193 lines
6.8 KiB
Python
193 lines
6.8 KiB
Python
#!/usr/bin/python
|
|
# -*- coding: utf-8 -*-
|
|
#
|
|
# Copyright 2013 The Plaso Project Authors.
|
|
# Please see the AUTHORS file for details on individual authors.
|
|
#
|
|
# Licensed under the Apache License, Version 2.0 (the "License");
|
|
# you may not use this file except in compliance with the License.
|
|
# You may obtain a copy of the License at
|
|
#
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing, software
|
|
# distributed under the License is distributed on an "AS IS" BASIS,
|
|
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
# See the License for the specific language governing permissions and
|
|
# limitations under the License.
|
|
"""Parser for Windows EventLog (EVT) files."""
|
|
|
|
import logging
|
|
|
|
import pyevt
|
|
|
|
from plaso.events import time_events
|
|
from plaso.lib import errors
|
|
from plaso.lib import eventdata
|
|
from plaso.parsers import interface
|
|
from plaso.parsers import manager
|
|
|
|
|
|
class WinEvtRecordEvent(time_events.PosixTimeEvent):
|
|
"""Convenience class for a Windows EventLog (EVT) record event."""
|
|
|
|
DATA_TYPE = 'windows:evt:record'
|
|
|
|
def __init__(
|
|
self, timestamp, timestamp_description, evt_record, recovered=False):
|
|
"""Initializes the event.
|
|
|
|
Args:
|
|
timestamp: The POSIX timestamp value.
|
|
timestamp_description: A description string for the timestamp value.
|
|
evt_record: The EVT record (pyevt.record).
|
|
recovered: Boolean value to indicate the record was recovered, False
|
|
by default.
|
|
"""
|
|
super(WinEvtRecordEvent, self).__init__(timestamp, timestamp_description)
|
|
|
|
self.recovered = recovered
|
|
self.offset = evt_record.offset
|
|
|
|
try:
|
|
self.record_number = evt_record.identifier
|
|
except OverflowError as exception:
|
|
logging.warning(
|
|
u'Unable to assign the record identifier with error: {0:s}.'.format(
|
|
exception))
|
|
try:
|
|
event_identifier = evt_record.event_identifier
|
|
except OverflowError as exception:
|
|
event_identifier = None
|
|
logging.warning(
|
|
u'Unable to assign the event identifier with error: {0:s}.'.format(
|
|
exception))
|
|
|
|
# We are only interest in the event identifier code to match the behavior
|
|
# of EVTX event records.
|
|
if event_identifier is not None:
|
|
self.event_identifier = event_identifier & 0xffff
|
|
self.facility = (event_identifier >> 16) & 0x0fff
|
|
self.severity = event_identifier >> 30
|
|
self.message_identifier = event_identifier
|
|
|
|
self.event_type = evt_record.event_type
|
|
self.event_category = evt_record.event_category
|
|
self.source_name = evt_record.source_name
|
|
|
|
# Computer name is the value stored in the event record and does not
|
|
# necessarily corresponds with the actual hostname.
|
|
self.computer_name = evt_record.computer_name
|
|
self.user_sid = evt_record.user_security_identifier
|
|
|
|
self.strings = list(evt_record.strings)
|
|
|
|
|
|
class WinEvtParser(interface.BaseParser):
|
|
"""Parses Windows EventLog (EVT) files."""
|
|
|
|
NAME = 'winevt'
|
|
DESCRIPTION = u'Parser for Windows EventLog (EVT) files.'
|
|
|
|
def _ParseRecord(
|
|
self, parser_context, evt_record, file_entry=None, parser_chain=None,
|
|
recovered=False):
|
|
"""Extract data from a Windows EventLog (EVT) record.
|
|
|
|
Args:
|
|
parser_context: A parser context object (instance of ParserContext).
|
|
evt_record: An event record (pyevt.record).
|
|
file_entry: Optional file entry object (instance of dfvfs.FileEntry).
