Pro.Core — Core API for parsing and scanning files

Overview

The Pro.Core module contains the core API for parsing and scanning files.

Core Concepts

Some of the most important classes are:

• NTContainer - This is a generic container used to encapsulate data such as files and memory. It’s an extremely important class and it’s used extensively. Containers can be created through SDK functions such as createContainerFromFile() and newContainer().

• NTBuffer/NTContainerBuffer/CFFBuffer/etc. - These type of classes are used to efficiently read iteratively small amounts of data from a source. NTBuffer is the base class and derived classes are named after the object they read from. E.g.: NTContainerBuffer reads from NTContainer and CFFBuffer reads from CFFObject.

• NTTextStream/NTTextBuffer/NTTextStringBuffer - These classes are used to output text. The amount of indentation can be specified. NTTextStream is the base class and derived classes are named after the output type: NTTextBuffer outputs to a utf-8 array and NTTextStringBuffer to a utf-16 array.

• NTXml - Used to parse XML. This class is fast and secure. The code is based on RapidXML.

• CFFObject - The class from which every format class is derived (ZipObject, PEObject, etc.). While NTContainer provides basic parsing facilities, more complex types and the use of CFFStruct rely upon CFFObject.

• CFFHeader - Headers contain definition of structures and can be loaded from SQLite files or XML strings. The structures can be imported from C/C++ code through the Header Manager or from debug symbols such as PDB files.

• CFFStruct - This class represents a data structure.

• CFFFlags - This class represents the flags of a field in a CFFStruct.

Hint

If you’re wondering why the case convention for methods is not always the same, the reason is simple. Classes such as CFFObject and CFFStruct are based on older code which followed the pascal-case convention. Consequently all derived classes like PEObject follow this convention. All other classes use the camel-case convention.

Basic types like integers and strings are automatically converted between C++ and Python. However, lists are preserved for efficiency reasons. Whenever the signature of a method contains a list or another type of container class, you must work with the C++ class. For example, the following example creates a list of C++ integers and iterates through it:

from Pro.Core import *

l = NTIntList()
for i in range(10):
    l.append(i)
it = NTIntListIt(l)
while it.hasNext():
    print(it.next())

Lists, vectors, hashes and sets all have specialized C++ classes usually relying on Qt containers. These type of classes are easily recognized due to the naming convention.

Note

While in C++ these classes are implemented as template classes, in Python they are exposed as different types. However, NTIntList will have exactly the same methods as NTStringList.

Parsing Files

Printing out a structure in a file can be as simple as:

from Pro.Core import *
from Pro.PE import *

def printDOSHeader(fname):
    c = createContainerFromFile(fname)
    if c.isNull():
        return
    pe = PEObject()
    if not pe.Load(c):
        return
    out = NTTextBuffer()
    pe.DosHeader().Dump(out) # CFFStruct.Dump
    print(out.buffer)

Warning

Avoid initializing NTContainer and CFFObject objects globally in order to avoid memory leaks!

If you really need to use a global object, make sure to set it to None when it is no longer needed. This way, the garbage collector will release the allocated memory.

NTContainer is a powerful abstraction for reading from a target. The target can be a memory buffer, a file or even the memory of a remote process. When NTContainer objects are returned by calling functions like createContainerFromFile() or newContainer(), they may either encapsulate a file or a memory buffer. Whether to use a file or a memory buffer is internally decided upon the basis of current memory resources.

If you want to make sure that an NTContainer instance encapsulates a memory buffer you can do it by specifically setting its internal object:

from Pro.Core import *

c = NTContainer()
# set a byte array as the internal object of NTContainer
c.setData(b"")
# NTContainer are never resizeable by default
c.setResizable(True)
# append some data
c.append(b"foo")
# print out the size of 3
print(c.size())

Ranges and address spaces can also be applied to NTContainer. Consider the following example:

from Pro.Core import *

c = NTContainer()
c.setData(b"Hello, world!")
# increase the reference count of c
c2 = c.clone()
# set a new range for c2
c2.setRange(7, 5)
# prints out "Hello, world!"
print(c.read(0, c.size()).decode("utf-8"))
# prints out "world"
print(c2.read(0, c2.size()).decode("utf-8"))

The c2 instance refers to the same object as c but with a different range. This is very useful when working with embedded objects. For instance, parsing a resource inside of a binary file might only require setting the range on an instance NTContainer of the parent binary file, before being passed onto CFFObject.Load().

It is not necessary to subclass CFFObject in order parse a file. We can use CFFObject directly:

from Pro.Core import *

xml_header = """<header>

<r id='_IMAGE_DOS_HEADER' type='struct'>
  <f id='e_magic' type='unsigned short'/>
  <f id='e_cblp' type='unsigned short'/>
  <f id='e_cp' type='unsigned short'/>
  <f id='e_crlc' type='unsigned short'/>
  <f id='e_cparhdr' type='unsigned short'/>
  <f id='e_minalloc' type='unsigned short'/>
  <f id='e_maxalloc' type='unsigned short'/>
  <f id='e_ss' type='unsigned short'/>
  <f id='e_sp' type='unsigned short'/>
  <f id='e_csum' type='unsigned short'/>
  <f id='e_ip' type='unsigned short'/>
  <f id='e_cs' type='unsigned short'/>
  <f id='e_lfarlc' type='unsigned short'/>
  <f id='e_ovno' type='unsigned short'/>
  <f id='e_res' type='unsigned short [4]'/>
  <f id='e_oemid' type='unsigned short'/>
  <f id='e_oeminfo' type='unsigned short'/>
  <f id='e_res2' type='unsigned short [10]'/>
  <f id='e_lfanew' type='int'/>
</r>

</header>"""

def printStructure(fname):
    c = createContainerFromFile(fname)
    if c.isNull():
        return
    # load header from an XML string
    header = CFFHeader()
    if not header.LoadFromXml(xml_header):
        return
    obj = CFFObject()
    # since CFFObject is not subclassed, the Load method cannot fail
    obj.Load(c)
    # map a structure to a specific offset
    offset = 0
    s = obj.MakeStruct(header, "_IMAGE_DOS_HEADER", offset, CFFSO_VC | CFFSO_Pack1)
    out = NTTextBuffer()
    s.Dump(out)
    print(out.buffer)

To read in a buffered way from a target object, be it CFFObject or NTContainer, you can use NTBuffer derived classes such as NTContainerBuffer and CFFBuffer:

from Pro.Core import *

def bufferedRead(fname):
    c = createContainerFromFile(fname)
    if c.isNull():
        return
    obj = CFFObject()
    obj.Load(c)
    offset = 0
    r = obj.ToBuffer(offset)
    try:
        # read a single byte from the file
        b = r.u8()
    except IndexError:
        print("error: out of range")

By default buffered readers default to Bufferize_Forwards. If you want to read backwards or back and forth you can specify Bufferize_Backwards or Bufferize_BackAndForth respectively.

The default endianness can be specified both for CFFObject and NTBuffer instances. If not specified, endianness will default to ENDIANNESS_LITTLE.

If need to parse an XML string, you can use our NTXml class, which is both fast and secure.

from Pro.Core import *

x = NTXml()
ret = x.parse("<r><e t='test'></e></r>")
if ret == NTXml_ErrNone:
    n = x.findChild(None, "r")
    if n != None:
        n = x.findChild(n, "e")
        if n != None:
            a = x.findAttribute(n, "t")
            if a != None:
                print(x.value(a))

All the filters which are available in the UI can be used programmatically from the SDK.

from Pro.Core import *

c = NTContainer()
c.setData(b"Hello, world!")
# compress data with zlib
fstr = "<flts><f name='pack/zlib' level='9' raw='true'/></flts>"
# set the last parameter to False to hide the wait-box
c = applyFilters(c, fstr, True)
# print out the compressed data
print(c.read(0, c.size()))

By using filters it’s possible to perform complex data operations with just a few lines of code. In the code snippet above we use a filter to compress the input data using zlib.

Scanning Files

In this section we offer an introduction into the internals of our scan engine.

The core classes are:

• Report - This class represents a project. A project can be unpacked or packed. When it’s unpacked, it consists of a directory containing a number of DBs and other files. When it’s packed, the same files are merged into a single file and may be compressed and/or encrypted. Fundamentally, in the context of file scanning, a project contains a SQLite3 database which, in turn, contains XML reports for each scanned file. The current instance of this class is returned by ProCoreContext.getReport().

• ScanProvider - This is the base class inherited by all the scan engines for the different file formats.

• ScanEntryData - This is the class that contains the data passed to ScanProvider.addEntry(). Every time a scan provider for a file format encounters a threat, warning, information, privacy issue or embedded file, it calls ScanProvider.addEntry().

• FormatTree - A tree of uint32 ids that describe the layout structure of the analyzed file. This is the layout shown in the format view in the analysis workspace.

• FormatItemInfo - The information returned for each individual item in the format tree. ScanProvider._formatViewInfo() returns this information based on the id provided when constructing the FormatTree.

• ScanViewData - This class is returned by ScanProvider._scanViewData() and ScanProvider._formatViewData(). It may represent raw data, in case of an embedded file, as well as a complex UI.

• CommonSystem - Logic providers return classes derived from this class to define a scanning behaviour. For instance, when creating a logic provider which analyzes only a specific set of files in a directory or on a file system, the derived class LocalSystem can be used.

• ProCoreContext - Provides context information like the current scan provider (ProCoreContext.currentScanProvider()) or the current report (ProCoreContext.getReport()). The global instance of this class is returned by proCoreContext().

As mentioned, for every scanned file an XML report is generated. Below is the commented schema of these XML reports.

<!-- XML schema

note: attributes are marked by parenthesis

o = object
 (t = type
  u = current entry unique id (in hex)
  s = target (base64)
  r = risk
  f = flags)

s = scan entries
  t = threat
  w = warning
  i = info
   (t = type
    u = unique identifier for the entry (in hex)
    f = flags (optional)
    s = target (optional, for embedded files)(base64)
    l = object format (for embedded files)
    )
   (- ic = indirect category
      it = indirect type
    - fi = format item id
    ii = internal file uid
    v  = view
    of = offset
    sz = size)
    d = data (mandatory)
  extra:
    t = text
    flts = filters
      f = filter
        (name + params)
    s = shellcode
      (a = arch
       b = base address
       )

e = embedded objects
  o = object (see above)

h = hashes
  md5 = md5 hash
  etc.

m = metadata
 (ct = creation time
  mt = modification time
  at = access time
  )
  e = entry (content is base64 encoded)
   (id = name identifying the entry (raw)
    l = label (base64)
    f = flags (1 for text to show in report)
    )

<!-- sample -->
<o t="pe" s="C:/file" r="100">

  <!-- scan entries -->
  <s>

    <!-- threat entry -->
    <t t="5" u="0">

      <!-- custom data for the current entry, this is handled by
           the specific scan provider -->
      <d>
        <start>0</start>
        <size>1000</size>
      </d>

      <!-- human readable text (for showing advanced infos)
           encoded in utf8->base64 -->
      <t></t>

      <!-- filters applied on the retrieved data -->
      <flts>
        <f n="aes" p="cbc;256" k="11223344.." />
        <f n="z" />
      </flts>

    </t>

  </s>

  <!-- what follows is a list of embedded objects
       in the same order of the embedded file entries -->
  <e>
    <o t="pdf" r="70">
      <!-- ... -->
    </o>
  </e>

  <!-- various hashes (if any) stored for the current object -->
  <h>
   <md5>00000000000000..</md5>
   <sha1>000000000000...</sha1>
  </h>

  <!-- metadata (if any) -->
  <m ct="hex" wt="hex" at="hex">
    <e>base64</e>
    <e f=1>base64</e> <!-- will be shown as text in the report view -->
  </m>


</o>

The important part to understand when working with the SDK is the custom data mentioned in the schema (the <d> node). This is the custom XML data which is provided by the ScanProvider during the scanning process via ScanProvider.addEntry() and is then passed back to ScanProvider._scanViewData() when requesting data relative to a scan entry.

The data returned from a scan entry can be everything: from a simple description of a threat to an embedded file. In fact, ScanProvider._scanViewData() can return even complex UIs or native code disassembled by our Carbon engine.

Module API

Pro.Core module API.

Attributes:

