michkoll / fakenevtx Goto Github PK

2021-01-26 16:19:40,353 [Workflow.Workflow    (_validate           )] [INFO ]  Evtx file verified successfully.
2021-01-26 16:19:40,354 [Workflow.Workflow    (run                 )] [INFO ]  Starting step ModifyEventdataStep
2021-01-26 16:20:18,589 [Workflow.FilterUtils (find_records        )] [INFO ]  Found 38908 records
2021-01-26 16:20:18,598 [Workflow.Workflow    (run                 )] [INFO ]  Execute ModifyEventdataStep(new_value=CENCORED) for record 44901763
2021-01-26 16:20:18,700 [Workflow.ModifyStep  (execute             )] [INFO ]  Changed value of element <Data Name=TargetUserName from Administrator to CENCORED
Traceback (most recent call last):
  File "C:\Users\xxx\bin\Python\Python38\lib\site-packages\Evtx\BinaryParser.py", line 648, in unpack_binary
    return bytes(struct.unpack_from("<{}s".format(length), self._buf, o)[0])
struct.error: bad char in struct format

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "test.py", line 26, in <module>
    main(args.src, args.dest)
  File "test.py", line 17, in main
    workflow.run(src, dest)
  File "C:\Users\xxx\bin\Python\Python38\lib\site-packages\Workflow\Workflow.py", line 68, in run
    step.run(dest_evtx_path)
  File "C:\Users\xxx\bin\Python\Python38\lib\site-packages\Workflow\Workflow.py", line 148, in run
    self.repair_hash()
  File "C:\Users\xxx\bin\Python\Python38\lib\site-packages\Workflow\Workflow.py", line 207, in repair_hash
    chunk.repair_header()
  File "C:\Users\xxx\bin\Python\Python38\lib\site-packages\Evtx\Evtx.py", line 389, in repair_header
    hex(self.calculate_data_checksum()),
  File "C:\Users\xxx\bin\Python\Python38\lib\site-packages\Evtx\Evtx.py", line 368, in calculate_data_checksum
    data = self.unpack_binary(0x200, self.next_record_offset() - 0x200)
  File "C:\Users\xxx\bin\Python\Python38\lib\site-packages\Evtx\BinaryParser.py", line 650, in unpack_binary
    raise OverrunBufferException(o, len(self._buf))
Evtx.BinaryParser.OverrunBufferException: Tried to parse beyond the end of the file (read: 0x11200, buffer length: 0x1401000)