ese-parser 0.1.5__cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
ese_parser/__init__.py
ADDED
|
Binary file
|
|
@@ -0,0 +1,105 @@
|
|
|
1
|
+
Metadata-Version: 2.4
|
|
2
|
+
Name: ese-parser
|
|
3
|
+
Version: 0.1.5
|
|
4
|
+
Summary: High-performance Microsoft ESE (Extensible Storage Engine) database parser
|
|
5
|
+
Keywords: ese,database,parser,forensics,edb
|
|
6
|
+
Author: Claude Sonnet 4.5 (LOL no way im doin this by myself)
|
|
7
|
+
License: MIT OR Apache-2.0
|
|
8
|
+
Description-Content-Type: text/markdown; charset=UTF-8; variant=GFM
|
|
9
|
+
Project-URL: Documentation, https://docs.rs/ese-parser
|
|
10
|
+
Project-URL: Source Code, https://github.com/ac-rn/ese-rs
|
|
11
|
+
|
|
12
|
+
# ESE-RS
|
|
13
|
+
|
|
14
|
+
High-performance Microsoft ESE (Extensible Storage Engine) database parser written in Rust with Python bindings.
|
|
15
|
+
|
|
16
|
+
## Features
|
|
17
|
+
|
|
18
|
+
- 🚀 **40x faster** than Impacket's Python implementations
|
|
19
|
+
- 🦀 **Memory-safe** Rust implementation
|
|
20
|
+
- 🐍 **Python bindings** via PyO3
|
|
21
|
+
- 📦 **Zero-copy parsing** where possible
|
|
22
|
+
- 🔧 **Cross-platform** (Windows, Linux, macOS)
|
|
23
|
+
|
|
24
|
+
## Installation
|
|
25
|
+
|
|
26
|
+
### Python
|
|
27
|
+
|
|
28
|
+
```bash
|
|
29
|
+
pip install ese-parser
|
|
30
|
+
```
|
|
31
|
+
|
|
32
|
+
### Rust
|
|
33
|
+
|
|
34
|
+
```toml
|
|
35
|
+
[dependencies]
|
|
36
|
+
ese-rs = "0.1"
|
|
37
|
+
```
|
|
38
|
+
|
|
39
|
+
## Quick Start
|
|
40
|
+
|
|
41
|
+
### Python
|
|
42
|
+
|
|
43
|
+
```python
|
|
44
|
+
from ese_parser import EseDatabase
|
|
45
|
+
|
|
46
|
+
# Open database
|
|
47
|
+
db = EseDatabase("database.edb")
|
|
48
|
+
|
|
49
|
+
# List tables
|
|
50
|
+
for table in db.get_tables():
|
|
51
|
+
print(table)
|
|
52
|
+
|
|
53
|
+
# Read table
|
|
54
|
+
records = db.read_table("MSysObjects")
|
|
55
|
+
for record in records:
|
|
56
|
+
print(record)
|
|
57
|
+
```
|
|
58
|
+
|
|
59
|
+
### Rust
|
|
60
|
+
|
|
61
|
+
```rust
|
|
62
|
+
use ese_rs::Database;
|
|
63
|
+
|
|
64
|
+
fn main() -> Result<(), Box<dyn std::error::Error>> {
|
|
65
|
+
let db = Database::open("database.edb")?;
|
|
66
|
+
|
|
67
|
+
let mut cursor = db.open_table(b"MSysObjects")?;
|
|
68
|
+
while let Some(record) = cursor.next_row()? {
|
|
69
|
+
println!("{:?}", record);
|
|
70
|
+
}
|
|
71
|
+
|
|
72
|
+
Ok(())
|
|
73
|
+
}
|
|
74
|
+
```
|
|
75
|
+
|
|
76
|
+
## Documentation
|
|
77
|
+
|
|
78
|
+
- [Python API Documentation](python/README.md)
|
|
79
|
+
- [Examples](examples/)
|
|
80
|
+
|
|
81
|
+
## Performance
|
|
82
|
+
|
|
83
|
+
Benchmark parsing 340,288+ records from 3 databases:
|
|
84
|
+
|
|
85
|
+
- **Python (Impacket)**: 82.12 seconds
|
|
86
|
+
- **Rust (ese-rs)**: 2.18 seconds
|
|
87
|
+
- **Speedup**: 37.69x
|
|
88
|
+
|
|
89
|
+
## Supported Database Types
|
|
90
|
+
|
|
91
|
+
- Windows Search (`.edb`)
|
|
92
|
+
- Active Directory (`.dit`)
|
|
93
|
+
- Exchange (`.edb`)
|
|
94
|
+
- SRUM (`SRUDB.dat`)
|
|
95
|
+
- WebCache (`WebCacheV*.dat`)
|
|
96
|
+
- Any ESE database (Windows 2003+)
|
|
97
|
+
|
|
98
|
+
## License
|
|
99
|
+
|
|
100
|
+
Dual-licensed under MIT OR Apache-2.0.
|
|
101
|
+
|
|
102
|
+
## Acknowledgments
|
|
103
|
+
|
|
104
|
+
Based on the ESE format specification and inspired by Impacket's ese.py implementation.
|
|
105
|
+
|
|
@@ -0,0 +1,5 @@
|
|
|
1
|
+
ese_parser-0.1.5.dist-info/METADATA,sha256=0RY84s6lWamthlq7UCITZsi3xui3Nf88zU2Pj0yZJDA,2146
|
|
2
|
+
ese_parser-0.1.5.dist-info/WHEEL,sha256=eH6P3IzsjilZKce3GMnpqPjrTsuWgV_aktrl4raaW14,143
|
|
3
|
+
ese_parser/__init__.py,sha256=eX3k-7r_R-3QhUNjVIKchAPrsVjxOTfgspzo3E50Vt4,123
|
|
4
|
+
ese_parser/ese_parser.cpython-39-x86_64-linux-gnu.so,sha256=94qCf2qzo-b64SjjMApCEvc2BZ3JCo_qXyeBhzMCoHU,844424
|
|
5
|
+
ese_parser-0.1.5.dist-info/RECORD,,
|