evtx 0.1.1

A Fast (and safe) parser for the Windows XML Event Log (EVTX) format
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38

use crate::binxml::name::BinXmlName;
use crate::Offset;

use std::collections::HashMap;
use std::io::{Cursor, Seek, SeekFrom};

pub type StringHash = u16;

pub type CachedString = (String, StringHash, Offset);

#[derive(Debug)]
pub struct StringCache(HashMap<Offset, CachedString>);

impl StringCache {
    pub fn new() -> Self {
        StringCache(HashMap::new())
    }

    pub fn populate(&mut self, data: &[u8], offsets: &[Offset]) -> Result<(), failure::Error> {
        let mut cursor = Cursor::new(data);

        for offset in offsets.iter().filter(|&&offset| offset > 0) {
            cursor.seek(SeekFrom::Start(*offset as u64))?;
            self.0
                .insert(*offset, BinXmlName::from_stream(&mut cursor)?);
        }

        Ok(())
    }

    pub fn get_string_and_hash(&self, offset: Offset) -> Option<&CachedString> {
        self.0.get(&offset)
    }

    pub fn len(&self) -> usize {
        self.0.len()
    }
}