Bufferize_BackAndForth	Buffering method for NTBuffer.
Bufferize_Backwards	Buffering method for NTBuffer.
Bufferize_Forwards	Buffering method for NTBuffer.
Bufferize_Invalid	Buffering method for NTBuffer.
CFFDBIndexSize32	32-bit index size for CFFDB.
CFFDBIndexSize64	64-bit index size for CFFDB.
CFFDBInvalidIndex	Invalid index for CFFDB.
CFFDBRootIndex	Root index for CFFDB.
CFFKST_Raw	Key sub-type raw.
CFFKST_String	Key sub-type string.
CFFKST_UTF8	Key sub-type utf-8.
CFFKT_Cert	Key type certificate.
CFFKT_Invalid	Key type invalid.
CFFKT_Pass	Key type password.
CFFN_Base	Base value for standard CFFObject notifications.
CFFN_Malformed	CFFObject notification for malformed data.
CFFN_MoreFiles	CFFObject notification for the file limit.
CFFN_NoDecrypt	CFFObject notification for failed decryption.
CFFN_NoUnpack	CFFObject notification for failed decompression.
CFFN_ParsingLimit	CFFObject notification for an internal parsing limit.
CFFN_Recursive	CFFObject notification for recursion.
CFFN_UnpackLimit	CFFObject notification for the decompression limit.
CFFN_UnpackNestLimit	CFFObject notification for the decompression nesting limit.
CFFPtrMaxSize	The maximum supported pointer size.
CFFPtrMinSize	The minimum supported pointer size.
CFFPtrSize16	16-bit pointer size.
CFFPtrSize32	32-bit pointer size.
CFFPtrSize64	64-bit pointer size.
CFFRange_Custom	Range value.
CFFRange_Last	Last range value plus one.
CFFRange_Unknown	Range value (alias of CFFRange_Unreferenced).
CFFRange_Unreferenced	Range value.
CFFRange_Unused	Range value.
CFFRange_Used	Range value.
CFFSO_Clang	This flag specifies that the structure was generated by the Clang compiler.
CFFSO_CompilerMask	Compiler mask for the flags of the structure.
CFFSO_EndianBig	This flag specifies that the structure is big-endian.
CFFSO_EndianDefault	This flag specifies that the structure uses the default endianness.
CFFSO_EndianLittle	This flag specifies that the structure is little-endian.
CFFSO_EndiannessBig	This flag specifies that the structure is big-endian.
CFFSO_EndiannessDefault	This flag specifies that the structure uses the default endianness.
CFFSO_EndiannessLittle	This flag specifies that the structure is little-endian.
CFFSO_EndiannessMask	Endianness mask for the flags of the structure.
CFFSO_GCC	This flag specifies that the structure was generated by the GCC compiler.
CFFSO_NoCompiler	This flag specifies that the structure wasn’t generated by a specific compiler.
CFFSO_NoPlatform	This flag specifies that the structure isn’t bound to specific platform.
CFFSO_Pack1	This flag specifies that the structure has an alignment of 1.
CFFSO_Pack16	This flag specifies that the structure has an alignment of 16.
CFFSO_Pack2	This flag specifies that the structure has an alignment of 2.
CFFSO_Pack4	This flag specifies that the structure has an alignment of 4.
CFFSO_Pack8	This flag specifies that the structure has an alignment of 8.
CFFSO_PackMask	Alignment mask for the flags of the structure.
CFFSO_PackNone	This flag specifies that the structure doesn’t have an alignment.
CFFSO_PlatformMask	Platform mask for the flags of the structure.
CFFSO_Pointer16	This flag specifies that the pointer size of the structure is 16-bits.
CFFSO_Pointer32	This flag specifies that the pointer size of the structure is 32-bits.
CFFSO_Pointer64	This flag specifies that the pointer size of the structure is 64-bits.
CFFSO_PointerDefault	This flag specifies that the pointer size of the structure is the default one for the object.
CFFSO_PointerMask	Pointer mask for the flags of the structure.
CFFSO_VC	This flag specifies that the structure was generated by the Visual C++ compiler.
CFFSO_Windows	This flag specifies that the structure was generated for the Windows platform.
CFF_ARRAY_NULL_TERMINATED	If specified, makes an array of structure be null-terminated.
CT_ActionScript2	Scan entry type for ActionScript2.
CT_ActionScript3	Scan entry type for ActionScript3.
CT_AppLaunch	Scan entry type for application launches.
CT_AttackSurface	Scan entry type for attack surfaces.
CT_BinaryData	Scan entry type for binary data.
CT_Blacklisted	Scan entry type for a blacklisted item.
CT_ByteCode	Scan entry type for byte-code.
CT_DalvikByteCode	Scan entry type for Dalvik byte-code.
CT_DataEntriesEnd	Scan entry type for data entries end.
CT_DataEntriesStart	Scan entry type for data entries start.
CT_DebugData	Scan entry type for debug data.
CT_DecompressionBomb	Scan entry type for decompression bombs.
CT_EmbeddedFile	Scan entry type for embedded objects.
CT_EntryLimit	Scan entry type for entry limits.
CT_FileSystemLimit	Scan entry type for when a file system objects exceeds the maximum size at which its files are automatically scanned.
CT_ForeignData	Scan entry type for foreign data.
CT_FreePages	Scan entry type for free pages.
CT_Geolocation	Scan entry type for geo-locations.
CT_HiddenSheets	Scan entry type for hidden sheets.
CT_Intelligence	Scan entry type for an intelligence report.
CT_InteractiveForm	Scan entry type for interactive forms.
CT_InvalidCertificate	Scan entry type for invalid certificates.
CT_JavaByteCode	Scan entry type for Java byte-code.
CT_JavaScript	Scan entry type for JavaScript.
CT_MSILByteCode	Scan entry type for MSIL byte-code.
CT_Malformed	Scan entry type for malformed data.
CT_MalformedDocument	Scan entry type for malformed documents.
CT_MetaData	Scan entry type for meta-data.
CT_MetaDataUnknown	Scan entry type for unknown meta-data.
CT_NativeCode	Scan entry type for native code.
CT_NoDecompress	Scan entry type for failed decompression.
CT_NoDecrypt	Scan entry type for failed decryption.
CT_OKDecompressed	Scan entry type for successful decompression.
CT_OKDecrypted	Scan entry type for successful decryption.
CT_PersonalData	Scan entry type for personal data.
CT_Privileges	Scan entry type for required privileges.
CT_Recursive	Scan entry type for recursion.
CT_Report	Scan entry type for a report.
CT_Resources	Scan entry type for issues in resources.
CT_Script	Scan entry type for scripts.
CT_ShellCode	Scan entry type for shellcode.
CT_SignatureMatch	Scan entry type for signature matches.
CT_SpreadsheetFormulas	Scan entry type for spreadsheet formulas.
CT_SymbolicLink	Scan entry type for symbolic links.
CT_Thumbnail	Scan entry type for thumbnails.
CT_TrueType	Scan entry type for TrueType fonts.
CT_TrustedCertificate	Scan entry type for trusted certificates.
CT_Type1	Scan entry type for Type1 fonts.
CT_Type2	Scan entry type for Type2 fonts.
CT_UnaccountedSpace	Scan entry type for unaccounted space.
CT_UnknownFont	Scan entry type for unknown fonts.
CT_UnpackLimit	Scan entry type for the decompression limit.
CT_UnpackNestLimit	Scan entry type for the decompression nesting limit.
CT_UnreferencedData	Scan entry type for unreferenced data.
CT_UntrustedCertificate	Scan entry type for untrusted certificates.
CT_UnverifiedCertificate	Scan entry type for unverified certificates.
CT_VBAScript	Scan entry type for VBA code.
CT_VBSScript	Scan entry type for VBS scripts.
CT_VersionInfo	Scan entry type for version information.
CT_Whitelisted	Scan entry type for a whitelisted item.
CT_WrongCheckSum	Scan entry type for invalid checksums.
CT_WrongDigest	Scan entry type for invalid digests.
CT_WrongHash	Scan entry type for invalid hashes.
DSNF_NoAccessSpecifier	Doesn’t include the member type (i.e.: public, protected, private) in the unmangled symbol.
DSNF_NoCallingConvention	Doesn’t include the calling convention in the unmangled symbol.
DSNF_NoMemberType	Doesn’t include the member type (i.e.: static, virtual, extern) in the unmangled symbol.
DSNF_NoReturnType	Doesn’t include the return type in the unmangled symbol.
DSNF_SimpleSignature	Returns a simplified signature of the unmangled symbol.
DisasmOpt_FileOffsets	Shows offsets in disassemblies shown in the text view.
DisasmOpt_Opcodes	Shows opcodes in disassemblies shown in the text view.
ENDIANNESS_BIG	Big-endian option.
ENDIANNESS_LITTLE	Little-endian option.
EXPLICIT_OFLAGS_MASK	The mask for explicit object flags.
FormatGroup_AddressSpace	Address space format group.
FormatGroup_Archive	Archive format group.
FormatGroup_Audio	Audio format group.
FormatGroup_Certificate	Certificate format group.
FormatGroup_Database	Database format group.
FormatGroup_Document	Document format group.
FormatGroup_Email	Email format group.
FormatGroup_Executable	Executable format group.
FormatGroup_FS	File system format group.
FormatGroup_First	First format group.
FormatGroup_Font	Font format group.
FormatGroup_Image	Image format group.
FormatGroup_Last	Last format group (not included).
FormatGroup_ManagedExecutable	Managed executable format group.
FormatGroup_Memory	Memory format group.
FormatGroup_P2P	P2P format group.
FormatGroup_Script	Script format group.
FormatGroup_System	System file format group.
FormatGroup_Unknown	Unknown format group.
FormatGroup_Video	Video format group.
GB_SIZE	This constant defines the size of a gigabyte.
GSP_FDFL_DONT_SORT	Don’t sort scan providers flag.
GSP_FDFL_INCLUDE_DUMMY	Include dummy provider flag.
GSP_FDFL_ONLY_EXTERNALS	Include external scan providers flag.
GSP_FDFL_ONLY_FORMATS	Include only formats and not extensions flag.
IMPLICIT_OFLAG_UNKNOWN_FORMAT	Implicit object flag.
INVALID_OFFSET	Invalid file or data offset.
INVALID_STREAM_OFFSET	Invalid file or data offset.
KB_SIZE	This constant defines the size of a kilobyte.
MB_SIZE	This constant defines the size of a megabyte.
METAFLAG_STRING	Specifies the string nature of the meta-data.
NATURE_BYTEARRAY	Byte-array type nature.
NATURE_NUMBER	Integer number type nature.
NATURE_REAL	Real number type nature.
NATURE_STRING	String type nature.
NATURE_UNKNOWN	Unknown type nature.
NTDefaultLocaleLongDate	The long date format used by the application’s locale.
NTDefaultLocaleShortDate	The short date format specified by the application’s locale.
NTFileOpt_CreateNew	Creates the file only if it doesn’t already exist.
NTFileOpt_ReadOnly	Read-only file access.
NTFileOpt_ShareWrite	Shared write file access.
NTFileOpt_Write	Read/write file access.
NTFlagOutput_IgnoreUnknown	Ignores unknown flags and options.
NTFriday	Fifth day of the week.
NTISODate	ISO 8601 extended date format: either yyyy-MM-dd for dates or yyyy-MM-ddTHH:mm:ss (e.g.
NTLocalTime	Local time, controlled by a system time-zone setting.
NTMonday	First day of the week.
NTOffsetFromUTC	An offset in seconds from Coordinated Universal Time.
NTProcessMemoryAccess_Execute	Executable memory flag.
NTProcessMemoryAccess_Guard	Guarded memory flag.
NTProcessMemoryAccess_Read	Readable memory flag.
NTProcessMemoryAccess_UserMode	User-mode memory flag.
NTProcessMemoryAccess_Write	Writable memory flag.
NTProcessMemoryState_Commit	Committed memory state.
NTProcessMemoryState_Free	Freed memory state.
NTProcessMemoryState_Reserve	Reserved memory state.
NTProcessMemoryType_Image	Image memory type.
NTProcessMemoryType_Mapped	Mapped memory type.
NTProcessMemoryType_Private	Private memory type.
NTRFC2822Date	RFC 2822, RFC 850 and RFC 1036 date format.
NTSaturday	Sixth day of the week.
NTSunday	Seventh day of the week.
NTSystemLocaleLongDate	The long date format used by the operating system.
NTSystemLocaleShortDate	The short date format used by the operating system.
NTTextDate	Date format equivalent to using the date format string "ddd MMM d yyyy".
NTThursday	Fourth day of the week.
NTTimeZone	A named time zone.
NTTuesday	Second day of the week.
NTUTC	Coordinated Universal Time.
NTWednesday	Third day of the week.
NTXml_ErrAlloc	Returned if an allocation error occurred.
NTXml_ErrNone	Returned if no error occurred.
NTXml_ErrParse	Returned if a parse error occurred.
NTXml_ErrUnknown	Returned if an unknown error occurred.
NTXml_FaultTolerant	Parses malformed XML data.
NTXml_IgnoreNS	Ignores XML node namespaces.
NTXml_InvalidFlags	Returned if invalid flags were specified.
NTXml_InvalidNode	Returned if an invalid node was specified.
NTXml_InvalidType	Returned if an invalid type was specified.
NT_ASF_BlockIO	Address space flag for block I/O.
NT_ASF_IgnoreInvalidPages	Address space flag to ignore invalid pages.
NT_ASF_IsSparse	Address space flag for sparse address spaces.
NT_ASF_Memory	Address space flag for process memory.
NT_ASPSF_ALL	Address space standard flag which combines all supported flags.
NT_ASPSF_DIRTY	Address space standard flag for dirty pages.
NT_ASPSF_EXECUTE	Address space standard flag for executable pages.
NT_ASPSF_GUARD	Address space standard flag for guarded pages.
NT_ASPSF_PRESENCE	Address space standard flag for readable/present pages.
NT_ASPSF_TRANSITION	Address space standard flag for transitional pages.
NT_ASPSF_USER_MODE	Address space standard flag for user mode pages.
NT_ASPSF_WRITE	Address space standard flag for writable pages.
NT_ASR_INVALID	Address space result for unsuccessful operations.
NT_ASR_OK	Address space result for successful operations.
NT_ASR_UNSUPPORTED	Address space result for unsupported operations.
NT_FileAttr_Compressed	File attribute flag.
NT_FileAttr_Encrypted	File attribute flag.
NT_FileAttr_Hidden	File attribute flag.
NT_FileAttr_ReadOnly	File attribute flag.
NT_FileAttr_System	File attribute flag.
NT_FileAttr_Temporary	File attribute flag.
NT_FileExt_Dll	Applies a shared library extension to the file name (e.g.: ".dll" on Windows and ".dylib" on macOS).
NT_FileExt_Exe	Applies a binary extension to the file name (i.e., ".exe" on Windows).
NT_FileExt_Link	Applies a link extension to the file name (i.e., ".lnk" on Windows).
NT_Folder_App	Retrieves the application directory.
NT_Folder_AppData	Retrieves the AppData directory on Windows.
NT_Folder_AppExe	Retrieves the application directory.
NT_Folder_AppMenu	Retrieves the AppMenu directory on Windows.
NT_Folder_Applications	Retrieves the applications directory on Windows.
NT_Folder_Applications_x86	Retrieves the x86 applications directory on Windows.
NT_Folder_Common_AppMenu	Retrieves the shared AppMenu directory on Windows.
NT_Folder_Common_Desktop	Retrieves the shared desktop directory on Windows.
NT_Folder_Current	Retrieves the current working directory.
NT_Folder_Desktop	Retrieves the desktop directory.
NT_Folder_Documents	Retrieves the documents directory.
NT_Folder_Home	Retrieves the home directory.
NT_Folder_Root	Retrieves the root directory (i.e., "/" on Linux/macOS and "C:/" on Windows).
NT_Folder_SystemTemp	Retrieves the default system temporary directory.
NT_Folder_Temp	Retrieves the temporary directory.
NT_MEMORY_REGIONS_MAX_ADDR	Maximum memory address for memory regions.
NT_ProcessAccess_All	All process access privileges.
NT_ProcessAccess_Read	Process read access privileges.
NT_ProcessAccess_Terminate	Process termination access privileges.
OFLAG_MORE_CHILDREN	Object flag.
OFLAG_MORE_ENTRIES	Object flag.
OFLAG_MORE_SHELLCODE	Object flag.
OFLAG_NO_DECRYPT	Object flag.
OFLAG_NO_UNPACK	Object flag.
OFLAG_PARSING_LIMIT	Object flag.
OFLAG_UNPACK_LIMIT	Object flag.
OFLAG_UNPACK_NESTING	Object flag.
REPORT_DB_EXT	File extension for an unpacked project.
REPORT_DB_NAME	Name of the main project database.
REPORT_EXT	File extension for a packed project.
REPORT_INT_ODB_NAME	Name of the internal files database.
REPORT_INT_PATH	Name of the internal files path.
REPORT_INT_ROOT_PREFIX	The prefix used to reference internal files from root entries.
REPORT_ODB_NAME	Name of the object database.
REPORT_PROJECT_SIGNATURE	File signature for a packed project.
REPORT_VERSION	Current project version.
SCANVIEW_BE	Specifies that the returned data is big-endian.
SCANVIEW_CARBON	Carbon view.
SCANVIEW_CELLTABLE	Cell table view.
SCANVIEW_CHART	Chart view.
SCANVIEW_CODEC_ASCII	Specifies that the returned data is ascii.
SCANVIEW_CODEC_MASK	Codec mask for the returned data.
SCANVIEW_CODEC_UCS2	Specifies that the returned data is ucs-2.
SCANVIEW_CODEC_UCS4	Specifies that the returned data is ucs-4.
SCANVIEW_CODEC_UTF16	Specifies that the returned data is utf-16.
SCANVIEW_CODEC_UTF32	Specifies that the returned data is utf-32.
SCANVIEW_CODEC_UTF8	Specifies that the returned data is utf-8.
SCANVIEW_CODE_JAVASCRIPT	Specifies that the returned data is JavaScript code.
SCANVIEW_CODE_MASK	Code mask for the returned data.
SCANVIEW_CODE_NONE	Specifies no code type for the returned data.
SCANVIEW_CODE_VBA	Specifies that the returned data is VBA code.
SCANVIEW_CODE_VBS	Specifies that the returned data is VBS code.
SCANVIEW_CUSTOM	Custom view.
SCANVIEW_CUSTOM_2	Second custom view.
SCANVIEW_CUSTOM_3	Third custom view.
SCANVIEW_CUSTOM_4	Fourth custom view.
SCANVIEW_CUSTOM_5	Fifth custom view.
SCANVIEW_DATA_NOT_SHARED	Specifies that the returned data is utf-16 is not shared among the views.
SCANVIEW_EMASK	Endianness mask for the returned data.
SCANVIEW_FILEINFO	File info view.
SCANVIEW_FS	File system view.
SCANVIEW_GEO	Geo-location view.
SCANVIEW_HEX	Hex view.
SCANVIEW_KEYVALUE	Key-value view.
SCANVIEW_LE	Specifies that the returned data is little-endian.
SCANVIEW_LIST	List view.
SCANVIEW_ME	Specifies that the returned data is middle-endian.
SCANVIEW_MEDIA	Media view.
SCANVIEW_NONE	Invalid view.
SCANVIEW_PLOT	Plot view.
SCANVIEW_RAW	Raw hex view.
SCANVIEW_TABLE	Table view.
SCANVIEW_TEXT	Text view.
SCANVIEW_TEXTBROWSER	Text browser view.
SCANVIEW_TREE	Tree view.
SCANVIEW_WEB	Web view.
SEC_File	Scan entry category for embedded objects.
SEC_Info	Scan entry category for information.
SEC_Intrinsic	Scan entry category for intrinsic threats.
SEC_Online	Scan entry category for online entries.
SEC_Privacy	Scan entry category for privacy issues.
SEC_Threat	Scan entry category for threats.
SEC_Warn	Scan entry category for warnings.
SFT_AccessTime	Scan provider time type for file access.
SFT_CreationTime	Scan provider time type for file creation.
SFT_ModificationTime	Scan provider time type for file modification.
TB_SIZE	This constant defines the size of a terabyte.
THIS_HDR_NAME	The special name of the header file associated with the report.
THIS_HEADER_NAME	The file name of the header file associated with the report.
TYPES_NATURE_BASE	Base value for type nature.
ToolDir_CheckExistence	Checks for the existence of the directory.
ToolDir_CreateIfMissing	Creates the directory if missing.
ToolDir_None	Returns the requested directory without checking for its existence or creating it if missing.

Classes:

CFFBuffer(object, offset, method)	This class provides buffered read capability for CFFObject.
CFFContainer()	This is a derived class from NTContainer which can reference data as CFFObject and CFFStruct.
CFFContainerList()	List of CFFContainer elements.
CFFContainerListIt(obj)	Iterator class for CFFContainerList.
CFFContext()	This class is used internally by CFFStruct to store information from members which affect the position and size of other members.
CFFDB()	This class creates a volatile tree structure that is either stored in memory or on disk.
CFFFlags()	This class contains flags and options for a member of CFFStruct.
CFFGetKeyResult()	This class is the return value of CFFObject.GetKey().
CFFGetKeyResultList()	List of CFFGetKeyResult elements.
CFFGetKeyResultListIt(obj)	Iterator class for CFFGetKeyResultList.
CFFHeader()	This class represents a header.
CFFHeaderAliasData()	Alias data of a header file.
CFFHeaderStructData()	Structure data of a header file.
CFFHeaderTypeDefData()	Type definition data of a header file.
CFFInitParams(wo, options)	This class contains the initialization parameters for the CFFObject.Initialize() method.
CFFKeyIndex()	This class represents a key index.
CFFObject()	The class from which every format class is derived (ZipObject, PEObject, etc.).
CFFStruct()	This class represents a data structure and references a CFFObject instance.
CFFStructIt(s)	Iterator for an array of CFFStruct structures.
CFFStructList()	List of CFFStruct elements.
CFFStructListIt(obj)	Iterator class for CFFStructList.
CFSEntry(iface)	Wrapper class for a CFSEntryInterface instance.
CFSEntryInterface()	This class represents a single file system entry.
CFSInstance(iface)	Wrapper class for a CFSInterface instance.
CFSInterface()	This class represents a file system interface
CFSIterator(iface)	Wrapper class for a CFSIteratorInterface instance.
CFSIteratorInterface()	This class represents a file system iterator.
CFSList(iface)	Wrapper class for a CFSListInterface instance.
CFSListInterface()	This class represents a file system list.
CommonSystem()	Logic providers return classes derived from this class to define a scanning behaviour.
FileToScan()	This class contains information about the file to scan returned by classes derived from CommonSystem.
FormatItemInfo()	The information about a format item returned by ScanProvider._formatViewInfo().
FormatTree()	Tree of FormatTreeNode nodes.
FormatTreeNode()	This class represents a node of FormatTree.
FormatTreeNodeList()	List of FormatTreeNode elements.
FormatTreeNodeListIt(obj)	Iterator class for FormatTreeNodeList.
KROffset()	Match for a byte search in NTContainer.
Layout()	Layouts are used to create ranges and associate structures to hex views.
LayoutData()	This class contains the data of a layout entry.
LayoutInterval()	This class represents a layout interval.
LayoutPair(t1, t2)	Pair of (LayoutInterval, LayoutData) elements.
LayoutPairList()	List of LayoutPair elements.
LayoutPairListIt(obj)	Iterator class for LayoutPairList.
LocalSystem()	CommonSystem derived class used to perform local file system scans.
NTAddressSpace()	This class is used to apply address spaces to containers.
NTBuffer()	Base class for buffered read operations.
NTByteArrayList()	List of bytes elements.
NTByteArrayListIt(obj)	Iterator class for NTByteArrayList.
NTContainer()	This is a generic container used to encapsulate data such as files and memory.
NTContainerBuffer(container, endianness, …)	This class provides buffered read capability for NTContainer.
NTDate(y, m, d)	This class provides date functions.
NTDateTime(date, time, spec)	This class provides date and time functions.
NTDoubleList()	List of float elements.
NTDoubleListIt(obj)	Iterator class for NTDoubleList.
NTDoubleVector()	Vector list of float elements.
NTDoubleVectorIt(obj)	Iterator class for NTDoubleVector.
NTFileEnum(path)	This class enumerates files from a specified path.
NTIWait()	Interface for wait objects.
NTIntList()	List of int elements.
NTIntListIt(obj)	Iterator class for NTIntList.
NTIntVariantHash()	Dictionary of int -> BasicType elements.
NTIntVariantHashIt(obj)	Iterator class for NTIntVariantHash.
NTIntVector()	Vector list of int elements.
NTIntVectorIt(obj)	Iterator class for NTIntVector.
NTMaxUIntList()	List of int elements.
NTMaxUIntListIt(obj)	Iterator class for NTMaxUIntList.
NTMaxUIntTree()	Tree of NTMaxUIntTreeNode nodes.
NTMaxUIntTreeNode()	This class represents a node of NTMaxUIntTree.
NTMaxUIntTreeNodeList()	List of NTMaxUIntTreeNode elements.
NTMaxUIntTreeNodeListIt(obj)	Iterator class for NTMaxUIntTreeNodeList.
NTMaxUIntVector()	Vector list of int elements.
NTMaxUIntVectorIt(obj)	Iterator class for NTMaxUIntVector.
NTMemoryInfoList()	List of NTMemoryInfo elements.
NTMemoryInfoListIt(obj)	Iterator class for NTMemoryInfoList.
NTModuleInfoList()	List of NTModuleInfo elements.
NTModuleInfoListIt(obj)	Iterator class for NTModuleInfoList.
NTOffsetRange()	This class defines a generic offset-size range.
NTOffsetRangeList()	List of NTOffsetRange elements.
NTOffsetRangeListIt(obj)	Iterator class for NTOffsetRangeList.
NTProcessInfoList()	List of NTProcessInfo elements.
NTProcessInfoListIt(obj)	Iterator class for NTProcessInfoList.
NTProcessRegionsEnumerator(pid)	This class implements an enumerator for memory regions.
NTSimpleWait()	Basic implementation of NTIWait.
NTStringList()	List of str elements.
NTStringListIt(obj)	Iterator class for NTStringList.
NTStringPair(t1, t2)	Pair of (str, str) elements.
NTStringPairList()	List of NTStringPair elements.
NTStringPairListIt(obj)	Iterator class for NTStringPairList.
NTStringStringHash()	Dictionary of str -> str elements.
NTStringStringHashIt(obj)	Iterator class for NTStringStringHash.
NTStringStringHashList()	List of NTStringStringHash elements.
NTStringStringHashListIt(obj)	Iterator class for NTStringStringHashList.
NTStringVariantHash()	Dictionary of str -> BasicType elements.
NTStringVariantHashIt(obj)	Iterator class for NTStringVariantHash.
NTTextBuffer()	This is a class derived from NTTextStream.
NTTextStream()	An interface for outputting text and mnemonics.
NTTextStringBuffer()	This is a class derived from NTTextStream.
NTTextTag()	This class represents a single text tag.
NTTextTags()	This class represents a sorted list of text tags.
NTTime(h, m, s, ms)	This class provides clock time functionality.
NTTimer()	This class implements a fast milliseconds timer based on NT_GetTickCount().
NTUInt64List()	List of int elements.
NTUInt64ListIt(obj)	Iterator class for NTUInt64List.
NTUInt64UIntHash()	Dictionary of int -> int elements.
NTUInt64UIntHashIt(obj)	Iterator class for NTUInt64UIntHash.
NTUIntList()	List of int elements.
NTUIntListIt(obj)	Iterator class for NTUIntList.
NTUIntTree()	Tree of NTUIntTreeNode nodes.
NTUIntTreeNode()	This class represents a node of NTUIntTree.
NTUIntTreeNodeList()	List of NTUIntTreeNode elements.
NTUIntTreeNodeListIt(obj)	Iterator class for NTUIntTreeNodeList.
NTUIntVector()	Vector list of int elements.
NTUIntVectorIt(obj)	Iterator class for NTUIntVector.
NTUShortUShortHash()	Dictionary of int -> int elements.
NTUShortUShortHashIt(obj)	Iterator class for NTUShortUShortHash.
NTUShortVector()	Vector list of int elements.
NTUShortVectorIt(obj)	Iterator class for NTUShortVector.
NTUTF8StringHash()	Dictionary of str -> str elements.
NTUTF8StringHashIt(obj)	Iterator class for NTUTF8StringHash.
NTUTF8StringList()	List of str elements.
NTUTF8StringListIt(obj)	Iterator class for NTUTF8StringList.
NTVariantList()	List of BasicType elements.
NTVariantListIt(obj)	Iterator class for NTVariantList.
NTVoidBuffer()	This is a class derived from NTTextStream.
NTXml()	XML parser class.
NT_MEMORY_INFO()	This class represents a memory region.
NT_MODULE_INFO()	This class contains information about a loaded module.
NT_PROCESS_INFO()	This class contains information about a process.
PDBAssociationInfo()	This class contains association information for Windows PDB files.
ProCoreContext()	This class provides functionality for the current context.
ProGlobalSettings()	This class provides access to the main settings of the application.
ProPlugin()	This class represents a generic plugin.
ProPluginInterface()	This class represents a generic plugin interface.
ProPluginList()	List of ProPlugin elements.
ProPluginListIt(obj)	Iterator class for ProPluginList.
ProSettings()	This class provides access to settings.
ProTextPrintBuffer()	This is a class derived from NTTextStream.
ProValueStorage()	This class provides SQLite-backed key -> value storage facility.
ProWebRequest(url)	This class can be used to make a web request.
Report()	This class represents a project.
ScanEntryBaseAttributes()	This class contains the base attributes of a scan entry retrieved from the report.
ScanEntryData()	This class represents a scan entry.
ScanMetaDataEntries()	List of ScanMetaDataEntry elements.
ScanMetaDataEntriesIt(obj)	Iterator class for ScanMetaDataEntries.
ScanMetaDataEntry()	This class represents a scan meta-data entry.
ScanProvider()	This is the base class inherited by all the scan engines for the different file formats.
ScanProviderWait(sprovider)	This class only wraps ScanProvider.isAborted().
ScanViewData()	This class is used as I/O container to retrieve data and UI views from a scan provider.
objdb_info()	This class contains information about an entry in the object database.
objdbview_info()	This class contains parameters to create a window view of the object database.

