evtx icon indicating copy to clipboard operation
evtx copied to clipboard

error on evtx files for header and hexdump

Open umpa385 opened this issue 2 years ago • 0 comments

seeing this error for evtx files? Not sure what is causing this though, is there any evtx logs that can't be handled by this rust binary?

Failed to dump the next record.

Caused by: 0: Failed to parse chunk number 0 1: Failed to parse chunk header 2: Failed to deserialize next_template_offset of type u32 3: Offset 0x08180000 (135790592) - An error has occurred while trying to deserialize binary stream

       Original message:
       `failed to fill whole buffer`
   
   Hexdump:
       
   
   ---------------------------------------------------------------------------
   Current Value 00
                 --
   
   00000000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
   00000010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
   00000020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
   00000030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
   00000040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
   00000050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
   00000060: 00 00 00 00                                      ....
   ----------------------------------------------------------------------------
   
4: failed to fill whole buffer

Failed to dump the next record.

Caused by: 0: Failed to parse chunk number 7 1: Failed to parse chunk header 2: Invalid EVTX chunk header magic, expected ElfChnk0, found [ 0, 0, 1B, 5, 0, 0, 2, E] Failed to dump the next record.

Caused by: 0: Failed to parse chunk number 8 1: Failed to parse chunk header 2: Invalid EVTX chunk header magic, expected ElfChnk0, found [8A, 14, B3, D8, 1, F, 1, 1] Failed to dump the next record.

umpa385 avatar Sep 01 '22 18:09 umpa385