3gstudent / Eventlogedit-evtx--Evolution

Remove individual lines from Windows XML Event Log (EVTX) files
260 stars 62 forks source link

I get 40+ errors and 2+ warnings when compiling. #6

Closed ghost closed 4 years ago

ghost commented 4 years ago

I get all of these errors when compiling all of the files, if needed I can send all the warnings and errors for all files. Thanks for your help in advance.

When i tried to compile DeleteRecordByTerminateProcessEx.cpp --------------------Configuration: mingw5 - CUI Debug, Builder Type: MinGW--------------------

Compiling F:\Lkms19\Hry\editlog\Eventlogedit-evtx--Evolution-master\DeleteRecordbyTerminateProcessEx.cpp... [Error] F:\Lkms19\Hry\editlog\Eventlogedit-evtx--Evolution-master\DeleteRecordbyTerminateProcessEx.cpp:2:20: winevt.h: No such file or directory [Error] F:\Lkms19\Hry\editlog\Eventlogedit-evtx--Evolution-master\DeleteRecordbyTerminateProcessEx.cpp:14: error: ISO C++ forbids declaration of NTSTATUS' with no type [Error] F:\Lkms19\Hry\editlog\Eventlogedit-evtx--Evolution-master\DeleteRecordbyTerminateProcessEx.cpp:14: error: typedefNTSTATUS' is initialized (use typeof instead) [Error] F:\Lkms19\Hry\editlog\Eventlogedit-evtx--Evolution-master\DeleteRecordbyTerminateProcessEx.cpp:14: error: expected primary-expression before "attribute" [Error] F:\Lkms19\Hry\editlog\Eventlogedit-evtx--Evolution-master\DeleteRecordbyTerminateProcessEx.cpp:14: error: expected ,' or;' before '(' token [Error] F:\Lkms19\Hry\editlog\Eventlogedit-evtx--Evolution-master\DeleteRecordbyTerminateProcessEx.cpp:142: error: printf' was not declared in this scope [Error] F:\Lkms19\Hry\editlog\Eventlogedit-evtx--Evolution-master\DeleteRecordbyTerminateProcessEx.cpp:155: error: cannot convertWCHAR' to `const CHAR' for argument 10' toBOOL EnumServicesStatusExA(SC_HANDLE__, SC_ENUM_TYPE, DWORD, DWORD, BYTE, DWORD, DWORD, DWORD, DWORD, const CHAR)' [Error] F:\Lkms19\Hry\editlog\Eventlogedit-evtx--Evolution-master\DeleteRecordbyTerminateProcessEx.cpp:160: error: printf' was not declared in this scope [Error] F:\Lkms19\Hry\editlog\Eventlogedit-evtx--Evolution-master\DeleteRecordbyTerminateProcessEx.cpp:164: error: cannot convertWCHAR' to `const CHAR' for argument 10' toBOOL EnumServicesStatusExA(SC_HANDLE__, SC_ENUM_TYPE, DWORD, DWORD, BYTE, DWORD, DWORD, DWORD, DWORD, const CHAR)' [Error] F:\Lkms19\Hry\editlog\Eventlogedit-evtx--Evolution-master\DeleteRecordbyTerminateProcessEx.cpp:168: error: cannot convert CHAR*' toconst wchar_t' for argument 1' tosize_t wcslen(const wchar_t)' [Error] F:\Lkms19\Hry\editlog\Eventlogedit-evtx--Evolution-master\DeleteRecordbyTerminateProcessEx.cpp:168: error: _wcslwr_s' was not declared in this scope [Error] F:\Lkms19\Hry\editlog\Eventlogedit-evtx--Evolution-master\DeleteRecordbyTerminateProcessEx.cpp:169: error: cannot convertCHAR' to `const wchar_t' for argument 1' towchar_t wcsstr(const wchar_t, const wchar_t)' [Error] F:\Lkms19\Hry\editlog\Eventlogedit-evtx--Evolution-master\DeleteRecordbyTerminateProcessEx.cpp:171: error: printf' was not declared in this scope [Error] F:\Lkms19\Hry\editlog\Eventlogedit-evtx--Evolution-master\DeleteRecordbyTerminateProcessEx.cpp:192: error: cannot convertWCHAR' to CHAR*' for argument1' to UINT GetSystemDirectoryA(CHAR*, UINT)' [Error] F:\Lkms19\Hry\editlog\Eventlogedit-evtx--Evolution-master\DeleteRecordbyTerminateProcessEx.cpp:193: error: cannot convertWCHAR' to `CHAR' for argument 1' toCHAR lstrcatA(CHAR, const CHAR)' [Error] F:\Lkms19\Hry\editlog\Eventlogedit-evtx--Evolution-master\DeleteRecordbyTerminateProcessEx.cpp:194: error: cannot convert `WCHAR' to CHAR*' for argument1' to CHAR* lstrcatA(CHAR*, const CHAR*)' [Error] F:\Lkms19\Hry\editlog\Eventlogedit-evtx--Evolution-master\DeleteRecordbyTerminateProcessEx.cpp:195: error: cannot convertWCHAR' to `CHAR' for argument 1' toCHAR lstrcatA(CHAR, const CHAR)' [Error] F:\Lkms19\Hry\editlog\Eventlogedit-evtx--Evolution-master\DeleteRecordbyTerminateProcessEx.cpp:196: error: cannot convert `WCHAR' to CHAR*' for argument1' to CHAR* lstrcatA(CHAR*, const CHAR*)' [Error] F:\Lkms19\Hry\editlog\Eventlogedit-evtx--Evolution-master\DeleteRecordbyTerminateProcessEx.cpp:197: error: cannot convertWCHAR' to `CHAR' for argument 1' toCHAR lstrcatA(CHAR, const CHAR)' [Error] F:\Lkms19\Hry\editlog\Eventlogedit-evtx--Evolution-master\DeleteRecordbyTerminateProcessEx.cpp:199: error: cannot convert `WCHAR' to CHAR*' for argument1' to CHAR* lstrcatA(CHAR*, const CHAR*)' [Error] F:\Lkms19\Hry\editlog\Eventlogedit-evtx--Evolution-master\DeleteRecordbyTerminateProcessEx.cpp:201: error:EvtExportLogFilePath' was not declared in this scope [Error] F:\Lkms19\Hry\editlog\Eventlogedit-evtx--Evolution-master\DeleteRecordbyTerminateProcessEx.cpp:201: error: EvtExportLog' was not declared in this scope [Error] F:\Lkms19\Hry\editlog\Eventlogedit-evtx--Evolution-master\DeleteRecordbyTerminateProcessEx.cpp:202: error:printf' was not declared in this scope [Error] F:\Lkms19\Hry\editlog\Eventlogedit-evtx--Evolution-master\DeleteRecordbyTerminateProcessEx.cpp:218: error: _NtQuerySystemInformation' was not declared in this scope [Error] F:\Lkms19\Hry\editlog\Eventlogedit-evtx--Evolution-master\DeleteRecordbyTerminateProcessEx.cpp:218: error: expected;' before "NtQuerySystemInformation" [Error] F:\Lkms19\Hry\editlog\Eventlogedit-evtx--Evolution-master\DeleteRecordbyTerminateProcessEx.cpp:219: error: NtQuerySystemInformation' was not declared in this scope [Error] F:\Lkms19\Hry\editlog\Eventlogedit-evtx--Evolution-master\DeleteRecordbyTerminateProcessEx.cpp:221: error:printf' was not declared in this scope [Error] F:\Lkms19\Hry\editlog\Eventlogedit-evtx--Evolution-master\DeleteRecordbyTerminateProcessEx.cpp:227: error: printf' was not declared in this scope [Error] F:\Lkms19\Hry\editlog\Eventlogedit-evtx--Evolution-master\DeleteRecordbyTerminateProcessEx.cpp:233: error:printf' was not declared in this scope [Error] F:\Lkms19\Hry\editlog\Eventlogedit-evtx--Evolution-master\DeleteRecordbyTerminateProcessEx.cpp:238: error: NtQuerySystemInformation' was not declared in this scope [Error] F:\Lkms19\Hry\editlog\Eventlogedit-evtx--Evolution-master\DeleteRecordbyTerminateProcessEx.cpp:242: error:printf' was not declared in this scope [Error] F:\Lkms19\Hry\editlog\Eventlogedit-evtx--Evolution-master\DeleteRecordbyTerminateProcessEx.cpp:273: error: printf' was not declared in this scope [Warning] F:\Lkms19\Hry\editlog\Eventlogedit-evtx--Evolution-master\DeleteRecordbyTerminateProcessEx.cpp:282: warning: cast to pointer from integer of different size [Error] F:\Lkms19\Hry\editlog\Eventlogedit-evtx--Evolution-master\DeleteRecordbyTerminateProcessEx.cpp:307: error:printf' was not declared in this scope [Error] F:\Lkms19\Hry\editlog\Eventlogedit-evtx--Evolution-master\DeleteRecordbyTerminateProcessEx.cpp:324: error: printf' was not declared in this scope [Error] F:\Lkms19\Hry\editlog\Eventlogedit-evtx--Evolution-master\DeleteRecordbyTerminateProcessEx.cpp:336: error:printf' was not declared in this scope [Error] F:\Lkms19\Hry\editlog\Eventlogedit-evtx--Evolution-master\DeleteRecordbyTerminateProcessEx.cpp:342: error: cannot convert WCHAR*' toCHAR' for argument 1' toUINT GetSystemDirectoryA(CHAR, UINT)' [Error] F:\Lkms19\Hry\editlog\Eventlogedit-evtx--Evolution-master\DeleteRecordbyTerminateProcessEx.cpp:343: error: cannot convert WCHAR*' toCHAR' for argument 1' toCHAR lstrcatA(CHAR, const CHAR)' [Error] F:\Lkms19\Hry\editlog\Eventlogedit-evtx--Evolution-master\DeleteRecordbyTerminateProcessEx.cpp:344: error: cannot convert WCHAR*' toCHAR' for argument 1' toCHAR lstrcatA(CHAR, const CHAR)' [Error] F:\Lkms19\Hry\editlog\Eventlogedit-evtx--Evolution-master\DeleteRecordbyTerminateProcessEx.cpp:345: error: printf' was not declared in this scope [Error] F:\Lkms19\Hry\editlog\Eventlogedit-evtx--Evolution-master\DeleteRecordbyTerminateProcessEx.cpp:357: error: cannot convert_TCHAR' to `WCHAR' for argument 1' toBOOL DeleteRecord(WCHAR, WCHAR)' [Warning] F:\Lkms19\Hry\editlog\Eventlogedit-evtx--Evolution-master\DeleteRecordbyTerminateProcessEx.cpp:377: warning: NULL used in arithmetic [Error] F:\Lkms19\Hry\editlog\Eventlogedit-evtx--Evolution-master\DeleteRecordbyTerminateProcessEx.cpp:386: error: cannot convert _TCHAR*' toWCHAR' for argument 1' toBOOL CloseFileHandle(WCHAR, DWORD)' [Warning] F:\Lkms19\Hry\editlog\Eventlogedit-evtx--Evolution-master\DeleteRecordbyTerminateProcessEx.cpp:387: warning: NULL used in arithmetic [Error] F:\Lkms19\Hry\editlog\Eventlogedit-evtx--Evolution-master\DeleteRecordbyTerminateProcessEx.cpp:395: error: cannot convert const wchar_t*' toconst CHAR' for argument 1' toBOOL CopyFileA(const CHAR, const CHAR, BOOL)' [Error] F:\Lkms19\Hry\editlog\Eventlogedit-evtx--Evolution-master\DeleteRecordbyTerminateProcessEx.cpp:401: error: cannot convert `const wchar_t' to const CHAR*' for argument1' to `BOOL DeleteFileA(const CHAR*)' [Error] g++.exe: 5\mingw\include: No such file or directory [Error] g++.exe: 5\mingw\include\c++\3.4.5: No such file or directory [Error] g++.exe: 5\mingw\lib\gcc\mingw32\3.4.5\include: No such file or directory [Error] g++.exe: 5\mingw\bin\: No such file or directory [Error] g++.exe: 5\mingw\mingw32\bin\: No such file or directory

