ADExplorerSnapshot.py icon indicating copy to clipboard operation
ADExplorerSnapshot.py copied to clipboard

Treeview support

Open c3c opened this issue 1 month ago • 0 comments

The treeview is the parent/child relationship between all DNs as visible in the ADExplorer GUI, and is stored along with the snapshot data so it doesn't have to be built on-demand. The snapshot structure is roughly:

- Header
- Object data
- Properties
- Classes
- Rights
- Treeview

Up until this point, we didn't support parsing the treeview yet. This PR will add support for reconstructing the treeview data based on object data in the dump in case the treeview is missing.

The treeview blob is roughly laid out as follows:

- Treeview header
     - magic
     - number of naming contexts
     - offsets to naming contexts [number_of_contexts]
- Naming contexts [number_of_contexts]
     -   ParentNode
         - objectOffset
         - number_of_children_with_children
         - number_of_children_without_children
         - children_offsets[number_of_children_with_children] # refers to new ParentNodes
         - inline_children_offsets[number_of_children_without_children] # these are direct objectOffsets
         ... data

Special care needs to be taken for parent DN nodes that aren't part of the object data. Since we don't have an object to refer to, we need to create an artificial/synthetic node. In this case, we'll insert the synthetic object data right before where the treeview data was expected before, and update the metadata header to the new offset.

This will allow support for Outflank async BOFs to recreate the treeview data. As a bonus, DNS data will be visible.

c3c avatar Dec 06 '25 20:12 c3c