Pro.Core — Core API for parsing and scanning files

Overview

The Pro.Core module contains the core API for parsing and scanning files.

Core Concepts

Some of the most important classes are:

  • NTContainer - This is a generic container used to encapsulate data such as files and memory. It’s an extremely important class and it’s used extensively. Containers can be created through SDK functions such as createContainerFromFile() and newContainer().

  • NTBuffer/NTContainerBuffer/CFFBuffer/etc. - These type of classes are used to efficiently read iteratively small amounts of data from a source. NTBuffer is the base class and derived classes are named after the object they read from. E.g.: NTContainerBuffer reads from NTContainer and CFFBuffer reads from CFFObject.

  • NTTextStream/NTTextBuffer/NTTextStringBuffer - These classes are used to output text. The amount of indentation can be specified. NTTextStream is the base class and derived classes are named after the output type: NTTextBuffer outputs to a utf-8 array and NTTextStringBuffer to a utf-16 array.

  • NTXml - Used to parse XML. This class is fast and secure. The code is based on RapidXML.

  • CFFObject - The class from which every format class is derived (ZipObject, PEObject, etc.). While NTContainer provides basic parsing facilities, more complex types and the use of CFFStruct rely upon CFFObject.

  • CFFHeader - Headers contain definition of structures and can be loaded from SQLite files or XML strings. The structures can be imported from C/C++ code through the Header Manager or from debug symbols such as PDB files.

  • CFFStruct - This class represents a data structure.

  • CFFFlags - This class represents the flags of a field in a CFFStruct.

Hint

If you’re wondering why the case convention for methods is not always the same, the reason is simple. Classes such as CFFObject and CFFStruct are based on older code which followed the pascal-case convention. Consequently all derived classes like PEObject follow this convention. All other classes use the camel-case convention.

Basic types like integers and strings are automatically converted between C++ and Python. However, lists are preserved for efficiency reasons. Whenever the signature of a method contains a list or another type of container class, you must work with the C++ class. For example, the following example creates a list of C++ integers and iterates through it:

from Pro.Core import *

l = NTIntList()
for i in range(10):
    l.append(i)
it = NTIntListIt(l)
while it.hasNext():
    print(it.next())

Lists, vectors, hashes and sets all have specialized C++ classes usually relying on Qt containers. These type of classes are easily recognized due to the naming convention.

Note

While in C++ these classes are implemented as template classes, in Python they are exposed as different types. However, NTIntList will have exactly the same methods as NTStringList.

Parsing Files

Printing out a structure in a file can be as simple as:

from Pro.Core import *
from Pro.PE import *

def printDOSHeader(fname):
    c = createContainerFromFile(fname)
    if c.isNull():
        return
    pe = PEObject()
    if not pe.Load(c):
        return
    out = NTTextBuffer()
    pe.DosHeader().Dump(out) # CFFStruct.Dump
    print(out.buffer)

Warning

Avoid initializing NTContainer and CFFObject objects globally in order to avoid memory leaks!

If you really need to use a global object, make sure to set it to None when it is no longer needed. This way, the garbage collector will release the allocated memory.

NTContainer is a powerful abstraction for reading from a target. The target can be a memory buffer, a file or even the memory of a remote process. When NTContainer objects are returned by calling functions like createContainerFromFile() or newContainer(), they may either encapsulate a file or a memory buffer. Whether to use a file or a memory buffer is internally decided upon the basis of current memory resources.

If you want to make sure that an NTContainer instance encapsulates a memory buffer you can do it by specifically setting its internal object:

from Pro.Core import *

c = NTContainer()
# set a byte array as the internal object of NTContainer
c.setData(b"")
# NTContainer are never resizeable by default
c.setResizable(True)
# append some data
c.append(b"foo")
# print out the size of 3
print(c.size())

Ranges and address spaces can also be applied to NTContainer. Consider the following example:

from Pro.Core import *

c = NTContainer()
c.setData(b"Hello, world!")
# increase the reference count of c
c2 = c.clone()
# set a new range for c2
c2.setRange(7, 5)
# prints out "Hello, world!"
print(c.read(0, c.size()).decode("utf-8"))
# prints out "world"
print(c2.read(0, c2.size()).decode("utf-8"))

The c2 instance refers to the same object as c but with a different range. This is very useful when working with embedded objects. For instance, parsing a resource inside of a binary file might only require setting the range on an instance NTContainer of the parent binary file, before being passed onto CFFObject.Load().

It is not necessary to subclass CFFObject in order parse a file. We can use CFFObject directly:

from Pro.Core import *

xml_header = """<header>

<r id='_IMAGE_DOS_HEADER' type='struct'>
  <f id='e_magic' type='unsigned short'/>
  <f id='e_cblp' type='unsigned short'/>
  <f id='e_cp' type='unsigned short'/>
  <f id='e_crlc' type='unsigned short'/>
  <f id='e_cparhdr' type='unsigned short'/>
  <f id='e_minalloc' type='unsigned short'/>
  <f id='e_maxalloc' type='unsigned short'/>
  <f id='e_ss' type='unsigned short'/>
  <f id='e_sp' type='unsigned short'/>
  <f id='e_csum' type='unsigned short'/>
  <f id='e_ip' type='unsigned short'/>
  <f id='e_cs' type='unsigned short'/>
  <f id='e_lfarlc' type='unsigned short'/>
  <f id='e_ovno' type='unsigned short'/>
  <f id='e_res' type='unsigned short [4]'/>
  <f id='e_oemid' type='unsigned short'/>
  <f id='e_oeminfo' type='unsigned short'/>
  <f id='e_res2' type='unsigned short [10]'/>
  <f id='e_lfanew' type='int'/>
</r>

</header>"""

def printStructure(fname):
    c = createContainerFromFile(fname)
    if c.isNull():
        return
    # load header from an XML string
    header = CFFHeader()
    if not header.LoadFromXml(xml_header):
        return
    obj = CFFObject()
    # since CFFObject is not subclassed, the Load method cannot fail
    obj.Load(c)
    # map a structure to a specific offset
    offset = 0
    s = obj.MakeStruct(header, "_IMAGE_DOS_HEADER", offset, CFFSO_VC | CFFSO_Pack1)
    out = NTTextBuffer()
    s.Dump(out)
    print(out.buffer)

To read in a buffered way from a target object, be it CFFObject or NTContainer, you can use NTBuffer derived classes such as NTContainerBuffer and CFFBuffer:

from Pro.Core import *

def bufferedRead(fname):
    c = createContainerFromFile(fname)
    if c.isNull():
        return
    obj = CFFObject()
    obj.Load(c)
    offset = 0
    r = obj.ToBuffer(offset)
    try:
        # read a single byte from the file
        b = r.u8()
    except IndexError:
        print("error: out of range")

By default buffered readers default to Bufferize_Forwards. If you want to read backwards or back and forth you can specify Bufferize_Backwards or Bufferize_BackAndForth respectively.

The default endianness can be specified both for CFFObject and NTBuffer instances. If not specified, endianness will default to ENDIANNESS_LITTLE.

If need to parse an XML string, you can use our NTXml class, which is both fast and secure.

from Pro.Core import *

x = NTXml()
ret = x.parse("<r><e t='test'></e></r>")
if ret == NTXml_ErrNone:
    n = x.findChild(None, "r")
    if n != None:
        n = x.findChild(n, "e")
        if n != None:
            a = x.findAttribute(n, "t")
            if a != None:
                print(x.value(a))

All the filters which are available in the UI can be used programmatically from the SDK.

from Pro.Core import *

c = NTContainer()
c.setData(b"Hello, world!")
# compress data with zlib
fstr = "<flts><f name='pack/zlib' level='9' raw='true'/></flts>"
# set the last parameter to False to hide the wait-box
c = applyFilters(c, fstr, True)
# print out the compressed data
print(c.read(0, c.size()))

By using filters it’s possible to perform complex data operations with just a few lines of code. In the code snippet above we use a filter to compress the input data using zlib.

Scanning Files

In this section we offer an introduction into the internals of our scan engine.

The core classes are:

  • Report - This class represents a project. A project can be unpacked or packed. When it’s unpacked, it consists of a directory containing a number of DBs and other files. When it’s packed, the same files are merged into a single file and may be compressed and/or encrypted. Fundamentally, in the context of file scanning, a project contains a SQLite3 database which, in turn, contains XML reports for each scanned file. The current instance of this class is returned by ProCoreContext.getReport().

  • ScanProvider - This is the base class inherited by all the scan engines for the different file formats.

  • ScanEntryData - This is the class that contains the data passed to ScanProvider.addEntry(). Every time a scan provider for a file format encounters a threat, warning, information, privacy issue or embedded file, it calls ScanProvider.addEntry().

  • FormatTree - A tree of uint32 ids that describe the layout structure of the analyzed file. This is the layout shown in the format view in the analysis workspace.

  • FormatItemInfo - The information returned for each individual item in the format tree. ScanProvider._formatViewInfo() returns this information based on the id provided when constructing the FormatTree.

  • ScanViewData - This class is returned by ScanProvider._scanViewData() and ScanProvider._formatViewData(). It may represent raw data, in case of an embedded file, as well as a complex UI.

  • CommonSystem - Logic providers return classes derived from this class to define a scanning behaviour. For instance, when creating a logic provider which analyzes only a specific set of files in a directory or on a file system, the derived class LocalSystem can be used.

  • ProCoreContext - Provides context information like the current scan provider (ProCoreContext.currentScanProvider()) or the current report (ProCoreContext.getReport()). The global instance of this class is returned by proCoreContext().

As mentioned, for every scanned file an XML report is generated. Below is the commented schema of these XML reports.

<!-- XML schema

note: attributes are marked by parenthesis

o = object
 (t = type
  u = current entry unique id (in hex)
  s = target (base64)
  r = risk
  f = flags)

s = scan entries
  t = threat
  w = warning
  i = info
   (t = type
    u = unique identifier for the entry (in hex)
    f = flags (optional)
    s = target (optional, for embedded files)(base64)
    l = object format (for embedded files)
    )
   (- ic = indirect category
      it = indirect type
    - fi = format item id
    ii = internal file uid
    v  = view
    of = offset
    sz = size)
    d = data (mandatory)
  extra:
    t = text
    flts = filters
      f = filter
        (name + params)
    s = shellcode
      (a = arch
       b = base address
       )

e = embedded objects
  o = object (see above)

h = hashes
  md5 = md5 hash
  etc.

m = metadata
 (ct = creation time
  mt = modification time
  at = access time
  )
  e = entry (content is base64 encoded)
   (id = name identifying the entry (raw)
    l = label (base64)
    f = flags (1 for text to show in report)
    )

<!-- sample -->
<o t="pe" s="C:/file" r="100">

  <!-- scan entries -->
  <s>

    <!-- threat entry -->
    <t t="5" u="0">

      <!-- custom data for the current entry, this is handled by
           the specific scan provider -->
      <d>
        <start>0</start>
        <size>1000</size>
      </d>

      <!-- human readable text (for showing advanced infos)
           encoded in utf8->base64 -->
      <t></t>

      <!-- filters applied on the retrieved data -->
      <flts>
        <f n="aes" p="cbc;256" k="11223344.." />
        <f n="z" />
      </flts>

    </t>

  </s>

  <!-- what follows is a list of embedded objects
       in the same order of the embedded file entries -->
  <e>
    <o t="pdf" r="70">
      <!-- ... -->
    </o>
  </e>

  <!-- various hashes (if any) stored for the current object -->
  <h>
   <md5>00000000000000..</md5>
   <sha1>000000000000...</sha1>
  </h>

  <!-- metadata (if any) -->
  <m ct="hex" wt="hex" at="hex">
    <e>base64</e>
    <e f=1>base64</e> <!-- will be shown as text in the report view -->
  </m>


</o>

The important part to understand when working with the SDK is the custom data mentioned in the schema (the <d> node). This is the custom XML data which is provided by the ScanProvider during the scanning process via ScanProvider.addEntry() and is then passed back to ScanProvider._scanViewData() when requesting data relative to a scan entry.

The data returned from a scan entry can be everything: from a simple description of a threat to an embedded file. In fact, ScanProvider._scanViewData() can return even complex UIs or native code disassembled by our Carbon engine.

Module API

Pro.Core module API.

Attributes:

Bufferize_BackAndForth

Buffering method for NTBuffer.

Bufferize_Backwards

Buffering method for NTBuffer.

Bufferize_Forwards

Buffering method for NTBuffer.

Bufferize_Invalid

Buffering method for NTBuffer.

CFFDBIndexSize32

32-bit index size for CFFDB.

CFFDBIndexSize64

64-bit index size for CFFDB.

CFFDBInvalidIndex

Invalid index for CFFDB.

CFFDBRootIndex

Root index for CFFDB.

CFFN_Base

Base value for standard CFFObject notifications.

CFFN_Malformed

CFFObject notification for malformed data.

CFFN_MoreFiles

CFFObject notification for the file limit.

CFFN_NoDecrypt

CFFObject notification for failed decryption.

CFFN_NoUnpack

CFFObject notification for failed decompression.

CFFN_ParsingLimit

CFFObject notification for an internal parsing limit.

CFFN_Recursive

CFFObject notification for recursion.

CFFN_UnpackLimit

CFFObject notification for the decompression limit.

CFFN_UnpackNestLimit

CFFObject notification for the decompression nesting limit.

CFFPtrMaxSize

The maximum supported pointer size.

CFFPtrMinSize

The minimum supported pointer size.

CFFPtrSize16

16-bit pointer size.

CFFPtrSize32

32-bit pointer size.

CFFPtrSize64

64-bit pointer size.

CFFSO_Clang

This flag specifies that the structure was generated by the Clang compiler.

CFFSO_CompilerMask

Compiler mask for the flags of the structure.

CFFSO_EndianBig

This flag specifies that the structure is big-endian.

CFFSO_EndianDefault

This flag specifies that the structure uses the default endianness.

CFFSO_EndianLittle

This flag specifies that the structure is little-endian.

CFFSO_EndiannessBig

This flag specifies that the structure is big-endian.

CFFSO_EndiannessDefault

This flag specifies that the structure uses the default endianness.

CFFSO_EndiannessLittle

This flag specifies that the structure is little-endian.

CFFSO_EndiannessMask

Endianness mask for the flags of the structure.

CFFSO_GCC

This flag specifies that the structure was generated by the GCC compiler.

CFFSO_NoCompiler

This flag specifies that the structure wasn’t generated by a specific compiler.

CFFSO_NoPlatform

This flag specifies that the structure isn’t bound to specific platform.

CFFSO_Pack1

This flag specifies that the structure has an alignment of 1.

CFFSO_Pack16

This flag specifies that the structure has an alignment of 16.

CFFSO_Pack2

This flag specifies that the structure has an alignment of 2.

CFFSO_Pack4

This flag specifies that the structure has an alignment of 4.

CFFSO_Pack8

This flag specifies that the structure has an alignment of 8.

CFFSO_PackMask

Alignment mask for the flags of the structure.

CFFSO_PackNone

This flag specifies that the structure doesn’t have an alignment.

CFFSO_PlatformMask

Platform mask for the flags of the structure.

CFFSO_Pointer16

This flag specifies that the pointer size of the structure is 16-bits.

CFFSO_Pointer32

This flag specifies that the pointer size of the structure is 32-bits.

CFFSO_Pointer64

This flag specifies that the pointer size of the structure is 64-bits.

CFFSO_PointerDefault

This flag specifies that the pointer size of the structure is the default one for the object.

CFFSO_PointerMask

Pointer mask for the flags of the structure.

CFFSO_VC

This flag specifies that the structure was generated by the Visual C++ compiler.

CFFSO_Windows

This flag specifies that the structure was generated for the Windows platform.

CFF_ARRAY_NULL_TERMINATED

If specified, makes an array of structure be null-terminated.

CT_ActionScript2

Scan entry type for ActionScript2.

CT_ActionScript3

Scan entry type for ActionScript3.

CT_AppLaunch

Scan entry type for application launches.

CT_AttackSurface

Scan entry type for attack surfaces.

CT_BinaryData

Scan entry type for binary data.

CT_Blacklisted

Scan entry type for a blacklisted item.

CT_ByteCode

Scan entry type for byte-code.

CT_DalvikByteCode

Scan entry type for Dalvik byte-code.

CT_DataEntriesEnd

Scan entry type for data entries end.

CT_DataEntriesStart

Scan entry type for data entries start.

CT_DebugData

Scan entry type for debug data.

CT_DecompressionBomb

Scan entry type for decompression bombs.

CT_EmbeddedFile

Scan entry type for embedded objects.

CT_EntryLimit

Scan entry type for entry limits.

CT_ForeignData

Scan entry type for foreign data.

CT_FreePages

Scan entry type for free pages.

CT_Geolocation

Scan entry type for geo-locations.

CT_HiddenSheets

Scan entry type for hidden sheets.

CT_Intelligence

Scan entry type for an intelligence report.

CT_InteractiveForm

Scan entry type for interactive forms.

CT_InvalidCertificate

Scan entry type for invalid certificates.

CT_JavaByteCode

Scan entry type for Java byte-code.

CT_JavaScript

Scan entry type for JavaScript.

CT_MSILByteCode

Scan entry type for MSIL byte-code.

CT_Malformed

Scan entry type for malformed data.

CT_MalformedDocument

Scan entry type for malformed documents.

CT_MetaData

Scan entry type for meta-data.

CT_MetaDataUnknown

Scan entry type for unknown meta-data.

CT_NativeCode

Scan entry type for native code.

CT_NoDecompress

Scan entry type for failed decompression.

CT_NoDecrypt

Scan entry type for failed decryption.

CT_OKDecompressed

Scan entry type for successful decompression.

CT_OKDecrypted

Scan entry type for successful decryption.

CT_PersonalData

Scan entry type for personal data.

CT_Privileges

Scan entry type for required privileges.

CT_Recursive

Scan entry type for recursion.

CT_Report

Scan entry type for a report.

CT_Resources

Scan entry type for issues in resources.

CT_Script

Scan entry type for scripts.

CT_ShellCode

Scan entry type for shellcode.

CT_SignatureMatch

Scan entry type for signature matches.

CT_SpreadsheetFormulas

Scan entry type for spreadsheet formulas.

CT_SymbolicLink

Scan entry type for symbolic links.

CT_Thumbnail

Scan entry type for thumbnails.

CT_TrueType

Scan entry type for TrueType fonts.

CT_TrustedCertificate

Scan entry type for trusted certificates.

CT_Type1

Scan entry type for Type1 fonts.

CT_Type2

Scan entry type for Type2 fonts.

CT_UnaccountedSpace

Scan entry type for unaccounted space.

CT_UnknownFont

Scan entry type for unknown fonts.

CT_UnpackLimit

Scan entry type for the decompression limit.

CT_UnpackNestLimit

Scan entry type for the decompression nesting limit.

CT_UnreferencedData

Scan entry type for unreferenced data.

CT_UntrustedCertificate

Scan entry type for untrusted certificates.

CT_UnverifiedCertificate

Scan entry type for unverified certificates.

CT_VBAScript

Scan entry type for VBA code.

CT_VBSScript

Scan entry type for VBS scripts.

CT_VersionInfo

Scan entry type for version information.

CT_Whitelisted

Scan entry type for a whitelisted item.

CT_WrongCheckSum

Scan entry type for invalid checksums.

CT_WrongDigest

Scan entry type for invalid digests.

CT_WrongHash

Scan entry type for invalid hashes.

DSNF_NoAccessSpecifier

Doesn’t include the member type (i.e.: public, protected, private) in the unmangled symbol.

DSNF_NoCallingConvention

Doesn’t include the calling convention in the unmangled symbol.

DSNF_NoMemberType

Doesn’t include the member type (i.e.: static, virtual, extern) in the unmangled symbol.

DSNF_NoReturnType

Doesn’t include the return type in the unmangled symbol.

DSNF_SimpleSignature

Returns a simplified signature of the unmangled symbol.

DisasmOpt_FileOffsets

Shows offsets in disassemblies shown in the text view.

DisasmOpt_Opcodes

Shows opcodes in disassemblies shown in the text view.

ENDIANNESS_BIG

Big-endian option.

ENDIANNESS_LITTLE

Little-endian option.

EXPLICIT_OFLAGS_MASK

The mask for explicit object flags.

GB_SIZE

This constant defines the size of a gigabyte.

IMPLICIT_OFLAG_UNKNOWN_FORMAT

Implicit object flag.

INVALID_OFFSET

Invalid file or data offset.

INVALID_STREAM_OFFSET

Invalid file or data offset.

KB_SIZE

This constant defines the size of a kilobyte.

MB_SIZE

This constant defines the size of a megabyte.

METAFLAG_STRING

Specifies the string nature of the meta-data.

NATURE_BYTEARRAY

Byte-array type nature.

NATURE_NUMBER

Integer number type nature.

NATURE_REAL

Real number type nature.

NATURE_STRING

String type nature.

NATURE_UNKNOWN

Unknown type nature.

NTDefaultLocaleLongDate

The long date format used by the application’s locale.

NTDefaultLocaleShortDate

The short date format specified by the application’s locale.

NTFileOpt_CreateNew

Creates the file only if it doesn’t already exist.

NTFileOpt_ReadOnly

Read-only file access.

NTFileOpt_ShareWrite

Shared write file access.

NTFileOpt_Write

Read/write file access.

NTFlagOutput_IgnoreUnknown

Ignores unknown flags and options.

NTFriday

Fifth day of the week.

NTISODate

ISO 8601 extended date format: either yyyy-MM-dd for dates or yyyy-MM-ddTHH:mm:ss (e.g.

NTLocalTime

Local time, controlled by a system time-zone setting.

NTMonday

First day of the week.

NTOffsetFromUTC

An offset in seconds from Coordinated Universal Time.

NTProcessMemoryAccess_Execute

Executable memory flag.

NTProcessMemoryAccess_Guard

Guarded memory flag.

NTProcessMemoryAccess_Read

Readable memory flag.

NTProcessMemoryAccess_UserMode

User-mode memory flag.

NTProcessMemoryAccess_Write

Writable memory flag.

NTProcessMemoryState_Commit

Committed memory state.

NTProcessMemoryState_Free

Freed memory state.

NTProcessMemoryState_Reserve

Reserved memory state.

NTProcessMemoryType_Image

Image memory type.

NTProcessMemoryType_Mapped

Mapped memory type.

NTProcessMemoryType_Private

Private memory type.

NTRFC2822Date

RFC 2822, RFC 850 and RFC 1036 date format.

NTSaturday

Sixth day of the week.

NTSunday

Seventh day of the week.

NTSystemLocaleLongDate

The long date format used by the operating system.

NTSystemLocaleShortDate

The short date format used by the operating system.

NTTextDate

Date format equivalent to using the date format string "ddd MMM d yyyy".

NTThursday

Fourth day of the week.

NTTimeZone

A named time zone.

NTTuesday

Second day of the week.

NTUTC

Coordinated Universal Time.

NTWednesday

Third day of the week.

NTXml_ErrAlloc

Returned if an allocation error occurred.

NTXml_ErrNone

Returned if no error occurred.

NTXml_ErrParse

Returned if a parse error occurred.

NTXml_ErrUnknown

Returned if an unknown error occurred.

NTXml_FaultTolerant

Parses malformed XML data.

NTXml_IgnoreNS

Ignores XML node namespaces.

NTXml_InvalidFlags

Returned if invalid flags were specified.

NTXml_InvalidNode

Returned if an invalid node was specified.

NTXml_InvalidType

Returned if an invalid type was specified.

NT_ASF_BlockIO

Address space flag for block I/O.

NT_ASF_IgnoreInvalidPages

Address space flag to ignore invalid pages.

NT_ASF_IsSparse

Address space flag for sparse address spaces.

NT_ASF_Memory

Address space flag for process memory.

NT_ASPSF_ALL

Address space standard flag which combines all supported flags.

NT_ASPSF_DIRTY

Address space standard flag for dirty pages.

NT_ASPSF_EXECUTE

Address space standard flag for executable pages.

NT_ASPSF_GUARD

Address space standard flag for guarded pages.

NT_ASPSF_PRESENCE

Address space standard flag for readable/present pages.

NT_ASPSF_TRANSITION

Address space standard flag for transitional pages.

NT_ASPSF_USER_MODE

Address space standard flag for user mode pages.

NT_ASPSF_WRITE

Address space standard flag for writable pages.

NT_ASR_INVALID

Address space result for unsuccessful operations.

NT_ASR_OK

Address space result for successful operations.

NT_ASR_UNSUPPORTED

Address space result for unsupported operations.

NT_FileExt_Dll

Applies a shared library extension to the file name (e.g.: ".dll" on Windows and ".dylib" on macOS).

NT_FileExt_Exe

Applies a binary extension to the file name (i.e., ".exe" on Windows).

NT_FileExt_Link

Applies a link extension to the file name (i.e., ".lnk" on Windows).

NT_Folder_App

Retrieves the application directory.

NT_Folder_AppData

Retrieves the AppData directory on Windows.

NT_Folder_AppExe

Retrieves the application directory.

NT_Folder_AppMenu

Retrieves the AppMenu directory on Windows.

NT_Folder_Applications

Retrieves the applications directory on Windows.

NT_Folder_Applications_x86

Retrieves the x86 applications directory on Windows.

NT_Folder_Common_AppMenu

Retrieves the shared AppMenu directory on Windows.

NT_Folder_Common_Desktop

Retrieves the shared desktop directory on Windows.

NT_Folder_Current

Retrieves the current working directory.

NT_Folder_Desktop

Retrieves the desktop directory.

NT_Folder_Documents

Retrieves the documents directory.

NT_Folder_Home

Retrieves the home directory.

NT_Folder_Root

Retrieves the root directory (i.e., "/" on Linux/macOS and "C:/" on Windows).

NT_Folder_Temp

Retrieves the temporary directory.

NT_MEMORY_REGIONS_MAX_ADDR

Maximum memory address for memory regions.

NT_ProcessAccess_All

All process access privileges.

NT_ProcessAccess_Read

Process read access privileges.

NT_ProcessAccess_Terminate

Process termination access privileges.

OFLAG_MORE_CHILDREN

Object flag.

OFLAG_MORE_ENTRIES

Object flag.

OFLAG_MORE_SHELLCODE

Object flag.

OFLAG_NO_DECRYPT

Object flag.

OFLAG_NO_UNPACK

Object flag.

OFLAG_PARSING_LIMIT

Object flag.

OFLAG_UNPACK_LIMIT

Object flag.

OFLAG_UNPACK_NESTING

Object flag.

REPORT_DB_EXT

File extension for an unpacked project.

REPORT_DB_NAME

Name of the main project database.

REPORT_EXT

File extension for a packed project.

REPORT_INT_ODB_NAME

Name of the internal files database.

REPORT_INT_PATH

Name of the internal files path.

REPORT_INT_ROOT_PREFIX

The prefix used to reference internal files from root entries.

REPORT_ODB_NAME

Name of the object database.

REPORT_PROJECT_SIGNATURE

File signature for a packed project.

REPORT_VERSION

Current project version.

SCANVIEW_BE

Specifies that the returned data is big-endian.

SCANVIEW_CARBON

Carbon view.

SCANVIEW_CELLTABLE

Cell table view.

SCANVIEW_CHART

Chart view.

SCANVIEW_CODEC_ASCII

Specifies that the returned data is ascii.

SCANVIEW_CODEC_MASK

Codec mask for the returned data.

SCANVIEW_CODEC_UCS2

Specifies that the returned data is ucs-2.

SCANVIEW_CODEC_UCS4

Specifies that the returned data is ucs-4.

SCANVIEW_CODEC_UTF16

Specifies that the returned data is utf-16.

SCANVIEW_CODEC_UTF32

Specifies that the returned data is utf-32.

SCANVIEW_CODEC_UTF8

Specifies that the returned data is utf-8.

SCANVIEW_CODE_JAVASCRIPT

Specifies that the returned data is JavaScript code.

SCANVIEW_CODE_MASK

Code mask for the returned data.

SCANVIEW_CODE_NONE

Specifies no code type for the returned data.

SCANVIEW_CODE_VBA

Specifies that the returned data is VBA code.

SCANVIEW_CODE_VBS

Specifies that the returned data is VBS code.

SCANVIEW_CUSTOM

Custom view.

SCANVIEW_CUSTOM_2

Second custom view.

SCANVIEW_CUSTOM_3

Third custom view.

SCANVIEW_CUSTOM_4

Fourth custom view.

SCANVIEW_CUSTOM_5

Fifth custom view.

SCANVIEW_DATA_NOT_SHARED

Specifies that the returned data is utf-16 is not shared among the views.

SCANVIEW_EMASK

Endianness mask for the returned data.

SCANVIEW_GEO

Geo-location view.

SCANVIEW_HEX

Hex view.

SCANVIEW_KEYVALUE

Key-value view.

SCANVIEW_LE

Specifies that the returned data is little-endian.

SCANVIEW_LIST

List view.

SCANVIEW_ME

Specifies that the returned data is middle-endian.

SCANVIEW_MEDIA

Media view.

SCANVIEW_NONE

Invalid view.

SCANVIEW_PLOT

Plot view.

SCANVIEW_RAW

Raw hex view.

SCANVIEW_TABLE

Table view.

SCANVIEW_TEXT

Text view.

SCANVIEW_TEXTBROWSER

Text browser view.

SCANVIEW_TREE

Tree view.

SCANVIEW_WEB

Web view.

SEC_File

Scan entry category for embedded objects.

SEC_Info

Scan entry category for information.

SEC_Intrinsic

Scan entry category for intrinsic threats.

SEC_Online

Scan entry category for online entries.

SEC_Privacy

Scan entry category for privacy issues.

SEC_Threat

Scan entry category for threats.

SEC_Warn

Scan entry category for warnings.

SFT_AccessTime

Scan provider time type for file access.

SFT_CreationTime

Scan provider time type for file creation.

SFT_ModificationTime

Scan provider time type for file modification.

TB_SIZE

This constant defines the size of a terabyte.

THIS_HDR_NAME

The special name of the header file associated with the report.

THIS_HEADER_NAME

The file name of the header file associated with the report.

TYPES_NATURE_BASE

Base value for type nature.

ToolDir_CheckExistence

Checks for the existence of the directory.

ToolDir_CreateIfMissing

Creates the directory if missing.

ToolDir_None

Returns the requested directory without checking for its existence or creating it if missing.

Classes:

CFFBuffer(object, offset, method)

This class provides buffered read capability for CFFObject.

CFFContainer()

This is a derived class from NTContainer which can reference data as CFFObject and CFFStruct.

CFFContext()

This class is used internally by CFFStruct to store information from members which affect the position and size of other members.

CFFDB()

This class creates a volatile tree structure that is either stored in memory or on disk.

CFFFlags()

This class contains flags and options for a member of CFFStruct.

CFFHeader()

This class represents a header.

CFFHeaderAliasData()

Alias data of a header file.

CFFHeaderStructData()

Structure data of a header file.

CFFHeaderTypeDefData()

Type definition data of a header file.

CFFObject()

The class from which every format class is derived (ZipObject, PEObject, etc.).

CFFStruct()

This class represents a data structure and references a CFFObject instance.

CFFStructIt(s)

Iterator for an array of CFFStruct structures.

CFFStructList()

List of CFFStruct elements.

CFFStructListIt(obj)

Iterator class for CFFStructList.

CommonSystem()

Logic providers return classes derived from this class to define a scanning behaviour.

FileToScan()

This class contains information about the file to scan returned by classes derived from CommonSystem.

FormatItemInfo()

The information about a format item returned by ScanProvider._formatViewInfo().

FormatTree()

Tree of FormatTreeNode nodes.

FormatTreeNode()

This class represents a node of FormatTree.

FormatTreeNodeList()

List of FormatTreeNode elements.

FormatTreeNodeListIt(obj)

Iterator class for FormatTreeNodeList.

KROffset()

Match for a byte search in NTContainer.

Layout()

Layouts are used to create ranges and associate structures to hex views.

LayoutData()

This class contains the data of a layout entry.

LayoutInterval()

This class represents a layout interval.

LayoutPair(t1, t2)

Pair of (LayoutInterval, LayoutData) elements.

LayoutPairList()

List of LayoutPair elements.

LayoutPairListIt(obj)

Iterator class for LayoutPairList.

LocalSystem()

CommonSystem derived class used to perform local file system scans.

NTAddressSpace()

This class is used to apply address spaces to containers.

NTBuffer()

Base class for buffered read operations.

NTByteArrayList()

List of bytes elements.

NTByteArrayListIt(obj)

Iterator class for NTByteArrayList.

NTContainer()

This is a generic container used to encapsulate data such as files and memory.

NTContainerBuffer(container, endianness, …)

This class provides buffered read capability for NTContainer.

NTDate(y, m, d)

This class provides date functions.

NTDateTime(date, time, spec)

This class provides date and time functions.

NTDoubleList()

List of float elements.

NTDoubleListIt(obj)

Iterator class for NTDoubleList.

NTDoubleVector()

Vector list of float elements.

NTDoubleVectorIt(obj)

Iterator class for NTDoubleVector.

NTFileEnum(path)

This class enumerates files from a specified path.

NTIWait()

Interface for wait objects.

NTIntList()

List of int elements.

NTIntListIt(obj)

Iterator class for NTIntList.

NTIntVariantHash()

Dictionary of int -> BasicType elements.

NTIntVariantHashIt(obj)

Iterator class for NTIntVariantHash.

NTIntVector()

Vector list of int elements.

NTIntVectorIt(obj)

Iterator class for NTIntVector.

NTMaxUIntList()

List of int elements.

NTMaxUIntListIt(obj)

Iterator class for NTMaxUIntList.

NTMaxUIntTree()

Tree of NTMaxUIntTreeNode nodes.

NTMaxUIntTreeNode()

This class represents a node of NTMaxUIntTree.

NTMaxUIntTreeNodeList()

List of NTMaxUIntTreeNode elements.

NTMaxUIntTreeNodeListIt(obj)

Iterator class for NTMaxUIntTreeNodeList.

NTMaxUIntVector()

Vector list of int elements.

NTMaxUIntVectorIt(obj)

Iterator class for NTMaxUIntVector.

NTMemoryInfoList()

List of NTMemoryInfo elements.

NTMemoryInfoListIt(obj)

Iterator class for NTMemoryInfoList.

NTModuleInfoList()

List of NTModuleInfo elements.

NTModuleInfoListIt(obj)

Iterator class for NTModuleInfoList.

NTOffsetRange()

This class defines a generic offset-size range.

NTOffsetRangeList()

List of NTOffsetRange elements.

NTOffsetRangeListIt(obj)

Iterator class for NTOffsetRangeList.

NTProcessInfoList()

List of NTProcessInfo elements.

NTProcessInfoListIt(obj)

Iterator class for NTProcessInfoList.

NTProcessRegionsEnumerator(pid)

This class implements an enumerator for memory regions.

NTSimpleWait()

Basic implementation of NTIWait.

NTStringList()

List of str elements.

NTStringListIt(obj)

Iterator class for NTStringList.

NTStringStringHash()

Dictionary of str -> str elements.

NTStringStringHashIt(obj)

Iterator class for NTStringStringHash.

NTStringVariantHash()

Dictionary of str -> BasicType elements.

NTStringVariantHashIt(obj)

Iterator class for NTStringVariantHash.

NTTextBuffer()

This is a class derived from NTTextStream.

NTTextStream()

An interface for outputting text and mnemonics.

NTTextStringBuffer()

This is a class derived from NTTextStream.

NTTime(h, m, s, ms)

This class provides clock time functionality.

NTUIntList()

List of int elements.

NTUIntListIt(obj)

Iterator class for NTUIntList.

NTUIntTree()

Tree of NTUIntTreeNode nodes.

NTUIntTreeNode()

This class represents a node of NTUIntTree.

NTUIntTreeNodeList()

List of NTUIntTreeNode elements.

NTUIntTreeNodeListIt(obj)

Iterator class for NTUIntTreeNodeList.

NTUIntVector()

Vector list of int elements.

NTUIntVectorIt(obj)

Iterator class for NTUIntVector.

NTUShortUShortHash()

Dictionary of int -> int elements.

NTUShortUShortHashIt(obj)

Iterator class for NTUShortUShortHash.

NTUShortVector()

Vector list of int elements.

NTUShortVectorIt(obj)

Iterator class for NTUShortVector.

NTUTF8StringHash()

Dictionary of str -> str elements.

NTUTF8StringHashIt(obj)

Iterator class for NTUTF8StringHash.

NTUTF8StringList()

List of str elements.

NTUTF8StringListIt(obj)

Iterator class for NTUTF8StringList.

NTVariantList()

List of BasicType elements.

NTVariantListIt(obj)

Iterator class for NTVariantList.

NTVoidBuffer()

This is a class derived from NTTextStream.

NTXml()

XML parser class.

NT_MEMORY_INFO()

This class represents a memory region.

NT_MODULE_INFO()

This class contains information about a loaded module.

NT_PROCESS_INFO()

This class contains information about a process.

PDBAssociationInfo()

This class contains association information for Windows PDB files.

ProCoreContext()

This class provides functionality for the current context.

ProGlobalSettings()

This class provides access to the main settings of the application.

ProSettings()

This class provides access to settings.

ProTextPrintBuffer()

This is a class derived from NTTextStream.

ProValueStorage()

This class provides SQLite-backed key -> value storage facility.

ProWebRequest(url)

This class can be used to make a web request.

Report()

This class represents a project.

ScanEntryBaseAttributes()

This class contains the base attributes of a scan entry retrieved from the report.

ScanEntryData()

This class represents a scan entry.

ScanMetaDataEntries()

List of ScanMetaDataEntry elements.

ScanMetaDataEntriesIt(obj)

Iterator class for ScanMetaDataEntries.

ScanMetaDataEntry()

This class represents a scan meta-data entry.

ScanProvider()

This is the base class inherited by all the scan engines for the different file formats.

ScanProviderWait(sprovider)

This class only wraps ScanProvider.isAborted().

ScanViewData()

This class is used as I/O container to retrieve data and UI views from a scan provider.

objdb_info()

This class contains information about an entry in the object database.

objdbview_info()

This class contains parameters to create a window view of the object database.

Functions:

CurrentEndianness()

Returns the endianness of the system (ENDIANNESS_LITTLE or ENDIANNESS_BIG).

DemangleSymbolName(mangled[, flags])

Unmangles a decorated symbol.

MethodNameFromSimpleSignature(signature)

Extracts the function or method name from a simple signature.

NT_AppendFile(src, copySize, dst)

Appends copySize bytes of src file to dst file.

NT_ApplyFileExt(fileName, filetype)

Appends the default extension type for the current system specified by filetype to fileName.

NT_AutoDecodeBytes(raw)

This function tries to decode raw bytes into a string using simple heuristics.

NT_CloseFile(ntfile)

Closes an open file handle.

NT_CloseModuleHandle(ntmod)

Closes the handle of a module without unloading the module.

NT_CloseProcess(proc)

Closes a process handle.

NT_CopyFile(fileNameA, fileNameB)

Copies a file.

NT_CopyFileOpen(fileNameA, fileNameB)

Copies a file.

NT_CreateDirectory(dirName)

Creates a directory.

NT_CreateDirectoryTree(dirName)

Creates a directory and all the intermediate directories leading up to that directory if not yet present.

NT_CreateFile(FileName[, opt])

Creates a file.

NT_CreateFileLink(fileName, linkName[, descr])

Creates a link (e.g.: .lnk on Windows) file.

NT_CreateTempFile([ext, auto_delete])

Creates a temporary file.

NT_DecodeAsciiBytes(raw)

This function tries to decode an ascii string using simple heuristics.

NT_DecodeAsciiBytes16(raw, endianness)

This function tries to decode an ascii wide-char string using simple heuristics.

NT_DeleteDirectory(dirName)

Deletes a directory.

NT_DeleteFile(FileName)

Deletes a file.

NT_DeleteLink(linkName)

Deletes a link (e.g.: .lnk on Windows) file.

NT_DirectoryExists(dirName)

Checks the existence of a directory.

NT_FileExists(FileName)

Checks the existence of a file.

NT_FileExtFromName(fileName[, include_dot])

Retrieves the extension of a file name (e.g.: ".exe").

NT_FileNameFromPath(path)

Retrieves the file name from a path.

NT_FileToBuffer(fileName, maxSize[, readPartial])

Reads a file to a memory buffer.

NT_FloatToString(v)

Converts a float value to string.

NT_FreeModule(ntmod)

Unloads a module and closes its handle.

NT_GetCurrentModuleFileName()

Returns the name of the current module including its path.

NT_GetCurrentModulePath()

Returns the full path of the current module.

NT_GetCurrentProcessId()

Returns the current process id.

NT_GetCurrentProcessPath()

Returns the path of the executable of the current process.

NT_GetFileName(ntfile)

Retrieves the name of a file from its handle.

NT_GetFilePos(ntfile)

Gets the current file position.

NT_GetFileSize(ntfile)

Gets the size of a file.

NT_GetMemoryRegions(pid[, allocated_only, limit])

Retrieves the list of memory regions allocated by the specified process.

NT_GetModule(name)

Retrieves a module from its name.

NT_GetModuleList(pid)

Retrieves the list of modules loaded in the address space of a process.

NT_GetProcessFileName(pid_or_proc)

Retrieves the path of the executable of a specified process.

NT_GetProcessId(proc)

Retrieves the process id for a process handle.

NT_GetProcessList()

Returns the current list of processes.

NT_GetSpecialFolder(f)

Retrieves a special system directory.

NT_GetSystemFileHandle(ntfile)

Returns the internal system handle of a file.

NT_GetTempFileName([ext])

Generates a temporary file name.

NT_HasProcessAPI()

Returns True if the process API is available on the current system; otherwise returns False.

NT_HexCharToByte(ch)

Converts a hex character into its corresponding integer value (e.g.: ord('F') -> 15).

