search

omerbenamram / evtx

A Fast (and safe) parser for the Windows XML Event Log (EVTX) format
Apache License 2.0
625 stars 61 forks source link

Problems parsing evtx files originating from NetApp #224

Open maysara opened 1 year ago

maysara commented 1 year ago

I get the error :

Failed to dump the next record. Caused by: 0: Failed to parse record number 341 1: An error occurred while trying to serialize binary xml to output. 2: Building a JSON document failed with message: This is a bug - expected current value to exist, and to be an object type. Check that the value is not Value::null

Unfortunately I have not additional Info to provide from the output, and it seems to fail on all records.

maysara commented 1 year ago

Hello again,

I've uploaded a chunk that reproduces the problem here: https://hostb.org/1DGS You will need to use your handler as the secret to access it!

Please let me know when you have it, so i can remove it!

Edit: @omerbenamram , can you confirm having it?

maysara commented 1 year ago

My suspicion is that the binXML tags are numbered slightly different.

for example: <Event xmlns="http://

Works: 05 00 78 00 6d 00 6c 00 6e 00 73 00 00 00 05 01 x m l n s 35 00 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 5 h t t p : / /

Doesn't work: 05 00 78 00 6d 00 6c 00 6e 00 73 00 00 00 05 01 x m l n s 26 00 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 & h t t p : / /

Actual output is missing the xmlns on the left side of the equal sign:

Record 1 <?xml version="1.0" encoding="utf-8"?> < ="http://schemas.netapp.com/events/event">