eventlog

[djmunis@…]

Hi, I have a problem with eventlog.au3. when I use _eventlog_read() all components of array are ok except description. Sometimes the description do not show how in event viewer.
image of error
​http://img683.imageshack.us/img683/8637/errorob.png

The problem seem caused by _eventlog_read() ->> $aEvent[13]=EventLog_DecodeDesc($tEventLog) ->> Local $aStrings = EventLog_DecodeStrings($tEventLog) ->>

$sDesc = StringReplace($sDesc, "%" & $iI, $aStrings[$iI])

Func EventLog_DecodeStrings($tEventLog)

Local $pEventLog = DllStructGetPtr($tEventLog)
Local $iNumStrs = DllStructGetData($tEventLog, "NumStrings")
Local $iOffset = DllStructGetData($tEventLog, "StringOffset")
; The data offset is used to calculate buffer sizes.
Local $iDataOffset = DllStructGetData($tEventLog, "DataOffset")
Local $tBuffer = DllStructCreate("wchar Text& $iDataOffset - $iOffset &?", $pEventLog + $iOffset)

Local $aStrings[$iNumStrs + 1]
$aStrings[0] = $iNumStrs
For $iI = 1 To $iNumStrs

$aStrings[$iI] = DllStructGetData($tBuffer, "Text")
$iOffset += StringLen($aStrings[$iI]) + 1
$tBuffer = DllStructCreate("wchar Text& $iDataOffset - $iOffset &?", $pEventLog + $iOffset)

Next
Return $aStrings

EndFunc ;==>EventLog_DecodeStrings

Can you help me?

contact: djmunis@…
best regards

[djmunis@…]

the code of script and image of error

[mvg]

Hi, I have a problem with eventlog.au3
Can you help me?

Nope.
This section is for Bug-reports ... ONLY.
For user problems there is the Forum Section. -> ​http://www.autoitscript.com/forum

[djmunis]

How this is a bug of EventLog3.au3 that is part of autoit I thought that its a bug and i had post here.
Sorry,
Now I post on ​http://www.autoitscript.com/forum/topic/126175-eventlog-description

[mvg]

Seems someone forgot to adjust the offset counter to count wchar's instead of single byte chr's.

Func __EventLog_DecodeStrings($tEventLog)
	Local $pEventLog = DllStructGetPtr($tEventLog)
	Local $iNumStrs = DllStructGetData($tEventLog, "NumStrings")
	Local $iOffset = DllStructGetData($tEventLog, "StringOffset")
	; The data offset is used to calculate buffer sizes.
	Local $iDataOffset = DllStructGetData($tEventLog, "DataOffset")
	Local $tBuffer = DllStructCreate("wchar Text[" & $iDataOffset - $iOffset & "]", $pEventLog + $iOffset)

	Local $aStrings[$iNumStrs + 1]
	$aStrings[0] = $iNumStrs
	For $iI = 1 To $iNumStrs
		$aStrings[$iI] = DllStructGetData($tBuffer, "Text")
;~ 		$iOffset += StringLen($aStrings[$iI]) + 1 ;; org code
		$iOffset += StringLen($aStrings[$iI])*2 + 2 ;; suggested change.
		$tBuffer = DllStructCreate("wchar Text[" & $iDataOffset - $iOffset & "]", $pEventLog + $iOffset)
	Next
	Return $aStrings
EndFunc ;==>__EventLog_DecodeStrings

[mvg]

2 other suggestions/fixes ... (only tested on "(Language:0409 Keyboard:00000409 OS:WIN_XP/Service Pack 3 CPU:X86 OS:X86)")

Func __EventLog_DecodeUserName($tEventLog)
<snip>
	If IsArray($aAcctInfo) Then ...
;~  		Return $aAcctInfo[1] ;; org, contains computer name. need user type
		Return $aAcctInfo[0] ;; change: user type.
<snip>

Func __EventLog_DecodeComputer($tEventLog)
<snip>
	Local $tBuffer
;~ 	$iOffset += StringLen(__EventLog_DecodeSource($tBuffer)) + 1 ;; org, wrong count, + trigers a dllstruc error.
	$iOffset += StringLen(__EventLog_DecodeSource($tEventLog))*2 + 2 ;; changed, count + $tBuffer -> $tEventLog
<snip>

[djmunis]

Solved,
"$iOffset += StringLen($aStrings[$iI])*2 + 2" ;; suggested change works fine.

Other suggested changes i did not test.
A lot of thanks