winevt_c 0.3.6 → 0.3.7

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7a51085b5870b9ca54cc61070efc7b9c2e337f64db3c49c26bd02134989e4c49
-  data.tar.gz: 78a567ee5ccc9f71a909131218272d8868e240981de93f91492247bbb4456585
+  metadata.gz: '09884e034a7cae3228dd7531156419f3f3838249eed22babb630adef47e12907'
+  data.tar.gz: a0839583a5c6a8d14e493f8af87dc4ca31f658add382222f7104690e1f39dfc4
 SHA512:
-  metadata.gz: e4e0df85d30e468bf018168244c6979725e7e57bb9e9e5d361b83148b2d6a2ee7bba90d04de232eac59c70260635a628f230f4362cb6c1ae73bdab3c3634adeb
-  data.tar.gz: 7fb4a5811543f623a028e951498c4ad6637b00c716615c9bc5d5f1b781bb008551477237c6a9c409aecafcbd1a12b0457439fdc2da23ebeee27ddf748df93336
+  metadata.gz: 22e5cd794c57f957cdee9aca0b91a9975d7f8ccd50bd9975f3e0538176b417616f5da3aebcfeec8853f7398286cc0ede1507670d002c78fd5236d578b70ee672
+  data.tar.gz: fc7ea5311b493b56cdb2942fee4469eaa6efd2dd4655806a8ecdedaa64b030595d248c8fb285712dcfe30c6792921990d1cffe1264d6ea46ec0552c8a1584244

data/ext/winevt/winevt_query.c

@@ -142,7 +142,6 @@ rb_winevt_query_render(VALUE self)
 
   TypedData_Get_Struct(self, struct WinevtQuery, &rb_winevt_query_type, winevtQuery);
   result = render_event(winevtQuery->event, EvtRenderEventXml);
-  get_description(winevtQuery->event);
 
   return rb_utf8_str_new_cstr(result);
 }

data/ext/winevt/winevt_utils.c

@@ -282,27 +282,20 @@ VALUE get_values(EVT_HANDLE handle)
 char* get_description(EVT_HANDLE handle)
 {
 #define MAX_BUFFER 65535
-  WCHAR      buffer[4096], file[4096];
+  WCHAR      buffer[4096], *msg = buffer;
   WCHAR      descriptionBuffer[MAX_BUFFER];
   ULONG      bufferSize = 0;
   ULONG      bufferSizeNeeded = 0;
   EVT_HANDLE event;
   ULONG      status, count;
-  char*      errBuf;
   char*      result = "";
-  LPTSTR     msgBuf;
-  TCHAR publisherName[MAX_PATH];
-  TCHAR fileName[MAX_PATH];
+  LPTSTR     msgBuf = "";
   EVT_HANDLE hMetadata = NULL;
   PEVT_VARIANT values = NULL;
-  PEVT_VARIANT pProperty = NULL;
-  PEVT_VARIANT pTemp = NULL;
-  TCHAR paramEXE[MAX_PATH], messageEXE[MAX_PATH];
-  HMODULE hModule = NULL;
-
-  static PCWSTR eventProperties[] = {L"Event/System/Provider/@Name", L"Event/System/EventID",
-                                     L"Event/System/EventID/@Qualifiers"};
-  EVT_HANDLE renderContext = EvtCreateRenderContext(3, eventProperties, EvtRenderContextValues);
+  PWSTR pwBuffer = NULL;
+
+  static PCWSTR eventProperties[] = {L"Event/System/Provider/@Name"};
+  EVT_HANDLE renderContext = EvtCreateRenderContext(1, eventProperties, EvtRenderContextValues);
   if (renderContext == NULL) {
     rb_raise(rb_eWinevtQueryError, "Failed to create renderContext");
   }
@@ -336,18 +329,6 @@ char* get_description(EVT_HANDLE handle)
 
   // Obtain buffer as EVT_VARIANT pointer. To avoid ErrorCide 87 in EvtRender.
   values = (PEVT_VARIANT)buffer;
-  if ((values[0].Type == EvtVarTypeString) && (values[0].StringVal != NULL)) {
-    WideCharToMultiByte(CP_ACP, WC_COMPOSITECHECK | WC_DEFAULTCHAR, values[0].StringVal, -1, publisherName, MAX_PATH, NULL, NULL);
-  }
-
-  DWORD eventId = 0, qualifiers = 0;
-  if (values[1].Type == EvtVarTypeUInt16) {
-    eventId = values[1].UInt16Val;
-  }
-
-  if (values[2].Type == EvtVarTypeUInt16) {
-    qualifiers = values[2].UInt16Val;
-  }
 
