Exception when parsing EVTX files

[op7ic]

Hi Team,

I found the following exception when parsing few EVTX files:

    panic: userdata_flatten_first_value - wrong number of keys
    goroutine 515 [running]:
    github.com/yarox24/EvtxHussar/eventmap.userdata_flatten_first_value(0xc004915650?, 0x9?)
        F:/GoLangBase/GitEvtxHussar/EvtxHussar/eventmap/attrib_extraction.go:60 +0x9a
    github.com/yarox24/EvtxHussar/eventmap.ExtractAttribs(0x514780?, {0xc0003a8e40, 0x1, 0x6?}, 0x0)
        F:/GoLangBase/GitEvtxHussar/EvtxHussar/eventmap/event_map.go:178 +0x61d
    github.com/yarox24/EvtxHussar/engine.(*Engine).ParseL2FieldsOrderedDict(0xc0002f2000, {0xc000335b90, 0xf}, 0xf?)
        F:/GoLangBase/GitEvtxHussar/EvtxHussar/engine/engine.go:381 +0x153
    github.com/yarox24/EvtxHussar/engine.RunL2WorkerFlat(0xc0000a7d20)
        F:/GoLangBase/GitEvtxHussar/EvtxHussar/engine/layer2.go:146 +0x3e7
    github.com/yarox24/EvtxHussar/engine.RunL2Worker(0xc0000a7d20, 0x2000000020?)
        F:/GoLangBase/GitEvtxHussar/EvtxHussar/engine/layer2.go:338 +0x154
    created by github.com/yarox24/EvtxHussar/engine.(*Layer2GlobalMemory).StartL2Workers
        F:/GoLangBase/GitEvtxHussar/EvtxHussar/engine/layer2.go:363 +0x36

I'm running latest version of EVTXHussar.

[yarox24]

Hi Yuri,

It should be partially fixed with this commit: 08d0df7 (Version 1.8)

Why partially fixed? It shouldn't longer crash, but still some messages are lost. To debug it further I would need more information about "crashing" file:

• Filename.evtx
• Channel
• Event ID
• OS version of Windows from which Filename.evtx was taken

so I can try to regenerate this on my own.