libevtx-python - npm Package Compare versions

Comparing version 20240427 to 20240504

libfwevt/libfwevt_data_segment.c

+/*
+ * Data segment functions
+ *
+ * Copyright (C) 2011-2024, Joachim Metz <[e-mail]>
+ *
+ * Refer to AUTHORS for acknowledgements.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+#include <common.h>
+#include <memory.h>
+#include <types.h>
+
+#include "libfwevt_data_segment.h"
+#include "libfwevt_definitions.h"
+#include "libfwevt_libcerror.h"
+#include "libfwevt_libfdatetime.h"
+#include "libfwevt_libfguid.h"
+#include "libfwevt_libfwnt.h"
+
+/* Creates a data segment
+ * Make sure the value data_segment is referencing, is set to NULL
+ * Returns 1 if successful or -1 on error
+ */
+int libfwevt_data_segment_initialize(
+     libfwevt_data_segment_t **data_segment,
+     const uint8_t *data,
+     size_t data_size,
+     libcerror_error_t **error )
+{
+	static char *function = "libfwevt_data_segment_initialize";
+
+	if( data_segment == NULL )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
+		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
+		 "%s: invalid data segment.",
+		 function );
+
+		return( -1 );
+	}
+	if( *data_segment != NULL )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_RUNTIME,
+		 LIBCERROR_RUNTIME_ERROR_VALUE_ALREADY_SET,
+		 "%s: invalid data segment value already set.",
+		 function );
+
+		return( -1 );
+	}
+	if( data == NULL )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
+		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
+		 "%s: invalid data.",
+		 function );
+
+		return( -1 );
+	}
+	if( data_size > (size_t) MEMORY_MAXIMUM_ALLOCATION_SIZE )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
+		 LIBCERROR_ARGUMENT_ERROR_VALUE_OUT_OF_BOUNDS,
+		 "%s: invalid data size value out of bounds.",
+		 function );
+
+		return( -1 );
+	}
+	*data_segment = memory_allocate_structure(
+	                 libfwevt_data_segment_t );
+
+	if( *data_segment == NULL )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_MEMORY,
+		 LIBCERROR_MEMORY_ERROR_INSUFFICIENT,
+		 "%s: unable to create data segment.",
+		 function );
+
+		goto on_error;
+	}
+	if( memory_set(
+	     *data_segment,
+	     0,
+	     sizeof( libfwevt_data_segment_t ) ) == NULL )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_MEMORY,
+		 LIBCERROR_MEMORY_ERROR_SET_FAILED,
+		 "%s: unable to clear data segment.",
+		 function );
+
+		memory_free(
+		 *data_segment );
+
+		*data_segment = NULL;
+
+		return( -1 );
+	}
+	if( data_size > 0 )
+	{
+		( *data_segment)->data = (uint8_t *) memory_allocate(
+		                                      sizeof( uint8_t ) * data_size );
+
+		if( ( *data_segment)->data == NULL )
+		{
+			libcerror_error_set(
+			 error,
+			 LIBCERROR_ERROR_DOMAIN_MEMORY,
+			 LIBCERROR_MEMORY_ERROR_INSUFFICIENT,
+			 "%s: unable to create data.",
+			 function );
+
+			goto on_error;
+		}
+		( *data_segment)->data_size = data_size;
+
+		if( memory_copy(
+		     ( *data_segment)->data,
+		     data,
+		     data_size ) == NULL )
+		{
+			libcerror_error_set(
+			 error,
+			 LIBCERROR_ERROR_DOMAIN_MEMORY,
+			 LIBCERROR_MEMORY_ERROR_COPY_FAILED,
+			 "%s: unable to copy data.",
+			 function );
+
+			goto on_error;
+		}
+	}
+	return( 1 );
+
+on_error:
+	if( *data_segment != NULL )
+	{
+		if( ( *data_segment )->data != NULL )
+		{
+			memory_free(
+			 ( *data_segment )->data );
+		}
+		memory_free(
+		 *data_segment );
+
+		*data_segment = NULL;
+	}
+	return( -1 );
+}
+
+/* Frees a data segment
+ * Returns 1 if successful or -1 on error
+ */
+int libfwevt_data_segment_free(
+     libfwevt_data_segment_t **data_segment,
+     libcerror_error_t **error )
+{
+	static char *function = "libfwevt_data_segment_free";
+	int result            = 1;
+
+	if( data_segment == NULL )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
+		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
+		 "%s: invalid data segment.",
+		 function );
+
+		return( -1 );
+	}
+	if( *data_segment != NULL )
+	{
+		switch( ( *data_segment )->cached_value_type & 0x7f )
+		{
+			case LIBFWEVT_VALUE_TYPE_GUID:
+				if( libfguid_identifier_free(
+				     &( ( *data_segment )->guid ),
+				     error ) != 1 )
+				{
+					libcerror_error_set(
+					 error,
+					 LIBCERROR_ERROR_DOMAIN_RUNTIME,
+					 LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED,
+					 "%s: unable to free GUID.",
+					 function );
+
+					result = -1;
+				}
+				break;
+
+			case LIBFWEVT_VALUE_TYPE_FILETIME:
+				if( libfdatetime_filetime_free(
+				     &( ( *data_segment )->filetime ),
+				     error ) != 1 )
+				{
+					libcerror_error_set(
+					 error,
+					 LIBCERROR_ERROR_DOMAIN_RUNTIME,
+					 LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED,
+					 "%s: unable to free FILETIME.",
+					 function );
+
+					result = -1;
+				}
+				break;
+
+			case LIBFWEVT_VALUE_TYPE_SYSTEMTIME:
+				if( libfdatetime_systemtime_free(
+				     &( ( *data_segment )->systemtime ),
+				     error ) != 1 )
+				{
+					libcerror_error_set(
+					 error,
+					 LIBCERROR_ERROR_DOMAIN_RUNTIME,
+					 LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED,
+					 "%s: unable to free SYSTEMTIME.",
+					 function );
+
+					result = -1;
+				}
+				break;
+
+			case LIBFWEVT_VALUE_TYPE_NT_SECURITY_IDENTIFIER:
+				if( libfwnt_security_identifier_free(
+				     &( ( *data_segment )->security_identifier ),
+				     error ) != 1 )
+				{
+					libcerror_error_set(
+					 error,
+					 LIBCERROR_ERROR_DOMAIN_RUNTIME,
+					 LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED,
+					 "%s: unable to free NT security identifier.",
+					 function );
+
+					result = -1;
+				}
+				break;
+		}
+		if( ( *data_segment )->data != NULL )
+		{
+			memory_free(
+			 ( *data_segment )->data );
+		}
+		memory_free(
+		 *data_segment );
+
+		*data_segment = NULL;
+	}
+	return( result );
+}
+

libfwevt/libfwevt_data_segment.h

+/*
+ * Data segment functions
+ *
+ * Copyright (C) 2011-2024, Joachim Metz <[e-mail]>
+ *
+ * Refer to AUTHORS for acknowledgements.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+#if !defined( _LIBFWEVT_DATA_SEGMENT_H )
+#define _LIBFWEVT_DATA_SEGMENT_H
+
+#include <common.h>
+#include <types.h>
+
+#include "libfwevt_libcerror.h"
+#include "libfwevt_libfdatetime.h"
+#include "libfwevt_libfguid.h"
+#include "libfwevt_libfwnt.h"
+
+#if defined( __cplusplus )
+extern "C" {
+#endif
+
+typedef struct libfwevt_data_segment libfwevt_data_segment_t;
+
+struct libfwevt_data_segment
+{
+	/* The data
+	 */
+	uint8_t *data;
+
+	/* The data size
+	 */
+	size_t data_size;
+
+	/* The cached value type
+	 */
+	uint8_t cached_value_type;
+
+	/* The cached value
+	 */
+	union
+	{
+		/* Cached 64-bit value
+		 */
+		uint64_t value_64bit;
+
+		/* Cached GUID value
+		 */
+		libfguid_identifier_t *guid;
+
+		/* Cached FILETIME value
+		 */
+		libfdatetime_filetime_t *filetime;
+
+		/* Cached SYSTEMTIME value
+		 */
+		libfdatetime_systemtime_t *systemtime;
+
+		/* Cached NT security identifier value
+		 */
+		libfwnt_security_identifier_t *security_identifier;
+	};
+};
+
+int libfwevt_data_segment_initialize(
+     libfwevt_data_segment_t **data_segment,
+     const uint8_t *data,
+     size_t data_size,
+     libcerror_error_t **error );
+
+int libfwevt_data_segment_free(
+     libfwevt_data_segment_t **data_segment,
+     libcerror_error_t **error );
+
+#if defined( __cplusplus )
+}
+#endif
+
+#endif /* !defined( _LIBFWEVT_DATA_SEGMENT_H ) */
+