Complete Build DeleteRecordbyTerminateProcessEx: 48 error(s), 3 warning(s)

DeleteRecordByGetHandle --------------------Configuration: mingw5 - CUI Debug, Builder Type: MinGW--------------------

Compiling F:\Lkms19\Hry\editlog\Eventlogedit-evtx--Evolution-master\DeleteRecordbyGetHandle.cpp... [Error] F:\Lkms19\Hry\editlog\Eventlogedit-evtx--Evolution-master\DeleteRecordbyGetHandle.cpp:59: error: ISO C++ forbids declaration of NTSTATUS' with no type [Error] F:\Lkms19\Hry\editlog\Eventlogedit-evtx--Evolution-master\DeleteRecordbyGetHandle.cpp:59: error: typedefNTSTATUS' is initialized (use typeof instead) [Error] F:\Lkms19\Hry\editlog\Eventlogedit-evtx--Evolution-master\DeleteRecordbyGetHandle.cpp:59: error: expected primary-expression before "attribute" [Error] F:\Lkms19\Hry\editlog\Eventlogedit-evtx--Evolution-master\DeleteRecordbyGetHandle.cpp:59: error: expected ,' or;' before '(' token [Error] F:\Lkms19\Hry\editlog\Eventlogedit-evtx--Evolution-master\DeleteRecordbyGetHandle.cpp:144: error: invalid conversion from int (*)()' tovoid' [Error] F:\Lkms19\Hry\editlog\Eventlogedit-evtx--Evolution-master\DeleteRecordbyGetHandle.cpp:366: error: integer constant is too large for "long" type [Error] F:\Lkms19\Hry\editlog\Eventlogedit-evtx--Evolution-master\DeleteRecordbyGetHandle.cpp:397: error: integer constant is too large for "long" type [Error] F:\Lkms19\Hry\editlog\Eventlogedit-evtx--Evolution-master\DeleteRecordbyGetHandle.cpp:398: error: integer constant is too large for "long" type [Error] F:\Lkms19\Hry\editlog\Eventlogedit-evtx--Evolution-master\DeleteRecordbyGetHandle.cpp:399: error: integer constant is too large for "long" type [Error] F:\Lkms19\Hry\editlog\Eventlogedit-evtx--Evolution-master\DeleteRecordbyGetHandle.cpp:474: error: integer constant is too large for "long" type [Error] F:\Lkms19\Hry\editlog\Eventlogedit-evtx--Evolution-master\DeleteRecordbyGetHandle.cpp:474: error: integer constant is too large for "long" type [Error] F:\Lkms19\Hry\editlog\Eventlogedit-evtx--Evolution-master\DeleteRecordbyGetHandle.cpp:524: error: integer constant is too large for "long" type [Error] F:\Lkms19\Hry\editlog\Eventlogedit-evtx--Evolution-master\DeleteRecordbyGetHandle.cpp:524: error: integer constant is too large for "long" type [Error] F:\Lkms19\Hry\editlog\Eventlogedit-evtx--Evolution-master\DeleteRecordbyGetHandle.cpp:530: error: integer constant is too large for "long" type [Error] F:\Lkms19\Hry\editlog\Eventlogedit-evtx--Evolution-master\DeleteRecordbyGetHandle.cpp:531: error: integer constant is too large for "long" type [Error] F:\Lkms19\Hry\editlog\Eventlogedit-evtx--Evolution-master\DeleteRecordbyGetHandle.cpp:532: error: integer constant is too large for "long" type [Error] F:\Lkms19\Hry\editlog\Eventlogedit-evtx--Evolution-master\DeleteRecordbyGetHandle.cpp:611: error: sscanf_s' was not declared in this scope [Error] F:\Lkms19\Hry\editlog\Eventlogedit-evtx--Evolution-master\DeleteRecordbyGetHandle.cpp:627: error: invalid conversion fromint' to `const wchar_t' [Error] F:\Lkms19\Hry\editlog\Eventlogedit-evtx--Evolution-master\DeleteRecordbyGetHandle.cpp:627: error: initializing argument 2 of int swprintf(wchar_t*, const wchar_t*, ...)' [Error] F:\Lkms19\Hry\editlog\Eventlogedit-evtx--Evolution-master\DeleteRecordbyGetHandle.cpp:628: error:_wcslwr_s' was not declared in this scope [Error] F:\Lkms19\Hry\editlog\Eventlogedit-evtx--Evolution-master\DeleteRecordbyGetHandle.cpp:635: error: _NtQuerySystemInformation' was not declared in this scope [Error] F:\Lkms19\Hry\editlog\Eventlogedit-evtx--Evolution-master\DeleteRecordbyGetHandle.cpp:635: error: expected;' before "NtQuerySystemInformation" [Error] F:\Lkms19\Hry\editlog\Eventlogedit-evtx--Evolution-master\DeleteRecordbyGetHandle.cpp:636: error: NtQuerySystemInformation' was not declared in this scope [Error] F:\Lkms19\Hry\editlog\Eventlogedit-evtx--Evolution-master\DeleteRecordbyGetHandle.cpp:655: error:NtQuerySystemInformation' was not declared in this scope [Warning] F:\Lkms19\Hry\editlog\Eventlogedit-evtx--Evolution-master\DeleteRecordbyGetHandle.cpp:691: warning: cast to pointer from integer of different size [Warning] F:\Lkms19\Hry\editlog\Eventlogedit-evtx--Evolution-master\DeleteRecordbyGetHandle.cpp:751: warning: cast to pointer from integer of different size [Error] g++.exe: 5\mingw\include: No such file or directory [Error] g++.exe: 5\mingw\include\c++\3.4.5: No such file or directory [Error] g++.exe: 5\mingw\lib\gcc\mingw32\3.4.5\include: No such file or directory [Error] g++.exe: 5\mingw\bin\: No such file or directory [Error] g++.exe: 5\mingw\mingw32\bin\: No such file or directory

