1. 事件日志文件是二进制文件,它有若干条记录单元组
成,其中最前面的是记录头,最后面的是记录尾。
2. 每条记录(包括记录头、记录尾)的头、尾的双字是
这条记录的长度(单位:字节)。如记录头48个字节
(0x30),记录就是
30 00 00 00 4C 66 4C 65 …… 30 00 00 00
注意这里是字节顺序:
30 00 00 00
W1L W1H W2L W2H
3.每条记录的第二个双字是特定的码 4C 66 4C 65
4.分析Windows API 日志存储数据结构。
typedef struct _EVENTLOGRECORD {
DWORD Length;
DWORD Reserved;
DWORD RecordNumber;
DWORD TimeGenerated;
DWORD TimeWritten;
DWORD EventID;
WORD EventType;
WORD NumStrings;
WORD EventCategory;
WORD ReservedFlags;
DWORD ClosingRecordNumber;
DWORD StringOffset;
DWORD UserSidLength;
DWORD UserSidOffset;
DWORD DataLength;
DWORD DataOffset;
} EVENTLOGRECORD, *PEVENTLOGRECORD;
5.文档分析
当AppEvent.Evt为空时,文件内容如下:
00000000h: 30 00 00 00 4C 66 4C 65 01 00 00 00 01 00 00 00 ; 0...LfLe........
00000010h: 30 00 00 00 30 00 00 00 01 00 00 00 00 00 00 00 ; 0...0...........
00000020h: 00 00 01 00 00 00 00 00 80 3A 09 00 30 00 00 00 ; ........€:..0...
00000030h: 28 00 00 00 11 11 11 11 22 22 22 22 33 33 33 33 ; (.......""""3333
00000040h: 44 44 44 44 30 00 00 00 30 63 01 00 28 02 00 00 ; DDDD0...0c..(...
00000050h: 01 00 00 00 28 00 00 00
当AppEvent.Evt写入1条,来源:Ci 事件id:1001 类型:4 信息项:Hello;Hello
00000000h: 30 00 00 00 4C 66 4C 65 01 00 00 00 01 00 00 00 ; 0...LfLe........
00000010h: 30 00 00 00 30 00 00 00 01 00 00 00 00 00 00 00 ; 0...0...........
00000020h: 00 00 01 00 01 00 00 00