Pro.Core — Core API for parsing and scanning files

Overview

The Pro.Core module contains the core API for parsing and scanning files.

Core Concepts

Some of the most common important classes are:

  • NTContainer - This is a generic container used to encapsulate data such as files and memory. It’s an extremely important class and it’s used extensively. Containers can be created through SDK functions such as createContainerFromFile() and newContainer().

  • NTBuffer/NTContainerBuffer/CFFBuffer/etc. - These type of classes are used to efficiently read iteratively small amounts of data from a source. NTBuffer is the base class and derived classes are named after the object they read from. E.g.: NTContainerBuffer reads from NTContainer and CFFBuffer reads from CFFObject.

  • NTTextStream/NTTextBuffer/NTTextStringBuffer - These classes are used to output text. The amount of indentation can be specified. NTTextStream is the base class and derived classes are named after the output type: NTTextBuffer outputs to a utf-8 array and NTTextStringBuffer to a utf-16 array.

  • NTXml - Used to parse XML. This class is fast and secure. The code is based on RapidXML.

  • CFFObject - The class from which every format class is derived (ZipObject, PEObject, etc.). While NTContainer provides basic parsing facilities, more complex types and the use of CFFStruct rely upon CFFObject.

  • CFFHeader - Headers contain definition of structures and can be loaded from SQLite files or XML strings. The structures can be imported from C/C++ code through the Header Manager or from debug symbols such as PDB files.

  • CFFStruct - This class represents a data structure.

  • CFFFlags - This class represents the flags of a field in a CFFStruct.

Hint

If you’re wondering why the case convention for methods is not always the same, the reason is simple. Classes such as CFFObject and CFFStruct are based on older code which followed the pascal-case convention. Consequently all derived classes like PEObject follow this convention. All other classes use the camel-case convention.

Basic types like integers and strings are automatically converted between C++ and Python. However, lists are preserved for efficiency reasons. Whenever the signature of a method contains a list or another type of container class, you must work with the C++ class. For example, the following example creates a list of C++ integers and iterates through it:

from Pro.Core import *

l = NTIntList()
for i in range(10):
    l.append(i)
it = NTIntListIt(l)
while it.hasNext():
    print(it.next())

Lists, vectors, hashes and sets all have specialized C++ classes usually relying on Qt containers. These type of classes are easily recognized due to the naming convention.

Note

While in C++ these classes are implemented as template classes, in Python they are exposed as different types. However, NTIntList will have exactly the same methods as NTStringList.

Parsing Files

Printing out a structure in a file can be as simple as:

from Pro.Core import *
from Pro.PE import *

def printDOSHeader(fname):
    c = createContainerFromFile(fname)
    if c.isNull():
        return
    pe = PEObject()
    if not pe.Load(c):
        return
    out = NTTextBuffer()
    pe.DosHeader().Dump(out) # CFFStruct.Dump
    print(out.buffer)

Warning

Avoid initializing NTContainer and CFFObject objects globally in order to avoid memory leaks!

If you really need to use a global object, make sure to set it to None when it is no longer needed. This way, the garbage collector will release the allocated memory.

NTContainer is a powerful abstraction for reading from a target. The target can be a memory buffer, a file or even the memory of a remote process. When NTContainer objects are returned by calling functions like createContainerFromFile() or newContainer(), they may either encapsulate a file or a memory buffer. Whether to use a file or a memory buffer is internally decided upon the basis of current memory resources.

If you want to make sure that an NTContainer instance encapsulates a memory buffer you can do it by specifically setting its internal object:

from Pro.Core import *

c = NTContainer()
# set a byte array as the internal object of NTContainer
c.setData(b"")
# NTContainer are never resizeable by default
c.setResizable(True)
# append some data
c.append(b"foo")
# print out the size of 3
print(c.size())

Ranges and address spaces can also be applied to NTContainer. Consider the following example:

from Pro.Core import *

c = NTContainer()
c.setData(b"Hello, world!")
# increase the reference count of c
c2 = c.clone()
# set a new range for c2
c2.setRange(7, 5)
# prints out "Hello, world!"
print(c.read(0, c.size()).decode("utf-8"))
# prints out "world"
print(c2.read(0, c2.size()).decode("utf-8"))

The c2 instance refers to the same object as c but with a different range. This is very useful when working with embedded objects. For instance, parsing a resource inside of a binary file might only require setting the range on an instance NTContainer of the parent binary file, before being passed onto CFFObject.Load().

It is not necessary to subclass CFFObject in order parse a file. We can use CFFObject directly:

from Pro.Core import *

xml_header = """<header>

<r id='_IMAGE_DOS_HEADER' type='struct'>
  <f id='e_magic' type='unsigned short'/>
  <f id='e_cblp' type='unsigned short'/>
  <f id='e_cp' type='unsigned short'/>
  <f id='e_crlc' type='unsigned short'/>
  <f id='e_cparhdr' type='unsigned short'/>
  <f id='e_minalloc' type='unsigned short'/>
  <f id='e_maxalloc' type='unsigned short'/>
  <f id='e_ss' type='unsigned short'/>
  <f id='e_sp' type='unsigned short'/>
  <f id='e_csum' type='unsigned short'/>
  <f id='e_ip' type='unsigned short'/>
  <f id='e_cs' type='unsigned short'/>
  <f id='e_lfarlc' type='unsigned short'/>
  <f id='e_ovno' type='unsigned short'/>
  <f id='e_res' type='unsigned short [4]'/>
  <f id='e_oemid' type='unsigned short'/>
  <f id='e_oeminfo' type='unsigned short'/>
  <f id='e_res2' type='unsigned short [10]'/>
  <f id='e_lfanew' type='int'/>
</r>

</header>"""

def printStructure(fname):
    c = createContainerFromFile(fname)
    if c.isNull():
        return
    # load header from an XML string
    header = CFFHeader()
    if not header.LoadFromXml(xml_header):
        return
    obj = CFFObject()
    # since CFFObject is not subclassed, the Load method cannot fail
    obj.Load(c)
    # map a structure to a specific offset
    offset = 0
    s = obj.MakeStruct(header, "_IMAGE_DOS_HEADER", offset, CFFSO_VC | CFFSO_Pack1)
    out = NTTextBuffer()
    s.Dump(out)
    print(out.buffer)

To read in a buffered way from a target object, be it CFFObject or NTContainer, you can use NTBuffer derived classes such as NTContainerBuffer and CFFBuffer:

from Pro.Core import *

def bufferedRead(fname):
    c = createContainerFromFile(fname)
    if c.isNull():
        return
    obj = CFFObject()
    obj.Load(c)
    offset = 0
    r = obj.ToBuffer(offset)
    try:
        # read a single byte from the file
        b = r.u8()
    except IndexError:
        print("error: out of range")

By default buffered readers default to Bufferize_Forwards. If you want to read backwards or back and forth you can specify Bufferize_Backwards or Bufferize_BackAndForth respectively.

The default endianness can be specified both for CFFObject and NTBuffer instances. If not specified, endianness will default to ENDIANNESS_LITTLE.

If need to parse an XML string, you can use our NTXml class, which is both fast and secure.

from Pro.Core import *

x = NTXml()
ret = x.parse("<r><e t='test'></e></r>")
if ret == NTXml_ErrNone:
    n = x.findChild(None, "r")
    if n != None:
        n = x.findChild(n, "e")
        if n != None:
            a = x.findAttribute(n, "t")
            if a != None:
                print(x.value(a))

All the filters which are available in the UI can be used programmatically from the SDK.

from Pro.Core import *

c = NTContainer()
c.setData(b"Hello, world!")
# compress data with zlib
fstr = "<flts><f name='pack/zlib' level='9' raw='true'/></flts>"
# set the last parameter to False to hide the wait-box
c = applyFilters(c, fstr, True)
# print out the compressed data
print(c.read(0, c.size()))

By using filters it’s possible to perform complex data operations with just a few lines of code. In the code snippet above we use a filter to compress the input data using zlib.

Scanning Files

In this section we offer an introduction into the internals of our scan engine.

The core classes are:

  • Report - This class represents a project. A project can be unpacked or packed. When it’s unpacked, it consists of a directory containing a number of DBs and other files. When it’s packed, the same files are merged into a single file and may be compressed and/or encrypted. Fundamentally, in the context of file scanning, a project contains a SQLite3 database which, in turn, contains XML reports for each scanned file. The current instance of this class is returned by ProCoreContext.getReport().

  • ScanProvider - This is the base class inherited by all the scan engines for the different file formats.

  • ScanEntryData - This is the class that contains the data passed to ScanProvider.addEntry(). Every time a scan provider for a file format encounters a threat, warning, information, privacy issue or embedded file, it calls ScanProvider.addEntry().

  • FormatTree - A tree of uint32 ids that describe the layout structure of the analyzed file. This is the layout shown in the format view in the analysis workspace.

  • FormatItemInfo - The information returned for each individual item in the format tree. ScanProvider._formatViewInfo() returns this information based on the id provided when constructing the FormatTree.

  • ScanViewData - This class is returned by ScanProvider._scanViewData() and ScanProvider._formatViewData(). It may represent raw data, in case of an embedded file, as well as a complex UI.

  • CommonSystem - Logic providers return classes derived from this class to define a scanning behaviour. For instance, when creating a logic provider which analyzes only a specific set of files in a directory or on a file system, the derived class LocalSystem can be used.

  • ProCoreContext - Provides context information like the current scan provider (ProCoreContext.currentScanProvider()) or the current report (ProCoreContext.getReport()). The global instance of this class is returned by proCoreContext().

As mentioned, for every scanned file an XML report is generated. Below is the commented schema of these XML reports.

<!-- XML schema

note: attributes are marked by parenthesis

o = object
 (t = type
  u = current entry unique id (in hex)
  s = target (base64)
  r = risk
  f = flags)

s = scan entries
  t = threat
  w = warning
  i = info
   (t = type
    u = unique identifier for the entry (in hex)
    f = flags (optional)
    s = target (optional, for embedded files)(base64)
    l = object format (for embedded files)
    )
   (- ic = indirect category
      it = indirect type
    - fi = format item id
    v  = view
    of = offset
    sz = size)
    d = data (mandatory)
  extra:
    t = text
    flts = filters
      f = filter
        (name + params)
    s = shellcode
      (a = arch
       b = base address
       )

e = embedded objects
  o = object (see above)

h = hashes
  md5 = md5 hash
  etc.

m = metadata
 (ct = creation time
  mt = modification time
  at = access time
  )
  e = entry (content is base64 encoded)
   (id = name identifying the entry (raw)
    l = label (base64)
    f = flags (1 for text to show in report)
    )

<!-- sample -->
<o t="pe" s="C:/file" r="100">

  <!-- scan entries -->
  <s>

    <!-- threat entry -->
    <t t="5" u="0">

      <!-- custom data for the current entry, this is handled by
           the specific scan provider -->
      <d>
        <start>0</start>
        <size>1000</size>
      </d>

      <!-- human readable text (for showing advanced infos)
           encoded in utf8->base64 -->
      <t></t>

      <!-- filters applied on the retrieved data -->
      <flts>
        <f n="aes" p="cbc;256" k="11223344.." />
        <f n="z" />
      </flts>

    </t>

  </s>

  <!-- what follows is a list of embedded objects
       in the same order of the embedded file entries -->
  <e>
    <o t="pdf" r="70">
      <!-- ... -->
    </o>
  </e>

  <!-- various hashes (if any) stored for the current object -->
  <h>
   <md5>00000000000000..</md5>
   <sha1>000000000000...</sha1>
  </h>

  <!-- metadata (if any) -->
  <m ct="hex" wt="hex" at="hex">
    <e>base64</e>
    <e f=1>base64</e> <!-- will be shown as text in the report view -->
  </m>


</o>

The important part to understand when working with the SDK is the custom data mentioned in the schema (the <d> node). This is the custom XML data which is provided by the ScanProvider during the scanning process via ScanProvider.addEntry() and is then passed back to ScanProvider._scanViewData() when requesting data relative to a scan entry.

The data returned from a scan entry can be everything: from a simple description of a threat to an embedded file. In fact, ScanProvider._scanViewData() can return even complex UIs or native code disassembled by our Carbon engine.

Module API

Pro.Core module API.

Bufferize_BackAndForth: Final[int]

Buffering method for NTBuffer. To use when reading in both directions.

Bufferize_Backwards: Final[int]

Buffering method for NTBuffer. To use when reading backwards.

Bufferize_Forwards: Final[int]

Buffering method for NTBuffer. To use when reading forwards.

Bufferize_Invalid: Final[int]

Buffering method for NTBuffer. Only used for uninitialized instances.

See also NTBuffer.isNull().

class CFFBuffer(object: Pro.Core.CFFObject, offset: int, method: int = Bufferize_Forwards)

Bases: Pro.Core.NTBuffer

This class provides buffered read capability for CFFObject.

Parameters
  • object (CFFObject) – The object to read from.

  • offset (int) – The start offset to read from.

  • method (int) – The buffering method to use. Defaults to Bufferize_Forwards.

See also CFFObject.ToBuffer(), NTBuffer and NTContainerBuffer.

class CFFContainer

Bases: Pro.Core.NTContainer

This is a derived class from NTContainer which can reference data as CFFObject and CFFStruct.

See also NTContainer(), NTContainerBuffer and NTAddressSpace.

Object: Final[int]

Type of data internally referenced by the container.

See also NTContainer.dataType().

Struct: Final[int]

Type of data internally referenced by the container.

See also NTContainer.dataType().

setData(data: Union[CFFObject, CFFStruct, NTContainer, NT_FILE, bytes, int, str], own_or_size: Union[bool, int] = True)None

See NTContainer.setData().

toObject()Pro.Core.CFFObject
Returns

Returns the internal CFFObject referenced by the container if the dataType() is Object; otherwise returns None.

Return type

CFFObject

See also NTContainer.dataType().

toStruct()Pro.Core.CFFStruct
Returns

Returns the internal CFFStruct referenced by the container if the dataType() is Struct; otherwise returns an invalid struct.

Return type

CFFStruct

See also NTContainer.dataType().

class CFFContext

This class is used internally by CFFStruct to store information from members which affect the position and size of other members.

See also CFFStruct.Context() and CFFStruct.SetContext().

set(key: int, val: int)None

Sets a value of the context.

Parameters
  • key (int) – The key of the value to store.

  • val (int) – The value.

See also value().

value(key: int)int

Retrieves a value from the context.

Parameters

key (int) – The key of the value to retrieve.

Returns

Returns the value of the context if present; otherwise returns 0.

Return type

int

See also set().

class CFFDB

This class creates a volatile tree structure that is either stored in memory or on disk.

Indexes for the tree can either be 32-bit (CFFDBIndexSize32) or 64-bit (CFFDBIndexSize64).

Every item in the tree has fixed-size data. If no data size is specified when creating the tree, the fixed data size will be the same as the index size.

This class does not support the removal of items from the tree.

AppendChild(parent: int = 0)int

Appends an item.

Parameters

parent (int) – The parent index of the item to append.

Returns

Returns the index of the added child item if successful; otherwise returns CFFDBInvalidIndex.

Return type

int

See also PrependChild() and InsertChild().

Children(index: int)int

Returns the number of children for the specified index.

Parameters

index (int) – The index of the item for which to retrieve the number of children.

Returns

Returns the number of children.

Return type

int

See also Position(), Parent() and Index().

Data(index: int)tuple

Retrieves the data of an item.

Parameters

index (int) – The index of the item for which to retrieve the data.

Returns

Returns a tuple containing the retrieved data and a boolean. The boolean value is True if successful; otherwise it is False.

Return type

tuple[bytes, bool]

See also SetData(), Data32() and Data64().

Data32(index: int)tuple

Retrieves the data of an item as a 32-bit value.

Parameters

index (int) – The index of the item for which to retrieve the data.

Returns

Returns a tuple containing the retrieved data value and a boolean. The boolean value is True if successful; otherwise it is False.

Return type

tuple[int, bool]

See also SetData32(), Data() and Data64().

Data64(index: int)tuple

Retrieves the data of an item as a 64-bit value.

Parameters

index (int) – The index of the item for which to retrieve the data.

Returns

Returns a tuple containing the retrieved data value and a boolean. The boolean value is True if successful; otherwise it is False.

Return type

tuple[int, bool]

See also SetData64(), Data() and Data32().

Index(pos: int, parent: int = 0)int

Returns the index of an item given its parent and it’s position relative to its siblings.

Parameters
  • pos (int) – The position of the item relative to its siblings.

  • parent (int) – The index of the parent item.

Returns

Returns the requested index if successful; otherwise returns CFFDBInvalidIndex.

Return type

int

See also Parent(), Position() and Children().

InsertChild(pos: int, parent: int = 0)int

Inserts an item given its parent and position relative to its siblings.

Parameters
  • pos (int) – The position of the item to insert relative to its siblings.

  • parent (int) – The index of the parent item.

Returns

Returns the index of the added child item if successful; otherwise returns CFFDBInvalidIndex.

Return type

int

See also InsertChildren(), AppendChild() and PrependChild().

InsertChildren(pos: int, count: int, parent: int = 0)bool

Inserts multiple items given their parent and position relative to their siblings.

Parameters
  • pos (int) – The position of the items to insert relative to their siblings.

  • count (int) – The number of items to insert.

  • parent (int) – The index of the parent item.

Returns

Returns True if successful; otherwise returns False.

Return type

bool

See also InsertChild(), AppendChild() and PrependChild().

IsNull()bool
Returns

Returns True if invalid; otherwise returns False.

Return type

bool

See also IsValid() and Open().

IsValid()bool
Returns

Returns True if valid; otherwise returns False.

Return type

bool

See also IsNull() and Open().

Next(current: int)int

Gets the next item in the tree.

This method enumerates parent and child items.

Parameters

current (int) – The current index.

Returns

Returns the index if successful; otherwise returns CFFDBInvalidIndex.

Return type

int

See also Previous().

Open(fixed_data_size: int = 0, idxsize: int = CFFDBIndexSize32)bool

Initializes a CFFDB.

Parameters
  • fixed_data_size (int) – The size of the data associated with each item. If 0, it defaults to the index size.

  • idxsize (int) – The index size.

Returns

Returns True if successful; otherwise returns False.

Return type

bool

See also IsValid() and IsNull().

Parent(index: int)int

Returns the parent of an item.

Parameters

index (int) – The index of the item for which to retrieve the parent.

Returns

Returns the parent index if successful; otherwise returns CFFDBInvalidIndex.

Return type

int

See also Index(), Position() and Children().

Position(index: int)int

Returns the position of an item relative to its siblings.

Parameters

index (int) – The index of the item for which to retrieve the relative position.

Returns

Returns the position if successful; otherwise returns CFFDBInvalidIndex.

Return type

int

See also Children(), Index() and Parent().

PrependChild(parent: int = 0)int

Prepends an item.

Parameters

parent (int) – The parent index of the item to prepend.

Returns

Returns the index of the added child item if successful; otherwise returns CFFDBInvalidIndex.

Return type

int

See also AppendChild() and InsertChild().

Previous(current: int)int

Gets the previous item in the tree.

This method enumerates parent and child items.

Parameters

current (int) – The current index.

Returns

Returns the index if successful; otherwise returns CFFDBInvalidIndex.

Return type

int

See also Next().

SetData(index: int, value: bytes)bool

Sets the data of an item.

The size of value must match the size of the data specified when initializing the tree (See Open()).

Parameters
  • index (int) – The index of the item for which to set the data.

  • value (bytes) – The data to set.

Returns

Returns True if successful; otherwise returns False.

