diff --git a/.gitignore b/.gitignore index 6eaa32f..f395d4d 100644 --- a/.gitignore +++ b/.gitignore @@ -2,3 +2,4 @@ tests/cmake-build-debug/ .idea/ +.DS_Store \ No newline at end of file diff --git a/README.md b/README.md index e99733c..7bc4347 100644 --- a/README.md +++ b/README.md @@ -75,6 +75,7 @@ Hex patterns, include patterns and magic files for the use with the ImHex Hex Ed | DEX | | [`patterns/dex.hexpat`](patterns/dex.hexpat) | Dalvik EXecutable Format | | DS_Store | `application/octet-stream` | [`patterns/dsstore.hexpat`](patterns/dsstore.hexpat) | .DS_Store file format | | UEFI | | [`patterns/uefi.hexpat`](patterns/uefi.hexpat)` | UEFI structs for parsing efivars | +| EVTX | | [`patterns/evtx.hexpat`](patterns/evtx.hexpat) | MS Windows Vista Event Log | ### Scripts diff --git a/patterns/evtx.hexpat b/patterns/evtx.hexpat new file mode 100644 index 0000000..6680a3f --- /dev/null +++ b/patterns/evtx.hexpat @@ -0,0 +1,57 @@ +#pragma endian little + +struct Header { + char signature[0x8]; + u64 first_chunk_number; + u64 last_chunk_number; + u64 next_record_identifier; + u32 header_size; + u16 minor_format_version; + u16 major_format_version; + u16 header_block_size; + u16 number_of_chunks; + u8 unknown[0x4C]; + u32 file_Flag; + u32 checkSum; + u8 unknown2[3968]; +}; + +struct BinaryXML{ + u8 fragment_header_token; + u8 major_version; + u8 minor_version; + u8 flags; +}; + +struct Event_Record{ + u32 signature; + u32 size; + u64 event_record_identifier; + u64 written_data_amd_time; + BinaryXML binaryxml; +}; + +struct Chunk{ + char signature[0x8]; + u64 first_event_record_number; + u64 last_event_record_number; + u64 first_event_record_identifier; + u64 last_event_record_identifier; + u32 header_size; + u32 last_event_record_data_offset; + u32 free_space_offset; + u32 event_records_checksum; + u8 unknown[64]; + u32 unknown2; + u32 checksum; + u8 common_string_offset_array[256]; + u8 templatePtr[128]; + Event_Rsecord event_record; +}; + +struct Evtx { + Header header; + Chunk chunk; +}; + +Evtx evtx @ 0x00; diff --git a/tests/patterns/test_data/evtx.hexpat.evtx b/tests/patterns/test_data/evtx.hexpat.evtx new file mode 100644 index 0000000..5e4995b Binary files /dev/null and b/tests/patterns/test_data/evtx.hexpat.evtx differ