evtx/
lib.rs

1#![deny(unused_must_use)]
2#![forbid(unsafe_code)]
3#![allow(clippy::upper_case_acronyms)]
4// Don't allow dbg! prints in release.
5#![cfg_attr(not(debug_assertions), deny(clippy::dbg_macro))]
6#[macro_use]
7extern crate bitflags;
8
9pub use evtx_chunk::{EvtxChunk, EvtxChunkData, EvtxChunkHeader, IterChunkRecords};
10pub use evtx_file_header::{EvtxFileHeader, HeaderFlags};
11pub use evtx_parser::{EvtxParser, IntoIterChunks, IterChunks, ParserSettings};
12pub use evtx_record::{EvtxRecord, EvtxRecordHeader, RecordId, SerializedEvtxRecord};
13pub use utils::utf16::{Utf16LeDecodeError, Utf16LeSlice};
14
15pub mod binxml;
16pub mod err;
17pub mod model;
18
19// Optional: PE resource parsing to extract WEVT_TEMPLATE blobs (see issue #103).
20#[cfg(feature = "wevt_templates")]
21pub mod wevt_templates;
22
23mod evtx_chunk;
24mod evtx_file_header;
25mod evtx_parser;
26mod evtx_record;
27mod string_cache;
28mod utils;
29
30
31pub type ChunkOffset = u32;
32pub type FileOffset = u64;
33
34// For tests, we only initialize logging once.
35#[cfg(test)]
36use std::sync::Once;
37
38#[cfg(test)]
39static LOGGER_INIT: Once = Once::new();
40
41use crc32fast::Hasher;
42
43#[inline]
44pub fn checksum_ieee(data: &[u8]) -> u32 {
45    let mut hasher = Hasher::new();
46    hasher.update(data);
47    hasher.finalize()
48}
49
50// Rust runs the tests concurrently, so unless we synchronize logging access
51// it will crash when attempting to run `cargo test` with some logging facilities.
52#[cfg(test)]
53pub fn ensure_env_logger_initialized() {
54    use std::io::Write;
55
56    LOGGER_INIT.call_once(|| {
57        let mut builder = env_logger::Builder::from_default_env();
58        builder
59            .format(|buf, record| writeln!(buf, "[{}] - {}", record.level(), record.args()))
60            .init();
61    });
62}
63
64// Cannot use `cfg(test)` here since `rustdoc` won't look at it.
65#[cfg(debug_assertions)]
66mod test_readme {
67    macro_rules! calculated_doc {
68        ($doc:expr_2021, $id:ident) => {
69            #[doc = $doc]
70            enum $id {}
71        };
72    }
73
74    calculated_doc!(include_str!("../README.md"), _DoctestReadme);
75}
evtx/lib.rs

evtx/
lib.rs
