dissect.cstruct.types
#
Submodules#
dissect.cstruct.types.base
dissect.cstruct.types.bytesinteger
dissect.cstruct.types.chartype
dissect.cstruct.types.enum
dissect.cstruct.types.flag
dissect.cstruct.types.instance
dissect.cstruct.types.packedtype
dissect.cstruct.types.pointer
dissect.cstruct.types.structure
dissect.cstruct.types.voidtype
dissect.cstruct.types.wchartype
Package Contents#
Classes#
Implements a fixed or dynamically sized array type. |
|
Base class for cstruct type classes. |
|
Base class for raw types that have a name and size. |
|
Implements an integer type that can span an arbitrary amount of bytes. |
|
Implements a character type that can properly handle strings. |
|
Implements an Enum type. |
|
Implements a value instance of an Enum |
|
Implements a Flag type. |
|
Implements a value instance of a Flag |
|
Holds parsed structure data. |
|
Implements a packed type that uses Python struct packing characters. |
|
Implements a pointer to some other type. |
|
Like the Instance class, but for structures referenced by a pointer. |
|
Holds a structure field. |
|
Type class for structures. |
|
Type class for unions |
|
Implements a void type. |
|
Implements a wide-character type. |
- class dissect.cstruct.types.Array(cstruct: Array.__init__.cstruct, type_: BaseType, count: int)#
Bases:
BaseType
Implements a fixed or dynamically sized array type.
Example
When using the default C-style parser, the following syntax is supported:
x[3] -> 3 -> static length. x[] -> None -> null-terminated. x[expr] -> expr -> dynamic length.
- __repr__() str #
Return repr(self).
- __len__() int #
- default() List[Any] #
Return a default value of this type.
- class dissect.cstruct.types.BaseType(cstruct: BaseType.__init__.cstruct)#
Base class for cstruct type classes.
- __call__(*args, **kwargs) Any #
- reads(data: bytes) Any #
Parse the given data according to the type that implements this class.
- Parameters:
data – Byte string to parse.
- Returns:
The parsed value of this type.
- dumps(data: Any) bytes #
Dump the given data according to the type that implements this class.
- Parameters:
data – Data to dump.
- Returns:
The resulting bytes.
- Raises:
ArraySizeError – Raised when
len(data)
does not match the size of a statically sized array field.
- read(obj: BinaryIO, *args, **kwargs) Any #
Parse the given data according to the type that implements this class.
- Parameters:
obj – Data to parse. Can be a (byte) string or a file-like object.
- Returns:
The parsed value of this type.
- write(stream: BinaryIO, data: Any) int #
Write the given data to a writable file-like object according to the type that implements this class.
- Parameters:
stream – Writable file-like object to write to.
data – Data to write.
- Returns:
The amount of bytes written.
- Raises:
ArraySizeError – Raised when
len(data)
does not match the size of a statically sized array field.
- abstract default() Any #
Return a default value of this type.
- default_array(count: int) List[Any] #
Return a default array of this type.
- class dissect.cstruct.types.RawType(cstruct: RawType.__init__.cstruct, name: str = None, size: int = 0, alignment: int = None)#
Bases:
BaseType
Base class for raw types that have a name and size.
- __len__() int #
- __repr__() str #
Return repr(self).
- abstract default() Any #
Return a default value of this type.
- class dissect.cstruct.types.BytesInteger(cstruct: BytesInteger.__init__.cstruct, name: str, size: int, signed: bool, alignment: int = None)#
Bases:
dissect.cstruct.types.RawType
Implements an integer type that can span an arbitrary amount of bytes.
- static parse(buf: BinaryIO, size: int, count: int, signed: bool, endian: str) List[int] #
- default() int #
Return a default value of this type.
- default_array(count: int) List[int] #
Return a default array of this type.
- class dissect.cstruct.types.CharType(cstruct: CharType.__init__.cstruct)#
Bases:
dissect.cstruct.types.RawType
Implements a character type that can properly handle strings.
- class dissect.cstruct.types.Enum(cstruct: Enum.__init__.cstruct, name: str, type_: dissect.cstruct.types.BaseType, values: Dict[str, int])#
Bases:
dissect.cstruct.types.RawType
Implements an Enum type.
Enums can be made using any type. The API for accessing enums and their values is very similar to Python 3 native enums.
Example
When using the default C-style parser, the following syntax is supported:
- enum <name> [: <type>] {
<values>
};
For example, an enum that has A=1, B=5 and C=6 could be written like so:
- enum Testuint16 {
A, B=5, C
};
- __call__(value: Union[int, BinaryIO]) EnumInstance #
- __getitem__(attr: str) EnumInstance #
- __getattr__(attr: str) EnumInstance #
- __contains__(attr: str) bool #
- default() EnumInstance #
Return a default value of this type.
- default_array(count: int) List[EnumInstance] #
Return a default array of this type.
- class dissect.cstruct.types.EnumInstance(enum: Enum, value: int)#
Implements a value instance of an Enum
- property name: str#
- __eq__(value: Union[int, EnumInstance]) bool #
Return self==value.
- __ne__(value: Union[int, EnumInstance]) bool #
Return self!=value.
- __hash__() int #
Return hash(self).
- __str__() str #
Return str(self).
- __repr__() str #
Return repr(self).
- class dissect.cstruct.types.Flag(cstruct: Enum.__init__.cstruct, name: str, type_: dissect.cstruct.types.BaseType, values: Dict[str, int])#
Bases:
dissect.cstruct.types.Enum
Implements a Flag type.
Flags can be made using any type. The API for accessing flags and their values is very similar to Python 3 native flags.
Example
When using the default C-style parser, the following syntax is supported:
- flag <name> [: <type>] {
<values>
};
For example, a flag that has A=1, B=4 and C=8 could be written like so:
- flag Testuint16 {
A, B=4, C
};
- __call__(value: Union[int, BinaryIO]) FlagInstance #
- class dissect.cstruct.types.FlagInstance(enum: Enum, value: int)#
Bases:
dissect.cstruct.types.EnumInstance
Implements a value instance of a Flag
- property name: str#
- __nonzero__#
- __ror__#
- __rand__#
- __rxor__#
- __bool__()#
- __or__(other: Union[int, FlagInstance]) FlagInstance #
- __and__(other: Union[int, FlagInstance]) FlagInstance #
- __xor__(other: Union[int, FlagInstance]) FlagInstance #
- __invert__() FlagInstance #
- __str__() str #
Return str(self).
- __repr__() str #
Return repr(self).
- decompose() Tuple[List[str], int] #
- class dissect.cstruct.types.Instance(type_: dissect.cstruct.types.BaseType, values: Dict[str, Any], sizes: Dict[str, int] = None)#
Holds parsed structure data.
- __slots__ = ('_type', '_values', '_sizes')#
- __getattr__(attr: str) Any #
- __setattr__(attr: str, value: Any) None #
Implement setattr(self, name, value).
- __getitem__(item: str) Any #
- __contains__(attr: str) bool #
- __repr__() str #
Return repr(self).
- __len__() int #
- write(stream: BinaryIO) int #
Write this structure to a writable file-like object.
- Parameters:
fh – File-like objects that supports writing.
- Returns:
The amount of bytes written.
- class dissect.cstruct.types.PackedType(cstruct: PackedType.__init__.cstruct, name: str, size: int, packchar: str, alignment: int = None)#
Bases:
dissect.cstruct.types.RawType
Implements a packed type that uses Python struct packing characters.
- default() int #
Return a default value of this type.
- default_array(count: int) List[int] #
Return a default array of this type.
- class dissect.cstruct.types.Pointer(cstruct: Pointer.__init__.cstruct, target: dissect.cstruct.types.BaseType)#
Bases:
dissect.cstruct.types.RawType
Implements a pointer to some other type.
- __repr__() str #
Return repr(self).
- class dissect.cstruct.types.PointerInstance(type_: dissect.cstruct.types.BaseType, stream: BinaryIO, addr: int, ctx: Dict[str, Any])#
Like the Instance class, but for structures referenced by a pointer.
- __repr__() str #
Return repr(self).
- __str__() str #
Return str(self).
- __getattr__(attr: str) Any #
- __int__() int #
- __nonzero__() bool #
- __add__(other: Union[int, PointerInstance]) PointerInstance #
- __sub__(other: Union[int, PointerInstance]) PointerInstance #
- __mul__(other: Union[int, PointerInstance]) PointerInstance #
- __floordiv__(other: Union[int, PointerInstance]) PointerInstance #
- __mod__(other: Union[int, PointerInstance]) PointerInstance #
- __pow__(other: Union[int, PointerInstance]) PointerInstance #
- __lshift__(other: Union[int, PointerInstance]) PointerInstance #
- __rshift__(other: Union[int, PointerInstance]) PointerInstance #
- __and__(other: Union[int, PointerInstance]) PointerInstance #
- __xor__(other: Union[int, PointerInstance]) PointerInstance #
- __or__(other: Union[int, PointerInstance]) PointerInstance #
- __eq__(other: Union[int, PointerInstance]) bool #
Return self==value.
- dereference() Any #
- class dissect.cstruct.types.Field(name: str, type_: dissect.cstruct.types.BaseType, bits: int = None, offset: int = None)#
Holds a structure field.
- __repr__()#
Return repr(self).
- class dissect.cstruct.types.Structure(cstruct: Structure.__init__.cstruct, name: str, fields: List[Field] = None, align: bool = False, anonymous: bool = False)#
Bases:
dissect.cstruct.types.BaseType
Type class for structures.
- __len__() int #
- __repr__() str #
Return repr(self).
- add_field(name: str, type_: dissect.cstruct.types.BaseType, bits: int = None, offset: int = None) None #
Add a field to this structure.
- Parameters:
name – The field name.
type – The field type.
bits – The bit of the field.
offset – The field offset.
- default() dissect.cstruct.types.Instance #
Create and return an empty Instance from this structure.
- Returns:
An empty Instance from this structure.
- show(indent: int = 0) None #
Pretty print this structure.
- class dissect.cstruct.types.Union(cstruct: Structure.__init__.cstruct, name: str, fields: List[Field] = None, align: bool = False, anonymous: bool = False)#
Bases:
Structure
Type class for unions
- __repr__() str #
Return repr(self).
- abstract show(indent: int = 0) None #
Pretty print this structure.
- class dissect.cstruct.types.VoidType#
Bases:
dissect.cstruct.types.RawType
Implements a void type.
- class dissect.cstruct.types.WcharType(cstruct)#
Bases:
dissect.cstruct.types.RawType
Implements a wide-character type.
- property encoding: str#
- default() str #
Return a default value of this type.
- default_array(count: int) str #
Return a default array of this type.