Ejemplo n.º 1
0
 def createFields(self):
     yield Enum(Int32(self, "cputype"), CPU_TYPE)
     yield Int32(self, "cpusubtype")
     yield textHandler(UInt32(self, "offset"), hexadecimal)
     yield UInt32(self, "size")
     yield UInt32(self, "align")
     self['align'].createDescription = lambda: str(1 << self['align'].value)
Ejemplo n.º 2
0
    def createFields(self):
        # Header
        yield String(self, "magic", 4, "PMGL", charset="ASCII")
        yield filesizeHandler(Int32(self, "free_space",
                                    "Length of free space and/or quickref area at end of directory chunk"))
        yield Int32(self, "unknown")
        yield Int32(self, "previous", "Chunk number of previous listing chunk")
        yield Int32(self, "next", "Chunk number of previous listing chunk")

        # Entries
        stop = self.size - self["free_space"].value * 8
        entry_count = 0
        while self.current_size < stop:
            yield PMGL_Entry(self, "entry[]")
            entry_count += 1

        # Padding
        quickref_frequency = 1 + (1 << self["/dir/itsp/density"].value)
        num_quickref = (entry_count // quickref_frequency)
        if entry_count % quickref_frequency == 0:
            num_quickref -= 1
        print(self.current_size // 8, quickref_frequency, num_quickref)
        padding = (self["free_space"].value - (num_quickref * 2 + 2))
        if padding:
            yield PaddingBytes(self, "padding", padding)
        for i in range(num_quickref * quickref_frequency, 0, -quickref_frequency):
            yield UInt16(self, "quickref[%i]" % i)
        yield UInt16(self, "entry_count")
Ejemplo n.º 3
0
def parseProductInfo(parent, size):
    yield Int32(parent, "product_id")
    yield Int32(parent, "edition")
    yield UInt8(parent, "major_version")
    yield UInt8(parent, "minor_version")
    yield Int64(parent, "build_number")
    yield Int64(parent, "compilation_date")
Ejemplo n.º 4
0
 def createFields(self):
     yield String(self, "name", 32, strip="\0")
     yield PaddingBytes(self, "unknown[]", 32, pattern="\xCC")
     yield UInt32(self, "flags")
     yield UInt32(self, "id")
     yield UInt32(self, "type")
     yield Int32(self, "mesh_id")
     yield UInt32(self, "depth")
     yield Int32(self, "parent_offset")
     yield UInt32(self, "nchildren")
     yield UInt32(self, "first_child_offset")
     yield UInt32(self, "next_sibling_offset")
     yield Vertex(self, "pivot")
     yield Vertex(self, "position")
     yield Float32(self, "pitch")
     yield Float32(self, "yaw")
     yield Float32(self, "roll")
     for index in range(4):
         yield Vertex(self, "unknown_vertex[]")
     if self["parent_offset"].value != 0:
         yield UInt32(self, "parent_id")
     if self["first_child_offset"].value != 0:
         yield UInt32(self, "first_child_id")
     if self["next_sibling_offset"].value != 0:
         yield UInt32(self, "next_sibling_id")
Ejemplo n.º 5
0
 def createFields(self):
     yield Bytes(self, "id", 4, "Tcpdump identifier")
     yield UInt16(self, "maj_ver", "Major version")
     yield UInt16(self, "min_ver", "Minor version")
     yield Int32(self, "this_zone", "GMT to local time zone correction")
     yield Int32(self, "sigfigs", "accuracy of timestamps")
     yield UInt32(self, "snap_len", "max length saved portion of each pkt")
     yield Enum(UInt32(self, "link_type", "data link type"), self.LINK_TYPE_DESC)
     link = self["link_type"].value
     if link not in self.LINK_TYPE:
         raise ParserError("Unknown link type: %s" % link)
     name, parser = self.LINK_TYPE[link]
     while self.current_size < self.size:
         yield Packet(self, "packet[]", parser, name)
Ejemplo n.º 6
0
    def createFields(self):
        yield String(self, "file_magic", 20)
        yield UInt32(self, "header_size")
        yield UInt32(self, "file_version")
        yield UInt64(self, "file_size")
        yield UInt64(self, "creation_date")
        yield Int32(self, "min_lat")
        yield Int32(self, "min_lon")
        yield Int32(self, "max_lat")
        yield Int32(self, "max_lon")
        yield UInt16(self, "tile_size")
        yield VbeString(self, "projection")

        # flags
        yield Bit(self, "have_debug")
        yield Bit(self, "have_map_start")
        yield Bit(self, "have_start_zoom")
        yield Bit(self, "have_language_preference")
        yield Bit(self, "have_comment")
        yield Bit(self, "have_created_by")
        yield Bits(self, "reserved[]", 2)

        if self["have_map_start"].value:
            yield UInt32(self, "start_lat")
            yield UInt32(self, "start_lon")
        if self["have_start_zoom"].value:
            yield UInt8(self, "start_zoom")
        if self["have_language_preference"].value:
            yield VbeString(self, "language_preference")
        if self["have_comment"].value:
            yield VbeString(self, "comment")
        if self["have_created_by"].value:
            yield VbeString(self, "created_by")

        yield TagStringList(self, "poi_tags")
        yield TagStringList(self, "way_tags")

        yield UInt8(self, "num_zoom_intervals")
        for i in range(self["num_zoom_intervals"].value):
            yield ZoomIntervalCfg(self, "zoom_interval_cfg[]")

        for i in range(self["num_zoom_intervals"].value):
            zoomIntervalCfg = self["zoom_interval_cfg[%d]" % i]
            self.seekByte(zoomIntervalCfg["subfile_start"].value,
                          relative=False)
            yield ZoomSubFile(self,
                              "subfile[]",
                              size=zoomIntervalCfg["subfile_size"].value * 8,
                              zoomIntervalCfg=zoomIntervalCfg)
Ejemplo n.º 7
0
    def createFields(self):
        # Header
        yield UInt16(self, "version", "Version (=1)")
        yield Bytes(self, "endian", 2, "Endian (\\xfe\\xff for little endian)")
        yield UInt8(self, "os_version")
        yield UInt8(self, "os_revision")
        yield Enum(UInt16(self, "os"), OS_NAME)
        yield Int32(self, "unused", "(=-1)")
        yield GUID(self, "clsid")

        # User type
        yield PascalString32(self, "user_type", strip="\0")

        # Clipboard format
        if self["os"].value == OS_MAC:
            yield Int32(self, "unused[]", "(=-2)")
            yield String(self, "clipboard_format", 4)
        else:
            yield PascalString32(self, "clipboard_format", strip="\0")
        if self._current_size // 8 == self.datasize:
            return

        # -- OLE 2.01 ---

        # Program ID
        yield PascalString32(self, "prog_id", strip="\0")

        if self["os"].value != OS_MAC:
            # Magic number
            yield textHandler(
                UInt32(self, "magic", "Magic number (0x71B239F4)"),
                hexadecimal)

            # Unicode version
            yield PascalStringWin32(self, "user_type_unicode", strip="\0")
            yield PascalStringWin32(self,
                                    "clipboard_format_unicode",
                                    strip="\0")
            yield PascalStringWin32(self, "prog_id_unicode", strip="\0")

        # _current_size because current_size returns _current_max_size
        size = self.datasize - (self._current_size // 8)
        if size:
            yield NullBytes(self, "end_padding", size)

        if self.datasize < self.size // 8:
            yield RawBytes(self, "slack_space",
                           (self.size // 8) - self.datasize)
Ejemplo n.º 8
0
 def createFields(self):
     yield String(self, "header_id", 4, "DataBase Header Markup (\"mhbd\")", charset="ISO-8859-1")
     yield UInt32(self, "header_length", "Header Length")
     yield UInt32(self, "entry_length", "Entry Length")
     yield UInt32(self, "unknown[]")
     yield UInt32(self, "version_number", "Version Number")
     yield UInt32(self, "child_number", "Number of Children")
     yield UInt64(self, "id", "ID for this database")
     yield UInt16(self, "unknown[]")
     yield UInt32(self, "unknown[]")
     yield UInt64(self, "unknown[]")
     yield UInt16(self, "unknown[]")
     yield UInt16(self, "hashing_scheme[]", "Algorithm used to calculate the database hash")
     yield NullBytes(self, "unknown[]", 20)
     yield String(self, "language_id", 2, "Language ID")
     yield UInt64(self, "persistent_id", "Library Persistent ID")
     yield UInt32(self, "unknown[]")
     yield UInt32(self, "unknown[]")
     yield RawBytes(self, "hash[]", 20)
     yield Int32(self, "timezone_offset[]", "Timezone offset in seconds")
     yield UInt16(self, "unknown[]")
     yield RawBytes(self, "iphone_hash[]", 45)
     size = self["header_length"].value - self.current_size / 8
     if size > 0:
         yield NullBytes(self, "padding", size)
     for i in range(self["child_number"].value):
         yield DataSet(self, "dataset[]")
     padding = self.seekByte(self["entry_length"].value, "entry padding")
     if padding:
         yield padding
Ejemplo n.º 9
0
    def createFields(self):
        yield Enum(UInt8(self, "typecode"), TYPECODE_NAMES)

        self.root.newHandle(self)
        yield Int32(self, "proxyInterfaceName_count")
        for i in range(self['proxyInterfaceName_count'].value):
            yield PascalString16(self, "proxyInterfaceName[]", charset="UTF-8")
        yield ClassAnnotation(self, "classAnnotation")
        yield SerializedContent(self, "superClassDesc")
Ejemplo n.º 10
0
    def createFields(self):
        yield Bytes(self, "magic", 4, "Mach-O signature")
        yield Enum(Int32(self, "cputype"), CPU_TYPE)
        yield Int32(self, "cpusubtype")
        yield Enum(UInt32(self, "filetype"), FILE_TYPE)
        yield UInt32(self, "ncmds", "Number of load commands")
        yield UInt32(self, "sizeofcmds", "Total size of all load commands")

        if self.endian == BIG_ENDIAN:
            yield NullBits(self, "flags_reserved", 32 - len(self.FLAGS))
            for flag in self.FLAGS[::-1]:
                yield Bit(self, "flags_" + flag.lower())
        else:
            for flag in self.FLAGS:
                yield Bit(self, "flags_" + flag.lower())
            yield NullBits(self, "flags_reserved", 32 - len(self.FLAGS))

        if self.parent.is64bit:
            yield UInt32(self, "reserved")
Ejemplo n.º 11
0
 def createFields(self):
     yield String(self, "magic", 4, "ITSP", charset="ASCII")
     yield UInt32(self, "version", "Version (=1)")
     yield filesizeHandler(UInt32(self, "size", "Length (in bytes) of the directory header (84)"))
     yield UInt32(self, "unknown[]", "(=10)")
     yield filesizeHandler(UInt32(self, "block_size", "Directory block size"))
     yield UInt32(self, "density", "Density of quickref section, usually 2")
     yield UInt32(self, "index_depth", "Depth of the index tree")
     yield Int32(self, "nb_dir", "Chunk number of root index chunk")
     yield UInt32(self, "first_pmgl", "Chunk number of first PMGL (listing) chunk")
     yield UInt32(self, "last_pmgl", "Chunk number of last PMGL (listing) chunk")
     yield Int32(self, "unknown[]", "-1")
     yield UInt32(self, "nb_dir_chunk", "Number of directory chunks (total)")
     yield Enum(UInt32(self, "lang_id", "Windows language ID"), LANGUAGE_ID)
     yield GUID(self, "system_uuid", "{5D02926A-212E-11D0-9DF9-00A0C922E6EC}")
     yield filesizeHandler(UInt32(self, "size2", "Same value than size"))
     yield Int32(self, "unknown[]", "-1")
     yield Int32(self, "unknown[]", "-1")
     yield Int32(self, "unknown[]", "-1")
Ejemplo n.º 12
0
    def createFields(self):
        yield Enum(UInt8(self, "typecode"), TYPECODE_NAMES)
        yield SerializedContent(self, "classDesc")
        self.root.newHandle(self)

        yield Int32(self, "size")
        klass = VALUE_CLASS_MAP[
            self.classDesc.className[1]]  # className is [<elementType>
        for i in range(self['size'].value):
            yield klass(self, "value[]")
Ejemplo n.º 13
0
    def createFields(self):
        yield textHandler(UInt32(self, "magic"), hexadecimal)
        yield UInt32(self, "dir_start", "Directory start")
        yield Int32(self, "first_free_block", "First free block")
        yield UInt32(self, "filesize", "File size in bytes")

        yield self.seekByte(self["dir_start"].value)
        yield FileEntry(self, "file[]")

