View on GitHub

A Dissect module implementing various utility functions for the other Dissect modules.


dissect.util is available on PyPI.

$ pip install dissect.util

This module is also automatically installed if you install the dissect package.


This package is a library with a few CLI tools, so you primarily interact with it from Python. Most of the functionality of this library should be pretty straightforward from the API documentation, so here’s an example on how to implement your own AlignedStream:

from typing import BinaryIO

from dissect.util.stream import AlignedStream

class MyStream(AlignedStream):
    def __init__(self, fh: BinaryIO, size: int):
        # Customize the __init__ however you need
        self.fh = fh
        # You only need to give the super class the size (and optional ``align``)

    def _read(self, offset: int, length: int):
        # This is the only method you have to implement
        # Do whatever you need to do to return ``length`` amount of bytes (or less if EOF)
        return self.fh.read(length)


dump-nskeyedarchiver - CLI interface

Utility to dump NSKeyedArchiver plist files.

dump-nskeyedarchiver [-h] file

dump-nskeyedarchiver positional arguments

  • file - NSKeyedArchiver plist file to dump (default: None)

dump-nskeyedarchiver optional arguments

  • -h, --help - show this help message and exit


For more details, please refer to the API documentation of dissect.util.