST_SET_INPUT_DIRECTORY}\";\n\t\tthen\n\t\t\tcontinue;\n\t\tfi\n\t\tTEST_SET=`basename ${TEST_SET_INPUT_DIRECTORY}`;\n\n\t\tif check_for_test_set_in_ignore_list \"${TEST_SET}\" \"${IGNORE_LIST}\";\n\t\tthen\n\t\t\tcontinue;\n\t\tfi\n\t\tTEST_SET_DIRECTORY=$(get_test_set_directory \"${TEST_PROFILE_DIRECTORY}\" \"${TEST_SET_INPUT_DIRECTORY}\");\n\n\t\tRESULT=${EXIT_SUCCESS};\n\n\t\tif test -f \"${TEST_SET_DIRECTORY}/files\";\n\t\tthen\n\t\t\tIFS=\"\" read -a INPUT_FILES <<< $(cat ${TEST_SET_DIRECTORY}/files | sed \"s?^?${TEST_SET_INPUT_DIRECTORY}/?\");\n\t\telse\n\t\t\tIFS=\"\" read -a INPUT_FILES <<< $(ls -1d ${TEST_SET_INPUT_DIRECTORY}/${INPUT_GLOB});\n\t\tfi\n\t\tfor INPUT_FILE in \"${INPUT_FILES[@]}\";\n\t\tdo\n\t\t\tTESTED_WITH_OPTIONS=0;\n\n\t\t\tfor OPTION_SET in ${OPTION_SETS[@]};\n\t\t\tdo\n\t\t\t\tTEST_DATA_OPTION_FILE=$(get_test_data_option_file \"${TEST_SET_DIRECTORY}\" \"${INPUT_FILE}\" \"${OPTION_SET}\");\n\n\t\t\t\tif test -f ${TEST_DATA_OPTION_FILE};\n\t\t\t\tthen\n\t\t\t\t\tTESTED_WITH_OPTIONS=1;\n\n\t\t\t\t\tIFS=\" \" read -a OPTIONS <<< $(read_test_data_option_file \"${TEST_SET_DIRECTORY}\" \"${INPUT_FILE}\" \"${OPTION_SET}\");\n\n\t\t\t\t\trun_test_on_input_file \"${TEST_SET_DIRECTORY}\" \"evtxexport\" \"with_stdout_reference\" \"${OPTION_SET}\" \"${TEST_EXECUTABLE}\" \"${INPUT_FILE}\" \"${PROFILE_OPTIONS[@]}\" \"${OPTIONS[@]}\";\n\t\t\t\t\tRESULT=$?;\n\n\t\t\t\t\tif test ${RESULT} -ne ${EXIT_SUCCESS};\n\t\t\t\t\tthen\n\t\t\t\t\t\tbreak;\n\t\t\t\t\tfi\n\t\t\t\tfi\n\t\t\tdone\n\n\t\t\tif test ${TESTED_WITH_OPTIONS} -eq 0;\n\t\t\tthen\n\t\t\t\trun_test_on_input_file \"${TEST_SET_DIRECTORY}\" \"evtxexport\" \"with_stdout_reference\" \"\" \"${TEST_EXECUTABLE}\" \"${INPUT_FILE}\" \"${PROFILE_OPTIONS[@]}\";\n\t\t\t\tRESULT=$?;\n\t\t\tfi\n\n\t\t\tif test ${RESULT} -ne ${EXIT_SUCCESS};\n\t\t\tthen\n\t\t\t\tbreak;\n\t\t\tfi\n\t\tdone\n\n\t\t# Ignore failures due to corrupted data.\n\t\tif test \"${TEST_SET}\" = \"corrupted\";\n\t\tthen\n\t\t\tRESULT=${EXIT_SUCCESS};\n\t\tfi\n\t\tif test ${RESULT} -ne ${EXIT_SUCCESS};\n\t\tthen\n\t\t\tbreak;\n\t\tfi\n\tdone\ndone\n\nexit ${RESULT};\n\n\n" }, { "path": "tests/test_evtxinfo.ps1", "content": "# Info tool testing script\n#\n# Version: 20230410\n\n$ExitSuccess = 0\n$ExitFailure = 1\n$ExitIgnore = 77\n\n$Profiles = @(\"evtxinfo\")\n$OptionsPerProfile = @(\"\")\n$OptionSets = \"\"\n\n$InputGlob = \"*\"\n\nFunction GetTestExecutablesDirectory\n{\n\t$TestExecutablesDirectory = \"\"\n\n\tForEach (${VSDirectory} in (\"msvscpp\", \"vs2008\", \"vs2010\", \"vs2012\", \"vs2013\", \"vs2015\", \"vs2017\", \"vs2019\", \"vs2022\"))\n\t{\n\t\tForEach (${VSConfiguration} in (\"Release\", \"VSDebug\"))\n\t\t{\n\t\t\tForEach (${VSPlatform} in (\"Win32\", \"x64\"))\n\t\t\t{\n\t\t\t\t$TestExecutablesDirectory = \"..\\${VSDirectory}\\${VSConfiguration}\\${VSPlatform}\"\n\n\t\t\t\tIf (Test-Path ${TestExecutablesDirectory})\n\t\t\t\t{\n\t\t\t\t\tReturn ${TestExecutablesDirectory}\n\t\t\t\t}\n\t\t\t}\n\t\t\t$TestExecutablesDirectory = \"..\\${VSDirectory}\\${VSConfiguration}\"\n\n\t\t\tIf (Test-Path ${TestExecutablesDirectory})\n\t\t\t{\n\t\t\t\tReturn ${TestExecutablesDirectory}\n\t\t\t}\n\t\t}\n\t}\n\tReturn ${TestExecutablesDirectory}\n}\n\nFunction ReadIgnoreList\n{\n\tparam( [string]$TestProfileDirectory )\n\n\t$IgnoreFile = \"${TestProfileDirectory}\\ignore\"\n\t$IgnoreList = \"\"\n\n\tIf (Test-Path -Path ${IgnoreFile} -PathType \"Leaf\")\n\t{\n\t\t$IgnoreList = Get-Content -Path ${IgnoreFile} | Where {$_ -notmatch '^#.*'}\n\t}\n\tReturn $IgnoreList\n}\n\n$TestExecutablesDirectory = GetTestExecutablesDirectory\n\nIf (-Not (Test-Path ${TestExecutablesDirectory}))\n{\n\tWrite-Host \"Missing test executables directory.\" -foreground Red\n\n\tExit ${ExitFailure}\n}\n\n$TestExecutable = \"${TestExecutablesDirectory}\\evtxinfo.exe\"\n\nIf (-Not (Test-Path -Path \"input\"))\n{\n\tExit ${ExitIgnore}\n}\n$Result = ${ExitSuccess}\n\nFor ($ProfileIndex = 0; $ProfileIndex -le ($Profiles.length - 1); $ProfileIndex += 1)\n{\n\t$TestProfile = $Profiles[$ProfileIndex]\n\t$Options = $OptionsPerProfile[$ProfileIndex]\n\n\t$TestProfileDirectory = \"input\\.${TestProfile}\"\n\n\tIf (-Not (Test-Path -Path ${TestProfileDirectory} -PathType \"Container\"))\n\t{\n\t\tNew-Item -ItemType \"directory\" -Path ${TestProfileDirectory} | Out-Null\n\t}\n\t$IgnoreList = ReadIgnoreList ${TestProfileDirectory}\n\n\t# Note that the trailing backtick is needed.\n\tGet-ChildItem -Path \"input\" -Exclude \".*\" | ForEach-Object `\n\t{\n\t\t$TestSetDirectory = $_\n\n\t\tIf (-Not (Test-Path -Path ${TestSetDirectory} -PathType Container))\n\t\t{\n\t\t\tContinue\n\t\t}\n\t\t$TestSetName = ${TestSetDirectory}.Name\n\n\t\tIf (${IgnoreList}.Contains(${TestSetName}))\n\t\t{\n\t\t\tContinue\n\t\t}\n\t\tIf (-Not (Test-Path -Path \"${TestProfileDirectory}\\${TestSetName}\" -PathType Container))\n\t\t{\n\t\t\tNew-Item -Name \"${TestProfileDirectory}\\${TestSetName}\" -ItemType \"directory\" | Out-Null\n\t\t}\n\t\tIf (Test-Path -Path \"${TestProfileDirectory}\\${TestSetName}\\files\" -PathType Container)\n\t\t{\n\t\t\t$InputFiles = Get-content -Path \"${TestProfileDirectory}\\${TestSetName}\\files\"\n\t\t}\n\t\tElse\n\t\t{\n\t\t\t$InputFiles = Get-ChildItem -Path \"${TestSetDirectory}\\${InputGlob}\"\n\t\t}\n\t\tForEach ($InputFile in ${InputFiles})\n\t\t{\n\t\t\t$InputFileName = ${InputFile}.Name\n\n\t\t\t$TestedWithOptions = $False\n\n\t\t\t$TmpDir = \"tmp${PID}\"\n\n\t\t\tNew-Item -Name ${TmpDir} -ItemType \"directory\" | Out-Null\n\n\t\t\tPush-Location ${TmpDir}\n\n\t\t\tTry\n\t\t\t{\n\t\t\t\tForEach ($OptionSet in ${OptionSets} -split \" \")\n\t\t\t\t{\n\t\t\t\t\t$TestDataOptionFile = \"..\\${TestProfileDirectory}\\${TestSetName}\\${InputFileName}.${OptionSet}\"\n\n\t\t\t\t\tIf (-Not (Test-Path -Path \"${TestDataOptionFile}\" -PathType \"Leaf\"))\n\t\t\t\t\t{\n\t\t\t\t\t\tContinue\n\t\t\t\t\t}\n\t\t\t\t\t$InputOptions = Get-content -Path \"${TestDataOptionFile}\" -First 1\n\n\t\t\t\t\t$TestLog = \"${InputFileName}-${OptionSet}.log\"\n\n\t\t\t\t\tInvoke-Expression \"..\\${TestExecutable} ${Options} ${InputOptions} ${InputFile} > ${TestLog}\"\n\t\t\t\t\t$Result = $LastExitCode\n\n\t\t\t\t\tIf (${Result} -ne ${ExitSuccess})\n\t\t\t\t\t{\n\t\t\t\t\t\tBreak\n\t\t\t\t\t}\n\t\t\t\t\t$TestedWithOptions = $True\n\t\t\t\t}\n\t\t\t\tIf ((${Result} -eq ${ExitSuccess}) -And (-Not (${TestedWithOptions})))\n\t\t\t\t{\n\t\t\t\t\t$TestLog = \"${InputFileName}.log\"\n\n\t\t\t\t\tInvoke-Expression \"..\\${TestExecutable} ${Options} ${InputFile} > ${TestLog}\"\n\t\t\t\t\t$Result = $LastExitCode\n\t\t\t\t}\n\t\t\t\tIf (${Result} -eq ${ExitSuccess})\n\t\t\t\t{\n\t\t\t\t\t# Strip header with version.\n\t\t\t\t\t(Get-Content ${TestLog} | Select-Object -Skip 2) | Set-Content ${TestLog}\n\n\t\t\t\t\t$StoredTestLog = \"..\\${TestProfileDirectory}\\${TestSetName}\\${TestLog}\"\n\n\t\t\t\t\tIf (Test-Path -Path ${StoredTestLog} -PathType \"Leaf\")\n\t\t\t\t\t{\n\t\t\t\t\t\t$Difference = Compare-Object -ReferenceObject (Get-Content -Path ${StoredTestLog}) -DifferenceObject (Get-Content -Path ${TestLog})\n\n\t\t\t\t\t\tIf (${Difference})\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\t$Result = ${ExitFailure}\n\t\t\t\t\t\t}\n\t\t\t\t\t}\n\t\t\t\t\tElse\n\t\t\t\t\t{\n\t\t\t\t\t\tMove-Item -Path ${TestLog} -Destination ${StoredTestLog}\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\t\tFinally\n\t\t\t{\n\t\t\t\tPop-Location\n\n\t\t\t\tRemove-Item ${TmpDir} -Force -Recurse\n\t\t\t}\n\t\t}\n\t\tIf (${Result} -ne ${ExitSuccess})\n\t\t{\n\t\t\tBreak\n\t\t}\n\t}\n}\n\nExit ${Result}\n\n" }, { "path": "tests/test_evtxinfo.sh", "content": "#!/usr/bin/env bash\n# Info tool testing script\n#\n# Version: 20240413\n\nEXIT_SUCCESS=0;\nEXIT_FAILURE=1;\nEXIT_IGNORE=77;\n\nPROFILES=(\"evtxinfo\");\nOPTIONS_PER_PROFILE=(\"\");\nOPTION_SETS=();\n\nINPUT_GLOB=\"*\";\n\nif test -n \"${SKIP_TOOLS_TESTS}\" || test -n \"${SKIP_TOOLS_END_TO_END_TESTS}\";\nthen\n\texit ${EXIT_IGNORE};\nfi\n\nTEST_EXECUTABLE=\"../evtxtools/evtxinfo\";\n\nif ! test -x \"${TEST_EXECUTABLE}\";\nthen\n\tTEST_EXECUTABLE=\"../evtxtools/evtxinfo.exe\";\nfi\n\nif ! test -x \"${TEST_EXECUTABLE}\";\nthen\n\techo \"Missing test executable: ${TEST_EXECUTABLE}\";\n\n\texit ${EXIT_FAILURE};\nfi\n\nTEST_DIRECTORY=`dirname $0`;\n\nTEST_RUNNER=\"${TEST_DIRECTORY}/test_runner.sh\";\n\nif ! test -f \"${TEST_RUNNER}\";\nthen\n\techo \"Missing test runner: ${TEST_RUNNER}\";\n\n\texit ${EXIT_FAILURE};\nfi\n\nsource ${TEST_RUNNER};\n\nif ! test -d \"input\";\nthen\n\techo \"Test input directory not found.\";\n\n\texit ${EXIT_IGNORE};\nfi\nRESULT=`ls input/* | tr ' ' '\\n' | wc -l`;\n\nif test ${RESULT} -eq ${EXIT_SUCCESS};\nthen\n\techo \"No files or directories found in the test input directory\";\n\n\texit ${EXIT_IGNORE};\nfi\n\nfor PROFILE_INDEX in ${!PROFILES[*]};\ndo\n\tTEST_PROFILE=${PROFILES[${PROFILE_INDEX}]};\n\n\tTEST_PROFILE_DIRECTORY=$(get_test_profile_directory \"input\" \"${TEST_PROFILE}\");\n\n\tIGNORE_LIST=$(read_ignore_list \"${TEST_PROFILE_DIRECTORY}\");\n\n\tIFS=\" \" read -a PROFILE_OPTIONS <<< ${OPTIONS_PER_PROFILE[${PROFILE_INDEX}]};\n\n\tRESULT=${EXIT_SUCCESS};\n\n\tfor TEST_SET_INPUT_DIRECTORY in input/*;\n\tdo\n\t\tif ! test -d \"${TEST_SET_INPUT_DIRECTORY}\";\n\t\tthen\n\t\t\tcontinue;\n\t\tfi\n\t\tTEST_SET=`basename ${TEST_SET_INPUT_DIRECTORY}`;\n\n\t\tif check_for_test_set_in_ignore_list \"${TEST_SET}\" \"${IGNORE_LIST}\";\n\t\tthen\n\t\t\tcontinue;\n\t\tfi\n\t\tTEST_SET_DIRECTORY=$(get_test_set_directory \"${TEST_PROFILE_DIRECTORY}\" \"${TEST_SET_INPUT_DIRECTORY}\");\n\n\t\tRESULT=${EXIT_SUCCESS};\n\n\t\tif test -f \"${TEST_SET_DIRECTORY}/files\";\n\t\tthen\n\t\t\tIFS=\"\" read -a INPUT_FILES <<< $(cat ${TEST_SET_DIRECTORY}/files | sed \"s?