        size = (self.size - self.current_size) // 8
        if size:
            yield RawBytes(self, "end", size)
Ejemplo n.º 14
0
 def createFields(self):
     yield filesizeHandler(UInt32(self, "size"))
     yield Enum(Int32(self, "format"), self.FORMAT_NAME)
     if self["format"].value == self.FORMAT_CLIPBOARD:
         yield Enum(UInt32(self, "dib_format"), self.DIB_FORMAT)
         if self["dib_format"].value == self.DIB_BMP:
             yield BmpHeader(self, "bmp_header")
             size = (self.size - self.current_size) // 8
             yield parseImageData(self, "pixels", size, self["bmp_header"])
             return
     size = (self.size - self.current_size) // 8
     if size:
         yield RawBytes(self, "data", size)
Ejemplo n.º 15
0
 def createFields(self):
     yield Int32(self, "fc", "File Offset")
     yield UInt16(self, "cb", "Byte Count")
Ejemplo n.º 16
0
def parseLong(parent):
    yield Int32(parent, "digit_count")
    for index in range(abs(parent["digit_count"].value)):
        yield UInt16(parent, "digit[]")
Ejemplo n.º 17
0
def parseInt32(parent):
    yield Int32(parent, "value")
Ejemplo n.º 18
0
 def createFields(self):
     yield Enum(UInt8(self, "typecode"), TYPECODE_NAMES)
     yield Int32(self, "handle")
Ejemplo n.º 19
0
def parseEmfMappingMode(parser):
    yield Enum(Int32(parser, "mapping_mode"), EMF_MAPPING_MODE)
Ejemplo n.º 20
0
def parseXY32(parser):
    yield Int32(parser, "x")
    yield Int32(parser, "y")
Ejemplo n.º 21
0
def parseBrushIndirect(parser):
    yield UInt32(parser, "ihBrush")
    yield UInt32(parser, "style")
    yield RGBA(parser, "color")
    yield Int32(parser, "hatch")
Ejemplo n.º 22
0
    def createFields(self):
        yield UInt16(self, "wIdent", "Magic Number")
        yield UInt16(self, "nFib", "File Information Block (FIB) Version")
        yield UInt16(self, "nProduct", "Product Version")
        yield Enum(UInt16(self, "lid", "Language ID"), LANGUAGE_ID)
        yield Int16(self, "pnNext")

        yield Bit(self, "fDot", "Is the document a document template?")
        yield Bit(self, "fGlsy", "Is the document a glossary?")
        yield Bit(self, "fComplex", "Is the document in Complex format?")
        yield Bit(self, "fHasPic", "Does the document have embedded images?")
        yield Bits(self, "cQuickSaves", 4, "Number of times the document was quick-saved")
        yield Bit(self, "fEncrypted", "Is the document encrypted?")
        yield Bits(self, "reserved[]", 7)

        yield UInt16(self, "nFibBack")
        yield UInt32(self, "reserved[]")
        yield NullBytes(self, "rgwSpare", 6)

        yield UInt32(self, "fcMin", "File offset of first text character")
        yield UInt32(self, "fcMax", "File offset of last text character + 1")
        yield Int32(self, "cbMax", "File offset of last byte + 1")
        yield NullBytes(self, "fcSpare", 16)

        yield UInt32(self, "ccpText", "Length of main document text stream")
        yield Int32(self, "ccpFtn", "Length of footnote subdocument text stream")
        yield Int32(self, "ccpHdr", "Length of header subdocument text stream")
        yield Int32(self, "ccpMcr", "Length of macro subdocument text stream")
        yield Int32(self, "ccpAtn", "Length of annotation subdocument text stream")
        yield NullBytes(self, "ccpSpare", 16)

