Pro.Core — Core API for parsing and scanning files

Overview

The Pro.Core module contains the core API for parsing and scanning files.

Core Concepts

Some of the most important classes are:

  • NTContainer - This is a generic container used to encapsulate data such as files and memory. It’s an extremely important class and it’s used extensively. Containers can be created through SDK functions such as createContainerFromFile() and newContainer().

  • NTBuffer/NTContainerBuffer/CFFBuffer/etc. - These type of classes are used to efficiently read iteratively small amounts of data from a source. NTBuffer is the base class and derived classes are named after the object they read from. E.g.: NTContainerBuffer reads from NTContainer and CFFBuffer reads from CFFObject.

  • NTTextStream/NTTextBuffer/NTTextStringBuffer - These classes are used to output text. The amount of indentation can be specified. NTTextStream is the base class and derived classes are named after the output type: NTTextBuffer outputs to a utf-8 array and NTTextStringBuffer to a utf-16 array.

  • NTXml - Used to parse XML. This class is fast and secure. The code is based on RapidXML.

  • CFFObject - The class from which every format class is derived (ZipObject, PEObject, etc.). While NTContainer provides basic parsing facilities, more complex types and the use of CFFStruct rely upon CFFObject.

  • CFFHeader - Headers contain definition of structures and can be loaded from SQLite files or XML strings. The structures can be imported from C/C++ code through the Header Manager or from debug symbols such as PDB files.

  • CFFStruct - This class represents a data structure.

  • CFFFlags - This class represents the flags of a field in a CFFStruct.

Hint

If you’re wondering why the case convention for methods is not always the same, the reason is simple. Classes such as CFFObject and CFFStruct are based on older code which followed the pascal-case convention. Consequently all derived classes like PEObject follow this convention. All other classes use the camel-case convention.

Basic types like integers and strings are automatically converted between C++ and Python. However, lists are preserved for efficiency reasons. Whenever the signature of a method contains a list or another type of container class, you must work with the C++ class. For example, the following example creates a list of C++ integers and iterates through it:

from Pro.Core import *

l = NTIntList()
for i in range(10):
    l.append(i)
it = NTIntListIt(l)
while it.hasNext():
    print(it.next())

Lists, vectors, hashes and sets all have specialized C++ classes usually relying on Qt containers. These type of classes are easily recognized due to the naming convention.

Note

While in C++ these classes are implemented as template classes, in Python they are exposed as different types. However, NTIntList will have exactly the same methods as NTStringList.

Parsing Files

Printing out a structure in a file can be as simple as:

from Pro.Core import *
from Pro.PE import *

def printDOSHeader(fname):
    c = createContainerFromFile(fname)
    if c.isNull():
        return
    pe = PEObject()
    if not pe.Load(c):
        return
    out = NTTextBuffer()
    pe.DosHeader().Dump(out) # CFFStruct.Dump
    print(out.buffer)

Warning

Avoid initializing NTContainer and CFFObject objects globally in order to avoid memory leaks!

If you really need to use a global object, make sure to set it to None when it is no longer needed. This way, the garbage collector will release the allocated memory.

NTContainer is a powerful abstraction for reading from a target. The target can be a memory buffer, a file or even the memory of a remote process. When NTContainer objects are returned by calling functions like createContainerFromFile() or newContainer(), they may either encapsulate a file or a memory buffer. Whether to use a file or a memory buffer is internally decided upon the basis of current memory resources.

If you want to make sure that an NTContainer instance encapsulates a memory buffer you can do it by specifically setting its internal object:

from Pro.Core import *

c = NTContainer()
# set a byte array as the internal object of NTContainer
c.setData(b"")
# NTContainer are never resizeable by default
c.setResizable(True)
# append some data
c.append(b"foo")
# print out the size of 3
print(c.size())

Ranges and address spaces can also be applied to NTContainer. Consider the following example:

from Pro.Core import *

c = NTContainer()
c.setData(b"Hello, world!")
# increase the reference count of c
c2 = c.clone()
# set a new range for c2
c2.setRange(7, 5)
# prints out "Hello, world!"
print(c.read(0, c.size()).decode("utf-8"))
# prints out "world"
print(c2.read(0, c2.size()).decode("utf-8"))

The c2 instance refers to the same object as c but with a different range. This is very useful when working with embedded objects. For instance, parsing a resource inside of a binary file might only require setting the range on an instance NTContainer of the parent binary file, before being passed onto CFFObject.Load().

It is not necessary to subclass CFFObject in order parse a file. We can use CFFObject directly:

from Pro.Core import *

xml_header = """<header>

<r id='_IMAGE_DOS_HEADER' type='struct'>
  <f id='e_magic' type='unsigned short'/>
  <f id='e_cblp' type='unsigned short'/>
  <f id='e_cp' type='unsigned short'/>
  <f id='e_crlc' type='unsigned short'/>
  <f id='e_cparhdr' type='unsigned short'/>
  <f id='e_minalloc' type='unsigned short'/>
  <f id='e_maxalloc' type='unsigned short'/>
  <f id='e_ss' type='unsigned short'/>
  <f id='e_sp' type='unsigned short'/>
  <f id='e_csum' type='unsigned short'/>
  <f id='e_ip' type='unsigned short'/>
  <f id='e_cs' type='unsigned short'/>
  <f id='e_lfarlc' type='unsigned short'/>
  <f id='e_ovno' type='unsigned short'/>
  <f id='e_res' type='unsigned short [4]'/>
  <f id='e_oemid' type='unsigned short'/>
  <f id='e_oeminfo' type='unsigned short'/>
  <f id='e_res2' type='unsigned short [10]'/>
  <f id='e_lfanew' type='int'/>
</r>

</header>"""

def printStructure(fname):
    c = createContainerFromFile(fname)
    if c.isNull():
        return
    # load header from an XML string
    header = CFFHeader()
    if not header.LoadFromXml(xml_header):
        return
    obj = CFFObject()
    # since CFFObject is not subclassed, the Load method cannot fail
    obj.Load(c)
    # map a structure to a specific offset
    offset = 0
    s = obj.MakeStruct(header, "_IMAGE_DOS_HEADER", offset, CFFSO_VC | CFFSO_Pack1)
    out = NTTextBuffer()
    s.Dump(out)
    print(out.buffer)

To read in a buffered way from a target object, be it CFFObject or NTContainer, you can use NTBuffer derived classes such as NTContainerBuffer and CFFBuffer:

from Pro.Core import *

def bufferedRead(fname):
    c = createContainerFromFile(fname)
    if c.isNull():
        return
    obj = CFFObject()
    obj.Load(c)
    offset = 0
    r = obj.ToBuffer(offset)
    try:
        # read a single byte from the file
        b = r.u8()
    except IndexError:
        print("error: out of range")

By default buffered readers default to Bufferize_Forwards. If you want to read backwards or back and forth you can specify Bufferize_Backwards or Bufferize_BackAndForth respectively.

The default endianness can be specified both for CFFObject and NTBuffer instances. If not specified, endianness will default to ENDIANNESS_LITTLE.

If need to parse an XML string, you can use our NTXml class, which is both fast and secure.

from Pro.Core import *

x = NTXml()
ret = x.parse("<r><e t='test'></e></r>")
if ret == NTXml_ErrNone:
    n = x.findChild(None, "r")
    if n != None:
        n = x.findChild(n, "e")
        if n != None:
            a = x.findAttribute(n, "t")
            if a != None:
                print(x.value(a))

All the filters which are available in the UI can be used programmatically from the SDK.

from Pro.Core import *

c = NTContainer()
c.setData(b"Hello, world!")
# compress data with zlib
fstr = "<flts><f name='pack/zlib' level='9' raw='true'/></flts>"
# set the last parameter to False to hide the wait-box
c = applyFilters(c, fstr, True)
# print out the compressed data
print(c.read(0, c.size()))

By using filters it’s possible to perform complex data operations with just a few lines of code. In the code snippet above we use a filter to compress the input data using zlib.

Scanning Files

In this section we offer an introduction into the internals of our scan engine.

The core classes are:

  • Report - This class represents a project. A project can be unpacked or packed. When it’s unpacked, it consists of a directory containing a number of DBs and other files. When it’s packed, the same files are merged into a single file and may be compressed and/or encrypted. Fundamentally, in the context of file scanning, a project contains a SQLite3 database which, in turn, contains XML reports for each scanned file. The current instance of this class is returned by ProCoreContext.getReport().

  • ScanProvider - This is the base class inherited by all the scan engines for the different file formats.

  • ScanEntryData - This is the class that contains the data passed to ScanProvider.addEntry(). Every time a scan provider for a file format encounters a threat, warning, information, privacy issue or embedded file, it calls ScanProvider.addEntry().

  • FormatTree - A tree of uint32 ids that describe the layout structure of the analyzed file. This is the layout shown in the format view in the analysis workspace.

  • FormatItemInfo - The information returned for each individual item in the format tree. ScanProvider._formatViewInfo() returns this information based on the id provided when constructing the FormatTree.

  • ScanViewData - This class is returned by ScanProvider._scanViewData() and ScanProvider._formatViewData(). It may represent raw data, in case of an embedded file, as well as a complex UI.

  • CommonSystem - Logic providers return classes derived from this class to define a scanning behaviour. For instance, when creating a logic provider which analyzes only a specific set of files in a directory or on a file system, the derived class LocalSystem can be used.

  • ProCoreContext - Provides context information like the current scan provider (ProCoreContext.currentScanProvider()) or the current report (ProCoreContext.getReport()). The global instance of this class is returned by proCoreContext().

As mentioned, for every scanned file an XML report is generated. Below is the commented schema of these XML reports.

<!-- XML schema

note: attributes are marked by parenthesis

o = object
 (t = type
  u = current entry unique id (in hex)
  s = target (base64)
  r = risk
  f = flags)

s = scan entries
  t = threat
  w = warning
  i = info
   (t = type
    u = unique identifier for the entry (in hex)
    f = flags (optional)
    s = target (optional, for embedded files)(base64)
    l = object format (for embedded files)
    )
   (- ic = indirect category
      it = indirect type
    - fi = format item id
    ii = internal file uid
    v  = view
    of = offset
    sz = size)
    d = data (mandatory)
  extra:
    t = text
    flts = filters
      f = filter
        (name + params)
    s = shellcode
      (a = arch
       b = base address
       )

e = embedded objects
  o = object (see above)

h = hashes
  md5 = md5 hash
  etc.

m = metadata
 (ct = creation time
  mt = modification time
  at = access time
  )
  e = entry (content is base64 encoded)
   (id = name identifying the entry (raw)
    l = label (base64)
    f = flags (1 for text to show in report)
    )

<!-- sample -->
<o t="pe" s="C:/file" r="100">

  <!-- scan entries -->
  <s>

    <!-- threat entry -->
    <t t="5" u="0">

      <!-- custom data for the current entry, this is handled by
           the specific scan provider -->
      <d>
        <start>0</start>
        <size>1000</size>
      </d>

      <!-- human readable text (for showing advanced infos)
           encoded in utf8->base64 -->
      <t></t>

      <!-- filters applied on the retrieved data -->
      <flts>
        <f n="aes" p="cbc;256" k="11223344.." />
        <f n="z" />
      </flts>

    </t>

  </s>

  <!-- what follows is a list of embedded objects
       in the same order of the embedded file entries -->
  <e>
    <o t="pdf" r="70">
      <!-- ... -->
    </o>
  </e>

  <!-- various hashes (if any) stored for the current object -->
  <h>
   <md5>00000000000000..</md5>
   <sha1>000000000000...</sha1>
  </h>

  <!-- metadata (if any) -->
  <m ct="hex" wt="hex" at="hex">
    <e>base64</e>
    <e f=1>base64</e> <!-- will be shown as text in the report view -->
  </m>


</o>

The important part to understand when working with the SDK is the custom data mentioned in the schema (the <d> node). This is the custom XML data which is provided by the ScanProvider during the scanning process via ScanProvider.addEntry() and is then passed back to ScanProvider._scanViewData() when requesting data relative to a scan entry.

The data returned from a scan entry can be everything: from a simple description of a threat to an embedded file. In fact, ScanProvider._scanViewData() can return even complex UIs or native code disassembled by our Carbon engine.

Module API

Pro.Core module API.

Attributes:

Bufferize_BackAndForth

Buffering method for NTBuffer.

Bufferize_Backwards

Buffering method for NTBuffer.

Bufferize_Forwards

Buffering method for NTBuffer.

Bufferize_Invalid

Buffering method for NTBuffer.

CFFDBIndexSize32

32-bit index size for CFFDB.

CFFDBIndexSize64

64-bit index size for CFFDB.

CFFDBInvalidIndex

Invalid index for CFFDB.

CFFDBRootIndex

Root index for CFFDB.

CFFKST_Raw

Key sub-type raw.

CFFKST_String

Key sub-type string.

CFFKST_UTF8

Key sub-type utf-8.

CFFKT_Cert

Key type certificate.

CFFKT_Invalid

Key type invalid.

CFFKT_Pass

Key type password.

CFFN_Base

Base value for standard CFFObject notifications.

CFFN_Malformed

CFFObject notification for malformed data.

CFFN_MoreFiles

CFFObject notification for the file limit.

CFFN_NoDecrypt

CFFObject notification for failed decryption.

CFFN_NoUnpack

CFFObject notification for failed decompression.

CFFN_ParsingLimit

CFFObject notification for an internal parsing limit.

CFFN_Recursive

CFFObject notification for recursion.

CFFN_UnpackLimit

CFFObject notification for the decompression limit.

CFFN_UnpackNestLimit

CFFObject notification for the decompression nesting limit.

CFFPtrMaxSize

The maximum supported pointer size.

CFFPtrMinSize

The minimum supported pointer size.

CFFPtrSize16

16-bit pointer size.

CFFPtrSize32

32-bit pointer size.

CFFPtrSize64

64-bit pointer size.

CFFRange_Custom

Range value.

CFFRange_Last

Last range value plus one.

CFFRange_Unknown

Range value (alias of CFFRange_Unreferenced).

CFFRange_Unreferenced

Range value.

CFFRange_Unused

Range value.

CFFRange_Used

Range value.

CFFSO_Clang

This flag specifies that the structure was generated by the Clang compiler.

CFFSO_CompilerMask

Compiler mask for the flags of the structure.

CFFSO_EndianBig

This flag specifies that the structure is big-endian.

CFFSO_EndianDefault

This flag specifies that the structure uses the default endianness.

CFFSO_EndianLittle

This flag specifies that the structure is little-endian.

CFFSO_EndiannessBig

This flag specifies that the structure is big-endian.

CFFSO_EndiannessDefault

This flag specifies that the structure uses the default endianness.

CFFSO_EndiannessLittle

This flag specifies that the structure is little-endian.

CFFSO_EndiannessMask

Endianness mask for the flags of the structure.

CFFSO_GCC

This flag specifies that the structure was generated by the GCC compiler.

CFFSO_NoCompiler

This flag specifies that the structure wasn’t generated by a specific compiler.

CFFSO_NoPlatform

This flag specifies that the structure isn’t bound to specific platform.

CFFSO_Pack1

This flag specifies that the structure has an alignment of 1.

CFFSO_Pack16

This flag specifies that the structure has an alignment of 16.

CFFSO_Pack2

This flag specifies that the structure has an alignment of 2.

CFFSO_Pack4

This flag specifies that the structure has an alignment of 4.

CFFSO_Pack8

This flag specifies that the structure has an alignment of 8.

CFFSO_PackMask

Alignment mask for the flags of the structure.

CFFSO_PackNone

This flag specifies that the structure doesn’t have an alignment.

CFFSO_PlatformMask

Platform mask for the flags of the structure.

CFFSO_Pointer16

This flag specifies that the pointer size of the structure is 16-bits.

CFFSO_Pointer32

This flag specifies that the pointer size of the structure is 32-bits.

CFFSO_Pointer64

This flag specifies that the pointer size of the structure is 64-bits.

CFFSO_PointerDefault

This flag specifies that the pointer size of the structure is the default one for the object.

CFFSO_PointerMask

Pointer mask for the flags of the structure.

CFFSO_VC

This flag specifies that the structure was generated by the Visual C++ compiler.

CFFSO_Windows

This flag specifies that the structure was generated for the Windows platform.

CFF_ARRAY_NULL_TERMINATED

If specified, makes an array of structure be null-terminated.

CT_ActionScript2

Scan entry type for ActionScript2.

CT_ActionScript3

Scan entry type for ActionScript3.

CT_AppLaunch

Scan entry type for application launches.

CT_AttackSurface

Scan entry type for attack surfaces.

CT_BinaryData

Scan entry type for binary data.

CT_Blacklisted

Scan entry type for a blacklisted item.

CT_ByteCode

Scan entry type for byte-code.

CT_DalvikByteCode

Scan entry type for Dalvik byte-code.

CT_DataEntriesEnd

Scan entry type for data entries end.

CT_DataEntriesStart

Scan entry type for data entries start.

CT_DebugData

Scan entry type for debug data.

CT_DecompressionBomb

Scan entry type for decompression bombs.

CT_EmbeddedFile

Scan entry type for embedded objects.

CT_EntryLimit

Scan entry type for entry limits.

CT_ForeignData

Scan entry type for foreign data.

CT_FreePages

Scan entry type for free pages.

CT_Geolocation

Scan entry type for geo-locations.

CT_HiddenSheets

Scan entry type for hidden sheets.

CT_Intelligence

Scan entry type for an intelligence report.

CT_InteractiveForm

Scan entry type for interactive forms.

CT_InvalidCertificate

Scan entry type for invalid certificates.

CT_JavaByteCode

Scan entry type for Java byte-code.

CT_JavaScript

Scan entry type for JavaScript.

CT_MSILByteCode

Scan entry type for MSIL byte-code.

CT_Malformed

Scan entry type for malformed data.

CT_MalformedDocument

Scan entry type for malformed documents.

CT_MetaData

Scan entry type for meta-data.

CT_MetaDataUnknown

Scan entry type for unknown meta-data.

CT_NativeCode

Scan entry type for native code.

CT_NoDecompress

Scan entry type for failed decompression.

CT_NoDecrypt

Scan entry type for failed decryption.

CT_OKDecompressed

Scan entry type for successful decompression.

CT_OKDecrypted

Scan entry type for successful decryption.

CT_PersonalData

Scan entry type for personal data.

CT_Privileges

Scan entry type for required privileges.

CT_Recursive

Scan entry type for recursion.

CT_Report

Scan entry type for a report.

CT_Resources

Scan entry type for issues in resources.

CT_Script

Scan entry type for scripts.

CT_ShellCode

Scan entry type for shellcode.

CT_SignatureMatch

Scan entry type for signature matches.

CT_SpreadsheetFormulas

Scan entry type for spreadsheet formulas.

CT_SymbolicLink

Scan entry type for symbolic links.

CT_Thumbnail

Scan entry type for thumbnails.

CT_TrueType

Scan entry type for TrueType fonts.

CT_TrustedCertificate

Scan entry type for trusted certificates.

CT_Type1

Scan entry type for Type1 fonts.

CT_Type2

Scan entry type for Type2 fonts.

CT_UnaccountedSpace

Scan entry type for unaccounted space.

CT_UnknownFont

Scan entry type for unknown fonts.

CT_UnpackLimit

Scan entry type for the decompression limit.

CT_UnpackNestLimit

Scan entry type for the decompression nesting limit.

CT_UnreferencedData

Scan entry type for unreferenced data.

CT_UntrustedCertificate

Scan entry type for untrusted certificates.

CT_UnverifiedCertificate

Scan entry type for unverified certificates.

CT_VBAScript

Scan entry type for VBA code.

CT_VBSScript

Scan entry type for VBS scripts.

CT_VersionInfo

Scan entry type for version information.

CT_Whitelisted

Scan entry type for a whitelisted item.

CT_WrongCheckSum

Scan entry type for invalid checksums.

CT_WrongDigest

Scan entry type for invalid digests.

CT_WrongHash

Scan entry type for invalid hashes.

DSNF_NoAccessSpecifier

Doesn’t include the member type (i.e.: public, protected, private) in the unmangled symbol.

DSNF_NoCallingConvention

Doesn’t include the calling convention in the unmangled symbol.

DSNF_NoMemberType

Doesn’t include the member type (i.e.: static, virtual, extern) in the unmangled symbol.

DSNF_NoReturnType

Doesn’t include the return type in the unmangled symbol.

DSNF_SimpleSignature

Returns a simplified signature of the unmangled symbol.

DisasmOpt_FileOffsets

Shows offsets in disassemblies shown in the text view.

DisasmOpt_Opcodes

Shows opcodes in disassemblies shown in the text view.

ENDIANNESS_BIG

Big-endian option.

ENDIANNESS_LITTLE

Little-endian option.

EXPLICIT_OFLAGS_MASK

The mask for explicit object flags.

GB_SIZE

This constant defines the size of a gigabyte.

IMPLICIT_OFLAG_UNKNOWN_FORMAT

Implicit object flag.

INVALID_OFFSET

Invalid file or data offset.

INVALID_STREAM_OFFSET

Invalid file or data offset.

KB_SIZE

This constant defines the size of a kilobyte.

MB_SIZE

This constant defines the size of a megabyte.

METAFLAG_STRING

Specifies the string nature of the meta-data.

NATURE_BYTEARRAY

Byte-array type nature.