Return type

bool

See also Data(), SetData32() and SetData64().

SetData32(index: int, value: int)bool

Sets the data of an item as a 32-bit value.

Parameters
  • index (int) – The index of the item for which to set the data.

  • value (int) – The 32-bit value to set.

Returns

Returns True if successful; otherwise returns False.

Return type

bool

See also Data32(), SetData() and SetData64().

SetData64(index: int, value: int)bool

Sets the data of an item as a 64-bit value.

Parameters
  • index (int) – The index of the item for which to set the data.

  • value (int) – The 64-bit value to set.

Returns

Returns True if successful; otherwise returns False.

Return type

bool

See also Data64(), SetData() and SetData32().

CFFDBIndexSize32: Final[int]

32-bit index size for CFFDB.

See also CFFDB.

CFFDBIndexSize64: Final[int]

64-bit index size for CFFDB.

See also CFFDB.

CFFDBInvalidIndex: Final[int]

Invalid index for CFFDB.

See also CFFDB.

CFFDBRootIndex: Final[int]

Root index for CFFDB.

See also CFFDB.

class CFFFlags

This class contains flags and options for a member of CFFStruct.

Count()int
Returns

Returns the number of flags and options available.

Return type

int

See also Output(), Name() and IsFlag().

Description(i: int)str

Retrieves the description of a flag or option.

Parameters

i (int) – The index of the flag or option.

Returns

Returns the description if available; otherwise returns an empty string.

Return type

str

See also ShortDescription(), Name() and Value().

IsFlag(value: int, i_or_name: Union[int, str])bool

Checks if a flag or option is set in the input value.

Parameters
  • value (int) – The input value.

  • i_or_name (Union[int, str]) – The index or name of the flag or option.

Returns

Returns True if the flag or option is set in the input value; otherwise returns False.

Return type

bool

See also Output(), Name() and Value().

IsNull()bool
Returns

Returns True if the CFFFlags instance is invalid; otherwise returns False.

Return type

bool

See also IsValid().

IsOptionsOnly()bool
Returns

Returns True if the current CFFFlags instance contains only options and not flags; otherwise returns False.

Return type

bool

See also ValueDescription().

IsValid()bool
Returns

Returns True if the CFFFlags instance is valid; otherwise returns False.

Return type

bool

See also IsNull().

Name(i: int)str

Retrieves the name of a flag or option.

Parameters

i (int) – The index of the flag or option.

Returns

Returns the name of the flag or option if successful; otherwise returns an empty string.

Return type

str

See also Name() and Output().

Output(out: Pro.Core.NTTextStream, value: int, opt: int = 0, sep: Optional[str] = None)None

Outputs the flags and options set in the input value to a text stream .

Parameters
  • out (NTTextStream) – The text stream.

  • value (int) – The input value.

  • opt (int) – The output options. NTFlagOutput_IgnoreUnknown can be specified to ignore unknown flags.

  • sep (Optional[str]) – The separator for the output. Defaults to " | ".

See also NTTextStream and ShortDescription().

Position(name: str)int

Retrieves the position of a flag or option from its name.

Parameters

name (str) – The name of the flag or option.

Returns

Returns the index of the flag or option if successful; otherwise returns -1.

Return type

int

See also Name() and Value().

ShortDescription(i: int)str

Retrieves the short description of a flag or option.

Parameters

i (int) – The index of the flag or option.

Returns

Returns the short description if available; otherwise returns an empty string.

Return type

str

See also Description(), Name() and Value().

Type(i: Optional[int] = None)int

Retrieves the type of the CFFFlags instance or the type of one of its members.

Parameters

i (Optional[int]) – The index of the flag or option.

Returns

Returns the requested type if successful; otherwise returns 0.

Return type

int

See also Name() and Value().

Value(i: int)int

Retrieves the value of a flag or option.

Parameters

i (int) – The index of the flag or option.

Returns

Returns the value if successful; otherwise returns 0.

Return type

int

See also Name() and Description().

ValueDescription(value: int)str

Retrieves the description for the input value.

This method works only if the CFFFlags instance contains only options (See IsOptionsOnly()).

Parameters

value (int) – The input value.

Returns

Returns the value description if successful; otherwise returns an empty string.

Return type

str

See also IsOptionsOnly() and Output().

class CFFHeader

This class represents a header.

Headers contain definition of structures and can be loaded from SQLite files or XML strings. The structures can be imported from C/C++ code through the Header Manager or from debug symbols such as PDB files.

Important

Editing is supported only for SQLite-backed headers.

Example:

from Pro.Core import *

xml_header = """<header>

<r id='_IMAGE_DOS_HEADER' type='struct'>
  <f id='e_magic' type='unsigned short'/>
  <f id='e_cblp' type='unsigned short'/>
  <f id='e_cp' type='unsigned short'/>
  <f id='e_crlc' type='unsigned short'/>
  <f id='e_cparhdr' type='unsigned short'/>
  <f id='e_minalloc' type='unsigned short'/>
  <f id='e_maxalloc' type='unsigned short'/>
  <f id='e_ss' type='unsigned short'/>
  <f id='e_sp' type='unsigned short'/>
  <f id='e_csum' type='unsigned short'/>
  <f id='e_ip' type='unsigned short'/>
  <f id='e_cs' type='unsigned short'/>
  <f id='e_lfarlc' type='unsigned short'/>
  <f id='e_ovno' type='unsigned short'/>
  <f id='e_res' type='unsigned short [4]'/>
  <f id='e_oemid' type='unsigned short'/>
  <f id='e_oeminfo' type='unsigned short'/>
  <f id='e_res2' type='unsigned short [10]'/>
  <f id='e_lfanew' type='int'/>
</r>

</header>"""

def printStructure(fname):
    c = createContainerFromFile(fname)
    if c.isNull():
        return
    # load header from an XML string
    header = CFFHeader()
    if not header.LoadFromXml(xml_header):
        return
    obj = CFFObject()
    # since CFFObject is not subclassed, the Load method cannot fail
    obj.Load(c)
    # map a structure to a specific offset
    offset = 0
    s = obj.MakeStruct(header, "_IMAGE_DOS_HEADER", offset, CFFSO_VC | CFFSO_Pack1)
    out = NTTextBuffer()
    s.Dump(out)
    print(out.buffer)

See also CFFStruct and CFFObject.

AC_Define: Final[int]

Alias category for a definition.

AC_Enum: Final[int]

Alias category for an enumerator.

AC_Last: Final[int]

Alias category terminator.

AVT_Integer: Final[int]

Alias integer value type.

AVT_Last: Final[int]

Alias terminator value type.

AVT_Real: Final[int]

Alias floating point value type.

AVT_String: Final[int]

Alias string value type.

BeginEdit()None

Begins an SQLite transaction.

See also EndEdit() and InsertStruct().

Close()None

Clears the current instance.

See also LoadFromFile() and LoadFromXml().

EndEdit()None

Ends an SQLite transaction.

See also BeginEdit() and InsertStruct().

Equals(s: Pro.Core.CFFHeader)bool

Checks whether two headers reference the same internal data.

Parameters

s (CFFHeader) – The other header.

Returns

Returns True if the two headers reference the same internal data; otherwise returns False.

Return type

bool

static GetACName(category: int)str

Retrieves the alias category name.

Parameters

category (int) – The alias category.

Returns

Returns the name of the alias category if successful; otherwise returns an empty string.

Return type

str

See also GetAVTName().

static GetAVTName(vtype: int)str

Retrieves the alias value type name.

Parameters

vtype (int) – The alias value type.

Returns

Returns the name of the alias value type if successful; otherwise returns an empty string.

Return type

str

See also GetACName().

GetAliasCount()int
Returns

Returns the number of alias in the header.

Return type

int

See also GetAliasData() and InsertAlias().

GetAliasData(i: int)Pro.Core.CFFHeaderAliasData

Retrieves the data for an alias.

Parameters

i (int) – The index of the alias.

Returns

Returns the data of the alias if successful; otherwise returns an empty data structure.

Return type

CFFHeaderAliasData

See also GetAliasCount() and InsertAlias().

GetSQLiteDB()sqlite3
Returns

Returns the SQLite handle if the header is backed by SQLite internally; otherwise returns None.

Return type

sqlite3

GetStructBaseData(i: int)Pro.Core.CFFHeaderStructData

Retrieves the basic data of a structure.

The difference with GetStructData() is that the XML schema of the structure is not retrieved. Therefore, this method is a bit faster.

Parameters

i (int) – The index of the structure.

Returns

Returns the data of the structure if successful; otherwise returns an empty data structure.

Return type

CFFHeaderStructData

See also GetStructData(), GetStructCount() and InsertStruct().

GetStructCount()int
Returns

Returns the number of structures in the header.

Return type

int

See also GetStructData() and InsertStruct().

GetStructData(i_or_name: Union[int, str])Pro.Core.CFFHeaderStructData

Retrieves the data of a structure.

Parameters

i_or_name (Union[int, str]) – The name or the index of the structure.

Returns

Returns the data of the structure if successful; otherwise returns an empty data structure.

Return type

CFFHeaderStructData

See also GetStructBaseData(), GetStructCount() and InsertStruct().

GetTypeDefCount()int
Returns

Returns the number of type definitions in the header.

Return type

int

See also GetTypeDefData() and InsertTypeDef().

GetTypeDefData(i: int)Pro.Core.CFFHeaderTypeDefData

Retrieves the data of a type definition.

Parameters

i (int) – The index of the type definition.

Returns

Returns the data of the type definition if successful; otherwise returns an empty data structure.

Return type

CFFHeaderTypeDefData

See also GetTypeDefCount() and InsertTypeDef().

InsertAlias(name: str, category: int, type: str, vtype: int, value: str)None

Inserts or replaces an alias in the header file.

This method is supported only by SQLite-backed header files.

Parameters
  • name (str) – The name of the alias.

  • category (int) – The category of the alias.

  • type (str) – The type of the alias.

  • vtype (int) – The value type of the alias.

  • value (str) – The value of the alias.

See also GetAliasData() and GetAliasCount().

InsertStruct(schema: str)None

Inserts or replaces a structure in the header file.

This method is supported only by SQLite-backed header files.

Parameters

schema (str) – The XML schema of the structure.

See also GetStructData() and GetStructCount().

InsertTypeDef(name: str, type: str)None

Inserts or replaces a type definition in the header file.

This method is supported only by SQLite-backed header files.

Parameters
  • name (str) – The name of the type definition.

  • type (str) – The type definition.

See also GetTypeDefData() and GetTypeDefCount().

IsModified()bool
Returns

Returns True if the header was modified; otherwise returns False.

Return type

bool

See also SetModified().

IsNull()bool
Returns

Returns True if the header is invalid; otherwise returns False.

Return type

bool

See also IsValid().

IsValid()bool
Returns

Returns True if the header is valid; otherwise returns False.

Return type

bool

See also IsNull().

LoadFromFile(name: str)bool

Loads a header file from an SQLite database.

Parameters

name (str) – The name of the header file.

Returns

Returns True if successful; otherwise returns False.

Return type

bool

See also LoadFromXml().

LoadFromXml(xml: Union[Pro.Core.NTXml, str])bool

Initializes a header instance from XML data.

Parameters

xml (Union[NTXml, str]) – Either an XML string or an NTXml instance.

Returns

Returns True if successful; otherwise returns False.

Return type

bool

See also LoadFromFile().

SetModified(b: bool)None

Sets the modified status for the header file.

Parameters

b (bool) – If True, the header file is marked as modified.

See also IsModified().

class CFFHeaderAliasData

Alias data of a header file.

See also CFFHeader.

category

The category of the alias.

name

The name of the alias.

type

The type of the alias.

value

The value of the alias.

vtype

The value type of the alias.

class CFFHeaderStructData

Structure data of a header file.

See also CFFHeader.

name

The name of the structure.

schema

The XML schema of the structure.

type

The type of the structure.

class CFFHeaderTypeDefData

Type definition data of a header file.

See also CFFHeader.

name

The name of the type definition.

type

The type definition.

CFFN_Base: Final[int]

Base value for standard CFFObject notifications.

See also CFFObject.Notify().

CFFN_Malformed: Final[int]

CFFObject notification for malformed data.

See also CFFObject.Notify().

CFFN_MoreFiles: Final[int]

CFFObject notification for the file limit.

See also CFFObject.Notify().

CFFN_NoDecrypt: Final[int]

CFFObject notification for failed decryption.

See also CFFObject.Notify().

CFFN_NoUnpack: Final[int]

CFFObject notification for failed decompression.

See also CFFObject.Notify().

CFFN_ParsingLimit: Final[int]

CFFObject notification for an internal parsing limit.

See also CFFObject.Notify().

CFFN_Recursive: Final[int]

CFFObject notification for recursion.

See also CFFObject.Notify().

CFFN_UnpackLimit: Final[int]

CFFObject notification for the decompression limit.

See also CFFObject.Notify().

CFFN_UnpackNestLimit: Final[int]

CFFObject notification for the decompression nesting limit.

See also CFFObject.Notify().

class CFFObject

The class from which every format class is derived (ZipObject, PEObject, etc.).

The internal data of a CFFObject is an NTContainer (See Load()).

See also NTContainer, CFFStruct, CFFHeader and CFFBuffer.

AdjustSign(type: int, num: int)int

Makes the input number negative if the last bit is set and the input type is an integer.

Parameters
  • type (int) – The input type.

  • num (int) – The input number.

Returns

Returns the adjusted number.

Return type

int

Align(AlignConst: int)bool

Aligns the object to the specified size.

Parameters

AlignConst (int) – The alignment.

Returns

Returns True if successful; otherwise returns False.

Return type

bool

See also NTContainer.align() and Shift().

AppendTo(nStartOffset: int, nLenght: int, pDst: Pro.Core.NTContainer)bool

Appends part of this object to a container.

Parameters
  • nStartOffset (int) – The offset of the range to append.

  • nLenght (int) – The size of the range to append.

  • pDst (NTContainer) – The destination container.

Returns

Returns True if successful; otherwise returns False.

Return type

bool

See also NTContainer.appendTo().

Compare(offset: int, bytes_or_uSize: Union[bytes, int], b: Optional[int] = None)bool

Compares the specified data to the one in the object.

Parameters
  • offset (int) – The start offset for the comparison.

  • bytes_or_uSize (Union[bytes, int]) – Either the data to compare or the size to compare.

  • b (Optional[int]) – If the previous parameter is the size to compare, this parameter is the byte which to compare the data to.

Returns

Returns True if the data matches; otherwise returns False.

Return type

bool

See also NTContainer.compare().

CopyFrom(Src: Pro.Core.NTContainer, nDstOffset: int, nLenght: int, nSrcStartOffset: int = 0)bool

Copies data from a container to the object.

Parameters
  • Src (NTContainer) – The container from which to copy the data.

  • nDstOffset (int) – The offset at which to copy the data.

  • nLenght (int) – The size of the data to copy.

  • nSrcStartOffset (int) – The offset from which to copy the data in the container.

Returns

Returns True if successful; otherwise returns False.

Return type

bool

See also NTContainer.copyTo().

CopyTo(nStartOffset: int, nLenght: int, pDst: Pro.Core.NTContainer, nDstStartOffset: int = 0)bool

Copies a part of the object to a container.

Parameters
  • nStartOffset (int) – The offset of the data to copy.

  • nLenght (int) – The size of the data to copy.

  • pDst (NTContainer) – The destination container.

  • nDstStartOffset (int) – The offset at which to write the data to in the destination container.

Returns

Returns True if successful; otherwise returns False.

Return type

bool

See also NTContainer.copyTo().

Fill(offset: int, c: int, uSize: int)bool

Fills a portion of the object with the specified byte.

Parameters
  • offset (int) – The offset of the range to fill.

  • c (int) – The 8-bit value used for the fill operation.

  • uSize (int) – The size of the range to fill.

Returns

Returns True if successful; otherwise returns False.

Return type

bool

See also NTContainer.fill().

GetDefaultEndianness()int
Returns

Returns the default endianness of the object (ENDIANNESS_LITTLE or ENDIANNESS_BIG).

Return type

int

See also SetDefaultEndianness().

GetDefaultStructOptions()int
Returns

Returns the default options for CFFStruct instances created from this object (e.g., CFFSO_Pack1).

Return type

int

See also SetDefaultStructOptions().

GetMappingAddress()int
Returns

Returns the address at which this object is mapped if available; otherwise returns INVALID_STREAM_OFFSET.

Return type

int

See also IsMapped() and SetMappingAddress().

GetMemoryUnpackLimit()int
Returns

Returns the maximum amount of bytes which can be allocated for in-memory decompression algorithms.

Return type

int

See also SetMemoryUnpackLimit().

GetObjectFormatName()str
Returns

Returns the file format name of the object if available; otherwise returns an empty string.

Return type

str

See also SetObjectFormatName().

GetObjectGenericFormatName()str
Returns

Returns the generic format name of the object if available; otherwise returns an empty string (e.g., the generic format name of HTML is XML).

Return type

str

See also SetObjectGenericFormatName().

GetObjectName()str
Returns

Returns the name of the object if available; otherwise returns an empty string.

Return type

str

See also SetObjectName().

GetObjectTypeName()str
Returns

Returns the type name of the object if available; otherwise returns an empty string.

Return type

str

See also SetObjectTypeName().

GetSize()int
Returns

Returns the size of the internally referenced container.

Return type

int

See also NTContainer.resize() and SetSize().

GetSpecialData(key: str, defval: Pro.Core.NTContainer = NTContainer())Pro.Core.NTContainer

Retrieves special data associated to the object.

Parameters
  • key (str) – The key of the data to retrieve.

  • defval (NTContainer) – The value to return if key is not present.

Returns

Returns the requested data if present; otherwise returns the default return value.

Return type

NTContainer

See also SetSpecialData().

GetStream()Pro.Core.NTContainer
Returns

Returns the internally referenced container.

Return type

NTContainer

See also Load() and ReplaceStream().

GetTag()str
Returns

Returns the tag name set for debugging purposes if present; otherwise returns an empty string.

Return type

str

See also SetTag().

GetTypeName(Type: int)str

Returns the name of the specified type.

Parameters

Type (int) – The type for which to return the name.

Returns

Returns the type name if implemented; otherwise returns an empty string.

Return type

str

See also GetTypeNature().

GetTypeNature(Type: int)int

Returns the nature of the specified type.

Parameters

Type (int) – The type for which to return the nature.

Returns

Returns the nature of the type if successful; otherwise returns NATURE_UNKNOWN.

Return type

int

See also NATURE_BYTEARRAY, NATURE_NUMBER, NATURE_REAL and NATURE_STRING.

See also GetTypeName().

GetUnpackLimit()int
Returns

Returns the limit for decompression operations.

Return type

int

See also SetUnpackLimit().

GetUnpackNestingLimit()int
Returns

Returns the nesting limit for decompression operations.

Return type

int

See also SetUnpackNestingLimit().

IsMapped()bool
Returns

Returns True if the object has a mapping address; otherwise returns False.

Return type

bool

See also GetMappingAddress() and SetMappingAddress().

IsModified()bool
Returns

Returns True if the object was modified; otherwise returns False.

Return type

bool

See also Modified().

IsNull()bool
Returns

Returns True if the object is uninitialized; otherwise returns False.

Return type

bool

See also Load().

IsTypeDynamicPersistent(Type: int)bool

Checks whether a type is persistently dynamic.

This means that the size of the type is dependent on the underlying data.

Parameters

Type (int) – The type to check.

Returns

Returns True if the type is persistently dynamic; otherwise returns False.

Return type

bool

Load(Stream: Pro.Core.NTContainer)bool

Loads the object data.

