ちゃっぴの監禁部屋 ガチガチに締めすぎて動きがとれなくなる。。。

#include <locale.h>
#include <Windows.h>
#include <WinEvt.h>

#pragma comment(lib, "Wevtapi.lib")

LPWSTR GetSystemErrorMessage(DWORD error)
{
  LPWSTR message = NULL;
  FormatMessage(
      FORMAT_MESSAGE_ALLOCATE_BUFFER | FORMAT_MESSAGE_FROM_SYSTEM | FORMAT_MESSAGE_IGNORE_INSERTS
    , NULL
    , error
    , LANG_USER_DEFAULT
    , (LPWSTR)&message
    , 0
    , NULL);
  return message;
}

int wmain(int argc, LPWSTR argv[])
{
  _wsetlocale(LC_ALL, L"");
  int result = 1;
  EVT_HANDLE handle = EvtOpenChannelConfig(NULL, L"Application", 0);
  if (!handle)
  {
    wprintf_s(L"%s\n", GetSystemErrorMessage(GetLastError()));
  }
  else
  {
    DWORD size = 0;
    EvtGetChannelConfigProperty(
        handle
      , EvtChannelConfigAccess
      , 0
      , 0
      , NULL
      , &size);
    DWORD errorCode = GetLastError();
    if (errorCode != ERROR_INSUFFICIENT_BUFFER)
    {
      wprintf_s(L"%s\n", GetSystemErrorMessage(GetLastError()));
    }
    else
    {
      PEVT_VARIANT buffer 
        = (PEVT_VARIANT)HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, size);
      if (!EvtGetChannelConfigProperty(
              handle
            , EvtChannelConfigAccess
            , 0
            , size
            , buffer
            , &size))
      {
        wprintf_s(L"%s\n", GetSystemErrorMessage(GetLastError()));
      }
      else
      {
        wprintf_s(L"%s\n", buffer->StringVal);
        result = 0;
      }
    }
    EvtClose(handle);
  }
  return result;
}

O:BAG:SYD:(A;;0xf0007;;;SY)(A;;0x7;;;BA)(A;;0x7;;;SO)(A;;0x3;;;IU)(A;;0x3;;;SU)(
A;;0x3;;;S-1-5-3)(A;;0x3;;;S-1-5-33)(A;;0x1;;;S-1-5-32-573)

コメント