Issues using libevtx as a library

[gclen]

Hi,

I am able to compile (from the git repo) and use evtxtools as intended. However, I would like to use libevtx as a library to parse and convert evtx files in my own code. I'm attempting to use parts of evtxtools/evtxtools.c. However, when I try to compile (I have included all the appropriate dependency directories) I am getting many errors such as:

/home/user/Documents/libevtx/evtxtools/evtxtools_libcerror.h:45:23: fatal error: libcerror.h: No such file or directory

When I run a find command looking for "libcerror.h" it does not find anything. However, it appears that there is a libcerror_error.h file. If I modify the include a similar error pops up for a different file. I have downloaded all the dependencies using synclibs.sh. Do you have any suggestions? Thanks!

[joachimmetz]

Can you provide more information about the compilation steps you are following. Also see: https://github.com/libyal/libevtx/wiki/Building

[gclen]

I was able to download and compile using your build instructions. That is:

git clone https://github.com/libyal/libevtx.git
cd libevtx/
./synclibs.sh
./autogen.sh
./configure
make
sudo make install

I copied evtxtools/evtxtools.c into a file called src/main.cpp. I then ran the following command

g++ -g -std=c++11 -I/home/gclenden/Documents/libevtx/include -I/home/gclenden/Documents/libevtx/common -I/home/gclenden/Documents/libevtx/libcerror -I/home/gclenden/Documents/libevtx/libcdata -I/home/gclenden/Documents/libevtx/libcthreads -I/home/gclenden/Documents/libevtx/libclocale -I/home/gclenden/Documents/libevtx/libcnotify -I/home/gclenden/Documents/libevtx/libcsplit -I/home/gclenden/Documents/libevtx/libuna -I/home/gclenden/Documents/libevtx/libcfile -I/home/gclenden/Documents/libevtx/libcpath -I/home/gclenden/Documents/libevtx/libbfio -I/home/gclenden/Documents/libevtx/libfcache -I/home/gclenden/Documents/libevtx/libfdata -I/home/gclenden/Documents/libevtx/libfdatetime -I/home/gclenden/Documents/libevtx/libfguid -I/home/gclenden/Documents/libevtx/libfvalue -I/home/gclenden/Documents/libevtx/libfwevt -I/home/gclenden/Documents/libevtx/libfwnt -I/home/gclenden/Documents/libevtx/libexe -I/home/gclenden/Documents/libevtx/libregf -I/home/gclenden/Documents/libevtx/libwrc -I/home/gclenden/Documents/libevtx/libcdirectory -I/home/gclenden/Documents/libevtx/evtxtools -c -o build/main.o src/main.cpp

And got the following error:

In file included from src/main.cpp:36:0:
/home/gclenden/Documents/libevtx/evtxtools/evtxtools_libcerror.h:45:23: fatal error: libcerror.h: No such file or directory

As far as I can tell there is no libcerror.h in the libevtx git repo (even after all dependencies are downloaded). Do you have any suggestions?

[joachimmetz]

I copied evtxtools/evtxtools.c into a file called src/main.cpp. I then ran the following command

My first question is why do you copied this code?

The reason that you get the error is that you're not passing the correct pre-compiler definitions. Also see:
https://github.com/libyal/libevtx/blob/master/evtxtools/evtxtools_libcerror.h

You compilation configuration expects libcerror to be a stand-alone library. Setting up the proper build environment and setting is handled by .configure and make.