尝试读取evtx文件时出现编译器错误

Compiler error while trying to read evtx file?

本文关键字:编译器 错误 文件 读取 evtx      更新时间:2023-10-16

我得到编译器错误_T标识符未找到。。请帮我解决这个错误??我也想用C语言制作这个程序??但首先解决错误,这样我就可以调试和观察流程了??在VS 2008 上编译

#include <iostream>
#include <fstream>
using namespace std;
typedef unsigned long ULONG;
typedef struct _EVENTLOGHEADER {
ULONG HeaderSize;
ULONG Signature;
ULONG MajorVersion;
ULONG MinorVersion;
ULONG StartOffset;
ULONG EndOffset;
ULONG CurrentRecordNumber;
ULONG OldestRecordNumber;
ULONG MaxSize;
ULONG Flags;
ULONG Retention;
ULONG EndHeaderSize;
} EVENTLOGHEADER, *PEVENTLOGHEADER;  
typedef unsigned long DWORD;
typedef unsigned short WORD;
typedef struct _EVENTLOGRECORD {
    DWORD Length;
    DWORD Reserved;
    DWORD RecordNumber;
    DWORD TimeGenerated;
    DWORD TimeWritten;
    DWORD EventID;
    WORD  EventType;
    WORD  NumStrings;
    WORD  EventCategory;
    WORD  ReservedFlags;
    DWORD ClosingRecordNumber;
    DWORD StringOffset;
    DWORD UserSidLength;
    DWORD UserSidOffset;
    DWORD DataLength;
    DWORD DataOffset;
} EVENTLOGRECORD, *PEVENTLOGRECORD;
void main()
{
    ifstream file;
    file.open("C:WindowsSystem32winevtLogs\Application.evtx",ios::in|ios::binary);
    if(file.is_open()){
        _EVENTLOGHEADER logheader;
        _EVENTLOGRECORD logRecord;
        //Reading the header
        file.read((char*)&logheader,sizeof(_EVENTLOGHEADER));
        int startOfLog;
        //Loop on every record
        for(unsigned int numberFile=0;numberFile < logheader.CurrentRecordNumber -1;numberFile++){
            //Save the position
            startOfLog = file.tellg();
            //Read log record
            file.read((char*)&logRecord,sizeof(_EVENTLOGRECORD));
            /*******************************************************
            Here are the other information (section 'Remarks' on the 'EVENTLOGRECORD structure' link 
            ********************************************************/
            //Reading sourcename
            wchar_t buffData;
            wstring SourceName;
            file.read((char*)&buffData,sizeof(wchar_t));
            while(buffData!=_T('')){
                SourceName.push_back(buffData);
                file.read((char*)&buffData,sizeof(wchar_t));
            }
            //Reading computer name
            wstring ComputerName;
            file.read((char*)&buffData,sizeof(wchar_t));
            while(buffData!=_T('')){
                ComputerName.push_back(buffData);
                file.read((char*)&buffData,sizeof(wchar_t));
            }
            //Sets the position to the SID offset 
            int readCursor = startOfLog + logRecord.UserSidOffset;
            file.seekg(readCursor);
            char * userSid = NULL;
            if(logRecord.UserSidLength != 0)
            {
                userSid = (PCHAR)malloc(logRecord.UserSidLength);
                file.read(userSid,logRecord.UserSidLength); //Reading the sid
                //Here you can work on the SiD (but you need win32 API).If you need it, I could show you how i deal with this sid 
                free(userSid);
            }
            //Sets the position to the Strings offset
            readCursor = startOfLog + logRecord.StringOffset;
            file.seekg(readCursor);
            wstring buffString;
            vector<wstring> allStrings;
            //Reading all the strings
            for(int i=0; i< logRecord.NumStrings; i++) {
                file.read((char*)&buffData,sizeof(wchar_t));
                while(buffData!=_T('')){
                    buffString.push_back(buffData);
                    file.read((char*)&buffData,sizeof(wchar_t));
                }
                allStrings.push_back(buffString);
                buffString.clear();
            }
            //Sets the position to the Data offset
            readCursor = startOfLog + logRecord.DataOffset;
            file.seekg(readCursor);
            unsigned char *Data = (unsigned char *)malloc(logRecord.DataLength*sizeof(unsigned char));
            file.read((char*)Data,logRecord.DataLength); //Lecture des données
            //Sets the position to the end of log offset
            readCursor = startOfLog + logRecord.Length - sizeof(DWORD) ;
            file.seekg(readCursor);
            DWORD length;
            file.read((char*)&length,sizeof(DWORD));
            //Do what you want with the log record
            //Clean before reading next log
            ComputerName.clear();
            SourceName.clear();
            allStrings.clear();
            free(Data);
    }
}
}

_T是一种特定于Windows的方法,用于指定窄字符常量/字符串文字、宽字符常量/串文字,具体取决于项目设置。它需要适当的#include指令,而这些指令在代码中不存在,它不是编译器定义的宏。

但是,您不需要它。您在while(buffData!=_T(''))中使用它,但buffData的类型为wchar_t,与项目设置无关。在这种情况下,只需使用一个宽字符常量:L''

_T宏是在Tchar.h中定义的,因此您似乎只需要包含该标头。

也就是说,您编写的代码似乎不能同时作为ANSI和Unicode的编译器,因此停止使用TCHAR并在宽字符前加上L会更有意义。因此,与其写_T(''),不如写L'',甚至只是普通的旧0