^?${TEST_SET_INPUT_DIRECTORY}/?\");\n\t\telse\n\t\t\tIFS=\"\" read -a INPUT_FILES <<< $(ls -1d ${TEST_SET_INPUT_DIRECTORY}/${INPUT_GLOB});\n\t\tfi\n\t\tfor INPUT_FILE in \"${INPUT_FILES[@]}\";\n\t\tdo\n\t\t\tTESTED_WITH_OPTIONS=0;\n\n\t\t\tfor OPTION_SET in ${OPTION_SETS[@]};\n\t\t\tdo\n\t\t\t\tTEST_DATA_OPTION_FILE=$(get_test_data_option_file \"${TEST_SET_DIRECTORY}\" \"${INPUT_FILE}\" \"${OPTION_SET}\");\n\n\t\t\t\tif test -f ${TEST_DATA_OPTION_FILE};\n\t\t\t\tthen\n\t\t\t\t\tTESTED_WITH_OPTIONS=1;\n\n\t\t\t\t\tIFS=\" \" read -a OPTIONS <<< $(read_test_data_option_file \"${TEST_SET_DIRECTORY}\" \"${INPUT_FILE}\" \"${OPTION_SET}\");\n\n\t\t\t\t\trun_test_on_input_file \"${TEST_SET_DIRECTORY}\" \"evtxinfo\" \"with_stdout_reference\" \"${OPTION_SET}\" \"${TEST_EXECUTABLE}\" \"${INPUT_FILE}\" \"${PROFILE_OPTIONS[@]}\" \"${OPTIONS[@]}\";\n\t\t\t\t\tRESULT=$?;\n\n\t\t\t\t\tif test ${RESULT} -ne ${EXIT_SUCCESS};\n\t\t\t\t\tthen\n\t\t\t\t\t\tbreak;\n\t\t\t\t\tfi\n\t\t\t\tfi\n\t\t\tdone\n\n\t\t\tif test ${TESTED_WITH_OPTIONS} -eq 0;\n\t\t\tthen\n\t\t\t\trun_test_on_input_file \"${TEST_SET_DIRECTORY}\" \"evtxinfo\" \"with_stdout_reference\" \"\" \"${TEST_EXECUTABLE}\" \"${INPUT_FILE}\" \"${PROFILE_OPTIONS[@]}\";\n\t\t\t\tRESULT=$?;\n\t\t\tfi\n\n\t\t\tif test ${RESULT} -ne ${EXIT_SUCCESS};\n\t\t\tthen\n\t\t\t\tbreak;\n\t\t\tfi\n\t\tdone\n\n\t\t# Ignore failures due to corrupted data.\n\t\tif test \"${TEST_SET}\" = \"corrupted\";\n\t\tthen\n\t\t\tRESULT=${EXIT_SUCCESS};\n\t\tfi\n\t\tif test ${RESULT} -ne ${EXIT_SUCCESS};\n\t\tthen\n\t\t\tbreak;\n\t\tfi\n\tdone\ndone\n\nexit ${RESULT};\n\n" }, { "path": "tests/test_library.ps1", "content": "# Tests library functions and types.\n#\n# Version: 20230410\n\n$ExitSuccess = 0\n$ExitFailure = 1\n$ExitIgnore = 77\n\n$LibraryTests = \"chunk chunks_table error io_handle notify record record_values template_definition\"\n$LibraryTestsWithInput = \"file support\"\n$OptionSets = \"\"\n\n$InputGlob = \"*\"\n\nFunction GetTestExecutablesDirectory\n{\n\t$TestExecutablesDirectory = \"\"\n\n\tForEach (${VSDirectory} in (\"msvscpp\", \"vs2008\", \"vs2010\", \"vs2012\", \"vs2013\", \"vs2015\", \"vs2017\", \"vs2019\", \"vs2022\"))\n\t{\n\t\tForEach (${VSConfiguration} in (\"Release\", \"VSDebug\"))\n\t\t{\n\t\t\tForEach (${VSPlatform} in (\"Win32\", \"x64\"))\n\t\t\t{\n\t\t\t\t$TestExecutablesDirectory = \"..\\${VSDirectory}\\${VSConfiguration}\\${VSPlatform}\"\n\n\t\t\t\tIf (Test-Path ${TestExecutablesDirectory})\n\t\t\t\t{\n\t\t\t\t\tReturn ${TestExecutablesDirectory}\n\t\t\t\t}\n\t\t\t}\n\t\t\t$TestExecutablesDirectory = \"..\\${VSDirectory}\\${VSConfiguration}\"\n\n\t\t\tIf (Test-Path ${TestExecutablesDirectory})\n\t\t\t{\n\t\t\t\tReturn ${TestExecutablesDirectory}\n\t\t\t}\n\t\t}\n\t}\n\tReturn ${TestExecutablesDirectory}\n}\n\nFunction ReadIgnoreList\n{\n\tparam( [string]$TestProfileDirectory )\n\n\t$IgnoreFile = \"${TestProfileDirectory}\\ignore\"\n\t$IgnoreList = \"\"\n\n\tIf (Test-Path -Path ${IgnoreFile} -PathType \"Leaf\")\n\t{\n\t\t$IgnoreList = Get-Content -Path ${IgnoreFile} | Where {$_ -notmatch '^#.*'}\n\t}\n\tReturn $IgnoreList\n}\n\nFunction RunTest\n{\n\tparam( [string]$TestType )\n\n\t$TestDescription = \"Testing: ${TestName}\"\n\t$TestExecutable = \"${TestExecutablesDirectory}\\evtx_test_${TestName}.exe\"\n\n\tIf (-Not (Test-Path -Path ${TestExecutable} -PathType \"Leaf\"))\n\t{\n\t\tWrite-Host \"${TestDescription} (\" -nonewline\n\t\tWrite-Host \"SKIP\" -foreground Cyan -nonewline\n\t\tWrite-Host \")\"\n\n\t\tReturn ${ExitIgnore}\n\t}\n\t$Output = Invoke-Expression ${TestExecutable}\n\t$Result = ${LastExitCode}\n\n\tIf (${Result} -ne ${ExitSuccess})\n\t{\n\t\tWrite-Host ${Output} -foreground Red\n\t}\n\tWrite-Host \"${TestDescription} (\" -nonewline\n\n\tIf (${Result} -ne ${ExitSuccess})\n\t{\n\t\tWrite-Host \"FAIL\" -foreground Red -nonewline\n\t}\n\tElse\n\t{\n\t\tWrite-Host \"PASS\" -foreground Green -nonewline\n\t}\n\tWrite-Host \")\"\n\n\tReturn ${Result}\n}\n\nFunction RunTestWithInput\n{\n\tparam( [string]$TestType )\n\n\t$TestDescription = \"Testing: ${TestName}\"\n\t$TestExecutable = \"${TestExecutablesDirectory}\\evtx_test_${TestName}.exe\"\n\n\tIf (-Not (Test-Path -Path ${TestExecutable} -PathType \"Leaf\"))\n\t{\n\t\tWrite-Host \"${TestDescription} (\" -nonewline\n\t\tWrite-Host \"SKIP\" -foreground Cyan -nonewline\n\t\tWrite-Host \")\"\n\n\t\tReturn ${ExitIgnore}\n\t}\n\t$TestProfileDirectory = \"input\\.libevtx\"\n\n\tIf (-Not (Test-Path -Path ${TestProfileDirectory} -PathType \"Container\"))\n\t{\n\t\tNew-Item -ItemType \"directory\" -Path ${TestProfileDirectory}\n\t}\n\t$IgnoreList = ReadIgnoreList ${TestProfileDirectory}\n\n\t$Result = ${ExitSuccess}\n\n\tForEach ($TestSetInputDirectory in Get-ChildItem -Path \"input\" -Exclude \".*\")\n\t{\n\t\tIf (-Not (Test-Path -Path ${TestSetInputDirectory} -PathType \"Container\"))\n\t\t{\n\t\t\tContinue\n\t\t}\n\t\tIf (${TestSetInputDirectory} -Contains ${IgnoreList})\n\t\t{\n\t\t\tContinue\n\t\t}\n\t\t$TestSetName = ${TestSetInputDirectory}.Name\n\n\t\tIf (Test-Path -Path \"${TestProfileDirectory}\\${TestSetName}\\files\" -PathType \"Leaf\")\n\t\t{\n\t\t\t$InputFiles = Get-Content -Path \"${TestProfileDirectory}\\${TestSetName}\\files\" | Where {$_ -ne \"\"}\n\t\t}\n\t\tElse\n\t\t{\n\t\t\t$InputFiles = Get-ChildItem -Path ${TestSetInputDirectory} -Include ${InputGlob}\n\t\t}\n\t\tForEach ($InputFile in ${InputFiles})\n\t\t{\n\t\t\t$TestedWithOptions = $False\n\n\t\t\tForEach ($OptionSet in ${OptionSets} -split \" \")\n\t\t\t{\n\t\t\t\t$InputFileName = ${InputFile}.Name\n\t\t\t\t$TestDataOptionFile = \"${TestProfileDirectory}\\${TestSetName}\\${InputFileName}.${OptionSet}\"\n\n\t\t\t\tIf (-Not (Test-Path -Path \"${TestDataOptionFile}\" -PathType \"Leaf\"))\n\t\t\t\t{\n\t\t\t\t\tContinue\n\t\t\t\t}\n\t\t\t\t$InputOptions = Get-content -Path \"${TestDataOptionFile}\" -First 1\n\n\t\t\t\t$Output = Invoke-Expression \"${TestExecutable} ${InputOptions} ${InputFile}\"\n\t\t\t\t$Result = $LastExitCode\n\n\t\t\t\tIf (${Result} -ne ${ExitSuccess})\n\t\t\t\t{\n\t\t\t\t\tBreak\n\t\t\t\t}\n\t\t\t\t$TestedWithOptions = $True\n\t\t\t}\n\t\t\tIf ((${Result} -eq ${ExitSuccess}) -And (-Not (${TestedWithOptions})))\n\t\t\t{\n\t\t\t\t$Output = Invoke-Expression \"${TestExecutable} ${InputFile}\"\n\t\t\t\t$Result = ${LastExitCode}\n\t\t\t}\n\t\t\tIf (${Result} -ne ${ExitSuccess})\n\t\t\t{\n\t\t\t\tBreak\n\t\t\t}\n\t\t}\n\t\tIf (${Result} -ne ${ExitSuccess})\n\t\t{\n\t\t\tBreak\n\t\t}\n\t}\n\tIf (${Result} -ne ${ExitSuccess})\n\t{\n\t\tWrite-Host ${Output} -foreground Red\n\t}\n\tWrite-Host \"${TestDescription} (\" -nonewline\n\n\tIf (${Result} -ne ${ExitSuccess})\n\t{\n\t\tWrite-Host \"FAIL\" -foreground Red -nonewline\n\t}\n\tElse\n\t{\n\t\tWrite-Host \"PASS\" -foreground Green -nonewline\n\t}\n\tWrite-Host \")\"\n\n\tReturn ${Result}\n}\n\n$TestExecutablesDirectory = GetTestExecutablesDirectory\n\nIf (-Not (Test-Path ${TestExecutablesDirectory}))\n{\n\tWrite-Host \"Missing test executables directory.\" -foreground Red\n\n\tExit ${ExitFailure}\n}\n\n$Result = ${ExitIgnore}\n\nForeach (${TestName} in ${LibraryTests} -split \" \")\n{\n\t# Split will return an array of a single empty string when LibraryTests is empty.\n\tIf (-Not (${TestName}))\n\t{\n\t\tContinue\n\t}\n\t$Result = RunTest ${TestName}\n\n\tIf ((${Result} -ne ${ExitSuccess}) -And (${Result} -ne ${ExitIgnore}))\n\t{\n\t\tBreak\n\t}\n}\n\nForeach (${TestName} in ${LibraryTestsWithInput} -split \" \")\n{\n\t# Split will return an array of a single empty string when LibraryTestsWithInput is empty.\n\tIf (-Not (${TestName}))\n\t{\n\t\tContinue\n\t}\n\tIf (Test-Path -Path \"input\" -PathType \"Container\")\n\t{\n\t\t$Result = RunTestWithInput ${TestName}\n\t}\n\tElse\n\t{\n\t\t$Result = RunTest ${TestName}\n\t}\n\tIf ((${Result} -ne ${ExitSuccess}) -And (${Result} -ne ${ExitIgnore}))\n\t{\n\t\tBreak\n\t}\n}\n\nExit ${Result}\n\n" }, { "path": "tests/test_library.sh", "content": "#!/usr/bin/env bash\n# Tests library functions and types.\n#\n# Version: 20240413\n\nEXIT_SUCCESS=0;\nEXIT_FAILURE=1;\nEXIT_IGNORE=77;\n\nLIBRARY_TESTS=\"chunk chunks_table error io_handle notify record record_values template_definition\";\nLIBRARY_TESTS_WITH_INPUT=\"file support\";\nOPTION_SETS=();\n\nINPUT_GLOB=\"*\";\n\nrun_test()\n{\n\tlocal TEST_NAME=$1;\n\n\tlocal TEST_DESCRIPTION=\"Testing: ${TEST_NAME}\";\n\tlocal TEST_EXECUTABLE=\"./evtx_test_${TEST_NAME}\";\n\n\tif ! test -x \"${TEST_EXECUTABLE}\";\n\tthen\n\t\tTEST_EXECUTABLE=\"${TEST_EXECUTABLE}.exe\";\n\tfi\n\n\t# TODO: add support for TEST_PROFILE and OPTION_SETS?\n\trun_test_with_arguments \"${TEST_DESCRIPTION}\" \"${TEST_EXECUTABLE}\";\n\tlocal RESULT=$?;\n\n\treturn ${RESULT};\n}\n\nrun_test_with_input()\n{\n\tlocal TEST_NAME=$1;\n\n\tlocal TEST_DESCRIPTION=\"Testing: ${TEST_NAME}\";\n\tlocal TEST_EXECUTABLE=\"./evtx_test_${TEST_NAME}\";\n\n\tif ! test -x \"${TEST_EXECUTABLE}\";\n\tthen\n\t\tTEST_EXECUTABLE=\"${TEST_EXECUTABLE}.exe\";\n\tfi\n\n\tif ! test -d \"input\";\n\tthen\n\t\techo \"Test input directory not found.