def test_hEvtRpcRegisterLogQuery_hEvtRpcQueryNext(self):
dce, rpctransport = self.connect(2)
try:
resp = even6.hEvtRpcRegisterLogQuery(
dce, 'Security\x00', '*\x00',
even6.EvtQueryChannelName | even6.EvtReadNewestToOldest)
resp.dump()
except Exception as e:
return
log_handle = resp['Handle']
try:
resp = even6.EvtRpcQueryNext(dce, log_handle, 5, 1000, 0)
resp.dump()
except Exception as e:
return
for i in range(resp['NumActualRecords']):
event_offset = resp['EventDataIndices'][i]['Data']
event_size = resp['EventDataSizes'][i]['Data']
event = resp['ResultBuffer'][event_offset:event_offset +
event_size]
buff = ''.join([x.encode('hex') for x in event]).decode('hex')
print(hexdump(buff))
def test_hEvtRpcRegisterLogQuery_hEvtRpcQueryNext(self):
dce, rpctransport = self.connect(2)
try:
resp = even6.hEvtRpcRegisterLogQuery(dce, 'Security\x00', '*\x00', even6.EvtQueryChannelName | even6.EvtReadNewestToOldest)
resp.dump()
except Exception, e:
return
def test_hEvtRpcRegisterLogQuery_hEvtRpcQueryNext(self):
dce, rpctransport = self.connect()
resp = even6.hEvtRpcRegisterLogQuery(dce, 'Security\x00',
even6.EvtQueryChannelName | even6.EvtReadNewestToOldest,
'*\x00')
resp.dump()
log_handle = resp['Handle']
resp = even6.hEvtRpcQueryNext(dce, log_handle, 5, 1000)
resp.dump()
for i in xrange(resp['NumActualRecords']):
event_offset = resp['EventDataIndices'][i]['Data']
event_size = resp['EventDataSizes'][i]['Data']
event = resp['ResultBuffer'][event_offset:event_offset + event_size]
def test_hEvtRpcRegisterLogQuery_hEvtRpcQueryNext(self):
dce, rpctransport = self.connect(2)
try:
resp = even6.hEvtRpcRegisterLogQuery(dce, 'Security\x00', '*\x00', even6.EvtQueryChannelName | even6.EvtReadNewestToOldest)
resp.dump()
except Exception as e:
return
log_handle = resp['Handle']
try:
resp = even6.EvtRpcQueryNext(dce, log_handle, 5, 1000, 0)
resp.dump()
except Exception as e:
return
for i in range(resp['NumActualRecords']):
event_offset = resp['EventDataIndices'][i]['Data']
event_size = resp['EventDataSizes'][i]['Data']
event = resp['ResultBuffer'][event_offset:event_offset + event_size]
buff = ''.join([x.encode('hex') for x in event]).decode('hex')
print hexdump(buff)