NATURE_NUMBER

Integer number type nature.

NATURE_REAL

Real number type nature.

NATURE_STRING

String type nature.

NATURE_UNKNOWN

Unknown type nature.

NTDefaultLocaleLongDate

The long date format used by the application’s locale.

NTDefaultLocaleShortDate

The short date format specified by the application’s locale.

NTFileOpt_CreateNew

Creates the file only if it doesn’t already exist.

NTFileOpt_ReadOnly

Read-only file access.

NTFileOpt_ShareWrite

Shared write file access.

NTFileOpt_Write

Read/write file access.

NTFlagOutput_IgnoreUnknown

Ignores unknown flags and options.

NTFriday

Fifth day of the week.

NTISODate

ISO 8601 extended date format: either yyyy-MM-dd for dates or yyyy-MM-ddTHH:mm:ss (e.g.

NTLocalTime

Local time, controlled by a system time-zone setting.

NTMonday

First day of the week.

NTOffsetFromUTC

An offset in seconds from Coordinated Universal Time.

NTProcessMemoryAccess_Execute

Executable memory flag.

NTProcessMemoryAccess_Guard

Guarded memory flag.

NTProcessMemoryAccess_Read

Readable memory flag.

NTProcessMemoryAccess_UserMode

User-mode memory flag.

NTProcessMemoryAccess_Write

Writable memory flag.

NTProcessMemoryState_Commit

Committed memory state.

NTProcessMemoryState_Free

Freed memory state.

NTProcessMemoryState_Reserve

Reserved memory state.

NTProcessMemoryType_Image

Image memory type.

NTProcessMemoryType_Mapped

Mapped memory type.

NTProcessMemoryType_Private

Private memory type.

NTRFC2822Date

RFC 2822, RFC 850 and RFC 1036 date format.

NTSaturday

Sixth day of the week.

NTSunday

Seventh day of the week.

NTSystemLocaleLongDate

The long date format used by the operating system.

NTSystemLocaleShortDate

The short date format used by the operating system.

NTTextDate

Date format equivalent to using the date format string "ddd MMM d yyyy".

NTThursday

Fourth day of the week.

NTTimeZone

A named time zone.

NTTuesday

Second day of the week.

NTUTC

Coordinated Universal Time.

NTWednesday

Third day of the week.

NTXml_ErrAlloc

Returned if an allocation error occurred.

NTXml_ErrNone

Returned if no error occurred.

NTXml_ErrParse

Returned if a parse error occurred.

NTXml_ErrUnknown

Returned if an unknown error occurred.

NTXml_FaultTolerant

Parses malformed XML data.

NTXml_IgnoreNS

Ignores XML node namespaces.

NTXml_InvalidFlags

Returned if invalid flags were specified.

NTXml_InvalidNode

Returned if an invalid node was specified.

NTXml_InvalidType

Returned if an invalid type was specified.

NT_ASF_BlockIO

Address space flag for block I/O.

NT_ASF_IgnoreInvalidPages

Address space flag to ignore invalid pages.

NT_ASF_IsSparse

Address space flag for sparse address spaces.

NT_ASF_Memory

Address space flag for process memory.

NT_ASPSF_ALL

Address space standard flag which combines all supported flags.

NT_ASPSF_DIRTY

Address space standard flag for dirty pages.

NT_ASPSF_EXECUTE

Address space standard flag for executable pages.

NT_ASPSF_GUARD

Address space standard flag for guarded pages.

NT_ASPSF_PRESENCE

Address space standard flag for readable/present pages.

NT_ASPSF_TRANSITION

Address space standard flag for transitional pages.

NT_ASPSF_USER_MODE

Address space standard flag for user mode pages.

NT_ASPSF_WRITE

Address space standard flag for writable pages.

NT_ASR_INVALID

Address space result for unsuccessful operations.

NT_ASR_OK

Address space result for successful operations.

NT_ASR_UNSUPPORTED

Address space result for unsupported operations.

NT_FileAttr_Compressed

File attribute flag.

NT_FileAttr_Encrypted

File attribute flag.

NT_FileAttr_Hidden

File attribute flag.

NT_FileAttr_ReadOnly

File attribute flag.

NT_FileAttr_System

File attribute flag.

NT_FileAttr_Temporary

File attribute flag.

NT_FileExt_Dll

Applies a shared library extension to the file name (e.g.: ".dll" on Windows and ".dylib" on macOS).

NT_FileExt_Exe

Applies a binary extension to the file name (i.e., ".exe" on Windows).

NT_FileExt_Link

Applies a link extension to the file name (i.e., ".lnk" on Windows).

NT_Folder_App

Retrieves the application directory.

NT_Folder_AppData

Retrieves the AppData directory on Windows.

NT_Folder_AppExe

Retrieves the application directory.

NT_Folder_AppMenu

Retrieves the AppMenu directory on Windows.

NT_Folder_Applications

Retrieves the applications directory on Windows.

NT_Folder_Applications_x86

Retrieves the x86 applications directory on Windows.

NT_Folder_Common_AppMenu

Retrieves the shared AppMenu directory on Windows.

NT_Folder_Common_Desktop

Retrieves the shared desktop directory on Windows.

NT_Folder_Current

Retrieves the current working directory.

NT_Folder_Desktop

Retrieves the desktop directory.

NT_Folder_Documents

Retrieves the documents directory.

NT_Folder_Home

Retrieves the home directory.

NT_Folder_Root

Retrieves the root directory (i.e., "/" on Linux/macOS and "C:/" on Windows).

NT_Folder_SystemTemp

Retrieves the default system temporary directory.

NT_Folder_Temp

Retrieves the temporary directory.

NT_MEMORY_REGIONS_MAX_ADDR

Maximum memory address for memory regions.

NT_ProcessAccess_All

All process access privileges.

NT_ProcessAccess_Read

Process read access privileges.

NT_ProcessAccess_Terminate

Process termination access privileges.

OFLAG_MORE_CHILDREN

Object flag.

OFLAG_MORE_ENTRIES

Object flag.

OFLAG_MORE_SHELLCODE

Object flag.

OFLAG_NO_DECRYPT

Object flag.

OFLAG_NO_UNPACK

Object flag.

OFLAG_PARSING_LIMIT

Object flag.

OFLAG_UNPACK_LIMIT

Object flag.

OFLAG_UNPACK_NESTING

Object flag.

REPORT_DB_EXT

File extension for an unpacked project.

REPORT_DB_NAME

Name of the main project database.

REPORT_EXT

File extension for a packed project.

REPORT_INT_ODB_NAME

Name of the internal files database.

REPORT_INT_PATH

Name of the internal files path.

REPORT_INT_ROOT_PREFIX

The prefix used to reference internal files from root entries.

REPORT_ODB_NAME

Name of the object database.

REPORT_PROJECT_SIGNATURE

File signature for a packed project.

REPORT_VERSION

Current project version.

SCANVIEW_BE

Specifies that the returned data is big-endian.

SCANVIEW_CARBON

Carbon view.

SCANVIEW_CELLTABLE

Cell table view.

SCANVIEW_CHART

Chart view.

SCANVIEW_CODEC_ASCII

Specifies that the returned data is ascii.

SCANVIEW_CODEC_MASK

Codec mask for the returned data.

SCANVIEW_CODEC_UCS2

Specifies that the returned data is ucs-2.

SCANVIEW_CODEC_UCS4

Specifies that the returned data is ucs-4.

SCANVIEW_CODEC_UTF16

Specifies that the returned data is utf-16.

SCANVIEW_CODEC_UTF32

Specifies that the returned data is utf-32.

SCANVIEW_CODEC_UTF8

Specifies that the returned data is utf-8.

SCANVIEW_CODE_JAVASCRIPT

Specifies that the returned data is JavaScript code.

SCANVIEW_CODE_MASK

Code mask for the returned data.

SCANVIEW_CODE_NONE

Specifies no code type for the returned data.

SCANVIEW_CODE_VBA

Specifies that the returned data is VBA code.

SCANVIEW_CODE_VBS

Specifies that the returned data is VBS code.

SCANVIEW_CUSTOM

Custom view.

SCANVIEW_CUSTOM_2

Second custom view.

SCANVIEW_CUSTOM_3

Third custom view.

SCANVIEW_CUSTOM_4

Fourth custom view.

SCANVIEW_CUSTOM_5

Fifth custom view.

SCANVIEW_DATA_NOT_SHARED

Specifies that the returned data is utf-16 is not shared among the views.

SCANVIEW_EMASK

Endianness mask for the returned data.

SCANVIEW_FILEINFO

File info view.

SCANVIEW_FS

File system view.

SCANVIEW_GEO

Geo-location view.

SCANVIEW_HEX

Hex view.

SCANVIEW_KEYVALUE

Key-value view.

SCANVIEW_LE

Specifies that the returned data is little-endian.

SCANVIEW_LIST

List view.

SCANVIEW_ME

Specifies that the returned data is middle-endian.

SCANVIEW_MEDIA

Media view.

SCANVIEW_NONE

Invalid view.

SCANVIEW_PLOT

Plot view.

SCANVIEW_RAW

Raw hex view.

SCANVIEW_TABLE

Table view.

SCANVIEW_TEXT

Text view.

SCANVIEW_TEXTBROWSER

Text browser view.

SCANVIEW_TREE

Tree view.

SCANVIEW_WEB

Web view.

SEC_File

Scan entry category for embedded objects.

SEC_Info

Scan entry category for information.

SEC_Intrinsic

Scan entry category for intrinsic threats.

SEC_Online

Scan entry category for online entries.

SEC_Privacy

Scan entry category for privacy issues.

SEC_Threat

Scan entry category for threats.

SEC_Warn

Scan entry category for warnings.

SFT_AccessTime

Scan provider time type for file access.

SFT_CreationTime

Scan provider time type for file creation.

SFT_ModificationTime

Scan provider time type for file modification.

TB_SIZE

This constant defines the size of a terabyte.

THIS_HDR_NAME

The special name of the header file associated with the report.

THIS_HEADER_NAME

The file name of the header file associated with the report.

TYPES_NATURE_BASE

Base value for type nature.

ToolDir_CheckExistence

Checks for the existence of the directory.

ToolDir_CreateIfMissing

Creates the directory if missing.

ToolDir_None

Returns the requested directory without checking for its existence or creating it if missing.

Classes:

CFFBuffer(object, offset, method)

This class provides buffered read capability for CFFObject.

CFFContainer()

This is a derived class from NTContainer which can reference data as CFFObject and CFFStruct.

CFFContext()

This class is used internally by CFFStruct to store information from members which affect the position and size of other members.

CFFDB()

This class creates a volatile tree structure that is either stored in memory or on disk.

CFFFlags()

This class contains flags and options for a member of CFFStruct.

CFFGetKeyResult()

This class is the return value of CFFObject.GetKey().

CFFHeader()

This class represents a header.

CFFHeaderAliasData()

Alias data of a header file.

CFFHeaderStructData()

Structure data of a header file.

CFFHeaderTypeDefData()

Type definition data of a header file.

CFFInitParams(wo, options)

This class contains the initialization parameters for the CFFObject.Initialize() method.

CFFKeyIndex()

This class represents a key index.

CFFObject()

The class from which every format class is derived (ZipObject, PEObject, etc.).

CFFStruct()

This class represents a data structure and references a CFFObject instance.

CFFStructIt(s)

Iterator for an array of CFFStruct structures.

CFFStructList()

List of CFFStruct elements.

CFFStructListIt(obj)

Iterator class for CFFStructList.

CFSEntry(iface)

Wrapper class for a CFSEntryInterface instance.

CFSEntryInterface()

This class represents a single file system entry.

CFSInstance(iface)

Wrapper class for a CFSInterface instance.

CFSInterface()

This class represents a file system interface

CFSIterator(iface)

Wrapper class for a CFSIteratorInterface instance.

CFSIteratorInterface()

This class represents a file system iterator.

CFSList(iface)

Wrapper class for a CFSListInterface instance.

CFSListInterface()

This class represents a file system list.

CommonSystem()

Logic providers return classes derived from this class to define a scanning behaviour.

FileToScan()

This class contains information about the file to scan returned by classes derived from CommonSystem.

FormatItemInfo()

The information about a format item returned by ScanProvider._formatViewInfo().

FormatTree()

Tree of FormatTreeNode nodes.

FormatTreeNode()

This class represents a node of FormatTree.

FormatTreeNodeList()

List of FormatTreeNode elements.

FormatTreeNodeListIt(obj)

Iterator class for FormatTreeNodeList.

KROffset()

Match for a byte search in NTContainer.

Layout()

Layouts are used to create ranges and associate structures to hex views.

LayoutData()

This class contains the data of a layout entry.

LayoutInterval()

This class represents a layout interval.

LayoutPair(t1, t2)

Pair of (LayoutInterval, LayoutData) elements.

LayoutPairList()

List of LayoutPair elements.

LayoutPairListIt(obj)

Iterator class for LayoutPairList.

LocalSystem()

CommonSystem derived class used to perform local file system scans.

NTAddressSpace()

This class is used to apply address spaces to containers.

NTBuffer()

Base class for buffered read operations.

NTByteArrayList()

List of bytes elements.

NTByteArrayListIt(obj)

Iterator class for NTByteArrayList.

NTContainer()

This is a generic container used to encapsulate data such as files and memory.

NTContainerBuffer(container, endianness, …)

This class provides buffered read capability for NTContainer.

NTDate(y, m, d)

This class provides date functions.

NTDateTime(date, time, spec)

This class provides date and time functions.

NTDoubleList()

List of float elements.

NTDoubleListIt(obj)

Iterator class for NTDoubleList.

NTDoubleVector()

Vector list of float elements.

NTDoubleVectorIt(obj)

Iterator class for NTDoubleVector.

NTFileEnum(path)

This class enumerates files from a specified path.

NTIWait()

Interface for wait objects.

NTIntList()

List of int elements.

NTIntListIt(obj)

Iterator class for NTIntList.

NTIntVariantHash()

Dictionary of int -> BasicType elements.

NTIntVariantHashIt(obj)

Iterator class for NTIntVariantHash.

NTIntVector()

Vector list of int elements.

NTIntVectorIt(obj)

Iterator class for NTIntVector.

NTMaxUIntList()

List of int elements.

NTMaxUIntListIt(obj)

Iterator class for NTMaxUIntList.

NTMaxUIntTree()

Tree of NTMaxUIntTreeNode nodes.

NTMaxUIntTreeNode()

This class represents a node of NTMaxUIntTree.

NTMaxUIntTreeNodeList()

List of NTMaxUIntTreeNode elements.

NTMaxUIntTreeNodeListIt(obj)

Iterator class for NTMaxUIntTreeNodeList.

NTMaxUIntVector()

Vector list of int elements.

NTMaxUIntVectorIt(obj)

Iterator class for NTMaxUIntVector.

NTMemoryInfoList()

List of NTMemoryInfo elements.

NTMemoryInfoListIt(obj)

Iterator class for NTMemoryInfoList.

NTModuleInfoList()

List of NTModuleInfo elements.

NTModuleInfoListIt(obj)

Iterator class for NTModuleInfoList.

NTOffsetRange()

This class defines a generic offset-size range.

NTOffsetRangeList()

List of NTOffsetRange elements.

NTOffsetRangeListIt(obj)

Iterator class for NTOffsetRangeList.

NTProcessInfoList()

List of NTProcessInfo elements.

NTProcessInfoListIt(obj)

Iterator class for NTProcessInfoList.

NTProcessRegionsEnumerator(pid)

This class implements an enumerator for memory regions.

NTSimpleWait()

Basic implementation of NTIWait.

NTStringList()

List of str elements.

NTStringListIt(obj)

Iterator class for NTStringList.

NTStringStringHash()

Dictionary of str -> str elements.

NTStringStringHashIt(obj)

Iterator class for NTStringStringHash.

NTStringStringHashList()

List of NTStringStringHash elements.

NTStringStringHashListIt(obj)

Iterator class for NTStringStringHashList.

NTStringVariantHash()

Dictionary of str -> BasicType elements.

NTStringVariantHashIt(obj)

Iterator class for NTStringVariantHash.

NTTextBuffer()

This is a class derived from NTTextStream.

NTTextStream()

An interface for outputting text and mnemonics.

NTTextStringBuffer()

This is a class derived from NTTextStream.

NTTime(h, m, s, ms)

This class provides clock time functionality.

NTTimer()

This class implements a fast milliseconds timer based on NT_GetTickCount().

NTUInt64List()

List of int elements.

NTUInt64ListIt(obj)

Iterator class for NTUInt64List.

NTUInt64UIntHash()

Dictionary of int -> int elements.

NTUInt64UIntHashIt(obj)

Iterator class for NTUInt64UIntHash.

NTUIntList()

List of int elements.

NTUIntListIt(obj)

Iterator class for NTUIntList.

NTUIntTree()

Tree of NTUIntTreeNode nodes.

NTUIntTreeNode()

This class represents a node of NTUIntTree.

NTUIntTreeNodeList()

List of NTUIntTreeNode elements.

NTUIntTreeNodeListIt(obj)

Iterator class for NTUIntTreeNodeList.

NTUIntVector()

Vector list of int elements.

NTUIntVectorIt(obj)

Iterator class for NTUIntVector.

NTUShortUShortHash()

Dictionary of int -> int elements.

NTUShortUShortHashIt(obj)

Iterator class for NTUShortUShortHash.

NTUShortVector()

Vector list of int elements.

NTUShortVectorIt(obj)

Iterator class for NTUShortVector.

NTUTF8StringHash()

Dictionary of str -> str elements.

NTUTF8StringHashIt(obj)

Iterator class for NTUTF8StringHash.

NTUTF8StringList()

List of str elements.

NTUTF8StringListIt(obj)

Iterator class for NTUTF8StringList.

NTVariantList()

List of BasicType elements.

NTVariantListIt(obj)

Iterator class for NTVariantList.

NTVoidBuffer()

This is a class derived from NTTextStream.

NTXml()

XML parser class.

NT_MEMORY_INFO()

This class represents a memory region.

NT_MODULE_INFO()

This class contains information about a loaded module.

NT_PROCESS_INFO()

This class contains information about a process.

PDBAssociationInfo()

This class contains association information for Windows PDB files.

ProCoreContext()

This class provides functionality for the current context.

ProGlobalSettings()

This class provides access to the main settings of the application.

ProSettings()

This class provides access to settings.

ProTextPrintBuffer()

This is a class derived from NTTextStream.

ProValueStorage()

This class provides SQLite-backed key -> value storage facility.

ProWebRequest(url)

This class can be used to make a web request.

Report()

This class represents a project.

ScanEntryBaseAttributes()

This class contains the base attributes of a scan entry retrieved from the report.

ScanEntryData()

This class represents a scan entry.

ScanMetaDataEntries()

List of ScanMetaDataEntry elements.

ScanMetaDataEntriesIt(obj)

Iterator class for ScanMetaDataEntries.

ScanMetaDataEntry()

This class represents a scan meta-data entry.

ScanProvider()

This is the base class inherited by all the scan engines for the different file formats.

ScanProviderWait(sprovider)

This class only wraps ScanProvider.isAborted().

ScanViewData()

This class is used as I/O container to retrieve data and UI views from a scan provider.

objdb_info()

This class contains information about an entry in the object database.

objdbview_info()

This class contains parameters to create a window view of the object database.

Functions:

CurrentEndianness()

Returns the endianness of the system (ENDIANNESS_LITTLE or ENDIANNESS_BIG).

DemangleSymbolName(mangled[, flags])

Unmangles a decorated symbol.

MethodNameFromSimpleSignature(signature)

Extracts the function or method name from a simple signature.

NT_AppendFile(src, copySize, dst)

Appends copySize bytes of src file to dst file.

NT_ApplyFileExt(fileName, filetype)

Appends the default extension type for the current system specified by filetype to fileName.

NT_AutoDecodeBytes(raw)

This function tries to decode raw bytes into a string using simple heuristics.

NT_CloseFile(ntfile)

Closes an open file handle.

NT_CloseModuleHandle(ntmod)

Closes the handle of a module without unloading the module.

NT_CloseProcess(proc)

Closes a process handle.

NT_ColorFromString(str)

Compute a color from an input string.

NT_CopyFile(fileNameA, fileNameB)

Copies a file.

NT_CopyFileOpen(fileNameA, fileNameB)

Copies a file.

NT_CreateDirectory(dirName)

Creates a directory.

NT_CreateDirectoryTree(dirName)

Creates a directory and all the intermediate directories leading up to that directory if not yet present.

NT_CreateFile(FileName[, opt])

Creates a file.

NT_CreateFileLink(fileName, linkName[, descr])

Creates a link (e.g.: .lnk on Windows) file.

NT_CreateTempFile([ext, auto_delete])

Creates a temporary file.

NT_DecodeAsciiBytes(raw)

This function tries to decode an ascii string using simple heuristics.

NT_DecodeAsciiBytes16(raw, endianness)

This function tries to decode an ascii wide-char string using simple heuristics.

NT_DeleteDirectory(dirName)

Deletes a directory.

NT_DeleteFile(FileName)

Deletes a file.

NT_DeleteLink(linkName)

Deletes a link (e.g.: .lnk on Windows) file.

NT_DirectoryExists(dirName)

Checks the existence of a directory.

NT_FileExists(FileName)

Checks the existence of a file.

