/src/libfwevt/libfwevt/libfwevt_event.c

Source (jump to first uncovered line)
/*
 * Event functions
 *
 * Copyright (C) 2011-2023, Joachim Metz <joachim.metz@gmail.com>
 *
 * Refer to AUTHORS for acknowledgements.
 *
 * This program is free software: you can redistribute it and/or modify
 * it under the terms of the GNU Lesser General Public License as published by
 * the Free Software Foundation, either version 3 of the License, or
 * (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU Lesser General Public License
 * along with this program.  If not, see <https://www.gnu.org/licenses/>.
 */

#include <common.h>
#include <byte_stream.h>
#include <memory.h>
#include <types.h>

#include "libfwevt_event.h"
#include "libfwevt_libcerror.h"
#include "libfwevt_libcnotify.h"
#include "libfwevt_libuna.h"
#include "libfwevt_types.h"

#include "fwevt_template.h"

/* Creates an event
 * Make sure the value event is referencing, is set to NULL
 * Returns 1 if successful or -1 on error
 */
int libfwevt_event_initialize(
     libfwevt_event_t **event,
     libcerror_error_t **error )
{
  libfwevt_internal_event_t *internal_event = NULL;
  static char *function                     = "libfwevt_event_initialize";

  if( event == NULL )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
     "%s: invalid event.",
     function );

    return( -1 );
  }
  if( *event != NULL )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
     LIBCERROR_RUNTIME_ERROR_VALUE_ALREADY_SET,
     "%s: invalid event value already set.",
     function );

    return( -1 );
  }
  internal_event = memory_allocate_structure(
                    libfwevt_internal_event_t );

  if( internal_event == NULL )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_MEMORY,
     LIBCERROR_MEMORY_ERROR_INSUFFICIENT,
     "%s: unable to create event.",
     function );

    goto on_error;
  }
  if( memory_set(
       internal_event,
       0,
       sizeof( libfwevt_internal_event_t ) ) == NULL )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_MEMORY,
     LIBCERROR_MEMORY_ERROR_SET_FAILED,
     "%s: unable to clear event.",
     function );

    goto on_error;
  }
  *event = (libfwevt_event_t *) internal_event;

  return( 1 );

on_error:
  if( internal_event != NULL )
  {
    memory_free(
     internal_event );
  }
  return( -1 );
}

/* Frees an event
 * Returns 1 if successful or -1 on error
 */
int libfwevt_event_free(
     libfwevt_event_t **event,
     libcerror_error_t **error )
{
  static char *function = "libfwevt_event_free";

  if( event == NULL )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
     "%s: invalid event.",
     function );

    return( -1 );
  }
  if( *event != NULL )
  {
    *event = NULL;
  }
  return( 1 );
}

/* Frees an event
 * Returns 1 if successful or -1 on error
 */
int libfwevt_internal_event_free(
     libfwevt_internal_event_t **internal_event,
     libcerror_error_t **error )
{
  static char *function = "libfwevt_internal_event_free";

  if( internal_event == NULL )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
     "%s: invalid event.",
     function );

    return( -1 );
  }
  if( *internal_event != NULL )
  {
    memory_free(
     *internal_event );

    *internal_event = NULL;
  }
  return( 1 );
}

/* Reads the event
 * Returns 1 if successful or -1 on error
 */
int libfwevt_event_read_data(
     libfwevt_event_t *event,
     const uint8_t *data,
     size_t data_size,
     size_t data_offset,
     libcerror_error_t **error )
{
  libfwevt_internal_event_t *internal_event = NULL;
  fwevt_template_event_t *wevt_event        = NULL;
  static char *function                     = "libfwevt_event_read_data";

