Evtx.Nodes

Package Evtx :: Module Nodes |
[hide private]
[frames] | no frames]

# Module Nodes

source code

Classes | [hide private]
| SYSTEM_TOKENS
| SuppressConditionalSubstitution This exception is to be thrown to indicate that a conditional substitution evaluated to NULL, and the parent element should be suppressed.
| BXmlNode
| NameStringNode
| TemplateNode
| EndOfStreamNode The binary XML node for the system token 0x00.
| OpenStartElementNode The binary XML node for the system token 0x01.
| CloseStartElementNode The binary XML node for the system token 0x02.
| CloseEmptyElementNode The binary XML node for the system token 0x03.
| CloseElementNode The binary XML node for the system token 0x04.
| ValueNode The binary XML node for the system token 0x05.
| AttributeNode The binary XML node for the system token 0x06.
| CDataSectionNode The binary XML node for the system token 0x07.
| EntityReferenceNode The binary XML node for the system token 0x09.
| ProcessingInstructionTargetNode The binary XML node for the system token 0x0A.
| ProcessingInstructionDataNode The binary XML node for the system token 0x0B.
| TemplateInstanceNode The binary XML node for the system token 0x0C.
| NormalSubstitutionNode The binary XML node for the system token 0x0D.
| ConditionalSubstitutionNode The binary XML node for the system token 0x0E.
| StreamStartNode The binary XML node for the system token 0x0F.
| RootNode The binary XML node for the Root node.
| VariantTypeNode
| NullTypeNode Variant type 0x00.
| WstringTypeNode Variant ttype 0x01.
| StringTypeNode Variant type 0x02.
| SignedByteTypeNode Variant type 0x03.
| UnsignedByteTypeNode Variant type 0x04.
| SignedWordTypeNode Variant type 0x05.
| UnsignedWordTypeNode Variant type 0x06.
| SignedDwordTypeNode Variant type 0x07.
| UnsignedDwordTypeNode Variant type 0x08.
| SignedQwordTypeNode Variant type 0x09.
| UnsignedQwordTypeNode Variant type 0x0A.
| FloatTypeNode Variant type 0x0B.
| DoubleTypeNode Variant type 0x0C.
| BooleanTypeNode Variant type 0x0D.
| BinaryTypeNode Variant type 0x0E.
| GuidTypeNode Variant type 0x0F.
| SizeTypeNode Variant type 0x10.
| FiletimeTypeNode Variant type 0x11.
| SystemtimeTypeNode Variant type 0x12.
| SIDTypeNode Variant type 0x13.
| Hex32TypeNode Variant type 0x14.
| Hex64TypeNode Variant type 0x15.
| BXmlTypeNode Variant type 0x21.
| WstringArrayTypeNode Variant ttype 0x81.

Functions | [hide private]
get_variant_value(buf, offset, chunk, parent, type_, length=None) @return A VariantType subclass instance found in the given buffer and offset. | source code

Variables | [hide private]
| node_dispatch_table = ``[`<class 'Evtx.Nodes.EndOfStreamNode'>`,` <`...``
| node_readable_tokens = ``[``'``End of Stream``'``,` `'``Open Start Element``'``,``...``
| __package__ = ``'``Evtx``'``

Variables Details | [hide private]

  ### node_dispatch_table Value:
      [<class 'Evtx.Nodes.EndOfStreamNode'>,
       <class 'Evtx.Nodes.OpenStartElementNode'>,
       <class 'Evtx.Nodes.CloseStartElementNode'>,
       <class 'Evtx.Nodes.CloseEmptyElementNode'>,
       <class 'Evtx.Nodes.CloseElementNode'>,
       <class 'Evtx.Nodes.ValueNode'>,
       <class 'Evtx.Nodes.AttributeNode'>,
       <class 'Evtx.Nodes.CDataSectionNode'>,
      ...

  ### node_readable_tokens Value:
      ['End of Stream',
       'Open Start Element',
       'Close Start Element',
       'Close Empty Element',
       'Close Element',
       'Value',
       'Attribute',
       'unknown',
      ...