Package Evtx :: Module BinaryParser :: Class Block
[hide private]
[frames] | no frames]

Class Block

source code


Base class for structure blocks in binary parsing. A block is associated with a offset into a byte-string.

Instance Methods [hide private]
 
__init__(self, buf, offset)
Constructor.
source code
 
__repr__(self)
repr(x)
source code
 
__unicode__(self) source code
 
__str__(self)
str(x)
source code
 
declare_field(self, type, name, offset=None, length=None)
Declaratively add fields to this block.
source code
 
current_field_offset(self) source code
 
unpack_byte(self, offset)
Returns a little-endian unsigned byte from the relative offset.
source code
 
unpack_int8(self, offset)
Returns a little-endian signed byte from the relative offset.
source code
 
unpack_word(self, offset)
Returns a little-endian unsigned WORD (2 bytes) from the relative offset.
source code
 
unpack_word_be(self, offset)
Returns a big-endian unsigned WORD (2 bytes) from the relative offset.
source code
 
unpack_int16(self, offset)
Returns a little-endian signed WORD (2 bytes) from the relative offset.
source code
 
pack_word(self, offset, word)
Applies the little-endian WORD (2 bytes) to the relative offset.
source code
 
unpack_dword(self, offset)
Returns a little-endian DWORD (4 bytes) from the relative offset.
source code
 
unpack_dword_be(self, offset)
Returns a big-endian DWORD (4 bytes) from the relative offset.
source code
 
unpack_int32(self, offset)
Returns a little-endian signed integer (4 bytes) from the relative offset.
source code
 
unpack_qword(self, offset)
Returns a little-endian QWORD (8 bytes) from the relative offset.
source code
 
unpack_int64(self, offset)
Returns a little-endian signed 64-bit integer (8 bytes) from the relative offset.
source code
 
unpack_float(self, offset)
Returns a single-precision float (4 bytes) from the relative offset.
source code
 
unpack_double(self, offset)
Returns a double-precision float (8 bytes) from the relative offset.
source code
 
unpack_binary(self, offset, length=False)
Returns raw binary data from the relative offset with the given length.
source code
 
unpack_string(self, offset, length)
Returns a string from the relative offset with the given length.
source code
 
unpack_wstring(self, offset, length)
Returns a string from the relative offset with the given length, where each character is a wchar (2 bytes) Arguments: - `offset`: The relative offset from the start of the block.
source code
 
unpack_dosdate(self, offset)
Returns a datetime from the DOSDATE and DOSTIME starting at the relative offset.
source code
 
unpack_filetime(self, offset)
Returns a datetime from the QWORD Windows timestamp starting at the relative offset.
source code
 
unpack_systemtime(self, offset)
Returns a datetime from the QWORD Windows SYSTEMTIME timestamp starting at the relative offset.
source code
 
unpack_guid(self, offset)
Returns a string containing a GUID starting at the relative offset.
source code
 
absolute_offset(self, offset)
Get the absolute offset from an offset relative to this block Arguments: - `offset`: The relative offset into this block.
source code
 
offset(self)
Equivalent to self.absolute_offset(0x0), which is the starting offset of this block.
source code

Inherited from object: __delattr__, __format__, __getattribute__, __hash__, __new__, __reduce__, __reduce_ex__, __setattr__, __sizeof__, __subclasshook__

Properties [hide private]

Inherited from object: __class__

Method Details [hide private]

__init__(self, buf, offset)
(Constructor)

source code 

Constructor.
Arguments:
- `buf`: Byte string containing stuff to parse.
- `offset`: The offset into the buffer at which the block starts.

Overrides: object.__init__

__repr__(self)
(Representation operator)

source code 

repr(x)

Overrides: object.__repr__
(inherited documentation)

__str__(self)
(Informal representation operator)

source code 

str(x)

Overrides: object.__str__
(inherited documentation)

declare_field(self, type, name, offset=None, length=None)

source code 

Declaratively add fields to this block.
This method will dynamically add corresponding
  offset and unpacker methods to this block.
Arguments:
- `type`: A string. Should be one of the unpack_* types.
- `name`: A string.
- `offset`: A number.
- `length`: (Optional) A number. For (w)strings, length in chars.