Functions:

CurrentEndianness()	Returns the endianness of the system (ENDIANNESS_LITTLE or ENDIANNESS_BIG).
DemangleSymbolName(mangled[, flags])	Unmangles a decorated symbol.
MethodNameFromSimpleSignature(signature)	Extracts the function or method name from a simple signature.
NT_AppendFile(src, copySize, dst)	Appends copySize bytes of src file to dst file.
NT_ApplyFileExt(fileName, filetype)	Appends the default extension type for the current system specified by filetype to fileName.
NT_AutoDecodeBytes(raw)	This function tries to decode raw bytes into a string using simple heuristics.
NT_CloseFile(ntfile)	Closes an open file handle.
NT_CloseModuleHandle(ntmod)	Closes the handle of a module without unloading the module.
NT_CloseProcess(proc)	Closes a process handle.
NT_ColorFromString(str)	Compute a color from an input string.
NT_CopyFile(fileNameA, fileNameB)	Copies a file.
NT_CopyFileOpen(fileNameA, fileNameB)	Copies a file.
NT_CreateDirectory(dirName)	Creates a directory.
NT_CreateDirectoryTree(dirName)	Creates a directory and all the intermediate directories leading up to that directory if not yet present.
NT_CreateFile(FileName[, opt])	Creates a file.
NT_CreateFileLink(fileName, linkName[, descr])	Creates a link (e.g.: .lnk on Windows) file.
NT_CreateTempFile([ext, auto_delete])	Creates a temporary file.
NT_DecodeAsciiBytes(raw)	This function tries to decode an ascii string using simple heuristics.
NT_DecodeAsciiBytes16(raw, endianness)	This function tries to decode an ascii wide-char string using simple heuristics.
NT_DeleteDirectory(dirName)	Deletes a directory.
NT_DeleteFile(FileName)	Deletes a file.
NT_DeleteLink(linkName)	Deletes a link (e.g.: .lnk on Windows) file.
NT_DirectoryExists(dirName)	Checks the existence of a directory.
NT_FileExists(FileName)	Checks the existence of a file.
NT_FileExtFromName(fileName[, include_dot])	Retrieves the extension of a file name (e.g.: ".exe").
NT_FileNameFromPath(path)	Retrieves the file name from a path.
NT_FileToBuffer(fileName, maxSize[, readPartial])	Reads a file to a memory buffer.
NT_FloatToString(v)	Converts a float value to string.
NT_FreeModule(ntmod)	Unloads a module and closes its handle.
NT_GetCurrentDirectory()	Returns the current working directory.
NT_GetCurrentModuleFileName()	Returns the name of the current module including its path.
NT_GetCurrentModulePath()	Returns the full path of the current module.
NT_GetCurrentProcessId()	Returns the current process id.
NT_GetCurrentProcessPath()	Returns the path of the executable of the current process.
NT_GetCustomTempFolder()	Gets the temporary directory set for the application.
NT_GetFileAttributes(fileName)	Retrieves the attributes of a file.
NT_GetFileAttributesAsString(fileName)	Retrieves the attributes of a file as a string.
NT_GetFileName(ntfile)	Retrieves the name of a file from its handle.
NT_GetFileOwner(fileName)	Retrieves the file owner of a file.
NT_GetFilePermissionsAsString(fileName)	Retrieves the file permissions as a string.
NT_GetFilePos(ntfile)	Gets the current file position.
NT_GetFileSize(ntfile)	Gets the size of a file.
NT_GetMemoryRegions(pid[, allocated_only, limit])	Retrieves the list of memory regions allocated by the specified process.
NT_GetModule(name)	Retrieves a module from its name.
NT_GetModuleList(pid)	Retrieves the list of modules loaded in the address space of a process.
NT_GetProcessFileName(pid_or_proc)	Retrieves the path of the executable of a specified process.
NT_GetProcessId(proc)	Retrieves the process id for a process handle.
NT_GetProcessList([only_accessible])	Retrieves the current list of processes.
NT_GetSpecialFolder(f)	Retrieves a special system directory.
NT_GetSystemFileHandle(ntfile)	Returns the internal system handle of a file.
NT_GetTempFileName([ext])	Generates a temporary file name.
NT_GetTickCount()	Returns the time passed since system boot in milliseconds.
NT_HasProcessAPI()	Returns True if the process API is available on the current system; otherwise returns False.
NT_HexCharToByte(ch)	Converts a hex character into its corresponding integer value (e.g.: ord('F') -> 15).
NT_IsCurrentModuleDLL()	Returns True if the current module is a shared library; otherwise returns False.
NT_IsRelativePath(path)	Checks whether a path is relative.
NT_KillProcess(pid_or_proc[, timeout])	Terminates a process.
NT_LoadModule(name)	Loads a module from disk.
NT_MakeCString(str)	Escapes a string for C (e.g.: "Hello,\nWorld!" becomes "Hello,\\nWorld!").
NT_MakeFileExecutable(fileName)	Adds executable attributes to the specified file if they’re missing.
NT_MatchFileName(fileNameA, fileNameB)	Compares two paths taking also into account the case sensitivity of the current file system.
NT_MemorySizeToString(size[, prec])	Converts a size in bytes to a string representation using byte, KB, MB or GB units.
NT_NormalizeFileName(fileName)	Replaces any backslash in a file name with a forward slash.
NT_NormalizePath(path)	Replaces any backslash in a path with a forward slash and makes sure that the path ends with a trailing forward slash.
NT_NormalizeToNative(fileOrPath)	Replaces the slashes of a file name or path with the slashes expected by the current system (i.e., backslashes on Windows and slashes on Linux/macOS).
NT_NormalizeToOrigin(fileOrPath)	Replaces the slashes of a file name or path with the slashes expected by the originating system (i.e., backslashes on Windows and slashes on Linux/macOS).
NT_OpenFile(FileName[, opt])	Opens an existing file.
NT_OpenProcess(pid[, access])	Retrieves a handle to a process.
NT_PathFromFileName(fileName)	Separates a path or file name from its trailing part.
NT_RawPathFromFileName(fileName)	Behaves exactly like NT_PathFromFileName(), except that it retains the slashes of the input.
NT_ReadFile(ntfile, nBytesToRead)	Reads a specified amount of bytes from a file and updates the file position.
NT_ReadProcessMemory(proc, MemoryAddr, …)	Reads the memory of a process.
NT_ResetFixedFileSize(ntfile)	Resets the fixed file size set by calling NT_SetFixedFileSize().
NT_ResolveShortcut(shortcut)	Resolves the target of a link (.lnk) file.
NT_ResolveSymbol(ntmod, symname)	Resolves the symbol of a module.
NT_SetCurrentDirectory(dirName)	Sets the current working directory.
NT_SetCustomTempFolder(path)	Sets a custom temporary folder to be used by the application.
NT_SetFileAutoDelete(ntfile, auto_delete)	Sets the auto-deletion flag for the file.
NT_SetFilePos(ntfile, FileOffset)	Sets the current file position.
NT_SetFileSize(ntfile, NewFileSize)	Changes the size of a file.
NT_SetFixedFileSize(ntfile, FixedFileSize)	Sets the fixed size of a file.
NT_StripFileExt(fileName)	Strips the extension from a file name.
NT_TrashFile(fileName[, showProgress])	Moves a file to the trash.
NT_UnescapeCString(str)	Unescapes a C string (e.g.: "Hello,\\nWorld!" becomes "Hello,\nWorld!").
NT_Win32FileTimeToDateTime(Time)	Converts a Windows FILETIME to NTDateTime.
NT_WriteFile(ntfile, bytes)	Writes the specified bytes to a file.
NT_WriteProcessMemory(proc, MemoryAddr, bytes)	Writes the memory of a process.
appDataDir([opt])	Retrieves the user data directory for the application.
applyFilters(data, str[, waitdlg_or_wo])	Applies the specified filters to an NTContainer and returns the resulting data as an NTContainer.
carbonThemesDir()	Returns the carbon themes directory.
cfsFileSystem()	Maps the computer file system to a CFSInstance instance.
cfsFileSystemEntry(path)	Maps a file system file to a CFSEntry instance.
configDir()	Returns the configuration directory.
createAddressSpace(name[, pt_offs, arg2, arg3])	Creates an address space based on a page-table.
createBlockIOAddressSpace(total_size, page_size)	Creates a block I/O address space.
createContainerFromFile(fname)	Creates an NTContainer object from a file on disk.
createSparseAddressSpace([reference_as, …])	Creates a sparse address space.
enableHook(name, enable)	Enables or disables the specified hook
executeFunctionInMainThread(func[, ud, blocking])	Executes a function from the main thread.
getFormatDescr(ext)	Retrieves the description for a format or extension.
getFormatExtensions(ext)	Retrieves all extensions for the specified format or extension.
getFormatFromExtension(ext)	Converts an extension to its format name.
getFormatGroup(ext)	Converts a format or extension to its format group.
getFormatGroupFromShortName(name)	Converts the short name to a format group.
getFormatGroupName(group[, plural])	Retrieves the user-friendly name for the format group.
getShortFormatGroupName(group)	Retrieves the short name for the format group.
getSupportedFileExtensions()	Returns the list of supported file extensions.
getSupportedFormatsAndDescr([flags])	Returns a list of supported file formats and their description.
headersDir()	Returns the headers directory.
identifyPossibleFormats(data)	Identifies a list of possible file formats for the input data.
isExtensionSupported(ext)	Checks whether a format or extension is supported.
isGuiThread()	Returns True if called from the UI thread; otherwise returns False.
mediaDir()	Returns the media directory.
newContainer([size, reserve_size, max_size])	Creates a new NTContainer object.
ntAlpha(rgb)	Retrieves the alpha color component from an RGBA value.
ntAlphaBlend(src, bkg)	Performs an alpha blend operation on two RGBA values.
ntBlue(rgb)	Retrieves the blue color component from an RGBA value.
ntGreen(rgb)	Retrieves the green color component from an RGBA value.
ntRed(rgb)	Retrieves the read color component from an RGBA value.
ntRgb(r, g, b)	Creates an RGBA value from its red, green and blue color components.
ntRgba(r, g, b, a)	Creates an RGBA value from its red, green, blue and alpha color components.
ntShiftToColor(source, target, fraction)	Shift an RGBA value to another RGBA value.
packageCertificatesDir()	Returns the package certificates directory.
pluginsDir()	Returns the plugins directory.
proAbort(ret[, msg])	Aborts the application with an optional message.
proAddRecentFile(history, fname[, max_list_size])	Adds a recent file name to a specified historical list.
proAddRecentItem(history, item[, max_list_size])	Adds a recent item to a specified historical list.
proApplicationFileName()	Returns the path of the main application.
proArchIsX64()	Returns True if the current architecture is x64; otherwise returns False.
proArchIsX86()	Returns True if the current architecture is x86; otherwise returns False.
proArchName()	Returns the name of the current architecture (e.g., 'x64').
proClearOutput([with_undo])	Clears the output view if available.
proCoreContext()	Returns the global ProCoreContext instance.
proCrashApplication(i)	Crashes the application on purpose.
proDisasmOptions()	Returns the current disassembly options for the text view.
proGetAvailablePlugins(config_name)	Retrieves a list of generic plugins.
proGetIntPtr(name)	Retrieves an internal pointer.
proGetLine([prompt])	Retrieves an input string either by prompting a dialog box or from the terminal.
proGetRecentItems(history)	Retrieves a specified historical list.
proGetRiskBgColor(risk, bg)	Computes a color based on risk percentage.
proLaunchApplication(app[, args])	Launches an application.
proLaunchThisApplication([args])	Launches the main application.
proPlatformIsLinux()	Returns True if the current platform is Linux; otherwise returns False.
proPlatformIsMacOS()	Returns True if the current platform is macOS; otherwise returns False.
proPlatformIsWindows()	Returns True if the current platform is Windows; otherwise returns False.
proPlatformName()	Returns the name of the current platform (supported values are: 'windows', 'linux' and 'macos').
proPlatformShortName()	Returns the short name of the current platform (supported values are: 'win', 'lin' and 'mac').
proPrint(str)	Prints a message to the output view.
proPrintnl(str)	Prints a message to the output view.
proProcessEvents([ms])	Processes thread loop events.
proSetReturnCode(ret)	Sets the return code for the application.
proTextStream()	Creates a new NTTextBuffer instance with the default disassembly options.
proVersion()	Returns the current version of the application as a string in the shape of major_version.minor_version.build_version.
proVersionBuild()	Returns the build number of the application.
proVersionMajor()	Returns the major version of the application.
proVersionMinor()	Returns the minor version of the application.
pythonAllowIdleProcessing(b)	Enables or disables the idle processing of Python code.
themesDir()	Returns the themes directory.
userCarbonThemesDir([opt])	Retrieves the user carbon themes directory.
userConfigDir([opt])	Retrieves the user configuration directory.
userHeadersDir([opt])	Retrieves the user headers directory.
userMediaDir([opt])	Retrieves the user media directory.
userPDBSymbolsDir([opt])	Retrieves the user PDB symbols directory.
userPackageCertificatesDir([opt])	Retrieves the user package certificates directory.
userPackagesDir([opt])	Retrieves the user packages directory.
userPluginsDir([opt])	Retrieves the user plugins directory.
userPythonPluginsDir([opt])	Retrieves the user Python plugins directory.
userThemesDir([opt])	Retrieves the user themes directory.

Bufferize_BackAndForth: Final[int]

Buffering method for NTBuffer. To use when reading in both directions.

Bufferize_Backwards: Final[int]

Buffering method for NTBuffer. To use when reading backwards.

Bufferize_Forwards: Final[int]

Buffering method for NTBuffer. To use when reading forwards.

Bufferize_Invalid: Final[int]

Buffering method for NTBuffer. Only used for uninitialized instances.

See also NTBuffer.isNull().

class CFFBuffer(object: Pro.Core.CFFObject, offset: int, method: int = Bufferize_Forwards)

Bases: Pro.Core.NTBuffer

This class provides buffered read capability for CFFObject.

Parameters

• object (CFFObject) – The object to read from.

• offset (int) – The start offset to read from.

• method (int) – The buffering method to use. Defaults to Bufferize_Forwards.

See also CFFObject.ToBuffer(), NTBuffer and NTContainerBuffer.

class CFFContainer

Bases: Pro.Core.NTContainer

This is a derived class from NTContainer which can reference data as CFFObject and CFFStruct.

See also NTContainer(), NTContainerBuffer and NTAddressSpace.

Attributes:

FileSystem	Type of data internally referenced by the container.
Object	Type of data internally referenced by the container.
Struct	Type of data internally referenced by the container.

Methods:

setData(data[, own_or_size])	See NTContainer.setData().
toFileSystem()	Returns the internal CFSInstance referenced by the container if the dataType() is FileSystem; otherwise returns an invalid CFSInstance instance.
toObject()	Returns the internal CFFObject referenced by the container if the dataType() is Object; otherwise returns None.
toStruct()	Returns the internal CFFStruct referenced by the container if the dataType() is Struct; otherwise returns an invalid struct.

FileSystem: Final[int]

Type of data internally referenced by the container.

Available since Cerbero Suite 7.0 and Cerbero Engine 4.0.

See also NTContainer.dataType().

Object: Final[int]

Type of data internally referenced by the container.

See also NTContainer.dataType().

Struct: Final[int]

Type of data internally referenced by the container.

See also NTContainer.dataType().

setData(data: Union[CFFObject, CFFStruct, CFSInstance, NTByteArrayList, NTContainer, NTStringList, NTTextTags, NT_FILE, NT_PROCESS, bytes, int, str], own_or_size: Union[bool, int] = True) → None

See NTContainer.setData().

toFileSystem() → Pro.Core.CFSInstance

Returns

Returns the internal CFSInstance referenced by the container if the dataType() is FileSystem; otherwise returns an invalid CFSInstance instance.

Return type

CFSInstance

Available since Cerbero Suite 7.0 and Cerbero Engine 4.0.

See also NTContainer.dataType().

toObject() → object

Returns

Returns the internal CFFObject referenced by the container if the dataType() is Object; otherwise returns None.

Return type

CFFObject

See also NTContainer.dataType().

toStruct() → Pro.Core.CFFStruct

Returns

Returns the internal CFFStruct referenced by the container if the dataType() is Struct; otherwise returns an invalid struct.

Return type

CFFStruct

See also NTContainer.dataType().

class CFFContainerList

List of CFFContainer elements.

Methods:

append(value)	Inserts value at the end of the list.
at(i)	Returns the item at index position i in the list.
clear()	Removes all items from the list.
contains(value)	Checks the presence of an element in the list.
count(value)	Returns the number of occurrences of value in the list.
indexOf(value[, start])	Searches for an element in the list.
insert(i, value)	Inserts value at index position i in the list.
isEmpty()	Checks whether the list is empty.
iterator()	Creates an iterator for the list.
removeAll(value)	Removes all occurrences of value in the list and returns the number of entries removed.
removeAt(i)	Removes the item at index position i.
reserve(alloc)	Reserve space for alloc elements.
size()	Returns the number of items in the list.
takeAt(i)	Removes the item at index position i and returns it.

append(value: Pro.Core.CFFContainer) → None

Inserts value at the end of the list.

Parameters

value (CFFContainer) – The value to add to the list.

See also insert().

at(i: int) → Pro.Core.CFFContainer

Returns the item at index position i in the list. i must be a valid index position in the list (i.e., 0 <= i < size()).

Parameters

i (int) – The index of the element to return.

Returns

Returns the requested element.

Return type

CFFContainer

clear() → None

Removes all items from the list.

contains(value: Pro.Core.CFFContainer) → bool

Checks the presence of an element in the list.

Parameters

value (CFFContainer) – The value to check for.

Returns

Returns True if the list contains an occurrence of value; otherwise returns False.

Return type

bool

See also indexOf() and count().

count(value: Pro.Core.CFFContainer) → int

Returns the number of occurrences of value in the list.

Parameters

value (CFFContainer) – The value to count.

Returns

Returns the number of occurrences.

Return type

int

See also indexOf() and contains().

indexOf(value: Pro.Core.CFFContainer, start: int = 0) → int

Searches for an element in the list.

Parameters

• value (CFFContainer) – The value to search for.

• start (int) – The start index.

Returns

Returns the index position of the first occurrence of value in the list. Returns -1 if no item was found.

Return type

int

See also contains().

insert(i: int, value: Pro.Core.CFFContainer) → None

Inserts value at index position i in the list. If i is 0, the value is prepended to the list. If i is size(), the value is appended to the list.

Parameters

• i (int) – The position at which to add the value.

• value (CFFContainer) – The value to add.

See also append() and removeAt().

isEmpty() → bool

Checks whether the list is empty.

Returns

Returns True if the list contains no items; otherwise returns False.

Return type

bool

See also size().

iterator() → Pro.Core.CFFContainerListIt

Creates an iterator for the list.

Returns

Returns the iterator.

Return type

CFFContainerListIt

removeAll(value: Pro.Core.CFFContainer) → int

Removes all occurrences of value in the list and returns the number of entries removed.

Parameters

value (CFFContainer) – The value to remove from the list.

Returns

Returns the number of entries removed.

Return type

int

See also removeAt().

removeAt(i: int) → None

Removes the item at index position i. i must be a valid index position in the list (i.e., 0 <= i < size()).

Parameters

i (int) – The index of the item to remove.

See also removeAll().

reserve(alloc: int) → None

Reserve space for alloc elements. Calling this method doesn’t change the size of the list.

Parameters

alloc (int) – The amount of elements to reserve space for.

size() → int

Returns

Returns the number of items in the list.

Return type

int

See also isEmpty().

takeAt(i: int) → Pro.Core.CFFContainer

Removes the item at index position i and returns it. i must be a valid index position in the list (i.e., 0 <= i < size()).

Parameters

i (int) – The index of the element to remove from the list.

Returns

Returns the removed element. If you don’t use the return value, removeAt() is more efficient.

Return type

CFFContainer

See also removeAt().

class CFFContainerListIt(obj: Pro.Core.CFFContainerList)

Iterator class for CFFContainerList.

Parameters

obj (CFFContainerList) – The object to iterate over.

Methods:

hasNext()	Returns True if there is at least one item ahead of the iterator, i.e. the iterator is not at the back of the container; otherwise returns False.
hasPrevious()	Returns True if there is at least one item behind the iterator, i.e. the iterator is not at the front of the container; otherwise returns False.
next()	Returns the next item and advances the iterator by one position.
previous()	Returns the previous item and moves the iterator back by one position.
toBack()	Moves the iterator to the back of the container (after the last item).
toFront()	Moves the iterator to the front of the container (before the first item).

hasNext() → bool

Returns

Returns True if there is at least one item ahead of the iterator, i.e. the iterator is not at the back of the container; otherwise returns False.

Return type

bool

See also hasPrevious() and next().

hasPrevious() → bool

Returns

Returns True if there is at least one item behind the iterator, i.e. the iterator is not at the front of the container; otherwise returns False.

Return type

bool

See also hasNext() and previous().

next() → Pro.Core.CFFContainer

Returns

Returns the next item and advances the iterator by one position.

Return type

CFFContainer

See also hasNext() and previous().

previous() → Pro.Core.CFFContainer

Returns

Returns the previous item and moves the iterator back by one position.

Return type

CFFContainer

See also hasPrevious() and next().

toBack() → None

Moves the iterator to the back of the container (after the last item).