|
|
The default is None.
|
|
parser_chain: Optional string containing the parsing chain up to this
|
|
point. The default is None.
|
|
recovered: Boolean value to indicate the record was recovered, False
|
|
by default.
|
|
"""
|
|
try:
|
|
creation_time = evt_record.get_creation_time_as_integer()
|
|
except OverflowError as exception:
|
|
logging.warning(
|
|
u'Unable to read the timestamp from record with error: {0:s}'.format(
|
|
exception))
|
|
creation_time = 0
|
|
|
|
if creation_time:
|
|
event_object = WinEvtRecordEvent(
|
|
creation_time, eventdata.EventTimestamp.CREATION_TIME,
|
|
evt_record, recovered)
|
|
parser_context.ProduceEvent(
|
|
event_object, parser_chain=parser_chain, file_entry=file_entry)
|
|
|
|
try:
|
|
written_time = evt_record.get_written_time_as_integer()
|
|
except OverflowError as exception:
|
|
logging.warning(
|
|
u'Unable to read the timestamp from record with error: {0:s}'.format(
|
|
exception))
|
|
written_time = 0
|
|
|
|
if written_time:
|
|
event_object = WinEvtRecordEvent(
|
|
written_time, eventdata.EventTimestamp.WRITTEN_TIME,
|
|
evt_record, recovered)
|
|
parser_context.ProduceEvent(
|
|
event_object, parser_chain=parser_chain, file_entry=file_entry)
|
|
|
|
def Parse(self, parser_context, file_entry, parser_chain=None):
|
|
"""Extract data from a Windows EventLog (EVT) file.
|
|
|
|
Args:
|
|
parser_context: A parser context object (instance of ParserContext).
|
|
file_entry: A file entry object (instance of dfvfs.FileEntry).
|
|
parser_chain: Optional string containing the parsing chain up to this
|
|
point. The default is None.
|
|
|
|
Raises:
|
|
UnableToParseFile: when the file cannot be parsed.
|
|
"""
|
|
parser_chain = self._BuildParserChain(parser_chain)
|
|
|
|
file_object = file_entry.GetFileObject()
|
|
evt_file = pyevt.file()
|
|
evt_file.set_ascii_codepage(parser_context.codepage)
|
|
|
|
try:
|
|
evt_file.open_file_object(file_object)
|
|
except IOError as exception:
|
|
evt_file.close()
|
|
file_object.close()
|
|
raise errors.UnableToParseFile(
|
|
u'[{0:s}] unable to parse file {1:s} with error: {2:s}'.format(
|
|
self.NAME, file_entry.name, exception))
|
|
|
|
for record_index in range(0, evt_file.number_of_records):
|
|
try:
|
|
evt_record = evt_file.get_record(record_index)
|
|
self._ParseRecord(
|
|
parser_context, evt_record, file_entry=file_entry,
|
|
parser_chain=parser_chain)
|
|
except IOError as exception:
|
|
logging.warning((
|
|
u'[{0:s}] unable to parse event record: {1:d} in file: {2:s} '
|
|
u'with error: {3:s}').format(
|
|
self.NAME, record_index, file_entry.name, exception))
|
|
|
|
for record_index in range(0, evt_file.number_of_recovered_records):
|
|
try:
|
|
evt_record = evt_file.get_recovered_record(record_index)
|
|
self._ParseRecord(
|
|
parser_context, evt_record, file_entry=file_entry,
|
|
parser_chain=parser_chain, recovered=True)
|
|
except IOError as exception:
|
|
logging.info((
|
|
u'[{0:s}] unable to parse recovered event record: {1:d} in file: '
|
|
u'{2:s} with error: {3:s}').format(
|
|
self.NAME, record_index, file_entry.name, exception))
|
|
|
|
evt_file.close()
|
|
file_object.close()
|
|
|
|
|
|
manager.ParsersManager.RegisterParser(WinEvtParser)
|