grokevt-ripdll(1)

Usage

grokevt-ripdll input-dll output-db

Overview

grokevt-ripdll parses a PE-formatted file (modern .exe and .dll files are examples PE-formatted files) and extracts all message resources. These resources are then stored in a Berkeley-style database file, which maps relative virtual addresses (RVAs) to the message resources themselves. These RVAs are what can be found in a windows event log file (.evt extension) to reference the proper message resource. This utility is not intended to be used directly by end-users. It is used by grokevt-builddb(1) to extract resources from all DLL/EXEs referenced in the registry.

Arguments

input-dll: This is the PE formatted file to extract resources from. (It doesn't need to have a .dll extension, but it is most commonly used on DLLs.)

output-db: The database file to store the RVA->message mapping in. If this file already exists, it will be overwritten. To extract the entries stored in this database, see grokevt-dumpmsgs(1).

Credits

Original PE header code borrowed from the pymavis project. For more information, see:

FC
          http://www.mplayerhq.hu/~arpi/pymavis/
        F[0]

Message resource parsing added by Timothy D. Morgan.

Releases

9 releases since Debian 5.0 (Lenny); the text changed 2 times.

grokevt(7) a collection of scripts built for reading windows event log files. grokevt-addlog(1) A tool for adding a raw event log to an existing GrokEVT database. grokevt-builddb(1) Builds a database tree based on a single windows system for the purpose of event log conversion. grokevt-dumpmsgs(1) A tool for dumping the contents of message databases built previously by grokevt-ripdll(1). grokevt-findlogs(1) Attempts to find log file fragments in raw binary files, such as memory dumps and disk images. grokevt-parselog(1) Parse a windows event log and generate human-readable output based on message resources stored in a database.

Referred to by

grokevt-addlog(1) A tool for adding a raw event log to an existing GrokEVT database. grokevt-builddb(1) Builds a database tree based on a single windows system for the purpose of event log conversion. grokevt-dumpmsgs(1) A tool for dumping the contents of message databases built previously by grokevt-ripdll(1). grokevt-findlogs(1) Attempts to find log file fragments in raw binary files, such as memory dumps and disk images. grokevt-parselog(1) Parse a windows event log and generate human-readable output based on message resources stored in a database. grokevt(7) a collection of scripts built for reading windows event log files.