Pro.Core
— Core API for parsing and scanning files¶
Core Concepts¶
Some of the most important classes are:
NTContainer
- This is a generic container used to encapsulate data such as files and memory. It’s an extremely important class and it’s used extensively. Containers can be created through SDK functions such ascreateContainerFromFile()
andnewContainer()
.NTBuffer
/NTContainerBuffer
/CFFBuffer
/etc. - These type of classes are used to efficiently read iteratively small amounts of data from a source.NTBuffer
is the base class and derived classes are named after the object they read from. E.g.:NTContainerBuffer
reads fromNTContainer
andCFFBuffer
reads fromCFFObject
.NTTextStream
/NTTextBuffer
/NTTextStringBuffer
- These classes are used to output text. The amount of indentation can be specified.NTTextStream
is the base class and derived classes are named after the output type:NTTextBuffer
outputs to a utf-8 array andNTTextStringBuffer
to a utf-16 array.NTXml
- Used to parse XML. This class is fast and secure. The code is based on RapidXML.CFFObject
- The class from which every format class is derived (ZipObject, PEObject, etc.). WhileNTContainer
provides basic parsing facilities, more complex types and the use ofCFFStruct
rely uponCFFObject
.CFFHeader
- Headers contain definition of structures and can be loaded from SQLite files or XML strings. The structures can be imported from C/C++ code through the Header Manager or from debug symbols such as PDB files.CFFStruct
- This class represents a data structure.CFFFlags
- This class represents the flags of a field in a CFFStruct.
Hint
If you’re wondering why the case convention for methods is not always the same, the reason is simple. Classes such as CFFObject
and CFFStruct
are based on older code which followed the pascal-case convention. Consequently all derived classes like PEObject follow this convention. All other classes use the camel-case convention.
Basic types like integers and strings are automatically converted between C++ and Python. However, lists are preserved for efficiency reasons. Whenever the signature of a method contains a list or another type of container class, you must work with the C++ class. For example, the following example creates a list of C++ integers and iterates through it:
from Pro.Core import *
l = NTIntList()
for i in range(10):
l.append(i)
it = NTIntListIt(l)
while it.hasNext():
print(it.next())
Lists, vectors, hashes and sets all have specialized C++ classes usually relying on Qt containers. These type of classes are easily recognized due to the naming convention.
Note
While in C++ these classes are implemented as template classes, in Python they are exposed as different types. However, NTIntList
will have exactly the same methods as NTStringList
.
Parsing Files¶
Printing out a structure in a file can be as simple as:
from Pro.Core import *
from Pro.PE import *
def printDOSHeader(fname):
c = createContainerFromFile(fname)
if c.isNull():
return
pe = PEObject()
if not pe.Load(c):
return
out = NTTextBuffer()
pe.DosHeader().Dump(out) # CFFStruct.Dump
print(out.buffer)
Warning
Avoid initializing NTContainer
and CFFObject
objects globally in order to avoid memory leaks!
If you really need to use a global object, make sure to set it to None
when it is no longer needed. This way, the garbage collector will release the allocated memory.
NTContainer
is a powerful abstraction for reading from a target. The target can be a memory buffer, a file or even the memory of a remote process. When NTContainer
objects are returned by calling functions like createContainerFromFile()
or newContainer()
, they may either encapsulate a file or a memory buffer. Whether to use a file or a memory buffer is internally decided upon the basis of current memory resources.
If you want to make sure that an NTContainer
instance encapsulates a memory buffer you can do it by specifically setting its internal object:
from Pro.Core import *
c = NTContainer()
# set a byte array as the internal object of NTContainer
c.setData(b"")
# NTContainer are never resizeable by default
c.setResizable(True)
# append some data
c.append(b"foo")
# print out the size of 3
print(c.size())
Ranges and address spaces can also be applied to NTContainer
. Consider the following example:
from Pro.Core import *
c = NTContainer()
c.setData(b"Hello, world!")
# increase the reference count of c
c2 = c.clone()
# set a new range for c2
c2.setRange(7, 5)
# prints out "Hello, world!"
print(c.read(0, c.size()).decode("utf-8"))
# prints out "world"
print(c2.read(0, c2.size()).decode("utf-8"))
The c2
instance refers to the same object as c
but with a different range. This is very useful when working with embedded objects. For instance, parsing a resource inside of a binary file might only require setting the range on an instance NTContainer
of the parent binary file, before being passed onto CFFObject.Load()
.
It is not necessary to subclass CFFObject
in order parse a file. We can use CFFObject
directly:
from Pro.Core import *
xml_header = """<header>
<r id='_IMAGE_DOS_HEADER' type='struct'>
<f id='e_magic' type='unsigned short'/>
<f id='e_cblp' type='unsigned short'/>
<f id='e_cp' type='unsigned short'/>
<f id='e_crlc' type='unsigned short'/>
<f id='e_cparhdr' type='unsigned short'/>
<f id='e_minalloc' type='unsigned short'/>
<f id='e_maxalloc' type='unsigned short'/>
<f id='e_ss' type='unsigned short'/>
<f id='e_sp' type='unsigned short'/>
<f id='e_csum' type='unsigned short'/>
<f id='e_ip' type='unsigned short'/>
<f id='e_cs' type='unsigned short'/>
<f id='e_lfarlc' type='unsigned short'/>
<f id='e_ovno' type='unsigned short'/>
<f id='e_res' type='unsigned short [4]'/>
<f id='e_oemid' type='unsigned short'/>
<f id='e_oeminfo' type='unsigned short'/>
<f id='e_res2' type='unsigned short [10]'/>
<f id='e_lfanew' type='int'/>
</r>
</header>"""
def printStructure(fname):
c = createContainerFromFile(fname)
if c.isNull():
return
# load header from an XML string
header = CFFHeader()
if not header.LoadFromXml(xml_header):
return
obj = CFFObject()
# since CFFObject is not subclassed, the Load method cannot fail
obj.Load(c)
# map a structure to a specific offset
offset = 0
s = obj.MakeStruct(header, "_IMAGE_DOS_HEADER", offset, CFFSO_VC | CFFSO_Pack1)
out = NTTextBuffer()
s.Dump(out)
print(out.buffer)
To read in a buffered way from a target object, be it CFFObject
or NTContainer
, you can use NTBuffer
derived classes such as NTContainerBuffer
and CFFBuffer
:
from Pro.Core import *
def bufferedRead(fname):
c = createContainerFromFile(fname)
if c.isNull():
return
obj = CFFObject()
obj.Load(c)
offset = 0
r = obj.ToBuffer(offset)
try:
# read a single byte from the file
b = r.u8()
except IndexError:
print("error: out of range")
By default buffered readers default to Bufferize_Forwards
. If you want to read backwards or back and forth you can specify Bufferize_Backwards
or Bufferize_BackAndForth
respectively.
The default endianness can be specified both for CFFObject
and NTBuffer
instances. If not specified, endianness will default to ENDIANNESS_LITTLE
.
If need to parse an XML string, you can use our NTXml
class, which is both fast and secure.
from Pro.Core import *
x = NTXml()
ret = x.parse("<r><e t='test'></e></r>")
if ret == NTXml_ErrNone:
n = x.findChild(None, "r")
if n != None:
n = x.findChild(n, "e")
if n != None:
a = x.findAttribute(n, "t")
if a != None:
print(x.value(a))
All the filters which are available in the UI can be used programmatically from the SDK.
from Pro.Core import *
c = NTContainer()
c.setData(b"Hello, world!")
# compress data with zlib
fstr = "<flts><f name='pack/zlib' level='9' raw='true'/></flts>"
# set the last parameter to False to hide the wait-box
c = applyFilters(c, fstr, True)
# print out the compressed data
print(c.read(0, c.size()))
By using filters it’s possible to perform complex data operations with just a few lines of code. In the code snippet above we use a filter to compress the input data using zlib.
Scanning Files¶
In this section we offer an introduction into the internals of our scan engine.
The core classes are:
Report
- This class represents a project. A project can be unpacked or packed. When it’s unpacked, it consists of a directory containing a number of DBs and other files. When it’s packed, the same files are merged into a single file and may be compressed and/or encrypted. Fundamentally, in the context of file scanning, a project contains a SQLite3 database which, in turn, contains XML reports for each scanned file. The current instance of this class is returned byProCoreContext.getReport()
.ScanProvider
- This is the base class inherited by all the scan engines for the different file formats.ScanEntryData
- This is the class that contains the data passed toScanProvider.addEntry()
. Every time a scan provider for a file format encounters a threat, warning, information, privacy issue or embedded file, it callsScanProvider.addEntry()
.FormatTree
- A tree of uint32 ids that describe the layout structure of the analyzed file. This is the layout shown in the format view in the analysis workspace.FormatItemInfo
- The information returned for each individual item in the format tree.ScanProvider._formatViewInfo()
returns this information based on the id provided when constructing theFormatTree
.ScanViewData
- This class is returned byScanProvider._scanViewData()
andScanProvider._formatViewData()
. It may represent raw data, in case of an embedded file, as well as a complex UI.CommonSystem
- Logic providers return classes derived from this class to define a scanning behaviour. For instance, when creating a logic provider which analyzes only a specific set of files in a directory or on a file system, the derived classLocalSystem
can be used.ProCoreContext
- Provides context information like the current scan provider (ProCoreContext.currentScanProvider()
) or the current report (ProCoreContext.getReport()
). The global instance of this class is returned byproCoreContext()
.
As mentioned, for every scanned file an XML report is generated. Below is the commented schema of these XML reports.
<!-- XML schema
note: attributes are marked by parenthesis
o = object
(t = type
u = current entry unique id (in hex)
s = target (base64)
r = risk
f = flags)
s = scan entries
t = threat
w = warning
i = info
(t = type
u = unique identifier for the entry (in hex)
f = flags (optional)
s = target (optional, for embedded files)(base64)
l = object format (for embedded files)
)
(- ic = indirect category
it = indirect type
- fi = format item id
ii = internal file uid
v = view
of = offset
sz = size)
d = data (mandatory)
extra:
t = text
flts = filters
f = filter
(name + params)
s = shellcode
(a = arch
b = base address
)
e = embedded objects
o = object (see above)
h = hashes
md5 = md5 hash
etc.
m = metadata
(ct = creation time
mt = modification time
at = access time
)
e = entry (content is base64 encoded)
(id = name identifying the entry (raw)
l = label (base64)
f = flags (1 for text to show in report)
)
<!-- sample -->
<o t="pe" s="C:/file" r="100">
<!-- scan entries -->
<s>
<!-- threat entry -->
<t t="5" u="0">
<!-- custom data for the current entry, this is handled by
the specific scan provider -->
<d>
<start>0</start>
<size>1000</size>
</d>
<!-- human readable text (for showing advanced infos)
encoded in utf8->base64 -->
<t></t>
<!-- filters applied on the retrieved data -->
<flts>
<f n="aes" p="cbc;256" k="11223344.." />
<f n="z" />
</flts>
</t>
</s>
<!-- what follows is a list of embedded objects
in the same order of the embedded file entries -->
<e>
<o t="pdf" r="70">
<!-- ... -->
</o>
</e>
<!-- various hashes (if any) stored for the current object -->
<h>
<md5>00000000000000..</md5>
<sha1>000000000000...</sha1>
</h>
<!-- metadata (if any) -->
<m ct="hex" wt="hex" at="hex">
<e>base64</e>
<e f=1>base64</e> <!-- will be shown as text in the report view -->
</m>
</o>
The important part to understand when working with the SDK is the custom data mentioned in the schema (the <d> node). This is the custom XML data which is provided by the ScanProvider
during the scanning process via ScanProvider.addEntry()
and is then passed back to ScanProvider._scanViewData()
when requesting data relative to a scan entry.
The data returned from a scan entry can be everything: from a simple description of a threat to an embedded file. In fact, ScanProvider._scanViewData()
can return even complex UIs or native code disassembled by our Carbon engine.
Module API¶
Pro.Core module API.
Attributes:
Buffering method for
NTBuffer
.Buffering method for
NTBuffer
.Buffering method for
NTBuffer
.Buffering method for
NTBuffer
.32-bit index size for
CFFDB
.64-bit index size for
CFFDB
.Invalid index for
CFFDB
.Root index for
CFFDB
.Key sub-type raw.
Key sub-type string.
Key sub-type utf-8.
Key type certificate.
Key type invalid.
Key type password.
Base value for standard
CFFObject
notifications.
CFFObject
notification for malformed data.
CFFObject
notification for the file limit.
CFFObject
notification for failed decryption.
CFFObject
notification for failed decompression.
CFFObject
notification for an internal parsing limit.
CFFObject
notification for recursion.
CFFObject
notification for the decompression limit.
CFFObject
notification for the decompression nesting limit.The maximum supported pointer size.
The minimum supported pointer size.
16-bit pointer size.
32-bit pointer size.
64-bit pointer size.
Range value.
Last range value plus one.
Range value (alias of
CFFRange_Unreferenced
).Range value.
Range value.
Range value.
This flag specifies that the structure was generated by the Clang compiler.
Compiler mask for the flags of the structure.
This flag specifies that the structure is big-endian.
This flag specifies that the structure uses the default endianness.
This flag specifies that the structure is little-endian.
This flag specifies that the structure is big-endian.
This flag specifies that the structure uses the default endianness.
This flag specifies that the structure is little-endian.
Endianness mask for the flags of the structure.
This flag specifies that the structure was generated by the GCC compiler.
This flag specifies that the structure wasn’t generated by a specific compiler.
This flag specifies that the structure isn’t bound to specific platform.
This flag specifies that the structure has an alignment of 1.
This flag specifies that the structure has an alignment of 16.
This flag specifies that the structure has an alignment of 2.
This flag specifies that the structure has an alignment of 4.
This flag specifies that the structure has an alignment of 8.
Alignment mask for the flags of the structure.
This flag specifies that the structure doesn’t have an alignment.
Platform mask for the flags of the structure.
This flag specifies that the pointer size of the structure is 16-bits.
This flag specifies that the pointer size of the structure is 32-bits.
This flag specifies that the pointer size of the structure is 64-bits.
This flag specifies that the pointer size of the structure is the default one for the object.
Pointer mask for the flags of the structure.
This flag specifies that the structure was generated by the Visual C++ compiler.
This flag specifies that the structure was generated for the Windows platform.
If specified, makes an array of structure be null-terminated.
Scan entry type for ActionScript2.
Scan entry type for ActionScript3.
Scan entry type for application launches.
Scan entry type for attack surfaces.
Scan entry type for binary data.
Scan entry type for a blacklisted item.
Scan entry type for byte-code.
Scan entry type for Dalvik byte-code.
Scan entry type for data entries end.
Scan entry type for data entries start.
Scan entry type for debug data.
Scan entry type for decompression bombs.
Scan entry type for embedded objects.
Scan entry type for entry limits.
Scan entry type for when a file system objects exceeds the maximum size at which its files are automatically scanned.
Scan entry type for foreign data.
Scan entry type for free pages.
Scan entry type for geo-locations.
Scan entry type for hidden sheets.
Scan entry type for an intelligence report.
Scan entry type for interactive forms.
Scan entry type for invalid certificates.
Scan entry type for Java byte-code.
Scan entry type for JavaScript.
Scan entry type for MSIL byte-code.
Scan entry type for malformed data.
Scan entry type for malformed documents.
Scan entry type for meta-data.
Scan entry type for unknown meta-data.
Scan entry type for native code.
Scan entry type for failed decompression.
Scan entry type for failed decryption.
Scan entry type for successful decompression.
Scan entry type for successful decryption.
Scan entry type for personal data.
Scan entry type for required privileges.
Scan entry type for recursion.
Scan entry type for a report.
Scan entry type for issues in resources.
Scan entry type for scripts.
Scan entry type for shellcode.
Scan entry type for signature matches.
Scan entry type for spreadsheet formulas.
Scan entry type for symbolic links.
Scan entry type for thumbnails.
Scan entry type for TrueType fonts.
Scan entry type for trusted certificates.
Scan entry type for Type1 fonts.
Scan entry type for Type2 fonts.
Scan entry type for unaccounted space.
Scan entry type for unknown fonts.
Scan entry type for the decompression limit.
Scan entry type for the decompression nesting limit.
Scan entry type for unreferenced data.
Scan entry type for untrusted certificates.
Scan entry type for unverified certificates.
Scan entry type for VBA code.
Scan entry type for VBS scripts.
Scan entry type for version information.
Scan entry type for a whitelisted item.
Scan entry type for invalid checksums.
Scan entry type for invalid digests.
Scan entry type for invalid hashes.
Doesn’t include the member type (i.e.: public, protected, private) in the unmangled symbol.
Doesn’t include the calling convention in the unmangled symbol.
Doesn’t include the member type (i.e.: static, virtual, extern) in the unmangled symbol.
Doesn’t include the return type in the unmangled symbol.
Returns a simplified signature of the unmangled symbol.
Shows offsets in disassemblies shown in the text view.
Shows opcodes in disassemblies shown in the text view.
Big-endian option.
Little-endian option.
The mask for explicit object flags.
Address space format group.
Archive format group.
Audio format group.
Certificate format group.
Database format group.
Document format group.
Email format group.
Executable format group.
File system format group.
First format group.
Font format group.
Image format group.
Last format group (not included).
Managed executable format group.
Memory format group.
P2P format group.
Script format group.
System file format group.
Unknown format group.
Video format group.
This constant defines the size of a gigabyte.
Don’t sort scan providers flag.
Include dummy provider flag.
Include external scan providers flag.
Include only formats and not extensions flag.
Implicit object flag.
Invalid file or data offset.
Invalid file or data offset.
This constant defines the size of a kilobyte.
This constant defines the size of a megabyte.
Specifies the string nature of the meta-data.
Byte-array type nature.
Integer number type nature.
Real number type nature.
String type nature.
Unknown type nature.
The long date format used by the application’s locale.
The short date format specified by the application’s locale.
Creates the file only if it doesn’t already exist.
Read-only file access.
Shared write file access.
Read/write file access.
Ignores unknown flags and options.
Fifth day of the week.
ISO 8601 extended date format: either yyyy-MM-dd for dates or yyyy-MM-ddTHH:mm:ss (e.g.
Local time, controlled by a system time-zone setting.
First day of the week.
An offset in seconds from Coordinated Universal Time.
Executable memory flag.
Guarded memory flag.
Readable memory flag.
User-mode memory flag.
Writable memory flag.
Committed memory state.
Freed memory state.
Reserved memory state.
Image memory type.
Mapped memory type.
Private memory type.
RFC 2822, RFC 850 and RFC 1036 date format.
Sixth day of the week.
Seventh day of the week.
The long date format used by the operating system.
The short date format used by the operating system.
Date format equivalent to using the date format string
"ddd MMM d yyyy"
.Fourth day of the week.
A named time zone.
Second day of the week.
Coordinated Universal Time.
Third day of the week.
Returned if an allocation error occurred.
Returned if no error occurred.
Returned if a parse error occurred.
Returned if an unknown error occurred.
Parses malformed XML data.
Ignores XML node namespaces.
Returned if invalid flags were specified.
Returned if an invalid node was specified.
Returned if an invalid type was specified.
Address space flag for block I/O.
Address space flag to ignore invalid pages.
Address space flag for sparse address spaces.
Address space flag for process memory.
Address space standard flag which combines all supported flags.
Address space standard flag for dirty pages.
Address space standard flag for executable pages.
Address space standard flag for guarded pages.
Address space standard flag for readable/present pages.
Address space standard flag for transitional pages.
Address space standard flag for user mode pages.
Address space standard flag for writable pages.
Address space result for unsuccessful operations.
Address space result for successful operations.
Address space result for unsupported operations.
File attribute flag.
File attribute flag.
File attribute flag.
File attribute flag.
File attribute flag.
File attribute flag.
Applies a shared library extension to the file name (e.g.:
".dll"
on Windows and".dylib"
on macOS).Applies a binary extension to the file name (i.e.,
".exe"
on Windows).Applies a link extension to the file name (i.e.,
".lnk"
on Windows).Retrieves the application directory.
Retrieves the AppData directory on Windows.
Retrieves the application directory.
Retrieves the AppMenu directory on Windows.
