Skip to content

Apply language preference to lazily discovered MUI files #39

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
scudette merged 4 commits into from
Jun 12, 2026
Merged

Apply language preference to lazily discovered MUI files #39

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
abe979a
Apply language preference to lazily discovered MUI files
TL-yan Jun 11, 2026
652d581
Slight refactor
scudette Jun 12, 2026
2cd1140
Added regex back
scudette Jun 12, 2026
9372974
Fix build
scudette Jun 12, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,3 +6,6 @@ test:

windows:
GOOS=windows GOARCH=amd64 CGO_ENABLED=1 CC=x86_64-w64-mingw32-gcc go build -o dumpevtx.exe cmd/*.go

staticcheck:
staticcheck ./...
2 changes: 1 addition & 1 deletion cmd/extract_windows.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -78,7 +78,7 @@ func walkProvider(cb func(provider string, message_table string) error) error {
continue
}

for _, message_file := range resolver.ExpandLocations(
for _, message_file := range resolver.ExpandMessageFileLocation(
message_files) {
err = cb(provider_name, message_file)
if err != nil {
Expand Down
3 changes: 0 additions & 3 deletions evtx.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -300,9 +300,6 @@ type ParseContext struct {
// XML Attributes are written to this template.
stack []*TemplateNode

// Remember the attribute we are currently parsing.
current_keys []string

attribute_mode bool

// A
Expand Down
6 changes: 3 additions & 3 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ require (
github.com/pkg/errors v0.9.1
github.com/sebdah/goldie v1.0.0
github.com/stretchr/testify v1.9.0
golang.org/x/sys v0.37.0
golang.org/x/sys v0.46.0
www.velocidex.com/golang/binparsergen v0.1.1-0.20240404114946-8f66c7cf586e
www.velocidex.com/golang/go-pe v0.1.1-0.20251107001057-f93001158cd9
)
Expand All @@ -26,11 +26,11 @@ require (
github.com/pmezard/go-difflib v1.0.0 // indirect
github.com/sergi/go-diff v1.4.0 // indirect
github.com/xhit/go-str2duration/v2 v2.1.0 // indirect
golang.org/x/text v0.30.0 // indirect
golang.org/x/text v0.38.0 // indirect
gopkg.in/yaml.v3 v3.0.1 // indirect
)

// replace www.velocidex.com/golang/go-pe => /home/mic/projects/go-pe/
// replace github.com/Velocidex/ordereddict => /home/mic/projects/ordereddict

go 1.24.0
go 1.25.0
8 changes: 4 additions & 4 deletions go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -56,10 +56,10 @@ github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8
github.com/xhit/go-str2duration/v2 v2.1.0 h1:lxklc02Drh6ynqX+DdPyp5pCKLUQpRT8bp8Ydu2Bstc=
github.com/xhit/go-str2duration/v2 v2.1.0/go.mod h1:ohY8p+0f07DiV6Em5LKB0s2YpLtXVyJfNt1+BlmyAsU=
golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.37.0 h1:fdNQudmxPjkdUTPnLn5mdQv7Zwvbvpaxqs831goi9kQ=
golang.org/x/sys v0.37.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
golang.org/x/text v0.30.0 h1:yznKA/E9zq54KzlzBEAWn1NXSQ8DIp/NYMy88xJjl4k=
golang.org/x/text v0.30.0/go.mod h1:yDdHFIX9t+tORqspjENWgzaCVXgk0yYnYuSZ8UzzBVM=
golang.org/x/sys v0.46.0 h1:noSf2Fq6F8DBgS+LysIkx7rIExoNHJsxOAtPp4rthXw=
golang.org/x/sys v0.46.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
golang.org/x/text v0.38.0 h1:sXmwo9DwP3OK9EZ7PqAdaooSGozfl/3a6/xJcbzPRhE=
golang.org/x/text v0.38.0/go.mod h1:YXZt3QhHUKYT53r2lLKFIVi6Ao1jdzrTR/KQ09qyxF4=
golang.org/x/xerrors v0.0.0-20231012003039-104605ab7028/go.mod h1:NDW/Ps6MPRej6fsCIbMTohpP40sJ/P/vI1MoTEGwX90=
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15 h1:YR8cESwS4TdDjEe65xsg0ogRM/Nc3DYOhEAlW+xobZo=
Expand Down
3 changes: 1 addition & 2 deletions message_sets.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -81,8 +81,7 @@ func (self *MessageSet) GetParameter(id int) string {
self.mu.Lock()
defer self.mu.Unlock()

res, _ := self.Parameters[id]
return res
return self.Parameters[id]
}

// Calculates the largest expansion number from the message string.
Expand Down
8 changes: 2 additions & 6 deletions messages.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,12 +9,8 @@ import (
)

var (
expansion_re = regexp.MustCompile(`\%[0-9ntr]+`)
parameter_re = regexp.MustCompile(`^\%\%([0-9]+)`)
system_root_re = regexp.MustCompile("(?i)%?SystemRoot%?")
windir_re = regexp.MustCompile("(?i)%windir%")
programfiles_re = regexp.MustCompile("(?i)%programfiles%")
system32_re = regexp.MustCompile(`(?i)\\System32\\`)
expansion_re = regexp.MustCompile(`\%[0-9ntr]+`)
parameter_re = regexp.MustCompile(`^\%\%([0-9]+)`)
)

type MessageResolver interface {
Expand Down
Loading
Loading