python-evtx
===========
Introduction
------------
python-evtx is a pure Python parser for recent Windows Event Log files (those with the file extension ".evtx"). The module provides programmatic access to the File and Chunk headers, record templates, and event entries. For example, you can use python-evtx to review the event logs of Windows 7 systems from a Mac or Linux workstation. The structure definitions and parsing strategies were heavily inspired by the work of Andreas Schuster and his Perl implementation "Parse-Evtx".
Background
----------
With the release of Windows Vista, Microsoft introduced an updated event log file format. The format used in Windows XP was a circular buffer of record structures that each contained a list of strings. A viewer resolved templates hosted in system library files and inserted the strings into appropriate positions. The newer event log format is proprietary binary XML. Unpacking chunks from an event log file from Windows 7 results in a complete XML document with a variable schema. The changes helped Microsoft tune the file format to real-world uses of event logs, such as long running logs with hundreds of megabytes of data, and system independent template resolution.
Related Work
------------
Andreas Schuster released the first public description of the .evtx file format in 2007. He is the author of the thorough document "Introducing the Microsoft Vista event log file format" that describes the motivation and details of the format. Mr. Schuster also maintains the Perl implementation of a parser called "Parse-Evtx". I referred to the source code of this library extensively during the development of python-evtx.
Joachim Metz also released a cross-platform, LGPL licensed C++ based parser in 2011. His document "Windows XML Event Log (EVTX): Analysis of EVTX" provides a detailed description of the structures and context of newer event log files.
Dependencies
------------
python-evtx works on both the 2.7 and 3.x versions of the Python programming language. As it is purely Python, the module works equally well across platforms. The code does not depend on any modules that require separate compilation; however, if you have lxml installed, its even nicer.
python-evtx operates on event log files from Windows operating systems newer than Windows Vista. These files typically have the file extension .evtx. Version 5.09 of the `file` utility identifies such a file as "MS Vista Windows Event Log". To manual confirm the file type, look for the ASCII string "ElfFile" in the first seven bytes:
willi/evtx » xxd -l 32 Security.evtx
0000000: 456c 6646 696c 6500 0000 0000 0000 0000 ElfFile.........
0000010: d300 0000 0000 0000 375e 0000 0000 0000 ........7^......
Examples
--------
Provided with the parsing module `Evtx` are three scripts that mimic the tools distributed with Parse-Evtx. `evtxinfo.py` prints metadata about the event log and verifies the checksums of each chunk. `evtxtemplates.py` builds and prints the templates used throughout the event log. Finally, `evtxdump.py` parses the event log and transforms the binary XML into a human readable ASCII XML format.
Note the length of the `evtxdump.py` script: its only 20 lines. Now, review the contents and notice the complete implementation of the logic:
print(e_views.XML_HEADER)
print('<Events>')
for record in log.records:
print(record.xml())
print('</Events>')
Working with python-evtx is really easy!
Installation
------------
Updates to python-evtx are pushed to PyPi, so you can install the module using either `easy_install` or `pip`. For example, you can use `pip` like so:
pip install python-evtx
The source code for python-evtx is hosted at Github, and you may download, fork, and review it from this repository (http://www.github.com/williballenthin/python-evtx). Please report issues or feature requests through Github's bug tracker associated with the project.
License
-------
python-evtx is licensed under the Apache License, Version 2.0. This means it is freely available for use and modification in a personal and professional capacity.
没有合适的资源?快使用搜索试试~ 我知道了~
python-evtx:适用于最新Windows事件日志文件(.evtx)的纯Python解析器
共38个文件
py:25个
evtx:6个
yml:3个
需积分: 50 11 下载量 47 浏览量
2021-05-04
06:24:09
上传
评论
收藏 447KB ZIP 举报
温馨提示
python-evtx 介绍 python-evtx是用于最近的Windows事件日志文件(文件扩展名为“ .evtx”的文件)的纯Python解析器。 该模块提供对File和Chunk标头,记录模板和事件条目的编程访问。 例如,您可以使用python-evtx从Mac或Linux工作站查看Windows 7系统的事件日志。 结构定义和解析策略在很大程度上受到了Andreas Schuster和他的Perl实现“ Parse-Evtx”的启发。 背景 随着Windows Vista的发布,Microsoft引入了更新的事件日志文件格式。 Windows XP中使用的格式是记录结构的循环缓冲区,每个记录结构都包含一个字符串列表。 查看器解析了系统库文件中托管的模板,并将字符串插入了适当的位置。 较新的事件日志格式是专有的二进制XML。 从Windows 7的事件日志文件中解压缩块会得到具有可
资源详情
资源评论
资源推荐
收起资源包目录
python-evtx-master.zip (38个子文件)
python-evtx-master
.github
workflows
test.yml 843B
publish.yml 865B
scripts
evtx_eid_record_numbers.py 924B
evtx_dates.py 2KB
evtx_info.py 4KB
evtx_record_structure.py 3KB
evtx_dump_chunk_slack.py 2KB
evtx_filter_records.py 2KB
evtx_dump.py 1KB
evtx_templates.py 2KB
evtx_extract_record.py 1KB
evtx_structure.py 6KB
evtx_record_template.py 736B
.travis.yml 390B
setup.py 2KB
README.md 4KB
LICENSE.TXT 11KB
tests
test_issue_38.py 1021B
fixtures.py 2KB
test_issue_43.py 616B
test_header.py 1KB
data
issue_38.evtx 68KB
dns_log_malformed.evtx 68KB
system.evtx 1.07MB
security.evtx 2.07MB
issue_43.evtx 2.07MB
readme.md 622B
issue_39.evtx 1MB
test_issue_39.py 1KB
test_issue_37.py 2KB
test_chunks.py 5KB
test_records.py 13KB
.gitignore 343B
Evtx
Evtx.py 17KB
Nodes.py 48KB
__init__.py 812B
BinaryParser.py 19KB
Views.py 10KB
共 38 条
- 1
八年一轮回
- 粉丝: 44
- 资源: 4727
上传资源 快速赚钱
- 我的内容管理 展开
- 我的资源 快来上传第一个资源
- 我的收益 登录查看自己的收益
- 我的积分 登录查看自己的积分
- 我的C币 登录后查看C币余额
- 我的收藏
- 我的下载
- 下载帮助
最新资源
- 基于QT+QML+C++实现的仿 Windows10 画图3D 的颜色选择器+源码
- 32代码四驱简易电动小车蓝牙控制、语音控制、寻光、巡线、避障(内含语音模块为天问ASR-PRO开发板与32单片机串口通信的代码)
- 基于STM32的计步器的设计
- 基于Qt与STM32平台开发的汽车车机系统上位机
- 基于MQTT的智能宠物投喂系统
- 312749069629470selfieU重绘.apk
- http%3A%2F%2Fimg.wsdl.vivo.com.cn%2Fappstore%2Fdeveloper%2Ficon%2F201412%2F201412231038336
- 主要记录B站up主莫烦matplotlib教程中的代码.zip
- Java SE Development Kit 8u411 Windows x64 Installer
- 用于科学绘图的 Matplotlib 样式.zip
资源上传下载、课程学习等过程中有任何疑问或建议,欢迎提出宝贵意见哦~我们会及时处理!
点击此处反馈
安全验证
文档复制为VIP权益,开通VIP直接复制
信息提交成功
评论0