#if defined( HAVE_DEBUG_OUTPUT )
  uint64_t value_64bit                      = 0;
  uint32_t value_32bit                      = 0;
  uint16_t value_16bit                      = 0;
#endif

  if( event == NULL )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
     "%s: invalid event.",
     function );

    return( -1 );
  }
  internal_event = (libfwevt_internal_event_t *) event;

  if( data == NULL )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
     "%s: invalid data.",
     function );

    return( -1 );
  }
  if( data_size > (size_t) SSIZE_MAX )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
     LIBCERROR_ARGUMENT_ERROR_VALUE_EXCEEDS_MAXIMUM,
     "%s: invalid data size value exceeds maximum.",
     function );

    return( -1 );
  }
  if( data_offset >= data_size )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
     LIBCERROR_ARGUMENT_ERROR_VALUE_OUT_OF_BOUNDS,
     "%s: invalid data offset value out of bounds.",
     function );

    return( -1 );
  }
  if( ( data_size < sizeof( fwevt_template_event_t ) )
   || ( data_offset > ( data_size - sizeof( fwevt_template_event_t ) ) ) )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
     LIBCERROR_ARGUMENT_ERROR_VALUE_TOO_SMALL,
     "%s: invalid data value too small.",
     function );

    return( -1 );
  }
  wevt_event = (fwevt_template_event_t *) &( data[ data_offset ] );

#if defined( HAVE_DEBUG_OUTPUT )
  if( libcnotify_verbose != 0 )
  {
    libcnotify_printf(
     "%s: event data:\n",
     function );
    libcnotify_print_data(
     (uint8_t *) wevt_event,
     sizeof( fwevt_template_event_t ),
     0 );
  }
#endif
  byte_stream_copy_to_uint16_little_endian(
   wevt_event->identifier,
   internal_event->identifier );

  byte_stream_copy_to_uint32_little_endian(
   wevt_event->message_identifier,
   internal_event->message_identifier );

  byte_stream_copy_to_uint32_little_endian(
   wevt_event->template_offset,
   internal_event->template_offset );

  byte_stream_copy_to_uint32_little_endian(
   wevt_event->opcode_offset,
   internal_event->opcode_offset );

  byte_stream_copy_to_uint32_little_endian(
   wevt_event->level_offset,
   internal_event->level_offset );

  byte_stream_copy_to_uint32_little_endian(
   wevt_event->task_offset,
   internal_event->task_offset );

  byte_stream_copy_to_uint32_little_endian(
   wevt_event->flags,
   internal_event->flags );

  internal_event->version = wevt_event->version;

#if defined( HAVE_DEBUG_OUTPUT )
  if( libcnotify_verbose != 0 )
  {
    libcnotify_printf(
     "%s: identifier\t\t\t\t\t: 0x%04" PRIx16 "\n",
     function,
     internal_event->identifier );

    libcnotify_printf(
     "%s: version\t\t\t\t\t: %" PRIu8 "\n",
     function,
     wevt_event->version );

    libcnotify_printf(
     "%s: channel\t\t\t\t\t: %" PRIu8 "\n",
     function,
     wevt_event->channel );

    libcnotify_printf(
     "%s: level\t\t\t\t\t\t: %" PRIu8 "\n",
     function,
     wevt_event->level );

    libcnotify_printf(
     "%s: opcode\t\t\t\t\t: %" PRIu8 "\n",
     function,
     wevt_event->opcode );

    byte_stream_copy_to_uint16_little_endian(
     wevt_event->task,
     value_16bit );
    libcnotify_printf(
     "%s: task\t\t\t\t\t\t: %" PRIu16 "\n",
     function,
     value_16bit );

    byte_stream_copy_to_uint64_little_endian(
     wevt_event->keywords,
     value_64bit );
    libcnotify_printf(
     "%s: keywords\t\t\t\t\t: 0x%08" PRIx64 "\n",
     function,
     value_64bit );

    libcnotify_printf(
     "%s: message identifier\t\t\t\t: 0x%08" PRIx32 "\n",
     function,
     internal_event->message_identifier );

    libcnotify_printf(
     "%s: template offset\t\t\t\t: 0x%08" PRIx32 "\n",
     function,
     internal_event->template_offset );

    libcnotify_printf(
     "%s: opcode offset\t\t\t\t\t: 0x%08" PRIx32 "\n",
     function,
     internal_event->opcode_offset );

    libcnotify_printf(
     "%s: level offset\t\t\t\t\t: 0x%08" PRIx32 "\n",
     function,
     internal_event->level_offset );

