winevt_c 0.5.1 → 0.6.0

data/ext/winevt/winevt_utils.cpp

@@ -1,97 +1,71 @@
 #include <winevt_c.h>
+
 #include <sddl.h>
 #include <stdlib.h>
 #include <string>
 #include <vector>
 
-char*
-wstr_to_mbstr(UINT cp, const WCHAR *wstr, int clen)
-{
-    char *ptr;
-    int len = WideCharToMultiByte(cp, 0, wstr, clen, nullptr, 0, nullptr, nullptr);
-    if (!(ptr = static_cast<char *>(xmalloc(len)))) return nullptr;
-    WideCharToMultiByte(cp, 0, wstr, clen, ptr, len, nullptr, nullptr);
-
-    return ptr;
-}
-
-void free_allocated_mbstr(const char* str)
-{
-  if (str)
-    xfree((char *)str);
-}
-
 VALUE
-wstr_to_rb_str(UINT cp, const WCHAR *wstr, int clen)
+wstr_to_rb_str(UINT cp, const WCHAR* wstr, int clen)
 {
-    VALUE vstr;
-    CHAR *ptr;
-    int len = WideCharToMultiByte(cp, 0, wstr, clen, nullptr, 0, nullptr, nullptr);
-    ptr = ALLOCV_N(CHAR, vstr, len);
-    WideCharToMultiByte(cp, 0, wstr, clen, ptr, len, nullptr, nullptr);
-    VALUE str = rb_utf8_str_new_cstr(ptr);
-    ALLOCV_END(vstr);
-
-    return str;
+  VALUE vstr;
+  CHAR* ptr;
+  int len = WideCharToMultiByte(cp, 0, wstr, clen, nullptr, 0, nullptr, nullptr);
+  ptr = ALLOCV_N(CHAR, vstr, len);
+  WideCharToMultiByte(cp, 0, wstr, clen, ptr, len, nullptr, nullptr);
+  VALUE str = rb_utf8_str_new_cstr(ptr);
+  ALLOCV_END(vstr);
+
+  return str;
 }
 
-WCHAR* render_event(EVT_HANDLE handle, DWORD flags)
+VALUE
+render_to_rb_str(EVT_HANDLE handle, DWORD flags)
 {
-  std::vector<WCHAR> buffer(1);
-  ULONG      bufferSize = 0;
-  ULONG      bufferSizeNeeded = 0;
-  ULONG      status, count;
-  static WCHAR* result;
-  LPTSTR     msgBuf;
-
-  do {
-    if (bufferSizeNeeded > bufferSize) {
-      bufferSize = bufferSizeNeeded;
-      try {
-        buffer.resize(bufferSize);
-        buffer.shrink_to_fit();
-      } catch (std::bad_alloc e) {
-        status = ERROR_OUTOFMEMORY;
-        bufferSize = 0;
-        rb_raise(rb_eWinevtQueryError, "Out of memory");
-        break;
-      }
-    }
+  VALUE vbuffer;
+  WCHAR* buffer;
+  ULONG bufferSize = 0;
+  ULONG bufferSizeUsed = 0;
+  ULONG count;
+  BOOL succeeded;
+  VALUE result;
 
-    if (EvtRender(nullptr,
-                  handle,
-                  flags,
-                  buffer.size(),
-                  &buffer.front(),
-                  &bufferSizeNeeded,
-                  &count) != FALSE) {
-      status = ERROR_SUCCESS;
-    } else {
-      status = GetLastError();
-    }
-  } while (status == ERROR_INSUFFICIENT_BUFFER);
+  if (flags != EvtRenderEventXml && flags != EvtRenderBookmark) {
+    return Qnil;
+  }
 
-  if (status != ERROR_SUCCESS) {
-    FormatMessage(
-        FORMAT_MESSAGE_ALLOCATE_BUFFER |
-        FORMAT_MESSAGE_FROM_SYSTEM |
-        FORMAT_MESSAGE_IGNORE_INSERTS,
-        nullptr, status,
-        MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT),
-        msgBuf, 0, nullptr);
-
-    VALUE errmsg = rb_str_new2(msgBuf);
-    LocalFree(msgBuf);
-
-    rb_raise(rb_eWinevtQueryError, "ErrorCode: %ld\nError: %s\n", status, RSTRING_PTR(errmsg));
+  // Get the size of the buffer
+  EvtRender(nullptr, handle, flags, 0, NULL, &bufferSize, &count);
+
+  // bufferSize is in bytes, not characters
+  buffer = (WCHAR*)ALLOCV(vbuffer, bufferSize);
+
+  succeeded =
+    EvtRender(nullptr, handle, flags, bufferSize, buffer, &bufferSizeUsed, &count);
+  if (!succeeded) {
+    DWORD status = GetLastError();
+    CHAR msgBuf[256];
+
+    FormatMessageA(FORMAT_MESSAGE_FROM_SYSTEM | FORMAT_MESSAGE_IGNORE_INSERTS,
+                   nullptr,
+                   status,
+                   MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT),
+                   msgBuf,
+                   _countof(msgBuf),
+                   nullptr);
+    ALLOCV_END(vbuffer);
+    rb_raise(rb_eWinevtQueryError, "ErrorCode: %lu\nError: %s\n", status, msgBuf);
   }
 
-  result = _wcsdup(&buffer.front());
+  result = wstr_to_rb_str(CP_UTF8, buffer, -1);
+  ALLOCV_END(vbuffer);
 
   return result;
 }
 
-static std::wstring guid_to_wstr(const GUID& guid) {
+static std::wstring
+guid_to_wstr(const GUID& guid)
+{
   LPOLESTR p = nullptr;
   if (FAILED(StringFromCLSID(guid, &p))) {
     return nullptr;
@@ -101,259 +75,290 @@ static std::wstring guid_to_wstr(const GUID& guid) {
   return s;
 }
 
