`dissect.etl.headers.headers`¶

Module Contents¶

Classes¶

`Marker`	Abstracts the marker calculation for headers.
`Header`	A baseclass for the different ETL headers.
`InvalidHeader`	An invalid header.
`UnimplementedHeader`	A header that isn't implemented yet.
`EventProperty`	Defines what the message trace header can additionally find in its payload.
`MessageTraceHeader`	A baseclass for the different ETL headers.
`EventTraceHeader`	A baseclass for the different ETL headers.
`EventInstanceHeader`	A baseclass for the different ETL headers.
`EventInstanceGUIDHeader`	A more expanded EventInstanceHeader.
`ErrorHeader`	When an error event was created. However, the structure of the header isn't clear.

Attributes¶

BIT64_HEADERS

dissect.etl.headers.headers.BIT64_HEADERS¶

class dissect.etl.headers.headers.Marker(marker: int)¶

Abstracts the marker calculation for headers.

MARKER_MASK = 4278190080¶

HEADER_MASK = 16711680¶

REMAINDER_MASK = 65535¶

MESSAGE_FLAGS = 144¶

HEADER_FLAGS = 192¶

marker¶

property flags: int¶

property header_type: int¶

property remainder: int¶

class dissect.etl.headers.headers.Header(marker: Marker, data: memoryview, etl: dissect.etl.etl.ETL)¶

A baseclass for the different ETL headers.

data¶

property minimal_size: int¶

Abstractmethod:

Minimum header size.

property provider_id: uuid.UUID¶: Provider that generated this event.

property version: int¶: The version of the event.

property timestamp: datetime.datetime¶: The timestamp of the event.

property time_delta: int¶: The change in time relative to the start of the logfile.

property marker: int¶: The marker data for this event.

property is_64bit: bool¶: A value to determine if the header is 64 or 32 bits.

property size: int¶

The size of the event.

In most cases this is inside the remainder field of the marker.

property data_size: int¶: The size of the payload.

property payload: memoryview¶: Grab the payload data from the datastream.

property header: dissect.cstruct.types.structure.Structure¶: Type of header that will get parsed.

abstract additional_header_fields() → dict[str, Any]¶

Additional fields that hold interesting information.

each header subclass defines what additional information it wants to return to a record.

standard_header_fields() → dict[str, Any]¶: Some standard header information that can be retrieved for any header.

__repr__() → str¶

class dissect.etl.headers.headers.InvalidHeader(marker: Marker, data: bytes, etl: dissect.etl.etl.ETL)¶

Bases: Header

An invalid header.

class dissect.etl.headers.headers.UnimplementedHeader(marker: Marker, data: memoryview, etl: dissect.etl.etl.ETL)¶

Bases: Header

A header that isn’t implemented yet.

class dissect.etl.headers.headers.EventProperty¶

Bases: enum.IntEnum

Defines what the message trace header can additionally find in its payload.

SEQUENCE = 1¶

GUID = 2¶

COMPONENT_ID = 4¶

TIMESTAMP = 8¶

PERFORMANCE_TIMESTAMP = 16¶

SYSTEMINFO = 32¶

POINTER32 = 64¶

POINTER64 = 128¶

class dissect.etl.headers.headers.MessageTraceHeader(marker: Marker, data: bytes, etl: dissect.etl.etl.ETL)¶

Bases: Header

A baseclass for the different ETL headers.

payload_offset = 0¶

opcode = None¶

property minimal_size: int¶: Minimum header size.

property time_delta: int¶: The change in time relative to the start of the logfile.

property version: int¶: The version of the event.

property id: int¶: The id of the message event.

property event_property: int¶: What type of payload to expect.

property provider_id: uuid.UUID¶: Provider that generated this event.

property thread_id: int¶

property process_id: int¶

property sequence_number: int¶

additional_header_fields() → dict[str, Any]¶

Additional fields that hold interesting information.

each header subclass defines what additional information it wants to return to a record.

class dissect.etl.headers.headers.EventTraceHeader(marker: Marker, data: memoryview, etl: dissect.etl.etl.ETL)¶

Bases: Header

A baseclass for the different ETL headers.

property minimal_size: int¶: Minimum header size.

property thread_id: int¶: The thread id that created this event.

property process_id: int¶: The process id that created this event.

additional_header_fields() → dict[str, Any]¶

Additional fields that hold interesting information.

each header subclass defines what additional information it wants to return to a record.

class dissect.etl.headers.headers.EventInstanceHeader(marker: Marker, data: memoryview, etl: dissect.etl.etl.ETL)¶

Bases: Header

A baseclass for the different ETL headers.

property minimal_size: int¶: Minimum header size.

additional_header_fields() → dict[str, Any]¶

Additional fields that hold interesting information.

each header subclass defines what additional information it wants to return to a record.

class dissect.etl.headers.headers.EventInstanceGUIDHeader(marker: Marker, data: memoryview, etl: dissect.etl.etl.ETL)¶

Bases: Header

A more expanded EventInstanceHeader.

This is created from an EventInstanceHeader, but it’s not quite clear which one is specifically used. For now, this header is default.

property minimal_size: int¶: Minimum header size.

property thread_id: int¶: The thread id that created this event.

property process_id: int¶: The process id that created this event.

property parent_guid: int¶

additional_header_fields() → dict[str, Any]¶

Additional fields that hold interesting information.

each header subclass defines what additional information it wants to return to a record.

class dissect.etl.headers.headers.ErrorHeader(marker: Marker, data: memoryview, etl: dissect.etl.etl.ETL)¶

Bases: Header

When an error event was created. However, the structure of the header isn’t clear.

property minimal_size: int¶: Minimum header size.

additional_header_fields() → dict[str, Any]¶

Additional fields that hold interesting information.

each header subclass defines what additional information it wants to return to a record.

dissect.etl.headers.headers¶

Module Contents¶

Classes¶

Attributes¶

`dissect.etl.headers.headers`¶