2.1. lf.win.dtypes — Common Microsoft Windows data types

This module provides support for several data types that are common to multiple Microsoft Windows artifacts.

2.1.1. Native data types

The following data types inherit from lf.dtypes.Native.

class lf.win.dtypes.BYTE
class lf.win.dtypes.CHAR
class lf.win.dtypes.DOUBLE
class lf.win.dtypes.DWORD
class lf.win.dtypes.DWORD32
class lf.win.dtypes.DWORD64
class lf.win.dtypes.DWORDLONG
class lf.win.dtypes.FILETIME
class lf.win.dtypes.HFILE
class lf.win.dtypes.INT
class lf.win.dtypes.INT8
class lf.win.dtypes.INT16
class lf.win.dtypes.INT32
class lf.win.dtypes.INT64
class lf.win.dtypes.LARGE_INTEGER
class lf.win.dtypes.LONG
class lf.win.dtypes.LONG32
class lf.win.dtypes.LONG64
class lf.win.dtypes.LONGLONG
class lf.win.dtypes.POINTER_32
class lf.win.dtypes.POINTER_64
class lf.win.dtypes.REAL
class lf.win.dtypes.REAL32
class lf.win.dtypes.SHORT
class lf.win.dtypes.UCHAR
class lf.win.dtypes.UINT
class lf.win.dtypes.UINT8
class lf.win.dtypes.UINT16
class lf.win.dtypes.UINT32
class lf.win.dtypes.UINT64
class lf.win.dtypes.ULONG
class lf.win.dtypes.ULONG32
class lf.win.dtypes.ULONG64
class lf.win.dtypes.ULONGLONG
class lf.win.dtypes.UNSIGNED32
class lf.win.dtypes.UNSIGNED64
class lf.win.dtypes.USHORT
class lf.win.dtypes.UTIME
class lf.win.dtypes.WCHAR
class lf.win.dtypes.WORD
class lf.win.dtypes.QWORD
class lf.win.dtypes.SHORT
class lf.win.dtypes.ATOM
class lf.win.dtypes.ATTRIBUTE_TYPE_CODE
class lf.win.dtypes.BOOLEAN
class lf.win.dtypes.COLORREF
class lf.win.dtypes.CURRENCY
class lf.win.dtypes.DATE
class lf.win.dtypes.HRESULT
class lf.win.dtypes.LANGID
class lf.win.dtypes.LCN
class lf.win.dtypes.LGRPID
class lf.win.dtypes.USN
class lf.win.dtypes.VARIANT_BOOL
class lf.win.dtypes.VCN

2.1.2. Record data types

The following data types inherit from lf.dtypes.Record.

class lf.win.dtypes.GUID_LE
class lf.win.dtypes.GUID_BE
class lf.win.dtypes.CLSID_LE
class lf.win.dtypes.CLSID_BE
class lf.win.dtypes.LCID_LE
class lf.win.dtypes.LCID_BE
class lf.win.dtypes.FILETIME_LE
class lf.win.dtypes.FILETIME_BE
class lf.win.dtypes.HRESULT_LE
class lf.win.dtypes.HRESULT_BE
class lf.win.dtypes.DECIMAL_LE
class lf.win.dtypes.DECIMAL_BE