search

0xrawsec / golang-evtx

GNU General Public License v3.0
157 stars 26 forks source link

panic: Index out of range #7

Closed darkr4y closed 5 years ago

darkr4y commented 6 years ago

Hi，here I am again. Today when I convert a evtx file without carve mode , It shows as follow:

panic: Index out of range

goroutine 166 [running]:
github.com/0xrawsec/golang-evtx/evtx.(*TemplateInstance).ElementToGoEvtx(0xc4208418c0, 0x1142b80, 0xc4206ae8a2, 0xc4202d3b90, 0xc4209563e8)
    /Users/darkray/go/src/github.com/0xrawsec/golang-evtx/evtx/structs.go:484 +0x776
github.com/0xrawsec/golang-evtx/evtx.(*TemplateInstance).NodeToGoEvtx(0xc4208418c0, 0xc4206f6a40, 0xc4206af8d0)
    /Users/darkray/go/src/github.com/0xrawsec/golang-evtx/evtx/structs.go:591 +0x7df
github.com/0xrawsec/golang-evtx/evtx.(*TemplateInstance).NodeToGoEvtx(0xc4208418c0, 0xc4206f69c0, 0x0)
    /Users/darkray/go/src/github.com/0xrawsec/golang-evtx/evtx/structs.go:547 +0x150
github.com/0xrawsec/golang-evtx/evtx.(*TemplateInstance).NodeToGoEvtx(0xc4208418c0, 0xc4206f6980, 0x5)
    /Users/darkray/go/src/github.com/0xrawsec/golang-evtx/evtx/structs.go:547 +0x150
github.com/0xrawsec/golang-evtx/evtx.(*TemplateInstance).NodeToGoEvtx(0xc4208418c0, 0xc4200578a8, 0x0)
    /Users/darkray/go/src/github.com/0xrawsec/golang-evtx/evtx/structs.go:541 +0xdc2
github.com/0xrawsec/golang-evtx/evtx.(*TemplateInstance).ElementToGoEvtx(0xc420a94c60, 0x1142b40, 0xc420bb3ac0, 0x110, 0xc420865e60)
    /Users/darkray/go/src/github.com/0xrawsec/golang-evtx/evtx/structs.go:502 +0x172
github.com/0xrawsec/golang-evtx/evtx.(*TemplateInstance).ElementToGoEvtx(0xc420a94c60, 0x1142b80, 0xc420c1b4c2, 0x6, 0xc420865ee8)
    /Users/darkray/go/src/github.com/0xrawsec/golang-evtx/evtx/structs.go:482 +0x530
github.com/0xrawsec/golang-evtx/evtx.(*TemplateInstance).NodeToGoEvtx(0xc420a94c60, 0xc4206f6640, 0x5)
    /Users/darkray/go/src/github.com/0xrawsec/golang-evtx/evtx/structs.go:591 +0x7df
github.com/0xrawsec/golang-evtx/evtx.(*TemplateInstance).NodeToGoEvtx(0xc420a94c60, 0xc420057e28, 0x0)
    /Users/darkray/go/src/github.com/0xrawsec/golang-evtx/evtx/structs.go:541 +0xdc2
github.com/0xrawsec/golang-evtx/evtx.(*TemplateInstance).GoEvtxMap(0xc420a94c60, 0x0)
    /Users/darkray/go/src/github.com/0xrawsec/golang-evtx/evtx/structs.go:624 +0x9c
github.com/0xrawsec/golang-evtx/evtx.(*Fragment).GoEvtxMap(0xc420ad4660, 0xc420756300)
    /Users/darkray/go/src/github.com/0xrawsec/golang-evtx/evtx/structs.go:103 +0x4f
github.com/0xrawsec/golang-evtx/evtx.Event.GoEvtxMap(0x1fb8, 0x30000002a2a, 0x2dfb, 0x1d344084866810d, 0xc4209da000, 0x1d344084866810d, 0x0, 0x0)
    /Users/darkray/go/src/github.com/0xrawsec/golang-evtx/evtx/event.go:79 +0x1c3
github.com/0xrawsec/golang-evtx/evtx.(*Chunk).Events.func1(0xc420188020, 0xc4209da000)
    /Users/darkray/go/src/github.com/0xrawsec/golang-evtx/evtx/chunk.go:249 +0x11c
created by github.com/0xrawsec/golang-evtx/evtx.(*Chunk).Events
    /Users/darkray/go/src/github.com/0xrawsec/golang-evtx/evtx/chunk.go:244 +0x97

and I have seen the issue #6 , but I can not confirm what the problem is. thx for ur help ;)