binxml

package
v1.0.4 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 16, 2024 License: MIT Imports: 13 Imported by: 0

Documentation

Index

Constants

View Source 
const (
	Null       = 0x00
	String     = 0x01
	ANSIString = 0x02
	Int8       = 0x03
	Uint8      = 0x04
	Int16      = 0x05
	Uint16     = 0x06
	Int32      = 0x07
	Uint32     = 0x08
	Int64      = 0x09
	Uint64     = 0x0A
	Float32    = 0x0B
	Float64    = 0x0C
	Bool       = 0x0D
	Binary     = 0x0E
	GUID       = 0x0F
	SizeT      = 0x10
	FileTime   = 0x11
	SysTime    = 0x12
	SID        = 0x13
	HexInt32   = 0x14
	HexInt64   = 0x15
	BinXML     = 0x21
)

Variables

View Source 
var (
	ElementType              uint8 = 0x01
	ValueTextType            uint8 = 0x05
	AttributeType            uint8 = 0x06
	CDATAType                uint8 = 0x07
	CharRefType              uint8 = 0x08
	EntityRefType            uint8 = 0x09
	ProcInstType             uint8 = 0x0B
	NormalSubstitutionType   uint8 = 0x0D
	OptionalSubstitutionType uint8 = 0x0E
)
View Source 
var (
	Debug = false
)
View Source 
var (
	ExcludeSize = excludeSize{}
)

Functions

func NameHash 

func NameHash(s string) uint16

func RenderXML 

func RenderXML(b []byte) (string, error)

Types

type Attribute 

type Attribute struct {
	More bool       `json:"has_more"`
	Name *Name      `json:"name"`
	Data []*Content `json:"data"`
}

func (*Attribute) Decode 

func (a *Attribute) Decode(r *Reader) error

type Bookmark 

type Bookmark struct {
	// A 32-bit unsigned integer that contains the total size in bytes of the
	// bookmark, including the header and logRecordNumbers.
	BookmarkSize uint32 `json:"bookmark_size"`
	// A 32-bit unsigned integer, and MUST be set to 0x00000018.
	HeaderSize uint32 `json:"header_size"`
	// A 32-bit unsigned integer that contains the number of channels in the
	// query. This is the number of elements in logRecordNumbers.
	LogRecordNumbersSize uint32 `json:"log_record_numbers_size"`
	// A 32-bit unsigned integer that indicates what channel the current
	// event is from.
	CurrentChannel uint32 `json:"current_channel"`
	// A 32-bit unsigned integer that contains the read direction. 0x00000000
	// indicates chronological order based on time written, and 0x00000001
	// indicates reverse order.
	ReadDirection uint32 `json:"read_direction"`
	// A 32-bit unsigned integer that contains the byte offset from the start
	// of the header to logRecordNumbers.
	RecordIDsOffset uint32 `json:"record_ids_offset"`
	// An array of 64-bit unsigned integers that contain the record numbers
	// for each of the channels or backup event logs. The order of the record
	// numbers MUST match the order of the channels or backup event logs in
	// the query (for example, the first channel in the query corresponds to
	// the first member of the array).
	LogRecordNumbers []uint64 `json:"log_record_numbers"`
}

A query can refer to several channels or backup event logs. A subscription can refer to several channels. To accurately record the state of a query, it is necessary to know where the file cursor (bookmark) is with respect to those channels or backup event logs. The bookmark data is encoded as follows. Note that all integer fields in this structure MUST be in little-endian byte order (that is, least significant byte first).

func (*Bookmark) Decode 

func (o *Bookmark) Decode(r *Reader) error

type Content 

type Content struct {
	Type         uint8         `json:"type"`
	More         bool          `json:"-"`
	Element      *Element      `json:"element,omitempty"`
	Text         string        `json:"text_value,omitempty"`
	Substitution *Substitution `json:"substitution,omitempty"`
	CharRef      uint16        `json:"char_ref,omitempty"`
	EntityRef    *Name         `json:"entitiy_ref,omitempty"`
	CDATA        string        `json:"cdata,omitempty"`
	ProcInst     *ProcInst     `json:"pidata,omitempty"`
}

func (*Content) Decode 

func (c *Content) Decode(r *Reader) error

func (*Content) ReadTag 

func (c *Content) ReadTag(r *Reader) error

type Document 

type Document struct {
	Prolog   *ProcInst `json:"prolog,omitempty"`
	Fragment *Fragment `json:"fragment"`
	Misc     *ProcInst `json:"misc,omitempty"`
}

func (*Document) Decode 

func (o *Document) Decode(r *Reader) error

type Element 

type Element struct {
	HasAttr      bool         `json:"has_attr"`
	IsOpenClose  bool         `json:"is_open_close,omitempty"`
	DependencyID int16        `json:"dependency_id"`
	Name         *Name        `json:"name"`
	Attributes   []*Attribute `json:"attributes,omitempty"`
	Content      []*Content   `json:"content,omitempty"`
}

func (*Element) Decode 

func (o *Element) Decode(r *Reader) error

type Fragment 

type Fragment struct {
	MajorVersion uint8     `json:"major_ver"`
	MinorVersion uint8     `json:"minor_ver"`
	Flags        uint8     `json:"flags"`
	Template     *Template `json:"template,omitempty"`
	Element      *Element  `json:"element,omitempty"`
}

