winevt_c 0.2.4-x86-mingw32 → 0.3.0-x86-mingw32

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f2ddcba0748cab7991885f70297cbee4bdc2a2db21a75af65e5dc2d773184f02
-  data.tar.gz: 3e5ba3267549bd1e9f2e8acade28a728d476a78cf3a951d3990c8e34b82c6f18
+  metadata.gz: ec281ab900bda5f04c90ce925feb586e29baa7765b92c523054f99dad40874d4
+  data.tar.gz: 74c01f7f85c5d3d26364883ceba104d1640a286736a654a079e9dbe7198a8186
 SHA512:
-  metadata.gz: 49ed30e77fccd83c616c0956228db16c2f339e7d6f9070f15e3480b77d419580f5ac3491d66e11a629e0cf061a5def1007dd23d865d97df1efe6d556a37c8b6a
-  data.tar.gz: c00e3a0bfb9d7bb40cd25c303cb04132059f8e271b90dc4423f717e80dcc362089fe51b5d74837895bc9af580ee46df8ae305129bc57790ce2a312cc58458ba7
+  metadata.gz: 8d92bdbd2c84912e045678c8bff2cf6dfa08dac8472147e68c57a3ac6f5d87d1020fdbeed5a279b999ae50282909569edb5777790bcb20fd62ae9df3111114bb
+  data.tar.gz: d5e37e9b7066db2b79e26ac89ebd43d92694640a0eeb7a8a9c0e18aa82b34d040bb217a74dca725710fd6ab6941381c1d98c2d4cfd3f2461f3e3ffcf052d1107

data/ext/winevt/extconf.rb

@@ -12,8 +12,10 @@ dir_config("winevt", includedir, libdir)
 
 have_library("wevtapi")
 have_func("EvtQuery", "winevt.h")
+have_library("advapi32")
+have_library("ole32")
 
-$LDFLAGS << " -lwevtapi"
+$LDFLAGS << " -lwevtapi -ladvapi32 -lole32"
 $CFLAGS << " -std=c99 -fPIC -fms-extensions "
 # $CFLAGS << " -g -O0"
 

data/ext/winevt/winevt_c.h

@@ -24,6 +24,7 @@
 char* wstr_to_mbstr(UINT cp, const WCHAR *wstr, int clen);
 char* render_event(EVT_HANDLE handle, DWORD flags);
 char* get_description(EVT_HANDLE handle);
+VALUE get_values(EVT_HANDLE handle);
 
 VALUE rb_cQuery;
 VALUE rb_cChannel;

data/ext/winevt/winevt_query.c

@@ -159,6 +159,15 @@ rb_winevt_query_message(VALUE self)
   return rb_utf8_str_new_cstr(result);
 }
 
+static VALUE
+rb_winevt_query_string_inserts(VALUE self)
+{
+  struct WinevtQuery *winevtQuery;
+
+  TypedData_Get_Struct(self, struct WinevtQuery, &rb_winevt_query_type, winevtQuery);
+  return get_values(winevtQuery->event);
+}
+
 static DWORD
 get_evt_seek_flag_from_cstr(char* flag_str)
 {
@@ -221,7 +230,10 @@ rb_winevt_query_each(VALUE self)
   TypedData_Get_Struct(self, struct WinevtQuery, &rb_winevt_query_type, winevtQuery);
 
   while (rb_winevt_query_next(self)) {
-    rb_yield_values(2, rb_winevt_query_render(self), rb_winevt_query_message(self));
+    rb_yield_values(3,
+                    rb_winevt_query_render(self),
+                    rb_winevt_query_message(self),
+                    rb_winevt_query_string_inserts(self));
   }
 
   return Qnil;
@@ -236,6 +248,7 @@ void Init_winevt_query(VALUE rb_cEventLog)
   rb_define_method(rb_cQuery, "next", rb_winevt_query_next, 0);
   rb_define_method(rb_cQuery, "render", rb_winevt_query_render, 0);
   rb_define_method(rb_cQuery, "message", rb_winevt_query_message, 0);
+  rb_define_method(rb_cQuery, "string_inserts", rb_winevt_query_string_inserts, 0);
   rb_define_method(rb_cQuery, "seek", rb_winevt_query_seek, 1);
   rb_define_method(rb_cQuery, "offset", rb_winevt_query_get_offset, 0);
   rb_define_method(rb_cQuery, "offset=", rb_winevt_query_set_offset, 1);

data/ext/winevt/winevt_subscribe.c

@@ -174,6 +174,15 @@ rb_winevt_subscribe_message(VALUE self)
   return rb_utf8_str_new_cstr(result);
 }
 