libfwevt/libfwevt_floating_point.c

+/*
+ * Floating point (IEEE 754) functions
+ *
+ * Copyright (C) 2011-2024, Joachim Metz <[e-mail]>
+ *
+ * Refer to AUTHORS for acknowledgements.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+#include <common.h>
+#include <byte_stream.h>
+#include <types.h>
+
+#include "libfwevt_floating_point.h"
+#include "libfwevt_libcerror.h"
+
+/* Deterimes the size of the string of a 32-bit floating point
+ * The string size includes the end of string character
+ * Returns 1 if successful or -1 on error
+ */
+int libfwevt_float32_get_string_size(
+     uint32_t value_32bit,
+     size_t *string_size,
+     libcerror_error_t **error )
+{
+	static char *function        = "libfwevt_float32_get_string_size";
+	uint8_t is_indeterminate     = 0;
+	uint8_t is_infinite          = 0;
+	uint8_t is_not_a_number      = 0;
+	uint8_t is_negative          = 0;
+	uint8_t number_of_characters = 0;
+
+	if( string_size == NULL )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
+		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
+		 "%s: invalid string size.",
+		 function );
+
+		return( -1 );
+	}
+	is_negative = (uint8_t) ( value_32bit >> 31 );
+
+	if( is_negative != 0 )
+	{
+		value_32bit &= ~( (uint32_t) 1 << 31 );
+	}
+	if( value_32bit == 0x7f800000UL )
+	{
+		is_infinite = 1;
+	}
+	else if( ( is_negative != 0 )
+	      && ( value_32bit == 0x7fc00000UL ) )
+	{
+		is_indeterminate = 1;
+	}
+	else if( ( value_32bit >= 0x7f800001UL )
+	      && ( value_32bit <= 0x7fffffffUL ) )
+	{
+		is_not_a_number = 1;
+	}
+	if( is_indeterminate != 0 )
+	{
+		/* "Ind" + end-of-string character */
+		number_of_characters = 4;
+	}
+	else if( is_infinite != 0 )
+	{
+		/* "Inf" + end-of-string character */
+		number_of_characters = 4;
+	}
+	else if( is_not_a_number != 0 )
+	{
+		/* "Nan" + end-of-string character */
+		number_of_characters = 4;
+	}
+	else
+	{
+		/* "[-]0.000000e[+-]000" + end-of-string character */
+		if( is_negative != 0 )
+		{
+			number_of_characters = 15;
+		}
+		else
+		{
+			number_of_characters = 14;
+		}
+	}
+	*string_size = number_of_characters;
+
+	return( 1 );
+}
+
+/* Copies a 32-bit floating point to an UTF-8 string
+ * The string size should include the end of string character
+ * Returns 1 if successful or -1 on error
+ */
+int libfwevt_float32_copy_to_utf8_string_with_index(
+     uint32_t value_32bit,
+     uint8_t *utf8_string,
+     size_t utf8_string_size,
+     size_t *utf8_string_index,
+     libcerror_error_t **error )
+{
+	byte_stream_float32_t value_float32;
+
+	static char *function         = "libfwevt_float32_copy_to_utf8_string_with_index";
+	size_t safe_utf8_string_index = 0;
+	uint32_t divider              = 0;
+	uint32_t value_fraction       = 0;
+	int16_t exponent10            = 0;
+	int16_t exponent2             = 0;
+	uint8_t digit_index           = 0;
+	uint8_t exponent_sign         = 0;
+	uint8_t is_indeterminate      = 0;
+	uint8_t is_infinite           = 0;
+	uint8_t is_not_a_number       = 0;
+	uint8_t is_negative           = 0;
+	uint8_t number_of_characters  = 0;
+	double exponent_value         = 0.0;
+	double value_float            = 0.0;
+
+	if( utf8_string == NULL )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
+		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
+		 "%s: invalid UTF-8 string.",
+		 function );
+
+		return( -1 );
+	}
+	if( utf8_string_size > (size_t) SSIZE_MAX )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
+		 LIBCERROR_ARGUMENT_ERROR_VALUE_EXCEEDS_MAXIMUM,
+		 "%s: invalid UTF-8 string size value exceeds maximum.",
+		 function );
+
+		return( -1 );
+	}
+	if( utf8_string_index == NULL )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
+		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
+		 "%s: invalid UTF-8 string index.",
+		 function );
+
+		return( -1 );
+	}
+	safe_utf8_string_index = *utf8_string_index;
+
+	is_negative = (uint8_t) ( value_32bit >> 31 );
+
+	if( is_negative != 0 )
+	{
+		value_32bit &= ~( (uint32_t) 1 << 31 );
+	}
+	if( value_32bit == 0x7f800000UL )
+	{
+		is_infinite = 1;
+	}
+	else if( ( is_negative != 0 )
+	      && ( value_32bit == 0x7fc00000UL ) )
+	{
+		is_indeterminate = 1;
+	}
+	else if( ( value_32bit >= 0x7f800001UL )
+	      && ( value_32bit <= 0x7fffffffUL ) )
+	{
+		is_not_a_number = 1;
+	}
+	else if( value_32bit != 0 )
+	{
+		value_float32.integer = value_32bit;
+		value_float           = (double) value_float32.floating_point;
+
+		exponent2 = (int16_t) ( value_32bit >> 23 );
+
+		if( exponent2 == 0 )
+		{
+			exponent2 = -126;
+		}
+		else
+		{
+			exponent2 -= 127;
+		}
+	}
+	if( is_indeterminate != 0 )
+	{
+		/* "Ind" + end-of-string character */
+		number_of_characters = 4;
+	}
+	else if( is_infinite != 0 )
+	{
+		/* "Inf" + end-of-string character */
+		number_of_characters = 4;
+	}
+	else if( is_not_a_number != 0 )
+	{
+		/* "Nan" + end-of-string character */
+		number_of_characters = 4;
+	}
+	else
+	{
+		/* "[-]0.000000e[+-]000" + end-of-string character */
+		if( is_negative != 0 )
+		{
+			number_of_characters = 15;
+		}
+		else
+		{
+			number_of_characters = 14;
+		}
+	}
+	if( ( number_of_characters > utf8_string_size )
+	 || ( safe_utf8_string_index > ( utf8_string_size - number_of_characters ) ) )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
+		 LIBCERROR_ARGUMENT_ERROR_VALUE_TOO_SMALL,
+		 "%s: invalid UTF-8 string size value too small.",
+		 function );
+
+		return( -1 );
+	}
+	if( is_indeterminate != 0 )
+	{
+		/* "Ind" + end-of-string character */
+		utf8_string[ safe_utf8_string_index++ ] = (uint8_t) 'I';
+		utf8_string[ safe_utf8_string_index++ ] = (uint8_t) 'n';
+		utf8_string[ safe_utf8_string_index++ ] = (uint8_t) 'd';
+	}
+	else if( is_infinite != 0 )
+	{
+		/* "Inf" + end-of-string character */
+		utf8_string[ safe_utf8_string_index++ ] = (uint8_t) 'I';
+		utf8_string[ safe_utf8_string_index++ ] = (uint8_t) 'n';
+		utf8_string[ safe_utf8_string_index++ ] = (uint8_t) 'f';
+	}
+	else if( is_not_a_number != 0 )
+	{
+		/* "Nan" + end-of-string character */
+		utf8_string[ safe_utf8_string_index++ ] = (uint8_t) 'N';
+		utf8_string[ safe_utf8_string_index++ ] = (uint8_t) 'a';
+		utf8_string[ safe_utf8_string_index++ ] = (uint8_t) 'N';
+	}
+	else
+	{
+		/* "[-]0.000000e[+-]000" + end-of-string character */
+		if( is_negative != 0 )
+		{
+			utf8_string[ safe_utf8_string_index++ ] = (uint8_t) '-';
+		}
+		if( exponent2 < 0 )
+		{
+			exponent_sign = (uint8_t) '-';
+			exponent2    *= -1;
+		}
+		else
+		{
+			exponent_sign = (uint8_t) '+';
+		}
+		exponent_value = 1.0;
+		exponent10     = 0;
+
+		while( exponent2 > 0 )
+		{
+			exponent_value *= 2;
+			exponent2--;
+
+			if( exponent_value >= 10.0 )
+			{
+				exponent_value /= 10.0;
+				exponent10++;
+
+				if( exponent_sign == (uint8_t) '-' )
+				{
+					value_float *= 10.0;
+				}
+				else
+				{
+					value_float /= 10.0;
+				}
+			}
+		}
+		if( value_float != 0.0 )
+		{
+			while( ( value_float < 1.0 )
+			    || ( value_float >= 10.0 ) )
+			{
+				exponent10++;
+
+				if( exponent_sign == (uint8_t) '-' )
+				{
+					value_float *= 10;
+				}
+				else
+				{
+					value_float /= 10;
+				}
+			}
+		}
+		for( digit_index = 0;
+		     digit_index < 7;
+		     digit_index++ )
+		{
+			value_fraction *= 10;
+			value_fraction += (uint8_t) value_float;
+
+			value_float -= (uint8_t) value_float;
+			value_float *= 10.0;
+		}
+		if( value_float >= 5.0 )
+		{
+			value_fraction += 1;
+		}
+		divider = 1000000;
+
+		for( digit_index = 0;
+		     digit_index < 7;
+		     digit_index++ )
+		{
+			utf8_string[ safe_utf8_string_index++ ] = (uint8_t) '0' + (uint8_t) ( value_fraction / divider );
+
+			if( digit_index == 0 )
+			{
+				utf8_string[ safe_utf8_string_index++ ] = (uint8_t) '.';
+			}
+			value_fraction %= divider;
+			divider        /= 10;
+		}
+		utf8_string[ safe_utf8_string_index++ ] = (uint8_t) 'e';
+		utf8_string[ safe_utf8_string_index++ ] = exponent_sign;
+
+		divider = 100;
+
+		for( digit_index = 0;
+		     digit_index < 3;
+		     digit_index++ )
+		{
+			utf8_string[ safe_utf8_string_index++ ] = (uint8_t) '0' + (uint8_t) ( exponent10 / divider );
+
+			exponent10 %= divider;
+			divider    /= 10;
+		}
+	}
+	utf8_string[ safe_utf8_string_index++ ] = 0;
+
+	*utf8_string_index = safe_utf8_string_index;
+
+	return( 1 );
+}
+
+/* Copies a 32-bit floating point to an UTF-16 string
+ * The string size should include the end of string character
+ * Returns 1 if successful or -1 on error
+ */
+int libfwevt_float32_copy_to_utf16_string_with_index(
+     uint32_t value_32bit,
+     uint16_t *utf16_string,
+     size_t utf16_string_size,
+     size_t *utf16_string_index,
+     libcerror_error_t **error )
+{
+	byte_stream_float32_t value_float32;
+
+	static char *function          = "libfwevt_float32_copy_to_utf16_string_with_index";
+	size_t safe_utf16_string_index = 0;
+	uint32_t divider               = 0;
+	uint32_t value_fraction        = 0;
+	uint16_t exponent_sign         = 0;
+	int16_t exponent10             = 0;
+	int16_t exponent2              = 0;
+	uint8_t digit_index            = 0;
+	uint8_t is_indeterminate       = 0;
+	uint8_t is_infinite            = 0;
+	uint8_t is_not_a_number        = 0;
+	uint8_t is_negative            = 0;
+	uint8_t number_of_characters   = 0;
+	double exponent_value          = 0.0;
+	double value_float             = 0.0;
+
+	if( utf16_string == NULL )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
+		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
+		 "%s: invalid UTF-16 string.",
+		 function );
+
+		return( -1 );
+	}
+	if( utf16_string_size > (size_t) SSIZE_MAX )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
+		 LIBCERROR_ARGUMENT_ERROR_VALUE_EXCEEDS_MAXIMUM,
+		 "%s: invalid UTF-16 string size value exceeds maximum.",
+		 function );
+
+		return( -1 );
+	}
+	if( utf16_string_index == NULL )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
+		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
+		 "%s: invalid UTF-16 string index.",
+		 function );
+
+		return( -1 );
+	}
+	safe_utf16_string_index = *utf16_string_index;
+
+	is_negative = (uint8_t) ( value_32bit >> 31 );
+
+	if( is_negative != 0 )
+	{
+		value_32bit &= ~( (uint32_t) 1 << 31 );
+	}
+	if( value_32bit == 0x7f800000UL )
+	{
+		is_infinite = 1;
+	}
+	else if( ( is_negative != 0 )
+	      && ( value_32bit == 0x7fc00000UL ) )
+	{
+		is_indeterminate = 1;
+	}
+	else if( ( value_32bit >= 0x7f800001UL )
+	      && ( value_32bit <= 0x7fffffffUL ) )
+	{
+		is_not_a_number = 1;
+	}
+	else if( value_32bit != 0 )
+	{
+		value_float32.integer = value_32bit;
+		value_float           = (double) value_float32.floating_point;
+
+		exponent2 = (int16_t) ( value_32bit >> 23 );
+
+		if( exponent2 == 0 )
+		{
+			exponent2 = -126;
+		}
+		else
+		{
+			exponent2 -= 127;
+		}
+	}
+	if( is_indeterminate != 0 )
+	{
+		/* "Ind" + end-of-string character */
+		number_of_characters = 4;
+	}
+	else if( is_infinite != 0 )
+	{
+		/* "Inf" + end-of-string character */
+		number_of_characters = 4;
+	}
+	else if( is_not_a_number != 0 )
+	{
+		/* "Nan" + end-of-string character */
+		number_of_characters = 4;
+	}
+	else
+	{
+		/* "[-]0.000000e[+-]000" + end-of-string character */
+		if( is_negative != 0 )
+		{
+			number_of_characters = 15;
+		}
+		else
+		{
+			number_of_characters = 14;
+		}
+	}
+	if( ( number_of_characters > utf16_string_size )
+	 || ( safe_utf16_string_index > ( utf16_string_size - number_of_characters ) ) )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
+		 LIBCERROR_ARGUMENT_ERROR_VALUE_TOO_SMALL,
+		 "%s: invalid UTF-16 string size value too small.",
+		 function );
+
+		return( -1 );
+	}
+	if( is_indeterminate != 0 )
+	{
+		/* "Ind" + end-of-string character */
+		utf16_string[ safe_utf16_string_index++ ] = (uint16_t) 'I';
+		utf16_string[ safe_utf16_string_index++ ] = (uint16_t) 'n';
+		utf16_string[ safe_utf16_string_index++ ] = (uint16_t) 'd';
+	}
+	else if( is_infinite != 0 )
+	{
+		/* "Inf" + end-of-string character */
+		utf16_string[ safe_utf16_string_index++ ] = (uint16_t) 'I';
+		utf16_string[ safe_utf16_string_index++ ] = (uint16_t) 'n';
+		utf16_string[ safe_utf16_string_index++ ] = (uint16_t) 'f';
+	}
+	else if( is_not_a_number != 0 )
+	{
+		/* "Nan" + end-of-string character */
+		utf16_string[ safe_utf16_string_index++ ] = (uint16_t) 'N';
+		utf16_string[ safe_utf16_string_index++ ] = (uint16_t) 'a';
+		utf16_string[ safe_utf16_string_index++ ] = (uint16_t) 'N';
+	}
+	else
+	{
+		/* "[-]0.000000e[+-]000" + end-of-string character */
+		if( is_negative != 0 )
+		{
+			utf16_string[ safe_utf16_string_index++ ] = (uint16_t) '-';
+		}
+		if( exponent2 < 0 )
+		{
+			exponent_sign = (uint16_t) '-';
+			exponent2    *= -1;
+		}
+		else
+		{
+			exponent_sign = (uint16_t) '+';
+		}
+		exponent_value = 1.0;
+		exponent10     = 0;
+
+		while( exponent2 > 0 )
+		{
+			exponent_value *= 2;
+			exponent2--;
+
+			if( exponent_value >= 10.0 )
+			{
+				exponent_value /= 10.0;
+				exponent10++;
+
+				if( exponent_sign == (uint16_t) '-' )
+				{
+					value_float *= 10.0;
+				}
+				else
+				{
+					value_float /= 10.0;
+				}
+			}
+		}
+		if( value_float != 0.0 )
+		{
+			while( ( value_float < 1.0 )
+			    || ( value_float >= 10.0 ) )
+			{
+				exponent10++;
+
+				if( exponent_sign == (uint16_t) '-' )
+				{
+					value_float *= 10;
+				}
+				else
+				{
+					value_float /= 10;
+				}
+			}
+		}
+		for( digit_index = 0;
+		     digit_index < 7;
+		     digit_index++ )
+		{
+			value_fraction *= 10;
+			value_fraction += (uint8_t) value_float;
+
+			value_float -= (uint8_t) value_float;
+			value_float *= 10.0;
+		}
+		if( value_float >= 5.0 )
+		{
+			value_fraction += 1;
+		}
+		divider = 1000000;
+
+		for( digit_index = 0;
+		     digit_index < 7;
+		     digit_index++ )
+		{
+			utf16_string[ safe_utf16_string_index++ ] = (uint16_t) '0' + (uint16_t) ( value_fraction / divider );
+
+			if( digit_index == 0 )
+			{
+				utf16_string[ safe_utf16_string_index++ ] = (uint16_t) '.';
+			}
+			value_fraction %= divider;
+			divider        /= 10;
+		}
+		utf16_string[ safe_utf16_string_index++ ] = (uint16_t) 'e';
+		utf16_string[ safe_utf16_string_index++ ] = exponent_sign;
+
+		divider = 100;
+
+		for( digit_index = 0;
+		     digit_index < 3;
+		     digit_index++ )
+		{
+			utf16_string[ safe_utf16_string_index++ ] = (uint16_t) '0' + (uint16_t) ( exponent10 / divider );
+
+			exponent10 %= divider;
+			divider    /= 10;
+		}
+	}
+	utf16_string[ safe_utf16_string_index++ ] = 0;
+
+	*utf16_string_index = safe_utf16_string_index;
+
+	return( 1 );
+}
+
+/* Deterimes the size of the string of a 64-bit floating point
+ * The string size includes the end of string character
+ * Returns 1 if successful or -1 on error
+ */
+int libfwevt_float64_get_string_size(
+     uint64_t value_64bit,
+     size_t *string_size,
+     libcerror_error_t **error )
+{
+	static char *function        = "libfwevt_float64_get_string_size";
+	uint8_t is_indeterminate     = 0;
+	uint8_t is_infinite          = 0;
+	uint8_t is_not_a_number      = 0;
+	uint8_t is_negative          = 0;
+	uint8_t number_of_characters = 0;
+
+	if( string_size == NULL )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
+		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
+		 "%s: invalid string size.",
+		 function );
+
+		return( -1 );
+	}
+	is_negative = (uint8_t) ( value_64bit >> 63 );
+
+	if( is_negative != 0 )
+	{
+		value_64bit &= ~( (uint64_t) 1 << 63 );
+	}
+#if defined( __BORLANDC__ ) && ( __BORLANDC__ < 0x0560 )
+	if( value_64bit == 0x7ff0000000000000UL )
+#else
+	if( value_64bit == 0x7ff0000000000000ULL )
+#endif
+	{
+		is_infinite = 1;
+	}
+#if defined( __BORLANDC__ ) && ( __BORLANDC__ < 0x0560 )
+	else if( ( is_negative != 0 )
+	      && ( value_64bit == 0x7ff8000000000000UL ) )
+#else
+	else if( ( is_negative != 0 )
+	      && ( value_64bit == 0x7ff8000000000000ULL ) )
+#endif
+	{
+		is_indeterminate = 1;
+	}
+#if defined( __BORLANDC__ ) && ( __BORLANDC__ < 0x0560 )
+	else if( ( value_64bit >= 0x7ff0000000000001UL )
+	      && ( value_64bit <= 0x7fffffffffffffffUL ) )
+#else
+	else if( ( value_64bit >= 0x7ff0000000000001ULL )
+	      && ( value_64bit <= 0x7fffffffffffffffULL ) )
+#endif
+	{
+		is_not_a_number = 1;
+	}
+	if( is_indeterminate != 0 )
+	{
+		/* "Ind" + end-of-string character */
+		number_of_characters = 4;
+	}
+	else if( is_infinite != 0 )
+	{
+		/* "Inf" + end-of-string character */
+		number_of_characters = 4;
+	}
+	else if( is_not_a_number != 0 )
+	{
+		/* "Nan" + end-of-string character */
+		number_of_characters = 4;
+	}
+	else
+	{
+		/* "[-]0.000000e[+-]000" + end-of-string character */
+		if( is_negative != 0 )
+		{
+			number_of_characters = 15;
+		}
+		else
+		{
+			number_of_characters = 14;
+		}
+	}
+	*string_size = number_of_characters;
+
+	return( 1 );
+}
+
+/* Copies a 64-bit floating point to an UTF-8 string
+ * The string size should include the end of string character
+ * Returns 1 if successful or -1 on error
+ */
+int libfwevt_float64_copy_to_utf8_string_with_index(
+     uint64_t value_64bit,
+     uint8_t *utf8_string,
+     size_t utf8_string_size,
+     size_t *utf8_string_index,
+     libcerror_error_t **error )
+{
+	byte_stream_float64_t value_float64;
+
+	static char *function         = "libfwevt_float64_copy_to_utf8_string_with_index";
+	size_t safe_utf8_string_index = 0;
+	uint64_t divider              = 0;
+	uint64_t value_fraction       = 0;
+	int16_t exponent10            = 0;
+	int16_t exponent2             = 0;
+	uint8_t digit_index           = 0;
+	uint8_t exponent_sign         = 0;
+	uint8_t is_indeterminate      = 0;
+	uint8_t is_infinite           = 0;
+	uint8_t is_not_a_number       = 0;
+	uint8_t is_negative           = 0;
+	uint8_t number_of_characters  = 0;
+	double exponent_value         = 0.0;
+	double value_float            = 0.0;
+
+	if( utf8_string == NULL )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
+		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
+		 "%s: invalid UTF-8 string.",
+		 function );
+
+		return( -1 );
+	}
+	if( utf8_string_size > (size_t) SSIZE_MAX )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
+		 LIBCERROR_ARGUMENT_ERROR_VALUE_EXCEEDS_MAXIMUM,
+		 "%s: invalid UTF-8 string size value exceeds maximum.",
+		 function );
+
+		return( -1 );
+	}
+	if( utf8_string_index == NULL )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
+		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
+		 "%s: invalid UTF-8 string index.",
+		 function );
+
+		return( -1 );
+	}
+	safe_utf8_string_index = *utf8_string_index;
+
+	is_negative = (uint8_t) ( value_64bit >> 63 );
+
+	if( is_negative != 0 )
+	{
+		value_64bit &= ~( (uint64_t) 1 << 63 );
+	}
+#if defined( __BORLANDC__ ) && ( __BORLANDC__ < 0x0560 )
+	if( value_64bit == 0x7ff0000000000000UL )
+#else
+	if( value_64bit == 0x7ff0000000000000ULL )
+#endif
+	{
+		is_infinite = 1;
+	}
+#if defined( __BORLANDC__ ) && ( __BORLANDC__ < 0x0560 )
+	else if( ( is_negative != 0 )
+	      && ( value_64bit == 0x7ff8000000000000UL ) )
+#else
+	else if( ( is_negative != 0 )
+	      && ( value_64bit == 0x7ff8000000000000ULL ) )
+#endif
+	{
+		is_indeterminate = 1;
+	}
+#if defined( __BORLANDC__ ) && ( __BORLANDC__ < 0x0560 )
+	else if( ( value_64bit >= 0x7ff0000000000001UL )
+	      && ( value_64bit <= 0x7fffffffffffffffUL ) )
+#else
+	else if( ( value_64bit >= 0x7ff0000000000001ULL )
+	      && ( value_64bit <= 0x7fffffffffffffffULL ) )
+#endif
+	{
+		is_not_a_number = 1;
+	}
+	else if( value_64bit != 0 )
+	{
+		value_float64.integer = value_64bit;
+		value_float           = (double) value_float64.floating_point;
+
+		exponent2 = (int16_t) ( value_64bit >> 52 );
+
+		if( exponent2 == 0 )
+		{
+			exponent2 = -1023;
+		}
+		else
+		{
+			exponent2 -= 1023;
+		}
+	}
+	if( is_indeterminate != 0 )
+	{
+		/* "Ind" + end-of-string character */
+		number_of_characters = 4;
+	}
+	else if( is_infinite != 0 )
+	{
+		/* "Inf" + end-of-string character */
+		number_of_characters = 4;
+	}
+	else if( is_not_a_number != 0 )
+	{
+		/* "Nan" + end-of-string character */
+		number_of_characters = 4;
+	}
+	else
+	{
+		/* "[-]0.000000e[+-]000" + end-of-string character */
+		if( is_negative != 0 )
+		{
+			number_of_characters = 15;
+		}
+		else
+		{
+			number_of_characters = 14;
+		}
+	}
+	if( ( number_of_characters > utf8_string_size )
+	 || ( safe_utf8_string_index > ( utf8_string_size - number_of_characters ) ) )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
+		 LIBCERROR_ARGUMENT_ERROR_VALUE_TOO_SMALL,
+		 "%s: invalid UTF-8 string size value too small.",
+		 function );
+
+		return( -1 );
+	}
+	if( is_indeterminate != 0 )
+	{
+		/* "Ind" + end-of-string character */
+		utf8_string[ safe_utf8_string_index++ ] = (uint8_t) 'I';
+		utf8_string[ safe_utf8_string_index++ ] = (uint8_t) 'n';
+		utf8_string[ safe_utf8_string_index++ ] = (uint8_t) 'd';
+	}
+	else if( is_infinite != 0 )
+	{
+		/* "Inf" + end-of-string character */
+		utf8_string[ safe_utf8_string_index++ ] = (uint8_t) 'I';
+		utf8_string[ safe_utf8_string_index++ ] = (uint8_t) 'n';
+		utf8_string[ safe_utf8_string_index++ ] = (uint8_t) 'f';
+	}
+	else if( is_not_a_number != 0 )
+	{
+		/* "Nan" + end-of-string character */
+		utf8_string[ safe_utf8_string_index++ ] = (uint8_t) 'N';
+		utf8_string[ safe_utf8_string_index++ ] = (uint8_t) 'a';
+		utf8_string[ safe_utf8_string_index++ ] = (uint8_t) 'N';
+	}
+	else
+	{
+		/* "[-]0.000000e[+-]000" + end-of-string character */
+		if( is_negative != 0 )
+		{
+			utf8_string[ safe_utf8_string_index++ ] = (uint8_t) '-';
+		}
+		if( exponent2 < 0 )
+		{
+			exponent_sign = (uint8_t) '-';
+			exponent2    *= -1;
+		}
+		else
+		{
+			exponent_sign = (uint8_t) '+';
+		}
+		exponent_value = 1.0;
+		exponent10     = 0;
+
+		while( exponent2 > 0 )
+		{
+			exponent_value *= 2;
+			exponent2--;
+
+			if( exponent_value >= 10.0 )
+			{
+				exponent_value /= 10.0;
+				exponent10++;
+
+				if( exponent_sign == (uint8_t) '-' )
+				{
+					value_float *= 10.0;
+				}
+				else
+				{
+					value_float /= 10.0;
+				}
+			}
+		}
+		if( value_float != 0.0 )
+		{
+			while( ( value_float < 1.0 )
+			    || ( value_float >= 10.0 ) )
+			{
+				exponent10++;
+
+				if( exponent_sign == (uint8_t) '-' )
+				{
+					value_float *= 10;
+				}
+				else
+				{
+					value_float /= 10;
+				}
+			}
+		}
+		for( digit_index = 0;
+		     digit_index < 7;
+		     digit_index++ )
+		{
+			value_fraction *= 10;
+			value_fraction += (uint8_t) value_float;
+
+			value_float -= (uint8_t) value_float;
+			value_float *= 10.0;
+		}
+		if( value_float >= 5.0 )
+		{
+			value_fraction += 1;
+		}
+		divider = 1000000;
+
+		for( digit_index = 0;
+		     digit_index < 7;
+		     digit_index++ )
+		{
+			utf8_string[ safe_utf8_string_index++ ] = (uint8_t) '0' + (uint8_t) ( value_fraction / divider );
+
+			if( digit_index == 0 )
+			{
+				utf8_string[ safe_utf8_string_index++ ] = (uint8_t) '.';
+			}
+			value_fraction %= divider;
+			divider        /= 10;
+		}
+		utf8_string[ safe_utf8_string_index++ ] = (uint8_t) 'e';
+		utf8_string[ safe_utf8_string_index++ ] = exponent_sign;
+
+		divider = 100;
+
+		for( digit_index = 0;
+		     digit_index < 3;
+		     digit_index++ )
+		{
+			utf8_string[ safe_utf8_string_index++ ] = (uint8_t) '0' + (uint8_t) ( exponent10 / divider );
+
+			exponent10 %= divider;
+			divider    /= 10;
+		}
+	}
+	utf8_string[ safe_utf8_string_index++ ] = 0;
+
+	*utf8_string_index = safe_utf8_string_index;
+
+	return( 1 );
+}
+
+/* Copies a 64-bit floating point to an UTF-16 string
+ * The string size should include the end of string character
+ * Returns 1 if successful or -1 on error
+ */
+int libfwevt_float64_copy_to_utf16_string_with_index(
+     uint64_t value_64bit,
+     uint16_t *utf16_string,
+     size_t utf16_string_size,
+     size_t *utf16_string_index,
+     libcerror_error_t **error )
+{
+	byte_stream_float64_t value_float64;
+
+	static char *function          = "libfwevt_float64_copy_to_utf16_string_with_index";
+	size_t safe_utf16_string_index = 0;
+	uint64_t divider               = 0;
+	uint64_t value_fraction        = 0;
+	uint16_t exponent_sign         = 0;
+	int16_t exponent10             = 0;
+	int16_t exponent2              = 0;
+	uint8_t digit_index            = 0;
+	uint8_t is_indeterminate       = 0;
+	uint8_t is_infinite            = 0;
+	uint8_t is_not_a_number        = 0;
+	uint8_t is_negative            = 0;
+	uint8_t number_of_characters   = 0;
+	double exponent_value          = 0.0;
+	double value_float             = 0.0;
+
+	if( utf16_string == NULL )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
+		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
+		 "%s: invalid UTF-16 string.",
+		 function );
+
+		return( -1 );
+	}
+	if( utf16_string_size > (size_t) SSIZE_MAX )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
+		 LIBCERROR_ARGUMENT_ERROR_VALUE_EXCEEDS_MAXIMUM,
+		 "%s: invalid UTF-16 string size value exceeds maximum.",
+		 function );
+
+		return( -1 );
+	}
+	if( utf16_string_index == NULL )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
+		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
+		 "%s: invalid UTF-16 string index.",
+		 function );
+
+		return( -1 );
+	}
+	safe_utf16_string_index = *utf16_string_index;
+
+	is_negative = (uint8_t) ( value_64bit >> 63 );
+
+	if( is_negative != 0 )
+	{
+		value_64bit &= ~( (uint64_t) 1 << 63 );
+	}
+#if defined( __BORLANDC__ ) && ( __BORLANDC__ < 0x0560 )
+	if( value_64bit == 0x7ff0000000000000UL )
+#else
+	if( value_64bit == 0x7ff0000000000000ULL )
+#endif
+	{
+		is_infinite = 1;
+	}
+#if defined( __BORLANDC__ ) && ( __BORLANDC__ < 0x0560 )
+	else if( ( is_negative != 0 )
+	      && ( value_64bit == 0x7ff8000000000000UL ) )
+#else
+	else if( ( is_negative != 0 )
+	      && ( value_64bit == 0x7ff8000000000000ULL ) )
+#endif
+	{
+		is_indeterminate = 1;
+	}
+#if defined( __BORLANDC__ ) && ( __BORLANDC__ < 0x0560 )
+	else if( ( value_64bit >= 0x7ff0000000000001UL )
+	      && ( value_64bit <= 0x7fffffffffffffffUL ) )
+#else
+	else if( ( value_64bit >= 0x7ff0000000000001ULL )
+	      && ( value_64bit <= 0x7fffffffffffffffULL ) )
+#endif
+	{
+		is_not_a_number = 1;
+	}
+	else if( value_64bit != 0 )
+	{
+		value_float64.integer = value_64bit;
+		value_float           = (double) value_float64.floating_point;
+
+		exponent2 = (int16_t) ( value_64bit >> 52 );
+
+		if( exponent2 == 0 )
+		{
+			exponent2 = -1023;
+		}
+		else
+		{
+			exponent2 -= 1023;
+		}
+	}
+	if( is_indeterminate != 0 )
+	{
+		/* "Ind" + end-of-string character */
+		number_of_characters = 4;
+	}
+	else if( is_infinite != 0 )
+	{
+		/* "Inf" + end-of-string character */
+		number_of_characters = 4;
+	}
+	else if( is_not_a_number != 0 )
+	{
+		/* "Nan" + end-of-string character */
+		number_of_characters = 4;
+	}
+	else
+	{
+		/* "[-]0.000000e[+-]000" + end-of-string character */
+		if( is_negative != 0 )
+		{
+			number_of_characters = 15;
+		}
+		else
+		{
+			number_of_characters = 14;
+		}
+	}
+	if( ( number_of_characters > utf16_string_size )
+	 || ( safe_utf16_string_index > ( utf16_string_size - number_of_characters ) ) )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
+		 LIBCERROR_ARGUMENT_ERROR_VALUE_TOO_SMALL,
+		 "%s: invalid UTF-16 string size value too small.",
+		 function );
+
+		return( -1 );
+	}
+	if( is_indeterminate != 0 )
+	{
+		/* "Ind" + end-of-string character */
+		utf16_string[ safe_utf16_string_index++ ] = (uint16_t) 'I';
+		utf16_string[ safe_utf16_string_index++ ] = (uint16_t) 'n';
+		utf16_string[ safe_utf16_string_index++ ] = (uint16_t) 'd';
+	}
+	else if( is_infinite != 0 )
+	{
+		/* "Inf" + end-of-string character */
+		utf16_string[ safe_utf16_string_index++ ] = (uint16_t) 'I';
+		utf16_string[ safe_utf16_string_index++ ] = (uint16_t) 'n';
+		utf16_string[ safe_utf16_string_index++ ] = (uint16_t) 'f';
+	}
+	else if( is_not_a_number != 0 )
+	{
+		/* "Nan" + end-of-string character */
+		utf16_string[ safe_utf16_string_index++ ] = (uint16_t) 'N';
+		utf16_string[ safe_utf16_string_index++ ] = (uint16_t) 'a';
+		utf16_string[ safe_utf16_string_index++ ] = (uint16_t) 'N';
+	}
+	else
+	{
+		/* "[-]0.000000e[+-]000" + end-of-string character */
+		if( is_negative != 0 )
+		{
+			utf16_string[ safe_utf16_string_index++ ] = (uint16_t) '-';
+		}
+		if( exponent2 < 0 )
+		{
+			exponent_sign = (uint16_t) '-';
+			exponent2    *= -1;
+		}
+		else
+		{
+			exponent_sign = (uint16_t) '+';
+		}
+		exponent_value = 1.0;
+		exponent10     = 0;
+
+		while( exponent2 > 0 )
+		{
+			exponent_value *= 2;
+			exponent2--;
+
+			if( exponent_value >= 10.0 )
+			{
+				exponent_value /= 10.0;
+				exponent10++;
+
+				if( exponent_sign == (uint16_t) '-' )
+				{
+					value_float *= 10.0;
+				}
+				else
+				{
+					value_float /= 10.0;
+				}
+			}
+		}
+		if( value_float != 0.0 )
+		{
+			while( ( value_float < 1.0 )
+			    || ( value_float >= 10.0 ) )
+			{
+				exponent10++;
+
+				if( exponent_sign == (uint16_t) '-' )
+				{
+					value_float *= 10;
+				}
+				else
+				{
+					value_float /= 10;
+				}
+			}
+		}
+		for( digit_index = 0;
+		     digit_index < 7;
+		     digit_index++ )
+		{
+			value_fraction *= 10;
+			value_fraction += (uint8_t) value_float;
+
+			value_float -= (uint8_t) value_float;
+			value_float *= 10.0;
+		}
+		if( value_float >= 5.0 )
+		{
+			value_fraction += 1;
+		}
+		divider = 1000000;
+
+		for( digit_index = 0;
+		     digit_index < 7;
+		     digit_index++ )
+		{
+			utf16_string[ safe_utf16_string_index++ ] = (uint16_t) '0' + (uint16_t) ( value_fraction / divider );
+
+			if( digit_index == 0 )
+			{
+				utf16_string[ safe_utf16_string_index++ ] = (uint16_t) '.';
+			}
+			value_fraction %= divider;
+			divider        /= 10;
+		}
+		utf16_string[ safe_utf16_string_index++ ] = (uint16_t) 'e';
+		utf16_string[ safe_utf16_string_index++ ] = exponent_sign;
+
+		divider = 100;
+
+		for( digit_index = 0;
+		     digit_index < 3;
+		     digit_index++ )
+		{
+			utf16_string[ safe_utf16_string_index++ ] = (uint16_t) '0' + (uint16_t) ( exponent10 / divider );
+
+			exponent10 %= divider;
+			divider    /= 10;
+		}
+	}
+	utf16_string[ safe_utf16_string_index++ ] = 0;
+
+	*utf16_string_index = safe_utf16_string_index;
+
+	return( 1 );
+}
+

libfwevt/libfwevt_floating_point.h

+/*
+ * Floating point (IEEE 754) functions
+ *
+ * Copyright (C) 2011-2024, Joachim Metz <[e-mail]>
+ *
+ * Refer to AUTHORS for acknowledgements.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+#if !defined( _LIBFWEVT_FLOATING_POINT_H )
+#define _LIBFWEVT_FLOATING_POINT_H
+
+#include <common.h>
+#include <types.h>
+
+#include "libfwevt_libcerror.h"
+
+#if defined( __cplusplus )
+extern "C" {
+#endif
+
+int libfwevt_float32_get_string_size(
+     uint32_t value_32bit,
+     size_t *string_size,
+     libcerror_error_t **error );
+
+int libfwevt_float32_copy_to_utf8_string_with_index(
+     uint32_t value_32bit,
+     uint8_t *utf8_string,
+     size_t utf8_string_size,
+     size_t *utf8_string_index,
+     libcerror_error_t **error );
+
+int libfwevt_float32_copy_to_utf16_string_with_index(
+     uint32_t value_32bit,
+     uint16_t *utf16_string,
+     size_t utf16_string_size,
+     size_t *utf16_string_index,
+     libcerror_error_t **error );
+
+int libfwevt_float64_get_string_size(
+     uint64_t value_64bit,
+     size_t *string_size,
+     libcerror_error_t **error );
+
+int libfwevt_float64_copy_to_utf8_string_with_index(
+     uint64_t value_64bit,
+     uint8_t *utf8_string,
+     size_t utf8_string_size,
+     size_t *utf8_string_index,
+     libcerror_error_t **error );
+
+int libfwevt_float64_copy_to_utf16_string_with_index(
+     uint64_t value_64bit,
+     uint16_t *utf16_string,
+     size_t utf16_string_size,
+     size_t *utf16_string_index,
+     libcerror_error_t **error );
+
+#if defined( __cplusplus )
+}
+#endif
+
+#endif /* !defined( _LIBFWEVT_FLOATING_POINT_H ) */
+

libfwevt/libfwevt_integer.c

+/*
+ * Integer functions
+ *
+ * Copyright (C) 2011-2024, Joachim Metz <[e-mail]>
+ *
+ * Refer to AUTHORS for acknowledgements.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+#include <common.h>
+#include <types.h>
+
+#include "libfwevt_integer.h"
+#include "libfwevt_libcerror.h"
+
+/* Copies an integer from an UTF-16 stream
+ * Returns 1 if successful or -1 on error
+ */
+int libfwevt_integer_copy_from_utf16_stream(
+     uint64_t *integer_value,
+     const uint8_t *utf16_stream,
+     size_t utf16_stream_size,
+     libcerror_error_t **error )
+{
+	static char *function       = "libfwevt_integer_copy_from_utf16_stream";
+	size_t utf16_stream_offset  = 0;
+	uint64_t safe_integer_value = 0;
+	uint8_t digit               = 0;
+
+	if( integer_value == NULL )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
+		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
+		 "%s: invalid integer value.",
+		 function );
+
+		return( -1 );
+	}
+	if( utf16_stream == NULL )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
+		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
+		 "%s: invalid UTF-16 stream.",
+		 function );
+
+		return( -1 );
+	}
+	if( ( utf16_stream_size < 2 )
+	 || ( utf16_stream_size > SSIZE_MAX )
+	 || ( ( utf16_stream_size % 2 ) != 0 ) )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
+		 LIBCERROR_ARGUMENT_ERROR_VALUE_OUT_OF_BOUNDS,
+		 "%s: UTF-16 stream size value out of bounds.",
+		 function );
+
+		return( -1 );
+	}
+	for( utf16_stream_offset = 0;
+	     utf16_stream_offset < utf16_stream_size;
+	     utf16_stream_offset += 2 )
+	{
+		if( utf16_stream_offset >= 42 )
+		{
+			libcerror_error_set(
+			 error,
+			 LIBCERROR_ERROR_DOMAIN_RUNTIME,
+			 LIBCERROR_RUNTIME_ERROR_UNSUPPORTED_VALUE,
+			 "%s: unsupported UTF-16 stream.",
+			 function );
+
+			return( -1 );
+		}
+		if( utf16_stream[ utf16_stream_offset + 1 ] != 0 )
+		{
+			libcerror_error_set(
+			 error,
+			 LIBCERROR_ERROR_DOMAIN_RUNTIME,
+			 LIBCERROR_RUNTIME_ERROR_UNSUPPORTED_VALUE,
+			 "%s: unsupported integer string.",
+			 function );
+
+			return( -1 );
+		}
+		digit = utf16_stream[ utf16_stream_offset ];
+
+		if( digit == 0 )
+		{
+			break;
+		}
+		if( ( digit < (uint8_t) '0' )
+		 || ( digit > (uint8_t) '9' ) )
+		{
+			libcerror_error_set(
+			 error,
+			 LIBCERROR_ERROR_DOMAIN_RUNTIME,
+			 LIBCERROR_RUNTIME_ERROR_UNSUPPORTED_VALUE,
+			 "%s: invalid integer string.",
+			 function );
+
+			return( -1 );
+		}
+		safe_integer_value *= 10;
+		safe_integer_value += digit - (uint8_t) '0';
+	}
+	if( ( utf16_stream[ utf16_stream_offset ] != 0 )
+	 || ( utf16_stream[ utf16_stream_offset + 1 ] != 0 ) )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_RUNTIME,
+		 LIBCERROR_RUNTIME_ERROR_UNSUPPORTED_VALUE,
+		 "%s: unsupported integer string.",
+		 function );
+
+		return( -1 );
+	}
+	*integer_value = safe_integer_value;
+
+	return( 1 );
+}
+
+/* Deterimes the size of the string of the integer as a signed decimal
+ * The string size includes the end of string character
+ * Returns 1 if successful or -1 on error
+ */
+int libfwevt_integer_as_signed_decimal_get_string_size(
+     uint64_t integer_value,
+     uint8_t integer_size,
+     size_t *string_size,
+     libcerror_error_t **error )
+{
+	static char *function        = "libfwevt_integer_as_signed_decimal_get_string_size";
+	uint64_t divider             = 0;
+	uint8_t is_negative          = 0;
+	uint8_t number_of_characters = 0;
+	int8_t bit_shift             = integer_size - 1;
+
+	if( string_size == NULL )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
+		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
+		 "%s: invalid string size.",
+		 function );
+
+		return( -1 );
+	}
+	/* The string is at least a single digit with an end of string character
+	 */
+	number_of_characters = 2;
+
+	is_negative = (uint8_t) ( integer_value >> bit_shift );
+
+	if( is_negative != 0 )
+	{
+		number_of_characters += 1;
+
+		integer_value &= ~( (uint64_t) 1 << bit_shift );
+
+		if( integer_value == 0 )
+		{
+			integer_value |= (uint64_t) 1 << bit_shift;
+		}
+	}
+	divider = 1;
+
+	while( ( integer_value / divider ) >= 10 )
+	{
+		divider *= 10;
+
+		number_of_characters += 1;
+	}
+	*string_size = number_of_characters;
+
+	return( 1 );
+}
+
+/* Copies an integer as an unsigned decimal to an UTF-8 string
+ * The string size should include the end of string character
+ * Returns 1 if successful or -1 on error
+ */
+int libfwevt_integer_as_signed_decimal_copy_to_utf8_string_with_index(
+     uint64_t integer_value,
+     uint8_t integer_size,
+     uint8_t *utf8_string,
+     size_t utf8_string_size,
+     size_t *utf8_string_index,
+     libcerror_error_t **error )
+{
+	static char *function         = "libfwevt_integer_as_signed_decimal_copy_to_utf8_string_with_index";
+	size_t safe_utf8_string_index = 0;
+	uint64_t divider              = 0;
+	uint8_t is_negative           = 0;
+	uint8_t number_of_characters  = 0;
+	int8_t bit_shift              = integer_size - 1;
+
+	if( utf8_string == NULL )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
+		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
+		 "%s: invalid UTF-8 string.",
+		 function );
+
+		return( -1 );
+	}
+	if( utf8_string_size > (size_t) SSIZE_MAX )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
+		 LIBCERROR_ARGUMENT_ERROR_VALUE_EXCEEDS_MAXIMUM,
+		 "%s: invalid UTF-8 string size value exceeds maximum.",
+		 function );
+
+		return( -1 );
+	}
+	if( utf8_string_index == NULL )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
+		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
+		 "%s: invalid UTF-8 string index.",
+		 function );
+
+		return( -1 );
+	}
+	safe_utf8_string_index = *utf8_string_index;
+
+	/* The string is at least a single digit with an end of string character
+	 */
+	number_of_characters = 2;
+
+	is_negative = (uint8_t) ( integer_value >> bit_shift );
+
+	if( is_negative != 0 )
+	{
+		number_of_characters += 1;
+
+		integer_value &= ~( (uint64_t) 1 << bit_shift );
+
+		if( integer_value == 0 )
+		{
+			integer_value |= (uint64_t) 1 << bit_shift;
+		}
+	}
+	divider = 1;
+
+	while( ( integer_value / divider ) >= 10 )
+	{
+		divider *= 10;
+
+		number_of_characters += 1;
+	}
+	if( ( number_of_characters > utf8_string_size )
+	 || ( safe_utf8_string_index > ( utf8_string_size - number_of_characters ) ) )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
+		 LIBCERROR_ARGUMENT_ERROR_VALUE_TOO_SMALL,
+		 "%s: invalid UTF-8 string size value too small.",
+		 function );
+
+		return( -1 );
+	}
+	if( is_negative != 0 )
+	{
+		utf8_string[ safe_utf8_string_index++ ] = (uint8_t) '-';
+	}
+	while( divider > 1 )
+	{
+		utf8_string[ safe_utf8_string_index++ ] = (uint8_t) '0' + (uint8_t) ( integer_value / divider );
+
+		integer_value %= divider;
+
+		divider /= 10;
+	}
+	utf8_string[ safe_utf8_string_index++ ] = (uint8_t) '0' + (uint8_t) ( integer_value / divider );
+	utf8_string[ safe_utf8_string_index++ ] = 0;
+
+	*utf8_string_index = safe_utf8_string_index;
+
+	return( 1 );
+}
+
+/* Copies an integer as an unsigned decimal to an UTF-16 string
+ * The string size should include the end of string character
+ * Returns 1 if successful or -1 on error
+ */
+int libfwevt_integer_as_signed_decimal_copy_to_utf16_string_with_index(
+     uint64_t integer_value,
+     uint8_t integer_size,
+     uint16_t *utf16_string,
+     size_t utf16_string_size,
+     size_t *utf16_string_index,
+     libcerror_error_t **error )
+{
+	static char *function          = "libfwevt_integer_as_signed_decimal_copy_to_utf16_string_with_index";
+	size_t safe_utf16_string_index = 0;
+	uint64_t divider               = 0;
+	uint8_t is_negative            = 0;
+	uint8_t number_of_characters   = 0;
+	int8_t bit_shift               = integer_size - 1;
+
+	if( utf16_string == NULL )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
+		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
+		 "%s: invalid UTF-16 string.",
+		 function );
+
+		return( -1 );
+	}
+	if( utf16_string_size > (size_t) SSIZE_MAX )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
+		 LIBCERROR_ARGUMENT_ERROR_VALUE_EXCEEDS_MAXIMUM,
+		 "%s: invalid UTF-16 string size value exceeds maximum.",
+		 function );
+
+		return( -1 );
+	}
+	if( utf16_string_index == NULL )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
+		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
+		 "%s: invalid UTF-16 string index.",
+		 function );
+
+		return( -1 );
+	}
+	safe_utf16_string_index = *utf16_string_index;
+
+	/* The string is at least a single digit with an end of string character
+	 */
+	number_of_characters = 2;
+
+	is_negative = (uint8_t) ( integer_value >> bit_shift );
+
+	if( is_negative != 0 )
+	{
+		number_of_characters += 1;
+
+		integer_value &= ~( (uint64_t) 1 << bit_shift );
+
+		if( integer_value == 0 )
+		{
+			integer_value |= (uint64_t) 1 << bit_shift;
+		}
+	}
+	divider = 1;
+
+	while( ( integer_value / divider ) >= 10 )
+	{
+		divider *= 10;
+
+		number_of_characters += 1;
+	}
+	if( ( number_of_characters > utf16_string_size )
+	 || ( safe_utf16_string_index > ( utf16_string_size - number_of_characters ) ) )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
+		 LIBCERROR_ARGUMENT_ERROR_VALUE_TOO_SMALL,
+		 "%s: invalid UTF-16 string size value too small.",
+		 function );
+
+		return( -1 );
+	}
+	if( is_negative != 0 )
+	{
+		utf16_string[ safe_utf16_string_index++ ] = (uint16_t) '-';
+	}
+	while( divider > 1 )
+	{
+		utf16_string[ safe_utf16_string_index++ ] = (uint16_t) '0' + (uint16_t) ( integer_value / divider );
+
+		integer_value %= divider;
+
+		divider /= 10;
+	}
+	utf16_string[ safe_utf16_string_index++ ] = (uint16_t) '0' + (uint16_t) ( integer_value / divider );
+	utf16_string[ safe_utf16_string_index++ ] = 0;
+
+	*utf16_string_index = safe_utf16_string_index;
+
+	return( 1 );
+}
+
+/* Deterimes the size of the string of the integer as an unsigned decimal
+ * The string size includes the end of string character
+ * Returns 1 if successful or -1 on error
+ */
+int libfwevt_integer_as_unsigned_decimal_get_string_size(
+     uint64_t integer_value,
+     size_t *string_size,
+     libcerror_error_t **error )
+{
+	static char *function        = "libfwevt_integer_as_decimal_get_string_size";
+	uint64_t divider             = 0;
+	uint8_t number_of_characters = 0;
+
+	if( string_size == NULL )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
+		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
+		 "%s: invalid string size.",
+		 function );
+
+		return( -1 );
+	}
+	/* The string is at least a single digit with an end of string character
+	 */
+	number_of_characters = 2;
+
+	divider = 1;
+
+	while( ( integer_value / divider ) >= 10 )
+	{
+		divider *= 10;
+
+		number_of_characters += 1;
+	}
+	*string_size = number_of_characters;
+
+	return( 1 );
+}
+
+/* Copies an integer as an unsigned decimal to an UTF-8 string
+ * The string size should include the end of string character
+ * Returns 1 if successful or -1 on error
+ */
+int libfwevt_integer_as_unsigned_decimal_copy_to_utf8_string_with_index(
+     uint64_t integer_value,
+     uint8_t *utf8_string,
+     size_t utf8_string_size,
+     size_t *utf8_string_index,
+     libcerror_error_t **error )
+{
+	static char *function         = "libfwevt_integer_as_unsigned_decimal_copy_to_utf8_string_with_index";
+	size_t safe_utf8_string_index = 0;
+	uint64_t divider              = 0;
+	uint8_t number_of_characters  = 0;
+
+	if( utf8_string == NULL )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
+		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
+		 "%s: invalid UTF-8 string.",
+		 function );
+
+		return( -1 );
+	}
+	if( utf8_string_size > (size_t) SSIZE_MAX )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
+		 LIBCERROR_ARGUMENT_ERROR_VALUE_EXCEEDS_MAXIMUM,
+		 "%s: invalid UTF-8 string size value exceeds maximum.",
+		 function );
+
+		return( -1 );
+	}
+	if( utf8_string_index == NULL )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
+		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
+		 "%s: invalid UTF-8 string index.",
+		 function );
+
+		return( -1 );
+	}
+	safe_utf8_string_index = *utf8_string_index;
+
+	/* The string is at least a single digit with an end of string character
+	 */
+	number_of_characters = 2;
+
+	divider = 1;
+
+	while( ( integer_value / divider ) >= 10 )
+	{
+		divider *= 10;
+
+		number_of_characters += 1;
+	}
+	if( ( number_of_characters > utf8_string_size )
+	 || ( safe_utf8_string_index > ( utf8_string_size - number_of_characters ) ) )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
+		 LIBCERROR_ARGUMENT_ERROR_VALUE_TOO_SMALL,
+		 "%s: invalid UTF-8 string size value too small.",
+		 function );
+
+		return( -1 );
+	}
+	while( divider > 1 )
+	{
+		utf8_string[ safe_utf8_string_index++ ] = (uint8_t) '0' + (uint8_t) ( integer_value / divider );
+
+		integer_value %= divider;
+
+		divider /= 10;
+	}
+	utf8_string[ safe_utf8_string_index++ ] = (uint8_t) '0' + (uint8_t) ( integer_value / divider );
+	utf8_string[ safe_utf8_string_index++ ] = 0;
+
+	*utf8_string_index = safe_utf8_string_index;
+
+	return( 1 );
+}
+
+/* Copies an integer as an unsigned decimal to an UTF-16 string
+ * The string size should include the end of string character
+ * Returns 1 if successful or -1 on error
+ */
+int libfwevt_integer_as_unsigned_decimal_copy_to_utf16_string_with_index(
+     uint64_t integer_value,
+     uint16_t *utf16_string,
+     size_t utf16_string_size,
+     size_t *utf16_string_index,
+     libcerror_error_t **error )
+{
+	static char *function          = "libfwevt_integer_as_unsigned_decimal_copy_to_utf16_string_with_index";
+	size_t safe_utf16_string_index = 0;
+	uint64_t divider               = 0;
+	uint8_t number_of_characters   = 0;
+
+	if( utf16_string == NULL )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
+		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
+		 "%s: invalid UTF-16 string.",
+		 function );
+
+		return( -1 );
+	}
+	if( utf16_string_size > (size_t) SSIZE_MAX )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
+		 LIBCERROR_ARGUMENT_ERROR_VALUE_EXCEEDS_MAXIMUM,
+		 "%s: invalid UTF-16 string size value exceeds maximum.",
+		 function );
+
+		return( -1 );
+	}
+	if( utf16_string_index == NULL )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
+		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
+		 "%s: invalid UTF-16 string index.",
+		 function );
+
+		return( -1 );
+	}
+	safe_utf16_string_index = *utf16_string_index;
+
+	/* The string is at least a single digit with an end of string character
+	 */
+	number_of_characters = 2;
+
+	divider = 1;
+
+	while( ( integer_value / divider ) >= 10 )
+	{
+		divider *= 10;
+
+		number_of_characters += 1;
+	}
+	if( ( number_of_characters > utf16_string_size )
+	 || ( safe_utf16_string_index > ( utf16_string_size - number_of_characters ) ) )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
+		 LIBCERROR_ARGUMENT_ERROR_VALUE_TOO_SMALL,
+		 "%s: invalid UTF-16 string size value too small.",
+		 function );
+
+		return( -1 );
+	}
+	while( divider > 1 )
+	{
+		utf16_string[ safe_utf16_string_index++ ] = (uint16_t) '0' + (uint16_t) ( integer_value / divider );
+
+		integer_value %= divider;
+
+		divider /= 10;
+	}
+	utf16_string[ safe_utf16_string_index++ ] = (uint16_t) '0' + (uint16_t) ( integer_value / divider );
+	utf16_string[ safe_utf16_string_index++ ] = 0;
+
+	*utf16_string_index = safe_utf16_string_index;
+
+	return( 1 );
+}
+
+/* Copies an integer as hexadecimal to an UTF-8 string
+ * The string size should include the end of string character
+ * Returns 1 if successful or -1 on error
+ */
+int libfwevt_integer_as_hexadecimal_copy_to_utf8_string_with_index(
+     uint64_t integer_value,
+     uint8_t integer_size,
+     uint8_t *utf8_string,
+     size_t utf8_string_size,
+     size_t *utf8_string_index,
+     libcerror_error_t **error )
+{
+	static char *function         = "libfwevt_integer_as_hexadecimal_copy_to_utf8_string_with_index";
+	size_t safe_utf8_string_index = 0;
+	uint8_t number_of_characters  = 0;
+	uint8_t byte_value            = 0;
+	int8_t bit_shift              = 0;
+
+	if( integer_size == 32 )
+	{
+		number_of_characters = 11;
+	}
+	else if( integer_size == 64 )
+	{
+		number_of_characters = 19;
+	}
+	else
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_RUNTIME,
+		 LIBCERROR_RUNTIME_ERROR_UNSUPPORTED_VALUE,
+		 "%s: unsupported integer size.",
+		 function );
+
+		return( -1 );
+	}
+	if( utf8_string == NULL )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
+		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
+		 "%s: invalid UTF-8 string.",
+		 function );
+
+		return( -1 );
+	}
+	if( utf8_string_size > (size_t) SSIZE_MAX )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
+		 LIBCERROR_ARGUMENT_ERROR_VALUE_EXCEEDS_MAXIMUM,
+		 "%s: invalid UTF-8 string size value exceeds maximum.",
+		 function );
+
+		return( -1 );
+	}
+	if( utf8_string_index == NULL )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
+		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
+		 "%s: invalid UTF-8 string index.",
+		 function );
+
+		return( -1 );
+	}
+	safe_utf8_string_index = *utf8_string_index;
+
+	if( ( number_of_characters > utf8_string_size )
+	 || ( safe_utf8_string_index > ( utf8_string_size - number_of_characters ) ) )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
+		 LIBCERROR_ARGUMENT_ERROR_VALUE_TOO_SMALL,
+		 "%s: invalid UTF-8 string size value too small.",
+		 function );
+
+		return( -1 );
+	}
+	utf8_string[ safe_utf8_string_index++ ] = (uint8_t) '0';
+	utf8_string[ safe_utf8_string_index++ ] = (uint8_t) 'x';
+
+	bit_shift = (uint8_t) ( integer_size - 4 );
+
+	do
+	{
+		byte_value = (uint8_t) ( ( integer_value >> bit_shift ) & 0x0f );
+
+		if( byte_value <= 9 )
+		{
+			utf8_string[ safe_utf8_string_index++ ] = (uint8_t) '0' + byte_value;
+		}
+		else
+		{
+			utf8_string[ safe_utf8_string_index++ ] = (uint8_t) 'a' + byte_value - 10;
+		}
+		bit_shift -= 4;
+	}
+	while( bit_shift >= 0 );
+
+	utf8_string[ safe_utf8_string_index++ ] = 0;
+
+	*utf8_string_index = safe_utf8_string_index;
+
+	return( 1 );
+}
+
+/* Copies an integer as hexadecimal to an UTF-16 string
+ * The string size should include the end of string character
+ * Returns 1 if successful or -1 on error
+ */
+int libfwevt_integer_as_hexadecimal_copy_to_utf16_string_with_index(
+     uint64_t integer_value,
+     uint8_t integer_size,
+     uint16_t *utf16_string,
+     size_t utf16_string_size,
+     size_t *utf16_string_index,
+     libcerror_error_t **error )
+{
+	static char *function          = "libfwevt_integer_as_hexadecimal_copy_to_utf16_string_with_index";
+	size_t safe_utf16_string_index = 0;
+	uint8_t number_of_characters   = 0;
+	uint8_t byte_value             = 0;
+	int8_t bit_shift               = 0;
+
+	if( integer_size == 32 )
+	{
+		number_of_characters = 11;
+	}
+	else if( integer_size == 64 )
+	{
+		number_of_characters = 19;
+	}
+	else
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_RUNTIME,
+		 LIBCERROR_RUNTIME_ERROR_UNSUPPORTED_VALUE,
+		 "%s: unsupported integer size.",
+		 function );
+
+		return( -1 );
+	}
+	if( utf16_string == NULL )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
+		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
+		 "%s: invalid UTF-16 string.",
+		 function );
+
+		return( -1 );
+	}
+	if( utf16_string_size > (size_t) SSIZE_MAX )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
+		 LIBCERROR_ARGUMENT_ERROR_VALUE_EXCEEDS_MAXIMUM,
+		 "%s: invalid UTF-16 string size value exceeds maximum.",
+		 function );
+
+		return( -1 );
+	}
+	if( utf16_string_index == NULL )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
+		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
+		 "%s: invalid UTF-16 string index.",
+		 function );
+
+		return( -1 );
+	}
+	safe_utf16_string_index = *utf16_string_index;
+
+	if( ( number_of_characters > utf16_string_size )
+	 || ( safe_utf16_string_index > ( utf16_string_size - number_of_characters ) ) )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
+		 LIBCERROR_ARGUMENT_ERROR_VALUE_TOO_SMALL,
+		 "%s: invalid UTF-16 string size value too small.",
+		 function );
+
+		return( -1 );
+	}
+	utf16_string[ safe_utf16_string_index++ ] = (uint16_t) '0';
+	utf16_string[ safe_utf16_string_index++ ] = (uint16_t) 'x';
+
+	bit_shift = (uint16_t) ( integer_size - 4 );
+
+	do
+	{
+		byte_value = (uint16_t) ( ( integer_value >> bit_shift ) & 0x0f );
+
+		if( byte_value <= 9 )
+		{
+			utf16_string[ safe_utf16_string_index++ ] = (uint16_t) '0' + byte_value;
+		}
+		else
+		{
+			utf16_string[ safe_utf16_string_index++ ] = (uint16_t) 'a' + byte_value - 10;
+		}
+		bit_shift -= 4;
+	}
+	while( bit_shift >= 0 );
+
+	utf16_string[ safe_utf16_string_index++ ] = 0;
+
+	*utf16_string_index = safe_utf16_string_index;
+
+	return( 1 );
+}
+

libfwevt/libfwevt_integer.h

+/*
+ * Integer functions
+ *
+ * Copyright (C) 2011-2024, Joachim Metz <[e-mail]>
+ *
+ * Refer to AUTHORS for acknowledgements.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+#if !defined( _LIBFWEVT_INTEGER_H )
+#define _LIBFWEVT_INTEGER_H
+
+#include <common.h>
+#include <types.h>
+
+#include "libfwevt_libcerror.h"
+
+#if defined( __cplusplus )
+extern "C" {
+#endif
+
+int libfwevt_integer_copy_from_utf16_stream(
+     uint64_t *integer_value,
+     const uint8_t *utf16_stream,
+     size_t utf16_stream_size,
+     libcerror_error_t **error );
+
+int libfwevt_integer_as_signed_decimal_get_string_size(
+     uint64_t integer_value,
+     uint8_t integer_size,
+     size_t *string_size,
+     libcerror_error_t **error );
+
+int libfwevt_integer_as_signed_decimal_copy_to_utf8_string_with_index(
+     uint64_t integer_value,
+     uint8_t integer_size,
+     uint8_t *utf8_string,
+     size_t utf8_string_size,
+     size_t *utf8_string_index,
+     libcerror_error_t **error );
+
+int libfwevt_integer_as_signed_decimal_copy_to_utf16_string_with_index(
+     uint64_t integer_value,
+     uint8_t integer_size,
+     uint16_t *utf16_string,
+     size_t utf16_string_size,
+     size_t *utf16_string_index,
+     libcerror_error_t **error );
+
+int libfwevt_integer_as_unsigned_decimal_get_string_size(
+     uint64_t integer_value,
+     size_t *string_size,
+     libcerror_error_t **error );
+
+int libfwevt_integer_as_unsigned_decimal_copy_to_utf8_string_with_index(
+     uint64_t integer_value,
+     uint8_t *utf8_string,
+     size_t utf8_string_size,
+     size_t *utf8_string_index,
+     libcerror_error_t **error );
+
+int libfwevt_integer_as_unsigned_decimal_copy_to_utf16_string_with_index(
+     uint64_t integer_value,
+     uint16_t *utf16_string,
+     size_t utf16_string_size,
+     size_t *utf16_string_index,
+     libcerror_error_t **error );
+
+int libfwevt_integer_as_hexadecimal_copy_to_utf8_string_with_index(
+     uint64_t integer_value,
+     uint8_t integer_size,
+     uint8_t *utf8_string,
+     size_t utf8_string_size,
+     size_t *utf8_string_index,
+     libcerror_error_t **error );
+
+int libfwevt_integer_as_hexadecimal_copy_to_utf16_string_with_index(
+     uint64_t integer_value,
+     uint8_t integer_size,
+     uint16_t *utf16_string,
+     size_t utf16_string_size,
+     size_t *utf16_string_index,
+     libcerror_error_t **error );
+
+#if defined( __cplusplus )
+}
+#endif
+
+#endif /* !defined( _LIBFWEVT_INTEGER_H ) */
+

libfwevt/libfwevt_libfdatetime.h

+/*
+ * The libfdatetime header wrapper
+ *
+ * Copyright (C) 2011-2024, Joachim Metz <[e-mail]>
+ *
+ * Refer to AUTHORS for acknowledgements.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+#if !defined( _LIBFWEVT_LIBFDATETIME_H )
+#define _LIBFWEVT_LIBFDATETIME_H
+
+#include <common.h>
+
+/* Define HAVE_LOCAL_LIBFDATETIME for local use of libfdatetime
+ */
+#if defined( HAVE_LOCAL_LIBFDATETIME )
+
+#include <libfdatetime_date_time_values.h>
+#include <libfdatetime_definitions.h>
+#include <libfdatetime_fat_date_time.h>
+#include <libfdatetime_filetime.h>
+#include <libfdatetime_floatingtime.h>
+#include <libfdatetime_hfs_time.h>
+#include <libfdatetime_nsf_timedate.h>
+#include <libfdatetime_posix_time.h>
+#include <libfdatetime_systemtime.h>
+#include <libfdatetime_types.h>
+
+#else
+
+/* If libtool DLL support is enabled set LIBFDATETIME_DLL_IMPORT
+ * before including libfdatetime.h
+ */
+#if defined( _WIN32 ) && defined( DLL_IMPORT )
+#define LIBFDATETIME_DLL_IMPORT
+#endif
+
+#include <libfdatetime.h>
+
+#endif /* defined( HAVE_LOCAL_LIBFDATETIME ) */
+
+#endif /* !defined( _LIBFWEVT_LIBFDATETIME_H ) */
+

libfwevt/libfwevt_libfwnt.h

+/*
+ * The libfwnt header wrapper
+ *
+ * Copyright (C) 2011-2024, Joachim Metz <[e-mail]>
+ *
+ * Refer to AUTHORS for acknowledgements.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+#if !defined( _LIBFWEVT_LIBFWNT_H )
+#define _LIBFWEVT_LIBFWNT_H
+
+#include <common.h>
+
+/* Define HAVE_LOCAL_LIBFWNT for local use of libfwnt
+ */
+#if defined( HAVE_LOCAL_LIBFWNT )
+
+#include <libfwnt_access_control_entry.h>
+#include <libfwnt_access_control_list.h>
+#include <libfwnt_bit_stream.h>
+#include <libfwnt_definitions.h>
+#include <libfwnt_huffman_tree.h>
+#include <libfwnt_locale_identifier.h>
+#include <libfwnt_lznt1.h>
+#include <libfwnt_lzx.h>
+#include <libfwnt_lzxpress.h>
+#include <libfwnt_security_descriptor.h>
+#include <libfwnt_security_identifier.h>
+#include <libfwnt_types.h>
+
+#else
+
+/* If libtool DLL support is enabled set LIBFWNT_DLL_IMPORT
+ * before including libfwnt.h
+ */
+#if defined( _WIN32 ) && defined( DLL_IMPORT )
+#define LIBFWNT_DLL_IMPORT
+#endif
+
+#include <libfwnt.h>
+
+#endif /* defined( HAVE_LOCAL_LIBFWNT ) */
+
+#endif /* !defined( _LIBFWEVT_LIBFWNT_H ) */
+

libfwevt/libfwevt_xml_string.c

+/*
+ * XML string functions
+ *
+ * Copyright (C) 2011-2024, Joachim Metz <[e-mail]>
+ *
+ * Refer to AUTHORS for acknowledgements.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+#include <common.h>
+#include <types.h>
+
+#include "libfwevt_libcerror.h"
+#include "libfwevt_libuna.h"
+#include "libfwevt_xml_string.h"
+
+/* Determines the size of an UTF-8 XML string from an UTF-16 stream
+ * Returns 1 if successful or -1 on error
+ */
+int libfwevt_utf8_xml_string_size_from_utf16_stream(
+     const uint8_t *utf16_stream,
+     size_t utf16_stream_size,
+     int byte_order,
+     size_t *utf8_string_size,
+     libcerror_error_t **error )
+{
+	static char *function                        = "libfwevt_utf8_xml_string_size_from_utf16_stream";
+	libuna_unicode_character_t unicode_character = 0;
+	size_t safe_utf8_string_size                 = 0;
+	size_t utf16_stream_index                    = 0;
+	int read_byte_order                          = 0;
+	int result                                   = 0;
+
+	if( utf16_stream == NULL )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
+		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
+		 "%s: invalid UTF-16 stream.",
+		 function );
+
+		return( -1 );
+	}
+	if( utf16_stream_size > (size_t) SSIZE_MAX )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
+		 LIBCERROR_ARGUMENT_ERROR_VALUE_EXCEEDS_MAXIMUM,
+		 "%s: invalid UTF-16 stream size value exceeds maximum.",
+		 function );
+
+		return( -1 );
+	}
+	if( ( utf16_stream_size % 2 ) != 0 )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
+		 LIBCERROR_ARGUMENT_ERROR_VALUE_TOO_SMALL,
+		 "%s: missing UTF-16 stream value.",
+		 function );
+
+		return( -1 );
+	}
+	if( utf8_string_size == NULL )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
+		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
+		 "%s: invalid UTF-8 string size.",
+		 function );
+
+		return( -1 );
+	}
+	if( utf16_stream_size == 0 )
+	{
+		return( 1 );
+	}
+	/* Check if UTF-16 stream is in big or little endian
+	 */
+	if( utf16_stream_size >= 2 )
+	{
+		if( ( utf16_stream[ 0 ] == 0xfe )
+		 && ( utf16_stream[ 1 ] == 0xff ) )
+		{
+			read_byte_order    = LIBUNA_ENDIAN_BIG;
+			utf16_stream_index = 2;
+		}
+		else if( ( utf16_stream[ 0 ] == 0xff )
+		      && ( utf16_stream[ 1 ] == 0xfe ) )
+		{
+			read_byte_order    = LIBUNA_ENDIAN_LITTLE;
+			utf16_stream_index = 2;
+		}
+		if( byte_order == 0 )
+		{
+			byte_order = read_byte_order;
+		}
+	}
+	while( ( utf16_stream_index + 1 ) < utf16_stream_size )
+	{
+		/* Convert the UTF-16 stream bytes into an Unicode character
+		 */
+		if( libuna_unicode_character_copy_from_utf16_stream(
+		     &unicode_character,
+		     utf16_stream,
+		     utf16_stream_size,
+		     &utf16_stream_index,
+		     byte_order,
+		     error ) != 1 )
+		{
+			libcerror_error_set(
+			 error,
+			 LIBCERROR_ERROR_DOMAIN_CONVERSION,
+			 LIBCERROR_CONVERSION_ERROR_INPUT_FAILED,
+			 "%s: unable to copy Unicode character from UTF-16 stream.",
+			 function );
+
+			return( -1 );
+		}
+		switch( unicode_character )
+		{
+			/* Replace & by &amp; */
+			case (libuna_unicode_character_t) '&':
+				safe_utf8_string_size += 5;
+				break;
+
+			/* Replace < by &lt; and > by &gt; */
+			case (libuna_unicode_character_t) '<':
+			case (libuna_unicode_character_t) '>':
+				safe_utf8_string_size += 4;
+				break;
+
+			/* Replace ' by &apos; and " by &quot; */
+/* TODO disabled for now since Event Viewer does not uses it
+			case (libuna_unicode_character_t) '\'':
+			case (libuna_unicode_character_t) '"':
+				safe_utf8_string_size += 6;
+				break;
+*/
+
+			default:
+				/* Determine how many UTF-8 character bytes are required
+				 */
+				if( ( byte_order & LIBUNA_UTF16_STREAM_ALLOW_UNPAIRED_SURROGATE ) == 0 )
+				{
+					result = libuna_unicode_character_size_to_utf8(
+						  unicode_character,
+						  &safe_utf8_string_size,
+						  error );
+				}
+				else
+				{
+					result = libuna_unicode_character_size_to_utf8_rfc2279(
+						  unicode_character,
+						  &safe_utf8_string_size,
+						  error );
+				}
+				if( result != 1 )
+				{
+					libcerror_error_set(
+					 error,
+					 LIBCERROR_ERROR_DOMAIN_CONVERSION,
+					 LIBCERROR_CONVERSION_ERROR_INPUT_FAILED,
+					 "%s: unable to unable to determine size of Unicode character in UTF-8.",
+					 function );
+
+					return( -1 );
+				}
+				break;
+		}
+		if( unicode_character == 0 )
+		{
+			break;
+		}
+	}
+	/* Check if the string is terminated with an end-of-string character
+	 */
+	if( unicode_character != 0 )
+	{
+		safe_utf8_string_size++;
+	}
+	*utf8_string_size = safe_utf8_string_size;
+
+	return( 1 );
+}
+
+/* Copies an UTF-8 XML string from an UTF-16 stream
+ * Returns 1 if successful or -1 on error
+ */
+int libfwevt_utf8_xml_string_with_index_copy_from_utf16_stream(
+     libuna_utf8_character_t *utf8_string,
+     size_t utf8_string_size,
+     size_t *utf8_string_index,
+     const uint8_t *utf16_stream,
+     size_t utf16_stream_size,
+     int byte_order,
+     libcerror_error_t **error )
+{
+	static char *function                        = "libfwevt_utf8_xml_string_with_index_copy_from_utf16_stream";
+	libuna_unicode_character_t unicode_character = 0;
+	size_t safe_utf8_string_index                = 0;
+	size_t utf16_stream_index                    = 0;
+	int read_byte_order                          = 0;
+	int result                                   = 0;
+
+	if( utf8_string == NULL )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
+		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
+		 "%s: invalid UTF-8 string.",
+		 function );
+
+		return( -1 );
+	}
+	if( utf8_string_size > (size_t) SSIZE_MAX )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
+		 LIBCERROR_ARGUMENT_ERROR_VALUE_EXCEEDS_MAXIMUM,
+		 "%s: invalid UTF-8 string size value exceeds maximum.",
+		 function );
+
+		return( -1 );
+	}
+	if( utf8_string_index == NULL )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
+		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
+		 "%s: invalid UTF-8 string index.",
+		 function );
+
+		return( -1 );
+	}
+	if( utf16_stream == NULL )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
+		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
+		 "%s: invalid UTF-16 stream.",
+		 function );
+
+		return( -1 );
+	}
+	if( utf16_stream_size > (size_t) SSIZE_MAX )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
+		 LIBCERROR_ARGUMENT_ERROR_VALUE_EXCEEDS_MAXIMUM,
+		 "%s: invalid UTF-16 stream size value exceeds maximum.",
+		 function );
+
+		return( -1 );
+	}
+	if( ( utf16_stream_size == 0 )
+	 || ( ( utf16_stream_size % 2 ) != 0 ) )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
+		 LIBCERROR_ARGUMENT_ERROR_VALUE_TOO_SMALL,
+		 "%s: missing UTF-16 stream value.",
+		 function );
+
+		return( -1 );
+	}
+	/* Check if UTF-16 stream is in big or little endian
+	 */
+	if( utf16_stream_size >= 2 )
+	{
+		if( ( utf16_stream[ 0 ] == 0xfe )
+		 && ( utf16_stream[ 1 ] == 0xff ) )
+		{
+			read_byte_order    = LIBUNA_ENDIAN_BIG;
+			utf16_stream_index = 2;
+		}
+		else if( ( utf16_stream[ 0 ] == 0xff )
+		      && ( utf16_stream[ 1 ] == 0xfe ) )
+		{
+			read_byte_order    = LIBUNA_ENDIAN_LITTLE;
+			utf16_stream_index = 2;
+		}
+		if( byte_order == 0 )
+		{
+			byte_order = read_byte_order;
+		}
+	}
+	safe_utf8_string_index = *utf8_string_index;
+
+	while( ( utf16_stream_index + 1 ) < utf16_stream_size )
+	{
+		/* Convert the UTF-16 stream bytes into an Unicode character
+		 */
+		if( libuna_unicode_character_copy_from_utf16_stream(
+		     &unicode_character,
+		     utf16_stream,
+		     utf16_stream_size,
+		     &utf16_stream_index,
+		     byte_order,
+		     error ) != 1 )
+		{
+			libcerror_error_set(
+			 error,
+			 LIBCERROR_ERROR_DOMAIN_CONVERSION,
+			 LIBCERROR_CONVERSION_ERROR_INPUT_FAILED,
+			 "%s: unable to copy Unicode character from UTF-16 stream.",
+			 function );
+
+			return( -1 );
+		}
+		switch( unicode_character )
+		{
+			/* Replace & by &amp; */
+			case (libuna_unicode_character_t) '&':
+				if( ( safe_utf8_string_index + 5 ) > utf8_string_size )
+				{
+					libcerror_error_set(
+					 error,
+					 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
+					 LIBCERROR_ARGUMENT_ERROR_VALUE_TOO_SMALL,
+					 "%s: UTF-8 string size too small.",
+					 function );
+
+					return( -1 );
+				}
+				utf8_string[ safe_utf8_string_index++ ] = (uint8_t) '&';
+				utf8_string[ safe_utf8_string_index++ ] = (uint8_t) 'a';
+				utf8_string[ safe_utf8_string_index++ ] = (uint8_t) 'm';
+				utf8_string[ safe_utf8_string_index++ ] = (uint8_t) 'p';
+				utf8_string[ safe_utf8_string_index++ ] = (uint8_t) ';';
+
+				break;
+
+			/* Replace < by &lt; */
+			case (libuna_unicode_character_t) '<':
+				if( ( safe_utf8_string_index + 4 ) > utf8_string_size )
+				{
+					libcerror_error_set(
+					 error,
+					 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
+					 LIBCERROR_ARGUMENT_ERROR_VALUE_TOO_SMALL,
+					 "%s: UTF-8 string size too small.",
+					 function );
+
+					return( -1 );
+				}
+				utf8_string[ safe_utf8_string_index++ ] = (uint8_t) '&';
+				utf8_string[ safe_utf8_string_index++ ] = (uint8_t) 'l';
+				utf8_string[ safe_utf8_string_index++ ] = (uint8_t) 't';
+				utf8_string[ safe_utf8_string_index++ ] = (uint8_t) ';';
+
+				break;
+
+			/* Replace > by &gt; */
+			case (libuna_unicode_character_t) '>':
+				if( ( safe_utf8_string_index + 4 ) > utf8_string_size )
+				{
+					libcerror_error_set(
+					 error,
+					 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
+					 LIBCERROR_ARGUMENT_ERROR_VALUE_TOO_SMALL,
+					 "%s: UTF-8 string size too small.",
+					 function );
+
+					return( -1 );
+				}
+				utf8_string[ safe_utf8_string_index++ ] = (uint8_t) '&';
+				utf8_string[ safe_utf8_string_index++ ] = (uint8_t) 'g';
+				utf8_string[ safe_utf8_string_index++ ] = (uint8_t) 't';
+				utf8_string[ safe_utf8_string_index++ ] = (uint8_t) ';';
+
+				break;
+
+			/* Replace ' by &apos; */
+/* TODO disabled for now since Event Viewer does not uses it
+			case (libuna_unicode_character_t) '\'':
+				if( ( safe_utf8_string_index + 6 ) > utf8_string_size )
+				{
+					libcerror_error_set(
+					 error,
+					 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
+					 LIBCERROR_ARGUMENT_ERROR_VALUE_TOO_SMALL,
+					 "%s: UTF-8 string size too small.",
+					 function );
+
+					return( -1 );
+				}
+				utf8_string[ safe_utf8_string_index++ ] = (uint8_t) '&';
+				utf8_string[ safe_utf8_string_index++ ] = (uint8_t) 'a';
+				utf8_string[ safe_utf8_string_index++ ] = (uint8_t) 'p';
+				utf8_string[ safe_utf8_string_index++ ] = (uint8_t) 'o';
+				utf8_string[ safe_utf8_string_index++ ] = (uint8_t) 's';
+				utf8_string[ safe_utf8_string_index++ ] = (uint8_t) ';';
+
+				break;
+*/
+
+			/* Replace " by &quot; */
+/* TODO disabled for now since Event Viewer does not uses it
+			case (libuna_unicode_character_t) '"':
+				if( ( safe_utf8_string_index + 6 ) > utf8_string_size )
+				{
+					libcerror_error_set(
+					 error,
+					 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
+					 LIBCERROR_ARGUMENT_ERROR_VALUE_TOO_SMALL,
+					 "%s: UTF-8 string size too small.",
+					 function );
+
+					return( -1 );
+				}
+				utf8_string[ safe_utf8_string_index++ ] = (uint8_t) '&';
+				utf8_string[ safe_utf8_string_index++ ] = (uint8_t) 'q';
+				utf8_string[ safe_utf8_string_index++ ] = (uint8_t) 'u';
+				utf8_string[ safe_utf8_string_index++ ] = (uint8_t) 'o';
+				utf8_string[ safe_utf8_string_index++ ] = (uint8_t) 't';
+				utf8_string[ safe_utf8_string_index++ ] = (uint8_t) ';';
+
+				break;
+*/
+
+			default:
+				/* Convert the Unicode character into UTF-8 character bytes
+				 */
+				if( ( byte_order & LIBUNA_UTF16_STREAM_ALLOW_UNPAIRED_SURROGATE ) == 0 )
+				{
+					result = libuna_unicode_character_copy_to_utf8(
+						  unicode_character,
+						  utf8_string,
+						  utf8_string_size,
+						  &safe_utf8_string_index,
+						  error );
+				}
+				else
+				{
+					result = libuna_unicode_character_copy_to_utf8_rfc2279(
+						  unicode_character,
+						  utf8_string,
+						  utf8_string_size,
+						  &safe_utf8_string_index,
+						  error );
+				}
+				if( result != 1 )
+				{
+					libcerror_error_set(
+					 error,
+					 LIBCERROR_ERROR_DOMAIN_CONVERSION,
+					 LIBCERROR_CONVERSION_ERROR_OUTPUT_FAILED,
+					 "%s: unable to copy Unicode character to UTF-8.",
+					 function );
+
+					return( -1 );
+				}
+				break;
+		}
+		if( unicode_character == 0 )
+		{
+			break;
+		}
+	}
+	/* Check if the string is terminated with an end-of-string character
+	 */
+	if( unicode_character != 0 )
+	{
+		if( safe_utf8_string_index >= utf8_string_size )
+		{
+			libcerror_error_set(
+			 error,
+			 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
+			 LIBCERROR_ARGUMENT_ERROR_VALUE_TOO_SMALL,
+			 "%s: UTF-8 string too small.",
+			 function );
+
+			return( -1 );
+		}
+		utf8_string[ safe_utf8_string_index ] = 0;
+
+		safe_utf8_string_index++;
+	}
+	*utf8_string_index = safe_utf8_string_index;
+
+	return( 1 );
+}
+
+/* Determines the size of an UTF-16 XML string from an UTF-16 stream
+ * Returns 1 if successful or -1 on error
+ */
+int libfwevt_utf16_xml_string_size_from_utf16_stream(
+     const uint8_t *utf16_stream,
+     size_t utf16_stream_size,
+     int byte_order,
+     size_t *utf16_string_size,
+     libcerror_error_t **error )
+{
+	static char *function                        = "libfwevt_utf16_xml_string_size_from_utf16_stream";
+	libuna_unicode_character_t unicode_character = 0;
+	size_t safe_utf16_string_size                = 0;
+	size_t utf16_stream_index                    = 0;
+	int read_byte_order                          = 0;
+	int result                                   = 0;
+
+	if( utf16_stream == NULL )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
+		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
+		 "%s: invalid UTF-16 stream.",
+		 function );
+
+		return( -1 );
+	}
+	if( utf16_stream_size > (size_t) SSIZE_MAX )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
+		 LIBCERROR_ARGUMENT_ERROR_VALUE_EXCEEDS_MAXIMUM,
+		 "%s: invalid UTF-16 stream size value exceeds maximum.",
+		 function );
+
+		return( -1 );
+	}
+	if( ( utf16_stream_size % 2 ) != 0 )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
+		 LIBCERROR_ARGUMENT_ERROR_VALUE_TOO_SMALL,
+		 "%s: missing UTF-16 stream value.",
+		 function );
+
+		return( -1 );
+	}
+	if( utf16_string_size == NULL )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
+		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
+		 "%s: invalid UTF-16 string size.",
+		 function );
+
+		return( -1 );
+	}
+	if( utf16_stream_size == 0 )
+	{
+		return( 1 );
+	}
+	/* Check if UTF-16 stream is in big or little endian
+	 */
+	if( utf16_stream_size >= 2 )
+	{
+		if( ( utf16_stream[ 0 ] == 0x0ff )
+		 && ( utf16_stream[ 1 ] == 0x0fe ) )
+		{
+			read_byte_order    = LIBUNA_ENDIAN_LITTLE;
+			utf16_stream_index = 2;
+		}
+		else if( ( utf16_stream[ 0 ] == 0x0fe )
+		      && ( utf16_stream[ 1 ] == 0x0ff ) )
+		{
+			read_byte_order    = LIBUNA_ENDIAN_BIG;
+			utf16_stream_index = 2;
+		}
+		if( byte_order == 0 )
+		{
+			byte_order = read_byte_order;
+		}
+	}
+	while( ( utf16_stream_index + 1 ) < utf16_stream_size )
+	{
+		/* Convert the UTF-16 stream bytes into an Unicode character
+		 */
+		if( libuna_unicode_character_copy_from_utf16_stream(
+		     &unicode_character,
+		     utf16_stream,
+		     utf16_stream_size,
+		     &utf16_stream_index,
+		     byte_order,
+		     error ) != 1 )
+		{
+			libcerror_error_set(
+			 error,
+			 LIBCERROR_ERROR_DOMAIN_CONVERSION,
+			 LIBCERROR_CONVERSION_ERROR_INPUT_FAILED,
+			 "%s: unable to copy Unicode character from UTF-16 stream.",
+			 function );
+
+			return( -1 );
+		}
+		switch( unicode_character )
+		{
+			/* Replace & by &amp; */
+			case (libuna_unicode_character_t) '&':
+				safe_utf16_string_size += 5;
+				break;
+
+			/* Replace < by &lt; and > by &gt; */
+			case (libuna_unicode_character_t) '<':
+			case (libuna_unicode_character_t) '>':
+				safe_utf16_string_size += 4;
+				break;
+
+			/* Replace ' by &apos; and " by &quot; */
+/* TODO disabled for now since Event Viewer does not uses it
+			case (libuna_unicode_character_t) '\'':
+			case (libuna_unicode_character_t) '"':
+				safe_utf16_string_size += 6;
+				break;
+*/
+
+			default:
+				/* Determine how many UTF-16 character bytes are required
+				 */
+				if( ( byte_order & LIBUNA_UTF16_STREAM_ALLOW_UNPAIRED_SURROGATE ) == 0 )
+				{
+					result = libuna_unicode_character_size_to_utf16(
+						  unicode_character,
+						  &safe_utf16_string_size,
+						  error );
+				}
+				else
+				{
+					result = libuna_unicode_character_size_to_ucs2(
+						  unicode_character,
+						  &safe_utf16_string_size,
+						  error );
+				}
+				if( result != 1 )
+				{
+					libcerror_error_set(
+					 error,
+					 LIBCERROR_ERROR_DOMAIN_CONVERSION,
+					 LIBCERROR_CONVERSION_ERROR_INPUT_FAILED,
+					 "%s: unable to unable to determine size of Unicode character in UTF-16.",
+					 function );
+
+					return( -1 );
+				}
+				break;
+		}
+		if( unicode_character == 0 )
+		{
+			break;
+		}
+	}
+	/* Check if the string is terminated with an end-of-string character
+	 */
+	if( unicode_character != 0 )
+	{
+		safe_utf16_string_size++;
+	}
+	*utf16_string_size = safe_utf16_string_size;
+
+	return( 1 );
+}
+
+/* Copies an UTF-16 XML string from an UTF-16 stream
+ * Returns 1 if successful or -1 on error
+ */
+int libfwevt_utf16_xml_string_with_index_copy_from_utf16_stream(
+     libuna_utf16_character_t *utf16_string,
+     size_t utf16_string_size,
+     size_t *utf16_string_index,
+     const uint8_t *utf16_stream,
+     size_t utf16_stream_size,
+     int byte_order,
+     libcerror_error_t **error )
+{
+	static char *function                        = "libfwevt_utf16_xml_string_with_index_copy_from_utf16_stream";
+	libuna_unicode_character_t unicode_character = 0;
+	size_t safe_utf16_string_index               = 0;
+	size_t utf16_stream_index                    = 0;
+	int read_byte_order                          = 0;
+	int result                                   = 0;
+
+	if( utf16_string == NULL )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
+		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
+		 "%s: invalid UTF-16 string.",
+		 function );
+
+		return( -1 );
+	}
+	if( utf16_string_size > (size_t) SSIZE_MAX )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
+		 LIBCERROR_ARGUMENT_ERROR_VALUE_EXCEEDS_MAXIMUM,
+		 "%s: invalid UTF-16 string size value exceeds maximum.",
+		 function );
+
+		return( -1 );
+	}
+	if( utf16_string_index == NULL )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
+		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
+		 "%s: invalid UTF-16 string index.",
+		 function );
+
+		return( -1 );
+	}
+	if( utf16_stream == NULL )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
+		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
+		 "%s: invalid UTF-16 stream.",
+		 function );
+
+		return( -1 );
+	}
+	if( utf16_stream_size > (size_t) SSIZE_MAX )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
+		 LIBCERROR_ARGUMENT_ERROR_VALUE_EXCEEDS_MAXIMUM,
+		 "%s: invalid UTF-16 stream size value exceeds maximum.",
+		 function );
+
+		return( -1 );
+	}
+	if( ( utf16_stream_size == 0 )
+	 || ( ( utf16_stream_size % 2 ) != 0 ) )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
+		 LIBCERROR_ARGUMENT_ERROR_VALUE_TOO_SMALL,
+		 "%s: missing UTF-16 stream value.",
+		 function );
+
+		return( -1 );
+	}
+	/* Check if UTF-16 stream is in big or little endian
+	 */
+	if( utf16_stream_size >= 2 )
+	{
+		if( ( utf16_stream[ 0 ] == 0x0ff )
+		 && ( utf16_stream[ 1 ] == 0x0fe ) )
+		{
+			read_byte_order    = LIBUNA_ENDIAN_LITTLE;
+			utf16_stream_index = 2;
+		}
+		else if( ( utf16_stream[ 0 ] == 0x0fe )
+		      && ( utf16_stream[ 1 ] == 0x0ff ) )
+		{
+			read_byte_order    = LIBUNA_ENDIAN_BIG;
+			utf16_stream_index = 2;
+		}
+		if( byte_order == 0 )
+		{
+			byte_order = read_byte_order;
+		}
+	}
+	safe_utf16_string_index = *utf16_string_index;
+
+	while( ( utf16_stream_index + 1 ) < utf16_stream_size )
+	{
+		/* Convert the UTF-16 stream bytes into an Unicode character
+		 */
+		if( libuna_unicode_character_copy_from_utf16_stream(
+		     &unicode_character,
+		     utf16_stream,
+		     utf16_stream_size,
+		     &utf16_stream_index,
+		     byte_order,
+		     error ) != 1 )
+		{
+			libcerror_error_set(
+			 error,
+			 LIBCERROR_ERROR_DOMAIN_CONVERSION,
+			 LIBCERROR_CONVERSION_ERROR_INPUT_FAILED,
+			 "%s: unable to copy Unicode character from UTF-16 stream.",
+			 function );
+
+			return( -1 );
+		}
+		switch( unicode_character )
+		{
+			/* Replace & by &amp; */
+			case (libuna_unicode_character_t) '&':
+				if( ( safe_utf16_string_index + 5 ) > utf16_string_size )
+				{
+					libcerror_error_set(
+					 error,
+					 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
+					 LIBCERROR_ARGUMENT_ERROR_VALUE_TOO_SMALL,
+					 "%s: UTF-16 string size too small.",
+					 function );
+
+					return( -1 );
+				}
+				utf16_string[ safe_utf16_string_index++ ] = (uint16_t) '&';
+				utf16_string[ safe_utf16_string_index++ ] = (uint16_t) 'a';
+				utf16_string[ safe_utf16_string_index++ ] = (uint16_t) 'm';
+				utf16_string[ safe_utf16_string_index++ ] = (uint16_t) 'p';
+				utf16_string[ safe_utf16_string_index++ ] = (uint16_t) ';';
+
+				break;
+
+			/* Replace < by &lt; */
+			case (libuna_unicode_character_t) '<':
+				if( ( safe_utf16_string_index + 4 ) > utf16_string_size )
+				{
+					libcerror_error_set(
+					 error,
+					 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
+					 LIBCERROR_ARGUMENT_ERROR_VALUE_TOO_SMALL,
+					 "%s: UTF-16 string size too small.",
+					 function );
+
+					return( -1 );
+				}
+				utf16_string[ safe_utf16_string_index++ ] = (uint16_t) '&';
+				utf16_string[ safe_utf16_string_index++ ] = (uint16_t) 'l';
+				utf16_string[ safe_utf16_string_index++ ] = (uint16_t) 't';
+				utf16_string[ safe_utf16_string_index++ ] = (uint16_t) ';';
+
+				break;
+
+			/* Replace > by &gt; */
+			case (libuna_unicode_character_t) '>':
+				if( ( safe_utf16_string_index + 4 ) > utf16_string_size )
+				{
+					libcerror_error_set(
+					 error,
+					 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
+					 LIBCERROR_ARGUMENT_ERROR_VALUE_TOO_SMALL,
+					 "%s: UTF-16 string size too small.",
+					 function );
+
+					return( -1 );
+				}
+				utf16_string[ safe_utf16_string_index++ ] = (uint16_t) '&';
+				utf16_string[ safe_utf16_string_index++ ] = (uint16_t) 'g';
+				utf16_string[ safe_utf16_string_index++ ] = (uint16_t) 't';
+				utf16_string[ safe_utf16_string_index++ ] = (uint16_t) ';';
+
+				break;
+
+			/* Replace ' by &apos; */
+/* TODO disabled for now since Event Viewer does not uses it
+			case (libuna_unicode_character_t) '\'':
+				if( ( safe_utf16_string_index + 6 ) > utf16_string_size )
+				{
+					libcerror_error_set(
+					 error,
+					 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
+					 LIBCERROR_ARGUMENT_ERROR_VALUE_TOO_SMALL,
+					 "%s: UTF-16 string size too small.",
+					 function );
+
+					return( -1 );
+				}
+				utf16_string[ safe_utf16_string_index++ ] = (uint16_t) '&';
+				utf16_string[ safe_utf16_string_index++ ] = (uint16_t) 'a';
+				utf16_string[ safe_utf16_string_index++ ] = (uint16_t) 'p';
+				utf16_string[ safe_utf16_string_index++ ] = (uint16_t) 'o';
+				utf16_string[ safe_utf16_string_index++ ] = (uint16_t) 's';
+				utf16_string[ safe_utf16_string_index++ ] = (uint16_t) ';';
+
+				break;
+*/
+
+			/* Replace " by &quot; */
+/* TODO disabled for now since Event Viewer does not uses it
+			case (libuna_unicode_character_t) '"':
+				if( ( safe_utf16_string_index + 6 ) > utf16_string_size )
+				{
+					libcerror_error_set(
+					 error,
+					 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
+					 LIBCERROR_ARGUMENT_ERROR_VALUE_TOO_SMALL,
+					 "%s: UTF-16 string size too small.",
+					 function );
+
+					return( -1 );
+				}
+				utf16_string[ safe_utf16_string_index++ ] = (uint16_t) '&';
+				utf16_string[ safe_utf16_string_index++ ] = (uint16_t) 'q';
+				utf16_string[ safe_utf16_string_index++ ] = (uint16_t) 'u';
+				utf16_string[ safe_utf16_string_index++ ] = (uint16_t) 'o';
+				utf16_string[ safe_utf16_string_index++ ] = (uint16_t) 't';
+				utf16_string[ safe_utf16_string_index++ ] = (uint16_t) ';';
+
+				break;
+*/
+
+			default:
+				/* Convert the Unicode character into UTF-16 character bytes
+				 */
+				if( ( byte_order & LIBUNA_UTF16_STREAM_ALLOW_UNPAIRED_SURROGATE ) == 0 )
+				{
+					result = libuna_unicode_character_copy_to_utf16(
+						  unicode_character,
+						  utf16_string,
+						  utf16_string_size,
+						  &safe_utf16_string_index,
+						  error );
+				}
+				else
+				{
+					result = libuna_unicode_character_copy_to_ucs2(
+						  unicode_character,
+						  utf16_string,
+						  utf16_string_size,
+						  &safe_utf16_string_index,
+						  error );
+				}
+				if( result != 1 )
+				{
+					libcerror_error_set(
+					 error,
+					 LIBCERROR_ERROR_DOMAIN_CONVERSION,
+					 LIBCERROR_CONVERSION_ERROR_OUTPUT_FAILED,
+					 "%s: unable to copy Unicode character to UTF-16.",
+					 function );
+
+					return( -1 );
+				}
+				break;
+		}
+		if( unicode_character == 0 )
+		{
+			break;
+		}
+	}
+	/* Check if the string is terminated with an end-of-string character
+	 */
+	if( unicode_character != 0 )
+	{
+		if( safe_utf16_string_index >= utf16_string_size )
+		{
+			libcerror_error_set(
+			 error,
+			 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
+			 LIBCERROR_ARGUMENT_ERROR_VALUE_TOO_SMALL,
+			 "%s: UTF-16 string too small.",
+			 function );
+
+			return( -1 );
+		}
+		utf16_string[ safe_utf16_string_index ] = 0;
+
+		safe_utf16_string_index++;
+	}
+	*utf16_string_index = safe_utf16_string_index;
+
+	return( 1 );
+}
+

