From 5b55d4d6930abaee21c0ee21ea8843b19a021c58 Mon Sep 17 00:00:00 2001
From: 1orenz0 <1orenz0>
Date: Wed, 9 Oct 2019 15:41:41 +0100
Subject: [PATCH] [event_log] Add some more format type to support

---
 samples/event_log/wevtutil.py  | 14 ++++++++++++++
 windows/winobject/event_log.py |  1 +
 2 files changed, 15 insertions(+)

diff --git a/samples/event_log/wevtutil.py b/samples/event_log/wevtutil.py
index a2848c5..1cf7170 100644
--- a/samples/event_log/wevtutil.py
+++ b/samples/event_log/wevtutil.py
@@ -158,16 +158,26 @@ class RealtimeEventLogger(RealtimeEventLoggerBase):
             value = self.parse_unicode_string(stream)
         elif in_type == "win:UInt8":
             value = struct.unpack("B", stream.read(1))[0]
+
+        elif in_type == "win:Int32":
+            value = struct.unpack("I", stream.read(4))[0]
         elif in_type == "win:UInt32":
             value = struct.unpack("I", stream.read(4))[0]
         elif in_type == "win:HexInt32":
             value = struct.unpack("I", stream.read(4))[0]
         elif in_type == "xs:unsignedLong":
             value = struct.unpack("I", stream.read(4))[0]
+
         elif in_type == "win:UInt64":
             value = struct.unpack("Q", stream.read(8))[0]
         elif in_type == "win:Pointer":
             value = struct.unpack("Q", stream.read(8))[0]
+        elif in_type == "win:Double":
+            value = struct.unpack("Q", stream.read(8))[0]
+
+        elif in_type == "win:Boolean":
+            value = struct.unpack("I", stream.read(4))[0] == 1
+
         elif in_type == "win:Binary":
             if not length:
                 raise ValueError(" param_in_type (%s) cannot be used with a null length value" % in_type)
@@ -175,6 +185,7 @@ class RealtimeEventLogger(RealtimeEventLoggerBase):
             # TODO : we should return the raw bytes buffer, since get_param_str_format is too crude 
             #        to properly display win:SocketAddress parameters
             value = binascii.hexlify(stream.read(length)) 
+
         elif in_type == "win:GUID":
             guid_data = struct.unpack("IHHBBBBBBBB", stream.read(16))
             value = gdef.GUID.from_raw(*guid_data).to_string()
@@ -185,7 +196,10 @@ class RealtimeEventLogger(RealtimeEventLoggerBase):
 
     def get_param_str_format(self, param_out_type):
         PYTHON_FORMAT_DICT = {
+            "xs:boolean" : "s", # "True" or "False"
             "xs:unsignedByte" : "02x",
+            "xs:int" : "d",
+            "xs:double" : "f",
             "xs:unsignedInt" : "d",
             "xs:unsignedLong" : "d",
             "win:ErrorCode"  : "x",
diff --git a/windows/winobject/event_log.py b/windows/winobject/event_log.py
index fc3d9eb..65fa831 100644
--- a/windows/winobject/event_log.py
+++ b/windows/winobject/event_log.py
@@ -451,6 +451,7 @@ class ChannelConfig(EvtHandle):
     def enabled(self):
         return bool(chaninfo(self, gdef.EvtChannelConfigEnabled).value)
 
+
     @property
     def classic(self):
         """``True`` if the channel is a classic event channel (for example the Application or System log)"""