0xrawsec / golang-evtx

GNU General Public License v3.0
157 stars 26 forks source link

Unable to retrieve any value, how should I use GetString() method? #35

Open CaledoniaProject opened 1 year ago

CaledoniaProject commented 1 year ago

Please take a look at this,

package main

import (
    "flag"
    "fmt"
    "log"

    "github.com/0xrawsec/golang-evtx/evtx"
)

func main() {
    flag.Parse()

    for _, filename := range flag.Args() {
        eventFile, err := evtx.OpenDirty(filename)
        if err != nil {
            log.Fatal(err)
        }

        for event := range eventFile.FastEvents() {
            if event.EventID() == 7045 {
                path1 := evtx.Path("/Event/EventData/param1")
                fmt.Println(event.GetString(&path1))
            }
        }
    }
}