libfwevt/libfwevt_xml_string.h

+/*
+ * XML string functions
+ *
+ * Copyright (C) 2011-2024, Joachim Metz <[e-mail]>
+ *
+ * Refer to AUTHORS for acknowledgements.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+#if !defined( _LIBFWEVT_XML_STRING_H )
+#define _LIBFWEVT_XML_STRING_H
+
+#include <common.h>
+#include <types.h>
+
+#include "libfwevt_libcerror.h"
+#include "libfwevt_libuna.h"
+
+#if defined( __cplusplus )
+extern "C" {
+#endif
+
+int libfwevt_utf8_xml_string_size_from_utf16_stream(
+     const uint8_t *utf16_stream,
+     size_t utf16_stream_size,
+     int byte_order,
+     size_t *utf8_string_size,
+     libcerror_error_t **error );
+
+int libfwevt_utf8_xml_string_with_index_copy_from_utf16_stream(
+     libuna_utf8_character_t *utf8_string,
+     size_t utf8_string_size,
+     size_t *utf8_string_index,
+     const uint8_t *utf16_stream,
+     size_t utf16_stream_size,
+     int byte_order,
+     libcerror_error_t **error );
+
+int libfwevt_utf16_xml_string_size_from_utf16_stream(
+     const uint8_t *utf16_stream,
+     size_t utf16_stream_size,
+     int byte_order,
+     size_t *utf16_string_size,
+     libcerror_error_t **error );
+
+int libfwevt_utf16_xml_string_with_index_copy_from_utf16_stream(
+     libuna_utf16_character_t *utf16_string,
+     size_t utf16_string_size,
+     size_t *utf16_string_index,
+     const uint8_t *utf16_stream,
+     size_t utf16_stream_size,
+     int byte_order,
+     libcerror_error_t **error );
+
+#if defined( __cplusplus )
+}
+#endif
+
+#endif /* !defined( _LIBFWEVT_XML_STRING_H ) */
+

common/config.h

@@ -608,3 +608,3 @@ /* common/config.h.  Generated from config.h.in by configure.  */
 /* Define to the full name and version of this package. */
-#define PACKAGE_STRING "libevtx 20240427"
+#define PACKAGE_STRING "libevtx 20240504"
 
@@ -618,3 +618,3 @@ /* Define to the one symbol short name of this package. */
 /* Define to the version of this package. */
-#define PACKAGE_VERSION "20240427"
+#define PACKAGE_VERSION "20240504"
 
@@ -648,3 +648,3 @@ /* The size of `int', as computed by sizeof. */
 /* Version number of package */
-#define VERSION "20240427"
+#define VERSION "20240504"
 
@@ -651,0 +651,0 @@ /* Number of bits in a file offset, on hosts where this is settable. */

include/libevtx.h

@@ -560,2 +560,44 @@ /*
 
+/* Retrieves the size of the UTF-8 encoded channel name
+ * The returned size includes the end of string character
+ * Returns 1 if successful, 0 if not available or -1 on error
+ */
+LIBEVTX_EXTERN \
+int libevtx_record_get_utf8_channel_name_size(
+     libevtx_record_t *record,
+     size_t *utf8_string_size,
+     libevtx_error_t **error );
+
+/* Retrieves the UTF-8 encoded channel name
+ * The size should include the end of string character
+ * Returns 1 if successful, 0 if not available or -1 on error
+ */
+LIBEVTX_EXTERN \
+int libevtx_record_get_utf8_channel_name(
+     libevtx_record_t *record,
+     uint8_t *utf8_string,
+     size_t utf8_string_size,
+     libevtx_error_t **error );
+
+/* Retrieves the size of the UTF-16 encoded channel name
+ * The returned size includes the end of string character
+ * Returns 1 if successful, 0 if not available or -1 on error
+ */
+LIBEVTX_EXTERN \
+int libevtx_record_get_utf16_channel_name_size(
+     libevtx_record_t *record,
+     size_t *utf16_string_size,
+     libevtx_error_t **error );
+
+/* Retrieves the UTF-16 encoded channel name
+ * The size should include the end of string character
+ * Returns 1 if successful, 0 if not available or -1 on error
+ */
+LIBEVTX_EXTERN \
+int libevtx_record_get_utf16_channel_name(
+     libevtx_record_t *record,
+     uint16_t *utf16_string,
+     size_t utf16_string_size,
+     libevtx_error_t **error );
+
 /* Retrieves the size of the UTF-8 encoded computer name
@@ -562,0 +604,0 @@ * The returned size includes the end of string character

include/libevtx.h.in

@@ -560,2 +560,44 @@ /*
 
+/* Retrieves the size of the UTF-8 encoded channel name
+ * The returned size includes the end of string character
+ * Returns 1 if successful, 0 if not available or -1 on error
+ */
+LIBEVTX_EXTERN \
+int libevtx_record_get_utf8_channel_name_size(
+     libevtx_record_t *record,
+     size_t *utf8_string_size,
+     libevtx_error_t **error );
+
+/* Retrieves the UTF-8 encoded channel name
+ * The size should include the end of string character
+ * Returns 1 if successful, 0 if not available or -1 on error
+ */
+LIBEVTX_EXTERN \
+int libevtx_record_get_utf8_channel_name(
+     libevtx_record_t *record,
+     uint8_t *utf8_string,
+     size_t utf8_string_size,
+     libevtx_error_t **error );
+
+/* Retrieves the size of the UTF-16 encoded channel name
+ * The returned size includes the end of string character
+ * Returns 1 if successful, 0 if not available or -1 on error
+ */
+LIBEVTX_EXTERN \
+int libevtx_record_get_utf16_channel_name_size(
+     libevtx_record_t *record,
+     size_t *utf16_string_size,
+     libevtx_error_t **error );
+
+/* Retrieves the UTF-16 encoded channel name
+ * The size should include the end of string character
+ * Returns 1 if successful, 0 if not available or -1 on error
+ */
+LIBEVTX_EXTERN \
+int libevtx_record_get_utf16_channel_name(
+     libevtx_record_t *record,
+     uint16_t *utf16_string,
+     size_t utf16_string_size,
+     libevtx_error_t **error );
+
 /* Retrieves the size of the UTF-8 encoded computer name
@@ -562,0 +604,0 @@ * The returned size includes the end of string character

include/libevtx/definitions.h

@@ -27,7 +27,7 @@ /*
 
-#define LIBEVTX_VERSION			20240427
+#define LIBEVTX_VERSION			20240504
 
 /* The version string
  */
-#define LIBEVTX_VERSION_STRING		"20240427"
+#define LIBEVTX_VERSION_STRING		"20240504"
 
@@ -34,0 +34,0 @@ /* The access flags definitions

libevtx/libevtx_definitions.h

@@ -40,7 +40,7 @@ /*
 #else
-#define LIBEVTX_VERSION						20240427
+#define LIBEVTX_VERSION						20240504
 
 /* The version string
  */
-#define LIBEVTX_VERSION_STRING					"20240427"
+#define LIBEVTX_VERSION_STRING					"20240504"
 
@@ -47,0 +47,0 @@ /* The access flags definitions

libevtx/libevtx_record_values.h

@@ -240,2 +240,24 @@ /*
 
+int libevtx_record_values_get_utf8_channel_name_size(
+     libevtx_record_values_t *record_values,
+     size_t *utf8_string_size,
+     libcerror_error_t **error );
+
+int libevtx_record_values_get_utf8_channel_name(
+     libevtx_record_values_t *record_values,
+     uint8_t *utf8_string,
+     size_t utf8_string_size,
+     libcerror_error_t **error );
+
+int libevtx_record_values_get_utf16_channel_name_size(
+     libevtx_record_values_t *record_values,
+     size_t *utf16_string_size,
+     libcerror_error_t **error );
+
+int libevtx_record_values_get_utf16_channel_name(
+     libevtx_record_values_t *record_values,
+     uint16_t *utf16_string,
+     size_t utf16_string_size,
+     libcerror_error_t **error );
+
 int libevtx_record_values_get_utf8_computer_name_size(
@@ -242,0 +264,0 @@ libevtx_record_values_t *record_values,

libevtx/libevtx_record.c

@@ -976,2 +976,186 @@ /*
 
+/* Retrieves the size of the UTF-8 encoded channel name
+ * The returned size includes the end of string character
+ * Returns 1 if successful, 0 if not available or -1 on error
+ */
+int libevtx_record_get_utf8_channel_name_size(
+     libevtx_record_t *record,
+     size_t *utf8_string_size,
+     libcerror_error_t **error )
+{
+	libevtx_internal_record_t *internal_record = NULL;
+	static char *function                      = "libevtx_record_get_utf8_channel_name_size";
+	int result                                 = 0;
+
+	if( record == NULL )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
+		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
+		 "%s: invalid record.",
+		 function );
+
+		return( -1 );
+	}
+	internal_record = (libevtx_internal_record_t *) record;
+
+	result = libevtx_record_values_get_utf8_channel_name_size(
+	          internal_record->record_values,
+	          utf8_string_size,
+	          error );
+
+	if( result == -1 )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_RUNTIME,
+		 LIBCERROR_RUNTIME_ERROR_GET_FAILED,
+		 "%s: unable to retrieve UTF-8 string size of channel name.",
+		 function );
+
+		return( -1 );
+	}
+	return( result );
+}
+
+/* Retrieves the UTF-8 encoded channel name
+ * The size should include the end of string character
+ * Returns 1 if successful, 0 if not available or -1 on error
+ */
+int libevtx_record_get_utf8_channel_name(
+     libevtx_record_t *record,
+     uint8_t *utf8_string,
+     size_t utf8_string_size,
+     libcerror_error_t **error )
+{
+	libevtx_internal_record_t *internal_record = NULL;
+	static char *function                      = "libevtx_record_get_utf8_channel_name";
+	int result                                 = 0;
+
+	if( record == NULL )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
+		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
+		 "%s: invalid record.",
+		 function );
+
+		return( -1 );
+	}
+	internal_record = (libevtx_internal_record_t *) record;
+
+	result = libevtx_record_values_get_utf8_channel_name(
+	          internal_record->record_values,
+	          utf8_string,
+	          utf8_string_size,
+	          error );
+
+	if( result == -1 )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_RUNTIME,
+		 LIBCERROR_RUNTIME_ERROR_COPY_FAILED,
+		 "%s: unable to copy channel name to UTF-8 string.",
+		 function );
+
+		return( -1 );
+	}
+	return( result );
+}
+
+/* Retrieves the size of the UTF-16 encoded channel name
+ * The returned size includes the end of string character
+ * Returns 1 if successful, 0 if not available or -1 on error
+ */
+int libevtx_record_get_utf16_channel_name_size(
+     libevtx_record_t *record,
+     size_t *utf16_string_size,
+     libcerror_error_t **error )
+{
+	libevtx_internal_record_t *internal_record = NULL;
+	static char *function                      = "libevtx_record_get_utf16_channel_name_size";
+	int result                                 = 0;
+
+	if( record == NULL )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
+		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
+		 "%s: invalid record.",
+		 function );
+
+		return( -1 );
+	}
+	internal_record = (libevtx_internal_record_t *) record;
+
+	result = libevtx_record_values_get_utf16_channel_name_size(
+	          internal_record->record_values,
+	          utf16_string_size,
+	          error );
+
+	if( result == -1 )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_RUNTIME,
+		 LIBCERROR_RUNTIME_ERROR_GET_FAILED,
+		 "%s: unable to retrieve UTF-16 string size of channel name.",
+		 function );
+
+		return( -1 );
+	}
+	return( result );
+}
+
+/* Retrieves the UTF-16 encoded channel name
+ * The size should include the end of string character
+ * Returns 1 if successful, 0 if not available or -1 on error
+ */
+int libevtx_record_get_utf16_channel_name(
+     libevtx_record_t *record,
+     uint16_t *utf16_string,
+     size_t utf16_string_size,
+     libcerror_error_t **error )
+{
+	libevtx_internal_record_t *internal_record = NULL;
+	static char *function                      = "libevtx_record_get_utf16_channel_name";
+	int result                                 = 0;
+
+	if( record == NULL )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
+		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
+		 "%s: invalid record.",
+		 function );
+
+		return( -1 );
+	}
+	internal_record = (libevtx_internal_record_t *) record;
+
+	result = libevtx_record_values_get_utf16_channel_name(
+	          internal_record->record_values,
+	          utf16_string,
+	          utf16_string_size,
+	          error );
+
+	if( result == -1 )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_RUNTIME,
+		 LIBCERROR_RUNTIME_ERROR_COPY_FAILED,
+		 "%s: unable to copy channel name to UTF-16 string.",
+		 function );
+
+		return( -1 );
+	}
+	return( result );
+}
+
 /* Retrieves the size of the UTF-8 encoded computer name
@@ -978,0 +1162,0 @@ * The returned size includes the end of string character

libevtx/libevtx_record.h

@@ -174,2 +174,28 @@ /*
 LIBEVTX_EXTERN \
+int libevtx_record_get_utf8_channel_name_size(
+     libevtx_record_t *record,
+     size_t *utf8_string_size,
+     libcerror_error_t **error );
+
+LIBEVTX_EXTERN \
+int libevtx_record_get_utf8_channel_name(
+     libevtx_record_t *record,
+     uint8_t *utf8_string,
+     size_t utf8_string_size,
+     libcerror_error_t **error );
+
+LIBEVTX_EXTERN \
+int libevtx_record_get_utf16_channel_name_size(
+     libevtx_record_t *record,
+     size_t *utf16_string_size,
+     libcerror_error_t **error );
+
+LIBEVTX_EXTERN \
+int libevtx_record_get_utf16_channel_name(
+     libevtx_record_t *record,
+     uint16_t *utf16_string,
+     size_t utf16_string_size,
+     libcerror_error_t **error );
+
+LIBEVTX_EXTERN \
 int libevtx_record_get_utf8_computer_name_size(
@@ -176,0 +202,0 @@ libevtx_record_t *record,

libfwevt/libfwevt_date_time.c

 /*
- * Date and time values functions
+ * Date and time functions
  *
@@ -36,12 +36,13 @@ * Copyright (C) 2011-2024, Joachim Metz <[e-mail]>
 
-/* Copies an ISO 8601 UTF-8 formatted string to a FILETIME value
+/* Copies an ISO 8601 UTF-16 stream to a FILETIME value
  * Returns 1 if successful or -1 on error
  */
-int libfwevt_utf8_string_copy_to_filetime(
-     const uint8_t *utf8_string,
-     size_t utf8_string_size,
+int libfwevt_filetime_copy_from_utf16_stream(
      uint64_t *filetime,
+     const uint8_t *utf16_stream,
+     size_t utf16_stream_size,
      libcerror_error_t **error )
 {
-	static char *function       = "libfwevt_utf8_string_copy_to_filetime";
+	static char *function       = "libfwevt_filetime_copy_from_utf16_stream";
+	size_t utf16_stream_offset  = 0;
 	uint64_t safe_filetime      = 0;
@@ -58,5 +59,4 @@ uint32_t fraction_of_second = 0;
 	uint8_t seconds             = 0;
-	size_t utf8_string_index    = 0;
 
