search

microsoft / etl2pcapng

Utility that converts an .etl file containing a Windows network packet capture into .pcapng format.
MIT License
607 stars 114 forks source link

Crash #44

Closed SavSanta closed 2 years ago

SavSanta commented 2 years ago

I had a ETL that I had already transferred to a Linux box after a lot of security control finagling...soon to find out Wireshark didnt support ithat format. Found etl2pcapng but of course it's for Windows when Im on LInux now lol. Decided to see if WINE would work since it looked small and self-contained.. Got the errors below. This may be a WINE thing but just in case it's not gonna post about it here.

wine64 etl2pcapng/x64/etl2pcapng.exe NetTrace.etl WindowsPcap.pcapng 87 ⨯

0009:fixme:advapi:OpenTraceW 0x22fa10: stub
OpenTrace failed with 5
0009:fixme:kernelbase:AppPolicyGetProcessTerminationMethod FFFFFFFFFFFFFFFA, 000000000022FB90

On a sidenote I was surprised there was no Linux tool for this. Maybe I'll get of my rump, spend a week trying to understand this code and see if I can port it to .NET CORE

maolson-msft commented 2 years ago

I agree that this is likely a WINE issue, and if a fix were made it would likely be inside WINE rather than in this tool, so I'm closing this Issue.