In derived classes this method also checks the signature file format.

Parameters

Stream (NTContainer) – The data to load.

Returns

Returns True if the data is accepted; otherwise returns False.

Return type

bool

See also GetStream() and ReplaceStream().

MakeStruct(header: Pro.Core.CFFHeader, name: str, offset: int, options: Optional[int] = None)Pro.Core.CFFStruct

Returns a CFFStruct instance.

Parameters
  • header (CFFHeader) – The header from which to fetch the definition of the structure.

  • name (str) – The name of the structure to return.

  • offset (int) – The offset at which to load the structure.

  • options (Optional[int]) – The options for the layout of the structure (e.g., CFFSO_Pack1).

Returns

Returns a valid structure if successful; otherwise returns an invalid structure.

Return type

CFFStruct

See also MakeStructArray(), CFFStruct and CFFHeader.

MakeStructArray(header: Pro.Core.CFFHeader, name: str, offset: int, nentries: int, options: Optional[int] = None)Pro.Core.CFFStruct

Returns an array of CFFStruct.

Parameters
  • header (CFFHeader) – The header from which to fetch the definition of the structure.

  • name (str) – The name of the structure to return.

  • offset (int) – The offset at which to load the structure.

  • nentries (int) – The number of array entries.

  • options (Optional[int]) – The options for the layout of the structure (e.g., CFFSO_Pack1).

Returns

Returns a valid structure if successful; otherwise returns an invalid structure.

Return type

CFFStruct

See also MakeStruct(), CFFStruct and CFFHeader.

Modified(b: bool)None

Sets the modified status for the object.

Parameters

b (bool) – If True, marks the object as modified; otherwise marks the object as unmodified.

See also IsModified().

NewContainer(size: int, reserve_size: int = 1024, max_size: int = 0)Pro.Core.NTContainer

Creates a new NTContainer object.

Whether the container will be using an internal memory buffer or a file on disk is decided on the basis of available memory resources at the time of the call.

Parameters
  • size (int) – The initial size of the container.

  • reserve_size (int) – The size to initially reserve for the container.

  • max_size (int) – The maximum size the container will ever reach. This is an optional parameter used to decide whether the container can operate on a memory buffer.

Returns

Returns the created container if successful; otherwise returns an invalid container.

Return type

NTContainer

See also newContainer() and NTContainer.

Notify(code: int)bool

Internally notifies the associated ScanProvider (if any) of a problem.

Parameters

code (int) – The notification code (e.g., CFFN_NoDecrypt).

Returns

Returns True if successful; otherwise returns False.

Return type

bool

See also ScanProvider.

Read(offset: int, uSize: int)bytes

Reads data from the object.

Parameters
  • offset (int) – The offset of the data to read.

  • uSize (int) – The size of the data to read.

Returns

Returns the data read if successful; otherwise return an empty bytes object.

Return type

bytes

See also Write().

ReadNumber(offset: int, type: int, endianness: int, is_signed: bool)tuple

Reads an integer from the object.

Parameters
  • offset (int) – The offset of the integer to read.

  • type (int) – The type of integer to read.

  • endianness (int) – The endianness of the integer (ENDIANNESS_LITTLE or ENDIANNESS_BIG).

  • is_signed (bool) – If True, the integer is treated as signed.

Returns

Returns a tuple containing the value read and a boolean. The boolean value is True if successful; otherwise it is False.

Return type

tuple[int, bool]

See also ReadUInt8(), ReadUInt16(), ReadUInt32() and ReadUInt64().

ReadUInt16(offset: int, endianness: Optional[int] = None)tuple

Reads an unsigned 16-bit integer from the object.

Parameters
Returns

Returns a tuple containing the value read and a boolean. The boolean value is True if successful; otherwise it is False.

Return type

tuple[int, bool]

See also WriteUInt16(), ReadUInt8(), ReadUInt32(), ReadUInt64() and ReadNumber().

ReadUInt16String(offset: int, maxlen: int, endianness: int)tuple

Reads an utf-16 array from the object.

The method stops when either a null terminator or maxlen is reached.

Parameters
  • offset (int) – The offset of the array to read.

  • maxlen (int) – The maximum length of the entry in characters.

  • endianness (int) – The endianness of the array (ENDIANNESS_LITTLE or ENDIANNESS_BIG).

Returns

Returns a tuple containing the array read and a boolean. The boolean value is True if successful; otherwise it is False.

Return type

tuple[str, bool]

See also ReadUInt8String() and ReadUInt32String().

ReadUInt32(offset: int, endianness: Optional[int] = None)tuple

Reads an unsigned 32-bit integer from the object.

Parameters
Returns

Returns a tuple containing the value read and a boolean. The boolean value is True if successful; otherwise it is False.

Return type

tuple[int, bool]

See also WriteUInt32(), ReadUInt8(), ReadUInt16(), ReadUInt64() and ReadNumber().

ReadUInt32String(offset: int, maxlen: int, endianness: int)tuple

Reads an utf-32 array from the object.

The method stops when either a null terminator or maxlen is reached.

Parameters
  • offset (int) – The offset of the array to read.

  • maxlen (int) – The maximum length of the entry in characters.

  • endianness (int) – The endianness of the array (ENDIANNESS_LITTLE or ENDIANNESS_BIG).

Returns

Returns a tuple containing the array read and a boolean. The boolean value is True if successful; otherwise it is False.

Return type

tuple[str, bool]

See also ReadUInt8String() and ReadUInt16String().

ReadUInt64(offset: int, endianness: Optional[int] = None)tuple

Reads an unsigned 64-bit integer from the object.

Parameters
Returns

Returns a tuple containing the value read and a boolean. The boolean value is True if successful; otherwise it is False.

Return type

tuple[int, bool]

See also WriteUInt64(), ReadUInt8(), ReadUInt16(), ReadUInt32() and ReadNumber().

ReadUInt8(offset: int)tuple

Reads an unsigned 8-bit integer from the object.

Parameters

offset (int) – The offset of the value to read.

Returns

Returns a tuple containing the value read and a boolean. The boolean value is True if successful; otherwise it is False.

Return type

tuple[int, bool]

See also WriteUInt8(), ReadUInt16(), ReadUInt32(), ReadUInt64() and ReadNumber().

ReadUInt8String(offset: int, maxlen: int)tuple

Reads an utf-8 array from the object.

The method stops when either a null terminator or maxlen is reached.

Parameters
  • offset (int) – The offset of the array to read.

  • maxlen (int) – The maximum length of the entry in bytes.

Returns

Returns a tuple containing the array read and a boolean. The boolean value is True if successful; otherwise it is False.

Return type

tuple[str, bool]

See also ReadUInt16String() and ReadUInt32String().

ReplaceStream(NewStream: Pro.Core.NTContainer)None

Replaces the internal data of the object.

Parameters

NewStream (NTContainer) – The new internal container for the object.

See also Load() and GetStream().

SetDefaultEndianness(nEndiannessType: int)None

Sets the default endianness for the object.

Parameters

nEndiannessType (int) – The default endianness for the object (ENDIANNESS_LITTLE or ENDIANNESS_BIG).

See also GetDefaultEndianness().

SetDefaultStructOptions(options: int)None

Sets the default options for CFFStruct instances created from this object (e.g., CFFSO_Pack1).

These options are used whenever options are not explicitly specified when calling MakeStruct() or MakeStructArray().

Parameters

options (int) – The default options.

See also GetDefaultStructOptions().

SetMappingAddress(mapping: int)None

Sets the address at which the object is mapped.

For instance, the mapping address is set for binaries loaded from a memory image.

Parameters

mapping (int) – The mapping address.

See also GetMappingAddress() and IsMapped().

SetMemoryUnpackLimit(limit: int)None

Sets the maximum amount of bytes which can be allocated for in-memory decompression algorithms.

Parameters

limit (int) – The limit in bytes.

See also GetMemoryUnpackLimit().

SetObjectFormatName(format: str)None

Sets the file format name of the object.

Parameters

format (str) – The file format name.

See also GetObjectFormatName().

SetObjectGenericFormatName(format: str)None

Sets the generic format name of the object (e.g., the generic format name of HTML is XML).

Parameters

format (str) – The generic format name.

See also GetObjectGenericFormatName().

SetObjectName(name: str)None

Sets the name of the object.

Parameters

name (str) – The object name.

See also GetObjectName().

SetObjectTypeName(type_name: str)None

Sets the type name of the object.

Parameters

type_name (str) – The object type name.

See also GetObjectTypeName().

SetSize(NewSize: int)bool

Resizes the internal data of the object.

Parameters

NewSize (int) – The new size of the data.

Returns

Returns True if successful; otherwise returns False.

Return type

bool

See also NTContainer.resizable() and GetSize().

SetSpecialData(key: str, value: Pro.Core.NTContainer)None

Sets special data associated to the object.

Parameters
  • key (str) – The key of the data to set.

  • value (NTContainer) – The data.

See also GetSpecialData().

SetTag(t: str)None

Sets the tag name of the object for debugging purposes

Parameters

t (str) – The tag name.

See also GetTag().

SetUnpackLimit(limit: int)None

Sets the limit for decompression operations.

Parameters

limit (int) – The limit in bytes.

See also GetUnpackLimit().

SetUnpackNestingLimit(limit: int)None

Sets the nesting limit for decompression operations.

Parameters

limit (int) – The limit.

See also GetUnpackNestingLimit().

Shift(uSize: int)bool

Appends uSize bytes at the end of the object data and sets them to zero.

Parameters

uSize (int) – The number of bytes to append.

Returns

Returns True if successful; otherwise returns False.

Return type

bool

See also NTContainer.shift() and Align().

ToBuffer(offset: int, method: int = Bufferize_Forwards)Pro.Core.CFFBuffer

Returns a CFFBuffer that reads from the object.

Parameters
  • offset (int) – The start offset.

  • method (int) – The buffering method to use. Defaults to Bufferize_Forwards.

Returns

Returns the CFFBuffer instance.

Return type

CFFBuffer

See also CFFBuffer.

ToUInt16(n: int)int

Applies the default endianness of the object to the 16-bit input integer.

The bytes of the integer will be inverted only if the default endianness of the object doesn’t match the endianness of the current platform.

Parameters

n (int) – The input integer.

Returns

Returns the inverted integer if the the default endianness of the object doesn’t match the endianness of the current platform; otherwise returns the input integer.

Return type

int

See also ToUInt32() and ToUInt64().

ToUInt32(n: int)int

Applies the default endianness of the object to the 32-bit input integer.

Parameters

n (int) – The input integer.

Returns

Returns the inverted integer if the the default endianness of the object doesn’t match the endianness of the current platform; otherwise returns the input integer.

Return type

int

See also ToUInt16() and ToUInt64().

ToUInt64(n: int)int

Applies the default endianness of the object to the 64-bit input integer.

Parameters

n (int) – The input integer.

Returns

Returns the inverted integer if the the default endianness of the object doesn’t match the endianness of the current platform; otherwise returns the input integer.

Return type

int

See also ToUInt16() and ToUInt32().

ValidRange(offset: int, Size: int)bool

Checks the validity of a range in the context of the object.

Parameters
  • offset (int) – The offset of the range to check.

  • Size (int) – The size of the range to check.

Returns

Returns True if the range is valid; otherwise returns False.

Return type

bool

See also NTContainer.validRange().

Write(offset: int, bytes_or_uSize: Union[bytes, int], bytes: Optional[bytes] = None)bool

Writes data to the object.

Parameters
  • offset (int) – The offset at which to write the data.

  • bytes_or_uSize (Union[bytes, int]) – Either the data to write or the number of bytes to write.

  • bytes (Optional[bytes]) – The data to write.

Returns

Returns True if successful; otherwise returns False.

Return type

bool

See also Read().

WriteUInt16(offset: int, n_or_nEndiannessType: int, n: Optional[int] = None)bool

Writes an unsigned 16-bit integer to the object.

Parameters
  • offset (int) – The offset at which to write the value.

  • n_or_nEndiannessType (int) – Either the value to write or the endianness (ENDIANNESS_LITTLE or ENDIANNESS_BIG) to use when writing the value. If the endianness is not specified, the value is written using the default endianness of the object.

  • n (Optional[int]) – The value to write.

Returns

Returns True if successful; otherwise returns False.

Return type

bool

See also ReadUInt16(), WriteUInt8(), WriteUInt32() and WriteUInt64().

WriteUInt32(offset: int, n_or_nEndiannessType: int, n: Optional[int] = None)bool

Writes an unsigned 32-bit integer to the object.

Parameters
  • offset (int) – The offset at which to write the value.

  • n_or_nEndiannessType (int) – Either the value to write or the endianness (ENDIANNESS_LITTLE or ENDIANNESS_BIG) to use when writing the value. If the endianness is not specified, the value is written using the default endianness of the object.

  • n (Optional[int]) – The value to write.

Returns

Returns True if successful; otherwise returns False.

Return type

bool

See also ReadUInt32(), WriteUInt8(), WriteUInt16() and WriteUInt64().

WriteUInt64(offset: int, n_or_nEndiannessType: int, n: Optional[int] = None)bool

Writes an unsigned 64-bit integer to the object.

Parameters
  • offset (int) – The offset at which to write the value.

  • n_or_nEndiannessType (int) – Either the value to write or the endianness (ENDIANNESS_LITTLE or ENDIANNESS_BIG) to use when writing the value. If the endianness is not specified, the value is written using the default endianness of the object.

  • n (Optional[int]) – The value to write.

Returns

Returns True if successful; otherwise returns False.

Return type

bool

See also ReadUInt64(), WriteUInt8(), WriteUInt16() and WriteUInt32().

WriteUInt8(offset: int, n: int)bool

Writes an unsigned 8-bit integer to the object.

Parameters
  • offset (int) – The offset at which to write the value.

  • n (int) – The value to write.

Returns

Returns True if successful; otherwise returns False.

Return type

bool

See also ReadUInt8(), WriteUInt16(), WriteUInt32() and WriteUInt64().

CFFPtrMaxSize: Final[int]

The maximum supported pointer size.

This value is reserved for future use.

See also CFFObject.

CFFPtrMinSize: Final[int]

The minimum supported pointer size.

This value is reserved for future use.

See also CFFObject.

CFFPtrSize16: Final[int]

16-bit pointer size.

This value is reserved for future use.

See also CFFObject.

CFFPtrSize32: Final[int]

32-bit pointer size.

This value is reserved for future use.

See also CFFObject.

CFFPtrSize64: Final[int]

64-bit pointer size.

This value is reserved for future use.

See also CFFObject.

CFFSO_Clang: Final[int]

This flag specifies that the structure was generated by the Clang compiler.

See also CFFObject.SetDefaultStructOptions() and CFFStruct.

CFFSO_CompilerMask: Final[int]

Compiler mask for the flags of the structure.

See also CFFObject.SetDefaultStructOptions() and CFFStruct.

CFFSO_EndianBig: Final[int]

This flag specifies that the structure is big-endian.

See also CFFObject.SetDefaultStructOptions() and CFFStruct.

CFFSO_EndianDefault: Final[int]

This flag specifies that the structure uses the default endianness.

See also CFFObject.SetDefaultStructOptions() and CFFStruct.

CFFSO_EndianLittle: Final[int]

This flag specifies that the structure is little-endian.

See also CFFObject.SetDefaultStructOptions() and CFFStruct.

CFFSO_EndiannessBig: Final[int]

This flag specifies that the structure is big-endian.

See also CFFObject.SetDefaultStructOptions() and CFFStruct.

CFFSO_EndiannessDefault: Final[int]

This flag specifies that the structure uses the default endianness.

See also CFFObject.SetDefaultStructOptions() and CFFStruct.

CFFSO_EndiannessLittle: Final[int]

This flag specifies that the structure is little-endian.

See also CFFObject.SetDefaultStructOptions() and CFFStruct.

CFFSO_EndiannessMask: Final[int]

Endianness mask for the flags of the structure.

See also CFFObject.SetDefaultStructOptions() and CFFStruct.

CFFSO_GCC: Final[int]

This flag specifies that the structure was generated by the GCC compiler.

See also CFFObject.SetDefaultStructOptions() and CFFStruct.

CFFSO_NoCompiler: Final[int]

This flag specifies that the structure wasn’t generated by a specific compiler.

See also CFFObject.SetDefaultStructOptions() and CFFStruct.

CFFSO_NoPlatform: Final[int]

This flag specifies that the structure isn’t bound to specific platform.

See also CFFObject.SetDefaultStructOptions() and CFFStruct.

CFFSO_Pack1: Final[int]

This flag specifies that the structure has an alignment of 1.

See also CFFObject.SetDefaultStructOptions() and CFFStruct.

CFFSO_Pack16: Final[int]

This flag specifies that the structure has an alignment of 16.

See also CFFObject.SetDefaultStructOptions() and CFFStruct.

CFFSO_Pack2: Final[int]

This flag specifies that the structure has an alignment of 2.

See also CFFObject.SetDefaultStructOptions() and CFFStruct.

CFFSO_Pack4: Final[int]

This flag specifies that the structure has an alignment of 4.

See also CFFObject.SetDefaultStructOptions() and CFFStruct.

CFFSO_Pack8: Final[int]

This flag specifies that the structure has an alignment of 8.

See also CFFObject.SetDefaultStructOptions() and CFFStruct.

CFFSO_PackMask: Final[int]

Alignment mask for the flags of the structure.

See also CFFObject.SetDefaultStructOptions() and CFFStruct.

CFFSO_PackNone: Final[int]

This flag specifies that the structure doesn’t have an alignment.

See also CFFObject.SetDefaultStructOptions() and CFFStruct.

CFFSO_PlatformMask: Final[int]

Platform mask for the flags of the structure.

See also CFFObject.SetDefaultStructOptions() and CFFStruct.

CFFSO_Pointer16: Final[int]

This flag specifies that the pointer size of the structure is 16-bits.

See also CFFObject.SetDefaultStructOptions() and CFFStruct.

CFFSO_Pointer32: Final[int]

This flag specifies that the pointer size of the structure is 32-bits.

See also CFFObject.SetDefaultStructOptions() and CFFStruct.

CFFSO_Pointer64: Final[int]

This flag specifies that the pointer size of the structure is 64-bits.

See also CFFObject.SetDefaultStructOptions() and CFFStruct.

CFFSO_PointerDefault: Final[int]

This flag specifies that the pointer size of the structure is the default one for the object.

See also CFFObject.SetDefaultStructOptions() and CFFStruct.

CFFSO_PointerMask: Final[int]

Pointer mask for the flags of the structure.

See also CFFObject.SetDefaultStructOptions() and CFFStruct.

CFFSO_VC: Final[int]

This flag specifies that the structure was generated by the Visual C++ compiler.

See also CFFObject.SetDefaultStructOptions() and CFFStruct.

CFFSO_Windows: Final[int]

This flag specifies that the structure was generated for the Windows platform.

See also CFFObject.SetDefaultStructOptions() and CFFStruct.

class CFFStruct

This class represents a data structure and references a CFFObject instance.

Instances of CFFStruct can be returned from CFFObject derived classes or by using CFFObject.MakeStruct() in combination with an instance of CFFHeader.

Example:

from Pro.Core import *
from Pro.PE import *

def printDOSHeader(fname):
    c = createContainerFromFile(fname)
    if c.isNull():
        return
    pe = PEObject()
    if not pe.Load(c):
        return
    out = NTTextBuffer()
    pe.DosHeader().Dump(out) # CFFStruct.Dump
    print(out.buffer)

See also CFFStruct, CFFHeader and CFFObject.MakeStruct().