-VALUE get_values(EVT_HANDLE handle)
+static VALUE
+extract_user_evt_variants(PEVT_VARIANT pRenderedValues, DWORD propCount)
 {
-  std::vector<WCHAR> buffer;
-  ULONG bufferSize = 0;
-  ULONG bufferSizeNeeded = 0;
-  DWORD status, propCount = 0;
-  char *result;
-  LPTSTR msgBuf;
-  WCHAR* tmpWChar = nullptr;
   VALUE userValues = rb_ary_new();
-
-  static PCWSTR eventProperties[] = { L"Event/EventData/Data[1]" };
-  EVT_HANDLE renderContext = EvtCreateRenderContext(0, nullptr, EvtRenderContextUser);
-  if (renderContext == nullptr) {
-    rb_raise(rb_eWinevtQueryError, "Failed to create renderContext");
-  }
-
-  do {
-    if (bufferSizeNeeded > bufferSize) {
-      bufferSize = bufferSizeNeeded;
-      try {
-        buffer.resize(bufferSize);
-        buffer.shrink_to_fit();
-      } catch (std::bad_alloc e) {
-        status = ERROR_OUTOFMEMORY;
-        bufferSize = 0;
-        rb_raise(rb_eWinevtQueryError, "Out of memory");
-        break;
-      }
-    }
-
-    if (EvtRender(renderContext,
-                  handle,
-                  EvtRenderEventValues,
-                  buffer.size(),
-                  &buffer.front(),
-                  &bufferSizeNeeded,
-                  &propCount) != FALSE) {
-      status = ERROR_SUCCESS;
-    } else {
-      status = GetLastError();
-    }
-  } while (status == ERROR_INSUFFICIENT_BUFFER);
-
-  if (status != ERROR_SUCCESS) {
-    FormatMessage(
-        FORMAT_MESSAGE_ALLOCATE_BUFFER |
-        FORMAT_MESSAGE_FROM_SYSTEM |
-        FORMAT_MESSAGE_IGNORE_INSERTS,
-        nullptr, status,
-        MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT),
-        msgBuf, 0, nullptr);
-
-    VALUE errmsg = rb_str_new2(msgBuf);
-    LocalFree(msgBuf);
-
-    rb_raise(rb_eWinevtQueryError, "ErrorCode: %lu\nError: %s\n", status, RSTRING_PTR(errmsg));
-  }
-
-  PEVT_VARIANT pRenderedValues = reinterpret_cast<PEVT_VARIANT>(&buffer.front());
-  LARGE_INTEGER timestamp;
-  SYSTEMTIME st;
-  FILETIME ft;
-  std::vector<CHAR> strTime(128);
-  std::vector<CHAR> sResult(256);
   VALUE rbObj;
 
