Evtx.BinaryParser.Block

Package Evtx :: Module BinaryParser :: Class Block |
[hide private]
[frames] | no frames]

# Class Block

source code

Base class for structure blocks in binary parsing. A block is associated with a offset into a byte-string.

Instance Methods | [hide private]
__init__(self, buf, offset) Constructor. | source code
__repr__(self) repr(x) | source code
__unicode__(self) | source code
__str__(self) str(x) | source code
declare_field(self, type, name, offset=None, length=None) Declaratively add fields to this block. | source code
current_field_offset(self) | source code
unpack_byte(self, offset) Returns a little-endian unsigned byte from the relative offset. | source code
unpack_int8(self, offset) Returns a little-endian signed byte from the relative offset. | source code
unpack_word(self, offset) Returns a little-endian unsigned WORD (2 bytes) from the relative offset. | source code
unpack_word_be(self, offset) Returns a big-endian unsigned WORD (2 bytes) from the relative offset. | source code
unpack_int16(self, offset) Returns a little-endian signed WORD (2 bytes) from the relative offset. | source code
pack_word(self, offset, word) Applies the little-endian WORD (2 bytes) to the relative offset. | source code
unpack_dword(self, offset) Returns a little-endian DWORD (4 bytes) from the relative offset. | source code
unpack_dword_be(self, offset) Returns a big-endian DWORD (4 bytes) from the relative offset. | source code
unpack_int32(self, offset) Returns a little-endian signed integer (4 bytes) from the relative offset. | source code
unpack_qword(self, offset) Returns a little-endian QWORD (8 bytes) from the relative offset. | source code
unpack_int64(self, offset) Returns a little-endian signed 64-bit integer (8 bytes) from the relative offset. | source code
unpack_float(self, offset) Returns a single-precision float (4 bytes) from the relative offset. | source code
unpack_double(self, offset) Returns a double-precision float (8 bytes) from the relative offset. | source code
unpack_binary(self, offset, length=False) Returns raw binary data from the relative offset with the given length. | source code
unpack_string(self, offset, length) Returns a string from the relative offset with the given length. | source code
unpack_wstring(self, offset, length) Returns a string from the relative offset with the given length, where each character is a wchar (2 bytes) Arguments: - `offset`: The relative offset from the start of the block. | source code
unpack_dosdate(self, offset) Returns a datetime from the DOSDATE and DOSTIME starting at the relative offset. | source code
unpack_filetime(self, offset) Returns a datetime from the QWORD Windows timestamp starting at the relative offset. | source code
unpack_systemtime(self, offset) Returns a datetime from the QWORD Windows SYSTEMTIME timestamp starting at the relative offset. | source code
unpack_guid(self, offset) Returns a string containing a GUID starting at the relative offset. | source code
absolute_offset(self, offset) Get the absolute offset from an offset relative to this block Arguments: - `offset`: The relative offset into this block. | source code
offset(self) Equivalent to self.absolute_offset(0x0), which is the starting offset of this block. | source code
Inherited from `object`: `__delattr__`, `__format__`, `__getattribute__`, `__hash__`, `__new__`, `__reduce__`, `__reduce_ex__`, `__setattr__`, `__sizeof__`, `__subclasshook__`

Properties | [hide private]
Inherited from `object`: `__class__`

Method Details | [hide private]

### __init__(self, buf, offset) (Constructor) | source code
    Constructor.
    Arguments:
    - `buf`: Byte string containing stuff to parse.
    - `offset`: The offset into the buffer at which the block starts.
Overrides: object.__init__

### __repr__(self) (Representation operator) | source code
repr(x) Overrides: object.__repr__ (inherited documentation)

### __str__(self) (Informal representation operator) | source code
str(x) Overrides: object.__str__ (inherited documentation)

### declare_field(self, type, name, offset=None, length=None) | source code
    Declaratively add fields to this block.
    This method will dynamically add corresponding
      offset and unpacker methods to this block.
    Arguments:
    - `type`: A string. Should be one of the unpack_* types.
    - `name`: A string.
    - `offset`: A number.
    - `length`: (Optional) A number. For (w)strings, length in chars.

### unpack_byte(self, offset) | source code
    Returns a little-endian unsigned byte from the relative offset.
    Arguments:
    - `offset`: The relative offset from the start of the block.
    Throws:
    - `OverrunBufferException`

### unpack_int8(self, offset) | source code
    Returns a little-endian signed byte from the relative offset.
    Arguments:
    - `offset`: The relative offset from the start of the block.
    Throws:
    - `OverrunBufferException`

### unpack_word(self, offset) | source code
    Returns a little-endian unsigned WORD (2 bytes) from the
      relative offset.
    Arguments:
    - `offset`: The relative offset from the start of the block.
    Throws:
    - `OverrunBufferException`

### unpack_word_be(self, offset) | source code
    Returns a big-endian unsigned WORD (2 bytes) from the
      relative offset.
    Arguments:
    - `offset`: The relative offset from the start of the block.
    Throws:
    - `OverrunBufferException`

### unpack_int16(self, offset) | source code
    Returns a little-endian signed WORD (2 bytes) from the
      relative offset.
    Arguments:
    - `offset`: The relative offset from the start of the block.
    Throws:
    - `OverrunBufferException`

### pack_word(self, offset, word) | source code
    Applies the little-endian WORD (2 bytes) to the relative offset.
    Arguments:
    - `offset`: The relative offset from the start of the block.
    - `word`: The data to apply.

### unpack_dword(self, offset) | source code
    Returns a little-endian DWORD (4 bytes) from the relative offset.
    Arguments:
    - `offset`: The relative offset from the start of the block.
    Throws:
    - `OverrunBufferException`

### unpack_dword_be(self, offset) | source code
    Returns a big-endian DWORD (4 bytes) from the relative offset.
    Arguments:
    - `offset`: The relative offset from the start of the block.
    Throws:
    - `OverrunBufferException`

### unpack_int32(self, offset) | source code
    Returns a little-endian signed integer (4 bytes) from the
      relative offset.
    Arguments:
    - `offset`: The relative offset from the start of the block.
    Throws:
    - `OverrunBufferException`

### unpack_qword(self, offset) | source code
    Returns a little-endian QWORD (8 bytes) from the relative offset.
    Arguments:
    - `offset`: The relative offset from the start of the block.
    Throws:
    - `OverrunBufferException`

### unpack_int64(self, offset) | source code
    Returns a little-endian signed 64-bit integer (8 bytes) from
      the relative offset.
    Arguments:
    - `offset`: The relative offset from the start of the block.
    Throws:
    - `OverrunBufferException`

### unpack_float(self, offset) | source code
    Returns a single-precision float (4 bytes) from
      the relative offset.  IEEE 754 format.
    Arguments:
    - `offset`: The relative offset from the start of the block.
    Throws:
    - `OverrunBufferException`

### unpack_double(self, offset) | source code
    Returns a double-precision float (8 bytes) from
      the relative offset.  IEEE 754 format.
    Arguments:
    - `offset`: The relative offset from the start of the block.
    Throws:
    - `OverrunBufferException`

### unpack_binary(self, offset, length=False) | source code
    Returns raw binary data from the relative offset with the given length.
    Arguments:
    - `offset`: The relative offset from the start of the block.
    - `length`: The length of the binary blob. If zero, the empty string
        zero length is returned.
    Throws:
    - `OverrunBufferException`

### unpack_string(self, offset, length) | source code
    Returns a string from the relative offset with the given length.
    Arguments:
    - `offset`: The relative offset from the start of the block.
    - `length`: The length of the string.
    Throws:
    - `OverrunBufferException`

### unpack_wstring(self, offset, length) | source code
    Returns a string from the relative offset with the given length,
    where each character is a wchar (2 bytes)
    Arguments:
    - `offset`: The relative offset from the start of the block.
    - `length`: The length of the string.
    Throws:
    - `UnicodeDecodeError`

### unpack_dosdate(self, offset) | source code
    Returns a datetime from the DOSDATE and DOSTIME starting at
    the relative offset.
    Arguments:
    - `offset`: The relative offset from the start of the block.
    Throws:
    - `OverrunBufferException`

### unpack_filetime(self, offset) | source code
    Returns a datetime from the QWORD Windows timestamp starting at
    the relative offset.
    Arguments:
    - `offset`: The relative offset from the start of the block.
    Throws:
    - `OverrunBufferException`

### unpack_systemtime(self, offset) | source code
    Returns a datetime from the QWORD Windows SYSTEMTIME timestamp
      starting at the relative offset.
      See http://msdn.microsoft.com/en-us/library/ms724950%28VS.85%29.aspx
    Arguments:
    - `offset`: The relative offset from the start of the block.
    Throws:
    - `OverrunBufferException`

### unpack_guid(self, offset) | source code
    Returns a string containing a GUID starting at the relative offset.
    Arguments:
    - `offset`: The relative offset from the start of the block.
    Throws:
    - `OverrunBufferException`