See also toFront() and previous().

toFront() → None

Moves the iterator to the front of the container (before the first item).

See also toBack() and next().

class CFFContext

This class is used internally by CFFStruct to store information from members which affect the position and size of other members.

See also CFFStruct.Context() and CFFStruct.SetContext().

Methods:

set(key, val)	Sets a value of the context.
value(key)	Retrieves a value from the context.

set(key: int, val: int) → None

Sets a value of the context.

Parameters

• key (int) – The key of the value to store.

• val (int) – The value.

See also value().

value(key: int) → int

Retrieves a value from the context.

Parameters

key (int) – The key of the value to retrieve.

Returns

Returns the value of the context if present; otherwise returns 0.

Return type

int

See also set().

class CFFDB

This class creates a volatile tree structure that is either stored in memory or on disk.

Indexes for the tree can either be 32-bit (CFFDBIndexSize32) or 64-bit (CFFDBIndexSize64).

Every item in the tree has fixed-size data. If no data size is specified when creating the tree, the fixed data size will be the same as the index size.

This class does not support the removal of items from the tree.

Methods:

AppendChild([parent])	Appends an item.
Children(index)	Returns the number of children for the specified index.
Data(index)	Retrieves the data of an item.
Data32(index)	Retrieves the data of an item as a 32-bit value.
Data64(index)	Retrieves the data of an item as a 64-bit value.
Index(pos[, parent])	Returns the index of an item given its parent and it’s position relative to its siblings.
InsertChild(pos[, parent])	Inserts an item given its parent and position relative to its siblings.
InsertChildren(pos, count[, parent])	Inserts multiple items given their parent and position relative to their siblings.
IsNull()	Returns True if invalid; otherwise returns False.
IsValid()	Returns True if valid; otherwise returns False.
Next(current)	Gets the next item in the tree.
Open([fixed_data_size, idxsize])	Initializes a CFFDB.
Parent(index)	Returns the parent of an item.
Position(index)	Returns the position of an item relative to its siblings.
PrependChild([parent])	Prepends an item.
Previous(current)	Gets the previous item in the tree.
SetData(index, value)	Sets the data of an item.
SetData32(index, value)	Sets the data of an item as a 32-bit value.
SetData64(index, value)	Sets the data of an item as a 64-bit value.

AppendChild(parent: int = 0) → int

Appends an item.

Parameters

parent (int) – The parent index of the item to append.

Returns

Returns the index of the added child item if successful; otherwise returns CFFDBInvalidIndex.

Return type

int

See also PrependChild() and InsertChild().

Children(index: int) → int

Returns the number of children for the specified index.

Parameters

index (int) – The index of the item for which to retrieve the number of children.

Returns

Returns the number of children.

Return type

int

See also Position(), Parent() and Index().

Data(index: int) → tuple

Retrieves the data of an item.

Parameters

index (int) – The index of the item for which to retrieve the data.

Returns

Returns a tuple containing the retrieved data and a boolean. The boolean value is True if successful; otherwise it is False.

Return type

tuple[bytes, bool]

See also SetData(), Data32() and Data64().

Data32(index: int) → tuple

Retrieves the data of an item as a 32-bit value.

Parameters

index (int) – The index of the item for which to retrieve the data.

Returns

Returns a tuple containing the retrieved data value and a boolean. The boolean value is True if successful; otherwise it is False.

Return type

tuple[int, bool]

See also SetData32(), Data() and Data64().

Data64(index: int) → tuple

Retrieves the data of an item as a 64-bit value.

Parameters

index (int) – The index of the item for which to retrieve the data.

Returns

Returns a tuple containing the retrieved data value and a boolean. The boolean value is True if successful; otherwise it is False.

Return type

tuple[int, bool]

See also SetData64(), Data() and Data32().

Index(pos: int, parent: int = 0) → int

Returns the index of an item given its parent and it’s position relative to its siblings.

Parameters

• pos (int) – The position of the item relative to its siblings.

• parent (int) – The index of the parent item.

Returns

Returns the requested index if successful; otherwise returns CFFDBInvalidIndex.

Return type

int

See also Parent(), Position() and Children().

InsertChild(pos: int, parent: int = 0) → int

Inserts an item given its parent and position relative to its siblings.

Parameters

• pos (int) – The position of the item to insert relative to its siblings.

• parent (int) – The index of the parent item.

Returns

Returns the index of the added child item if successful; otherwise returns CFFDBInvalidIndex.

Return type

int

See also InsertChildren(), AppendChild() and PrependChild().

InsertChildren(pos: int, count: int, parent: int = 0) → bool

Inserts multiple items given their parent and position relative to their siblings.

Parameters

• pos (int) – The position of the items to insert relative to their siblings.

• count (int) – The number of items to insert.

• parent (int) – The index of the parent item.

Returns

Returns True if successful; otherwise returns False.

Return type

bool

See also InsertChild(), AppendChild() and PrependChild().

IsNull() → bool

Returns

Returns True if invalid; otherwise returns False.

Return type

bool

See also IsValid() and Open().

IsValid() → bool

Returns

Returns True if valid; otherwise returns False.

Return type

bool

See also IsNull() and Open().

Next(current: int) → int

Gets the next item in the tree.

This method enumerates parent and child items.

Parameters

current (int) – The current index.

Returns

Returns the index if successful; otherwise returns CFFDBInvalidIndex.

Return type

int

See also Previous().

Open(fixed_data_size: int = 0, idxsize: int = CFFDBIndexSize32) → bool

Initializes a CFFDB.

Parameters

• fixed_data_size (int) – The size of the data associated with each item. If 0, it defaults to the index size.

• idxsize (int) – The index size.

Returns

Returns True if successful; otherwise returns False.

Return type

bool

See also IsValid() and IsNull().

Parent(index: int) → int

Returns the parent of an item.

Parameters

index (int) – The index of the item for which to retrieve the parent.

Returns

Returns the parent index if successful; otherwise returns CFFDBInvalidIndex.

Return type

int

See also Index(), Position() and Children().

Position(index: int) → int

Returns the position of an item relative to its siblings.

Parameters

index (int) – The index of the item for which to retrieve the relative position.

Returns

Returns the position if successful; otherwise returns CFFDBInvalidIndex.

Return type

int

See also Children(), Index() and Parent().

PrependChild(parent: int = 0) → int

Prepends an item.

Parameters

parent (int) – The parent index of the item to prepend.

Returns

Returns the index of the added child item if successful; otherwise returns CFFDBInvalidIndex.

Return type

int

See also AppendChild() and InsertChild().

Previous(current: int) → int

Gets the previous item in the tree.

This method enumerates parent and child items.

Parameters

current (int) – The current index.

Returns

Returns the index if successful; otherwise returns CFFDBInvalidIndex.

Return type

int

See also Next().

SetData(index: int, value: bytes) → bool

Sets the data of an item.

The size of value must match the size of the data specified when initializing the tree (See Open()).

Parameters

• index (int) – The index of the item for which to set the data.

• value (bytes) – The data to set.

Returns

Returns True if successful; otherwise returns False.

Return type

bool

See also Data(), SetData32() and SetData64().

SetData32(index: int, value: int) → bool

Sets the data of an item as a 32-bit value.

Parameters

• index (int) – The index of the item for which to set the data.

• value (int) – The 32-bit value to set.

Returns

Returns True if successful; otherwise returns False.

Return type

bool

See also Data32(), SetData() and SetData64().

SetData64(index: int, value: int) → bool

Sets the data of an item as a 64-bit value.

Parameters

• index (int) – The index of the item for which to set the data.

• value (int) – The 64-bit value to set.

Returns

Returns True if successful; otherwise returns False.

Return type

bool

See also Data64(), SetData() and SetData32().

CFFDBIndexSize32: Final[int]

32-bit index size for CFFDB.

See also CFFDB.

CFFDBIndexSize64: Final[int]

64-bit index size for CFFDB.

See also CFFDB.

CFFDBInvalidIndex: Final[int]

Invalid index for CFFDB.

See also CFFDB.

CFFDBRootIndex: Final[int]

Root index for CFFDB.

See also CFFDB.

class CFFFlags

This class contains flags and options for a member of CFFStruct.

Methods:

Count()	Returns the number of flags and options available.
Description(i)	Retrieves the description of a flag or option.
IsFlag(value, i_or_name)	Checks if a flag or option is set in the input value.
IsNull()	Returns True if the CFFFlags instance is invalid; otherwise returns False.
IsOptionsOnly()	Returns True if the current CFFFlags instance contains only options and not flags; otherwise returns False.
IsValid()	Returns True if the CFFFlags instance is valid; otherwise returns False.
Name(i)	Retrieves the name of a flag or option.
Output(out, value[, opt, sep])	Outputs the flags and options set in the input value to a text stream .
Position(name)	Retrieves the position of a flag or option by its name.
ShortDescription(i)	Retrieves the short description of a flag or option.
Type([i])	Retrieves the type of the CFFFlags instance or the type of one of its members.
Value(i)	Retrieves the value of a flag or option.
ValueDescription(value)	Retrieves the description for the input value.
ValueName(value)	Retrieves the name for the input value.

Count() → int

Returns

Returns the number of flags and options available.

Return type

int

See also Output(), Name() and IsFlag().

Description(i: int) → str

Retrieves the description of a flag or option.

Parameters

i (int) – The index of the flag or option.

Returns

Returns the description if available; otherwise returns an empty string.

Return type

str

See also ShortDescription(), Name() and Value().

IsFlag(value: int, i_or_name: Union[int, str]) → bool

Checks if a flag or option is set in the input value.

Parameters

• value (int) – The input value.

• i_or_name (Union[int, str]) – The index or name of the flag or option.

Returns

Returns True if the flag or option is set in the input value; otherwise returns False.

Return type

bool

See also Output(), Name() and Value().

IsNull() → bool

Returns

Returns True if the CFFFlags instance is invalid; otherwise returns False.

Return type

bool

See also IsValid().

IsOptionsOnly() → bool

Returns

Returns True if the current CFFFlags instance contains only options and not flags; otherwise returns False.

Return type

bool

See also ValueDescription().

IsValid() → bool

Returns

Returns True if the CFFFlags instance is valid; otherwise returns False.

Return type

bool

See also IsNull().

Name(i: int) → str

Retrieves the name of a flag or option.

Parameters

i (int) – The index of the flag or option.

Returns

Returns the name of the flag or option if successful; otherwise returns an empty string.

Return type

str

See also Name() and Output().

Output(out: Pro.Core.NTTextStream, value: int, opt: int = 0, sep: Optional[str] = None) → None

Outputs the flags and options set in the input value to a text stream .

Parameters

• out (NTTextStream) – The text stream.

• value (int) – The input value.

• opt (int) – The output options. NTFlagOutput_IgnoreUnknown can be specified to ignore unknown flags.

• sep (Optional[str]) – The separator for the output. Defaults to " | ".

See also NTTextStream and ShortDescription().

Position(name: str) → int

Retrieves the position of a flag or option by its name.

Parameters

name (str) – The name of the flag or option.

Returns

Returns the index of the flag or option if successful; otherwise returns -1.

Return type

int

See also Name() and Value().

ShortDescription(i: int) → str

Retrieves the short description of a flag or option.

Parameters

i (int) – The index of the flag or option.

Returns

Returns the short description if available; otherwise returns an empty string.

Return type

str

See also Description(), Name() and Value().

Type(i: Optional[int] = None) → int

Retrieves the type of the CFFFlags instance or the type of one of its members.

Parameters

i (Optional[int]) – The index of the flag or option.

Returns

Returns the requested type if successful; otherwise returns 0.

Return type

int

See also Name() and Value().

Value(i: int) → int

Retrieves the value of a flag or option.

Parameters

i (int) – The index of the flag or option.

Returns

Returns the value if successful; otherwise returns 0.

Return type

int

See also Name() and Description().

ValueDescription(value: int) → str

Retrieves the description for the input value.

This method works only if the CFFFlags instance contains only options (See IsOptionsOnly()).

Parameters

value (int) – The input value.

Returns

Returns the value description if successful; otherwise returns an empty string.

Return type

str

See also ValueName(), IsOptionsOnly() and Output().

ValueName(value: int) → str

Retrieves the name for the input value.

This method works only if the CFFFlags instance contains only options (See IsOptionsOnly()).

Parameters

value (int) – The input value.

Returns

Returns the value description if successful; otherwise returns an empty string.

Return type

str

Available since Cerbero Suite 7.3 and Cerbero Engine 4.3.

See also ValueDescription(), IsOptionsOnly() and Output().

class CFFGetKeyResult

This class is the return value of CFFObject.GetKey().

Available since Cerbero Suite 6.3 and Cerbero Engine 3.3.

See also CFFObject.GetKey().

Attributes:

data	The key data.
key_type	The key type (e.g., CFFKT_Pass).

data

The key data.

key_type

The key type (e.g., CFFKT_Pass).

class CFFGetKeyResultList

List of CFFGetKeyResult elements.

Methods:

append(value)	Inserts value at the end of the list.
at(i)	Returns the item at index position i in the list.
clear()	Removes all items from the list.
contains(value)	Checks the presence of an element in the list.
count(value)	Returns the number of occurrences of value in the list.
indexOf(value[, start])	Searches for an element in the list.
insert(i, value)	Inserts value at index position i in the list.
isEmpty()	Checks whether the list is empty.
iterator()	Creates an iterator for the list.
removeAll(value)	Removes all occurrences of value in the list and returns the number of entries removed.
removeAt(i)	Removes the item at index position i.
reserve(alloc)	Reserve space for alloc elements.
size()	Returns the number of items in the list.
takeAt(i)	Removes the item at index position i and returns it.

append(value: Pro.Core.CFFGetKeyResult) → None

Inserts value at the end of the list.

Parameters

value (CFFGetKeyResult) – The value to add to the list.

See also insert().

at(i: int) → Pro.Core.CFFGetKeyResult

Returns the item at index position i in the list. i must be a valid index position in the list (i.e., 0 <= i < size()).

Parameters

i (int) – The index of the element to return.

Returns

Returns the requested element.

Return type

CFFGetKeyResult

clear() → None

Removes all items from the list.

contains(value: Pro.Core.CFFGetKeyResult) → bool

Checks the presence of an element in the list.

Parameters

value (CFFGetKeyResult) – The value to check for.

Returns

Returns True if the list contains an occurrence of value; otherwise returns False.

Return type

bool

See also indexOf() and count().

count(value: Pro.Core.CFFGetKeyResult) → int

Returns the number of occurrences of value in the list.

Parameters

value (CFFGetKeyResult) – The value to count.

Returns

Returns the number of occurrences.

Return type

int

See also indexOf() and contains().

indexOf(value: Pro.Core.CFFGetKeyResult, start: int = 0) → int

Searches for an element in the list.

Parameters

• value (CFFGetKeyResult) – The value to search for.

• start (int) – The start index.

Returns

Returns the index position of the first occurrence of value in the list. Returns -1 if no item was found.

Return type

int

See also contains().

insert(i: int, value: Pro.Core.CFFGetKeyResult) → None

Inserts value at index position i in the list. If i is 0, the value is prepended to the list. If i is size(), the value is appended to the list.

Parameters

• i (int) – The position at which to add the value.

• value (CFFGetKeyResult) – The value to add.

See also append() and removeAt().

isEmpty() → bool

Checks whether the list is empty.

Returns

Returns True if the list contains no items; otherwise returns False.

Return type

bool

See also size().

iterator() → Pro.Core.CFFGetKeyResultListIt

Creates an iterator for the list.

Returns

Returns the iterator.

Return type

CFFGetKeyResultListIt

removeAll(value: Pro.Core.CFFGetKeyResult) → int

Removes all occurrences of value in the list and returns the number of entries removed.

Parameters

value (CFFGetKeyResult) – The value to remove from the list.

Returns

Returns the number of entries removed.

Return type

int

See also removeAt().

removeAt(i: int) → None

Removes the item at index position i. i must be a valid index position in the list (i.e., 0 <= i < size()).

Parameters

i (int) – The index of the item to remove.

See also removeAll().

reserve(alloc: int) → None

Reserve space for alloc elements. Calling this method doesn’t change the size of the list.

Parameters

alloc (int) – The amount of elements to reserve space for.

size() → int

Returns

Returns the number of items in the list.

Return type

int

See also isEmpty().

takeAt(i: int) → Pro.Core.CFFGetKeyResult

Removes the item at index position i and returns it. i must be a valid index position in the list (i.e., 0 <= i < size()).

Parameters

i (int) – The index of the element to remove from the list.

Returns

Returns the removed element. If you don’t use the return value, removeAt() is more efficient.

Return type

CFFGetKeyResult

See also removeAt().

class CFFGetKeyResultListIt(obj: Pro.Core.CFFGetKeyResultList)

Iterator class for CFFGetKeyResultList.

Parameters

obj (CFFGetKeyResultList) – The object to iterate over.

Methods:

hasNext()	Returns True if there is at least one item ahead of the iterator, i.e. the iterator is not at the back of the container; otherwise returns False.
hasPrevious()	Returns True if there is at least one item behind the iterator, i.e. the iterator is not at the front of the container; otherwise returns False.
next()	Returns the next item and advances the iterator by one position.
previous()	Returns the previous item and moves the iterator back by one position.
toBack()	Moves the iterator to the back of the container (after the last item).
toFront()	Moves the iterator to the front of the container (before the first item).

hasNext() → bool

Returns

Returns True if there is at least one item ahead of the iterator, i.e. the iterator is not at the back of the container; otherwise returns False.

Return type

bool

See also hasPrevious() and next().

hasPrevious() → bool

Returns

Returns True if there is at least one item behind the iterator, i.e. the iterator is not at the front of the container; otherwise returns False.

Return type

bool

See also hasNext() and previous().

next() → Pro.Core.CFFGetKeyResult

Returns

Returns the next item and advances the iterator by one position.

Return type

CFFGetKeyResult

See also hasNext() and previous().

previous() → Pro.Core.CFFGetKeyResult

Returns

Returns the previous item and moves the iterator back by one position.

Return type

CFFGetKeyResult

See also hasPrevious() and next().

toBack() → None

Moves the iterator to the back of the container (after the last item).

See also toFront() and previous().

toFront() → None

Moves the iterator to the front of the container (before the first item).

See also toBack() and next().

class CFFHeader

This class represents a header.

Headers contain definition of structures and can be loaded from SQLite files or XML strings. The structures can be imported from C/C++ code through the Header Manager or from debug symbols such as PDB files.

Important

Editing is supported only for SQLite-backed headers.

Example:

from Pro.Core import *

xml_header = """<header>

<r id='_IMAGE_DOS_HEADER' type='struct'>
  <f id='e_magic' type='unsigned short'/>
  <f id='e_cblp' type='unsigned short'/>
  <f id='e_cp' type='unsigned short'/>
  <f id='e_crlc' type='unsigned short'/>
  <f id='e_cparhdr' type='unsigned short'/>
  <f id='e_minalloc' type='unsigned short'/>
  <f id='e_maxalloc' type='unsigned short'/>
  <f id='e_ss' type='unsigned short'/>
  <f id='e_sp' type='unsigned short'/>
  <f id='e_csum' type='unsigned short'/>
  <f id='e_ip' type='unsigned short'/>
  <f id='e_cs' type='unsigned short'/>
  <f id='e_lfarlc' type='unsigned short'/>
  <f id='e_ovno' type='unsigned short'/>
  <f id='e_res' type='unsigned short [4]'/>
  <f id='e_oemid' type='unsigned short'/>
  <f id='e_oeminfo' type='unsigned short'/>
  <f id='e_res2' type='unsigned short [10]'/>
  <f id='e_lfanew' type='int'/>
</r>

</header>"""

def printStructure(fname):
    c = createContainerFromFile(fname)
    if c.isNull():
        return
    # load header from an XML string
    header = CFFHeader()
    if not header.LoadFromXml(xml_header):
        return
    obj = CFFObject()
    # since CFFObject is not subclassed, the Load method cannot fail
    obj.Load(c)
    # map a structure to a specific offset
    offset = 0
    s = obj.MakeStruct(header, "_IMAGE_DOS_HEADER", offset, CFFSO_VC | CFFSO_Pack1)
    out = NTTextBuffer()
    s.Dump(out)
    print(out.buffer)

See also CFFStruct and CFFObject.

Attributes:

AC_Define	Alias category for a definition.
AC_Enum	Alias category for an enumerator.
AC_Last	Alias category terminator.
AVT_Integer	Alias integer value type.
AVT_Last	Alias terminator value type.
AVT_Real	Alias floating point value type.
AVT_String	Alias string value type.

Methods:

BeginEdit()	Begins an SQLite transaction.
Close()	Clears the current instance.
EndEdit()	Ends an SQLite transaction.
Equals(s)	Checks whether two headers reference the same internal data.
GetACName(category)	Retrieves the alias category name.
GetAVTName(vtype)	Retrieves the alias value type name.
GetAliasCount()	Returns the number of alias in the header.
GetAliasData(i)	Retrieves the data for an alias.
GetSQLiteDB()	Returns the SQLite handle if the header is backed by SQLite internally; otherwise returns None.
GetStructBaseData(i)	Retrieves the basic data of a structure.
GetStructCount()	Returns the number of structures in the header.
GetStructData(i_or_name)	Retrieves the data of a structure.
GetTypeDefCount()	Returns the number of type definitions in the header.
GetTypeDefData(i)	Retrieves the data of a type definition.
InsertAlias(name, category, type, vtype, value)	Inserts or replaces an alias in the header file.
InsertStruct(schema)	Inserts or replaces a structure in the header file.
InsertTypeDef(name, type)	Inserts or replaces a type definition in the header file.
IsModified()	Returns True if the header was modified; otherwise returns False.
IsNull()	Returns True if the header is invalid; otherwise returns False.
IsValid()	Returns True if the header is valid; otherwise returns False.
LoadFromFile(name)	Loads a header file from an SQLite database.
LoadFromXml(xml)	Initializes a header instance from XML data.
SetModified(b)	Sets the modified status for the header file.