Retrieves the applications directory on Windows.
Retrieves the x86 applications directory on Windows.
Retrieves the shared AppMenu directory on Windows.
Retrieves the shared desktop directory on Windows.
Retrieves the current working directory.
Retrieves the desktop directory.
Retrieves the documents directory.
Retrieves the home directory.
Retrieves the root directory (i.e.,
"/"
on Linux/macOS and"C:/"
on Windows).Retrieves the default system temporary directory.
Retrieves the temporary directory.
Maximum memory address for memory regions.
All process access privileges.
Process read access privileges.
Process termination access privileges.
Object flag.
Object flag.
Object flag.
Object flag.
Object flag.
Object flag.
Object flag.
Object flag.
File extension for an unpacked project.
Name of the main project database.
File extension for a packed project.
Name of the internal files database.
Name of the internal files path.
The prefix used to reference internal files from root entries.
Name of the object database.
File signature for a packed project.
Current project version.
Specifies that the returned data is big-endian.
Carbon view.
Cell table view.
Chart view.
Specifies that the returned data is ascii.
Codec mask for the returned data.
Specifies that the returned data is ucs-2.
Specifies that the returned data is ucs-4.
Specifies that the returned data is utf-16.
Specifies that the returned data is utf-32.
Specifies that the returned data is utf-8.
Specifies that the returned data is JavaScript code.
Code mask for the returned data.
Specifies no code type for the returned data.
Specifies that the returned data is VBA code.
Specifies that the returned data is VBS code.
Custom view.
Second custom view.
Third custom view.
Fourth custom view.
Fifth custom view.
Specifies that the returned data is utf-16 is not shared among the views.
Endianness mask for the returned data.
File info view.
File system view.
Geo-location view.
Hex view.
Key-value view.
Specifies that the returned data is little-endian.
List view.
Specifies that the returned data is middle-endian.
Media view.
Invalid view.
Plot view.
Raw hex view.
Table view.
Text view.
Text browser view.
Tree view.
Web view.
Scan entry category for embedded objects.
Scan entry category for information.
Scan entry category for intrinsic threats.
Scan entry category for online entries.
Scan entry category for privacy issues.
Scan entry category for threats.
Scan entry category for warnings.
Scan provider time type for file access.
Scan provider time type for file creation.
Scan provider time type for file modification.
This constant defines the size of a terabyte.
The special name of the header file associated with the report.
The file name of the header file associated with the report.
Base value for type nature.
Checks for the existence of the directory.
Creates the directory if missing.
Returns the requested directory without checking for its existence or creating it if missing.
Classes:
CFFBuffer
(object, offset, method)This class provides buffered read capability for
CFFObject
.This is a derived class from
NTContainer
which can reference data asCFFObject
andCFFStruct
.List of
CFFContainer
elements.
CFFContainerListIt
(obj)Iterator class for
CFFContainerList
.This class is used internally by
CFFStruct
to store information from members which affect the position and size of other members.
CFFDB
()This class creates a volatile tree structure that is either stored in memory or on disk.
CFFFlags
()This class contains flags and options for a member of
CFFStruct
.This class is the return value of
CFFObject.GetKey()
.List of
CFFGetKeyResult
elements.Iterator class for
CFFGetKeyResultList
.This class represents a header.
Alias data of a header file.
Structure data of a header file.
Type definition data of a header file.
CFFInitParams
(wo, options)This class contains the initialization parameters for the
CFFObject.Initialize()
method.This class represents a key index.
The class from which every format class is derived (ZipObject, PEObject, etc.).
This class represents a data structure and references a
CFFObject
instance.
CFFStructIt
(s)Iterator for an array of
CFFStruct
structures.List of
CFFStruct
elements.
CFFStructListIt
(obj)Iterator class for
CFFStructList
.
CFSEntry
(iface)Wrapper class for a
CFSEntryInterface
instance.This class represents a single file system entry.
CFSInstance
(iface)Wrapper class for a
CFSInterface
instance.This class represents a file system interface
CFSIterator
(iface)Wrapper class for a
CFSIteratorInterface
instance.This class represents a file system iterator.
CFSList
(iface)Wrapper class for a
CFSListInterface
instance.This class represents a file system list.
Logic providers return classes derived from this class to define a scanning behaviour.
This class contains information about the file to scan returned by classes derived from
CommonSystem
.The information about a format item returned by
ScanProvider._formatViewInfo()
.Tree of
FormatTreeNode
nodes.This class represents a node of
FormatTree
.List of
FormatTreeNode
elements.
FormatTreeNodeListIt
(obj)Iterator class for
FormatTreeNodeList
.
KROffset
()Match for a byte search in
NTContainer
.
Layout
()Layouts are used to create ranges and associate structures to hex views.
This class contains the data of a layout entry.
This class represents a layout interval.
LayoutPair
(t1, t2)Pair of (
LayoutInterval
,LayoutData
) elements.List of
LayoutPair
elements.
LayoutPairListIt
(obj)Iterator class for
LayoutPairList
.
CommonSystem
derived class used to perform local file system scans.This class is used to apply address spaces to containers.
NTBuffer
()Base class for buffered read operations.
List of
bytes
elements.
NTByteArrayListIt
(obj)Iterator class for
NTByteArrayList
.This is a generic container used to encapsulate data such as files and memory.
NTContainerBuffer
(container, endianness, …)This class provides buffered read capability for
NTContainer
.
NTDate
(y, m, d)This class provides date functions.
NTDateTime
(date, time, spec)This class provides date and time functions.
List of
float
elements.
NTDoubleListIt
(obj)Iterator class for
NTDoubleList
.Vector list of
float
elements.
NTDoubleVectorIt
(obj)Iterator class for
NTDoubleVector
.
NTFileEnum
(path)This class enumerates files from a specified path.
NTIWait
()Interface for wait objects.
List of
int
elements.
NTIntListIt
(obj)Iterator class for
NTIntList
.Dictionary of
int
->BasicType
elements.
NTIntVariantHashIt
(obj)Iterator class for
NTIntVariantHash
.Vector list of
int
elements.
NTIntVectorIt
(obj)Iterator class for
NTIntVector
.List of
int
elements.
NTMaxUIntListIt
(obj)Iterator class for
NTMaxUIntList
.Tree of
NTMaxUIntTreeNode
nodes.This class represents a node of
NTMaxUIntTree
.List of
NTMaxUIntTreeNode
elements.Iterator class for
NTMaxUIntTreeNodeList
.Vector list of
int
elements.
NTMaxUIntVectorIt
(obj)Iterator class for
NTMaxUIntVector
.List of
NTMemoryInfo
elements.
NTMemoryInfoListIt
(obj)Iterator class for
NTMemoryInfoList
.List of
NTModuleInfo
elements.
NTModuleInfoListIt
(obj)Iterator class for
NTModuleInfoList
.This class defines a generic offset-size range.
List of
NTOffsetRange
elements.
NTOffsetRangeListIt
(obj)Iterator class for
NTOffsetRangeList
.List of
NTProcessInfo
elements.
NTProcessInfoListIt
(obj)Iterator class for
NTProcessInfoList
.This class implements an enumerator for memory regions.
Basic implementation of
NTIWait
.List of
str
elements.
NTStringListIt
(obj)Iterator class for
NTStringList
.
NTStringPair
(t1, t2)Pair of (
str
,str
) elements.List of
NTStringPair
elements.
NTStringPairListIt
(obj)Iterator class for
NTStringPairList
.Dictionary of
str
->str
elements.
NTStringStringHashIt
(obj)Iterator class for
NTStringStringHash
.List of
NTStringStringHash
elements.Iterator class for
NTStringStringHashList
.Dictionary of
str
->BasicType
elements.Iterator class for
NTStringVariantHash
.This is a class derived from
NTTextStream
.An interface for outputting text and mnemonics.
This is a class derived from
NTTextStream
.This class represents a single text tag.
This class represents a sorted list of text tags.
NTTime
(h, m, s, ms)This class provides clock time functionality.
NTTimer
()This class implements a fast milliseconds timer based on
NT_GetTickCount()
.List of
int
elements.
NTUInt64ListIt
(obj)Iterator class for
NTUInt64List
.Dictionary of
int
->int
elements.
NTUInt64UIntHashIt
(obj)Iterator class for
NTUInt64UIntHash
.List of
int
elements.
NTUIntListIt
(obj)Iterator class for
NTUIntList
.Tree of
NTUIntTreeNode
nodes.This class represents a node of
NTUIntTree
.List of
NTUIntTreeNode
elements.
NTUIntTreeNodeListIt
(obj)Iterator class for
NTUIntTreeNodeList
.Vector list of
int
elements.
NTUIntVectorIt
(obj)Iterator class for
NTUIntVector
.Dictionary of
int
->int
elements.
NTUShortUShortHashIt
(obj)Iterator class for
NTUShortUShortHash
.Vector list of
int
elements.
NTUShortVectorIt
(obj)Iterator class for
NTUShortVector
.Dictionary of
str
->str
elements.
NTUTF8StringHashIt
(obj)Iterator class for
NTUTF8StringHash
.List of
str
elements.
NTUTF8StringListIt
(obj)Iterator class for
NTUTF8StringList
.List of
BasicType
elements.
NTVariantListIt
(obj)Iterator class for
NTVariantList
.This is a class derived from
NTTextStream
.
NTXml
()XML parser class.
This class represents a memory region.
This class contains information about a loaded module.
This class contains information about a process.
This class contains association information for Windows PDB files.
This class provides functionality for the current context.
This class provides access to the main settings of the application.
This class represents a generic plugin.
This class represents a generic plugin interface.
List of
ProPlugin
elements.
ProPluginListIt
(obj)Iterator class for
ProPluginList
.This class provides access to settings.
This is a class derived from
NTTextStream
.This class provides SQLite-backed key -> value storage facility.
ProWebRequest
(url)This class can be used to make a web request.
Report
()This class represents a project.
This class contains the base attributes of a scan entry retrieved from the report.
This class represents a scan entry.
List of
ScanMetaDataEntry
elements.Iterator class for
ScanMetaDataEntries
.This class represents a scan meta-data entry.
This is the base class inherited by all the scan engines for the different file formats.
ScanProviderWait
(sprovider)This class only wraps
ScanProvider.isAborted()
.This class is used as I/O container to retrieve data and UI views from a scan provider.
This class contains information about an entry in the object database.
This class contains parameters to create a window view of the object database.
Functions:
Returns the endianness of the system (
ENDIANNESS_LITTLE
orENDIANNESS_BIG
).
DemangleSymbolName
(mangled[, flags])Unmangles a decorated symbol.
MethodNameFromSimpleSignature
(signature)Extracts the function or method name from a simple signature.
NT_AppendFile
(src, copySize, dst)Appends
copySize
bytes ofsrc
file todst
file.
NT_ApplyFileExt
(fileName, filetype)Appends the default extension type for the current system specified by
filetype
tofileName
.
NT_AutoDecodeBytes
(raw)This function tries to decode raw bytes into a string using simple heuristics.
NT_CloseFile
(ntfile)Closes an open file handle.
NT_CloseModuleHandle
(ntmod)Closes the handle of a module without unloading the module.
NT_CloseProcess
(proc)Closes a process handle.
NT_ColorFromString
(str)Compute a color from an input string.
NT_CopyFile
(fileNameA, fileNameB)Copies a file.
NT_CopyFileOpen
(fileNameA, fileNameB)Copies a file.
NT_CreateDirectory
(dirName)Creates a directory.
NT_CreateDirectoryTree
(dirName)Creates a directory and all the intermediate directories leading up to that directory if not yet present.
NT_CreateFile
(FileName[, opt])Creates a file.
NT_CreateFileLink
(fileName, linkName[, descr])Creates a link (e.g.: .lnk on Windows) file.
NT_CreateTempFile
([ext, auto_delete])Creates a temporary file.
NT_DecodeAsciiBytes
(raw)This function tries to decode an ascii string using simple heuristics.
NT_DecodeAsciiBytes16
(raw, endianness)This function tries to decode an ascii wide-char string using simple heuristics.
NT_DeleteDirectory
(dirName)Deletes a directory.
NT_DeleteFile
(FileName)Deletes a file.
NT_DeleteLink
(linkName)Deletes a link (e.g.: .lnk on Windows) file.
NT_DirectoryExists
(dirName)Checks the existence of a directory.
NT_FileExists
(FileName)Checks the existence of a file.
NT_FileExtFromName
(fileName[, include_dot])Retrieves the extension of a file name (e.g.:
".exe"
).
NT_FileNameFromPath
(path)Retrieves the file name from a path.
NT_FileToBuffer
(fileName, maxSize[, readPartial])Reads a file to a memory buffer.
Converts a float value to string.
NT_FreeModule
(ntmod)Unloads a module and closes its handle.
Returns the current working directory.
Returns the name of the current module including its path.
Returns the full path of the current module.
Returns the current process id.
Returns the path of the executable of the current process.
Gets the temporary directory set for the application.
NT_GetFileAttributes
(fileName)Retrieves the attributes of a file.
NT_GetFileAttributesAsString
(fileName)Retrieves the attributes of a file as a string.
NT_GetFileName
(ntfile)Retrieves the name of a file from its handle.
NT_GetFileOwner
(fileName)Retrieves the file owner of a file.
NT_GetFilePermissionsAsString
(fileName)Retrieves the file permissions as a string.
NT_GetFilePos
(ntfile)Gets the current file position.
NT_GetFileSize
(ntfile)Gets the size of a file.
NT_GetMemoryRegions
(pid[, allocated_only, limit])Retrieves the list of memory regions allocated by the specified process.
NT_GetModule
(name)Retrieves a module from its name.
NT_GetModuleList
(pid)Retrieves the list of modules loaded in the address space of a process.
NT_GetProcessFileName
(pid_or_proc)Retrieves the path of the executable of a specified process.
NT_GetProcessId
(proc)Retrieves the process id for a process handle.
NT_GetProcessList
([only_accessible])Retrieves the current list of processes.
Retrieves a special system directory.
NT_GetSystemFileHandle
(ntfile)Returns the internal system handle of a file.
NT_GetTempFileName
([ext])Generates a temporary file name.
Returns the time passed since system boot in milliseconds.
Returns
True
if the process API is available on the current system; otherwise returnsFalse
.
NT_HexCharToByte
(ch)Converts a hex character into its corresponding integer value (e.g.:
ord('F')
->15
).Returns
True
if the current module is a shared library; otherwise returnsFalse
.
NT_IsRelativePath
(path)Checks whether a path is relative.
NT_KillProcess
(pid_or_proc[, timeout])Terminates a process.
NT_LoadModule
(name)Loads a module from disk.
NT_MakeCString
(str)Escapes a string for C (e.g.:
"Hello,\nWorld!"
becomes"Hello,\\nWorld!"
).
NT_MakeFileExecutable
(fileName)Adds executable attributes to the specified file if they’re missing.
NT_MatchFileName
(fileNameA, fileNameB)Compares two paths taking also into account the case sensitivity of the current file system.
NT_MemorySizeToString
(size[, prec])Converts a size in bytes to a string representation using byte, KB, MB or GB units.
NT_NormalizeFileName
(fileName)Replaces any backslash in a file name with a forward slash.
NT_NormalizePath
(path)Replaces any backslash in a path with a forward slash and makes sure that the path ends with a trailing forward slash.
NT_NormalizeToNative
(fileOrPath)Replaces the slashes of a file name or path with the slashes expected by the current system (i.e., backslashes on Windows and slashes on Linux/macOS).
NT_NormalizeToOrigin
(fileOrPath)Replaces the slashes of a file name or path with the slashes expected by the originating system (i.e., backslashes on Windows and slashes on Linux/macOS).
NT_OpenFile
(FileName[, opt])Opens an existing file.
NT_OpenProcess
(pid[, access])Retrieves a handle to a process.
NT_PathFromFileName
(fileName)Separates a path or file name from its trailing part.
NT_RawPathFromFileName
(fileName)Behaves exactly like
NT_PathFromFileName()
, except that it retains the slashes of the input.
NT_ReadFile
(ntfile, nBytesToRead)Reads a specified amount of bytes from a file and updates the file position.
NT_ReadProcessMemory
(proc, MemoryAddr, …)Reads the memory of a process.
NT_ResetFixedFileSize
(ntfile)Resets the fixed file size set by calling
NT_SetFixedFileSize()
.
NT_ResolveShortcut
(shortcut)Resolves the target of a link (.lnk) file.
NT_ResolveSymbol
(ntmod, symname)Resolves the symbol of a module.
NT_SetCurrentDirectory
(dirName)Sets the current working directory.
NT_SetCustomTempFolder
(path)Sets a custom temporary folder to be used by the application.
NT_SetFileAutoDelete
(ntfile, auto_delete)Sets the auto-deletion flag for the file.
NT_SetFilePos
(ntfile, FileOffset)Sets the current file position.
NT_SetFileSize
(ntfile, NewFileSize)Changes the size of a file.
NT_SetFixedFileSize
(ntfile, FixedFileSize)Sets the fixed size of a file.
NT_StripFileExt
(fileName)Strips the extension from a file name.
NT_TrashFile
(fileName[, showProgress])Moves a file to the trash.
NT_UnescapeCString
(str)Unescapes a C string (e.g.:
"Hello,\\nWorld!"
becomes"Hello,\nWorld!"
).Converts a Windows
FILETIME
toNTDateTime
.
NT_WriteFile
(ntfile, bytes)Writes the specified bytes to a file.
NT_WriteProcessMemory
(proc, MemoryAddr, bytes)Writes the memory of a process.
appDataDir
([opt])Retrieves the user data directory for the application.
applyFilters
(data, str[, waitdlg_or_wo])Applies the specified filters to an
NTContainer
and returns the resulting data as anNTContainer
.Returns the carbon themes directory.
Maps the computer file system to a
CFSInstance
instance.
cfsFileSystemEntry
(path)Maps a file system file to a
CFSEntry
instance.Returns the configuration directory.
createAddressSpace
(name[, pt_offs, arg2, arg3])Creates an address space based on a page-table.
createBlockIOAddressSpace
(total_size, page_size)Creates a block I/O address space.
createContainerFromFile
(fname)Creates an
NTContainer
object from a file on disk.
createSparseAddressSpace
([reference_as, …])Creates a sparse address space.
enableHook
(name, enable)Enables or disables the specified hook
executeFunctionInMainThread
(func[, ud, blocking])Executes a function from the main thread.
getFormatDescr
(ext)Retrieves the description for a format or extension.
getFormatExtensions
(ext)Retrieves all extensions for the specified format or extension.
Converts an extension to its format name.
getFormatGroup
(ext)Converts a format or extension to its format group.
Converts the short name to a format group.
getFormatGroupName
(group[, plural])Retrieves the user-friendly name for the format group.
getShortFormatGroupName
(group)Retrieves the short name for the format group.
Returns the list of supported file extensions.
getSupportedFormatsAndDescr
([flags])Returns a list of supported file formats and their description.
Returns the headers directory.
identifyPossibleFormats
(data)Identifies a list of possible file formats for the input data.
isExtensionSupported
(ext)Checks whether a format or extension is supported.
Returns
True
if called from the UI thread; otherwise returnsFalse
.
mediaDir
()Returns the media directory.
newContainer
([size, reserve_size, max_size])Creates a new
NTContainer
object.
ntAlpha
(rgb)Retrieves the alpha color component from an RGBA value.
ntAlphaBlend
(src, bkg)Performs an alpha blend operation on two RGBA values.
ntBlue
(rgb)Retrieves the blue color component from an RGBA value.
ntGreen
(rgb)Retrieves the green color component from an RGBA value.
ntRed
(rgb)Retrieves the read color component from an RGBA value.
ntRgb
(r, g, b)Creates an RGBA value from its red, green and blue color components.
ntRgba
(r, g, b, a)Creates an RGBA value from its red, green, blue and alpha color components.
ntShiftToColor
(source, target, fraction)Shift an RGBA value to another RGBA value.
Returns the package certificates directory.
Returns the plugins directory.
proAbort
(ret[, msg])Aborts the application with an optional message.
proAddRecentFile
(history, fname[, max_list_size])Adds a recent file name to a specified historical list.
proAddRecentItem
(history, item[, max_list_size])Adds a recent item to a specified historical list.
Returns the path of the main application.
Returns
True
if the current architecture is x64; otherwise returnsFalse
.Returns
True
if the current architecture is x86; otherwise returnsFalse
.Returns the name of the current architecture (e.g.,
'x64'
).
proClearOutput
([with_undo])Clears the output view if available.
Returns the global
ProCoreContext
instance.Crashes the application on purpose.
Returns the current disassembly options for the text view.
proGetAvailablePlugins
(config_name)Retrieves a list of generic plugins.
proGetIntPtr
(name)Retrieves an internal pointer.
proGetLine
([prompt])Retrieves an input string either by prompting a dialog box or from the terminal.
proGetRecentItems
(history)Retrieves a specified historical list.
proGetRiskBgColor
(risk, bg)Computes a color based on risk percentage.
proLaunchApplication
(app[, args])Launches an application.
proLaunchThisApplication
([args])Launches the main application.
Returns
True
if the current platform is Linux; otherwise returnsFalse
.Returns
True
if the current platform is macOS; otherwise returnsFalse
.Returns
True
if the current platform is Windows; otherwise returnsFalse
.Returns the name of the current platform (supported values are:
'windows'
,'linux'
and'macos'
).Returns the short name of the current platform (supported values are:
'win'
,'lin'
and'mac'
).
proPrint
(str)Prints a message to the output view.
proPrintnl
(str)Prints a message to the output view.
proProcessEvents
([ms])Processes thread loop events.
proSetReturnCode
(ret)Sets the return code for the application.
Creates a new
NTTextBuffer
instance with the default disassembly options.Returns the current version of the application as a string in the shape of major_version.minor_version.build_version.
Returns the build number of the application.
Returns the major version of the application.
Returns the minor version of the application.
Enables or disables the idle processing of Python code.
Returns the themes directory.
userCarbonThemesDir
([opt])Retrieves the user carbon themes directory.
userConfigDir
([opt])Retrieves the user configuration directory.
userHeadersDir
([opt])Retrieves the user headers directory.
userMediaDir
([opt])Retrieves the user media directory.
userPDBSymbolsDir
([opt])Retrieves the user PDB symbols directory.
userPackageCertificatesDir
([opt])Retrieves the user package certificates directory.
userPackagesDir
([opt])Retrieves the user packages directory.
userPluginsDir
([opt])Retrieves the user plugins directory.
userPythonPluginsDir
([opt])Retrieves the user Python plugins directory.
userThemesDir
([opt])Retrieves the user themes directory.
- Bufferize_BackAndForth: Final[int]¶
Buffering method for
NTBuffer
. To use when reading in both directions.
- Bufferize_Invalid: Final[int]¶
Buffering method for
NTBuffer
. Only used for uninitialized instances.See also
NTBuffer.isNull()
.
- class CFFBuffer(object: Pro.Core.CFFObject, offset: int, method: int = Bufferize_Forwards)¶
Bases:
Pro.Core.NTBuffer
This class provides buffered read capability for
CFFObject
.
- Parameters
object (CFFObject) – The object to read from.
offset (int) – The start offset to read from.
method (int) – The buffering method to use. Defaults to
Bufferize_Forwards
.See also
CFFObject.ToBuffer()
,NTBuffer
andNTContainerBuffer
.
- class CFFContainer¶
Bases:
Pro.Core.NTContainer
This is a derived class from
NTContainer
which can reference data asCFFObject
andCFFStruct
.See also
NTContainer()
,NTContainerBuffer
andNTAddressSpace
.Attributes:
Type of data internally referenced by the container.
Type of data internally referenced by the container.
Type of data internally referenced by the container.
Methods:
setData
(data[, own_or_size])Returns the internal
CFSInstance
referenced by the container if thedataType()
isFileSystem
; otherwise returns an invalidCFSInstance
instance.
toObject
()Returns the internal
CFFObject
referenced by the container if thedataType()
isObject
; otherwise returnsNone
.
toStruct
()Returns the internal
CFFStruct
referenced by the container if thedataType()
isStruct
; otherwise returns an invalid struct.
- FileSystem: Final[int]¶
Type of data internally referenced by the container.
Available since Cerbero Suite 7.0 and Cerbero Engine 4.0.
See also
NTContainer.dataType()
.
- Object: Final[int]¶
Type of data internally referenced by the container.
See also
NTContainer.dataType()
.
- Struct: Final[int]¶
Type of data internally referenced by the container.
See also
NTContainer.dataType()
.
- setData(data: Union[CFFObject, CFFStruct, CFSInstance, NTByteArrayList, NTContainer, NTStringList, NTTextTags, NT_FILE, NT_PROCESS, bytes, int, str], own_or_size: Union[bool, int] = True) → None¶
- toFileSystem() → Pro.Core.CFSInstance¶
- Returns
Returns the internal
CFSInstance
referenced by the container if thedataType()
isFileSystem
; otherwise returns an invalidCFSInstance
instance.- Return type
Available since Cerbero Suite 7.0 and Cerbero Engine 4.0.
See also
NTContainer.dataType()
.
- toObject() → object¶
- Returns
Returns the internal
CFFObject
referenced by the container if thedataType()
isObject
; otherwise returnsNone
.- Return type
See also
NTContainer.dataType()
.
- toStruct() → Pro.Core.CFFStruct¶
- Returns
Returns the internal
CFFStruct
referenced by the container if thedataType()
isStruct
; otherwise returns an invalid struct.- Return type
See also
NTContainer.dataType()
.
- class CFFContainerList¶
List of
CFFContainer
elements.Methods:
append
(value)Inserts
value
at the end of the list.
at
(i)Returns the item at index position
i
in the list.
clear
()Removes all items from the list.
contains
(value)Checks the presence of an element in the list.
count
(value)Returns the number of occurrences of
value
in the list.
indexOf
(value[, start])Searches for an element in the list.
insert
(i, value)Inserts
value
at index positioni
in the list.
isEmpty
()Checks whether the list is empty.
iterator
()Creates an iterator for the list.
removeAll
(value)Removes all occurrences of
value
in the list and returns the number of entries removed.
removeAt
(i)Removes the item at index position
i
.
reserve
(alloc)Reserve space for
alloc
elements.
size
()Returns the number of items in the list.
takeAt
(i)Removes the item at index position
i
and returns it.
- append(value: Pro.Core.CFFContainer) → None¶
Inserts
value
at the end of the list.
- Parameters
value (CFFContainer) – The value to add to the list.
See also
insert()
.
- at(i: int) → Pro.Core.CFFContainer¶
Returns the item at index position
i
in the list.i
must be a valid index position in the list (i.e.,0 <= i < size()
).
- Parameters
i (int) – The index of the element to return.
- Returns
Returns the requested element.
- Return type
- clear() → None¶
Removes all items from the list.
- contains(value: Pro.Core.CFFContainer) → bool¶
Checks the presence of an element in the list.
- Parameters
value (CFFContainer) – The value to check for.
- Returns
Returns
True
if the list contains an occurrence ofvalue
; otherwise returnsFalse
.- Return type
bool
- count(value: Pro.Core.CFFContainer) → int¶
Returns the number of occurrences of
value
in the list.
- Parameters
value (CFFContainer) – The value to count.
- Returns
Returns the number of occurrences.
- Return type
int
See also
indexOf()
andcontains()
.
- indexOf(value: Pro.Core.CFFContainer, start: int = 0) → int¶
Searches for an element in the list.
- Parameters
value (CFFContainer) – The value to search for.
start (int) – The start index.
- Returns
Returns the index position of the first occurrence of
value
in the list. Returns-1
if no item was found.- Return type
int
See also
contains()
.
- insert(i: int, value: Pro.Core.CFFContainer) → None¶
Inserts
value
at index positioni
in the list. Ifi
is0
, the value is prepended to the list. Ifi
issize()
, the value is appended to the list.
- Parameters
i (int) – The position at which to add the value.
value (CFFContainer) – The value to add.
See also
append()
andremoveAt()
.
- isEmpty() → bool¶
Checks whether the list is empty.
- Returns
Returns
True
if the list contains no items; otherwise returnsFalse
.- Return type
bool
See also
size()
.
- iterator() → Pro.Core.CFFContainerListIt¶
Creates an iterator for the list.
- Returns
Returns the iterator.
- Return type
- removeAll(value: Pro.Core.CFFContainer) → int¶
Removes all occurrences of
value
in the list and returns the number of entries removed.
- Parameters
value (CFFContainer) – The value to remove from the list.
- Returns
Returns the number of entries removed.
- Return type
int
See also
removeAt()
.
- removeAt(i: int) → None¶
Removes the item at index position
i
.i
must be a valid index position in the list (i.e.,0 <= i < size()
).
- Parameters
i (int) – The index of the item to remove.
See also
removeAll()
.
- reserve(alloc: int) → None¶
Reserve space for
alloc
elements. Calling this method doesn’t change the size of the list.
- Parameters
alloc (int) – The amount of elements to reserve space for.
- takeAt(i: int) → Pro.Core.CFFContainer¶
Removes the item at index position
i
and returns it.i
must be a valid index position in the list (i.e.,0 <= i < size()
).
- Parameters
i (int) – The index of the element to remove from the list.
- Returns
Returns the removed element. If you don’t use the return value,
removeAt()
is more efficient.- Return type
See also
removeAt()
.
- class CFFContainerListIt(obj: Pro.Core.CFFContainerList)¶
Iterator class for
CFFContainerList
.
- Parameters
obj (CFFContainerList) – The object to iterate over.
Methods:
hasNext
()Returns
True
if there is at least one item ahead of the iterator, i.e. the iterator is not at the back of the container; otherwise returnsFalse
.Returns
True
if there is at least one item behind the iterator, i.e. the iterator is not at the front of the container; otherwise returnsFalse
.
next
()Returns the next item and advances the iterator by one position.
previous
()Returns the previous item and moves the iterator back by one position.
toBack
()Moves the iterator to the back of the container (after the last item).
toFront
()Moves the iterator to the front of the container (before the first item).
- hasNext() → bool¶
- Returns
Returns
True
if there is at least one item ahead of the iterator, i.e. the iterator is not at the back of the container; otherwise returnsFalse
.- Return type
bool
See also
hasPrevious()
andnext()
.
- hasPrevious() → bool¶
- Returns
Returns
True
if there is at least one item behind the iterator, i.e. the iterator is not at the front of the container; otherwise returnsFalse
.- Return type
bool
See also
hasNext()
andprevious()
.
- next() → Pro.Core.CFFContainer¶
- Returns
Returns the next item and advances the iterator by one position.
- Return type
See also
hasNext()
andprevious()
.
- previous() → Pro.Core.CFFContainer¶
- Returns
Returns the previous item and moves the iterator back by one position.
- Return type
See also
hasPrevious()
andnext()
.
- toBack() → None¶
Moves the iterator to the back of the container (after the last item).
See also
toFront()
andprevious()
.
- class CFFContext¶
This class is used internally by
CFFStruct
to store information from members which affect the position and size of other members.See also
CFFStruct.Context()
andCFFStruct.SetContext()
.Methods:
set
(key, val)Sets a value of the context.
value
(key)Retrieves a value from the context.
- class CFFDB¶
This class creates a volatile tree structure that is either stored in memory or on disk.
Indexes for the tree can either be 32-bit (
CFFDBIndexSize32
) or 64-bit (CFFDBIndexSize64
).Every item in the tree has fixed-size data. If no data size is specified when creating the tree, the fixed data size will be the same as the index size.
This class does not support the removal of items from the tree.
Methods:
AppendChild
([parent])Appends an item.
Children
(index)Returns the number of children for the specified index.
Data
(index)Retrieves the data of an item.
Data32
(index)Retrieves the data of an item as a 32-bit value.
Data64
(index)Retrieves the data of an item as a 64-bit value.
Index
(pos[, parent])Returns the index of an item given its parent and it’s position relative to its siblings.
InsertChild
(pos[, parent])Inserts an item given its parent and position relative to its siblings.
InsertChildren
(pos, count[, parent])Inserts multiple items given their parent and position relative to their siblings.
IsNull
()Returns
True
if invalid; otherwise returnsFalse
.
IsValid
()Returns
True
if valid; otherwise returnsFalse
.
Next
(current)Gets the next item in the tree.
Open
([fixed_data_size, idxsize])Initializes a
CFFDB
.
Parent
(index)Returns the parent of an item.
Position
(index)Returns the position of an item relative to its siblings.
PrependChild
([parent])Prepends an item.
Previous
(current)Gets the previous item in the tree.
SetData
(index, value)Sets the data of an item.
SetData32
(index, value)Sets the data of an item as a 32-bit value.
SetData64
(index, value)Sets the data of an item as a 64-bit value.
- AppendChild(parent: int = 0) → int¶
Appends an item.
- Parameters
parent (int) – The parent index of the item to append.
- Returns
Returns the index of the added child item if successful; otherwise returns
CFFDBInvalidIndex
.- Return type
int
See also
PrependChild()
andInsertChild()
.
- Children(index: int) → int¶
Returns the number of children for the specified index.
- Parameters
index (int) – The index of the item for which to retrieve the number of children.
- Returns
Returns the number of children.
- Return type
int
See also
Position()
,Parent()
andIndex()
.
- Data(index: int) → tuple¶
Retrieves the data of an item.
- Parameters
index (int) – The index of the item for which to retrieve the data.
- Returns
Returns a tuple containing the retrieved data and a boolean. The boolean value is
True
if successful; otherwise it isFalse
.- Return type
tuple[bytes, bool]
- Data32(index: int) → tuple¶
Retrieves the data of an item as a 32-bit value.
- Parameters
index (int) – The index of the item for which to retrieve the data.
- Returns
Returns a tuple containing the retrieved data value and a boolean. The boolean value is
True
if successful; otherwise it isFalse
.- Return type
tuple[int, bool]
See also
SetData32()
,Data()
andData64()
.
- Data64(index: int) → tuple¶
Retrieves the data of an item as a 64-bit value.
- Parameters
index (int) – The index of the item for which to retrieve the data.
- Returns
Returns a tuple containing the retrieved data value and a boolean. The boolean value is
True
if successful; otherwise it isFalse
.- Return type
tuple[int, bool]
See also
SetData64()
,Data()
andData32()
.
- Index(pos: int, parent: int = 0) → int¶
Returns the index of an item given its parent and it’s position relative to its siblings.
- Parameters
pos (int) – The position of the item relative to its siblings.
parent (int) – The index of the parent item.
- Returns
Returns the requested index if successful; otherwise returns
CFFDBInvalidIndex
.- Return type
int
See also
Parent()
,Position()
andChildren()
.
- InsertChild(pos: int, parent: int = 0) → int¶
Inserts an item given its parent and position relative to its siblings.
- Parameters
pos (int) – The position of the item to insert relative to its siblings.
parent (int) – The index of the parent item.
- Returns
Returns the index of the added child item if successful; otherwise returns
CFFDBInvalidIndex
.- Return type
int
See also
InsertChildren()
,AppendChild()
andPrependChild()
.
- InsertChildren(pos: int, count: int, parent: int = 0) → bool¶
Inserts multiple items given their parent and position relative to their siblings.
- Parameters
pos (int) – The position of the items to insert relative to their siblings.
count (int) – The number of items to insert.
parent (int) – The index of the parent item.
- Returns
Returns
True
if successful; otherwise returnsFalse
.- Return type
bool
See also
InsertChild()
,AppendChild()
andPrependChild()
.
- IsNull() → bool¶
- Returns
Returns
True
if invalid; otherwise returnsFalse
.- Return type
bool
- IsValid() → bool¶
- Returns
Returns
True
if valid; otherwise returnsFalse
.- Return type
bool
- Next(current: int) → int¶
Gets the next item in the tree.
This method enumerates parent and child items.
- Parameters
current (int) – The current index.
- Returns
Returns the index if successful; otherwise returns
CFFDBInvalidIndex
.- Return type
int
See also
Previous()
.
- Open(fixed_data_size: int = 0, idxsize: int = CFFDBIndexSize32) → bool¶
Initializes a
CFFDB
.
- Parameters
fixed_data_size (int) – The size of the data associated with each item. If
0
, it defaults to the index size.idxsize (int) – The index size.
- Returns
Returns
True
if successful; otherwise returnsFalse
.- Return type
bool
- Parent(index: int) → int¶
Returns the parent of an item.
- Parameters
index (int) – The index of the item for which to retrieve the parent.
- Returns
Returns the parent index if successful; otherwise returns
CFFDBInvalidIndex
.- Return type
int
See also
Index()
,Position()
andChildren()
.
- Position(index: int) → int¶
Returns the position of an item relative to its siblings.
- Parameters
index (int) – The index of the item for which to retrieve the relative position.
- Returns
Returns the position if successful; otherwise returns
CFFDBInvalidIndex
.- Return type
int
See also
Children()
,Index()
andParent()
.
- PrependChild(parent: int = 0) → int¶
Prepends an item.
- Parameters
parent (int) – The parent index of the item to prepend.
- Returns
Returns the index of the added child item if successful; otherwise returns
CFFDBInvalidIndex
.- Return type
int
See also
AppendChild()
andInsertChild()
.
- Previous(current: int) → int¶
Gets the previous item in the tree.
This method enumerates parent and child items.
- Parameters
current (int) – The current index.
- Returns
Returns the index if successful; otherwise returns
CFFDBInvalidIndex
.- Return type
int
See also
Next()
.
- SetData(index: int, value: bytes) → bool¶
Sets the data of an item.
The size of
value
must match the size of the data specified when initializing the tree (SeeOpen()
).
- Parameters
index (int) – The index of the item for which to set the data.
value (bytes) – The data to set.
- Returns
Returns
True
if successful; otherwise returnsFalse
.- Return type
bool
See also
Data()
,SetData32()
andSetData64()
.
- SetData32(index: int, value: int) → bool¶
Sets the data of an item as a 32-bit value.
- Parameters
index (int) – The index of the item for which to set the data.
value (int) – The 32-bit value to set.
- Returns
Returns
True
if successful; otherwise returnsFalse
.- Return type
bool
See also
Data32()
,SetData()
andSetData64()
.
- SetData64(index: int, value: int) → bool¶
Sets the data of an item as a 64-bit value.
- Parameters
index (int) – The index of the item for which to set the data.
value (int) – The 64-bit value to set.
- Returns
Returns
True
if successful; otherwise returnsFalse
.- Return type
bool
See also
Data64()
,SetData()
andSetData32()
.
- class CFFFlags¶
This class contains flags and options for a member of
CFFStruct
.Methods:
Count
()Returns the number of flags and options available.
Description
(i)Retrieves the description of a flag or option.
IsFlag
(value, i_or_name)Checks if a flag or option is set in the input value.
IsNull
()Returns
True
if theCFFFlags
instance is invalid; otherwise returnsFalse
.Returns
True
if the currentCFFFlags
instance contains only options and not flags; otherwise returnsFalse
.
IsValid
()Returns
True
if theCFFFlags
instance is valid; otherwise returnsFalse
.
Name
(i)Retrieves the name of a flag or option.
Output
(out, value[, opt, sep])Outputs the flags and options set in the input value to a text stream .
Position
(name)Retrieves the position of a flag or option by its name.
Retrieves the short description of a flag or option.
Type
([i])Retrieves the type of the
CFFFlags
instance or the type of one of its members.
Value
(i)Retrieves the value of a flag or option.
ValueDescription
(value)Retrieves the description for the input value.
ValueName
(value)Retrieves the name for the input value.
- Count() → int¶
- Returns
Returns the number of flags and options available.
- Return type
int
- Description(i: int) → str¶
Retrieves the description of a flag or option.
- Parameters
i (int) – The index of the flag or option.
- Returns
Returns the description if available; otherwise returns an empty string.
- Return type
str
See also
ShortDescription()
,Name()
andValue()
.
- IsFlag(value: int, i_or_name: Union[int, str]) → bool¶
Checks if a flag or option is set in the input value.
- Parameters
value (int) – The input value.
i_or_name (Union[int, str]) – The index or name of the flag or option.
- Returns
Returns
True
if the flag or option is set in the input value; otherwise returnsFalse
.- Return type
bool
- IsNull() → bool¶
- Returns
Returns
True
if theCFFFlags
instance is invalid; otherwise returnsFalse
.- Return type
bool
See also
IsValid()
.
- IsOptionsOnly() → bool¶
- Returns
Returns
True
if the currentCFFFlags
instance contains only options and not flags; otherwise returnsFalse
.- Return type
bool
See also
ValueDescription()
.
- IsValid() → bool¶
- Returns
Returns
True
if theCFFFlags
instance is valid; otherwise returnsFalse
.- Return type
bool
See also
IsNull()
.
- Name(i: int) → str¶
Retrieves the name of a flag or option.
- Parameters
i (int) – The index of the flag or option.
- Returns
Returns the name of the flag or option if successful; otherwise returns an empty string.
- Return type
str
- Output(out: Pro.Core.NTTextStream, value: int, opt: int = 0, sep: Optional[str] = None) → None¶
Outputs the flags and options set in the input value to a text stream .
- Parameters
out (NTTextStream) – The text stream.
value (int) – The input value.
opt (int) – The output options.
NTFlagOutput_IgnoreUnknown
can be specified to ignore unknown flags.sep (Optional[str]) – The separator for the output. Defaults to
" | "
.See also
NTTextStream
andShortDescription()
.
- Position(name: str) → int¶
Retrieves the position of a flag or option by its name.
- Parameters
name (str) – The name of the flag or option.
- Returns
Returns the index of the flag or option if successful; otherwise returns
-1
.- Return type
int
- ShortDescription(i: int) → str¶
Retrieves the short description of a flag or option.
- Parameters
i (int) – The index of the flag or option.
- Returns
Returns the short description if available; otherwise returns an empty string.
- Return type
str
See also
Description()
,Name()
andValue()
.
- Type(i: Optional[int] = None) → int¶
Retrieves the type of the
CFFFlags
instance or the type of one of its members.
- Parameters
i (Optional[int]) – The index of the flag or option.
- Returns
Returns the requested type if successful; otherwise returns
0
.- Return type
int
- Value(i: int) → int¶
Retrieves the value of a flag or option.
- Parameters
i (int) – The index of the flag or option.
- Returns
Returns the value if successful; otherwise returns
0
.- Return type
int
See also
Name()
andDescription()
.
- ValueDescription(value: int) → str¶
Retrieves the description for the input value.
This method works only if the
CFFFlags
instance contains only options (SeeIsOptionsOnly()
).
- Parameters
value (int) – The input value.
- Returns
Returns the value description if successful; otherwise returns an empty string.
- Return type
str
See also
ValueName()
,IsOptionsOnly()
andOutput()
.
- ValueName(value: int) → str¶
Retrieves the name for the input value.
This method works only if the
CFFFlags
instance contains only options (SeeIsOptionsOnly()
).
- Parameters
value (int) – The input value.
- Returns
Returns the value description if successful; otherwise returns an empty string.
- Return type
str
Available since Cerbero Suite 7.3 and Cerbero Engine 4.3.
See also
ValueDescription()
,IsOptionsOnly()
andOutput()
.
- class CFFGetKeyResult¶
This class is the return value of
CFFObject.GetKey()
.Available since Cerbero Suite 6.3 and Cerbero Engine 3.3.
See also
CFFObject.GetKey()
.Attributes:
The key data.
The key type (e.g.,
CFFKT_Pass
).
- data¶
The key data.
- key_type¶
The key type (e.g.,
CFFKT_Pass
).
- class CFFGetKeyResultList¶
List of
CFFGetKeyResult
elements.Methods:
append
(value)Inserts
value
at the end of the list.
at
(i)Returns the item at index position
i
in the list.
clear
()Removes all items from the list.
contains
(value)Checks the presence of an element in the list.
count
(value)Returns the number of occurrences of
value
in the list.
indexOf
(value[, start])Searches for an element in the list.
insert
(i, value)Inserts
value
at index positioni
in the list.
isEmpty
()Checks whether the list is empty.
iterator
()Creates an iterator for the list.
removeAll
(value)Removes all occurrences of
value
in the list and returns the number of entries removed.
removeAt
(i)Removes the item at index position
i
.
reserve
(alloc)Reserve space for
alloc
elements.
size
()Returns the number of items in the list.
takeAt
(i)Removes the item at index position
i
and returns it.
- append(value: Pro.Core.CFFGetKeyResult) → None¶
Inserts
value
at the end of the list.
- Parameters
value (CFFGetKeyResult) – The value to add to the list.
See also
insert()
.
- at(i: int) → Pro.Core.CFFGetKeyResult¶
Returns the item at index position
i
in the list.i
must be a valid index position in the list (i.e.,0 <= i < size()
).
- Parameters
i (int) – The index of the element to return.
- Returns
Returns the requested element.
- Return type
- clear() → None¶
Removes all items from the list.
- contains(value: Pro.Core.CFFGetKeyResult) → bool¶
Checks the presence of an element in the list.
- Parameters
value (CFFGetKeyResult) – The value to check for.
- Returns
Returns
True
if the list contains an occurrence ofvalue
; otherwise returnsFalse
.- Return type
bool
- count(value: Pro.Core.CFFGetKeyResult) → int¶
Returns the number of occurrences of
value
in the list.
- Parameters
value (CFFGetKeyResult) – The value to count.
- Returns
Returns the number of occurrences.
- Return type
int
See also
indexOf()
andcontains()
.
- indexOf(value: Pro.Core.CFFGetKeyResult, start: int = 0) → int¶
Searches for an element in the list.
- Parameters
value (CFFGetKeyResult) – The value to search for.
start (int) – The start index.
- Returns
Returns the index position of the first occurrence of
value
in the list. Returns-1
if no item was found.- Return type
int
See also
contains()
.
- insert(i: int, value: Pro.Core.CFFGetKeyResult) → None¶
Inserts
value
at index positioni
in the list. Ifi
is0
, the value is prepended to the list. Ifi
issize()
, the value is appended to the list.
- Parameters
i (int) – The position at which to add the value.
value (CFFGetKeyResult) – The value to add.
See also
append()
andremoveAt()
.
- isEmpty() → bool¶
Checks whether the list is empty.
- Returns
Returns
True
if the list contains no items; otherwise returnsFalse
.- Return type
bool
See also
size()
.
- iterator() → Pro.Core.CFFGetKeyResultListIt¶
Creates an iterator for the list.
- Returns
Returns the iterator.
- Return type
- removeAll(value: Pro.Core.CFFGetKeyResult) → int¶
Removes all occurrences of
value
in the list and returns the number of entries removed.
- Parameters
value (CFFGetKeyResult) – The value to remove from the list.
- Returns
Returns the number of entries removed.
- Return type
int
See also
removeAt()
.
- removeAt(i: int) → None¶
Removes the item at index position
i
.i
must be a valid index position in the list (i.e.,0 <= i < size()
).
- Parameters
i (int) – The index of the item to remove.
See also
removeAll()
.
- reserve(alloc: int) → None¶
Reserve space for
alloc
elements. Calling this method doesn’t change the size of the list.
- Parameters
alloc (int) – The amount of elements to reserve space for.
- takeAt(i: int) → Pro.Core.CFFGetKeyResult¶
Removes the item at index position
i
and returns it.i
must be a valid index position in the list (i.e.,0 <= i < size()
).
- Parameters
i (int) – The index of the element to remove from the list.
- Returns
Returns the removed element. If you don’t use the return value,
removeAt()
is more efficient.- Return type
See also
removeAt()
.
- class CFFGetKeyResultListIt(obj: Pro.Core.CFFGetKeyResultList)¶
Iterator class for
CFFGetKeyResultList
.
- Parameters
obj (CFFGetKeyResultList) – The object to iterate over.
Methods:
hasNext
()Returns
True
if there is at least one item ahead of the iterator, i.e. the iterator is not at the back of the container; otherwise returnsFalse
.Returns
True
if there is at least one item behind the iterator, i.e. the iterator is not at the front of the container; otherwise returnsFalse
.
next
()Returns the next item and advances the iterator by one position.
previous
()Returns the previous item and moves the iterator back by one position.
toBack
()Moves the iterator to the back of the container (after the last item).
toFront
()Moves the iterator to the front of the container (before the first item).
- hasNext() → bool¶
- Returns
Returns
True
if there is at least one item ahead of the iterator, i.e. the iterator is not at the back of the container; otherwise returnsFalse
.- Return type
bool
See also
hasPrevious()
andnext()
.
- hasPrevious() → bool¶
- Returns
Returns
True
if there is at least one item behind the iterator, i.e. the iterator is not at the front of the container; otherwise returnsFalse
.- Return type
bool
See also
hasNext()
andprevious()
.
- next() → Pro.Core.CFFGetKeyResult¶
- Returns
Returns the next item and advances the iterator by one position.
- Return type
See also
hasNext()
andprevious()
.
- previous() → Pro.Core.CFFGetKeyResult¶
- Returns
Returns the previous item and moves the iterator back by one position.
- Return type
See also
hasPrevious()
andnext()
.
- toBack() → None¶
Moves the iterator to the back of the container (after the last item).
See also
toFront()
andprevious()
.
- class CFFHeader¶
This class represents a header.
Headers contain definition of structures and can be loaded from SQLite files or XML strings. The structures can be imported from C/C++ code through the Header Manager or from debug symbols such as PDB files.
Important
Editing is supported only for SQLite-backed headers.
Example:
from Pro.Core import * xml_header = """<header> <r id='_IMAGE_DOS_HEADER' type='struct'> <f id='e_magic' type='unsigned short'/> <f id='e_cblp' type='unsigned short'/> <f id='e_cp' type='unsigned short'/> <f id='e_crlc' type='unsigned short'/> <f id='e_cparhdr' type='unsigned short'/> <f id='e_minalloc' type='unsigned short'/> <f id='e_maxalloc' type='unsigned short'/> <f id='e_ss' type='unsigned short'/> <f id='e_sp' type='unsigned short'/> <f id='e_csum' type='unsigned short'/> <f id='e_ip' type='unsigned short'/> <f id='e_cs' type='unsigned short'/> <f id='e_lfarlc' type='unsigned short'/> <f id='e_ovno' type='unsigned short'/> <f id='e_res' type='unsigned short [4]'/> <f id='e_oemid' type='unsigned short'/> <f id='e_oeminfo' type='unsigned short'/> <f id='e_res2' type='unsigned short [10]'/> <f id='e_lfanew' type='int'/> </r> </header>""" def printStructure(fname): c = createContainerFromFile(fname) if c.isNull(): return # load header from an XML string header = CFFHeader() if not header.LoadFromXml(xml_header): return obj = CFFObject() # since CFFObject is not subclassed, the Load method cannot fail obj.Load(c) # map a structure to a specific offset offset = 0 s = obj.MakeStruct(header, "_IMAGE_DOS_HEADER", offset, CFFSO_VC | CFFSO_Pack1) out = NTTextBuffer() s.Dump(out) print(out.buffer)See also
CFFStruct
andCFFObject
.Attributes:
Alias category for a definition.
Alias category for an enumerator.
Alias category terminator.
Alias integer value type.
Alias terminator value type.
Alias floating point value type.
Alias string value type.
Methods:
Begins an SQLite transaction.
Close
()Clears the current instance.
EndEdit
()Ends an SQLite transaction.
Equals
(s)Checks whether two headers reference the same internal data.
GetACName
(category)Retrieves the alias category name.
GetAVTName
(vtype)Retrieves the alias value type name.
Returns the number of alias in the header.
GetAliasData
(i)Retrieves the data for an alias.
Returns the SQLite handle if the header is backed by SQLite internally; otherwise returns
None
.Retrieves the basic data of a structure.
Returns the number of structures in the header.
GetStructData
(i_or_name)Retrieves the data of a structure.
Returns the number of type definitions in the header.
Retrieves the data of a type definition.
InsertAlias
(name, category, type, vtype, value)Inserts or replaces an alias in the header file.
InsertStruct
(schema)Inserts or replaces a structure in the header file.
InsertTypeDef
(name, type)Inserts or replaces a type definition in the header file.
Returns
True
if the header was modified; otherwise returnsFalse
.
IsNull
()Returns
True
if the header is invalid; otherwise returnsFalse
.
IsValid
()Returns
True
if the header is valid; otherwise returnsFalse
.
LoadFromFile
(name)Loads a header file from an SQLite database.
LoadFromXml
(xml)Initializes a header instance from XML data.
SetModified
(b)Sets the modified status for the header file.
- AC_Define: Final[int]¶
Alias category for a definition.
- AC_Enum: Final[int]¶
Alias category for an enumerator.
- AC_Last: Final[int]¶
Alias category terminator.
- AVT_Integer: Final[int]¶
Alias integer value type.
- AVT_Last: Final[int]¶
Alias terminator value type.
- AVT_Real: Final[int]¶
Alias floating point value type.
- AVT_String: Final[int]¶
Alias string value type.
- BeginEdit() → None¶
Begins an SQLite transaction.
See also
EndEdit()
andInsertStruct()
.
- Close() → None¶
Clears the current instance.
See also
LoadFromFile()
andLoadFromXml()
.
- EndEdit() → None¶
Ends an SQLite transaction.
See also
BeginEdit()
andInsertStruct()
.
- Equals(s: Pro.Core.CFFHeader) → bool¶
Checks whether two headers reference the same internal data.
- Parameters
s (CFFHeader) – The other header.
- Returns
Returns
True
if the two headers reference the same internal data; otherwise returnsFalse
.- Return type
bool
- static GetACName(category: int) → str¶
Retrieves the alias category name.
- Parameters
category (int) – The alias category.
- Returns
Returns the name of the alias category if successful; otherwise returns an empty string.
- Return type
str
See also
GetAVTName()
.
- static GetAVTName(vtype: int) → str¶
Retrieves the alias value type name.
- Parameters
vtype (int) – The alias value type.
- Returns
Returns the name of the alias value type if successful; otherwise returns an empty string.
- Return type
str
See also
GetACName()
.
- GetAliasCount() → int¶
- Returns
Returns the number of alias in the header.
- Return type
int
See also
GetAliasData()
andInsertAlias()
.
- GetAliasData(i: int) → Pro.Core.CFFHeaderAliasData¶
Retrieves the data for an alias.
- Parameters
i (int) – The index of the alias.
- Returns
Returns the data of the alias if successful; otherwise returns an empty data structure.
- Return type
See also
GetAliasCount()
andInsertAlias()
.
- GetSQLiteDB() → sqlite3¶
- Returns
Returns the SQLite handle if the header is backed by SQLite internally; otherwise returns
None
.- Return type
sqlite3
- GetStructBaseData(i: int) → Pro.Core.CFFHeaderStructData¶
Retrieves the basic data of a structure.
The difference with
GetStructData()
is that the XML schema of the structure is not retrieved. Therefore, this method is a bit faster.
- Parameters
i (int) – The index of the structure.
- Returns
Returns the data of the structure if successful; otherwise returns an empty data structure.
- Return type
See also
GetStructData()
,GetStructCount()
andInsertStruct()
.
- GetStructCount() → int¶
- Returns
Returns the number of structures in the header.
- Return type
int
See also
GetStructData()
andInsertStruct()
.
- GetStructData(i_or_name: Union[int, str]) → Pro.Core.CFFHeaderStructData¶
Retrieves the data of a structure.
- Parameters
i_or_name (Union[int, str]) – The name or the index of the structure.
- Returns
Returns the data of the structure if successful; otherwise returns an empty data structure.
- Return type
See also
GetStructBaseData()
,GetStructCount()
andInsertStruct()
.
- GetTypeDefCount() → int¶
- Returns
Returns the number of type definitions in the header.
- Return type
int
See also
GetTypeDefData()
andInsertTypeDef()
.
- GetTypeDefData(i: int) → Pro.Core.CFFHeaderTypeDefData¶
Retrieves the data of a type definition.
- Parameters
i (int) – The index of the type definition.
- Returns
Returns the data of the type definition if successful; otherwise returns an empty data structure.
- Return type
See also
GetTypeDefCount()
andInsertTypeDef()
.
- InsertAlias(name: str, category: int, type: str, vtype: int, value: str) → None¶
Inserts or replaces an alias in the header file.
This method is supported only by SQLite-backed header files.
- Parameters
name (str) – The name of the alias.
category (int) – The category of the alias.
type (str) – The type of the alias.
vtype (int) – The value type of the alias.
value (str) – The value of the alias.
See also
GetAliasData()
andGetAliasCount()
.
- InsertStruct(schema: str) → None¶
Inserts or replaces a structure in the header file.
This method is supported only by SQLite-backed header files.
- Parameters
schema (str) – The XML schema of the structure.
See also
GetStructData()
andGetStructCount()
.
- InsertTypeDef(name: str, type: str) → None¶
Inserts or replaces a type definition in the header file.
This method is supported only by SQLite-backed header files.
- Parameters
name (str) – The name of the type definition.
type (str) – The type definition.
See also
GetTypeDefData()
andGetTypeDefCount()
.
- IsModified() → bool¶
- Returns
Returns
True
if the header was modified; otherwise returnsFalse
.- Return type
bool
See also
SetModified()
.
- IsNull() → bool¶
- Returns
Returns
True
if the header is invalid; otherwise returnsFalse
.- Return type
bool
See also
IsValid()
.
- IsValid() → bool¶
- Returns
Returns
True
if the header is valid; otherwise returnsFalse
.- Return type
bool
See also
IsNull()
.
- LoadFromFile(name: str) → bool¶
Loads a header file from an SQLite database.
- Parameters
name (str) – The name of the header file.
- Returns
Returns
True
if successful; otherwise returnsFalse
.- Return type
bool
See also
LoadFromXml()
.
- LoadFromXml(xml: Union[Pro.Core.NTXml, str]) → bool¶
Initializes a header instance from XML data.
- Parameters
xml (Union[NTXml, str]) – Either an XML string or an
NTXml
instance.- Returns
Returns
True
if successful; otherwise returnsFalse
.- Return type
bool
See also
LoadFromFile()
.
- SetModified(b: bool) → None¶
Sets the modified status for the header file.
- Parameters
b (bool) – If
True
, the header file is marked as modified.See also
IsModified()
.
- class CFFHeaderAliasData¶
Alias data of a header file.
See also
CFFHeader
.Attributes:
The category of the alias.
The name of the alias.
The type of the alias.
The value of the alias.
The value type of the alias.
- category¶
The category of the alias.
- name¶
The name of the alias.
- type¶
The type of the alias.
- value¶
The value of the alias.
- vtype¶
The value type of the alias.
- class CFFHeaderStructData¶
Structure data of a header file.
See also
CFFHeader
.Attributes:
The name of the structure.
The XML schema of the structure.
The type of the structure.
- name¶
The name of the structure.
- schema¶
The XML schema of the structure.
- type¶
The type of the structure.
- class CFFHeaderTypeDefData¶
Type definition data of a header file.
See also
CFFHeader
.Attributes:
The name of the type definition.
The type definition.
- name¶
The name of the type definition.
- type¶
The type definition.
- class CFFInitParams(wo: Optional[Pro.Core.NTIWait] = None, options: int = 0)¶
This class contains the initialization parameters for the
CFFObject.Initialize()
method.
- Parameters
wo (NTIWait) – The wait object.
options (int) – The parsing options.
Attributes:
This flag instructs the parser not to decrypt the file.
This flag instructs the parser to avoid parsing malformed data.
A boolean that signals the presence of a wait object that isn’t the default dummy one.
The maximum number of allowed child entries.
Options for the parser (e.g.,
StrictParser
).The wait object for operation.
- DontDecrypt: Final[int]¶
This flag instructs the parser not to decrypt the file.
Note
The parser might choose to ignore this flag.
See also
options
.
- StrictParser: Final[int]¶
This flag instructs the parser to avoid parsing malformed data.
Note
The parser might choose to ignore this flag.
See also
options
.
- has_wo¶
A boolean that signals the presence of a wait object that isn’t the default dummy one.
See also
wo
.
- max_children¶
The maximum number of allowed child entries.
- options¶
Options for the parser (e.g.,
StrictParser
).
- CFFKST_Raw: Final[int]¶
Key sub-type raw.
Available since Cerbero Suite 6.3 and Cerbero Engine 3.3.
- CFFKST_String: Final[int]¶
Key sub-type string.
Available since Cerbero Suite 6.3 and Cerbero Engine 3.3.
- CFFKST_UTF8: Final[int]¶
Key sub-type utf-8.
Available since Cerbero Suite 6.3 and Cerbero Engine 3.3.
- CFFKT_Cert: Final[int]¶
Key type certificate.
Available since Cerbero Suite 6.3 and Cerbero Engine 3.3.
See also
CFFGetKeyResult
.
- CFFKT_Invalid: Final[int]¶
Key type invalid.
Available since Cerbero Suite 6.3 and Cerbero Engine 3.3.
See also
CFFGetKeyResult
.
- CFFKT_Pass: Final[int]¶
Key type password.
Available since Cerbero Suite 6.3 and Cerbero Engine 3.3.
See also
CFFGetKeyResult
.
- class CFFKeyIndex¶
This class represents a key index.
Available since Cerbero Suite 6.3 and Cerbero Engine 3.3.
See also
CFFObject.GetKey()
andCFFObject.KeyMatch()
.
- CFFN_Base: Final[int]¶
Base value for standard
CFFObject
notifications.See also
CFFObject.Notify()
.
- CFFN_Malformed: Final[int]¶
CFFObject
notification for malformed data.See also
CFFObject.Notify()
.
- CFFN_MoreFiles: Final[int]¶
CFFObject
notification for the file limit.See also
CFFObject.Notify()
.
- CFFN_NoDecrypt: Final[int]¶
CFFObject
notification for failed decryption.See also
CFFObject.Notify()
.
- CFFN_NoUnpack: Final[int]¶
CFFObject
notification for failed decompression.See also
CFFObject.Notify()
.
- CFFN_ParsingLimit: Final[int]¶
CFFObject
notification for an internal parsing limit.See also
CFFObject.Notify()
.
- CFFN_Recursive: Final[int]¶
CFFObject
notification for recursion.See also
CFFObject.Notify()
.
- CFFN_UnpackLimit: Final[int]¶
CFFObject
notification for the decompression limit.See also
CFFObject.Notify()
.
- CFFN_UnpackNestLimit: Final[int]¶
CFFObject
notification for the decompression nesting limit.See also
CFFObject.Notify()
.
- class CFFObject¶
Bases:
Pro.Core.CFSInterface
The class from which every format class is derived (ZipObject, PEObject, etc.).
The internal data of a
CFFObject
is anNTContainer
(SeeLoad()
).See also
NTContainer
,CFFStruct
,CFFHeader
andCFFBuffer
.Methods:
AdjustSign
(type, num)Makes the input number negative if the last bit is set and the input type is an integer.
Align
(AlignConst)Aligns the object to the specified size.
AppendTo
(nStartOffset, nLenght, pDst)Appends part of this object to a container.
Compare
(offset, bytes_or_uSize[, b])Compares the specified data to the one in the object.
CopyFrom
(Src, nDstOffset, nLenght[, …])Copies data from a container to the object.
CopyTo
(nStartOffset, nLenght, pDst[, …])Copies a part of the object to a container.
CustomKeyMatch
(kr)Marks a custom key as successfully having being used for decryption.
Disables ranges.
EnableRanges
(bits_per_element, granularity)Creates a range bit mask for the current object.
Fill
(offset, c, uSize)Fills a portion of the object with the specified byte.
Returns the default endianness of the object (
ENDIANNESS_LITTLE
orENDIANNESS_BIG
).Returns the default options for
CFFStruct
instances created from this object (e.g.,CFFSO_Pack1
).
GetKey
(ki, accepted_keys[, converter])Retrieves a decryption key.
Returns the list of matched decryption keys.
Returns the address at which this object is mapped if available; otherwise returns
INVALID_STREAM_OFFSET
.Returns the maximum amount of bytes which can be allocated for in-memory decompression algorithms.
Returns the file format name of the object if available; otherwise returns an empty string.
Returns the generic format name of the object if available; otherwise returns an empty string (e.g., the generic format name of HTML is XML).
Returns the name of the object if available; otherwise returns an empty string.
Returns the type name of the object if available; otherwise returns an empty string.
GetSize
()Returns the size of the internally referenced container.
GetSpecialData
(key[, defval])Retrieves special data associated to the object.
Returns the internally referenced container.
GetSubStream
(offset_or_range[, …])Retrieves a sub-stream of the internally referenced container.
GetTag
()Returns the tag name set for debugging purposes if present; otherwise returns an empty string.
GetTypeName
(Type)Returns the name of the specified type.
GetTypeNature
(Type)Returns the nature of the specified type.
Returns the limit for decompression operations.
Returns the nesting limit for decompression operations.
Returns
True
if file system support is available; otherwise returnsFalse
.
Initialize
([p])Provides a generic way to initialize an object.
IsMapped
()Returns
True
if the object has a mapping address; otherwise returnsFalse
.Returns
True
if the object was modified; otherwise returnsFalse
.
IsNull
()Returns
True
if the object is uninitialized; otherwise returnsFalse
.
IsTypeDynamicPersistent
(Type)Checks whether a type is persistently dynamic.
KeyMatch
(ki[, converter])Marks a key as successfully having being used for decryption.
Load
(Stream)Loads the object data.
LocationDescription
(offset)Provides a description for a specified location.
MakeStruct
(header, name, offset[, options])Returns a
CFFStruct
instance.
MakeStructArray
(header, name, offset, nentries)Returns an array of
CFFStruct
.
Modified
(b)Sets the modified status for the object.
NewContainer
(size[, reserve_size, max_size])Creates a new
NTContainer
object.
Notify
(code)Internally notifies the associated
ScanProvider
(if any) of a problem.Returns
True
if ranges are enabled for the current object; otherwise returnsFalse
.
Read
(offset, uSize)Reads data from the object.
ReadNumber
(offset, type, endianness, is_signed)Reads an integer from the object.
ReadUInt16
(offset[, endianness])Reads an unsigned 16-bit integer from the object.
ReadUInt16String
(offset, maxlen, endianness)Reads an utf-16 array from the object.
ReadUInt32
(offset[, endianness])Reads an unsigned 32-bit integer from the object.
ReadUInt32String
(offset, maxlen, endianness)Reads an utf-32 array from the object.
ReadUInt64
(offset[, endianness])Reads an unsigned 64-bit integer from the object.
ReadUInt8
(offset)Reads an unsigned 8-bit integer from the object.
ReadUInt8String
(offset, maxlen)Reads an utf-8 array from the object.
ReplaceStream
(NewStream)Replaces the internal data of the object.
SetDefaultEndianness
(nEndiannessType)Sets the default endianness for the object.
SetDefaultStructOptions
(options)Sets the default options for
CFFStruct
instances created from this object (e.g.,CFFSO_Pack1
).
SetFSSupport
(b)Sets the status of file system support.
SetMappingAddress
(mapping)Sets the address at which the object is mapped.
SetMemoryUnpackLimit
(limit)Sets the maximum amount of bytes which can be allocated for in-memory decompression algorithms.
SetObjectFormatName
(format)Sets the file format name of the object.
SetObjectGenericFormatName
(format)Sets the generic format name of the object (e.g., the generic format name of HTML is XML).
SetObjectName
(name)Sets the name of the object.
SetObjectTypeName
(type_name)Sets the type name of the object.
SetRange
(offset, size, val)Sets a range value for the current object.
SetRangeValue
(offset, size, val)Sets a range value for the current object.
SetSize
(NewSize)Resizes the internal data of the object.
SetSpecialData
(key, value)Sets special data associated to the object.
SetTag
(t)Sets the tag name of the object for debugging purposes
SetUnpackLimit
(limit)Sets the limit for decompression operations.
SetUnpackNestingLimit
(limit)Sets the nesting limit for decompression operations.
Shift
(uSize)Appends
uSize
bytes at the end of the object data and sets them to zero.
ToBuffer
(offset[, method])Returns a
CFFBuffer
that reads from the object.
ToUInt16
(n)Applies the default endianness of the object to the 16-bit input integer.
ToUInt32
(n)Applies the default endianness of the object to the 32-bit input integer.
ToUInt64
(n)Applies the default endianness of the object to the 64-bit input integer.
ValidRange
(offset, Size)Checks the validity of a range in the context of the object.
Write
(offset, bytes_or_uSize[, bytes])Writes data to the object.
WriteUInt16
(offset, n_or_nEndiannessType[, n])Writes an unsigned 16-bit integer to the object.
WriteUInt32
(offset, n_or_nEndiannessType[, n])Writes an unsigned 32-bit integer to the object.
WriteUInt64
(offset, n_or_nEndiannessType[, n])Writes an unsigned 64-bit integer to the object.
WriteUInt8
(offset, n)Writes an unsigned 8-bit integer to the object.
- AdjustSign(type: int, num: int) → int¶
Makes the input number negative if the last bit is set and the input type is an integer.
- Parameters
type (int) – The input type.
num (int) – The input number.
- Returns
Returns the adjusted number.
- Return type
int
- Align(AlignConst: int) → bool¶
Aligns the object to the specified size.
- Parameters
AlignConst (int) – The alignment.
- Returns
Returns
True
if successful; otherwise returnsFalse
.- Return type
bool
See also
NTContainer.align()
andShift()
.
- AppendTo(nStartOffset: int, nLenght: int, pDst: Pro.Core.NTContainer) → bool¶
Appends part of this object to a container.
- Parameters
nStartOffset (int) – The offset of the range to append.
nLenght (int) – The size of the range to append.
pDst (NTContainer) – The destination container.
- Returns
Returns
True
if successful; otherwise returnsFalse
.- Return type
bool
See also
NTContainer.appendTo()
.
- Compare(offset: int, bytes_or_uSize: Union[bytes, int], b: Optional[int] = None) → bool¶
Compares the specified data to the one in the object.
- Parameters
offset (int) – The start offset for the comparison.
bytes_or_uSize (Union[bytes, int]) – Either the data to compare or the size to compare.
b (Optional[int]) – If the previous parameter is the size to compare, this parameter is the byte which to compare the data to.
- Returns
Returns
True
if the data matches; otherwise returnsFalse
.- Return type
bool
See also
NTContainer.compare()
.
- CopyFrom(Src: Pro.Core.NTContainer, nDstOffset: int, nLenght: int, nSrcStartOffset: int = 0) → bool¶
Copies data from a container to the object.
- Parameters
Src (NTContainer) – The container from which to copy the data.
nDstOffset (int) – The offset at which to copy the data.
nLenght (int) – The size of the data to copy.
nSrcStartOffset (int) – The offset from which to copy the data in the container.
- Returns
Returns
True
if successful; otherwise returnsFalse
.- Return type
bool
See also
NTContainer.copyTo()
.
- CopyTo(nStartOffset: int, nLenght: int, pDst: Pro.Core.NTContainer, nDstStartOffset: int = 0) → bool¶
Copies a part of the object to a container.
- Parameters
nStartOffset (int) – The offset of the data to copy.
nLenght (int) – The size of the data to copy.
pDst (NTContainer) – The destination container.
nDstStartOffset (int) – The offset at which to write the data to in the destination container.
- Returns
Returns
True
if successful; otherwise returnsFalse
.- Return type
bool
See also
NTContainer.copyTo()
.
- CustomKeyMatch(kr: Pro.Core.CFFGetKeyResult) → None¶
Marks a custom key as successfully having being used for decryption.
Note
This method should be used for keys not returned by
GetKey()
.
- Parameters
kr (CFFGetKeyResult) – The custom key.
Available since Cerbero Suite 7.8 and Cerbero Engine 4.8.
See also
KeyMatch()
andGetKeyMatches()
.
- DisableRanges() → None¶
Disables ranges.
Available since Cerbero Suite 6.2 and Cerbero Engine 3.2.
See also
EnableRanges()
,RangesEnabled()
andSetRange()
.
- EnableRanges(bits_per_element: int, granularity: int, initval: int = 0) → None¶
Creates a range bit mask for the current object.
- Parameters
bits_per_element (int) – The mask bits for each element.
granularity (int) – The granularity of each element.
initval (int) – The initial value of each element.
Note
The granularity is might be changed for larger files to meet memory constraints.
Available since Cerbero Suite 6.2 and Cerbero Engine 3.2.
See also
DisableRanges()
,RangesEnabled()
andSetRange()
.
- Fill(offset: int, c: int, uSize: int) → bool¶
Fills a portion of the object with the specified byte.
- Parameters
offset (int) – The offset of the range to fill.
c (int) – The 8-bit value used for the fill operation.
uSize (int) – The size of the range to fill.
- Returns
Returns
True
if successful; otherwise returnsFalse
.- Return type
bool
See also
NTContainer.fill()
.
- GetDefaultEndianness() → int¶
- Returns
Returns the default endianness of the object (
ENDIANNESS_LITTLE
orENDIANNESS_BIG
).- Return type
int
See also
SetDefaultEndianness()
.
- GetDefaultStructOptions() → int¶
- Returns
Returns the default options for
CFFStruct
instances created from this object (e.g.,CFFSO_Pack1
).- Return type
int
See also
SetDefaultStructOptions()
.
- GetKey(ki: Pro.Core.CFFKeyIndex, accepted_keys: int, converter: str = 'utf-8') → Pro.Core.CFFGetKeyResult¶
Retrieves a decryption key.
Example:
ki = CFFKeyIndex() while True: kres = self.GetKey(ki, CFFKT_Pass, "utf-8") if kres.key_type == CFFKT_Invalid: # if there are no more keys, exit the loop break if self.Decrypt(kres.data): # our decryption method # if the decryption was successful, mark the key and exit the loop self.KeyMatch(ki, "utf-8") break
- Parameters
ki (CFFKeyIndex) – The key index.
accepted_keys (int) – The mask of accepted key types (e.g.,
CFFKT_Pass
).converter (str) – The converter to use for passwords (e.g.,
"utf-8"
,"ascii"
,"utf-16-le"
).- Returns
Returns a key result if successful; otherwise
CFFGetKeyResult.key_type
isCFFKT_Invalid
.- Return type
Available since Cerbero Suite 6.3 and Cerbero Engine 3.3.
See also
KeyMatch()
,GetKeyMatches()
andCFFGetKeyResult
.
- GetKeyMatches() → Pro.Core.CFFGetKeyResultList¶
- Returns
Returns the list of matched decryption keys.
- Return type
Available since Cerbero Suite 7.8 and Cerbero Engine 4.8.
See also
KeyMatch()
andCustomKeyMatch()
.
- GetMappingAddress() → int¶
- Returns
Returns the address at which this object is mapped if available; otherwise returns
INVALID_STREAM_OFFSET
.- Return type
int
See also
IsMapped()
andSetMappingAddress()
.
- GetMemoryUnpackLimit() → int¶
- Returns
Returns the maximum amount of bytes which can be allocated for in-memory decompression algorithms.
- Return type
int
See also
SetMemoryUnpackLimit()
.
- GetObjectFormatName() → str¶
- Returns
Returns the file format name of the object if available; otherwise returns an empty string.
- Return type
str
See also
SetObjectFormatName()
.
- GetObjectGenericFormatName() → str¶
- Returns
Returns the generic format name of the object if available; otherwise returns an empty string (e.g., the generic format name of HTML is XML).
- Return type
str
See also
SetObjectGenericFormatName()
.
- GetObjectName() → str¶
- Returns
Returns the name of the object if available; otherwise returns an empty string.
- Return type
str
See also
SetObjectName()
.
- GetObjectTypeName() → str¶
- Returns
Returns the type name of the object if available; otherwise returns an empty string.
- Return type
str
See also
SetObjectTypeName()
.
- GetSize() → int¶
- Returns
Returns the size of the internally referenced container.
- Return type
int
See also
NTContainer.resize()
andSetSize()
.
- GetSpecialData(key: str, defval: Pro.Core.NTContainer = NTContainer()) → Pro.Core.NTContainer¶
Retrieves special data associated to the object.
- Parameters
key (str) – The key of the data to retrieve.
defval (NTContainer) – The value to return if
key
is not present.- Returns
Returns the requested data if present; otherwise returns the default return value.
- Return type
See also
SetSpecialData()
.
- GetStream() → Pro.Core.NTContainer¶
- Returns
Returns the internally referenced container.
- Return type
See also
GetSubStream()
,Load()
andReplaceStream()
.
- GetSubStream(offset_or_range: Union[Pro.Core.NTOffsetRange, int], optimize_for_speed_or_size: Union[bool, int] = INVALID_STREAM_OFFSET, optimize_for_speed: bool = True) → Pro.Core.NTContainer¶
Retrieves a sub-stream of the internally referenced container.
Hint
This is a convenience method. Internally this method calls
GetStream()
followed byNTContainer.setRange()
.
- Parameters
offset_or_range (Union[NTOffsetRange, int]) – Either the offset or the range.
optimize_for_speed_or_size (Union[bool, int]) – Either the size or the
optimize_for_speed_or_size
parameter.optimize_for_speed (bool) – If
True
, might cause a deep copy under certain circumstances.- Returns
Returns the specified sub-stream.
- Return type
Available since Cerbero Suite 7.2 and Cerbero Engine 4.2.
See also
GetStream()
andNTContainer.setRange()
.
- GetTag() → str¶
- Returns
Returns the tag name set for debugging purposes if present; otherwise returns an empty string.
- Return type
str
See also
SetTag()
.
- GetTypeName(Type: int) → str¶
Returns the name of the specified type.
- Parameters
Type (int) – The type for which to return the name.
- Returns
Returns the type name if implemented; otherwise returns an empty string.
- Return type
str
See also
GetTypeNature()
.
- GetTypeNature(Type: int) → int¶
Returns the nature of the specified type.
- Parameters
Type (int) – The type for which to return the nature.
- Returns
Returns the nature of the type if successful; otherwise returns
NATURE_UNKNOWN
.- Return type
int
See also
NATURE_BYTEARRAY
,NATURE_NUMBER
,NATURE_REAL
andNATURE_STRING
.See also
GetTypeName()
.
- GetUnpackLimit() → int¶
- Returns
Returns the limit for decompression operations.
- Return type
int
See also
SetUnpackLimit()
.
- GetUnpackNestingLimit() → int¶
- Returns
Returns the nesting limit for decompression operations.
- Return type
int
See also
SetUnpackNestingLimit()
.
- HasFSSupport() → bool¶
- Returns
Returns
True
if file system support is available; otherwise returnsFalse
.- Return type
bool
Available since Cerbero Suite 7.0 and Cerbero Engine 4.0.
See also
SetFSSupport()
.
- Initialize(p: Pro.Core.CFFInitParams = CFFInitParams()) → bool¶
Provides a generic way to initialize an object.
Note
This method should be overridden by derived classes.
- Parameters
p (CFFInitParams) – The initialization parameters.
- Returns
Returns
True
if successful; otherwise returnsFalse
.- Return type
bool
Available since Cerbero Suite 7.2 and Cerbero Engine 4.2.
See also
CFFInitParams
andLoad()
.
- IsMapped() → bool¶
- Returns
Returns
True
if the object has a mapping address; otherwise returnsFalse
.- Return type
bool
See also
GetMappingAddress()
andSetMappingAddress()
.
- IsModified() → bool¶
- Returns
Returns
True
if the object was modified; otherwise returnsFalse
.- Return type
bool
See also
Modified()
.
- IsNull() → bool¶
- Returns
Returns
True
if the object is uninitialized; otherwise returnsFalse
.- Return type
bool
See also
Load()
.
- IsTypeDynamicPersistent(Type: int) → bool¶
Checks whether a type is persistently dynamic.
This means that the size of the type is dependent on the underlying data.
- Parameters
Type (int) – The type to check.
- Returns
Returns
True
if the type is persistently dynamic; otherwise returnsFalse
.- Return type
bool
- KeyMatch(ki: Pro.Core.CFFKeyIndex, converter: str = 'utf-8') → None¶
Marks a key as successfully having being used for decryption.
- Parameters
ki (CFFKeyIndex) – The key index.
converter (str) – The converter to use for passwords (e.g.,
"utf-8"
,"ascii"
,"utf-16-le"
).Available since Cerbero Suite 6.3 and Cerbero Engine 3.3.
See also
GetKey()
,CFFGetKeyResult
andCustomKeyMatch()
.
- Load(Stream: Pro.Core.NTContainer) → bool¶
Loads the object data.
Note
In derived built-in classes this method also checks the signature file format.
- Parameters
Stream (NTContainer) – The data to load.
- Returns
Returns
True
if the data is accepted; otherwise returnsFalse
.- Return type
bool
See also
Initialize()
,GetStream()
andReplaceStream()
.
- LocationDescription(offset: int) → str¶
Provides a description for a specified location.
Note
This method is currently implemented only for executables such as PE, ELF and MachO.
- Parameters
offset (int) – The location offset.
- Returns
Returns the description if successful; otherwise returns an empty string.
- Return type
str
Available since Cerbero Suite 7.3 and Cerbero Engine 4.3.
- MakeStruct(header: Pro.Core.CFFHeader, name: str, offset: int, options: Optional[int] = None) → Pro.Core.CFFStruct¶
Returns a
CFFStruct
instance.
- Parameters
header (CFFHeader) – The header from which to fetch the definition of the structure.
name (str) – The name of the structure to return.
offset (int) – The offset at which to load the structure.
options (Optional[int]) – The options for the layout of the structure (e.g.,
CFFSO_Pack1
).- Returns
Returns a valid structure if successful; otherwise returns an invalid structure.
- Return type
See also
MakeStructArray()
,CFFStruct
andCFFHeader
.
- MakeStructArray(header: Pro.Core.CFFHeader, name: str, offset: int, nentries: int, options: Optional[int] = None) → Pro.Core.CFFStruct¶
Returns an array of
CFFStruct
.
- Parameters
header (CFFHeader) – The header from which to fetch the definition of the structure.
name (str) – The name of the structure to return.
offset (int) – The offset at which to load the structure.
nentries (int) – The number of array entries.
options (Optional[int]) – The options for the layout of the structure (e.g.,
CFFSO_Pack1
).- Returns
Returns a valid structure if successful; otherwise returns an invalid structure.
- Return type
See also
MakeStruct()
,CFFStruct
andCFFHeader
.
- Modified(b: bool) → None¶
Sets the modified status for the object.
- Parameters
b (bool) – If
True
, marks the object as modified; otherwise marks the object as unmodified.See also
IsModified()
.
- NewContainer(size: int, reserve_size: int = 1024, max_size: int = 0) → Pro.Core.NTContainer¶
Creates a new
NTContainer
object.Whether the container will be using an internal memory buffer or a file on disk is decided on the basis of available memory resources at the time of the call.
- Parameters
size (int) – The initial size of the container.
reserve_size (int) – The size to initially reserve for the container.
max_size (int) – The maximum size the container will ever reach. This is an optional parameter used to decide whether the container can operate on a memory buffer.
- Returns
Returns the created container if successful; otherwise returns an invalid container.
- Return type
See also
newContainer()
andNTContainer
.
- Notify(code: int) → bool¶
Internally notifies the associated
ScanProvider
(if any) of a problem.
- Parameters
code (int) – The notification code (e.g.,
CFFN_NoDecrypt
).- Returns
Returns
True
if successful; otherwise returnsFalse
.- Return type
bool
See also
ScanProvider
.
- RangesEnabled() → bool¶
- Returns
Returns
True
if ranges are enabled for the current object; otherwise returnsFalse
.- Return type
bool
Available since Cerbero Suite 6.2 and Cerbero Engine 3.2.
See also
EnableRanges()
,DisableRanges()
andSetRange()
.
- Read(offset: int, uSize: int) → bytes¶
Reads data from the object.
- Parameters
offset (int) – The offset of the data to read.
uSize (int) – The size of the data to read.
- Returns
Returns the data read if successful; otherwise return an empty
bytes
object.- Return type
bytes
See also
Write()
.
- ReadNumber(offset: int, type: int, endianness: int, is_signed: bool) → tuple¶
Reads an integer from the object.
- Parameters
offset (int) – The offset of the integer to read.
type (int) – The type of integer to read.
endianness (int) – The endianness of the integer (
ENDIANNESS_LITTLE
orENDIANNESS_BIG
).is_signed (bool) – If
True
, the integer is treated as signed.- Returns
Returns a tuple containing the value read and a boolean. The boolean value is
True
if successful; otherwise it isFalse
.- Return type
tuple[int, bool]
See also
ReadUInt8()
,ReadUInt16()
,ReadUInt32()
andReadUInt64()
.
- ReadUInt16(offset: int, endianness: Optional[int] = None) → tuple¶
Reads an unsigned 16-bit integer from the object.
- Parameters
offset (int) – The offset of the value to read.
endianness (Optional[int]) – The endianness of the value (
ENDIANNESS_LITTLE
orENDIANNESS_BIG
).- Returns
Returns a tuple containing the value read and a boolean. The boolean value is
True
if successful; otherwise it isFalse
.- Return type
tuple[int, bool]
See also
WriteUInt16()
,ReadUInt8()
,ReadUInt32()
,ReadUInt64()
andReadNumber()
.
- ReadUInt16String(offset: int, maxlen: int, endianness: int) → tuple¶
Reads an utf-16 array from the object.
The method stops when either a null terminator or
maxlen
is reached.
- Parameters
offset (int) – The offset of the array to read.
maxlen (int) – The maximum length of the entry in characters.
endianness (int) – The endianness of the array (
ENDIANNESS_LITTLE
orENDIANNESS_BIG
).- Returns
Returns a tuple containing the array read and a boolean. The boolean value is
True
if successful; otherwise it isFalse
.- Return type
tuple[bytes, bool]
See also
ReadUInt8String()
andReadUInt32String()
.
- ReadUInt32(offset: int, endianness: Optional[int] = None) → tuple¶
Reads an unsigned 32-bit integer from the object.
- Parameters
offset (int) – The offset of the value to read.
endianness (Optional[int]) – The endianness of the value (
ENDIANNESS_LITTLE
orENDIANNESS_BIG
).- Returns
Returns a tuple containing the value read and a boolean. The boolean value is
True
if successful; otherwise it isFalse
.- Return type
tuple[int, bool]
See also
WriteUInt32()
,ReadUInt8()
,ReadUInt16()
,ReadUInt64()
andReadNumber()
.
- ReadUInt32String(offset: int, maxlen: int, endianness: int) → tuple¶
Reads an utf-32 array from the object.
The method stops when either a null terminator or
maxlen
is reached.
- Parameters
offset (int) – The offset of the array to read.
maxlen (int) – The maximum length of the entry in characters.
endianness (int) – The endianness of the array (
ENDIANNESS_LITTLE
orENDIANNESS_BIG
).- Returns
Returns a tuple containing the array read and a boolean. The boolean value is
True
if successful; otherwise it isFalse
.- Return type
tuple[bytes, bool]
See also
ReadUInt8String()
andReadUInt16String()
.
- ReadUInt64(offset: int, endianness: Optional[int] = None) → tuple¶
Reads an unsigned 64-bit integer from the object.
- Parameters
offset (int) – The offset of the value to read.
endianness (Optional[int]) – The endianness of the value (
ENDIANNESS_LITTLE
orENDIANNESS_BIG
).- Returns
Returns a tuple containing the value read and a boolean. The boolean value is
True
if successful; otherwise it isFalse
.- Return type
tuple[int, bool]
See also
WriteUInt64()
,ReadUInt8()
,ReadUInt16()
,ReadUInt32()
andReadNumber()
.
- ReadUInt8(offset: int) → tuple¶
Reads an unsigned 8-bit integer from the object.
- Parameters
offset (int) – The offset of the value to read.
- Returns
Returns a tuple containing the value read and a boolean. The boolean value is
True
if successful; otherwise it isFalse
.- Return type
tuple[int, bool]
See also
WriteUInt8()
,ReadUInt16()
,ReadUInt32()
,ReadUInt64()
andReadNumber()
.
- ReadUInt8String(offset: int, maxlen: int) → tuple¶
Reads an utf-8 array from the object.
The method stops when either a null terminator or
maxlen
is reached.
- Parameters
offset (int) – The offset of the array to read.
maxlen (int) – The maximum length of the entry in bytes.
- Returns
Returns a tuple containing the array read and a boolean. The boolean value is
True
if successful; otherwise it isFalse
.- Return type
tuple[bytes, bool]
See also
ReadUInt16String()
andReadUInt32String()
.
- ReplaceStream(NewStream: Pro.Core.NTContainer) → None¶
Replaces the internal data of the object.
- Parameters
NewStream (NTContainer) – The new internal container for the object.
See also
Load()
andGetStream()
.
- SetDefaultEndianness(nEndiannessType: int) → None¶
Sets the default endianness for the object.
- Parameters
nEndiannessType (int) – The default endianness for the object (
ENDIANNESS_LITTLE
orENDIANNESS_BIG
).See also
GetDefaultEndianness()
.
- SetDefaultStructOptions(options: int) → None¶
Sets the default options for
CFFStruct
instances created from this object (e.g.,CFFSO_Pack1
).These options are used whenever options are not explicitly specified when calling
MakeStruct()
orMakeStructArray()
.
- Parameters
options (int) – The default options.
See also
GetDefaultStructOptions()
.
- SetFSSupport(b: bool) → None¶
Sets the status of file system support.
- Parameters
b (bool) – If
True
, enables file system support; otherwise disables it.Available since Cerbero Suite 7.0 and Cerbero Engine 4.0.
See also
HasFSSupport()
.
- SetMappingAddress(mapping: int) → None¶
Sets the address at which the object is mapped.
For instance, the mapping address is set for binaries loaded from a memory image.
- Parameters
mapping (int) – The mapping address.
See also
GetMappingAddress()
andIsMapped()
.
- SetMemoryUnpackLimit(limit: int) → None¶
Sets the maximum amount of bytes which can be allocated for in-memory decompression algorithms.
- Parameters
limit (int) – The limit in bytes.
See also
GetMemoryUnpackLimit()
.
- SetObjectFormatName(format: str) → None¶
Sets the file format name of the object.
- Parameters
format (str) – The file format name.
See also
GetObjectFormatName()
.
- SetObjectGenericFormatName(format: str) → None¶
Sets the generic format name of the object (e.g., the generic format name of HTML is XML).
- Parameters
format (str) – The generic format name.
See also
GetObjectGenericFormatName()
.
- SetObjectName(name: str) → None¶
Sets the name of the object.
- Parameters
name (str) – The object name.
See also
GetObjectName()
.
- SetObjectTypeName(type_name: str) → None¶
Sets the type name of the object.
- Parameters
type_name (str) – The object type name.
See also
GetObjectTypeName()
.
- SetRange(offset: int, size: int, val: int) → None¶
Sets a range value for the current object.
Warning
This method is deprecated and should not be confused with
NTContainer.setRange()
. UseSetRangeValue()
instead.
- Parameters
offset (int) – The offset of the range.
size (int) – The size of the range.
val (int) – The value of the range (e.g.,
CFFRange_Used
).Available since Cerbero Suite 6.2 and Cerbero Engine 3.2.
See also
SetRangeValue()
,EnableRanges()
,DisableRanges()
andRangesEnabled()
.
- SetRangeValue(offset: int, size: int, val: int) → None¶
Sets a range value for the current object.
- Parameters
offset (int) – The offset of the range.
size (int) – The size of the range.
val (int) – The value of the range (e.g.,
CFFRange_Used
).Available since Cerbero Suite 7.3 and Cerbero Engine 4.3.
See also
EnableRanges()
,DisableRanges()
andRangesEnabled()
.
- SetSize(NewSize: int) → bool¶
Resizes the internal data of the object.
- Parameters
NewSize (int) – The new size of the data.
- Returns
Returns
True
if successful; otherwise returnsFalse
.- Return type
bool
See also
NTContainer.setResizable()
andGetSize()
.
- SetSpecialData(key: str, value: Pro.Core.NTContainer) → None¶
Sets special data associated to the object.
- Parameters
key (str) – The key of the data to set.
value (NTContainer) – The data.
See also
GetSpecialData()
.
- SetTag(t: str) → None¶
Sets the tag name of the object for debugging purposes
- Parameters
t (str) – The tag name.
See also
GetTag()
.
- SetUnpackLimit(limit: int) → None¶
Sets the limit for decompression operations.
- Parameters
limit (int) – The limit in bytes.
See also
GetUnpackLimit()
.
- SetUnpackNestingLimit(limit: int) → None¶
Sets the nesting limit for decompression operations.
- Parameters
limit (int) – The limit.
See also
GetUnpackNestingLimit()
.
- Shift(uSize: int) → bool¶
Appends
uSize
bytes at the end of the object data and sets them to zero.
- Parameters
uSize (int) – The number of bytes to append.
- Returns
Returns
True
if successful; otherwise returnsFalse
.- Return type
bool
See also
NTContainer.shift()
andAlign()
.
- ToBuffer(offset: int, method: int = Bufferize_Forwards) → Pro.Core.CFFBuffer¶
Returns a
CFFBuffer
that reads from the object.
- Parameters
offset (int) – The start offset.
method (int) – The buffering method to use. Defaults to
Bufferize_Forwards
.- Returns
Returns the
CFFBuffer
instance.- Return type
See also
CFFBuffer
.
- ToUInt16(n: int) → int¶
Applies the default endianness of the object to the 16-bit input integer.
The bytes of the integer will be inverted only if the default endianness of the object doesn’t match the endianness of the current platform.
- Parameters
n (int) – The input integer.
- Returns
Returns the inverted integer if the the default endianness of the object doesn’t match the endianness of the current platform; otherwise returns the input integer.
- Return type
int
See also
ToUInt32()
andToUInt64()
.
- ToUInt32(n: int) → int¶
Applies the default endianness of the object to the 32-bit input integer.
- Parameters
n (int) – The input integer.
- Returns
Returns the inverted integer if the the default endianness of the object doesn’t match the endianness of the current platform; otherwise returns the input integer.
- Return type
int
See also
ToUInt16()
andToUInt64()
.
- ToUInt64(n: int) → int¶
Applies the default endianness of the object to the 64-bit input integer.
- Parameters
n (int) – The input integer.
- Returns
Returns the inverted integer if the the default endianness of the object doesn’t match the endianness of the current platform; otherwise returns the input integer.
- Return type
int
See also
ToUInt16()
andToUInt32()
.
- ValidRange(offset: int, Size: int) → bool¶
Checks the validity of a range in the context of the object.
- Parameters
offset (int) – The offset of the range to check.
Size (int) – The size of the range to check.
- Returns
Returns
True
if the range is valid; otherwise returnsFalse
.- Return type
bool
See also
NTContainer.validRange()
.
- Write(offset: int, bytes_or_uSize: Union[bytes, int], bytes: Optional[bytes] = None) → bool¶
Writes data to the object.
- Parameters
offset (int) – The offset at which to write the data.
bytes_or_uSize (Union[bytes, int]) – Either the data to write or the number of bytes to write.
bytes (Optional[bytes]) – The data to write.
- Returns
Returns
True
if successful; otherwise returnsFalse
.- Return type
bool
See also
Read()
.
- WriteUInt16(offset: int, n_or_nEndiannessType: int, n: Optional[int] = None) → bool¶
Writes an unsigned 16-bit integer to the object.
- Parameters
offset (int) – The offset at which to write the value.
n_or_nEndiannessType (int) – Either the value to write or the endianness (
ENDIANNESS_LITTLE
orENDIANNESS_BIG
) to use when writing the value. If the endianness is not specified, the value is written using the default endianness of the object.n (Optional[int]) – The value to write.
- Returns
Returns
True
if successful; otherwise returnsFalse
.- Return type
bool
See also
ReadUInt16()
,WriteUInt8()
,WriteUInt32()
andWriteUInt64()
.
- WriteUInt32(offset: int, n_or_nEndiannessType: int, n: Optional[int] = None) → bool¶
Writes an unsigned 32-bit integer to the object.
- Parameters
offset (int) – The offset at which to write the value.
n_or_nEndiannessType (int) – Either the value to write or the endianness (
ENDIANNESS_LITTLE
orENDIANNESS_BIG
) to use when writing the value. If the endianness is not specified, the value is written using the default endianness of the object.n (Optional[int]) – The value to write.
- Returns
Returns
True
if successful; otherwise returnsFalse
.- Return type
bool
See also
ReadUInt32()
,WriteUInt8()
,WriteUInt16()
andWriteUInt64()
.
- WriteUInt64(offset: int, n_or_nEndiannessType: int, n: Optional[int] = None) → bool¶
Writes an unsigned 64-bit integer to the object.
- Parameters
offset (int) – The offset at which to write the value.
n_or_nEndiannessType (int) – Either the value to write or the endianness (
ENDIANNESS_LITTLE
orENDIANNESS_BIG
) to use when writing the value. If the endianness is not specified, the value is written using the default endianness of the object.n (Optional[int]) – The value to write.
- Returns
Returns
True
if successful; otherwise returnsFalse
.- Return type
bool
See also
ReadUInt64()
,WriteUInt8()
,WriteUInt16()
andWriteUInt32()
.
- WriteUInt8(offset: int, n: int) → bool¶
Writes an unsigned 8-bit integer to the object.
- Parameters
offset (int) – The offset at which to write the value.
n (int) – The value to write.
- Returns
Returns
True
if successful; otherwise returnsFalse
.- Return type
bool
See also
ReadUInt8()
,WriteUInt16()
,WriteUInt32()
andWriteUInt64()
.
- CFFPtrMaxSize: Final[int]¶
The maximum supported pointer size.
This value is reserved for future use.
See also
CFFObject
.
- CFFPtrMinSize: Final[int]¶
The minimum supported pointer size.
This value is reserved for future use.
See also
CFFObject
.
- CFFPtrSize16: Final[int]¶
16-bit pointer size.
This value is reserved for future use.
See also
CFFObject
.
- CFFPtrSize32: Final[int]¶
32-bit pointer size.
This value is reserved for future use.
See also
CFFObject
.
- CFFPtrSize64: Final[int]¶
64-bit pointer size.
This value is reserved for future use.
See also
CFFObject
.
- CFFRange_Custom: Final[int]¶
Range value.
Available since Cerbero Suite 6.2 and Cerbero Engine 3.2.
See also
CFFObject.SetRange()
.
- CFFRange_Last: Final[int]¶
Last range value plus one.
Available since Cerbero Suite 6.2 and Cerbero Engine 3.2.
- CFFRange_Unknown: Final[int]¶
Range value (alias of
CFFRange_Unreferenced
).Available since Cerbero Suite 6.2 and Cerbero Engine 3.2.
See also
CFFObject.SetRange()
.
- CFFRange_Unreferenced: Final[int]¶
Range value.
Available since Cerbero Suite 6.2 and Cerbero Engine 3.2.
See also
CFFObject.SetRange()
.
- CFFRange_Unused: Final[int]¶
Range value.
Available since Cerbero Suite 6.2 and Cerbero Engine 3.2.
See also
CFFObject.SetRange()
.
- CFFRange_Used: Final[int]¶
Range value.
Available since Cerbero Suite 6.2 and Cerbero Engine 3.2.
See also
CFFObject.SetRange()
.
- CFFSO_Clang: Final[int]¶
This flag specifies that the structure was generated by the Clang compiler.
See also
CFFObject.SetDefaultStructOptions()
andCFFStruct
.
- CFFSO_CompilerMask: Final[int]¶
Compiler mask for the flags of the structure.
See also
CFFObject.SetDefaultStructOptions()
andCFFStruct
.
- CFFSO_EndianBig: Final[int]¶
This flag specifies that the structure is big-endian.
See also
CFFObject.SetDefaultStructOptions()
andCFFStruct
.
- CFFSO_EndianDefault: Final[int]¶
This flag specifies that the structure uses the default endianness.
See also
CFFObject.SetDefaultStructOptions()
andCFFStruct
.
- CFFSO_EndianLittle: Final[int]¶
This flag specifies that the structure is little-endian.
See also
CFFObject.SetDefaultStructOptions()
andCFFStruct
.
- CFFSO_EndiannessBig: Final[int]¶
This flag specifies that the structure is big-endian.
See also
CFFObject.SetDefaultStructOptions()
andCFFStruct
.
- CFFSO_EndiannessDefault: Final[int]¶
This flag specifies that the structure uses the default endianness.
See also
CFFObject.SetDefaultStructOptions()
andCFFStruct
.
- CFFSO_EndiannessLittle: Final[int]¶
This flag specifies that the structure is little-endian.
See also
CFFObject.SetDefaultStructOptions()
andCFFStruct
.
- CFFSO_EndiannessMask: Final[int]¶
Endianness mask for the flags of the structure.
See also
CFFObject.SetDefaultStructOptions()
andCFFStruct
.
- CFFSO_GCC: Final[int]¶
This flag specifies that the structure was generated by the GCC compiler.
See also
CFFObject.SetDefaultStructOptions()
andCFFStruct
.
- CFFSO_NoCompiler: Final[int]¶
This flag specifies that the structure wasn’t generated by a specific compiler.
See also
CFFObject.SetDefaultStructOptions()
andCFFStruct
.
- CFFSO_NoPlatform: Final[int]¶
This flag specifies that the structure isn’t bound to specific platform.
See also
CFFObject.SetDefaultStructOptions()
andCFFStruct
.
- CFFSO_Pack1: Final[int]¶
This flag specifies that the structure has an alignment of 1.
See also
CFFObject.SetDefaultStructOptions()
andCFFStruct
.
- CFFSO_Pack16: Final[int]¶
This flag specifies that the structure has an alignment of 16.
See also
CFFObject.SetDefaultStructOptions()
andCFFStruct
.
- CFFSO_Pack2: Final[int]¶
This flag specifies that the structure has an alignment of 2.
See also
CFFObject.SetDefaultStructOptions()
andCFFStruct
.
- CFFSO_Pack4: Final[int]¶
This flag specifies that the structure has an alignment of 4.
See also
CFFObject.SetDefaultStructOptions()
andCFFStruct
.
- CFFSO_Pack8: Final[int]¶
This flag specifies that the structure has an alignment of 8.
See also
CFFObject.SetDefaultStructOptions()
andCFFStruct
.
- CFFSO_PackMask: Final[int]¶
Alignment mask for the flags of the structure.
See also
CFFObject.SetDefaultStructOptions()
andCFFStruct
.
- CFFSO_PackNone: Final[int]¶
This flag specifies that the structure doesn’t have an alignment.
See also
CFFObject.SetDefaultStructOptions()
andCFFStruct
.
- CFFSO_PlatformMask: Final[int]¶
Platform mask for the flags of the structure.
See also
CFFObject.SetDefaultStructOptions()
andCFFStruct
.
- CFFSO_Pointer16: Final[int]¶
This flag specifies that the pointer size of the structure is 16-bits.
See also
CFFObject.SetDefaultStructOptions()
andCFFStruct
.
- CFFSO_Pointer32: Final[int]¶
This flag specifies that the pointer size of the structure is 32-bits.
See also
CFFObject.SetDefaultStructOptions()
andCFFStruct
.
- CFFSO_Pointer64: Final[int]¶
This flag specifies that the pointer size of the structure is 64-bits.
See also
CFFObject.SetDefaultStructOptions()
andCFFStruct
.
- CFFSO_PointerDefault: Final[int]¶
This flag specifies that the pointer size of the structure is the default one for the object.
See also
CFFObject.SetDefaultStructOptions()
andCFFStruct
.
- CFFSO_PointerMask: Final[int]¶
Pointer mask for the flags of the structure.
See also
CFFObject.SetDefaultStructOptions()
andCFFStruct
.
- CFFSO_VC: Final[int]¶
This flag specifies that the structure was generated by the Visual C++ compiler.
See also
CFFObject.SetDefaultStructOptions()
andCFFStruct
.
- CFFSO_Windows: Final[int]¶
This flag specifies that the structure was generated for the Windows platform.
See also
CFFObject.SetDefaultStructOptions()
andCFFStruct
.
- class CFFStruct¶
This class represents a data structure and references a
CFFObject
instance.Instances of
CFFStruct
can be returned fromCFFObject
derived classes or by usingCFFObject.MakeStruct()
in combination with an instance ofCFFHeader
.Example:
from Pro.Core import * from Pro.PE import * def printDOSHeader(fname): c = createContainerFromFile(fname) if c.isNull(): return pe = PEObject() if not pe.Load(c): return out = NTTextBuffer() pe.DosHeader().Dump(out) # CFFStruct.Dump print(out.buffer)See also
CFFStruct
,CFFHeader
andCFFObject.MakeStruct()
.Methods:
Add
(i)If the current instance represents an array of structures, this method changes which entry is currently referenced.
At
(i)Retrieves a specific structure among an array of structures.
Bytes
(i_or_name)Returns the byte-array representation of a member of the structure.
Context
()Returns the context helper class for the current structure.
Count
()Returns the number of entries in the current array of structures.
Dump
(out)Outputs the members of the structure to a text stream according to their type nature.
Equals
(s)Checks whether two structures reference the same internal data.
Fill
(c_or_i_or_name[, c])Fills the entire structure or a member of it with a specified 8-bit value.
Flags
(i_or_name)Returns the flags for a member of the structure.
Returns the start offset of the structure.
Checks whether the structure contains members whose size depends upon the underlying data.
HasFlags
([i_or_name])Checks whether at least one member or a specific member of the structure has flags associated with it.
IsArray
()Returns
True
if the current instance represents an array of structures; otherwise returnsFalse
.
IsFixed
()Returns
True
if the structures has a fixed size; otherwise returnsFalse
.
IsNull
()Returns
True
if the structure is invalid; otherwise returnsFalse
.
IsValid
()Returns
True
if the structure is valid; otherwise returnsFalse
.Returns the length of the longer member name of the structure.
Converts an array of structure into a single structure.
Returns the number of members in the structure.
MemberName
(i)Retrieves the name of a member of the structure by its index.
MemberNature
(i_or_name)Retrieves the type nature of a member of the structure.
MemberOffset
(i_or_name)Retrieves the offset of a member of the structure.
MemberPosition
(name)Retrieves the index of a member of the structure.
MemberSize
(i_or_name)Retrieves the size of a member of the structure.
MemberType
(i)Retrieves the type of a member of the structure.
Retrieves the type name of a member of the structure.
Returns a list of indexes of those members in the structure which have flags.
Num
(i_or_name)Returns the numeric representation of a member of the structure.
Object
()Returns the internally referenced object.
Offset
()Returns the start offset of the structure.
Raw
(i_or_name)Returns the raw data of a member of the structure.
Set
(i_or_name, bytes_or_number_or_str)Sets a member of the structure.
SetContext
(ctx)Sets the context helper class for the current structure.
SetCount
(n)Sets the number of entries in the array of structures.
Sets the number of members that the structure has.
SetObject
(obj)Sets the internally referenced object.
SetOffset
(o)Sets the start offset of the structure.
SetRaw
(i_or_name, bytes)Sets the raw data of a member of the structure.
Size
()Returns the size of the structure.
Str
(i_or_name[, align_nums])Returns the string representation of a member of the structure.
Returns the name of the structure.
SubStruct
(i_or_name)Retrieves a sub-structure of the current structure.
Returns the total size occupied by the array of structures.
Uns
(i_or_name)Returns the unsigned integer representation of a member of the structure.
Zero
([i_or_name])Fills the entire structure or a member of it with zero.
iterator
()Returns an iterator for an array of structures.
- Add(i: int) → Pro.Core.CFFStruct¶
If the current instance represents an array of structures, this method changes which entry is currently referenced.
- Parameters
i (int) – The iterator can be increased by a negative amount.
- Returns
Returns the requested structure if within the limit of available entries; otherwise returns an invalid structure.
- Return type
See also
At()
,Count()
anditerator()
.
- At(i: int) → Pro.Core.CFFStruct¶
Retrieves a specific structure among an array of structures.
- Parameters
i (int) – The index of the structure to retrieve.
- Returns
Returns the requested structure if within the limit of available entries; otherwise returns an invalid structure.
- Return type
See also
Count()
,At()
anditerator()
.
- Bytes(i_or_name: Union[int, str]) → bytes¶
Returns the byte-array representation of a member of the structure.
This method automatically handles the endianness of the requested data.
- Parameters
i_or_name (Union[int, str]) – The index or name of the member of the structure.
- Returns
Returns the requested data if successful; otherwise returns an empty
bytes
object.- Return type
bytes
- Context() → Pro.Core.CFFContext¶
- Returns
Returns the context helper class for the current structure.
- Return type
See also
SetContext()
.
- Count() → int¶
- Returns
Returns the number of entries in the current array of structures.
- Return type
int
See also
SetCount()
,At()
anditerator()
.
- Dump(out: Pro.Core.NTTextStream) → bool¶
Outputs the members of the structure to a text stream according to their type nature.
- Parameters
out (NTTextStream) – The text stream for the output.
- Returns
Returns
True
if successful; otherwise returnsFalse
.- Return type
bool
See also
NTTextStream
.
- Equals(s: Pro.Core.CFFStruct) → bool¶
Checks whether two structures reference the same internal data.
- Parameters
s (CFFStruct) – The other structure.
- Returns
Returns
True
if the structure reference the same internal data; otherwise returnsFalse
.- Return type
bool
- Fill(c_or_i_or_name: Union[int, str], c: Optional[int] = None) → bool¶
Fills the entire structure or a member of it with a specified 8-bit value.
- Parameters
c_or_i_or_name (Union[int, str]) – Either the 8-bit value used to fill the structure or the index or name of the member of the structure to fill.
c (Optional[int]) – The 8-bit value used to fill the member of the structure.
- Returns
Returns
True
if successful; otherwise returnsFalse
.- Return type
bool
See also
Zero()
.
- Flags(i_or_name: Union[int, str]) → Pro.Core.CFFFlags¶
Returns the flags for a member of the structure.
- Parameters
i_or_name (Union[int, str]) – The index or name of the member of the structure.
- Returns
Returns a valid
CFFFlags
instance if successful; otherwise returns an invalidCFFFlags
instance.- Return type
See also
HasFlags()
,MembersWithFlags()
andCFFFlags
.
- GetOffset() → int¶
- Returns
Returns the start offset of the structure.
- Return type
int
See also
Offset()
,SetOffset()
andSize()
.
- HasDynamicSize() → bool¶
Checks whether the structure contains members whose size depends upon the underlying data.
Note
In an array of dynamic structures every entry can potentially have a different size than the other entries. Knowing whether or not a structure is dynamic is important for optimization purposes: skipping multiple entries in an array of dynamic structures requires to read the data for each entry to perform the calculation (e.g.,
Add()
).
- Returns
Returns
True
if the structure contains members whose size depends upon the underlying data; otherwise returnsFalse
.- Return type
bool
- HasFlags(i_or_name: Optional[Union[int, str]] = None) → bool¶
Checks whether at least one member or a specific member of the structure has flags associated with it.
- Parameters
i_or_name (Optional[Union[int, str]]) – The index or name of the member of the structure.
- Returns
Returns
True
if flags are available; otherwise returnsFalse
.- Return type
bool
See also
Flags()
,MembersWithFlags()
andCFFFlags
.
- IsArray() → bool¶
- Returns
Returns
True
if the current instance represents an array of structures; otherwise returnsFalse
.- Return type
bool
See also
Count()
andMakeSingle()
.
- IsFixed() → bool¶
- Returns
Returns
True
if the structures has a fixed size; otherwise returnsFalse
.- Return type
bool
- IsNull() → bool¶
- Returns
Returns
True
if the structure is invalid; otherwise returnsFalse
.- Return type
bool
See also
IsValid()
.
- IsValid() → bool¶
- Returns
Returns
True
if the structure is valid; otherwise returnsFalse
.- Return type
bool
See also
IsNull()
.
- LongestMemberName() → int¶
- Returns
Returns the length of the longer member name of the structure.
- Return type
int
See also
MemberName()
.
- MakeSingle() → Pro.Core.CFFStruct¶
Converts an array of structure into a single structure.
- Returns
Returns the currently referenced structure in the array as a single structure.
- Return type
- MemberCount() → int¶
- Returns
Returns the number of members in the structure.
- Return type
int
See also
SetMemberCount()
.
- MemberName(i: int) → str¶
Retrieves the name of a member of the structure by its index.
- Parameters
i (int) – The index of the member of the structure.
- Returns
Returns the member name if successful; otherwise returns an empty string.
- Return type
str
See also
MemberPosition()
,MemberOffset()
andMemberSize()
.
- MemberNature(i_or_name: Union[int, str]) → int¶
Retrieves the type nature of a member of the structure.
- Parameters
i_or_name (Union[int, str]) – The index or name of the member of the structure.
- Returns
Returns the type nature if successful; otherwise returns
NATURE_UNKNOWN
.- Return type
int
See also
MemberName()
,MemberOffset()
andMemberSize()
.
- MemberOffset(i_or_name: Union[int, str]) → int¶
Retrieves the offset of a member of the structure.
- Parameters
i_or_name (Union[int, str]) – The index or name of the member of the structure.
- Returns
Returns the offset if successful; otherwise returns
INVALID_STREAM_OFFSET
.- Return type
int
See also
MemberName()
,MemberSize()
andMemberPosition()
.
- MemberPosition(name: str) → int¶
Retrieves the index of a member of the structure.
- Parameters
name (str) – The name of the member of the structure.
- Returns
Returns the index if successful; otherwise returns
-1
.- Return type
int
See also
MemberName()
,MemberOffset()
andMemberSize()
.
- MemberSize(i_or_name: Union[int, str]) → int¶
Retrieves the size of a member of the structure.
- Parameters
i_or_name (Union[int, str]) – The index or name of the member of the structure.
- Returns
Returns the size if successful; otherwise returns
0
.- Return type
int
See also
MemberOffset()
,MemberName()
andMemberPosition()
.
- MemberType(i: int) → int¶
Retrieves the type of a member of the structure.
- Parameters
i (int) – The index or name of the member of the structure.
- Returns
Returns the type if successful; otherwise returns
0xFFFFFFFFFFFFFFFF
.- Return type
int
See also
MemberTypeName()
,MemberName()
,MemberOffset()
andMemberSize()
.
- MemberTypeName(i: int) → str¶
Retrieves the type name of a member of the structure.
- Parameters
i (int) – The index or name of the member of the structure.
- Returns
Returns the type name if successful; otherwise returns an empty string.
- Return type
str
See also
MemberType()
,MemberName()
,MemberOffset()
andMemberSize()
.
- MembersWithFlags() → Pro.Core.NTIntList¶
- Returns
Returns a list of indexes of those members in the structure which have flags.
- Return type
See also
HasFlags()
,Flags()
andCFFFlags
.
- Num(i_or_name: Union[int, str]) → int¶
Returns the numeric representation of a member of the structure.
Important
If the member to retrieve is an unsigned integer which doesn’t exceed 64 bit in size, then the slightly faster
Uns()
method can be used instead ofNum()
.This method automatically handles the endianness of the requested data.
- Parameters
i_or_name (Union[int, str]) – The index or name of the member of the structure.
- Returns
Returns the numeric value if successful; otherwise returns
0
.- Return type
int
- Object() → Pro.Core.CFFObject¶
- Returns
Returns the internally referenced object.
- Return type
See also
SetObject()
.
- Offset() → int¶
- Returns
Returns the start offset of the structure.
- Return type
int
See also
GetOffset()
,SetOffset()
andSize()
.
- Raw(i_or_name: Union[int, str]) → bytes¶
Returns the raw data of a member of the structure.
- Parameters
i_or_name (Union[int, str]) – The index or name of the member of the structure.
- Returns
Returns the requested data if successful; otherwise returns an empty
bytes
object.- Return type
bytes
See also
SetRaw()
.
- Set(i_or_name: Union[int, str], bytes_or_number_or_str: Union[bytes, int, str]) → bool¶
Sets a member of the structure.
This method automatically handles the endianness of the data to set.
- Parameters
i_or_name (Union[int, str]) – The index or name of the member of the structure.
bytes_or_number_or_str (Union[bytes, int, str]) – The data to set. This value is automatically converted to the raw data.
- Returns
Returns
True
if successful; otherwise returnsFalse
.- Return type
bool
- SetContext(ctx: Pro.Core.CFFContext) → None¶
Sets the context helper class for the current structure.
- Parameters
ctx (CFFContext) – The context helper class to set.
See also
Context()
.
- SetCount(n: int) → None¶
Sets the number of entries in the array of structures.
- Parameters
n (int) – The number of entries to set.
See also
Count()
,At()
anditerator()
.
- SetMemberCount(n: int) → None¶
Sets the number of members that the structure has.
Note
This method can only reduce the number of members initially available in the structure and it’s used to adapt structures which have different number of members depending on a version or size field.
- Parameters
n (int) – The number of members to set.
See also
MemberCount()
.
- SetObject(obj: Pro.Core.CFFObject) → None¶
Sets the internally referenced object.
- Parameters
obj (CFFObject) – The object to set.
See also
Object()
.
- SetOffset(o: int) → None¶
Sets the start offset of the structure.
- Parameters
o (int) – The start offset to set.
See also
Offset()
,GetOffset()
andSize()
.
- SetRaw(i_or_name: Union[int, str], bytes: bytes) → bool¶
Sets the raw data of a member of the structure.
- Parameters
i_or_name (Union[int, str]) – The index or name of the member of the structure.
bytes (bytes) – The raw data to set.
- Returns
Returns
True
if successful; otherwise returnsFalse
.- Return type
bool
See also
Raw()
.
- Size() → int¶
- Returns
Returns the size of the structure.
- Return type
int
See also
TotalSize()
,Offset()
andGetOffset()
.
- Str(i_or_name: Union[int, str], align_nums: bool = False) → str¶
Returns the string representation of a member of the structure.
This method automatically handles the endianness of the requested data.
- Parameters
i_or_name (Union[int, str]) – The index or name of the member of the structure.
align_nums (bool) – If
True
, aligns numbers using zero-padding.- Returns
Returns the string if successful; otherwise returns an empty string.
- Return type
str
- StructName() → str¶
- Returns
Returns the name of the structure.
- Return type
str
- SubStruct(i_or_name: Union[int, str]) → Pro.Core.CFFStruct¶
Retrieves a sub-structure of the current structure.
This method is available only to fixed size structures.
- Parameters
i_or_name (Union[int, str]) – The name or index of the sub-structure to retrieve.
- Returns
Returns the sub-structure if successful; otherwise returns an invalid structure.
- Return type
See also
IsFixed()
.
- TotalSize() → int¶
- Returns
Returns the total size occupied by the array of structures.
- Return type
int
See also
Size()
,Offset()
andGetOffset()
.
- Uns(i_or_name: Union[int, str]) → int¶
Returns the unsigned integer representation of a member of the structure.
Important
The maximum supported size for unsigned integers returned by this method is 64 bits. To retrieve larger or negative integers
Num()
must be used. The difference between the two methods is thatUns()
is slightly faster thanNum()
.This method automatically handles the endianness of the requested data.
- Parameters
i_or_name (Union[int, str]) – The index or name of the member of the structure.
- Returns
Returns the numeric value if successful; otherwise returns
0
.- Return type
int
Available since Cerbero Suite 5.0 and Cerbero Engine 2.0.
- Zero(i_or_name: Optional[Union[int, str]] = None) → bool¶
Fills the entire structure or a member of it with zero.
- Parameters
i_or_name (Optional[Union[int, str]]) – The index or name of the member of the structure.
- Returns
Returns
True
if successful; otherwise returnsFalse
.- Return type
bool
See also
Fill()
.
- iterator() → Pro.Core.CFFStructIt¶
- Returns
Returns an iterator for an array of structures.
- Return type
See also
CFFStructIt
.
- class CFFStructIt(s: Pro.Core.CFFStruct)¶
Iterator for an array of
CFFStruct
structures.
- Parameters
s (CFFStruct) – The array of structures to iterate over.
See also
CFFStruct.iterator()
andCFFStruct
.Methods:
HasNext
()Returns
True
if there is an entry after the current one; otherwise returnsFalse
.
Next
()Returns the entry after the current one and moves the iterator if successful; otherwise returns an invalid structure.
hasNext
()Returns
True
if there is an entry after the current one; otherwise returnsFalse
.
next
()Returns the entry after the current one and moves the iterator if successful; otherwise returns an invalid structure.
- HasNext() → bool¶
- Returns
Returns
True
if there is an entry after the current one; otherwise returnsFalse
.- Return type
bool
- Next() → Pro.Core.CFFStruct¶
- Returns
Returns the entry after the current one and moves the iterator if successful; otherwise returns an invalid structure.
- Return type
- hasNext() → bool¶
- Returns
Returns
True
if there is an entry after the current one; otherwise returnsFalse
.- Return type
bool
- next() → Pro.Core.CFFStruct¶
- Returns
Returns the entry after the current one and moves the iterator if successful; otherwise returns an invalid structure.
- Return type
- class CFFStructList¶
List of
CFFStruct
elements.Methods:
append
(value)Inserts
value
at the end of the list.
at
(i)Returns the item at index position
i
in the list.
clear
()Removes all items from the list.
contains
(value)Checks the presence of an element in the list.
count
(value)Returns the number of occurrences of
value
in the list.
indexOf
(value[, start])Searches for an element in the list.
insert
(i, value)Inserts
value
at index positioni
in the list.
isEmpty
()Checks whether the list is empty.
iterator
()Creates an iterator for the list.
removeAll
(value)Removes all occurrences of
value
in the list and returns the number of entries removed.
removeAt
(i)Removes the item at index position
i
.
reserve
(alloc)Reserve space for
alloc
elements.
size
()Returns the number of items in the list.
takeAt
(i)Removes the item at index position
i
and returns it.
- append(value: Pro.Core.CFFStruct) → None¶
Inserts
value
at the end of the list.
- Parameters
value (CFFStruct) – The value to add to the list.
See also
insert()
.
- at(i: int) → Pro.Core.CFFStruct¶
Returns the item at index position
i
in the list.i
must be a valid index position in the list (i.e.,0 <= i < size()
).
- Parameters
i (int) – The index of the element to return.
- Returns
Returns the requested element.
- Return type
- clear() → None¶
Removes all items from the list.
- contains(value: Pro.Core.CFFStruct) → bool¶
Checks the presence of an element in the list.
- Parameters
value (CFFStruct) – The value to check for.
- Returns
Returns
True
if the list contains an occurrence ofvalue
; otherwise returnsFalse
.- Return type
bool
- count(value: Pro.Core.CFFStruct) → int¶
Returns the number of occurrences of
value
in the list.
- Parameters
value (CFFStruct) – The value to count.
- Returns
Returns the number of occurrences.
- Return type
int
See also
indexOf()
andcontains()
.
- indexOf(value: Pro.Core.CFFStruct, start: int = 0) → int¶
Searches for an element in the list.
- Parameters
value (CFFStruct) – The value to search for.
start (int) – The start index.
- Returns
Returns the index position of the first occurrence of
value
in the list. Returns-1
if no item was found.- Return type
int
See also
contains()
.
- insert(i: int, value: Pro.Core.CFFStruct) → None¶
Inserts
value
at index positioni
in the list. Ifi
is0
, the value is prepended to the list. Ifi
issize()
, the value is appended to the list.
- Parameters
i (int) – The position at which to add the value.
value (CFFStruct) – The value to add.
See also
append()
andremoveAt()
.
- isEmpty() → bool¶
Checks whether the list is empty.
- Returns
Returns
True
if the list contains no items; otherwise returnsFalse
.- Return type
bool
See also
size()
.
- iterator() → Pro.Core.CFFStructListIt¶
Creates an iterator for the list.
- Returns
Returns the iterator.
- Return type
- removeAll(value: Pro.Core.CFFStruct) → int¶
Removes all occurrences of
value
in the list and returns the number of entries removed.
- Parameters
value (CFFStruct) – The value to remove from the list.
- Returns
Returns the number of entries removed.
- Return type
int
See also
removeAt()
.
- removeAt(i: int) → None¶
Removes the item at index position
i
.i
must be a valid index position in the list (i.e.,0 <= i < size()
).
- Parameters
i (int) – The index of the item to remove.
See also
removeAll()
.
- reserve(alloc: int) → None¶
Reserve space for
alloc
elements. Calling this method doesn’t change the size of the list.
- Parameters
alloc (int) – The amount of elements to reserve space for.
- takeAt(i: int) → Pro.Core.CFFStruct¶
Removes the item at index position
i
and returns it.i
must be a valid index position in the list (i.e.,0 <= i < size()
).
- Parameters
i (int) – The index of the element to remove from the list.
- Returns
Returns the removed element. If you don’t use the return value,
removeAt()
is more efficient.- Return type
See also
removeAt()
.
- class CFFStructListIt(obj: Pro.Core.CFFStructList)¶
Iterator class for
CFFStructList
.
- Parameters
obj (CFFStructList) – The object to iterate over.
Methods:
hasNext
()Returns
True
if there is at least one item ahead of the iterator, i.e. the iterator is not at the back of the container; otherwise returnsFalse
.Returns
True
if there is at least one item behind the iterator, i.e. the iterator is not at the front of the container; otherwise returnsFalse
.
next
()Returns the next item and advances the iterator by one position.
previous
()Returns the previous item and moves the iterator back by one position.
toBack
()Moves the iterator to the back of the container (after the last item).
toFront
()Moves the iterator to the front of the container (before the first item).
- hasNext() → bool¶
- Returns
Returns
True
if there is at least one item ahead of the iterator, i.e. the iterator is not at the back of the container; otherwise returnsFalse
.- Return type
bool
See also
hasPrevious()
andnext()
.
- hasPrevious() → bool¶
- Returns
Returns
True
if there is at least one item behind the iterator, i.e. the iterator is not at the front of the container; otherwise returnsFalse
.- Return type
bool
See also
hasNext()
andprevious()
.
- next() → Pro.Core.CFFStruct¶
- Returns
Returns the next item and advances the iterator by one position.
- Return type
See also
hasNext()
andprevious()
.
- previous() → Pro.Core.CFFStruct¶
- Returns
Returns the previous item and moves the iterator back by one position.
- Return type
See also
hasPrevious()
andnext()
.
- toBack() → None¶
Moves the iterator to the back of the container (after the last item).
See also
toFront()
andprevious()
.
- CFF_ARRAY_NULL_TERMINATED: Final[int]¶
If specified, makes an array of structure be null-terminated.
See also
CFFObject.MakeStructArray()
.
- class CFSEntry(iface: Optional[Pro.Core.CFSEntryInterface] = None)¶
Wrapper class for a
CFSEntryInterface
instance.
- Parameters
iface (Optional[CFSEntryInterface]) – The
CFSEntryInterface
instance to be wrapped.Important
When wrapping an instance of
CFSEntryInterface
, it is necessary to call__disown__()
on it to avoid Python freeing the allocated object. The object will be freed automatically by theCFSEntry
wrapper.Available since Cerbero Suite 7.0 and Cerbero Engine 4.0.
See also
CFSEntryInterface
.Attributes:
Access time type.
Creation time type.
Directory entry type.
Drive entry type.
Fast data flag.
File entry type.
Invalid entry type.
Modification time type.
Methods:
AddProperty
(name, value[, offset])Adds a property to the entry.
Data
([wo])Retrieves the data associated with the entry.
Returns the offset of the entry data if available; otherwise returns
INVALID_STREAM_OFFSET
.
DataSize
()Returns the size of the entry data if available; otherwise returns
0
.
Flags
()Returns the flags of the entry (e.g.,
FastData
).
HasData
()Returns
True
if entry data is available; otherwise returnsFalse
.Returns
True
if entry data size is available; otherwise returnsFalse
.
IsNull
()Returns
True
if the entry is invalid; otherwise returnsFalse
.
IsValid
()Returns
True
if the entry is valid; otherwise returnsFalse
.
Name
()Returns the entry name if available; otherwise returns an empty string.
Path
()Returns the full path of the entry, including the file name.
Property
(name)Retrieves a property of the entry.
Returns the number of properties available.
Returns the list of property names.
PropertyOffset
(name)Retrieves the offset of a property.
SetData
(data)Sets the data of the entry.
SetDataOffset
(offset)Sets the offset of the entry data.
SetDataSize
(size)Sets the size of the entry data.
SetFlags
(flags)Sets the flags of the entry.
SetName
(name)Sets the name of the entry.
SetPath
(path)Sets the full path of the entry.
SetTime
(ttype, t)Sets a specific file time of the entry.
SetType
(type)Sets the type of the entry.
Time
(ttype)Retrieves a specific file time of the entry.
ToXML
([sort, include_data])Converts the entry to an XML string.
Type
()Returns the entry type (e.g.,
Directory
).
- AddProperty(name: str, value: Optional[Union[int, float, bool, bytes, str]], offset: int = INVALID_STREAM_OFFSET) → None¶
Adds a property to the entry.
- Parameters
name (str) – The name of the property.
value (BasicType) – The value of the property.
offset (int) – The optional offset of the property.
See also
Property()
,PropertyCount()
andPropertyNames()
.
- Data(wo: Optional[Pro.Core.NTIWait] = None) → Pro.Core.NTContainer¶
Retrieves the data associated with the entry.
- Parameters
wo (NTIWait) – The optional wait operation for the retrieval of the data.
- Returns
Returns a valid
NTContainer
if successful; otherwise returns an invalidNTContainer
.- Return type
See also
SetData()
,DataOffset()
,DataSize()
andHasData()
.
- DataOffset() → int¶
- Returns
Returns the offset of the entry data if available; otherwise returns
INVALID_STREAM_OFFSET
.- Return type
int
See also
Data()
,SetData()
,DataSize()
andHasData()
.
- DataSize() → int¶
- Returns
Returns the size of the entry data if available; otherwise returns
0
.- Return type
int
Note
The size of the entry data is returned only when set previously using
SetDataSize()
. This method will not internally callData()
to return the size of the data.See also
HasDataSize()
,SetDataSize()
,DataOffset()
,Data()
andSetData()
.
- Drive: Final[int]¶
Drive entry type.
- FastData: Final[int]¶
Fast data flag.
- Flags() → int¶
- Returns
Returns the flags of the entry (e.g.,
FastData
).- Return type
int
Available since Cerbero Suite 7.1 and Cerbero Engine 4.1.
See also
SetFlags()
.
- HasData() → bool¶
- Returns
Returns
True
if entry data is available; otherwise returnsFalse
.- Return type
bool
See also
Data()
,SetData()
,DataOffset()
andDataSize()
.
- HasDataSize() → bool¶
- Returns
Returns
True
if entry data size is available; otherwise returnsFalse
.- Return type
bool
See also
DataSize()
,DataOffset()
,Data()
,SetData()
andHasData()
.
- IsNull() → bool¶
- Returns
Returns
True
if the entry is invalid; otherwise returnsFalse
.- Return type
bool
See also
IsValid()
.
- IsValid() → bool¶
- Returns
Returns
True
if the entry is valid; otherwise returnsFalse
.- Return type
bool
See also
IsNull()
.
- Name() → str¶
- Returns
Returns the entry name if available; otherwise returns an empty string.
- Return type
str
See also
SetName()
.
- Path() → str¶
- Returns
Returns the full path of the entry, including the file name.
- Return type
str
Available since Cerbero Suite 7.1 and Cerbero Engine 4.1.
See also
SetPath()
.
- Property(name: str) → Optional[Union[int, float, bool, bytes, str]]¶
Retrieves a property of the entry.
- Parameters
name (str) – The name of the property to retrieve.
- Returns
Returns the property value if successful; otherwise returns
None
.- Return type
BasicType
See also
PropertyCount()
,PropertyNames()
,AddProperty()
andPropertyOffset()
.
- PropertyCount() → int¶
- Returns
Returns the number of properties available.
- Return type
int
See also
Property()
,PropertyNames()
,AddProperty()
andPropertyOffset()
.
- PropertyNames() → Pro.Core.NTStringList¶
- Returns
Returns the list of property names.
- Return type
See also
Property()
,PropertyCount()
,AddProperty()
andPropertyOffset()
.
- PropertyOffset(name: str) → int¶
Retrieves the offset of a property.
- Parameters
name (str) – The name of the property.
- Returns
Returns the of offset of the property if available; otherwise returns
INVALID_STREAM_OFFSET
.- Return type
int
See also
Property()
,PropertyCount()
,PropertyNames()
andAddProperty()
.
- SetData(data: Pro.Core.NTContainer) → None¶
Sets the data of the entry.
- Parameters
data (NTContainer) – The data of the entry.
See also
Data()
,DataOffset()
,DataSize()
andHasData()
.
- SetDataOffset(offset: int) → None¶
Sets the offset of the entry data.
- Parameters
offset (int) – The offset of the entry data.
See also
DataOffset()
,DataSize()
,Data()
andSetData()
.
- SetDataSize(size: int) → None¶
Sets the size of the entry data.
- Parameters
size (int) – The size of the entry data.
See also
DataOffset()
,DataSize()
,Data()
andSetData()
.
- SetFlags(flags: int) → None¶
Sets the flags of the entry.
- Parameters
flags (int) – The flags of the entry (e.g.,
FastData
).Available since Cerbero Suite 7.1 and Cerbero Engine 4.1.
See also
Flags()
.
- SetName(name: str) → None¶
Sets the name of the entry.
- Parameters
name (str) – The name of the entry.
See also
Name()
.
- SetPath(path: str) → None¶
Sets the full path of the entry.
- Parameters
path (str) – The full path of the entry, including the file name.
Available since Cerbero Suite 7.1 and Cerbero Engine 4.1.
See also
Path()
.
- SetTime(ttype: int, t: Pro.Core.NTDateTime) → None¶
Sets a specific file time of the entry.
- Parameters
ttype (int) – The type of time to set (e.g.,
ModificationTime
).t (NTDateTime) – The time to set.
See also
Time()
.
- SetType(type: int) → None¶
Sets the type of the entry.
- Parameters
type (int) – The type to set (e.g.,
Directory
).See also
Type()
.
- Time(ttype: int) → Pro.Core.NTDateTime¶
Retrieves a specific file time of the entry.
- Parameters
ttype (int) – The type of time to retrieve (e.g.,
ModificationTime
).- Returns
Returns a valid
NTDateTime
if successful; otherwise returns an invalidNTDateTime
instance.- Return type
See also
SetTime()
.
- ToXML(sort: bool = True, include_data: bool = False) → str¶
Converts the entry to an XML string.
- Parameters
sort (bool) – If
True
, sorts the properties alphabetically.include_data (bool) – If
True
, includes the data of the entry encoded as base64.- Returns
Returns the XML string if successful; otherwise returns an empty string.
- Return type
str
- class CFSEntryInterface¶
This class represents a single file system entry.
Its method should never be called directly, but through
CFSEntry
.Hint
All methods used to retrieve data in this class can be overridden. Alternatively, set methods can be used to set the data and thus removing the need to create a derived class that overrides get methods. The two approaches can also be combined. This design leaves to the developer the choice of how to use the interface.
Available since Cerbero Suite 7.0 and Cerbero Engine 4.0.
See also
CFSEntry
.Methods:
AddProperty
(name, value[, offset])Adds a property to the entry.
Data
([wo])Retrieves the data associated with the entry.
Returns the offset of the entry data if available; otherwise returns
INVALID_STREAM_OFFSET
.
DataSize
()Returns the size of the entry data if available; otherwise returns
0
.
Flags
()Returns the flags of the entry (e.g.,
FastData
).
HasData
()Returns
True
if entry data is available; otherwise returnsFalse
.Returns
True
if entry data size is available; otherwise returnsFalse
.
Name
()Returns the entry name if available; otherwise returns an empty string.
Path
()Returns the full path of the entry, including the file name.
Property
(name)Retrieves a property of the entry.
Returns the number of properties available.
Returns the list of property names.
PropertyOffset
(name)Retrieves the offset of a property.
SetData
(data)Sets the data of the entry.
SetDataOffset
(offset)Sets the offset of the entry data.
SetDataSize
(size)Sets the size of the entry data.
SetFlags
(flags)Sets the flags of the entry.
SetName
(name)Sets the name of the entry.
SetPath
(path)Sets the full path of the entry.
SetTime
(ttype, t)Sets a specific file time of the entry.
SetType
(type)Sets the type of the entry.
Time
(ttype)Retrieves a specific file time of the entry.
Type
()Returns the entry type (e.g.,
Directory
).
- AddProperty(name: str, value: Optional[Union[int, float, bool, bytes, str]], offset: int = INVALID_STREAM_OFFSET) → None¶
Adds a property to the entry.
- Parameters
name (str) – The name of the property.
value (BasicType) – The value of the property.
offset (int) – The optional offset of the property.
See also
Property()
,PropertyCount()
andPropertyNames()
.
- Data(wo: Optional[Pro.Core.NTIWait] = None) → Pro.Core.NTContainer¶
Retrieves the data associated with the entry.
- Parameters
wo (NTIWait) – The optional wait operation for the retrieval of the data.
- Returns
Returns a valid
NTContainer
if successful; otherwise returns an invalidNTContainer
.- Return type
See also
SetData()
,DataOffset()
,DataSize()
andHasData()
.
- DataOffset() → int¶
- Returns
Returns the offset of the entry data if available; otherwise returns
INVALID_STREAM_OFFSET
.- Return type
int
See also
Data()
,SetData()
,DataSize()
andHasData()
.
- DataSize() → int¶
- Returns
Returns the size of the entry data if available; otherwise returns
0
.- Return type
int
Note
The size of the entry data is returned only when set previously using
SetDataSize()
. This method will not internally callData()
to return the size of the data.See also
HasDataSize()
,SetDataSize()
,DataOffset()
,Data()
andSetData()
.
- Flags() → int¶
- Returns
Returns the flags of the entry (e.g.,
FastData
).- Return type
int
Available since Cerbero Suite 7.1 and Cerbero Engine 4.1.
See also
SetFlags()
.
- HasData() → bool¶
- Returns
Returns
True
if entry data is available; otherwise returnsFalse
.- Return type
bool
See also
Data()
,SetData()
,DataOffset()
andDataSize()
.
- HasDataSize() → bool¶
- Returns
Returns
True
if entry data size is available; otherwise returnsFalse
.- Return type
bool
See also
DataSize()
,DataOffset()
,Data()
,SetData()
andHasData()
.
- Name() → str¶
- Returns
Returns the entry name if available; otherwise returns an empty string.
- Return type
str
See also
SetName()
.
- Path() → str¶
- Returns
Returns the full path of the entry, including the file name.
- Return type
str
Available since Cerbero Suite 7.1 and Cerbero Engine 4.1.
See also
SetPath()
.
- Property(name: str) → Optional[Union[int, float, bool, bytes, str]]¶
Retrieves a property of the entry.
- Parameters
name (str) – The name of the property to retrieve.
- Returns
Returns the property value if successful; otherwise returns
None
.- Return type
BasicType
See also
PropertyCount()
,PropertyNames()
,AddProperty()
andPropertyOffset()
.
- PropertyCount() → int¶
- Returns
Returns the number of properties available.
- Return type
int
See also
Property()
,PropertyNames()
,AddProperty()
andPropertyOffset()
.
- PropertyNames() → Pro.Core.NTStringList¶
- Returns
Returns the list of property names.
- Return type
See also
Property()
,PropertyCount()
,AddProperty()
andPropertyOffset()
.
- PropertyOffset(name: str) → int¶
Retrieves the offset of a property.
- Parameters
name (str) – The name of the property.
- Returns
Returns the of offset of the property if available; otherwise returns
INVALID_STREAM_OFFSET
.- Return type
int
See also
Property()
,PropertyCount()
,PropertyNames()
andAddProperty()
.
- SetData(data: Pro.Core.NTContainer) → None¶
Sets the data of the entry.
- Parameters
data (NTContainer) – The data of the entry.
See also
Data()
,DataOffset()
,DataSize()
andHasData()
.
- SetDataOffset(offset: int) → None¶
Sets the offset of the entry data.
- Parameters
offset (int) – The offset of the entry data.
See also
DataOffset()
,DataSize()
,Data()
andSetData()
.
- SetDataSize(size: int) → None¶
Sets the size of the entry data.
- Parameters
size (int) – The size of the entry data.
See also
DataOffset()
,DataSize()
,Data()
andSetData()
.