Add debug ouput / more detailed traceback to make handling malformed EVTX files easier

[ichhabkeinbock]

I have MS Security Event Logs in EVTX format. I'm able to read them using williballenthin/python-evtx, but it's incredibly slow. Thus, I wanted to export the events using pyevtx-rs, but the EVTX data seems to be corrupt, since I get the following Traceback:

Traceback (most recent call last):
    File "test.py", line 7, in <module>
        for record in parser.records_json():
            RuntimeError: Failed to parse chunk header

The code I'm using is the one for getting JSON from the EVTX written in your README.

As I don't know, why one lib is parsing the EVTX without issues and the other one crashes, and also don't know where exactly the malformed chunk header is, I'd like to ask for the implementation of some debug informations, like the EventNumber of the event which caused the crash and other information. So it would be easier to find the reason for the crash.

// Edit I tested the original Rust Code and run the current release executable on the Security Event Logs. To be clear, these Event Logs are just exported from the Eventviewer and no additional changes have been made. So, either there's something not correctly handled within the code, or the events are not formatted as expected, what would be a MS issue. The code crached as well due to invalid chunk headers. This is the error message I get:

Failed to dump the next record.

Caused by:
    0: Failed to parse chunk number 2181
    1: Failed to parse chunk header
    2: Invalid EVTX chunk header magic, expected `ElfChnk0`, found `[ 6, 24, 37, 3F, 47, FD, 37, 60]`
Failed to dump the next record.

Caused by:
    0: Failed to parse chunk number 2182
    1: Failed to parse chunk header
    2: Invalid EVTX chunk header magic, expected `ElfChnk0`, found `[B4, 25, AB,  A,  2, 74, A7, 3B]`
Failed to dump the next record.

Caused by:
    0: Failed to parse chunk number 2183
    1: Failed to parse chunk header
    2: Invalid EVTX chunk header magic, expected `ElfChnk0`, found `[6F, F7, 7E, 88, 83, D4, F7, D8]`
Failed to dump the next record.

Caused by:
    0: Failed to parse chunk number 2184
    1: Failed to parse chunk header
    2: Invalid EVTX chunk header magic, expected `ElfChnk0`, found `[78, AA, B5, 63, 6A, D7, E4, F9]`
Failed to dump the next record.

Caused by:
    0: Failed to parse chunk number 2185
    1: Failed to parse chunk header
    2: Invalid EVTX chunk header magic, expected `ElfChnk0`, found `[EA, 39, 57, 5A, 90,  C, 50, B5]`
Failed to dump the next record.

Caused by:
    0: Failed to parse chunk number 2186
    1: Failed to parse chunk header
    2: Invalid EVTX chunk header magic, expected `ElfChnk0`, found `[F7, FB, B2, 9D, 20, E2, 78, 21]`
Failed to dump the next record.

Caused by:
    0: Failed to parse chunk number 2187
    1: Failed to parse chunk header
    2: Invalid EVTX chunk header magic, expected `ElfChnk0`, found `[21, F3, 53, F3, A0, 40, AC, 32]`
Failed to dump the next record.

Caused by:
    0: Failed to parse chunk number 2188
    1: Failed to parse chunk header
    2: Invalid EVTX chunk header magic, expected `ElfChnk0`, found `[AB, 63, B1, 65,  8, 29, 39, E9]`
Failed to dump the next record.

Caused by:
    0: Failed to parse chunk number 2189
    1: Failed to parse chunk header
    2: Invalid EVTX chunk header magic, expected `ElfChnk0`, found `[5D, A4, 2F, 3D, 47, 1E, 6F, 54]`
Failed to dump the next record.

Caused by:
    0: Failed to parse chunk number 2190
    1: Failed to parse chunk header
    2: Invalid EVTX chunk header magic, expected `ElfChnk0`, found `[A1, 2C, AE, 6A, 3C, 47, BE, 6B]`
Failed to dump the next record.

Caused by:
    0: Failed to parse chunk number 2191
    1: Failed to parse chunk header
    2: Invalid EVTX chunk header magic, expected `ElfChnk0`, found `[21, 98,  0, 73, A8, 81,  0, 7F]`
Failed to dump the next record.

Caused by:
    0: Failed to parse chunk number 2192
    1: Failed to parse chunk header
    2: Invalid EVTX chunk header magic, expected `ElfChnk0`, found `[5B,  1, 9A, DC, E6, 37, E1, 45]`