janstarke / bodyfile

Parser and Generator for the famous `mactime` bodyfile format

Hi there 👋

• 🔭 I’m currently working on ...

  • https://github.com/janstarke/pbc4rust
  • https://github.com/janstarke/evtx2bodyfile
  • https://github.com/janstarke/regview

• 🌱 I’m currently learning ...

  • The Rust programming language
  • the mathematics behind paring based cryptography

• 💬 Ask me about ...

  • Software technology (especially coding)
  • Digital forensics

Visit me at https://janstarke.github.io/

bodyfile's Issues

bodyfile parser error: IllegalUid

when the following data:

0|{"activity_id":null,"channel_name":"Windows PowerShell","custom_data":{"EventData":{"Binary":null,"Data":{"#text":["Function","Started","\tProviderName=Function\r\n\tNewProviderState=Started\r\n\r\n\tSequenceNumber=9\r\n\r\n\tHostName=ConsoleHost\r\n\tHostVersion=5.1.19041.1320\r\n\tHostId=12fb1550-f49d-40b7-87d2-73ddcc759951\r\n\tHostApplication=C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\PowerShell.exe -NoLogo -Noninteractive -NoProfile -ExecutionPolicy Bypass & 'C:\\WINDOWS\\CCM\\SystemTemp\\c84ad3ec-850b-4d5d-a8e3-ccaf990d2e10.ps1'\r\n\tEngineVersion=\r\n\tRunspaceId=\r\n\tPipelineId=\r\n\tCommandName=\r\n\tCommandType=\r\n\tScriptName=\r\n\tCommandPath=\r\n\tCommandLine="]}}},"event_id":600,"event_record_id":11278,"provider_name":"PowerShell"}|0||0|0|0|-1|1647260786|-1|-1
0|{"activity_id":null,"channel_name":"Windows PowerShell","custom_data":{"EventData":{"Binary":null,"Data":{"#text":["Variable","Started","\tProviderName=Variable\r\n\tNewProviderState=Started\r\n\r\n\tSequenceNumber=11\r\n\r\n\tHostName=ConsoleHost\r\n\tHostVersion=5.1.19041.1320\r\n\tHostId=12fb1550-f49d-40b7-87d2-73ddcc759951\r\n\tHostApplication=C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\PowerShell.exe -NoLogo -Noninteractive -NoProfile -ExecutionPolicy Bypass & 'C:\\WINDOWS\\CCM\\SystemTemp\\c84ad3ec-850b-4d5d-a8e3-ccaf990d2e10.ps1'\r\n\tEngineVersion=\r\n\tRunspaceId=\r\n\tPipelineId=\r\n\tCommandName=\r\n\tCommandType=\r\n\tScriptName=\r\n\tCommandPath=\r\n\tCommandLine="]}}},"event_id":600,"event_record_id":11279,"provider_name":"PowerShell"}|0||0|0|0|-1|1647260786|-1|-1
0|{"activity_id":null,"channel_name":"Windows PowerShell","custom_data":{"EventData":{"Binary":null,"Data":{"#text":["Available","None","\tNewEngineState=Available\r\n\tPreviousEngineState=None\r\n\r\n\tSequenceNumber=13\r\n\r\n\tHostName=ConsoleHost\r\n\tHostVersion=5.1.19041.1320\r\n\tHostId=12fb1550-f49d-40b7-87d2-73ddcc759951\r\n\tHostApplication=C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\PowerShell.exe -NoLogo -Noninteractive -NoProfile -ExecutionPolicy Bypass & 'C:\\WINDOWS\\CCM\\SystemTemp\\c84ad3ec-850b-4d5d-a8e3-ccaf990d2e10.ps1'\r\n\tEngineVersion=5.1.19041.1320\r\n\tRunspaceId=9e5bfb08-c8c3-4168-a1a3-46bc1f6aed98\r\n\tPipelineId=\r\n\tCommandName=\r\n\tCommandType=\r\n\tScriptName=\r\n\tCommandPath=\r\n\tCommandLine="]}}},"event_id":400,"event_record_id":11280,"provider_name":"PowerShell"}|0||0|0|0|-1|1647260786|-1|-1