NT_FileExtFromName(fileName[, include_dot])

Retrieves the extension of a file name (e.g.: ".exe").

NT_FileNameFromPath(path)

Retrieves the file name from a path.

NT_FileToBuffer(fileName, maxSize[, readPartial])

Reads a file to a memory buffer.

NT_FloatToString(v)

Converts a float value to string.

NT_FreeModule(ntmod)

Unloads a module and closes its handle.

NT_GetCurrentDirectory()

Returns the current working directory.

NT_GetCurrentModuleFileName()

Returns the name of the current module including its path.

NT_GetCurrentModulePath()

Returns the full path of the current module.

NT_GetCurrentProcessId()

Returns the current process id.

NT_GetCurrentProcessPath()

Returns the path of the executable of the current process.

NT_GetCustomTempFolder()

Gets the temporary directory set for the application.

NT_GetFileAttributes(fileName)

Retrieves the attributes of a file.

NT_GetFileAttributesAsString(fileName)

Retrieves the attributes of a file as a string.

NT_GetFileName(ntfile)

Retrieves the name of a file from its handle.

NT_GetFileOwner(fileName)

Retrieves the file owner of a file.

NT_GetFilePermissionsAsString(fileName)

Retrieves the file permissions as a string.

NT_GetFilePos(ntfile)

Gets the current file position.

NT_GetFileSize(ntfile)

Gets the size of a file.

NT_GetMemoryRegions(pid[, allocated_only, limit])

Retrieves the list of memory regions allocated by the specified process.

NT_GetModule(name)

Retrieves a module from its name.

NT_GetModuleList(pid)

Retrieves the list of modules loaded in the address space of a process.

NT_GetProcessFileName(pid_or_proc)

Retrieves the path of the executable of a specified process.

NT_GetProcessId(proc)

Retrieves the process id for a process handle.

NT_GetProcessList([only_accessible])

Retrieves the current list of processes.

NT_GetSpecialFolder(f)

Retrieves a special system directory.

NT_GetSystemFileHandle(ntfile)

Returns the internal system handle of a file.

NT_GetTempFileName([ext])

Generates a temporary file name.

NT_GetTickCount()

Returns the time passed since system boot in milliseconds.

NT_HasProcessAPI()

Returns True if the process API is available on the current system; otherwise returns False.

NT_HexCharToByte(ch)

Converts a hex character into its corresponding integer value (e.g.: ord('F') -> 15).

NT_IsCurrentModuleDLL()

Returns True if the current module is a shared library; otherwise returns False.

NT_IsRelativePath(path)

Checks whether a path is relative.

NT_KillProcess(pid_or_proc[, timeout])

Terminates a process.

NT_LoadModule(name)

Loads a module from disk.

NT_MakeCString(str)

Escapes a string for C (e.g.: "Hello,\nWorld!" becomes "Hello,\\nWorld!").

NT_MakeFileExecutable(fileName)

Adds executable attributes to the specified file if they’re missing.

NT_MatchFileName(fileNameA, fileNameB)

Compares two paths taking also into account the case sensitivity of the current file system.

NT_MemorySizeToString(size[, prec])

Converts a size in bytes to a string representation using byte, KB, MB or GB units.

NT_NormalizeFileName(fileName)

Replaces any backslash in a file name with a forward slash.

NT_NormalizePath(path)

Replaces any backslash in a path with a forward slash and makes sure that the path ends with a trailing forward slash.

NT_NormalizeToNative(fileOrPath)

Replaces the slashes of a file name or path with the slashes expected by the current system (i.e., backslashes on Windows and slashes on Linux/macOS).

NT_NormalizeToOrigin(fileOrPath)

Replaces the slashes of a file name or path with the slashes expected by the originating system (i.e., backslashes on Windows and slashes on Linux/macOS).

NT_OpenFile(FileName[, opt])

Opens an existing file.

NT_OpenProcess(pid[, access])

Retrieves a handle to a process.

NT_PathFromFileName(fileName)

Separates a path or file name from its trailing part.

NT_RawPathFromFileName(fileName)

Behaves exactly like NT_PathFromFileName(), except that it retains the slashes of the input.

NT_ReadFile(ntfile, nBytesToRead)

Reads a specified amount of bytes from a file and updates the file position.

NT_ReadProcessMemory(proc, MemoryAddr, …)

Reads the memory of a process.

NT_ResetFixedFileSize(ntfile)

Resets the fixed file size set by calling NT_SetFixedFileSize().

NT_ResolveShortcut(shortcut)

Resolves the target of a link (.lnk) file.

NT_ResolveSymbol(ntmod, symname)

Resolves the symbol of a module.

NT_SetCurrentDirectory(dirName)

Sets the current working directory.

NT_SetCustomTempFolder(path)

Sets a custom temporary folder to be used by the application.

NT_SetFileAutoDelete(ntfile, auto_delete)

Sets the auto-deletion flag for the file.

NT_SetFilePos(ntfile, FileOffset)

Sets the current file position.

NT_SetFileSize(ntfile, NewFileSize)

Changes the size of a file.

NT_SetFixedFileSize(ntfile, FixedFileSize)

Sets the fixed size of a file.

NT_StripFileExt(fileName)

Strips the extension from a file name.

NT_TrashFile(fileName[, showProgress])

Moves a file to the trash.

NT_UnescapeCString(str)

Unescapes a C string (e.g.: "Hello,\\nWorld!" becomes "Hello,\nWorld!").

NT_Win32FileTimeToDateTime(Time)

Converts a Windows FILETIME to NTDateTime.

NT_WriteFile(ntfile, bytes)

Writes the specified bytes to a file.

NT_WriteProcessMemory(proc, MemoryAddr, bytes)

Writes the memory of a process.

appDataDir([opt])

Retrieves the user data directory for the application.

applyFilters(data, str[, waitdlg_or_wo])

Applies the specified filters to an NTContainer and returns the resulting data as an NTContainer.

carbonThemesDir()

Returns the carbon themes directory.

cfsFileSystem()

Maps the computer file system to a CFSInstance instance.

cfsFileSystemEntry(path)

Maps a file system file to a CFSEntry instance.

configDir()

Returns the configuration directory.

createAddressSpace(name[, pt_offs, arg2, arg3])

Creates an address space based on a page-table.

createBlockIOAddressSpace(total_size, page_size)

Creates a block I/O address space.

createContainerFromFile(fname)

Creates an NTContainer object from a file on disk.

createSparseAddressSpace([reference_as, …])

Creates a sparse address space.

enableHook(name, enable)

Enables or disables the specified hook

executeFunctionInMainThread(func[, ud, blocking])

Executes a function from the main thread.

headersDir()

Returns the headers directory.

identifyPossibleFormats(data)

Identifies a list of possible file formats for the input data.

isGuiThread()

Returns True if called from the UI thread; otherwise returns False.

mediaDir()

Returns the media directory.

newContainer([size, reserve_size, max_size])

Creates a new NTContainer object.

ntAlpha(rgb)

Retrieves the alpha color component from an RGBA value.

ntAlphaBlend(src, bkg)

Performs an alpha blend operation on two RGBA values.

ntBlue(rgb)

Retrieves the blue color component from an RGBA value.

ntGreen(rgb)

Retrieves the green color component from an RGBA value.

ntRed(rgb)

Retrieves the read color component from an RGBA value.

ntRgb(r, g, b)

Creates an RGBA value from its red, green and blue color components.

ntRgba(r, g, b, a)

Creates an RGBA value from its red, green, blue and alpha color components.

ntShiftToColor(source, target, fraction)

Shift an RGBA value to another RGBA value.

packageCertificatesDir()

Returns the package certificates directory.

pluginsDir()

Returns the plugins directory.

proAbort(ret[, msg])

Aborts the application with an optional message.

proAddRecentFile(history, fname[, max_list_size])

Adds a recent file name to a specified historical list.

proAddRecentItem(history, item[, max_list_size])

Adds a recent item to a specified historical list.

proApplicationFileName()

Returns the path of the main application.

proArchIsX64()

Returns True if the current architecture is x64; otherwise returns False.

proArchIsX86()

Returns True if the current architecture is x86; otherwise returns False.

proArchName()

Returns the name of the current architecture (e.g., 'x64').

proClearOutput([with_undo])

Clears the output view if available.

proCoreContext()

Returns the global ProCoreContext instance.

proCrashApplication(i)

Crashes the application on purpose.

proDisasmOptions()

Returns the current disassembly options for the text view.

proGetIntPtr(name)

Retrieves an internal pointer.

proGetLine([prompt])

Retrieves an input string either by prompting a dialog box or from the terminal.

proGetRecentItems(history)

Retrieves a specified historical list.

proGetRiskBgColor(risk, bg)

Computes a color based on risk percentage.

proLaunchApplication(app[, args])

Launches an application.

proLaunchThisApplication([args])

Launches the main application.

proPlatformIsLinux()

Returns True if the current platform is Linux; otherwise returns False.

proPlatformIsMacOS()

Returns True if the current platform is macOS; otherwise returns False.

proPlatformIsWindows()

Returns True if the current platform is Windows; otherwise returns False.

proPlatformName()

Returns the name of the current platform (supported values are: 'windows', 'linux' and 'macos').

proPlatformShortName()

Returns the short name of the current platform (supported values are: 'win', 'lin' and 'mac').

proPrint(str)

Prints a message to the output view.

proPrintnl(str)

Prints a message to the output view.

proProcessEvents([ms])

Processes thread loop events.

proSetReturnCode(ret)

Sets the return code for the application.

proTextStream()

Creates a new NTTextBuffer instance with the default disassembly options.

proVersion()

Returns the current version of the application as a string in the shape of major_version.minor_version.build_version.

proVersionBuild()

Returns the build number of the application.

proVersionMajor()

Returns the major version of the application.

proVersionMinor()

Returns the minor version of the application.

pythonAllowIdleProcessing(b)

Enables or disables the idle processing of Python code.

themesDir()

Returns the themes directory.

userCarbonThemesDir([opt])

Retrieves the user carbon themes directory.

userConfigDir([opt])

Retrieves the user configuration directory.

userHeadersDir([opt])

Retrieves the user headers directory.

userMediaDir([opt])

Retrieves the user media directory.

userPDBSymbolsDir([opt])

Retrieves the user PDB symbols directory.

userPackageCertificatesDir([opt])

Retrieves the user package certificates directory.

userPackagesDir([opt])

Retrieves the user packages directory.

userPluginsDir([opt])

Retrieves the user plugins directory.

userPythonPluginsDir([opt])

Retrieves the user Python plugins directory.

userThemesDir([opt])

Retrieves the user themes directory.

Bufferize_BackAndForth: Final[int]

Buffering method for NTBuffer. To use when reading in both directions.

Bufferize_Backwards: Final[int]

Buffering method for NTBuffer. To use when reading backwards.

Bufferize_Forwards: Final[int]

Buffering method for NTBuffer. To use when reading forwards.

Bufferize_Invalid: Final[int]

Buffering method for NTBuffer. Only used for uninitialized instances.

See also NTBuffer.isNull().

class CFFBuffer(object: Pro.Core.CFFObject, offset: int, method: int = Bufferize_Forwards)

Bases: Pro.Core.NTBuffer

This class provides buffered read capability for CFFObject.

Parameters
  • object (CFFObject) – The object to read from.

  • offset (int) – The start offset to read from.

  • method (int) – The buffering method to use. Defaults to Bufferize_Forwards.

See also CFFObject.ToBuffer(), NTBuffer and NTContainerBuffer.

class CFFContainer

Bases: Pro.Core.NTContainer

This is a derived class from NTContainer which can reference data as CFFObject and CFFStruct.

See also NTContainer(), NTContainerBuffer and NTAddressSpace.

Attributes:

FileSystem

Type of data internally referenced by the container.

Object

Type of data internally referenced by the container.

Struct

Type of data internally referenced by the container.

Methods:

setData(data[, own_or_size])

See NTContainer.setData().

toFileSystem()

Returns the internal CFSInstance referenced by the container if the dataType() is FileSystem; otherwise returns an invalid CFSInstance instance.

toObject()

Returns the internal CFFObject referenced by the container if the dataType() is Object; otherwise returns None.

toStruct()

Returns the internal CFFStruct referenced by the container if the dataType() is Struct; otherwise returns an invalid struct.

FileSystem: Final[int]

Type of data internally referenced by the container.

Available since Cerbero Suite 7.0 and Cerbero Engine 4.0.

See also NTContainer.dataType().

Object: Final[int]

Type of data internally referenced by the container.

See also NTContainer.dataType().

Struct: Final[int]

Type of data internally referenced by the container.

See also NTContainer.dataType().

setData(data: Union[CFFObject, CFFStruct, CFSInstance, NTByteArrayList, NTContainer, NTStringList, NT_FILE, NT_PROCESS, bytes, int, str], own_or_size: Union[bool, int] = True)None

See NTContainer.setData().

toFileSystem()Pro.Core.CFSInstance
Returns

Returns the internal CFSInstance referenced by the container if the dataType() is FileSystem; otherwise returns an invalid CFSInstance instance.

Return type

CFSInstance

Available since Cerbero Suite 7.0 and Cerbero Engine 4.0.

See also NTContainer.dataType().

toObject()Pro.Core.CFFObject
Returns

Returns the internal CFFObject referenced by the container if the dataType() is Object; otherwise returns None.

Return type

CFFObject

See also NTContainer.dataType().

toStruct()Pro.Core.CFFStruct
Returns

Returns the internal CFFStruct referenced by the container if the dataType() is Struct; otherwise returns an invalid struct.

Return type

CFFStruct

See also NTContainer.dataType().

class CFFContext

This class is used internally by CFFStruct to store information from members which affect the position and size of other members.

See also CFFStruct.Context() and CFFStruct.SetContext().

Methods:

set(key, val)

Sets a value of the context.

value(key)

Retrieves a value from the context.

set(key: int, val: int)None

Sets a value of the context.

Parameters
  • key (int) – The key of the value to store.

  • val (int) – The value.

See also value().

value(key: int)int

Retrieves a value from the context.

Parameters

key (int) – The key of the value to retrieve.

Returns

Returns the value of the context if present; otherwise returns 0.

Return type

int

See also set().

class CFFDB

This class creates a volatile tree structure that is either stored in memory or on disk.

Indexes for the tree can either be 32-bit (CFFDBIndexSize32) or 64-bit (CFFDBIndexSize64).

Every item in the tree has fixed-size data. If no data size is specified when creating the tree, the fixed data size will be the same as the index size.

This class does not support the removal of items from the tree.

Methods:

AppendChild([parent])

Appends an item.

Children(index)

Returns the number of children for the specified index.

Data(index)

Retrieves the data of an item.

Data32(index)

Retrieves the data of an item as a 32-bit value.

Data64(index)

Retrieves the data of an item as a 64-bit value.

Index(pos[, parent])

Returns the index of an item given its parent and it’s position relative to its siblings.

InsertChild(pos[, parent])

Inserts an item given its parent and position relative to its siblings.

InsertChildren(pos, count[, parent])

Inserts multiple items given their parent and position relative to their siblings.

IsNull()

Returns True if invalid; otherwise returns False.

IsValid()

Returns True if valid; otherwise returns False.

Next(current)

Gets the next item in the tree.

Open([fixed_data_size, idxsize])

Initializes a CFFDB.

Parent(index)

Returns the parent of an item.

Position(index)

Returns the position of an item relative to its siblings.

PrependChild([parent])

Prepends an item.

Previous(current)

Gets the previous item in the tree.

SetData(index, value)

Sets the data of an item.

SetData32(index, value)

Sets the data of an item as a 32-bit value.

SetData64(index, value)

Sets the data of an item as a 64-bit value.

AppendChild(parent: int = 0)int

Appends an item.

Parameters

parent (int) – The parent index of the item to append.

Returns

Returns the index of the added child item if successful; otherwise returns CFFDBInvalidIndex.

Return type

int

See also PrependChild() and InsertChild().

Children(index: int)int

Returns the number of children for the specified index.

Parameters

index (int) – The index of the item for which to retrieve the number of children.

Returns

Returns the number of children.

Return type

int

See also Position(), Parent() and Index().

Data(index: int)tuple

Retrieves the data of an item.

Parameters

index (int) – The index of the item for which to retrieve the data.

Returns

Returns a tuple containing the retrieved data and a boolean. The boolean value is True if successful; otherwise it is False.

Return type

tuple[bytes, bool]

See also SetData(), Data32() and Data64().

Data32(index: int)tuple

Retrieves the data of an item as a 32-bit value.

Parameters

index (int) – The index of the item for which to retrieve the data.

Returns

Returns a tuple containing the retrieved data value and a boolean. The boolean value is True if successful; otherwise it is False.

Return type

tuple[int, bool]

See also SetData32(), Data() and Data64().

Data64(index: int)tuple

Retrieves the data of an item as a 64-bit value.

Parameters

index (int) – The index of the item for which to retrieve the data.

Returns

Returns a tuple containing the retrieved data value and a boolean. The boolean value is True if successful; otherwise it is False.

Return type

tuple[int, bool]

See also SetData64(), Data() and Data32().

Index(pos: int, parent: int = 0)int

Returns the index of an item given its parent and it’s position relative to its siblings.

Parameters
  • pos (int) – The position of the item relative to its siblings.

  • parent (int) – The index of the parent item.

Returns

Returns the requested index if successful; otherwise returns CFFDBInvalidIndex.

Return type

int

See also Parent(), Position() and Children().

InsertChild(pos: int, parent: int = 0)int

Inserts an item given its parent and position relative to its siblings.

Parameters
  • pos (int) – The position of the item to insert relative to its siblings.

  • parent (int) – The index of the parent item.

Returns

Returns the index of the added child item if successful; otherwise returns CFFDBInvalidIndex.

Return type

int

See also InsertChildren(), AppendChild() and PrependChild().

InsertChildren(pos: int, count: int, parent: int = 0)bool

Inserts multiple items given their parent and position relative to their siblings.

Parameters
  • pos (int) – The position of the items to insert relative to their siblings.

  • count (int) – The number of items to insert.

  • parent (int) – The index of the parent item.

Returns

Returns True if successful; otherwise returns False.

Return type

bool

See also InsertChild(), AppendChild() and PrependChild().

IsNull()bool
Returns

Returns True if invalid; otherwise returns False.

Return type

bool

See also IsValid() and Open().

IsValid()bool
Returns

Returns True if valid; otherwise returns False.

Return type

bool

See also IsNull() and Open().

Next(current: int)int

Gets the next item in the tree.

This method enumerates parent and child items.

Parameters

current (int) – The current index.

Returns

Returns the index if successful; otherwise returns CFFDBInvalidIndex.

Return type

int

See also Previous().

Open(fixed_data_size: int = 0, idxsize: int = CFFDBIndexSize32)bool

Initializes a CFFDB.

Parameters
  • fixed_data_size (int) – The size of the data associated with each item. If 0, it defaults to the index size.

  • idxsize (int) – The index size.

Returns

Returns True if successful; otherwise returns False.

Return type

bool

See also IsValid() and IsNull().

Parent(index: int)int

Returns the parent of an item.

Parameters

index (int) – The index of the item for which to retrieve the parent.

Returns

Returns the parent index if successful; otherwise returns CFFDBInvalidIndex.

Return type

int

See also Index(), Position() and Children().

Position(index: int)int

Returns the position of an item relative to its siblings.

Parameters

index (int) – The index of the item for which to retrieve the relative position.

Returns

Returns the position if successful; otherwise returns CFFDBInvalidIndex.

Return type

int

See also Children(), Index() and Parent().

PrependChild(parent: int = 0)int

Prepends an item.

Parameters

parent (int) – The parent index of the item to prepend.

Returns

Returns the index of the added child item if successful; otherwise returns CFFDBInvalidIndex.

Return type

int

See also AppendChild() and InsertChild().

Previous(current: int)int

Gets the previous item in the tree.

This method enumerates parent and child items.

Parameters

current (int) – The current index.

Returns

Returns the index if successful; otherwise returns CFFDBInvalidIndex.

Return type

int

See also Next().

SetData(index: int, value: bytes)bool

Sets the data of an item.

The size of value must match the size of the data specified when initializing the tree (See Open()).

Parameters
  • index (int) – The index of the item for which to set the data.

  • value (bytes) – The data to set.

Returns

Returns True if successful; otherwise returns False.

Return type

bool

See also Data(), SetData32() and SetData64().

SetData32(index: int, value: int)bool

Sets the data of an item as a 32-bit value.

Parameters
  • index (int) – The index of the item for which to set the data.

  • value (int) – The 32-bit value to set.

Returns

Returns True if successful; otherwise returns False.

Return type

bool

See also Data32(), SetData() and SetData64().

SetData64(index: int, value: int)bool

Sets the data of an item as a 64-bit value.

Parameters
  • index (int) – The index of the item for which to set the data.

  • value (int) – The 64-bit value to set.

Returns

Returns True if successful; otherwise returns False.

Return type

bool

See also Data64(), SetData() and SetData32().

CFFDBIndexSize32: Final[int]

32-bit index size for CFFDB.

See also CFFDB.

CFFDBIndexSize64: Final[int]

64-bit index size for CFFDB.

See also CFFDB.

CFFDBInvalidIndex: Final[int]

Invalid index for CFFDB.

See also CFFDB.

CFFDBRootIndex: Final[int]

Root index for CFFDB.

