winevt_c 0.3.2 → 0.3.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 00ad0bd482eaac0eda25838c5a183d40a57cf99da30221e9c3eaaeb6a7b6f2f7
-  data.tar.gz: 1ff2674b2503c078501740d851765b07a8010cd20e6dcc4e18560424266b860d
+  metadata.gz: 2c713acb1b15b2818f7cb81ecd564c923add4c2f34e7ef43f9f7cd3ea23b29ac
+  data.tar.gz: 8fd5b462b37d00132bf5adf5cd3ac13e225da909211295673581dc299aa22152
 SHA512:
-  metadata.gz: e14a6ea1584be82c9e111f83387838043f54be435e6509cd36b8162c76b5ee2ab951b4b25676239462628edb167521980b00da480fb4b304cfa1da051abb347a
-  data.tar.gz: ce59efd377aec40a5b63fb56e7fe36673b58b73aa54bc887f798c45eb2aadce3ee744b4c934110ee9f31a516621746f9f3f22868681d173067a7f4fb253837b1
+  metadata.gz: e4d48f7577dd0b39c525d5b444153caa747893818a7e6e1d46b0a26735ceeb0d9138aa6bad988d9eb97225595c61fbe1c11a6afeb2b200002ca61aa1fd77b49c
+  data.tar.gz: 66c894ca7b2b8cd70234c7ca67068b098c4179b74927d72672dfe10c9d9d5f82485de47a7c61f38f74fd77613c79e8497c1cdff5ac6b3f726e197f1bbb57252b

data/ext/winevt/winevt_utils.c

@@ -134,6 +134,9 @@ VALUE get_values(EVT_HANDLE handle)
 
   for (int i = 0; i < propCount; i++) {
     switch (pRenderedValues[i].Type) {
+    case EvtVarTypeNull:
+      rb_ary_push(userValues, Qnil);
+      break;
     case EvtVarTypeString:
       if (pRenderedValues[i].StringVal == NULL) {
         rb_ary_push(userValues, rb_utf8_str_new_cstr("(NULL)"));
@@ -193,16 +196,6 @@ VALUE get_values(EVT_HANDLE handle)
       result = pRenderedValues[i].BooleanVal ? "true" : "false";
       rb_ary_push(userValues, rb_utf8_str_new_cstr(result));
       break;
-    case EvtVarTypeHexInt32:
-      rbObj = ULONG2NUM(pRenderedValues[i].UInt32Val);
-      rbObj = rb_sprintf("%#x", rbObj);
-      rb_ary_push(userValues, rbObj);
-      break;
-    case EvtVarTypeHexInt64:
-      rbObj = ULONG2NUM(pRenderedValues[i].UInt64Val);
-      rbObj = rb_sprintf("%#x", rbObj);
-      rb_ary_push(userValues, rbObj);
-      break;
     case EvtVarTypeGuid:
       if (pRenderedValues[i].GuidVal != NULL) {
         StringFromCLSID(pRenderedValues[i].GuidVal, &tmpWChar);
@@ -212,13 +205,9 @@ VALUE get_values(EVT_HANDLE handle)
         rb_ary_push(userValues, rb_utf8_str_new_cstr("?"));
       }
       break;
-    case EvtVarTypeSid:
-      if (ConvertSidToStringSidW(pRenderedValues[i].SidVal, &tmpWChar)) {
-        result = wstr_to_mbstr(CP_UTF8, tmpWChar, -1);
-        rb_ary_push(userValues, rb_utf8_str_new_cstr(result));
-      } else {
-        rb_ary_push(userValues, rb_utf8_str_new_cstr("?"));
-      }
+    case EvtVarTypeSizeT:
+      rbObj = SIZET2NUM(pRenderedValues[i].SizeTVal);
+      rb_ary_push(userValues, rbObj);
       break;
     case EvtVarTypeFileTime:
       timestamp.QuadPart = pRenderedValues[i].FileTimeVal;
@@ -234,6 +223,44 @@ VALUE get_values(EVT_HANDLE handle)
         rb_ary_push(userValues, rb_utf8_str_new_cstr("?"));
       }
       break;
+    case EvtVarTypeSysTime:
+      if (pRenderedValues[i].SysTimeVal != NULL) {
+        st = *pRenderedValues[i].SysTimeVal;
+        sprintf(strTime, "%04d-%02d-%02d %02d:%02d:%02d.%dZ",
+                st.wYear , st.wMonth , st.wDay ,
+                st.wHour , st.wMinute , st.wSecond,
+                st.wMilliseconds);
+        rb_ary_push(userValues, rb_utf8_str_new_cstr(strTime));
+      } else {
+        rb_ary_push(userValues, rb_utf8_str_new_cstr("?"));
+      }
+      break;
+    case EvtVarTypeSid:
+      if (ConvertSidToStringSidW(pRenderedValues[i].SidVal, &tmpWChar)) {
+        result = wstr_to_mbstr(CP_UTF8, tmpWChar, -1);
+        rb_ary_push(userValues, rb_utf8_str_new_cstr(result));
+      } else {
+        rb_ary_push(userValues, rb_utf8_str_new_cstr("?"));
+      }
+      break;
+    case EvtVarTypeHexInt32:
+      rbObj = ULONG2NUM(pRenderedValues[i].UInt32Val);
+      rbObj = rb_sprintf("%#x", rbObj);
+      rb_ary_push(userValues, rbObj);
+      break;
+    case EvtVarTypeHexInt64:
+      rbObj = ULONG2NUM(pRenderedValues[i].UInt64Val);
+      rbObj = rb_sprintf("%#x", rbObj);
+      rb_ary_push(userValues, rbObj);
+      break;
+    case EvtVarTypeEvtXml:
+      if (pRenderedValues[i].XmlVal == NULL) {
+        rb_ary_push(userValues, rb_utf8_str_new_cstr("(NULL)"));
+      } else {
+        result = wstr_to_mbstr(CP_UTF8, pRenderedValues[i].XmlVal, -1);
+        rb_ary_push(userValues, rb_utf8_str_new_cstr(result));
+      }
+      break;
     default:
       rb_ary_push(userValues, rb_utf8_str_new_cstr("?"));
       break;