\";\n\n\t\treturn ${EXIT_IGNORE};\n\tfi\n\tlocal RESULT=`ls input/* | tr ' ' '\\n' | wc -l`;\n\n\tif test ${RESULT} -eq ${EXIT_SUCCESS};\n\tthen\n\t\techo \"No files or directories found in the test input directory\";\n\n\t\treturn ${EXIT_IGNORE};\n\tfi\n\n\tlocal TEST_PROFILE_DIRECTORY=$(get_test_profile_directory \"input\" \"libevtx\");\n\n\tlocal IGNORE_LIST=$(read_ignore_list \"${TEST_PROFILE_DIRECTORY}\");\n\n\tRESULT=${EXIT_SUCCESS};\n\n\tfor TEST_SET_INPUT_DIRECTORY in input/*;\n\tdo\n\t\tif ! test -d \"${TEST_SET_INPUT_DIRECTORY}\";\n\t\tthen\n\t\t\tcontinue;\n\t\tfi\n\t\tif check_for_directory_in_ignore_list \"${TEST_SET_INPUT_DIRECTORY}\" \"${IGNORE_LIST}\";\n\t\tthen\n\t\t\tcontinue;\n\t\tfi\n\n\t\tlocal TEST_SET_DIRECTORY=$(get_test_set_directory \"${TEST_PROFILE_DIRECTORY}\" \"${TEST_SET_INPUT_DIRECTORY}\");\n\n\t\tif test -f \"${TEST_SET_DIRECTORY}/files\";\n\t\tthen\n\t\t\tIFS=\"\" read -a INPUT_FILES <<< $(cat ${TEST_SET_DIRECTORY}/files | sed \"s?^?${TEST_SET_INPUT_DIRECTORY}/?\");\n\t\telse\n\t\t\tIFS=\"\" read -a INPUT_FILES <<< $(ls -1d ${TEST_SET_INPUT_DIRECTORY}/${INPUT_GLOB});\n\t\tfi\n\t\tfor INPUT_FILE in \"${INPUT_FILES[@]}\";\n\t\tdo\n\t\t\tOPTION_INPUT_FILE=\"${INPUT_FILE}\";\n\n\t\t\tif test \"${OSTYPE}\" = \"msys\";\n\t\t\tthen\n\t\t\t\t# A test executable built with MinGW expects a Windows path.\n\t\t\t\tINPUT_FILE=`echo ${INPUT_FILE} | sed 's?/?\\\\\\\\?g'`;\n\t\t\tfi\n\t\t\tlocal TESTED_WITH_OPTIONS=0;\n\n\t\t\tfor OPTION_SET in ${OPTION_SETS[@]};\n\t\t\tdo\n\t\t\t\tlocal TEST_DATA_OPTION_FILE=$(get_test_data_option_file \"${TEST_SET_DIRECTORY}\" \"${OPTION_INPUT_FILE}\" \"${OPTION_SET}\");\n\n\t\t\t\tif test -f ${TEST_DATA_OPTION_FILE};\n\t\t\t\tthen\n\t\t\t\t\tTESTED_WITH_OPTIONS=1;\n\n\t\t\t\t\tIFS=\" \" read -a OPTIONS <<< $(read_test_data_option_file \"${TEST_SET_DIRECTORY}\" \"${INPUT_FILE}\" \"${OPTION_SET}\");\n\n\t\t\t\t\trun_test_on_input_file \"${TEST_SET_DIRECTORY}\" \"${TEST_DESCRIPTION}\" \"default\" \"${OPTION_SET}\" \"${TEST_EXECUTABLE}\" \"${INPUT_FILE}\" \"${OPTIONS[@]}\";\n\t\t\t\t\tRESULT=$?;\n\n\t\t\t\t\tif test ${RESULT} -ne ${EXIT_SUCCESS};\n\t\t\t\t\tthen\n\t\t\t\t\t\tbreak;\n\t\t\t\t\tfi\n\t\t\t\tfi\n\t\t\tdone\n\n\t\t\tif test ${TESTED_WITH_OPTIONS} -eq 0;\n\t\t\tthen\n\t\t\t\trun_test_on_input_file \"${TEST_SET_DIRECTORY}\" \"${TEST_DESCRIPTION}\" \"default\" \"\" \"${TEST_EXECUTABLE}\" \"${INPUT_FILE}\";\n\t\t\t\tRESULT=$?;\n\t\t\tfi\n\n\t\t\tif test ${RESULT} -ne ${EXIT_SUCCESS};\n\t\t\tthen\n\t\t\t\tbreak;\n\t\t\tfi\n\t\tdone\n\n\t\tif test ${RESULT} -ne ${EXIT_SUCCESS};\n\t\tthen\n\t\t\tbreak;\n\t\tfi\n\tdone\n\n\treturn ${RESULT};\n}\n\nif test -n \"${SKIP_LIBRARY_TESTS}\";\nthen\n\texit ${EXIT_IGNORE};\nfi\n\nTEST_DIRECTORY=`dirname $0`;\n\nTEST_RUNNER=\"${TEST_DIRECTORY}/test_runner.sh\";\n\nif ! test -f \"${TEST_RUNNER}\";\nthen\n\techo \"Missing test runner: ${TEST_RUNNER}\";\n\n\texit ${EXIT_FAILURE};\nfi\n\nsource ${TEST_RUNNER};\n\nRESULT=${EXIT_IGNORE};\n\nfor TEST_NAME in ${LIBRARY_TESTS};\ndo\n\trun_test \"${TEST_NAME}\";\n\tRESULT=$?;\n\n\tif test ${RESULT} -ne ${EXIT_SUCCESS};\n\tthen\n\t\tbreak;\n\tfi\ndone\n\nif test ${RESULT} -ne ${EXIT_SUCCESS} && test ${RESULT} -ne ${EXIT_IGNORE};\nthen\n\texit ${RESULT};\nfi\n\nfor TEST_NAME in ${LIBRARY_TESTS_WITH_INPUT};\ndo\n\tif test -d \"input\";\n\tthen\n\t\trun_test_with_input \"${TEST_NAME}\";\n\t\tRESULT=$?;\n\telse\n\t\trun_test \"${TEST_NAME}\";\n\t\tRESULT=$?;\n\tfi\n\n\tif test ${RESULT} -ne ${EXIT_SUCCESS};\n\tthen\n\t\tbreak;\n\tfi\ndone\n\nexit ${RESULT};\n\n" }, { "path": "tests/test_manpage.sh", "content": "#!/usr/bin/env bash\n# Tests man pages.\n#\n# Version: 20240413\n\nEXIT_SUCCESS=0;\nEXIT_FAILURE=1;\nEXIT_IGNORE=77;\n\nrun_test()\n{\n\tlocal INPUT_FILE=$1;\n\tlocal RESULT=0\n\n\tTEST_NAME=`basename ${INPUT_FILE}`;\n\techo -n \"Testing man with input: ${TEST_NAME}\";\n\n\tLC_ALL=en_US.UTF-8 MANROFFSEQ='' MANWIDTH=80 man --warnings -E UTF-8 -l -Tutf8 -Z ${INPUT_FILE} > /dev/null 2> ${TMPDIR}/${TEST_NAME}.warnings;\n\tRESULT=$?;\n\n\t# For now line break warnings are ignored.\n\tif test -f ${TMPDIR}/${TEST_NAME}.warnings;\n\tthen\n\t\tsed \"/can't break line/ d\" -i ${TMPDIR}/${TEST_NAME}.warnings;\n\tfi\n\tif test -s ${TMPDIR}/${TEST_NAME}.warnings;\n\tthen\n\t\tRESULT=${EXIT_FAILURE};\n\tfi\n\tif test ${RESULT} -ne ${EXIT_SUCCESS};\n\tthen\n\t\techo \" (FAIL)\";\n\telse\n\t\techo \" (PASS)\";\n\tfi\n\tif test -s ${TMPDIR}/${TEST_NAME}.warnings;\n\tthen\n\t\tcat ${TMPDIR}/${TEST_NAME}.warnings;\n\tfi\n\treturn ${RESULT};\n}\n\nif test \"${OSTYPE}\" = \"msys\";\nthen\n\texit ${EXIT_IGNORE};\nfi\n\nTEST_DIRECTORY=`dirname $0`;\n\nTEST_RUNNER=\"${TEST_DIRECTORY}/test_runner.sh\";\n\nif ! test -f \"${TEST_RUNNER}\";\nthen\n\techo \"Missing test runner: ${TEST_RUNNER}\";\n\n\texit ${EXIT_FAILURE};\nfi\n\nsource ${TEST_RUNNER};\n\nassert_availability_binary man;\n\nRESULT=${EXIT_IGNORE};\n\nTMPDIR=\"tmp$$\";\n\nrm -rf ${TMPDIR};\nmkdir ${TMPDIR};\n\nMANUALS_PATH=\"../manuals\";\n\nif ! test -d ${MANUALS_PATH};\nthen\n\tMANUALS_PATH=\"manuals\";\nfi\n\nif ! test -d ${MANUALS_PATH};\nthen\n\techo \"Manuals directory not found.\";\n\n\texit ${EXIT_IGNORE};\nfi\n\nfor INPUT_FILE in ${MANUALS_PATH}/*.[13];\ndo\n\trun_test \"${INPUT_FILE}\";\n\tRESULT=$?;\n\n\tif test ${RESULT} -ne ${EXIT_SUCCESS};\n\tthen\n\t\tbreak;\n\tfi\ndone\n\nrm -rf ${TMPDIR};\n\nexit ${RESULT};\n\n" }, { "path": "tests/test_python_module.sh", "content": "#!/usr/bin/env bash\n# Tests Python module functions and types.\n#\n# Version: 20240417\n\nEXIT_SUCCESS=0;\nEXIT_FAILURE=1;\nEXIT_NO_TESTS_RAN=5;\nEXIT_IGNORE=77;\n\nTEST_FUNCTIONS=\"support\";\nTEST_FUNCTIONS_WITH_INPUT=\"file\";\nOPTION_SETS=();\n\nTEST_TOOL_DIRECTORY=\".\";\nINPUT_GLOB=\"*\";\n\nLIBRARY_NAME=\"libevtx\";\nPYTHON_MODULE=\"pyevtx\";\n\ntest_python_function()\n{\n\tlocal TEST_FUNCTION=$1;\n\n\tlocal TEST_DESCRIPTION=\"Testing Python-bindings functions: ${TEST_FUNCTION}\";\n\tlocal TEST_SCRIPT=\"${TEST_TOOL_DIRECTORY}/${PYTHON_MODULE}_test_${TEST_FUNCTION}.py\";\n\n\trun_test_with_arguments \"${TEST_DESCRIPTION}\" \"${TEST_SCRIPT}\";\n\tlocal RESULT=$?;\n\n\treturn ${RESULT};\n}\n\ntest_python_function_with_input()\n{\n\tlocal TEST_FUNCTION=$1;\n\n\tlocal TEST_DESCRIPTION=\"Testing Python-bindings functions: ${TEST_FUNCTION}\";\n\tlocal TEST_SCRIPT=\"${TEST_TOOL_DIRECTORY}/${PYTHON_MODULE}_test_${TEST_FUNCTION}.py\";\n\n\tif ! test -d \"input\";\n\tthen\n\t\techo \"Test input directory not found.\";\n\n\t\treturn ${EXIT_IGNORE};\n\tfi\n\tlocal RESULT=`ls input/* | tr ' ' '\\n' | wc -l`;\n\n\tif test ${RESULT} -eq ${EXIT_SUCCESS};\n\tthen\n\t\techo \"No files or directories found in the test input directory\";\n\n\t\treturn ${EXIT_IGNORE};\n\tfi\n\n\tlocal TEST_PROFILE_DIRECTORY=$(get_test_profile_directory \"input\" \"${PYTHON_MODULE}\");\n\n\tlocal IGNORE_LIST=$(read_ignore_list \"${TEST_PROFILE_DIRECTORY}\");\n\n\tRESULT=${EXIT_SUCCESS};\n\n\tfor TEST_SET_INPUT_DIRECTORY in input/*;\n\tdo\n\t\tif ! test -d \"${TEST_SET_INPUT_DIRECTORY}\";\n\t\tthen\n\t\t\tcontinue;\n\t\tfi\n\t\tif check_for_directory_in_ignore_list \"${TEST_SET_INPUT_DIRECTORY}\" \"${IGNORE_LIST}\";\n\t\tthen\n\t\t\tcontinue;\n\t\tfi\n\n\t\tlocal TEST_SET_DIRECTORY=$(get_test_set_directory \"${TEST_PROFILE_DIRECTORY}\" \"${TEST_SET_INPUT_DIRECTORY}\");\n\n\t\tif test -f \"${TEST_SET_DIRECTORY}/files\";\n\t\tthen\n\t\t\tIFS=\"\" read -a INPUT_FILES <<< $(cat ${TEST_SET_DIRECTORY}/files | sed \"s?^?${TEST_SET_INPUT_DIRECTORY}/?\");\n\t\telse\n\t\t\tIFS=\"\" read -a INPUT_FILES <<< $(ls -1d ${TEST_SET_INPUT_DIRECTORY}/${INPUT_GLOB});\n\t\tfi\n\t\tfor INPUT_FILE in \"${INPUT_FILES[@]}\";\n\t\tdo\n\t\t\tlocal TESTED_WITH_OPTIONS=0;\n\n\t\t\tfor OPTION_SET in ${OPTION_SETS[@]};\n\t\t\tdo\n\t\t\t\tlocal TEST_DATA_OPTION_FILE=$(get_test_data_option_file \"${TEST_SET_DIRECTORY}\" \"${INPUT_FILE}\" \"${OPTION_SET}\");\n\n\t\t\t\tif test -f ${TEST_DATA_OPTION_FILE};\n\t\t\t\tthen\n\t\t\t\t\tTESTED_WITH_OPTIONS=1;\n\n\t\t\t\t\tIFS=\" \" read -a OPTIONS <<< $(read_test_data_option_file \"${TEST_SET_DIRECTORY}\" \"${INPUT_FILE}\" \"${OPTION_SET}\");\n\n\t\t\t\t\trun_test_on_input_file \"${TEST_SET_DIRECTORY}\" \"${TEST_DESCRIPTION}\" \"default\" \"${OPTION_SET}\" \"${TEST_SCRIPT}\" \"${INPUT_FILE}\" \"${OPTIONS[@]}\";\n\t\t\t\t\tRESULT=$?;\n\n\t\t\t\t\tif test ${RESULT} -ne ${EXIT_SUCCESS};\n\t\t\t\t\tthen\n\t\t\t\t\t\tbreak;\n\t\t\t\t\tfi\n\t\t\t\tfi\n\t\t\tdone\n\n\t\t\tif test ${TESTED_WITH_OPTIONS} -eq 0;\n\t\t\tthen\n\t\t\t\trun_test_on_input_file \"${TEST_SET_DIRECTORY}\" \"${TEST_DESCRIPTION}\" \"default\" \"\" \"${TEST_SCRIPT}\" \"${INPUT_FILE}\";\n\t\t\t\tRESULT=$?;\n\t\t\tfi\n\n\t\t\tif test ${RESULT} -ne ${EXIT_SUCCESS};\n\t\t\tthen\n\t\t\t\tbreak;\n\t\t\tfi\n\t\tdone\n\n\t\tif test ${RESULT} -ne ${EXIT_SUCCESS};\n\t\tthen\n\t\t\tbreak;\n\t\tfi\n\tdone\n\n\treturn ${RESULT};\n}\n\nif test -n \"${SKIP_PYTHON_TESTS}\";\nthen\n\texit ${EXIT_IGNORE};\nfi\n\nTEST_DIRECTORY=`dirname $0`;\n\nTEST_RUNNER=\"${TEST_DIRECTORY}/test_runner.sh\";\n\nif ! test -f \"${TEST_RUNNER}\";\nthen\n\techo \"Missing test runner: ${TEST_RUNNER}\";\n\n\texit ${EXIT_FAILURE};\nfi\n\nsource ${TEST_RUNNER};\n\nPLATFORM=`uname -s | sed 's/-.*$//'`;\n\nif test \"${PLATFORM}\" = \"MINGW64_NT\" || test \"${PLATFORM}\" = \"MSYS_NT\";\nthen\n\tcp ../${LIBRARY_NAME}/.libs/*.dll ../${PYTHON_MODULE}/.libs/;\n\tcp ../${PYTHON_MODULE}/.libs/${PYTHON_MODULE}.dll ../${PYTHON_MODULE}/.libs/${PYTHON_MODULE}.pyd;\nfi\n\nRESULT=${EXIT_IGNORE};\n\nfor TEST_FUNCTION in ${TEST_FUNCTIONS};\ndo\n\ttest_python_function \"${TEST_FUNCTION}\";\n\tRESULT=$?;\n\n\tif test ${RESULT} -eq ${EXIT_NO_TESTS_RAN};\n\tthen\n\t\tRESULT=${EXIT_IGNORE};\n\tfi\n\tif test ${RESULT} -ne ${EXIT_SUCCESS} && test ${RESULT} -ne ${EXIT_IGNORE};\n\tthen\n\t\tbreak;\n\tfi\ndone\n\nif test ${RESULT} -ne ${EXIT_SUCCESS} && test ${RESULT} -ne ${EXIT_IGNORE};\nthen\n\texit ${RESULT};\nfi\n\nfor TEST_FUNCTION in ${TEST_FUNCTIONS_WITH_INPUT};\ndo\n\tif test -d \"input\";\n\tthen\n\t\ttest_python_function_with_input \"${TEST_FUNCTION}\";\n\t\tRESULT=$?;\n\telse\n\t\ttest_python_function \"${TEST_FUNCTION}\";\n\t\tRESULT=$?;\n\tfi\n\tif test ${RESULT} -eq ${EXIT_NO_TESTS_RAN};\n\tthen\n\t\tRESULT=${EXIT_IGNORE};\n\tfi\n\tif test ${RESULT} -ne ${EXIT_SUCCESS} && test ${RESULT} -ne ${EXIT_IGNORE};\n\tthen\n\t\tbreak;\n\tfi\ndone\n\nexit ${RESULT};\n\n" }, { "path": "tests/test_runner.sh", "content": "#!