Treeview support
The treeview is the parent/child relationship between all DNs as visible in the ADExplorer GUI, and is stored along with the snapshot data so it doesn't have to be built on-demand. The snapshot structure is roughly:
- Header
- Object data
- Properties
- Classes
- Rights
- Treeview
Up until this point, we didn't support parsing the treeview yet. This PR will add support for reconstructing the treeview data based on object data in the dump in case the treeview is missing.
The treeview blob is roughly laid out as follows:
- Treeview header
- magic
- number of naming contexts
- offsets to naming contexts [number_of_contexts]
- Naming contexts [number_of_contexts]
- ParentNode
- objectOffset
- number_of_children_with_children
- number_of_children_without_children
- children_offsets[number_of_children_with_children] # refers to new ParentNodes
- inline_children_offsets[number_of_children_without_children] # these are direct objectOffsets
... data
Special care needs to be taken for parent DN nodes that aren't part of the object data. Since we don't have an object to refer to, we need to create an artificial/synthetic node. In this case, we'll insert the synthetic object data right before where the treeview data was expected before, and update the metadata header to the new offset.
This will allow support for Outflank async BOFs to recreate the treeview data. As a bonus, DNS data will be visible.