2008/02/14 | Windows 日志存储数据结构
类别(语言类学习笔记) | 评论(0) | 阅读(67) | 发表于 20:35

Windows 日志存储数据结构


1. 事件日志文件是二进制文件,它有若干条记录单元组
    成,其中最前面的是记录头,最后面的是记录尾。
2. 每条记录(包括记录头、记录尾)的头、尾的双字是
    这条记录的长度(单位:字节)。如记录头48个字节
    (0x30),记录就是
    30 00 00 00  4C 66 4C 65 ……    30 00 00 00
    注意这里是字节顺序:
    30   00        00     00
   W1L   W1H    W2L     W2H
3.每条记录的第二个双字是特定的码 4C 66 4C 65
4.分析Windows API 日志存储数据结构。
typedef struct _EVENTLOGRECORD {
  DWORD  Length;
  DWORD  Reserved;
  DWORD  RecordNumber;
  DWORD  TimeGenerated;
  DWORD  TimeWritten;
  DWORD  EventID;
  WORD   EventType;
  WORD   NumStrings;
  WORD   EventCategory;
  WORD   ReservedFlags;
  DWORD  ClosingRecordNumber;
  DWORD  StringOffset;
  DWORD  UserSidLength;
  DWORD  UserSidOffset;
  DWORD  DataLength;
  DWORD  DataOffset;
} EVENTLOGRECORD, *PEVENTLOGRECORD;
5.文档分析
当AppEvent.Evt为空时,文件内容如下:
00000000h: 30 00 00 00 4C 66 4C 65 01 00 00 00 01 00 00 00 ; 0...LfLe........
00000010h: 30 00 00 00 30 00 00 00 01 00 00 00 00 00 00 00 ; 0...0...........
00000020h: 00 00 01 00 00 00 00 00 80 3A 09 00 30 00 00 00 ; ........€:..0...
00000030h: 28 00 00 00 11 11 11 11 22 22 22 22 33 33 33 33 ; (.......""""3333
00000040h: 44 44 44 44 30 00 00 00 30 63 01 00 28 02 00 00 ; DDDD0...0c..(...
00000050h: 01 00 00 00 28 00 00 00

当AppEvent.Evt写入1条,来源:Ci   事件id:1001  类型:4  信息项:Hello;Hello
00000000h: 30 00 00 00 4C 66 4C 65 01 00 00 00 01 00 00 00 ; 0...LfLe........
00000010h: 30 00 00 00 30 00 00 00 01 00 00 00 00 00 00 00 ; 0...0...........
00000020h: 00 00 01 00 01 00 00 00 80 3A 09 00 30 00 00 00 ; ........€:..0...
00000030h: 78 00 00 00 4C 66 4C 65 01 00 00 00 1F 8B 8A 3E ; x...LfLe.....媻>
00000040h: 1F 8B 8A 3E E9 03 00 00 04 00 02 00 01 00 00 00 ; .媻>?..........
00000050h: 00 00 00 00 58 00 00 00 00 00 00 00 58 00 00 00 ; ....X.......X...
00000060h: 00 00 00 00 70 00 00 00 43 00 69 00 00 00 43 00 ; ....p...C.i...C.
00000070h: 48 00 45 00 4E 00 47 00 4C 00 49 00 41 00 4E 00 ; H.E.N.G.L.I.A.N.
00000080h: 4D 00 41 00 4F 00 00 00 48 00 65 00 6C 00 6C 00 ; M.A.O...H.e.l.l.
00000090h: 6F 00 00 00 48 00 65 00 6C 00 6C 00 6F 00 00 00 ; o...H.e.l.l.o...
000000a0h: 00 00 00 00 78 00 00 00 28 00 00 00 11 11 11 11 ; ....x...(.......
000000b0h: 22 22 22 22 33 33 33 33 44 44 44 44 30 00 00 00 ; """"3333DDDD0...
000000c0h: A8 00 00 00 02 00 00 00 01 00 00 00 28 00 00 00 ; ?..........(...