/usr/bin/env bash\n# Bash functions to run an executable for testing.\n#\n# Version: 20231119\n#\n# When CHECK_WITH_ASAN is set to a non-empty value the test executable\n# is run with asan, otherwise it is run without.\n#\n# When CHECK_WITH_GDB is set to a non-empty value the test executable\n# is run with gdb, otherwise it is run without.\n#\n# When CHECK_WITH_STDERR is set to a non-empty value the test executable\n# is run with error output to stderr.\n#\n# When CHECK_WITH_VALGRIND is set to a non-empty value the test executable\n# is run with valgrind, otherwise it is run without.\n#\n# PYTHON is used to determine the Python interpreter.\n\nEXIT_SUCCESS=0;\nEXIT_FAILURE=1;\nEXIT_IGNORE=77;\n\n# Checks the availability of a binary and exits if not available.\n#\n# Arguments:\n# a string containing the name of the binary\n#\nassert_availability_binary()\n{\n\tlocal BINARY=$1;\n\n\twhich ${BINARY} > /dev/null 2>&1;\n\tif test $? -ne ${EXIT_SUCCESS};\n\tthen\n\t\techo \"Missing binary: ${BINARY}\";\n\t\techo \"\";\n\n\t\texit ${EXIT_FAILURE};\n\tfi\n}\n\n# Checks the availability of binaries and exits if not available.\n#\n# Globals:\n# CHECK_WITH_GDB\n# CHECK_WITH_VALGRIND\n#\nassert_availability_binaries()\n{\n\tassert_availability_binary cat;\n\tassert_availability_binary cut;\n\tassert_availability_binary diff;\n\tassert_availability_binary file;\n\tassert_availability_binary gzip;\n\tassert_availability_binary ls;\n\tassert_availability_binary readlink;\n\tassert_availability_binary sed;\n\tassert_availability_binary tr;\n\tassert_availability_binary uname;\n\tassert_availability_binary wc;\n\tassert_availability_binary zcat;\n\n\tif test -n \"${CHECK_WITH_GDB}\";\n\tthen\n\t\tassert_availability_binary gdb;\n\n\telif test -n \"${CHECK_WITH_VALGRIND}\";\n\tthen\n\t\tassert_availability_binary valgrind;\n\tfi\n}\n\n# Checks if the test set is in the ignore list.\n#\n# Arguments:\n# a string containing the test set\n# a string containing space separated ignore list\n#\n# Returns:\n# an integer containing the exit status to indicate the input directory\n# was found in the ignore list.\n#\ncheck_for_test_set_in_ignore_list()\n{\n\tlocal TEST_SET=$1;\n\tlocal IGNORE_LIST=$2;\n\n\tlocal IFS=\" \";\n\n\tfor LIST_ELEMENT in ${IGNORE_LIST};\n\tdo\n\t\tif test \"${LIST_ELEMENT}\" = \"${TEST_SET}\";\n\t\tthen\n\t\t\treturn ${EXIT_SUCCESS};\n\t\tfi\n\tdone\n\treturn ${EXIT_FAILURE};\n}\n\n# Checks if the input directory is in the ignore list.\n#\n# Arguments:\n# a string containing the path of the test input directory\n# a string containing space separated ignore list\n#\n# Returns:\n# an integer containing the exit status to indicate the input directory\n# was found in the ignore list.\n#\ncheck_for_directory_in_ignore_list()\n{\n\tlocal INPUT_DIRECTORY=$1;\n\tlocal IGNORE_LIST=$2;\n\n\tlocal INPUT_BASENAME=`basename ${INPUT_DIRECTORY}`;\n\n\tlocal IFS=\" \";\n\n\tfor LIST_ELEMENT in ${IGNORE_LIST};\n\tdo\n\t\tif test \"${LIST_ELEMENT}\" = \"${INPUT_BASENAME}\";\n\t\tthen\n\t\t\treturn ${EXIT_SUCCESS};\n\t\tfi\n\tdone\n\treturn ${EXIT_FAILURE};\n}\n\n# Searches for the binary variant of the executable in case the test executable\n# refers to a libtool shell script.\n#\n# Arguments:\n# a string containing the path of the test executable\n#\n# Returns:\n# a string containing the path of the binary variant of the test executable\n#\nfind_binary_executable()\n{\n\tlocal TEST_EXECUTABLE=$1;\n\n\tTEST_EXECUTABLE=$( readlink_f \"${TEST_EXECUTABLE}\" );\n\n\t# Note that the behavior of `file -bi` is not helpful on Mac OS X.\n\tlocal EXECUTABLE_TYPE=`file -b ${TEST_EXECUTABLE}`;\n\n\t# Check if the test executable is a libtool shell script.\n\t# Linux: POSIX shell script, ASCII text executable, with very long lines\n\t# Mac OS X: POSIX shell script text executable\n\techo \"${EXECUTABLE_TYPE}\" | grep \"POSIX shell script\" > /dev/null 2>&1;\n\tRESULT=$?;\n\n\tif test ${RESULT} -eq ${EXIT_SUCCESS};\n\tthen\n\t\tlocal TEST_EXECUTABLE_BASENAME=`basename ${TEST_EXECUTABLE}`;\n\t\tlocal TEST_EXECUTABLE_DIRNAME=`dirname ${TEST_EXECUTABLE}`;\n\n\t\tTEST_EXECUTABLE=\"${TEST_EXECUTABLE_DIRNAME}/.libs/${TEST_EXECUTABLE_BASENAME}\";\n\n\t\tif test -x ${TEST_EXECUTABLE};\n\t\tthen\n\t\t\t# Note that the behavior of `file -bi` is not helpful on Mac OS X.\n\t\t\tEXECUTABLE_TYPE=`file -b ${TEST_EXECUTABLE}`;\n\n\t\t\t# Linux: ELF 64-bit LSB executable, x86-64, ...\n\t\t\t# Mac OS X: Mach-O 64-bit executable x86_64\n\t\t\techo \"${EXECUTABLE_TYPE}\" | grep \"executable\" > /dev/null 2>&1;\n\t\t\tRESULT=$?;\n\n\t\t\tif test ${RESULT} -ne ${EXIT_SUCCESS};\n\t\t\tthen\n\t\t\t\techo \"Invalid test executable: ${TEST_EXECUTABLE}\";\n\n\t\t\t\texit ${EXIT_FAILURE};\n\t\t\tfi\n\t\tfi\n\tfi\n\techo ${TEST_EXECUTABLE};\n}\n\n# Searches for the path to the binary variant of the library.\n#\n# Arguments:\n# a string containing the path of the test executable\n#\n# Returns:\n# a string containing the path of the binary variant of the library.\n#\nfind_binary_library_path()\n{\n\tlocal TEST_EXECUTABLE=$1;\n\tlocal LIBRARY_NAME=`dirname ${TEST_EXECUTABLE}`;\n\n\tlocal NAME=`basename ${LIBRARY_NAME}`;\n\n\tif test ${NAME} = \".libs\";\n\tthen\n\t\tLIBRARY_NAME=`dirname ${LIBRARY_NAME}`;\n\t\tNAME=`basename ${LIBRARY_NAME}`;\n\tfi\n\tif test ${NAME} = \"tests\";\n\tthen\n\t\tLIBRARY_NAME=`dirname ${LIBRARY_NAME}`;\n\t\tNAME=`basename ${LIBRARY_NAME}`;\n\tfi\n\techo ${LIBRARY_NAME} | grep 'tools' > /dev/null 2>&1;\n\n\tif test $? -eq ${EXIT_SUCCESS};\n\tthen\n\t\tLIBRARY_NAME=`basename ${LIBRARY_NAME} | sed 's/\\(.*\\)tools$/lib\\1/'`;\n\telse\n\t\tLIBRARY_NAME=`basename ${LIBRARY_NAME} | sed 's/^py//' | sed 's/^\\([^_]*\\)_test_.*$/lib\\1/'`;\n\tfi\n\tTEST_EXECUTABLE=`dirname ${TEST_EXECUTABLE}`;\n\tTEST_EXECUTABLE=`dirname ${TEST_EXECUTABLE}`;\n\tTEST_EXECUTABLE=`dirname ${TEST_EXECUTABLE}`;\n\n\tlocal LIBRARY_PATH=\"${TEST_EXECUTABLE}/${LIBRARY_NAME}/.libs\";\n\n\tif ! test -d \"${LIBRARY_PATH}\";\n\tthen\n\t\tLIBRARY_PATH=\"../${LIBRARY_NAME}/.libs\";\n\tfi\n\techo \"${LIBRARY_PATH}\";\n}\n\n# Searches for the path to the binary variant of the Python module\n#\n# Arguments:\n# a string containing the path of the test executable\n#\n# Returns:\n# a string containing the path of the binary variant of the Python module\n#\nfind_binary_python_module_path()\n{\n\tlocal TEST_EXECUTABLE=$1;\n\n\tlocal PYTHON_MODULE_NAME=`basename ${TEST_EXECUTABLE} | sed 's/^py\\(.*\\)_test_.*$/py\\1/'`;\n\n\tTEST_EXECUTABLE=`dirname ${TEST_EXECUTABLE}`;\n\tTEST_EXECUTABLE=`dirname ${TEST_EXECUTABLE}`;\n\tTEST_EXECUTABLE=`dirname ${TEST_EXECUTABLE}`;\n\n\tlocal PYTHON_MODULE_PATH=\"${TEST_EXECUTABLE}/${PYTHON_MODULE_NAME}/.libs\";\n\n\tif ! test -d \"${PYTHON_MODULE_PATH}\";\n\tthen\n\t\tPYTHON_MODULE_PATH=\"../${PYTHON_MODULE_NAME}/.libs\";\n\tfi\n\techo \"${PYTHON_MODULE_PATH}\";\n}\n\n# Determines the test data option file.\n#\n# Arguments:\n# a string containing the path of the test set directory\n# a string containing the path of the test input file\n# a string containing the name of the test data option set\n#\n# Returns:\n# a string containing the test input files\n#\nget_test_data_option_file()\n{\n\tlocal TEST_SET_DIRECTORY=$1;\n\tlocal INPUT_FILE=$2;\n\tlocal OPTION_SET=$3;\n\n\tlocal INPUT_NAME=`basename \"${INPUT_FILE}\"`;\n\tlocal TEST_DATA_OPTION_FILE=\"${TEST_SET_DIRECTORY}/${INPUT_NAME}.${OPTION_SET}\";\n\n\techo \"${TEST_DATA_OPTION_FILE}\";\n}\n\n# Determines the test profile directory.\n# The directory is created if it does not exist.\n#\n# Arguments:\n# a string containing the path of the test input directory\n# a string containing the name of the test profile\n#\n# Returns:\n# a string containing the path of the test profile directory\n#\nget_test_profile_directory()\n{\n\tlocal TEST_INPUT_DIRECTORY=$1;\n\tlocal TEST_PROFILE=$2;\n\n\tlocal TEST_PROFILE_DIRECTORY=\"${TEST_INPUT_DIRECTORY}/.${TEST_PROFILE}\";\n\n\tif ! test -d \"${TEST_PROFILE_DIRECTORY}\";\n\tthen\n\t\tmkdir \"${TEST_PROFILE_DIRECTORY}\";\n\tfi\n\techo \"${TEST_PROFILE_DIRECTORY}\";\n}\n\n# Determines the test set directory.\n# The directory is created if it does not exist.\n#\n# Arguments:\n# a string containing the path of the test profile directory\n# a string containing the path of the test set input directory\n#\n# Returns:\n# a string containing the path of the test set directory\n#\nget_test_set_directory()\n{\n\tlocal TEST_PROFILE_DIRECTORY=$1;\n\tlocal TEST_SET_INPUT_DIRECTORY=$2;\n\n\tlocal TEST_SET=`basename ${TEST_SET_INPUT_DIRECTORY}`;\n\tlocal TEST_SET_DIRECTORY=\"${TEST_PROFILE_DIRECTORY}/${TEST_SET}\";\n\n\tif ! test -d \"${TEST_SET_DIRECTORY}\";\n\tthen\n\t\tmkdir \"${TEST_SET_DIRECTORY}\";\n\tfi\n\techo \"${TEST_SET_DIRECTORY}\";\n}\n\n# Provides a cross-platform variant of \"readlink -f\"\n#\n# Arguments:\n# a string containing a path\n#\n# Returns:\n# a string containing the path with all symbolic links resolved\n#\nreadlink_f() {\n\tlocal TARGET=\"$1\"\n\n\tif test -f \"${TARGET}\";\n\tthen\n\t\twhile test -L \"${TARGET}\";\n\t\tdo\n\t\t\tTARGET=`readlink \"${TARGET}\"`;\n\t\tdone\n\tfi\n\tlocal BASENAME=`basename \"${TARGET}\"`;\n\tlocal DIRNAME=`dirname \"${TARGET}\"`;\n\n\tDIRNAME=`(cd \"${DIRNAME}\" && pwd -P)`;\n\n\techo \"${DIRNAME}/${BASENAME}\";\n}\n\n# Reads the test profile ignore file if it exists.