0|{"activity_id":null,"channel_name":"Windows PowerShell","custom_data":{"EventData":{"Binary":null,"Data":{"#text":["Stopped","Available","\tNewEngineState=Stopped\r\n\tPreviousEngineState=Available\r\n\r\n\tSequenceNumber=15\r\n\r\n\tHostName=ConsoleHost\r\n\tHostVersion=5.1.19041.1320\r\n\tHostId=12fb1550-f49d-40b7-87d2-73ddcc759951\r\n\tHostApplication=C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\PowerShell.exe -NoLogo -Noninteractive -NoProfile -ExecutionPolicy Bypass & 'C:\\WINDOWS\\CCM\\SystemTemp\\c84ad3ec-850b-4d5d-a8e3-ccaf990d2e10.ps1'\r\n\tEngineVersion=5.1.19041.1320\r\n\tRunspaceId=9e5bfb08-c8c3-4168-a1a3-46bc1f6aed98\r\n\tPipelineId=\r\n\tCommandName=\r\n\tCommandType=\r\n\tScriptName=\r\n\tCommandPath=\r\n\tCommandLine="]}}},"event_id":403,"event_record_id":11281,"provider_name":"PowerShell"}|0||0|0|0|-1|1647260787|-1|-1
0|{"activity_id":null,"channel_name":"Windows PowerShell","custom_data":{"EventData":{"Binary":null,"Data":{"#text":["Registry","Started","\tProviderName=Registry\r\n\tNewProviderState=Started\r\n\r\n\tSequenceNumber=1\r\n\r\n\tHostName=ConsoleHost\r\n\tHostVersion=5.1.19041.1320\r\n\tHostId=d6f4e1cd-f910-4cbb-8942-03db9969b70c\r\n\tHostApplication=C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\PowerShell.exe -NoLogo -Noninteractive -NoProfile -ExecutionPolicy Bypass & 'C:\\WINDOWS\\CCM\\SystemTemp\\92002c24-17b2-4a94-9a27-8254b4ace281.ps1'\r\n\tEngineVersion=\r\n\tRunspaceId=\r\n\tPipelineId=\r\n\tCommandName=\r\n\tCommandType=\r\n\tScriptName=\r\n\tCommandPath=\r\n\tCommandLine="]}}},"event_id":600,"event_record_id":11282,"provider_name":"PowerShell"}|0||0|0|0|-1|1647261716|-1|-1
0|{"activity_id":null,"channel_name":"Windows PowerShell","custom_data":{"EventData":{"Binary":null,"Data":{"#text":["Alias","Started","\tProviderName=Alias\r\n\tNewProviderState=Started\r\n\r\n\tSequenceNumber=3\r\n\r\n\tHostName=ConsoleHost\r\n\tHostVersion=5.1.19041.1320\r\n\tHostId=d6f4e1cd-f910-4cbb-8942-03db9969b70c\r\n\tHostApplication=C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\PowerShell.exe -NoLogo -Noninteractive -NoProfile -ExecutionPolicy Bypass & 'C:\\WINDOWS\\CCM\\SystemTemp\\92002c24-17b2-4a94-9a27-8254b4ace281.ps1'\r\n\tEngineVersion=\r\n\tRunspaceId=\r\n\tPipelineId=\r\n\tCommandName=\r\n\tCommandType=\r\n\tScriptName=\r\n\tCommandPath=\r\n\tCommandLine="]}}},"event_id":600,"event_record_id":11283,"provider_name":"PowerShell"}|0||0|0|0|-1|1647261716|-1|-1
0|{"activity_id":null,"channel_name":"Windows PowerShell","custom_data":{"EventData":{"Binary":null,"Data":{"#text":["Environment","Started","\tProviderName=Environment\r\n\tNewProviderState=Started\r\n\r\n\tSequenceNumber=5\r\n\r\n\tHostName=ConsoleHost\r\n\tHostVersion=5.1.19041.1320\r\n\tHostId=d6f4e1cd-f910-4cbb-8942-03db9969b70c\r\n\tHostApplication=C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\PowerShell.exe -NoLogo -Noninteractive -NoProfile -ExecutionPolicy Bypass & 'C:\\WINDOWS\\CCM\\SystemTemp\\92002c24-17b2-4a94-9a27-8254b4ace281.ps1'\r\n\tEngineVersion=\r\n\tRunspaceId=\r\n\tPipelineId=\r\n\tCommandName=\r\n\tCommandType=\r\n\tScriptName=\r\n\tCommandPath=\r\n\tCommandLine="]}}},"event_id":600,"event_record_id":11284,"provider_name":"PowerShell"}|0||0|0|0|-1|1647261716|-1|-1
0|{"activity_id":null,"channel_name":"Windows PowerShell","custom_data":{"EventData":{"Binary":null,"Data":{"#text":["FileSystem","Started","\tProviderName=FileSystem\r\n\tNewProviderState=Started\r\n\r\n\tSequenceNumber=7\r\n\r\n\tHostName=ConsoleHost\r\n\tHostVersion=5.1.19041.1320\r\n\tHostId=d6f4e1cd-f910-4cbb-8942-03db9969b70c\r\n\tHostApplication=C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\PowerShell.exe -NoLogo -Noninteractive -NoProfile -ExecutionPolicy Bypass & 'C:\\WINDOWS\\CCM\\SystemTemp\\92002c24-17b2-4a94-9a27-8254b4ace281.ps1'\r\n\tEngineVersion=\r\n\tRunspaceId=\r\n\tPipelineId=\r\n\tCommandName=\r\n\tCommandType=\r\n\tScriptName=\r\n\tCommandPath=\r\n\tCommandLine="]}}},"event_id":600,"event_record_id":11285,"provider_name":"PowerShell"}|0||0|0|0|-1|1647261716|-1|-1
0|{"activity_id":null,"channel_name":"Windows PowerShell","custom_data":{"EventData":{"Binary":null,"Data":{"#text":["Function","Started","\tProviderName=Function\r\n\tNewProviderState=Started\r\n\r\n\tSequenceNumber=9\r\n\r\n\tHostName=ConsoleHost\r\n\tHostVersion=5.1.19041.1320\r\n\tHostId=d6f4e1cd-f910-4cbb-8942-03db9969b70c\r\n\tHostApplication=C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\PowerShell.exe -NoLogo -Noninteractive -NoProfile -ExecutionPolicy Bypass & 'C:\\WINDOWS\\CCM\\SystemTemp\\92002c24-17b2-4a94-9a27-8254b4ace281.ps1'\r\n\tEngineVersion=\r\n\tRunspaceId=\r\n\tPipelineId=\r\n\tCommandName=\r\n\tCommandType=\r\n\tScriptName=\r\n\tCommandPath=\r\n\tCommandLine="]}}},"event_id":600,"event_record_id":11286,"provider_name":"PowerShell"}|0||0|0|0|-1|1647261716|-1|-1
0|{"activity_id":null,"channel_name":"Windows PowerShell","custom_data":{"EventData":{"Binary":null,"Data":{"#text":["Variable","Started","\tProviderName=Variable\r\n\tNewProviderState=Started\r\n\r\n\tSequenceNumber=11\r\n\r\n\tHostName=ConsoleHost\r\n\tHostVersion=5.1.19041.1320\r\n\tHostId=d6f4e1cd-f910-4cbb-8942-03db9969b70c\r\n\tHostApplication=C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\PowerShell.exe -NoLogo -Noninteractive -NoProfile -ExecutionPolicy Bypass & 'C:\\WINDOWS\\CCM\\SystemTemp\\92002c24-17b2-4a94-9a27-8254b4ace281.ps1'\r\n\tEngineVersion=\r\n\tRunspaceId=\r\n\tPipelineId=\r\n\tCommandName=\r\n\tCommandType=\r\n\tScriptName=\r\n\tCommandPath=\r\n\tCommandLine="]}}},"event_id":600,"event_record_id":11287,"provider_name":"PowerShell"}|0||0|0|0|-1|1647261716|-1|-1
