Package Evtx :: Module BinaryParser
[hide private]
[frames] | no frames]

Module BinaryParser

source code

Classes [hide private]
  memoize
cache the return value of a method
  BinaryParserException
Base Exception class for binary parsing.
  ParseException
An exception to be thrown during binary parsing, such as when an invalid header is encountered.
  OverrunBufferException
  Block
Base class for structure blocks in binary parsing.
Functions [hide private]
 
debug(*message)
TODO(wb): replace with logging
source code
 
warning(message)
TODO(wb): replace with logging
source code
 
info(message)
TODO(wb): replace with logging
source code
 
error(message)
TODO(wb): replace with logging
source code
 
hex_dump(src, start_addr=0)
see: http://code.activestate.com/recipes/142812-hex-dumper/ @param src A bytestring containing the data to dump.
source code
 
align(offset, alignment)
Return the offset aligned to the nearest greater given alignment...
source code
 
dosdate(dosdate, dostime)
`dosdate`: 2 bytes, little endian.
source code
 
parse_filetime(qword) source code
Variables [hide private]
  verbose = False
  __package__ = 'Evtx'
Function Details [hide private]

hex_dump(src, start_addr=0)

source code 

see:
http://code.activestate.com/recipes/142812-hex-dumper/
@param src A bytestring containing the data to dump.
@param start_addr An integer representing the start
  address of the data in whatever context it comes from.
@return A string containing a classic hex dump with 16
  bytes per line.  If start_addr is provided, then the
  data is interpreted as starting at this offset, and
  the offset column is updated accordingly.

align(offset, alignment)

source code 

Return the offset aligned to the nearest greater given alignment
Arguments:
- `offset`: An integer
- `alignment`: An integer

dosdate(dosdate, dostime)

source code 

`dosdate`: 2 bytes, little endian. `dostime`: 2 bytes, little endian. returns: datetime.datetime or datetime.datetime.min on error