grokevt-dumpmsgs(1)

Usage

grokevt-dumpmsgs message-db1 [message-db2 ...]

Overview

grokevt-dumpmsgs takes one or more message databases previously built with grokevt-ripdll(1) and prints out all entries to stdout. This is mainly a debugging tool, but may be useful for analyzing the message contents of PE files while developing other applications.

Arguments

grokevt-dumpmsgs uses the following arguments:

message-dbN: If multiple message databases are supplied, entries of all databases are printed to stdout in the order they are provided.

Outout

grokevt-dumpmsgs prints each database entry out on a single line, in two comma-separated columns. The first column is the message ID, which is in the format:

FC
          XXXX-YYYYYYYY
        F[0]

Here, XXXX represents the message's language code, and the YYYYYYYY represents the message's relative virtual address (RVA) within the message block of the PE file. The second column contains the message itself. Messages containing special characters (such as newlines or commas) are encoded in the same manner that grokevt-parselog(1) encodes them ("%XX" where XX is the hexadecimal value of the character).

Credits

Written by Timothy D. Morgan.

Releases

9 releases since Debian 5.0 (Lenny); the text changed 2 times.

grokevt(7) a collection of scripts built for reading windows event log files. grokevt-addlog(1) A tool for adding a raw event log to an existing GrokEVT database. grokevt-builddb(1) Builds a database tree based on a single windows system for the purpose of event log conversion. grokevt-findlogs(1) Attempts to find log file fragments in raw binary files, such as memory dumps and disk images. grokevt-parselog(1) Parse a windows event log and generate human-readable output based on message resources stored in a database. grokevt-ripdll(1) A tool for extracting message resources from a PE-formatted file.

Referred to by

grokevt-addlog(1) A tool for adding a raw event log to an existing GrokEVT database. grokevt-ripdll(1) A tool for extracting message resources from a PE-formatted file. grokevt-builddb(1) Builds a database tree based on a single windows system for the purpose of event log conversion. grokevt-findlogs(1) Attempts to find log file fragments in raw binary files, such as memory dumps and disk images. grokevt-parselog(1) Parse a windows event log and generate human-readable output based on message resources stored in a database.