unpack_byte(self, offset)

source code 

Returns a little-endian unsigned byte from the relative offset.
Arguments:
- `offset`: The relative offset from the start of the block.
Throws:
- `OverrunBufferException`

unpack_int8(self, offset)

source code 

Returns a little-endian signed byte from the relative offset.
Arguments:
- `offset`: The relative offset from the start of the block.
Throws:
- `OverrunBufferException`

unpack_word(self, offset)

source code 

Returns a little-endian unsigned WORD (2 bytes) from the
  relative offset.
Arguments:
- `offset`: The relative offset from the start of the block.
Throws:
- `OverrunBufferException`

unpack_word_be(self, offset)

source code 

Returns a big-endian unsigned WORD (2 bytes) from the
  relative offset.
Arguments:
- `offset`: The relative offset from the start of the block.
Throws:
- `OverrunBufferException`

unpack_int16(self, offset)

source code 

Returns a little-endian signed WORD (2 bytes) from the
  relative offset.
Arguments:
- `offset`: The relative offset from the start of the block.
Throws:
- `OverrunBufferException`

pack_word(self, offset, word)

source code 

Applies the little-endian WORD (2 bytes) to the relative offset.
Arguments:
- `offset`: The relative offset from the start of the block.
- `word`: The data to apply.

unpack_dword(self, offset)

source code 

Returns a little-endian DWORD (4 bytes) from the relative offset.
Arguments:
- `offset`: The relative offset from the start of the block.
Throws:
- `OverrunBufferException`

unpack_dword_be(self, offset)

source code 

Returns a big-endian DWORD (4 bytes) from the relative offset.
Arguments:
- `offset`: The relative offset from the start of the block.
Throws:
- `OverrunBufferException`

unpack_int32(self, offset)

source code 

Returns a little-endian signed integer (4 bytes) from the
  relative offset.
Arguments:
- `offset`: The relative offset from the start of the block.
Throws:
- `OverrunBufferException`

unpack_qword(self, offset)

source code 

Returns a little-endian QWORD (8 bytes) from the relative offset.
Arguments:
- `offset`: The relative offset from the start of the block.
Throws:
- `OverrunBufferException`

unpack_int64(self, offset)

source code 

Returns a little-endian signed 64-bit integer (8 bytes) from
  the relative offset.
Arguments:
- `offset`: The relative offset from the start of the block.
Throws:
- `OverrunBufferException`

unpack_float(self, offset)

source code 

Returns a single-precision float (4 bytes) from
  the relative offset.  IEEE 754 format.
Arguments:
- `offset`: The relative offset from the start of the block.
Throws:
- `OverrunBufferException`

unpack_double(self, offset)

source code 

Returns a double-precision float (8 bytes) from
  the relative offset.  IEEE 754 format.
Arguments:
- `offset`: The relative offset from the start of the block.
Throws:
- `OverrunBufferException`

unpack_binary(self, offset, length=False)

source code 

Returns raw binary data from the relative offset with the given length.
Arguments:
- `offset`: The relative offset from the start of the block.
- `length`: The length of the binary blob. If zero, the empty string
    zero length is returned.
Throws:
- `OverrunBufferException`

unpack_string(self, offset, length)

source code 

Returns a string from the relative offset with the given length.
Arguments:
- `offset`: The relative offset from the start of the block.
- `length`: The length of the string.
Throws:
- `OverrunBufferException`

unpack_wstring(self, offset, length)

source code 

Returns a string from the relative offset with the given length,
where each character is a wchar (2 bytes)
Arguments:
- `offset`: The relative offset from the start of the block.
- `length`: The length of the string.
Throws:
- `UnicodeDecodeError`

unpack_dosdate(self, offset)

source code 

Returns a datetime from the DOSDATE and DOSTIME starting at
the relative offset.
Arguments:
- `offset`: The relative offset from the start of the block.
Throws:
- `OverrunBufferException`

unpack_filetime(self, offset)

source code 

Returns a datetime from the QWORD Windows timestamp starting at
the relative offset.
Arguments:
- `offset`: The relative offset from the start of the block.
Throws:
- `OverrunBufferException`

unpack_systemtime(self, offset)

source code 

Returns a datetime from the QWORD Windows SYSTEMTIME timestamp
  starting at the relative offset.
  See http://msdn.microsoft.com/en-us/library/ms724950%28VS.85%29.aspx
Arguments:
- `offset`: The relative offset from the start of the block.
Throws:
- `OverrunBufferException`

unpack_guid(self, offset)

source code 

Returns a string containing a GUID starting at the relative offset.
Arguments:
- `offset`: The relative offset from the start of the block.
Throws:
- `OverrunBufferException`