func (*Fragment) Decode 

func (o *Fragment) Decode(r *Reader) error

type Name 

type Name struct {
	Hash uint16 `json:"name_hash"`
	Name string `json:"name"`
}

func (*Name) Decode 

func (n *Name) Decode(r *Reader) error

func (*Name) String 

func (n *Name) String() string

type ProcInst 

type ProcInst struct {
	Target *Name  `json:"target"`
	Data   string `json:"data"`
}

func (*ProcInst) Decode 

func (o *ProcInst) Decode(r *Reader) error

type Reader 

type Reader struct {
	binary.ByteOrder
	// contains filtered or unexported fields
}

func NewReader 

func NewReader(b []byte) *Reader

func (*Reader) Begin 

func (r *Reader) Begin(ctx string)

func (*Reader) Done 

func (r *Reader) Done() error

func (*Reader) Read 

func (r *Reader) Read(data any) (int, error)

func (*Reader) ReadTag 

func (r *Reader) ReadTag(expect ...uint8) uint8

func (*Reader) ReadTagAndMore 

func (r *Reader) ReadTagAndMore(expect ...uint8) (uint8, bool)

func (*Reader) ReadUTF16NStringWithSize 

func (r *Reader) ReadUTF16NStringWithSize(s any) error

func (*Reader) ReadUTF16String 

func (r *Reader) ReadUTF16String(s any, sz int) error

func (*Reader) ReadUTF16StringWithSize 

func (r *Reader) ReadUTF16StringWithSize(s any) error

func (*Reader) ReadWithBytes 

func (r *Reader) ReadWithBytes(b []byte, f interface{}) error

func (*Reader) ReadWithLen 

func (r *Reader) ReadWithLen(f interface{}, excludeSize ...excludeSize) error

func (*Reader) SetSize 

func (r *Reader) SetSize(sz *uint32)

func (*Reader) WithErr 

func (r *Reader) WithErr(err ...error) error

func (*Reader) WithErrf 

func (r *Reader) WithErrf(frmt string, args ...interface{}) error

type Renderer 

type Renderer struct {
	EscapeText bool
	// contains filtered or unexported fields
}

func NewRenderer 

func NewRenderer() *Renderer

func (*Renderer) Render 

func (r *Renderer) Render(o interface{}) string

type ResultSet 

type ResultSet struct {
	// A 32-bit unsigned integer that contains the total size in bytes of this
	// structure, including the header.
	TotalSize uint32 `json:"total_size"`
	// This MUST always be set to 0x00000010.
	HeaderSize uint32 `json:"header_size"`
	// This MUST always be set to 0x00000010.
	EventOffset uint32 `json:"event_offset"`
	// A 32-bit unsigned integer that contains the byte offset from the start
	// of this structure to bookMarkData.
	BookmarkOffset uint32 `json:"bookmark_offset"`
	// Size in bytes of the BinXml data in the eventData field.
	BinXMLSize uint32 `json:"binxml_size"`
	// A byte-array that contains variable length BinXml data.
	Document *Document `json:"document"`
	// Number of subqueryIDs fields that follow. This is 0 if the event
	// is selected by an XPath expression (rather than a structured XML query).
	SubqueriesLength uint32 `json:"subqueries_length"`
	// An array of subquery IDs. Events that are selected using a structured
	// XML query can be selected by one or more subqueries. Each subquery has
	// either an ID specified in the XML element that defines the subquery,
	// or defaults to 0xFFFFFFFF. This list has an entry for each subquery
	// that matches the event. If two subqueries select the event, and both
	// use the same ID, the ID only is listed once.
	Subqueries []uint32 `json:"subqueries"`
	// A byte-array that contains variable length bookmark data.
	Bookmark *Bookmark `json:"bookmark"`
}

An event query or subscription returns multiple events in the result set. The result set is a buffer containing one or more variable length EVENT_DESCRIPTOR structures, as specified in [MS-DTYP] section 2.3.1. Methods that return multiple events always return an array of offsets into the buffer for the individual events.

func Unmarshal 

func Unmarshal(b []byte) (*ResultSet, error)

func (*ResultSet) Decode 

func (o *ResultSet) Decode(r *Reader) error

type Substitution 

type Substitution struct {
	IsOptional bool   `json:"optional,omitempty"`
	ID         uint16 `json:"id"`
	Type       uint8  `json:"type"`
}

func (*Substitution) Decode 

func (s *Substitution) Decode(r *Reader) error

type Template 

type Template struct {
	ID       *uuid.UUID      `json:"template_id"`
	Length   uint32          `json:"template_size"`
	Fragment *Fragment       `json:"fragment"`
	Values   *TemplateValues `json:"values"`
}

func (*Template) Decode 

func (o *Template) Decode(r *Reader) error

type TemplateValues 

type TemplateValues struct {
	Values       []*Value `json:"values"`
	ValuesLength uint32   `json:"values_length"`
}

func (*TemplateValues) Decode 

func (o *TemplateValues) Decode(r *Reader) error

type Value 

type Value struct {
	ID      int           `json:"id"`
	Length  uint16        `json:"length,omitempty"`
	Type    uint8         `json:"type"`
	IsArray bool          `json:"is_array,omitempty"`
	Data    []interface{} `json:"data,omitempty"`
	Raw     []byte        `json:"-"`
}

func (*Value) Decode 

func (v *Value) Decode(r *Reader) error

func (*Value) DecodeValue 

func (o *Value) DecodeValue(b []byte) error

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.