Package Evtx :: Module Nodes
[hide private]
[frames] | no frames]

Module Nodes

source code

Classes [hide private]
  SYSTEM_TOKENS
  SuppressConditionalSubstitution
This exception is to be thrown to indicate that a conditional substitution evaluated to NULL, and the parent element should be suppressed.
  BXmlNode
  NameStringNode
  TemplateNode
  EndOfStreamNode
The binary XML node for the system token 0x00.
  OpenStartElementNode
The binary XML node for the system token 0x01.
  CloseStartElementNode
The binary XML node for the system token 0x02.
  CloseEmptyElementNode
The binary XML node for the system token 0x03.
  CloseElementNode
The binary XML node for the system token 0x04.
  ValueNode
The binary XML node for the system token 0x05.
  AttributeNode
The binary XML node for the system token 0x06.
  CDataSectionNode
The binary XML node for the system token 0x07.
  EntityReferenceNode
The binary XML node for the system token 0x09.
  ProcessingInstructionTargetNode
The binary XML node for the system token 0x0A.
  ProcessingInstructionDataNode
The binary XML node for the system token 0x0B.
  TemplateInstanceNode
The binary XML node for the system token 0x0C.
  NormalSubstitutionNode
The binary XML node for the system token 0x0D.
  ConditionalSubstitutionNode
The binary XML node for the system token 0x0E.
  StreamStartNode
The binary XML node for the system token 0x0F.
  RootNode
The binary XML node for the Root node.
  VariantTypeNode
  NullTypeNode
Variant type 0x00.
  WstringTypeNode
Variant ttype 0x01.
  StringTypeNode
Variant type 0x02.
  SignedByteTypeNode
Variant type 0x03.
  UnsignedByteTypeNode
Variant type 0x04.
  SignedWordTypeNode
Variant type 0x05.
  UnsignedWordTypeNode
Variant type 0x06.
  SignedDwordTypeNode
Variant type 0x07.
  UnsignedDwordTypeNode
Variant type 0x08.
  SignedQwordTypeNode
Variant type 0x09.
  UnsignedQwordTypeNode
Variant type 0x0A.
  FloatTypeNode
Variant type 0x0B.
  DoubleTypeNode
Variant type 0x0C.
  BooleanTypeNode
Variant type 0x0D.
  BinaryTypeNode
Variant type 0x0E.
  GuidTypeNode
Variant type 0x0F.
  SizeTypeNode
Variant type 0x10.
  FiletimeTypeNode
Variant type 0x11.
  SystemtimeTypeNode
Variant type 0x12.
  SIDTypeNode
Variant type 0x13.
  Hex32TypeNode
Variant type 0x14.
  Hex64TypeNode
Variant type 0x15.
  BXmlTypeNode
Variant type 0x21.
  WstringArrayTypeNode
Variant ttype 0x81.
Functions [hide private]
 
get_variant_value(buf, offset, chunk, parent, type_, length=None)
@return A VariantType subclass instance found in the given buffer and offset.
source code
Variables [hide private]
  node_dispatch_table = [<class 'Evtx.Nodes.EndOfStreamNode'>, <...
  node_readable_tokens = ['End of Stream', 'Open Start Element',...
  __package__ = 'Evtx'
Variables Details [hide private]

node_dispatch_table

Value:
[<class 'Evtx.Nodes.EndOfStreamNode'>,
 <class 'Evtx.Nodes.OpenStartElementNode'>,
 <class 'Evtx.Nodes.CloseStartElementNode'>,
 <class 'Evtx.Nodes.CloseEmptyElementNode'>,
 <class 'Evtx.Nodes.CloseElementNode'>,
 <class 'Evtx.Nodes.ValueNode'>,
 <class 'Evtx.Nodes.AttributeNode'>,
 <class 'Evtx.Nodes.CDataSectionNode'>,
...

node_readable_tokens

Value:
['End of Stream',
 'Open Start Element',
 'Close Start Element',
 'Close Empty Element',
 'Close Element',
 'Value',
 'Attribute',
 'unknown',
...