|
|
|
|
|
|
|
check_magic(self)
@return A boolean that indicates if the first eight bytes of
the ChunkHeader match the expected magic value. |
source code
|
|
|
calculate_header_checksum(self)
@return A integer in the range of an unsigned int that
is the calculated CRC32 checksum of the ChunkHeader fields. |
source code
|
|
|
calculate_data_checksum(self)
@return A integer in the range of an unsigned int that
is the calculated CRC32 checksum of the Chunk data. |
source code
|
|
|
verify(self)
@return A boolean that indicates that the FileHeader
successfully passes a set of heuristic checks that
all EVTX ChunkHeaders should pass. |
source code
|
|
|
|
|
strings(self)
@return A dict(offset --> NameStringNode) |
source code
|
|
|
add_string(self,
offset,
parent=None)
@param offset An integer offset that is relative to the start of
this chunk. |
source code
|
|
|
|
|
add_template(self,
offset,
parent=None)
@param offset An integer which contains the chunk-relative offset
to a template to load into this Chunk. |
source code
|
|
|
templates(self)
@return A dict(offset --> Template) of all encountered
templates in this Chunk. |
source code
|
|
|
|
|
|
Inherited from BinaryParser.Block :
__unicode__ ,
absolute_offset ,
current_field_offset ,
declare_field ,
offset ,
pack_word ,
unpack_binary ,
unpack_byte ,
unpack_dosdate ,
unpack_double ,
unpack_dword ,
unpack_dword_be ,
unpack_filetime ,
unpack_float ,
unpack_guid ,
unpack_int16 ,
unpack_int32 ,
unpack_int64 ,
unpack_int8 ,
unpack_qword ,
unpack_string ,
unpack_systemtime ,
unpack_word ,
unpack_word_be ,
unpack_wstring
Inherited from object :
__delattr__ ,
__format__ ,
__getattribute__ ,
__hash__ ,
__new__ ,
__reduce__ ,
__reduce_ex__ ,
__setattr__ ,
__sizeof__ ,
__subclasshook__
|