scripts: evtx_record_structure: refactor and cleanup

Author: williballenthin

scripts/evtx_record_structure.py

@@ -1,34 +1,38 @@
 #!/usr/bin/env python
 import hexdump
 
-from Evtx.Evtx import Evtx
+import Evtx.Evtx as evtx
 from Evtx.Nodes import RootNode
 from Evtx.Nodes import BXmlTypeNode
 from Evtx.Nodes import TemplateInstanceNode
 from Evtx.Nodes import VariantTypeNode
-from Evtx.Views import evtx_record_xml_view
 
 
 def describe_root(record, root, indent=0, suppress_values=False):
     """
-    @type record: Record
-    @type indent: int
-    @rtype: None
+    Args:
+      record (Evtx.Record):
+      indent (int):
     """
     def format_node(n, extra=None, indent=0):
         """
         Depends on closure over `record` and `suppress_values`.
-        @type n: BXmlNode
-        @type extra: str
-        @rtype: str
+
+        Args:
+          n (Evtx.Nodes.BXmlNode):
+          extra (str):
+
+        Returns:
+          str:
         """
         ret = ""
+        indent_s = '  ' * indent
+        name = n.__class__.__name__
+        offset = n.offset() - record.offset()
         if extra is not None:
-            ret = "%s%s(offset=%s, %s)" % \
-                   ("  " * indent, n.__class__.__name__, hex(n.offset() - record.offset()), extra)
+            ret = "%s%s(offset=%s, %s)" % (indent_s, name, hex(offset), extra)
         else:
-            ret = "%s%s(offset=%s)" % \
-                   ("  " * indent, n.__class__.__name__, hex(n.offset() - record.offset()))
+            ret = "%s%s(offset=%s)" % (indent_s, name, hex(offset))
 
         if not suppress_values and isinstance(n, VariantTypeNode):
             ret += " --> %s" % (n.string())
@@ -40,14 +44,18 @@ def format_node(n, extra=None, indent=0):
 
     def rec(node, indent=0):
         """
-        @type node: BXmlNode
-        @type indent: int
-        @rtype: str
+        Args:
+          node (Evtx.Nodes.BXmlNode):
+          indent (int):
+
+        Returns:
+          str:
         """
         ret = ""
         if isinstance(node, TemplateInstanceNode):
             if node.is_resident_template():
-                ret += "%s\n" % (format_node(node, extra="resident=True, length=%s" % (hex(node.template().data_length())), indent=indent))
+                extra = "resident=True, length=%s" % (hex(node.template().data_length()))
+                ret += "%s\n" % (format_node(node, extra=extra, indent=indent))
                 ret += rec(node.template(), indent=indent + 1)
             else:
                 ret += "%s\n" % (format_node(node, extra="resident=False", indent=indent))
@@ -56,12 +64,15 @@ def rec(node, indent=0):
 
         for child in node.children():
             ret += rec(child, indent=indent + 1)
+
         if isinstance(node, RootNode):
             ofs = node.tag_and_children_length()
-            ret += "%sSubstitutions(offset=%s)\n" % ("  " * (indent + 1),
-                                                     hex(node.offset() - record.offset() + ofs))
+            indent_s = '  ' * (indent + 1)
+            offset = node.offset() - record.offset() + ofs
+            ret += "%sSubstitutions(offset=%s)\n" % (indent_s, hex(offset))
             for sub in node.substitutions():
                 ret += "%s\n" % (format_node(sub, indent=indent + 2))
+
         return ret
 
     ret = ""
@@ -82,15 +93,13 @@ def main():
                         help="Do not print the values of substitutions.")
     args = parser.parse_args()
 
-    with Evtx(args.evtx) as evtx:
-        hexdump.hexdump(evtx.get_record(args.record).data())
+    with evtx.Evtx(args.evtx) as log:
+        hexdump.hexdump(log.get_record(args.record).data())
 
-        print(("record(absolute_offset=%s)" % \
-                  (evtx.get_record(args.record).offset())))
-        print(describe_root(evtx.get_record(args.record),
-                            evtx.get_record(args.record).root(),
-                            suppress_values=args.suppress_values))
-        print(evtx_record_xml_view(evtx.get_record(args.record)))
+        record = log.get_record(args.record)
+        print("record(absolute_offset=%s)" % record.offset())
+        print(describe_root(record, record.root(), suppress_values=args.suppress_values))
+        print(record.xml())
 
 
 if __name__ == "__main__":