\n#\n# Arguments:\n# a string containing the path of the test profile directory\n#\n# Returns:\n# a string containing a space separated ignore list\n#\nread_ignore_list()\n{\n\tlocal TEST_PROFILE_DIRECTORY=$1;\n\tlocal IGNORE_FILE=\"${TEST_PROFILE_DIRECTORY}/ignore\";\n\tlocal IGNORE_LIST=\"\";\n\n\tif test -f \"${IGNORE_FILE}\";\n\tthen\n\t\tIGNORE_LIST=`cat ${IGNORE_FILE} | sed '/^#/d' | tr '\\n' ' '`;\n\tfi\n\techo ${IGNORE_LIST};\n}\n\n# Reads a test data option file.\n#\n# Arguments:\n# a string containing the path of the test set directory\n# a string containing the path of the test input file\n# a string containing the name of the test data option set\n#\n# Returns:\n# a string containing the test data specific options\n#\nread_test_data_option_file()\n{\n\tlocal TEST_SET_DIRECTORY=$1;\n\tlocal INPUT_FILE=$2;\n\tlocal OPTION_SET=$3;\n\n\tlocal TEST_DATA_OPTION_FILE=\"${INPUT_FILE}.${OPTION_SET}\";\n\n\tif ! test -f \"${TEST_DATA_OPTION_FILE}\";\n\tthen\n\t\tTEST_DATA_OPTION_FILE=$(get_test_data_option_file \"${TEST_SET_DIRECTORY}\" \"${INPUT_FILE}\" \"${OPTION_SET}\");\n\tfi\n\n\tlocal OPTIONS_STRING=`head -n 1 \"${TEST_DATA_OPTION_FILE}\" | sed 's/[\\r\\n]*$//'`;\n\n\tif test \"${OPTIONS_STRING}\" = \"# libyal test data options\";\n\tthen\n\t\tOPTIONS_STRING=`tail -n +2 \"${TEST_DATA_OPTION_FILE}\" | sed 's/^offset=/-o/;s/^password=/-p/;s/^recovery_password=/-r/;s/^startup_key=/-s/;s/virtual_address=/-v/' | tr '\\n' ' '`;\n\tfi\n\techo \"${OPTIONS_STRING}\";\n}\n\n# Runs the test with optional arguments.\n#\n# Globals:\n# CHECK_WITH_ASAN\n# CHECK_WITH_GDB\n# CHECK_WITH_STDERR\n# CHECK_WITH_VALGRIND\n#\n# Arguments:\n# a string containing the test description\n# a string containing the path of the test executable\n# an array containing the arguments for the test executable\n#\n# Returns:\n# an integer containg the exit status of the test executable\n#\nrun_test_with_arguments()\n{\n\tlocal TEST_DESCRIPTION=$1;\n\tlocal TEST_EXECUTABLE=$2;\n\tshift 2;\n\tlocal ARGUMENTS=(\"$@\");\n\n\tif ! test -f \"${TEST_EXECUTABLE}\";\n\tthen\n\t\techo \"Missing test executable: ${TEST_EXECUTABLE}\";\n\t\techo \"\";\n\n\t\treturn ${EXIT_FAILURE};\n\tfi\n\tlocal PLATFORM=`uname -s | sed 's/-.*$//'`;\n\n\t# Note that the behavior of `file -bi` is not helpful on Mac OS X.\n\tlocal EXECUTABLE_TYPE=`file -b ${TEST_EXECUTABLE}`;\n\n\t# Check if the test executable is a Python script.\n\t# Linux: Python script, ASCII text executable\n\t# Mac OS X: a python script text executable\n\techo \"${EXECUTABLE_TYPE}\" | grep -i \"python script\" > /dev/null 2>&1;\n\tlocal IS_PYTHON_SCRIPT=$?;\n\n\tif test ${IS_PYTHON_SCRIPT} -eq 0 && test -z ${PYTHON};\n\tthen\n\t\tlocal PYTHON=`which python 2> /dev/null`;\n\n\t\tif ! test -x ${PYTHON};\n\t\tthen\n\t\t\techo \"Missing executable: ${PYTHON}\";\n\n\t\t\texit ${EXIT_FAILURE};\n\t\tfi\n\tfi\n\tlocal RESULT=0;\n\n\tif test -n \"${CHECK_WITH_ASAN}\";\n\tthen\n\t\tlocal TEST_EXECUTABLE=$( find_binary_executable ${TEST_EXECUTABLE} );\n\t\tlocal LIBRARY_PATH=$( find_binary_library_path ${TEST_EXECUTABLE} );\n\t\tlocal PYTHON_MODULE_PATH=$( find_binary_python_module_path ${TEST_EXECUTABLE} );\n\n\t\tlocal LSAN_SUPPRESSIONS=\"lsan.suppressions\";\n\n\t\tif ! test -f ${LSAN_SUPPRESSIONS};\n\t\tthen\n\t\t\tLSAN_SUPPRESSIONS=\"../lsan.suppressions\";\n\t\tfi\n\t\tif test \"${PLATFORM}\" = \"Darwin\";\n\t\tthen\n\t\t\tif test ${IS_PYTHON_SCRIPT} -eq 0;\n\t\t\tthen\n\t\t\t\tLSAN_OPTIONS=suppressions=\"${LSAN_SUPPRESSIONS}\" DYLD_LIBRARY_PATH=\"${LIBRARY_PATH}\" PYTHONPATH=\"${PYTHON_MODULE_PATH}\" \"${PYTHON}\" \"${TEST_EXECUTABLE}\" ${ARGUMENTS[@]};\n\t\t\t\tRESULT=$?;\n\t\t\telse\n\t\t\t\tLSAN_OPTIONS=suppressions=\"${LSAN_SUPPRESSIONS}\" DYLD_LIBRARY_PATH=\"${LIBRARY_PATH}\" \"${TEST_EXECUTABLE}\" ${ARGUMENTS[@]};\n\t\t\t\tRESULT=$?;\n\t\t\tfi\n\t\telse\n\t\t\tlocal CONFIG_LOG=\"../config.log\";\n\n\t\t\tif ! test -f ${CONFIG_LOG};\n\t\t\tthen\n\t\t\t\tCONFIG_LOG=\"../../config.log\";\n\t\t\tfi\n\t\t\tlocal CC=`cat ${CONFIG_LOG} | grep -e \"^CC=\" | sed \"s/CC='\\\\(.*\\\\)'/\\1/\"`;\n\t\t\tlocal LIBASAN=\"\";\n\n\t\t\tif test -z ${CC} || test ${CC} != \"clang\";\n\t\t\tthen\n\t\t\t\tlocal LDCONFIG=`which ldconfig 2> /dev/null`;\n\n\t\t\t\tif test -z ${LDCONFIG} || ! test -x ${LDCONFIG};\n\t\t\t\tthen\n\t\t\t\t\tLDCONFIG=\"/sbin/ldconfig\";\n\t\t\t\tfi\n\t\t\t\tif test -z ${LDCONFIG} || ! test -x ${LDCONFIG};\n\t\t\t\tthen\n\t\t\t\t\techo \"Missing binary: ldconfig\";\n\t\t\t\t\techo \"\";\n\n\t\t\t\t\texit ${EXIT_FAILURE};\n\t\t\t\tfi\n\t\t\t\tLIBASAN=`${LDCONFIG} -p | grep libasan | sed 's/^.* => //' | sort | tail -n 1`;\n\n\t\t\t\tif ! test -f ${LIBASAN};\n\t\t\t\tthen\n\t\t\t\t\techo \"Missing library: ${BINARY}\";\n\t\t\t\t\techo \"\";\n\n\t\t\t\t\texit ${EXIT_FAILURE};\n\t\t\t\tfi\n\t\t\tfi\n\t\t\tif test ${IS_PYTHON_SCRIPT} -eq 0;\n\t\t\tthen\n\t\t\t\tLSAN_OPTIONS=suppressions=\"${LSAN_SUPPRESSIONS}\" LD_PRELOAD=\"${LIBASAN}\" LD_LIBRARY_PATH=\"${LIBRARY_PATH}\" PYTHONPATH=\"${PYTHON_MODULE_PATH}\" \"${PYTHON}\" \"${TEST_EXECUTABLE}\" ${ARGUMENTS[@]};\n\t\t\t\tRESULT=$?;\n\t\t\telse\n\t\t\t\tLSAN_OPTIONS=suppressions=\"${LSAN_SUPPRESSIONS}\" LD_PRELOAD=\"${LIBASAN}\" LD_LIBRARY_PATH=\"${LIBRARY_PATH}\" \"${TEST_EXECUTABLE}\" ${ARGUMENTS[@]};\n\t\t\t\tRESULT=$?;\n\t\t\tfi\n\t\tfi\n\n\telif test -n \"${CHECK_WITH_GDB}\";\n\tthen\n\t\tlocal TEST_EXECUTABLE=$( find_binary_executable ${TEST_EXECUTABLE} );\n\t\tlocal LIBRARY_PATH=$( find_binary_library_path ${TEST_EXECUTABLE} );\n\t\tlocal PYTHON_MODULE_PATH=$( find_binary_python_module_path ${TEST_EXECUTABLE} );\n\n\t\tif test \"${PLATFORM}\" = \"Darwin\";\n\t\tthen\n\t\t\tif test ${IS_PYTHON_SCRIPT} -eq 0;\n\t\t\tthen\n\t\t\t\tDYLD_LIBRARY_PATH=\"${LIBRARY_PATH}\" PYTHONPATH=\"${PYTHON_MODULE_PATH}\" gdb -ex \"set non-stop on\" -ex \"run\" -ex \"quit\" --args \"${PYTHON}\" \"${TEST_EXECUTABLE}\" ${ARGUMENTS[@]};\n\t\t\t\tRESULT=$?;\n\t\t\telse\n\t\t\t\tDYLD_LIBRARY_PATH=\"${LIBRARY_PATH}\" gdb -ex \"set non-stop on\" -ex \"run\" -ex \"quit\" --args \"${TEST_EXECUTABLE}\" ${ARGUMENTS[@]};\n\t\t\t\tRESULT=$?;\n\t\t\tfi\n\n\t\telif test \"${PLATFORM}\" = \"CYGWIN_NT\";\n\t\tthen\n\t\t\tif test ${IS_PYTHON_SCRIPT} -eq 0;\n\t\t\tthen\n\t\t\t\tPATH=\"${LIBRARY_PATH}:${PATH}\" PYTHONPATH=\"${PYTHON_MODULE_PATH}\" gdb -ex \"set non-stop on\" -ex \"run\" -ex \"quit\" --args \"${PYTHON}\" \"${TEST_EXECUTABLE}\" ${ARGUMENTS[@]};\n\t\t\t\tRESULT=$?;\n\t\t\telse\n\t\t\t\tPATH=\"${LIBRARY_PATH}:${PATH}\" gdb -ex \"set non-stop on\" -ex \"run\" -ex \"quit\" --args \"${TEST_EXECUTABLE}\" ${ARGUMENTS[@]};\n\t\t\t\tRESULT=$?;\n\t\t\tfi\n\n\t\telse\n\t\t\tif test ${IS_PYTHON_SCRIPT} -eq 0;\n\t\t\tthen\n\t\t\t\tLD_LIBRARY_PATH=\"${LIBRARY_PATH}\" PYTHONPATH=\"${PYTHON_MODULE_PATH}\" gdb -ex \"set non-stop on\" -ex \"run\" -ex \"quit\" --args \"${PYTHON}\" \"${TEST_EXECUTABLE}\" ${ARGUMENTS[@]};\n\t\t\t\tRESULT=$?;\n\t\t\telse\n\t\t\t\tLD_LIBRARY_PATH=\"${LIBRARY_PATH}\" gdb -ex \"set non-stop on\" -ex \"run\" -ex \"quit\" --args \"${TEST_EXECUTABLE}\" ${ARGUMENTS[@]};\n\t\t\t\tRESULT=$?;\n\t\t\tfi\n\t\tfi\n\n\telif test -n \"${CHECK_WITH_VALGRIND}\";\n\tthen\n\t\tlocal TEST_EXECUTABLE=$( find_binary_executable ${TEST_EXECUTABLE} );\n\t\tlocal LIBRARY_PATH=$( find_binary_library_path ${TEST_EXECUTABLE} );\n\t\tlocal PYTHON_MODULE_PATH=$( find_binary_python_module_path ${TEST_EXECUTABLE} );\n\n\t\tlocal VALGRIND_LOG=\"valgrind.log-$$\";\n\t\tlocal VALGRIND_OPTIONS=(\"--tool=memcheck\" \"--leak-check=full\" \"--show-leak-kinds=definite,indirect,possible\" \"--track-origins=yes\" \"--log-file=${VALGRIND_LOG}\");\n\n\t\tif test \"${PLATFORM}\" = \"Darwin\";\n\t\tthen\n\t\t\tif test ${IS_PYTHON_SCRIPT} -eq 0;\n\t\t\tthen\n\t\t\t\tDYLD_LIBRARY_PATH=\"${LIBRARY_PATH}\" PYTHONPATH=\"${PYTHON_MODULE_PATH}\" valgrind ${VALGRIND_OPTIONS[@]} \"${PYTHON}\" \"${TEST_EXECUTABLE}\" ${ARGUMENTS[@]};\n\t\t\t\tRESULT=$?;\n\t\t\telse\n\t\t\t\tDYLD_LIBRARY_PATH=\"${LIBRARY_PATH}\" valgrind ${VALGRIND_OPTIONS[@]} \"${TEST_EXECUTABLE}\" ${ARGUMENTS[@]};\n\t\t\t\tRESULT=$?;\n\t\t\tfi\n\n\t\telif test \"${PLATFORM}\" = \"CYGWIN_NT\";\n\t\tthen\n\t\t\tif test ${IS_PYTHON_SCRIPT} -eq 0;\n\t\t\tthen\n\t\t\t\tPATH=\"${LIBRARY_PATH}:${PATH}\" PYTHONPATH=\"${PYTHON_MODULE_PATH}\" valgrind ${VALGRIND_OPTIONS[@]} \"${PYTHON}\" \"${TEST_EXECUTABLE}\" ${ARGUMENTS[@]};\n\t\t\t\tRESULT=$?;\n\t\t\telse\n\t\t\t\tPATH=\"${LIBRARY_PATH}:${PATH}\" valgrind ${VALGRIND_OPTIONS[@]} \"${TEST_EXECUTABLE}\" ${ARGUMENTS[@]};\n\t\t\t\tRESULT=$?;\n\t\t\tfi\n\n\t\telse\n\t\t\tif test ${IS_PYTHON_SCRIPT} -eq 0;\n\t\t\tthen\n\t\t\t\tLD_LIBRARY_PATH=\"${LIBRARY_PATH}\" PYTHONPATH=\"${PYTHON_MODULE_PATH}\" valgrind ${VALGRIND_OPTIONS[@]} \"${PYTHON}\" \"${TEST_EXECUTABLE}\" ${ARGUMENTS[@]};\n\t\t\t\tRESULT=$?;\n\t\t\telse\n\t\t\t\tLD_LIBRARY_PATH=\"${LIBRARY_PATH}\" valgrind ${VALGRIND_OPTIONS[@]} \"${TEST_EXECUTABLE}\" ${ARGUMENTS[@]};\n\t\t\t\tRESULT=$?;\n\t\t\tfi\n\t\tfi\n\t\tif test ${RESULT} -eq ${EXIT_SUCCESS};\n\t\tthen\n\t\t\tgrep \"All heap blocks were freed -- no leaks are possible\" ${VALGRIND_LOG} > /dev/null 2>&1;\n\n\t\t\tif test $? -ne ${EXIT_SUCCESS};\n\t\t\tthen\n\t\t\t\t# Ignore \"still reachable\"\n\t\t\t\t# Also see: http://valgrind.org/docs/manual/faq.html#faq.deflost\n\n\t\t\t\tgrep \"definitely lost: 0 bytes in 0 blocks\" ${VALGRIND_LOG} > /dev/null 2>&1;\n\t\t\t\tRESULT_DIRECTLY_LOST=$?;\n\n\t\t\t\tgrep \"indirectly lost: 0 bytes in 0 blocks\" ${VALGRIND_LOG} > /dev/null 2>&1;\n\t\t\t\tRESULT_INDIRECTLY_LOST=$?;\n\n\t\t\t\tgrep \"possibly lost: 0 bytes in 0 blocks\" ${VALGRIND_LOG} > /dev/null 2>&1;\n\t\t\t\tRESULT_POSSIBLY_LOST=$?;\n\n\t\t\t\tgrep \"suppressed: 0 bytes in 0 blocks\" ${VALGRIND_LOG} > /dev/null 2>&1;\n\t\t\t\tRESULT_SUPPRESSED=$?;\n\n\t\t\t\tif test ${RESULT_DIRECTLY_LOST} -ne ${EXIT_SUCCESS} || test ${RESULT_INDIRECTLY_LOST} -ne ${EXIT_SUCCESS} || test ${RESULT_POSSIBLY_LOST} -ne ${EXIT_SUCCESS} || test ${RESULT_SUPPRESSED} -ne ${EXIT_SUCCESS};\n\t\t\t\tthen\n\t\t\t\t\techo \"Memory leakage detected.