AC_Define: Final[int]

Alias category for a definition.

AC_Enum: Final[int]

Alias category for an enumerator.

AC_Last: Final[int]

Alias category terminator.

AVT_Integer: Final[int]

Alias integer value type.

AVT_Last: Final[int]

Alias terminator value type.

AVT_Real: Final[int]

Alias floating point value type.

AVT_String: Final[int]

Alias string value type.

BeginEdit() → None

Begins an SQLite transaction.

See also EndEdit() and InsertStruct().

Close() → None

Clears the current instance.

See also LoadFromFile() and LoadFromXml().

EndEdit() → None

Ends an SQLite transaction.

See also BeginEdit() and InsertStruct().

Equals(s: Pro.Core.CFFHeader) → bool

Checks whether two headers reference the same internal data.

Parameters

s (CFFHeader) – The other header.

Returns

Returns True if the two headers reference the same internal data; otherwise returns False.

Return type

bool

static GetACName(category: int) → str

Retrieves the alias category name.

Parameters

category (int) – The alias category.

Returns

Returns the name of the alias category if successful; otherwise returns an empty string.

Return type

str

See also GetAVTName().

static GetAVTName(vtype: int) → str

Retrieves the alias value type name.

Parameters

vtype (int) – The alias value type.

Returns

Returns the name of the alias value type if successful; otherwise returns an empty string.

Return type

str

See also GetACName().

GetAliasCount() → int

Returns

Returns the number of alias in the header.

Return type

int

See also GetAliasData() and InsertAlias().

GetAliasData(i: int) → Pro.Core.CFFHeaderAliasData

Retrieves the data for an alias.

Parameters

i (int) – The index of the alias.

Returns

Returns the data of the alias if successful; otherwise returns an empty data structure.

Return type

CFFHeaderAliasData

See also GetAliasCount() and InsertAlias().

GetSQLiteDB() → sqlite3

Returns

Returns the SQLite handle if the header is backed by SQLite internally; otherwise returns None.

Return type

sqlite3

GetStructBaseData(i: int) → Pro.Core.CFFHeaderStructData

Retrieves the basic data of a structure.

The difference with GetStructData() is that the XML schema of the structure is not retrieved. Therefore, this method is a bit faster.

Parameters

i (int) – The index of the structure.

Returns

Returns the data of the structure if successful; otherwise returns an empty data structure.

Return type

CFFHeaderStructData

See also GetStructData(), GetStructCount() and InsertStruct().

GetStructCount() → int

Returns

Returns the number of structures in the header.

Return type

int

See also GetStructData() and InsertStruct().

GetStructData(i_or_name: Union[int, str]) → Pro.Core.CFFHeaderStructData

Retrieves the data of a structure.

Parameters

i_or_name (Union[int, str]) – The name or the index of the structure.

Returns

Returns the data of the structure if successful; otherwise returns an empty data structure.

Return type

CFFHeaderStructData

See also GetStructBaseData(), GetStructCount() and InsertStruct().

GetTypeDefCount() → int

Returns

Returns the number of type definitions in the header.

Return type

int

See also GetTypeDefData() and InsertTypeDef().

GetTypeDefData(i: int) → Pro.Core.CFFHeaderTypeDefData

Retrieves the data of a type definition.

Parameters

i (int) – The index of the type definition.

Returns

Returns the data of the type definition if successful; otherwise returns an empty data structure.

Return type

CFFHeaderTypeDefData

See also GetTypeDefCount() and InsertTypeDef().

InsertAlias(name: str, category: int, type: str, vtype: int, value: str) → None

Inserts or replaces an alias in the header file.

This method is supported only by SQLite-backed header files.

Parameters

• name (str) – The name of the alias.

• category (int) – The category of the alias.

• type (str) – The type of the alias.

• vtype (int) – The value type of the alias.

• value (str) – The value of the alias.

See also GetAliasData() and GetAliasCount().

InsertStruct(schema: str) → None

Inserts or replaces a structure in the header file.

This method is supported only by SQLite-backed header files.

Parameters

schema (str) – The XML schema of the structure.

See also GetStructData() and GetStructCount().

InsertTypeDef(name: str, type: str) → None

Inserts or replaces a type definition in the header file.

This method is supported only by SQLite-backed header files.

Parameters

• name (str) – The name of the type definition.

• type (str) – The type definition.

See also GetTypeDefData() and GetTypeDefCount().

IsModified() → bool

Returns

Returns True if the header was modified; otherwise returns False.

Return type

bool

See also SetModified().

IsNull() → bool

Returns

Returns True if the header is invalid; otherwise returns False.

Return type

bool

See also IsValid().

IsValid() → bool

Returns

Returns True if the header is valid; otherwise returns False.

Return type

bool

See also IsNull().

LoadFromFile(name: str) → bool

Loads a header file from an SQLite database.

Parameters

name (str) – The name of the header file.

Returns

Returns True if successful; otherwise returns False.

Return type

bool

See also LoadFromXml().

LoadFromXml(xml: Union[Pro.Core.NTXml, str]) → bool

Initializes a header instance from XML data.

Parameters

xml (Union[NTXml, str]) – Either an XML string or an NTXml instance.

Returns

Returns True if successful; otherwise returns False.

Return type

bool

See also LoadFromFile().

SetModified(b: bool) → None

Sets the modified status for the header file.

Parameters

b (bool) – If True, the header file is marked as modified.

See also IsModified().

class CFFHeaderAliasData

Alias data of a header file.

See also CFFHeader.

Attributes:

category	The category of the alias.
name	The name of the alias.
type	The type of the alias.
value	The value of the alias.
vtype	The value type of the alias.

category

The category of the alias.

name

The name of the alias.

type

The type of the alias.

value

The value of the alias.

vtype

The value type of the alias.

class CFFHeaderStructData

Structure data of a header file.

See also CFFHeader.

Attributes:

name	The name of the structure.
schema	The XML schema of the structure.
type	The type of the structure.

name

The name of the structure.

schema

The XML schema of the structure.

type

The type of the structure.

class CFFHeaderTypeDefData

Type definition data of a header file.

See also CFFHeader.

Attributes:

name	The name of the type definition.
type	The type definition.

name

The name of the type definition.

type

The type definition.

class CFFInitParams(wo: Optional[Pro.Core.NTIWait] = None, options: int = 0)

This class contains the initialization parameters for the CFFObject.Initialize() method.

Parameters

• wo (NTIWait) – The wait object.

• options (int) – The parsing options.

Attributes:

DontDecrypt	This flag instructs the parser not to decrypt the file.
StrictParser	This flag instructs the parser to avoid parsing malformed data.
has_wo	A boolean that signals the presence of a wait object that isn’t the default dummy one.
max_children	The maximum number of allowed child entries.
options	Options for the parser (e.g., StrictParser).
wo	The wait object for operation.

DontDecrypt: Final[int]

This flag instructs the parser not to decrypt the file.

Note

The parser might choose to ignore this flag.

See also options.

StrictParser: Final[int]

This flag instructs the parser to avoid parsing malformed data.

Note

The parser might choose to ignore this flag.

See also options.

has_wo

A boolean that signals the presence of a wait object that isn’t the default dummy one.

See also wo.

max_children

The maximum number of allowed child entries.

options

Options for the parser (e.g., StrictParser).

wo

The wait object for operation.

Hint

If a wait object is not specified, a dummy one is provided, so that this field is always valid. To check for the presence of a real wait object use has_wo.

CFFKST_Raw: Final[int]

Key sub-type raw.

Available since Cerbero Suite 6.3 and Cerbero Engine 3.3.

CFFKST_String: Final[int]

Key sub-type string.

Available since Cerbero Suite 6.3 and Cerbero Engine 3.3.

CFFKST_UTF8: Final[int]

Key sub-type utf-8.

Available since Cerbero Suite 6.3 and Cerbero Engine 3.3.

CFFKT_Cert: Final[int]

Key type certificate.

Available since Cerbero Suite 6.3 and Cerbero Engine 3.3.

See also CFFGetKeyResult.

CFFKT_Invalid: Final[int]

Key type invalid.

Available since Cerbero Suite 6.3 and Cerbero Engine 3.3.

See also CFFGetKeyResult.

CFFKT_Pass: Final[int]

Key type password.

Available since Cerbero Suite 6.3 and Cerbero Engine 3.3.

See also CFFGetKeyResult.

class CFFKeyIndex

This class represents a key index.

Available since Cerbero Suite 6.3 and Cerbero Engine 3.3.

See also CFFObject.GetKey() and CFFObject.KeyMatch().

CFFN_Base: Final[int]

Base value for standard CFFObject notifications.

See also CFFObject.Notify().

CFFN_Malformed: Final[int]

CFFObject notification for malformed data.

See also CFFObject.Notify().

CFFN_MoreFiles: Final[int]

CFFObject notification for the file limit.

See also CFFObject.Notify().

CFFN_NoDecrypt: Final[int]

CFFObject notification for failed decryption.

See also CFFObject.Notify().

CFFN_NoUnpack: Final[int]

CFFObject notification for failed decompression.

See also CFFObject.Notify().

CFFN_ParsingLimit: Final[int]

CFFObject notification for an internal parsing limit.

See also CFFObject.Notify().

CFFN_Recursive: Final[int]

CFFObject notification for recursion.

See also CFFObject.Notify().

CFFN_UnpackLimit: Final[int]

CFFObject notification for the decompression limit.

See also CFFObject.Notify().

CFFN_UnpackNestLimit: Final[int]

CFFObject notification for the decompression nesting limit.

See also CFFObject.Notify().

class CFFObject

Bases: Pro.Core.CFSInterface

The class from which every format class is derived (ZipObject, PEObject, etc.).

The internal data of a CFFObject is an NTContainer (See Load()).

See also NTContainer, CFFStruct, CFFHeader and CFFBuffer.

Methods:

AdjustSign(type, num)	Makes the input number negative if the last bit is set and the input type is an integer.
Align(AlignConst)	Aligns the object to the specified size.
AppendTo(nStartOffset, nLenght, pDst)	Appends part of this object to a container.
Compare(offset, bytes_or_uSize[, b])	Compares the specified data to the one in the object.
CopyFrom(Src, nDstOffset, nLenght[, …])	Copies data from a container to the object.
CopyTo(nStartOffset, nLenght, pDst[, …])	Copies a part of the object to a container.
CustomKeyMatch(kr)	Marks a custom key as successfully having being used for decryption.
DisableRanges()	Disables ranges.
EnableRanges(bits_per_element, granularity)	Creates a range bit mask for the current object.
Fill(offset, c, uSize)	Fills a portion of the object with the specified byte.
GetDefaultEndianness()	Returns the default endianness of the object (ENDIANNESS_LITTLE or ENDIANNESS_BIG).
GetDefaultStructOptions()	Returns the default options for CFFStruct instances created from this object (e.g., CFFSO_Pack1).
GetKey(ki, accepted_keys[, converter])	Retrieves a decryption key.
GetKeyMatches()	Returns the list of matched decryption keys.
GetMappingAddress()	Returns the address at which this object is mapped if available; otherwise returns INVALID_STREAM_OFFSET.
GetMemoryUnpackLimit()	Returns the maximum amount of bytes which can be allocated for in-memory decompression algorithms.
GetObjectFormatName()	Returns the file format name of the object if available; otherwise returns an empty string.
GetObjectGenericFormatName()	Returns the generic format name of the object if available; otherwise returns an empty string (e.g., the generic format name of HTML is XML).
GetObjectName()	Returns the name of the object if available; otherwise returns an empty string.
GetObjectTypeName()	Returns the type name of the object if available; otherwise returns an empty string.
GetSize()	Returns the size of the internally referenced container.
GetSpecialData(key[, defval])	Retrieves special data associated to the object.
GetStream()	Returns the internally referenced container.
GetSubStream(offset_or_range[, …])	Retrieves a sub-stream of the internally referenced container.
GetTag()	Returns the tag name set for debugging purposes if present; otherwise returns an empty string.
GetTypeName(Type)	Returns the name of the specified type.
GetTypeNature(Type)	Returns the nature of the specified type.
GetUnpackLimit()	Returns the limit for decompression operations.
GetUnpackNestingLimit()	Returns the nesting limit for decompression operations.
HasFSSupport()	Returns True if file system support is available; otherwise returns False.
Initialize([p])	Provides a generic way to initialize an object.
IsMapped()	Returns True if the object has a mapping address; otherwise returns False.
IsModified()	Returns True if the object was modified; otherwise returns False.
IsNull()	Returns True if the object is uninitialized; otherwise returns False.
IsTypeDynamicPersistent(Type)	Checks whether a type is persistently dynamic.
KeyMatch(ki[, converter])	Marks a key as successfully having being used for decryption.
Load(Stream)	Loads the object data.
LocationDescription(offset)	Provides a description for a specified location.
MakeStruct(header, name, offset[, options])	Returns a CFFStruct instance.
MakeStructArray(header, name, offset, nentries)	Returns an array of CFFStruct.
Modified(b)	Sets the modified status for the object.
NewContainer(size[, reserve_size, max_size])	Creates a new NTContainer object.
Notify(code)	Internally notifies the associated ScanProvider (if any) of a problem.
RangesEnabled()	Returns True if ranges are enabled for the current object; otherwise returns False.
Read(offset, uSize)	Reads data from the object.
ReadNumber(offset, type, endianness, is_signed)	Reads an integer from the object.
ReadUInt16(offset[, endianness])	Reads an unsigned 16-bit integer from the object.
ReadUInt16String(offset, maxlen, endianness)	Reads an utf-16 array from the object.
ReadUInt32(offset[, endianness])	Reads an unsigned 32-bit integer from the object.
ReadUInt32String(offset, maxlen, endianness)	Reads an utf-32 array from the object.
ReadUInt64(offset[, endianness])	Reads an unsigned 64-bit integer from the object.
ReadUInt8(offset)	Reads an unsigned 8-bit integer from the object.
ReadUInt8String(offset, maxlen)	Reads an utf-8 array from the object.
ReplaceStream(NewStream)	Replaces the internal data of the object.
SetDefaultEndianness(nEndiannessType)	Sets the default endianness for the object.
SetDefaultStructOptions(options)	Sets the default options for CFFStruct instances created from this object (e.g., CFFSO_Pack1).
SetFSSupport(b)	Sets the status of file system support.
SetMappingAddress(mapping)	Sets the address at which the object is mapped.
SetMemoryUnpackLimit(limit)	Sets the maximum amount of bytes which can be allocated for in-memory decompression algorithms.
SetObjectFormatName(format)	Sets the file format name of the object.
SetObjectGenericFormatName(format)	Sets the generic format name of the object (e.g., the generic format name of HTML is XML).
SetObjectName(name)	Sets the name of the object.
SetObjectTypeName(type_name)	Sets the type name of the object.
SetRange(offset, size, val)	Sets a range value for the current object.
SetRangeValue(offset, size, val)	Sets a range value for the current object.
SetSize(NewSize)	Resizes the internal data of the object.
SetSpecialData(key, value)	Sets special data associated to the object.
SetTag(t)	Sets the tag name of the object for debugging purposes
SetUnpackLimit(limit)	Sets the limit for decompression operations.
SetUnpackNestingLimit(limit)	Sets the nesting limit for decompression operations.
Shift(uSize)	Appends uSize bytes at the end of the object data and sets them to zero.
ToBuffer(offset[, method])	Returns a CFFBuffer that reads from the object.
ToUInt16(n)	Applies the default endianness of the object to the 16-bit input integer.
ToUInt32(n)	Applies the default endianness of the object to the 32-bit input integer.
ToUInt64(n)	Applies the default endianness of the object to the 64-bit input integer.
ValidRange(offset, Size)	Checks the validity of a range in the context of the object.
Write(offset, bytes_or_uSize[, bytes])	Writes data to the object.
WriteUInt16(offset, n_or_nEndiannessType[, n])	Writes an unsigned 16-bit integer to the object.
WriteUInt32(offset, n_or_nEndiannessType[, n])	Writes an unsigned 32-bit integer to the object.
WriteUInt64(offset, n_or_nEndiannessType[, n])	Writes an unsigned 64-bit integer to the object.
WriteUInt8(offset, n)	Writes an unsigned 8-bit integer to the object.

AdjustSign(type: int, num: int) → int

Makes the input number negative if the last bit is set and the input type is an integer.

Parameters

• type (int) – The input type.

• num (int) – The input number.

Returns

Returns the adjusted number.

Return type

int

Align(AlignConst: int) → bool

Aligns the object to the specified size.

Parameters

AlignConst (int) – The alignment.

Returns

Returns True if successful; otherwise returns False.

Return type

bool

See also NTContainer.align() and Shift().

AppendTo(nStartOffset: int, nLenght: int, pDst: Pro.Core.NTContainer) → bool

Appends part of this object to a container.

Parameters

• nStartOffset (int) – The offset of the range to append.

• nLenght (int) – The size of the range to append.

• pDst (NTContainer) – The destination container.

Returns

Returns True if successful; otherwise returns False.

Return type

bool

See also NTContainer.appendTo().

Compare(offset: int, bytes_or_uSize: Union[bytes, int], b: Optional[int] = None) → bool

Compares the specified data to the one in the object.

Parameters

• offset (int) – The start offset for the comparison.

• bytes_or_uSize (Union[bytes, int]) – Either the data to compare or the size to compare.

• b (Optional[int]) – If the previous parameter is the size to compare, this parameter is the byte which to compare the data to.

Returns

Returns True if the data matches; otherwise returns False.

Return type

bool

See also NTContainer.compare().

CopyFrom(Src: Pro.Core.NTContainer, nDstOffset: int, nLenght: int, nSrcStartOffset: int = 0) → bool

Copies data from a container to the object.

Parameters

• Src (NTContainer) – The container from which to copy the data.

• nDstOffset (int) – The offset at which to copy the data.

• nLenght (int) – The size of the data to copy.

• nSrcStartOffset (int) – The offset from which to copy the data in the container.

Returns

Returns True if successful; otherwise returns False.

Return type

bool

See also NTContainer.copyTo().

CopyTo(nStartOffset: int, nLenght: int, pDst: Pro.Core.NTContainer, nDstStartOffset: int = 0) → bool

Copies a part of the object to a container.

Parameters

• nStartOffset (int) – The offset of the data to copy.

• nLenght (int) – The size of the data to copy.

• pDst (NTContainer) – The destination container.

• nDstStartOffset (int) – The offset at which to write the data to in the destination container.

Returns

Returns True if successful; otherwise returns False.

Return type

bool

See also NTContainer.copyTo().

CustomKeyMatch(kr: Pro.Core.CFFGetKeyResult) → None

Marks a custom key as successfully having being used for decryption.

Note

This method should be used for keys not returned by GetKey().

Parameters

kr (CFFGetKeyResult) – The custom key.

Available since Cerbero Suite 7.8 and Cerbero Engine 4.8.

See also KeyMatch() and GetKeyMatches().

DisableRanges() → None

Disables ranges.

Available since Cerbero Suite 6.2 and Cerbero Engine 3.2.

See also EnableRanges(), RangesEnabled() and SetRange().

EnableRanges(bits_per_element: int, granularity: int, initval: int = 0) → None

Creates a range bit mask for the current object.

Parameters

• bits_per_element (int) – The mask bits for each element.

• granularity (int) – The granularity of each element.

• initval (int) – The initial value of each element.

Note

The granularity is might be changed for larger files to meet memory constraints.

Available since Cerbero Suite 6.2 and Cerbero Engine 3.2.

See also DisableRanges(), RangesEnabled() and SetRange().

Fill(offset: int, c: int, uSize: int) → bool

Fills a portion of the object with the specified byte.

Parameters

• offset (int) – The offset of the range to fill.

• c (int) – The 8-bit value used for the fill operation.

• uSize (int) – The size of the range to fill.

Returns

Returns True if successful; otherwise returns False.

Return type

bool

See also NTContainer.fill().

GetDefaultEndianness() → int

Returns

Returns the default endianness of the object (ENDIANNESS_LITTLE or ENDIANNESS_BIG).

Return type

int

See also SetDefaultEndianness().

GetDefaultStructOptions() → int

Returns

Returns the default options for CFFStruct instances created from this object (e.g., CFFSO_Pack1).

Return type

int

See also SetDefaultStructOptions().

GetKey(ki: Pro.Core.CFFKeyIndex, accepted_keys: int, converter: str = 'utf-8') → Pro.Core.CFFGetKeyResult

Retrieves a decryption key.

Example:

ki = CFFKeyIndex()
while True:
    kres = self.GetKey(ki, CFFKT_Pass, "utf-8")
    if kres.key_type == CFFKT_Invalid:
        # if there are no more keys, exit the loop
        break
    if self.Decrypt(kres.data): # our decryption method
        # if the decryption was successful, mark the key and exit the loop
        self.KeyMatch(ki, "utf-8")
        break

Parameters

• ki (CFFKeyIndex) – The key index.