data/lib/winevt/query.rb

@@ -4,9 +4,9 @@ module Winevt
       alias_method :each_raw, :each
       def each
         each_raw do |xml, message, string_inserts|
-          message = message.gsub(/(%\d+)/, '\1$s')
-          message = sprintf(message, *string_inserts) rescue message.gsub(/(%\d+)/, "?")
-          yield(xml, message, string_inserts)
+          placeholdered_message = message.gsub(/(%\d+)/, '\1$s')
+          replaced_message = sprintf(placeholdered_message, *string_inserts) rescue message.gsub(/(%\d+)/, "?")
+          yield(xml, replaced_message, string_inserts)
         end
       end
     end

data/lib/winevt/subscribe.rb

@@ -4,9 +4,9 @@ module Winevt
       alias_method :each_raw, :each
       def each
         each_raw do |xml, message, string_inserts|
-          message = message.gsub(/(%\d+)/, '\1$s')
-          message = sprintf(message, *string_inserts) rescue message.gsub(/(%\d+)/, "?")
-          yield(xml, message, string_inserts)
+          placeholdered_message = message.gsub(/(%\d+)/, '\1$s')
+          replaced_message = sprintf(placeholdered_message, *string_inserts) rescue message.gsub(/(%\d+)/, "?")
+          yield(xml, replaced_message, string_inserts)
         end
       end
     end

data/lib/winevt/version.rb

@@ -1,3 +1,3 @@
 module Winevt
-  VERSION = "0.3.2"
+  VERSION = "0.3.3"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: winevt_c
 version: !ruby/object:Gem::Version
-  version: 0.3.2
+  version: 0.3.3
 platform: ruby
 authors:
 - Hiroshi Hatake