title: How do the variable length fields in the windows EVENTLOGRECORD structure work?
body: <p>I've tried, with little success, to identify how the variable length portion of the EVENTLOGRECORD data works.  </p>
  
  <p>Winnt.h defines the structure, and the following data, as follows:  </p>
  
  <pre><code>typedef struct _EVENTLOGRECORD {
  DWORD  Length;        // Length of full record
  DWORD  Reserved;      // Used by the service
  DWORD  RecordNumber;  // Absolute record number
  DWORD  TimeGenerated; // Seconds since 1-1-1970
  DWORD  TimeWritten;   // Seconds since 1-1-1970
  DWORD  EventID;
  WORD   EventType;
  WORD   NumStrings;
  WORD   EventCategory;
  WORD   ReservedFlags; // For use with paired events (auditing)
  DWORD  ClosingRecordNumber; // For use with paired events (auditing)
  DWORD  StringOffset;  // Offset from beginning of record
  DWORD  UserSidLength;
  DWORD  UserSidOffset;
  DWORD  DataLength;
  DWORD  DataOffset;    // Offset from beginning of record
  //
  // Then follow:
  //
  // WCHAR SourceName[]
  // WCHAR Computername[]
  // SID   UserSid
  // WCHAR Strings[]
  // BYTE  Data[]
  // CHAR  Pad[]
  // DWORD Length;
  
      //
  } EVENTLOGRECORD, *PEVENTLOGRECORD;
  </code></pre>
  
  <p>I can pull out the first chunk which appears to be the source with the following code, but its certainly not the intended method:</p>
  
  <pre><code>memcpy(&amp;strings, pRecord+sizeof(EVENTLOGRECORD), tmpLog-&gt;UserSidOffset);
  </code></pre>
  
  <p>But from the comments in Winnt.h, I'm also getting the computer name.  </p>
  
  <p>So can someone explain how to determine the "SourceName" length from the EVENTLOGRECORD structure, and explain what StringOffset, DataLength and DataOffset are?</p>
  
  <p>Thanks.</p>