    libcnotify_printf(
     "%s: task offset\t\t\t\t\t: 0x%08" PRIx32 "\n",
     function,
     internal_event->task_offset );

    byte_stream_copy_to_uint32_little_endian(
     wevt_event->unknown3,
     value_32bit );
    libcnotify_printf(
     "%s: unknown3\t\t\t\t\t: 0x%08" PRIx32 "\n",
     function,
     value_32bit );

    byte_stream_copy_to_uint32_little_endian(
     wevt_event->unknown4,
     value_32bit );
    libcnotify_printf(
     "%s: unknown4\t\t\t\t\t: 0x%08" PRIx32 "\n",
     function,
     value_32bit );

    libcnotify_printf(
     "%s: flags\t\t\t\t\t\t: 0x%08" PRIx32 "\n",
     function,
     internal_event->flags );

    libcnotify_printf(
     "\n" );
  }
#endif /* defined( HAVE_DEBUG_OUTPUT ) */

  return( 1 );
}

/* Retrieves the identifier
 * Returns 1 if successful or -1 on error
 */
int libfwevt_event_get_identifier(
     libfwevt_event_t *event,
     uint32_t *identifier,
     libcerror_error_t **error )
{
  libfwevt_internal_event_t *internal_event = NULL;
  static char *function                     = "libfwevt_event_get_identifier";

  if( event == NULL )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
     "%s: invalid event.",
     function );

    return( -1 );
  }
  internal_event = (libfwevt_internal_event_t *) event;

  if( identifier == NULL )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
     "%s: invalid identifier.",
     function );

    return( -1 );
  }
  *identifier = (uint32_t) internal_event->identifier;

  return( 1 );
}

/* Retrieves the version
 * Returns 1 if successful, 0 if not available or -1 on error
 */
int libfwevt_event_get_version(
     libfwevt_event_t *event,
     uint8_t *version,
     libcerror_error_t **error )
{
  libfwevt_internal_event_t *internal_event = NULL;
  static char *function                     = "libfwevt_event_get_version";

  if( event == NULL )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
     "%s: invalid event.",
     function );

    return( -1 );
  }
  internal_event = (libfwevt_internal_event_t *) event;

  if( version == NULL )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
     "%s: invalid version.",
     function );

    return( -1 );
  }
  *version = internal_event->version;

  return( 1 );
}

/* Retrieves the message identifier
 * Returns 1 if successful or -1 on error
 */
int libfwevt_event_get_message_identifier(
     libfwevt_event_t *event,
     uint32_t *message_identifier,
     libcerror_error_t **error )
{
  libfwevt_internal_event_t *internal_event = NULL;
  static char *function                     = "libfwevt_event_get_message_identifier";

  if( event == NULL )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
     "%s: invalid event.",
     function );

    return( -1 );
  }
  internal_event = (libfwevt_internal_event_t *) event;

  if( message_identifier == NULL )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
     "%s: invalid message identifier.",
     function );

    return( -1 );
  }
  *message_identifier = internal_event->message_identifier;

  return( 1 );
}

/* Retrieves the template offset
 * Returns 1 if successful or -1 on error
 */
int libfwevt_event_get_template_offset(
     libfwevt_event_t *event,
     uint32_t *template_offset,
     libcerror_error_t **error )
{
  libfwevt_internal_event_t *internal_event = NULL;
  static char *function                     = "libfwevt_event_get_template_offset";

  if( event == NULL )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
     "%s: invalid event.",
     function );

    return( -1 );
  }
  internal_event = (libfwevt_internal_event_t *) event;

  if( template_offset == NULL )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
     "%s: invalid template offset.",
     function );

    return( -1 );
  }
  *template_offset = internal_event->template_offset;

