search

williballenthin / python-evt

Pure Python parser for classic Windows Event Log files (.evt)
Apache License 2.0
48 stars 11 forks source link

Allow shift left operator take precedence over plus #5

Closed michaelrommel closed 1 year ago

michaelrommel commented 1 year ago

This allows proper calculations. Had the error, where a thread completely blocked because it tried to calculate

22722 << 32 + 163545272

and hung up while calculating this large number whereas

(22722 << 32) + 163545272

would return quickly and raise an exception later, which is better.

michaelrommel commented 1 year ago

Well, 'catch' is maybe simplifying it too much 😄 , it took me 6 hours to track down what went wrong, until I hit the str train of thought... I nee to check the evtx repo also, we use that as well, don't know how much code the two share... 😄

williballenthin commented 1 year ago

here's one: https://github.com/williballenthin/INDXParse/blob/85e9bf0c009d689e777d2d95aaa7b6c142d3fc2c/SDS.py#L72

want to create the PR so you can be recognized for the effort?

williballenthin commented 1 year ago

this one looks ok, would you agree: https://github.com/williballenthin/python-evtx/blob/5658f404ada542d7d1ebda2d680343f77e8d25f8/Evtx/Nodes.py#L1445

michaelrommel commented 1 year ago

No no no - everybody learns from each other!! I would not have been able to write the whole parser thing in the first place. I am just good in hunting down bugs, IF they are reproducible. Even if it takes to 3am, wouldn't be able to sleep anyhow...

williballenthin commented 1 year ago

well, please know i appreciate the effort you put in - thank you!

michaelrommel commented 1 year ago

The other good thing is, that the repo now has a recent commit and people do not think that it is stale 😄