Add(i: int)Pro.Core.CFFStruct

If the current instance represents an array of structures, this method changes which entry is currently referenced.

Parameters

i (int) – The iterator can be increased by a negative amount.

Returns

Returns the requested structure if within the limit of available entries; otherwise returns an invalid structure.

Return type

CFFStruct

See also At(), Count() and iterator().

At(i: int)Pro.Core.CFFStruct

Retrieves a specific structure among an array of structures.

Parameters

i (int) – The index of the structure to retrieve.

Returns

Returns the requested structure if within the limit of available entries; otherwise returns an invalid structure.

Return type

CFFStruct

See also Count(), At() and iterator().

Bytes(i_or_name: Union[int, str])bytes

Returns the byte-array representation of a member of the structure.

This method automatically handles the endianness of the requested data.

Parameters

i_or_name (Union[int, str]) – The index or name of the member of the structure.

Returns

Returns the requested data if successful; otherwise returns an empty bytes object.

Return type

bytes

See also Set(), Str(), Num() and Raw().

Context()Pro.Core.CFFContext
Returns

Returns the context helper class for the current structure.

Return type

CFFContext

See also SetContext().

Count()int
Returns

Returns the number of entries in the current array of structures.

Return type

int

See also SetCount(), At() and iterator().

Dump(out: Pro.Core.NTTextStream)bool

Outputs the members of the structure to a text stream according to their type nature.

Parameters

out (NTTextStream) – The text stream for the output.

Returns

Returns True if successful; otherwise returns False.

Return type

bool

See also NTTextStream.

Equals(s: Pro.Core.CFFStruct)bool

Checks whether two structures reference the same internal data.

Parameters

s (CFFStruct) – The other structure.

Returns

Returns True if the structure reference the same internal data; otherwise returns False.

Return type

bool

Fill(c_or_i_or_name: Union[int, str], c: Optional[int] = None)bool

Fills the entire structure or a member of it with a specified 8-bit value.

Parameters
  • c_or_i_or_name (Union[int, str]) – Either the 8-bit value used to fill the structure or the index or name of the member of the structure to fill.

  • c (Optional[int]) – The 8-bit value used to fill the member of the structure.

Returns

Returns True if successful; otherwise returns False.

Return type

bool

See also Zero().

Flags(i_or_name: Union[int, str])Pro.Core.CFFFlags

Returns the flags for a member of the structure.

Parameters

i_or_name (Union[int, str]) – The index or name of the member of the structure.

Returns

Returns a valid CFFFlags instance if successful; otherwise returns an invalid CFFFlags instance.

Return type

CFFFlags

See also HasFlags(), MembersWithFlags() and CFFFlags.

GetOffset()int
Returns

Returns the start offset of the structure.

Return type

int

See also Offset(), SetOffset() and Size().

HasDynamicSize()bool

Checks whether the structure contains members whose size depends upon the underlying data.

Note

In an array of dynamic structures every entry can potentially have a different size than the other entries. Knowing whether or not a structure is dynamic is important for optimization purposes: skipping multiple entries in an array of dynamic structures requires to read the data for each entry to perform the calculation (e.g., Add()).

Returns

Returns True if the structure contains members whose size depends upon the underlying data; otherwise returns False.

Return type

bool

See also Add() and At().

HasFlags(i_or_name: Optional[Union[int, str]] = None)bool

Checks whether at least one member or a specific member of the structure has flags associated with it.

Parameters

i_or_name (Optional[Union[int, str]]) – The index or name of the member of the structure.

Returns

Returns True if flags are available; otherwise returns False.

Return type

bool

See also Flags(), MembersWithFlags() and CFFFlags.

IsArray()bool
Returns

Returns True if the current instance represents an array of structures; otherwise returns False.

Return type

bool

See also Count() and MakeSingle().

IsFixed()bool
Returns

Returns True if the structures has a fixed size; otherwise returns False.

Return type

bool

IsNull()bool
Returns

Returns True if the structure is invalid; otherwise returns False.

Return type

bool

See also IsValid().

IsValid()bool
Returns

Returns True if the structure is valid; otherwise returns False.

Return type

bool

See also IsNull().

LongestMemberName()int
Returns

Returns the length of the longer member name of the structure.

Return type

int

See also MemberName().

MakeSingle()Pro.Core.CFFStruct

Converts an array of structure into a single structure.

Returns

Returns the currently referenced structure in the array as a single structure.

Return type

CFFStruct

See also IsArray() and Count().

MemberCount()int
Returns

Returns the number of members in the structure.

Return type

int

See also SetMemberCount().

MemberName(i: int)str

Retrieves the name of a member of the structure from its index.

Parameters

i (int) – The index of the member of the structure.

Returns

Returns the member name if successful; otherwise returns an empty string.

Return type

str

See also MemberPosition(), MemberOffset() and MemberSize().

MemberNature(i_or_name: Union[int, str])int

Retrieves the type nature of a member of the structure.

Parameters

i_or_name (Union[int, str]) – The index or name of the member of the structure.

Returns

Returns the type nature if successful; otherwise returns NATURE_UNKNOWN.

Return type

int

See also MemberName(), MemberOffset() and MemberSize().

MemberOffset(i_or_name: Union[int, str])int

Retrieves the offset of a member of the structure.

Parameters

i_or_name (Union[int, str]) – The index or name of the member of the structure.

Returns

Returns the offset if successful; otherwise returns INVALID_STREAM_OFFSET.

Return type

int

See also MemberName(), MemberSize() and MemberPosition().

MemberPosition(name: str)int

Retrieves the index of a member of the structure.

Parameters

name (str) – The name of the member of the structure.

Returns

Returns the index if successful; otherwise returns -1.

Return type

int

See also MemberName(), MemberOffset() and MemberSize().

MemberSize(i_or_name: Union[int, str])int

Retrieves the size of a member of the structure.

Parameters

i_or_name (Union[int, str]) – The index or name of the member of the structure.

Returns

Returns the size if successful; otherwise returns 0.

Return type

int

See also MemberOffset(), MemberName() and MemberPosition().

MemberType(i: int)int

Retrieves the type of a member of the structure.

Parameters

i (int) – The index or name of the member of the structure.

Returns

Returns the type if successful; otherwise returns 0xFFFFFFFFFFFFFFFF.

Return type

int

See also MemberTypeName(), MemberName(), MemberOffset() and MemberSize().

MemberTypeName(i: int)str

Retrieves the type name of a member of the structure.

Parameters

i (int) – The index or name of the member of the structure.

Returns

Returns the type name if successful; otherwise returns an empty string.

Return type

str

See also MemberType(), MemberName(), MemberOffset() and MemberSize().

MembersWithFlags()Pro.Core.NTIntList
Returns

Returns a list of indexes of those members in the structure which have flags.

Return type

NTIntList

See also HasFlags(), Flags() and CFFFlags.

Num(i_or_name: Union[int, str])int

Returns the numeric representation of a member of the structure.

Important

If the member to retrieve is an unsigned integer which doesn’t exceed 64 bit in size, then the slightly faster Uns() method can be used instead of Num().

This method automatically handles the endianness of the requested data.

Parameters

i_or_name (Union[int, str]) – The index or name of the member of the structure.

Returns

Returns the numeric value if successful; otherwise returns 0.

Return type

int

See also Set(), Uns(), Str(), Bytes() and Raw().

Object()Pro.Core.CFFObject
Returns

Returns the internally referenced object.

Return type

CFFObject

See also SetObject().

Offset()int
Returns

Returns the start offset of the structure.

Return type

int

See also GetOffset(), SetOffset() and Size().

Raw(i_or_name: Union[int, str])bytes

Returns the raw data of a member of the structure.

Parameters

i_or_name (Union[int, str]) – The index or name of the member of the structure.

Returns

Returns the requested data if successful; otherwise returns an empty bytes object.

Return type

bytes

See also SetRaw().

Set(i_or_name: Union[int, str], bytes_or_number_or_str: Union[bytes, int, str])bool

Sets a member of the structure.

This method automatically handles the endianness of the data to set.

Parameters
  • i_or_name (Union[int, str]) – The index or name of the member of the structure.

  • bytes_or_number_or_str (Union[bytes, int, str]) – The data to set. This value is automatically converted to the raw data.

Returns

Returns True if successful; otherwise returns False.

Return type

bool

See also Str(), Num(), Bytes() and Raw().

SetContext(ctx: Pro.Core.CFFContext)None

Sets the context helper class for the current structure.

Parameters

ctx (CFFContext) – The context helper class to set.

See also Context().

SetCount(n: int)None

Sets the number of entries in the array of structures.

Parameters

n (int) – The number of entries to set.

See also Count(), At() and iterator().

SetMemberCount(n: int)None

Sets the number of members that the structure has.

Note

This method can only reduce the number of members initially available in the structure and it’s used to adapt structures which have different number of members depending on a version or size field.

Parameters

n (int) – The number of members to set.

See also MemberCount().

SetObject(obj: Pro.Core.CFFObject)None

Sets the internally referenced object.

Parameters

obj (CFFObject) – The object to set.

See also Object().

SetOffset(o: int)None

Sets the start offset of the structure.

Parameters

o (int) – The start offset to set.

See also Offset(), GetOffset() and Size().

SetRaw(i_or_name: Union[int, str], bytes: bytes)bool

Sets the raw data of a member of the structure.

Parameters
  • i_or_name (Union[int, str]) – The index or name of the member of the structure.

  • bytes (bytes) – The raw data to set.

Returns

Returns True if successful; otherwise returns False.

Return type

bool

See also Raw().

Size()int
Returns

Returns the size of the structure.

Return type

int

See also TotalSize(), Offset() and GetOffset().

Str(i_or_name: Union[int, str], align_nums: bool = False)str

Returns the string representation of a member of the structure.

This method automatically handles the endianness of the requested data.

Parameters
  • i_or_name (Union[int, str]) – The index or name of the member of the structure.

  • align_nums (bool) – If True, aligns numbers using zero-padding.

Returns

Returns the string if successful; otherwise returns an empty string.

Return type

str

See also Set(), Num(), Bytes() and Raw().

StructName()str
Returns

Returns the name of the structure.

Return type

str

SubStruct(i_or_name: Union[int, str])Pro.Core.CFFStruct

Retrieves a sub-structure of the current structure.

This method is available only to fixed size structures.

Parameters

i_or_name (Union[int, str]) – The name or index of the sub-structure to retrieve.

Returns

Returns the sub-structure if successful; otherwise returns an invalid structure.

Return type

CFFStruct

See also IsFixed().

TotalSize()int
Returns

Returns the total size occupied by the array of structures.

Return type

int

See also Size(), Offset() and GetOffset().

Uns(i_or_name: Union[int, str])int

Returns the unsigned integer representation of a member of the structure.

Important

The maximum supported size for unsigned integers returned by this method is 64 bits. To retrieve larger or negative integers Num() must be used. The difference between the two methods is that Uns() is slightly faster than Num().

This method automatically handles the endianness of the requested data.

Parameters

i_or_name (Union[int, str]) – The index or name of the member of the structure.

Returns

Returns the numeric value if successful; otherwise returns 0.

Return type

int

Available since Cerbero Suite 5.0 and Cerbero Engine 2.0.

See also Set(), Num(), Str(), Bytes() and Raw().

Zero(i_or_name: Optional[Union[int, str]] = None)bool

Fills the entire structure or a member of it with zero.

Parameters

i_or_name (Optional[Union[int, str]]) – The index or name of the member of the structure.

Returns

Returns True if successful; otherwise returns False.

Return type

bool

See also Fill().

iterator()Pro.Core.CFFStructIt
Returns

Returns an iterator for an array of structures.

Return type

CFFStructIt

See also CFFStructIt.

class CFFStructIt(s: Pro.Core.CFFStruct)

Iterator for an array of CFFStruct structures.

Parameters

s (CFFStruct) – The array of structures to iterate over.

See also CFFStruct.iterator() and CFFStruct.

HasNext()bool
Returns

Returns True if there is an entry after the current one; otherwise returns False.

Return type

bool

See also Next(), hasNext(), next() and CFFStruct.

Next()Pro.Core.CFFStruct
Returns

Returns the entry after the current one and moves the iterator if successful; otherwise returns an invalid structure.

Return type

CFFStruct

See also HasNext(), hasNext(), next() and CFFStruct.

hasNext()bool
Returns

Returns True if there is an entry after the current one; otherwise returns False.

Return type

bool

See also next() and CFFStruct.

next()Pro.Core.CFFStruct
Returns

Returns the entry after the current one and moves the iterator if successful; otherwise returns an invalid structure.

Return type

CFFStruct

See also hasNext() and CFFStruct.

class CFFStructList

List of CFFStruct elements.

append(value: Pro.Core.CFFStruct)None

Inserts value at the end of the list.

Parameters

value (CFFStruct) – The value to add to the list.

See also insert().

at(i: int)Pro.Core.CFFStruct

Returns the item at index position i in the list. i must be a valid index position in the list (i.e., 0 <= i < size()).

Parameters

i (int) – The index of the element to return.

Returns

Returns the requested element.

Return type

CFFStruct

clear()None

Removes all items from the list.

contains(value: Pro.Core.CFFStruct)bool

Checks the presence of an element in the list.

Parameters

value (CFFStruct) – The value to check for.

Returns

Returns True if the list contains an occurrence of value; otherwise returns False.

Return type

bool

See also indexOf() and count().

count(value: Pro.Core.CFFStruct)int

Returns the number of occurrences of value in the list.

Parameters

value (CFFStruct) – The value to count.

Returns

Returns the number of occurrences.

Return type

int

See also indexOf() and contains().

indexOf(value: Pro.Core.CFFStruct, start: int = 0)int

Searches for an element in the list.

Parameters
  • value (CFFStruct) – The value to search for.

  • start (int) – The start index.

Returns

Returns the index position of the first occurrence of value in the list. Returns -1 if no item was found.

Return type

int

See also contains().

insert(i: int, value: Pro.Core.CFFStruct)None

Inserts value at index position i in the list. If i is 0, the value is prepended to the list. If i is size(), the value is appended to the list.

Parameters
  • i (int) – The position at which to add the value.

  • value (CFFStruct) – The value to add.

See also append() and removeAt().

isEmpty()bool

Checks whether the list is empty.

Returns

Returns True if the list contains no items; otherwise returns False.

Return type

bool

See also size().

iterator()Pro.Core.CFFStructListIt

Creates an iterator for the list.

Returns

Returns the iterator.

Return type

CFFStructListIt

removeAll(value: Pro.Core.CFFStruct)int

Removes all occurrences of value in the list and returns the number of entries removed.

Parameters

value (CFFStruct) – The value to remove from the list.

Returns

Returns the number of entries removed.

Return type

int

See also removeAt().

removeAt(i: int)None

Removes the item at index position i. i must be a valid index position in the list (i.e., 0 <= i < size()).

Parameters

i (int) – The index of the item to remove.

See also removeAll().

reserve(alloc: int)None

Reserve space for alloc elements. Calling this method doesn’t change the size of the list.

Parameters

alloc (int) – The amount of elements to reserve space for.

size()int
Returns

Returns the number of items in the list.

Return type

int

See also isEmpty().

takeAt(i: int)Pro.Core.CFFStruct

Removes the item at index position i and returns it. i must be a valid index position in the list (i.e., 0 <= i < size()).

Parameters

i (int) – The index of the element to remove from the list.

Returns

Returns the removed element. If you don’t use the return value, removeAt() is more efficient.

Return type

CFFStruct

See also removeAt().

class CFFStructListIt(obj: Pro.Core.CFFStructList)

Iterator class for CFFStructList.

Parameters

obj (CFFStructList) – The object to iterate over.

hasNext()bool
Returns

Returns True if there is at least one item ahead of the iterator, i.e. the iterator is not at the back of the container; otherwise returns False.

Return type

bool

See also hasPrevious() and next().

hasPrevious()bool
Returns

Returns True if there is at least one item behind the iterator, i.e. the iterator is not at the front of the container; otherwise returns False.

Return type

bool

See also hasNext() and previous().

next()Pro.Core.CFFStruct
Returns

Returns the next item and advances the iterator by one position.

Return type

CFFStruct

See also hasNext() and previous().

previous()Pro.Core.CFFStruct
Returns

Returns the previous item and moves the iterator back by one position.

Return type

CFFStruct

See also hasPrevious() and next().

toBack()None

Moves the iterator to the back of the container (after the last item).

See also toFront() and previous().

toFront()None

Moves the iterator to the front of the container (before the first item).

See also toBack() and next().

CFF_ARRAY_NULL_TERMINATED: Final[int]

If specified, makes an array of structure be null-terminated.

See also CFFObject.MakeStructArray().

CT_ActionScript2: Final[int]

Scan entry type for ActionScript2.

See also ScanProvider.addEntry() and ScanEntryData.

CT_ActionScript3: Final[int]

Scan entry type for ActionScript3.

See also ScanProvider.addEntry() and ScanEntryData.

CT_AppLaunch: Final[int]

Scan entry type for application launches.

See also ScanProvider.addEntry() and ScanEntryData.

CT_AttackSurface: Final[int]

Scan entry type for attack surfaces.

See also ScanProvider.addEntry() and ScanEntryData.

CT_BinaryData: Final[int]

Scan entry type for binary data.

See also ScanProvider.addEntry() and ScanEntryData.

CT_ByteCode: Final[int]

Scan entry type for byte-code.

See also ScanProvider.addEntry() and ScanEntryData.

CT_DalvikByteCode: Final[int]

Scan entry type for Dalvik byte-code.

See also ScanProvider.addEntry() and ScanEntryData.

CT_DataEntriesEnd: Final[int]

Scan entry type for data entries end.

See also ScanProvider.addEntry() and ScanEntryData.

CT_DataEntriesStart: Final[int]

Scan entry type for data entries start.

See also ScanProvider.addEntry() and ScanEntryData.

CT_DebugData: Final[int]

Scan entry type for debug data.

See also ScanProvider.addEntry() and ScanEntryData.

CT_DecompressionBomb: Final[int]

Scan entry type for decompression bombs.

See also ScanProvider.addEntry() and ScanEntryData.

CT_EmbeddedFile: Final[int]

Scan entry type for embedded objects.

See also SEC_File, ScanProvider.addEntry() and ScanEntryData.

CT_EntryLimit: Final[int]

Scan entry type for entry limits.

See also ScanProvider.addEntry() and ScanEntryData.

CT_ForeignData: Final[int]

Scan entry type for foreign data.

See also ScanProvider.addEntry() and ScanEntryData.

CT_FreePages: Final[int]

Scan entry type for free pages.

See also ScanProvider.addEntry() and ScanEntryData.

CT_Geolocation: Final[int]

Scan entry type for geo-locations.

See also ScanProvider.addEntry() and ScanEntryData.

CT_HiddenSheets: Final[int]

Scan entry type for hidden sheets.

See also ScanProvider.addEntry() and ScanEntryData.

CT_InteractiveForm: Final[int]

Scan entry type for interactive forms.

See also ScanProvider.addEntry() and ScanEntryData.

CT_InvalidCertificate: Final[int]

Scan entry type for invalid certificates.

See also ScanProvider.addEntry() and ScanEntryData.

CT_JavaByteCode: Final[int]

Scan entry type for Java byte-code.

See also ScanProvider.addEntry() and ScanEntryData.

CT_JavaScript: Final[int]

Scan entry type for JavaScript.

See also ScanProvider.addEntry() and ScanEntryData.

CT_MSILByteCode: Final[int]

Scan entry type for MSIL byte-code.

See also ScanProvider.addEntry() and ScanEntryData.