• accepted_keys (int) – The mask of accepted key types (e.g., CFFKT_Pass).

• converter (str) – The converter to use for passwords (e.g., "utf-8", "ascii", "utf-16-le").

Returns

Returns a key result if successful; otherwise CFFGetKeyResult.key_type is CFFKT_Invalid.

Return type

CFFGetKeyResult

Available since Cerbero Suite 6.3 and Cerbero Engine 3.3.

See also KeyMatch(), GetKeyMatches() and CFFGetKeyResult.

GetKeyMatches() → Pro.Core.CFFGetKeyResultList

Returns

Returns the list of matched decryption keys.

Return type

CFFGetKeyResultList

Available since Cerbero Suite 7.8 and Cerbero Engine 4.8.

See also KeyMatch() and CustomKeyMatch().

GetMappingAddress() → int

Returns

Returns the address at which this object is mapped if available; otherwise returns INVALID_STREAM_OFFSET.

Return type

int

See also IsMapped() and SetMappingAddress().

GetMemoryUnpackLimit() → int

Returns

Returns the maximum amount of bytes which can be allocated for in-memory decompression algorithms.

Return type

int

See also SetMemoryUnpackLimit().

GetObjectFormatName() → str

Returns

Returns the file format name of the object if available; otherwise returns an empty string.

Return type

str

See also SetObjectFormatName().

GetObjectGenericFormatName() → str

Returns

Returns the generic format name of the object if available; otherwise returns an empty string (e.g., the generic format name of HTML is XML).

Return type

str

See also SetObjectGenericFormatName().

GetObjectName() → str

Returns

Returns the name of the object if available; otherwise returns an empty string.

Return type

str

See also SetObjectName().

GetObjectTypeName() → str

Returns

Returns the type name of the object if available; otherwise returns an empty string.

Return type

str

See also SetObjectTypeName().

GetSize() → int

Returns

Returns the size of the internally referenced container.

Return type

int

See also NTContainer.resize() and SetSize().

GetSpecialData(key: str, defval: Pro.Core.NTContainer = NTContainer()) → Pro.Core.NTContainer

Retrieves special data associated to the object.

Parameters

• key (str) – The key of the data to retrieve.

• defval (NTContainer) – The value to return if key is not present.

Returns

Returns the requested data if present; otherwise returns the default return value.

Return type

NTContainer

See also SetSpecialData().

GetStream() → Pro.Core.NTContainer

Returns

Returns the internally referenced container.

Return type

NTContainer

See also GetSubStream(), Load() and ReplaceStream().

GetSubStream(offset_or_range: Union[Pro.Core.NTOffsetRange, int], optimize_for_speed_or_size: Union[bool, int] = INVALID_STREAM_OFFSET, optimize_for_speed: bool = True) → Pro.Core.NTContainer

Retrieves a sub-stream of the internally referenced container.

Hint

This is a convenience method. Internally this method calls GetStream() followed by NTContainer.setRange().

Parameters

• offset_or_range (Union[NTOffsetRange, int]) – Either the offset or the range.

• optimize_for_speed_or_size (Union[bool, int]) – Either the size or the optimize_for_speed_or_size parameter.

• optimize_for_speed (bool) – If True, might cause a deep copy under certain circumstances.

Returns

Returns the specified sub-stream.

Return type

NTContainer

Available since Cerbero Suite 7.2 and Cerbero Engine 4.2.

See also GetStream() and NTContainer.setRange().

GetTag() → str

Returns

Returns the tag name set for debugging purposes if present; otherwise returns an empty string.

Return type

str

See also SetTag().

GetTypeName(Type: int) → str

Returns the name of the specified type.

Parameters

Type (int) – The type for which to return the name.

Returns

Returns the type name if implemented; otherwise returns an empty string.

Return type

str

See also GetTypeNature().

GetTypeNature(Type: int) → int

Returns the nature of the specified type.

Parameters

Type (int) – The type for which to return the nature.

Returns

Returns the nature of the type if successful; otherwise returns NATURE_UNKNOWN.

Return type

int

See also NATURE_BYTEARRAY, NATURE_NUMBER, NATURE_REAL and NATURE_STRING.

See also GetTypeName().

GetUnpackLimit() → int

Returns

Returns the limit for decompression operations.

Return type

int

See also SetUnpackLimit().

GetUnpackNestingLimit() → int

Returns

Returns the nesting limit for decompression operations.

Return type

int

See also SetUnpackNestingLimit().

HasFSSupport() → bool

Returns

Returns True if file system support is available; otherwise returns False.

Return type

bool

Available since Cerbero Suite 7.0 and Cerbero Engine 4.0.

See also SetFSSupport().

Initialize(p: Pro.Core.CFFInitParams = CFFInitParams()) → bool

Provides a generic way to initialize an object.

Note

This method should be overridden by derived classes.

Parameters

p (CFFInitParams) – The initialization parameters.

Returns

Returns True if successful; otherwise returns False.

Return type

bool

Available since Cerbero Suite 7.2 and Cerbero Engine 4.2.

See also CFFInitParams and Load().

IsMapped() → bool

Returns

Returns True if the object has a mapping address; otherwise returns False.

Return type

bool

See also GetMappingAddress() and SetMappingAddress().

IsModified() → bool

Returns

Returns True if the object was modified; otherwise returns False.

Return type

bool

See also Modified().

IsNull() → bool

Returns

Returns True if the object is uninitialized; otherwise returns False.

Return type

bool

See also Load().

IsTypeDynamicPersistent(Type: int) → bool

Checks whether a type is persistently dynamic.

This means that the size of the type is dependent on the underlying data.

Parameters

Type (int) – The type to check.

Returns

Returns True if the type is persistently dynamic; otherwise returns False.

Return type

bool

KeyMatch(ki: Pro.Core.CFFKeyIndex, converter: str = 'utf-8') → None

Marks a key as successfully having being used for decryption.

Parameters

• ki (CFFKeyIndex) – The key index.

• converter (str) – The converter to use for passwords (e.g., "utf-8", "ascii", "utf-16-le").

Available since Cerbero Suite 6.3 and Cerbero Engine 3.3.

See also GetKey(), CFFGetKeyResult and CustomKeyMatch().

Load(Stream: Pro.Core.NTContainer) → bool

Loads the object data.

Note

In derived built-in classes this method also checks the signature file format.

Parameters

Stream (NTContainer) – The data to load.

Returns

Returns True if the data is accepted; otherwise returns False.

Return type

bool

See also Initialize(), GetStream() and ReplaceStream().

LocationDescription(offset: int) → str

Provides a description for a specified location.

Note

This method is currently implemented only for executables such as PE, ELF and MachO.

Parameters

offset (int) – The location offset.

Returns

Returns the description if successful; otherwise returns an empty string.

Return type

str

Available since Cerbero Suite 7.3 and Cerbero Engine 4.3.

MakeStruct(header: Pro.Core.CFFHeader, name: str, offset: int, options: Optional[int] = None) → Pro.Core.CFFStruct

Returns a CFFStruct instance.

Parameters

• header (CFFHeader) – The header from which to fetch the definition of the structure.

• name (str) – The name of the structure to return.

• offset (int) – The offset at which to load the structure.

• options (Optional[int]) – The options for the layout of the structure (e.g., CFFSO_Pack1).

Returns

Returns a valid structure if successful; otherwise returns an invalid structure.

Return type

CFFStruct

See also MakeStructArray(), CFFStruct and CFFHeader.

MakeStructArray(header: Pro.Core.CFFHeader, name: str, offset: int, nentries: int, options: Optional[int] = None) → Pro.Core.CFFStruct

Returns an array of CFFStruct.

Parameters

• header (CFFHeader) – The header from which to fetch the definition of the structure.

• name (str) – The name of the structure to return.

• offset (int) – The offset at which to load the structure.

• nentries (int) – The number of array entries.

• options (Optional[int]) – The options for the layout of the structure (e.g., CFFSO_Pack1).

Returns

Returns a valid structure if successful; otherwise returns an invalid structure.

Return type

CFFStruct

See also MakeStruct(), CFFStruct and CFFHeader.

Modified(b: bool) → None

Sets the modified status for the object.

Parameters

b (bool) – If True, marks the object as modified; otherwise marks the object as unmodified.

See also IsModified().

NewContainer(size: int, reserve_size: int = 1024, max_size: int = 0) → Pro.Core.NTContainer

Creates a new NTContainer object.

Whether the container will be using an internal memory buffer or a file on disk is decided on the basis of available memory resources at the time of the call.

Parameters

• size (int) – The initial size of the container.

• reserve_size (int) – The size to initially reserve for the container.

• max_size (int) – The maximum size the container will ever reach. This is an optional parameter used to decide whether the container can operate on a memory buffer.

Returns

Returns the created container if successful; otherwise returns an invalid container.

Return type

NTContainer

See also newContainer() and NTContainer.

Notify(code: int) → bool

Internally notifies the associated ScanProvider (if any) of a problem.

Parameters

code (int) – The notification code (e.g., CFFN_NoDecrypt).

Returns

Returns True if successful; otherwise returns False.

Return type

bool

See also ScanProvider.

RangesEnabled() → bool

Returns

Returns True if ranges are enabled for the current object; otherwise returns False.

Return type

bool

Available since Cerbero Suite 6.2 and Cerbero Engine 3.2.

See also EnableRanges(), DisableRanges() and SetRange().

Read(offset: int, uSize: int) → bytes

Reads data from the object.

Parameters

• offset (int) – The offset of the data to read.

• uSize (int) – The size of the data to read.

Returns

Returns the data read if successful; otherwise return an empty bytes object.

Return type

bytes

See also Write().

ReadNumber(offset: int, type: int, endianness: int, is_signed: bool) → tuple

Reads an integer from the object.

Parameters

• offset (int) – The offset of the integer to read.

• type (int) – The type of integer to read.

• endianness (int) – The endianness of the integer (ENDIANNESS_LITTLE or ENDIANNESS_BIG).

• is_signed (bool) – If True, the integer is treated as signed.

Returns

Returns a tuple containing the value read and a boolean. The boolean value is True if successful; otherwise it is False.

Return type

tuple[int, bool]

See also ReadUInt8(), ReadUInt16(), ReadUInt32() and ReadUInt64().

ReadUInt16(offset: int, endianness: Optional[int] = None) → tuple

Reads an unsigned 16-bit integer from the object.

Parameters

• offset (int) – The offset of the value to read.

• endianness (Optional[int]) – The endianness of the value (ENDIANNESS_LITTLE or ENDIANNESS_BIG).

Returns

Returns a tuple containing the value read and a boolean. The boolean value is True if successful; otherwise it is False.

Return type

tuple[int, bool]

See also WriteUInt16(), ReadUInt8(), ReadUInt32(), ReadUInt64() and ReadNumber().

ReadUInt16String(offset: int, maxlen: int, endianness: int) → tuple

Reads an utf-16 array from the object.

The method stops when either a null terminator or maxlen is reached.

Parameters

• offset (int) – The offset of the array to read.

• maxlen (int) – The maximum length of the entry in characters.

• endianness (int) – The endianness of the array (ENDIANNESS_LITTLE or ENDIANNESS_BIG).

Returns

Returns a tuple containing the array read and a boolean. The boolean value is True if successful; otherwise it is False.

Return type

tuple[bytes, bool]

See also ReadUInt8String() and ReadUInt32String().

ReadUInt32(offset: int, endianness: Optional[int] = None) → tuple

Reads an unsigned 32-bit integer from the object.

Parameters

• offset (int) – The offset of the value to read.

• endianness (Optional[int]) – The endianness of the value (ENDIANNESS_LITTLE or ENDIANNESS_BIG).

Returns

Returns a tuple containing the value read and a boolean. The boolean value is True if successful; otherwise it is False.

Return type

tuple[int, bool]

See also WriteUInt32(), ReadUInt8(), ReadUInt16(), ReadUInt64() and ReadNumber().

ReadUInt32String(offset: int, maxlen: int, endianness: int) → tuple

Reads an utf-32 array from the object.

The method stops when either a null terminator or maxlen is reached.

Parameters

• offset (int) – The offset of the array to read.

• maxlen (int) – The maximum length of the entry in characters.

• endianness (int) – The endianness of the array (ENDIANNESS_LITTLE or ENDIANNESS_BIG).

Returns

Returns a tuple containing the array read and a boolean. The boolean value is True if successful; otherwise it is False.

Return type

tuple[bytes, bool]

See also ReadUInt8String() and ReadUInt16String().

ReadUInt64(offset: int, endianness: Optional[int] = None) → tuple

Reads an unsigned 64-bit integer from the object.

Parameters

• offset (int) – The offset of the value to read.

• endianness (Optional[int]) – The endianness of the value (ENDIANNESS_LITTLE or ENDIANNESS_BIG).

Returns

Returns a tuple containing the value read and a boolean. The boolean value is True if successful; otherwise it is False.

Return type

tuple[int, bool]

See also WriteUInt64(), ReadUInt8(), ReadUInt16(), ReadUInt32() and ReadNumber().

ReadUInt8(offset: int) → tuple

Reads an unsigned 8-bit integer from the object.

Parameters

offset (int) – The offset of the value to read.

Returns

Returns a tuple containing the value read and a boolean. The boolean value is True if successful; otherwise it is False.

Return type

tuple[int, bool]

See also WriteUInt8(), ReadUInt16(), ReadUInt32(), ReadUInt64() and ReadNumber().

ReadUInt8String(offset: int, maxlen: int) → tuple

Reads an utf-8 array from the object.

The method stops when either a null terminator or maxlen is reached.

Parameters

• offset (int) – The offset of the array to read.

• maxlen (int) – The maximum length of the entry in bytes.

Returns

Returns a tuple containing the array read and a boolean. The boolean value is True if successful; otherwise it is False.

Return type

tuple[bytes, bool]

See also ReadUInt16String() and ReadUInt32String().

ReplaceStream(NewStream: Pro.Core.NTContainer) → None

Replaces the internal data of the object.

Parameters

NewStream (NTContainer) – The new internal container for the object.

See also Load() and GetStream().

SetDefaultEndianness(nEndiannessType: int) → None

Sets the default endianness for the object.

Parameters

nEndiannessType (int) – The default endianness for the object (ENDIANNESS_LITTLE or ENDIANNESS_BIG).

See also GetDefaultEndianness().

SetDefaultStructOptions(options: int) → None

Sets the default options for CFFStruct instances created from this object (e.g., CFFSO_Pack1).

These options are used whenever options are not explicitly specified when calling MakeStruct() or MakeStructArray().

Parameters

options (int) – The default options.

See also GetDefaultStructOptions().

SetFSSupport(b: bool) → None

Sets the status of file system support.

Parameters

b (bool) – If True, enables file system support; otherwise disables it.

Available since Cerbero Suite 7.0 and Cerbero Engine 4.0.

See also HasFSSupport().

SetMappingAddress(mapping: int) → None

Sets the address at which the object is mapped.

For instance, the mapping address is set for binaries loaded from a memory image.

Parameters

mapping (int) – The mapping address.

See also GetMappingAddress() and IsMapped().

SetMemoryUnpackLimit(limit: int) → None

Sets the maximum amount of bytes which can be allocated for in-memory decompression algorithms.

Parameters

limit (int) – The limit in bytes.

See also GetMemoryUnpackLimit().

SetObjectFormatName(format: str) → None

Sets the file format name of the object.

Parameters

format (str) – The file format name.

See also GetObjectFormatName().

SetObjectGenericFormatName(format: str) → None

Sets the generic format name of the object (e.g., the generic format name of HTML is XML).

Parameters

format (str) – The generic format name.

See also GetObjectGenericFormatName().

SetObjectName(name: str) → None

Sets the name of the object.

Parameters

name (str) – The object name.

See also GetObjectName().

SetObjectTypeName(type_name: str) → None

Sets the type name of the object.

Parameters

type_name (str) – The object type name.

See also GetObjectTypeName().

SetRange(offset: int, size: int, val: int) → None

Sets a range value for the current object.

Warning

This method is deprecated and should not be confused with NTContainer.setRange(). Use SetRangeValue() instead.

Parameters

• offset (int) – The offset of the range.

• size (int) – The size of the range.

• val (int) – The value of the range (e.g., CFFRange_Used).

Available since Cerbero Suite 6.2 and Cerbero Engine 3.2.

See also SetRangeValue(), EnableRanges(), DisableRanges() and RangesEnabled().

SetRangeValue(offset: int, size: int, val: int) → None

Sets a range value for the current object.

Parameters

• offset (int) – The offset of the range.

• size (int) – The size of the range.

• val (int) – The value of the range (e.g., CFFRange_Used).

Available since Cerbero Suite 7.3 and Cerbero Engine 4.3.

See also EnableRanges(), DisableRanges() and RangesEnabled().

SetSize(NewSize: int) → bool

Resizes the internal data of the object.

Parameters

NewSize (int) – The new size of the data.

Returns

Returns True if successful; otherwise returns False.

Return type

bool

See also NTContainer.setResizable() and GetSize().

SetSpecialData(key: str, value: Pro.Core.NTContainer) → None

Sets special data associated to the object.

Parameters

• key (str) – The key of the data to set.

• value (NTContainer) – The data.

See also GetSpecialData().

SetTag(t: str) → None

Sets the tag name of the object for debugging purposes

Parameters

t (str) – The tag name.

See also GetTag().

SetUnpackLimit(limit: int) → None

Sets the limit for decompression operations.

Parameters

limit (int) – The limit in bytes.

See also GetUnpackLimit().

SetUnpackNestingLimit(limit: int) → None

Sets the nesting limit for decompression operations.

Parameters

limit (int) – The limit.

See also GetUnpackNestingLimit().

Shift(uSize: int) → bool

Appends uSize bytes at the end of the object data and sets them to zero.

Parameters

uSize (int) – The number of bytes to append.

Returns

Returns True if successful; otherwise returns False.

Return type

bool

See also NTContainer.shift() and Align().

ToBuffer(offset: int, method: int = Bufferize_Forwards) → Pro.Core.CFFBuffer

Returns a CFFBuffer that reads from the object.

Parameters

• offset (int) – The start offset.

• method (int) – The buffering method to use. Defaults to Bufferize_Forwards.

Returns

Returns the CFFBuffer instance.

Return type

CFFBuffer

See also CFFBuffer.

ToUInt16(n: int) → int

Applies the default endianness of the object to the 16-bit input integer.

The bytes of the integer will be inverted only if the default endianness of the object doesn’t match the endianness of the current platform.

Parameters

n (int) – The input integer.

Returns

Returns the inverted integer if the the default endianness of the object doesn’t match the endianness of the current platform; otherwise returns the input integer.

Return type

int

See also ToUInt32() and ToUInt64().

ToUInt32(n: int) → int

Applies the default endianness of the object to the 32-bit input integer.

Parameters

n (int) – The input integer.

Returns

Returns the inverted integer if the the default endianness of the object doesn’t match the endianness of the current platform; otherwise returns the input integer.

Return type

int

See also ToUInt16() and ToUInt64().

ToUInt64(n: int) → int

Applies the default endianness of the object to the 64-bit input integer.

Parameters

n (int) – The input integer.

Returns

Returns the inverted integer if the the default endianness of the object doesn’t match the endianness of the current platform; otherwise returns the input integer.

Return type

int

See also ToUInt16() and ToUInt32().

ValidRange(offset: int, Size: int) → bool

Checks the validity of a range in the context of the object.

Parameters

• offset (int) – The offset of the range to check.

• Size (int) – The size of the range to check.

Returns

Returns True if the range is valid; otherwise returns False.

Return type

bool

See also NTContainer.validRange().

Write(offset: int, bytes_or_uSize: Union[bytes, int], bytes: Optional[bytes] = None) → bool

Writes data to the object.

Parameters

• offset (int) – The offset at which to write the data.

• bytes_or_uSize (Union[bytes, int]) – Either the data to write or the number of bytes to write.

• bytes (Optional[bytes]) – The data to write.

Returns

Returns True if successful; otherwise returns False.

Return type

bool

See also Read().

WriteUInt16(offset: int, n_or_nEndiannessType: int, n: Optional[int] = None) → bool

Writes an unsigned 16-bit integer to the object.

Parameters

• offset (int) – The offset at which to write the value.

• n_or_nEndiannessType (int) – Either the value to write or the endianness (ENDIANNESS_LITTLE or ENDIANNESS_BIG) to use when writing the value. If the endianness is not specified, the value is written using the default endianness of the object.

• n (Optional[int]) – The value to write.

Returns

Returns True if successful; otherwise returns False.

Return type

bool

See also ReadUInt16(), WriteUInt8(), WriteUInt32() and WriteUInt64().

WriteUInt32(offset: int, n_or_nEndiannessType: int, n: Optional[int] = None) → bool

Writes an unsigned 32-bit integer to the object.

Parameters

• offset (int) – The offset at which to write the value.

• n_or_nEndiannessType (int) – Either the value to write or the endianness (ENDIANNESS_LITTLE or ENDIANNESS_BIG) to use when writing the value. If the endianness is not specified, the value is written using the default endianness of the object.

• n (Optional[int]) – The value to write.

Returns

Returns True if successful; otherwise returns False.

Return type

bool

See also ReadUInt32(), WriteUInt8(), WriteUInt16() and WriteUInt64().

