Package Evtx :: Module Evtx :: Class ChunkHeader
[hide private]
[frames] | no frames]

Class ChunkHeader

source code


Instance Methods [hide private]
 
__init__(self, buf, offset)
Constructor.
source code
 
__repr__(self)
repr(x)
source code
 
__str__(self)
str(x)
source code
 
check_magic(self)
@return A boolean that indicates if the first eight bytes of the ChunkHeader match the expected magic value.
source code
 
calculate_header_checksum(self)
@return A integer in the range of an unsigned int that is the calculated CRC32 checksum of the ChunkHeader fields.
source code
 
calculate_data_checksum(self)
@return A integer in the range of an unsigned int that is the calculated CRC32 checksum of the Chunk data.
source code
 
verify(self)
@return A boolean that indicates that the FileHeader successfully passes a set of heuristic checks that all EVTX ChunkHeaders should pass.
source code
 
_load_strings(self) source code
 
strings(self)
@return A dict(offset --> NameStringNode)
source code
 
add_string(self, offset, parent=None)
@param offset An integer offset that is relative to the start of this chunk.
source code
 
_load_templates(self)
@return None
source code
 
add_template(self, offset, parent=None)
@param offset An integer which contains the chunk-relative offset to a template to load into this Chunk.
source code
 
templates(self)
@return A dict(offset --> Template) of all encountered templates in this Chunk.
source code
 
first_record(self) source code
 
records(self) source code

Inherited from BinaryParser.Block: __unicode__, absolute_offset, current_field_offset, declare_field, offset, pack_word, unpack_binary, unpack_byte, unpack_dosdate, unpack_double, unpack_dword, unpack_dword_be, unpack_filetime, unpack_float, unpack_guid, unpack_int16, unpack_int32, unpack_int64, unpack_int8, unpack_qword, unpack_string, unpack_systemtime, unpack_word, unpack_word_be, unpack_wstring

Inherited from object: __delattr__, __format__, __getattribute__, __hash__, __new__, __reduce__, __reduce_ex__, __setattr__, __sizeof__, __subclasshook__

Properties [hide private]

Inherited from object: __class__

Method Details [hide private]

__init__(self, buf, offset)
(Constructor)

source code 

Constructor.
Arguments:
- `buf`: Byte string containing stuff to parse.
- `offset`: The offset into the buffer at which the block starts.

Overrides: object.__init__
(inherited documentation)

__repr__(self)
(Representation operator)

source code 

repr(x)

Overrides: object.__repr__
(inherited documentation)

__str__(self)
(Informal representation operator)

source code 

str(x)

Overrides: object.__str__
(inherited documentation)

add_string(self, offset, parent=None)

source code 

@param offset An integer offset that is relative to the start of
  this chunk.
@param parent (Optional) The parent of the newly created
   NameStringNode instance. (Default: this chunk).
@return None

add_template(self, offset, parent=None)

source code 

@param offset An integer which contains the chunk-relative offset
   to a template to load into this Chunk.
@param parent (Optional) The parent of the newly created
   TemplateNode instance. (Default: this chunk).
@return Newly added TemplateNode instance.