CT_Malformed: Final[int]

Scan entry type for malformed data.

See also ScanProvider.addEntry() and ScanEntryData.

CT_MalformedDocument: Final[int]

Scan entry type for malformed documents.

See also ScanProvider.addEntry() and ScanEntryData.

CT_MetaData: Final[int]

Scan entry type for meta-data.

See also ScanProvider.addEntry() and ScanEntryData.

CT_MetaDataUnknown: Final[int]

Scan entry type for unknown meta-data.

See also ScanProvider.addEntry() and ScanEntryData.

CT_NativeCode: Final[int]

Scan entry type for native code.

See also ScanProvider.addEntry() and ScanEntryData.

CT_NoDecompress: Final[int]

Scan entry type for failed decompression.

See also ScanProvider.addEntry() and ScanEntryData.

CT_NoDecrypt: Final[int]

Scan entry type for failed decryption.

See also ScanProvider.addEntry() and ScanEntryData.

CT_OKDecompressed: Final[int]

Scan entry type for successful decompression.

See also ScanProvider.addEntry() and ScanEntryData.

CT_OKDecrypted: Final[int]

Scan entry type for successful decryption.

See also ScanProvider.addEntry() and ScanEntryData.

CT_PersonalData: Final[int]

Scan entry type for personal data.

See also ScanProvider.addEntry() and ScanEntryData.

CT_Privileges: Final[int]

Scan entry type for required privileges.

See also ScanProvider.addEntry() and ScanEntryData.

CT_Recursive: Final[int]

Scan entry type for recursion.

See also ScanProvider.addEntry() and ScanEntryData.

CT_Resources: Final[int]

Scan entry type for issues in resources.

See also ScanProvider.addEntry() and ScanEntryData.

CT_Script: Final[int]

Scan entry type for scripts.

See also ScanProvider.addEntry() and ScanEntryData.

CT_ShellCode: Final[int]

Scan entry type for shellcode.

See also ScanProvider.addEntry() and ScanEntryData.

CT_SignatureMatch: Final[int]

Scan entry type for signature matches.

See also ScanProvider.addEntry() and ScanEntryData.

CT_SpreadsheetFormulas: Final[int]

Scan entry type for spreadsheet formulas.

See also ScanProvider.addEntry() and ScanEntryData.

Scan entry type for symbolic links.

See also ScanProvider.addEntry() and ScanEntryData.

CT_Thumbnail: Final[int]

Scan entry type for thumbnails.

See also ScanProvider.addEntry() and ScanEntryData.

CT_TrueType: Final[int]

Scan entry type for TrueType fonts.

See also ScanProvider.addEntry() and ScanEntryData.

CT_TrustedCertificate: Final[int]

Scan entry type for trusted certificates.

See also ScanProvider.addEntry() and ScanEntryData.

CT_Type1: Final[int]

Scan entry type for Type1 fonts.

See also ScanProvider.addEntry() and ScanEntryData.

CT_Type2: Final[int]

Scan entry type for Type2 fonts.

See also ScanProvider.addEntry() and ScanEntryData.

CT_UnaccountedSpace: Final[int]

Scan entry type for unaccounted space.

See also ScanProvider.addEntry() and ScanEntryData.

CT_UnknownFont: Final[int]

Scan entry type for unknown fonts.

See also ScanProvider.addEntry() and ScanEntryData.

CT_UnpackLimit: Final[int]

Scan entry type for the decompression limit.

See also ScanProvider.addEntry() and ScanEntryData.

CT_UnpackNestLimit: Final[int]

Scan entry type for the decompression nesting limit.

See also ScanProvider.addEntry() and ScanEntryData.

CT_UnreferencedData: Final[int]

Scan entry type for unreferenced data.

See also ScanProvider.addEntry() and ScanEntryData.

CT_UntrustedCertificate: Final[int]

Scan entry type for untrusted certificates.

See also ScanProvider.addEntry() and ScanEntryData.

CT_UnverifiedCertificate: Final[int]

Scan entry type for unverified certificates.

See also ScanProvider.addEntry() and ScanEntryData.

CT_VBAScript: Final[int]

Scan entry type for VBA code.

See also ScanProvider.addEntry() and ScanEntryData.

CT_VBSScript: Final[int]

Scan entry type for VBS scripts.

See also ScanProvider.addEntry() and ScanEntryData.

CT_VersionInfo: Final[int]

Scan entry type for version information.

See also ScanProvider.addEntry() and ScanEntryData.

CT_WrongCheckSum: Final[int]

Scan entry type for invalid checksums.

See also ScanProvider.addEntry() and ScanEntryData.

CT_WrongDigest: Final[int]

Scan entry type for invalid digests.

See also ScanProvider.addEntry() and ScanEntryData.

CT_WrongHash: Final[int]

Scan entry type for invalid hashes.

See also ScanProvider.addEntry() and ScanEntryData.

class CommonSystem

Logic providers return classes derived from this class to define a scanning behaviour.

See also LocalSystem and ProCoreContext.getSystem().

addFile(file: str, name: str = str())None

Adds a file to the queue of files to scan.

Parameters
  • file (str) – The name of the file to scan on disk.

  • name (str) – An optional name for the file.

See also addFiles() and addPath().

addFiles(files: Pro.Core.NTStringList, names: Pro.Core.NTStringList = NTStringList())None

Adds a a list of files to the queue of files to scan.

Parameters
  • files (NTStringList) – A list with the names of the files to scan on disk.

  • names (NTStringList) – A list with optional names for the files.

See also addFile() and addPaths().

addPath(path: str)None

Adds a path to the queue of paths to scan.

Parameters

path (str) – The path to scan.

See also addPaths(), addFile() and allPaths().

addPaths(paths: Pro.Core.NTStringList)None

Adds a list of paths to the queue of paths to scan.

Parameters

paths (NTStringList) – A list of the paths to scan.

See also addPath(), addFiles() and allPaths().

allPaths()None

Scans all available paths.

See also addFiles() and addPaths().

clear()None

Clears the scan system.

See also addFile() and addPaths().

defaultLocalSeparator()int
Returns

Returns the path separator for the current platform.

Return type

int

See also setDefaultLocalSeparator() and defaultSeparator().

defaultScanContext()str

Retrieves the scan context for the system.

Note

This method is served for future use.

Returns

Returns the scan context.

Return type

str

See also setDefaultScanContext().

defaultSeparator()int
Returns

Returns the path separator for the system.

Return type

int

See also setDefaultSeparator() and defaultLocalSeparator().

isBatchScan()bool
Returns

Returns True if the system performs a batch scan; otherwise returns False.

Return type

bool

See also setBatchScan().

last()Pro.Core.FileToScan
Returns

Returns the last FileToScan returned by calling next().

Return type

FileToScan

See also next().

next()Pro.Core.FileToScan
Returns

Returns the next file to scan if available; otherwise returns an invalid FileToScan instance.

Return type

FileToScan

See also last() and nextFile().

nextFile()Pro.Core.FileToScan

This method must be overwritten by derived classes to provide the next FileToScan data.

Warning

This method must not be called directly! Instead, next() must be called.

Returns

Returns the next file to scan if available; otherwise returns an invalid FileToScan instance.

Return type

FileToScan

setBatchScan(b: bool)None

Sets the batch scan status of the system.

By default the batch scan status is set to True.

Parameters

b (bool) – If True, the system performs a batch scan; otherwise it performs a single scan.

See also isBatchScan().

setDefaultLocalSeparator(sep: int)None

Sets the path separator for the current platform.

Parameters

sep (int) – The local path separator.

See also defaultLocalSeparator() and setDefaultSeparator().

setDefaultScanContext(ctx: str)None

Sets the scan context for the system.

Note

This method is served for future use.

Parameters

ctx (str) – The scan context.

See also defaultScanContext().

setDefaultSeparator(sep: int)None

Sets the path separator for the system.

Parameters

sep (int) – The path separator.

See also defaultSeparator() and setDefaultLocalSeparator().

setExtensions(exts: Pro.Core.NTStringList)None

Sets the file extensions to scan.

Parameters

exts (NTStringList) – The list of file extensions to scan.

See also addFiles() and addPaths().

setPrefixReplace(before: str, after: str)None

Sets a replacement rule for file prefixes.

Parameters
  • before (str) – The prefix to replace.

  • after (str) – The new prefix.

See also addFiles() and addPaths().

CurrentEndianness()int
Returns

Returns the endianness of the system (ENDIANNESS_LITTLE or ENDIANNESS_BIG).

Return type

int

DSNF_NoAccessSpecifier: Final[int]

Doesn’t include the member type (i.e.: public, protected, private) in the unmangled symbol.

See also DemangleSymbolName().

DSNF_NoCallingConvention: Final[int]

Doesn’t include the calling convention in the unmangled symbol.

See also DemangleSymbolName().

DSNF_NoMemberType: Final[int]

Doesn’t include the member type (i.e.: static, virtual, extern) in the unmangled symbol.

See also DemangleSymbolName().

DSNF_NoReturnType: Final[int]

Doesn’t include the return type in the unmangled symbol.

See also DemangleSymbolName().

DSNF_SimpleSignature: Final[int]

Returns a simplified signature of the unmangled symbol.

Combination of DSNF_NoAccessSpecifier, DSNF_NoCallingConvention, DSNF_NoReturnType and DSNF_NoMemberType.

See also DemangleSymbolName().

DemangleSymbolName(mangled: str, flags: int = 0)str

Unmangles a decorated symbol. Symbols generated by Visual C++ and GCC are supported.

Parameters
  • mangled (str) – The mangled symbol.

  • flags (int) – Optional flags (e.g.: DSNF_SimpleSignature).

Returns

Returns the unmangled symbol.

Return type

str

See also MethodNameFromSimpleSignature() and DSNF_SimpleSignature.

DisasmOpt_FileOffsets: Final[int]

Shows offsets in disassemblies shown in the text view.

See also proDisasmOptions().

DisasmOpt_Opcodes: Final[int]

Shows opcodes in disassemblies shown in the text view.

See also proDisasmOptions().

ENDIANNESS_BIG: Final[int]

Big-endian option.

See also ENDIANNESS_LITTLE and CFFObject.SetDefaultEndianness().

ENDIANNESS_LITTLE: Final[int]

Little-endian option.

See also ENDIANNESS_BIG and CFFObject.SetDefaultEndianness().

EXPLICIT_OFLAGS_MASK: Final[int]

The mask for explicit object flags.

Explicit flags are set by the scan provider during the scanning process.

See also ScanProvider and IMPLICIT_OFLAG_UNKNOWN_FORMAT.

class FileToScan

This class contains information about the file to scan returned by classes derived from CommonSystem.

See also CommonSystem.next() and CommonSystem.

clear()None

Clears the instance.

See also isValid().

context()str
Returns

Returns the scan context for the file.

Return type

str

See also setContext() and CommonSystem.defaultScanContext().

format()str
Returns

Returns the format to be used to scan the file.

Return type

str

See also setFormat().

isValid()bool
Returns

Returns True if the file to scan is valid; otherwise returns False.

Return type

bool

See also clear().

localName()str
Returns

Returns the name of the file to scan on disk.

Return type

str

See also setLocalName() and name().

name()str
Returns

Returns the optional name of the file to scan.

Return type

str

See also setName() and localName().

setContext(context: str)None

Sets the scan context for the file.

Parameters

context (str) – The scan context.

See also context() and CommonSystem.setDefaultScanContext().

setFormat(format: str)None

Sets the format to be used to scan the file.

Parameters

format (str) – The file format.

See also format().

setLocalName(locname: str)None

Sets the name of the file to scan on disk.

Parameters

locname (str) – The name of the file on disk.

See also localName() and setName().

setName(name: str)None

Sets the optional name of the file to scan.

Parameters

name (str) – The optional name of the file.

See also name() and setLocalName().

class FormatItemInfo

The information about a format item returned by ScanProvider._formatViewInfo().

bg

The background color.

See also ntRgb().

clear()None

Clears the fields of the class.

fid

The format item id. This is the id provided when creating the FormatTree.

icon

An integer which represents the public icon to be used for the item. Public icons are defined in the Pro.UI module.

text

The text to be used as label for the item.

class FormatTree

Tree of FormatTreeNode nodes.

appendChild(parent: Pro.Core.FormatTreeNode, value: int)Pro.Core.FormatTreeNode

Adds a node to the children of the specified parent node.

Parameters
  • parent (FormatTreeNode) – The parent node. This value can be None to add a root-level node.

  • value (int) – The value of the new node.

Returns

Returns the newly created node.

Return type

FormatTreeNode

See also prependChild() and insertChild().

children(parent: Pro.Core.FormatTreeNode)int

Returns the number of child nodes for the specified parent node.

Parameters

parent (FormatTreeNode) – The parent node. This value can be None to retrieve the number of root-level nodes.

Returns

Returns the number of child nodes.

Return type

int

See also childrenList(), siblings() and parentNode().

childrenList(parent: Pro.Core.FormatTreeNode)Pro.Core.FormatTreeNodeList

Returns the list of child nodes for the specified parent node.

Parameters

parent (FormatTreeNode) – The parent node. This value can be None to retrieve the list of root-level nodes.

Returns

Returns the list of child nodes.

Return type

FormatTreeNodeList

See also children(), siblings() and parentNode().

clear()None

Removes all nodes from the tree.

See also clearChildren().

clearChildren(parent: Pro.Core.FormatTreeNode)None

Removes all the child nodes of the specified parent node.

Parameters

parent (FormatTreeNode) – The parent node.

See also clear().

enableIDs(b: bool)None

Enables id-based look-up for nodes. This method must be called before adding nodes to the tree. By default id-based look-up is not enabled.

Parameters

b (bool) – Must be True to enable id-based look-up.

See also node() and nodeId().

insertChild(parent: Pro.Core.FormatTreeNode, pos: int, value: int)Pro.Core.FormatTreeNode

Inserts a new node into the list of child nodes of the specified parent node at a given position.

Parameters
  • parent (FormatTreeNode) – The parent node. This value can be None to insert a root-level node.

  • pos (int) – The position where to insert the child node. An value of 0 is the same as calling prependChild(). A value of children() is the same as calling appendChild().

  • value (int) – The value of the new node.

Returns

Returns the newly created node.

Return type

FormatTreeNode

See also appendChild() and prependChild().

node(nid_or_parent: Union[Pro.Core.FormatTreeNode, int], pos: Optional[int] = None)Pro.Core.FormatTreeNode

Returns a node given a parent and a child index or, alternatively, given a node id. To retrieve nodes by id, enableIDs() must have been called first.

Parameters
  • nid_or_parent (Union[FormatTreeNode, int]) – Can be either a parent node or a node id.

  • pos (Optional[int]) – The child index. This parameter can be used only when a parent node is specified.

Returns

Returns the requested node. If the node couldn’t be found, the return value is None.

Return type

FormatTreeNode

See also enableIDs().

nodeId(node: Pro.Core.FormatTreeNode)int

Returns the node id for the specified node. enableIDs() must have been called first in order for nodes to have valid ids.

Parameters

node (FormatTreeNode) – The node for which to retrieve the node id.

Returns

Returns the node id.

Return type

int

See also enableIDs() and node().

parentNode(node: Pro.Core.FormatTreeNode)Pro.Core.FormatTreeNode

Retrieves the parent node for the specified node.

Parameters

node (FormatTreeNode) – The node for which to retrieve the parent node.

Returns

Returns the parent node. If the specified node is a root-level node, then the method returns None.

Return type

FormatTreeNode

See also childrenList() and node().

position(node: Pro.Core.FormatTreeNode)int

Returns the position of the specified node related its siblings.

Parameters

node (FormatTreeNode) – The node for which to retrieve the position. This value can be None to retrieve the position of a root-level node.

Returns

Returns the index position.

Return type

int

See also children() and siblings().

prependChild(parent: Pro.Core.FormatTreeNode, value: int)Pro.Core.FormatTreeNode

Prepends a node to the children of the specified parent node.

Parameters
  • parent (FormatTreeNode) – The parent node. This value can be None to prepend a root-level node.

  • value (int) – The value of the new node.

Returns

Returns the newly created node.

Return type

FormatTreeNode

See also appendChild() and insertChild().

remove(node: Pro.Core.FormatTreeNode)None

Removes a node from the tree.

Parameters

node (FormatTreeNode) – The node to remove.

See also removeChild().

removeChild(parent: Pro.Core.FormatTreeNode, pos: int)None

Removes a child node at a specified position.

Parameters
  • parent (FormatTreeNode) – The parent node. This value can be None to remove a root-level node.

  • pos (int) – The index of the child to remove.

See also remove().

siblings(node: Pro.Core.FormatTreeNode)int

Returns the number of siblings of the specified node.

Parameters

node (FormatTreeNode) – The node for which to get the number of siblings.

Returns

Returns the number of siblings.

Return type

int

See also children() and childrenList().

swap(node: Pro.Core.FormatTreeNode, newPos: int)None

Swaps two sibling nodes.

Parameters
  • node (FormatTreeNode) – One of the nodes to swap.

  • newPos (int) – The new position at which to place the specified node.

See also children() and siblings().

class FormatTreeNode

This class represents a node of FormatTree.

children

A FormatTreeNodeList list of children nodes.”

See also FormatTree.childrenList().

nid

The node id.

See also FormatTree.nodeId() and FormatTree.enableIDs().

parent

The parent node.

See also FormatTree.parentNode().

value

The int value of the node.

class FormatTreeNodeList

List of FormatTreeNode elements.

append(value: Pro.Core.FormatTreeNode)None

Inserts value at the end of the list.

Parameters

value (FormatTreeNode) – The value to add to the list.

See also insert().

at(i: int)Pro.Core.FormatTreeNode

Returns the item at index position i in the list. i must be a valid index position in the list (i.e., 0 <= i < size()).

Parameters

i (int) – The index of the element to return.

Returns

Returns the requested element.

Return type

FormatTreeNode

clear()None

Removes all items from the list.

contains(value: Pro.Core.FormatTreeNode)bool

Checks the presence of an element in the list.

Parameters

value (FormatTreeNode) – The value to check for.

Returns

Returns True if the list contains an occurrence of value; otherwise returns False.

Return type

bool

See also indexOf() and count().

count(value: Pro.Core.FormatTreeNode)int

Returns the number of occurrences of value in the list.

Parameters

value (FormatTreeNode) – The value to count.

Returns

Returns the number of occurrences.

Return type

int

See also indexOf() and contains().

indexOf(value: Pro.Core.FormatTreeNode, start: int = 0)int

Searches for an element in the list.

Parameters
  • value (FormatTreeNode) – The value to search for.

  • start (int) – The start index.

Returns

Returns the index position of the first occurrence of value in the list. Returns -1 if no item was found.

Return type

int

See also contains().

insert(i: int, value: Pro.Core.FormatTreeNode)None

Inserts value at index position i in the list. If i is 0, the value is prepended to the list. If i is size(), the value is appended to the list.

Parameters
  • i (int) – The position at which to add the value.

  • value (FormatTreeNode) – The value to add.

See also append() and removeAt().

isEmpty()bool

Checks whether the list is empty.

Returns

Returns True if the list contains no items; otherwise returns False.

Return type

bool

See also size().

iterator()Pro.Core.FormatTreeNodeListIt

Creates an iterator for the list.

Returns

Returns the iterator.

Return type

FormatTreeNodeListIt

removeAll(value: Pro.Core.FormatTreeNode)int

Removes all occurrences of value in the list and returns the number of entries removed.

Parameters

value (FormatTreeNode) – The value to remove from the list.

Returns

Returns the number of entries removed.

