dissect.ole.ole

Module Contents

Classes

OLE

DirectoryEntry

Chain

MiniChain

ChainStream

Basic buffered stream that provides aligned reads.
class dissect.ole.ole.OLE(fh: BinaryIO)
fh
header
sector_size
mini_sector_size
mini_cutoff
num_fat_entries
num_difat_entries
root
ministream
get(path: str, root: DirectoryEntry | None = None) → DirectoryEntry
directory(sid: int) → DirectoryEntry
fat(sect: int) → int
minifat(sect: int) → int
chain(sect: int, size: int | None = None) → MiniChain
minichain(sect: int, size: int | None = None) → MiniChain
class dissect.ole.ole.DirectoryEntry(ole: OLE, sid: int)
ole
sid
entry
name
type
flags
user_flags
ctime
mtime
start
size
__repr__() → str
open() → ChainStream
listdir() → dict[str, DirectoryEntry]
walk() → collections.abc.Iterator[DirectoryEntry]
property child: DirectoryEntry | None
property left_sibling: DirectoryEntry | None
property right_sibling: DirectoryEntry | None
property has_child: bool
property has_left_sibling: bool
property has_right_sibling: bool
property is_minifat: bool
property is_red: bool
property is_black: bool
property is_valid: bool
property is_stream: bool
property is_storage: bool
class dissect.ole.ole.Chain(ole: OLE, sect: int, size: int | None = None)
ole
sect
size = None
chain
ended = False
__len__() → int
__iter__() → collections.abc.Iterator[int]
__getitem__(i: int) → int
open() → ChainStream
fill() → None
class dissect.ole.ole.MiniChain(ole: OLE, sect: int, size: int | None = None)

Bases: Chain

open() → ChainStream
class dissect.ole.ole.ChainStream(stream: BinaryIO, chain: Chain, sector_size: int, offset: int = 0)

Bases: dissect.util.stream.AlignedStream

Basic buffered stream that provides aligned reads.

Must be subclassed for various stream implementations. Subclasses can implement:

  • _read()

  • _seek()

The offset and length for _read are guaranteed to be aligned for streams of a known size. If your stream has an unknown size (i.e. size == None), reads of length -1 (i.e. read until EOF) will be passed through to your implementation of _read. The only time that overriding _seek would make sense is if there’s no known size of your stream, but still want to provide SEEK_END functionality.

Most subclasses of AlignedStream take one or more file-like objects as source. Operations on these subclasses, like reading, will modify the source file-like object as a side effect.

Parameters:

  • size – The size of the stream. This is used in read and seek operations. None if unknown.

  • align – The alignment size. Read operations are aligned on this boundary. Also determines buffer size.

_read(offset: int, length: int) → bytes

Read method that backs this aligned stream.

_seek(pos: int, whence: int = 0) → int

Calculate and return the new stream position after a seek.

chain
sector_size
offset = 0