winevt_c 0.2.2 → 0.2.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1bdf0fc0bcbfe5bb9159a97beeb3d927abc91b7c778d294d3278c5a5070ef653
-  data.tar.gz: 3c331edbac89075b6f3d19efbc7bd6bf4fe538329f4b5366b0ae653ee673e13f
+  metadata.gz: ceb67692c7a6324d2bad7e87b741d74abc6779ab9d3952eca5fe1852feefdfaa
+  data.tar.gz: 1c15645f07fbec4a07d3cb3f61eb702a9c7876784d03a56fbe3a0a24720c6067
 SHA512:
-  metadata.gz: 5baa4bb0952f3c81ce3eebc2f36fdecb467cc79f980e6b6d77c7542c4a262a2f56ba67d2888923f6a1f52e9e258ed6561b8c0700f39313dd7c0b31f220db6ad1
-  data.tar.gz: a34ef222a4b7977a3c688288470a3e30df3f9c145b279b85c03c4b911a364b4c9c9aba05820bc1269c862b01c605c7a96ff105125cf9d8eb6164be896b20b4c4
+  metadata.gz: 6e903c5dfdefbc8add788b0bc3a5585ddaab32cb3811f4600a9126ec5f7d27977348955302b1e68700030e67af66b3c4d4e670d95ac1da3f11333df350bea23d
+  data.tar.gz: a48f284b8b70926a5cba4b92e98e5b172e88b4603701baf081648dfd9e5775fd6c9849cdefebfe92c8dbe46e0a82ced4d51c487827dc8eb70f5673e4a7ccdfc5

data/ext/winevt/winevt_utils.c

@@ -90,8 +90,9 @@ char* get_description(EVT_HANDLE handle)
   TCHAR paramEXE[MAX_PATH], messageEXE[MAX_PATH];
   HMODULE hModule = NULL;
 
-  static PCWSTR eventProperties[] = {L"Event/System/Provider/@Name", L"Event/System/EventID"};
-  EVT_HANDLE renderContext = EvtCreateRenderContext(2, eventProperties, EvtRenderContextValues);
+  static PCWSTR eventProperties[] = {L"Event/System/Provider/@Name", L"Event/System/EventID",
+                                     L"Event/System/EventID/@Qualifiers"};
+  EVT_HANDLE renderContext = EvtCreateRenderContext(3, eventProperties, EvtRenderContextValues);
   if (renderContext == NULL) {
     rb_raise(rb_eWinevtQueryError, "Failed to create renderContext");
   }
@@ -127,11 +128,15 @@ char* get_description(EVT_HANDLE handle)
     WideCharToMultiByte(CP_ACP, WC_COMPOSITECHECK | WC_DEFAULTCHAR, values[0].StringVal, -1, publisherName, MAX_PATH, NULL, NULL);
   }
 
-  DWORD eventId = 0;
+  DWORD eventId = 0, qualifiers = 0;
   if (values[1].Type == EvtVarTypeUInt16) {
     eventId = values[1].UInt16Val;
   }
 
+  if (values[2].Type == EvtVarTypeUInt16) {
+    qualifiers = values[2].UInt16Val;
+  }
+
   // Open publisher metadata
   hMetadata = EvtOpenPublisherMetadata(NULL, values[0].StringVal, NULL, MAKELCID(MAKELANGID(LANG_NEUTRAL, SUBLANG_NEUTRAL), SORT_DEFAULT), 0);
   if (hMetadata == NULL) {
@@ -202,21 +207,25 @@ char* get_description(EVT_HANDLE handle)
     hModule = LoadLibraryEx(messageEXE, NULL,
                             DONT_RESOLVE_DLL_REFERENCES | LOAD_LIBRARY_AS_DATAFILE);
 
-    if(FormatMessageW(FORMAT_MESSAGE_FROM_HMODULE | FORMAT_MESSAGE_IGNORE_INSERTS,
-                      hModule,
-                      eventId,
-                      0, // Use current code page. Users must specify character encoding in Ruby side.
-                      descriptionBuffer,
-                      MAX_BUFFER,
-                      NULL) == 0){
-
-      FormatMessageW(FORMAT_MESSAGE_FROM_HMODULE | FORMAT_MESSAGE_IGNORE_INSERTS,
-                     hModule,
-                     0xB0000000 | eventId,
-                     0, // Use current code page. Users must specify character encoding in Ruby side.
-                     descriptionBuffer,
-                     MAX_BUFFER,
-                     NULL);
+    if(!FormatMessageW(FORMAT_MESSAGE_FROM_HMODULE | FORMAT_MESSAGE_IGNORE_INSERTS,
+                         hModule,
+                         eventId,
+                         0, // Use current code page. Users must specify character encoding in Ruby side.
+                         descriptionBuffer,
+                         MAX_BUFFER,
+                       NULL)) {
+      if (ERROR_MR_MID_NOT_FOUND == GetLastError()) {
+        // clear buffer
+        ZeroMemory(descriptionBuffer, sizeof(descriptionBuffer));
+        eventId = qualifiers << 16 | eventId;
+        FormatMessageW(FORMAT_MESSAGE_FROM_HMODULE | FORMAT_MESSAGE_IGNORE_INSERTS,
+                       hModule,
+                       eventId,
+                       0, // Use current code page. Users must specify character encoding in Ruby side.
+                       descriptionBuffer,
+                       MAX_BUFFER,
+                       NULL);
+      }
     }
   }
 

data/lib/winevt/version.rb

@@ -1,3 +1,3 @@
 module Winevt
-  VERSION = "0.2.2"
+  VERSION = "0.2.3"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: winevt_c
 version: !ruby/object:Gem::Version
-  version: 0.2.2
+  version: 0.2.3
 platform: ruby
 authors:
 - Hiroshi Hatake