|
|
|
|
|
|
|
|
|
|
|
check_magic(self)
@return A boolean that indicates if the first eight bytes of
the ChunkHeader match the expected magic value. |
source code
|
|
|
|
calculate_header_checksum(self)
@return A integer in the range of an unsigned int that
is the calculated CRC32 checksum of the ChunkHeader fields. |
source code
|
|
|
|
calculate_data_checksum(self)
@return A integer in the range of an unsigned int that
is the calculated CRC32 checksum of the Chunk data. |
source code
|
|
|
|
verify(self)
@return A boolean that indicates that the FileHeader
successfully passes a set of heuristic checks that
all EVTX ChunkHeaders should pass. |
source code
|
|
|
|
|
|
|
strings(self)
@return A dict(offset --> NameStringNode) |
source code
|
|
|
|
add_string(self,
offset,
parent=None)
@param offset An integer offset that is relative to the start of
this chunk. |
source code
|
|
|
|
|
|
|
add_template(self,
offset,
parent=None)
@param offset An integer which contains the chunk-relative offset
to a template to load into this Chunk. |
source code
|
|
|
|
templates(self)
@return A dict(offset --> Template) of all encountered
templates in this Chunk. |
source code
|
|
|
|
|
|
|
|
|
Inherited from BinaryParser.Block:
__unicode__,
absolute_offset,
current_field_offset,
declare_field,
offset,
pack_word,
unpack_binary,
unpack_byte,
unpack_dosdate,
unpack_double,
unpack_dword,
unpack_dword_be,
unpack_filetime,
unpack_float,
unpack_guid,
unpack_int16,
unpack_int32,
unpack_int64,
unpack_int8,
unpack_qword,
unpack_string,
unpack_systemtime,
unpack_word,
unpack_word_be,
unpack_wstring
Inherited from object:
__delattr__,
__format__,
__getattribute__,
__hash__,
__new__,
__reduce__,
__reduce_ex__,
__setattr__,
__sizeof__,
__subclasshook__
|