当AppEvent.Evt写入1条,来源:Application Management   事件id:1002  类型:1  信息项:What;What
00000000h: 30 00 00 00 4C 66 4C 65 01 00 00 00 01 00 00 00 ; 0...LfLe........
00000010h: 30 00 00 00 30 00 00 00 01 00 00 00 00 00 00 00 ; 0...0...........
00000020h: 00 00 01 00 01 00 00 00 80 3A 09 00 30 00 00 00 ; ........€:..0...
00000030h: 9C 00 00 00 4C 66 4C 65 01 00 00 00 80 8C 8A 3E ; ?..LfLe....€寠>
00000040h: 80 8C 8A 3E EA 03 00 00 01 00 02 00 01 00 00 00 ; €寠>?..........
00000050h: 00 00 00 00 80 00 00 00 00 00 00 00 80 00 00 00 ; ....€.......€...
00000060h: 00 00 00 00 94 00 00 00 41 00 70 00 70 00 6C 00 ; ....?..A.p.p.l.
00000070h: 69 00 63 00 61 00 74 00 69 00 6F 00 6E 00 20 00 ; i.c.a.t.i.o.n. .
00000080h: 4D 00 61 00 6E 00 61 00 67 00 65 00 6D 00 65 00 ; M.a.n.a.g.e.m.e.
00000090h: 6E 00 74 00 00 00 43 00 48 00 45 00 4E 00 47 00 ; n.t...C.H.E.N.G.
000000a0h: 4C 00 49 00 41 00 4E 00 4D 00 41 00 4F 00 00 00 ; L.I.A.N.M.A.O...
000000b0h: 57 00 68 00 61 00 74 00 00 00 57 00 68 00 61 00 ; W.h.a.t...W.h.a.
000000c0h: 74 00 00 00 00 00 00 00 9C 00 00 00 28 00 00 00 ; t.......?..(...
000000d0h: 11 11 11 11 22 22 22 22 33 33 33 33 44 44 44 44 ; ....""""3333DDDD
000000e0h: 30 00 00 00 CC 00 00 00 02 00 00 00 01 00 00 00 ; 0...?..........
000000f0h: 28 00 00 00

当AppEvent.Evt写入2条。
第1条来源:Application Management   事件id:1002  类型:1  信息项:What;What
第2条来源:Ci   事件id:1001  类型:4  信息项:Hello;Hello
00000000h: 30 00 00 00 4C 66 4C 65 01 00 00 00 01 00 00 00 ; 0...LfLe........
00000010h: 30 00 00 00 30 00 00 00 01 00 00 00 00 00 00 00 ; 0...0...........
00000020h: 00 00 01 00 01 00 00 00 80 3A 09 00 30 00 00 00 ; ........€:..0...
00000030h: 9C 00 00 00 4C 66 4C 65 01 00 00 00 80 8C 8A 3E ; ?..LfLe....€寠>
00000040h: 80 8C 8A 3E EA 03 00 00 01 00 02 00 01 00 00 00 ; €寠>?..........
00000050h: 00 00 00 00 80 00 00 00 00 00 00 00 80 00 00 00 ; ....€.......€...
00000060h: 00 00 00 00 94 00 00 00 41 00 70 00 70 00 6C 00 ; ....?..A.p.p.l.
00000070h: 69 00 63 00 61 00 74 00 69 00 6F 00 6E 00 20 00 ; i.c.a.t.i.o.n. .
00000080h: 4D 00 61 00 6E 00 61 00 67 00 65 00 6D 00 65 00 ; M.a.n.a.g.e.m.e.
00000090h: 6E 00 74 00 00 00 43 00 48 00 45 00 4E 00 47 00 ; n.t...C.H.E.N.G.
000000a0h: 4C 00 49 00 41 00 4E 00 4D 00 41 00 4F 00 00 00 ; L.I.A.N.M.A.O...
000000b0h: 57 00 68 00 61 00 74 00 00 00 57 00 68 00 61 00 ; W.h.a.t...W.h.a.
000000c0h: 74 00 00 00 00 00 00 00 9C 00 00 00 78 00 00 00 ; t.......?..x...
000000d0h: 4C 66 4C 65 02 00 00 00 90 8D 8A 3E 90 8D 8A 3E ; LfLe....悕?悕?
000000e0h: E9 03 00 00 04 00 02 00 01 00 00 00 00 00 00 00 ; ?..............
000000f0h: 58 00 00 00 00 00 00 00 58 00 00 00 00 00 00 00 ; X.......X.......
00000100h: 70 00 00 00 43 00 69 00 00 00 43 00 48 00 45 00 ; p...C.i...C.H.E.
00000110h: 4E 00 47 00 4C 00 49 00 41 00 4E 00 4D 00 41 00 ; N.G.L.I.A.N.M.A.
00000120h: 4F 00 00 00 48 00 65 00 6C 00 6C 00 6F 00 00 00 ; O...H.e.l.l.o...
00000130h: 48 00 65 00 6C 00 6C 00 6F 00 00 00 00 00 00 00 ; H.e.l.l.o.......
00000140h: 78 00 00 00 28 00 00 00 11 11 11 11 22 22 22 22 ; x...(.......""""
00000150h: 33 33 33 33 44 44 44 44 30 00 00 00 44 01 00 00 ; 3333DDDD0...D...
00000160h: 03 00 00 00 01 00 00 00 28 00 00 00
6.数据项分析
分析结果:
当AppEvent.Evt写入2条。
第1条来源:Application Management   事件id:1002  类型:1  信息项:What;What
第2条来源:Ci   事件id:1001  类型:4  信息项:Hello;Hello

•文件头
0000h 30 00 00 00 文件头长度30h=48
 4C 66 4C 65 LeLf(开始标记)
 01 00 00 00 ..
 01 00 00 00 ..
0010h 30 00 00 00 第一条记录的偏移量
 30 00 00 00 某条记录的偏移量(任意)
 01 00 00 00 [0014h]偏移地址的记录号
 00 00 00 00 当[0018h]指向的不是第一句记录时,此时这里的值则为:01 00 00 00表示为起始记录。不能为 00 00 00 00
0020h 00 00 01 00 事件日志文件的总长度65536
 01 00 00 00 是一个变值,用于标识是否为系统目录下的日志文件。通常系统会随机产生一个数,来标识为系统目录下的文件。以做特别的处理。
 80 3A 09 00 注册表中机器的保留字
 30 00 00 00 文件头长度30h=48
•记录项信息
0030h 9C 00 00 00 记录长009Ch个字节
DWORD Length

 4C 66 4C 65 LeLf(开始标记)  
DWORD Reserved

 01 00 00 00 记录串号,当前是第1条记录
DWORD RecordNumber

 80 8C 8A 3E 时间代码,从1970年到现在的秒数DWORD TimeGenerated

0040h 80 8C 8A 3E 时间代码,从1970年到现在的秒数DWORD TimeWritten

 EA 03 00 00 事件ID号,当前为 1002
DWORD EventID

 01 00 02 00 低位为 类型
WORD EventType

  //1 错误(红灯)
  //2 警告(叹号)
  //4 信息(I)
  //8 成功审核(锁)
  //10h 失败审核
  ……
  本例为 01 错误(红灯)
  //高位:消息量,就是事件包含多少条有关消息,本例为2条
WORD NumStrings

 01 00 00 00 低位为 事件的种类
WORD EventCategory

  本例为1是消息。
  高位为 事件的保留标记
WORD ReservedFlags

0050h 00 00 00 00 是事件的结束记录数
  DWORD ClosingRecordNumber

 80 00 00 00 事件消息的偏移量
  DWORD StringOffset

  如,本记录开始于0030h
  那么,消息信息的开始就为 00B0h
 00 00 00 00 用户信息的长度
  DWORD UserSidLength

 80 00 00 00 用户信息的偏移量(因为没,记录的是事件消息的偏移量)
  DWORD UserSidOffset

0060h 00 00 00 00 数据的长度
  DWORD DataLength

 94 00 00 00 数据的偏移量
  如,本记录开始于0030h
  那么,数据的开始就为00C4h
  DWORD DataOffset

0068h 41 00 70 00 从这里开始是来源信息
...  (每个字母以一个WORD存)
0094h 00 00 来源信息结束
0096h 43 00 48 00 从这里开始是计算机名信息
...  (每个字母以一个WORD存)
00AEh 00 00 计算机名结束
00B0h 57 00 68 00 从这里开始消息信息,第条以00 00为结束。
...  (每个字母以一个WORD存)
00C2h 00 00 消息信息结束
00C4h 00 00 00 00 数据的存储地址,当前为空
00C6h 9C 00 00 00 本条记录的长度
... ... 下面为另一条记录

•文件尾
0144h 28 00 00 00 文件尾长度28h=40
  本事件日志文件结尾为016Ch
 11 11 11 11 
 22 22 22 22 
 33 33 33 33 
0154h 44 44 44 44 4个双字的标识
 30 00 00 00 第一条记录的偏移量
 44 01 00 00 文件尾的偏移量
 03 00 00 00 记录尾的串号
  (本日志共2条记录,记录尾的串号是3)
0164h 01 00 00 00 第一条记录的串号
 28 00 00 00 文件尾长度28h=40

0

评论Comments