search

williballenthin / EVTXtract

EVTXtract recovers and reconstructs fragments of EVTX log files from raw binary data, including unallocated space and memory images.
Apache License 2.0
189 stars 22 forks source link

XMLSyntaxError: error parsing attribute name #13

Open williballenthin opened 7 years ago

williballenthin commented 7 years ago 
INFO:evtxtract.carvers:Unknown exception processing record at 0x423129920
Traceback (most recent call last):
  File "evtxtract/carvers.py", line 175, in extract_chunk_records
  File "evtxtract/utils.py", line 48, in get_eid
  File "evtxtract/utils.py", line 18, in to_lxml
  File "src/lxml/lxml.etree.pyx", line 3213, in lxml.etree.fromstring (src/lxml/lxml.etree.c:79003)
  File "src/lxml/parser.pxi", line 1848, in lxml.etree._parseMemoryDocument (src/lxml/lxml.etree.c:118334)
  File "src/lxml/parser.pxi", line 1729, in lxml.etree._parseDoc (src/lxml/lxml.etree.c:116892)
  File "src/lxml/parser.pxi", line 1063, in lxml.etree._BaseParser._parseUnicodeDoc (src/lxml/lxml.etree.c:110879)
  File "src/lxml/parser.pxi", line 595, in lxml.etree._ParserContext._handleParseResultDoc (src/lxml/lxml.etree.c:105102)
  File "src/lxml/parser.pxi", line 706, in lxml.etree._handleParseResult (src/lxml/lxml.etree.c:106810)
  File "src/lxml/parser.pxi", line 635, in lxml.etree._raiseParseError (src/lxml/lxml.etree.c:105664)
XMLSyntaxError: error parsing attribute name, line 30, column 103 (line 30)
williballenthin commented 7 years ago

source of the issue is a rogue < in the content of a string.

unfortunately, python-evtx does not correctly escape strings in sub-substitutions when assembling templates, so we can't currently fix this.

H3kc commented 2 years ago 

INFO:evtxtract.carvers:Unknown exception processing record at 0x423129920

Traceback (most recent call last):

  File "evtxtract/carvers.py", line 175, in extract_chunk_records

  File "evtxtract/utils.py", line 48, in get_eid

  File "evtxtract/utils.py", line 18, in to_lxml

  File "src/lxml/lxml.etree.pyx", line 3213, in lxml.etree.fromstring (src/lxml/lxml.etree.c:79003)

  File "src/lxml/parser.pxi", line 1848, in lxml.etree._parseMemoryDocument (src/lxml/lxml.etree.c:118334)

  File "src/lxml/parser.pxi", line 1729, in lxml.etree._parseDoc (src/lxml/lxml.etree.c:116892)

  File "src/lxml/parser.pxi", line 1063, in lxml.etree._BaseParser._parseUnicodeDoc (src/lxml/lxml.etree.c:110879)

  File "src/lxml/parser.pxi", line 595, in lxml.etree._ParserContext._handleParseResultDoc (src/lxml/lxml.etree.c:105102)

  File "src/lxml/parser.pxi", line 706, in lxml.etree._handleParseResult (src/lxml/lxml.etree.c:106810)

  File "src/lxml/parser.pxi", line 635, in lxml.etree._raiseParseError (src/lxml/lxml.etree.c:105664)

XMLSyntaxError: error parsing attribute name, line 30, column 103 (line 30)