NT_IsCurrentModuleDLL()

Returns True if the current module is a shared library; otherwise returns False.

NT_IsRelativePath(path)

Checks whether a path is relative.

NT_KillProcess(pid_or_proc[, timeout])

Terminates a process.

NT_LoadModule(name)

Loads a module from disk.

NT_MakeCString(str)

Escapes a string for C (e.g.: "Hello,\nWorld!" becomes "Hello,\\nWorld!").

NT_MakeFileExecutable(fileName)

Adds executable attributes to the specified file if they’re missing.

NT_MatchFileName(fileNameA, fileNameB)

Compares two paths taking also into account the case sensitivity of the current file system.

NT_NormalizeFileName(fileName)

Replaces any backslash in a file name with a forward slash.

NT_NormalizePath(path)

Replaces any backslash in a path with a forward slash and makes sure that the path ends with a trailing forward slash.

NT_NormalizeToNative(fileOrPath)

Replaces the slashes of an already normalized file name or path with the slashes expected by the current system (i.e., backslashes on Windows and slashes on Linux/macOS).

NT_OpenFile(FileName[, opt])

Opens an existing file.

NT_OpenProcess(pid[, access])

Retrieves a handle to a process.

NT_PathFromFileName(fileName)

Separates a path or file name from its trailing part.

NT_RawPathFromFileName(fileName)

Behaves exactly like NT_PathFromFileName(), except that it retains the slashes of the input.

NT_ReadFile(ntfile, nBytesToRead)

Reads a specified amount of bytes from a file and updates the file position.

NT_ReadProcessMemory(proc, MemoryAddr, …)

Reads the memory of a process.

NT_ResetFixedFileSize(ntfile)

Resets the fixed file size set by calling NT_SetFixedFileSize().

NT_ResolveShortcut(shortcut)

Resolves the target of a link (.lnk) file.

NT_ResolveSymbol(ntmod, symname)

Resolves the symbol of a module.

NT_SetFileAutoDelete(ntfile, auto_delete)

Sets the auto-deletion flag for the file.

NT_SetFilePos(ntfile, FileOffset)

Sets the current file position.

NT_SetFileSize(ntfile, NewFileSize)

Changes the size of a file.

NT_SetFixedFileSize(ntfile, FixedFileSize)

Sets the fixed size of a file.

NT_StripFileExt(fileName)

Strips the extension from a file name.

NT_TrashFile(fileName[, showProgress])

Moves a file to the trash.

NT_UnescapeCString(str)

Unescapes a C string (e.g.: "Hello,\\nWorld!" becomes "Hello,\nWorld!").

NT_Win32FileTimeToDateTime(Time)

Converts a Windows FILETIME to NTDateTime.

NT_WriteFile(ntfile, bytes)

Writes the specified bytes to a file.

NT_WriteProcessMemory(proc, MemoryAddr, bytes)

Writes the memory of a process.

appDataDir([opt])

Retrieves the user data directory for the application.

applyFilters(data, str[, waitdlg])

Applies the specified filters to an NTContainer and returns the resulting data as an NTContainer.

carbonThemesDir()

Returns the carbon themes directory.

configDir()

Returns the configuration directory.

createAddressSpace(name[, pt_offs, arg2, arg3])

Creates an address space based on a page-table.

createBlockIOAddressSpace(total_size, page_size)

Creates a block I/O address space.

createContainerFromFile(fname)

Creates an NTContainer object from a file on disk.

createSparseAddressSpace([reference_as, …])

Creates a sparse address space.

enableHook(name, enable)

Enables or disables the specified hook

executeFunctionInMainThread(func[, ud, blocking])

Executes a function from the main thread.

headersDir()

Returns the headers directory.

identifyPossibleFormats(data)

Identifies a list of possible file formats for the input data.

isGuiThread()

Returns True if called from the UI thread; otherwise returns False.

mediaDir()

Returns the media directory.

newContainer([size, reserve_size, max_size])

Creates a new NTContainer object.

ntAlpha(rgb)

Retrieves the alpha color component from an RGBA value.

ntAlphaBlend(src, bkg)

Performs an alpha blend operation on two RGBA values.

ntBlue(rgb)

Retrieves the blue color component from an RGBA value.

ntGreen(rgb)

Retrieves the green color component from an RGBA value.

ntRed(rgb)

Retrieves the read color component from an RGBA value.

ntRgb(r, g, b)

Creates an RGBA value from its red, green and blue color components.

ntRgba(r, g, b, a)

Creates an RGBA value from its red, green, blue and alpha color components.

ntShiftToColor(source, target, fraction)

Shift an RGBA value to another RGBA value.

packageCertificatesDir()

Returns the package certificates directory.

pluginsDir()

Returns the plugins directory.

proAbort(ret[, msg])

Aborts the application with an optional message.

proApplicationFileName()

Returns the path of the main application.

proArchIsX64()

Returns True if the current architecture is x64; otherwise returns False.

proArchIsX86()

Returns True if the current architecture is x86; otherwise returns False.

proArchName()

Returns the name of the current architecture (e.g., 'x64').

proClearOutput([with_undo])

Clears the output view if available.

proCoreContext()

Returns the global ProCoreContext instance.

proCrashApplication(i)

Crashes the application on purpose.

proDisasmOptions()

Returns the current disassembly options for the text view.

proGetLine([prompt])

Retrieves an input string either by prompting a dialog box or from the terminal.

proGetRiskBgColor(risk, bg)

Computes a color based on risk percentage.

proLaunchApplication(app[, args])

Launches an application.

proLaunchThisApplication([args])

Launches the main application.

proPlatformIsLinux()

Returns True if the current platform is Linux; otherwise returns False.

proPlatformIsMacOS()

Returns True if the current platform is macOS; otherwise returns False.

proPlatformIsWindows()

Returns True if the current platform is Windows; otherwise returns False.

proPlatformName()

Returns the name of the current platform (supported values are: 'windows', 'linux' and 'macos').

proPlatformShortName()

Returns the short name of the current platform (supported values are: 'win', 'lin' and 'mac').

proPrint(str)

Prints a message to the output view.

proPrintnl(str)

Prints a message to the output view.

proProcessEvents([ms])

Processes thread loop events.

proSetReturnCode(ret)

Sets the return code for the application.

proTextStream()

Creates a new NTTextStringBuffer instance with the default disassembly options.

proVersion()

Returns the current version of the application as a string in the shape of major_version.minor_version.build_version.

proVersionBuild()

Returns the build number of the application.

proVersionMajor()

Returns the major version of the application.

proVersionMinor()

Returns the minor version of the application.

pythonAllowIdleProcessing(b)

Enables or disables the idle processing of Python code.

themesDir()

Returns the themes directory.

userCarbonThemesDir([opt])

Retrieves the user carbon themes directory.

userConfigDir([opt])

Retrieves the user configuration directory.

userHeadersDir([opt])

Retrieves the user headers directory.

userMediaDir([opt])

Retrieves the user media directory.

userPDBSymbolsDir([opt])

Retrieves the user PDB symbols directory.

userPackageCertificatesDir([opt])

Retrieves the user package certificates directory.

userPackagesDir([opt])

Retrieves the user packages directory.

userPluginsDir([opt])

Retrieves the user plugins directory.

userPythonPluginsDir([opt])

Retrieves the user Python plugins directory.

userThemesDir([opt])

Retrieves the user themes directory.

Bufferize_BackAndForth: Final[int]

Buffering method for NTBuffer. To use when reading in both directions.

Bufferize_Backwards: Final[int]

Buffering method for NTBuffer. To use when reading backwards.

Bufferize_Forwards: Final[int]

Buffering method for NTBuffer. To use when reading forwards.

Bufferize_Invalid: Final[int]

Buffering method for NTBuffer. Only used for uninitialized instances.

See also NTBuffer.isNull().

class CFFBuffer(object: Pro.Core.CFFObject, offset: int, method: int = Bufferize_Forwards)

Bases: Pro.Core.NTBuffer

This class provides buffered read capability for CFFObject.

Parameters
  • object (CFFObject) – The object to read from.

  • offset (int) – The start offset to read from.

  • method (int) – The buffering method to use. Defaults to Bufferize_Forwards.

See also CFFObject.ToBuffer(), NTBuffer and NTContainerBuffer.

class CFFContainer

Bases: Pro.Core.NTContainer

This is a derived class from NTContainer which can reference data as CFFObject and CFFStruct.

See also NTContainer(), NTContainerBuffer and NTAddressSpace.

Attributes:

Object

Type of data internally referenced by the container.

Struct

Type of data internally referenced by the container.

Methods:

setData(data[, own_or_size])

See NTContainer.setData().

toObject()

Returns the internal CFFObject referenced by the container if the dataType() is Object; otherwise returns None.

toStruct()

Returns the internal CFFStruct referenced by the container if the dataType() is Struct; otherwise returns an invalid struct.

Object: Final[int]

Type of data internally referenced by the container.

See also NTContainer.dataType().

Struct: Final[int]

Type of data internally referenced by the container.

See also NTContainer.dataType().

setData(data: Union[CFFObject, CFFStruct, NTByteArrayList, NTContainer, NTStringList, NT_FILE, NT_PROCESS, bytes, int, str], own_or_size: Union[bool, int] = True)None

See NTContainer.setData().

toObject()Pro.Core.CFFObject
Returns

Returns the internal CFFObject referenced by the container if the dataType() is Object; otherwise returns None.

Return type

CFFObject

See also NTContainer.dataType().

toStruct()Pro.Core.CFFStruct
Returns

Returns the internal CFFStruct referenced by the container if the dataType() is Struct; otherwise returns an invalid struct.

Return type

CFFStruct

See also NTContainer.dataType().

class CFFContext

This class is used internally by CFFStruct to store information from members which affect the position and size of other members.

See also CFFStruct.Context() and CFFStruct.SetContext().

Methods:

set(key, val)

Sets a value of the context.

value(key)

Retrieves a value from the context.

set(key: int, val: int)None

Sets a value of the context.

Parameters
  • key (int) – The key of the value to store.

  • val (int) – The value.

See also value().

value(key: int)int

Retrieves a value from the context.

Parameters

key (int) – The key of the value to retrieve.

Returns

Returns the value of the context if present; otherwise returns 0.

Return type

int

See also set().

class CFFDB

This class creates a volatile tree structure that is either stored in memory or on disk.

Indexes for the tree can either be 32-bit (CFFDBIndexSize32) or 64-bit (CFFDBIndexSize64).

Every item in the tree has fixed-size data. If no data size is specified when creating the tree, the fixed data size will be the same as the index size.

This class does not support the removal of items from the tree.

Methods:

AppendChild([parent])

Appends an item.

Children(index)

Returns the number of children for the specified index.

Data(index)

Retrieves the data of an item.

Data32(index)

Retrieves the data of an item as a 32-bit value.

Data64(index)

Retrieves the data of an item as a 64-bit value.

Index(pos[, parent])

Returns the index of an item given its parent and it’s position relative to its siblings.

InsertChild(pos[, parent])

Inserts an item given its parent and position relative to its siblings.

InsertChildren(pos, count[, parent])

Inserts multiple items given their parent and position relative to their siblings.

IsNull()

Returns True if invalid; otherwise returns False.

IsValid()

Returns True if valid; otherwise returns False.

Next(current)

Gets the next item in the tree.

Open([fixed_data_size, idxsize])

Initializes a CFFDB.

Parent(index)

Returns the parent of an item.

Position(index)

Returns the position of an item relative to its siblings.

PrependChild([parent])

Prepends an item.

Previous(current)

Gets the previous item in the tree.

SetData(index, value)

Sets the data of an item.

SetData32(index, value)

Sets the data of an item as a 32-bit value.

SetData64(index, value)

Sets the data of an item as a 64-bit value.

AppendChild(parent: int = 0)int

Appends an item.

Parameters

parent (int) – The parent index of the item to append.

Returns

Returns the index of the added child item if successful; otherwise returns CFFDBInvalidIndex.

Return type

int

See also PrependChild() and InsertChild().

Children(index: int)int

Returns the number of children for the specified index.

Parameters

index (int) – The index of the item for which to retrieve the number of children.

Returns

Returns the number of children.

Return type

int

See also Position(), Parent() and Index().

Data(index: int)tuple

Retrieves the data of an item.

Parameters

index (int) – The index of the item for which to retrieve the data.

Returns

Returns a tuple containing the retrieved data and a boolean. The boolean value is True if successful; otherwise it is False.

Return type

tuple[bytes, bool]

See also SetData(), Data32() and Data64().

Data32(index: int)tuple

Retrieves the data of an item as a 32-bit value.

Parameters

index (int) – The index of the item for which to retrieve the data.

Returns

Returns a tuple containing the retrieved data value and a boolean. The boolean value is True if successful; otherwise it is False.

Return type

tuple[int, bool]

See also SetData32(), Data() and Data64().

Data64(index: int)tuple

Retrieves the data of an item as a 64-bit value.

Parameters

index (int) – The index of the item for which to retrieve the data.

Returns

Returns a tuple containing the retrieved data value and a boolean. The boolean value is True if successful; otherwise it is False.

Return type

tuple[int, bool]

See also SetData64(), Data() and Data32().

Index(pos: int, parent: int = 0)int

Returns the index of an item given its parent and it’s position relative to its siblings.

Parameters
  • pos (int) – The position of the item relative to its siblings.

  • parent (int) – The index of the parent item.

Returns

Returns the requested index if successful; otherwise returns CFFDBInvalidIndex.

Return type

int

See also Parent(), Position() and Children().

InsertChild(pos: int, parent: int = 0)int

Inserts an item given its parent and position relative to its siblings.

Parameters
  • pos (int) – The position of the item to insert relative to its siblings.

  • parent (int) – The index of the parent item.

Returns

Returns the index of the added child item if successful; otherwise returns CFFDBInvalidIndex.

Return type

int

See also InsertChildren(), AppendChild() and PrependChild().

InsertChildren(pos: int, count: int, parent: int = 0)bool

Inserts multiple items given their parent and position relative to their siblings.

Parameters
  • pos (int) – The position of the items to insert relative to their siblings.

  • count (int) – The number of items to insert.

  • parent (int) – The index of the parent item.

Returns

Returns True if successful; otherwise returns False.

Return type

bool

See also InsertChild(), AppendChild() and PrependChild().

IsNull()bool
Returns

Returns True if invalid; otherwise returns False.

Return type

bool

See also IsValid() and Open().

IsValid()bool
Returns

Returns True if valid; otherwise returns False.

Return type

bool

See also IsNull() and Open().

Next(current: int)int

Gets the next item in the tree.

This method enumerates parent and child items.

Parameters

current (int) – The current index.

Returns

Returns the index if successful; otherwise returns CFFDBInvalidIndex.

Return type

int

See also Previous().

Open(fixed_data_size: int = 0, idxsize: int = CFFDBIndexSize32)bool

Initializes a CFFDB.

Parameters
  • fixed_data_size (int) – The size of the data associated with each item. If 0, it defaults to the index size.

  • idxsize (int) – The index size.

Returns

Returns True if successful; otherwise returns False.

Return type

bool

See also IsValid() and IsNull().

Parent(index: int)int

Returns the parent of an item.

Parameters

index (int) – The index of the item for which to retrieve the parent.

Returns

Returns the parent index if successful; otherwise returns CFFDBInvalidIndex.

Return type

int

See also Index(), Position() and Children().

Position(index: int)int

Returns the position of an item relative to its siblings.

Parameters

index (int) – The index of the item for which to retrieve the relative position.

Returns

Returns the position if successful; otherwise returns CFFDBInvalidIndex.

Return type

int

See also Children(), Index() and Parent().

PrependChild(parent: int = 0)int

Prepends an item.

Parameters

parent (int) – The parent index of the item to prepend.

Returns

Returns the index of the added child item if successful; otherwise returns CFFDBInvalidIndex.

Return type

int

See also AppendChild() and InsertChild().

Previous(current: int)int

Gets the previous item in the tree.

This method enumerates parent and child items.

Parameters

current (int) – The current index.

Returns

Returns the index if successful; otherwise returns CFFDBInvalidIndex.

Return type

int

See also Next().

SetData(index: int, value: bytes)bool

Sets the data of an item.

The size of value must match the size of the data specified when initializing the tree (See Open()).

Parameters
  • index (int) – The index of the item for which to set the data.

  • value (bytes) – The data to set.

Returns

Returns True if successful; otherwise returns False.

Return type

bool

See also Data(), SetData32() and SetData64().

SetData32(index: int, value: int)bool

Sets the data of an item as a 32-bit value.

Parameters
  • index (int) – The index of the item for which to set the data.

  • value (int) – The 32-bit value to set.

Returns

Returns True if successful; otherwise returns False.

Return type

bool

See also Data32(), SetData() and SetData64().

SetData64(index: int, value: int)bool

Sets the data of an item as a 64-bit value.

Parameters
  • index (int) – The index of the item for which to set the data.

  • value (int) – The 64-bit value to set.

Returns

Returns True if successful; otherwise returns False.

Return type

bool

See also Data64(), SetData() and SetData32().

CFFDBIndexSize32: Final[int]

32-bit index size for CFFDB.

See also CFFDB.

CFFDBIndexSize64: Final[int]

64-bit index size for CFFDB.

See also CFFDB.

CFFDBInvalidIndex: Final[int]

Invalid index for CFFDB.

See also CFFDB.

CFFDBRootIndex: Final[int]

Root index for CFFDB.

See also CFFDB.

class CFFFlags

This class contains flags and options for a member of CFFStruct.

Methods:

Count()

Returns the number of flags and options available.

Description(i)

Retrieves the description of a flag or option.

IsFlag(value, i_or_name)

Checks if a flag or option is set in the input value.

IsNull()

Returns True if the CFFFlags instance is invalid; otherwise returns False.

IsOptionsOnly()

Returns True if the current CFFFlags instance contains only options and not flags; otherwise returns False.

IsValid()

Returns True if the CFFFlags instance is valid; otherwise returns False.

Name(i)

Retrieves the name of a flag or option.

Output(out, value[, opt, sep])

Outputs the flags and options set in the input value to a text stream .

Position(name)

Retrieves the position of a flag or option by its name.

ShortDescription(i)

Retrieves the short description of a flag or option.

Type([i])

Retrieves the type of the CFFFlags instance or the type of one of its members.

Value(i)

Retrieves the value of a flag or option.

ValueDescription(value)

Retrieves the description for the input value.

Count()int
Returns

Returns the number of flags and options available.

Return type

int

See also Output(), Name() and IsFlag().

Description(i: int)str

Retrieves the description of a flag or option.

Parameters

i (int) – The index of the flag or option.

Returns

Returns the description if available; otherwise returns an empty string.

Return type

str

See also ShortDescription(), Name() and Value().

IsFlag(value: int, i_or_name: Union[int, str])bool

Checks if a flag or option is set in the input value.

Parameters
  • value (int) – The input value.

  • i_or_name (Union[int, str]) – The index or name of the flag or option.

Returns

Returns True if the flag or option is set in the input value; otherwise returns False.

Return type

bool

See also Output(), Name() and Value().

IsNull()bool
Returns

Returns True if the CFFFlags instance is invalid; otherwise returns False.

Return type

bool

See also IsValid().

IsOptionsOnly()bool
Returns

Returns True if the current CFFFlags instance contains only options and not flags; otherwise returns False.

Return type

bool

See also ValueDescription().

IsValid()bool
Returns

Returns True if the CFFFlags instance is valid; otherwise returns False.

Return type

bool

See also IsNull().

Name(i: int)str

Retrieves the name of a flag or option.

Parameters

i (int) – The index of the flag or option.

Returns

Returns the name of the flag or option if successful; otherwise returns an empty string.

Return type

str

See also Name() and Output().

Output(out: Pro.Core.NTTextStream, value: int, opt: int = 0, sep: Optional[str] = None)None

Outputs the flags and options set in the input value to a text stream .

Parameters
  • out (NTTextStream) – The text stream.

  • value (int) – The input value.

  • opt (int) – The output options. NTFlagOutput_IgnoreUnknown can be specified to ignore unknown flags.

  • sep (Optional[str]) – The separator for the output. Defaults to " | ".

See also NTTextStream and ShortDescription().

Position(name: str)int

Retrieves the position of a flag or option by its name.

Parameters

name (str) – The name of the flag or option.

Returns

Returns the index of the flag or option if successful; otherwise returns -1.

Return type

int

See also Name() and Value().

ShortDescription(i: int)str

Retrieves the short description of a flag or option.

Parameters

i (int) – The index of the flag or option.

Returns

Returns the short description if available; otherwise returns an empty string.

Return type

str

See also Description(), Name() and Value().

Type(i: Optional[int] = None)int

Retrieves the type of the CFFFlags instance or the type of one of its members.

Parameters

i (Optional[int]) – The index of the flag or option.

Returns

Returns the requested type if successful; otherwise returns 0.

Return type

int

See also Name() and Value().

Value(i: int)int

Retrieves the value of a flag or option.

Parameters

i (int) – The index of the flag or option.

Returns

Returns the value if successful; otherwise returns 0.

Return type

int

See also Name() and Description().