See also CFFDB.

class CFFFlags

This class contains flags and options for a member of CFFStruct.

Methods:

Count()

Returns the number of flags and options available.

Description(i)

Retrieves the description of a flag or option.

IsFlag(value, i_or_name)

Checks if a flag or option is set in the input value.

IsNull()

Returns True if the CFFFlags instance is invalid; otherwise returns False.

IsOptionsOnly()

Returns True if the current CFFFlags instance contains only options and not flags; otherwise returns False.

IsValid()

Returns True if the CFFFlags instance is valid; otherwise returns False.

Name(i)

Retrieves the name of a flag or option.

Output(out, value[, opt, sep])

Outputs the flags and options set in the input value to a text stream .

Position(name)

Retrieves the position of a flag or option by its name.

ShortDescription(i)

Retrieves the short description of a flag or option.

Type([i])

Retrieves the type of the CFFFlags instance or the type of one of its members.

Value(i)

Retrieves the value of a flag or option.

ValueDescription(value)

Retrieves the description for the input value.

ValueName(value)

Retrieves the name for the input value.

Count()int
Returns

Returns the number of flags and options available.

Return type

int

See also Output(), Name() and IsFlag().

Description(i: int)str

Retrieves the description of a flag or option.

Parameters

i (int) – The index of the flag or option.

Returns

Returns the description if available; otherwise returns an empty string.

Return type

str

See also ShortDescription(), Name() and Value().

IsFlag(value: int, i_or_name: Union[int, str])bool

Checks if a flag or option is set in the input value.

Parameters
  • value (int) – The input value.

  • i_or_name (Union[int, str]) – The index or name of the flag or option.

Returns

Returns True if the flag or option is set in the input value; otherwise returns False.

Return type

bool

See also Output(), Name() and Value().

IsNull()bool
Returns

Returns True if the CFFFlags instance is invalid; otherwise returns False.

Return type

bool

See also IsValid().

IsOptionsOnly()bool
Returns

Returns True if the current CFFFlags instance contains only options and not flags; otherwise returns False.

Return type

bool

See also ValueDescription().

IsValid()bool
Returns

Returns True if the CFFFlags instance is valid; otherwise returns False.

Return type

bool

See also IsNull().

Name(i: int)str

Retrieves the name of a flag or option.

Parameters

i (int) – The index of the flag or option.

Returns

Returns the name of the flag or option if successful; otherwise returns an empty string.

Return type

str

See also Name() and Output().

Output(out: Pro.Core.NTTextStream, value: int, opt: int = 0, sep: Optional[str] = None)None

Outputs the flags and options set in the input value to a text stream .

Parameters
  • out (NTTextStream) – The text stream.

  • value (int) – The input value.

  • opt (int) – The output options. NTFlagOutput_IgnoreUnknown can be specified to ignore unknown flags.

  • sep (Optional[str]) – The separator for the output. Defaults to " | ".

See also NTTextStream and ShortDescription().

Position(name: str)int

Retrieves the position of a flag or option by its name.

Parameters

name (str) – The name of the flag or option.

Returns

Returns the index of the flag or option if successful; otherwise returns -1.

Return type

int

See also Name() and Value().

ShortDescription(i: int)str

Retrieves the short description of a flag or option.

Parameters

i (int) – The index of the flag or option.

Returns

Returns the short description if available; otherwise returns an empty string.

Return type

str

See also Description(), Name() and Value().

Type(i: Optional[int] = None)int

Retrieves the type of the CFFFlags instance or the type of one of its members.

Parameters

i (Optional[int]) – The index of the flag or option.

Returns

Returns the requested type if successful; otherwise returns 0.

Return type

int

See also Name() and Value().

Value(i: int)int

Retrieves the value of a flag or option.

Parameters

i (int) – The index of the flag or option.

Returns

Returns the value if successful; otherwise returns 0.

Return type

int

See also Name() and Description().

ValueDescription(value: int)str

Retrieves the description for the input value.

This method works only if the CFFFlags instance contains only options (See IsOptionsOnly()).

Parameters

value (int) – The input value.

Returns

Returns the value description if successful; otherwise returns an empty string.

Return type

str

See also ValueName(), IsOptionsOnly() and Output().

ValueName(value: int)str

Retrieves the name for the input value.

This method works only if the CFFFlags instance contains only options (See IsOptionsOnly()).

Parameters

value (int) – The input value.

Returns

Returns the value description if successful; otherwise returns an empty string.

Return type

str

Available since Cerbero Suite 7.3 and Cerbero Engine 4.3.

See also ValueDescription(), IsOptionsOnly() and Output().

class CFFGetKeyResult

This class is the return value of CFFObject.GetKey().

Available since Cerbero Suite 6.3 and Cerbero Engine 3.3.

See also CFFObject.GetKey().

Attributes:

data

The key data.

key_type

The key type (e.g., CFFKT_Pass).

data

The key data.

key_type

The key type (e.g., CFFKT_Pass).

class CFFHeader

This class represents a header.

Headers contain definition of structures and can be loaded from SQLite files or XML strings. The structures can be imported from C/C++ code through the Header Manager or from debug symbols such as PDB files.

Important

Editing is supported only for SQLite-backed headers.

Example:

from Pro.Core import *

xml_header = """<header>

<r id='_IMAGE_DOS_HEADER' type='struct'>
  <f id='e_magic' type='unsigned short'/>
  <f id='e_cblp' type='unsigned short'/>
  <f id='e_cp' type='unsigned short'/>
  <f id='e_crlc' type='unsigned short'/>
  <f id='e_cparhdr' type='unsigned short'/>
  <f id='e_minalloc' type='unsigned short'/>
  <f id='e_maxalloc' type='unsigned short'/>
  <f id='e_ss' type='unsigned short'/>
  <f id='e_sp' type='unsigned short'/>
  <f id='e_csum' type='unsigned short'/>
  <f id='e_ip' type='unsigned short'/>
  <f id='e_cs' type='unsigned short'/>
  <f id='e_lfarlc' type='unsigned short'/>
  <f id='e_ovno' type='unsigned short'/>
  <f id='e_res' type='unsigned short [4]'/>
  <f id='e_oemid' type='unsigned short'/>
  <f id='e_oeminfo' type='unsigned short'/>
  <f id='e_res2' type='unsigned short [10]'/>
  <f id='e_lfanew' type='int'/>
</r>

</header>"""

def printStructure(fname):
    c = createContainerFromFile(fname)
    if c.isNull():
        return
    # load header from an XML string
    header = CFFHeader()
    if not header.LoadFromXml(xml_header):
        return
    obj = CFFObject()
    # since CFFObject is not subclassed, the Load method cannot fail
    obj.Load(c)
    # map a structure to a specific offset
    offset = 0
    s = obj.MakeStruct(header, "_IMAGE_DOS_HEADER", offset, CFFSO_VC | CFFSO_Pack1)
    out = NTTextBuffer()
    s.Dump(out)
    print(out.buffer)

See also CFFStruct and CFFObject.

Attributes:

AC_Define

Alias category for a definition.

AC_Enum

Alias category for an enumerator.

AC_Last

Alias category terminator.

AVT_Integer

Alias integer value type.

AVT_Last

Alias terminator value type.

AVT_Real

Alias floating point value type.

AVT_String

Alias string value type.

Methods:

BeginEdit()

Begins an SQLite transaction.

Close()

Clears the current instance.

EndEdit()

Ends an SQLite transaction.

Equals(s)

Checks whether two headers reference the same internal data.

GetACName(category)

Retrieves the alias category name.

GetAVTName(vtype)

Retrieves the alias value type name.

GetAliasCount()

Returns the number of alias in the header.

GetAliasData(i)

Retrieves the data for an alias.

GetSQLiteDB()

Returns the SQLite handle if the header is backed by SQLite internally; otherwise returns None.

GetStructBaseData(i)

Retrieves the basic data of a structure.

GetStructCount()

Returns the number of structures in the header.

GetStructData(i_or_name)

Retrieves the data of a structure.

GetTypeDefCount()

Returns the number of type definitions in the header.

GetTypeDefData(i)

Retrieves the data of a type definition.

InsertAlias(name, category, type, vtype, value)

Inserts or replaces an alias in the header file.

InsertStruct(schema)

Inserts or replaces a structure in the header file.

InsertTypeDef(name, type)

Inserts or replaces a type definition in the header file.

IsModified()

Returns True if the header was modified; otherwise returns False.

IsNull()

Returns True if the header is invalid; otherwise returns False.

IsValid()

Returns True if the header is valid; otherwise returns False.

LoadFromFile(name)

Loads a header file from an SQLite database.

LoadFromXml(xml)

Initializes a header instance from XML data.

SetModified(b)

Sets the modified status for the header file.

AC_Define: Final[int]

Alias category for a definition.

AC_Enum: Final[int]

Alias category for an enumerator.

AC_Last: Final[int]

Alias category terminator.

AVT_Integer: Final[int]

Alias integer value type.

AVT_Last: Final[int]

Alias terminator value type.

AVT_Real: Final[int]

Alias floating point value type.

AVT_String: Final[int]

Alias string value type.

BeginEdit()None

Begins an SQLite transaction.

See also EndEdit() and InsertStruct().

Close()None

Clears the current instance.

See also LoadFromFile() and LoadFromXml().

EndEdit()None

Ends an SQLite transaction.

See also BeginEdit() and InsertStruct().

Equals(s: Pro.Core.CFFHeader)bool

Checks whether two headers reference the same internal data.

Parameters

s (CFFHeader) – The other header.

Returns

Returns True if the two headers reference the same internal data; otherwise returns False.

Return type

bool

static GetACName(category: int)str

Retrieves the alias category name.

Parameters

category (int) – The alias category.

Returns

Returns the name of the alias category if successful; otherwise returns an empty string.

Return type

str

See also GetAVTName().

static GetAVTName(vtype: int)str

Retrieves the alias value type name.

Parameters

vtype (int) – The alias value type.

Returns

Returns the name of the alias value type if successful; otherwise returns an empty string.

Return type

str

See also GetACName().

GetAliasCount()int
Returns

Returns the number of alias in the header.

Return type

int

See also GetAliasData() and InsertAlias().

GetAliasData(i: int)Pro.Core.CFFHeaderAliasData

Retrieves the data for an alias.

Parameters

i (int) – The index of the alias.

Returns

Returns the data of the alias if successful; otherwise returns an empty data structure.

Return type

CFFHeaderAliasData

See also GetAliasCount() and InsertAlias().

GetSQLiteDB()sqlite3
Returns

Returns the SQLite handle if the header is backed by SQLite internally; otherwise returns None.

Return type

sqlite3

GetStructBaseData(i: int)Pro.Core.CFFHeaderStructData

Retrieves the basic data of a structure.

The difference with GetStructData() is that the XML schema of the structure is not retrieved. Therefore, this method is a bit faster.

Parameters

i (int) – The index of the structure.

Returns

Returns the data of the structure if successful; otherwise returns an empty data structure.

Return type

CFFHeaderStructData

See also GetStructData(), GetStructCount() and InsertStruct().

GetStructCount()int
Returns

Returns the number of structures in the header.

Return type

int

See also GetStructData() and InsertStruct().

GetStructData(i_or_name: Union[int, str])Pro.Core.CFFHeaderStructData

Retrieves the data of a structure.

Parameters

i_or_name (Union[int, str]) – The name or the index of the structure.

Returns

Returns the data of the structure if successful; otherwise returns an empty data structure.

Return type

CFFHeaderStructData

See also GetStructBaseData(), GetStructCount() and InsertStruct().

GetTypeDefCount()int
Returns

Returns the number of type definitions in the header.

Return type

int

See also GetTypeDefData() and InsertTypeDef().

GetTypeDefData(i: int)Pro.Core.CFFHeaderTypeDefData

Retrieves the data of a type definition.

Parameters

i (int) – The index of the type definition.

Returns

Returns the data of the type definition if successful; otherwise returns an empty data structure.

Return type

CFFHeaderTypeDefData

See also GetTypeDefCount() and InsertTypeDef().

InsertAlias(name: str, category: int, type: str, vtype: int, value: str)None

Inserts or replaces an alias in the header file.

This method is supported only by SQLite-backed header files.

Parameters
  • name (str) – The name of the alias.

  • category (int) – The category of the alias.

  • type (str) – The type of the alias.

  • vtype (int) – The value type of the alias.

  • value (str) – The value of the alias.

See also GetAliasData() and GetAliasCount().

InsertStruct(schema: str)None

Inserts or replaces a structure in the header file.

This method is supported only by SQLite-backed header files.

Parameters

schema (str) – The XML schema of the structure.

See also GetStructData() and GetStructCount().

InsertTypeDef(name: str, type: str)None

Inserts or replaces a type definition in the header file.

This method is supported only by SQLite-backed header files.

Parameters
  • name (str) – The name of the type definition.

  • type (str) – The type definition.

See also GetTypeDefData() and GetTypeDefCount().

IsModified()bool
Returns

Returns True if the header was modified; otherwise returns False.

Return type

bool

See also SetModified().

IsNull()bool
Returns

Returns True if the header is invalid; otherwise returns False.

Return type

bool

See also IsValid().

IsValid()bool
Returns

Returns True if the header is valid; otherwise returns False.

Return type

bool

See also IsNull().

LoadFromFile(name: str)bool

Loads a header file from an SQLite database.

Parameters

name (str) – The name of the header file.

Returns

Returns True if successful; otherwise returns False.

Return type

bool

See also LoadFromXml().

LoadFromXml(xml: Union[Pro.Core.NTXml, str])bool

Initializes a header instance from XML data.

Parameters

xml (Union[NTXml, str]) – Either an XML string or an NTXml instance.

Returns

Returns True if successful; otherwise returns False.

Return type

bool

See also LoadFromFile().

SetModified(b: bool)None

Sets the modified status for the header file.

Parameters

b (bool) – If True, the header file is marked as modified.

See also IsModified().

class CFFHeaderAliasData

Alias data of a header file.

See also CFFHeader.

Attributes:

category

The category of the alias.

name

The name of the alias.

type

The type of the alias.

value

The value of the alias.

vtype

The value type of the alias.

category

The category of the alias.

name

The name of the alias.

type

The type of the alias.

value

The value of the alias.

vtype

The value type of the alias.

class CFFHeaderStructData

Structure data of a header file.

See also CFFHeader.

Attributes:

name

The name of the structure.

schema

The XML schema of the structure.

type

The type of the structure.

name

The name of the structure.

schema

The XML schema of the structure.

type

The type of the structure.

class CFFHeaderTypeDefData

Type definition data of a header file.

See also CFFHeader.

Attributes:

name

The name of the type definition.

type

The type definition.

name

The name of the type definition.

type

The type definition.

class CFFInitParams(wo: Optional[Pro.Core.NTIWait] = None, options: int = 0)

This class contains the initialization parameters for the CFFObject.Initialize() method.

Parameters
  • wo (NTIWait) – The wait object.

  • options (int) – The parsing options.

Attributes:

DontDecrypt

This flag instructs the parser not to decrypt the file.

StrictParser

This flag instructs the parser to avoid parsing malformed data.

has_wo

A boolean that signals the presence of a wait object that isn’t the default dummy one.

max_children

The maximum number of allowed child entries.

options

Options for the parser (e.g., StrictParser).

wo

The wait object for operation.

DontDecrypt: Final[int]

This flag instructs the parser not to decrypt the file.

Note

The parser might choose to ignore this flag.

See also options.

StrictParser: Final[int]

This flag instructs the parser to avoid parsing malformed data.

Note

The parser might choose to ignore this flag.

See also options.

has_wo

A boolean that signals the presence of a wait object that isn’t the default dummy one.

See also wo.

max_children

The maximum number of allowed child entries.

options

Options for the parser (e.g., StrictParser).

wo

The wait object for operation.

Hint

If a wait object is not specified, a dummy one is provided, so that this field is always valid. To check for the presence of a real wait object use has_wo.

CFFKST_Raw: Final[int]

Key sub-type raw.

Available since Cerbero Suite 6.3 and Cerbero Engine 3.3.

CFFKST_String: Final[int]

Key sub-type string.

Available since Cerbero Suite 6.3 and Cerbero Engine 3.3.

CFFKST_UTF8: Final[int]

Key sub-type utf-8.

Available since Cerbero Suite 6.3 and Cerbero Engine 3.3.

CFFKT_Cert: Final[int]

Key type certificate.

Available since Cerbero Suite 6.3 and Cerbero Engine 3.3.

See also CFFGetKeyResult.

CFFKT_Invalid: Final[int]

Key type invalid.

Available since Cerbero Suite 6.3 and Cerbero Engine 3.3.

See also CFFGetKeyResult.

CFFKT_Pass: Final[int]

Key type password.

Available since Cerbero Suite 6.3 and Cerbero Engine 3.3.

See also CFFGetKeyResult.

class CFFKeyIndex

This class represents a key index.

Available since Cerbero Suite 6.3 and Cerbero Engine 3.3.

See also CFFObject.GetKey() and CFFObject.KeyMatch().

CFFN_Base: Final[int]

Base value for standard CFFObject notifications.

See also CFFObject.Notify().

CFFN_Malformed: Final[int]

CFFObject notification for malformed data.

See also CFFObject.Notify().

CFFN_MoreFiles: Final[int]

CFFObject notification for the file limit.

See also CFFObject.Notify().

CFFN_NoDecrypt: Final[int]

CFFObject notification for failed decryption.

See also CFFObject.Notify().

CFFN_NoUnpack: Final[int]

CFFObject notification for failed decompression.

See also CFFObject.Notify().

CFFN_ParsingLimit: Final[int]

CFFObject notification for an internal parsing limit.

See also CFFObject.Notify().

CFFN_Recursive: Final[int]

CFFObject notification for recursion.

See also CFFObject.Notify().

CFFN_UnpackLimit: Final[int]

CFFObject notification for the decompression limit.

See also CFFObject.Notify().

CFFN_UnpackNestLimit: Final[int]

CFFObject notification for the decompression nesting limit.

See also CFFObject.Notify().

class CFFObject

Bases: Pro.Core.CFSInterface

The class from which every format class is derived (ZipObject, PEObject, etc.).

The internal data of a CFFObject is an NTContainer (See Load()).

See also NTContainer, CFFStruct, CFFHeader and CFFBuffer.

Methods:

AdjustSign(type, num)

Makes the input number negative if the last bit is set and the input type is an integer.

Align(AlignConst)

Aligns the object to the specified size.

AppendTo(nStartOffset, nLenght, pDst)

Appends part of this object to a container.

Compare(offset, bytes_or_uSize[, b])

Compares the specified data to the one in the object.

CopyFrom(Src, nDstOffset, nLenght[, …])

Copies data from a container to the object.

CopyTo(nStartOffset, nLenght, pDst[, …])

Copies a part of the object to a container.

DisableRanges()

Disables ranges.

EnableRanges(bits_per_element, granularity)

Creates a range bit mask for the current object.

Fill(offset, c, uSize)

Fills a portion of the object with the specified byte.

GetDefaultEndianness()

Returns the default endianness of the object (ENDIANNESS_LITTLE or ENDIANNESS_BIG).

GetDefaultStructOptions()

Returns the default options for CFFStruct instances created from this object (e.g., CFFSO_Pack1).

GetKey(ki, accepted_keys[, converter])

Retrieves a decryption key.

GetMappingAddress()

Returns the address at which this object is mapped if available; otherwise returns INVALID_STREAM_OFFSET.

GetMemoryUnpackLimit()

Returns the maximum amount of bytes which can be allocated for in-memory decompression algorithms.

GetObjectFormatName()

Returns the file format name of the object if available; otherwise returns an empty string.

GetObjectGenericFormatName()

Returns the generic format name of the object if available; otherwise returns an empty string (e.g., the generic format name of HTML is XML).

GetObjectName()

Returns the name of the object if available; otherwise returns an empty string.

GetObjectTypeName()

Returns the type name of the object if available; otherwise returns an empty string.

GetSize()

Returns the size of the internally referenced container.

GetSpecialData(key[, defval])

Retrieves special data associated to the object.

GetStream()

Returns the internally referenced container.

GetSubStream(offset_or_range[, …])

Retrieves a sub-stream of the internally referenced container.

GetTag()

Returns the tag name set for debugging purposes if present; otherwise returns an empty string.

GetTypeName(Type)

Returns the name of the specified type.

GetTypeNature(Type)

Returns the nature of the specified type.

GetUnpackLimit()

Returns the limit for decompression operations.

GetUnpackNestingLimit()

Returns the nesting limit for decompression operations.

HasFSSupport()

Returns True if file system support is available; otherwise returns False.

Initialize([p])

Provides a generic way to initialize an object.

IsMapped()

Returns True if the object has a mapping address; otherwise returns False.

IsModified()

Returns True if the object was modified; otherwise returns False.

IsNull()

Returns True if the object is uninitialized; otherwise returns False.

IsTypeDynamicPersistent(Type)

Checks whether a type is persistently dynamic.

KeyMatch(ki[, converter])

Marks a key as successfully having being used for decryption.

Load(Stream)

Loads the object data.

LocationDescription(offset)

Provides a description for a specified location.

MakeStruct(header, name, offset[, options])

Returns a CFFStruct instance.

MakeStructArray(header, name, offset, nentries)

Returns an array of CFFStruct.

Modified(b)

Sets the modified status for the object.

NewContainer(size[, reserve_size, max_size])

Creates a new NTContainer object.