+static VALUE
+rb_winevt_subscribe_string_inserts(VALUE self)
+{
+  struct WinevtSubscribe *winevtSubscribe;
+
+  TypedData_Get_Struct(self, struct WinevtSubscribe, &rb_winevt_subscribe_type, winevtSubscribe);
+  return get_values(winevtSubscribe->event);
+}
+
 static VALUE
 rb_winevt_subscribe_each(VALUE self)
 {
@@ -184,7 +193,10 @@ rb_winevt_subscribe_each(VALUE self)
   TypedData_Get_Struct(self, struct WinevtSubscribe, &rb_winevt_subscribe_type, winevtSubscribe);
 
   while (rb_winevt_subscribe_next(self)) {
-    rb_yield_values(2, rb_winevt_subscribe_render(self), rb_winevt_subscribe_message(self));
+    rb_yield_values(3,
+                    rb_winevt_subscribe_render(self),
+                    rb_winevt_subscribe_message(self),
+                    rb_winevt_subscribe_string_inserts(self));
   }
 
   return Qnil;
@@ -213,6 +225,7 @@ void Init_winevt_subscribe(VALUE rb_cEventLog)
   rb_define_method(rb_cSubscribe, "next", rb_winevt_subscribe_next, 0);
   rb_define_method(rb_cSubscribe, "render", rb_winevt_subscribe_render, 0);
   rb_define_method(rb_cSubscribe, "message", rb_winevt_subscribe_message, 0);
+  rb_define_method(rb_cSubscribe, "string_inserts", rb_winevt_subscribe_string_inserts, 0);
   rb_define_method(rb_cSubscribe, "each", rb_winevt_subscribe_each, 0);
   rb_define_method(rb_cSubscribe, "bookmark", rb_winevt_subscribe_get_bookmark, 0);
   rb_define_method(rb_cSubscribe, "tail?", rb_winevt_subscribe_tail_p, 0);

data/ext/winevt/winevt_utils.c

@@ -1,4 +1,6 @@
 #include <winevt_c.h>
+#include <sddl.h>
+#include <stdlib.h>
 
 char*
 wstr_to_mbstr(UINT cp, const WCHAR *wstr, int clen)
@@ -69,6 +71,183 @@ char* render_event(EVT_HANDLE handle, DWORD flags)
   return result;
 }
 