0|{"activity_id":null,"channel_name":"Windows PowerShell","custom_data":{"EventData":{"Binary":null,"Data":{"#text":["Available","None","\tNewEngineState=Available\r\n\tPreviousEngineState=None\r\n\r\n\tSequenceNumber=13\r\n\r\n\tHostName=ConsoleHost\r\n\tHostVersion=5.1.19041.1320\r\n\tHostId=d6f4e1cd-f910-4cbb-8942-03db9969b70c\r\n\tHostApplication=C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\PowerShell.exe -NoLogo -Noninteractive -NoProfile -ExecutionPolicy Bypass & 'C:\\WINDOWS\\CCM\\SystemTemp\\92002c24-17b2-4a94-9a27-8254b4ace281.ps1'\r\n\tEngineVersion=5.1.19041.1320\r\n\tRunspaceId=ce9032de-e9c5-46cd-901c-ac7b12ef775f\r\n\tPipelineId=\r\n\tCommandName=\r\n\tCommandType=\r\n\tScriptName=\r\n\tCommandPath=\r\n\tCommandLine="]}}},"event_id":400,"event_record_id":11288,"provider_name":"PowerShell"}|0||0|0|0|-1|1647261716|-1|-1
0|{"activity_id":null,"channel_name":"Windows PowerShell","custom_data":{"EventData":{"Binary":null,"Data":{"#text":["Stopped","Available","\tNewEngineState=Stopped\r\n\tPreviousEngineState=Available\r\n\r\n\tSequenceNumber=15\r\n\r\n\tHostName=ConsoleHost\r\n\tHostVersion=5.1.19041.1320\r\n\tHostId=d6f4e1cd-f910-4cbb-8942-03db9969b70c\r\n\tHostApplication=C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\PowerShell.exe -NoLogo -Noninteractive -NoProfile -ExecutionPolicy Bypass & 'C:\\WINDOWS\\CCM\\SystemTemp\\92002c24-17b2-4a94-9a27-8254b4ace281.ps1'\r\n\tEngineVersion=5.1.19041.1320\r\n\tRunspaceId=ce9032de-e9c5-46cd-901c-ac7b12ef775f\r\n\tPipelineId=\r\n\tCommandName=\r\n\tCommandType=\r\n\tScriptName=\r\n\tCommandPath=\r\n\tCommandLine="]}}},"event_id":403,"event_record_id":11289,"provider_name":"PowerShell"}|0||0|0|0|-1|1647261716|-1|-1
0|{"activity_id":null,"channel_name":"Windows PowerShell","custom_data":{"EventData":{"Binary":null,"Data":{"#text":["Registry","Started","\tProviderName=Registry\r\n\tNewProviderState=Started\r\n\r\n\tSequenceNumber=1\r\n\r\n\tHostName=ConsoleHost\r\n\tHostVersion=5.1.19041.1320\r\n\tHostId=e04060c8-1f2f-4a10-994b-4e3cfbb1c323\r\n\tHostApplication=C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\PowerShell.exe -NoLogo -Noninteractive -NoProfile -ExecutionPolicy Bypass & 'C:\\WINDOWS\\CCM\\SystemTemp\\e3428e80-41fb-4a90-a9df-a3bb372c9a0b.ps1'\r\n\tEngineVersion=\r\n\tRunspaceId=\r\n\tPipelineId=\r\n\tCommandName=\r\n\tCommandType=\r\n\tScriptName=\r\n\tCommandPath=\r\n\tCommandLine="]}}},"event_id":600,"event_record_id":11290,"provider_name":"PowerShell"}|0||0|0|0|-1|1647261717|-1|-1