Return type

int

See also removeAt().

removeAt(i: int)None

Removes the item at index position i. i must be a valid index position in the list (i.e., 0 <= i < size()).

Parameters

i (int) – The index of the item to remove.

See also removeAll().

reserve(alloc: int)None

Reserve space for alloc elements. Calling this method doesn’t change the size of the list.

Parameters

alloc (int) – The amount of elements to reserve space for.

size()int
Returns

Returns the number of items in the list.

Return type

int

See also isEmpty().

takeAt(i: int)Pro.Core.FormatTreeNode

Removes the item at index position i and returns it. i must be a valid index position in the list (i.e., 0 <= i < size()).

Parameters

i (int) – The index of the element to remove from the list.

Returns

Returns the removed element. If you don’t use the return value, removeAt() is more efficient.

Return type

FormatTreeNode

See also removeAt().

class FormatTreeNodeListIt(obj: Pro.Core.FormatTreeNodeList)

Iterator class for FormatTreeNodeList.

Parameters

obj (FormatTreeNodeList) – The object to iterate over.

hasNext()bool
Returns

Returns True if there is at least one item ahead of the iterator, i.e. the iterator is not at the back of the container; otherwise returns False.

Return type

bool

See also hasPrevious() and next().

hasPrevious()bool
Returns

Returns True if there is at least one item behind the iterator, i.e. the iterator is not at the front of the container; otherwise returns False.

Return type

bool

See also hasNext() and previous().

next()Pro.Core.FormatTreeNode
Returns

Returns the next item and advances the iterator by one position.

Return type

FormatTreeNode

See also hasNext() and previous().

previous()Pro.Core.FormatTreeNode
Returns

Returns the previous item and moves the iterator back by one position.

Return type

FormatTreeNode

See also hasPrevious() and next().

toBack()None

Moves the iterator to the back of the container (after the last item).

See also toFront() and previous().

toFront()None

Moves the iterator to the front of the container (before the first item).

See also toBack() and next().

GB_SIZE: Final[int]

This constant defines the size of a gigabyte.

See also KB_SIZE, MB_SIZE and TB_SIZE.

IMPLICIT_OFLAG_UNKNOWN_FORMAT: Final[int]

Implicit object flag.

This flag is automatically set if no matching file format could be found for the scanned object or one of its embedded objects.

See also ScanProvider and EXPLICIT_OFLAGS_MASK.

INVALID_OFFSET: Final[int]

Invalid file or data offset.

The equivalent of INVALID_STREAM_OFFSET.

See also NTContainer and CFFObject.

INVALID_STREAM_OFFSET: Final[int]

Invalid file or data offset.

The equivalent of INVALID_OFFSET.

See also NTContainer and CFFObject.

KB_SIZE: Final[int]

This constant defines the size of a kilobyte.

See also MB_SIZE, GB_SIZE and TB_SIZE.

class KROffset

Match for a byte search in NTContainer.

See also NTContainer.find(), NTContainer.findFirst() and NTContainer.findMulti().

offset

The start offset of the matche sequence. It’s INVALID_STREAM_OFFSET in case of no match.

pattern

The index of the matched pattern. This value applies only to NTContainer.findMulti().

class Layout

Layouts are used to create ranges and associate structures to hex views.

Layouts can be exported and imported as XML data.

Note

Structures referenced by layouts must be stored in SQLite-backed header files. In the future we plan to allow XML header data to be stored inside the layout itself.

In the following code example a simple layout is created for a 64-bit Elf file and is then associated to the current hex view:

from Pro.Core import *
from Pro.UI import *

def buildElfLayout(obj, l):
    # load the SQLite-backed header file
    hname = "elf"
    hdr = CFFHeader()
    if not hdr.LoadFromFile(hname):
        return
    # specify the packing options for the structures we add to the layout
    sopts = CFFSO_GCC | CFFSO_Pack1
    d = LayoutData()
    d.setTypeOptions(sopts)
    # add the Elf header to the layout
    ehdr = obj.MakeStruct(hdr, "_Elf64_Ehdr", 0, sopts)
    d.setColor(ntRgba(255, 0, 0, 70))
    d.setStruct(hname, "_Elf64_Ehdr")
    l.add(0, ehdr.Size(), d)
    # add the sections (we assume that e_shentsize is 0x40) to the layout
    e_shoff = ehdr.Num("e_shoff")
    e_shnum = ehdr.Num("e_shnum")
    esects = obj.MakeStructArray(hdr, "_Elf64_Shdr", e_shoff, e_shnum, sopts)
    d.setStruct(hname, "_Elf64_Shdr")
    d.setArraySize(e_shnum)
    l.add(e_shoff, esects.TotalSize(), d)

# get the current view
hv = proContext().getCurrentView()
# it must be a hew view
if hv.isValid() and hv.type() == ProView.Type_Hex:
    # get the container referenced by the hex view
    c = hv.getData()
    obj = CFFObject()
    obj.Load(c)
    # create a new layout named "ELF_ANALYSIS"
    lname = "ELF_ANALYSIS"
    l = proContext().getLayout(lname)
    # build the layout
    buildElfLayout(obj, l)
    # apply the layout to the current hex view
    hv.setLayoutName(lname)

See also LayoutInterval, LayoutData, LayoutPair and CFFHeader.

add(interval_or_offset: Union[Pro.Core.LayoutInterval, int], data_or_size: Union[Pro.Core.LayoutData, int], data: Optional[Pro.Core.LayoutData] = None)None

Associates LayoutData to an interval.

Parameters
  • interval_or_offset (Union[LayoutInterval, int]) – Either the interval or the start offset of the interval.

  • data_or_size (Union[LayoutData, int]) – Either the data to associate or the size of the interval.

  • data (Optional[LayoutData]) – The data to associate.

See also count(), remove() and at().

at(i_or_interval_or_lp: Union[Pro.Core.LayoutInterval, Pro.Core.LayoutPair, int])Union[Pro.Core.LayoutPair, int]

Retrieves the index of the layout entry if an interval or layout pair are specified; otherwise returns a layout pair if an index is specified.

Parameters

i_or_interval_or_lp (Union[LayoutInterval, LayoutPair, int]) – Either the index of the layout entry, the interval or the layout pair.

Returns

Returns the index of the layout entry if an interval or layout pair are specified and successful; otherwise returns 0. Alternatively, returns a layout pair if an index is specified and successful; otherwise returns an invalid layout pair.

Return type

Union[LayoutPair, int]

See also count(), add() and remove().

clear()None

Clears the current layout.

See also isValid() and fromXml().

count()int
Returns

Returns the number of layout entries.

Return type

int

See also add(), remove() and at().

fromXml(xstr: str)bool

Imports a layout from XML data.

Parameters

xstr (str) – The XML string.

Returns

Returns True if successful; otherwise returns False.

Return type

bool

See also toXml().

getMatches(offset: int, size: int)Pro.Core.LayoutPairList

Retrieves a list of layout pairs which match exactly the specified interval.

Parameters
  • offset (int) – The start offset of the interval.

  • size (int) – The size of the interval.

Returns

Returns a list of layout pairs.

Return type

LayoutPairList

See also getOverlappingWith().

getOverlappingWith(offset: int, size: int)Pro.Core.LayoutPairList

Retrieves a list of layout pairs which overlap with the specified interval.

Parameters
  • offset (int) – The start offset of the interval.

  • size (int) – The size of the interval.

Returns

Returns a list of layout pairs.

Return type

LayoutPairList

See also getMatches().

isModified()bool
Returns

Returns True if the layout was modified; otherwise returns False.

Return type

bool

See also setModified().

isNull()bool
Returns

Returns True if the layout is invalid; otherwise returns False.

Return type

bool

See also isValid().

isValid()bool
Returns

Returns True if the layout is valid; otherwise returns False.

Return type

bool

See also isNull().

layoutName()str
Returns

Returns the name of the layout.

Return type

str

See also renameLayout().

remove(interval_or_offset: Union[Pro.Core.LayoutInterval, int], size: Optional[int] = None)None

Removes layout entries matching a specified interval.

Parameters
  • interval_or_offset (Union[LayoutInterval, int]) – Either the interval or the start offset of the interval.

  • size (Optional[int]) – The size of the interval.

See also add(), at() and count().

renameLayout(name: str)bool

Renames the layout.

Parameters

name (str) – The new name of the layout.

Returns

Returns True if successful; otherwise returns False.

Return type

bool

See also layoutName().

saveIfModified()None

Saves the layout to the current project if the layout was modified.

See also isModified().

setModified(b: bool)None

Sets the modified status of the layout.

Parameters

b (bool) – If True, the layout is marked as modified.

See also isModified().

toXml()str

Exports the layout to XML.

Returns

Returns an XML string.

Return type

str

See also fromXml().

class LayoutData

This class contains the data of a layout entry.

See also Layout.

arraySize()int
Returns

Returns the size of the array of structures.

Return type

int

See also setArraySize().

getColor()int
Returns

Returns the background color of the netry.

Return type

int

See also setColor().

getDescription()str
Returns

Returns the description of the entry.

Return type

str

See also setDescription().

getHeader()str
Returns

Returns the name of header which contains the referenced structure.

Return type

str

See also setStruct().

getType()str
Returns

Returns the name of the associated structure.

Return type

str

See also setStruct().

setArraySize(n: int)None

Sets the size of the array of structures.

Parameters

n (int) – The size of the array.

See also arraySize().

setColor(rgba: int)None

Sets the background color.

Parameters

rgba (int) – The background color.

See also getColor().

setDescription(description: str)None

Sets the description of the entry.

Parameters

description (str) – The description of the entry.

See also getDescription().

setStruct(hdr: str, type: str)None

Sets the associated structure.

Parameters
  • hdr (str) – The name of the header file which contains the structure.

  • type (str) – The name of the structure.

See also getHeader() and getType().

setTypeOptions(opt: int)None

Sets the options for the associated structure.

Parameters

opt (int) – The options for the associated structure (e.g., CFFSO_Pack1).

See also typeOptions() and setStruct().

typeOptions()int
Returns

Returuns the options for associated structure.

Return type

int

See also setTypeOptions() and setStruct().

class LayoutInterval

This class represents a layout interval.

See also Layout.

end

The end offset of the interval.

start

The start offset of the interval.

class LayoutPair(t1: Optional[Pro.Core.LayoutInterval] = None, t2: Optional[Pro.Core.LayoutData] = None)

Pair of (LayoutInterval, LayoutData) elements.

Parameters
  • t1 (Optional[LayoutInterval]) – The first element of the pair.

  • t2 (Optional[LayoutData]) – The second element of the pair.

first()Pro.Core.LayoutInterval
Returns

Returns the first element in the pair.

Return type

LayoutInterval

See also second() and setFirst().

second()Pro.Core.LayoutData
Returns

Returns the second element in the pair.

Return type

LayoutData

See also first() and setSecond().

setFirst(v: Pro.Core.LayoutInterval)None

Sets the first element in the pair.

Parameters

v (LayoutInterval) – The value of the element.

See also first() and setSecond().

setSecond(v: Pro.Core.LayoutData)None

Sets the second element in the pair.

Parameters

v (LayoutData) – The value of the element.

See also second() and setFirst().

class LayoutPairList

List of LayoutPair elements.

append(value: Pro.Core.LayoutPair)None

Inserts value at the end of the list.

Parameters

value (LayoutPair) – The value to add to the list.

See also insert().

at(i: int)Pro.Core.LayoutPair

Returns the item at index position i in the list. i must be a valid index position in the list (i.e., 0 <= i < size()).

Parameters

i (int) – The index of the element to return.

Returns

Returns the requested element.

Return type

LayoutPair

clear()None

Removes all items from the list.

contains(value: Pro.Core.LayoutPair)bool

Checks the presence of an element in the list.

Parameters

value (LayoutPair) – The value to check for.

Returns

Returns True if the list contains an occurrence of value; otherwise returns False.

Return type

bool

See also indexOf() and count().

count(value: Pro.Core.LayoutPair)int

Returns the number of occurrences of value in the list.

Parameters

value (LayoutPair) – The value to count.

Returns

Returns the number of occurrences.

Return type

int

See also indexOf() and contains().

indexOf(value: Pro.Core.LayoutPair, start: int = 0)int

Searches for an element in the list.

Parameters
  • value (LayoutPair) – The value to search for.

  • start (int) – The start index.

Returns

Returns the index position of the first occurrence of value in the list. Returns -1 if no item was found.

Return type

int

See also contains().

insert(i: int, value: Pro.Core.LayoutPair)None

Inserts value at index position i in the list. If i is 0, the value is prepended to the list. If i is size(), the value is appended to the list.

Parameters
  • i (int) – The position at which to add the value.

  • value (LayoutPair) – The value to add.

See also append() and removeAt().

isEmpty()bool

Checks whether the list is empty.

Returns

Returns True if the list contains no items; otherwise returns False.

Return type

bool

See also size().

iterator()Pro.Core.LayoutPairListIt

Creates an iterator for the list.

Returns

Returns the iterator.

Return type

LayoutPairListIt

removeAll(value: Pro.Core.LayoutPair)int

Removes all occurrences of value in the list and returns the number of entries removed.

Parameters

value (LayoutPair) – The value to remove from the list.

Returns

Returns the number of entries removed.

Return type

int

See also removeAt().

removeAt(i: int)None

Removes the item at index position i. i must be a valid index position in the list (i.e., 0 <= i < size()).

Parameters

i (int) – The index of the item to remove.

See also removeAll().

reserve(alloc: int)None

Reserve space for alloc elements. Calling this method doesn’t change the size of the list.

Parameters

alloc (int) – The amount of elements to reserve space for.

size()int
Returns

Returns the number of items in the list.

Return type

int

See also isEmpty().

takeAt(i: int)Pro.Core.LayoutPair

Removes the item at index position i and returns it. i must be a valid index position in the list (i.e., 0 <= i < size()).

Parameters

i (int) – The index of the element to remove from the list.

Returns

Returns the removed element. If you don’t use the return value, removeAt() is more efficient.

Return type

LayoutPair

See also removeAt().

class LayoutPairListIt(obj: Pro.Core.LayoutPairList)

Iterator class for LayoutPairList.

Parameters

obj (LayoutPairList) – The object to iterate over.

hasNext()bool
Returns

Returns True if there is at least one item ahead of the iterator, i.e. the iterator is not at the back of the container; otherwise returns False.

Return type

bool

See also hasPrevious() and next().

hasPrevious()bool
Returns

Returns True if there is at least one item behind the iterator, i.e. the iterator is not at the front of the container; otherwise returns False.

Return type

bool

See also hasNext() and previous().

next()Pro.Core.LayoutPair
Returns

Returns the next item and advances the iterator by one position.

Return type

LayoutPair

See also hasNext() and previous().

previous()Pro.Core.LayoutPair
Returns

Returns the previous item and moves the iterator back by one position.

Return type

LayoutPair

See also hasPrevious() and next().

toBack()None

Moves the iterator to the back of the container (after the last item).

See also toFront() and previous().

toFront()None

Moves the iterator to the front of the container (before the first item).

See also toBack() and next().

class LocalSystem

Bases: Pro.Core.CommonSystem

CommonSystem derived class used to perform local file system scans.

See also CommonSystem and ProCoreContext.getSystem().

MB_SIZE: Final[int]

This constant defines the size of a megabyte.

See also KB_SIZE, GB_SIZE and TB_SIZE.

METAFLAG_STRING: Final[int]

Specifies the string nature of the meta-data.

See also ScanMetaDataEntry.flags and ScanProvider.addMetaDataString().

MethodNameFromSimpleSignature(signature: str)str

Extracts the function or method name from a simple signature. A simple method signature doesn’t include a return type or other specifiers before the method name.

When working with mangled symbols, the simple signature must first be obtained by calling DemangleSymbolName() with DSNF_SimpleSignature.

Parameters

signature (str) – The simple signature.

Returns

Returns the method name.

Return type

str

See also DemangleSymbolName().

NATURE_BYTEARRAY: Final[int]

Byte-array type nature.

See also CFFObject.GetTypeNature().

NATURE_NUMBER: Final[int]

Integer number type nature.

See also CFFObject.GetTypeNature().

NATURE_REAL: Final[int]

Real number type nature.

See also CFFObject.GetTypeNature().

NATURE_STRING: Final[int]

String type nature.

See also CFFObject.GetTypeNature().

NATURE_UNKNOWN: Final[int]

Unknown type nature.

See also CFFObject.GetTypeNature().

class NTAddressSpace

This class is used to apply address spaces to containers.

See also NTContainer.addAddressSpace(), createAddressSpace() and createSparseAddressSpace().

addSparseRange(address: int, size: int, offset: int = INVALID_STREAM_OFFSET, flags: int = - 1)None

Adds a sparse range to the address space.

Parameters
  • address (int) – The address of the range.

  • size (int) – The size of the range.

  • offset (int) – The offset at which to map the address.

  • flags (int) – Optional page flags for the range (e.g., NT_ASPSF_EXECUTE).

See also createSparseAddressSpace().

addressRange()tuple
Returns

Returns the start and end address of the address space.

Return type

tuple[int, int]

See also size().

cacheEnabled()bool
Returns

Returns True if address translation caching is enabled; otherwise returns False.

Return type

bool

See also setCacheEnabled().

flags()int
Returns

Returns the flags for the address space (e.g., NT_ASF_IgnoreInvalidPages).

Return type

int

See also setFlags().

getPageFlagsLabels(pflags: int, all: bool = False)Pro.Core.NTStringList

Converts page flags into a list of strings.

Parameters
  • pflags (int) – The page flags.

  • all (bool) – If True, includes every known flag.

Returns

Returns a list of flag labels.

Return type

NTStringList

See also pageFlags().

isNull()bool
Returns

Returns True if the address space is invalid; otherwise returns False.

Return type

bool

pageFlags(c: Pro.Core.NTContainer, address: int)tuple

Returns the page flags for the specified address.

The returned flags can be platform specific and may not be standard page flags such as NT_ASPSF_EXECUTE. To convert the returned flags into standard page flags, use toStdPageFlags(). Alternatively, stdPageFlags() can be called instead of this method to retrieve standard page flags for a specified address.

Parameters
  • c (NTContainer) – The source container.

  • address (int) – The address for which to retrieve the page flags.

Returns

Returns the result of the operation (possible values are NT_ASR_UNSUPPORTED, NT_ASR_INVALID and NT_ASR_OK) and the page flags if the first value is NT_ASR_OK.

Return type

tuple[int, int]

See also getPageFlagsLabels(), toStdPageFlags() and stdPageFlags().

pageSize()int
Returns

Returns the page size of the address space.

Return type

int

setCacheEnabled(b: bool)None

Sets the status of address translation caching.

Caching is automatically enabled for address spaces with a page size which is equal or greater than 1 KB.

Parameters

b (bool) – If True, enables address translation caching.

See also cacheEnabled().

setFlags(f: int)None

Sets the flags for the address space.

Parameters

f (int) – The flags to set (e.g., NT_ASF_IgnoreInvalidPages).

See also flags().

size()int
Returns

Returns the size of the address space.

Return type

int

See also addressRange().

stdPageFlags(c: Pro.Core.NTContainer, address: int)tuple

Returns standard page flags such as NT_ASPSF_EXECUTE for a specified address.

Parameters
  • c (NTContainer) – The source container.

  • address (int) – The address for which to retrieve the standard page flags.

Returns

Returns the result of the operation (possible values are NT_ASR_UNSUPPORTED, NT_ASR_INVALID and NT_ASR_OK) and the standard page flags if the first value is NT_ASR_OK.

