Enhance parser reliability and fix map keying issues

[randomaccess3]

Noticed some of the event logs in TheTechHiveScenario werent parsing properly. They work with evtx_dump (https://github.com/omerbenamram/EVTX) so I gave copilot the task of reviewing the code, comparing with evtx_dump, and re-evaluating against the dataset (https://github.com/randomaccess3/DFIRArtifactMuseum/tree/main/Windows/EventLogs/Win11/TheTechHiveScenario)

Current version:

This version:

I havent done more testing than this however.

[Copilot]

Pull request overview

This PR improves EVTX parsing robustness and correctness when handling real-world logs (including TheTechHiveScenario), with targeted fixes for map keying, safer record parsing, and broader tag/value support.

Changes:

• Fix event map dictionary keying to include Provider consistently (load + lookup).
• Harden parsing against malformed EVTX/XML (record boundary checks, safer ampersand handling, safer JSON payload conversion).
• Add support for additional BinXML/value variants (e.g., BinaryTag.Value2, more ValueType decoding, hex array formatting).

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
EvtxECmd/Program.cs	Avoid unconditional XML→JSON conversion; improve error record keying; add best-effort JSON conversion helper.
EvtxECmd/FodyWeavers.xsd	Add schema elements for Include/Exclude runtimes.
evtx/Tags/Value.cs	Expand supported ValueType decoding to reduce parser failures on non-string value tags.
evtx/Tags/TemplateInstance.cs	Fail fast with a clearer exception when templates cannot be resolved.
evtx/Tags/TagBuilder.cs	Treat BinaryTag.Value2 the same as Value for tag construction.
evtx/SubstitutionArrayEntry.cs	Improve formatting for 32/64-bit hex arrays (but needs bounds safety).
evtx/EventRecord.cs	Make XML element parsing more fault-tolerant; fix map key usage; safer ampersand escaping strategy.
evtx/EventLog.cs	Key event maps by EventId-Channel-Provider consistently.
evtx/ChunkInfo.cs	Add record boundary validation to stop safely on truncated/invalid record structures (but header length check needs correction).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[randomaccess3]

Need to redo the copilot stuff as I added a commit here that covers the RenderingInfo that is currently dropped. It sits as an additional object outside of EventData

[randomaccess3]

@copilot please review the code again

[randomaccess3]

@copilot can you review the previous comments in this pull request and see if they still apply. Make suggestions as required.

[Copilot]

Pull request overview

Copilot reviewed 9 out of 9 changed files in this pull request and generated 2 comments.

Comments suppressed due to low confidence (3)

evtx/EventRecord.cs:567

• ReadRenderingInfoKeywords calls reader.Read() after ReadSubtree(), but BuildProperties' outer while(reader.Read()) loop will read again. This causes the parser to skip the element immediately following inside .

        // ReadSubtree leaves the original reader positioned on Keywords' end element, so advance past it
        reader.Read();

evtx/SubstitutionArrayEntry.cs:292

• Array32BitHex parsing loops while index < DataBytes.Length, but BitConverter.ToUInt32 requires at least 4 bytes. If DataBytes isn't a multiple of 4 (corrupt/partial data), this will throw and break parsing.

                while (index < DataBytes.Length)
                {
                    var ul = BitConverter.ToUInt32(DataBytes, index);
                    index += 4;
                    a32h.Add($"0x{ul:X}");
                }

evtx/SubstitutionArrayEntry.cs:303

• Array64BitHex parsing loops while index < DataBytes.Length, but BitConverter.ToUInt64 requires at least 8 bytes. If DataBytes isn't a multiple of 8, this will throw and abort record parsing.

                while (index < DataBytes.Length)
                {
                    var ul = BitConverter.ToUInt64(DataBytes, index);
                    index += 8;
                    a64h.Add($"0x{ul:X}");
                }