evtx_dump.py OSError: [Errno 22] Invalid argument

[d474b3r9]

Hello,

i am on windows 10 64 bits and i can't workaround this issue.
This code works for another EVT file so i don't understand the problem and i am not enough skilled in python to debug it. If you want i can provide you the file involved to test by yourself.

python .\python-evtx-master\scripts\evtx_dump.py System.evtx > hoho.xml
Traceback (most recent call last):
File ".\python-evtx-master\scripts\evtx_dump.py", line 42, in
main()
File ".\python-evtx-master\scripts\evtx_dump.py", line 37, in main
print(record.xml())
File "C:\Python35\lib\site-packages\Evtx\Evtx.py", line 481, in xml
return e_views.evtx_record_xml_view(self)
File "C:\Python35\lib\site-packages\Evtx\Views.py", line 204, in evtx_record_xml_view
return render_root_node(record.root())
File "C:\Python35\lib\site-packages\Evtx\Views.py", line 191, in render_root_node
return render_root_node_with_subs(root_node, subs)
File "C:\Python35\lib\site-packages\Evtx\Views.py", line 176, in render_root_node_with_subs
rec(c, acc)
File "C:\Python35\lib\site-packages\Evtx\Views.py", line 126, in rec
rec(child, acc)
File "C:\Python35\lib\site-packages\Evtx\Views.py", line 166, in rec
sub = render_root_node(sub.root())
File "C:\Python35\lib\site-packages\Evtx\Views.py", line 191, in render_root_node
return render_root_node_with_subs(root_node, subs)
File "C:\Python35\lib\site-packages\Evtx\Views.py", line 176, in render_root_node_with_subs
rec(c, acc)
File "C:\Python35\lib\site-packages\Evtx\Views.py", line 126, in rec
rec(child, acc)
File "C:\Python35\lib\site-packages\Evtx\Views.py", line 126, in rec
rec(child, acc)
File "C:\Python35\lib\site-packages\Evtx\Views.py", line 159, in rec
sub = escape_value(sub.string())
File "C:\Python35\lib\site-packages\Evtx\Nodes.py", line 1401, in string
return self.filetime().isoformat(' ')
File "C:\Python35\lib\site-packages\Evtx\BinaryParser.py", line 205, in no_length_handler
return f(offset)
File "C:\Python35\lib\site-packages\Evtx\BinaryParser.py", line 518, in unpack_filetime
return parse_filetime(self.unpack_qword(offset))
File "C:\Python35\lib\site-packages\Evtx\BinaryParser.py", line 109, in parse_filetime
return datetime.utcfromtimestamp(float(qword) * 1e-7 - 11644473600)
OSError: [Errno 22] Invalid argument

Regards,
Jonathan.

[john-corcoran]

Hi, just to echo that I'm encountering the same issue with Python 3.5.2 on Windows 10 and Python 3.6.3 on Windows 7. Python 2.7 doesn't raise the issue and processing completes successfully.

Edit: just did some further testing and the issue doesn't occur on Ubuntu 16.04 with Python 3.5.2.

I can send a sample EVTX by email if it helps with diagnosis?

[williballenthin]

hey @john-corcoran thanks for the additional info. this will be very helpful.

can you confirm all your interpreters are 64-bit?

[john-corcoran]

Hi @williballenthin, just tested both 64-bit and 32-bit instances of Python 3.6.4 on Windows 7, and both gave the same exception at the same point as listed in the OP.

I'll email through a sample EVTX that is exhibiting the issue. Thanks for looking into it!

[williballenthin]

for the evtx file provided by @john-corcoran, the problematic record is number 21:

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"><System><Provider Name="Microsoft-Windows-Diagnosis-DPS" Guid="{6bba3851-2c7e-4dea-8f54-31e5afd029e3}"></Provider>
<EventID Qualifiers="">115</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>1</Task>
<Opcode>15</Opcode>
<Keywords>0x4000000800000000</Keywords>
<TimeCreated SystemTime="2017-07-31 15:44:22.804375"></TimeCreated>
<EventRecordID>21</EventRecordID>
<Correlation ActivityID="{9a6fb385-875e-46dd-a5c0-4c81ae940516}" RelatedActivityID=""></Correlation>
<Execution ProcessID="1144" ThreadID="2424"></Execution>
<Channel>Microsoft-Windows-Diagnosis-DPS/Operational</Channel>
<Computer>exploited</Computer>
<Security UserID="S-1-5-19"></Security>
</System>
<EventData><Data Name="ScenarioId">{180b3a99-8c39-4f12-b631-2031998efe45}</Data>
<Data Name="InstanceId">{9a6fb385-875e-46dd-a5c0-4c81ae940516}</Data>
<Data Name="OriginalActivityId">{00000000-0000-0000-0000-000000000000}</Data>
<Data Name="DiagnosticModuleImageName">%windir%\system32\radardt.dll</Data>
<Data Name="ResolutionId">{5ee64afb-398d-4edb-af71-3b830219abf7}</Data>
<Data Name="ResolutionSID">S-1-5-21-1478063154-1558866469-3193402370-1000</Data>
<Data Name="ResolutionSessionId">1</Data>
<Data Name="ResolutionExpirationDate">0001-01-01 00:00:00</Data>
<Data Name="DiagnosticModuleId">{45de1ea9-10bc-4f96-9b21-4b6b83dbf476}</Data>
</EventData>
</Event>

notably, the ResolutionExpirationDate is empty. according to the py3 documentation, dates less than 1970 will raise an OSError, which is what we see here. ref: https://docs.python.org/3/library/datetime.html#datetime.datetime.utcfromtimestamp

[williballenthin]

this behavior changed in python 3.3, where OSError is now raised instead of ValueError. there's a handler for ValueError here that needs to be updated.

[williballenthin]

issue addressed in 5fb7662

thanks to @SeekWellServer for reporting the issue, and @john-corcoran for providing a test binary!