        yield FC_CB(self, "StshfOrig", "Original STSH allocation")
        yield FC_CB(self, "Stshf", "Current STSH allocation")
        yield FC_CB(self, "PlcffndRef", "Footnote reference PLC")
        yield FC_CB(self, "PlcffndTxt", "Footnote text PLC")
        yield FC_CB(self, "PlcfandRef", "Annotation reference PLC")
        yield FC_CB(self, "PlcfandTxt", "Annotation text PLC")
        yield FC_CB(self, "Plcfsed", "Section descriptor PLC")
        yield FC_CB(self, "Plcfpgd", "Page descriptor PLC")
        yield FC_CB(self, "Plcfphe", "Paragraph heights PLC")
        yield FC_CB(self, "Sttbfglsy", "Glossary string table")
        yield FC_CB(self, "Plcfglsy", "Glossary PLC")
        yield FC_CB(self, "Plcfhdd", "Header PLC")
        yield FC_CB(self, "PlcfbteChpx", "Character property bin table PLC")
        yield FC_CB(self, "PlcfbtePapx", "Paragraph property bin table PLC")
        yield FC_CB(self, "Plcfsea", "Private Use PLC")
        yield FC_CB(self, "Sttbfffn")
        yield FC_CB(self, "PlcffldMom")
        yield FC_CB(self, "PlcffldHdr")
        yield FC_CB(self, "PlcffldFtn")
        yield FC_CB(self, "PlcffldAtn")
        yield FC_CB(self, "PlcffldMcr")
        yield FC_CB(self, "Sttbfbkmk")
        yield FC_CB(self, "Plcfbkf")
        yield FC_CB(self, "Plcfbkl")
        yield FC_CB(self, "Cmds")
        yield FC_CB(self, "Plcmcr")
        yield FC_CB(self, "Sttbfmcr")
        yield FC_CB(self, "PrDrvr", "Printer Driver information")
        yield FC_CB(self, "PrEnvPort", "Printer environment for Portrait mode")
        yield FC_CB(self, "PrEnvLand", "Printer environment for Landscape mode")
        yield FC_CB(self, "Wss", "Window Save State")
        yield FC_CB(self, "Dop", "Document Property data")
        yield FC_CB(self, "SttbfAssoc")
        yield FC_CB(self, "Clx", "'Complex' file format data")
        yield FC_CB(self, "PlcfpgdFtn", "Footnote page descriptor PLC")
        yield FC_CB(self, "AutosaveSource", "Original filename for Autosave purposes")
        yield FC_CB(self, "Spare5")
        yield FC_CB(self, "Spare6")

        yield Int16(self, "wSpare4")
        yield UInt16(self, "pnChpFirst")
        yield UInt16(self, "pnPapFirst")
        yield UInt16(self, "cpnBteChp", "Count of CHPX FKPs recorded in file")
        yield UInt16(self, "cpnBtePap", "Count of PAPX FKPs recorded in file")
Ejemplo n.º 23
0
 def createFields(self):
     yield Int32(self, "fc", "Table Stream Offset")
     yield UInt32(self, "lcb", "Byte Count")
Ejemplo n.º 24
0
    def createFields(self):
        yield UInt16(self, "clw", "Count of fields in the array of longs")
        self._size = self['clw'].value * 32 + 16
        yield Int32(self, "cbMax", "Stream offset of last byte + 1")
        yield displayHandler(UInt32(self, "lProductCreated", "Date when the creator program was built"), buildDateHandler)
        yield displayHandler(UInt32(self, "lProductRevised", "Date when the last modifier program was built"), buildDateHandler)

        yield UInt32(self, "ccpText", "Length of main document text stream")
        yield Int32(self, "ccpFtn", "Length of footnote subdocument text stream")
        yield Int32(self, "ccpHdr", "Length of header subdocument text stream")
        yield Int32(self, "ccpMcr", "Length of macro subdocument text stream")
        yield Int32(self, "ccpAtn", "Length of annotation subdocument text stream")
        yield Int32(self, "ccpEdn", "Length of endnote subdocument text stream")
        yield Int32(self, "ccpTxbx", "Length of textbox subdocument text stream")
        yield Int32(self, "ccpHdrTxbx", "Length of header textbox subdocument text stream")
        yield Int32(self, "pnFbpChpFirst", "Start of CHPX (Character Property) sector chain (sector = 512-byte 'page')")
        yield Int32(self, "pnChpFirst", "First CHPX sector")
        yield Int32(self, "cpnBteChp", "Number of CHPX sectors in the file")
        yield Int32(self, "pnFbpPapFirst", "Start of PAPX (Paragraph Property) sector chain")
        yield Int32(self, "pnPapFirst", "First PAPX sector")
        yield Int32(self, "cpnBtePap", "Number of PAPX sectors in the file")
        yield Int32(self, "pnFbpLvcFirst", "Start of LVC sector chain")
        yield Int32(self, "pnLvcFirst", "First LVC sector")
        yield Int32(self, "cpnBteLvc", "Number of LVC sectors in the file")
        yield Int32(self, "fcIslandFirst")
        yield Int32(self, "fcIslandLim")
        while self.current_size < self.size:
            yield Int32(self, "unknown[]")
Ejemplo n.º 25
0
    def createFields(self):
        yield UInt16(self, "cfclcb", "Count of fields in the array of FC/LCB pairs")
        self._size = self['cfclcb'].value * 64 + 16