\";\n\t\t\t\t\tcat ${VALGRIND_LOG};\n\n\t\t\t\t\tRESULT=${EXIT_FAILURE};\n\t\t\t\tfi\n\t\t\tfi\n\t\t\t# Detect valgrind warnings.\n\t\t\tlocal NUMBER_OF_LINES=`wc -l ${VALGRIND_LOG} | awk '{ print $1 }'`;\n\n\t\t\tif test ${NUMBER_OF_LINES} -ne 15 && test ${NUMBER_OF_LINES} -ne 22;\n\t\t\tthen\n\t\t\t\techo \"Unsupported number of lines: ${NUMBER_OF_LINES}\";\n\t\t\t\tcat ${VALGRIND_LOG};\n\n\t\t\t\tRESULT=${EXIT_FAILURE};\n\t\t\tfi\n\t\tfi\n\t\trm -f ${VALGRIND_LOG};\n\n\telif test ${IS_PYTHON_SCRIPT} -eq 0;\n\tthen\n\t\tif ! test -f \"${TEST_EXECUTABLE}\";\n\t\tthen\n\t\t\techo \"Invalid test Python script: ${TEST_EXECUTABLE}\";\n\t\t\techo \"\";\n\n\t\t\treturn ${EXIT_FAILURE};\n\t\tfi\n\t\tlocal TEST_EXECUTABLE=$( find_binary_executable ${TEST_EXECUTABLE} );\n\t\tlocal LIBRARY_PATH=$( find_binary_library_path ${TEST_EXECUTABLE} );\n\t\tlocal PYTHON_MODULE_PATH=$( find_binary_python_module_path ${TEST_EXECUTABLE} );\n\n\t\tif test \"${PLATFORM}\" = \"Darwin\";\n\t\tthen\n\t\t\tif test -n \"${CHECK_WITH_STDERR}\";\n\t\t\tthen\n\t\t\t\tDYLD_LIBRARY_PATH=\"${LIBRARY_PATH}\" PYTHONPATH=\"${PYTHON_MODULE_PATH}\" \"${PYTHON}\" \"${TEST_EXECUTABLE}\" ${ARGUMENTS[@]};\n\t\t\t\tRESULT=$?;\n\t\t\telse\n\t\t\t\tDYLD_LIBRARY_PATH=\"${LIBRARY_PATH}\" PYTHONPATH=\"${PYTHON_MODULE_PATH}\" \"${PYTHON}\" \"${TEST_EXECUTABLE}\" ${ARGUMENTS[@]} 2> /dev/null;\n\t\t\t\tRESULT=$?;\n\t\t\tfi\n\n\t\telif test \"${PLATFORM}\" = \"CYGWIN_NT\";\n\t\tthen\n\t\t\tif test -n \"${CHECK_WITH_STDERR}\";\n\t\t\tthen\n\t\t\t\tPATH=\"${LIBRARY_PATH}:${PATH}\" PYTHONPATH=\"${PYTHON_MODULE_PATH}\" \"${PYTHON}\" \"${TEST_EXECUTABLE}\" ${ARGUMENTS[@]};\n\t\t\t\tRESULT=$?;\n\t\t\telse\n\t\t\t\tPATH=\"${LIBRARY_PATH}:${PATH}\" PYTHONPATH=\"${PYTHON_MODULE_PATH}\" \"${PYTHON}\" \"${TEST_EXECUTABLE}\" ${ARGUMENTS[@]} 2> /dev/null;\n\t\t\t\tRESULT=$?;\n\t\t\tfi\n\n\t\telse\n\t\t\tif test -n \"${CHECK_WITH_STDERR}\";\n\t\t\tthen\n\t\t\t\tLD_LIBRARY_PATH=\"${LIBRARY_PATH}\" PYTHONPATH=\"${PYTHON_MODULE_PATH}\" \"${PYTHON}\" \"${TEST_EXECUTABLE}\" ${ARGUMENTS[@]};\n\t\t\t\tRESULT=$?;\n\t\t\telse\n\t\t\t\tLD_LIBRARY_PATH=\"${LIBRARY_PATH}\" PYTHONPATH=\"${PYTHON_MODULE_PATH}\" \"${PYTHON}\" \"${TEST_EXECUTABLE}\" ${ARGUMENTS[@]} 2> /dev/null;\n\t\t\t\tRESULT=$?;\n\t\t\tfi\n\t\tfi\n\telse\n\t\tif ! test -x \"${TEST_EXECUTABLE}\";\n\t\tthen\n\t\t\techo \"Invalid test executable: ${TEST_EXECUTABLE}\";\n\t\t\techo \"\";\n\n\t\t\treturn ${EXIT_FAILURE};\n\t\tfi\n\n\t\tif test -n \"${CHECK_WITH_STDERR}\";\n\t\tthen\n\t\t\t${TEST_EXECUTABLE} ${ARGUMENTS[@]};\n\t\t\tRESULT=$?;\n\t\telse\n\t\t\t${TEST_EXECUTABLE} ${ARGUMENTS[@]} 2> /dev/null;\n\t\t\tRESULT=$?;\n\t\tfi\n\tfi\n\tif test -n \"${TEST_DESCRIPTION}\";\n\tthen\n\t\techo -n \"${TEST_DESCRIPTION}\";\n\n\t\tif test ${RESULT} -ne ${EXIT_SUCCESS};\n\t\tthen\n\t\t\techo \" (FAIL)\";\n\t\telse\n\t\t\techo \" (PASS)\";\n\t\tfi\n\tfi\n\treturn ${RESULT};\n}\n\n# Runs the test with an input file and optional arguments.\n#\n# Globals:\n# CHECK_WITH_ASAN\n# CHECK_WITH_GDB\n# CHECK_WITH_STDERR\n# CHECK_WITH_VALGRIND\n#\n# Arguments:\n# a string containing the path of the test executable\n# a string containing the path of the test input file\n# an array containing the arguments for the test executable\n#\n# Returns:\n# an integer containg the exit status of the test executable\n#\nrun_test_with_input_and_arguments()\n{\n\tlocal TEST_EXECUTABLE=$1;\n\tlocal INPUT_FILE=$2;\n\tshift 2;\n\tlocal ARGUMENTS=(\"$@\");\n\n\tif ! test -f \"${TEST_EXECUTABLE}\";\n\tthen\n\t\techo \"Missing test executable: ${TEST_EXECUTABLE}\";\n\t\techo \"\";\n\n\t\treturn ${EXIT_FAILURE};\n\tfi\n\tlocal PLATFORM=`uname -s | sed 's/-.*$//'`;\n\n\t# Note that the behavior of `file -bi` is not helpful on Mac OS X.\n\tlocal EXECUTABLE_TYPE=`file -b ${TEST_EXECUTABLE}`;\n\n\t# Check if the test executable is a Python script.\n\t# Linux: Python script, ASCII text executable\n\t# Mac OS X: a python script text executable\n\techo \"${EXECUTABLE_TYPE}\" | grep -i \"python script\" > /dev/null 2>&1;\n\tlocal IS_PYTHON_SCRIPT=$?;\n\n\tif test ${IS_PYTHON_SCRIPT} -eq 0 && test -z ${PYTHON};\n\tthen\n\t\tlocal PYTHON=`which python 2> /dev/null`;\n\n\t\tif ! test -x ${PYTHON};\n\t\tthen\n\t\t\techo \"Missing executable: ${PYTHON}\";\n\n\t\t\texit ${EXIT_FAILURE};\n\t\tfi\n\tfi\n\tlocal RESULT=0;\n\n\tif test -n \"${CHECK_WITH_ASAN}\";\n\tthen\n\t\tlocal TEST_EXECUTABLE=$( find_binary_executable ${TEST_EXECUTABLE} );\n\t\tlocal LIBRARY_PATH=$( find_binary_library_path ${TEST_EXECUTABLE} );\n\t\tlocal PYTHON_MODULE_PATH=$( find_binary_python_module_path ${TEST_EXECUTABLE} );\n\n\t\tlocal LSAN_SUPPRESSIONS=\"lsan.suppressions\";\n\n\t\tif ! test -f ${LSAN_SUPPRESSIONS};\n\t\tthen\n\t\t\tLSAN_SUPPRESSIONS=\"../lsan.suppressions\";\n\t\tfi\n\t\tif test \"${PLATFORM}\" = \"Darwin\";\n\t\tthen\n\t\t\t# TODO DYLD_INSERT_LIBRARIES=/Library/Developer/CommandLineTools/usr/lib/clang/8.1.0/lib/darwin/libclang_rt.asan_osx_dynamic.dylib\n\t\t\tif test ${IS_PYTHON_SCRIPT} -eq 0;\n\t\t\tthen\n\t\t\t\tLSAN_OPTIONS=suppressions=\"${LSAN_SUPPRESSIONS}\" DYLD_LIBRARY_PATH=\"${LIBRARY_PATH}\" PYTHONPATH=\"${PYTHON_MODULE_PATH}\" \"${PYTHON}\" \"${TEST_EXECUTABLE}\" ${ARGUMENTS[@]} \"${INPUT_FILE}\";\n\t\t\t\tRESULT=$?;\n\t\t\telse\n\t\t\t\tLSAN_OPTIONS=suppressions=\"${LSAN_SUPPRESSIONS}\" DYLD_LIBRARY_PATH=\"${LIBRARY_PATH}\" \"${TEST_EXECUTABLE}\" ${ARGUMENTS[@]} \"${INPUT_FILE}\";\n\t\t\t\tRESULT=$?;\n\t\t\tfi\n\t\telse\n\t\t\tlocal CONFIG_LOG=\"../config.log\";\n\n\t\t\tif ! test -f ${CONFIG_LOG};\n\t\t\tthen\n\t\t\t\tCONFIG_LOG=\"../../config.log\";\n\t\t\tfi\n\t\t\tlocal CC=`cat ${CONFIG_LOG} | grep -e \"^CC=\" | sed \"s/CC='\\\\(.*\\\\)'/\\1/\"`;\n\t\t\tlocal LIBASAN=\"\";\n\n\t\t\tif test -z ${CC} || test ${CC} != \"clang\";\n\t\t\tthen\n\t\t\t\tlocal LDCONFIG=`which ldconfig 2> /dev/null`;\n\n\t\t\t\tif test -z ${LDCONFIG} || ! test -x ${LDCONFIG};\n\t\t\t\tthen\n\t\t\t\t\tLDCONFIG=\"/sbin/ldconfig\";\n\t\t\t\tfi\n\t\t\t\tif test -z ${LDCONFIG} || ! test -x ${LDCONFIG};\n\t\t\t\tthen\n\t\t\t\t\techo \"Missing binary: ldconfig\";\n\t\t\t\t\techo \"\";\n\n\t\t\t\t\texit ${EXIT_FAILURE};\n\t\t\t\tfi\n\t\t\t\tLIBASAN=`${LDCONFIG} -p | grep libasan | sed 's/^.* => //' | sort | tail -n 1`;\n\n\t\t\t\tif ! test -f ${LIBASAN};\n\t\t\t\tthen\n\t\t\t\t\techo \"Missing library: ${BINARY}\";\n\t\t\t\t\techo \"\";\n\n\t\t\t\t\texit ${EXIT_FAILURE};\n\t\t\t\tfi\n\t\t\tfi\n\t\t\tif test ${IS_PYTHON_SCRIPT} -eq 0;\n\t\t\tthen\n\t\t\t\tLSAN_OPTIONS=suppressions=\"${LSAN_SUPPRESSIONS}\" LD_PRELOAD=\"${LIBASAN}\" LD_LIBRARY_PATH=\"${LIBRARY_PATH}\" PYTHONPATH=\"${PYTHON_MODULE_PATH}\" \"${PYTHON}\" \"${TEST_EXECUTABLE}\" ${ARGUMENTS[@]} \"${INPUT_FILE}\";\n\t\t\t\tRESULT=$?;\n\t\t\telse\n\t\t\t\tLSAN_OPTIONS=suppressions=\"${LSAN_SUPPRESSIONS}\" LD_PRELOAD=\"${LIBASAN}\" LD_LIBRARY_PATH=\"${LIBRARY_PATH}\" \"${TEST_EXECUTABLE}\" ${ARGUMENTS[@]} \"${INPUT_FILE}\";\n\t\t\t\tRESULT=$?;\n\t\t\tfi\n\t\tfi\n\n\telif test -n \"${CHECK_WITH_GDB}\";\n\tthen\n\t\tlocal TEST_EXECUTABLE=$( find_binary_executable ${TEST_EXECUTABLE} );\n\t\tlocal LIBRARY_PATH=$( find_binary_library_path ${TEST_EXECUTABLE} );\n\t\tlocal PYTHON_MODULE_PATH=$( find_binary_python_module_path ${TEST_EXECUTABLE} );\n\n\t\tif test \"${PLATFORM}\" = \"Darwin\";\n\t\tthen\n\t\t\tif test ${IS_PYTHON_SCRIPT} -eq 0;\n\t\t\tthen\n\t\t\t\tDYLD_LIBRARY_PATH=\"${LIBRARY_PATH}\" PYTHONPATH=\"${PYTHON_MODULE_PATH}\" gdb -ex \"set non-stop on\" -ex \"run\" -ex \"quit\" --args \"${PYTHON}\" \"${TEST_EXECUTABLE}\" ${ARGUMENTS[@]} \"${INPUT_FILE}\";\n\t\t\t\tRESULT=$?;\n\t\t\telse\n\t\t\t\tDYLD_LIBRARY_PATH=\"${LIBRARY_PATH}\" gdb -ex \"set non-stop on\" -ex \"run\" -ex \"quit\" --args \"${TEST_EXECUTABLE}\" ${ARGUMENTS[@]} \"${INPUT_FILE}\";\n\t\t\t\tRESULT=$?;\n\t\t\tfi\n\n\t\telif test \"${PLATFORM}\" = \"CYGWIN_NT\";\n\t\tthen\n\t\t\tif test ${IS_PYTHON_SCRIPT} -eq 0;\n\t\t\tthen\n\t\t\t\tPATH=\"${LIBRARY_PATH}:${PATH}\" PYTHONPATH=\"${PYTHON_MODULE_PATH}\" gdb -ex \"set non-stop on\" -ex \"run\" -ex \"quit\" --args \"${PYTHON}\" \"${TEST_EXECUTABLE}\" ${ARGUMENTS[@]} \"${INPUT_FILE}\";\n\t\t\t\tRESULT=$?;\n\t\t\telse\n\t\t\t\tPATH=\"${LIBRARY_PATH}:${PATH}\" gdb -ex \"set non-stop on\" -ex \"run\" -ex \"quit\" --args \"${TEST_EXECUTABLE}\" ${ARGUMENTS[@]} \"${INPUT_FILE}\";\n\t\t\t\tRESULT=$?;\n\t\t\tfi\n\n\t\telse\n\t\t\tif test ${IS_PYTHON_SCRIPT} -eq 0;\n\t\t\tthen\n\t\t\t\tLD_LIBRARY_PATH=\"${LIBRARY_PATH}\" PYTHONPATH=\"${PYTHON_MODULE_PATH}\" gdb -ex \"set non-stop on\" -ex \"run\" -ex \"quit\" --args \"${PYTHON}\" \"${TEST_EXECUTABLE}\" ${ARGUMENTS[@]} \"${INPUT_FILE}\";\n\t\t\t\tRESULT=$?;\n\t\t\telse\n\t\t\t\tLD_LIBRARY_PATH=\"${LIBRARY_PATH}\" gdb -ex \"set non-stop on\" -ex \"run\" -ex \"quit\" --args \"${TEST_EXECUTABLE}\" ${ARGUMENTS[@]} \"${INPUT_FILE}\";\n\t\t\t\tRESULT=$?;\n\t\t\tfi\n\t\tfi\n\n\telif test -n \"${CHECK_WITH_VALGRIND}\";\n\tthen\n\t\tlocal TEST_EXECUTABLE=$( find_binary_executable ${TEST_EXECUTABLE} );\n\t\tlocal LIBRARY_PATH=$( find_binary_library_path ${TEST_EXECUTABLE} );\n\t\tlocal PYTHON_MODULE_PATH=$( find_binary_python_module_path ${TEST_EXECUTABLE} );\n\n\t\tlocal VALGRIND_LOG=\"valgrind.log-$$\";\n\t\tlocal VALGRIND_OPTIONS=(\"--tool=memcheck\" \"--leak-check=full\" \"--show-leak-kinds=definite,indirect,possible\" \"--track-origins=yes\" \"--log-file=${VALGRIND_LOG}\");\n\n\t\tif test \"${PLATFORM}\" = \"Darwin\";\n\t\tthen\n\t\t\tif test ${IS_PYTHON_SCRIPT} -eq 0;\n\t\t\tthen\n\t\t\t\tDYLD_LIBRARY_PATH=\"${LIBRARY_PATH}\" PYTHONPATH=\"${PYTHON_MODULE_PATH}\" valgrind ${VALGRIND_OPTIONS[@]} \"${PYTHON}\" \"${TEST_EXECUTABLE}\" ${ARGUMENTS[@]} \"${INPUT_FILE}\";\n\t\t\t\tRESULT=$?;\n\t\t\telse\n\t\t\t\tDYLD_LIBRARY_PATH=\"${LIBRARY_PATH}\" valgrind ${VALGRIND_OPTIONS[@]} \"${TEST_EXECUTABLE}\" ${ARGUMENTS[@]} \"${INPUT_FILE}\";\n\t\t\t\tRESULT=$?;\n\t\t\tfi\n\n\t\telif test \"${PLATFORM}\" = \"CYGWIN_NT\";\n\t\tthen\n\t\t\tif test ${IS_PYTHON_SCRIPT} -eq 0;\n\t\t\tthen\n\t\t\t\tPATH=\"${LIBRARY_PATH}:${PATH}\" PYTHONPATH=\"${PYTHON_MODULE_PATH}\" valgrind ${VALGRIND_OPTIONS[@]} \"${PYTHON}\" \"${TEST_EXECUTABLE}\" ${ARGUMENTS[@]} \"${INPUT_FILE}\";\n\t\t\t\tRESULT=$?;\n\t\t\telse\n\t\t\t\tPATH=\"${LIBRARY_PATH}:${PATH}\" valgrind ${VALGRIND_OPTIONS[@]} \"${TEST_EXECUTABLE}\" ${ARGUMENTS[@]} \"${INPUT_FILE}\";\n\t\t\t\tRESULT=$?;\n\t\t\tfi\n\n\t\telse\n\t\t\tif test ${IS_PYTHON_SCRIPT} -eq 0;\n\t\t\tthen\n\t\t\t\tLD_LIBRARY_PATH=\"${LIBRARY_PATH}\" PYTHONPATH=\"${PYTHON_MODULE_PATH}\" valgrind ${VALGRIND_OPTIONS[@]} \"${PYTHON}\" \"${TEST_EXECUTABLE}\" ${ARGUMENTS[@]} \"${INPUT_FILE}\";\n\t\t\t\tRESULT=$?;\n\t\t\telse\n\t\t\t\tLD_LIBRARY_PATH=\"${LIBRARY_PATH}\" valgrind ${VALGRIND_OPTIONS[@]} \"${TEST_EXECUTABLE}\" ${ARGUMENTS[@]} \"${INPUT_FILE}\";\n\t\t\t\tRESULT=$?;\n\t\t\tfi\n\t\tfi\n\t\tif test ${RESULT} -eq ${EXIT_SUCCESS};\n\t\tthen\n\t\t\tgrep \"All heap blocks were freed -- no leaks are possible\" ${VALGRIND_LOG} > /dev/null 2>&1;\n\n\t\t\tif test $? -ne ${EXIT_SUCCESS};\n\t\t\tthen\n\t\t\t\t# Ignore \"still reachable\"\n\t\t\t\t# Also see: http://valgrind.org/docs/manual/faq.html#faq.deflost\n\n\t\t\t\tgrep \"definitely lost: 0 bytes in 0 blocks\" ${VALGRIND_LOG} > /dev/null 2>&1;\n\t\t\t\tRESULT_DIRECTLY_LOST=$?;\n\n\t\t\t\tgrep \"indirectly lost: 0 bytes in 0 blocks\" ${VALGRIND_LOG} > /dev/null 2>&1;\n\t\t\t\tRESULT_INDIRECTLY_LOST=$?;\n\n\t\t\t\tgrep \"possibly lost: 0 bytes in 0 blocks\" ${VALGRIND_LOG} > /dev/null 2>&1;\n\t\t\t\tRESULT_POSSIBLY_LOST=$?;\n\n\t\t\t\tgrep \"suppressed: 0 bytes in 0 blocks\" ${VALGRIND_LOG} > /dev/null 2>&1;\n\t\t\t\tRESULT_SUPPRESSED=$?;\n\n\t\t\t\tif test ${RESULT_DIRECTLY_LOST} -ne ${EXIT_SUCCESS} || test ${RESULT_INDIRECTLY_LOST} -ne ${EXIT_SUCCESS} || test ${RESULT_POSSIBLY_LOST} -ne ${EXIT_SUCCESS} || test ${RESULT_SUPPRESSED} -ne ${EXIT_SUCCESS};\n\t\t\t\tthen\n\t\t\t\t\techo \"Memory leakage detected.\";\n\t\t\t\t\tcat ${VALGRIND_LOG};\n\n\t\t\t\t\tRESULT=${EXIT_FAILURE};\n\t\t\t\tfi\n\t\t\tfi\n\t\t\t# Detect valgrind warnings.\n\t\t\tlocal NUMBER_OF_LINES=`wc -l ${VALGRIND_LOG} | awk '{ print $1 }'`;\n\n\t\t\tif test ${NUMBER_OF_LINES} -ne 15 && test ${NUMBER_OF_LINES} -ne 22;\n\t\t\tthen\n\t\t\t\techo \"Unsupported number of lines: ${NUMBER_OF_LINES}\";\n\t\t\t\tcat ${VALGRIND_LOG};\n\n\t\t\t\tRESULT=${EXIT_FAILURE};\n\t\t\tfi\n\t\tfi\n\t\trm -f ${VALGRIND_LOG};\n\n\telif test ${IS_PYTHON_SCRIPT} -eq 0;\n\tthen\n\t\tif ! test -f \"${TEST_EXECUTABLE}\";\n\t\tthen\n\t\t\techo \"Invalid test Python script: ${TEST_EXECUTABLE}\";\n\t\t\techo \"\";\n\n\t\t\treturn ${EXIT_FAILURE};\n\t\tfi\n\t\tlocal TEST_EXECUTABLE=$( find_binary_executable ${TEST_EXECUTABLE} );\n\t\tlocal LIBRARY_PATH=$( find_binary_library_path ${TEST_EXECUTABLE} );\n\t\tlocal PYTHON_MODULE_PATH=$( find_binary_python_module_path ${TEST_EXECUTABLE} );\n\n\t\tif test \"${PLATFORM}\" = \"Darwin\";\n\t\tthen\n\t\t\tif test -n \"${CHECK_WITH_STDERR}\";\n\t\t\tthen\n\t\t\t\tDYLD_LIBRARY_PATH=\"${LIBRARY_PATH}\" PYTHONPATH=\"${PYTHON_MODULE_PATH}\" \"${PYTHON}\" \"${TEST_EXECUTABLE}\" ${ARGUMENTS[@]} \"${INPUT_FILE}\";\n\t\t\t\tRESULT=$?;\n\t\t\telse\n\t\t\t\tDYLD_LIBRARY_PATH=\"${LIBRARY_PATH}\" PYTHONPATH=\"${PYTHON_MODULE_PATH}\" \"${PYTHON}\" \"${TEST_EXECUTABLE}\" ${ARGUMENTS[@]} \"${INPUT_FILE}\" 2> /dev/null;\n\t\t\t\tRESULT=$?;\n\t\t\tfi\n\n\t\telif test \"${PLATFORM}\" = \"CYGWIN_NT\";\n\t\tthen\n\t\t\tif test -n \"${CHECK_WITH_STDERR}\";\n\t\t\tthen\n\t\t\t\tPATH=\"${LIBRARY_PATH}:${PATH}\" PYTHONPATH=\"${PYTHON_MODULE_PATH}\" \"${PYTHON}\" \"${TEST_EXECUTABLE}\" ${ARGUMENTS[@]} \"${INPUT_FILE}\";\n\t\t\t\tRESULT=$?;\n\t\t\telse\n\t\t\t\tPATH=\"${LIBRARY_PATH}:${PATH}\" PYTHONPATH=\"${PYTHON_MODULE_PATH}\" \"${PYTHON}\" \"${TEST_EXECUTABLE}\" ${ARGUMENTS[@]} \"${INPUT_FILE}\" 2> /dev/null;\n\t\t\t\tRESULT=$?;\n\t\t\tfi\n\n\t\telse\n\t\t\tif test -n \"${CHECK_WITH_STDERR}\";\n\t\t\tthen\n\t\t\t\tLD_LIBRARY_PATH=\"${LIBRARY_PATH}\" PYTHONPATH=\"${PYTHON_MODULE_PATH}\" \"${PYTHON}\" \"${TEST_EXECUTABLE}\" ${ARGUMENTS[@]} \"${INPUT_FILE}\";\n\t\t\t\tRESULT=$?;\n\t\t\telse\n\t\t\t\tLD_LIBRARY_PATH=\"${LIBRARY_PATH}\" PYTHONPATH=\"${PYTHON_MODULE_PATH}\" \"${PYTHON}\" \"${TEST_EXECUTABLE}\" ${ARGUMENTS[@]} \"${INPUT_FILE}\" 2> /dev/null;\n\t\t\t\tRESULT=$?;\n\t\t\tfi\n\t\tfi\n\telse\n\t\tif ! test -x \"${TEST_EXECUTABLE}\";\n\t\tthen\n\t\t\techo \"Invalid test executable: ${TEST_EXECUTABLE}\";\n\t\t\techo \"\";\n\n\t\t\treturn ${EXIT_FAILURE};\n\t\tfi\n\n\t\tif test -n \"${CHECK_WITH_STDERR}\";\n\t\tthen\n\t\t\t${TEST_EXECUTABLE} ${ARGUMENTS[@]} \"${INPUT_FILE}\";\n\t\t\tRESULT=$?;\n\t\telse\n\t\t\t${TEST_EXECUTABLE} ${ARGUMENTS[@]} \"${INPUT_FILE}\" 2> /dev/null;\n\t\t\tRESULT=$?;\n\t\tfi\n\tfi\n\treturn ${RESULT};\n}\n\n# Runs the test on the input file.\n#\n# Note that this function is not intended to be directly invoked\n# from outside the test runner script.\n#\n# Arguments:\n# a string containing the path of the test set directory\n# a string containing the description of the test\n# a string containing the test mode\n# a string containing the name of the test data option set\n# a string containing the path of the test executable\n# a string containing the path of the test input file\n# an array containing the arguments for the test executable\n#\n# Returns:\n# an integer containg the exit status of the test executable\n#\nrun_test_on_input_file()\n{\n\tlocal TEST_SET_DIRECTORY=$1;\n\tlocal TEST_DESCRIPTION=$2;\n\tlocal TEST_MODE=$3;\n\tlocal OPTION_SET=$4;\n\tlocal TEST_EXECUTABLE=$5;\n\tlocal INPUT_FILE=$6;\n\tshift 6;\n\tlocal ARGUMENTS=(\"$@\");\n\n\tlocal INPUT_NAME=`basename \"${INPUT_FILE}\"`;\n\tlocal TEST_OUTPUT=\"${INPUT_NAME}\";\n\n\tif test -n \"${OPTION_SET}\";\n\tthen\n\t\tTEST_OUTPUT=\"${INPUT_NAME}-${OPTION_SET}\";\n\tfi\n\n\tlocal TMPDIR=\"tmp$$\";\n\tlocal RESULT=0;\n\n\trm -rf ${TMPDIR};\n\tmkdir ${TMPDIR};\n\n\tif test \"${TEST_MODE}\" = \"with_callback\";\n\tthen\n\t\ttest_callback \"${TMPDIR}\" \"${TEST_SET_DIRECTORY}\" \"${TEST_OUTPUT}\" \"${TEST_EXECUTABLE}\" \"${TEST_INPUT}\" ${ARGUMENTS[@]};\n\t\tRESULT=$?;\n\n\telif test \"${TEST_MODE}\" = \"with_stdout_reference\";\n\tthen\n\t\tTEST_EXECUTABLE=$( readlink_f \"${TEST_EXECUTABLE}\" );\n\n\t\tif ! test -x ${TEST_EXECUTABLE};\n\t\tthen\n\t\t\techo \"Invalid test executable: ${TEST_EXECUTABLE}\";\n\t\t\techo \"\";\n\n\t\t\treturn ${EXIT_FAILURE};\n\t\tfi\n\t\tlocal INPUT_FILE_FULL_PATH=$( readlink_f \"${INPUT_FILE}\" );\n\t\tlocal TEST_LOG=\"${TEST_OUTPUT}.log\";\n\n\t\t(cd ${TMPDIR} && run_test_with_input_and_arguments \"${TEST_EXECUTABLE}\" \"${INPUT_FILE_FULL_PATH}\" ${ARGUMENTS[@]} > \"${TEST_LOG}\");\n\t\tRESULT=$?;\n\n\t\t# Compare output if test ran successfully.\n\t\tif test ${RESULT} -eq ${EXIT_SUCCESS};\n\t\tthen\n\t\t\tlocal TEST_RESULTS=\"${TMPDIR}/${TEST_LOG}\";\n\t\t\tlocal STORED_TEST_RESULTS=\"${TEST_SET_DIRECTORY}/${TEST_LOG}.gz\";\n\n\t\t\t# Strip header with version.\n\t\t\tsed -i'~' '1,2d' \"${TEST_RESULTS}\";\n\n\t\t\tif test -f \"${STORED_TEST_RESULTS}\";\n\t\t\tthen\n\t\t\t\t# Using zcat here since zdiff has issues on Mac OS X.\n\t\t\t\t# Note that zcat on Mac OS X requires the input from stdin.\n\t\t\t\tzcat < \"${STORED_TEST_RESULTS}\" | diff \"${TEST_RESULTS}\" -;\n\t\t\t\tRESULT=$?;\n\t\t\telse\n\t\t\t\tgzip \"${TEST_RESULTS}\";\n\n\t\t\t\tmv \"${TEST_RESULTS}.gz\" ${TEST_SET_DIRECTORY};\n\t\t\tfi\n\t\tfi\n\n\telse\n\t\trun_test_with_input_and_arguments \"${TEST_EXECUTABLE}\" \"${INPUT_FILE}\" ${ARGUMENTS[@]};\n\t\tRESULT=$?;\n\tfi\n\n\trm -rf ${TMPDIR};\n\n\tif test -n \"${TEST_DESCRIPTION}\";\n\tthen\n\t\tARGUMENTS=`echo \"${ARGUMENTS[*]}\" | tr '\\n' ' ' | sed 's/[ ]\\$//'`;\n\n\t\tif test -z \"${ARGUMENTS}\";\n\t\tthen\n\t\t\techo -n \"${TEST_DESCRIPTION} with input: ${INPUT_FILE}\";\n\t\telse\n\t\t\techo -n \"${TEST_DESCRIPTION} with options: '${ARGUMENTS}' and input: ${INPUT_FILE}\";\n\t\tfi\n\n\t\tif test ${RESULT} -ne ${EXIT_SUCCESS};\n\t\tthen\n\t\t\techo \" (FAIL)\";\n\t\telse\n\t\t\techo \" (PASS)\";\n\t\tfi\n\tfi\n\treturn ${RESULT};\n}\n\n" }, { "path": "tests/test_tools.ps1", "content": "# Tests tools functions and types.\n#\n# Version: 20230410\n\n$ExitSuccess = 0\n$ExitFailure = 1\n$ExitIgnore = 77\n\n$ToolsTests = \"info_handle message_handle message_string output path_handle registry_file resource_file signal\"\n$ToolsTestsWithInput = \"\"\n\n$InputGlob = \"*\"\n\nFunction GetTestProfileDirectory\n{\n\tparam( [string]$TestInputDirectory, [string]$TestProfile )\n\n\t$TestProfileDirectory = \"${TestInputDirectory}\\.