WEVT Support

[omerbenamram]

Closes #103

Motivation

Issue #103 is about offline / carved EVTX analysis: records frequently reference template instances (substitution values), but the corresponding template definitions live in provider PE resources (WEVT_TEMPLATE). Without those templates, you can parse the record BinXML but you can’t reliably render the final event fragment.

This PR makes template extraction + spec-backed parsing a first-class, cross-platform workflow in evtx_dump, so you can:

• extract templates from provider binaries into a cache
• extract a record’s TemplateInstance substitution array
• render the final XML event fragment offline

What’s implemented

• Module organization: evtx::wevt_templates is split into focused modules (extract, manifest, binxml, render, temp) with stable re-exports (public API paths remain the same).
• Spec-backed CRIM/WEVT parsing: deterministic parsing with strict bounds checks and actionable errors; exposes stable join keys (provider/event → template GUID/offset).
• WEVT inline-name BinXML support: the deserializer supports the inline-name dialect used in templates, enabling deterministic rendering.
• evtx_dump workflow commands:
  • extract-wevt-templates: build the cache/index (including provider/event → template GUID join rows)
  • dump-template-instances: dump per-record substitution arrays (JSONL)
  • apply-wevt-cache: render template + substitutions to XML (substitutions from EVTX record or JSON)
• Docs: a concise end-to-end flow in the README + deeper technical notes in docs/wevt_templates.md.

Integration / compatibility

• Existing evtx_dump usage is unchanged; these subcommands are additive.
• wevt_templates is now built by default as part of the evtx_dump feature, so CI (cargo test) and release binaries compile/include the offline-template tooling.
  • Library-only consumers can still disable default features (or avoid evtx_dump) to avoid pulling in template extraction dependencies.

References

• Issue add support for WEVT_TEMPLATE evtx template structure parsing #103: add support for WEVT_TEMPLATE evtx template structure parsing #103
• Project notes: docs/wevt_templates.md
• MS-EVEN6 (BinXml inline-name structure + NameHash): https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-even6/c73573ae-1c90-43a2-a65f-ad7501155956
• libfwevt manifest spec doc (CRIM/WEVT/EVNT/TTBL/TEMP): https://github.com/libyal/libfwevt/blob/main/documentation/Windows%20Event%20manifest%20binary%20format.asciidoc

Tests: cargo test (default features)

---

Note

Introduces end-to-end offline WEVT template support and hardens parsing.

• Adds wevt_templates feature with optional deps (goblin, glob); new evtx_dump subcommands: extract-wevt-templates, dump-template-instances, apply-wevt-cache
• Enables cache-backed rendering via --wevt-cache-index for XML/JSON outputs
• Implements WEVT inline-name BinXML dialect and strict NameHash validation; threads BinXmlNameEncoding through deserializer
• Major parser refactor: replaces I/O macros with ByteCursor, converts many readers to *_cursor variants, improves bounds checks and error types; more resilient chunk/file/record header handling
• Documentation: README section and docs/wevt_templates.md with usage and format details
• Minor: .gitignore updates and Cargo feature wiring

^{Written by Cursor Bugbot for commit 1c9450e. This will update automatically on new commits. Configure here.}