Evtx.BinaryParser

Package Evtx :: Module BinaryParser |
[hide private]
[frames] | no frames]

# Module BinaryParser

source code

Classes | [hide private]
| memoize cache the return value of a method
| BinaryParserException Base Exception class for binary parsing.
| ParseException An exception to be thrown during binary parsing, such as when an invalid header is encountered.
| OverrunBufferException
| Block Base class for structure blocks in binary parsing.

Functions | [hide private]
debug(*message) TODO(wb): replace with logging | source code
warning(message) TODO(wb): replace with logging | source code
info(message) TODO(wb): replace with logging | source code
error(message) TODO(wb): replace with logging | source code
hex_dump(src, start_addr=0) see: http://code.activestate.com/recipes/142812-hex-dumper/ @param src A bytestring containing the data to dump. | source code
align(offset, alignment) Return the offset aligned to the nearest greater given alignment... | source code
dosdate(dosdate, dostime) `dosdate`: 2 bytes, little endian. | source code
parse_filetime(qword) | source code

Variables | [hide private]
| verbose = `False`
| __package__ = ``'``Evtx``'``

Function Details | [hide private]

### hex_dump(src, start_addr=0) | source code
    see:
    http://code.activestate.com/recipes/142812-hex-dumper/
    @param src A bytestring containing the data to dump.
    @param start_addr An integer representing the start
      address of the data in whatever context it comes from.
    @return A string containing a classic hex dump with 16
      bytes per line.  If start_addr is provided, then the
      data is interpreted as starting at this offset, and
      the offset column is updated accordingly.

### align(offset, alignment) | source code
    Return the offset aligned to the nearest greater given alignment
    Arguments:
    - `offset`: An integer
    - `alignment`: An integer

### dosdate(dosdate, dostime) | source code
`dosdate`: 2 bytes, little endian. `dostime`: 2 bytes, little endian. returns: datetime.datetime or datetime.datetime.min on error