  return( 1 );
}


Coverage Report

Created: 2023-06-07 06:53

Line	Count	Source (jump to first uncovered line)
1		/*
2		* Event functions
3		*
4		* Copyright (C) 2011-2023, Joachim Metz <joachim.metz@gmail.com>
5		*
6		* Refer to AUTHORS for acknowledgements.
7		*
8		* This program is free software: you can redistribute it and/or modify
9		* it under the terms of the GNU Lesser General Public License as published by
10		* the Free Software Foundation, either version 3 of the License, or
11		* (at your option) any later version.
12		*
13		* This program is distributed in the hope that it will be useful,
14		* but WITHOUT ANY WARRANTY; without even the implied warranty of
15		* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16		* GNU General Public License for more details.
17		*
18		* You should have received a copy of the GNU Lesser General Public License
19		* along with this program. If not, see <https://www.gnu.org/licenses/>.
20		*/
21
22		#include <common.h>
23		#include <byte_stream.h>
24		#include <memory.h>
25		#include <types.h>
26
27		#include "libfwevt_event.h"
28		#include "libfwevt_libcerror.h"
29		#include "libfwevt_libcnotify.h"
30		#include "libfwevt_libuna.h"
31		#include "libfwevt_types.h"
32
33		#include "fwevt_template.h"
34
35		/* Creates an event
36		* Make sure the value event is referencing, is set to NULL
37		* Returns 1 if successful or -1 on error
38		*/
39		int libfwevt_event_initialize(
40		libfwevt_event_t **event,
41		libcerror_error_t **error )
42	69.5k	{
43	69.5k	libfwevt_internal_event_t *internal_event = NULL;
44	69.5k	static char *function = "libfwevt_event_initialize";
45
46	69.5k	if( event == NULL )
47	0	{
48	0	libcerror_error_set(
49	0	error,
50	0	LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
51	0	LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
52	0	"%s: invalid event.",
53	0	function );
54
55	0	return( -1 );
56	0	}
57	69.5k	if( *event != NULL )
58	0	{
59	0	libcerror_error_set(
60	0	error,
61	0	LIBCERROR_ERROR_DOMAIN_RUNTIME,
62	0	LIBCERROR_RUNTIME_ERROR_VALUE_ALREADY_SET,
63	0	"%s: invalid event value already set.",
64	0	function );
65
66	0	return( -1 );
67	0	}
68	69.5k	internal_event = memory_allocate_structure(
69	69.5k	libfwevt_internal_event_t );
70
71	69.5k	if( internal_event == NULL )
72	0	{
73	0	libcerror_error_set(
74	0	error,
75	0	LIBCERROR_ERROR_DOMAIN_MEMORY,
76	0	LIBCERROR_MEMORY_ERROR_INSUFFICIENT,
77	0	"%s: unable to create event.",
78	0	function );
79
80	0	goto on_error;
81	0	}
82	69.5k	if( memory_set(
83	69.5k	internal_event,
84	69.5k	0,
85	69.5k	sizeof( libfwevt_internal_event_t ) ) == NULL )
86	0	{
87	0	libcerror_error_set(
88	0	error,
89	0	LIBCERROR_ERROR_DOMAIN_MEMORY,
90	0	LIBCERROR_MEMORY_ERROR_SET_FAILED,
91	0	"%s: unable to clear event.",
92	0	function );
93
94	0	goto on_error;
95	0	}
96	69.5k	event = (libfwevt_event_t ) internal_event;
97
98	69.5k	return( 1 );
99
100	0	on_error:
101	0	if( internal_event != NULL )
102	0	{
103	0	memory_free(
104	0	internal_event );
105	0	}
106	0	return( -1 );
107	69.5k	}
108
109		/* Frees an event
110		* Returns 1 if successful or -1 on error
111		*/
112		int libfwevt_event_free(
113		libfwevt_event_t **event,
114		libcerror_error_t **error )
115	0	{
116	0	static char *function = "libfwevt_event_free";
117
118	0	if( event == NULL )
119	0	{
120	0	libcerror_error_set(
121	0	error,
122	0	LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
123	0	LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
124	0	"%s: invalid event.",
125	0	function );
126
127	0	return( -1 );
128	0	}
129	0	if( *event != NULL )
130	0	{
131	0	*event = NULL;
132	0	}
133	0	return( 1 );
134	0	}
135
136		/* Frees an event
