Skip to content

evtx_dump_chunk_slack: write argument must be str not bytes #74

@forensenellanebbia

Description

@forensenellanebbia

If I use Python 3 (x64) to run the script evtx_dump_chunk_slack.py against an EVTX file, I get this error:

Traceback (most recent call last):
File "./bin/evtx_dump_chunk_slack.py", line 47, in
main()
File "./bin/evtx_dump_chunk_slack.py", line 43, in main
sys.stdout.write(buf[last_allocated_offset:chunk_start + 0x10000])
TypeError: write() argument must be str, not bytes

I tried with Python 3.8.5 and 3.9.7.

To bypass the error, and to make the script work with both Python 2 and 3, I replaced line 43:

sys.stdout.write(buf[last_allocated_offset:chunk_start + 0x10000])

with:

try:
    sys.stdout.buffer.write(buf[last_allocated_offset:chunk_start + 0x10000])
except:
    sys.stdout.write(buf[last_allocated_offset:chunk_start + 0x10000])

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions