mandiant / goauditparser Goto Github PK

This is going to be SUPER useful, but, I can't seem to get it to work. I downloaded the binary from the portal, acquired a Comprehensive mans file from the HX and tried all the options, but just going with the simplest one here -

To make it easier to try and get it to work I renamed the file to Comp.mans. (I tried it without renaming and same memory error).

and this always give me --

"""
[+] Extracting archives: |----------| 0/1 0% [elapsed: 00:00 left: 00:00, NaN iters/sec]panic: runtime error: invalid memory address or nil pointer dereference
[signal 0xc0000005 code=0x0 addr=0x18 pc=0x56ab36]

goroutine 19 [running]:
github.com/fireeye/goauditparser.GoAuditExtract_Thread(0x651b40, 0xc000144c40, 0x5d7941, 0x1, 0xc000012580, 0x37, 0xc00000af60, 0x5, 0x10100, 0xc00001acc0, ...)
D:/Exclusions/Programming/GoLang/src/github.com/fireeye/goauditparser/extractor.go:230 +0x366
created by github.com/fireeye/goauditparser.GoAuditExtract_Start
D:/Exclusions/Programming/GoLang/src/github.com/fireeye/goauditparser/extractor.go:139 +0x2fd
"""

If I can just get this to extract the timeline and the audits... that would be huge.

I tried these diff combinations, placing the files in all different areas.
GoAuditParser_Win.exe -i Comp.mans
GoAuditParser_Win.exe -i zip -o csv
GoAuditParser_Win.exe -i Comp.mans -o csv -tl -t 1

I kept getting the memory error each time.

Thanks for writing this, hopefully I can get it to work!