dissect.archive.wim

Module Contents

Classes

WIM

Windows Imaging Format implementation.

Resource

Image

SecurityBlock

DirectoryEntry

ReparsePoint

Utility class for parsing reparse point buffers.

CompressedStream

Basic buffered stream that provides easy aligned reads.

Attributes

DEFAULT_CHUNK_SIZE

dissect.archive.wim.DEFAULT_CHUNK_SIZE
class dissect.archive.wim.WIM(fh: BinaryIO)

Windows Imaging Format implementation.

Supports reading resources and browsing images from WIM files.

property resources: dict[bytes, Resource]

Return the table of resources in the WIM file.

images() → Iterator[Image]

Iterate over all images in the WIM file.

class dissect.archive.wim.Resource(wim: WIM, size: int, flags: dissect.archive.c_wim.RESHDR_FLAG, offset: int, original_size: int, part_number: int | None = None, reference_count: int | None = None, hash: bytes | None = None)
property is_metadata: bool
property is_compressed: bool
property is_spanned: bool
__slots__ = ('wim', 'size', 'flags', 'offset', 'original_size', 'part_number', 'reference_count', 'hash')
classmethod from_short_header(wim: WIM, reshdr: dissect.archive.c_wim.c_wim.RESHDR_DISK_SHORT) → Resource
classmethod from_header(wim: WIM, reshdr: dissect.archive.c_wim.c_wim.RESHDR_DISK) → Resource
open() → BinaryIO
class dissect.archive.wim.Image(wim: WIM, fh: BinaryIO)
__repr__() → str

Return repr(self).

get(path: str, entry: DirectoryEntry | None = None) → DirectoryEntry
class dissect.archive.wim.SecurityBlock(fh: BinaryIO)
class dissect.archive.wim.DirectoryEntry(image: Image, fh: BinaryIO)
property last_write_time_ns: int

Return the last write time in nanoseconds.

__repr__() → str

Return repr(self).

is_dir() → bool

Return whether this entry is a directory.

is_file() → bool

Return whether this entry is a regular file.

is_reparse_point() → bool

Return whether this entry is a reparse point.

Return whether this entry is a symlink reparse point.

is_mount_point() → bool

Return whether this entry is a mount point reparse point.

reparse_point() → ReparsePoint

Return parsed reparse point data if this directory entry is a reparse point.

size(name: str = '') → int

Return the entry size.

creation_time() → datetime.datetime

Return the creation time.

creation_time_ns() → int

Return the creation time in nanoseconds.

last_access_time() → datetime.datetime

Return the last access time.

last_access_time_ns() → int

Return the last access time in nanoseconds.

last_write_time() → datetime.datetime

Return the last write time.

listdir() → dict[str, DirectoryEntry]

Return a directory listing.

iterdir() → Iterator[DirectoryEntry]

Iterate directory contents.

open(name: str = '') → BinaryIO

Return a file-like object for the contents of this directory entry.

Parameters:

name – Optional alternate stream name to open.

class dissect.archive.wim.ReparsePoint(tag: dissect.archive.c_wim.IO_REPARSE_TAG, fh: BinaryIO)

Utility class for parsing reparse point buffers.

Parameters:

  • tag – The type of reparse point to parse.

  • fh – A file-like object of the reparse point buffer.

property substitute_name: str | None
property print_name: str | None
property absolute: bool
property relative: bool
class dissect.archive.wim.CompressedStream(fh: BinaryIO, offset: int, compressed_size: int, original_size: int, decompressor: Callable[[bytes], bytes])

Bases: dissect.util.stream.AlignedStream

Basic buffered stream that provides easy aligned reads.

Must be subclassed for various stream implementations. Subclasses can implement:

  • _read(offset, length)

  • _seek(pos, whence=io.SEEK_SET)

The offset and length for _read are guaranteed to be aligned. The only time that overriding _seek would make sense is if there’s no known size of your stream, but still want to provide SEEK_END functionality.

Most subclasses of AlignedStream take one or more file-like objects as source. Operations on these subclasses, like reading, will modify the source file-like object as a side effect.

Parameters:

  • size – The size of the stream. This is used in read and seek operations. None if unknown.

  • align – The alignment size. Read operations are aligned on this boundary. Also determines buffer size.