dissect.esedb.page

Module Contents

Classes

Page

Represents a logical page of an ESE database.

Tag

A tag is the "physical" data entry of a page.

Node

A node is the "logical" data entry of a page.

LeafNode

Special leaf node.

BranchNode

Special branch node. Parses the child page information.
class dissect.esedb.page.Page(esedb: dissect.esedb.esedb.EseDB, num: int, buf: bytes)

Represents a logical page of an ESE database.

Parameters:

  • esedb – An instance of EseDB.

  • num – The logical page number.

  • buf – The physical page data.

esedb
num
buf
header
header2 = None
flags
previous_page
next_page
data
tag_count
node_count
property is_small_page: bool
property is_root: bool
property is_leaf: bool
property is_parent: bool
property is_empty: bool
property is_space_tree: bool
property is_index: bool
property is_long_value: bool
property is_branch: bool
property key_prefix: bytes | None
tag(num: int) → Tag

Retrieve a tag by index.

Parameters:

num – The tag number to retrieve.

Raises:

IndexError – If the tag number is out of bounds.

tags() → collections.abc.Iterator[Tag]

Yield all tags.

node(num: int) → BranchNode | LeafNode

Retrieve a node by index.

Nodes are just tags, but indexed from the first tag.

Parameters:

num – The node number to retrieve.

Raises:

IndexError – If the node number is out of bounds.

nodes() → collections.abc.Iterator[BranchNode | LeafNode]

Yield all nodes.

iter_leaf_nodes() → collections.abc.Iterator[LeafNode]

Walk the page tree and yield leaf nodes.

Two methods can be used, one is to travel down to the first leaf, and keep reading next_page’s, the other is to traverse the tree branches.

Impacket uses the first method, but gets caught in an infinite loop on some dirty databases. Traversing the branches seems safer, at the risk of missing a couple (possibly corrupt) pages.

For this reason, we actually explicitly check if the last page we parse has a next_page attribute, and also parse that. This methods seems to work so far.

__repr__() → str
class dissect.esedb.page.Tag(page: Page, num: int)

A tag is the “physical” data entry of a page.

Parameters:

  • page – The Page this tag is in.

  • num – The tag number to parse.

__slots__ = ('data', 'flags', 'num', 'offset', 'page', 'size', 'tag')
page
num
tag
size
offset
data
flags
__repr__() → str
class dissect.esedb.page.Node(tag: Tag)

A node is the “logical” data entry of a page.

Parameters:

tag – The Tag to parse a node from.

__slots__ = ('data', 'key', 'key_prefix', 'key_suffix', 'num', 'tag')
tag
num
key = b''
key_prefix = b''
key_suffix = b''
data
class dissect.esedb.page.LeafNode(tag: Tag)

Bases: Node

Special leaf node.

__repr__() → str
class dissect.esedb.page.BranchNode(tag: Tag)

Bases: Node

Special branch node. Parses the child page information.

__slots__ = ('child',)
child
__repr__() → str