WriteUInt64(offset: int, n_or_nEndiannessType: int, n: Optional[int] = None) → bool

Writes an unsigned 64-bit integer to the object.

Parameters

• offset (int) – The offset at which to write the value.

• n_or_nEndiannessType (int) – Either the value to write or the endianness (ENDIANNESS_LITTLE or ENDIANNESS_BIG) to use when writing the value. If the endianness is not specified, the value is written using the default endianness of the object.

• n (Optional[int]) – The value to write.

Returns

Returns True if successful; otherwise returns False.

Return type

bool

See also ReadUInt64(), WriteUInt8(), WriteUInt16() and WriteUInt32().

WriteUInt8(offset: int, n: int) → bool

Writes an unsigned 8-bit integer to the object.

Parameters

• offset (int) – The offset at which to write the value.

• n (int) – The value to write.

Returns

Returns True if successful; otherwise returns False.

Return type

bool

See also ReadUInt8(), WriteUInt16(), WriteUInt32() and WriteUInt64().

CFFPtrMaxSize: Final[int]

The maximum supported pointer size.

This value is reserved for future use.

See also CFFObject.

CFFPtrMinSize: Final[int]

The minimum supported pointer size.

This value is reserved for future use.

See also CFFObject.

CFFPtrSize16: Final[int]

16-bit pointer size.

This value is reserved for future use.

See also CFFObject.

CFFPtrSize32: Final[int]

32-bit pointer size.

This value is reserved for future use.

See also CFFObject.

CFFPtrSize64: Final[int]

64-bit pointer size.

This value is reserved for future use.

See also CFFObject.

CFFRange_Custom: Final[int]

Range value.

Available since Cerbero Suite 6.2 and Cerbero Engine 3.2.

See also CFFObject.SetRange().

CFFRange_Last: Final[int]

Last range value plus one.

Available since Cerbero Suite 6.2 and Cerbero Engine 3.2.

CFFRange_Unknown: Final[int]

Range value (alias of CFFRange_Unreferenced).

Available since Cerbero Suite 6.2 and Cerbero Engine 3.2.

See also CFFObject.SetRange().

CFFRange_Unreferenced: Final[int]

Range value.

Available since Cerbero Suite 6.2 and Cerbero Engine 3.2.

See also CFFObject.SetRange().

CFFRange_Unused: Final[int]

Range value.

Available since Cerbero Suite 6.2 and Cerbero Engine 3.2.

See also CFFObject.SetRange().

CFFRange_Used: Final[int]

Range value.

Available since Cerbero Suite 6.2 and Cerbero Engine 3.2.

See also CFFObject.SetRange().

CFFSO_Clang: Final[int]

This flag specifies that the structure was generated by the Clang compiler.

See also CFFObject.SetDefaultStructOptions() and CFFStruct.

CFFSO_CompilerMask: Final[int]

Compiler mask for the flags of the structure.

See also CFFObject.SetDefaultStructOptions() and CFFStruct.

CFFSO_EndianBig: Final[int]

This flag specifies that the structure is big-endian.

See also CFFObject.SetDefaultStructOptions() and CFFStruct.

CFFSO_EndianDefault: Final[int]

This flag specifies that the structure uses the default endianness.

See also CFFObject.SetDefaultStructOptions() and CFFStruct.

CFFSO_EndianLittle: Final[int]

This flag specifies that the structure is little-endian.

See also CFFObject.SetDefaultStructOptions() and CFFStruct.

CFFSO_EndiannessBig: Final[int]

This flag specifies that the structure is big-endian.

See also CFFObject.SetDefaultStructOptions() and CFFStruct.

CFFSO_EndiannessDefault: Final[int]

This flag specifies that the structure uses the default endianness.

See also CFFObject.SetDefaultStructOptions() and CFFStruct.

CFFSO_EndiannessLittle: Final[int]

This flag specifies that the structure is little-endian.

See also CFFObject.SetDefaultStructOptions() and CFFStruct.

CFFSO_EndiannessMask: Final[int]

Endianness mask for the flags of the structure.

See also CFFObject.SetDefaultStructOptions() and CFFStruct.

CFFSO_GCC: Final[int]

This flag specifies that the structure was generated by the GCC compiler.

See also CFFObject.SetDefaultStructOptions() and CFFStruct.

CFFSO_NoCompiler: Final[int]

This flag specifies that the structure wasn’t generated by a specific compiler.

See also CFFObject.SetDefaultStructOptions() and CFFStruct.

CFFSO_NoPlatform: Final[int]

This flag specifies that the structure isn’t bound to specific platform.

See also CFFObject.SetDefaultStructOptions() and CFFStruct.

CFFSO_Pack1: Final[int]

This flag specifies that the structure has an alignment of 1.

See also CFFObject.SetDefaultStructOptions() and CFFStruct.

CFFSO_Pack16: Final[int]

This flag specifies that the structure has an alignment of 16.

See also CFFObject.SetDefaultStructOptions() and CFFStruct.

CFFSO_Pack2: Final[int]

This flag specifies that the structure has an alignment of 2.

See also CFFObject.SetDefaultStructOptions() and CFFStruct.

CFFSO_Pack4: Final[int]

This flag specifies that the structure has an alignment of 4.

See also CFFObject.SetDefaultStructOptions() and CFFStruct.

CFFSO_Pack8: Final[int]

This flag specifies that the structure has an alignment of 8.

See also CFFObject.SetDefaultStructOptions() and CFFStruct.

CFFSO_PackMask: Final[int]

Alignment mask for the flags of the structure.

See also CFFObject.SetDefaultStructOptions() and CFFStruct.

CFFSO_PackNone: Final[int]

This flag specifies that the structure doesn’t have an alignment.

See also CFFObject.SetDefaultStructOptions() and CFFStruct.

CFFSO_PlatformMask: Final[int]

Platform mask for the flags of the structure.

See also CFFObject.SetDefaultStructOptions() and CFFStruct.

CFFSO_Pointer16: Final[int]

This flag specifies that the pointer size of the structure is 16-bits.

See also CFFObject.SetDefaultStructOptions() and CFFStruct.

CFFSO_Pointer32: Final[int]

This flag specifies that the pointer size of the structure is 32-bits.

See also CFFObject.SetDefaultStructOptions() and CFFStruct.

CFFSO_Pointer64: Final[int]

This flag specifies that the pointer size of the structure is 64-bits.

See also CFFObject.SetDefaultStructOptions() and CFFStruct.

CFFSO_PointerDefault: Final[int]

This flag specifies that the pointer size of the structure is the default one for the object.

See also CFFObject.SetDefaultStructOptions() and CFFStruct.

CFFSO_PointerMask: Final[int]

Pointer mask for the flags of the structure.

See also CFFObject.SetDefaultStructOptions() and CFFStruct.

CFFSO_VC: Final[int]

This flag specifies that the structure was generated by the Visual C++ compiler.

See also CFFObject.SetDefaultStructOptions() and CFFStruct.

CFFSO_Windows: Final[int]

This flag specifies that the structure was generated for the Windows platform.

See also CFFObject.SetDefaultStructOptions() and CFFStruct.

class CFFStruct

This class represents a data structure and references a CFFObject instance.

Instances of CFFStruct can be returned from CFFObject derived classes or by using CFFObject.MakeStruct() in combination with an instance of CFFHeader.

Example:

from Pro.Core import *
from Pro.PE import *

def printDOSHeader(fname):
    c = createContainerFromFile(fname)
    if c.isNull():
        return
    pe = PEObject()
    if not pe.Load(c):
        return
    out = NTTextBuffer()
    pe.DosHeader().Dump(out) # CFFStruct.Dump
    print(out.buffer)

See also CFFStruct, CFFHeader and CFFObject.MakeStruct().

Methods:

Add(i)	If the current instance represents an array of structures, this method changes which entry is currently referenced.
At(i)	Retrieves a specific structure among an array of structures.
Bytes(i_or_name)	Returns the byte-array representation of a member of the structure.
Context()	Returns the context helper class for the current structure.
Count()	Returns the number of entries in the current array of structures.
Dump(out)	Outputs the members of the structure to a text stream according to their type nature.
Equals(s)	Checks whether two structures reference the same internal data.
Fill(c_or_i_or_name[, c])	Fills the entire structure or a member of it with a specified 8-bit value.
Flags(i_or_name)	Returns the flags for a member of the structure.
GetOffset()	Returns the start offset of the structure.
HasDynamicSize()	Checks whether the structure contains members whose size depends upon the underlying data.
HasFlags([i_or_name])	Checks whether at least one member or a specific member of the structure has flags associated with it.
IsArray()	Returns True if the current instance represents an array of structures; otherwise returns False.
IsFixed()	Returns True if the structures has a fixed size; otherwise returns False.
IsNull()	Returns True if the structure is invalid; otherwise returns False.
IsValid()	Returns True if the structure is valid; otherwise returns False.
LongestMemberName()	Returns the length of the longer member name of the structure.
MakeSingle()	Converts an array of structure into a single structure.
MemberCount()	Returns the number of members in the structure.
MemberName(i)	Retrieves the name of a member of the structure by its index.
MemberNature(i_or_name)	Retrieves the type nature of a member of the structure.
MemberOffset(i_or_name)	Retrieves the offset of a member of the structure.
MemberPosition(name)	Retrieves the index of a member of the structure.
MemberSize(i_or_name)	Retrieves the size of a member of the structure.
MemberType(i)	Retrieves the type of a member of the structure.
MemberTypeName(i)	Retrieves the type name of a member of the structure.
MembersWithFlags()	Returns a list of indexes of those members in the structure which have flags.
Num(i_or_name)	Returns the numeric representation of a member of the structure.
Object()	Returns the internally referenced object.
Offset()	Returns the start offset of the structure.
Raw(i_or_name)	Returns the raw data of a member of the structure.
Set(i_or_name, bytes_or_number_or_str)	Sets a member of the structure.
SetContext(ctx)	Sets the context helper class for the current structure.
SetCount(n)	Sets the number of entries in the array of structures.
SetMemberCount(n)	Sets the number of members that the structure has.
SetObject(obj)	Sets the internally referenced object.
SetOffset(o)	Sets the start offset of the structure.
SetRaw(i_or_name, bytes)	Sets the raw data of a member of the structure.
Size()	Returns the size of the structure.
Str(i_or_name[, align_nums])	Returns the string representation of a member of the structure.
StructName()	Returns the name of the structure.
SubStruct(i_or_name)	Retrieves a sub-structure of the current structure.
TotalSize()	Returns the total size occupied by the array of structures.
Uns(i_or_name)	Returns the unsigned integer representation of a member of the structure.
Zero([i_or_name])	Fills the entire structure or a member of it with zero.
iterator()	Returns an iterator for an array of structures.

Add(i: int) → Pro.Core.CFFStruct

If the current instance represents an array of structures, this method changes which entry is currently referenced.

Parameters

i (int) – The iterator can be increased by a negative amount.

Returns

Returns the requested structure if within the limit of available entries; otherwise returns an invalid structure.

Return type

CFFStruct

See also At(), Count() and iterator().

At(i: int) → Pro.Core.CFFStruct

Retrieves a specific structure among an array of structures.

Parameters

i (int) – The index of the structure to retrieve.

Returns

Returns the requested structure if within the limit of available entries; otherwise returns an invalid structure.

Return type

CFFStruct

See also Count(), At() and iterator().

Bytes(i_or_name: Union[int, str]) → bytes

Returns the byte-array representation of a member of the structure.

This method automatically handles the endianness of the requested data.

Parameters

i_or_name (Union[int, str]) – The index or name of the member of the structure.

Returns

Returns the requested data if successful; otherwise returns an empty bytes object.

Return type

bytes

See also Set(), Str(), Num() and Raw().

Context() → Pro.Core.CFFContext

Returns

Returns the context helper class for the current structure.

Return type

CFFContext

See also SetContext().

Count() → int

Returns

Returns the number of entries in the current array of structures.

Return type

int

See also SetCount(), At() and iterator().

Dump(out: Pro.Core.NTTextStream) → bool

Outputs the members of the structure to a text stream according to their type nature.

Parameters

out (NTTextStream) – The text stream for the output.

Returns

Returns True if successful; otherwise returns False.

Return type

bool

See also NTTextStream.

Equals(s: Pro.Core.CFFStruct) → bool

Checks whether two structures reference the same internal data.

Parameters

s (CFFStruct) – The other structure.

Returns

Returns True if the structure reference the same internal data; otherwise returns False.

Return type

bool

Fill(c_or_i_or_name: Union[int, str], c: Optional[int] = None) → bool

Fills the entire structure or a member of it with a specified 8-bit value.

Parameters

• c_or_i_or_name (Union[int, str]) – Either the 8-bit value used to fill the structure or the index or name of the member of the structure to fill.

• c (Optional[int]) – The 8-bit value used to fill the member of the structure.

Returns

Returns True if successful; otherwise returns False.

Return type

bool

See also Zero().

Flags(i_or_name: Union[int, str]) → Pro.Core.CFFFlags

Returns the flags for a member of the structure.

Parameters

i_or_name (Union[int, str]) – The index or name of the member of the structure.

Returns

Returns a valid CFFFlags instance if successful; otherwise returns an invalid CFFFlags instance.

Return type

CFFFlags

See also HasFlags(), MembersWithFlags() and CFFFlags.

GetOffset() → int

Returns

Returns the start offset of the structure.

Return type

int

See also Offset(), SetOffset() and Size().

HasDynamicSize() → bool

Checks whether the structure contains members whose size depends upon the underlying data.

Note

In an array of dynamic structures every entry can potentially have a different size than the other entries. Knowing whether or not a structure is dynamic is important for optimization purposes: skipping multiple entries in an array of dynamic structures requires to read the data for each entry to perform the calculation (e.g., Add()).

Returns

Returns True if the structure contains members whose size depends upon the underlying data; otherwise returns False.

Return type

bool

See also Add() and At().

HasFlags(i_or_name: Optional[Union[int, str]] = None) → bool

Checks whether at least one member or a specific member of the structure has flags associated with it.

Parameters

i_or_name (Optional[Union[int, str]]) – The index or name of the member of the structure.

Returns

Returns True if flags are available; otherwise returns False.

Return type

bool

See also Flags(), MembersWithFlags() and CFFFlags.

IsArray() → bool

Returns

Returns True if the current instance represents an array of structures; otherwise returns False.

Return type

bool

See also Count() and MakeSingle().

IsFixed() → bool

Returns

Returns True if the structures has a fixed size; otherwise returns False.

Return type

bool

IsNull() → bool

Returns

Returns True if the structure is invalid; otherwise returns False.

Return type

bool

See also IsValid().

IsValid() → bool

Returns

Returns True if the structure is valid; otherwise returns False.

Return type

bool

See also IsNull().

LongestMemberName() → int

Returns

Returns the length of the longer member name of the structure.

Return type

int

See also MemberName().

MakeSingle() → Pro.Core.CFFStruct

Converts an array of structure into a single structure.

Returns

Returns the currently referenced structure in the array as a single structure.

Return type

CFFStruct

See also IsArray() and Count().

MemberCount() → int

Returns

Returns the number of members in the structure.

Return type

int

See also SetMemberCount().

MemberName(i: int) → str

Retrieves the name of a member of the structure by its index.

Parameters

i (int) – The index of the member of the structure.

Returns

Returns the member name if successful; otherwise returns an empty string.

Return type

str

See also MemberPosition(), MemberOffset() and MemberSize().

MemberNature(i_or_name: Union[int, str]) → int

Retrieves the type nature of a member of the structure.

Parameters

i_or_name (Union[int, str]) – The index or name of the member of the structure.

Returns

Returns the type nature if successful; otherwise returns NATURE_UNKNOWN.

Return type

int

See also MemberName(), MemberOffset() and MemberSize().

MemberOffset(i_or_name: Union[int, str]) → int

Retrieves the offset of a member of the structure.

Parameters

i_or_name (Union[int, str]) – The index or name of the member of the structure.

Returns

Returns the offset if successful; otherwise returns INVALID_STREAM_OFFSET.

Return type

int

See also MemberName(), MemberSize() and MemberPosition().

MemberPosition(name: str) → int

Retrieves the index of a member of the structure.

Parameters

name (str) – The name of the member of the structure.

Returns

Returns the index if successful; otherwise returns -1.

Return type

int

See also MemberName(), MemberOffset() and MemberSize().

MemberSize(i_or_name: Union[int, str]) → int

Retrieves the size of a member of the structure.

Parameters

i_or_name (Union[int, str]) – The index or name of the member of the structure.

Returns

Returns the size if successful; otherwise returns 0.

Return type

int

See also MemberOffset(), MemberName() and MemberPosition().

MemberType(i: int) → int

Retrieves the type of a member of the structure.

Parameters

i (int) – The index or name of the member of the structure.

Returns

Returns the type if successful; otherwise returns 0xFFFFFFFFFFFFFFFF.

Return type

int

See also MemberTypeName(), MemberName(), MemberOffset() and MemberSize().

MemberTypeName(i: int) → str

Retrieves the type name of a member of the structure.

Parameters

i (int) – The index or name of the member of the structure.

Returns

Returns the type name if successful; otherwise returns an empty string.

Return type

str

See also MemberType(), MemberName(), MemberOffset() and MemberSize().

MembersWithFlags() → Pro.Core.NTIntList

Returns

Returns a list of indexes of those members in the structure which have flags.

Return type

NTIntList

See also HasFlags(), Flags() and CFFFlags.

Num(i_or_name: Union[int, str]) → int

Returns the numeric representation of a member of the structure.

Important

If the member to retrieve is an unsigned integer which doesn’t exceed 64 bit in size, then the slightly faster Uns() method can be used instead of Num().

This method automatically handles the endianness of the requested data.

Parameters

i_or_name (Union[int, str]) – The index or name of the member of the structure.

Returns

Returns the numeric value if successful; otherwise returns 0.

Return type

int

See also Set(), Uns(), Str(), Bytes() and Raw().

Object() → Pro.Core.CFFObject

Returns

Returns the internally referenced object.

Return type

CFFObject

See also SetObject().

Offset() → int

Returns

Returns the start offset of the structure.

Return type

int

See also GetOffset(), SetOffset() and Size().

Raw(i_or_name: Union[int, str]) → bytes

Returns the raw data of a member of the structure.

Parameters

i_or_name (Union[int, str]) – The index or name of the member of the structure.

Returns

Returns the requested data if successful; otherwise returns an empty bytes object.

Return type

bytes

See also SetRaw().

Set(i_or_name: Union[int, str], bytes_or_number_or_str: Union[bytes, int, str]) → bool

Sets a member of the structure.

This method automatically handles the endianness of the data to set.

Parameters

• i_or_name (Union[int, str]) – The index or name of the member of the structure.

• bytes_or_number_or_str (Union[bytes, int, str]) – The data to set. This value is automatically converted to the raw data.

Returns

Returns True if successful; otherwise returns False.

Return type

bool

See also Str(), Num(), Bytes() and Raw().

SetContext(ctx: Pro.Core.CFFContext) → None

Sets the context helper class for the current structure.

Parameters

ctx (CFFContext) – The context helper class to set.

See also Context().

SetCount(n: int) → None

Sets the number of entries in the array of structures.

Parameters

n (int) – The number of entries to set.

See also Count(), At() and iterator().

SetMemberCount(n: int) → None

Sets the number of members that the structure has.

Note

This method can only reduce the number of members initially available in the structure and it’s used to adapt structures which have different number of members depending on a version or size field.

Parameters

n (int) – The number of members to set.

See also MemberCount().

SetObject(obj: Pro.Core.CFFObject) → None

Sets the internally referenced object.

Parameters

obj (CFFObject) – The object to set.

See also Object().

SetOffset(o: int) → None

Sets the start offset of the structure.

Parameters

o (int) – The start offset to set.

See also Offset(), GetOffset() and Size().

SetRaw(i_or_name: Union[int, str], bytes: bytes) → bool

Sets the raw data of a member of the structure.

Parameters

• i_or_name (Union[int, str]) – The index or name of the member of the structure.

• bytes (bytes) – The raw data to set.

Returns

Returns True if successful; otherwise returns False.

Return type

bool

See also Raw().

Size() → int

Returns

Returns the size of the structure.

Return type

int

See also TotalSize(), Offset() and GetOffset().

Str(i_or_name: Union[int, str], align_nums: bool = False) → str

Returns the string representation of a member of the structure.

This method automatically handles the endianness of the requested data.

Parameters

• i_or_name (Union[int, str]) – The index or name of the member of the structure.

• align_nums (bool) – If True, aligns numbers using zero-padding.

Returns

Returns the string if successful; otherwise returns an empty string.

Return type

str

See also Set(), Num(), Bytes() and Raw().

StructName() → str

Returns

Returns the name of the structure.

Return type

str

SubStruct(i_or_name: Union[int, str]) → Pro.Core.CFFStruct

Retrieves a sub-structure of the current structure.

This method is available only to fixed size structures.

Parameters

i_or_name (Union[int, str]) – The name or index of the sub-structure to retrieve.

Returns

Returns the sub-structure if successful; otherwise returns an invalid structure.

Return type

CFFStruct

See also IsFixed().

TotalSize() → int

Returns

Returns the total size occupied by the array of structures.

Return type

int

See also Size(), Offset() and GetOffset().

Uns(i_or_name: Union[int, str]) → int

Returns the unsigned integer representation of a member of the structure.

