When attempting to parse an evtx file as gathered by a collector on a Win server 2012 R2 box ; I get the following errors:
./evtx_dump.py Archive-ForwardedEvents-2017-07-19-09-54-122.evtx
<?xml version="1.1" encoding="utf-8" standalone="yes" ?>
<Events>
Traceback (most recent call last):
File "./evtx_dump.py", line 46, in <module>
main()
File "./evtx_dump.py", line 41, in main
print(record.xml())
File "/usr/local/lib/python2.7/dist-packages/python_evtx-0.6.0-py2.7.egg/Evtx/Evtx.py", line 481, in xml
return e_views.evtx_record_xml_view(self)
File "/usr/local/lib/python2.7/dist-packages/python_evtx-0.6.0-py2.7.egg/Evtx/Views.py", line 204, in evtx_record_xml_view
return render_root_node(record.root())
File "/usr/local/lib/python2.7/dist-packages/python_evtx-0.6.0-py2.7.egg/Evtx/Views.py", line 182, in render_root_node
for sub in root_node.substitutions():
File "/usr/local/lib/python2.7/dist-packages/python_evtx-0.6.0-py2.7.egg/Evtx/BinaryParser.py", line 64, in __call__
cache[key] = self.func(*args, **kw)
File "/usr/local/lib/python2.7/dist-packages/python_evtx-0.6.0-py2.7.egg/Evtx/Nodes.py", line 1001, in substitutions
ofs = self.tag_and_children_length()
File "/usr/local/lib/python2.7/dist-packages/python_evtx-0.6.0-py2.7.egg/Evtx/Nodes.py", line 962, in tag_and_children_length
for child in self.children():
File "/usr/local/lib/python2.7/dist-packages/python_evtx-0.6.0-py2.7.egg/Evtx/BinaryParser.py", line 64, in __call__
cache[key] = self.func(*args, **kw)
File "/usr/local/lib/python2.7/dist-packages/python_evtx-0.6.0-py2.7.egg/Evtx/Nodes.py", line 952, in children
return self._children(end_tokens=[SYSTEM_TOKENS.EndOfStreamToken])
File "/usr/local/lib/python2.7/dist-packages/python_evtx-0.6.0-py2.7.egg/Evtx/Nodes.py", line 159, in _children
ofs += child.length()
File "/usr/local/lib/python2.7/dist-packages/python_evtx-0.6.0-py2.7.egg/Evtx/BinaryParser.py", line 64, in __call__
cache[key] = self.func(*args, **kw)
File "/usr/local/lib/python2.7/dist-packages/python_evtx-0.6.0-py2.7.egg/Evtx/Nodes.py", line 177, in length
for child in self.children():
File "/usr/local/lib/python2.7/dist-packages/python_evtx-0.6.0-py2.7.egg/Evtx/BinaryParser.py", line 64, in __call__
cache[key] = self.func(*args, **kw)
File "/usr/local/lib/python2.7/dist-packages/python_evtx-0.6.0-py2.7.egg/Evtx/Nodes.py", line 334, in children
SYSTEM_TOKENS.CloseEmptyElementToken])
File "/usr/local/lib/python2.7/dist-packages/python_evtx-0.6.0-py2.7.egg/Evtx/Nodes.py", line 162, in _children
if child.find_end_of_stream():
File "/usr/local/lib/python2.7/dist-packages/python_evtx-0.6.0-py2.7.egg/Evtx/BinaryParser.py", line 64, in __call__
cache[key] = self.func(*args, **kw)
File "/usr/local/lib/python2.7/dist-packages/python_evtx-0.6.0-py2.7.egg/Evtx/Nodes.py", line 186, in find_end_of_stream
ret = child.find_end_of_stream()
AttributeError: 'NullTypeNode' object has no attribute 'find_end_of_stream'
running Python 2.7.9 on Debian 8. I installed the current version of python-evtx using the setup.py utility from the github download. Please let me know if you need any more details.
Hi,
When attempting to parse an evtx file as gathered by a collector on a Win server 2012 R2 box ; I get the following errors:
running Python 2.7.9 on Debian 8. I installed the current version of python-evtx using the setup.py utility from the github download. Please let me know if you need any more details.