Notify(code)

Internally notifies the associated ScanProvider (if any) of a problem.

RangesEnabled()

Returns True if ranges are enabled for the current object; otherwise returns False.

Read(offset, uSize)

Reads data from the object.

ReadNumber(offset, type, endianness, is_signed)

Reads an integer from the object.

ReadUInt16(offset[, endianness])

Reads an unsigned 16-bit integer from the object.

ReadUInt16String(offset, maxlen, endianness)

Reads an utf-16 array from the object.

ReadUInt32(offset[, endianness])

Reads an unsigned 32-bit integer from the object.

ReadUInt32String(offset, maxlen, endianness)

Reads an utf-32 array from the object.

ReadUInt64(offset[, endianness])

Reads an unsigned 64-bit integer from the object.

ReadUInt8(offset)

Reads an unsigned 8-bit integer from the object.

ReadUInt8String(offset, maxlen)

Reads an utf-8 array from the object.

ReplaceStream(NewStream)

Replaces the internal data of the object.

SetDefaultEndianness(nEndiannessType)

Sets the default endianness for the object.

SetDefaultStructOptions(options)

Sets the default options for CFFStruct instances created from this object (e.g., CFFSO_Pack1).

SetFSSupport(b)

Sets the status of file system support.

SetMappingAddress(mapping)

Sets the address at which the object is mapped.

SetMemoryUnpackLimit(limit)

Sets the maximum amount of bytes which can be allocated for in-memory decompression algorithms.

SetObjectFormatName(format)

Sets the file format name of the object.

SetObjectGenericFormatName(format)

Sets the generic format name of the object (e.g., the generic format name of HTML is XML).

SetObjectName(name)

Sets the name of the object.

SetObjectTypeName(type_name)

Sets the type name of the object.

SetRange(offset, size, val)

Sets a range value for the current object.

SetRangeValue(offset, size, val)

Sets a range value for the current object.

SetSize(NewSize)

Resizes the internal data of the object.

SetSpecialData(key, value)

Sets special data associated to the object.

SetTag(t)

Sets the tag name of the object for debugging purposes

SetUnpackLimit(limit)

Sets the limit for decompression operations.

SetUnpackNestingLimit(limit)

Sets the nesting limit for decompression operations.

Shift(uSize)

Appends uSize bytes at the end of the object data and sets them to zero.

ToBuffer(offset[, method])

Returns a CFFBuffer that reads from the object.

ToUInt16(n)

Applies the default endianness of the object to the 16-bit input integer.

ToUInt32(n)

Applies the default endianness of the object to the 32-bit input integer.

ToUInt64(n)

Applies the default endianness of the object to the 64-bit input integer.

ValidRange(offset, Size)

Checks the validity of a range in the context of the object.

Write(offset, bytes_or_uSize[, bytes])

Writes data to the object.

WriteUInt16(offset, n_or_nEndiannessType[, n])

Writes an unsigned 16-bit integer to the object.

WriteUInt32(offset, n_or_nEndiannessType[, n])

Writes an unsigned 32-bit integer to the object.

WriteUInt64(offset, n_or_nEndiannessType[, n])

Writes an unsigned 64-bit integer to the object.

WriteUInt8(offset, n)

Writes an unsigned 8-bit integer to the object.

AdjustSign(type: int, num: int)int

Makes the input number negative if the last bit is set and the input type is an integer.

Parameters
  • type (int) – The input type.

  • num (int) – The input number.

Returns

Returns the adjusted number.

Return type

int

Align(AlignConst: int)bool

Aligns the object to the specified size.

Parameters

AlignConst (int) – The alignment.

Returns

Returns True if successful; otherwise returns False.

Return type

bool

See also NTContainer.align() and Shift().

AppendTo(nStartOffset: int, nLenght: int, pDst: Pro.Core.NTContainer)bool

Appends part of this object to a container.

Parameters
  • nStartOffset (int) – The offset of the range to append.

  • nLenght (int) – The size of the range to append.

  • pDst (NTContainer) – The destination container.

Returns

Returns True if successful; otherwise returns False.

Return type

bool

See also NTContainer.appendTo().

Compare(offset: int, bytes_or_uSize: Union[bytes, int], b: Optional[int] = None)bool

Compares the specified data to the one in the object.

Parameters
  • offset (int) – The start offset for the comparison.

  • bytes_or_uSize (Union[bytes, int]) – Either the data to compare or the size to compare.

  • b (Optional[int]) – If the previous parameter is the size to compare, this parameter is the byte which to compare the data to.

Returns

Returns True if the data matches; otherwise returns False.

Return type

bool

See also NTContainer.compare().

CopyFrom(Src: Pro.Core.NTContainer, nDstOffset: int, nLenght: int, nSrcStartOffset: int = 0)bool

Copies data from a container to the object.

Parameters
  • Src (NTContainer) – The container from which to copy the data.

  • nDstOffset (int) – The offset at which to copy the data.

  • nLenght (int) – The size of the data to copy.

  • nSrcStartOffset (int) – The offset from which to copy the data in the container.

Returns

Returns True if successful; otherwise returns False.

Return type

bool

See also NTContainer.copyTo().

CopyTo(nStartOffset: int, nLenght: int, pDst: Pro.Core.NTContainer, nDstStartOffset: int = 0)bool

Copies a part of the object to a container.

Parameters
  • nStartOffset (int) – The offset of the data to copy.

  • nLenght (int) – The size of the data to copy.

  • pDst (NTContainer) – The destination container.

  • nDstStartOffset (int) – The offset at which to write the data to in the destination container.

Returns

Returns True if successful; otherwise returns False.

Return type

bool

See also NTContainer.copyTo().

DisableRanges()None

Disables ranges.

Available since Cerbero Suite 6.2 and Cerbero Engine 3.2.

See also EnableRanges(), RangesEnabled() and SetRange().

EnableRanges(bits_per_element: int, granularity: int, initval: int = 0)None

Creates a range bit mask for the current object.

Parameters
  • bits_per_element (int) – The mask bits for each element.

  • granularity (int) – The granularity of each element.

  • initval (int) – The initial value of each element.

Note

The granularity is might be changed for larger files to meet memory constraints.

Available since Cerbero Suite 6.2 and Cerbero Engine 3.2.

See also DisableRanges(), RangesEnabled() and SetRange().

Fill(offset: int, c: int, uSize: int)bool

Fills a portion of the object with the specified byte.

Parameters
  • offset (int) – The offset of the range to fill.

  • c (int) – The 8-bit value used for the fill operation.

  • uSize (int) – The size of the range to fill.

Returns

Returns True if successful; otherwise returns False.

Return type

bool

See also NTContainer.fill().

GetDefaultEndianness()int
Returns

Returns the default endianness of the object (ENDIANNESS_LITTLE or ENDIANNESS_BIG).

Return type

int

See also SetDefaultEndianness().

GetDefaultStructOptions()int
Returns

Returns the default options for CFFStruct instances created from this object (e.g., CFFSO_Pack1).

Return type

int

See also SetDefaultStructOptions().

GetKey(ki: Pro.Core.CFFKeyIndex, accepted_keys: int, converter: str = 'utf-8')Pro.Core.CFFGetKeyResult

Retrieves a decryption key.

Example:

ki = CFFKeyIndex()
while True:
    kres = self.GetKey(ki, CFFKT_Pass, "utf-8")
    if kres.key_type == CFFKT_Invalid:
        # if there are no more keys, exit the loop
        break
    if self.Decrypt(kres.data): # our decryption method
        # if the decryption was successful, mark the key and exit the loop
        self.KeyMatch(ki, "utf-8")
        break
Parameters
  • ki (CFFKeyIndex) – The key index.

  • accepted_keys (int) – The mask of accepted key types (e.g., CFFKT_Pass).

  • converter (str) – The converter to use for passwords (e.g., "utf-8", "ascii", "utf-16-le").

Returns

Returns a key result if successful; otherwise CFFGetKeyResult.key_type is CFFKT_Invalid.

Return type

CFFGetKeyResult

Available since Cerbero Suite 6.3 and Cerbero Engine 3.3.

See also KeyMatch() and CFFGetKeyResult.

GetMappingAddress()int
Returns

Returns the address at which this object is mapped if available; otherwise returns INVALID_STREAM_OFFSET.

Return type

int

See also IsMapped() and SetMappingAddress().

GetMemoryUnpackLimit()int
Returns

Returns the maximum amount of bytes which can be allocated for in-memory decompression algorithms.

Return type

int

See also SetMemoryUnpackLimit().

GetObjectFormatName()str
Returns

Returns the file format name of the object if available; otherwise returns an empty string.

Return type

str

See also SetObjectFormatName().

GetObjectGenericFormatName()str
Returns

Returns the generic format name of the object if available; otherwise returns an empty string (e.g., the generic format name of HTML is XML).

Return type

str

See also SetObjectGenericFormatName().

GetObjectName()str
Returns

Returns the name of the object if available; otherwise returns an empty string.

Return type

str

See also SetObjectName().

GetObjectTypeName()str
Returns

Returns the type name of the object if available; otherwise returns an empty string.

Return type

str

See also SetObjectTypeName().

GetSize()int
Returns

Returns the size of the internally referenced container.

Return type

int

See also NTContainer.resize() and SetSize().

GetSpecialData(key: str, defval: Pro.Core.NTContainer = NTContainer())Pro.Core.NTContainer

Retrieves special data associated to the object.

Parameters
  • key (str) – The key of the data to retrieve.

  • defval (NTContainer) – The value to return if key is not present.

Returns

Returns the requested data if present; otherwise returns the default return value.

Return type

NTContainer

See also SetSpecialData().

GetStream()Pro.Core.NTContainer
Returns

Returns the internally referenced container.

Return type

NTContainer

See also GetSubStream(), Load() and ReplaceStream().

GetSubStream(offset_or_range: Union[Pro.Core.NTOffsetRange, int], optimize_for_speed_or_size: Union[bool, int] = INVALID_STREAM_OFFSET, optimize_for_speed: bool = True)Pro.Core.NTContainer

Retrieves a sub-stream of the internally referenced container.

Hint

This is a convenience method. Internally this method calls GetStream() followed by NTContainer.setRange().

Parameters
  • offset_or_range (Union[NTOffsetRange, int]) – Either the offset or the range.

  • optimize_for_speed_or_size (Union[bool, int]) – Either the size or the optimize_for_speed_or_size parameter.

  • optimize_for_speed (bool) – If True, might cause a deep copy under certain circumstances.

Returns

Returns the specified sub-stream.

Return type

NTContainer

Available since Cerbero Suite 7.2 and Cerbero Engine 4.2.

See also GetStream() and NTContainer.setRange().

GetTag()str
Returns

Returns the tag name set for debugging purposes if present; otherwise returns an empty string.

Return type

str

See also SetTag().

GetTypeName(Type: int)str

Returns the name of the specified type.

Parameters

Type (int) – The type for which to return the name.

Returns

Returns the type name if implemented; otherwise returns an empty string.

Return type

str

See also GetTypeNature().

GetTypeNature(Type: int)int

Returns the nature of the specified type.

Parameters

Type (int) – The type for which to return the nature.

Returns

Returns the nature of the type if successful; otherwise returns NATURE_UNKNOWN.

Return type

int

See also NATURE_BYTEARRAY, NATURE_NUMBER, NATURE_REAL and NATURE_STRING.

See also GetTypeName().

GetUnpackLimit()int
Returns

Returns the limit for decompression operations.

Return type

int

See also SetUnpackLimit().

GetUnpackNestingLimit()int
Returns

Returns the nesting limit for decompression operations.

Return type

int

See also SetUnpackNestingLimit().

HasFSSupport()bool
Returns

Returns True if file system support is available; otherwise returns False.

Return type

bool

Available since Cerbero Suite 7.0 and Cerbero Engine 4.0.

See also SetFSSupport().

Initialize(p: Pro.Core.CFFInitParams = CFFInitParams())bool

Provides a generic way to initialize an object.

Note

This method should be overridden by derived classes.

Parameters

p (CFFInitParams) – The initialization parameters.

Returns

Returns True if successful; otherwise returns False.

Return type

bool

Available since Cerbero Suite 7.2 and Cerbero Engine 4.2.

See also CFFInitParams and Load().

IsMapped()bool
Returns

Returns True if the object has a mapping address; otherwise returns False.

Return type

bool

See also GetMappingAddress() and SetMappingAddress().

IsModified()bool
Returns

Returns True if the object was modified; otherwise returns False.

Return type

bool

See also Modified().

IsNull()bool
Returns

Returns True if the object is uninitialized; otherwise returns False.

Return type

bool

See also Load().

IsTypeDynamicPersistent(Type: int)bool

Checks whether a type is persistently dynamic.

This means that the size of the type is dependent on the underlying data.

Parameters

Type (int) – The type to check.

Returns

Returns True if the type is persistently dynamic; otherwise returns False.

Return type

bool

KeyMatch(ki: Pro.Core.CFFKeyIndex, converter: str = 'utf-8')None

Marks a key as successfully having being used for decryption.

Parameters
  • ki (CFFKeyIndex) – The key index.

  • converter (str) – The converter to use for passwords (e.g., "utf-8", "ascii", "utf-16-le").

Available since Cerbero Suite 6.3 and Cerbero Engine 3.3.

See also GetKey() and CFFGetKeyResult.

Load(Stream: Pro.Core.NTContainer)bool

Loads the object data.

Note

In derived built-in classes this method also checks the signature file format.

Parameters

Stream (NTContainer) – The data to load.

Returns

Returns True if the data is accepted; otherwise returns False.

Return type

bool

See also Initialize(), GetStream() and ReplaceStream().

LocationDescription(offset: int)str

Provides a description for a specified location.

Note

This method is currently implemented only for executables such as PE, ELF and MachO.

Parameters

offset (int) – The location offset.

Returns

Returns the description if successful; otherwise returns an empty string.

Return type

str

Available since Cerbero Suite 7.3 and Cerbero Engine 4.3.

MakeStruct(header: Pro.Core.CFFHeader, name: str, offset: int, options: Optional[int] = None)Pro.Core.CFFStruct

Returns a CFFStruct instance.

Parameters
  • header (CFFHeader) – The header from which to fetch the definition of the structure.

  • name (str) – The name of the structure to return.

  • offset (int) – The offset at which to load the structure.

  • options (Optional[int]) – The options for the layout of the structure (e.g., CFFSO_Pack1).

Returns

Returns a valid structure if successful; otherwise returns an invalid structure.

Return type

CFFStruct

See also MakeStructArray(), CFFStruct and CFFHeader.

MakeStructArray(header: Pro.Core.CFFHeader, name: str, offset: int, nentries: int, options: Optional[int] = None)Pro.Core.CFFStruct

Returns an array of CFFStruct.

Parameters
  • header (CFFHeader) – The header from which to fetch the definition of the structure.

  • name (str) – The name of the structure to return.

  • offset (int) – The offset at which to load the structure.

  • nentries (int) – The number of array entries.

  • options (Optional[int]) – The options for the layout of the structure (e.g., CFFSO_Pack1).

Returns

Returns a valid structure if successful; otherwise returns an invalid structure.

Return type

CFFStruct

See also MakeStruct(), CFFStruct and CFFHeader.

Modified(b: bool)None

Sets the modified status for the object.

Parameters

b (bool) – If True, marks the object as modified; otherwise marks the object as unmodified.

See also IsModified().

NewContainer(size: int, reserve_size: int = 1024, max_size: int = 0)Pro.Core.NTContainer

Creates a new NTContainer object.

Whether the container will be using an internal memory buffer or a file on disk is decided on the basis of available memory resources at the time of the call.

Parameters
  • size (int) – The initial size of the container.

  • reserve_size (int) – The size to initially reserve for the container.

  • max_size (int) – The maximum size the container will ever reach. This is an optional parameter used to decide whether the container can operate on a memory buffer.

Returns

Returns the created container if successful; otherwise returns an invalid container.

Return type

NTContainer

See also newContainer() and NTContainer.

Notify(code: int)bool

Internally notifies the associated ScanProvider (if any) of a problem.

Parameters

code (int) – The notification code (e.g., CFFN_NoDecrypt).

Returns

Returns True if successful; otherwise returns False.

Return type

bool

See also ScanProvider.

RangesEnabled()bool
Returns

Returns True if ranges are enabled for the current object; otherwise returns False.

Return type

bool

Available since Cerbero Suite 6.2 and Cerbero Engine 3.2.

See also EnableRanges(), DisableRanges() and SetRange().

Read(offset: int, uSize: int)bytes

Reads data from the object.

Parameters
  • offset (int) – The offset of the data to read.

  • uSize (int) – The size of the data to read.

Returns

Returns the data read if successful; otherwise return an empty bytes object.

Return type

bytes

See also Write().

ReadNumber(offset: int, type: int, endianness: int, is_signed: bool)tuple

Reads an integer from the object.

Parameters
  • offset (int) – The offset of the integer to read.

  • type (int) – The type of integer to read.

  • endianness (int) – The endianness of the integer (ENDIANNESS_LITTLE or ENDIANNESS_BIG).

  • is_signed (bool) – If True, the integer is treated as signed.

Returns

Returns a tuple containing the value read and a boolean. The boolean value is True if successful; otherwise it is False.

Return type

tuple[int, bool]

See also ReadUInt8(), ReadUInt16(), ReadUInt32() and ReadUInt64().

ReadUInt16(offset: int, endianness: Optional[int] = None)tuple

Reads an unsigned 16-bit integer from the object.

Parameters
Returns

Returns a tuple containing the value read and a boolean. The boolean value is True if successful; otherwise it is False.

Return type

tuple[int, bool]

See also WriteUInt16(), ReadUInt8(), ReadUInt32(), ReadUInt64() and ReadNumber().

ReadUInt16String(offset: int, maxlen: int, endianness: int)tuple

Reads an utf-16 array from the object.

The method stops when either a null terminator or maxlen is reached.

Parameters
  • offset (int) – The offset of the array to read.

  • maxlen (int) – The maximum length of the entry in characters.

  • endianness (int) – The endianness of the array (ENDIANNESS_LITTLE or ENDIANNESS_BIG).

Returns

Returns a tuple containing the array read and a boolean. The boolean value is True if successful; otherwise it is False.

Return type

tuple[bytes, bool]

See also ReadUInt8String() and ReadUInt32String().

ReadUInt32(offset: int, endianness: Optional[int] = None)tuple

Reads an unsigned 32-bit integer from the object.

Parameters
Returns

Returns a tuple containing the value read and a boolean. The boolean value is True if successful; otherwise it is False.

Return type

tuple[int, bool]

See also WriteUInt32(), ReadUInt8(), ReadUInt16(), ReadUInt64() and ReadNumber().

ReadUInt32String(offset: int, maxlen: int, endianness: int)tuple

Reads an utf-32 array from the object.

The method stops when either a null terminator or maxlen is reached.

Parameters
  • offset (int) – The offset of the array to read.

  • maxlen (int) – The maximum length of the entry in characters.

  • endianness (int) – The endianness of the array (ENDIANNESS_LITTLE or ENDIANNESS_BIG).

Returns

Returns a tuple containing the array read and a boolean. The boolean value is True if successful; otherwise it is False.

Return type

tuple[bytes, bool]

See also ReadUInt8String() and ReadUInt16String().

ReadUInt64(offset: int, endianness: Optional[int] = None)tuple

Reads an unsigned 64-bit integer from the object.

Parameters
Returns

Returns a tuple containing the value read and a boolean. The boolean value is True if successful; otherwise it is False.

Return type

tuple[int, bool]

See also WriteUInt64(), ReadUInt8(), ReadUInt16(), ReadUInt32() and ReadNumber().

ReadUInt8(offset: int)tuple

Reads an unsigned 8-bit integer from the object.

Parameters

offset (int) – The offset of the value to read.

Returns

Returns a tuple containing the value read and a boolean. The boolean value is True if successful; otherwise it is False.

Return type

tuple[int, bool]

See also WriteUInt8(), ReadUInt16(), ReadUInt32(), ReadUInt64() and ReadNumber().

ReadUInt8String(offset: int, maxlen: int)tuple

Reads an utf-8 array from the object.

The method stops when either a null terminator or maxlen is reached.

Parameters
  • offset (int) – The offset of the array to read.

  • maxlen (int) – The maximum length of the entry in bytes.

Returns

Returns a tuple containing the array read and a boolean. The boolean value is True if successful; otherwise it is False.

Return type

tuple[bytes, bool]

See also ReadUInt16String() and ReadUInt32String().

ReplaceStream(NewStream: Pro.Core.NTContainer)None

Replaces the internal data of the object.

Parameters

NewStream (NTContainer) – The new internal container for the object.

See also Load() and GetStream().

SetDefaultEndianness(nEndiannessType: int)None

Sets the default endianness for the object.

Parameters

nEndiannessType (int) – The default endianness for the object (ENDIANNESS_LITTLE or ENDIANNESS_BIG).

See also GetDefaultEndianness().

SetDefaultStructOptions(options: int)None

Sets the default options for CFFStruct instances created from this object (e.g., CFFSO_Pack1).

These options are used whenever options are not explicitly specified when calling MakeStruct() or MakeStructArray().

Parameters

options (int) – The default options.

See also GetDefaultStructOptions().

SetFSSupport(b: bool)None

Sets the status of file system support.

