Evtx.Evtx.ChunkHeader

Package Evtx :: Module Evtx :: Class ChunkHeader |
[hide private]
[frames] | no frames]

# Class ChunkHeader

source code

Instance Methods | [hide private]
__init__(self, buf, offset) Constructor. | source code
__repr__(self) repr(x) | source code
__str__(self) str(x) | source code
check_magic(self) @return A boolean that indicates if the first eight bytes of the ChunkHeader match the expected magic value. | source code
calculate_header_checksum(self) @return A integer in the range of an unsigned int that is the calculated CRC32 checksum of the ChunkHeader fields. | source code
calculate_data_checksum(self) @return A integer in the range of an unsigned int that is the calculated CRC32 checksum of the Chunk data. | source code
verify(self) @return A boolean that indicates that the FileHeader successfully passes a set of heuristic checks that all EVTX ChunkHeaders should pass. | source code
_load_strings(self) | source code
strings(self) @return A dict(offset --> NameStringNode) | source code
add_string(self, offset, parent=None) @param offset An integer offset that is relative to the start of this chunk. | source code
_load_templates(self) @return None | source code
add_template(self, offset, parent=None) @param offset An integer which contains the chunk-relative offset to a template to load into this Chunk. | source code
templates(self) @return A dict(offset --> Template) of all encountered templates in this Chunk. | source code
first_record(self) | source code
records(self) | source code
Inherited from `BinaryParser.Block`: `__unicode__`, `absolute_offset`, `current_field_offset`, `declare_field`, `offset`, `pack_word`, `unpack_binary`, `unpack_byte`, `unpack_dosdate`, `unpack_double`, `unpack_dword`, `unpack_dword_be`, `unpack_filetime`, `unpack_float`, `unpack_guid`, `unpack_int16`, `unpack_int32`, `unpack_int64`, `unpack_int8`, `unpack_qword`, `unpack_string`, `unpack_systemtime`, `unpack_word`, `unpack_word_be`, `unpack_wstring` Inherited from `object`: `__delattr__`, `__format__`, `__getattribute__`, `__hash__`, `__new__`, `__reduce__`, `__reduce_ex__`, `__setattr__`, `__sizeof__`, `__subclasshook__`

Properties | [hide private]
Inherited from `object`: `__class__`

Method Details | [hide private]

### __init__(self, buf, offset) (Constructor) | source code
    Constructor.
    Arguments:
    - `buf`: Byte string containing stuff to parse.
    - `offset`: The offset into the buffer at which the block starts.
Overrides: object.__init__ (inherited documentation)

### __repr__(self) (Representation operator) | source code
repr(x) Overrides: object.__repr__ (inherited documentation)

### __str__(self) (Informal representation operator) | source code
str(x) Overrides: object.__str__ (inherited documentation)

### add_string(self, offset, parent=None) | source code
    @param offset An integer offset that is relative to the start of
      this chunk.
    @param parent (Optional) The parent of the newly created
       NameStringNode instance. (Default: this chunk).
    @return None

### add_template(self, offset, parent=None) | source code
    @param offset An integer which contains the chunk-relative offset
       to a template to load into this Chunk.
    @param parent (Optional) The parent of the newly created
       TemplateNode instance. (Default: this chunk).
    @return Newly added TemplateNode instance.