Return type

tuple[int, int]

See also pageFlags() and toStdPageFlags().

toAddress(c: Pro.Core.NTContainer, offset: int)int

Converts an offset to an address.

Note

Not all address spaces support this functionality.

Parameters
  • c (NTContainer) – The source container.

  • offset (int) – The offset to convert.

Returns

Returns the address if successful; otherwise returns INVALID_STREAM_OFFSET.

Return type

int

See also toOffset().

toOffset(c: Pro.Core.NTContainer, address: int)int

Converts an address to an offset.

Parameters
  • c (NTContainer) – The source container.

  • address (int) – The address to convert.

Returns

Returns the offset if successful; otherwise returns INVALID_STREAM_OFFSET.

Return type

int

See also toAddress().

toStdPageFlags(pflags: int)int

Converts address specific page flags retrieved by calling pageFlags() into standard page flags (e.g., NT_ASPSF_EXECUTE).

Parameters

pflags (int) – The page flags to convert.

Returns

Returns the standard page flags.

Return type

int

See also pageFlags() and stdPageFlags().

class NTBuffer

Base class for buffered read operations.

This class will throw an IndexError exception on error.

See also NTContainerBuffer and CFFBuffer.

_d64(endianness: Optional[int] = None)float

Reads a C double backwards.

Parameters

endianness (Optional[int]) – The endianness of the value (ENDIANNESS_LITTLE or ENDIANNESS_BIG).

Returns

Returns the numeric value.

Return type

float

See also d64().

_f32(endianness: Optional[int] = None)float

Reads a C float backwards.

Parameters

endianness (Optional[int]) – The endianness of the value (ENDIANNESS_LITTLE or ENDIANNESS_BIG).

Returns

Returns the numeric value.

Return type

float

See also f32().

_i16(endianness: Optional[int] = None)int

Reads an int16 backwards.

Parameters

endianness (Optional[int]) – The endianness of the value (ENDIANNESS_LITTLE or ENDIANNESS_BIG).

Returns

Returns the numeric value.

Return type

int

See also i16().

_i32(endianness: Optional[int] = None)int

Reads an int32 backwards.

Parameters

endianness (Optional[int]) – The endianness of the value (ENDIANNESS_LITTLE or ENDIANNESS_BIG).

Returns

Returns the numeric value.

Return type

int

See also i32().

_i64(endianness: Optional[int] = None)int

Reads an int64 backwards.

Parameters

endianness (Optional[int]) – The endianness of the value (ENDIANNESS_LITTLE or ENDIANNESS_BIG).

Returns

Returns the numeric value.

Return type

int

See also i64().

_i8()int

Reads an int8 backwards.

Returns

Returns the numeric value.

Return type

int

See also i8().

_u16(endianness: Optional[int] = None)int

Reads an uint16 backwards.

Parameters

endianness (Optional[int]) – The endianness of the value (ENDIANNESS_LITTLE or ENDIANNESS_BIG).

Returns

Returns the numeric value.

Return type

int

See also u16().

_u32(endianness: Optional[int] = None)int

Reads an uint32 backwards.

Parameters

endianness (Optional[int]) – The endianness of the value (ENDIANNESS_LITTLE or ENDIANNESS_BIG).

Returns

Returns the numeric value.

Return type

int

See also u32().

_u64(endianness: Optional[int] = None)int

Reads an uint64 backwards.

Parameters

endianness (Optional[int]) – The endianness of the value (ENDIANNESS_LITTLE or ENDIANNESS_BIG).

Returns

Returns the numeric value.

Return type

int

See also u64().

_u8()int

Reads an uint8 backwards.

Returns

Returns the numeric value.

Return type

int

See also u8().

d64(endianness: Optional[int] = None)float

Reads a C double.

Parameters

endianness (Optional[int]) – The endianness of the value (ENDIANNESS_LITTLE or ENDIANNESS_BIG).

Returns

Returns the numeric value.

Return type

float

See also _d64().

defaultEndianness()int
Returns

Returns the default endianness for the buffer.

Return type

int

See also setDefaultEndianness(), ENDIANNESS_LITTLE and ENDIANNESS_BIG.

f32(endianness: Optional[int] = None)float

Reads a C float.

Parameters

endianness (Optional[int]) – The endianness of the value (ENDIANNESS_LITTLE or ENDIANNESS_BIG).

Returns

Returns the numeric value.

Return type

float

See also _f32().

getBitPosition()int
Returns

Returns the current bit position.

Return type

int

See also ubits().

getOffset()int
Returns

Returns the current offset.

Return type

int

See also setOffset().

i16(endianness: Optional[int] = None)int

Reads an int16.

Parameters

endianness (Optional[int]) – The endianness of the value (ENDIANNESS_LITTLE or ENDIANNESS_BIG).

Returns

Returns the numeric value.

Return type

int

See also _i16().

i32(endianness: Optional[int] = None)int

Reads an int32.

Parameters

endianness (Optional[int]) – The endianness of the value (ENDIANNESS_LITTLE or ENDIANNESS_BIG).

Returns

Returns the numeric value.

Return type

int

See also _i32().

i64(endianness: Optional[int] = None)int

Reads an int64.

Parameters

endianness (Optional[int]) – The endianness of the value (ENDIANNESS_LITTLE or ENDIANNESS_BIG).

Returns

Returns the numeric value.

Return type

int

See also _i64().

i8()int

Reads an int8.

Returns

Returns the numeric value.

Return type

int

See also _i8().

isNull()bool
Returns

Returns True if the buffer is uninitialized; otherwise returns False.

Return type

bool

See also isValid().

isValid()bool
Returns

Returns True if the buffer is initialized; otherwise returns False.

Return type

bool

See also isNull().

read(n: int)bytes

Reads a number of bytes from the buffer.

Parameters

n (int) – The number of bytes to read. This value should never exceed half the size of the internal buffer.

Returns

Returns the bytes read.

Return type

bytes

See also setBufferSize().

setBufferSize(size: int)None

Sets the internal buffer size. This method must be called before any read operation are performed. If not called, the size will default 1 KB.

Parameters

size (int) – The size of the internal buffer.

setDefaultEndianness(endianness: int)None

Sets the default endianness for the buffer.

Parameters

endianness (int) – The default endianness for the buffer (ENDIANNESS_LITTLE or ENDIANNESS_BIG).

See also defaultEndianness().

setOffset(offset: int)None

Sets the current offset for the buffer.

Parameters

offset (int) – The current offset.

See also getOffset().

size()int
Returns

Returns the size of the object referenced by the buffer.

Return type

int

See also getOffset().

u16(endianness: Optional[int] = None)int

Reads an uint16.

Parameters

endianness (Optional[int]) – The endianness of the value (ENDIANNESS_LITTLE or ENDIANNESS_BIG).

Returns

Returns the numeric value.

Return type

int

See also _u16().

u32(endianness: Optional[int] = None)int

Reads an uint32.

Parameters

endianness (Optional[int]) – The endianness of the value (ENDIANNESS_LITTLE or ENDIANNESS_BIG).

Returns

Returns the numeric value.

Return type

int

See also _u32().

u64(endianness: Optional[int] = None)int

Reads an uint64.

Parameters

endianness (Optional[int]) – The endianness of the value (ENDIANNESS_LITTLE or ENDIANNESS_BIG).

Returns

Returns the numeric value.

Return type

int

See also _u64().

u8()int

Reads an uint8.

Returns

Returns the numeric value.

Return type

int

See also _u8().

ubits(nbits: int)int

Reads an amount of bits.

Parameters

nbits (int) – The number of bits to read.

Returns

Returns the bits read.

Return type

int

See also getBitPosition().

class NTByteArrayList

List of bytes elements.

append(value: bytes)None

Inserts value at the end of the list.

Parameters

value (bytes) – The value to add to the list.

See also insert().

at(i: int)bytes

Returns the item at index position i in the list. i must be a valid index position in the list (i.e., 0 <= i < size()).

Parameters

i (int) – The index of the element to return.

Returns

Returns the requested element.

Return type

bytes

clear()None

Removes all items from the list.

contains(value: bytes)bool

Checks the presence of an element in the list.

Parameters

value (bytes) – The value to check for.

Returns

Returns True if the list contains an occurrence of value; otherwise returns False.

Return type

bool

See also indexOf() and count().

count(value: bytes)int

Returns the number of occurrences of value in the list.

Parameters

value (bytes) – The value to count.

Returns

Returns the number of occurrences.

Return type

int

See also indexOf() and contains().

indexOf(value: bytes, start: int = 0)int

Searches for an element in the list.

Parameters
  • value (bytes) – The value to search for.

  • start (int) – The start index.

Returns

Returns the index position of the first occurrence of value in the list. Returns -1 if no item was found.

Return type

int

See also contains().

insert(i: int, value: bytes)None

Inserts value at index position i in the list. If i is 0, the value is prepended to the list. If i is size(), the value is appended to the list.

Parameters
  • i (int) – The position at which to add the value.

  • value (bytes) – The value to add.

See also append() and removeAt().

isEmpty()bool

Checks whether the list is empty.

Returns

Returns True if the list contains no items; otherwise returns False.

Return type

bool

See also size().

iterator()Pro.Core.NTByteArrayListIt

Creates an iterator for the list.

Returns

Returns the iterator.

Return type

NTByteArrayListIt

removeAll(value: bytes)int

Removes all occurrences of value in the list and returns the number of entries removed.

Parameters

value (bytes) – The value to remove from the list.

Returns

Returns the number of entries removed.

Return type

int

See also removeAt().

removeAt(i: int)None

Removes the item at index position i. i must be a valid index position in the list (i.e., 0 <= i < size()).

Parameters

i (int) – The index of the item to remove.

See also removeAll().

reserve(alloc: int)None

Reserve space for alloc elements. Calling this method doesn’t change the size of the list.

Parameters

alloc (int) – The amount of elements to reserve space for.

size()int
Returns

Returns the number of items in the list.

Return type

int

See also isEmpty().

takeAt(i: int)bytes

Removes the item at index position i and returns it. i must be a valid index position in the list (i.e., 0 <= i < size()).

Parameters

i (int) – The index of the element to remove from the list.

Returns

Returns the removed element. If you don’t use the return value, removeAt() is more efficient.

Return type

bytes

See also removeAt().

class NTByteArrayListIt(obj: Pro.Core.NTByteArrayList)

Iterator class for NTByteArrayList.

Parameters

obj (NTByteArrayList) – The object to iterate over.

hasNext()bool
Returns

Returns True if there is at least one item ahead of the iterator, i.e. the iterator is not at the back of the container; otherwise returns False.

Return type

bool

See also hasPrevious() and next().

hasPrevious()bool
Returns

Returns True if there is at least one item behind the iterator, i.e. the iterator is not at the front of the container; otherwise returns False.

Return type

bool

See also hasNext() and previous().

next()bytes
Returns

Returns the next item and advances the iterator by one position.

Return type

bytes

See also hasNext() and previous().

previous()bytes
Returns

Returns the previous item and moves the iterator back by one position.

Return type

bytes

See also hasPrevious() and next().

toBack()None

Moves the iterator to the back of the container (after the last item).

See also toFront() and previous().

toFront()None

Moves the iterator to the front of the container (before the first item).

See also toBack() and next().

class NTContainer

This is a generic container used to encapsulate data such as files and memory.

Containers can be created through functions such as createContainerFromFile() and newContainer().

See also createContainerFromFile(), newContainer(), NTContainerBuffer and NTAddressSpace.

Bytes: Final[int]

Type of data internally referenced by the container.

See also dataType().

BytesTree: Final[int]

Type of data internally referenced by the container.

See also dataType().

File: Final[int]

Type of data internally referenced by the container.

See also dataType().

Filled: Final[int]

Type of data internally referenced by the container.

See also dataType().

Filter: Final[int]

Type of data internally referenced by the container.

See also dataType().

Memory: Final[int]

Type of data internally referenced by the container.

See also dataType().

NoType: Final[int]

Type of data internally referenced by the container.

See also dataType().

Process: Final[int]

Type of data internally referenced by the container.

See also dataType().

Stream: Final[int]

Type of data internally referenced by the container.

See also dataType().

String: Final[int]

Type of data internally referenced by the container.

See also dataType().

StringList: Final[int]

Type of data internally referenced by the container.

See also dataType().

StringTree: Final[int]

Type of data internally referenced by the container.

See also dataType().

SubContainer: Final[int]

Type of data internally referenced by the container.

See also dataType().

addAddressSpace(aspace: Pro.Core.NTAddressSpace)Pro.Core.NTContainer

Adds an address space to the current container and returns a new container as the result.

Parameters

aspace (NTAddressSpace) – The address space.

Returns

Returns the new container.

Return type

NTContainer

See also hasAddressSpace(), getAddressSpace() and getSubContainer().

align(align_to: int)bool

Aligns the container to the specified size.

The container must be resizable for this method to succeed.

Parameters

align_to (int) – The alignment.

Returns

Returns True if successful; otherwise returns False.

Return type

bool

See also setResizable(), isResizable(), shift() and append().

append(bytes: bytes)bool

Appends data to the container.

The container must be resizable for this method to succeed.

Parameters

bytes (bytes) – The data to append.

Returns

Returns True if successful; otherwise returns False.

Return type

bool

See also setResizable(), isResizable(), shift() and align().

appendTo(dst_or_offset: Union[Pro.Core.NTContainer, int], size: Optional[int] = None, dst: Optional[Pro.Core.NTContainer] = None)bool

Appends this container to another container.

The other container must be resizable for this method to succeed.

Parameters
  • dst_or_offset (Union[NTContainer, int]) – Either the destination container or the start offset of the current container.

  • size (Optional[int]) – The size of the data to append.

  • dst (Optional[NTContainer]) – The destination container.

Returns

Returns True if successful; otherwise returns False.

Return type

bool

See also setResizable(), copyTo() and copyToEx().

clear()None

Deferences the data currently being referenced by this container.

If no other container holds references to the data, the data is freed.

See also setData(), isValid() and isNull().

clone()Pro.Core.NTContainer
Returns

Returns a container holding a new reference to the internal data.

Return type

NTContainer

See also copyToNewContainer().

compare(offset: int, bytes_or_size: Union[bytes, int], b: Optional[int] = None)bool

Compares the specified data to the one in the container.

Parameters
  • offset (int) – The start offset for the comparison.

  • bytes_or_size (Union[bytes, int]) – Either the data to compare or the size to compare.

  • b (Optional[int]) – If the previous parameter is the size to compare, this parameter is the byte which to compare the data to.

Returns

Returns True if the data matches; otherwise returns False.

Return type

bool

See also read().

copyTo(offset: int, size: int, dst: Pro.Core.NTContainer, dst_offset: int = 0)bool

Copies a part of the current container to another container.

Parameters
  • offset (int) – The offset of the data to copy.

  • size (int) – The size of the data to copy.

  • dst (NTContainer) – The destination container.

  • dst_offset (int) – The offset at which to write the data to in the destination container.

Returns

Returns True if successful; otherwise returns False.

Return type

bool

See also copyToEx(), appendTo() and save().

copyToEx(wait: Pro.Core.NTIWait, offset: int, size: int, dst: Pro.Core.NTContainer, dst_offset: int = 0)bool

Copies a part of the current container to another container.

Parameters
  • wait (NTIWait) – The wait interface.

  • offset (int) – The offset of the data to copy.

  • size (int) – The size of the data to copy.

  • dst (NTContainer) – The destination container.

  • dst_offset (int) – The offset at which to write the data to in the destination container.

Returns

Returns True if successful; otherwise returns False.

Return type

bool

See also copyTo(), appendTo() and save().

copyToNewContainer()Pro.Core.NTContainer

Copies the data referenced by the current container to a new container.

This method performs a deep copy, unlike clone() which only creates a new reference.

Returns

Returns the new container if successful; otherwise returns an invalid container.

Return type

NTContainer

See also clone() and copyToNewContainerEx().

copyToNewContainerEx(wait: Pro.Core.NTIWait, offset: Optional[int] = None, size: Optional[int] = None)Pro.Core.NTContainer

Copies the data referenced by the current container to a new container.

This method performs a deep copy, unlike clone() which only creates a new reference.

Parameters
  • wait (NTIWait) – The wait interface.

  • offset (Optional[int]) – The offset of the data to copy.

  • size (Optional[int]) – The size of the data to copy.

Returns

Returns the new container if successful; otherwise returns an invalid container.

Return type

NTContainer

See also clone() and copyToNewContainer().

dataType()int
Returns

Returns the internal data type referenced by the container.

Return type

int

See also NoType, Stream, SubContainer and File.

equals(s: Pro.Core.NTContainer)bool

Checks whether the current container references the same data as the specified container.

Parameters

s (NTContainer) – The other container.

Returns

Returns True if container reference the same data; otherwise returns False.

Return type

bool

See also clone().

fill(offset: int, b: int, size: int)bool

Fills a portion of the container with the specified byte.

Parameters
  • offset (int) – The offset of the range to fill.

  • b (int) – The 8-bit value used for the fill operation.

  • size (int) – The size of the range to fill.

Returns

Returns True if successful; otherwise returns False.

Return type

bool

See also write().

find(cb: object, ud: object, pattern: bytes, offset: int = 0, size: int = INVALID_STREAM_OFFSET, down: bool = True)bool

Searches for a specified pattern.

Example:

from Pro.Core import *

def findCallback(offset, pattern, ud):
    print(offset)
    return 0

c = NTContainer()
c.setData(b"FooBarFooBarFooBar")
c.find(findCallback, None, b"Bar")
Parameters
  • cb (object) – The callback for each match. This callback must return a value equal or bigger than zero to continue the search. To stop the search it must return a negative value.

  • ud (object) – The user data passed to the callback.

  • pattern (bytes) – The pattern to search for.

  • offset (int) – The offset of the range to search.

  • size (int) – The size of the range to search.

  • down (bool) – The search direction. If True, the search is downwards; otherwise it’s upwards.

Returns

Returns True if successful; otherwise returns False.

Return type

bool

See also findFirst(), findMulti() and findMultiFirst().

findFirst(pattern: bytes, offset: int = 0, size: int = INVALID_STREAM_OFFSET, down: bool = True)Pro.Core.KROffset

Searches for the first occurrence of a specified pattern.

Example:

from Pro.Core import *

c = NTContainer()
c.setData(b"FooBarFooBarFooBar")
m = c.findFirst(b"Bar")
if m.offset != INVALID_STREAM_OFFSET:
    print(m.offset)
Parameters
  • pattern (bytes) – The pattern to search for.

  • offset (int) – The offset of the range to search.

  • size (int) – The size of the range to search.

  • down (bool) – The search direction. If True, the search is downwards; otherwise it’s upwards.

Returns

Returns the first match if any; otherwise KROffset.offset is INVALID_STREAM_OFFSET.

Return type

KROffset

See also find(), findMulti() and findMultiFirst().

findMulti(cb: object, ud: object, patterns: Pro.Core.NTByteArrayList, offset: int = 0, size: int = INVALID_STREAM_OFFSET)bool

Searches for any pattern in a specified list.

The patterns in the specified list must have the same length.

Example:

from Pro.Core import *

def findCallback(offset, pattern, ud):
    # pattern is the index of the matched pattern into the passed list of patterns
    print("offset:", offset, "pattern:", pattern)
    return 0

c = NTContainer()
c.setData(b"FooBarFooBarFooBar")

patterns = NTByteArrayList()
patterns.append(b"Foo")
patterns.append(b"Bar")
c.findMulti(findCallback, None, patterns)
Parameters
  • cb (object) – The callback for each match. This callback must return a value equal or bigger than zero to continue the search. To stop the search it must return a negative value.