137		* Returns 1 if successful or -1 on error
138		*/
139		int libfwevt_internal_event_free(
140		libfwevt_internal_event_t **internal_event,
141		libcerror_error_t **error )
142	69.5k	{
143	69.5k	static char *function = "libfwevt_internal_event_free";
144
145	69.5k	if( internal_event == NULL )
146	0	{
147	0	libcerror_error_set(
148	0	error,
149	0	LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
150	0	LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
151	0	"%s: invalid event.",
152	0	function );
153
154	0	return( -1 );
155	0	}
156	69.5k	if( *internal_event != NULL )
157	69.5k	{
158	69.5k	memory_free(
159	69.5k	*internal_event );
160
161	69.5k	*internal_event = NULL;
162	69.5k	}
163	69.5k	return( 1 );
164	69.5k	}
165
166		/* Reads the event
167		* Returns 1 if successful or -1 on error
168		*/
169		int libfwevt_event_read_data(
170		libfwevt_event_t *event,
171		const uint8_t *data,
172		size_t data_size,
173		size_t data_offset,
174		libcerror_error_t **error )
175	69.5k	{
176	69.5k	libfwevt_internal_event_t *internal_event = NULL;
177	69.5k	fwevt_template_event_t *wevt_event = NULL;
178	69.5k	static char *function = "libfwevt_event_read_data";
179
180		#if defined( HAVE_DEBUG_OUTPUT )
181		uint64_t value_64bit = 0;
182		uint32_t value_32bit = 0;
183		uint16_t value_16bit = 0;
184		#endif
185
186	69.5k	if( event == NULL )
187	0	{
188	0	libcerror_error_set(
189	0	error,
190	0	LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
191	0	LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
192	0	"%s: invalid event.",
193	0	function );
194
195	0	return( -1 );
196	0	}
197	69.5k	internal_event = (libfwevt_internal_event_t *) event;
198
199	69.5k	if( data == NULL )
200	0	{
201	0	libcerror_error_set(
202	0	error,
203	0	LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
204	0	LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
205	0	"%s: invalid data.",
206	0	function );
207
208	0	return( -1 );
209	0	}
210	69.5k	if( data_size > (size_t) SSIZE_MAX )
211	0	{
212	0	libcerror_error_set(
213	0	error,
214	0	LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
215	0	LIBCERROR_ARGUMENT_ERROR_VALUE_EXCEEDS_MAXIMUM,
216	0	"%s: invalid data size value exceeds maximum.",
217	0	function );
218
219	0	return( -1 );
220	0	}
221	69.5k	if( data_offset >= data_size )
222	0	{
223	0	libcerror_error_set(
224	0	error,
225	0	LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
226	0	LIBCERROR_ARGUMENT_ERROR_VALUE_OUT_OF_BOUNDS,
227	0	"%s: invalid data offset value out of bounds.",
228	0	function );
229
230	0	return( -1 );
231	0	}
232	69.5k	if( ( data_size < sizeof( fwevt_template_event_t ) )
233	69.5k	\|\| ( data_offset > ( data_size - sizeof( fwevt_template_event_t ) ) ) )
234	0	{
235	0	libcerror_error_set(
236	0	error,
237	0	LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
238	0	LIBCERROR_ARGUMENT_ERROR_VALUE_TOO_SMALL,
239	0	"%s: invalid data value too small.",
240	0	function );
241
242	0	return( -1 );
243	0	}
244	69.5k	wevt_event = (fwevt_template_event_t *) &( data[ data_offset ] );
245
246		#if defined( HAVE_DEBUG_OUTPUT )
247		if( libcnotify_verbose != 0 )
248		{
249		libcnotify_printf(
250		"%s: event data:\n",
251		function );
252		libcnotify_print_data(
253		(uint8_t *) wevt_event,
254		sizeof( fwevt_template_event_t ),
255		0 );
256		}
257		#endif
258	69.5k	byte_stream_copy_to_uint16_little_endian(
259	69.5k	wevt_event->identifier,
260	69.5k	internal_event->identifier );
261
262	69.5k	byte_stream_copy_to_uint32_little_endian(
263	69.5k	wevt_event->message_identifier,
264	69.5k	internal_event->message_identifier );
265
266	69.5k	byte_stream_copy_to_uint32_little_endian(
267	69.5k	wevt_event->template_offset,
