{"id":205456,"date":"2025-05-29T09:59:42","date_gmt":"2025-05-29T01:59:42","guid":{"rendered":"https:\/\/server.hk\/cnblog\/205456\/"},"modified":"2025-05-29T09:59:42","modified_gmt":"2025-05-29T01:59:42","slug":"%e5%a6%82%e4%bd%95%e5%8f%8d%e5%90%91%e8%af%bb%e5%8f%96windows%e7%b3%bb%e7%bb%9f%e6%97%a5%e5%bf%97evtx%e6%96%87%e4%bb%b6%ef%bc%9f","status":"publish","type":"post","link":"https:\/\/server.hk\/cnblog\/205456\/","title":{"rendered":"\u5982\u4f55\u53cd\u5411\u8bfb\u53d6Windows\u7cfb\u7edf\u65e5\u5fd7EVTX\u6587\u4ef6\uff1f"},"content":{"rendered":"<p><b><\/b>     <\/p>\n<h1>\u5982\u4f55\u53cd\u5411\u8bfb\u53d6Windows\u7cfb\u7edf\u65e5\u5fd7EVTX\u6587\u4ef6\uff1f<\/h1>\n<p>\u76ee\u524d\u4e0a\u5df2\u7ecf\u6709\u5f88\u591a\u5173\u4e8e\u7684\u6587\u7ae0\u4e86\uff0c\u81ea\u5df1\u5728\u521d\u6b21\u9605\u8bfb\u8fd9\u4e9b\u6587\u7ae0\u4e2d\uff0c\u4e5f\u89c1\u8bc6\u5230\u4e86\u5f88\u591a\u5b66\u4e60\u601d\u8def\uff1b\u90a3\u4e48\u672c\u6587<span style=\"color: #FF6600;, Helvetica, Arial, sans-serif;font-size: 14px;background-color: #FFFFFF\">\u300a\u5982\u4f55\u53cd\u5411\u8bfb\u53d6Windows\u7cfb\u7edf\u65e5\u5fd7EVTX\u6587\u4ef6\uff1f\u300b<\/span>\uff0c\u4e5f\u5e0c\u671b\u80fd\u5e2e\u52a9\u5230\u5927\u5bb6\uff0c\u5982\u679c\u9605\u8bfb\u5b8c\u540e\u771f\u7684\u5bf9\u4f60\u5b66\u4e60<span style=\"color: #FF6600;, Helvetica, Arial, sans-serif;font-size: 14px;background-color: #FFFFFF\">\u6587\u7ae0<\/span>\u6709\u5e2e\u52a9\uff0c\u6b22\u8fce\u52a8\u52a8\u624b\u6307\uff0c\u8bc4\u8bba\u7559\u8a00\u5e76\u5206\u4eab~<\/p>\n<p><img decoding=\"async\" src=\"https:\/\/www.17golang.com\/uploads\/20241202\/1733138141674d96dd3c277.jpg\" class=\"aligncenter\"><\/p>\n<p><strong>\u5012\u5e8f\u8bfb\u53d6 windows \u7cfb\u7edf\u65e5\u5fd7 evtx \u6587\u4ef6<\/strong><\/p>\n<p>\u8981\u4ece\u6700\u540e\u8bfb\u53d6 evtx \u6587\u4ef6\uff0c\u9700\u8981\u53cd\u5411\u8fed\u4ee3\u8be5\u6587\u4ef6\u3002\u8fd9\u53ef\u4ee5\u5728 python \u4e2d\u4f7f\u7528\u4ee5\u4e0b\u6b65\u9aa4\u5b9e\u73b0\uff1a<\/p>\n<p>\u9996\u5148\uff0c\u6211\u4eec\u8981\u8bfb\u53d6\u6587\u4ef6\u5185\u5bb9\uff1a<\/p>\n<pre>with open(filename, \"r\", encoding=\"utf-8\") as f:\n    f.seek(0, os.seek_end)\n    position = f.tell()<\/pre>\n<p>\u63a5\u4e0b\u6765\uff0c\u6211\u4eec\u9010\u884c\u8bfb\u53d6\u6587\u4ef6\u5e76\u5c06\u5176\u53cd\u8f6c\uff1a<\/p>\n<pre>line = \"\"\nwhile position &gt;= 0:\n    f.seek(position)\n    next_char = f.read(1)\n    if next_char == \"\\n\":\n        yield line[::-1]\n        line = \"\"\n    else:\n        line += next_char\n    position -= 1\nyield line[::-1]<\/pre>\n<p>\u6700\u540e\uff0c\u6211\u4eec\u6253\u5370\u7ed3\u679c\uff1a<\/p>\n<pre>for line in readlines_reverse(\"go.mod\"):\n    print(line)<\/pre>\n<p><strong>\u6837\u4f8b\u8f93\u51fa\uff1a<\/strong><\/p>\n<pre>require (\n\ngo 1.20\n\nmodule daily\/gui\n)\n        gocv.io\/x\/gocv v0.33.0\n        github.com\/ncruces\/zenity v0.10.10\nrequire (\n\n)\n        github.com\/akavel\/rsrc v0.10.2 \/\/ indirect\n        github.com\/dchest\/jsmin v0.0.0-20220218165748-59f39799265f \/\/ indirect\n        github.com\/ josephspurrier\/goversioninfo v1.4.0 \/\/ indirect\n        github.com\/randall77\/makefat v0.0.0-20210315173500-7ddd0e42c844 \/\/ indirect\n        github.com\/stretchr\/testify v1.8.0 \/\/ indirect\n        golang.org\/x\/image v0.12.0 \/\/ indirect\n        golang.org\/x\/sys v0.12.0 \/\/ indirect<\/pre>\n<p>\u6587\u4e2d\u5173\u4e8e\u7684\u77e5\u8bc6\u4ecb\u7ecd\uff0c\u5e0c\u671b\u5bf9\u4f60\u7684\u5b66\u4e60\u6709\u6240\u5e2e\u52a9\uff01\u82e5\u662f\u53d7\u76ca\u532a\u6d45\uff0c\u90a3\u5c31\u52a8\u52a8\u9f20\u6807\u6536\u85cf\u8fd9\u7bc7\u300a\u5982\u4f55\u53cd\u5411\u8bfb\u53d6Windows\u7cfb\u7edf\u65e5\u5fd7EVTX\u6587\u4ef6\uff1f\u300b\u6587\u7ae0\u5427\uff0c\u4e5f\u53ef\u5173\u6ce8\u516c\u4f17\u53f7\u4e86\u89e3\u76f8\u5173\u6280\u672f\u6587\u7ae0\u3002<\/p>\n","protected":false},"excerpt":{"rendered":"<p>\u5982\u4f55\u53cd\u5411\u8bfb\u53d6Windows\u7cfb\u7edf\u65e5&#46;&#46;&#46;<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4925],"tags":[],"class_list":["post-205456","post","type-post","status-publish","format-standard","hentry","category-4925"],"_links":{"self":[{"href":"https:\/\/server.hk\/cnblog\/wp-json\/wp\/v2\/posts\/205456","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/server.hk\/cnblog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/server.hk\/cnblog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/server.hk\/cnblog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/server.hk\/cnblog\/wp-json\/wp\/v2\/comments?post=205456"}],"version-history":[{"count":0,"href":"https:\/\/server.hk\/cnblog\/wp-json\/wp\/v2\/posts\/205456\/revisions"}],"wp:attachment":[{"href":"https:\/\/server.hk\/cnblog\/wp-json\/wp\/v2\/media?parent=205456"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/server.hk\/cnblog\/wp-json\/wp\/v2\/categories?post=205456"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/server.hk\/cnblog\/wp-json\/wp\/v2\/tags?post=205456"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}