-  for (int i = 0; i < propCount; i++) {
+  for (DWORD i = 0; i < propCount; i++) {
     switch (pRenderedValues[i].Type) {
-    case EvtVarTypeNull:
-      rb_ary_push(userValues, Qnil);
-      break;
-    case EvtVarTypeString:
-      if (pRenderedValues[i].StringVal == nullptr) {
-        rb_ary_push(userValues, rb_utf8_str_new_cstr("(NULL)"));
-      } else {
-        std::wstring wStr(pRenderedValues[i].StringVal);
-        rbObj = wstr_to_rb_str(CP_UTF8, &wStr[0], -1);
+      case EvtVarTypeNull:
+        rb_ary_push(userValues, Qnil);
+        break;
+      case EvtVarTypeString:
+        if (pRenderedValues[i].StringVal == nullptr) {
+          rb_ary_push(userValues, rb_utf8_str_new_cstr("(NULL)"));
+        } else {
+          std::wstring wStr(pRenderedValues[i].StringVal);
+          rbObj = wstr_to_rb_str(CP_UTF8, &wStr[0], -1);
+          rb_ary_push(userValues, rbObj);
+        }
+        break;
+      case EvtVarTypeAnsiString:
+        if (pRenderedValues[i].AnsiStringVal == nullptr) {
+          rb_ary_push(userValues, rb_utf8_str_new_cstr("(NULL)"));
+        } else {
+          rb_ary_push(
+            userValues,
+            rb_utf8_str_new_cstr(const_cast<char*>(pRenderedValues[i].AnsiStringVal)));
+        }
+        break;
+      case EvtVarTypeSByte:
+        rbObj = INT2NUM(static_cast<UINT32>(pRenderedValues[i].SByteVal));
+        rb_ary_push(userValues, rbObj);
+        break;
+      case EvtVarTypeByte:
+        rbObj = INT2NUM(static_cast<UINT32>(pRenderedValues[i].ByteVal));
+        rb_ary_push(userValues, rbObj);
+        break;
+      case EvtVarTypeInt16:
+        rbObj = INT2NUM(static_cast<INT32>(pRenderedValues[i].Int16Val));
+        rb_ary_push(userValues, rbObj);
+        break;
+      case EvtVarTypeUInt16:
+        rbObj = UINT2NUM(static_cast<UINT32>(pRenderedValues[i].UInt16Val));
+        rb_ary_push(userValues, rbObj);
+        break;
+      case EvtVarTypeInt32:
+        rbObj = INT2NUM(pRenderedValues[i].Int32Val);
+        rb_ary_push(userValues, rbObj);
+        break;
+      case EvtVarTypeUInt32:
+        rbObj = UINT2NUM(pRenderedValues[i].UInt32Val);
+        rb_ary_push(userValues, rbObj);
+        break;
+      case EvtVarTypeInt64:
+        rbObj = LONG2NUM(pRenderedValues[i].Int64Val);
+        rb_ary_push(userValues, rbObj);
+        break;
+      case EvtVarTypeUInt64:
+        rbObj = ULONG2NUM(pRenderedValues[i].UInt64Val);
         rb_ary_push(userValues, rbObj);
+        break;
+      case EvtVarTypeSingle: {
+        CHAR sResult[256];
+        _snprintf_s(
+          sResult, _countof(sResult), _TRUNCATE, "%f", pRenderedValues[i].SingleVal);
+        rb_ary_push(userValues, rb_utf8_str_new_cstr(sResult));
+        break;
       }
-      break;
-    case EvtVarTypeAnsiString:
-      if (pRenderedValues[i].AnsiStringVal == nullptr) {
-        rb_ary_push(userValues, rb_utf8_str_new_cstr("(NULL)"));
-      } else {
-        rb_ary_push(userValues, rb_utf8_str_new_cstr(const_cast<char *>(pRenderedValues[i].AnsiStringVal)));
+      case EvtVarTypeDouble: {
+        CHAR sResult[256];
+        _snprintf_s(
+          sResult, _countof(sResult), _TRUNCATE, "%lf", pRenderedValues[i].DoubleVal);
+        rb_ary_push(userValues, rb_utf8_str_new_cstr(sResult));
+        break;
       }
-      break;
-    case EvtVarTypeSByte:
-      rbObj = INT2NUM(static_cast<UINT32>(pRenderedValues[i].SByteVal));
-      rb_ary_push(userValues, rbObj);
-      break;
-    case EvtVarTypeByte:
-      rbObj = INT2NUM(static_cast<UINT32>(pRenderedValues[i].ByteVal));
-      rb_ary_push(userValues, rbObj);
-      break;
-    case EvtVarTypeInt16:
-      rbObj = INT2NUM(static_cast<INT32>(pRenderedValues[i].Int16Val));
-      rb_ary_push(userValues, rbObj);
-      break;
-    case EvtVarTypeUInt16:
-      rbObj = UINT2NUM(static_cast<UINT32>(pRenderedValues[i].UInt16Val));
-      rb_ary_push(userValues, rbObj);
-      break;
-    case EvtVarTypeInt32:
-      rbObj = INT2NUM(pRenderedValues[i].Int32Val);
-      rb_ary_push(userValues, rbObj);
-      break;
-    case EvtVarTypeUInt32:
-      rbObj = UINT2NUM(pRenderedValues[i].UInt32Val);
-      rb_ary_push(userValues, rbObj);
-      break;
-    case EvtVarTypeInt64:
-      rbObj = LONG2NUM(pRenderedValues[i].Int64Val);
-      rb_ary_push(userValues, rbObj);
-      break;
-    case EvtVarTypeUInt64:
-      rbObj = ULONG2NUM(pRenderedValues[i].UInt64Val);
-      rb_ary_push(userValues, rbObj);
-      break;
-    case EvtVarTypeSingle:
-      _snprintf_s(&sResult.front(), sResult.size(), _TRUNCATE, "%f", pRenderedValues[i].SingleVal);
-      rb_ary_push(userValues, rb_utf8_str_new_cstr(&sResult.front()));
-      break;
-    case EvtVarTypeDouble:
-      _snprintf_s(&sResult.front(), sResult.size(), _TRUNCATE, "%lf", pRenderedValues[i].DoubleVal);
-      rb_ary_push(userValues, rb_utf8_str_new_cstr(&sResult.front()));
-      break;
-    case EvtVarTypeBoolean:
-      rbObj = pRenderedValues[i].BooleanVal ? Qtrue : Qfalse;
-      rb_ary_push(userValues, rbObj);
-      break;
-    case EvtVarTypeGuid:
-      if (pRenderedValues[i].GuidVal != nullptr) {
-        const GUID guid = *pRenderedValues[i].GuidVal;
-        std::wstring wstr = guid_to_wstr(guid);
-        rbObj = wstr_to_rb_str(CP_UTF8, wstr.c_str(), -1);
+      case EvtVarTypeBoolean:
+        rbObj = pRenderedValues[i].BooleanVal ? Qtrue : Qfalse;
         rb_ary_push(userValues, rbObj);
-      } else {
-        rb_ary_push(userValues, rb_utf8_str_new_cstr("?"));
+        break;
+      case EvtVarTypeGuid:
+        if (pRenderedValues[i].GuidVal != nullptr) {
+          const GUID guid = *pRenderedValues[i].GuidVal;
+          std::wstring wstr = guid_to_wstr(guid);
+          rbObj = wstr_to_rb_str(CP_UTF8, wstr.c_str(), -1);
+          rb_ary_push(userValues, rbObj);
+        } else {
+          rb_ary_push(userValues, rb_utf8_str_new_cstr("?"));
+        }
+        break;
+      case EvtVarTypeSizeT:
+        rbObj = SIZET2NUM(pRenderedValues[i].SizeTVal);
+        rb_ary_push(userValues, rbObj);
+        break;
+      case EvtVarTypeFileTime: {
+        LARGE_INTEGER timestamp;
+        CHAR strTime[128];
+        FILETIME ft;
+        SYSTEMTIME st;
+        timestamp.QuadPart = pRenderedValues[i].FileTimeVal;
+        ft.dwHighDateTime = timestamp.HighPart;
+        ft.dwLowDateTime = timestamp.LowPart;
+        if (FileTimeToSystemTime(&ft, &st)) {
+          _snprintf_s(strTime,
+                      _countof(strTime),
+                      _TRUNCATE,
+                      "%04d-%02d-%02d %02d:%02d:%02d.%dZ",
+                      st.wYear,
+                      st.wMonth,
+                      st.wDay,
+                      st.wHour,
+                      st.wMinute,
+                      st.wSecond,
+                      st.wMilliseconds);
+          rb_ary_push(userValues, rb_utf8_str_new_cstr(strTime));
+        } else {
+          rb_ary_push(userValues, rb_utf8_str_new_cstr("?"));
+        }
+        break;
       }
-      break;
-    case EvtVarTypeSizeT:
-      rbObj = SIZET2NUM(pRenderedValues[i].SizeTVal);
-      rb_ary_push(userValues, rbObj);
-      break;
-    case EvtVarTypeFileTime:
-      timestamp.QuadPart = pRenderedValues[i].FileTimeVal;
-      ft.dwHighDateTime = timestamp.HighPart;
-      ft.dwLowDateTime  = timestamp.LowPart;
-      if (FileTimeToSystemTime( &ft, &st )) {
-        _snprintf_s(&strTime.front(), strTime.size(), _TRUNCATE, "%04d-%02d-%02d %02d:%02d:%02d.%dZ",
-                    st.wYear , st.wMonth , st.wDay ,
-                    st.wHour , st.wMinute , st.wSecond,
-                    st.wMilliseconds);
-        rb_ary_push(userValues, rb_utf8_str_new_cstr(&strTime.front()));
-      } else {
-        rb_ary_push(userValues, rb_utf8_str_new_cstr("?"));
+      case EvtVarTypeSysTime: {
+        CHAR strTime[128];
+        SYSTEMTIME st;
+        if (pRenderedValues[i].SysTimeVal != nullptr) {
+          st = *pRenderedValues[i].SysTimeVal;
+          _snprintf_s(strTime,
+                      _countof(strTime),
+                      _TRUNCATE,
+                      "%04d-%02d-%02d %02d:%02d:%02d.%dZ",
+                      st.wYear,
+                      st.wMonth,
+                      st.wDay,
+                      st.wHour,
+                      st.wMinute,
+                      st.wSecond,
+                      st.wMilliseconds);
+          rb_ary_push(userValues, rb_utf8_str_new_cstr(strTime));
+        } else {
+          rb_ary_push(userValues, rb_utf8_str_new_cstr("?"));
+        }
+        break;
       }
-      break;
-    case EvtVarTypeSysTime:
-      if (pRenderedValues[i].SysTimeVal != nullptr) {
-        st = *pRenderedValues[i].SysTimeVal;
-        _snprintf_s(&strTime.front(), strTime.size(), _TRUNCATE, "%04d-%02d-%02d %02d:%02d:%02d.%dZ",
-                    st.wYear , st.wMonth , st.wDay ,
-                    st.wHour , st.wMinute , st.wSecond,
-                    st.wMilliseconds);
-        rb_ary_push(userValues, rb_utf8_str_new_cstr(&strTime.front()));
-      } else {
-        rb_ary_push(userValues, rb_utf8_str_new_cstr("?"));
+      case EvtVarTypeSid: {
+        WCHAR* tmpWChar = nullptr;
+        if (ConvertSidToStringSidW(pRenderedValues[i].SidVal, &tmpWChar)) {
+          rbObj = wstr_to_rb_str(CP_UTF8, tmpWChar, -1);
+          rb_ary_push(userValues, rbObj);
+          LocalFree(tmpWChar);
+        } else {
+          rb_ary_push(userValues, rb_utf8_str_new_cstr("?"));
+        }
+        break;
       }
-      break;
-    case EvtVarTypeSid:
-      if (ConvertSidToStringSidW(pRenderedValues[i].SidVal, &tmpWChar)) {
-        rbObj = wstr_to_rb_str(CP_UTF8, tmpWChar, -1);
+      case EvtVarTypeHexInt32:
+        rbObj = rb_sprintf("%#x", pRenderedValues[i].UInt32Val);
         rb_ary_push(userValues, rbObj);
-        LocalFree(tmpWChar);
-      } else {
-        rb_ary_push(userValues, rb_utf8_str_new_cstr("?"));
-      }
-      break;
-    case EvtVarTypeHexInt32:
-      rbObj = ULONG2NUM(pRenderedValues[i].UInt32Val);
-      rbObj = rb_sprintf("%#x", rbObj);
-      rb_ary_push(userValues, rbObj);
-      break;
-    case EvtVarTypeHexInt64:
-      rbObj = ULONG2NUM(pRenderedValues[i].UInt64Val);
-      rbObj = rb_sprintf("%#x", rbObj);
-      rb_ary_push(userValues, rbObj);
-      break;
-    case EvtVarTypeEvtXml:
-      if (pRenderedValues[i].XmlVal == nullptr) {
-        rb_ary_push(userValues, rb_utf8_str_new_cstr("(NULL)"));
-      } else {
-        rbObj = wstr_to_rb_str(CP_UTF8, pRenderedValues[i].XmlVal, -1);
+        break;
+      case EvtVarTypeHexInt64:
+        rbObj = rb_sprintf("%#I64x", pRenderedValues[i].UInt64Val);
         rb_ary_push(userValues, rbObj);
-      }
-      break;
-    default:
-      rb_ary_push(userValues, rb_utf8_str_new_cstr("?"));
-      break;
+        break;
+      case EvtVarTypeEvtXml:
+        if (pRenderedValues[i].XmlVal == nullptr) {
+          rb_ary_push(userValues, rb_utf8_str_new_cstr("(NULL)"));
+        } else {
+          rbObj = wstr_to_rb_str(CP_UTF8, pRenderedValues[i].XmlVal, -1);
+          rb_ary_push(userValues, rbObj);
+        }
+        break;
+      default:
+        rb_ary_push(userValues, rb_utf8_str_new_cstr("?"));
+        break;
     }
   }
 
-  if (renderContext)
+  return userValues;
+}
+
+VALUE
+get_values(EVT_HANDLE handle)
+{
+  VALUE vbuffer;
+  PEVT_VARIANT pRenderedValues;
+  ULONG bufferSize = 0;
+  ULONG bufferSizeUsed = 0;
+  DWORD propCount = 0;
+  BOOL succeeded;
+  VALUE userValues = Qnil;
+
+  EVT_HANDLE renderContext = EvtCreateRenderContext(0, nullptr, EvtRenderContextUser);
+  if (renderContext == nullptr) {
+    rb_raise(rb_eWinevtQueryError, "Failed to create renderContext");
+  }
+
+  // Get the size of the buffer
+  EvtRender(
+    renderContext, handle, EvtRenderEventValues, 0, NULL, &bufferSize, &propCount);
+
+  // bufferSize is in bytes, not array size
+  pRenderedValues = (PEVT_VARIANT)ALLOCV(vbuffer, bufferSize);
+
+  succeeded = EvtRender(renderContext,
+                        handle,
+                        EvtRenderEventValues,
+                        bufferSize,
+                        pRenderedValues,
+                        &bufferSizeUsed,
+                        &propCount);
+  if (!succeeded) {
+    DWORD status = GetLastError();
+    CHAR msgBuf[256];
+
+    ALLOCV_END(vbuffer);
     EvtClose(renderContext);
 
+    FormatMessageA(FORMAT_MESSAGE_FROM_SYSTEM | FORMAT_MESSAGE_IGNORE_INSERTS,
+                   nullptr,
+                   status,
+                   MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT),
+                   msgBuf,
+                   _countof(msgBuf),
+                   nullptr);
+    rb_raise(rb_eWinevtQueryError, "ErrorCode: %lu\nError: %s\n", status, msgBuf);
+  }
+
+  userValues = extract_user_evt_variants(pRenderedValues, propCount);
+
+  ALLOCV_END(vbuffer);
+  EvtClose(renderContext);
+
   return userValues;
 }
 
-static std::vector<WCHAR> get_message(EVT_HANDLE hMetadata, EVT_HANDLE handle)
+static std::vector<WCHAR>
+get_message(EVT_HANDLE hMetadata, EVT_HANDLE handle)
 {
 #define BUFSIZE 4096
   std::vector<WCHAR> result;
-  ULONG  status;
+  ULONG status;
   ULONG bufferSizeNeeded = 0;
   LPVOID lpMsgBuf;
   std::vector<WCHAR> message(BUFSIZE);
 
-  if (!EvtFormatMessage(hMetadata, handle, 0xffffffff, 0, nullptr, EvtFormatMessageEvent, message.size(), &message[0], &bufferSizeNeeded)) {
+  if (!EvtFormatMessage(hMetadata,
+                        handle,
+                        0xffffffff,
+                        0,
+                        nullptr,
+                        EvtFormatMessageEvent,
+                        message.size(),
+                        &message[0],
+                        &bufferSizeNeeded)) {
     status = GetLastError();
 
     if (status != ERROR_EVT_UNRESOLVED_VALUE_INSERT) {
       switch (status) {
-      case ERROR_EVT_MESSAGE_NOT_FOUND:
-      case ERROR_EVT_MESSAGE_ID_NOT_FOUND:
-      case ERROR_EVT_MESSAGE_LOCALE_NOT_FOUND:
-      case ERROR_RESOURCE_LANG_NOT_FOUND:
-      case ERROR_MUI_FILE_NOT_FOUND:
-      case ERROR_EVT_UNRESOLVED_PARAMETER_INSERT: {
-        if (FormatMessageW(FORMAT_MESSAGE_ALLOCATE_BUFFER |
-                           FORMAT_MESSAGE_FROM_SYSTEM |
-                           FORMAT_MESSAGE_IGNORE_INSERTS,
+        case ERROR_EVT_MESSAGE_NOT_FOUND:
+        case ERROR_EVT_MESSAGE_ID_NOT_FOUND:
+        case ERROR_EVT_MESSAGE_LOCALE_NOT_FOUND:
+        case ERROR_RESOURCE_LANG_NOT_FOUND:
+        case ERROR_MUI_FILE_NOT_FOUND:
+        case ERROR_EVT_UNRESOLVED_PARAMETER_INSERT: {
+          if (FormatMessageW(FORMAT_MESSAGE_ALLOCATE_BUFFER | FORMAT_MESSAGE_FROM_SYSTEM |
+                               FORMAT_MESSAGE_IGNORE_INSERTS,
+                             nullptr,
+                             status,
+                             MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT),
+                             reinterpret_cast<WCHAR*>(&lpMsgBuf),
+                             0,
+                             nullptr) == 0)
+            FormatMessageW(FORMAT_MESSAGE_ALLOCATE_BUFFER | FORMAT_MESSAGE_FROM_SYSTEM |
+                             FORMAT_MESSAGE_IGNORE_INSERTS,
                            nullptr,
                            status,
-                           MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT),
-                           reinterpret_cast<WCHAR *>(&lpMsgBuf), 0, nullptr) == 0)
-          FormatMessageW(FORMAT_MESSAGE_ALLOCATE_BUFFER |
-                         FORMAT_MESSAGE_FROM_SYSTEM |
-                         FORMAT_MESSAGE_IGNORE_INSERTS,
-                         nullptr,
-                         status,
-                         MAKELANGID(LANG_ENGLISH, SUBLANG_ENGLISH_US),
-                         reinterpret_cast<WCHAR *>(&lpMsgBuf), 0, nullptr);
-
-        std::wstring ret(reinterpret_cast<WCHAR *>(lpMsgBuf));
-        std::copy( ret.begin(), ret.end(), std::back_inserter(result));
-        LocalFree(lpMsgBuf);
-
-        goto cleanup;
-      }
+                           MAKELANGID(LANG_ENGLISH, SUBLANG_ENGLISH_US),
+                           reinterpret_cast<WCHAR*>(&lpMsgBuf),
+                           0,
+                           nullptr);
+
+          std::wstring ret(reinterpret_cast<WCHAR*>(lpMsgBuf));
+          std::copy(ret.begin(), ret.end(), std::back_inserter(result));
+          LocalFree(lpMsgBuf);
 
+          goto cleanup;
+        }
       }
 
       if (status != ERROR_INSUFFICIENT_BUFFER)
@@ -364,37 +369,49 @@ static std::vector<WCHAR> get_message(EVT_HANDLE hMetadata, EVT_HANDLE handle)
       message.resize(bufferSizeNeeded);
       message.shrink_to_fit();
 
-      if(!EvtFormatMessage(hMetadata, handle, 0xffffffff, 0, nullptr, EvtFormatMessageEvent, message.size(), &message.front(), &bufferSizeNeeded)) {
+      if (!EvtFormatMessage(hMetadata,
+                            handle,
+                            0xffffffff,
+                            0,
+                            nullptr,
+                            EvtFormatMessageEvent,
+                            message.size(),
+                            &message.front(),
+                            &bufferSizeNeeded)) {
         status = GetLastError();
 
         if (status != ERROR_EVT_UNRESOLVED_VALUE_INSERT) {
           switch (status) {
-          case ERROR_EVT_MESSAGE_NOT_FOUND:
-          case ERROR_EVT_MESSAGE_ID_NOT_FOUND:
-          case ERROR_EVT_MESSAGE_LOCALE_NOT_FOUND:
-          case ERROR_RESOURCE_LANG_NOT_FOUND:
-          case ERROR_MUI_FILE_NOT_FOUND:
-          case ERROR_EVT_UNRESOLVED_PARAMETER_INSERT:
-            if (FormatMessageW(FORMAT_MESSAGE_ALLOCATE_BUFFER |
-                               FORMAT_MESSAGE_FROM_SYSTEM |
-                               FORMAT_MESSAGE_IGNORE_INSERTS,
+            case ERROR_EVT_MESSAGE_NOT_FOUND:
+            case ERROR_EVT_MESSAGE_ID_NOT_FOUND:
+            case ERROR_EVT_MESSAGE_LOCALE_NOT_FOUND:
+            case ERROR_RESOURCE_LANG_NOT_FOUND:
+            case ERROR_MUI_FILE_NOT_FOUND:
+            case ERROR_EVT_UNRESOLVED_PARAMETER_INSERT:
+              if (FormatMessageW(FORMAT_MESSAGE_ALLOCATE_BUFFER |
+                                   FORMAT_MESSAGE_FROM_SYSTEM |
+                                   FORMAT_MESSAGE_IGNORE_INSERTS,
+                                 nullptr,
+                                 status,
+                                 MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT),
+                                 reinterpret_cast<WCHAR*>(&lpMsgBuf),
+                                 0,
+                                 nullptr) == 0)
+                FormatMessageW(FORMAT_MESSAGE_ALLOCATE_BUFFER |
+                                 FORMAT_MESSAGE_FROM_SYSTEM |
+                                 FORMAT_MESSAGE_IGNORE_INSERTS,
                                nullptr,
                                status,
-                               MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT),
-                               reinterpret_cast<WCHAR *>(&lpMsgBuf), 0, nullptr) == 0)
-              FormatMessageW(FORMAT_MESSAGE_ALLOCATE_BUFFER |
-                             FORMAT_MESSAGE_FROM_SYSTEM |
-                             FORMAT_MESSAGE_IGNORE_INSERTS,
-                             nullptr,
-                             status,
-                             MAKELANGID(LANG_ENGLISH, SUBLANG_ENGLISH_US),
-                             reinterpret_cast<WCHAR *>(&lpMsgBuf), 0, nullptr);
+                               MAKELANGID(LANG_ENGLISH, SUBLANG_ENGLISH_US),
+                               reinterpret_cast<WCHAR*>(&lpMsgBuf),
+                               0,
+                               nullptr);
 
-            std::wstring ret(reinterpret_cast<WCHAR *>(lpMsgBuf));
-            std::copy( ret.begin(), ret.end(), std::back_inserter(result));
-            LocalFree(lpMsgBuf);
+              std::wstring ret(reinterpret_cast<WCHAR*>(lpMsgBuf));
+              std::copy(ret.begin(), ret.end(), std::back_inserter(result));
+              LocalFree(lpMsgBuf);
 
-            goto cleanup;
+              goto cleanup;
           }
 
           rb_raise(rb_eWinevtQueryError, "ErrorCode: %lu", status);
@@ -412,19 +429,20 @@ cleanup:
 #undef BUFSIZE
 }
 
-WCHAR* get_description(EVT_HANDLE handle)
+WCHAR*
+get_description(EVT_HANDLE handle)
 {
 #define BUFSIZE 4096
   std::vector<WCHAR> buffer(BUFSIZE);
-  ULONG      bufferSize = 0;
-  ULONG      bufferSizeNeeded = 0;
-  ULONG      status, count;
+  ULONG bufferSizeNeeded = 0;
+  ULONG status, count;
   std::vector<WCHAR> result;
-  LPTSTR     msgBuf;
+  CHAR msgBuf[256];
   EVT_HANDLE hMetadata = nullptr;
 
-  static PCWSTR eventProperties[] = {L"Event/System/Provider/@Name"};
-  EVT_HANDLE renderContext = EvtCreateRenderContext(1, eventProperties, EvtRenderContextValues);
+  static PCWSTR eventProperties[] = { L"Event/System/Provider/@Name" };
+  EVT_HANDLE renderContext =
+    EvtCreateRenderContext(1, eventProperties, EvtRenderContextValues);
   if (renderContext == nullptr) {
     rb_raise(rb_eWinevtQueryError, "Failed to create renderContext");
   }
@@ -442,25 +460,26 @@ WCHAR* get_description(EVT_HANDLE handle)
   }
 
   if (status != ERROR_SUCCESS) {
-    FormatMessage(
-        FORMAT_MESSAGE_ALLOCATE_BUFFER |
-        FORMAT_MESSAGE_FROM_SYSTEM |
-        FORMAT_MESSAGE_IGNORE_INSERTS,
-        nullptr, status,
-        MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT),
-        msgBuf, 0, nullptr);
-
-    VALUE errmsg = rb_str_new2(msgBuf);
-    LocalFree(msgBuf);
-
-    rb_raise(rb_eWinevtQueryError, "ErrorCode: %lu\nError: %s\n", status, RSTRING_PTR(errmsg));
+    FormatMessageA(FORMAT_MESSAGE_FROM_SYSTEM | FORMAT_MESSAGE_IGNORE_INSERTS,
+                   nullptr,
+                   status,
+                   MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT),
+                   msgBuf,
+                   sizeof(msgBuf),
+                   nullptr);
+    rb_raise(rb_eWinevtQueryError, "ErrorCode: %lu\nError: %s\n", status, msgBuf);
   }
 
   // Obtain buffer as EVT_VARIANT pointer. To avoid ErrorCide 87 in EvtRender.
   const PEVT_VARIANT values = reinterpret_cast<PEVT_VARIANT>(&buffer.front());
 
   // Open publisher metadata
-  hMetadata = EvtOpenPublisherMetadata(nullptr, values[0].StringVal, nullptr, MAKELCID(MAKELANGID(LANG_NEUTRAL, SUBLANG_NEUTRAL), SORT_DEFAULT), 0);
+  hMetadata = EvtOpenPublisherMetadata(
+    nullptr,
+    values[0].StringVal,
+    nullptr,
+    MAKELCID(MAKELANGID(LANG_NEUTRAL, SUBLANG_NEUTRAL), SORT_DEFAULT),
+    0);
   if (hMetadata == nullptr) {
     // When winevt_c cannot open metadata, then give up to obtain
     // message file and clean up immediately.
@@ -481,3 +500,189 @@ cleanup:
 
   return _wcsdup(result.data());
 }
+
+VALUE
+render_system_event(EVT_HANDLE hEvent)
+{
+  DWORD status = ERROR_SUCCESS;
+  EVT_HANDLE hContext = NULL;
+  DWORD dwBufferSize = 0;
+  DWORD dwBufferUsed = 0;
+  DWORD dwPropertyCount = 0;
+  VALUE vRenderedValues;
+  PEVT_VARIANT pRenderedValues = NULL;
+  WCHAR wsGuid[50];
+  LPSTR pwsSid = NULL;
+  ULONGLONG ullTimeStamp = 0;
+  ULONGLONG ullNanoseconds = 0;
+  SYSTEMTIME st;
+  FILETIME ft;
+  CHAR buffer[32];
+  VALUE rbstr;
+  DWORD EventID;
+  VALUE hash = rb_hash_new();
+
+  hContext = EvtCreateRenderContext(0, NULL, EvtRenderContextSystem);
+  if (NULL == hContext) {
+    rb_raise(rb_eWinevtQueryError,
+             "Failed to create renderContext with %lu\n", GetLastError());
+  }
+
+  if (!EvtRender(hContext,
+                 hEvent,
+                 EvtRenderEventValues,
+                 dwBufferSize,
+                 pRenderedValues,
+                 &dwBufferUsed,
+                 &dwPropertyCount)) {
+    status = GetLastError();
+    if (ERROR_INSUFFICIENT_BUFFER == status) {
+      dwBufferSize = dwBufferUsed;
+      pRenderedValues = (PEVT_VARIANT)ALLOCV(vRenderedValues, dwBufferSize);
+      if (pRenderedValues) {
+        EvtRender(hContext,
+                  hEvent,
+                  EvtRenderEventValues,
+                  dwBufferSize,
+                  pRenderedValues,
+                  &dwBufferUsed,
+                  &dwPropertyCount);
+      } else {
+        EvtClose(hContext);
+        rb_raise(rb_eRuntimeError,
+             "Failed to malloc memory with %lu\n", status);
+      }
+    }
+
+    status = GetLastError();
+    if (ERROR_SUCCESS != status) {
+      EvtClose(hContext);
+      ALLOCV_END(vRenderedValues);
+
+      rb_raise(rb_eWinevtQueryError,
+               "EvtRender failed with %lu\n", status);
+    }
+  }
+
+  // EVT_VARIANT value with EvtRenderContextSystem will be decomposed
+  // as the following enum definition:
+  // https://docs.microsoft.com/en-us/windows/win32/api/winevt/ne-winevt-evt_system_property_id
+  rbstr = wstr_to_rb_str(CP_UTF8, pRenderedValues[EvtSystemProviderName].StringVal, -1);
+  rb_hash_aset(hash, rb_str_new2("ProviderName"), rbstr);
+  if (NULL != pRenderedValues[EvtSystemProviderGuid].GuidVal) {
+    const GUID* Guid = pRenderedValues[EvtSystemProviderGuid].GuidVal;
+    StringFromGUID2(*Guid, wsGuid, _countof(wsGuid));
+    rbstr = wstr_to_rb_str(CP_UTF8, wsGuid, -1);
+    rb_hash_aset(hash, rb_str_new2("ProviderGuid"), rbstr);
+  } else {
+    rb_hash_aset(hash, rb_str_new2("ProviderGuid"), Qnil);
+  }
+
+  EventID = pRenderedValues[EvtSystemEventID].UInt16Val;
+  if (EvtVarTypeNull != pRenderedValues[EvtSystemQualifiers].Type) {
+    EventID = MAKELONG(pRenderedValues[EvtSystemEventID].UInt16Val,
+                       pRenderedValues[EvtSystemQualifiers].UInt16Val);
+  }
+  rb_hash_aset(hash, rb_str_new2("EventID"), LONG2NUM(EventID));
+
+  rb_hash_aset(hash,
+               rb_str_new2("Version"),
+               (EvtVarTypeNull == pRenderedValues[EvtSystemVersion].Type)
+                 ? INT2NUM(0)
+                 : INT2NUM(pRenderedValues[EvtSystemVersion].ByteVal));
+  rb_hash_aset(hash,
+               rb_str_new2("Level"),
+               (EvtVarTypeNull == pRenderedValues[EvtSystemLevel].Type)
+                 ? INT2NUM(0)
+                 : INT2NUM(pRenderedValues[EvtSystemLevel].ByteVal));
+  rb_hash_aset(hash,
+               rb_str_new2("Task"),
+               (EvtVarTypeNull == pRenderedValues[EvtSystemTask].Type)
+                 ? INT2NUM(0)
+                 : INT2NUM(pRenderedValues[EvtSystemTask].UInt16Val));
+  rb_hash_aset(hash,
+               rb_str_new2("Opcode"),
+               (EvtVarTypeNull == pRenderedValues[EvtSystemOpcode].Type)
+                 ? INT2NUM(0)
+                 : INT2NUM(pRenderedValues[EvtSystemOpcode].ByteVal));
+  _snprintf_s(buffer, _countof(buffer), _TRUNCATE,
+              "0x%llx", pRenderedValues[EvtSystemKeywords].UInt64Val);
+  rb_hash_aset(hash,
+               rb_str_new2("Keywords"),
+               (EvtVarTypeNull == pRenderedValues[EvtSystemKeywords].Type)
+                 ? Qnil
+                 : rb_str_new2(buffer));
+
+  ullTimeStamp = pRenderedValues[EvtSystemTimeCreated].FileTimeVal;
+  ft.dwHighDateTime = (DWORD)((ullTimeStamp >> 32) & 0xFFFFFFFF);
+  ft.dwLowDateTime = (DWORD)(ullTimeStamp & 0xFFFFFFFF);
+
+  FileTimeToSystemTime(&ft, &st);
+  ullNanoseconds =
+    (ullTimeStamp % 10000000) *
+    100; // Display nanoseconds instead of milliseconds for higher resolution
+  _snprintf_s(buffer,
+              _countof(buffer),
+              _TRUNCATE,
+              "%02d/%02d/%02d %02d:%02d:%02d.%llu",
+              st.wYear,
+              st.wMonth,
+              st.wDay,
+              st.wHour,
+              st.wMinute,
+              st.wSecond,
+              ullNanoseconds);
+  rb_hash_aset(hash,
+               rb_str_new2("TimeCreated"),
+               (EvtVarTypeNull == pRenderedValues[EvtSystemKeywords].Type)
+                 ? Qnil
+                 : rb_str_new2(buffer));
+  _snprintf_s(buffer,
+              _countof(buffer),
+              _TRUNCATE,
+              "%llu",
+              pRenderedValues[EvtSystemEventRecordId].UInt64Val);
+  rb_hash_aset(hash,
+               rb_str_new2("EventRecordID"),
+               (EvtVarTypeNull == pRenderedValues[EvtSystemEventRecordId].UInt64Val)
+                 ? Qnil
+                 : rb_str_new2(buffer));
+
+  if (EvtVarTypeNull != pRenderedValues[EvtSystemActivityID].Type) {
+    const GUID* Guid = pRenderedValues[EvtSystemActivityID].GuidVal;
+    StringFromGUID2(*Guid, wsGuid, _countof(wsGuid));
+    rbstr = wstr_to_rb_str(CP_UTF8, wsGuid, -1);
+    rb_hash_aset(hash, rb_str_new2("ActivityID"), rbstr);
+  }
+
+  if (EvtVarTypeNull != pRenderedValues[EvtSystemRelatedActivityID].Type) {
+    const GUID* Guid = pRenderedValues[EvtSystemRelatedActivityID].GuidVal;
+    StringFromGUID2(*Guid, wsGuid, _countof(wsGuid));
+    rbstr = wstr_to_rb_str(CP_UTF8, wsGuid, -1);
+    rb_hash_aset(hash, rb_str_new2("RelatedActivityID"), rbstr);
+  }
+
+  rb_hash_aset(hash,
+               rb_str_new2("ProcessID"),
+               UINT2NUM(pRenderedValues[EvtSystemProcessID].UInt32Val));
+  rb_hash_aset(hash,
+               rb_str_new2("ThreadID"),
+               UINT2NUM(pRenderedValues[EvtSystemThreadID].UInt32Val));
+  rbstr = wstr_to_rb_str(CP_UTF8, pRenderedValues[EvtSystemChannel].StringVal, -1);
+  rb_hash_aset(hash, rb_str_new2("Channel"), rbstr);
+  rbstr = wstr_to_rb_str(CP_UTF8, pRenderedValues[EvtSystemComputer].StringVal, -1);
+  rb_hash_aset(hash, rb_str_new2("Computer"), rbstr);
+
+  if (EvtVarTypeNull != pRenderedValues[EvtSystemUserID].Type) {
+    if (ConvertSidToStringSid(pRenderedValues[EvtSystemUserID].SidVal, &pwsSid)) {
+      rbstr = rb_utf8_str_new_cstr(pwsSid);
+      rb_hash_aset(hash, rb_str_new2("UserID"), rbstr);
+      LocalFree(pwsSid);
+    }
+  }
+
+  EvtClose(hContext);
+  ALLOCV_END(vRenderedValues);
+
+  return hash;
+}