Complete Compile F:\Lkms19\Hry\editlog\Eventlogedit-evtx--Evolution-master\DeleteRecordbyGetHandle.cpp: 29 error(s), 2 warning(s)

3gstudent commented 4 years ago

You can use Visual Studio to compile the .cpp files and generate the .exe files.

ghost commented 4 years ago

I used C-free 5. I can't compile the files in VS 2019. I wasn't able to find many directories and stuff, how to fix it?

3gstudent commented 4 years ago

Use VS2015.

Here is the release file.

https://github.com/3gstudent/Eventlogedit-evtx--Evolution/releases/tag/v1.0.0

ghost commented 4 years ago

https://my.visualstudio.com/Downloads?q=visual%20studio%202015&wt.mc_id=o~msft~vscom~older-downloads

I have no idea whicho one to choose.

3gstudent commented 4 years ago

vs2015 Community

mcolson1985 commented 4 years ago

Hello , I created c:\temp folder and I moved DeleteRecordofFileEx.exe from https://github.com/3gstudent/Eventlogedit-evtx--Evolution/releases/tag/v1.0.0 and when I run CMD run as a Admin and run I got this see pic: My goal is to remove one record from eventvwr I wanted to remove one record id and to generate that temp.evtx( after I run this command DeleteRecordofFileEx.exe System.evtx 7055 but there is no temp.evtx) Could you please help?

github