   // Open publisher metadata
   hMetadata = EvtOpenPublisherMetadata(NULL, values[0].StringVal, NULL, MAKELCID(MAKELANGID(LANG_NEUTRAL, SUBLANG_NEUTRAL), SORT_DEFAULT), 0);
@@ -357,91 +338,47 @@ char* get_description(EVT_HANDLE handle)
     goto cleanup;
   }
 
-  /* TODO: Should we implement parameter file reading in C?
-  // Get the metadata property. If the buffer is not big enough, reallocate the buffer.
-  // Get parameter file first.
-  if  (!EvtGetPublisherMetadataProperty(hMetadata, EvtPublisherMetadataParameterFilePath, 0, bufferSize, pProperty, &count)) {
+  if (!EvtFormatMessage(hMetadata, handle, 0xffffffff, 0, NULL, EvtFormatMessageEvent, 4096, buffer, &bufferSizeNeeded)) {
     status = GetLastError();
-    if (ERROR_INSUFFICIENT_BUFFER == status) {
-      bufferSize = count;
-      pTemp = (PEVT_VARIANT)realloc(pProperty, bufferSize);
-      if (pTemp) {
-        pProperty = pTemp;
-        pTemp = NULL;
-        EvtGetPublisherMetadataProperty(hMetadata, EvtPublisherMetadataParameterFilePath, 0, bufferSize, pProperty, &count);
-      } else {
-        rb_raise(rb_eWinevtQueryError, "realloc failed");
-      }
-    }
-
-    if (ERROR_SUCCESS != (status = GetLastError())) {
-      rb_raise(rb_eWinevtQueryError, "EvtGetPublisherMetadataProperty for parameter file failed with %d\n", GetLastError());
-    }
-  }
-
-  if ((pProperty->Type == EvtVarTypeString) && (pProperty->StringVal != NULL)) {
-    WideCharToMultiByte(CP_ACP, WC_COMPOSITECHECK | WC_DEFAULTCHAR, pProperty->StringVal, -1, fileName, MAX_PATH, NULL, NULL);
-  }
-  if (paramEXE) {
-    ExpandEnvironmentStrings(fileName, paramEXE, _countof(paramEXE));
-  }
-  */
 
-  // Get the metadata property. If the buffer is not big enough, reallocate the buffer.
-  // Get message file contents.
-  if  (!EvtGetPublisherMetadataProperty(hMetadata, EvtPublisherMetadataMessageFilePath, 0, bufferSize, pProperty, &count)) {
-    status = GetLastError();
-    if (ERROR_INSUFFICIENT_BUFFER == status) {
-      bufferSize = count;
-      pTemp = (PEVT_VARIANT)xrealloc(pProperty, bufferSize);
-      if (pTemp) {
-        pProperty = pTemp;
-        pTemp = NULL;
-        EvtGetPublisherMetadataProperty(hMetadata, EvtPublisherMetadataMessageFilePath, 0, bufferSize, pProperty, &count);
-      } else {
-        rb_raise(rb_eWinevtQueryError, "realloc failed");
+    if (status != ERROR_EVT_UNRESOLVED_VALUE_INSERT) {
+      switch (status) {
+      case ERROR_EVT_MESSAGE_NOT_FOUND:
+      case ERROR_EVT_MESSAGE_ID_NOT_FOUND:
+      case ERROR_EVT_MESSAGE_LOCALE_NOT_FOUND:
+      case ERROR_RESOURCE_LANG_NOT_FOUND:
+      case ERROR_MUI_FILE_NOT_FOUND:
+      case ERROR_EVT_UNRESOLVED_PARAMETER_INSERT:
+        return "";
       }
-    }
 
-    if (ERROR_SUCCESS != (status = GetLastError())) {
-      rb_raise(rb_eWinevtQueryError, "EvtGetPublisherMetadataProperty for message file failed with %d\n", GetLastError());
+      if (status != ERROR_INSUFFICIENT_BUFFER)
+        rb_raise(rb_eWinevtQueryError, "ErrorCode: %d", status);
     }
-  }
-
-  if ((pProperty->Type == EvtVarTypeString) && (pProperty->StringVal != NULL)) {
-    WideCharToMultiByte(CP_ACP, WC_COMPOSITECHECK | WC_DEFAULTCHAR, pProperty->StringVal, -1, fileName, MAX_PATH, NULL, NULL);
-  }
-  if (messageEXE) {
-    ExpandEnvironmentStrings(fileName, messageEXE, _countof(messageEXE));
-  }
 