Important

The maximum supported size for unsigned integers returned by this method is 64 bits. To retrieve larger or negative integers Num() must be used. The difference between the two methods is that Uns() is slightly faster than Num().

This method automatically handles the endianness of the requested data.

Parameters

i_or_name (Union[int, str]) – The index or name of the member of the structure.

Returns

Returns the numeric value if successful; otherwise returns 0.

Return type

int

Available since Cerbero Suite 5.0 and Cerbero Engine 2.0.

See also Set(), Num(), Str(), Bytes() and Raw().

Zero(i_or_name: Optional[Union[int, str]] = None) → bool

Fills the entire structure or a member of it with zero.

Parameters

i_or_name (Optional[Union[int, str]]) – The index or name of the member of the structure.

Returns

Returns True if successful; otherwise returns False.

Return type

bool

See also Fill().

iterator() → Pro.Core.CFFStructIt

Returns

Returns an iterator for an array of structures.

Return type

CFFStructIt

See also CFFStructIt.

class CFFStructIt(s: Pro.Core.CFFStruct)

Iterator for an array of CFFStruct structures.

Parameters

s (CFFStruct) – The array of structures to iterate over.

See also CFFStruct.iterator() and CFFStruct.

Methods:

HasNext()	Returns True if there is an entry after the current one; otherwise returns False.
Next()	Returns the entry after the current one and moves the iterator if successful; otherwise returns an invalid structure.
hasNext()	Returns True if there is an entry after the current one; otherwise returns False.
next()	Returns the entry after the current one and moves the iterator if successful; otherwise returns an invalid structure.

HasNext() → bool

Returns

Returns True if there is an entry after the current one; otherwise returns False.

Return type

bool

See also Next(), hasNext(), next() and CFFStruct.

Next() → Pro.Core.CFFStruct

Returns

Returns the entry after the current one and moves the iterator if successful; otherwise returns an invalid structure.

Return type

CFFStruct

See also HasNext(), hasNext(), next() and CFFStruct.

hasNext() → bool

Returns

Returns True if there is an entry after the current one; otherwise returns False.

Return type

bool

See also next() and CFFStruct.

next() → Pro.Core.CFFStruct

Returns

Returns the entry after the current one and moves the iterator if successful; otherwise returns an invalid structure.

Return type

CFFStruct

See also hasNext() and CFFStruct.

class CFFStructList

List of CFFStruct elements.

Methods:

append(value)	Inserts value at the end of the list.
at(i)	Returns the item at index position i in the list.
clear()	Removes all items from the list.
contains(value)	Checks the presence of an element in the list.
count(value)	Returns the number of occurrences of value in the list.
indexOf(value[, start])	Searches for an element in the list.
insert(i, value)	Inserts value at index position i in the list.
isEmpty()	Checks whether the list is empty.
iterator()	Creates an iterator for the list.
removeAll(value)	Removes all occurrences of value in the list and returns the number of entries removed.
removeAt(i)	Removes the item at index position i.
reserve(alloc)	Reserve space for alloc elements.
size()	Returns the number of items in the list.
takeAt(i)	Removes the item at index position i and returns it.

append(value: Pro.Core.CFFStruct) → None

Inserts value at the end of the list.

Parameters

value (CFFStruct) – The value to add to the list.

See also insert().

at(i: int) → Pro.Core.CFFStruct

Returns the item at index position i in the list. i must be a valid index position in the list (i.e., 0 <= i < size()).

Parameters

i (int) – The index of the element to return.

Returns

Returns the requested element.

Return type

CFFStruct

clear() → None

Removes all items from the list.

contains(value: Pro.Core.CFFStruct) → bool

Checks the presence of an element in the list.

Parameters

value (CFFStruct) – The value to check for.

Returns

Returns True if the list contains an occurrence of value; otherwise returns False.

Return type

bool

See also indexOf() and count().

count(value: Pro.Core.CFFStruct) → int

Returns the number of occurrences of value in the list.

Parameters

value (CFFStruct) – The value to count.

Returns

Returns the number of occurrences.

Return type

int

See also indexOf() and contains().

indexOf(value: Pro.Core.CFFStruct, start: int = 0) → int

Searches for an element in the list.

Parameters

• value (CFFStruct) – The value to search for.

• start (int) – The start index.

Returns

Returns the index position of the first occurrence of value in the list. Returns -1 if no item was found.

Return type

int

See also contains().

insert(i: int, value: Pro.Core.CFFStruct) → None

Inserts value at index position i in the list. If i is 0, the value is prepended to the list. If i is size(), the value is appended to the list.

Parameters

• i (int) – The position at which to add the value.

• value (CFFStruct) – The value to add.

See also append() and removeAt().

isEmpty() → bool

Checks whether the list is empty.

Returns

Returns True if the list contains no items; otherwise returns False.

Return type

bool

See also size().

iterator() → Pro.Core.CFFStructListIt

Creates an iterator for the list.

Returns

Returns the iterator.

Return type

CFFStructListIt

removeAll(value: Pro.Core.CFFStruct) → int

Removes all occurrences of value in the list and returns the number of entries removed.

Parameters

value (CFFStruct) – The value to remove from the list.

Returns

Returns the number of entries removed.

Return type

int

See also removeAt().

removeAt(i: int) → None

Removes the item at index position i. i must be a valid index position in the list (i.e., 0 <= i < size()).

Parameters

i (int) – The index of the item to remove.

See also removeAll().

reserve(alloc: int) → None

Reserve space for alloc elements. Calling this method doesn’t change the size of the list.

Parameters

alloc (int) – The amount of elements to reserve space for.

size() → int

Returns

Returns the number of items in the list.

Return type

int

See also isEmpty().

takeAt(i: int) → Pro.Core.CFFStruct

Removes the item at index position i and returns it. i must be a valid index position in the list (i.e., 0 <= i < size()).

Parameters

i (int) – The index of the element to remove from the list.

Returns

Returns the removed element. If you don’t use the return value, removeAt() is more efficient.

Return type

CFFStruct

See also removeAt().

class CFFStructListIt(obj: Pro.Core.CFFStructList)

Iterator class for CFFStructList.

Parameters

obj (CFFStructList) – The object to iterate over.

Methods:

hasNext()	Returns True if there is at least one item ahead of the iterator, i.e. the iterator is not at the back of the container; otherwise returns False.
hasPrevious()	Returns True if there is at least one item behind the iterator, i.e. the iterator is not at the front of the container; otherwise returns False.
next()	Returns the next item and advances the iterator by one position.
previous()	Returns the previous item and moves the iterator back by one position.
toBack()	Moves the iterator to the back of the container (after the last item).
toFront()	Moves the iterator to the front of the container (before the first item).

hasNext() → bool

Returns

Returns True if there is at least one item ahead of the iterator, i.e. the iterator is not at the back of the container; otherwise returns False.

Return type

bool

See also hasPrevious() and next().

hasPrevious() → bool

Returns

Returns True if there is at least one item behind the iterator, i.e. the iterator is not at the front of the container; otherwise returns False.

Return type

bool

See also hasNext() and previous().

next() → Pro.Core.CFFStruct

Returns

Returns the next item and advances the iterator by one position.

Return type

CFFStruct

See also hasNext() and previous().

previous() → Pro.Core.CFFStruct

Returns

Returns the previous item and moves the iterator back by one position.

Return type

CFFStruct

See also hasPrevious() and next().

toBack() → None

Moves the iterator to the back of the container (after the last item).

See also toFront() and previous().

toFront() → None

Moves the iterator to the front of the container (before the first item).

See also toBack() and next().

CFF_ARRAY_NULL_TERMINATED: Final[int]

If specified, makes an array of structure be null-terminated.

See also CFFObject.MakeStructArray().

class CFSEntry(iface: Optional[Pro.Core.CFSEntryInterface] = None)

Wrapper class for a CFSEntryInterface instance.

Parameters

iface (Optional[CFSEntryInterface]) – The CFSEntryInterface instance to be wrapped.

Important

When wrapping an instance of CFSEntryInterface, it is necessary to call __disown__() on it to avoid Python freeing the allocated object. The object will be freed automatically by the CFSEntry wrapper.

Available since Cerbero Suite 7.0 and Cerbero Engine 4.0.

See also CFSEntryInterface.

Attributes:

AccessTime	Access time type.
CreationTime	Creation time type.
Directory	Directory entry type.
Drive	Drive entry type.
FastData	Fast data flag.
File	File entry type.
Invalid	Invalid entry type.
ModificationTime	Modification time type.

Methods:

AddProperty(name, value[, offset])	Adds a property to the entry.
Data([wo])	Retrieves the data associated with the entry.
DataOffset()	Returns the offset of the entry data if available; otherwise returns INVALID_STREAM_OFFSET.
DataSize()	Returns the size of the entry data if available; otherwise returns 0.
Flags()	Returns the flags of the entry (e.g., FastData).
HasData()	Returns True if entry data is available; otherwise returns False.
HasDataSize()	Returns True if entry data size is available; otherwise returns False.
IsNull()	Returns True if the entry is invalid; otherwise returns False.
IsValid()	Returns True if the entry is valid; otherwise returns False.
Name()	Returns the entry name if available; otherwise returns an empty string.
Path()	Returns the full path of the entry, including the file name.
Property(name)	Retrieves a property of the entry.
PropertyCount()	Returns the number of properties available.
PropertyNames()	Returns the list of property names.
PropertyOffset(name)	Retrieves the offset of a property.
SetData(data)	Sets the data of the entry.
SetDataOffset(offset)	Sets the offset of the entry data.
SetDataSize(size)	Sets the size of the entry data.
SetFlags(flags)	Sets the flags of the entry.
SetName(name)	Sets the name of the entry.
SetPath(path)	Sets the full path of the entry.
SetTime(ttype, t)	Sets a specific file time of the entry.
SetType(type)	Sets the type of the entry.
Time(ttype)	Retrieves a specific file time of the entry.
ToXML([sort, include_data])	Converts the entry to an XML string.
Type()	Returns the entry type (e.g., Directory).

AccessTime: Final[int]

Access time type.

See also Time() and SetTime().

AddProperty(name: str, value: Optional[Union[int, float, bool, bytes, str]], offset: int = INVALID_STREAM_OFFSET) → None

Adds a property to the entry.

Parameters

• name (str) – The name of the property.

• value (BasicType) – The value of the property.

• offset (int) – The optional offset of the property.

See also Property(), PropertyCount() and PropertyNames().

CreationTime: Final[int]

Creation time type.

See also Time() and SetTime().

Data(wo: Optional[Pro.Core.NTIWait] = None) → Pro.Core.NTContainer

Retrieves the data associated with the entry.

Parameters

wo (NTIWait) – The optional wait operation for the retrieval of the data.

Returns

Returns a valid NTContainer if successful; otherwise returns an invalid NTContainer.

Return type

NTContainer

See also SetData(), DataOffset(), DataSize() and HasData().

DataOffset() → int

Returns

Returns the offset of the entry data if available; otherwise returns INVALID_STREAM_OFFSET.

Return type

int

See also Data(), SetData(), DataSize() and HasData().

DataSize() → int

Returns

Returns the size of the entry data if available; otherwise returns 0.

Return type

int

Note

The size of the entry data is returned only when set previously using SetDataSize(). This method will not internally call Data() to return the size of the data.

See also HasDataSize(), SetDataSize(), DataOffset(), Data() and SetData().

Directory: Final[int]

Directory entry type.

See also Type() and SetType().

Drive: Final[int]

Drive entry type.

FastData: Final[int]

Fast data flag.

File: Final[int]

File entry type.

See also Type() and SetType().

Flags() → int

Returns

Returns the flags of the entry (e.g., FastData).

Return type

int

Available since Cerbero Suite 7.1 and Cerbero Engine 4.1.

See also SetFlags().

HasData() → bool

Returns

Returns True if entry data is available; otherwise returns False.

Return type

bool

See also Data(), SetData(), DataOffset() and DataSize().

HasDataSize() → bool

Returns

Returns True if entry data size is available; otherwise returns False.

Return type

bool

See also DataSize(), DataOffset(), Data(), SetData() and HasData().

Invalid: Final[int]

Invalid entry type.

See also Type() and SetType().

IsNull() → bool

Returns

Returns True if the entry is invalid; otherwise returns False.

Return type

bool

See also IsValid().

IsValid() → bool

Returns

Returns True if the entry is valid; otherwise returns False.

Return type

bool

See also IsNull().

ModificationTime: Final[int]

Modification time type.

See also Time() and SetTime().

Name() → str

Returns

Returns the entry name if available; otherwise returns an empty string.

Return type

str

See also SetName().

Path() → str

Returns

Returns the full path of the entry, including the file name.

Return type

str

Available since Cerbero Suite 7.1 and Cerbero Engine 4.1.

See also SetPath().

Property(name: str) → Optional[Union[int, float, bool, bytes, str]]

Retrieves a property of the entry.

Parameters

name (str) – The name of the property to retrieve.

Returns

Returns the property value if successful; otherwise returns None.

Return type

BasicType

See also PropertyCount(), PropertyNames(), AddProperty() and PropertyOffset().

PropertyCount() → int

Returns

Returns the number of properties available.

Return type

int

See also Property(), PropertyNames(), AddProperty() and PropertyOffset().

PropertyNames() → Pro.Core.NTStringList

Returns

Returns the list of property names.

Return type

NTStringList

See also Property(), PropertyCount(), AddProperty() and PropertyOffset().

PropertyOffset(name: str) → int

Retrieves the offset of a property.

Parameters

name (str) – The name of the property.

Returns

Returns the of offset of the property if available; otherwise returns INVALID_STREAM_OFFSET.

Return type

int

See also Property(), PropertyCount(), PropertyNames() and AddProperty().

SetData(data: Pro.Core.NTContainer) → None

Sets the data of the entry.

Parameters

data (NTContainer) – The data of the entry.

See also Data(), DataOffset(), DataSize() and HasData().

SetDataOffset(offset: int) → None

Sets the offset of the entry data.

Parameters

offset (int) – The offset of the entry data.

See also DataOffset(), DataSize(), Data() and SetData().

SetDataSize(size: int) → None

Sets the size of the entry data.

Parameters

size (int) – The size of the entry data.

See also DataOffset(), DataSize(), Data() and SetData().

SetFlags(flags: int) → None

Sets the flags of the entry.

Parameters

flags (int) – The flags of the entry (e.g., FastData).

Available since Cerbero Suite 7.1 and Cerbero Engine 4.1.

See also Flags().

SetName(name: str) → None

Sets the name of the entry.

Parameters

name (str) – The name of the entry.

See also Name().

SetPath(path: str) → None

Sets the full path of the entry.

Parameters

path (str) – The full path of the entry, including the file name.

Available since Cerbero Suite 7.1 and Cerbero Engine 4.1.

See also Path().

SetTime(ttype: int, t: Pro.Core.NTDateTime) → None

Sets a specific file time of the entry.

Parameters

• ttype (int) – The type of time to set (e.g., ModificationTime).

• t (NTDateTime) – The time to set.

See also Time().

SetType(type: int) → None

Sets the type of the entry.

Parameters

type (int) – The type to set (e.g., Directory).

See also Type().

Time(ttype: int) → Pro.Core.NTDateTime

Retrieves a specific file time of the entry.

Parameters

ttype (int) – The type of time to retrieve (e.g., ModificationTime).

Returns

Returns a valid NTDateTime if successful; otherwise returns an invalid NTDateTime instance.

Return type

NTDateTime

See also SetTime().

ToXML(sort: bool = True, include_data: bool = False) → str

Converts the entry to an XML string.

Parameters

• sort (bool) – If True, sorts the properties alphabetically.

• include_data (bool) – If True, includes the data of the entry encoded as base64.

Returns

Returns the XML string if successful; otherwise returns an empty string.

Return type

str

Type() → int

Returns

Returns the entry type (e.g., Directory).

Return type

int

See also SetType().

class CFSEntryInterface

This class represents a single file system entry.

Its method should never be called directly, but through CFSEntry.

Hint

All methods used to retrieve data in this class can be overridden. Alternatively, set methods can be used to set the data and thus removing the need to create a derived class that overrides get methods. The two approaches can also be combined. This design leaves to the developer the choice of how to use the interface.

Available since Cerbero Suite 7.0 and Cerbero Engine 4.0.

See also CFSEntry.

Methods:

AddProperty(name, value[, offset])	Adds a property to the entry.
Data([wo])	Retrieves the data associated with the entry.
DataOffset()	Returns the offset of the entry data if available; otherwise returns INVALID_STREAM_OFFSET.
DataSize()	Returns the size of the entry data if available; otherwise returns 0.
Flags()	Returns the flags of the entry (e.g., FastData).
HasData()	Returns True if entry data is available; otherwise returns False.
HasDataSize()	Returns True if entry data size is available; otherwise returns False.
Name()	Returns the entry name if available; otherwise returns an empty string.
Path()	Returns the full path of the entry, including the file name.
Property(name)	Retrieves a property of the entry.
PropertyCount()	Returns the number of properties available.
PropertyNames()	Returns the list of property names.
PropertyOffset(name)	Retrieves the offset of a property.
SetData(data)	Sets the data of the entry.
SetDataOffset(offset)	Sets the offset of the entry data.
SetDataSize(size)	Sets the size of the entry data.
SetFlags(flags)	Sets the flags of the entry.
SetName(name)	Sets the name of the entry.
SetPath(path)	Sets the full path of the entry.
SetTime(ttype, t)	Sets a specific file time of the entry.
SetType(type)	Sets the type of the entry.
Time(ttype)	Retrieves a specific file time of the entry.
Type()	Returns the entry type (e.g., Directory).

AddProperty(name: str, value: Optional[Union[int, float, bool, bytes, str]], offset: int = INVALID_STREAM_OFFSET) → None

Adds a property to the entry.

Parameters

• name (str) – The name of the property.

• value (BasicType) – The value of the property.

• offset (int) – The optional offset of the property.

See also Property(), PropertyCount() and PropertyNames().

Data(wo: Optional[Pro.Core.NTIWait] = None) → Pro.Core.NTContainer

Retrieves the data associated with the entry.

Parameters

wo (NTIWait) – The optional wait operation for the retrieval of the data.

Returns

Returns a valid NTContainer if successful; otherwise returns an invalid NTContainer.

Return type

NTContainer

See also SetData(), DataOffset(), DataSize() and HasData().

DataOffset() → int

Returns

Returns the offset of the entry data if available; otherwise returns INVALID_STREAM_OFFSET.

Return type

int

See also Data(), SetData(), DataSize() and HasData().

DataSize() → int

Returns

Returns the size of the entry data if available; otherwise returns 0.

Return type

int

Note

The size of the entry data is returned only when set previously using SetDataSize(). This method will not internally call Data() to return the size of the data.

See also HasDataSize(), SetDataSize(), DataOffset(), Data() and SetData().

Flags() → int

Returns

Returns the flags of the entry (e.g., FastData).

Return type

int

Available since Cerbero Suite 7.1 and Cerbero Engine 4.1.

See also SetFlags().

HasData() → bool

Returns

Returns True if entry data is available; otherwise returns False.

Return type

bool

See also Data(), SetData(), DataOffset() and DataSize().

HasDataSize() → bool

Returns

Returns True if entry data size is available; otherwise returns False.

Return type

bool

See also DataSize(), DataOffset(), Data(), SetData() and HasData().

Name() → str

Returns

Returns the entry name if available; otherwise returns an empty string.

Return type

str

See also SetName().

Path() → str

Returns

Returns the full path of the entry, including the file name.

Return type

str

Available since Cerbero Suite 7.1 and Cerbero Engine 4.1.

See also SetPath().

Property(name: str) → Optional[Union[int, float, bool, bytes, str]]

Retrieves a property of the entry.

Parameters

name (str) – The name of the property to retrieve.

Returns

Returns the property value if successful; otherwise returns None.

Return type

BasicType

See also PropertyCount(), PropertyNames(), AddProperty() and PropertyOffset().

PropertyCount() → int

Returns

Returns the number of properties available.

Return type

int

See also Property(), PropertyNames(), AddProperty() and PropertyOffset().

PropertyNames() → Pro.Core.NTStringList

Returns

Returns the list of property names.

Return type

NTStringList

See also Property(), PropertyCount(), AddProperty() and PropertyOffset().

PropertyOffset(name: str) → int

Retrieves the offset of a property.

Parameters

name (str) – The name of the property.

Returns

Returns the of offset of the property if available; otherwise returns INVALID_STREAM_OFFSET.

Return type

int

See also Property(), PropertyCount(), PropertyNames() and AddProperty().

SetData(data: Pro.Core.NTContainer) → None

Sets the data of the entry.

Parameters

data (NTContainer) – The data of the entry.

See also Data(), DataOffset(), DataSize() and HasData().

SetDataOffset(offset: int) → None

Sets the offset of the entry data.

Parameters

offset (int) – The offset of the entry data.

See also DataOffset(), DataSize(), Data() and SetData().

SetDataSize(size: int) → None

Sets the size of the entry data.

Parameters

size (int) – The size of the entry data.

See also DataOffset(), DataSize(), Data() and SetData().

SetFlags(flags: int) → None

Sets the flags of the entry.

Parameters

flags (int) – The flags of the entry (e.g., FastData).

Available since Cerbero Suite 7.1 and Cerbero Engine 4.1.

See also Flags().

SetName(name: str) → None