`dissect.database.bsd.db`¶

Module Contents¶

Classes¶

`DB`	Berkeley DB.
`Page`	A single page in a Berkeley DB.

Functions¶

`overflow_data`	Get off-page data.
`BS_TO_PAGE`
`BUCKET_TO_PAGE`

Attributes¶

An internal page entry structure + data (loosely related to Data-Base Thang).

dissect.database.bsd.db.DBT¶: An internal page entry structure + data (loosely related to Data-Base Thang).

class dissect.database.bsd.db.DB(fh: BinaryIO)¶

Berkeley DB.

Parameters:: fh – File-like object containing the Berkeley DB data.

fh¶

page_size¶

page¶

property is_btree: bool¶: Return whether the database of a DB_BTREE type.

property is_recno: bool¶: Return whether the database is a DB_RECNO type.

property is_hash: bool¶: Return whether the database is a DB_HASH type.

records() → collections.abc.Iterator[tuple[bytes | int, bytes]]¶: Iterate over all records in the database.

class dissect.database.bsd.db.Page(db: DB, pgno: int)¶

A single page in a Berkeley DB.

Parameters:

db – The parent DB instance.
pgno – The page number to load.

db¶

pgno¶

offset¶

property raw: bytes¶: Raw page data.

property data: memoryview¶: Page data, excluding any overhead (headers).

property header: dissect.database.bsd.c_db.c_db.PAGE¶: Page header.

property type: int¶: Page type.

property lookup: list[int]¶: List of offsets to entries in the page.

entry(index: int) → DBT¶

Get a single entry by index. Type depends on page type.

Also returns the associated data (DBT, Data-Base Thang, or key/data buffer) if applicable.

References

__db_ret

Parameters:: index – Index of the entry to retrieve.

entries() → collections.abc.Iterator[DBT]¶: Iterate over all entries in the page.

dissect.database.bsd.db.overflow_data(db: DB, pgno: int, size: int) → bytes¶

Get off-page data.

References

__db_goff

Parameters:

db – The parent DB instance.
pgno – The starting page number of the overflow data.
size – The total size of the overflow data to read.

dissect.database.bsd.db.BS_TO_PAGE(bucket: int, spares: list[int]) → int¶

dissect.database.bsd.db.BUCKET_TO_PAGE(db: DB, bucket: int) → int¶