  • ud (object) – The user data passed to the callback.

  • patterns (NTByteArrayList) – The list of patterns to search for.

  • offset (int) – The offset of the range to search.

  • size (int) – The size of the range to search.

Returns

Returns True if successful; otherwise returns False.

Return type

bool

See also find(), findFirst() and findMultiFirst().

findMultiFirst(patterns: Pro.Core.NTByteArrayList, offset: int = 0, size: int = INVALID_STREAM_OFFSET)Pro.Core.KROffset

Searches for the first occurrence of any pattern in a specified list.

The patterns in the specified list must have the same length.

Example:

from Pro.Core import *

c = NTContainer()
c.setData(b"FooBarFooBarFooBar")

patterns = NTByteArrayList()
patterns.append(b"Foo")
patterns.append(b"Bar")
m = c.findMultiFirst(patterns)
if m.offset != INVALID_STREAM_OFFSET:
    print(m.offset, m.pattern)
Parameters
  • patterns (NTByteArrayList) – The list of patterns to search for.

  • offset (int) – The offset of the range to search.

  • size (int) – The size of the range to search.

Returns

Returns the first match if any; otherwise KROffset.offset is INVALID_STREAM_OFFSET.

Return type

KROffset

See also find(), findFirst() and findMulti().

getAddressSpace()Pro.Core.NTAddressSpace
Returns

Returns the address space of the container if present; otherwise returns an invalid address space.

Return type

NTAddressSpace

See also addAddressSpace() and hasAddressSpace().

getRange()tuple
Returns

Returns a tuple containing a boolean and two integers. If the boolean is True, then the container has a range and the two integers are the offset and the size of the range.

Return type

tuple[bool, int, int]

See also hasRange(), setRange() and resetRange().

getSubContainer()Pro.Core.NTContainer
Returns

Returns the internal container referenced by the current container if any; otherwise returns an invalid container.

Return type

NTContainer

See also setSubContainer().

hasAddressSpace()bool
Returns

Returns True if the current container has an address space; otherwise returns False.

Return type

bool

See also getAddressSpace() and addAddressSpace().

hasRange()bool
Returns

Returns True if the current container has a range; otherwise returns False.

Return type

bool

See also getRange(), setRange() and resetRange().

hasReferenceContainer()bool
Returns

Returns True if the current container has a reference container; otherwise returns False.

Return type

bool

See also referenceContainer().

isNull()bool
Returns

Returns True if the current container is invalid; otherwise returns False.

Return type

bool

See also isValid().

isResizable()bool
Returns

Returns True if the current container is resizable; otherwise returns False.

Return type

bool

See also setResizable().

isValid()bool
Returns

Returns True if the current container is valid; otherwise returns False.

Return type

bool

See also isNull().

isValidAddress(address: int)bool

Checks whether the specified address is valid in the context of the current container.

Parameters

address (int) – The address to check.

Returns

Returns True if the address is valid; otherwise returns False.

Return type

bool

See also validRange() and validRawRange().

name()str
Returns

Returns the internal name of the container. A container may have a name only if created from a named object like a file.

Return type

str

See also dataType() and setData().

read(offset: int, size: int)bytes

Reads data from the container.

Parameters
  • offset (int) – The offset of the data to read.

  • size (int) – The size of the data to read.

Returns

Returns the requested data if successful; otherwise returns an empty bytes object.

Return type

bytes

See also write().

readU16BE(offset: int)tuple

Reads a big-endian 16-bit unsigned integer from the container.

Parameters

offset (int) – The offset of the value to read.

Returns

Returns a tuple consisting of the value and a boolean which indicates the success of the operation.

Return type

tuple[int, bool]

See also readU16LE() and writeU16BE().

readU16LE(offset: int)tuple

Reads a little-endian 16-bit unsigned integer from the container.

Parameters

offset (int) – The offset of the value to read.

Returns

Returns a tuple consisting of the value and a boolean which indicates the success of the operation.

Return type

tuple[int, bool]

See also readU16BE() and writeU16LE().

readU32BE(offset: int)tuple

Reads a big-endian 32-bit unsigned integer from the container.

Parameters

offset (int) – The offset of the value to read.

Returns

Returns a tuple consisting of the value and a boolean which indicates the success of the operation.

Return type

tuple[int, bool]

See also readU32LE() and writeU32BE().

readU32LE(offset: int)tuple

Reads a little-endian 32-bit unsigned integer from the container.

Parameters

offset (int) – The offset of the value to read.

Returns

Returns a tuple consisting of the value and a boolean which indicates the success of the operation.

Return type

tuple[int, bool]

See also readU32BE() and writeU32LE().

readU64BE(offset: int)tuple

Reads a big-endian 64-bit unsigned integer from the container.

Parameters

offset (int) – The offset of the value to read.

Returns

Returns a tuple consisting of the value and a boolean which indicates the success of the operation.

Return type

tuple[int, bool]

See also readU64LE() and writeU64BE().

readU64LE(offset: int)tuple

Reads a little-endian 64-bit unsigned integer from the container.

Parameters

offset (int) – The offset of the value to read.

Returns

Returns a tuple consisting of the value and a boolean which indicates the success of the operation.

Return type

tuple[int, bool]

See also readU64BE() and writeU64LE().

readU8(offset: int)tuple

Reads an 8-bit unsigned integer from the container.

Parameters

offset (int) – The offset of the value to read.

Returns

Returns a tuple consisting of the value and a boolean which indicates the success of the operation.

Return type

tuple[int, bool]

See also read().

referenceContainer()Pro.Core.NTContainer
Returns

Returns the reference container if any; otherwise returns None.

Return type

NTContainer

See also hasReferenceContainer().

resetRange()None

Resets the range of the container.

See also hasRange(), getRange() and setRange().

resize(new_size: int, zero: bool = True)bool

Resizes the container.

The container must be resizable for this method to succeed.

Parameters
  • new_size (int) – The new size of the container.

  • zero (bool) – If True, makes sure that additionally allocated size is initialized to zero.

Returns

Returns True if successful; otherwise returns False.

Return type

bool

save(fname: str, offset: int = 0, size: int = INVALID_STREAM_OFFSET)bool

Copies the container, or part of it, to a specified file.

Parameters
  • fname (str) – The file name.

  • offset (int) – The offset of the range to save.

  • size (int) – The size of the range to save.

Returns

Returns True if successful; otherwise returns False.

Return type

bool

See also appendTo(), copyTo() and copyToNewContainer().

setData(data: Union[NTContainer, NT_FILE, bytes, int, str], own_or_size: Union[bool, int] = True)None

Sets the internal data referenced by the container.

Parameters
  • data (Union[NTContainer, NT_FILE, bytes, int, str]) – The data to set.

  • own_or_size (Union[bool, int]) – If the data set is an NT_FILE, then the own parameter if True ensures that the file handle is automatically closed when the internal reference counter of the container reaches zero. If the data set is an 8-bit integer, then the size parameter determines how many times the 8-bit integer will be repeated.

See also dataType().

setRange(offset: int, size: int, optimize_for_speed: bool = True)None

Sets the internal range for the container.

Example:

from Pro.Core import *

c = NTContainer()
c.setData(b"Hello, world!")
# increase the reference count of c
c2 = c.clone()
# set a new range for c2
c2.setRange(7, 5)
# prints out "Hello, world!"
print(c.read(0, c.size()).decode("utf-8"))
# prints out "world"
print(c2.read(0, c2.size()).decode("utf-8"))

This is usually an inexpensive operation, unless the container has an address space and optimize_for_speed is True. In that case, the memory might be copied to allow faster I/O operations on it.

Parameters
  • offset (int) – The offset of the range.

  • size (int) – The size of the range.

  • optimize_for_speed (bool) – If True, might cause a deep copy under certain circumstances.

See also hasRange(), getRange() and resetRange().

setResizable(b: bool)None

Sets the resizable status of the container.

By default containers are not resizable.

Parameters

b (bool) – If True, the container becomes resizable.

See also isResizable().

setSubContainer(c: Pro.Core.NTContainer)None

Sets the internally referenced container.

Parameters

c (NTContainer) – The sub-container to set.

See also getSubContainer().

setTag(t: str)None

Sets an internal tag name for debugging purposes.

Parameters

t (str) – The tag name.

See also tag().

shift(size: int)bool

Appends size bytes at the end of the container and sets them to zero.

The container must be resizable for this method to succeed.

Parameters

size (int) – The amount of bytes to append.

Returns

Returns True if successful; otherwise returns False.

Return type

bool

See also align(), append() and resize().

size()int
Returns

Returns the size of the container. This might be the size of the underlying data referenced by the container, the size specified by setRange() or the size returned by the address space of the container if present.

Return type

int

See also getRange() and addAddressSpace().

supportsConcurrency()bool
Returns

Returns True if the data referenced by the container supports concurrent I/O operation; otherwise returns False.

Return type

bool

See also setData().

tag()str
Returns

Returns the tag name set for debugging purposes if present; otherwise returns an empty string.

Return type

str

See also setTag().

toBytes()bytes
Returns

Returns the internal bytes referenced by the container if the dataType() is Bytes; otherwise returns and empty bytes object.

Return type

bytes

See also dataType().

toContiguousProcess()Pro.Core.NTContainer

If the container references a process, this method applies an address space that makes the memory of the process appear contiguous.

Returns

Returns the contiguous memory of the process.

Return type

NTContainer

See also setData().

toString()str
Returns

Returns the internal string referenced by the container if the dataType() is String; otherwise returns and empty string.

Return type

str

See also dataType().

validRange(offset: int, size: int)bool

Checks the validity of a range in the context of the container.

Parameters
  • offset (int) – The offset of the range to check.

  • size (int) – The size of the range to check.

Returns

Returns True if the range is valid; otherwise returns False.

Return type

bool

See also validRawRange() and isValidAddress().

validRawRange(offset: int, size: int)bool

Checks the validity of a range in the context of the container ignoring the range set on the container through setRange().

Parameters
  • offset (int) – The offset of the range to check.

  • size (int) – The size of the range to check.

Returns

Returns True if the range is valid; otherwise returns False.

Return type

bool

See also validRange() and isValidAddress().

write(offset: int, bytes_or_c: Union[Pro.Core.NTContainer, bytes])bool

Write data to the container.

Parameters
  • offset (int) – The offset at which to write the data.

  • bytes_or_c (Union[NTContainer, bytes]) – The data to write. Can be a bytes object or a container.

Returns

Returns True if successful; otherwise returns False.

Return type

bool

See also read().

writeU16BE(offset: int, n: int)bool

Writes a big-endian 16-bit unsigned integer to the container.

Parameters
  • offset (int) – The offset at which to write the value.

  • n (int) – The value to write.

Returns

Returns True if successful; otherwise returns False.

Return type

bool

See also writeU16LE() and readU16BE().

writeU16LE(offset: int, n: int)bool

Writes a little-endian 16-bit unsigned integer to the container.

Parameters
  • offset (int) – The offset at which to write the value.

  • n (int) – The value to write.

Returns

Returns True if successful; otherwise returns False.

Return type

bool

See also writeU16BE() and readU16LE().

writeU32BE(offset: int, n: int)bool

Writes a big-endian 32-bit unsigned integer to the container.

Parameters
  • offset (int) – The offset at which to write the value.

  • n (int) – The value to write.

Returns

Returns True if successful; otherwise returns False.

Return type

bool

See also writeU32LE() and readU32BE().

writeU32LE(offset: int, n: int)bool

Writes a little-endian 32-bit unsigned integer to the container.

Parameters
  • offset (int) – The offset at which to write the value.

  • n (int) – The value to write.

Returns

Returns True if successful; otherwise returns False.

Return type

bool

See also writeU32BE() and readU32LE().

writeU64BE(offset: int, n: int)bool

Writes a big-endian 64-bit unsigned integer to the container.

Parameters
  • offset (int) – The offset at which to write the value.

  • n (int) – The value to write.

Returns

Returns True if successful; otherwise returns False.

Return type

bool

See also writeU64LE() and readU64BE().

writeU64LE(offset: int, n: int)bool

Writes a little-endian 64-bit unsigned integer to the container.

Parameters
  • offset (int) – The offset at which to write the value.

  • n (int) – The value to write.

Returns

Returns True if successful; otherwise returns False.

Return type

bool

See also writeU64BE() and readU64LE().

writeU8(offset: int, n: int)bool

Writes an 8-bit unsigned integer to the container.

Parameters
  • offset (int) – The offset at which to write the value.

  • n (int) – The value to write.

Returns

Returns True if successful; otherwise returns False.

Return type

bool

See also write().

class NTContainerBuffer(container: Pro.Core.NTContainer, endianness: int, offset: int, method: int = Bufferize_Forwards)

Bases: Pro.Core.NTBuffer

This class provides buffered read capability for NTContainer.

Parameters

See also NTBuffer and CFFBuffer.

class NTDate(y: Optional[int] = None, m: Optional[int] = None, d: Optional[int] = None)

This class provides date functions.

Optionally initializes a date from the input parameters.

Parameters
  • y (Optional[int]) – The year.

  • m (Optional[int]) – The month.

  • d (Optional[int]) – The day.

See also NTTime and NTDateTime.

addDays(ndays: int)Pro.Core.NTDate

Returns an NTDate object containing a date ndays later than the date of this object (or earlier if ndays is negative).

Returns a null date if the current date is invalid or the new date is out of range.

Parameters

ndays (int) – The days to add.

Returns

Returns a valid date if successful; otherwise returns a null date.

Return type

NTDate

See also addMonths(), addYears() and daysTo().

addMonths(nmonths: int)Pro.Core.NTDate

Returns an NTDate object containing a date nmonths later than the date of this object (or earlier if nmonths is negative).

Note

If the ending day/month combination does not exist in the resulting month/year, this function will return a date that is the latest valid date in the selected month.

Parameters

nmonths (int) – The months to add.

Returns

Returns a valid date if successful; otherwise returns a null date.

Return type

NTDate

See also addDays() and addYears().

addYears(nyears: int)Pro.Core.NTDate

Returns an NTDate object containing a date nyears later than the date of this object (or earlier if nyears is negative).

Note

If the ending day/month combination does not exist in the resulting year (e.g., for the Gregorian calendar, if the date was Feb 29 and the final year is not a leap year), this function will return a date that is the latest valid date in the given month (in the example, Feb 28).

Parameters

nyears (int) – The years to add.

Returns

Returns a valid date if successful; otherwise returns a null date.

Return type

NTDate

See also addMonths() and addYears().

static currentDate()Pro.Core.NTDate
Returns

Returns the current date, as reported by the system clock.

Return type

NTDate

See also NTTime.currentTime() and NTDateTime.currentDateTime().

day()int
Returns

Returns the day of the month for this date.

Return type

int

See also year(), month() and dayOfWeek().

dayOfWeek()int
Returns

Returns the weekday (1 = NTMonday to 7 = NTSunday) for this date.

Return type

int

See also day() and dayOfYear().

dayOfYear()int
Returns

Returns the day of the year (1 for the first day) for this date.

Return type

int

See also day() and dayOfWeek().

daysInMonth()int
Returns

Returns the number of days in the month for this date.

Return type

int

See also day() and daysInYear().

daysInYear()int
Returns

Returns the number of days in the year for this date.

Return type

int

See also day() and daysInMonth().

daysTo(d: Pro.Core.NTDate)int

Returns the number of days from this date to d (which is negative if d is earlier than this date).

Parameters

d (NTDate) – The date for which to compute the difference in days.

Returns

Returns the number of days or 0 if either date is invalid.

Return type

int

See also addDays().

static fromJulianDay(jd: int)Pro.Core.NTDate

Converts the Julian day jd to an NTDate object.

Parameters

jd (int) – The Julian day.

Returns

Returns the date object.

Return type

NTDate

See also toJulianDay().

static fromString(string: str, format: Union[NTDateFormat, str] = NTTextDate)NTDate

Converts a string to an NTDate object.

Parameters
  • string (str) – The string to convert.

  • format (Union[NTDateFormat, str]) – The format of the string.

Returns

Returns the converted date if successful; otherwise returns an invalid date.

Return type

NTDate

See also toString(), NTDate.fromString() and NTDateTime.fromString().

static isLeapYear(year: int)bool

Checks if the specified year is a leap year in the Gregorian calendar.

Parameters

year (int) – The year to check.

Returns

Returns True if the specified year is a leap year in the Gregorian calendar; otherwise returns False.

Return type

bool

isNull()bool
Returns

Returns True if the date is null; otherwise returns False.

Return type

bool

See also isValid().

isValid()bool

Checks the validity of the current date.

Returns

Returns True if the date is valid; otherwise returns False.

Return type

bool

See also isNull().

month()int
Returns

Returns the month-number for the date (1 = January) if the date is valid; otherwise returns 0.

Return type

int

See also year() and day().

setDate(year: int, month: int, day: int)bool

Sets this to represent the date, in the Gregorian calendar, with the given year, month and day numbers.

Parameters
  • year (int) – The year.

  • month (int) – The month.

  • day (int) – The day.

Returns

Returns True if the resulting date is valid; otherwise returns False.

Return type

bool

See also isValid().

toJulianDay()int

Converts the date to a Julian day.

Returns

Returns the Julian day.

Return type

int

See also fromJulianDay().

toString(format: Union[NTDateFormat, str] = NTTextDate)str

Returns the date as a string. The format parameter determines the format of the string.

Parameters

format (Union[NTDateFormat, str]) – Optionally specify the format of the string.

Returns

Returns the date string if successful; otherwise returns an empty string.

Return type

str

See also fromString().

weekNumber()int

Returns the ISO 8601 week number (1 to 53).

Returns

Returns the week number if the date is valid; otherwise returns 0.

Return type

int

See also isValid().

year()int
Returns

Returns the year of this date if the date is valid; otherwise returns 0.

Return type

int

See also month() and day().

class NTDateTime(date: Optional[NTDate] = None, time: Optional[NTTime] = None, spec: NTTimeSpec = NTLocalTime)

This class provides date and time functions.

Optionally constructs the NTDateTime from an NTTime and an NTDate.

Parameters
  • date (Optional[NTDate]) – The date object.

  • time (Optional[NTTime]) – The time object.

  • spec (NTTimeSpec) – Time specification. The default is NTLocalTime.

See also NTTime and NTDate.

addDays(ndays: int)Pro.Core.NTDateTime

Returns an NTDateTime object containing a datetime ndays days later than the datetime of this object (or earlier if ndays is negative).

Note

If the timeSpec() is NTLocalTime and the resulting date and time fall in the Standard Time to Daylight-Saving Time transition hour then the result will be adjusted accordingly, i.e. if the transition is at 2am and the clock goes forward to 3am and the result falls between 2am and 3am then the result will be adjusted to fall after 3am.

Parameters

ndays (int) – The days to add.

Returns

Returns a valid datetime if successful; otherwise returns a null datetime.

Return type

NTDateTime

See also daysTo(), addMonths(), addYears() and addSecs().

addMSecs(msecs: int)Pro.Core.NTDateTime

Returns an NTDateTime object containing a datetime msecs milliseconds later than the datetime of this object (or earlier if msecs is negative).

Parameters

msecs (int) – The milliseconds to add.

Returns

Returns a valid datetime if successful; otherwise returns a null datetime.

Return type

NTDateTime

See also msecsTo(), addSecs(), addDays(), addMonths() and addYears().

addMonths(nmonths: int)Pro.Core.NTDateTime

Returns an NTDateTime object containing a datetime nmonths months later than the datetime of this object (or earlier if nmonths is negative).

Note

If the timeSpec() is NTLocalTime and the resulting date and time fall in the