-  if (messageEXE != NULL) {
-    hModule = LoadLibraryEx(messageEXE, NULL,
-                            DONT_RESOLVE_DLL_REFERENCES | LOAD_LIBRARY_AS_DATAFILE);
-
-    if(!FormatMessageW(FORMAT_MESSAGE_FROM_HMODULE | FORMAT_MESSAGE_IGNORE_INSERTS,
-                       hModule,
-                       eventId,
-                       0, // Use current code page. Users must specify character encoding in Ruby side.
-                       descriptionBuffer,
-                       MAX_BUFFER,
-                       NULL)) {
-      if (ERROR_MR_MID_NOT_FOUND == GetLastError()) {
-        // clear buffer
-        ZeroMemory(descriptionBuffer, sizeof(descriptionBuffer));
-        eventId = qualifiers << 16 | eventId;
-        FormatMessageW(FORMAT_MESSAGE_FROM_HMODULE | FORMAT_MESSAGE_IGNORE_INSERTS,
-                       hModule,
-                       eventId,
-                       0, // Use current code page. Users must specify character encoding in Ruby side.
-                       descriptionBuffer,
-                       MAX_BUFFER,
-                       NULL);
+    if (status == ERROR_INSUFFICIENT_BUFFER) {
+      msg = (WCHAR *)malloc(sizeof(WCHAR) * bufferSizeNeeded);
+
+      if(!EvtFormatMessage(hMetadata, handle, 0xffffffff, 0, NULL, EvtFormatMessageEvent, bufferSizeNeeded, msg, &bufferSizeNeeded)) {
+        status = GetLastError();
+
+        if (status != ERROR_EVT_UNRESOLVED_VALUE_INSERT) {
+          switch (status) {
+          case ERROR_EVT_MESSAGE_NOT_FOUND:
+          case ERROR_EVT_MESSAGE_ID_NOT_FOUND:
+          case ERROR_EVT_MESSAGE_LOCALE_NOT_FOUND:
+          case ERROR_RESOURCE_LANG_NOT_FOUND:
+          case ERROR_MUI_FILE_NOT_FOUND:
+          case ERROR_EVT_UNRESOLVED_PARAMETER_INSERT:
+            return "";
+          }
+
+          rb_raise(rb_eWinevtQueryError, "ErrorCode: %d", status);
+        }
       }
     }
   }
-
-  result = wstr_to_mbstr(CP_UTF8, descriptionBuffer, -1);
+  result = wstr_to_mbstr(CP_UTF8, msg, -1);
 
 #undef MAX_BUFFER
 
@@ -453,8 +390,5 @@ cleanup:
   if (hMetadata)
     EvtClose(hMetadata);
 
-  if (hModule)
-    FreeLibrary(hModule);
-
   return result;
 }

data/lib/winevt/query.rb

@@ -1,14 +1,6 @@
 module Winevt
   class EventLog
     class Query
-      alias_method :each_raw, :each
-      def each
-        each_raw do |xml, message, string_inserts|
-          placeholdered_message = message.gsub(/(%\d+)/, '\1$s')
-          replaced_message = sprintf(placeholdered_message, *string_inserts) rescue message.gsub(/(%\d+)/, "?")
-          yield(xml, replaced_message, string_inserts)
-        end
-      end
     end
   end
 end

data/lib/winevt/subscribe.rb

@@ -1,14 +1,6 @@
 module Winevt
   class EventLog
     class Subscribe
-      alias_method :each_raw, :each
-      def each
-        each_raw do |xml, message, string_inserts|
-          placeholdered_message = message.gsub(/(%\d+)/, '\1$s')
-          replaced_message = sprintf(placeholdered_message, *string_inserts) rescue message.gsub(/(%\d+)/, "?")
-          yield(xml, replaced_message, string_inserts)
-        end
-      end
     end
   end
 end

data/lib/winevt/version.rb

@@ -1,3 +1,3 @@
 module Winevt
-  VERSION = "0.3.6"
+  VERSION = "0.3.7"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: winevt_c
 version: !ruby/object:Gem::Version
-  version: 0.3.6
+  version: 0.3.7
 platform: ruby
 authors:
 - Hiroshi Hatake
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2019-06-25 00:00:00.000000000 Z
+date: 2019-06-26 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler