[hide private]
[frames] | no frames]

[ Module Hierarchy | Class Hierarchy ]

# Class Hierarchy

- Evtx.Nodes.SYSTEM_TOKENS
- object: The most base type
  - exceptions.BaseException: Common base class for all exceptions
    - exceptions.Exception: Common base class for all non-exit exceptions.
      - Evtx.BinaryParser.BinaryParserException: Base Exception class for binary parsing.
        - Evtx.BinaryParser.ParseException: An exception to be thrown during binary parsing, such as when an invalid header is encountered.
          - Evtx.Evtx.InvalidRecordException
          - Evtx.BinaryParser.OverrunBufferException
      - Evtx.Nodes.SuppressConditionalSubstitution: This exception is to be thrown to indicate that a conditional substitution evaluated to NULL, and the parent element should be suppressed.
      - Evtx.Views.UnexpectedElementException
  - Evtx.BinaryParser.Block: Base class for structure blocks in binary parsing.
    - Evtx.Nodes.BXmlNode
      - Evtx.Nodes.AttributeNode: The binary XML node for the system token 0x06.
      - Evtx.Nodes.CDataSectionNode: The binary XML node for the system token 0x07.
      - Evtx.Nodes.CloseElementNode: The binary XML node for the system token 0x04.
      - Evtx.Nodes.CloseEmptyElementNode: The binary XML node for the system token 0x03.
      - Evtx.Nodes.CloseStartElementNode: The binary XML node for the system token 0x02.
      - Evtx.Nodes.ConditionalSubstitutionNode: The binary XML node for the system token 0x0E.
      - Evtx.Nodes.EndOfStreamNode: The binary XML node for the system token 0x00.
      - Evtx.Nodes.EntityReferenceNode: The binary XML node for the system token 0x09.
      - Evtx.Nodes.NameStringNode
      - Evtx.Nodes.NormalSubstitutionNode: The binary XML node for the system token 0x0D.
      - Evtx.Nodes.OpenStartElementNode: The binary XML node for the system token 0x01.
      - Evtx.Nodes.ProcessingInstructionDataNode: The binary XML node for the system token 0x0B.
      - Evtx.Nodes.ProcessingInstructionTargetNode: The binary XML node for the system token 0x0A.
      - Evtx.Nodes.RootNode: The binary XML node for the Root node.
      - Evtx.Nodes.StreamStartNode: The binary XML node for the system token 0x0F.
      - Evtx.Nodes.TemplateInstanceNode: The binary XML node for the system token 0x0C.
      - Evtx.Nodes.TemplateNode
      - Evtx.Nodes.ValueNode: The binary XML node for the system token 0x05.
      - Evtx.Nodes.VariantTypeNode
        - Evtx.Nodes.BXmlTypeNode: Variant type 0x21.
        - Evtx.Nodes.BinaryTypeNode: Variant type 0x0E.
        - Evtx.Nodes.BooleanTypeNode: Variant type 0x0D.
        - Evtx.Nodes.DoubleTypeNode: Variant type 0x0C.
        - Evtx.Nodes.FiletimeTypeNode: Variant type 0x11.
        - Evtx.Nodes.FloatTypeNode: Variant type 0x0B.
        - Evtx.Nodes.GuidTypeNode: Variant type 0x0F.
        - Evtx.Nodes.Hex32TypeNode: Variant type 0x14.
        - Evtx.Nodes.Hex64TypeNode: Variant type 0x15.
        - Evtx.Nodes.SIDTypeNode: Variant type 0x13.
        - Evtx.Nodes.SignedByteTypeNode: Variant type 0x03.
        - Evtx.Nodes.SignedDwordTypeNode: Variant type 0x07.
        - Evtx.Nodes.SignedQwordTypeNode: Variant type 0x09.
        - Evtx.Nodes.SignedWordTypeNode: Variant type 0x05.
        - Evtx.Nodes.SizeTypeNode: Variant type 0x10.
        - Evtx.Nodes.StringTypeNode: Variant type 0x02.
        - Evtx.Nodes.SystemtimeTypeNode: Variant type 0x12.
        - Evtx.Nodes.UnsignedByteTypeNode: Variant type 0x04.
        - Evtx.Nodes.UnsignedDwordTypeNode: Variant type 0x08.
        - Evtx.Nodes.UnsignedQwordTypeNode: Variant type 0x0A.
        - Evtx.Nodes.UnsignedWordTypeNode: Variant type 0x06.
        - Evtx.Nodes.WstringArrayTypeNode: Variant ttype 0x81.
        - Evtx.Nodes.WstringTypeNode: Variant ttype 0x01.
    - Evtx.Evtx.ChunkHeader
    - Evtx.Evtx.FileHeader
    - Evtx.Evtx.Record
  - Evtx.Evtx.Evtx: A convenience class that makes it easy to open an EVTX file and start iterating the important structures.
  - Evtx.Nodes.NullTypeNode: Variant type 0x00.
  - Evtx.Evtx.Template
  - Evtx.BinaryParser.memoize: cache the return value of a method