xml EvtxRecordId Error!

[UbuntuOS-git]

Here!
DeleteRecordofFile and DeleteRecordbyGetHandle:

*v7 = eventRecordIdentifier;
===>
*v7 = *v7 - 1;

When the first recordID is not 1 , it will be wrong.

[3gstudent]

DeleteRecordofFile and DeleteRecordbyGetHandle are not the final version, because there will still be traces of modification, and the format has not been completely corrected.

If you want to achieve the function, you can use DeleteRecordofFileEx and DeleteRecordbyGetHandleEx.

[UbuntuOS-git]

But if use DeleteRecordofFileEx and DeleteRecordbyGetHandleEx,the EventRecordIDs are not consecutive...