Initial commit

.github/workflows/release.yml

@@ -0,0 +1,32 @@
+name: Release
+run-name: Release ${{ github.ref_name }}
+on:
+  push:
+    tags:
+      - v*
+  workflow_dispatch:
+jobs:
+  release:
+    runs-on: windows-latest
+    permissions:
+      contents: write
+    env:
+      RELEASE_ZIP_FILENAME: ${{ github.event.repository.name }}-${{ github.ref_name }}-win-x64.zip
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+      - name: Set up MSVC environment
+        uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756
+      - name: Build
+        run: make build
+      - name: Create release ZIP file
+        run: |
+          Copy-Item LICENSE,COPYRIGHT out
+          Rename-Item out ${{ github.event.repository.name }}
+          Compress-Archive ${{ github.event.repository.name }} ${{ env.RELEASE_ZIP_FILENAME }}
+      - name: Release on GitHub
+        uses: softprops/action-gh-release@c062e08bd532815e2082a85e87e3ef29c3e6d191
+        with:
+          tag_name: ${{ github.ref_name }}
+          generate_release_notes: true
+          files: ${{ env.RELEASE_ZIP_FILENAME }}

.gitignore

@@ -0,0 +1 @@
+out

.vscode/settings.json

@@ -0,0 +1,9 @@
+{
+	"terminal.integrated.defaultProfile.windows": "x64 Native Tools Command Prompt for VS 2022 (Admin)",
+	"terminal.integrated.profiles.windows": {
+		"x64 Native Tools Command Prompt for VS 2022 (Admin)": {
+			"path": "sudo",
+			"args": ["${env:comspec}", "/k", "C:\\Program Files\\Microsoft Visual Studio\\2022\\Community\\VC\\Auxiliary\\Build\\vcvars64.bat"]
+		}
+	}
+}

COPYRIGHT

@@ -0,0 +1,13 @@
+Copyright (c) 2024 Shibi J M
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU General Public License, version 3,
+as published by the Free Software Foundation.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU General Public License for more details.
+
+You should have received a copy of the GNU General Public License
+along with this program.  If not, see <https://www.gnu.org/licenses/>.

Makefile

@@ -0,0 +1,4 @@
+build:
+	mkdir -p out
+	cl /Fe:out/nso-winevt-extractor.exe main.c
+	rm *.obj

main.c

@@ -0,0 +1,66 @@
+#pragma comment(lib, "wevtapi.lib")
+
+#include <stdio.h>
+#include <windows.h>
+#include <winevt.h>
+
+#define WriteData_MASK 0x2
+#define AppendData_MASK 0x4
+#define DeleteChild_MASK 0x40
+#define DELETE_MASK 0x10000
+#define READ_CONTROL_MASK 0x20000
+
+int main() {
+	EVT_HANDLE results = EvtQuery(NULL, L"Security", L"Event/System[EventID=5145]", EvtQueryForwardDirection);
+	PWSTR valuesToRender[] = {
+		L"Event/System/TimeCreated/@SystemTime",
+		L"Event/EventData/Data[@Name=\"IpAddress\"]",
+		L"Event/EventData/Data[@Name=\"ShareName\"]",
+		L"Event/EventData/Data[@Name=\"RelativeTargetName\"]",
+		L"Event/EventData/Data[@Name=\"AccessMask\"]",
+	};
+	DWORD totalValuesToRender = sizeof(valuesToRender) / sizeof(PWSTR);
+	EVT_HANDLE renderContext = EvtCreateRenderContext(totalValuesToRender, valuesToRender, EvtRenderContextValues);
+	EVT_HANDLE event = NULL;
+	DWORD evtNextReturned = 0;
+	while (EvtNext(results, 1, &event, INFINITE, 0, &evtNextReturned)) {
+		PEVT_VARIANT values = NULL;
+		DWORD valuesSize = 0;
+		EvtRender(renderContext, event, EvtRenderEventValues, valuesSize, values, &valuesSize, NULL);
+		values = (PEVT_VARIANT) malloc(valuesSize);
+		EvtRender(renderContext, event, EvtRenderEventValues, valuesSize, values, &valuesSize, NULL);
+		UINT32 accessMask = values[4].UInt32Val;
+		if (!(accessMask & (WriteData_MASK | AppendData_MASK | DeleteChild_MASK | DELETE_MASK | READ_CONTROL_MASK))) {
+			free(values);
+			EvtClose(event);
+			continue;
+		}
+		ULONGLONG fileTimeLong = values[0].FileTimeVal;
+		FILETIME fileTime;
+		fileTime.dwHighDateTime = (DWORD) (fileTimeLong >> 32);
+		fileTime.dwLowDateTime = (DWORD) fileTimeLong;
+		FileTimeToLocalFileTime(&fileTime, &fileTime);
+		SYSTEMTIME systemTime;
+		FileTimeToSystemTime(&fileTime, &systemTime);
+		WCHAR access[256] = {'\0'};
+		if (accessMask & READ_CONTROL_MASK) wcscat(access, L"Read ");
+		if (accessMask & WriteData_MASK) wcscat(access, L"Write ");
+		if (accessMask & AppendData_MASK) wcscat(access, L"Append ");
+		if (accessMask & DeleteChild_MASK) wcscat(access, L"Delete ");
+		if (accessMask & DELETE_MASK) wcscat(access, L"Delete ");
+		access[wcslen(access) - 1] = '\0';
+		wprintf(
+			L"%02d-%02d-%02d %02d:%02d:%02d\t%s\t%s\\%s\t%s\t0x%08X\n",
+			systemTime.wYear, systemTime.wMonth, systemTime.wDay, systemTime.wHour, systemTime.wMinute, systemTime.wSecond,
+			values[1].StringVal,
+			values[2].StringVal, values[3].StringVal,
+			access,
+			accessMask
+		);
+		free(values);
+		EvtClose(event);
+	}
+	EvtClose(renderContext);
+	EvtClose(results);
+	return 0;
+}