ValueDescription(value: int)str

Retrieves the description for the input value.

This method works only if the CFFFlags instance contains only options (See IsOptionsOnly()).

Parameters

value (int) – The input value.

Returns

Returns the value description if successful; otherwise returns an empty string.

Return type

str

See also IsOptionsOnly() and Output().

class CFFHeader

This class represents a header.

Headers contain definition of structures and can be loaded from SQLite files or XML strings. The structures can be imported from C/C++ code through the Header Manager or from debug symbols such as PDB files.

Important

Editing is supported only for SQLite-backed headers.

Example:

from Pro.Core import *

xml_header = """<header>

<r id='_IMAGE_DOS_HEADER' type='struct'>
  <f id='e_magic' type='unsigned short'/>
  <f id='e_cblp' type='unsigned short'/>
  <f id='e_cp' type='unsigned short'/>
  <f id='e_crlc' type='unsigned short'/>
  <f id='e_cparhdr' type='unsigned short'/>
  <f id='e_minalloc' type='unsigned short'/>
  <f id='e_maxalloc' type='unsigned short'/>
  <f id='e_ss' type='unsigned short'/>
  <f id='e_sp' type='unsigned short'/>
  <f id='e_csum' type='unsigned short'/>
  <f id='e_ip' type='unsigned short'/>
  <f id='e_cs' type='unsigned short'/>
  <f id='e_lfarlc' type='unsigned short'/>
  <f id='e_ovno' type='unsigned short'/>
  <f id='e_res' type='unsigned short [4]'/>
  <f id='e_oemid' type='unsigned short'/>
  <f id='e_oeminfo' type='unsigned short'/>
  <f id='e_res2' type='unsigned short [10]'/>
  <f id='e_lfanew' type='int'/>
</r>

</header>"""

def printStructure(fname):
    c = createContainerFromFile(fname)
    if c.isNull():
        return
    # load header from an XML string
    header = CFFHeader()
    if not header.LoadFromXml(xml_header):
        return
    obj = CFFObject()
    # since CFFObject is not subclassed, the Load method cannot fail
    obj.Load(c)
    # map a structure to a specific offset
    offset = 0
    s = obj.MakeStruct(header, "_IMAGE_DOS_HEADER", offset, CFFSO_VC | CFFSO_Pack1)
    out = NTTextBuffer()
    s.Dump(out)
    print(out.buffer)

See also CFFStruct and CFFObject.

Attributes:

AC_Define

Alias category for a definition.

AC_Enum

Alias category for an enumerator.

AC_Last

Alias category terminator.

AVT_Integer

Alias integer value type.

AVT_Last

Alias terminator value type.

AVT_Real

Alias floating point value type.

AVT_String

Alias string value type.

Methods:

BeginEdit()

Begins an SQLite transaction.

Close()

Clears the current instance.

EndEdit()

Ends an SQLite transaction.

Equals(s)

Checks whether two headers reference the same internal data.

GetACName(category)

Retrieves the alias category name.

GetAVTName(vtype)

Retrieves the alias value type name.

GetAliasCount()

Returns the number of alias in the header.

GetAliasData(i)

Retrieves the data for an alias.

GetSQLiteDB()

Returns the SQLite handle if the header is backed by SQLite internally; otherwise returns None.

GetStructBaseData(i)

Retrieves the basic data of a structure.

GetStructCount()

Returns the number of structures in the header.

GetStructData(i_or_name)

Retrieves the data of a structure.

GetTypeDefCount()

Returns the number of type definitions in the header.

GetTypeDefData(i)

Retrieves the data of a type definition.

InsertAlias(name, category, type, vtype, value)

Inserts or replaces an alias in the header file.

InsertStruct(schema)

Inserts or replaces a structure in the header file.

InsertTypeDef(name, type)

Inserts or replaces a type definition in the header file.

IsModified()

Returns True if the header was modified; otherwise returns False.

IsNull()

Returns True if the header is invalid; otherwise returns False.

IsValid()

Returns True if the header is valid; otherwise returns False.

LoadFromFile(name)

Loads a header file from an SQLite database.

LoadFromXml(xml)

Initializes a header instance from XML data.

SetModified(b)

Sets the modified status for the header file.

AC_Define: Final[int]

Alias category for a definition.

AC_Enum: Final[int]

Alias category for an enumerator.

AC_Last: Final[int]

Alias category terminator.

AVT_Integer: Final[int]

Alias integer value type.

AVT_Last: Final[int]

Alias terminator value type.

AVT_Real: Final[int]

Alias floating point value type.

AVT_String: Final[int]

Alias string value type.

BeginEdit()None

Begins an SQLite transaction.

See also EndEdit() and InsertStruct().

Close()None

Clears the current instance.

See also LoadFromFile() and LoadFromXml().

EndEdit()None

Ends an SQLite transaction.

See also BeginEdit() and InsertStruct().

Equals(s: Pro.Core.CFFHeader)bool

Checks whether two headers reference the same internal data.

Parameters

s (CFFHeader) – The other header.

Returns

Returns True if the two headers reference the same internal data; otherwise returns False.

Return type

bool

static GetACName(category: int)str

Retrieves the alias category name.

Parameters

category (int) – The alias category.

Returns

Returns the name of the alias category if successful; otherwise returns an empty string.

Return type

str

See also GetAVTName().

static GetAVTName(vtype: int)str

Retrieves the alias value type name.

Parameters

vtype (int) – The alias value type.

Returns

Returns the name of the alias value type if successful; otherwise returns an empty string.

Return type

str

See also GetACName().

GetAliasCount()int
Returns

Returns the number of alias in the header.

Return type

int

See also GetAliasData() and InsertAlias().

GetAliasData(i: int)Pro.Core.CFFHeaderAliasData

Retrieves the data for an alias.

Parameters

i (int) – The index of the alias.

Returns

Returns the data of the alias if successful; otherwise returns an empty data structure.

Return type

CFFHeaderAliasData

See also GetAliasCount() and InsertAlias().

GetSQLiteDB()sqlite3
Returns

Returns the SQLite handle if the header is backed by SQLite internally; otherwise returns None.

Return type

sqlite3

GetStructBaseData(i: int)Pro.Core.CFFHeaderStructData

Retrieves the basic data of a structure.

The difference with GetStructData() is that the XML schema of the structure is not retrieved. Therefore, this method is a bit faster.

Parameters

i (int) – The index of the structure.

Returns

Returns the data of the structure if successful; otherwise returns an empty data structure.

Return type

CFFHeaderStructData

See also GetStructData(), GetStructCount() and InsertStruct().

GetStructCount()int
Returns

Returns the number of structures in the header.

Return type

int

See also GetStructData() and InsertStruct().

GetStructData(i_or_name: Union[int, str])Pro.Core.CFFHeaderStructData

Retrieves the data of a structure.

Parameters

i_or_name (Union[int, str]) – The name or the index of the structure.

Returns

Returns the data of the structure if successful; otherwise returns an empty data structure.

Return type

CFFHeaderStructData

See also GetStructBaseData(), GetStructCount() and InsertStruct().

GetTypeDefCount()int
Returns

Returns the number of type definitions in the header.

Return type

int

See also GetTypeDefData() and InsertTypeDef().

GetTypeDefData(i: int)Pro.Core.CFFHeaderTypeDefData

Retrieves the data of a type definition.

Parameters

i (int) – The index of the type definition.

Returns

Returns the data of the type definition if successful; otherwise returns an empty data structure.

Return type

CFFHeaderTypeDefData

See also GetTypeDefCount() and InsertTypeDef().

InsertAlias(name: str, category: int, type: str, vtype: int, value: str)None

Inserts or replaces an alias in the header file.

This method is supported only by SQLite-backed header files.

Parameters
  • name (str) – The name of the alias.

  • category (int) – The category of the alias.

  • type (str) – The type of the alias.

  • vtype (int) – The value type of the alias.

  • value (str) – The value of the alias.

See also GetAliasData() and GetAliasCount().

InsertStruct(schema: str)None

Inserts or replaces a structure in the header file.

This method is supported only by SQLite-backed header files.

Parameters

schema (str) – The XML schema of the structure.

See also GetStructData() and GetStructCount().

InsertTypeDef(name: str, type: str)None

Inserts or replaces a type definition in the header file.

This method is supported only by SQLite-backed header files.

Parameters
  • name (str) – The name of the type definition.

  • type (str) – The type definition.

See also GetTypeDefData() and GetTypeDefCount().

IsModified()bool
Returns

Returns True if the header was modified; otherwise returns False.

Return type

bool

See also SetModified().

IsNull()bool
Returns

Returns True if the header is invalid; otherwise returns False.

Return type

bool

See also IsValid().

IsValid()bool
Returns

Returns True if the header is valid; otherwise returns False.

Return type

bool

See also IsNull().

LoadFromFile(name: str)bool

Loads a header file from an SQLite database.

Parameters

name (str) – The name of the header file.

Returns

Returns True if successful; otherwise returns False.

Return type

bool

See also LoadFromXml().

LoadFromXml(xml: Union[Pro.Core.NTXml, str])bool

Initializes a header instance from XML data.

Parameters

xml (Union[NTXml, str]) – Either an XML string or an NTXml instance.

Returns

Returns True if successful; otherwise returns False.

Return type

bool

See also LoadFromFile().

SetModified(b: bool)None

Sets the modified status for the header file.

Parameters

b (bool) – If True, the header file is marked as modified.

See also IsModified().

class CFFHeaderAliasData

Alias data of a header file.

See also CFFHeader.

Attributes:

category

The category of the alias.

name

The name of the alias.

type

The type of the alias.

value

The value of the alias.

vtype

The value type of the alias.

category

The category of the alias.

name

The name of the alias.

type

The type of the alias.

value

The value of the alias.

vtype

The value type of the alias.

class CFFHeaderStructData

Structure data of a header file.

See also CFFHeader.

Attributes:

name

The name of the structure.

schema

The XML schema of the structure.

type

The type of the structure.

name

The name of the structure.

schema

The XML schema of the structure.

type

The type of the structure.

class CFFHeaderTypeDefData

Type definition data of a header file.

See also CFFHeader.

Attributes:

name

The name of the type definition.

type

The type definition.

name

The name of the type definition.

type

The type definition.

CFFN_Base: Final[int]

Base value for standard CFFObject notifications.

See also CFFObject.Notify().

CFFN_Malformed: Final[int]

CFFObject notification for malformed data.

See also CFFObject.Notify().

CFFN_MoreFiles: Final[int]

CFFObject notification for the file limit.

See also CFFObject.Notify().

CFFN_NoDecrypt: Final[int]

CFFObject notification for failed decryption.

See also CFFObject.Notify().

CFFN_NoUnpack: Final[int]

CFFObject notification for failed decompression.

See also CFFObject.Notify().

CFFN_ParsingLimit: Final[int]

CFFObject notification for an internal parsing limit.

See also CFFObject.Notify().

CFFN_Recursive: Final[int]

CFFObject notification for recursion.

See also CFFObject.Notify().

CFFN_UnpackLimit: Final[int]

CFFObject notification for the decompression limit.

See also CFFObject.Notify().

CFFN_UnpackNestLimit: Final[int]

CFFObject notification for the decompression nesting limit.

See also CFFObject.Notify().

class CFFObject

The class from which every format class is derived (ZipObject, PEObject, etc.).

The internal data of a CFFObject is an NTContainer (See Load()).

See also NTContainer, CFFStruct, CFFHeader and CFFBuffer.

Methods:

AdjustSign(type, num)

Makes the input number negative if the last bit is set and the input type is an integer.

Align(AlignConst)

Aligns the object to the specified size.

AppendTo(nStartOffset, nLenght, pDst)

Appends part of this object to a container.

Compare(offset, bytes_or_uSize[, b])

Compares the specified data to the one in the object.

CopyFrom(Src, nDstOffset, nLenght[, …])

Copies data from a container to the object.

CopyTo(nStartOffset, nLenght, pDst[, …])

Copies a part of the object to a container.

Fill(offset, c, uSize)

Fills a portion of the object with the specified byte.

GetDefaultEndianness()

Returns the default endianness of the object (ENDIANNESS_LITTLE or ENDIANNESS_BIG).

GetDefaultStructOptions()

Returns the default options for CFFStruct instances created from this object (e.g., CFFSO_Pack1).

GetMappingAddress()

Returns the address at which this object is mapped if available; otherwise returns INVALID_STREAM_OFFSET.

GetMemoryUnpackLimit()

Returns the maximum amount of bytes which can be allocated for in-memory decompression algorithms.

GetObjectFormatName()

Returns the file format name of the object if available; otherwise returns an empty string.

GetObjectGenericFormatName()

Returns the generic format name of the object if available; otherwise returns an empty string (e.g., the generic format name of HTML is XML).

GetObjectName()

Returns the name of the object if available; otherwise returns an empty string.

GetObjectTypeName()

Returns the type name of the object if available; otherwise returns an empty string.

GetSize()

Returns the size of the internally referenced container.

GetSpecialData(key[, defval])

Retrieves special data associated to the object.

GetStream()

Returns the internally referenced container.

GetTag()

Returns the tag name set for debugging purposes if present; otherwise returns an empty string.

GetTypeName(Type)

Returns the name of the specified type.

GetTypeNature(Type)

Returns the nature of the specified type.

GetUnpackLimit()

Returns the limit for decompression operations.

GetUnpackNestingLimit()

Returns the nesting limit for decompression operations.

IsMapped()

Returns True if the object has a mapping address; otherwise returns False.

IsModified()

Returns True if the object was modified; otherwise returns False.

IsNull()

Returns True if the object is uninitialized; otherwise returns False.

IsTypeDynamicPersistent(Type)

Checks whether a type is persistently dynamic.

Load(Stream)

Loads the object data.

MakeStruct(header, name, offset[, options])

Returns a CFFStruct instance.

MakeStructArray(header, name, offset, nentries)

Returns an array of CFFStruct.

Modified(b)

Sets the modified status for the object.

NewContainer(size[, reserve_size, max_size])

Creates a new NTContainer object.

Notify(code)

Internally notifies the associated ScanProvider (if any) of a problem.

Read(offset, uSize)

Reads data from the object.

ReadNumber(offset, type, endianness, is_signed)

Reads an integer from the object.

ReadUInt16(offset[, endianness])

Reads an unsigned 16-bit integer from the object.

ReadUInt16String(offset, maxlen, endianness)

Reads an utf-16 array from the object.

ReadUInt32(offset[, endianness])

Reads an unsigned 32-bit integer from the object.

ReadUInt32String(offset, maxlen, endianness)

Reads an utf-32 array from the object.

ReadUInt64(offset[, endianness])

Reads an unsigned 64-bit integer from the object.

ReadUInt8(offset)

Reads an unsigned 8-bit integer from the object.

ReadUInt8String(offset, maxlen)

Reads an utf-8 array from the object.

ReplaceStream(NewStream)

Replaces the internal data of the object.

SetDefaultEndianness(nEndiannessType)

Sets the default endianness for the object.

SetDefaultStructOptions(options)

Sets the default options for CFFStruct instances created from this object (e.g., CFFSO_Pack1).

SetMappingAddress(mapping)

Sets the address at which the object is mapped.

SetMemoryUnpackLimit(limit)

Sets the maximum amount of bytes which can be allocated for in-memory decompression algorithms.

SetObjectFormatName(format)

Sets the file format name of the object.

SetObjectGenericFormatName(format)

Sets the generic format name of the object (e.g., the generic format name of HTML is XML).

SetObjectName(name)

Sets the name of the object.

SetObjectTypeName(type_name)

Sets the type name of the object.

SetSize(NewSize)

Resizes the internal data of the object.

SetSpecialData(key, value)

Sets special data associated to the object.

SetTag(t)

Sets the tag name of the object for debugging purposes

SetUnpackLimit(limit)

Sets the limit for decompression operations.

SetUnpackNestingLimit(limit)

Sets the nesting limit for decompression operations.

Shift(uSize)

Appends uSize bytes at the end of the object data and sets them to zero.

ToBuffer(offset[, method])

Returns a CFFBuffer that reads from the object.

ToUInt16(n)

Applies the default endianness of the object to the 16-bit input integer.

ToUInt32(n)

Applies the default endianness of the object to the 32-bit input integer.

ToUInt64(n)

Applies the default endianness of the object to the 64-bit input integer.

ValidRange(offset, Size)

Checks the validity of a range in the context of the object.

Write(offset, bytes_or_uSize[, bytes])

Writes data to the object.

WriteUInt16(offset, n_or_nEndiannessType[, n])

Writes an unsigned 16-bit integer to the object.

WriteUInt32(offset, n_or_nEndiannessType[, n])

Writes an unsigned 32-bit integer to the object.

WriteUInt64(offset, n_or_nEndiannessType[, n])

Writes an unsigned 64-bit integer to the object.

WriteUInt8(offset, n)

Writes an unsigned 8-bit integer to the object.

AdjustSign(type: int, num: int)int

Makes the input number negative if the last bit is set and the input type is an integer.

Parameters
  • type (int) – The input type.

  • num (int) – The input number.

Returns

Returns the adjusted number.

Return type

int

Align(AlignConst: int)bool

Aligns the object to the specified size.

Parameters

AlignConst (int) – The alignment.

Returns

Returns True if successful; otherwise returns False.

Return type

bool

See also NTContainer.align() and Shift().

AppendTo(nStartOffset: int, nLenght: int, pDst: Pro.Core.NTContainer)bool

Appends part of this object to a container.

Parameters
  • nStartOffset (int) – The offset of the range to append.

  • nLenght (int) – The size of the range to append.

  • pDst (NTContainer) – The destination container.

Returns

Returns True if successful; otherwise returns False.

Return type

bool

See also NTContainer.appendTo().

Compare(offset: int, bytes_or_uSize: Union[bytes, int], b: Optional[int] = None)bool

Compares the specified data to the one in the object.

Parameters
  • offset (int) – The start offset for the comparison.

  • bytes_or_uSize (Union[bytes, int]) – Either the data to compare or the size to compare.

  • b (Optional[int]) – If the previous parameter is the size to compare, this parameter is the byte which to compare the data to.

Returns

Returns True if the data matches; otherwise returns False.

Return type

bool

See also NTContainer.compare().

CopyFrom(Src: Pro.Core.NTContainer, nDstOffset: int, nLenght: int, nSrcStartOffset: int = 0)bool

Copies data from a container to the object.

Parameters
  • Src (NTContainer) – The container from which to copy the data.

  • nDstOffset (int) – The offset at which to copy the data.

  • nLenght (int) – The size of the data to copy.

  • nSrcStartOffset (int) – The offset from which to copy the data in the container.

Returns

Returns True if successful; otherwise returns False.

Return type

bool

See also NTContainer.copyTo().

CopyTo(nStartOffset: int, nLenght: int, pDst: Pro.Core.NTContainer, nDstStartOffset: int = 0)bool

Copies a part of the object to a container.

Parameters
  • nStartOffset (int) – The offset of the data to copy.

  • nLenght (int) – The size of the data to copy.

  • pDst (NTContainer) – The destination container.

  • nDstStartOffset (int) – The offset at which to write the data to in the destination container.

Returns

Returns True if successful; otherwise returns False.

Return type

bool

See also NTContainer.copyTo().

Fill(offset: int, c: int, uSize: int)bool

Fills a portion of the object with the specified byte.

Parameters
  • offset (int) – The offset of the range to fill.

  • c (int) – The 8-bit value used for the fill operation.

  • uSize (int) – The size of the range to fill.

Returns

Returns True if successful; otherwise returns False.

Return type

bool

See also NTContainer.fill().

GetDefaultEndianness()int
Returns

Returns the default endianness of the object (ENDIANNESS_LITTLE or ENDIANNESS_BIG).

Return type

int

See also SetDefaultEndianness().

GetDefaultStructOptions()int
Returns

Returns the default options for CFFStruct instances created from this object (e.g., CFFSO_Pack1).

Return type

int

See also SetDefaultStructOptions().

GetMappingAddress()int
Returns

Returns the address at which this object is mapped if available; otherwise returns INVALID_STREAM_OFFSET.

Return type

int

See also IsMapped() and SetMappingAddress().

GetMemoryUnpackLimit()int
Returns

Returns the maximum amount of bytes which can be allocated for in-memory decompression algorithms.

Return type

int

See also SetMemoryUnpackLimit().

GetObjectFormatName()str
Returns

Returns the file format name of the object if available; otherwise returns an empty string.

Return type

str

See also SetObjectFormatName().

GetObjectGenericFormatName()str
Returns

Returns the generic format name of the object if available; otherwise returns an empty string (e.g., the generic format name of HTML is XML).

Return type

str

See also SetObjectGenericFormatName().

GetObjectName()str
Returns

Returns the name of the object if available; otherwise returns an empty string.

Return type

str

See also SetObjectName().

GetObjectTypeName()str
Returns

Returns the type name of the object if available; otherwise returns an empty string.

Return type

str

See also SetObjectTypeName().

GetSize()int
Returns

Returns the size of the internally referenced container.

Return type

int

See also NTContainer.resize() and SetSize().