+VALUE get_values(EVT_HANDLE handle)
+{
+  PWSTR buffer = NULL;
+  ULONG bufferSize = 0;
+  ULONG bufferSizeNeeded = 0;
+  DWORD status, propCount = 0;
+  char *result = "";
+  LPTSTR msgBuf;
+  WCHAR* tmpWChar = NULL;
+  VALUE userValues = rb_ary_new();
+
+  static PCWSTR eventProperties[] = { L"Event/EventData/Data[1]" };
+  EVT_HANDLE renderContext = EvtCreateRenderContext(0, NULL, EvtRenderContextUser);
+  if (renderContext == NULL) {
+    rb_raise(rb_eWinevtQueryError, "Failed to create renderContext");
+  }
+
+  do {
+    if (bufferSizeNeeded > bufferSize) {
+      free(buffer);
+      bufferSize = bufferSizeNeeded;
+      buffer = malloc(bufferSize);
+      if (buffer == NULL) {
+        status = ERROR_OUTOFMEMORY;
+        bufferSize = 0;
+        rb_raise(rb_eWinevtQueryError, "Out of memory");
+        break;
+      }
+    }
+
+    if (EvtRender(renderContext,
+                  handle,
+                  EvtRenderEventValues,
+                  bufferSize,
+                  buffer,
+                  &bufferSizeNeeded,
+                  &propCount) != FALSE) {
+      status = ERROR_SUCCESS;
+    } else {
+      status = GetLastError();
+    }
+  } while (status == ERROR_INSUFFICIENT_BUFFER);
+
+  if (status != ERROR_SUCCESS) {
+    FormatMessage(
+        FORMAT_MESSAGE_ALLOCATE_BUFFER |
+        FORMAT_MESSAGE_FROM_SYSTEM |
+        FORMAT_MESSAGE_IGNORE_INSERTS,
+        NULL, status,
+        MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT),
+        &msgBuf, 0, NULL);
+    result = wstr_to_mbstr(CP_ACP, msgBuf, -1);
+
+    rb_raise(rb_eWinevtQueryError, "ErrorCode: %d\nError: %s\n", status, result);
+  }
+
+  PEVT_VARIANT pRenderedValues = (PEVT_VARIANT)buffer;
+  LARGE_INTEGER timestamp;
+  SYSTEMTIME st;
+  FILETIME ft;
+  CHAR strTime[128];
+  VALUE rbObj;
+
+  for (int i = 0; i < propCount; i++) {
+    switch (pRenderedValues[i].Type) {
+    case EvtVarTypeString:
+      if (pRenderedValues[i].StringVal == NULL) {
+        rb_ary_push(userValues, rb_utf8_str_new_cstr("(NULL)"));
+      } else {
+        result = wstr_to_mbstr(CP_UTF8, pRenderedValues[i].StringVal, -1);
+        rb_ary_push(userValues, rb_utf8_str_new_cstr(result));
+      }
+      break;
+    case EvtVarTypeAnsiString:
+      if (pRenderedValues[i].AnsiStringVal == NULL) {
+        rb_ary_push(userValues, rb_utf8_str_new_cstr("(NULL)"));
+      } else {
+        rb_ary_push(userValues, rb_utf8_str_new_cstr((char *)pRenderedValues[i].AnsiStringVal));
+      }
+      break;
+    case EvtVarTypeSByte:
+      rbObj = INT2NUM((INT32)pRenderedValues[i].SByteVal);
+      rb_ary_push(userValues, rbObj);
+      break;
+    case EvtVarTypeByte:
+      rbObj = INT2NUM((UINT32)pRenderedValues[i].ByteVal);
+      rb_ary_push(userValues, rbObj);
+      break;
+    case EvtVarTypeInt16:
+      rbObj = INT2NUM((INT32)pRenderedValues[i].Int16Val);
+      rb_ary_push(userValues, rbObj);
+      break;
+    case EvtVarTypeUInt16:
+      rbObj = UINT2NUM((UINT32)pRenderedValues[i].UInt16Val);
+      rb_ary_push(userValues, rbObj);
+      break;
+    case EvtVarTypeInt32:
+      rbObj = INT2NUM(pRenderedValues[i].Int32Val);
+      rb_ary_push(userValues, rbObj);
+      break;
+    case EvtVarTypeUInt32:
+      rbObj = UINT2NUM(pRenderedValues[i].UInt32Val);
+      rb_ary_push(userValues, rbObj);
+      break;
+    case EvtVarTypeInt64:
+      rbObj = LONG2NUM(pRenderedValues[i].Int64Val);
+      rb_ary_push(userValues, rbObj);
+      break;
+    case EvtVarTypeUInt64:
+      rbObj = ULONG2NUM(pRenderedValues[i].UInt64Val);
+      rb_ary_push(userValues, rbObj);
+      break;
+    case EvtVarTypeSingle:
+      sprintf(result, "%f", pRenderedValues[i].SingleVal);
+      rb_ary_push(userValues, rb_utf8_str_new_cstr(result));
+      break;
+    case EvtVarTypeDouble:
+      sprintf(result, "%lf", pRenderedValues[i].DoubleVal);
+      rb_ary_push(userValues, rb_utf8_str_new_cstr(result));
+      break;
+    case EvtVarTypeBoolean:
+      result = pRenderedValues[i].BooleanVal ? "true" : "false";
+      rb_ary_push(userValues, rb_utf8_str_new_cstr(result));
+      break;
+    case EvtVarTypeHexInt32:
+      rbObj = ULONG2NUM(pRenderedValues[i].UInt32Val);
+      rbObj = rb_sprintf("%#x", rbObj);
+      rb_ary_push(userValues, rbObj);
+      break;
+    case EvtVarTypeHexInt64:
+      rbObj = ULONG2NUM(pRenderedValues[i].UInt64Val);
+      rbObj = rb_sprintf("%#x", rbObj);
+      rb_ary_push(userValues, rbObj);
+      break;
+    case EvtVarTypeGuid:
+      if (pRenderedValues[i].GuidVal != NULL) {
+        StringFromCLSID(pRenderedValues[i].GuidVal, &tmpWChar);
+        result = wstr_to_mbstr(CP_UTF8, tmpWChar, -1);
+        rb_ary_push(userValues, rb_utf8_str_new_cstr(result));
+      } else {
+        rb_ary_push(userValues, rb_utf8_str_new_cstr("?"));
+      }
+      break;
+    case EvtVarTypeSid:
+      if (ConvertSidToStringSidW(pRenderedValues[i].SidVal, &tmpWChar)) {
+        result = wstr_to_mbstr(CP_UTF8, tmpWChar, -1);
+        rb_ary_push(userValues, rb_utf8_str_new_cstr(result));
+      } else {
+        rb_ary_push(userValues, rb_utf8_str_new_cstr("?"));
+      }
+      break;
+    case EvtVarTypeFileTime:
+      timestamp.QuadPart = pRenderedValues[i].FileTimeVal;
+      ft.dwHighDateTime = timestamp.HighPart;
+      ft.dwLowDateTime  = timestamp.LowPart;
+      if (FileTimeToSystemTime( &ft, &st )) {
+        sprintf(strTime, "%04d-%02d-%02d %02d:%02d:%02d.%dZ",
+                st.wYear , st.wMonth , st.wDay ,
+                st.wHour , st.wMinute , st.wSecond,
+                st.wMilliseconds);
+        rb_ary_push(userValues, rb_utf8_str_new_cstr(strTime));
+      } else {
+        rb_ary_push(userValues, rb_utf8_str_new_cstr("?"));
+      }
+      break;
+    default:
+      rb_ary_push(userValues, rb_utf8_str_new_cstr("?"));
+      break;
+    }
+  }
+
+  if (buffer)
+    free(buffer);
+
+  return userValues;
+}
+
 char* get_description(EVT_HANDLE handle)
 {
 #define MAX_BUFFER 65535
@@ -208,11 +387,11 @@ char* get_description(EVT_HANDLE handle)
                             DONT_RESOLVE_DLL_REFERENCES | LOAD_LIBRARY_AS_DATAFILE);
 
     if(!FormatMessageW(FORMAT_MESSAGE_FROM_HMODULE | FORMAT_MESSAGE_IGNORE_INSERTS,
-                         hModule,
-                         eventId,
-                         0, // Use current code page. Users must specify character encoding in Ruby side.
-                         descriptionBuffer,
-                         MAX_BUFFER,
+                       hModule,
+                       eventId,
+                       0, // Use current code page. Users must specify character encoding in Ruby side.
+                       descriptionBuffer,
+                       MAX_BUFFER,
                        NULL)) {
       if (ERROR_MR_MID_NOT_FOUND == GetLastError()) {
         // clear buffer

data/lib/winevt/version.rb

@@ -1,3 +1,3 @@
 module Winevt
-  VERSION = "0.2.4"
+  VERSION = "0.3.0"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: winevt_c
 version: !ruby/object:Gem::Version
-  version: 0.2.4
+  version: 0.3.0
 platform: x86-mingw32
 authors:
 - Hiroshi Hatake
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2019-06-22 00:00:00.000000000 Z
+date: 2019-06-24 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler