dissect.esedb.page

Module Contents

Classes

Page	Represents a logical page of an ESE database.
Tag	A tag is the "physical" data entry of a page.
Node	A node is the "logical" data entry of a page.
LeafNode	Special leaf node.
BranchNode	Special branch node. Parses the child page information.

class dissect.esedb.page.Page(esedb: dissect.esedb.esedb.EseDB, num: int, buf: bytes)

Represents a logical page of an ESE database.

Parameters:

• esedb – An instance of EseDB.

• num – The logical page number.

• buf – The physical page data.

is_small_page() → bool

is_root() → bool

is_leaf() → bool

is_parent() → bool

is_empty() → bool

is_space_tree() → bool

is_index() → bool

is_long_value() → bool

is_branch() → bool

key_prefix() → bytes | None

tag(num: int) → Tag

Retrieve a tag by index.

Parameters:

num – The tag number to retrieve.

Raises:

IndexError – If the tag number is out of bounds.

tags() → Iterator[Tag]

Yield all tags.

node(num: int) → BranchNode | LeafNode

Retrieve a node by index.

Nodes are just tags, but indexed from the first tag.

Parameters:

num – The node number to retrieve.

Raises:

IndexError – If the node number is out of bounds.

nodes() → Iterator[BranchNode | LeafNode]

Yield all nodes.

iter_leaf_nodes() → Iterator[LeafNode]

Walk the page tree and yield leaf nodes.

Two methods can be used, one is to travel down to the first leaf, and keep reading next_page’s, the other is to traverse the tree branches.

Impacket uses the first method, but gets caught in an infinite loop on some dirty databases. Traversing the branches seems safer, at the risk of missing a couple (possibly corrupt) pages.

For this reason, we actually explicitly check if the last page we parse has a next_page attribute, and also parse that. This methods seems to work so far.

__repr__() → str

Return repr(self).

class dissect.esedb.page.Tag(page: Page, num: int)

A tag is the “physical” data entry of a page.

Parameters:

• page – The Page this tag is in.

• num – The tag number to parse.

__slots__ = ('page', 'num', 'tag', 'offset', 'size', 'data', 'flags')

__repr__() → str

Return repr(self).

class dissect.esedb.page.Node(tag: Tag)

A node is the “logical” data entry of a page.

Parameters:

tag – The Tag to parse a node from.

__slots__ = ('tag', 'num', 'key', 'key_prefix', 'key_suffix', 'data')

class dissect.esedb.page.LeafNode(tag: Tag)

Bases: Node

Special leaf node.

__repr__() → str

Return repr(self).

class dissect.esedb.page.BranchNode(tag: Tag)

Bases: Node

Special branch node. Parses the child page information.

__slots__ = ('child',)

__repr__() → str

Return repr(self).