GetSpecialData(key: str, defval: Pro.Core.NTContainer = NTContainer())Pro.Core.NTContainer

Retrieves special data associated to the object.

Parameters
  • key (str) – The key of the data to retrieve.

  • defval (NTContainer) – The value to return if key is not present.

Returns

Returns the requested data if present; otherwise returns the default return value.

Return type

NTContainer

See also SetSpecialData().

GetStream()Pro.Core.NTContainer
Returns

Returns the internally referenced container.

Return type

NTContainer

See also Load() and ReplaceStream().

GetTag()str
Returns

Returns the tag name set for debugging purposes if present; otherwise returns an empty string.

Return type

str

See also SetTag().

GetTypeName(Type: int)str

Returns the name of the specified type.

Parameters

Type (int) – The type for which to return the name.

Returns

Returns the type name if implemented; otherwise returns an empty string.

Return type

str

See also GetTypeNature().

GetTypeNature(Type: int)int

Returns the nature of the specified type.

Parameters

Type (int) – The type for which to return the nature.

Returns

Returns the nature of the type if successful; otherwise returns NATURE_UNKNOWN.

Return type

int

See also NATURE_BYTEARRAY, NATURE_NUMBER, NATURE_REAL and NATURE_STRING.

See also GetTypeName().

GetUnpackLimit()int
Returns

Returns the limit for decompression operations.

Return type

int

See also SetUnpackLimit().

GetUnpackNestingLimit()int
Returns

Returns the nesting limit for decompression operations.

Return type

int

See also SetUnpackNestingLimit().

IsMapped()bool
Returns

Returns True if the object has a mapping address; otherwise returns False.

Return type

bool

See also GetMappingAddress() and SetMappingAddress().

IsModified()bool
Returns

Returns True if the object was modified; otherwise returns False.

Return type

bool

See also Modified().

IsNull()bool
Returns

Returns True if the object is uninitialized; otherwise returns False.

Return type

bool

See also Load().

IsTypeDynamicPersistent(Type: int)bool

Checks whether a type is persistently dynamic.

This means that the size of the type is dependent on the underlying data.

Parameters

Type (int) – The type to check.

Returns

Returns True if the type is persistently dynamic; otherwise returns False.

Return type

bool

Load(Stream: Pro.Core.NTContainer)bool

Loads the object data.

In derived classes this method also checks the signature file format.

Parameters

Stream (NTContainer) – The data to load.

Returns

Returns True if the data is accepted; otherwise returns False.

Return type

bool

See also GetStream() and ReplaceStream().

MakeStruct(header: Pro.Core.CFFHeader, name: str, offset: int, options: Optional[int] = None)Pro.Core.CFFStruct

Returns a CFFStruct instance.

Parameters
  • header (CFFHeader) – The header from which to fetch the definition of the structure.

  • name (str) – The name of the structure to return.

  • offset (int) – The offset at which to load the structure.

  • options (Optional[int]) – The options for the layout of the structure (e.g., CFFSO_Pack1).

Returns

Returns a valid structure if successful; otherwise returns an invalid structure.

Return type

CFFStruct

See also MakeStructArray(), CFFStruct and CFFHeader.

MakeStructArray(header: Pro.Core.CFFHeader, name: str, offset: int, nentries: int, options: Optional[int] = None)Pro.Core.CFFStruct

Returns an array of CFFStruct.

Parameters
  • header (CFFHeader) – The header from which to fetch the definition of the structure.

  • name (str) – The name of the structure to return.

  • offset (int) – The offset at which to load the structure.

  • nentries (int) – The number of array entries.

  • options (Optional[int]) – The options for the layout of the structure (e.g., CFFSO_Pack1).

Returns

Returns a valid structure if successful; otherwise returns an invalid structure.

Return type

CFFStruct

See also MakeStruct(), CFFStruct and CFFHeader.

Modified(b: bool)None

Sets the modified status for the object.

Parameters

b (bool) – If True, marks the object as modified; otherwise marks the object as unmodified.

See also IsModified().

NewContainer(size: int, reserve_size: int = 1024, max_size: int = 0)Pro.Core.NTContainer

Creates a new NTContainer object.

Whether the container will be using an internal memory buffer or a file on disk is decided on the basis of available memory resources at the time of the call.

Parameters
  • size (int) – The initial size of the container.

  • reserve_size (int) – The size to initially reserve for the container.

  • max_size (int) – The maximum size the container will ever reach. This is an optional parameter used to decide whether the container can operate on a memory buffer.

Returns

Returns the created container if successful; otherwise returns an invalid container.

Return type

NTContainer

See also newContainer() and NTContainer.

Notify(code: int)bool

Internally notifies the associated ScanProvider (if any) of a problem.

Parameters

code (int) – The notification code (e.g., CFFN_NoDecrypt).

Returns

Returns True if successful; otherwise returns False.

Return type

bool

See also ScanProvider.

Read(offset: int, uSize: int)bytes

Reads data from the object.

Parameters
  • offset (int) – The offset of the data to read.

  • uSize (int) – The size of the data to read.

Returns

Returns the data read if successful; otherwise return an empty bytes object.

Return type

bytes

See also Write().

ReadNumber(offset: int, type: int, endianness: int, is_signed: bool)tuple

Reads an integer from the object.

Parameters
  • offset (int) – The offset of the integer to read.

  • type (int) – The type of integer to read.

  • endianness (int) – The endianness of the integer (ENDIANNESS_LITTLE or ENDIANNESS_BIG).

  • is_signed (bool) – If True, the integer is treated as signed.

Returns

Returns a tuple containing the value read and a boolean. The boolean value is True if successful; otherwise it is False.

Return type

tuple[int, bool]

See also ReadUInt8(), ReadUInt16(), ReadUInt32() and ReadUInt64().

ReadUInt16(offset: int, endianness: Optional[int] = None)tuple

Reads an unsigned 16-bit integer from the object.

Parameters
Returns

Returns a tuple containing the value read and a boolean. The boolean value is True if successful; otherwise it is False.

Return type

tuple[int, bool]

See also WriteUInt16(), ReadUInt8(), ReadUInt32(), ReadUInt64() and ReadNumber().

ReadUInt16String(offset: int, maxlen: int, endianness: int)tuple

Reads an utf-16 array from the object.

The method stops when either a null terminator or maxlen is reached.

Parameters
  • offset (int) – The offset of the array to read.

  • maxlen (int) – The maximum length of the entry in characters.

  • endianness (int) – The endianness of the array (ENDIANNESS_LITTLE or ENDIANNESS_BIG).

Returns

Returns a tuple containing the array read and a boolean. The boolean value is True if successful; otherwise it is False.

Return type

tuple[bytes, bool]

See also ReadUInt8String() and ReadUInt32String().

ReadUInt32(offset: int, endianness: Optional[int] = None)tuple

Reads an unsigned 32-bit integer from the object.

Parameters
Returns

Returns a tuple containing the value read and a boolean. The boolean value is True if successful; otherwise it is False.

Return type

tuple[int, bool]

See also WriteUInt32(), ReadUInt8(), ReadUInt16(), ReadUInt64() and ReadNumber().

ReadUInt32String(offset: int, maxlen: int, endianness: int)tuple

Reads an utf-32 array from the object.

The method stops when either a null terminator or maxlen is reached.

Parameters
  • offset (int) – The offset of the array to read.

  • maxlen (int) – The maximum length of the entry in characters.

  • endianness (int) – The endianness of the array (ENDIANNESS_LITTLE or ENDIANNESS_BIG).

Returns

Returns a tuple containing the array read and a boolean. The boolean value is True if successful; otherwise it is False.

Return type

tuple[bytes, bool]

See also ReadUInt8String() and ReadUInt16String().

ReadUInt64(offset: int, endianness: Optional[int] = None)tuple

Reads an unsigned 64-bit integer from the object.

Parameters
Returns

Returns a tuple containing the value read and a boolean. The boolean value is True if successful; otherwise it is False.

Return type

tuple[int, bool]

See also WriteUInt64(), ReadUInt8(), ReadUInt16(), ReadUInt32() and ReadNumber().

ReadUInt8(offset: int)tuple

Reads an unsigned 8-bit integer from the object.

Parameters

offset (int) – The offset of the value to read.

Returns

Returns a tuple containing the value read and a boolean. The boolean value is True if successful; otherwise it is False.

Return type

tuple[int, bool]

See also WriteUInt8(), ReadUInt16(), ReadUInt32(), ReadUInt64() and ReadNumber().

ReadUInt8String(offset: int, maxlen: int)tuple

Reads an utf-8 array from the object.

The method stops when either a null terminator or maxlen is reached.

Parameters
  • offset (int) – The offset of the array to read.

  • maxlen (int) – The maximum length of the entry in bytes.

Returns

Returns a tuple containing the array read and a boolean. The boolean value is True if successful; otherwise it is False.

Return type

tuple[bytes, bool]

See also ReadUInt16String() and ReadUInt32String().

ReplaceStream(NewStream: Pro.Core.NTContainer)None

Replaces the internal data of the object.

Parameters

NewStream (NTContainer) – The new internal container for the object.

See also Load() and GetStream().

SetDefaultEndianness(nEndiannessType: int)None

Sets the default endianness for the object.

Parameters

nEndiannessType (int) – The default endianness for the object (ENDIANNESS_LITTLE or ENDIANNESS_BIG).

See also GetDefaultEndianness().

SetDefaultStructOptions(options: int)None

Sets the default options for CFFStruct instances created from this object (e.g., CFFSO_Pack1).

These options are used whenever options are not explicitly specified when calling MakeStruct() or MakeStructArray().

Parameters

options (int) – The default options.

See also GetDefaultStructOptions().

SetMappingAddress(mapping: int)None

Sets the address at which the object is mapped.

For instance, the mapping address is set for binaries loaded from a memory image.

Parameters

mapping (int) – The mapping address.

See also GetMappingAddress() and IsMapped().

SetMemoryUnpackLimit(limit: int)None

Sets the maximum amount of bytes which can be allocated for in-memory decompression algorithms.

Parameters

limit (int) – The limit in bytes.

See also GetMemoryUnpackLimit().

SetObjectFormatName(format: str)None

Sets the file format name of the object.

Parameters

format (str) – The file format name.

See also GetObjectFormatName().

SetObjectGenericFormatName(format: str)None

Sets the generic format name of the object (e.g., the generic format name of HTML is XML).

Parameters

format (str) – The generic format name.

See also GetObjectGenericFormatName().

SetObjectName(name: str)None

Sets the name of the object.

Parameters

name (str) – The object name.

See also GetObjectName().

SetObjectTypeName(type_name: str)None

Sets the type name of the object.

Parameters

type_name (str) – The object type name.

See also GetObjectTypeName().

SetSize(NewSize: int)bool

Resizes the internal data of the object.

Parameters

NewSize (int) – The new size of the data.

Returns

Returns True if successful; otherwise returns False.

Return type

bool

See also NTContainer.setResizable() and GetSize().

SetSpecialData(key: str, value: Pro.Core.NTContainer)None

Sets special data associated to the object.

Parameters
  • key (str) – The key of the data to set.

  • value (NTContainer) – The data.

See also GetSpecialData().

SetTag(t: str)None

Sets the tag name of the object for debugging purposes

Parameters

t (str) – The tag name.

See also GetTag().

SetUnpackLimit(limit: int)None

Sets the limit for decompression operations.

Parameters

limit (int) – The limit in bytes.

See also GetUnpackLimit().

SetUnpackNestingLimit(limit: int)None

Sets the nesting limit for decompression operations.

Parameters

limit (int) – The limit.

See also GetUnpackNestingLimit().

Shift(uSize: int)bool

Appends uSize bytes at the end of the object data and sets them to zero.

Parameters

uSize (int) – The number of bytes to append.

Returns

Returns True if successful; otherwise returns False.

Return type

bool

See also NTContainer.shift() and Align().

ToBuffer(offset: int, method: int = Bufferize_Forwards)Pro.Core.CFFBuffer

Returns a CFFBuffer that reads from the object.

Parameters
  • offset (int) – The start offset.

  • method (int) – The buffering method to use. Defaults to Bufferize_Forwards.

Returns

Returns the CFFBuffer instance.

Return type

CFFBuffer

See also CFFBuffer.

ToUInt16(n: int)int

Applies the default endianness of the object to the 16-bit input integer.

The bytes of the integer will be inverted only if the default endianness of the object doesn’t match the endianness of the current platform.

Parameters

n (int) – The input integer.

Returns

Returns the inverted integer if the the default endianness of the object doesn’t match the endianness of the current platform; otherwise returns the input integer.

Return type

int

See also ToUInt32() and ToUInt64().

ToUInt32(n: int)int

Applies the default endianness of the object to the 32-bit input integer.

Parameters

n (int) – The input integer.

Returns

Returns the inverted integer if the the default endianness of the object doesn’t match the endianness of the current platform; otherwise returns the input integer.

Return type

int

See also ToUInt16() and ToUInt64().

ToUInt64(n: int)int

Applies the default endianness of the object to the 64-bit input integer.

Parameters

n (int) – The input integer.

Returns

Returns the inverted integer if the the default endianness of the object doesn’t match the endianness of the current platform; otherwise returns the input integer.

Return type

int

See also ToUInt16() and ToUInt32().

ValidRange(offset: int, Size: int)bool

Checks the validity of a range in the context of the object.

Parameters
  • offset (int) – The offset of the range to check.

  • Size (int) – The size of the range to check.

Returns

Returns True if the range is valid; otherwise returns False.

Return type

bool

See also NTContainer.validRange().

Write(offset: int, bytes_or_uSize: Union[bytes, int], bytes: Optional[bytes] = None)bool

Writes data to the object.

Parameters
  • offset (int) – The offset at which to write the data.

  • bytes_or_uSize (Union[bytes, int]) – Either the data to write or the number of bytes to write.

  • bytes (Optional[bytes]) – The data to write.

Returns

Returns True if successful; otherwise returns False.

Return type

bool

See also Read().

WriteUInt16(offset: int, n_or_nEndiannessType: int, n: Optional[int] = None)bool

Writes an unsigned 16-bit integer to the object.

Parameters
  • offset (int) – The offset at which to write the value.

  • n_or_nEndiannessType (int) – Either the value to write or the endianness (ENDIANNESS_LITTLE or ENDIANNESS_BIG) to use when writing the value. If the endianness is not specified, the value is written using the default endianness of the object.

  • n (Optional[int]) – The value to write.

Returns

Returns True if successful; otherwise returns False.

Return type

bool

See also ReadUInt16(), WriteUInt8(), WriteUInt32() and WriteUInt64().

WriteUInt32(offset: int, n_or_nEndiannessType: int, n: Optional[int] = None)bool

Writes an unsigned 32-bit integer to the object.

Parameters
  • offset (int) – The offset at which to write the value.

  • n_or_nEndiannessType (int) – Either the value to write or the endianness (ENDIANNESS_LITTLE or ENDIANNESS_BIG) to use when writing the value. If the endianness is not specified, the value is written using the default endianness of the object.

  • n (Optional[int]) – The value to write.

Returns

Returns True if successful; otherwise returns False.

Return type

bool

See also ReadUInt32(), WriteUInt8(), WriteUInt16() and WriteUInt64().

WriteUInt64(offset: int, n_or_nEndiannessType: int, n: Optional[int] = None)bool

Writes an unsigned 64-bit integer to the object.

Parameters
  • offset (int) – The offset at which to write the value.

  • n_or_nEndiannessType (int) – Either the value to write or the endianness (ENDIANNESS_LITTLE or ENDIANNESS_BIG) to use when writing the value. If the endianness is not specified, the value is written using the default endianness of the object.

  • n (Optional[int]) – The value to write.

Returns

Returns True if successful; otherwise returns False.

Return type

bool

See also ReadUInt64(), WriteUInt8(), WriteUInt16() and WriteUInt32().

WriteUInt8(offset: int, n: int)bool

Writes an unsigned 8-bit integer to the object.

Parameters
  • offset (int) – The offset at which to write the value.

  • n (int) – The value to write.

Returns

Returns True if successful; otherwise returns False.

Return type

bool

See also ReadUInt8(), WriteUInt16(), WriteUInt32() and WriteUInt64().

CFFPtrMaxSize: Final[int]

The maximum supported pointer size.

This value is reserved for future use.

See also CFFObject.

CFFPtrMinSize: Final[int]

The minimum supported pointer size.

This value is reserved for future use.

See also CFFObject.

CFFPtrSize16: Final[int]

16-bit pointer size.

This value is reserved for future use.

See also CFFObject.

CFFPtrSize32: Final[int]

32-bit pointer size.

This value is reserved for future use.

See also CFFObject.

CFFPtrSize64: Final[int]

64-bit pointer size.

This value is reserved for future use.

See also CFFObject.

CFFSO_Clang: Final[int]

This flag specifies that the structure was generated by the Clang compiler.

See also CFFObject.SetDefaultStructOptions() and CFFStruct.

CFFSO_CompilerMask: Final[int]

Compiler mask for the flags of the structure.

See also CFFObject.SetDefaultStructOptions() and CFFStruct.

CFFSO_EndianBig: Final[int]

This flag specifies that the structure is big-endian.

See also CFFObject.SetDefaultStructOptions() and CFFStruct.

CFFSO_EndianDefault: Final[int]

This flag specifies that the structure uses the default endianness.

See also CFFObject.SetDefaultStructOptions() and CFFStruct.

CFFSO_EndianLittle: Final[int]

This flag specifies that the structure is little-endian.

See also CFFObject.SetDefaultStructOptions() and CFFStruct.

CFFSO_EndiannessBig: Final[int]

This flag specifies that the structure is big-endian.

See also CFFObject.SetDefaultStructOptions() and CFFStruct.

CFFSO_EndiannessDefault: Final[int]

This flag specifies that the structure uses the default endianness.

See also CFFObject.SetDefaultStructOptions() and CFFStruct.

CFFSO_EndiannessLittle: Final[int]

This flag specifies that the structure is little-endian.

See also CFFObject.SetDefaultStructOptions() and CFFStruct.

CFFSO_EndiannessMask: Final[int]

Endianness mask for the flags of the structure.

See also CFFObject.SetDefaultStructOptions() and CFFStruct.

CFFSO_GCC: Final[int]

This flag specifies that the structure was generated by the GCC compiler.

See also CFFObject.SetDefaultStructOptions() and CFFStruct.

CFFSO_NoCompiler: Final[int]

This flag specifies that the structure wasn’t generated by a specific compiler.

See also CFFObject.SetDefaultStructOptions() and CFFStruct.

CFFSO_NoPlatform: Final[int]

This flag specifies that the structure isn’t bound to specific platform.

See also CFFObject.SetDefaultStructOptions() and CFFStruct.

CFFSO_Pack1: Final[int]

This flag specifies that the structure has an alignment of 1.

See also CFFObject.SetDefaultStructOptions() and CFFStruct.

CFFSO_Pack16: Final[int]

This flag specifies that the structure has an alignment of 16.

See also CFFObject.SetDefaultStructOptions() and CFFStruct.

CFFSO_Pack2: Final[int]

This flag specifies that the structure has an alignment of 2.

See also CFFObject.SetDefaultStructOptions() and CFFStruct.

CFFSO_Pack4: Final[int]

This flag specifies that the structure has an alignment of 4.

See also CFFObject.SetDefaultStructOptions() and CFFStruct.

CFFSO_Pack8: Final[int]

This flag specifies that the structure has an alignment of 8.

See also CFFObject.SetDefaultStructOptions() and CFFStruct.

CFFSO_PackMask: Final[int]

Alignment mask for the flags of the structure.

See also CFFObject.SetDefaultStructOptions() and CFFStruct.

CFFSO_PackNone: Final[int]

This flag specifies that the structure doesn’t have an alignment.

See also CFFObject.SetDefaultStructOptions() and CFFStruct.

CFFSO_PlatformMask: Final[int]

Platform mask for the flags of the structure.

See also CFFObject.SetDefaultStructOptions() and CFFStruct.

CFFSO_Pointer16: Final[int]

This flag specifies that the pointer size of the structure is 16-bits.

See also CFFObject.SetDefaultStructOptions() and CFFStruct.

CFFSO_Pointer32: Final[int]

This flag specifies that the pointer size of the structure is 32-bits.

See also CFFObject.SetDefaultStructOptions() and CFFStruct.

CFFSO_Pointer64: Final[int]

This flag specifies that the pointer size of the structure is 64-bits.

See also CFFObject.SetDefaultStructOptions() and CFFStruct.

CFFSO_PointerDefault: Final[int]

This flag specifies that the pointer size of the structure is the default one for the object.

See also CFFObject.SetDefaultStructOptions() and CFFStruct.

CFFSO_PointerMask: Final[int]

Pointer mask for the flags of the structure.

See also CFFObject.SetDefaultStructOptions() and CFFStruct.

CFFSO_VC: Final[int]

This flag specifies that the structure was generated by the Visual C++ compiler.

See also CFFObject.SetDefaultStructOptions() and CFFStruct.

CFFSO_Windows: Final[int]

This flag specifies that the structure was generated for the Windows platform.

See also CFFObject.SetDefaultStructOptions() and CFFStruct.

class CFFStruct

This class represents a data structure and references a CFFObject instance.

Instances of CFFStruct can be returned from CFFObject derived classes or by using CFFObject.MakeStruct() in combination with an instance of CFFHeader.

Example:

from Pro.Core import *
from Pro.PE import *

def printDOSHeader(fname):
    c = createContainerFromFile(fname)
    if c.isNull():
        return
    pe = PEObject()
    if not pe.Load(c):
        return
    out = NTTextBuffer()
    pe.DosHeader().Dump(out) # CFFStruct.Dump
    print(out.buffer)

See also CFFStruct, CFFHeader and CFFObject.MakeStruct().

Methods:

Add(i)

If the current instance represents an array of structures, this method changes which entry is currently referenced.

At(i)

Retrieves a specific structure among an array of structures.

Bytes(i_or_name)

Returns the byte-array representation of a member of the structure.

Context()

Returns the context helper class for the current structure.

Count()

Returns the number of entries in the current array of structures.

Dump(out)

Outputs the members of the structure to a text stream according to their type nature.

Equals(s)

Checks whether two structures reference the same internal data.

Fill(c_or_i_or_name[, c])

Fills the entire structure or a member of it with a specified 8-bit value.

Flags(i_or_name)

Returns the flags for a member of the structure.

GetOffset()

Returns the start offset of the structure.

HasDynamicSize()

Checks whether the structure contains members whose size depends upon the underlying data.

HasFlags([i_or_name])

Checks whether at least one member or a specific member of the structure has flags associated with it.

IsArray()

Returns True if the current instance represents an array of structures; otherwise returns False.

IsFixed()

Returns True if the structures has a fixed size; otherwise returns False.

IsNull()

Returns True if the structure is invalid; otherwise returns False.

IsValid()

Returns True if the structure is valid; otherwise returns False.

LongestMemberName()

Returns the length of the longer member name of the structure.

MakeSingle()

Converts an array of structure into a single structure.

MemberCount()

Returns the number of members in the structure.

MemberName(i)

Retrieves the name of a member of the structure by its index.

MemberNature(i_or_name)

Retrieves the type nature of a member of the structure.

MemberOffset(i_or_name)

Retrieves the offset of a member of the structure.

MemberPosition(name)

Retrieves the index of a member of the structure.

MemberSize(i_or_name)

Retrieves the size of a member of the structure.

MemberType(i)

Retrieves the type of a member of the structure.

MemberTypeName(i)

Retrieves the type name of a member of the structure.

MembersWithFlags()

Returns a list of indexes of those members in the structure which have flags.

Num(i_or_name)

Returns the numeric representation of a member of the structure.

Object()

Returns the internally referenced object.

Offset()

Returns the start offset of the structure.

Raw(i_or_name)

Returns the raw data of a member of the structure.

Set(i_or_name, bytes_or_number_or_str)

Sets a member of the structure.

SetContext(ctx)

Sets the context helper class for the current structure.

SetCount(n)

Sets the number of entries in the array of structures.

SetMemberCount(n)

Sets the number of members that the structure has.

SetObject(obj)

Sets the internally referenced object.

SetOffset(o)

Sets the start offset of the structure.

SetRaw(i_or_name, bytes)

Sets the raw data of a member of the structure.

Size()

Returns the size of the structure.

Str(i_or_name[, align_nums])

Returns the string representation of a member of the structure.

StructName()

Returns the name of the structure.

SubStruct(i_or_name)

Retrieves a sub-structure of the current structure.

TotalSize()

Returns the total size occupied by the array of structures.

Uns(i_or_name)

Returns the unsigned integer representation of a member of the structure.

Zero([i_or_name])

Fills the entire structure or a member of it with zero.

iterator()

Returns an iterator for an array of structures.

Add(i: int)Pro.Core.CFFStruct

If the current instance represents an array of structures, this method changes which entry is currently referenced.

Parameters

i (int) – The iterator can be increased by a negative amount.

Returns

Returns the requested structure if within the limit of available entries; otherwise returns an invalid structure.

Return type

CFFStruct

See also At(), Count() and iterator().

At(i: int)Pro.Core.CFFStruct

Retrieves a specific structure among an array of structures.

Parameters

i (int) – The index of the structure to retrieve.

Returns

Returns the requested structure if within the limit of available entries; otherwise returns an invalid structure.

Return type

CFFStruct

See also Count(), At() and iterator().

Bytes(i_or_name: Union[int, str])bytes

Returns the byte-array representation of a member of the structure.

This method automatically handles the endianness of the requested data.

Parameters

i_or_name (Union[int, str]) – The index or name of the member of the structure.

Returns

Returns the requested data if successful; otherwise returns an empty bytes object.

Return type

bytes

See also Set(), Str(), Num() and Raw().

Context()Pro.Core.CFFContext
Returns

Returns the context helper class for the current structure.

Return type

CFFContext

See also SetContext().

Count()int
Returns

Returns the number of entries in the current array of structures.

Return type

int

See also SetCount(), At() and iterator().

Dump(out: Pro.Core.NTTextStream)bool

Outputs the members of the structure to a text stream according to their type nature.

Parameters

out (NTTextStream) – The text stream for the output.

Returns

Returns True if successful; otherwise returns False.

Return type

bool

See also NTTextStream.

Equals(s: Pro.Core.CFFStruct)bool

Checks whether two structures reference the same internal data.

Parameters

s (CFFStruct) – The other structure.

Returns

Returns True if the structure reference the same internal data; otherwise returns False.

Return type

bool

Fill(c_or_i_or_name: Union[int, str], c: Optional[int] = None)bool

Fills the entire structure or a member of it with a specified 8-bit value.

Parameters
  • c_or_i_or_name (Union[int, str]) – Either the 8-bit value used to fill the structure or the index or name of the member of the structure to fill.

  • c (Optional[int]) – The 8-bit value used to fill the member of the structure.

Returns

Returns True if successful; otherwise returns False.

Return type

bool

See also Zero().

Flags(i_or_name: Union[int, str])Pro.Core.CFFFlags

Returns the flags for a member of the structure.

Parameters

i_or_name (Union[int, str]) – The index or name of the member of the structure.

Returns

Returns a valid CFFFlags instance if successful; otherwise returns an invalid CFFFlags instance.

Return type

CFFFlags

See also HasFlags(), MembersWithFlags() and CFFFlags.

GetOffset()int
Returns

Returns the start offset of the structure.

Return type

int

See also Offset(), SetOffset() and Size().

HasDynamicSize()bool

Checks whether the structure contains members whose size depends upon the underlying data.

Note

In an array of dynamic structures every entry can potentially have a different size than the other entries. Knowing whether or not a structure is dynamic is important for optimization purposes: skipping multiple entries in an array of dynamic structures requires to read the data for each entry to perform the calculation (e.g., Add()).

Returns

Returns True if the structure contains members whose size depends upon the underlying data; otherwise returns False.

Return type

bool

See also Add() and At().

HasFlags(i_or_name: Optional[Union[int, str]] = None)bool

Checks whether at least one member or a specific member of the structure has flags associated with it.

Parameters

i_or_name (Optional[Union[int, str]]) – The index or name of the member of the structure.

Returns

Returns True if flags are available; otherwise returns False.

Return type

bool

See also Flags(), MembersWithFlags() and CFFFlags.

IsArray()bool
Returns

Returns True if the current instance represents an array of structures; otherwise returns False.

Return type

bool

See also Count() and MakeSingle().

IsFixed()bool
Returns

Returns True if the structures has a fixed size; otherwise returns False.

Return type

bool

IsNull()bool
Returns

Returns True if the structure is invalid; otherwise returns False.

Return type

bool

See also IsValid().

IsValid()bool
Returns

Returns True if the structure is valid; otherwise returns False.

Return type

bool

See also IsNull().

LongestMemberName()int
Returns

Returns the length of the longer member name of the structure.

Return type

int

See also MemberName().

MakeSingle()Pro.Core.CFFStruct

Converts an array of structure into a single structure.

Returns

Returns the currently referenced structure in the array as a single structure.

Return type

CFFStruct

See also IsArray() and Count().

MemberCount()int
Returns

Returns the number of members in the structure.

Return type

int

See also SetMemberCount().

MemberName(i: int)str

Retrieves the name of a member of the structure by its index.

Parameters

i (int) – The index of the member of the structure.

Returns

Returns the member name if successful; otherwise returns an empty string.

Return type

str

See also MemberPosition(), MemberOffset() and MemberSize().

MemberNature(i_or_name: Union[int, str])int

Retrieves the type nature of a member of the structure.

Parameters

i_or_name (Union[int, str]) – The index or name of the member of the structure.

Returns

Returns the type nature if successful; otherwise returns NATURE_UNKNOWN.

Return type

int

See also MemberName(), MemberOffset() and MemberSize().

MemberOffset(i_or_name: Union[int, str])int

Retrieves the offset of a member of the structure.

Parameters

i_or_name (Union[int, str]) – The index or name of the member of the structure.

Returns

Returns the offset if successful; otherwise returns INVALID_STREAM_OFFSET.

Return type

int

See also MemberName(), MemberSize() and MemberPosition().

MemberPosition(name: str)int

Retrieves the index of a member of the structure.

Parameters

name (str) – The name of the member of the structure.

Returns

Returns the index if successful; otherwise returns -1.

Return type

int

See also MemberName(), MemberOffset() and MemberSize().

MemberSize(i_or_name: Union[int, str])int

Retrieves the size of a member of the structure.

Parameters

i_or_name (Union[int, str]) – The index or name of the member of the structure.

Returns

Returns the size if successful; otherwise returns 0.

Return type

int

See also MemberOffset(), MemberName() and MemberPosition().

MemberType(i: int)int

Retrieves the type of a member of the structure.

Parameters

i (int) – The index or name of the member of the structure.

Returns

Returns the type if successful; otherwise returns 0xFFFFFFFFFFFFFFFF.

Return type

int

See also MemberTypeName(), MemberName(), MemberOffset() and MemberSize().

MemberTypeName(i: int)str

Retrieves the type name of a member of the structure.

Parameters

i (int) – The index or name of the member of the structure.

Returns

Returns the type name if successful; otherwise returns an empty string.

Return type

str

See also MemberType(), MemberName(), MemberOffset() and MemberSize().

MembersWithFlags()Pro.Core.NTIntList
Returns

Returns a list of indexes of those members in the structure which have flags.

Return type

NTIntList

See also HasFlags(), Flags() and CFFFlags.

Num(i_or_name: Union[int, str])int

Returns the numeric representation of a member of the structure.

Important

If the member to retrieve is an unsigned integer which doesn’t exceed 64 bit in size, then the slightly faster Uns() method can be used instead of Num().

This method automatically handles the endianness of the requested data.

Parameters

i_or_name (Union[int, str]) – The index or name of the member of the structure.

Returns

Returns the numeric value if successful; otherwise returns 0.

Return type

int

See also Set(), Uns(), Str(), Bytes() and Raw().

Object()Pro.Core.CFFObject
Returns

Returns the internally referenced object.

Return type

CFFObject

See also SetObject().

Offset()int
Returns

Returns the start offset of the structure.

Return type

int

See also GetOffset(), SetOffset() and Size().

Raw(i_or_name: Union[int, str])bytes

Returns the raw data of a member of the structure.

Parameters

i_or_name (Union[int, str]) – The index or name of the member of the structure.

Returns

Returns the requested data if successful; otherwise returns an empty bytes object.

Return type

bytes

See also SetRaw().

Set(i_or_name: Union[int, str], bytes_or_number_or_str: Union[bytes, int, str])bool

Sets a member of the structure.

This method automatically handles the endianness of the data to set.

Parameters
  • i_or_name (Union[int, str]) – The index or name of the member of the structure.

  • bytes_or_number_or_str (Union[bytes, int, str]) – The data to set. This value is automatically converted to the raw data.

Returns

Returns True if successful; otherwise returns False.

Return type

bool

See also Str(), Num(), Bytes() and Raw().

SetContext(ctx: Pro.Core.CFFContext)None

Sets the context helper class for the current structure.

Parameters

ctx (CFFContext) – The context helper class to set.

See also Context().

SetCount(n: int)None

Sets the number of entries in the array of structures.

Parameters

n (int) – The number of entries to set.

See also Count(), At() and iterator().

SetMemberCount(n: int)None

Sets the number of members that the structure has.

Note

This method can only reduce the number of members initially available in the structure and it’s used to adapt structures which have different number of members depending on a version or size field.

Parameters

n (int) – The number of members to set.

See also MemberCount().

SetObject(obj: Pro.Core.CFFObject)None

Sets the internally referenced object.

Parameters

obj (CFFObject) – The object to set.

See also Object().

SetOffset(o: int)None

Sets the start offset of the structure.

Parameters

o (int) – The start offset to set.

See also Offset(), GetOffset() and Size().

SetRaw(i_or_name: Union[int, str], bytes: bytes)bool

Sets the raw data of a member of the structure.

Parameters
  • i_or_name (Union[int, str]) – The index or name of the member of the structure.

  • bytes (bytes) – The raw data to set.

Returns

Returns True if successful; otherwise returns False.

Return type

bool

See also Raw().

Size()int
Returns

Returns the size of the structure.

Return type

int

See also TotalSize(), Offset() and GetOffset().

Str(i_or_name: Union[int, str], align_nums: bool = False)str

Returns the string representation of a member of the structure.

This method automatically handles the endianness of the requested data.

Parameters
  • i_or_name (Union[int, str]) – The index or name of the member of the structure.

  • align_nums (bool) – If True, aligns numbers using zero-padding.

Returns

Returns the string if successful; otherwise returns an empty string.

Return type

str

See also Set(), Num(), Bytes() and Raw().

StructName()str
Returns

Returns the name of the structure.

Return type

str

SubStruct(i_or_name: Union[int, str])Pro.Core.CFFStruct

Retrieves a sub-structure of the current structure.

This method is available only to fixed size structures.

Parameters

i_or_name (Union[int, str]) – The name or index of the sub-structure to retrieve.

Returns

Returns the sub-structure if successful; otherwise returns an invalid structure.

Return type

CFFStruct

See also IsFixed().

TotalSize()int
Returns

Returns the total size occupied by the array of structures.

Return type

int

See also Size(), Offset() and GetOffset().

Uns(i_or_name: Union[int, str])int

Returns the unsigned integer representation of a member of the structure.

Important

The maximum supported size for unsigned integers returned by this method is 64 bits. To retrieve larger or negative integers Num() must be used. The difference between the two methods is that Uns() is slightly faster than Num().

This method automatically handles the endianness of the requested data.

Parameters

i_or_name (Union[int, str]) – The index or name of the member of the structure.

Returns

Returns the numeric value if successful; otherwise returns 0.

Return type

int

Available since Cerbero Suite 5.0 and Cerbero Engine 2.0.

See also Set(), Num(), Str(), Bytes() and Raw().

Zero(i_or_name: Optional[Union[int, str]] = None)bool

Fills the entire structure or a member of it with zero.

Parameters

i_or_name (Optional[Union[int, str]]) – The index or name of the member of the structure.

Returns

Returns True if successful; otherwise returns False.

Return type

bool

See also Fill().

iterator()Pro.Core.CFFStructIt
Returns

Returns an iterator for an array of structures.

Return type

CFFStructIt

See also CFFStructIt.

class CFFStructIt(s: Pro.Core.CFFStruct)

Iterator for an array of CFFStruct structures.

Parameters

s (CFFStruct) – The array of structures to iterate over.

See also CFFStruct.iterator() and CFFStruct.

Methods:

HasNext()

Returns True if there is an entry after the current one; otherwise returns False.

Next()

Returns the entry after the current one and moves the iterator if successful; otherwise returns an invalid structure.

hasNext()

Returns True if there is an entry after the current one; otherwise returns False.

next()

Returns the entry after the current one and moves the iterator if successful; otherwise returns an invalid structure.

HasNext()bool
Returns

Returns True if there is an entry after the current one; otherwise returns False.

Return type

bool

See also Next(), hasNext(), next() and CFFStruct.

Next()Pro.Core.CFFStruct
Returns

Returns the entry after the current one and moves the iterator if successful; otherwise returns an invalid structure.

Return type

CFFStruct

See also HasNext(), hasNext(), next() and CFFStruct.

hasNext()bool
Returns

Returns True if there is an entry after the current one; otherwise returns False.

Return type

bool

See also next() and CFFStruct.

next()Pro.Core.CFFStruct
Returns

Returns the entry after the current one and moves the iterator if successful; otherwise returns an invalid structure.

Return type

CFFStruct

See also hasNext() and CFFStruct.

class CFFStructList

List of CFFStruct elements.

Methods:

append(value)

Inserts value at the end of the list.

at(i)

Returns the item at index position i in the list.

clear()

Removes all items from the list.

contains(value)

Checks the presence of an element in the list.

count(value)

Returns the number of occurrences of value in the list.

indexOf(value[, start])

Searches for an element in the list.

insert(i, value)

Inserts value at index position i in the list.

isEmpty()

Checks whether the list is empty.

iterator()

Creates an iterator for the list.

removeAll(value)

Removes all occurrences of value in the list and returns the number of entries removed.

removeAt(i)

Removes the item at index position i.

reserve(alloc)

Reserve space for alloc elements.

size()

Returns the number of items in the list.

takeAt(i)

Removes the item at index position i and returns it.

append(value: Pro.Core.CFFStruct)None

Inserts value at the end of the list.

Parameters

value (CFFStruct) – The value to add to the list.

See also insert().

at(i: int)Pro.Core.CFFStruct

Returns the item at index position i in the list. i must be a valid index position in the list (i.e., 0 <= i < size()).

Parameters

i (int) – The index of the element to return.

Returns

Returns the requested element.

Return type

CFFStruct

clear()None

Removes all items from the list.

contains(value: Pro.Core.CFFStruct)bool

Checks the presence of an element in the list.

Parameters

value (CFFStruct) – The value to check for.

Returns

Returns True if the list contains an occurrence of value; otherwise returns False.

Return type

bool

See also indexOf() and count().

count(value: Pro.Core.CFFStruct)int

Returns the number of occurrences of value in the list.

Parameters

value (CFFStruct) – The value to count.

Returns

Returns the number of occurrences.

Return type

int

See also indexOf() and contains().

indexOf(value: Pro.Core.CFFStruct, start: int = 0)int

Searches for an element in the list.

Parameters
  • value (CFFStruct) – The value to search for.

  • start (int) – The start index.

Returns

Returns the index position of the first occurrence of value in the list. Returns -1 if no item was found.

Return type

int

See also contains().

insert(i: int, value: Pro.Core.CFFStruct)None

Inserts value at index position i in the list. If i is 0, the value is prepended to the list. If i is size(), the value is appended to the list.

Parameters
  • i (int) – The position at which to add the value.

  • value (CFFStruct) – The value to add.

See also append() and removeAt().

isEmpty()bool

Checks whether the list is empty.

Returns

Returns True if the list contains no items; otherwise returns False.

Return type

bool

See also size().

iterator()Pro.Core.CFFStructListIt

Creates an iterator for the list.

Returns

Returns the iterator.

Return type

CFFStructListIt

removeAll(value: Pro.Core.CFFStruct)int

Removes all occurrences of value in the list and returns the number of entries removed.

Parameters

value (CFFStruct) – The value to remove from the list.

Returns

Returns the number of entries removed.

Return type

int

See also removeAt().

removeAt(i: int)None

Removes the item at index position i. i must be a valid index position in the list (i.e., 0 <= i < size()).

Parameters

i (int) – The index of the item to remove.

See also removeAll().

reserve(alloc: int)None

Reserve space for alloc elements. Calling this method doesn’t change the size of the list.

Parameters

alloc (int) – The amount of elements to reserve space for.

size()int
Returns

Returns the number of items in the list.

Return type

int

See also isEmpty().

takeAt(i: int)Pro.Core.CFFStruct

Removes the item at index position i and returns it. i must be a valid index position in the list (i.e., 0 <= i < size()).

Parameters

i (int) – The index of the element to remove from the list.

Returns

Returns the removed element. If you don’t use the return value, removeAt() is more efficient.

Return type

CFFStruct

See also removeAt().

class CFFStructListIt(obj: Pro.Core.CFFStructList)

Iterator class for CFFStructList.

Parameters

obj (CFFStructList) – The object to iterate over.

Methods:

hasNext()

Returns True if there is at least one item ahead of the iterator, i.e. the iterator is not at the back of the container; otherwise returns False.

hasPrevious()

Returns True if there is at least one item behind the iterator, i.e. the iterator is not at the front of the container; otherwise returns False.

next()

Returns the next item and advances the iterator by one position.

previous()

Returns the previous item and moves the iterator back by one position.

toBack()

Moves the iterator to the back of the container (after the last item).

toFront()

Moves the iterator to the front of the container (before the first item).

hasNext()bool
Returns

Returns True if there is at least one item ahead of the iterator, i.e. the iterator is not at the back of the container; otherwise returns False.

