Obtaining the "Name" of the StringOffset from the WinAPI ReadEventLog()

325 Views Asked by At

I am using the Windows API to get recent events from the Windows Event Viewer. Everything is working great so far but I am confused as to how I determine the StringOffset field. I iterated through and created an array of the strings that exist in that buffer but there is no context associated with each string.

Having a look at the Windows Event Viewer, I see in raw XML that there is a field name that you don't get in the API (at least none that I am aware of).

<EventData>
  <Data Name="ProcessID">4</Data> 
  <Data Name="Application">System</Data> 
  <Data Name="Direction">%%14592</Data> 
  <Data Name="SourceAddress">192.168.22.232</Data> 
  <Data Name="SourcePort">137</Data> 
  <Data Name="DestAddress">192.168.22.255</Data> 
  <Data Name="DestPort">137</Data> 
  <Data Name="Protocol">17</Data> 
  <Data Name="FilterRTID">71247</Data> 
  <Data Name="LayerName">%%14610</Data> 
  <Data Name="LayerRTID">44</Data> 
  <Data Name="RemoteUserID">S-1-0-0</Data> 
  <Data Name="RemoteMachineID">S-1-0-0</Data> 
</EventData>

The documentation begins here:

EVENTLOGRECORD structure

0

There are 0 best solutions below