-	if( utf8_string == NULL )
+	if( filetime == NULL )
 	{
@@ -67,3 +67,3 @@ libcerror_error_set(
 		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
-		 "%s: invalid UTF-8 string.",
+		 "%s: invalid FILETIME.",
 		 function );
@@ -73,4 +73,3 @@
 	}
-	if( ( utf8_string_size < 31 )
-	 || ( utf8_string_size > (size_t) SSIZE_MAX ) )
+	if( utf16_stream == NULL )
 	{
@@ -80,4 +79,4 @@ libcerror_error_set(
 		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
-		 LIBCERROR_ARGUMENT_ERROR_VALUE_OUT_OF_BOUNDS,
-		 "%s: invalid UTF-8 string size value out of bounds.",
+		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
+		 "%s: invalid UTF-16 stream.",
 		 function );
@@ -87,3 +86,5 @@
 	}
-	if( filetime == NULL )
+	if( ( utf16_stream_size < 62 )
+	 || ( utf16_stream_size > (size_t) SSIZE_MAX )
+	 || ( ( utf16_stream_size % 2 ) != 0 ) )
 	{
@@ -93,4 +94,4 @@ libcerror_error_set(
 		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
-		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
-		 "%s: invalid FILETIME value.",
+		 LIBCERROR_ARGUMENT_ERROR_VALUE_OUT_OF_BOUNDS,
+		 "%s: UTF-16 stream size value out of bounds.",
 		 function );
@@ -100,10 +101,18 @@
 	}
-	if( ( utf8_string[ 4 ] != (uint8_t) '-' )
-	 || ( utf8_string[ 7 ] != (uint8_t) '-' )
-	 || ( utf8_string[ 10 ] != (uint8_t) 'T' )
-	 || ( utf8_string[ 13 ] != (uint8_t) ':' )
-	 || ( utf8_string[ 16 ] != (uint8_t) ':' )
-	 || ( utf8_string[ 19 ] != (uint8_t) '.' )
-	 || ( utf8_string[ 29 ] != (uint8_t) 'Z' )
-	 || ( utf8_string[ 30 ] != (uint8_t) 0 ) )
+	if( ( utf16_stream[ 8 ] != (uint8_t) '-' )
+	 || ( utf16_stream[ 9 ] != 0 )
+	 || ( utf16_stream[ 14 ] != (uint8_t) '-' )
+	 || ( utf16_stream[ 15 ] != 0 )
+	 || ( utf16_stream[ 20 ] != (uint8_t) 'T' )
+	 || ( utf16_stream[ 21 ] != 0 )
+	 || ( utf16_stream[ 26 ] != (uint8_t) ':' )
+	 || ( utf16_stream[ 27 ] != 0 )
+	 || ( utf16_stream[ 32 ] != (uint8_t) ':' )
+	 || ( utf16_stream[ 33 ] != 0 )
+	 || ( utf16_stream[ 38 ] != (uint8_t) '.' )
+	 || ( utf16_stream[ 39 ] != 0 )
+	 || ( utf16_stream[ 58 ] != (uint8_t) 'Z' )
+	 || ( utf16_stream[ 59 ] != 0 )
+	 || ( utf16_stream[ 60 ] != 0 )
+	 || ( utf16_stream[ 61 ] != 0 ) )
 	{
@@ -119,8 +128,8 @@ libcerror_error_set(
 	}
-	for( utf8_string_index = 0;
-	     utf8_string_index < 4;
-	     utf8_string_index++ )
+	for( utf16_stream_offset = 0;
+	     utf16_stream_offset < 8;
+	     utf16_stream_offset += 2 )
 	{
-		if( ( utf8_string[ utf8_string_index ] < (uint8_t) '0' )
-		 || ( utf8_string[ utf8_string_index ] > (uint8_t) '9' ) )
+		if( ( utf16_stream[ utf16_stream_offset ] < (uint8_t) '0' )
+		 || ( utf16_stream[ utf16_stream_offset ] > (uint8_t) '9' ) )
 		{
@@ -137,10 +146,11 @@ libcerror_error_set(
 		year *= 10;
-		year += utf8_string[ utf8_string_index ] - (uint8_t) '0';
+		year += utf16_stream[ utf16_stream_offset ] - (uint8_t) '0';
 	}
-	for( utf8_string_index = 5;
-	     utf8_string_index < 7;
-	     utf8_string_index++ )
+	for( utf16_stream_offset = 10;
+	     utf16_stream_offset < 14;
+	     utf16_stream_offset += 2 )
 	{
-		if( ( utf8_string[ utf8_string_index ] < (uint8_t) '0' )
-		 || ( utf8_string[ utf8_string_index ] > (uint8_t) '9' ) )
+		if( ( utf16_stream[ utf16_stream_offset ] < (uint8_t) '0' )
+		 || ( utf16_stream[ utf16_stream_offset ] > (uint8_t) '9' )
+		 || ( utf16_stream[ utf16_stream_offset + 1 ] != 0 ) )
 		{
@@ -157,10 +167,11 @@ libcerror_error_set(
 		month *= 10;
-		month += utf8_string[ utf8_string_index ] - (uint8_t) '0';
+		month += utf16_stream[ utf16_stream_offset ] - (uint8_t) '0';
 	}
-	for( utf8_string_index = 8;
-	     utf8_string_index < 10;
-	     utf8_string_index++ )
+	for( utf16_stream_offset = 16;
+	     utf16_stream_offset < 20;
+	     utf16_stream_offset += 2 )
 	{
-		if( ( utf8_string[ utf8_string_index ] < (uint8_t) '0' )
-		 || ( utf8_string[ utf8_string_index ] > (uint8_t) '9' ) )
+		if( ( utf16_stream[ utf16_stream_offset ] < (uint8_t) '0' )
+		 || ( utf16_stream[ utf16_stream_offset ] > (uint8_t) '9' )
+		 || ( utf16_stream[ utf16_stream_offset + 1 ] != 0 ) )
 		{
@@ -177,10 +188,11 @@ libcerror_error_set(
 		day_of_month *= 10;
-		day_of_month += utf8_string[ utf8_string_index ] - (uint8_t) '0';
+		day_of_month += utf16_stream[ utf16_stream_offset ] - (uint8_t) '0';
 	}
-	for( utf8_string_index = 11;
-	     utf8_string_index < 13;
-	     utf8_string_index++ )
+	for( utf16_stream_offset = 22;
+	     utf16_stream_offset < 26;
+	     utf16_stream_offset += 2 )
 	{
-		if( ( utf8_string[ utf8_string_index ] < (uint8_t) '0' )
-		 || ( utf8_string[ utf8_string_index ] > (uint8_t) '9' ) )
+		if( ( utf16_stream[ utf16_stream_offset ] < (uint8_t) '0' )
+		 || ( utf16_stream[ utf16_stream_offset ] > (uint8_t) '9' )
+		 || ( utf16_stream[ utf16_stream_offset + 1 ] != 0 ) )
 		{
@@ -197,10 +209,11 @@ libcerror_error_set(
 		hours *= 10;
-		hours += utf8_string[ utf8_string_index ] - (uint8_t) '0';
+		hours += utf16_stream[ utf16_stream_offset ] - (uint8_t) '0';
 	}
-	for( utf8_string_index = 14;
-	     utf8_string_index < 16;
-	     utf8_string_index++ )
+	for( utf16_stream_offset = 28;
+	     utf16_stream_offset < 32;
+	     utf16_stream_offset += 2 )
 	{
-		if( ( utf8_string[ utf8_string_index ] < (uint8_t) '0' )
-		 || ( utf8_string[ utf8_string_index ] > (uint8_t) '9' ) )
+		if( ( utf16_stream[ utf16_stream_offset ] < (uint8_t) '0' )
+		 || ( utf16_stream[ utf16_stream_offset ] > (uint8_t) '9' )
+		 || ( utf16_stream[ utf16_stream_offset + 1 ] != 0 ) )
 		{
@@ -217,10 +230,11 @@ libcerror_error_set(
 		minutes *= 10;
-		minutes += utf8_string[ utf8_string_index ] - (uint8_t) '0';
+		minutes += utf16_stream[ utf16_stream_offset ] - (uint8_t) '0';
 	}
-	for( utf8_string_index = 17;
-	     utf8_string_index < 19;
-	     utf8_string_index++ )
+	for( utf16_stream_offset = 34;
+	     utf16_stream_offset < 38;
+	     utf16_stream_offset += 2 )
 	{
-		if( ( utf8_string[ utf8_string_index ] < (uint8_t) '0' )
-		 || ( utf8_string[ utf8_string_index ] > (uint8_t) '9' ) )
+		if( ( utf16_stream[ utf16_stream_offset ] < (uint8_t) '0' )
+		 || ( utf16_stream[ utf16_stream_offset ] > (uint8_t) '9' )
+		 || ( utf16_stream[ utf16_stream_offset + 1 ] != 0 ) )
 		{
@@ -237,10 +251,11 @@ libcerror_error_set(
 		seconds *= 10;
-		seconds += utf8_string[ utf8_string_index ] - (uint8_t) '0';
+		seconds += utf16_stream[ utf16_stream_offset ] - (uint8_t) '0';
 	}
-	for( utf8_string_index = 20;
-	     utf8_string_index < 29;
-	     utf8_string_index++ )
+	for( utf16_stream_offset = 40;
+	     utf16_stream_offset < 58;
+	     utf16_stream_offset += 2 )
 	{
-		if( ( utf8_string[ utf8_string_index ] < (uint8_t) '0' )
-		 || ( utf8_string[ utf8_string_index ] > (uint8_t) '9' ) )
+		if( ( utf16_stream[ utf16_stream_offset ] < (uint8_t) '0' )
+		 || ( utf16_stream[ utf16_stream_offset ] > (uint8_t) '9' )
+		 || ( utf16_stream[ utf16_stream_offset + 1 ] != 0 ) )
 		{
@@ -257,3 +272,3 @@ libcerror_error_set(
 		fraction_of_second *= 10;
-		fraction_of_second += utf8_string[ utf8_string_index ] - (uint8_t) '0';
+		fraction_of_second += utf16_stream[ utf16_stream_offset ] - (uint8_t) '0';
 	}
@@ -260,0 +275,0 @@ if( year < 1600 )

libfwevt/libfwevt_date_time.h

 /*
- * Date and time values functions
+ * Date and time functions
  *
@@ -22,4 +22,4 @@ * Copyright (C) 2011-2024, Joachim Metz <[e-mail]>
 
-#if !defined( _LIBFWEVT_DATE_TIME_VALUES_H )
-#define _LIBFWEVT_DATE_TIME_VALUES_H
+#if !defined( _LIBFWEVT_DATE_TIME_H )
+#define _LIBFWEVT_DATE_TIME_H
 
@@ -35,6 +35,6 @@ #include <common.h>
 
-int libfwevt_utf8_string_copy_to_filetime(
-     const uint8_t *utf8_string,
-     size_t utf8_string_size,
+int libfwevt_filetime_copy_from_utf16_stream(
      uint64_t *filetime,
+     const uint8_t *utf16_stream,
+     size_t utf16_stream_size,
      libcerror_error_t **error );
@@ -46,3 +46,3 @@
 
-#endif /* !defined( _LIBFWEVT_DATE_TIME_VALUES_H ) */
+#endif /* !defined( _LIBFWEVT_DATE_TIME_H ) */
 

libfwevt/libfwevt_definitions.h

@@ -39,7 +39,7 @@ /*
 
-#define LIBFWEVT_VERSION						20240427
+#define LIBFWEVT_VERSION						20240504
 
 /* The version string
  */
-#define LIBFWEVT_VERSION_STRING						"20240427"
+#define LIBFWEVT_VERSION_STRING						"20240504"
 
@@ -46,0 +46,0 @@ /* The byte order definitions

libfwevt/libfwevt_xml_tag.h

@@ -96,10 +96,5 @@ /*
      libfwevt_xml_tag_t *xml_tag,
-     int value_type,
+     uint8_t value_type,
      libcerror_error_t **error );
 
-int libfwevt_xml_tag_set_value_format_flags(
-     libfwevt_xml_tag_t *xml_tag,
-     uint32_t format_flags,
-     libcerror_error_t **error );
-
 int libfwevt_xml_tag_set_value_data(
@@ -109,3 +104,2 @@ libfwevt_xml_tag_t *xml_tag,
      size_t data_size,
-     int encoding,
      libcerror_error_t **error );
@@ -117,13 +111,5 @@
      size_t data_size,
-     int encoding,
-     int *value_entry_index,
+     int *data_segment_index,
      libcerror_error_t **error );
 
-ssize_t libfwevt_xml_tag_set_value_strings_array(
-         libfwevt_xml_tag_t *xml_tag,
-         const uint8_t *strings_array_data,
-         size_t strings_array_data_size,
-         int encoding,
-         libcerror_error_t **error );
-
 int libfwevt_xml_tag_append_attribute(
@@ -266,14 +252,2 @@ libfwevt_xml_tag_t *xml_tag,
 
-int libfwevt_xml_tag_get_utf8_xml_value_string_size(
-     libfwevt_internal_xml_tag_t *internal_xml_tag,
-     size_t *utf8_string_size,
-     libcerror_error_t **error );
-
-int libfwevt_xml_tag_get_utf8_xml_value_string_with_index(
-     libfwevt_internal_xml_tag_t *internal_xml_tag,
-     uint8_t *utf8_string,
-     size_t utf8_string_size,
-     size_t *utf8_string_index,
-     libcerror_error_t **error );
-
 int libfwevt_xml_tag_get_utf8_xml_string_size(
@@ -293,14 +267,2 @@ libfwevt_xml_tag_t *xml_tag,
 
-int libfwevt_xml_tag_get_utf16_xml_value_string_size(
-     libfwevt_internal_xml_tag_t *internal_xml_tag,
-     size_t *utf16_string_size,
-     libcerror_error_t **error );
-
-int libfwevt_xml_tag_get_utf16_xml_value_string_with_index(
-     libfwevt_internal_xml_tag_t *internal_xml_tag,
-     uint16_t *utf16_string,
-     size_t utf16_string_size,
-     size_t *utf16_string_index,
-     libcerror_error_t **error );
-
 int libfwevt_xml_tag_get_utf16_xml_string_size(
@@ -326,6 +288,2 @@ libfwevt_xml_tag_t *xml_tag,
 
-int libfwevt_xml_tag_debug_print_value_string(
-     libfwevt_internal_xml_tag_t *internal_xml_tag,
-     libcerror_error_t **error );
-
 int libfwevt_xml_tag_debug_print(
@@ -340,5 +298,6 @@ libfwevt_xml_tag_t *xml_tag,
 
-int libfwevt_xml_tag_value_debug_print(
+int libfwevt_xml_tag_debug_print_value_data_segment(
      libfwevt_xml_tag_t *xml_tag,
-     int value_entry_index,
+     int data_segment_index,
+     uint8_t escape_characters,
      libcerror_error_t **error );
@@ -345,0 +304,0 @@

libfwevt/libfwevt_xml_value.h

@@ -28,5 +28,7 @@ /*
 
+#include "libfwevt_data_segment.h"
 #include "libfwevt_extern.h"
+#include "libfwevt_libcdata.h"
 #include "libfwevt_libcerror.h"
-#include "libfwevt_libfvalue.h"
+#include "libfwevt_libcnotify.h"
 #include "libfwevt_types.h"
@@ -44,7 +46,11 @@
 	 */
-	int value_type;
+	uint8_t value_type;
 
-	/* The value (value)
+	/* The data segments
 	 */
-	libfvalue_value_t *value;
+	libcdata_array_t *data_segments;
+
+	/* The data size
+	 */
+	size_t data_size;
 };
@@ -54,3 +60,3 @@
      libfwevt_xml_value_t **xml_value,
-     int type,
+     uint8_t value_type,
      libcerror_error_t **error );
@@ -67,41 +73,25 @@
 
-int libfwevt_xml_value_set_data(
+int libfwevt_xml_value_get_type(
      libfwevt_xml_value_t *xml_value,
-     const uint8_t *data,
-     size_t data_size,
-     int encoding,
-     uint8_t flags,
+     uint8_t *value_type,
      libcerror_error_t **error );
 
-int libfwevt_xml_value_set_format_flags(
+int libfwevt_xml_value_get_number_of_data_segments(
      libfwevt_xml_value_t *xml_value,
-     uint32_t format_flags,
+     int *number_of_data_segments,
      libcerror_error_t **error );
 
-int libfwevt_xml_value_append_data(
+int libfwevt_internal_xml_value_get_data_segment_with_cached_value(
+     libfwevt_internal_xml_value_t *internal_xml_value,
+     int data_segment_index,
+     libfwevt_data_segment_t **data_segment,
+     libcerror_error_t **error );
+
+int libfwevt_xml_value_append_data_segment(
      libfwevt_xml_value_t *xml_value,
-     int *value_entry_index,
      const uint8_t *data,
      size_t data_size,
-     int encoding,
+     int *data_segment_index,
      libcerror_error_t **error );
 
-ssize_t libfwevt_xml_value_type_set_data_string(
-         libfwevt_xml_value_t *xml_value,
-         const uint8_t *data,
-         size_t data_size,
-         int encoding,
-         uint8_t flags,
-         libcerror_error_t **error );
-
-int libfwevt_xml_value_get_type(
-     libfwevt_xml_value_t *xml_value,
-     int *value_type,
-     libcerror_error_t **error );
-
-int libfwevt_xml_value_get_number_of_value_entries(
-     libfwevt_xml_value_t *xml_value,
-     int *number_of_value_entries,
-     libcerror_error_t **error );
-
 LIBFWEVT_EXTERN \
@@ -121,20 +111,2 @@ int libfwevt_xml_value_get_data_size(
 LIBFWEVT_EXTERN \
-int libfwevt_xml_value_copy_to_8bit(
-     libfwevt_xml_value_t *xml_value,
-     uint8_t *value_8bit,
-     libcerror_error_t **error );
-
-LIBFWEVT_EXTERN \
-int libfwevt_xml_value_copy_to_32bit(
-     libfwevt_xml_value_t *xml_value,
-     uint32_t *value_32bit,
-     libcerror_error_t **error );
-
-LIBFWEVT_EXTERN \
-int libfwevt_xml_value_copy_to_64bit(
-     libfwevt_xml_value_t *xml_value,
-     uint64_t *value_64bit,
-     libcerror_error_t **error );
-
-LIBFWEVT_EXTERN \
 int libfwevt_value_get_data_as_8bit_integer(
@@ -163,16 +135,34 @@ libfwevt_xml_value_t *xml_value,
 
-int libfwevt_xml_value_get_utf8_string_size_with_index(
-     libfwevt_xml_value_t *xml_value,
-     int value_entry_index,
+int libfwevt_internal_xml_value_get_data_segment_as_utf8_string_size(
+     libfwevt_internal_xml_value_t *internal_xml_value,
+     int data_segment_index,
+     libfwevt_data_segment_t *data_segment,
      size_t *utf8_string_size,
+     uint8_t escape_characters,
      libcerror_error_t **error );
 
-int libfwevt_xml_value_copy_to_utf8_string_with_index(
-     libfwevt_xml_value_t *xml_value,
-     int value_entry_index,
+int libfwevt_internal_xml_value_get_data_segment_as_utf8_string(
+     libfwevt_internal_xml_value_t *internal_xml_value,
+     int data_segment_index,
+     libfwevt_data_segment_t *data_segment,
      uint8_t *utf8_string,
      size_t utf8_string_size,
      size_t *utf8_string_index,
+     uint8_t escape_characters,
      libcerror_error_t **error );
 
+int libfwevt_internal_xml_value_get_data_as_utf8_string_size(
+     libfwevt_internal_xml_value_t *internal_xml_value,
+     size_t *utf8_string_size,
+     uint8_t escape_characters,
+     libcerror_error_t **error );
+
+int libfwevt_internal_xml_value_get_data_as_utf8_string_with_index(
+     libfwevt_internal_xml_value_t *internal_xml_value,
+     uint8_t *utf8_string,
+     size_t utf8_string_size,
+     size_t *utf8_string_index,
+     uint8_t escape_characters,
+     libcerror_error_t **error );
+
 LIBFWEVT_EXTERN \
@@ -191,16 +181,47 @@ int libfwevt_xml_value_get_utf8_string_size(
 
-int libfwevt_xml_value_get_utf16_string_size_with_index(
+LIBFWEVT_EXTERN \
+int libfwevt_xml_value_get_data_as_utf8_string_size(
      libfwevt_xml_value_t *xml_value,
-     int value_entry_index,
+     size_t *utf8_string_size,
+     libcerror_error_t **error );
+
+LIBFWEVT_EXTERN \
+int libfwevt_xml_value_get_data_as_utf8_string(
+     libfwevt_xml_value_t *xml_value,
+     uint8_t *utf8_string,
+     size_t utf8_string_size,
+     libcerror_error_t **error );
+
+int libfwevt_internal_xml_value_get_data_segment_as_utf16_string_size(
+     libfwevt_internal_xml_value_t *internal_xml_value,
+     int data_segment_index,
+     libfwevt_data_segment_t *data_segment,
      size_t *utf16_string_size,
+     uint8_t escape_characters,
      libcerror_error_t **error );
 
-int libfwevt_xml_value_copy_to_utf16_string_with_index(
-     libfwevt_xml_value_t *xml_value,
-     int value_entry_index,
+int libfwevt_internal_xml_value_get_data_segment_as_utf16_string(
+     libfwevt_internal_xml_value_t *internal_xml_value,
+     int data_segment_index,
+     libfwevt_data_segment_t *data_segment,
      uint16_t *utf16_string,
      size_t utf16_string_size,
      size_t *utf16_string_index,
+     uint8_t escape_characters,
      libcerror_error_t **error );
 
