dissect.archive.wim

Module Contents

Classes

WIM

Windows Imaging Format implementation.

Resource

Image

SecurityBlock

DirectoryEntry

ReparsePoint

Utility class for parsing reparse point buffers.

CompressedStream

Basic buffered stream that provides aligned reads.

Attributes

DEFAULT_CHUNK_SIZE

dissect.archive.wim.DEFAULT_CHUNK_SIZE = 32768
class dissect.archive.wim.WIM(fh: BinaryIO)

Windows Imaging Format implementation.

Supports reading resources and browsing images from WIM files.

fh
header
property resources: dict[bytes, Resource]

Return the table of resources in the WIM file.

images() → collections.abc.Iterator[Image]

Iterate over all images in the WIM file.

class dissect.archive.wim.Resource(wim: WIM, size: int, flags: dissect.archive.c_wim.RESHDR_FLAG, offset: int, original_size: int, part_number: int | None = None, reference_count: int | None = None, hash: bytes | None = None)
__slots__ = ('flags', 'hash', 'offset', 'original_size', 'part_number', 'reference_count', 'size', 'wim')
wim
size
flags
offset
original_size
part_number = None
reference_count = None
hash = None
classmethod from_short_header(wim: WIM, reshdr: dissect.archive.c_wim.c_wim.RESHDR_DISK_SHORT) → Resource
classmethod from_header(wim: WIM, reshdr: dissect.archive.c_wim.c_wim.RESHDR_DISK) → Resource
property is_metadata: bool
property is_compressed: bool
property is_spanned: bool
open() → BinaryIO
class dissect.archive.wim.Image(wim: WIM, fh: BinaryIO)
wim
security
root
__repr__() → str
get(path: str, entry: DirectoryEntry | None = None) → DirectoryEntry
class dissect.archive.wim.SecurityBlock(fh: BinaryIO)
header
descriptors = []
class dissect.archive.wim.DirectoryEntry(image: Image, fh: BinaryIO)
image
fh
entry
name = None
short_name = None
extra = None
streams
__repr__() → str
is_dir() → bool

Return whether this entry is a directory.

is_file() → bool

Return whether this entry is a regular file.

is_reparse_point() → bool

Return whether this entry is a reparse point.

Return whether this entry is a symlink reparse point.

is_mount_point() → bool

Return whether this entry is a mount point reparse point.

property reparse_point: ReparsePoint

Return parsed reparse point data if this directory entry is a reparse point.

size(name: str = '') → int

Return the entry size.

property creation_time: datetime.datetime

Return the creation time.

property creation_time_ns: int

Return the creation time in nanoseconds.

property last_access_time: datetime.datetime

Return the last access time.

property last_access_time_ns: int

Return the last access time in nanoseconds.

property last_write_time: datetime.datetime

Return the last write time.

property last_write_time_ns: int

Return the last write time in nanoseconds.

listdir() → dict[str, DirectoryEntry]

Return a directory listing.

iterdir() → collections.abc.Iterator[DirectoryEntry]

Iterate directory contents.

open(name: str = '') → BinaryIO

Return a file-like object for the contents of this directory entry.

Parameters:

name – Optional alternate stream name to open.

class dissect.archive.wim.ReparsePoint(tag: dissect.archive.c_wim.IO_REPARSE_TAG, fh: BinaryIO)

Utility class for parsing reparse point buffers.

Parameters:

  • tag – The type of reparse point to parse.

  • fh – A file-like object of the reparse point buffer.

tag
info = None
property substitute_name: str | None
property print_name: str | None
property absolute: bool
property relative: bool
class dissect.archive.wim.CompressedStream(fh: BinaryIO, offset: int, compressed_size: int, original_size: int, decompressor: collections.abc.Callable[[bytes], bytes], chunk_size: int = DEFAULT_CHUNK_SIZE)

Bases: dissect.util.stream.AlignedStream

Basic buffered stream that provides aligned reads.

Must be subclassed for various stream implementations. Subclasses can implement:

  • _read()

  • _seek()

The offset and length for _read are guaranteed to be aligned for streams of a known size. If your stream has an unknown size (i.e. size == None), reads of length -1 (i.e. read until EOF) will be passed through to your implementation of _read. The only time that overriding _seek would make sense is if there’s no known size of your stream, but still want to provide SEEK_END functionality.

Most subclasses of AlignedStream take one or more file-like objects as source. Operations on these subclasses, like reading, will modify the source file-like object as a side effect.

Parameters:

  • size – The size of the stream. This is used in read and seek operations. None if unknown.

  • align – The alignment size. Read operations are aligned on this boundary. Also determines buffer size.

_read(offset: int, length: int) → bytes

Read method that backs this aligned stream.

_seek(pos: int, whence: int = 0) → int

Calculate and return the new stream position after a seek.

fh
offset
compressed_size
original_size
decompressor
chunk_size = 32768