${TestProfile}\"\n\n\tIf (-Not (Test-Path -Path ${TestProfileDirectory} -PathType \"Container\"))\n\t{\n\t\tNew-Item -ItemType \"directory\" -Path ${TestProfileDirectory}\n\t}\n\tReturn ${TestProfileDirectory}\n}\n\nFunction GetTestSetDirectory\n{\n\tparam( [string]$TestProfileDirectory, [string]$TestSetInputDirectory )\n\n\t$TestSetDirectory = \"${TestProfileDirectory}\\${TestSetInputDirectory.Basename}\"\n\n\tIf (-Not (Test-Path -Path ${TestSetDirectory} -PathType \"Container\"))\n\t{\n\t\tNew-Item -ItemType \"directory\" -Path ${TestSetDirectory}\n\t}\n\tReturn ${TestSetDirectory}\n}\n\nFunction GetTestExecutablesDirectory\n{\n\t$TestExecutablesDirectory = \"\"\n\n\tForEach (${VSDirectory} in (\"msvscpp\", \"vs2008\", \"vs2010\", \"vs2012\", \"vs2013\", \"vs2015\", \"vs2017\", \"vs2019\", \"vs2022\"))\n\t{\n\t\tForEach (${VSConfiguration} in (\"Release\", \"VSDebug\"))\n\t\t{\n\t\t\tForEach (${VSPlatform} in (\"Win32\", \"x64\"))\n\t\t\t{\n\t\t\t\t$TestExecutablesDirectory = \"..\\${VSDirectory}\\${VSConfiguration}\\${VSPlatform}\"\n\n\t\t\t\tIf (Test-Path ${TestExecutablesDirectory})\n\t\t\t\t{\n\t\t\t\t\tReturn ${TestExecutablesDirectory}\n\t\t\t\t}\n\t\t\t}\n\t\t\t$TestExecutablesDirectory = \"..\\${VSDirectory}\\${VSConfiguration}\"\n\n\t\t\tIf (Test-Path ${TestExecutablesDirectory})\n\t\t\t{\n\t\t\t\tReturn ${TestExecutablesDirectory}\n\t\t\t}\n\t\t}\n\t}\n\tReturn ${TestExecutablesDirectory}\n}\n\nFunction ReadIgnoreList\n{\n\tparam( [string]$TestProfileDirectory )\n\n\t$IgnoreFile = \"${TestProfileDirectory}\\ignore\"\n\t$IgnoreList = \"\"\n\n\tIf (Test-Path -Path ${IgnoreFile} -PathType \"Leaf\")\n\t{\n\t\t$IgnoreList = Get-Content -Path ${IgnoreFile} | Where {$_ -notmatch '^#.*'}\n\t}\n\tReturn $IgnoreList\n}\n\nFunction RunTest\n{\n\tparam( [string]$TestType )\n\n\t$TestDescription = \"Testing: ${TestName}\"\n\t$TestExecutable = \"${TestExecutablesDirectory}\\evtx_test_tools_${TestName}.exe\"\n\n\t$Output = Invoke-Expression ${TestExecutable}\n\t$Result = ${LastExitCode}\n\n\tIf (${Result} -ne ${ExitSuccess})\n\t{\n\t\tWrite-Host ${Output} -foreground Red\n\t}\n\tWrite-Host \"${TestDescription} \" -nonewline\n\n\tIf (${Result} -ne ${ExitSuccess})\n\t{\n\t\tWrite-Host \" (FAIL)\"\n\t}\n\tElse\n\t{\n\t\tWrite-Host \" (PASS)\"\n\t}\n\tReturn ${Result}\n}\n\nFunction RunTestWithInput\n{\n\tparam( [string]$TestType )\n\n\t$TestDescription = \"Testing: ${TestName}\"\n\t$TestExecutable = \"${TestExecutablesDirectory}\\evtx_test_tools_${TestName}.exe\"\n\n\t$TestProfileDirectory = GetTestProfileDirectory \"input\" \"evtxtools\"\n\n\t$IgnoreList = ReadIgnoreList ${TestProfileDirectory}\n\n\t$Result = ${ExitSuccess}\n\n\tForEach ($TestSetInputDirectory in Get-ChildItem -Path \"input\" -Exclude \".*\")\n\t{\n\t\tIf (-Not (Test-Path -Path ${TestSetInputDirectory} -PathType \"Container\"))\n\t\t{\n\t\t\tContinue\n\t\t}\n\t\tIf (${TestSetInputDirectory} -Contains ${IgnoreList})\n\t\t{\n\t\t\tContinue\n\t\t}\n\t\t$TestSetDirectory = GetTestSetDirectory ${TestProfileDirectory} ${TestSetInputDirectory}\n\n\t\tIf (Test-Path -Path \"${TestSetDirectory}\\files\" -PathType \"Leaf\")\n\t\t{\n\t\t\t$InputFiles = Get-Content -Path \"${TestSetDirectory}\\files\" | Where {$_ -ne \"\"}\n\t\t}\n\t\tElse\n\t\t{\n\t\t\t$InputFiles = Get-ChildItem -Path ${TestSetInputDirectory} -Include ${InputGlob}\n\t\t}\n\t\tForEach ($InputFile in ${InputFiles})\n\t\t{\n\t\t\t# TODO: add test option support\n\t\t\t$Output = Invoke-Expression ${TestExecutable}\n\t\t\t$Result = ${LastExitCode}\n\n\t\t\tIf (${Result} -ne ${ExitSuccess})\n\t\t\t{\n\t\t\t\tBreak\n\t\t\t}\n\t\t}\n\t\tIf (${Result} -ne ${ExitSuccess})\n\t\t{\n\t\t\tBreak\n\t\t}\n\t}\n\tIf (${Result} -ne ${ExitSuccess})\n\t{\n\t\tWrite-Host ${Output} -foreground Red\n\t}\n\tWrite-Host \"${TestDescription} \" -nonewline\n\n\tIf (${Result} -ne ${ExitSuccess})\n\t{\n\t\tWrite-Host \" (FAIL)\"\n\t}\n\tElse\n\t{\n\t\tWrite-Host \" (PASS)\"\n\t}\n\tReturn ${Result}\n}\n\n$TestExecutablesDirectory = GetTestExecutablesDirectory\n\nIf (-Not (Test-Path ${TestExecutablesDirectory}))\n{\n\tWrite-Host \"Missing test executables directory.\" -foreground Red\n\n\tExit ${ExitFailure}\n}\n\n$Result = ${ExitIgnore}\n\nForeach (${TestName} in ${ToolsTests} -split \" \")\n{\n\t# Split will return an array of a single empty string when ToolsTests is empty.\n\tIf (-Not (${TestName}))\n\t{\n\t\tContinue\n\t}\n\t$Result = RunTest ${TestName}\n\n\tIf (${Result} -ne ${ExitSuccess})\n\t{\n\t\tBreak\n\t}\n}\n\nForeach (${TestName} in ${ToolsTestsWithInput} -split \" \")\n{\n\t# Split will return an array of a single empty string when ToolsTestsWithInput is empty.\n\tIf (-Not (${TestName}))\n\t{\n\t\tContinue\n\t}\n\tIf (Test-Path -Path \"input\" -PathType \"Container\")\n\t{\n\t\t$Result = RunTestWithInput ${TestName}\n\t}\n\tElse\n\t{\n\t\t$Result = RunTest ${TestName}\n\t}\n\tIf (${Result} -ne ${ExitSuccess})\n\t{\n\t\tBreak\n\t}\n}\n\nExit ${Result}\n\n" }, { "path": "tests/test_tools.sh", "content": "#!/usr/bin/env bash\n# Tests tools functions and types.\n#\n# Version: 20240413\n\nEXIT_SUCCESS=0;\nEXIT_FAILURE=1;\nEXIT_IGNORE=77;\n\nTOOLS_TESTS=\"info_handle message_handle message_string output path_handle registry_file resource_file signal\";\nTOOLS_TESTS_WITH_INPUT=\"\";\nOPTION_SETS=();\n\nINPUT_GLOB=\"*\";\n\nrun_test()\n{\n\tlocal TEST_NAME=$1;\n\n\tlocal TEST_DESCRIPTION=\"Testing: ${TEST_NAME}\";\n\tlocal TEST_EXECUTABLE=\"./evtx_test_tools_${TEST_NAME}\";\n\n\tif ! test -x \"${TEST_EXECUTABLE}\";\n\tthen\n\t\tTEST_EXECUTABLE=\"${TEST_EXECUTABLE}.exe\";\n\tfi\n\n\t# TODO: add support for TEST_PROFILE and OPTION_SETS?\n\trun_test_with_arguments \"${TEST_DESCRIPTION}\" \"${TEST_EXECUTABLE}\";\n\tlocal RESULT=$?;\n\n\treturn ${RESULT};\n}\n\nrun_test_with_input()\n{\n\tlocal TEST_NAME=$1;\n\n\tlocal TEST_DESCRIPTION=\"Testing: ${TEST_NAME}\";\n\tlocal TEST_EXECUTABLE=\"./evtx_test_tools_${TEST_NAME}\";\n\n\tif ! test -x \"${TEST_EXECUTABLE}\";\n\tthen\n\t\tTEST_EXECUTABLE=\"${TEST_EXECUTABLE}.exe\";\n\tfi\n\n\tif ! test -d \"input\";\n\tthen\n\t\techo \"Test input directory not found.\";\n\n\t\treturn ${EXIT_IGNORE};\n\tfi\n\tlocal RESULT=`ls input/* | tr ' ' '\\n' | wc -l`;\n\n\tif test ${RESULT} -eq ${EXIT_SUCCESS};\n\tthen\n\t\techo \"No files or directories found in the test input directory\";\n\n\t\treturn ${EXIT_IGNORE};\n\tfi\n\n\tlocal TEST_PROFILE_DIRECTORY=$(get_test_profile_directory \"input\" \"evtxtools\");\n\n\tlocal IGNORE_LIST=$(read_ignore_list \"${TEST_PROFILE_DIRECTORY}\");\n\n\tRESULT=${EXIT_SUCCESS};\n\n\tfor TEST_SET_INPUT_DIRECTORY in input/*;\n\tdo\n\t\tif ! test -d \"${TEST_SET_INPUT_DIRECTORY}\";\n\t\tthen\n\t\t\tcontinue;\n\t\tfi\n\t\tif check_for_directory_in_ignore_list \"${TEST_SET_INPUT_DIRECTORY}\" \"${IGNORE_LIST}\";\n\t\tthen\n\t\t\tcontinue;\n\t\tfi\n\n\t\tlocal TEST_SET_DIRECTORY=$(get_test_set_directory \"${TEST_PROFILE_DIRECTORY}\" \"${TEST_SET_INPUT_DIRECTORY}\");\n\n\t\tif test -f \"${TEST_SET_DIRECTORY}/files\";\n\t\tthen\n\t\t\tIFS=\"\" read -a INPUT_FILES <<< $(cat ${TEST_SET_DIRECTORY}/files | sed \"s?^?${TEST_SET_INPUT_DIRECTORY}/?\");\n\t\telse\n\t\t\tIFS=\"\" read -a INPUT_FILES <<< $(ls -1d ${TEST_SET_INPUT_DIRECTORY}/${INPUT_GLOB});\n\t\tfi\n\t\tfor INPUT_FILE in \"${INPUT_FILES[@]}\";\n\t\tdo\n\t\t\tOPTION_INPUT_FILE=\"${INPUT_FILE}\";\n\n\t\t\tif test \"${OSTYPE}\" = \"msys\";\n\t\t\tthen\n\t\t\t\t# A test executable built with MinGW expects a Windows path.\n\t\t\t\tINPUT_FILE=`echo ${INPUT_FILE} | sed 's?/?\\\\\\\\?g'`;\n\t\t\tfi\n\t\t\tlocal TESTED_WITH_OPTIONS=0;\n\n\t\t\tfor OPTION_SET in ${OPTION_SETS[@]};\n\t\t\tdo\n\t\t\t\tlocal TEST_DATA_OPTION_FILE=$(get_test_data_option_file \"${TEST_SET_DIRECTORY}\" \"${OPTION_INPUT_FILE}\" \"${OPTION_SET}\");\n\n\t\t\t\tif test -f ${TEST_DATA_OPTION_FILE};\n\t\t\t\tthen\n\t\t\t\t\tTESTED_WITH_OPTIONS=1;\n\n\t\t\t\t\tIFS=\" \" read -a OPTIONS <<< $(read_test_data_option_file \"${TEST_SET_DIRECTORY}\" \"${INPUT_FILE}\" \"${OPTION_SET}\");\n\n\t\t\t\t\trun_test_on_input_file \"${TEST_SET_DIRECTORY}\" \"${TEST_DESCRIPTION}\" \"default\" \"${OPTION_SET}\" \"${TEST_EXECUTABLE}\" \"${INPUT_FILE}\" \"${OPTIONS[@]}\";\n\t\t\t\t\tRESULT=$?;\n\n\t\t\t\t\tif test ${RESULT} -ne ${EXIT_SUCCESS};\n\t\t\t\t\tthen\n\t\t\t\t\t\tbreak;\n\t\t\t\t\tfi\n\t\t\t\tfi\n\t\t\tdone\n\n\t\t\tif test ${TESTED_WITH_OPTIONS} -eq 0;\n\t\t\tthen\n\t\t\t\trun_test_on_input_file \"${TEST_SET_DIRECTORY}\" \"${TEST_DESCRIPTION}\" \"default\" \"\" \"${TEST_EXECUTABLE}\" \"${INPUT_FILE}\";\n\t\t\t\tRESULT=$?;\n\t\t\tfi\n\n\t\t\tif test ${RESULT} -ne ${EXIT_SUCCESS};\n\t\t\tthen\n\t\t\t\tbreak;\n\t\t\tfi\n\t\tdone\n\n\t\tif test ${RESULT} -ne ${EXIT_SUCCESS};\n\t\tthen\n\t\t\tbreak;\n\t\tfi\n\tdone\n\n\treturn ${RESULT};\n}\n\nif test -n \"${SKIP_TOOLS_TESTS}\";\nthen\n\texit ${EXIT_IGNORE};\nfi\n\nTEST_DIRECTORY=`dirname $0`;\n\nTEST_RUNNER=\"${TEST_DIRECTORY}/test_runner.sh\";\n\nif ! test -f \"${TEST_RUNNER}\";\nthen\n\techo \"Missing test runner: ${TEST_RUNNER}\";\n\n\texit ${EXIT_FAILURE};\nfi\n\nsource ${TEST_RUNNER};\n\nRESULT=${EXIT_IGNORE};\n\nfor TEST_NAME in ${TOOLS_TESTS};\ndo\n\trun_test \"${TEST_NAME}\";\n\tRESULT=$?;\n\n\tif test ${RESULT} -ne ${EXIT_SUCCESS};\n\tthen\n\t\tbreak;\n\tfi\ndone\n\nif test ${RESULT} -ne ${EXIT_SUCCESS} && test ${RESULT} -ne ${EXIT_IGNORE};\nthen\n\texit ${RESULT};\nfi\n\nfor TEST_NAME in ${TOOLS_TESTS_WITH_INPUT};\ndo\n\tif test -d \"input\";\n\tthen\n\t\trun_test_with_input \"${TEST_NAME}\";\n\t\tRESULT=$?;\n\telse\n\t\trun_test \"${TEST_NAME}\";\n\t\tRESULT=$?;\n\tfi\n\n\tif test ${RESULT} -ne ${EXIT_SUCCESS};\n\tthen\n\t\tbreak;\n\tfi\ndone\n\nexit ${RESULT};\n\n" }, { "path": "tox.ini", "content": "[tox]\nenvlist = py3{10,11,12,13,14}\n\n[testenv]\nusedevelop = True\npip_pre = True\npassenv =\n CFLAGS\n CPPFLAGS\n INCLUDE\n LDFLAGS\n LIB\ndeps =\n build\n setuptools >= 65\n wheel\ncommands =\n python -m build --no-isolation --outdir=dist --wheel\n python -m pip install --no-index --find-links=dist libevtx-python\n python tests/runtests.py\n" } ]