dissect.cstruct.types.base

Module Contents

Classes

MetaType

Base metaclass for cstruct type classes.

BaseType

Base class for cstruct type classes.

ArrayMetaType

Base metaclass for array-like types.

Array

Implements a fixed or dynamically sized array type.

Attributes

EOF

dissect.cstruct.types.base.EOF = -3599
class dissect.cstruct.types.base.MetaType

Bases: type

Base metaclass for cstruct type classes.

cs: dissect.cstruct.cstruct.cstruct

The cstruct instance this type class belongs to.

size: int | None

The size of the type in bytes. Can be None for dynamic sized types.

dynamic: bool

Whether or not the type is dynamically sized.

alignment: int | None

The alignment of the type in bytes. A value of None will be treated as 1-byte aligned.

ArrayType: type[Array] = 'Array'

The array type for this type class.

__call__(*args, **kwargs) → MetaType | BaseType

Adds support for TypeClass(bytes | file-like object) parsing syntax.

__getitem__(num_entries: int | dissect.cstruct.expression.Expression | None) → ArrayMetaType

Create a new array with the given number of entries.

__len__() → int

Return the byte size of the type.

__default__() → BaseType

Return the default value of this type.

reads(data: bytes) → BaseType

Parse the given data from a bytes-like object.

Parameters:

data – Bytes-like object to parse.

Returns:

The parsed value of this type.

read(obj: BinaryIO | bytes) → BaseType

Parse the given data.

Parameters:

obj – Data to parse. Can be a bytes-like object or a file-like object.

Returns:

The parsed value of this type.

write(stream: BinaryIO, value: Any) → int

Write a value to a writable file-like object.

Parameters:

  • stream – File-like objects that supports writing.

  • value – Value to write.

Returns:

The amount of bytes written.

dumps(value: Any) → bytes

Dump a value to a byte string.

Parameters:

value – Value to dump.

Returns:

The raw bytes of this type.

class dissect.cstruct.types.base.BaseType

Base class for cstruct type classes.

dumps
write
__len__() → int

Return the byte size of the type.

class dissect.cstruct.types.base.ArrayMetaType

Bases: MetaType

Base metaclass for array-like types.

type: MetaType
num_entries: int | dissect.cstruct.expression.Expression | None
null_terminated: bool
__default__() → BaseType

Return the default value of this type.

class dissect.cstruct.types.base.Array

Bases: list, BaseType

Implements a fixed or dynamically sized array type.

Example

When using the default C-style parser, the following syntax is supported:

x[3] -> 3 -> static length. x[] -> None -> null-terminated. x[expr] -> expr -> dynamic length.