# Generated by cstruct-stubgen
from typing import BinaryIO, TypeAlias, overload

import dissect.cstruct as __cs__

class _c_evtx(__cs__.cstruct):
    class EVTX_HEADER(__cs__.Structure):
        magic: __cs__.CharArray
        first_chunk: _c_evtx.uint64
        last_chunk: _c_evtx.uint64
        next_record_id: _c_evtx.uint64
        header_size: _c_evtx.uint32
        minor_version: _c_evtx.uint16
        major_version: _c_evtx.uint16
        header_block_size: _c_evtx.uint16
        num_chunks: _c_evtx.uint16
        _padding: __cs__.CharArray
        flags: _c_evtx.uint32
        checksum: _c_evtx.uint32
        @overload
        def __init__(
            self,
            magic: __cs__.CharArray | None = ...,
            first_chunk: _c_evtx.uint64 | None = ...,
            last_chunk: _c_evtx.uint64 | None = ...,
            next_record_id: _c_evtx.uint64 | None = ...,
            header_size: _c_evtx.uint32 | None = ...,
            minor_version: _c_evtx.uint16 | None = ...,
            major_version: _c_evtx.uint16 | None = ...,
            header_block_size: _c_evtx.uint16 | None = ...,
            num_chunks: _c_evtx.uint16 | None = ...,
            _padding: __cs__.CharArray | None = ...,
            flags: _c_evtx.uint32 | None = ...,
            checksum: _c_evtx.uint32 | None = ...,
        ): ...
        @overload
        def __init__(self, fh: bytes | memoryview | bytearray | BinaryIO, /): ...

    class EVTX_CHUNK(__cs__.Structure):
        magic: __cs__.CharArray
        first_record_nr: _c_evtx.uint64
        last_record_nr: _c_evtx.uint64
        first_record_id: _c_evtx.uint64
        last_record_id: _c_evtx.uint64
        header_size: _c_evtx.uint32
        last_record_offset: _c_evtx.uint32
        free_space_offset: _c_evtx.uint32
        records_checksum: _c_evtx.uint32
        _padding: __cs__.CharArray
        flags: _c_evtx.uint32
        checksum: _c_evtx.uint32
        string_offsets: __cs__.Array[_c_evtx.uint32]
        template_ptr: __cs__.Array[_c_evtx.uint32]
        @overload
        def __init__(
            self,
            magic: __cs__.CharArray | None = ...,
            first_record_nr: _c_evtx.uint64 | None = ...,
            last_record_nr: _c_evtx.uint64 | None = ...,
            first_record_id: _c_evtx.uint64 | None = ...,
            last_record_id: _c_evtx.uint64 | None = ...,
            header_size: _c_evtx.uint32 | None = ...,
            last_record_offset: _c_evtx.uint32 | None = ...,
            free_space_offset: _c_evtx.uint32 | None = ...,
            records_checksum: _c_evtx.uint32 | None = ...,
            _padding: __cs__.CharArray | None = ...,
            flags: _c_evtx.uint32 | None = ...,
            checksum: _c_evtx.uint32 | None = ...,
            string_offsets: __cs__.Array[_c_evtx.uint32] | None = ...,
            template_ptr: __cs__.Array[_c_evtx.uint32] | None = ...,
        ): ...
        @overload
        def __init__(self, fh: bytes | memoryview | bytearray | BinaryIO, /): ...

    class EVTX_RECORD(__cs__.Structure):
        signature: _c_evtx.uint32
        size: _c_evtx.uint32
        record_id: _c_evtx.uint64
        time_written: _c_evtx.uint64
        data: __cs__.CharArray
        size_copy: _c_evtx.uint32
        @overload
        def __init__(
            self,
            signature: _c_evtx.uint32 | None = ...,
            size: _c_evtx.uint32 | None = ...,
            record_id: _c_evtx.uint64 | None = ...,
            time_written: _c_evtx.uint64 | None = ...,
            data: __cs__.CharArray | None = ...,
            size_copy: _c_evtx.uint32 | None = ...,
        ): ...
        @overload
        def __init__(self, fh: bytes | memoryview | bytearray | BinaryIO, /): ...

# Technically `c_evtx` is an instance of `_c_evtx`, but then we can't use it in type hints
c_evtx: TypeAlias = _c_evtx
