`dissect.cim.utils`¶

Module Contents¶

Classes¶

ObjectPath

Functions¶

`is_xp_mapping`
`find_current_mapping`
`parse_object_path`	Given a textual query string, parse it into an object path that we can query.

class dissect.cim.utils.ObjectPath¶

Bases: NamedTuple

hostname: str¶

namespace: str¶

class_: str¶

instance: dict[str, str]¶

dissect.cim.utils.is_xp_mapping(h: dissect.cim.c_cim.c_cim.mapping_header | dissect.cim.c_cim.c_cim.mapping_header_xp) → bool¶

dissect.cim.utils.find_current_mapping(mappings: list[BinaryIO]) → tuple[bool, BinaryIO]¶

dissect.cim.utils.parse_object_path(object_path: str, ns: dissect.cim.cim.Namespace | None = None) → ObjectPath¶

Given a textual query string, parse it into an object path that we can query.

Supported schemas:

cimv2 --> namespace
//./root/cimv2 --> namespace
//HOSTNAME/root/cimv2 --> namespace
winmgmts://./root/cimv2 --> namespace
Win32_Service --> class
//./root/cimv2:Win32_Service --> class
Win32_Service.Name='Beep' --> instance
//./root/cimv2:Win32_Service.Name="Beep" --> instance

We’d like to support this, but can’t differentiate this:

from a class:
//./root/cimv2/Win32_Service --> class

Parameters:

object_path (str) – the textual query string.
ns

Returns:

a path we can use to query.

Return type:

ObjectPath

dissect.cim.utils¶

Module Contents¶

Classes¶

Functions¶

`dissect.cim.utils`¶