+int libfwevt_internal_xml_value_get_data_as_utf16_string_size(
+     libfwevt_internal_xml_value_t *internal_xml_value,
+     size_t *utf16_string_size,
+     uint8_t escape_characters,
+     libcerror_error_t **error );
+
+int libfwevt_internal_xml_value_get_data_as_utf16_string_with_index(
+     libfwevt_internal_xml_value_t *internal_xml_value,
+     uint16_t *utf16_string,
+     size_t utf16_string_size,
+     size_t *utf16_string_index,
+     uint8_t escape_characters,
+     libcerror_error_t **error );
+
 LIBFWEVT_EXTERN \
@@ -219,10 +240,28 @@ int libfwevt_xml_value_get_utf16_string_size(
 
+LIBFWEVT_EXTERN \
+int libfwevt_xml_value_get_data_as_utf16_string_size(
+     libfwevt_xml_value_t *xml_value,
+     size_t *utf16_string_size,
+     libcerror_error_t **error );
+
+LIBFWEVT_EXTERN \
+int libfwevt_xml_value_get_data_as_utf16_string(
+     libfwevt_xml_value_t *xml_value,
+     uint16_t *utf16_string,
+     size_t utf16_string_size,
+     libcerror_error_t **error );
+
 #if defined( HAVE_DEBUG_OUTPUT )
 
-int libfwevt_debug_print_xml_value(
+int libfwevt_xml_value_debug_print(
      libfwevt_xml_value_t *xml_value,
-     int value_entry_index,
-     uint8_t flags,
+     uint8_t escape_characters,
      libcerror_error_t **error );
 
+int libfwevt_xml_value_debug_print_data_segment(
+     libfwevt_xml_value_t *xml_value,
+     int data_segment_index,
+     uint8_t escape_characters,
+     libcerror_error_t **error );
+
 #endif /* defined( HAVE_DEBUG_OUTPUT ) */
@@ -229,0 +268,0 @@

libfwevt/Makefile.in

@@ -125,18 +125,22 @@ # Makefile.in generated by automake 1.16.5 from Makefile.am.
 am__libfwevt_la_SOURCES_DIST = fwevt_template.h libfwevt_channel.c \
-	libfwevt_channel.h libfwevt_date_time.c libfwevt_date_time.h \
-	libfwevt_debug.c libfwevt_debug.h libfwevt_definitions.h \
-	libfwevt_extern.h libfwevt_error.c libfwevt_error.h \
-	libfwevt_event.c libfwevt_event.h libfwevt_libcdata.h \
-	libfwevt_libcerror.h libfwevt_libcnotify.h libfwevt_libfguid.h \
-	libfwevt_libfvalue.h libfwevt_libuna.h libfwevt_keyword.c \
-	libfwevt_keyword.h libfwevt_level.c libfwevt_level.h \
-	libfwevt_manifest.c libfwevt_manifest.h libfwevt_map.c \
-	libfwevt_map.h libfwevt_notify.c libfwevt_notify.h \
-	libfwevt_opcode.c libfwevt_opcode.h libfwevt_provider.c \
-	libfwevt_provider.h libfwevt_support.c libfwevt_support.h \
-	libfwevt_task.c libfwevt_task.h libfwevt_template.c \
-	libfwevt_template.h libfwevt_template_item.c \
-	libfwevt_template_item.h libfwevt_types.h libfwevt_unused.h \
-	libfwevt_xml_document.c libfwevt_xml_document.h \
-	libfwevt_xml_tag.c libfwevt_xml_tag.h \
+	libfwevt_channel.h libfwevt_data_segment.c \
+	libfwevt_data_segment.h libfwevt_date_time.c \
+	libfwevt_date_time.h libfwevt_debug.c libfwevt_debug.h \
+	libfwevt_definitions.h libfwevt_extern.h libfwevt_error.c \
+	libfwevt_error.h libfwevt_event.c libfwevt_event.h \
+	libfwevt_floating_point.c libfwevt_floating_point.h \
+	libfwevt_integer.c libfwevt_integer.h libfwevt_libcdata.h \
+	libfwevt_libcerror.h libfwevt_libcnotify.h \
+	libfwevt_libfdatetime.h libfwevt_libfguid.h libfwevt_libfwnt.h \
+	libfwevt_libuna.h libfwevt_keyword.c libfwevt_keyword.h \
+	libfwevt_level.c libfwevt_level.h libfwevt_manifest.c \
+	libfwevt_manifest.h libfwevt_map.c libfwevt_map.h \
+	libfwevt_notify.c libfwevt_notify.h libfwevt_opcode.c \
+	libfwevt_opcode.h libfwevt_provider.c libfwevt_provider.h \
+	libfwevt_support.c libfwevt_support.h libfwevt_task.c \
+	libfwevt_task.h libfwevt_template.c libfwevt_template.h \
+	libfwevt_template_item.c libfwevt_template_item.h \
+	libfwevt_types.h libfwevt_unused.h libfwevt_xml_document.c \
+	libfwevt_xml_document.h libfwevt_xml_string.c \
+	libfwevt_xml_string.h libfwevt_xml_tag.c libfwevt_xml_tag.h \
 	libfwevt_xml_template_value.c libfwevt_xml_template_value.h \
@@ -147,5 +151,8 @@ libfwevt_xml_token.c libfwevt_xml_token.h libfwevt_xml_value.c \
 @HAVE_LOCAL_LIBFWEVT_TRUE@	libfwevt_channel.lo \
+@HAVE_LOCAL_LIBFWEVT_TRUE@	libfwevt_data_segment.lo \
 @HAVE_LOCAL_LIBFWEVT_TRUE@	libfwevt_date_time.lo \
 @HAVE_LOCAL_LIBFWEVT_TRUE@	libfwevt_debug.lo libfwevt_error.lo \
 @HAVE_LOCAL_LIBFWEVT_TRUE@	libfwevt_event.lo \
+@HAVE_LOCAL_LIBFWEVT_TRUE@	libfwevt_floating_point.lo \
+@HAVE_LOCAL_LIBFWEVT_TRUE@	libfwevt_integer.lo \
 @HAVE_LOCAL_LIBFWEVT_TRUE@	libfwevt_keyword.lo \
@@ -161,2 +168,3 @@ @HAVE_LOCAL_LIBFWEVT_TRUE@	libfwevt_level.lo \
 @HAVE_LOCAL_LIBFWEVT_TRUE@	libfwevt_xml_document.lo \
+@HAVE_LOCAL_LIBFWEVT_TRUE@	libfwevt_xml_string.lo \
 @HAVE_LOCAL_LIBFWEVT_TRUE@	libfwevt_xml_tag.lo \
@@ -188,5 +196,8 @@ @HAVE_LOCAL_LIBFWEVT_TRUE@	libfwevt_xml_template_value.lo \
 am__depfiles_remade = ./$(DEPDIR)/libfwevt_channel.Plo \
+	./$(DEPDIR)/libfwevt_data_segment.Plo \
 	./$(DEPDIR)/libfwevt_date_time.Plo \
 	./$(DEPDIR)/libfwevt_debug.Plo ./$(DEPDIR)/libfwevt_error.Plo \
 	./$(DEPDIR)/libfwevt_event.Plo \
+	./$(DEPDIR)/libfwevt_floating_point.Plo \
+	./$(DEPDIR)/libfwevt_integer.Plo \
 	./$(DEPDIR)/libfwevt_keyword.Plo \
@@ -202,2 +213,3 @@ ./$(DEPDIR)/libfwevt_level.Plo \
 	./$(DEPDIR)/libfwevt_xml_document.Plo \
+	./$(DEPDIR)/libfwevt_xml_string.Plo \
 	./$(DEPDIR)/libfwevt_xml_tag.Plo \
@@ -634,3 +646,3 @@ ./$(DEPDIR)/libfwevt_xml_template_value.Plo \
 @HAVE_LOCAL_LIBFWEVT_TRUE@	@LIBFGUID_CPPFLAGS@ \
-@HAVE_LOCAL_LIBFWEVT_TRUE@	@LIBFVALUE_CPPFLAGS@ \
+@HAVE_LOCAL_LIBFWEVT_TRUE@	@LIBFWNT_CPPFLAGS@ \
 @HAVE_LOCAL_LIBFWEVT_TRUE@	@LIBUNA_CPPFLAGS@ \
@@ -643,2 +655,3 @@ @HAVE_LOCAL_LIBFWEVT_TRUE@	@PTHREAD_CPPFLAGS@
 @HAVE_LOCAL_LIBFWEVT_TRUE@	libfwevt_channel.c libfwevt_channel.h \
+@HAVE_LOCAL_LIBFWEVT_TRUE@	libfwevt_data_segment.c libfwevt_data_segment.h \
 @HAVE_LOCAL_LIBFWEVT_TRUE@	libfwevt_date_time.c libfwevt_date_time.h \
@@ -650,7 +663,10 @@ @HAVE_LOCAL_LIBFWEVT_TRUE@	libfwevt_debug.c libfwevt_debug.h \
 @HAVE_LOCAL_LIBFWEVT_TRUE@	libfwevt_event.c libfwevt_event.h \
+@HAVE_LOCAL_LIBFWEVT_TRUE@	libfwevt_floating_point.c libfwevt_floating_point.h \
+@HAVE_LOCAL_LIBFWEVT_TRUE@	libfwevt_integer.c libfwevt_integer.h \
 @HAVE_LOCAL_LIBFWEVT_TRUE@	libfwevt_libcdata.h \
 @HAVE_LOCAL_LIBFWEVT_TRUE@	libfwevt_libcerror.h \
 @HAVE_LOCAL_LIBFWEVT_TRUE@	libfwevt_libcnotify.h \
+@HAVE_LOCAL_LIBFWEVT_TRUE@	libfwevt_libfdatetime.h \
 @HAVE_LOCAL_LIBFWEVT_TRUE@	libfwevt_libfguid.h \
-@HAVE_LOCAL_LIBFWEVT_TRUE@	libfwevt_libfvalue.h \
+@HAVE_LOCAL_LIBFWEVT_TRUE@	libfwevt_libfwnt.h \
 @HAVE_LOCAL_LIBFWEVT_TRUE@	libfwevt_libuna.h \
@@ -671,2 +687,3 @@ @HAVE_LOCAL_LIBFWEVT_TRUE@	libfwevt_keyword.c libfwevt_keyword.h \
 @HAVE_LOCAL_LIBFWEVT_TRUE@	libfwevt_xml_document.c libfwevt_xml_document.h \
+@HAVE_LOCAL_LIBFWEVT_TRUE@	libfwevt_xml_string.c libfwevt_xml_string.h \
 @HAVE_LOCAL_LIBFWEVT_TRUE@	libfwevt_xml_tag.c libfwevt_xml_tag.h \
@@ -736,2 +753,3 @@ @HAVE_LOCAL_LIBFWEVT_TRUE@	libfwevt_xml_template_value.c libfwevt_xml_template_value.h \
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libfwevt_channel.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libfwevt_data_segment.Plo@am__quote@ # am--include-marker
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libfwevt_date_time.Plo@am__quote@ # am--include-marker
@@ -741,2 +759,4 @@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libfwevt_debug.Plo@am__quote@ # am--include-marker
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libfwevt_event.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libfwevt_floating_point.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libfwevt_integer.Plo@am__quote@ # am--include-marker
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libfwevt_keyword.Plo@am__quote@ # am--include-marker
@@ -754,2 +774,3 @@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libfwevt_level.Plo@am__quote@ # am--include-marker
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libfwevt_xml_document.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libfwevt_xml_string.Plo@am__quote@ # am--include-marker
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libfwevt_xml_tag.Plo@am__quote@ # am--include-marker
@@ -921,2 +942,3 @@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libfwevt_xml_template_value.Plo@am__quote@ # am--include-marker
 		-rm -f ./$(DEPDIR)/libfwevt_channel.Plo
+	-rm -f ./$(DEPDIR)/libfwevt_data_segment.Plo
 	-rm -f ./$(DEPDIR)/libfwevt_date_time.Plo
@@ -926,2 +948,4 @@ -rm -f ./$(DEPDIR)/libfwevt_debug.Plo
 	-rm -f ./$(DEPDIR)/libfwevt_event.Plo
+	-rm -f ./$(DEPDIR)/libfwevt_floating_point.Plo
+	-rm -f ./$(DEPDIR)/libfwevt_integer.Plo
 	-rm -f ./$(DEPDIR)/libfwevt_keyword.Plo
@@ -939,2 +963,3 @@ -rm -f ./$(DEPDIR)/libfwevt_level.Plo
 	-rm -f ./$(DEPDIR)/libfwevt_xml_document.Plo
+	-rm -f ./$(DEPDIR)/libfwevt_xml_string.Plo
 	-rm -f ./$(DEPDIR)/libfwevt_xml_tag.Plo
@@ -990,2 +1015,3 @@ -rm -f ./$(DEPDIR)/libfwevt_xml_template_value.Plo
 		-rm -f ./$(DEPDIR)/libfwevt_channel.Plo
+	-rm -f ./$(DEPDIR)/libfwevt_data_segment.Plo
 	-rm -f ./$(DEPDIR)/libfwevt_date_time.Plo
@@ -995,2 +1021,4 @@ -rm -f ./$(DEPDIR)/libfwevt_debug.Plo
 	-rm -f ./$(DEPDIR)/libfwevt_event.Plo
+	-rm -f ./$(DEPDIR)/libfwevt_floating_point.Plo
+	-rm -f ./$(DEPDIR)/libfwevt_integer.Plo
 	-rm -f ./$(DEPDIR)/libfwevt_keyword.Plo
@@ -1008,2 +1036,3 @@ -rm -f ./$(DEPDIR)/libfwevt_level.Plo
 	-rm -f ./$(DEPDIR)/libfwevt_xml_document.Plo
+	-rm -f ./$(DEPDIR)/libfwevt_xml_string.Plo
 	-rm -f ./$(DEPDIR)/libfwevt_xml_tag.Plo
@@ -1010,0 +1039,0 @@ -rm -f ./$(DEPDIR)/libfwevt_xml_template_value.Plo

PKG-INFO

 Metadata-Version: 2.1
 Name: libevtx-python
-Version: 20240427
+Version: 20240504
 Summary: Python bindings module for libevtx
@@ -5,0 +5,0 @@ Author: Joachim Metz

pyevtx/pyevtx_record.c

@@ -125,2 +125,9 @@ /*
 
+	{ "get_channel_name",
+	  (PyCFunction) pyevtx_record_get_channel_name,
+	  METH_NOARGS,
+	  "get_channel_name() -> Unicode string or None\n"
+	  "\n"
+	  "Retrieves the channel name." },
+
 	{ "get_computer_name",
@@ -234,2 +241,8 @@ (PyCFunction) pyevtx_record_get_computer_name,
 
+	{ "channel_name",
+	  (getter) pyevtx_record_get_channel_name,
+	  (setter) 0,
+	  "The channel name.",
+	  NULL },
+
 	{ "computer_name",
@@ -1356,2 +1369,123 @@ (getter) pyevtx_record_get_computer_name,
 
+/* Retrieves the channel name
+ * Returns a Python object if successful or NULL on error
+ */
+PyObject *pyevtx_record_get_channel_name(
+           pyevtx_record_t *pyevtx_record,
+           PyObject *arguments PYEVTX_ATTRIBUTE_UNUSED )
+{
+	PyObject *string_object  = NULL;
+	libcerror_error_t *error = NULL;
+	static char *function    = "pyevtx_record_get_channel_name";
+	char *utf8_string        = NULL;
+	size_t utf8_string_size  = 0;
+	int result               = 0;
+
+	PYEVTX_UNREFERENCED_PARAMETER( arguments )
+
+	if( pyevtx_record == NULL )
+	{
+		PyErr_Format(
+		 PyExc_ValueError,
+		 "%s: invalid record.",
+		 function );
+
+		return( NULL );
+	}
+	Py_BEGIN_ALLOW_THREADS
+
+	result = libevtx_record_get_utf8_channel_name_size(
+	          pyevtx_record->record,
+	          &utf8_string_size,
+	          &error );
+
+	Py_END_ALLOW_THREADS
+
+	if( result == -1 )
+	{
+		pyevtx_error_raise(
+		 error,
+		 PyExc_IOError,
+		 "%s: unable to determine size of channel name as UTF-8 string.",
+		 function );
+
+		libcerror_error_free(
+		 &error );
+
+		goto on_error;
+	}
+	else if( ( result == 0 )
+	      || ( utf8_string_size == 0 ) )
+	{
+		Py_IncRef(
+		 Py_None );
+
+		return( Py_None );
+	}
+	utf8_string = (char *) PyMem_Malloc(
+	                        sizeof( char ) * utf8_string_size );
+
+	if( utf8_string == NULL )
+	{
+		PyErr_Format(
+		 PyExc_MemoryError,
+		 "%s: unable to create UTF-8 string.",
+		 function );
+
+		goto on_error;
+	}
+	Py_BEGIN_ALLOW_THREADS
+
+	result = libevtx_record_get_utf8_channel_name(
+	          pyevtx_record->record,
+	          (uint8_t *) utf8_string,
+	          utf8_string_size,
+	          &error );
+
+	Py_END_ALLOW_THREADS
+
+	if( result != 1 )
+	{
+		pyevtx_error_raise(
+		 error,
+		 PyExc_IOError,
+		 "%s: unable to retrieve channel name as UTF-8 string.",
+		 function );
+
+		libcerror_error_free(
+		 &error );
+
+		goto on_error;
+	}
+	/* Pass the string length to PyUnicode_DecodeUTF8 otherwise it makes
+	 * the end of string character is part of the string
+	 */
+	string_object = PyUnicode_DecodeUTF8(
+	                 utf8_string,
+	                 (Py_ssize_t) utf8_string_size - 1,
+	                 NULL );
+
+	if( string_object == NULL )
+	{
+		PyErr_Format(
+		 PyExc_IOError,
+		 "%s: unable to convert UTF-8 string into Unicode object.",
+		 function );
+
+		goto on_error;
+	}
+	PyMem_Free(
+	 utf8_string );
+
+	return( string_object );
+
+on_error:
+	if( utf8_string != NULL )
+	{
+		PyMem_Free(
+		 utf8_string );
+	}
+	return( NULL );
+}
+
 /* Retrieves the computer name
@@ -1358,0 +1492,0 @@ * Returns a Python object if successful or NULL on error

pyevtx/pyevtx_record.h

@@ -113,2 +113,6 @@ /*
 
+PyObject *pyevtx_record_get_channel_name(
+           pyevtx_record_t *pyevtx_record,
+           PyObject *arguments );
+
 PyObject *pyevtx_record_get_computer_name(
@@ -115,0 +119,0 @@ pyevtx_record_t *pyevtx_record,

setup.cfg

 [metadata]
 name = libevtx-python
-version = 20240427
+version = 20240504
 description = Python bindings module for libevtx
@@ -5,0 +5,0 @@ long_description = Python bindings module for libevtx

libfwevt/libfwevt_libfvalue.h

-/*
- * The libfvalue header wrapper
- *
- * Copyright (C) 2011-2024, Joachim Metz <[e-mail]>
- *
- * Refer to AUTHORS for acknowledgements.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Lesser General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public License
- * along with this program.  If not, see <https://www.gnu.org/licenses/>.
- */
-
-#if !defined( _LIBFWEVT_LIBFVALUE_H )
-#define _LIBFWEVT_LIBFVALUE_H
-
-#include <common.h>
-
-/* Define HAVE_LOCAL_LIBFVALUE for local use of libfvalue
- */
-#if defined( HAVE_LOCAL_LIBFVALUE )
-
-#include <libfvalue_codepage.h>
-#include <libfvalue_data_handle.h>
-#include <libfvalue_definitions.h>
-#include <libfvalue_floating_point.h>
-#include <libfvalue_integer.h>
-#include <libfvalue_split_utf16_string.h>
-#include <libfvalue_split_utf8_string.h>
-#include <libfvalue_string.h>
-#include <libfvalue_table.h>
-#include <libfvalue_types.h>
-#include <libfvalue_value.h>
-#include <libfvalue_value_type.h>
-#include <libfvalue_utf16_string.h>
-#include <libfvalue_utf8_string.h>
-
-#else
-
-/* If libtool DLL support is enabled set LIBFVALUE_DLL_IMPORT
- * before including libfvalue.h
- */
-#if defined( _WIN32 ) && defined( DLL_IMPORT )
-#define LIBFVALUE_DLL_IMPORT
-#endif
-
-#include <libfvalue.h>
-
-#endif /* defined( HAVE_LOCAL_LIBFVALUE ) */
-
-#endif /* !defined( _LIBFWEVT_LIBFVALUE_H ) */
-

Alert delta unavailable

Currently unable to show alert delta for PyPI packages.

Improved metrics

Total package byte prevSize

15864376

0.82%

Number of package files

1156

0.78%