        yield FCLCB(self, "StshfOrig", "Original STSH allocation")
        yield FCLCB(self, "Stshf", "Current STSH allocation")
        yield FCLCB(self, "PlcffndRef", "Footnote reference (FRD) PLC")
        yield FCLCB(self, "PlcffndTxt", "Footnote text PLC")
        yield FCLCB(self, "PlcfandRef", "Annotation reference (ATRD) PLC")
        yield FCLCB(self, "PlcfandTxt", "Annotation text PLC")
        yield FCLCB(self, "Plcfsed", "Section descriptor (SED) PLC")
        yield FCLCB(self, "Plcpad", "No longer used; used to be Plcfpgd (Page descriptor PLC)")
        yield FCLCB(self, "Plcfphe", "Paragraph heights (PHE) PLC (only for Complex files)")
        yield FCLCB(self, "Sttbfglsy", "Glossary string table")
        yield FCLCB(self, "Plcfglsy", "Glossary PLC")
        yield FCLCB(self, "Plcfhdd", "Header (HDD) PLC")
        yield FCLCB(self, "PlcfbteChpx", "Character property bin table PLC")
        yield FCLCB(self, "PlcfbtePapx", "Paragraph property bin table PLC")
        yield FCLCB(self, "Plcfsea", "Private Use PLC")
        yield FCLCB(self, "Sttbfffn", "Font information STTB")
        yield FCLCB(self, "PlcffldMom", "Main document field position (FLD) PLC")
        yield FCLCB(self, "PlcffldHdr", "Header subdocument field position (FLD) PLC")
        yield FCLCB(self, "PlcffldFtn", "Footnote subdocument field position (FLD) PLC")
        yield FCLCB(self, "PlcffldAtn", "Annotation subdocument field position (FLD) PLC")
        yield FCLCB(self, "PlcffldMcr", "No longer used")
        yield FCLCB(self, "Sttbfbkmk", "Bookmark names STTB")
        yield FCLCB(self, "Plcfbkf", "Bookmark begin position (BKF) PLC")
        yield FCLCB(self, "Plcfbkl", "Bookmark end position (BKL) PLC")
        yield FCLCB(self, "Cmds", "Macro commands")
        yield FCLCB(self, "Plcmcr", "No longer used")
        yield FCLCB(self, "Sttbfmcr", "No longer used")
        yield FCLCB(self, "PrDrvr", "Printer Driver information")
        yield FCLCB(self, "PrEnvPort", "Printer environment for Portrait mode")
        yield FCLCB(self, "PrEnvLand", "Printer environment for Landscape mode")
        yield FCLCB(self, "Wss", "Window Save State")
        yield FCLCB(self, "Dop", "Document Property data")
        yield FCLCB(self, "SttbfAssoc", "Associated strings STTB")
        yield FCLCB(self, "Clx", "Complex file information")
        yield FCLCB(self, "PlcfpgdFtn", "Not used")
        yield FCLCB(self, "AutosaveSource", "Original filename for Autosave purposes")
        yield FCLCB(self, "GrpXstAtnOwners", "String Group for Annotation Owner Names")
        yield FCLCB(self, "SttbfAtnbkmk", "Annotation subdocument bookmark names STTB")
        yield FCLCB(self, "PlcdoaMom", "No longer used")
        yield FCLCB(self, "PlcdoaHdr", "No longer used")
        yield FCLCB(self, "PlcspaMom", "Main document File Shape (FSPA) PLC")
        yield FCLCB(self, "PlcspaHdr", "Header subdocument FSPA PLC")
        yield FCLCB(self, "PlcfAtnbkf", "Annotation subdocument bookmark begin position (BKF) PLC")
        yield FCLCB(self, "PlcfAtnbkl", "Annotation subdocument bookmark end position (BKL) PLC")
        yield FCLCB(self, "Pms", "Print Merge State")
        yield FCLCB(self, "FormFldSttbs", "Form field values STTB")
        yield FCLCB(self, "PlcfendRef", "Endnote Reference (FRD) PLC")