Parameters

b (bool) – If True, enables file system support; otherwise disables it.

Available since Cerbero Suite 7.0 and Cerbero Engine 4.0.

See also HasFSSupport().

SetMappingAddress(mapping: int)None

Sets the address at which the object is mapped.

For instance, the mapping address is set for binaries loaded from a memory image.

Parameters

mapping (int) – The mapping address.

See also GetMappingAddress() and IsMapped().

SetMemoryUnpackLimit(limit: int)None

Sets the maximum amount of bytes which can be allocated for in-memory decompression algorithms.

Parameters

limit (int) – The limit in bytes.

See also GetMemoryUnpackLimit().

SetObjectFormatName(format: str)None

Sets the file format name of the object.

Parameters

format (str) – The file format name.

See also GetObjectFormatName().

SetObjectGenericFormatName(format: str)None

Sets the generic format name of the object (e.g., the generic format name of HTML is XML).

Parameters

format (str) – The generic format name.

See also GetObjectGenericFormatName().

SetObjectName(name: str)None

Sets the name of the object.

Parameters

name (str) – The object name.

See also GetObjectName().

SetObjectTypeName(type_name: str)None

Sets the type name of the object.

Parameters

type_name (str) – The object type name.

See also GetObjectTypeName().

SetRange(offset: int, size: int, val: int)None

Sets a range value for the current object.

Warning

This method is deprecated and should not be confused with NTContainer.setRange(). Use SetRangeValue() instead.

Parameters
  • offset (int) – The offset of the range.

  • size (int) – The size of the range.

  • val (int) – The value of the range (e.g., CFFRange_Used).

Available since Cerbero Suite 6.2 and Cerbero Engine 3.2.

See also SetRangeValue(), EnableRanges(), DisableRanges() and RangesEnabled().

SetRangeValue(offset: int, size: int, val: int)None

Sets a range value for the current object.

Parameters
  • offset (int) – The offset of the range.

  • size (int) – The size of the range.

  • val (int) – The value of the range (e.g., CFFRange_Used).

Available since Cerbero Suite 7.3 and Cerbero Engine 4.3.

See also EnableRanges(), DisableRanges() and RangesEnabled().

SetSize(NewSize: int)bool

Resizes the internal data of the object.

Parameters

NewSize (int) – The new size of the data.

Returns

Returns True if successful; otherwise returns False.

Return type

bool

See also NTContainer.setResizable() and GetSize().

SetSpecialData(key: str, value: Pro.Core.NTContainer)None

Sets special data associated to the object.

Parameters
  • key (str) – The key of the data to set.

  • value (NTContainer) – The data.

See also GetSpecialData().

SetTag(t: str)None

Sets the tag name of the object for debugging purposes

Parameters

t (str) – The tag name.

See also GetTag().

SetUnpackLimit(limit: int)None

Sets the limit for decompression operations.

Parameters

limit (int) – The limit in bytes.

See also GetUnpackLimit().

SetUnpackNestingLimit(limit: int)None

Sets the nesting limit for decompression operations.

Parameters

limit (int) – The limit.

See also GetUnpackNestingLimit().

Shift(uSize: int)bool

Appends uSize bytes at the end of the object data and sets them to zero.

Parameters

uSize (int) – The number of bytes to append.

Returns

Returns True if successful; otherwise returns False.

Return type

bool

See also NTContainer.shift() and Align().

ToBuffer(offset: int, method: int = Bufferize_Forwards)Pro.Core.CFFBuffer

Returns a CFFBuffer that reads from the object.

Parameters
  • offset (int) – The start offset.

  • method (int) – The buffering method to use. Defaults to Bufferize_Forwards.

Returns

Returns the CFFBuffer instance.

Return type

CFFBuffer

See also CFFBuffer.

ToUInt16(n: int)int

Applies the default endianness of the object to the 16-bit input integer.

The bytes of the integer will be inverted only if the default endianness of the object doesn’t match the endianness of the current platform.

Parameters

n (int) – The input integer.

Returns

Returns the inverted integer if the the default endianness of the object doesn’t match the endianness of the current platform; otherwise returns the input integer.

Return type

int

See also ToUInt32() and ToUInt64().

ToUInt32(n: int)int

Applies the default endianness of the object to the 32-bit input integer.

Parameters

n (int) – The input integer.

Returns

Returns the inverted integer if the the default endianness of the object doesn’t match the endianness of the current platform; otherwise returns the input integer.

Return type

int

See also ToUInt16() and ToUInt64().

ToUInt64(n: int)int

Applies the default endianness of the object to the 64-bit input integer.

Parameters

n (int) – The input integer.

Returns

Returns the inverted integer if the the default endianness of the object doesn’t match the endianness of the current platform; otherwise returns the input integer.

Return type

int

See also ToUInt16() and ToUInt32().

ValidRange(offset: int, Size: int)bool

Checks the validity of a range in the context of the object.

Parameters
  • offset (int) – The offset of the range to check.

  • Size (int) – The size of the range to check.

Returns

Returns True if the range is valid; otherwise returns False.

Return type

bool

See also NTContainer.validRange().

Write(offset: int, bytes_or_uSize: Union[bytes, int], bytes: Optional[bytes] = None)bool

Writes data to the object.

Parameters
  • offset (int) – The offset at which to write the data.

  • bytes_or_uSize (Union[bytes, int]) – Either the data to write or the number of bytes to write.

  • bytes (Optional[bytes]) – The data to write.

Returns

Returns True if successful; otherwise returns False.

Return type

bool

See also Read().

WriteUInt16(offset: int, n_or_nEndiannessType: int, n: Optional[int] = None)bool

Writes an unsigned 16-bit integer to the object.

Parameters
  • offset (int) – The offset at which to write the value.

  • n_or_nEndiannessType (int) – Either the value to write or the endianness (ENDIANNESS_LITTLE or ENDIANNESS_BIG) to use when writing the value. If the endianness is not specified, the value is written using the default endianness of the object.

  • n (Optional[int]) – The value to write.

Returns

Returns True if successful; otherwise returns False.

Return type

bool

See also ReadUInt16(), WriteUInt8(), WriteUInt32() and WriteUInt64().

WriteUInt32(offset: int, n_or_nEndiannessType: int, n: Optional[int] = None)bool

Writes an unsigned 32-bit integer to the object.

Parameters
  • offset (int) – The offset at which to write the value.

  • n_or_nEndiannessType (int) – Either the value to write or the endianness (ENDIANNESS_LITTLE or ENDIANNESS_BIG) to use when writing the value. If the endianness is not specified, the value is written using the default endianness of the object.

  • n (Optional[int]) – The value to write.

Returns

Returns True if successful; otherwise returns False.

Return type

bool

See also ReadUInt32(), WriteUInt8(), WriteUInt16() and WriteUInt64().

WriteUInt64(offset: int, n_or_nEndiannessType: int, n: Optional[int] = None)bool

Writes an unsigned 64-bit integer to the object.

Parameters
  • offset (int) – The offset at which to write the value.

  • n_or_nEndiannessType (int) – Either the value to write or the endianness (ENDIANNESS_LITTLE or ENDIANNESS_BIG) to use when writing the value. If the endianness is not specified, the value is written using the default endianness of the object.

  • n (Optional[int]) – The value to write.

Returns

Returns True if successful; otherwise returns False.

Return type

bool

See also ReadUInt64(), WriteUInt8(), WriteUInt16() and WriteUInt32().

WriteUInt8(offset: int, n: int)bool

Writes an unsigned 8-bit integer to the object.

Parameters
  • offset (int) – The offset at which to write the value.

  • n (int) – The value to write.

Returns

Returns True if successful; otherwise returns False.

Return type

bool

See also ReadUInt8(), WriteUInt16(), WriteUInt32() and WriteUInt64().

CFFPtrMaxSize: Final[int]

The maximum supported pointer size.

This value is reserved for future use.

See also CFFObject.

CFFPtrMinSize: Final[int]

The minimum supported pointer size.

This value is reserved for future use.

See also CFFObject.

CFFPtrSize16: Final[int]

16-bit pointer size.

This value is reserved for future use.

See also CFFObject.

CFFPtrSize32: Final[int]

32-bit pointer size.

This value is reserved for future use.

See also CFFObject.

CFFPtrSize64: Final[int]

64-bit pointer size.

This value is reserved for future use.

See also CFFObject.

CFFRange_Custom: Final[int]

Range value.

Available since Cerbero Suite 6.2 and Cerbero Engine 3.2.

See also CFFObject.SetRange().

CFFRange_Last: Final[int]

Last range value plus one.

Available since Cerbero Suite 6.2 and Cerbero Engine 3.2.

CFFRange_Unknown: Final[int]

Range value (alias of CFFRange_Unreferenced).

Available since Cerbero Suite 6.2 and Cerbero Engine 3.2.

See also CFFObject.SetRange().

CFFRange_Unreferenced: Final[int]

Range value.

Available since Cerbero Suite 6.2 and Cerbero Engine 3.2.

See also CFFObject.SetRange().

CFFRange_Unused: Final[int]

Range value.

Available since Cerbero Suite 6.2 and Cerbero Engine 3.2.

See also CFFObject.SetRange().

CFFRange_Used: Final[int]

Range value.

Available since Cerbero Suite 6.2 and Cerbero Engine 3.2.

See also CFFObject.SetRange().

CFFSO_Clang: Final[int]

This flag specifies that the structure was generated by the Clang compiler.

See also CFFObject.SetDefaultStructOptions() and CFFStruct.

CFFSO_CompilerMask: Final[int]

Compiler mask for the flags of the structure.

See also CFFObject.SetDefaultStructOptions() and CFFStruct.

CFFSO_EndianBig: Final[int]

This flag specifies that the structure is big-endian.

See also CFFObject.SetDefaultStructOptions() and CFFStruct.

CFFSO_EndianDefault: Final[int]

This flag specifies that the structure uses the default endianness.

See also CFFObject.SetDefaultStructOptions() and CFFStruct.

CFFSO_EndianLittle: Final[int]

This flag specifies that the structure is little-endian.

See also CFFObject.SetDefaultStructOptions() and CFFStruct.

CFFSO_EndiannessBig: Final[int]

This flag specifies that the structure is big-endian.

See also CFFObject.SetDefaultStructOptions() and CFFStruct.

CFFSO_EndiannessDefault: Final[int]

This flag specifies that the structure uses the default endianness.

See also CFFObject.SetDefaultStructOptions() and CFFStruct.

CFFSO_EndiannessLittle: Final[int]

This flag specifies that the structure is little-endian.

See also CFFObject.SetDefaultStructOptions() and CFFStruct.

CFFSO_EndiannessMask: Final[int]

Endianness mask for the flags of the structure.

See also CFFObject.SetDefaultStructOptions() and CFFStruct.

CFFSO_GCC: Final[int]

This flag specifies that the structure was generated by the GCC compiler.

See also CFFObject.SetDefaultStructOptions() and CFFStruct.

CFFSO_NoCompiler: Final[int]

This flag specifies that the structure wasn’t generated by a specific compiler.

See also CFFObject.SetDefaultStructOptions() and CFFStruct.

CFFSO_NoPlatform: Final[int]

This flag specifies that the structure isn’t bound to specific platform.

See also CFFObject.SetDefaultStructOptions() and CFFStruct.

CFFSO_Pack1: Final[int]

This flag specifies that the structure has an alignment of 1.

See also CFFObject.SetDefaultStructOptions() and CFFStruct.

CFFSO_Pack16: Final[int]

This flag specifies that the structure has an alignment of 16.

See also CFFObject.SetDefaultStructOptions() and CFFStruct.

CFFSO_Pack2: Final[int]

This flag specifies that the structure has an alignment of 2.

See also CFFObject.SetDefaultStructOptions() and CFFStruct.

CFFSO_Pack4: Final[int]

This flag specifies that the structure has an alignment of 4.

See also CFFObject.SetDefaultStructOptions() and CFFStruct.

CFFSO_Pack8: Final[int]

This flag specifies that the structure has an alignment of 8.

See also CFFObject.SetDefaultStructOptions() and CFFStruct.

CFFSO_PackMask: Final[int]

Alignment mask for the flags of the structure.

See also CFFObject.SetDefaultStructOptions() and CFFStruct.

CFFSO_PackNone: Final[int]

This flag specifies that the structure doesn’t have an alignment.

See also CFFObject.SetDefaultStructOptions() and CFFStruct.

CFFSO_PlatformMask: Final[int]

Platform mask for the flags of the structure.

See also CFFObject.SetDefaultStructOptions() and CFFStruct.

CFFSO_Pointer16: Final[int]

This flag specifies that the pointer size of the structure is 16-bits.

See also CFFObject.SetDefaultStructOptions() and CFFStruct.

CFFSO_Pointer32: Final[int]

This flag specifies that the pointer size of the structure is 32-bits.

See also CFFObject.SetDefaultStructOptions() and CFFStruct.

CFFSO_Pointer64: Final[int]

This flag specifies that the pointer size of the structure is 64-bits.

See also CFFObject.SetDefaultStructOptions() and CFFStruct.

CFFSO_PointerDefault: Final[int]

This flag specifies that the pointer size of the structure is the default one for the object.

See also CFFObject.SetDefaultStructOptions() and CFFStruct.

CFFSO_PointerMask: Final[int]

Pointer mask for the flags of the structure.

See also CFFObject.SetDefaultStructOptions() and CFFStruct.

CFFSO_VC: Final[int]

This flag specifies that the structure was generated by the Visual C++ compiler.

See also CFFObject.SetDefaultStructOptions() and CFFStruct.

CFFSO_Windows: Final[int]

This flag specifies that the structure was generated for the Windows platform.

See also CFFObject.SetDefaultStructOptions() and CFFStruct.

class CFFStruct

This class represents a data structure and references a CFFObject instance.

Instances of CFFStruct can be returned from CFFObject derived classes or by using CFFObject.MakeStruct() in combination with an instance of CFFHeader.

Example:

from Pro.Core import *
from Pro.PE import *

def printDOSHeader(fname):
    c = createContainerFromFile(fname)
    if c.isNull():
        return
    pe = PEObject()
    if not pe.Load(c):
        return
    out = NTTextBuffer()
    pe.DosHeader().Dump(out) # CFFStruct.Dump
    print(out.buffer)

See also CFFStruct, CFFHeader and CFFObject.MakeStruct().

Methods:

Add(i)

If the current instance represents an array of structures, this method changes which entry is currently referenced.

At(i)

Retrieves a specific structure among an array of structures.

Bytes(i_or_name)

Returns the byte-array representation of a member of the structure.

Context()

Returns the context helper class for the current structure.

Count()

Returns the number of entries in the current array of structures.

Dump(out)

Outputs the members of the structure to a text stream according to their type nature.

Equals(s)

Checks whether two structures reference the same internal data.

Fill(c_or_i_or_name[, c])

Fills the entire structure or a member of it with a specified 8-bit value.

Flags(i_or_name)

Returns the flags for a member of the structure.

GetOffset()

Returns the start offset of the structure.

HasDynamicSize()

Checks whether the structure contains members whose size depends upon the underlying data.

HasFlags([i_or_name])

Checks whether at least one member or a specific member of the structure has flags associated with it.

IsArray()

Returns True if the current instance represents an array of structures; otherwise returns False.

IsFixed()

Returns True if the structures has a fixed size; otherwise returns False.

IsNull()

Returns True if the structure is invalid; otherwise returns False.

IsValid()

Returns True if the structure is valid; otherwise returns False.

LongestMemberName()

Returns the length of the longer member name of the structure.

MakeSingle()

Converts an array of structure into a single structure.

MemberCount()

Returns the number of members in the structure.

MemberName(i)

Retrieves the name of a member of the structure by its index.

MemberNature(i_or_name)

Retrieves the type nature of a member of the structure.

MemberOffset(i_or_name)

Retrieves the offset of a member of the structure.

MemberPosition(name)

Retrieves the index of a member of the structure.

MemberSize(i_or_name)

Retrieves the size of a member of the structure.

MemberType(i)

Retrieves the type of a member of the structure.

MemberTypeName(i)

Retrieves the type name of a member of the structure.

MembersWithFlags()

Returns a list of indexes of those members in the structure which have flags.

Num(i_or_name)

Returns the numeric representation of a member of the structure.

Object()

Returns the internally referenced object.

Offset()

Returns the start offset of the structure.

Raw(i_or_name)

Returns the raw data of a member of the structure.

Set(i_or_name, bytes_or_number_or_str)

Sets a member of the structure.

SetContext(ctx)

Sets the context helper class for the current structure.

SetCount(n)

Sets the number of entries in the array of structures.

SetMemberCount(n)

Sets the number of members that the structure has.

SetObject(obj)

Sets the internally referenced object.

SetOffset(o)

Sets the start offset of the structure.

SetRaw(i_or_name, bytes)

Sets the raw data of a member of the structure.

Size()

Returns the size of the structure.

Str(i_or_name[, align_nums])

Returns the string representation of a member of the structure.

StructName()

Returns the name of the structure.

SubStruct(i_or_name)

Retrieves a sub-structure of the current structure.

TotalSize()

Returns the total size occupied by the array of structures.

Uns(i_or_name)

Returns the unsigned integer representation of a member of the structure.

Zero([i_or_name])

Fills the entire structure or a member of it with zero.

iterator()

Returns an iterator for an array of structures.

Add(i: int)Pro.Core.CFFStruct

If the current instance represents an array of structures, this method changes which entry is currently referenced.

Parameters

i (int) – The iterator can be increased by a negative amount.

Returns

Returns the requested structure if within the limit of available entries; otherwise returns an invalid structure.

Return type

CFFStruct

See also At(), Count() and iterator().

At(i: int)Pro.Core.CFFStruct

Retrieves a specific structure among an array of structures.

Parameters

i (int) – The index of the structure to retrieve.

Returns

Returns the requested structure if within the limit of available entries; otherwise returns an invalid structure.

Return type

CFFStruct

See also Count(), At() and iterator().

Bytes(i_or_name: Union[int, str])bytes

Returns the byte-array representation of a member of the structure.

This method automatically handles the endianness of the requested data.

Parameters

i_or_name (Union[int, str]) – The index or name of the member of the structure.

Returns

Returns the requested data if successful; otherwise returns an empty bytes object.

Return type

bytes

See also Set(), Str(), Num() and Raw().

Context()Pro.Core.CFFContext
Returns

Returns the context helper class for the current structure.

Return type

CFFContext

See also SetContext().

Count()int
Returns

Returns the number of entries in the current array of structures.

Return type

int

See also SetCount(), At() and iterator().

Dump(out: Pro.Core.NTTextStream)bool

Outputs the members of the structure to a text stream according to their type nature.

Parameters

out (NTTextStream) – The text stream for the output.

Returns

Returns True if successful; otherwise returns False.

Return type

bool

See also NTTextStream.

Equals(s: Pro.Core.CFFStruct)bool

Checks whether two structures reference the same internal data.

Parameters

s (CFFStruct) – The other structure.

Returns

Returns True if the structure reference the same internal data; otherwise returns False.

Return type

bool

Fill(c_or_i_or_name: Union[int, str], c: Optional[int] = None)bool

Fills the entire structure or a member of it with a specified 8-bit value.

Parameters
  • c_or_i_or_name (Union[int, str]) – Either the 8-bit value used to fill the structure or the index or name of the member of the structure to fill.

  • c (Optional[int]) – The 8-bit value used to fill the member of the structure.

Returns

Returns True if successful; otherwise returns False.

Return type

bool

See also Zero().

Flags(i_or_name: Union[int, str])Pro.Core.CFFFlags

Returns the flags for a member of the structure.

Parameters

i_or_name (Union[int, str]) – The index or name of the member of the structure.

Returns

Returns a valid CFFFlags instance if successful; otherwise returns an invalid CFFFlags instance.

Return type

CFFFlags

See also HasFlags(), MembersWithFlags() and CFFFlags.

GetOffset()int
Returns

Returns the start offset of the structure.

Return type

int

See also Offset(), SetOffset() and Size().

HasDynamicSize()bool

Checks whether the structure contains members whose size depends upon the underlying data.

Note

In an array of dynamic structures every entry can potentially have a different size than the other entries. Knowing whether or not a structure is dynamic is important for optimization purposes: skipping multiple entries in an array of dynamic structures requires to read the data for each entry to perform the calculation (e.g., Add()).

Returns

Returns True if the structure contains members whose size depends upon the underlying data; otherwise returns False.

Return type

bool

See also Add() and At().

HasFlags(i_or_name: Optional[Union[int, str]] = None)bool

Checks whether at least one member or a specific member of the structure has flags associated with it.

Parameters

i_or_name (Optional[Union[int, str]]) – The index or name of the member of the structure.

Returns

Returns True if flags are available; otherwise returns False.

Return type

bool

See also Flags(), MembersWithFlags() and CFFFlags.

IsArray()bool
Returns

Returns True if the current instance represents an array of structures; otherwise returns False.

Return type

bool

See also Count() and MakeSingle().

IsFixed()bool
Returns

Returns True if the structures has a fixed size; otherwise returns False.

Return type

bool

IsNull()bool
Returns

Returns True if the structure is invalid; otherwise returns False.

Return type

bool

See also IsValid().

IsValid()bool
Returns

Returns True if the structure is valid; otherwise returns False.

Return type

bool

See also IsNull().

LongestMemberName()int
Returns

Returns the length of the longer member name of the structure.