Return type

bool

See also hasPrevious() and next().

hasPrevious()bool
Returns

Returns True if there is at least one item behind the iterator, i.e. the iterator is not at the front of the container; otherwise returns False.

Return type

bool

See also hasNext() and previous().

next()Pro.Core.CFFStruct
Returns

Returns the next item and advances the iterator by one position.

Return type

CFFStruct

See also hasNext() and previous().

previous()Pro.Core.CFFStruct
Returns

Returns the previous item and moves the iterator back by one position.

Return type

CFFStruct

See also hasPrevious() and next().

toBack()None

Moves the iterator to the back of the container (after the last item).

See also toFront() and previous().

toFront()None

Moves the iterator to the front of the container (before the first item).

See also toBack() and next().

CFF_ARRAY_NULL_TERMINATED: Final[int]

If specified, makes an array of structure be null-terminated.

See also CFFObject.MakeStructArray().

CT_ActionScript2: Final[int]

Scan entry type for ActionScript2.

See also ScanProvider.addEntry() and ScanEntryData.

CT_ActionScript3: Final[int]

Scan entry type for ActionScript3.

See also ScanProvider.addEntry() and ScanEntryData.

CT_AppLaunch: Final[int]

Scan entry type for application launches.

See also ScanProvider.addEntry() and ScanEntryData.

CT_AttackSurface: Final[int]

Scan entry type for attack surfaces.

See also ScanProvider.addEntry() and ScanEntryData.

CT_BinaryData: Final[int]

Scan entry type for binary data.

See also ScanProvider.addEntry() and ScanEntryData.

CT_Blacklisted: Final[int]

Scan entry type for a blacklisted item.

Available since Cerbero Suite 5.5 and Cerbero Engine 2.5.

See also ScanProvider.addEntry() and ScanEntryData.

CT_ByteCode: Final[int]

Scan entry type for byte-code.

See also ScanProvider.addEntry() and ScanEntryData.

CT_DalvikByteCode: Final[int]

Scan entry type for Dalvik byte-code.

See also ScanProvider.addEntry() and ScanEntryData.

CT_DataEntriesEnd: Final[int]

Scan entry type for data entries end.

See also ScanProvider.addEntry() and ScanEntryData.

CT_DataEntriesStart: Final[int]

Scan entry type for data entries start.

See also ScanProvider.addEntry() and ScanEntryData.

CT_DebugData: Final[int]

Scan entry type for debug data.

See also ScanProvider.addEntry() and ScanEntryData.

CT_DecompressionBomb: Final[int]

Scan entry type for decompression bombs.

See also ScanProvider.addEntry() and ScanEntryData.

CT_EmbeddedFile: Final[int]

Scan entry type for embedded objects.

See also SEC_File, ScanProvider.addEntry() and ScanEntryData.

CT_EntryLimit: Final[int]

Scan entry type for entry limits.

See also ScanProvider.addEntry() and ScanEntryData.

CT_ForeignData: Final[int]

Scan entry type for foreign data.

See also ScanProvider.addEntry() and ScanEntryData.

CT_FreePages: Final[int]

Scan entry type for free pages.

See also ScanProvider.addEntry() and ScanEntryData.

CT_Geolocation: Final[int]

Scan entry type for geo-locations.

See also ScanProvider.addEntry() and ScanEntryData.

CT_HiddenSheets: Final[int]

Scan entry type for hidden sheets.

See also ScanProvider.addEntry() and ScanEntryData.

CT_Intelligence: Final[int]

Scan entry type for an intelligence report.

Available since Cerbero Suite 5.5 and Cerbero Engine 2.5.

See also ScanProvider.addEntry() and ScanEntryData.

CT_InteractiveForm: Final[int]

Scan entry type for interactive forms.

See also ScanProvider.addEntry() and ScanEntryData.

CT_InvalidCertificate: Final[int]

Scan entry type for invalid certificates.

See also ScanProvider.addEntry() and ScanEntryData.

CT_JavaByteCode: Final[int]

Scan entry type for Java byte-code.

See also ScanProvider.addEntry() and ScanEntryData.

CT_JavaScript: Final[int]

Scan entry type for JavaScript.

See also ScanProvider.addEntry() and ScanEntryData.

CT_MSILByteCode: Final[int]

Scan entry type for MSIL byte-code.

See also ScanProvider.addEntry() and ScanEntryData.

CT_Malformed: Final[int]

Scan entry type for malformed data.

See also ScanProvider.addEntry() and ScanEntryData.

CT_MalformedDocument: Final[int]

Scan entry type for malformed documents.

See also ScanProvider.addEntry() and ScanEntryData.

CT_MetaData: Final[int]

Scan entry type for meta-data.

See also ScanProvider.addEntry() and ScanEntryData.

CT_MetaDataUnknown: Final[int]

Scan entry type for unknown meta-data.

See also ScanProvider.addEntry() and ScanEntryData.

CT_NativeCode: Final[int]

Scan entry type for native code.

See also ScanProvider.addEntry() and ScanEntryData.

CT_NoDecompress: Final[int]

Scan entry type for failed decompression.

See also ScanProvider.addEntry() and ScanEntryData.

CT_NoDecrypt: Final[int]

Scan entry type for failed decryption.

See also ScanProvider.addEntry() and ScanEntryData.

CT_OKDecompressed: Final[int]

Scan entry type for successful decompression.

See also ScanProvider.addEntry() and ScanEntryData.

CT_OKDecrypted: Final[int]

Scan entry type for successful decryption.

See also ScanProvider.addEntry() and ScanEntryData.

CT_PersonalData: Final[int]

Scan entry type for personal data.

See also ScanProvider.addEntry() and ScanEntryData.

CT_Privileges: Final[int]

Scan entry type for required privileges.

See also ScanProvider.addEntry() and ScanEntryData.

CT_Recursive: Final[int]

Scan entry type for recursion.

See also ScanProvider.addEntry() and ScanEntryData.

CT_Report: Final[int]

Scan entry type for a report.

Available since Cerbero Suite 5.5 and Cerbero Engine 2.5.

See also ScanProvider.addEntry() and ScanEntryData.

CT_Resources: Final[int]

Scan entry type for issues in resources.

See also ScanProvider.addEntry() and ScanEntryData.

CT_Script: Final[int]

Scan entry type for scripts.

See also ScanProvider.addEntry() and ScanEntryData.

CT_ShellCode: Final[int]

Scan entry type for shellcode.

See also ScanProvider.addEntry() and ScanEntryData.

CT_SignatureMatch: Final[int]

Scan entry type for signature matches.

See also ScanProvider.addEntry() and ScanEntryData.

CT_SpreadsheetFormulas: Final[int]

Scan entry type for spreadsheet formulas.

See also ScanProvider.addEntry() and ScanEntryData.

Scan entry type for symbolic links.

See also ScanProvider.addEntry() and ScanEntryData.

CT_Thumbnail: Final[int]

Scan entry type for thumbnails.

See also ScanProvider.addEntry() and ScanEntryData.

CT_TrueType: Final[int]

Scan entry type for TrueType fonts.

See also ScanProvider.addEntry() and ScanEntryData.

CT_TrustedCertificate: Final[int]

Scan entry type for trusted certificates.

See also ScanProvider.addEntry() and ScanEntryData.

CT_Type1: Final[int]

Scan entry type for Type1 fonts.

See also ScanProvider.addEntry() and ScanEntryData.

CT_Type2: Final[int]

Scan entry type for Type2 fonts.

See also ScanProvider.addEntry() and ScanEntryData.

CT_UnaccountedSpace: Final[int]

Scan entry type for unaccounted space.

See also ScanProvider.addEntry() and ScanEntryData.

CT_UnknownFont: Final[int]

Scan entry type for unknown fonts.

See also ScanProvider.addEntry() and ScanEntryData.

CT_UnpackLimit: Final[int]

Scan entry type for the decompression limit.

See also ScanProvider.addEntry() and ScanEntryData.

CT_UnpackNestLimit: Final[int]

Scan entry type for the decompression nesting limit.

See also ScanProvider.addEntry() and ScanEntryData.

CT_UnreferencedData: Final[int]

Scan entry type for unreferenced data.

See also ScanProvider.addEntry() and ScanEntryData.

CT_UntrustedCertificate: Final[int]

Scan entry type for untrusted certificates.

See also ScanProvider.addEntry() and ScanEntryData.

CT_UnverifiedCertificate: Final[int]

Scan entry type for unverified certificates.

See also ScanProvider.addEntry() and ScanEntryData.

CT_VBAScript: Final[int]

Scan entry type for VBA code.

See also ScanProvider.addEntry() and ScanEntryData.

CT_VBSScript: Final[int]

Scan entry type for VBS scripts.

See also ScanProvider.addEntry() and ScanEntryData.

CT_VersionInfo: Final[int]

Scan entry type for version information.

See also ScanProvider.addEntry() and ScanEntryData.

CT_Whitelisted: Final[int]

Scan entry type for a whitelisted item.

Available since Cerbero Suite 5.5 and Cerbero Engine 2.5.

See also ScanProvider.addEntry() and ScanEntryData.

CT_WrongCheckSum: Final[int]

Scan entry type for invalid checksums.

See also ScanProvider.addEntry() and ScanEntryData.

CT_WrongDigest: Final[int]

Scan entry type for invalid digests.

See also ScanProvider.addEntry() and ScanEntryData.

CT_WrongHash: Final[int]

Scan entry type for invalid hashes.

See also ScanProvider.addEntry() and ScanEntryData.

class CommonSystem

Logic providers return classes derived from this class to define a scanning behaviour.

See also LocalSystem and ProCoreContext.getSystem().

Methods:

addFile(file[, name])

Adds a file to the queue of files to scan.

addFiles(files[, names])

Adds a a list of files to the queue of files to scan.

addPath(path)

Adds a path to the queue of paths to scan.

addPaths(paths)

Adds a list of paths to the queue of paths to scan.

allPaths()

Scans all available paths.

clear()

Clears the scan system.

defaultLocalSeparator()

Returns the path separator for the current platform.

defaultScanContext()

Retrieves the scan context for the system.

defaultSeparator()

Returns the path separator for the system.

isBatchScan()

Returns True if the system performs a batch scan; otherwise returns False.

last()

Returns the last FileToScan returned by calling next().

next()

Returns the next file to scan if available; otherwise returns an invalid FileToScan instance.

nextFile()

This method must be overwritten by derived classes to provide the next FileToScan data.

setBatchScan(b)

Sets the batch scan status of the system.

setDefaultLocalSeparator(sep)

Sets the path separator for the current platform.

setDefaultScanContext(ctx)

Sets the scan context for the system.

setDefaultSeparator(sep)

Sets the path separator for the system.

setExtensions(exts)

Sets the file extensions to scan.

setPrefixReplace(before, after)

Sets a replacement rule for file prefixes.

addFile(file: str, name: str = str())None

Adds a file to the queue of files to scan.

Parameters
  • file (str) – The name of the file to scan on disk.

  • name (str) – An optional name for the file.

See also addFiles() and addPath().

addFiles(files: Pro.Core.NTStringList, names: Pro.Core.NTStringList = NTStringList())None

Adds a a list of files to the queue of files to scan.

Parameters
  • files (NTStringList) – A list with the names of the files to scan on disk.

  • names (NTStringList) – A list with optional names for the files.

See also addFile() and addPaths().

addPath(path: str)None

Adds a path to the queue of paths to scan.

Parameters

path (str) – The path to scan.

See also addPaths(), addFile() and allPaths().

addPaths(paths: Pro.Core.NTStringList)None

Adds a list of paths to the queue of paths to scan.

Parameters

paths (NTStringList) – A list of the paths to scan.

See also addPath(), addFiles() and allPaths().

allPaths()None

Scans all available paths.

See also addFiles() and addPaths().

clear()None

Clears the scan system.

See also addFile() and addPaths().

defaultLocalSeparator()int
Returns

Returns the path separator for the current platform.

Return type

int

See also setDefaultLocalSeparator() and defaultSeparator().

defaultScanContext()str

Retrieves the scan context for the system.

Note

This method is served for future use.

Returns

Returns the scan context.

Return type

str

See also setDefaultScanContext().

defaultSeparator()int
Returns

Returns the path separator for the system.

Return type

int

See also setDefaultSeparator() and defaultLocalSeparator().

isBatchScan()bool
Returns

Returns True if the system performs a batch scan; otherwise returns False.

Return type

bool

See also setBatchScan().

last()Pro.Core.FileToScan
Returns

Returns the last FileToScan returned by calling next().

Return type

FileToScan

See also next().

next()Pro.Core.FileToScan
Returns

Returns the next file to scan if available; otherwise returns an invalid FileToScan instance.

Return type

FileToScan

See also last() and nextFile().

nextFile()Pro.Core.FileToScan

This method must be overwritten by derived classes to provide the next FileToScan data.

Warning

This method must not be called directly! Instead, next() must be called.

Returns

Returns the next file to scan if available; otherwise returns an invalid FileToScan instance.

Return type

FileToScan

setBatchScan(b: bool)None

Sets the batch scan status of the system.

By default the batch scan status is set to True.

Parameters

b (bool) – If True, the system performs a batch scan; otherwise it performs a single scan.

See also isBatchScan().

setDefaultLocalSeparator(sep: int)None

Sets the path separator for the current platform.

Parameters

sep (int) – The local path separator.

See also defaultLocalSeparator() and setDefaultSeparator().

setDefaultScanContext(ctx: str)None

Sets the scan context for the system.

Note

This method is served for future use.

Parameters

ctx (str) – The scan context.

See also defaultScanContext().

setDefaultSeparator(sep: int)None

Sets the path separator for the system.

Parameters

sep (int) – The path separator.

See also defaultSeparator() and setDefaultLocalSeparator().

setExtensions(exts: Pro.Core.NTStringList)None

Sets the file extensions to scan.

Parameters

exts (NTStringList) – The list of file extensions to scan.

See also addFiles() and addPaths().

setPrefixReplace(before: str, after: str)None

Sets a replacement rule for file prefixes.

Parameters
  • before (str) – The prefix to replace.

  • after (str) – The new prefix.

See also addFiles() and addPaths().

CurrentEndianness()int
Returns

Returns the endianness of the system (ENDIANNESS_LITTLE or ENDIANNESS_BIG).

Return type

int

DSNF_NoAccessSpecifier: Final[int]

Doesn’t include the member type (i.e.: public, protected, private) in the unmangled symbol.

See also DemangleSymbolName().

DSNF_NoCallingConvention: Final[int]

Doesn’t include the calling convention in the unmangled symbol.

See also DemangleSymbolName().

DSNF_NoMemberType: Final[int]

Doesn’t include the member type (i.e.: static, virtual, extern) in the unmangled symbol.

See also DemangleSymbolName().

DSNF_NoReturnType: Final[int]

Doesn’t include the return type in the unmangled symbol.

See also DemangleSymbolName().

DSNF_SimpleSignature: Final[int]

Returns a simplified signature of the unmangled symbol.

Combination of DSNF_NoAccessSpecifier, DSNF_NoCallingConvention, DSNF_NoReturnType and DSNF_NoMemberType.

See also DemangleSymbolName().

DemangleSymbolName(mangled: str, flags: int = 0)str

Unmangles a decorated symbol. Symbols generated by Visual C++ and GCC are supported.

Parameters
  • mangled (str) – The mangled symbol.

  • flags (int) – Optional flags (e.g.: DSNF_SimpleSignature).

Returns

Returns the unmangled symbol.

Return type

str

See also MethodNameFromSimpleSignature() and DSNF_SimpleSignature.

DisasmOpt_FileOffsets: Final[int]

Shows offsets in disassemblies shown in the text view.

See also proDisasmOptions().

DisasmOpt_Opcodes: Final[int]

Shows opcodes in disassemblies shown in the text view.

See also proDisasmOptions().

ENDIANNESS_BIG: Final[int]

Big-endian option.

See also ENDIANNESS_LITTLE and CFFObject.SetDefaultEndianness().

ENDIANNESS_LITTLE: Final[int]

Little-endian option.

See also ENDIANNESS_BIG and CFFObject.SetDefaultEndianness().

EXPLICIT_OFLAGS_MASK: Final[int]

The mask for explicit object flags.

Explicit flags are set by the scan provider during the scanning process.

See also ScanProvider and IMPLICIT_OFLAG_UNKNOWN_FORMAT.

class FileToScan

This class contains information about the file to scan returned by classes derived from CommonSystem.

See also CommonSystem.next() and CommonSystem.

Methods:

clear()

Clears the instance.

context()

Returns the scan context for the file.

format()

Returns the format to be used to scan the file.

isValid()

Returns True if the file to scan is valid; otherwise returns False.

localName()

Returns the name of the file to scan on disk.

name()

Returns the optional name of the file to scan.

setContext(context)

Sets the scan context for the file.

setFormat(format)

Sets the format to be used to scan the file.

setLocalName(locname)

Sets the name of the file to scan on disk.

setName(name)

Sets the optional name of the file to scan.

clear()None

Clears the instance.

See also isValid().

context()str
Returns

Returns the scan context for the file.

Return type

str

See also setContext() and CommonSystem.defaultScanContext().

format()str
Returns

Returns the format to be used to scan the file.

Return type

str

See also setFormat().

isValid()bool
Returns

Returns True if the file to scan is valid; otherwise returns False.

Return type

bool

See also clear().

localName()str
Returns

Returns the name of the file to scan on disk.

Return type

str

See also setLocalName() and name().

name()str
Returns

Returns the optional name of the file to scan.

Return type

str

See also setName() and localName().

setContext(context: str)None

Sets the scan context for the file.

Parameters

context (str) – The scan context.

See also context() and CommonSystem.setDefaultScanContext().

setFormat(format: str)None

Sets the format to be used to scan the file.

Parameters

format (str) – The file format.

See also format().

setLocalName(locname: str)None

Sets the name of the file to scan on disk.

Parameters

locname (str) – The name of the file on disk.

See also localName() and setName().

setName(name: str)None

Sets the optional name of the file to scan.

Parameters

name (str) – The optional name of the file.

See also name() and setLocalName().

class FormatItemInfo

The information about a format item returned by ScanProvider._formatViewInfo().

Attributes:

bg

The background color.

fid

The format item id.

icon

An integer which represents the public icon to be used for the item.

text

The text to be used as label for the item.

Methods:

clear()

Clears the fields of the class.

bg

The background color.

See also ntRgb().

clear()None

Clears the fields of the class.

fid

The format item id. This is the id provided when creating the FormatTree.

icon

An integer which represents the public icon to be used for the item. Public icons are defined in the Pro.UI module.

text

The text to be used as label for the item.

class FormatTree

Bases: Pro.Core.NTUIntTree

Tree of FormatTreeNode nodes.

class FormatTreeNode

Bases: Pro.Core.NTUIntTreeNode

This class represents a node of FormatTree.

class FormatTreeNodeList

Bases: Pro.Core.NTUIntTreeNodeList

List of FormatTreeNode elements.

class FormatTreeNodeListIt(obj: Pro.Core.FormatTreeNodeList)

Bases: Pro.Core.NTUIntTreeNodeListIt

Iterator class for FormatTreeNodeList.

Parameters

obj (FormatTreeNodeList) – The object to iterate over.

GB_SIZE: Final[int]

This constant defines the size of a gigabyte.

See also KB_SIZE, MB_SIZE and TB_SIZE.

IMPLICIT_OFLAG_UNKNOWN_FORMAT: Final[int]

Implicit object flag.

This flag is automatically set if no matching file format could be found for the scanned object or one of its embedded objects.

See also ScanProvider and EXPLICIT_OFLAGS_MASK.

INVALID_OFFSET: Final[int]

Invalid file or data offset.

The equivalent of INVALID_STREAM_OFFSET.

See also NTContainer and CFFObject.

INVALID_STREAM_OFFSET: Final[int]

Invalid file or data offset.

The equivalent of INVALID_OFFSET.

See also NTContainer and CFFObject.

KB_SIZE: Final[int]

This constant defines the size of a kilobyte.

See also MB_SIZE, GB_SIZE and TB_SIZE.

class KROffset

Match for a byte search in NTContainer.

See also NTContainer.find(), NTContainer.findFirst() and NTContainer.findMulti().

Attributes:

offset

The start offset of the matche sequence.

pattern

The index of the matched pattern.

offset

The start offset of the matche sequence. It’s INVALID_STREAM_OFFSET in case of no match.

pattern

The index of the matched pattern. This value applies only to NTContainer.findMulti().

class Layout

Layouts are used to create ranges and associate structures to hex views.

Layouts can be exported and imported as XML data.

Note

Structures referenced by layouts must be stored in SQLite-backed header files. In the future we plan to allow XML header data to be stored inside the layout itself.

