ese
import "github.com/TheManticoreProject/Manticore/windows/database/ese"
Package ese implements a read-only parser for Extensible Storage Engine (ESE / JET Blue) database files (EDB), the on-disk format used by Active Directory’s NTDS.dit (as well as Windows Search, Exchange, etc.).
It exposes enough of the format to enumerate tables and iterate rows with typed column access — the subset needed to read NTDS.dit’s datatable and link_table. The implementation follows the behaviour of impacket’s ese.py and the libesedb format documentation.
References:
- libesedb “Extensible Storage Engine (ESE) Database File (EDB) format” https://github.com/libyal/libesedb
- impacket ese.py (ESENT_DB)
Index
Constants
JET column types (subset).
const (
JetColtypNil = 0
JetColtypBit = 1
JetColtypUnsignedByte = 2
JetColtypShort = 3
JetColtypLong = 4
JetColtypCurrency = 5
JetColtypIEEESingle = 6
JetColtypIEEEDouble = 7
JetColtypDateTime = 8
JetColtypBinary = 9
JetColtypText = 10
JetColtypLongBinary = 11
JetColtypLongText = 12
JetColtypUnsignedLong = 14
JetColtypLongLong = 15
JetColtypGUID = 16
JetColtypUnsignedShort = 17
)
type Column
Column describes one column of a table (from the catalog).
type Column struct {
Name string
ID uint32
Type uint32
SpaceUsage uint32
CodePage uint32
}
type Cursor
Cursor iterates the rows of a table’s data B-tree, left to right across leaf pages. The zero value is not usable; obtain one from Table.Rows.
type Cursor struct {
// contains filtered or unexported fields
}
func (*Cursor) Err
func (c *Cursor) Err() error
Err returns the first error encountered during iteration, if any.
func (*Cursor) Next
func (c *Cursor) Next() bool
Next advances to the next row, returning false at the end (check Err afterwards).
func (*Cursor) Row
func (c *Cursor) Row() *Row
Row returns the current row (valid after Next returns true).
type Database
Database is an opened ESE database.
type Database struct {
// contains filtered or unexported fields
}
func Open
func Open(path string) (*Database, error)
Open opens and parses the ESE database at path. Call Close when done.
func OpenBytes
func OpenBytes(data []byte) (*Database, error)
OpenBytes parses an ESE database from an in-memory image.
func (*Database) Close
func (d *Database) Close() error
Close releases the underlying file (no-op for OpenBytes).
func (*Database) PageSize
func (d *Database) PageSize() int
PageSize returns the database page size in bytes.
func (*Database) Table
func (d *Database) Table(name string) (*Table, error)
Table returns the named table, or an error if it does not exist.
func (*Database) TableNames
func (d *Database) TableNames() []string
TableNames returns the table names in catalog order.
type Row
Row is a decoded data record: column values by column ID, as raw on-disk bytes.
type Row struct {
// contains filtered or unexported fields
}
func (*Row) Has
func (r *Row) Has(name string) bool
Has reports whether the named column is present (non-empty) in this row.
func (*Row) Int64
func (r *Row) Int64(name string) (int64, bool)
Int64 returns the named column decoded as a little-endian int64.
func (*Row) Raw
func (r *Row) Raw(name string) ([]byte, bool)
Raw returns the raw bytes of the named column.
func (*Row) RawByID
func (r *Row) RawByID(id uint32) ([]byte, bool)
RawByID returns the raw bytes of the column with the given ID.
func (*Row) String
func (r *Row) String(name string) (string, bool)
String decodes the named text column to a Go string, honouring its code page (UTF-16LE for Unicode columns, otherwise byte-for-byte).
func (*Row) Uint32
func (r *Row) Uint32(name string) (uint32, bool)
Uint32 returns the named column decoded as a little-endian uint32.
type Table
Table describes one table and its columns (from the catalog).
type Table struct {
Name string
// contains filtered or unexported fields
}
func (*Table) Columns
func (t *Table) Columns() []*Column
Columns returns the table’s columns in catalog order.
func (*Table) Rows
func (t *Table) Rows() (*Cursor, error)
Rows returns a cursor positioned before the first row of the table. It descends the data B-tree to the left-most leaf page.