Return type

int

See also MemberName().

MakeSingle()Pro.Core.CFFStruct

Converts an array of structure into a single structure.

Returns

Returns the currently referenced structure in the array as a single structure.

Return type

CFFStruct

See also IsArray() and Count().

MemberCount()int
Returns

Returns the number of members in the structure.

Return type

int

See also SetMemberCount().

MemberName(i: int)str

Retrieves the name of a member of the structure by its index.

Parameters

i (int) – The index of the member of the structure.

Returns

Returns the member name if successful; otherwise returns an empty string.

Return type

str

See also MemberPosition(), MemberOffset() and MemberSize().

MemberNature(i_or_name: Union[int, str])int

Retrieves the type nature of a member of the structure.

Parameters

i_or_name (Union[int, str]) – The index or name of the member of the structure.

Returns

Returns the type nature if successful; otherwise returns NATURE_UNKNOWN.

Return type

int

See also MemberName(), MemberOffset() and MemberSize().

MemberOffset(i_or_name: Union[int, str])int

Retrieves the offset of a member of the structure.

Parameters

i_or_name (Union[int, str]) – The index or name of the member of the structure.

Returns

Returns the offset if successful; otherwise returns INVALID_STREAM_OFFSET.

Return type

int

See also MemberName(), MemberSize() and MemberPosition().

MemberPosition(name: str)int

Retrieves the index of a member of the structure.

Parameters

name (str) – The name of the member of the structure.

Returns

Returns the index if successful; otherwise returns -1.

Return type

int

See also MemberName(), MemberOffset() and MemberSize().

MemberSize(i_or_name: Union[int, str])int

Retrieves the size of a member of the structure.

Parameters

i_or_name (Union[int, str]) – The index or name of the member of the structure.

Returns

Returns the size if successful; otherwise returns 0.

Return type

int

See also MemberOffset(), MemberName() and MemberPosition().

MemberType(i: int)int

Retrieves the type of a member of the structure.

Parameters

i (int) – The index or name of the member of the structure.

Returns

Returns the type if successful; otherwise returns 0xFFFFFFFFFFFFFFFF.

Return type

int

See also MemberTypeName(), MemberName(), MemberOffset() and MemberSize().

MemberTypeName(i: int)str

Retrieves the type name of a member of the structure.

Parameters

i (int) – The index or name of the member of the structure.

Returns

Returns the type name if successful; otherwise returns an empty string.

Return type

str

See also MemberType(), MemberName(), MemberOffset() and MemberSize().

MembersWithFlags()Pro.Core.NTIntList
Returns

Returns a list of indexes of those members in the structure which have flags.

Return type

NTIntList

See also HasFlags(), Flags() and CFFFlags.

Num(i_or_name: Union[int, str])int

Returns the numeric representation of a member of the structure.

Important

If the member to retrieve is an unsigned integer which doesn’t exceed 64 bit in size, then the slightly faster Uns() method can be used instead of Num().

This method automatically handles the endianness of the requested data.

Parameters

i_or_name (Union[int, str]) – The index or name of the member of the structure.

Returns

Returns the numeric value if successful; otherwise returns 0.

Return type

int

See also Set(), Uns(), Str(), Bytes() and Raw().

Object()Pro.Core.CFFObject
Returns

Returns the internally referenced object.

Return type

CFFObject

See also SetObject().

Offset()int
Returns

Returns the start offset of the structure.

Return type

int

See also GetOffset(), SetOffset() and Size().

Raw(i_or_name: Union[int, str])bytes

Returns the raw data of a member of the structure.

Parameters

i_or_name (Union[int, str]) – The index or name of the member of the structure.

Returns

Returns the requested data if successful; otherwise returns an empty bytes object.

Return type

bytes

See also SetRaw().

Set(i_or_name: Union[int, str], bytes_or_number_or_str: Union[bytes, int, str])bool

Sets a member of the structure.

This method automatically handles the endianness of the data to set.

Parameters
  • i_or_name (Union[int, str]) – The index or name of the member of the structure.

  • bytes_or_number_or_str (Union[bytes, int, str]) – The data to set. This value is automatically converted to the raw data.

Returns

Returns True if successful; otherwise returns False.

Return type

bool

See also Str(), Num(), Bytes() and Raw().

SetContext(ctx: Pro.Core.CFFContext)None

Sets the context helper class for the current structure.

Parameters

ctx (CFFContext) – The context helper class to set.

See also Context().

SetCount(n: int)None

Sets the number of entries in the array of structures.

Parameters

n (int) – The number of entries to set.

See also Count(), At() and iterator().

SetMemberCount(n: int)None

Sets the number of members that the structure has.

Note

This method can only reduce the number of members initially available in the structure and it’s used to adapt structures which have different number of members depending on a version or size field.

Parameters

n (int) – The number of members to set.

See also MemberCount().

SetObject(obj: Pro.Core.CFFObject)None

Sets the internally referenced object.

Parameters

obj (CFFObject) – The object to set.

See also Object().

SetOffset(o: int)None

Sets the start offset of the structure.

Parameters

o (int) – The start offset to set.

See also Offset(), GetOffset() and Size().

SetRaw(i_or_name: Union[int, str], bytes: bytes)bool

Sets the raw data of a member of the structure.

Parameters
  • i_or_name (Union[int, str]) – The index or name of the member of the structure.

  • bytes (bytes) – The raw data to set.

Returns

Returns True if successful; otherwise returns False.

Return type

bool

See also Raw().

Size()int
Returns

Returns the size of the structure.

Return type

int

See also TotalSize(), Offset() and GetOffset().

Str(i_or_name: Union[int, str], align_nums: bool = False)str

Returns the string representation of a member of the structure.

This method automatically handles the endianness of the requested data.

Parameters
  • i_or_name (Union[int, str]) – The index or name of the member of the structure.

  • align_nums (bool) – If True, aligns numbers using zero-padding.

Returns

Returns the string if successful; otherwise returns an empty string.

Return type

str

See also Set(), Num(), Bytes() and Raw().

StructName()str
Returns

Returns the name of the structure.

Return type

str

SubStruct(i_or_name: Union[int, str])Pro.Core.CFFStruct

Retrieves a sub-structure of the current structure.

This method is available only to fixed size structures.

Parameters

i_or_name (Union[int, str]) – The name or index of the sub-structure to retrieve.

Returns

Returns the sub-structure if successful; otherwise returns an invalid structure.

Return type

CFFStruct

See also IsFixed().

TotalSize()int
Returns

Returns the total size occupied by the array of structures.

Return type

int

See also Size(), Offset() and GetOffset().

Uns(i_or_name: Union[int, str])int

Returns the unsigned integer representation of a member of the structure.

Important

The maximum supported size for unsigned integers returned by this method is 64 bits. To retrieve larger or negative integers Num() must be used. The difference between the two methods is that Uns() is slightly faster than Num().

This method automatically handles the endianness of the requested data.

Parameters

i_or_name (Union[int, str]) – The index or name of the member of the structure.

Returns

Returns the numeric value if successful; otherwise returns 0.

Return type

int

Available since Cerbero Suite 5.0 and Cerbero Engine 2.0.

See also Set(), Num(), Str(), Bytes() and Raw().

Zero(i_or_name: Optional[Union[int, str]] = None)bool

Fills the entire structure or a member of it with zero.

Parameters

i_or_name (Optional[Union[int, str]]) – The index or name of the member of the structure.

Returns

Returns True if successful; otherwise returns False.

Return type

bool

See also Fill().

iterator()Pro.Core.CFFStructIt
Returns

Returns an iterator for an array of structures.

Return type

CFFStructIt

See also CFFStructIt.

class CFFStructIt(s: Pro.Core.CFFStruct)

Iterator for an array of CFFStruct structures.

Parameters

s (CFFStruct) – The array of structures to iterate over.

See also CFFStruct.iterator() and CFFStruct.

Methods:

HasNext()

Returns True if there is an entry after the current one; otherwise returns False.

Next()

Returns the entry after the current one and moves the iterator if successful; otherwise returns an invalid structure.

hasNext()

Returns True if there is an entry after the current one; otherwise returns False.

next()

Returns the entry after the current one and moves the iterator if successful; otherwise returns an invalid structure.

HasNext()bool
Returns

Returns True if there is an entry after the current one; otherwise returns False.

Return type

bool

See also Next(), hasNext(), next() and CFFStruct.

Next()Pro.Core.CFFStruct
Returns

Returns the entry after the current one and moves the iterator if successful; otherwise returns an invalid structure.

Return type

CFFStruct

See also HasNext(), hasNext(), next() and CFFStruct.

hasNext()bool
Returns

Returns True if there is an entry after the current one; otherwise returns False.

Return type

bool

See also next() and CFFStruct.

next()Pro.Core.CFFStruct
Returns

Returns the entry after the current one and moves the iterator if successful; otherwise returns an invalid structure.

Return type

CFFStruct

See also hasNext() and CFFStruct.

class CFFStructList

List of CFFStruct elements.

Methods:

append(value)

Inserts value at the end of the list.

at(i)

Returns the item at index position i in the list.

clear()

Removes all items from the list.

contains(value)

Checks the presence of an element in the list.

count(value)

Returns the number of occurrences of value in the list.

indexOf(value[, start])

Searches for an element in the list.

insert(i, value)

Inserts value at index position i in the list.

isEmpty()

Checks whether the list is empty.

iterator()

Creates an iterator for the list.

removeAll(value)

Removes all occurrences of value in the list and returns the number of entries removed.

removeAt(i)

Removes the item at index position i.

reserve(alloc)

Reserve space for alloc elements.

size()

Returns the number of items in the list.

takeAt(i)

Removes the item at index position i and returns it.

append(value: Pro.Core.CFFStruct)None

Inserts value at the end of the list.

Parameters

value (CFFStruct) – The value to add to the list.

See also insert().

at(i: int)Pro.Core.CFFStruct

Returns the item at index position i in the list. i must be a valid index position in the list (i.e., 0 <= i < size()).

Parameters

i (int) – The index of the element to return.

Returns

Returns the requested element.

Return type

CFFStruct

clear()None

Removes all items from the list.

contains(value: Pro.Core.CFFStruct)bool

Checks the presence of an element in the list.

Parameters

value (CFFStruct) – The value to check for.

Returns

Returns True if the list contains an occurrence of value; otherwise returns False.

Return type

bool

See also indexOf() and count().

count(value: Pro.Core.CFFStruct)int

Returns the number of occurrences of value in the list.

Parameters

value (CFFStruct) – The value to count.

Returns

Returns the number of occurrences.

Return type

int

See also indexOf() and contains().

indexOf(value: Pro.Core.CFFStruct, start: int = 0)int

Searches for an element in the list.

Parameters
  • value (CFFStruct) – The value to search for.

  • start (int) – The start index.

Returns

Returns the index position of the first occurrence of value in the list. Returns -1 if no item was found.

Return type

int

See also contains().

insert(i: int, value: Pro.Core.CFFStruct)None

Inserts value at index position i in the list. If i is 0, the value is prepended to the list. If i is size(), the value is appended to the list.

Parameters
  • i (int) – The position at which to add the value.

  • value (CFFStruct) – The value to add.

See also append() and removeAt().

isEmpty()bool

Checks whether the list is empty.

Returns

Returns True if the list contains no items; otherwise returns False.

Return type

bool

See also size().

iterator()Pro.Core.CFFStructListIt

Creates an iterator for the list.

Returns

Returns the iterator.

Return type

CFFStructListIt

removeAll(value: Pro.Core.CFFStruct)int

Removes all occurrences of value in the list and returns the number of entries removed.

Parameters

value (CFFStruct) – The value to remove from the list.

Returns

Returns the number of entries removed.

Return type

int

See also removeAt().

removeAt(i: int)None

Removes the item at index position i. i must be a valid index position in the list (i.e., 0 <= i < size()).

Parameters

i (int) – The index of the item to remove.

See also removeAll().

reserve(alloc: int)None

Reserve space for alloc elements. Calling this method doesn’t change the size of the list.

Parameters

alloc (int) – The amount of elements to reserve space for.

size()int
Returns

Returns the number of items in the list.

Return type

int

See also isEmpty().

takeAt(i: int)Pro.Core.CFFStruct

Removes the item at index position i and returns it. i must be a valid index position in the list (i.e., 0 <= i < size()).

Parameters

i (int) – The index of the element to remove from the list.

Returns

Returns the removed element. If you don’t use the return value, removeAt() is more efficient.

Return type

CFFStruct

See also removeAt().

class CFFStructListIt(obj: Pro.Core.CFFStructList)

Iterator class for CFFStructList.

Parameters

obj (CFFStructList) – The object to iterate over.

Methods:

hasNext()

Returns True if there is at least one item ahead of the iterator, i.e. the iterator is not at the back of the container; otherwise returns False.

hasPrevious()

Returns True if there is at least one item behind the iterator, i.e. the iterator is not at the front of the container; otherwise returns False.

next()

Returns the next item and advances the iterator by one position.

previous()

Returns the previous item and moves the iterator back by one position.

toBack()

Moves the iterator to the back of the container (after the last item).

toFront()

Moves the iterator to the front of the container (before the first item).

hasNext()bool
Returns

Returns True if there is at least one item ahead of the iterator, i.e. the iterator is not at the back of the container; otherwise returns False.

Return type

bool

See also hasPrevious() and next().

hasPrevious()bool
Returns

Returns True if there is at least one item behind the iterator, i.e. the iterator is not at the front of the container; otherwise returns False.

Return type

bool

See also hasNext() and previous().

next()Pro.Core.CFFStruct
Returns

Returns the next item and advances the iterator by one position.

Return type

CFFStruct

See also hasNext() and previous().

previous()Pro.Core.CFFStruct
Returns

Returns the previous item and moves the iterator back by one position.

Return type

CFFStruct

See also hasPrevious() and next().

toBack()None

Moves the iterator to the back of the container (after the last item).

See also toFront() and previous().

toFront()None

Moves the iterator to the front of the container (before the first item).

See also toBack() and next().

CFF_ARRAY_NULL_TERMINATED: Final[int]

If specified, makes an array of structure be null-terminated.

See also CFFObject.MakeStructArray().

class CFSEntry(iface: Optional[Pro.Core.CFSEntryInterface] = None)

Wrapper class for a CFSEntryInterface instance.

Parameters

iface (Optional[CFSEntryInterface]) – The CFSEntryInterface instance to be wrapped.

Important

When wrapping an instance of CFSEntryInterface, it is necessary to call __disown__() on it to avoid Python freeing the allocated object. The object will be freed automatically by the CFSEntry wrapper.

Available since Cerbero Suite 7.0 and Cerbero Engine 4.0.

See also CFSEntryInterface.

Attributes:

AccessTime

Access time type.

CreationTime

Creation time type.

Directory

Directory entry type.

Drive

Drive entry type.

FastData

Fast data flag.

File

File entry type.

Invalid

Invalid entry type.

ModificationTime

Modification time type.

Methods:

AddProperty(name, value[, offset])

Adds a property to the entry.

Data([wo])

Retrieves the data associated with the entry.

DataOffset()

Returns the offset of the entry data if available; otherwise returns INVALID_STREAM_OFFSET.

DataSize()

Returns the size of the entry data if available; otherwise returns 0.

Flags()

Returns the flags of the entry (e.g., FastData).

HasData()

Returns True if entry data is available; otherwise returns False.

HasDataSize()

Returns True if entry data size is available; otherwise returns False.

IsNull()

Returns True if the entry is invalid; otherwise returns False.

IsValid()

Returns True if the entry is valid; otherwise returns False.

Name()

Returns the entry name if available; otherwise returns an empty string.

Path()

Returns the full path of the entry, including the file name.

Property(name)

Retrieves a property of the entry.

PropertyCount()

Returns the number of properties available.

PropertyNames()

Returns the list of property names.

PropertyOffset(name)

Retrieves the offset of a property.

SetData(data)

Sets the data of the entry.

SetDataOffset(offset)

Sets the offset of the entry data.

SetDataSize(size)

Sets the size of the entry data.

SetFlags(flags)

Sets the flags of the entry.

SetName(name)

Sets the name of the entry.

SetPath(path)

Sets the full path of the entry.

SetTime(ttype, t)

Sets a specific file time of the entry.

SetType(type)

Sets the type of the entry.

Time(ttype)

Retrieves a specific file time of the entry.

ToXML([sort, include_data])

Converts the entry to an XML string.

Type()

Returns the entry type (e.g., Directory).

AccessTime: Final[int]

Access time type.

See also Time() and SetTime().

AddProperty(name: str, value: Optional[Union[int, float, bool, bytes, str]], offset: int = INVALID_STREAM_OFFSET)None

Adds a property to the entry.

Parameters
  • name (str) – The name of the property.

  • value (BasicType) – The value of the property.

  • offset (int) – The optional offset of the property.

See also Property(), PropertyCount() and PropertyNames().

CreationTime: Final[int]

Creation time type.

See also Time() and SetTime().

Data(wo: Optional[Pro.Core.NTIWait] = None)Pro.Core.NTContainer

Retrieves the data associated with the entry.

Parameters

wo (NTIWait) – The optional wait operation for the retrieval of the data.

Returns

Returns a valid NTContainer if successful; otherwise returns an invalid NTContainer.

Return type

NTContainer

See also SetData(), DataOffset(), DataSize() and HasData().

DataOffset()int
Returns

Returns the offset of the entry data if available; otherwise returns INVALID_STREAM_OFFSET.

Return type

int

See also Data(), SetData(), DataSize() and HasData().

DataSize()int
Returns

Returns the size of the entry data if available; otherwise returns 0.

Return type

int

Note

The size of the entry data is returned only when set previously using SetDataSize(). This method will not internally call Data() to return the size of the data.

See also HasDataSize(), SetDataSize(), DataOffset(), Data() and SetData().

Directory: Final[int]

Directory entry type.

See also Type() and SetType().

Drive: Final[int]

Drive entry type.

FastData: Final[int]

Fast data flag.

File: Final[int]

File entry type.

See also Type() and SetType().

Flags()int
Returns

Returns the flags of the entry (e.g., FastData).

Return type

int

Available since Cerbero Suite 7.1 and Cerbero Engine 4.1.

See also SetFlags().

HasData()bool
Returns

Returns True if entry data is available; otherwise returns False.

Return type

bool

See also Data(), SetData(), DataOffset() and DataSize().

HasDataSize()bool
Returns

Returns True if entry data size is available; otherwise returns False.

Return type

bool

See also DataSize(), DataOffset(), Data(), SetData() and HasData().

Invalid: Final[int]

Invalid entry type.

See also Type() and SetType().

IsNull()bool
Returns

Returns True if the entry is invalid; otherwise returns False.

Return type

bool

See also IsValid().

IsValid()bool
Returns

Returns True if the entry is valid; otherwise returns False.

Return type

bool

See also IsNull().

ModificationTime: Final[int]

Modification time type.

See also Time() and SetTime().

Name()str
Returns

Returns the entry name if available; otherwise returns an empty string.

Return type

str

See also SetName().

Path()str
Returns

Returns the full path of the entry, including the file name.

Return type

str

Available since Cerbero Suite 7.1 and Cerbero Engine 4.1.

See also SetPath().

Property(name: str)Optional[Union[int, float, bool, bytes, str]]

Retrieves a property of the entry.

Parameters

name (str) – The name of the property to retrieve.

Returns

Returns the property value if successful; otherwise returns None.

Return type

BasicType

See also PropertyCount(), PropertyNames(), AddProperty() and PropertyOffset().

PropertyCount()int
Returns

Returns the number of properties available.

Return type

int

See also Property(), PropertyNames(), AddProperty() and PropertyOffset().

PropertyNames()Pro.Core.NTStringList
Returns

Returns the list of property names.

Return type

NTStringList

See also Property(), PropertyCount(), AddProperty() and PropertyOffset().

PropertyOffset(name: str)int

Retrieves the offset of a property.

Parameters

name (str) – The name of the property.

Returns

Returns the of offset of the property if available; otherwise returns INVALID_STREAM_OFFSET.

Return type

int

See also Property(), PropertyCount(), PropertyNames() and AddProperty().

SetData(data: Pro.Core.NTContainer)None

Sets the data of the entry.

Parameters

data (NTContainer) – The data of the entry.

See also Data(), DataOffset(), DataSize() and HasData().

SetDataOffset(offset: int)None

Sets the offset of the entry data.

Parameters

offset (int) – The offset of the entry data.

See also DataOffset(), DataSize(), Data() and SetData().

SetDataSize(size: int)None

Sets the size of the entry data.

Parameters

size (int) – The size of the entry data.

See also DataOffset(), DataSize(), Data() and SetData().

SetFlags(flags: int)None

Sets the flags of the entry.

Parameters

flags (int) – The flags of the entry (e.g., FastData).

Available since Cerbero Suite 7.1 and Cerbero Engine 4.1.

See also Flags().

SetName(name: str)None

Sets the name of the entry.

Parameters

name (str) – The name of the entry.

See also Name().

SetPath(path: str)None

Sets the full path of the entry.

Parameters

path (str) – The full path of the entry, including the file name.

Available since Cerbero Suite 7.1 and Cerbero Engine 4.1.

See also Path().

SetTime(ttype: int, t: Pro.Core.NTDateTime)None

Sets a specific file time of the entry.

Parameters

See also Time().

SetType(type: int)None

Sets the type of the entry.