In the following code example a simple layout is created for a 64-bit Elf file and is then associated to the current hex view:

from Pro.Core import *
from Pro.UI import *

def buildElfLayout(obj, l):
    # load the SQLite-backed header file
    hname = "elf"
    hdr = CFFHeader()
    if not hdr.LoadFromFile(hname):
        return
    # specify the packing options for the structures we add to the layout
    sopts = CFFSO_GCC | CFFSO_Pack1
    d = LayoutData()
    d.setTypeOptions(sopts)
    # add the Elf header to the layout
    ehdr = obj.MakeStruct(hdr, "_Elf64_Ehdr", 0, sopts)
    d.setColor(ntRgba(255, 0, 0, 70))
    d.setStruct(hname, "_Elf64_Ehdr")
    l.add(0, ehdr.Size(), d)
    # add the sections (we assume that e_shentsize is 0x40) to the layout
    e_shoff = ehdr.Num("e_shoff")
    e_shnum = ehdr.Num("e_shnum")
    esects = obj.MakeStructArray(hdr, "_Elf64_Shdr", e_shoff, e_shnum, sopts)
    d.setStruct(hname, "_Elf64_Shdr")
    d.setArraySize(e_shnum)
    l.add(e_shoff, esects.TotalSize(), d)

# get the current view
hv = proContext().getCurrentView()
# it must be a hew view
if hv.isValid() and hv.type() == ProView.Type_Hex:
    # get the container referenced by the hex view
    c = hv.getData()
    obj = CFFObject()
    obj.Load(c)
    # create a new layout named "ELF_ANALYSIS"
    lname = "ELF_ANALYSIS"
    l = proContext().getLayout(lname)
    # build the layout
    buildElfLayout(obj, l)
    # apply the layout to the current hex view
    hv.setLayoutName(lname)

See also LayoutInterval, LayoutData, LayoutPair and CFFHeader.

Methods:

add(interval_or_offset, data_or_size[, data])

Associates LayoutData to an interval.

at(i_or_interval_or_lp)

Retrieves the index of the layout entry if an interval or layout pair are specified; otherwise returns a layout pair if an index is specified.

clear()

Clears the current layout.

count()

Returns the number of layout entries.

fromXml(xstr)

Imports a layout from XML data.

getMatches(offset, size)

Retrieves a list of layout pairs which match exactly the specified interval.

getOverlappingWith(offset, size)

Retrieves a list of layout pairs which overlap with the specified interval.

isModified()

Returns True if the layout was modified; otherwise returns False.

isNull()

Returns True if the layout is invalid; otherwise returns False.

isValid()

Returns True if the layout is valid; otherwise returns False.

layoutName()

Returns the name of the layout.

remove(interval_or_offset[, size])

Removes layout entries matching a specified interval.

renameLayout(name)

Renames the layout.

saveIfModified()

Saves the layout to the current project if the layout was modified.

setModified(b)

Sets the modified status of the layout.

toXml()

Exports the layout to XML.

add(interval_or_offset: Union[Pro.Core.LayoutInterval, int], data_or_size: Union[Pro.Core.LayoutData, int], data: Optional[Pro.Core.LayoutData] = None)None

Associates LayoutData to an interval.

Parameters
  • interval_or_offset (Union[LayoutInterval, int]) – Either the interval or the start offset of the interval.

  • data_or_size (Union[LayoutData, int]) – Either the data to associate or the size of the interval.

  • data (Optional[LayoutData]) – The data to associate.

See also count(), remove() and at().

at(i_or_interval_or_lp: Union[Pro.Core.LayoutInterval, Pro.Core.LayoutPair, int])Union[Pro.Core.LayoutPair, int]

Retrieves the index of the layout entry if an interval or layout pair are specified; otherwise returns a layout pair if an index is specified.

Parameters

i_or_interval_or_lp (Union[LayoutInterval, LayoutPair, int]) – Either the index of the layout entry, the interval or the layout pair.

Returns

Returns the index of the layout entry if an interval or layout pair are specified and successful; otherwise returns 0. Alternatively, returns a layout pair if an index is specified and successful; otherwise returns an invalid layout pair.

Return type

Union[LayoutPair, int]

See also count(), add() and remove().

clear()None

Clears the current layout.

See also isValid() and fromXml().

count()int
Returns

Returns the number of layout entries.

Return type

int

See also add(), remove() and at().

fromXml(xstr: str)bool

Imports a layout from XML data.

Parameters

xstr (str) – The XML string.

Returns

Returns True if successful; otherwise returns False.

Return type

bool

See also toXml().

getMatches(offset: int, size: int)Pro.Core.LayoutPairList

Retrieves a list of layout pairs which match exactly the specified interval.

Parameters
  • offset (int) – The start offset of the interval.

  • size (int) – The size of the interval.

Returns

Returns a list of layout pairs.

Return type

LayoutPairList

See also getOverlappingWith().

getOverlappingWith(offset: int, size: int)Pro.Core.LayoutPairList

Retrieves a list of layout pairs which overlap with the specified interval.

Parameters
  • offset (int) – The start offset of the interval.

  • size (int) – The size of the interval.

Returns

Returns a list of layout pairs.

Return type

LayoutPairList

See also getMatches().

isModified()bool
Returns

Returns True if the layout was modified; otherwise returns False.

Return type

bool

See also setModified().

isNull()bool
Returns

Returns True if the layout is invalid; otherwise returns False.

Return type

bool

See also isValid().

isValid()bool
Returns

Returns True if the layout is valid; otherwise returns False.

Return type

bool

See also isNull().

layoutName()str
Returns

Returns the name of the layout.

Return type

str

See also renameLayout().

remove(interval_or_offset: Union[Pro.Core.LayoutInterval, int], size: Optional[int] = None)None

Removes layout entries matching a specified interval.

Parameters
  • interval_or_offset (Union[LayoutInterval, int]) – Either the interval or the start offset of the interval.

  • size (Optional[int]) – The size of the interval.

See also add(), at() and count().

renameLayout(name: str)bool

Renames the layout.

Parameters

name (str) – The new name of the layout.

Returns

Returns True if successful; otherwise returns False.

Return type

bool

See also layoutName().

saveIfModified()None

Saves the layout to the current project if the layout was modified.

See also isModified().

setModified(b: bool)None

Sets the modified status of the layout.

Parameters

b (bool) – If True, the layout is marked as modified.

See also isModified().

toXml()str

Exports the layout to XML.

Returns

Returns an XML string.

Return type

str

See also fromXml().

class LayoutData

This class contains the data of a layout entry.

See also Layout.

Methods:

arraySize()

Returns the size of the array of structures.

getColor()

Returns the background color of the netry.

getDescription()

Returns the description of the entry.

getHeader()

Returns the name of header which contains the referenced structure.

getType()

Returns the name of the associated structure.

setArraySize(n)

Sets the size of the array of structures.

setColor(rgba)

Sets the background color.

setDescription(description)

Sets the description of the entry.

setStruct(hdr, type)

Sets the associated structure.

setTypeOptions(opt)

Sets the options for the associated structure.

typeOptions()

Returuns the options for associated structure.

arraySize()int
Returns

Returns the size of the array of structures.

Return type

int

See also setArraySize().

getColor()int
Returns

Returns the background color of the netry.

Return type

int

See also setColor().

getDescription()str
Returns

Returns the description of the entry.

Return type

str

See also setDescription().

getHeader()str
Returns

Returns the name of header which contains the referenced structure.

Return type

str

See also setStruct().

getType()str
Returns

Returns the name of the associated structure.

Return type

str

See also setStruct().

setArraySize(n: int)None

Sets the size of the array of structures.

Parameters

n (int) – The size of the array.

See also arraySize().

setColor(rgba: int)None

Sets the background color.

Parameters

rgba (int) – The background color.

See also getColor().

setDescription(description: str)None

Sets the description of the entry.

Parameters

description (str) – The description of the entry.

See also getDescription().

setStruct(hdr: str, type: str)None

Sets the associated structure.

Parameters
  • hdr (str) – The name of the header file which contains the structure.

  • type (str) – The name of the structure.

See also getHeader() and getType().

setTypeOptions(opt: int)None

Sets the options for the associated structure.

Parameters

opt (int) – The options for the associated structure (e.g., CFFSO_Pack1).

See also typeOptions() and setStruct().

typeOptions()int
Returns

Returuns the options for associated structure.

Return type

int

See also setTypeOptions() and setStruct().

class LayoutInterval

This class represents a layout interval.

See also Layout.

Attributes:

end

The end offset of the interval.

start

The start offset of the interval.

end

The end offset of the interval.

start

The start offset of the interval.

class LayoutPair(t1: Optional[Pro.Core.LayoutInterval] = None, t2: Optional[Pro.Core.LayoutData] = None)

Pair of (LayoutInterval, LayoutData) elements.

Parameters
  • t1 (Optional[LayoutInterval]) – The first element of the pair.

  • t2 (Optional[LayoutData]) – The second element of the pair.

Methods:

first()

Returns the first element in the pair.

second()

Returns the second element in the pair.

setFirst(v)

Sets the first element in the pair.

setSecond(v)

Sets the second element in the pair.

first()Pro.Core.LayoutInterval
Returns

Returns the first element in the pair.

Return type

LayoutInterval

See also second() and setFirst().

second()Pro.Core.LayoutData
Returns

Returns the second element in the pair.

Return type

LayoutData

See also first() and setSecond().

setFirst(v: Pro.Core.LayoutInterval)None

Sets the first element in the pair.

Parameters

v (LayoutInterval) – The value of the element.

See also first() and setSecond().

setSecond(v: Pro.Core.LayoutData)None

Sets the second element in the pair.

Parameters

v (LayoutData) – The value of the element.

See also second() and setFirst().

class LayoutPairList

List of LayoutPair elements.

Methods:

append(value)

Inserts value at the end of the list.

at(i)

Returns the item at index position i in the list.

clear()

Removes all items from the list.

contains(value)

Checks the presence of an element in the list.

count(value)

Returns the number of occurrences of value in the list.

indexOf(value[, start])

Searches for an element in the list.

insert(i, value)

Inserts value at index position i in the list.

isEmpty()

Checks whether the list is empty.

iterator()

Creates an iterator for the list.

removeAll(value)

Removes all occurrences of value in the list and returns the number of entries removed.

removeAt(i)

Removes the item at index position i.

reserve(alloc)

Reserve space for alloc elements.

size()

Returns the number of items in the list.

takeAt(i)

Removes the item at index position i and returns it.

append(value: Pro.Core.LayoutPair)None

Inserts value at the end of the list.

Parameters

value (LayoutPair) – The value to add to the list.

See also insert().

at(i: int)Pro.Core.LayoutPair

Returns the item at index position i in the list. i must be a valid index position in the list (i.e., 0 <= i < size()).

Parameters

i (int) – The index of the element to return.

Returns

Returns the requested element.

Return type

LayoutPair

clear()None

Removes all items from the list.

contains(value: Pro.Core.LayoutPair)bool

Checks the presence of an element in the list.

Parameters

value (LayoutPair) – The value to check for.

Returns

Returns True if the list contains an occurrence of value; otherwise returns False.

Return type

bool

See also indexOf() and count().

count(value: Pro.Core.LayoutPair)int

Returns the number of occurrences of value in the list.

Parameters

value (LayoutPair) – The value to count.

Returns

Returns the number of occurrences.

Return type

int

See also indexOf() and contains().

indexOf(value: Pro.Core.LayoutPair, start: int = 0)int

Searches for an element in the list.

Parameters
  • value (LayoutPair) – The value to search for.

  • start (int) – The start index.

Returns

Returns the index position of the first occurrence of value in the list. Returns -1 if no item was found.

Return type

int

See also contains().

insert(i: int, value: Pro.Core.LayoutPair)None

Inserts value at index position i in the list. If i is 0, the value is prepended to the list. If i is size(), the value is appended to the list.

Parameters
  • i (int) – The position at which to add the value.

  • value (LayoutPair) – The value to add.

See also append() and removeAt().

isEmpty()bool

Checks whether the list is empty.

Returns

Returns True if the list contains no items; otherwise returns False.

Return type

bool

See also size().

iterator()Pro.Core.LayoutPairListIt

Creates an iterator for the list.

Returns

Returns the iterator.

Return type

LayoutPairListIt

removeAll(value: Pro.Core.LayoutPair)int

Removes all occurrences of value in the list and returns the number of entries removed.

Parameters

value (LayoutPair) – The value to remove from the list.

Returns

Returns the number of entries removed.

Return type

int

See also removeAt().

removeAt(i: int)None

Removes the item at index position i. i must be a valid index position in the list (i.e., 0 <= i < size()).

Parameters

i (int) – The index of the item to remove.

See also removeAll().

reserve(alloc: int)None

Reserve space for alloc elements. Calling this method doesn’t change the size of the list.

Parameters

alloc (int) – The amount of elements to reserve space for.

size()int
Returns

Returns the number of items in the list.

Return type

int

See also isEmpty().

takeAt(i: int)Pro.Core.LayoutPair

Removes the item at index position i and returns it. i must be a valid index position in the list (i.e., 0 <= i < size()).

Parameters

i (int) – The index of the element to remove from the list.

Returns

Returns the removed element. If you don’t use the return value, removeAt() is more efficient.

Return type

LayoutPair

See also removeAt().

class LayoutPairListIt(obj: Pro.Core.LayoutPairList)

Iterator class for LayoutPairList.

Parameters

obj (LayoutPairList) – The object to iterate over.

Methods:

hasNext()

Returns True if there is at least one item ahead of the iterator, i.e. the iterator is not at the back of the container; otherwise returns False.

hasPrevious()

Returns True if there is at least one item behind the iterator, i.e. the iterator is not at the front of the container; otherwise returns False.

next()

Returns the next item and advances the iterator by one position.

previous()

Returns the previous item and moves the iterator back by one position.

toBack()

Moves the iterator to the back of the container (after the last item).

toFront()

Moves the iterator to the front of the container (before the first item).

hasNext()bool
Returns

Returns True if there is at least one item ahead of the iterator, i.e. the iterator is not at the back of the container; otherwise returns False.

Return type

bool

See also hasPrevious() and next().

hasPrevious()bool
Returns

Returns True if there is at least one item behind the iterator, i.e. the iterator is not at the front of the container; otherwise returns False.

Return type

bool

See also hasNext() and previous().

next()Pro.Core.LayoutPair
Returns

Returns the next item and advances the iterator by one position.

Return type

LayoutPair

See also hasNext() and previous().

previous()Pro.Core.LayoutPair
Returns

Returns the previous item and moves the iterator back by one position.

Return type

LayoutPair

See also hasPrevious() and next().

toBack()None

Moves the iterator to the back of the container (after the last item).

See also toFront() and previous().

toFront()None

Moves the iterator to the front of the container (before the first item).

See also toBack() and next().

class LocalSystem

Bases: Pro.Core.CommonSystem

CommonSystem derived class used to perform local file system scans.

See also CommonSystem and ProCoreContext.getSystem().

MB_SIZE: Final[int]

This constant defines the size of a megabyte.

See also KB_SIZE, GB_SIZE and TB_SIZE.

METAFLAG_STRING: Final[int]

Specifies the string nature of the meta-data.

See also ScanMetaDataEntry.flags and ScanProvider.addMetaDataString().

MethodNameFromSimpleSignature(signature: str)str

Extracts the function or method name from a simple signature. A simple method signature doesn’t include a return type or other specifiers before the method name.

When working with mangled symbols, the simple signature must first be obtained by calling DemangleSymbolName() with DSNF_SimpleSignature.

Parameters

signature (str) – The simple signature.

Returns

Returns the method name.

Return type

str

See also DemangleSymbolName().

NATURE_BYTEARRAY: Final[int]

Byte-array type nature.

See also CFFObject.GetTypeNature().

NATURE_NUMBER: Final[int]

Integer number type nature.

See also CFFObject.GetTypeNature().

NATURE_REAL: Final[int]

Real number type nature.

See also CFFObject.GetTypeNature().

NATURE_STRING: Final[int]

String type nature.

See also CFFObject.GetTypeNature().

NATURE_UNKNOWN: Final[int]

Unknown type nature.

See also CFFObject.GetTypeNature().

class NTAddressSpace

This class is used to apply address spaces to containers.

See also NTContainer.addAddressSpace(), createAddressSpace() and createSparseAddressSpace().

Methods:

addSparseRange(address, size[, offset, flags])

Adds a sparse range to the address space.

addressRange()

Returns the start and end address of the address space.

cacheEnabled()

Returns True if address translation caching is enabled; otherwise returns False.

flags()

Returns the flags for the address space (e.g., NT_ASF_IgnoreInvalidPages).

getPageFlagsLabels(pflags[, all])

Converts page flags into a list of strings.

isNull()

Returns True if the address space is invalid; otherwise returns False.

pageFlags(c, address)

Returns the page flags for the specified address.

pageSize()

Returns the page size of the address space.

setCacheEnabled(b)

Sets the status of address translation caching.

setFlags(f)

Sets the flags for the address space.

size()

Returns the size of the address space.

stdPageFlags(c, address)

Returns standard page flags such as NT_ASPSF_EXECUTE for a specified address.

toAddress(c, offset)

Converts an offset to an address.

toOffset(c, address)

Converts an address to an offset.

toStdPageFlags(pflags)

Converts address specific page flags retrieved by calling pageFlags() into standard page flags (e.g., NT_ASPSF_EXECUTE).

addSparseRange(address: int, size: int, offset: int = INVALID_STREAM_OFFSET, flags: int = - 1)None

Adds a sparse range to the address space.

Parameters
  • address (int) – The address of the range.

  • size (int) – The size of the range.

  • offset (int) – The offset at which to map the address.

  • flags (int) – Optional page flags for the range (e.g., NT_ASPSF_EXECUTE).

See also createSparseAddressSpace().

addressRange()tuple
Returns

Returns the start and end address of the address space.

Return type

tuple[int, int]

See also size().

cacheEnabled()bool
Returns

Returns True if address translation caching is enabled; otherwise returns False.

Return type

bool

See also setCacheEnabled().

flags()int
Returns

Returns the flags for the address space (e.g., NT_ASF_IgnoreInvalidPages).

Return type

int

See also setFlags().

getPageFlagsLabels(pflags: int, all: bool = False)Pro.Core.NTStringList

Converts page flags into a list of strings.

Parameters
  • pflags (int) – The page flags.

  • all (bool) – If True, includes every known flag.

Returns

Returns a list of flag labels.

Return type

NTStringList

See also pageFlags().

isNull()bool
Returns

Returns True if the address space is invalid; otherwise returns False.

Return type

bool

pageFlags(c: Pro.Core.NTContainer, address: int)tuple

Returns the page flags for the specified address.

The returned flags can be platform specific and may not be standard page flags such as NT_ASPSF_EXECUTE. To convert the returned flags into standard page flags, use toStdPageFlags(). Alternatively, stdPageFlags() can be called instead of this method to retrieve standard page flags for a specified address.

Parameters
  • c (NTContainer) – The source container.

  • address (int) – The address for which to retrieve the page flags.

Returns

Returns the result of the operation (possible values are NT_ASR_UNSUPPORTED, NT_ASR_INVALID and NT_ASR_OK) and the page flags if the first value is NT_ASR_OK.

Return type

tuple[int, int]

See also getPageFlagsLabels(), toStdPageFlags() and stdPageFlags().

pageSize()int
Returns

Returns the page size of the address space.

Return type

int

setCacheEnabled(b: bool)None

Sets the status of address translation caching.

Caching is automatically enabled for address spaces with a page size which is equal or greater than 1 KB.

Parameters

b (bool) – If True, enables address translation caching.

See also cacheEnabled().

setFlags(f: int)None

Sets the flags for the address space.

Parameters

f (int) – The flags to set (e.g., NT_ASF_IgnoreInvalidPages).

See also flags().

size()int
Returns

Returns the size of the address space.

Return type

int

See also addressRange().

stdPageFlags(c: Pro.Core.NTContainer, address: int)tuple

Returns standard page flags such as NT_ASPSF_EXECUTE for a specified address.

Parameters
  • c (NTContainer) – The source container.

  • address (int) – The address for which to retrieve the standard page flags.

Returns

Returns the result of the operation (possible values are NT_ASR_UNSUPPORTED, NT_ASR_INVALID and NT_ASR_OK) and the standard page flags if the first value is NT_ASR_OK.

Return type

tuple[int, int]

See also pageFlags() and toStdPageFlags().

toAddress(c: Pro.Core.NTContainer, offset: int)int

Converts an offset to an address.

Note

Not all address spaces support this functionality.

Parameters
  • c (NTContainer) – The source container.

  • offset (int) – The offset to convert.

Returns

Returns the address if successful; otherwise returns INVALID_STREAM_OFFSET.

Return type

int

See also toOffset().

toOffset(c: Pro.Core.NTContainer, address: int)int

Converts an address to an offset.

Parameters
  • c (NTContainer) – The source container.

  • address (int) – The address to convert.

Returns

Returns the offset if successful; otherwise returns INVALID_STREAM_OFFSET.

Return type

int

See also toAddress().

toStdPageFlags(pflags: int)int

Converts address specific page flags retrieved by calling pageFlags() into standard page flags (e.g., NT_ASPSF_EXECUTE).

Parameters

pflags (int) – The page flags to convert.

Returns

Returns the standard page flags.

Return type

int

See also pageFlags() and stdPageFlags().

class NTBuffer

Base class for buffered read operations.

This class will throw an IndexError exception on error.

See also