268	69.5k	internal_event->template_offset );
269
270	69.5k	byte_stream_copy_to_uint32_little_endian(
271	69.5k	wevt_event->opcode_offset,
272	69.5k	internal_event->opcode_offset );
273
274	69.5k	byte_stream_copy_to_uint32_little_endian(
275	69.5k	wevt_event->level_offset,
276	69.5k	internal_event->level_offset );
277
278	69.5k	byte_stream_copy_to_uint32_little_endian(
279	69.5k	wevt_event->task_offset,
280	69.5k	internal_event->task_offset );
281
282	69.5k	byte_stream_copy_to_uint32_little_endian(
283	69.5k	wevt_event->flags,
284	69.5k	internal_event->flags );
285
286	69.5k	internal_event->version = wevt_event->version;
287
288		#if defined( HAVE_DEBUG_OUTPUT )
289		if( libcnotify_verbose != 0 )
290		{
291		libcnotify_printf(
292		"%s: identifier\t\t\t\t\t: 0x%04" PRIx16 "\n",
293		function,
294		internal_event->identifier );
295
296		libcnotify_printf(
297		"%s: version\t\t\t\t\t: %" PRIu8 "\n",
298		function,
299		wevt_event->version );
300
301		libcnotify_printf(
302		"%s: channel\t\t\t\t\t: %" PRIu8 "\n",
303		function,
304		wevt_event->channel );
305
306		libcnotify_printf(
307		"%s: level\t\t\t\t\t\t: %" PRIu8 "\n",
308		function,
309		wevt_event->level );
310
311		libcnotify_printf(
312		"%s: opcode\t\t\t\t\t: %" PRIu8 "\n",
313		function,
314		wevt_event->opcode );
315
316		byte_stream_copy_to_uint16_little_endian(
317		wevt_event->task,
318		value_16bit );
319		libcnotify_printf(
320		"%s: task\t\t\t\t\t\t: %" PRIu16 "\n",
321		function,
322		value_16bit );
323
324		byte_stream_copy_to_uint64_little_endian(
325		wevt_event->keywords,
326		value_64bit );
327		libcnotify_printf(
328		"%s: keywords\t\t\t\t\t: 0x%08" PRIx64 "\n",
329		function,
330		value_64bit );
331
332		libcnotify_printf(
333		"%s: message identifier\t\t\t\t: 0x%08" PRIx32 "\n",
334		function,
335		internal_event->message_identifier );
336
337		libcnotify_printf(
338		"%s: template offset\t\t\t\t: 0x%08" PRIx32 "\n",
339		function,
340		internal_event->template_offset );
341
342		libcnotify_printf(
343		"%s: opcode offset\t\t\t\t\t: 0x%08" PRIx32 "\n",
344		function,
345		internal_event->opcode_offset );
346
347		libcnotify_printf(
348		"%s: level offset\t\t\t\t\t: 0x%08" PRIx32 "\n",
349		function,
350		internal_event->level_offset );
351
352		libcnotify_printf(
353		"%s: task offset\t\t\t\t\t: 0x%08" PRIx32 "\n",
354		function,
355		internal_event->task_offset );
356
357		byte_stream_copy_to_uint32_little_endian(
358		wevt_event->unknown3,
359		value_32bit );
360		libcnotify_printf(
361		"%s: unknown3\t\t\t\t\t: 0x%08" PRIx32 "\n",
362		function,
363		value_32bit );
364
365		byte_stream_copy_to_uint32_little_endian(
366		wevt_event->unknown4,
367		value_32bit );
368		libcnotify_printf(
369		"%s: unknown4\t\t\t\t\t: 0x%08" PRIx32 "\n",
370		function,
371		value_32bit );
372
373		libcnotify_printf(
374		"%s: flags\t\t\t\t\t\t: 0x%08" PRIx32 "\n",
375		function,
376		internal_event->flags );
377
378		libcnotify_printf(
379		"\n" );
380		}
381		#endif /* defined( HAVE_DEBUG_OUTPUT ) */
382
383	69.5k	return( 1 );
384	69.5k	}
385
386		/* Retrieves the identifier
387		* Returns 1 if successful or -1 on error
388		*/
389		int libfwevt_event_get_identifier(
390		libfwevt_event_t *event,
391		uint32_t *identifier,
392		libcerror_error_t **error )
393	0	{
394	0	libfwevt_internal_event_t *internal_event = NULL;
395	0	static char *function = "libfwevt_event_get_identifier";
396
397	0	if( event == NULL )
398	0	{
399	0	libcerror_error_set(
400	0	error,
401	0	LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
402	0	LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
403	0	"%s: invalid event.",
404	0	function );
405
406	0	return( -1 );
407	0	}
