# Etl-Parser | Event Trace Log File Parser In Pure Python

**URL:** <https://onehack.st/t/etl-parser-event-trace-log-file-parser-in-pure-python/206325>\
**Category:** Tools & Scripts\
**Tags:** tools, hacking\
**Created:** [November 8, 2021, 8:05am UTC](https://onehack.st/t/etl-parser-event-trace-log-file-parser-in-pure-python/206325 "2021-11-08T08:05:10Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![BlueHacker](https://onehack.st/user_avatar/onehack.st/bluehacker/32/174721_2.png) [@BlueHacker](https://onehack.st/u/BlueHacker)\
**Post date:** [November 8, 2021, 8:05am UTC](https://onehack.st/t/etl-parser-event-trace-log-file-parser-in-pure-python/206325/1 "2021-11-08T08:05:10Z")

</div>

![image](https://onehack.st/uploads/default/original/3X/f/4/f416049fab33478c3cd6d76102c44e9e83112a60.jpeg)

Event Trace Log file reader in pure Python

`etl-parser` is a pure Python 3 parser library for `ETL` Windows log files. `ETL` is the default format for [ETW](https://docs.microsoft.com/en-us/windows/win32/etw/event-tracing-portal) as well as the default format for the Kernel logger.

`etl-parser` has no system dependencies, and will work well on both Windows and Linux.

Since this format is not documented, we merged information from the blog of [Geoff Chappel](https://www.geoffchappell.com/) and reverse engineering activities conducted by Airbus CERT team.

What is `ETL` and why is it a pain to work with? Consider `ETL` as a container, like `AVI` is for video files. Reading `ETL` is similarly frustrating as reading an `AVI` file without the right codec.

`etl-parser` tries to solve this problem by including parsers for the following well known log formats:

- ETW manifest base provider
- TraceLogging
- MOF for kernel log

## How to use `etl-parser`?

`etl-parser` offers two scripts. The first script, `etl2xml` transforms all known ETL events into XML:

```auto
etl2xml -i example.etl -o example.xml

```

The second script, `etl2pcap` transforms network captures created through `netsh` into the `pcap` file format:

```auto
netsh start trace capture=yes
netsh stop trace

etl2pcap -i NetTrace.etl -o NetTrace.pcap

```

You can also use `etl-parser` as a library:

from etl.etl import IEtlFileObserver, build\_from\_stream from etl.system import SystemTraceRecord from etl.perf import PerfInfo from etl.event import Event from etl.trace import Trace from etl.wintrace import WinTrace class EtlFileLogger(IEtlFileObserver): def on\_system\_trace(self, event: SystemTraceRecord): “”“Mof kernel message with Process Id and Thread Id”“” mof = event.get\_mof() # Invoke MOF parser def on\_perfinfo\_trace(self, event: PerfInfo): “”“Mof kernel message with timestamp”“” mof = event.get\_mof() # Invoke MOF parser def on\_trace\_record(self, event: Trace): “”“unknown”“” def on\_event\_record(self, event: Event): “”“ETW event this is what you search”“” # Choose the “parse\_” function which corresponds to your event message = event.parse\_tracelogging() # Invoke TraceLogging parser message = event.parse\_etw() # Invoke Manifest based parser def on\_win\_trace(self, event: WinTrace): “”“unknown”“” etw = event.parse\_etw() with open(“example.etl”, “rb”) as etl\_file: etl\_reader = build\_from\_stream(etl\_file.read()) etl\_reader.parse(EtlFileLogger())

# Installation

`etl-parser` is available from pip:

```auto
pip install etl-parser

```

Alternatively, you can install `etl-parser` using `setup.py`:

```auto
git clone https://github.com/airbus-cert/etl-parser.git
cd etl-parser
pip install -e .

```

## Missing a parser?

If you encounter a parsing error, please open an issue on the Airbus CERT GitHub repository.

## Why an ETL Parser?

The `EVTX` log format is fairly well documented, with lots of libraries and tools available today. This is not true for `ETL`: at time of development, there is no significant open-source project that we know of and the `ETL` format is not well documented.

ETL is massively used by Windows system programmers to log useful artifacts:

- `C:\Windows\System32\WDI\LogFiles\BootPerfDiagLogger.etl`
- `C:\Windows\System32\WDI\LogFiles\ShutdownPerfDiagLogger.etl`
- `NetTrace.etl` via `netsh`
- `C:\Windows\System32\WDI\<GUID>\<GUID>\snapshot.etl`
- etc.

A lot of new APIs such as `Tracelogging` or `WPP` are based on ETW. These APIs are used extensively by Microsoft developers for Windows. `Tracelogging` is addressed by `etl-parser`, `WPP` will be addressed in a future release.

Microsoft offers a lot of consumers that create ETL traces, such as `xperf.exe`, `logman.exe`, `netsh.exe`, etc.

We believe it is a gold mine for DFIR analysts.

## Credits

- This project is under copyright of the [Airbus Computer Emergency Response Team (CERT)](https://www.trusted-introducer.org/directory/teams/ai-cert.html) and distributed under the [Apache 2.0](https://www.apache.org/licenses/LICENSE-2.0) license
- [Geoff Chappel](https://www.geoffchappell.com/) for all information on his blog

## License

`etl-parser` is released under the [Apache 2.0](https://www.apache.org/licenses/LICENSE-2.0) license.

## GitHub:

> **[GitHub - airbus-cert/etl-parser: Event Trace Log file parser in pure Python](https://github.com/airbus-cert/etl-parser)**
>
> Event Trace Log file parser in pure Python