Failed to read Windows EventLog resources database

[kidrek]

I encountered an error yesterday when I used the psteal/psort tools.
This error seems to be caused by the Windows EventLog resources Analyzer : winevt_rc.py.
Source : https://plaso.readthedocs.io/en/latest/_modules/plaso/output/winevt_rc.html

Have you encountered this error before ?

Traceback (most recent call last):
  File "/usr/bin/psteal.py", line 33, in <module>
    sys.exit(load_entry_point('plaso==20250918', 'console_scripts', 'psteal')())
             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3/dist-packages/plaso/scripts/psteal.py", line 88, in Main
    tool.ProcessStorage()
  File "/usr/lib/python3/dist-packages/plaso/cli/psteal_tool.py", line 362, in ProcessStorage
    output_engine.ExportEvents(
  File "/usr/lib/python3/dist-packages/plaso/multi_process/output_engine.py", line 474, in ExportEvents
    self._ExportEvents(
  File "/usr/lib/python3/dist-packages/plaso/multi_process/output_engine.py", line 280, in _ExportEvents
    self._ExportEvent(
  File "/usr/lib/python3/dist-packages/plaso/multi_process/output_engine.py", line 175, in _ExportEvent
    self._FlushExportBuffer(
  File "/usr/lib/python3/dist-packages/plaso/multi_process/output_engine.py", line 356, in _FlushExportBuffer
    output_module.WriteFieldValuesOfMACBGroup(
  File "/usr/lib/python3/dist-packages/plaso/output/interface.py", line 99, in WriteFieldValuesOfMACBGroup
    field_values = self.GetFieldValues(
                   ^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3/dist-packages/plaso/output/shared_json.py", line 189, in GetFieldValues
    field_values['message'] = self._field_formatting_helper.GetFormattedField(
                              ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3/dist-packages/plaso/output/shared_json.py", line 89, in GetFormattedField
    output_value = callback_function(
                   ^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3/dist-packages/plaso/output/formatting_helper.py", line 318, in _FormatMessage
    message_formatter.FormatEventValues(output_mediator, event_values)
  File "/usr/lib/python3/dist-packages/plaso/formatters/interface.py", line 293, in FormatEventValues
    helper.FormatEventValues(output_mediator, event_values)
  File "/usr/lib/python3/dist-packages/plaso/formatters/winevt.py", line 52, in FormatEventValues
    self._winevt_resources_helper.GetParameterString(
  File "/usr/lib/python3/dist-packages/plaso/output/winevt_rc.py", line 1215, in GetParameterString
    message_string = self._ReadParameterMessageString(
                     ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3/dist-packages/plaso/output/winevt_rc.py", line 1085, in _ReadParameterMessageString
    self._ReadEnvironmentVariables(storage_reader)
  File "/usr/lib/python3/dist-packages/plaso/output/winevt_rc.py", line 1008, in _ReadEnvironmentVariables
    self._environment_variables = list(storage_reader.GetAttributeContainers(
                                       ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
AttributeError: 'NoneType' object has no attribute 'GetAttributeContainers'

best regards

[joachimmetz]

Please take a look at https://plaso.readthedocs.io/en/latest/sources/Troubleshooting.html and provide additional context as requested in the issue template https://github.com/log2timeline/plaso/issues/new?template=problem-report.md

based on AttributeError: 'NoneType' object has no attribute 'GetAttributeContainers' looks like storage_reader is None for some reason

[Mooth13]

Hi guys !
We encountered exact same error as described above, hope you'll find more context down here.

Describe the problem:

Psort.py from v20250918 returns an error, whereas there are none with v20240826.

Traceback (most recent call last):
  File "/usr/bin/psort.py", line 33, in <module>
    sys.exit(load_entry_point('plaso==20250918', 'console_scripts', 'psort')())
             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3/dist-packages/plaso/scripts/psort.py", line 78, in Main
    tool.ProcessStorage()
  File "/usr/lib/python3/dist-packages/plaso/cli/psort_tool.py", line 509, in ProcessStorage
    output_engine.ExportEvents(
  File "/usr/lib/python3/dist-packages/plaso/multi_process/output_engine.py", line 474, in ExportEvents
    self._ExportEvents(
  File "/usr/lib/python3/dist-packages/plaso/multi_process/output_engine.py", line 280, in _ExportEvents
    self._ExportEvent(
  File "/usr/lib/python3/dist-packages/plaso/multi_process/output_engine.py", line 175, in _ExportEvent
    self._FlushExportBuffer(
  File "/usr/lib/python3/dist-packages/plaso/multi_process/output_engine.py", line 356, in _FlushExportBuffer
    output_module.WriteFieldValuesOfMACBGroup(
  File "/usr/lib/python3/dist-packages/plaso/output/l2t_csv.py", line 315, in WriteFieldValuesOfMACBGroup
    output_text = self._event_formatting_helper.GetFormattedMACBGroup(
                  ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3/dist-packages/plaso/output/l2t_csv.py", line 52, in GetFormattedMACBGroup
    field_value = self._field_formatting_helper.GetFormattedField(
                  ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3/dist-packages/plaso/output/formatting_helper.py", line 592, in GetFormattedField
    output_value = callback_function(
                   ^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3/dist-packages/plaso/output/formatting_helper.py", line 345, in _FormatMessageShort
    message_formatter.FormatEventValues(output_mediator, event_values)
  File "/usr/lib/python3/dist-packages/plaso/formatters/interface.py", line 293, in FormatEventValues
    helper.FormatEventValues(output_mediator, event_values)
  File "/usr/lib/python3/dist-packages/plaso/formatters/winevt.py", line 52, in FormatEventValues
    self._winevt_resources_helper.GetParameterString(
  File "/usr/lib/python3/dist-packages/plaso/output/winevt_rc.py", line 1215, in GetParameterString
    message_string = self._ReadParameterMessageString(
                     ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3/dist-packages/plaso/output/winevt_rc.py", line 1085, in _ReadParameterMessageString
    self._ReadEnvironmentVariables(storage_reader)
  File "/usr/lib/python3/dist-packages/plaso/output/winevt_rc.py", line 1008, in _ReadEnvironmentVariables
    self._environment_variables = list(storage_reader.GetAttributeContainers(
                                       ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
AttributeError: 'NoneType' object has no attribute 'GetAttributeContainers'

To Reproduce:

The version of Plaso you used: 20250918
The operating system you are running Plaso on : Ubuntu 24.04
Steps to reproduce the behavior including command line and arguments and output: psort.py --output-time-zone UTC -o l2tcsv -w plaso.csv plaso.dump
The method you used to install Plaso: installed from [GiFT PPA][https://launchpad.net/~gift] stable track. I also tried different installation methods such as docker and pipx and I always met this same error with psort.

Thank you for your help !

[william-billaud]

Currently from my test

The version of Plaso you used: 20250918
The operating system you are running Plaso on : Ubuntu 24.04
The method you used to install Plaso: local source (python3.12 venv + pip install -e .)

Command to reproduce : psteal -o json_line -w a.jsonl --source test_data/System2.evtx

Issue seems to came from this commit, 6ed5aa4
, previously _storage_reader was always defined, even if windows_eventlog_provider was None which is no longer the case