dissect.util#
A Dissect module implementing various utility functions for the other Dissect modules.
Compression algorithms (
dissect.util.compression
)NSKeyedArchiver
plist implementation (dissect.util.plist
)Windows SID parser (
dissect.util.sid
)Stream implementations and helpers (
dissect.util.stream
)Timestamp parsers and helpers (
dissect.util.ts
)
Installation#
dissect.util
is available on PyPI.
$ pip install dissect.util
This module is also automatically installed if you install the dissect
package.
Usage#
This package is a library with a few CLI tools, so you primarily interact with it from Python. Most of the functionality
of this library should be pretty straightforward from the API documentation, so here’s an example on how to implement
your own AlignedStream
:
from typing import BinaryIO
from dissect.util.stream import AlignedStream
class MyStream(AlignedStream):
def __init__(self, fh: BinaryIO, size: int):
# Customize the __init__ however you need
self.fh = fh
# You only need to give the super class the size (and optional ``align``)
super().__init__(size)
def _read(self, offset: int, length: int):
# This is the only method you have to implement
# Do whatever you need to do to return ``length`` amount of bytes (or less if EOF)
self.fh.seek(offset)
return self.fh.read(length)
Tools#
dump-nskeyedarchiver - CLI interface#
Utility to dump NSKeyedArchiver plist files.
dump-nskeyedarchiver [-h] file
dump-nskeyedarchiver positional arguments#
file
- NSKeyedArchiver plist file to dump (default:None
)
dump-nskeyedarchiver optional arguments#
Reference#
For more details, please refer to the API documentation of dissect.util
.