Parameters

type (int) – The type to set (e.g., Directory).

See also Type().

Time(ttype: int)Pro.Core.NTDateTime

Retrieves a specific file time of the entry.

Parameters

ttype (int) – The type of time to retrieve (e.g., ModificationTime).

Returns

Returns a valid NTDateTime if successful; otherwise returns an invalid NTDateTime instance.

Return type

NTDateTime

See also SetTime().

ToXML(sort: bool = True, include_data: bool = False)str

Converts the entry to an XML string.

Parameters
  • sort (bool) – If True, sorts the properties alphabetically.

  • include_data (bool) – If True, includes the data of the entry encoded as base64.

Returns

Returns the XML string if successful; otherwise returns an empty string.

Return type

str

Type()int
Returns

Returns the entry type (e.g., Directory).

Return type

int

See also SetType().

class CFSEntryInterface

This class represents a single file system entry.

Its method should never be called directly, but through CFSEntry.

Hint

All methods used to retrieve data in this class can be overridden. Alternatively, set methods can be used to set the data and thus removing the need to create a derived class that overrides get methods. The two approaches can also be combined. This design leaves to the developer the choice of how to use the interface.

Available since Cerbero Suite 7.0 and Cerbero Engine 4.0.

See also CFSEntry.

Methods:

AddProperty(name, value[, offset])

Adds a property to the entry.

Data([wo])

Retrieves the data associated with the entry.

DataOffset()

Returns the offset of the entry data if available; otherwise returns INVALID_STREAM_OFFSET.

DataSize()

Returns the size of the entry data if available; otherwise returns 0.

Flags()

Returns the flags of the entry (e.g., FastData).

HasData()

Returns True if entry data is available; otherwise returns False.

HasDataSize()

Returns True if entry data size is available; otherwise returns False.

Name()

Returns the entry name if available; otherwise returns an empty string.

Path()

Returns the full path of the entry, including the file name.

Property(name)

Retrieves a property of the entry.

PropertyCount()

Returns the number of properties available.

PropertyNames()

Returns the list of property names.

PropertyOffset(name)

Retrieves the offset of a property.

SetData(data)

Sets the data of the entry.

SetDataOffset(offset)

Sets the offset of the entry data.

SetDataSize(size)

Sets the size of the entry data.

SetFlags(flags)

Sets the flags of the entry.

SetName(name)

Sets the name of the entry.

SetPath(path)

Sets the full path of the entry.

SetTime(ttype, t)

Sets a specific file time of the entry.

SetType(type)

Sets the type of the entry.

Time(ttype)

Retrieves a specific file time of the entry.

Type()

Returns the entry type (e.g., Directory).

AddProperty(name: str, value: Optional[Union[int, float, bool, bytes, str]], offset: int = INVALID_STREAM_OFFSET)None

Adds a property to the entry.

Parameters
  • name (str) – The name of the property.

  • value (BasicType) – The value of the property.

  • offset (int) – The optional offset of the property.

See also Property(), PropertyCount() and PropertyNames().

Data(wo: Optional[Pro.Core.NTIWait] = None)Pro.Core.NTContainer

Retrieves the data associated with the entry.

Parameters

wo (NTIWait) – The optional wait operation for the retrieval of the data.

Returns

Returns a valid NTContainer if successful; otherwise returns an invalid NTContainer.

Return type

NTContainer

See also SetData(), DataOffset(), DataSize() and HasData().

DataOffset()int
Returns

Returns the offset of the entry data if available; otherwise returns INVALID_STREAM_OFFSET.

Return type

int

See also Data(), SetData(), DataSize() and HasData().

DataSize()int
Returns

Returns the size of the entry data if available; otherwise returns 0.

Return type

int

Note

The size of the entry data is returned only when set previously using SetDataSize(). This method will not internally call Data() to return the size of the data.

See also HasDataSize(), SetDataSize(), DataOffset(), Data() and SetData().

Flags()int
Returns

Returns the flags of the entry (e.g., FastData).

Return type

int

Available since Cerbero Suite 7.1 and Cerbero Engine 4.1.

See also SetFlags().

HasData()bool
Returns

Returns True if entry data is available; otherwise returns False.

Return type

bool

See also Data(), SetData(), DataOffset() and DataSize().

HasDataSize()bool
Returns

Returns True if entry data size is available; otherwise returns False.

Return type

bool

See also DataSize(), DataOffset(), Data(), SetData() and HasData().

Name()str
Returns

Returns the entry name if available; otherwise returns an empty string.

Return type

str

See also SetName().

Path()str
Returns

Returns the full path of the entry, including the file name.

Return type

str

Available since Cerbero Suite 7.1 and Cerbero Engine 4.1.

See also SetPath().

Property(name: str)Optional[Union[int, float, bool, bytes, str]]

Retrieves a property of the entry.

Parameters

name (str) – The name of the property to retrieve.

Returns

Returns the property value if successful; otherwise returns None.

Return type

BasicType

See also PropertyCount(), PropertyNames(), AddProperty() and PropertyOffset().

PropertyCount()int
Returns

Returns the number of properties available.

Return type

int

See also Property(), PropertyNames(), AddProperty() and PropertyOffset().

PropertyNames()Pro.Core.NTStringList
Returns

Returns the list of property names.

Return type

NTStringList

See also Property(), PropertyCount(), AddProperty() and PropertyOffset().

PropertyOffset(name: str)int

Retrieves the offset of a property.

Parameters

name (str) – The name of the property.

Returns

Returns the of offset of the property if available; otherwise returns INVALID_STREAM_OFFSET.

Return type

int

See also Property(), PropertyCount(), PropertyNames() and AddProperty().

SetData(data: Pro.Core.NTContainer)None

Sets the data of the entry.

Parameters

data (NTContainer) – The data of the entry.

See also Data(), DataOffset(), DataSize() and HasData().

SetDataOffset(offset: int)None

Sets the offset of the entry data.

Parameters

offset (int) – The offset of the entry data.

See also DataOffset(), DataSize(), Data() and SetData().

SetDataSize(size: int)None

Sets the size of the entry data.

Parameters

size (int) – The size of the entry data.

See also DataOffset(), DataSize(), Data() and SetData().

SetFlags(flags: int)None

Sets the flags of the entry.

Parameters

flags (int) – The flags of the entry (e.g., FastData).

Available since Cerbero Suite 7.1 and Cerbero Engine 4.1.

See also Flags().

SetName(name: str)None

Sets the name of the entry.

Parameters

name (str) – The name of the entry.

See also Name().

SetPath(path: str)None

Sets the full path of the entry.

Parameters

path (str) – The full path of the entry, including the file name.

Available since Cerbero Suite 7.1 and Cerbero Engine 4.1.

See also Path().

SetTime(ttype: int, t: Pro.Core.NTDateTime)None

Sets a specific file time of the entry.

Parameters

See also Time().

SetType(type: int)None

Sets the type of the entry.

Parameters

type (int) – The type to set (e.g., Directory).

See also Type().

Time(ttype: int)Pro.Core.NTDateTime

Retrieves a specific file time of the entry.

Parameters

ttype (int) – The type of time to retrieve (e.g., CFSEntry.ModificationTime).

Returns

Returns a valid NTDateTime if successful; otherwise returns an invalid NTDateTime instance.

Return type

NTDateTime

See also SetTime().

Type()int
Returns

Returns the entry type (e.g., Directory).

Return type

int

See also SetType().

class CFSInstance(iface: Optional[Pro.Core.CFSInterface] = None)

Wrapper class for a CFSInterface instance.

Parameters

iface (Optional[CFSInterface]) – The CFSInterface instance to be wrapped.

Important

When wrapping an instance of CFSEntryInterface, it is necessary to call __disown__() on it to avoid Python freeing the allocated object. The object will be freed automatically by the CFSInstance wrapper.

Available since Cerbero Suite 7.0 and Cerbero Engine 4.0.

See also CFSInterface.

Methods:

FSCaseSensitive()

Returns True if the file system is case sensitive; otherwise returns False.

FSGetEntry(path)

Retrieves an entry by its full path name.

FSIterator([path])

Retrieves an iterator for the specified path.

FSList([path])

Retrieves an entry list for the specified path.

FSNameFromFullName(full_name)

Retrieves the name of the entry from its full path name.

FSPathFromFullName(full_name)

Retrieves the path of the entry from its full path name.

FSRootDirectory()

Returns the root path of the file system.

FSSeparator()

Returns the path separator of the file system.

HasFSFeature(feature)

Checks for the presence of a specific file system feature.

IsNull()

Returns True if the current instance is invalid; otherwise returns False.

IsValid()

Returns True if the current instance is valid; otherwise returns False.

FSCaseSensitive()bool
Returns

Returns True if the file system is case sensitive; otherwise returns False.

Return type

bool

FSGetEntry(path: str)Pro.Core.CFSEntry

Retrieves an entry by its full path name.

Parameters

path (str) – The full path name of the entry to retrieve.

Returns

Returns a valid entry if successful; otherwise returns an invalid CFSEntry.

Return type

CFSEntry

See also FSIterator() and FSList().

FSIterator(path: str = str())Pro.Core.CFSIterator

Retrieves an iterator for the specified path.

Parameters

path (str) – The path.

Returns

Returns a valid CFSIterator if successful; otherwise returns an invalid CFSIterator.

Return type

CFSIterator

See also FSList() and FSGetEntry().

FSList(path: str = str())Pro.Core.CFSList

Retrieves an entry list for the specified path.

Parameters

path (str) – The path.

Returns

Returns a valid CFSList if successful; otherwise returns an invalid CFSList.

Return type

CFSList

See also FSIterator() and FSGetEntry().

FSNameFromFullName(full_name: str)str

Retrieves the name of the entry from its full path name.

Parameters

full_name (str) – The full path name.

Returns

Returns the entry name.

Return type

str

See also FSPathFromFullName().

FSPathFromFullName(full_name: str)str

Retrieves the path of the entry from its full path name.

Parameters

full_name (str) – The full path name.

Returns

Returns the path of the entry.

Return type

str

See also FSNameFromFullName().

FSRootDirectory()str
Returns

Returns the root path of the file system.

Return type

str

FSSeparator()str
Returns

Returns the path separator of the file system.

Return type

str

HasFSFeature(feature: str)bool

Checks for the presence of a specific file system feature.

Available features are: metadata, mtime, size and physical.

Parameters

feature (str) – The name of the file system feature.

Returns

Returns True if the file system feature is available; otherwise returns False.

Return type

bool

IsNull()bool
Returns

Returns True if the current instance is invalid; otherwise returns False.

Return type

bool

See also IsValid().

IsValid()bool
Returns

Returns True if the current instance is valid; otherwise returns False.

Return type

bool

See also IsNull().

class CFSInterface

This class represents a file system interface

This interface is inherited by CFFObject, but can also be also wrapped inside CFSInstance.

Hint

All methods apart from FSIterator() and FSList() in this class can be overridden. To implement the creation of file system iterators or lists, the NewFSIterator() and NewFSList() methods must be overridden. It is sufficient to override just one of these two methods: the internal code is capable of creating a file system list from an iterator and vice-versa, leaving to the developer the choice of which of the two methods is easier to implement for a specific file system.

Available since Cerbero Suite 7.0 and Cerbero Engine 4.0.

See also CFSInstance.

Methods:

FSCaseSensitive()

Returns the case sensitivity of the file system.

FSGetEntry(path)

Retrieves an entry by its full path name.

FSIterator([path])

Retrieves an iterator for the specified path.

FSList([path])

Retrieves an entry list for the specified path.

FSNameFromFullName(full_name)

Retrieves the name of the entry from its full path name.

FSPathFromFullName(full_name)

Retrieves the path of the entry from its full path name.

FSRootDirectory()

Retrieves the root path of the file system.

FSSeparator()

Retrieves the path separator of the file system.

HasFSFeature(feature)

Checks for the presence of a specific file system feature.

NewFSIterator(path)

Retrieves an iterator for the specified path.

NewFSList(path)

Retrieves an entry list for the specified path.

FSCaseSensitive()bool

Returns the case sensitivity of the file system.

By default this method returns True.

Returns

Returns True if the file system is case sensitive; otherwise returns False.

Return type

bool

FSGetEntry(path: str)Pro.Core.CFSEntry

Retrieves an entry by its full path name.

Hint

If this method is not overridden, it will fall back to use FSIterator() to retrieve the entry.

Parameters

path (str) – The full path name of the entry to retrieve.

Returns

Returns a valid entry if successful; otherwise returns an invalid CFSEntry.

Return type

CFSEntry

See also FSIterator() and FSList().

FSIterator(path: str = str())Pro.Core.CFSIterator

Retrieves an iterator for the specified path.

Hint

Internally this method calls NewFSIterator().

Parameters

path (str) – The path.

Returns

Returns a valid CFSIterator if successful; otherwise returns an invalid CFSIterator.

Return type

CFSIterator

See also NewFSIterator() and FSList().

FSList(path: str = str())Pro.Core.CFSList

Retrieves an entry list for the specified path.

Hint

Internally this method calls NewFSList().

Parameters

path (str) – The path.

Returns

Returns a valid CFSList if successful; otherwise returns an invalid CFSList.

Return type

CFSList

See also NewFSList() and FSIterator().

FSNameFromFullName(full_name: str)str

Retrieves the name of the entry from its full path name.

Parameters

full_name (str) – The full path name.

Returns

Returns the entry name.

Return type

str

See also FSPathFromFullName().

FSPathFromFullName(full_name: str)str

Retrieves the path of the entry from its full path name.

Parameters

full_name (str) – The full path name.

Returns

Returns the path of the entry.

Return type

str

See also FSNameFromFullName().

FSRootDirectory()str

Retrieves the root path of the file system.

By default this method returns an empty string.

Returns

Returns the root path of the file system.

Return type

str

FSSeparator()str

Retrieves the path separator of the file system.

By default this method returns "/".

Returns

Returns the path separator of the file system.

Return type

str

HasFSFeature(feature: str)bool

Checks for the presence of a specific file system feature.

Available features are: metadata, mtime, size and physical.

Parameters

feature (str) – The name of the file system feature.

Returns

Returns True if the file system feature is available; otherwise returns False.

Return type

bool

NewFSIterator(path: str)Pro.Core.CFSIterator

Retrieves an iterator for the specified path.

Important

This method can be overridden to implement the functionality, but should not be called directly: the wrapper method FSIterator() should be called instead.

Parameters

path (str) – The path.

Returns

Returns a valid CFSIterator if successful; otherwise returns an invalid CFSIterator.

Return type

CFSIterator

See also FSIterator() and NewFSList().

NewFSList(path: str)Pro.Core.CFSList

Retrieves an entry list for the specified path.

Important

This method can be overridden to implement the functionality, but should not be called directly: the wrapper method FSList() should be called instead.

Parameters

path (str) – The path.

Returns

Returns a valid CFSList if successful; otherwise returns an invalid CFSList.

Return type

CFSList

See also FSList() and NewFSIterator().

class CFSIterator(iface: Optional[Pro.Core.CFSIteratorInterface] = None)

Wrapper class for a CFSIteratorInterface instance.

Parameters

iface (Optional[CFSIteratorInterface]) – The CFSIteratorInterface instance to be wrapped.

Important

When wrapping an instance of CFSIteratorInterface, it is necessary to call __disown__() on it to avoid Python freeing the allocated object. The object will be freed automatically by the CFSIterator wrapper.

Available since Cerbero Suite 7.0 and Cerbero Engine 4.0.

See also CFSIteratorInterface.

Methods:

HasNext()

Returns True if there is an entry after the current one; otherwise returns False.

IsNull()

Returns True if the iterator is invalid; otherwise returns False.

IsValid()

Returns True if the iterator is valid; otherwise returns False.

Next()

Returns the entry after the current one and moves the iterator if successful; otherwise returns an invalid CFSEntry.

HasNext()bool
Returns

Returns True if there is an entry after the current one; otherwise returns False.

Return type

bool

See also Next().

IsNull()bool
Returns

Returns True if the iterator is invalid; otherwise returns False.

Return type

bool

See also IsValid().

IsValid()bool
Returns

Returns True if the iterator is valid; otherwise returns False.

Return type

bool

See also IsNull().

Next()Pro.Core.CFSEntry
Returns

Returns the entry after the current one and moves the iterator if successful; otherwise returns an invalid CFSEntry.

Return type

CFSEntry

See also HasNext().

class CFSIteratorInterface

This class represents a file system iterator.

Its method should never be called directly, but through CFSIterator.

Important

Both the HasNext() and Next() methods must be overridden to implement this interface.

Available since Cerbero Suite 7.0 and Cerbero Engine 4.0.

See also CFSIterator.

Methods:

HasNext()

Returns True if there is an entry after the current one; otherwise returns False.

Next()

Returns the entry after the current one and moves the iterator if successful; otherwise returns an invalid CFSEntry.

HasNext()bool
Returns

Returns True if there is an entry after the current one; otherwise returns False.

Return type

bool

See also Next().

Next()Pro.Core.CFSEntry
Returns

Returns the entry after the current one and moves the iterator if successful; otherwise returns an invalid CFSEntry.

Return type

CFSEntry

See also HasNext().

class CFSList(iface: Optional[Pro.Core.CFSListInterface] = None)

Wrapper class for a CFSListInterface instance.

Parameters

iface (Optional[CFSListInterface]) – The CFSListInterface instance to be wrapped.

Important

When wrapping an instance of CFSListInterface, it is necessary to call __disown__() on it to avoid Python freeing the allocated object. The object will be freed automatically by the CFSList wrapper.

Available since Cerbero Suite 7.0 and Cerbero Engine 4.0.

See also CFSListInterface.

Methods:

At(i)

Retrieves a specific entry in the list.

Count()

Returns the number of entries in the list.

IsNull()

Returns True if the list is invalid; otherwise returns False.

IsValid()

Returns True if the list is valid; otherwise returns False.

Sort([case_insensitive, dirs_first])

Sorts in place the list.

At(i: int)Pro.Core.CFSEntry

Retrieves a specific entry in the list.

Parameters

i (int) – The position of the entry to retrieve.

Returns

Returns the entry if successful; otherwise returns an invalid CFSEntry.

Return type

CFSEntry

See also Count().

Count()int
Returns

Returns the number of entries in the list.

Return type

int

See also At().

IsNull()bool
Returns

Returns True if the list is invalid; otherwise returns False.

Return type

bool

See also IsValid().

IsValid()bool
Returns

Returns True if the list is valid; otherwise returns False.

Return type

bool

See also IsNull().

Sort(case_insensitive: bool = True, dirs_first: bool = True)None

Sorts in place the list.

Parameters
  • case_insensitive (bool) – If True, sorts the list ignoring the case; otherwise respects the case.

  • dirs_first (bool) – If True, places directories before file entries; otherwise mixes directory and file entries.

class CFSListInterface

This class represents a file system list.

Its method should never be called directly, but through CFSList.

Important

Both the At() and Count() methods must be overridden to implement this interface.

Available since Cerbero Suite 7.0 and Cerbero Engine 4.0.

See also CFSList.

Methods:

At(i)

Retrieves a specific entry in the list.

Count()

Returns the number of entries in the list.

At(i: int)Pro.Core.CFSEntry

Retrieves a specific entry in the list.

Parameters

i (int) – The position of the entry to retrieve.

Returns

Returns the entry if successful; otherwise returns an invalid CFSEntry.

Return type

CFSEntry

See also Count().

Count()int
Returns

Returns the number of entries in the list.

Return type

int

See also At().

CT_ActionScript2: Final[int]

Scan entry type for ActionScript2.

See also ScanProvider.addEntry() and ScanEntryData.

CT_ActionScript3: Final[int]

Scan entry type for ActionScript3.

See also ScanProvider.addEntry() and ScanEntryData.

CT_AppLaunch: Final[int]

Scan entry type for application launches.

See also ScanProvider.addEntry() and ScanEntryData.

CT_AttackSurface: Final[int]

Scan entry type for attack surfaces.

See also ScanProvider.addEntry() and ScanEntryData.

CT_BinaryData: Final[int]

Scan entry type for binary data.

See also ScanProvider.addEntry() and ScanEntryData.

CT_Blacklisted: Final[int]

Scan entry type for a blacklisted item.

Available since Cerbero Suite 5.5 and Cerbero Engine 2.5.

See also ScanProvider.addEntry() and ScanEntryData.

CT_ByteCode: Final[int]

Scan entry type for byte-code.

See also ScanProvider.addEntry() and ScanEntryData.

CT_DalvikByteCode: Final[int]

Scan entry type for Dalvik byte-code.

See also ScanProvider.addEntry() and ScanEntryData.

CT_DataEntriesEnd: Final[int]

Scan entry type for data entries end.

See also ScanProvider.addEntry() and ScanEntryData.

CT_DataEntriesStart: Final[int]

Scan entry type for data entries start.

See also ScanProvider.addEntry() and ScanEntryData.

CT_DebugData: Final[int]

Scan entry type for debug data.

See also ScanProvider.addEntry() and ScanEntryData.

CT_DecompressionBomb: Final[int]

Scan entry type for decompression bombs.

See also ScanProvider.addEntry() and ScanEntryData.

CT_EmbeddedFile: Final[int]

Scan entry type for embedded objects.

See also SEC_File, ScanProvider.addEntry() and ScanEntryData.

CT_EntryLimit: Final[