408	0	internal_event = (libfwevt_internal_event_t *) event;
409
410	0	if( identifier == NULL )
411	0	{
412	0	libcerror_error_set(
413	0	error,
414	0	LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
415	0	LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
416	0	"%s: invalid identifier.",
417	0	function );
418
419	0	return( -1 );
420	0	}
421	0	*identifier = (uint32_t) internal_event->identifier;
422
423	0	return( 1 );
424	0	}
425
426		/* Retrieves the version
427		* Returns 1 if successful, 0 if not available or -1 on error
428		*/
429		int libfwevt_event_get_version(
430		libfwevt_event_t *event,
431		uint8_t *version,
432		libcerror_error_t **error )
433	0	{
434	0	libfwevt_internal_event_t *internal_event = NULL;
435	0	static char *function = "libfwevt_event_get_version";
436
437	0	if( event == NULL )
438	0	{
439	0	libcerror_error_set(
440	0	error,
441	0	LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
442	0	LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
443	0	"%s: invalid event.",
444	0	function );
445
446	0	return( -1 );
447	0	}
448	0	internal_event = (libfwevt_internal_event_t *) event;
449
450	0	if( version == NULL )
451	0	{
452	0	libcerror_error_set(
453	0	error,
454	0	LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
455	0	LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
456	0	"%s: invalid version.",
457	0	function );
458
459	0	return( -1 );
460	0	}
461	0	*version = internal_event->version;
462
463	0	return( 1 );
464	0	}
465
466		/* Retrieves the message identifier
467		* Returns 1 if successful or -1 on error
468		*/
469		int libfwevt_event_get_message_identifier(
470		libfwevt_event_t *event,
471		uint32_t *message_identifier,
472		libcerror_error_t **error )
473	0	{
474	0	libfwevt_internal_event_t *internal_event = NULL;
475	0	static char *function = "libfwevt_event_get_message_identifier";
476
477	0	if( event == NULL )
478	0	{
479	0	libcerror_error_set(
480	0	error,
481	0	LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
482	0	LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
483	0	"%s: invalid event.",
484	0	function );
485
486	0	return( -1 );
487	0	}
488	0	internal_event = (libfwevt_internal_event_t *) event;
489
490	0	if( message_identifier == NULL )
491	0	{
492	0	libcerror_error_set(
493	0	error,
494	0	LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
495	0	LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
496	0	"%s: invalid message identifier.",
497	0	function );
498
499	0	return( -1 );
500	0	}
501	0	*message_identifier = internal_event->message_identifier;
502
503	0	return( 1 );
504	0	}
505
506		/* Retrieves the template offset
507		* Returns 1 if successful or -1 on error
508		*/
509		int libfwevt_event_get_template_offset(
510		libfwevt_event_t *event,
511		uint32_t *template_offset,
512		libcerror_error_t **error )
513	0	{
514	0	libfwevt_internal_event_t *internal_event = NULL;
515	0	static char *function = "libfwevt_event_get_template_offset";
516
517	0	if( event == NULL )
518	0	{
519	0	libcerror_error_set(
520	0	error,
521	0	LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
522	0	LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
523	0	"%s: invalid event.",
524	0	function );
525
526	0	return( -1 );
527	0	}
528	0	internal_event = (libfwevt_internal_event_t *) event;
529
530	0	if( template_offset == NULL )
531	0	{
532	0	libcerror_error_set(
533	0	error,
534	0	LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
535	0	LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
536	0	"%s: invalid template offset.",
537	0	function );
538
539	0	return( -1 );
540	0	}
541	0	*template_offset = internal_event->template_offset;
542
543	0	return( 1 );
544	0	}
545