        yield FCLCB(self, "PlcfendTxt", "Endnote Text PLC")
        yield FCLCB(self, "PlcffldEdn", "Endnote subdocument field position (FLD) PLC)")
        yield FCLCB(self, "PlcfpgdEdn", "not used")
        yield FCLCB(self, "DggInfo", "Office Art Object Table Data")
        yield FCLCB(self, "SttbfRMark", "Editor Author Abbreviations STTB")
        yield FCLCB(self, "SttbCaption", "Caption Title STTB")
        yield FCLCB(self, "SttbAutoCaption", "Auto Caption Title STTB")
        yield FCLCB(self, "Plcfwkb", "WKB PLC")
        yield FCLCB(self, "Plcfspl", "Spell Check State PLC")
        yield FCLCB(self, "PlcftxbxTxt", "Text Box Text PLC")
        yield FCLCB(self, "PlcffldTxbx", "Text Box Reference (FLD) PLC")
        yield FCLCB(self, "PlcfhdrtxbxTxt", "Header Text Box Text PLC")
        yield FCLCB(self, "PlcffldHdrTxbx", "Header Text Box Reference (FLD) PLC")
        yield FCLCB(self, "StwUser", "Macro User storage")
        yield FCLCB(self, "Sttbttmbd", "Embedded TrueType Font Data")
        yield FCLCB(self, "Unused")
        yield FCLCB(self, "PgdMother", "Main text page descriptors PLF")
        yield FCLCB(self, "BkdMother", "Main text break descriptors PLF")
        yield FCLCB(self, "PgdFtn", "Footnote text page descriptors PLF")
        yield FCLCB(self, "BkdFtn", "Footnote text break descriptors PLF")
        yield FCLCB(self, "PgdEdn", "Endnote text page descriptors PLF")
        yield FCLCB(self, "BkdEdn", "Endnote text break descriptors PLF")
        yield FCLCB(self, "SttbfIntlFld", "Field keywords STTB")
        yield FCLCB(self, "RouteSlip", "Mailer Routing Slip")
        yield FCLCB(self, "SttbSavedBy", "STTB of names of users who have saved the document")
        yield FCLCB(self, "SttbFnm", "STTB of filenames of documents referenced by this one")
        yield FCLCB(self, "PlcfLst", "List Format information PLC")
        yield FCLCB(self, "PlfLfo", "List Format Override information PLC")
        yield FCLCB(self, "PlcftxbxBkd", "Main document textbox break table (BKD) PLC")
        yield FCLCB(self, "PlcftxbxHdrBkd", "Header subdocument textbox break table (BKD) PLC")
        yield FCLCB(self, "DocUndo", "Undo/Versioning data")
        yield FCLCB(self, "Rgbuse", "Undo/Versioning data")
        yield FCLCB(self, "Usp", "Undo/Versioning data")
        yield FCLCB(self, "Uskf", "Undo/Versioning data")
        yield FCLCB(self, "PlcupcRgbuse", "Undo/Versioning data")
        yield FCLCB(self, "PlcupcUsp", "Undo/Versioning data")
        yield FCLCB(self, "SttbGlsyStyle", "Glossary entry style names STTB")
        yield FCLCB(self, "Plgosl", "Grammar options PL")
        yield FCLCB(self, "Plcocx", "OCX data PLC")
        yield FCLCB(self, "PlcfbteLvc", "Character property bin table PLC")
        if self['../fMac'].value:
            yield TimestampMac32(self, "ftModified", "Date last modified")
            yield Int32(self, "padding[]")
        else:
            yield TimestampWin64(self, "ftModified", "Date last modified")
        yield FCLCB(self, "Plcflvc", "LVC PLC")
        yield FCLCB(self, "Plcasumy", "Autosummary PLC")
        yield FCLCB(self, "Plcfgram", "Grammar check PLC")
        yield FCLCB(self, "SttbListNames", "List names STTB")
        yield FCLCB(self, "SttbfUssr", "Undo/Versioning data")
        while self.current_size < self.size:
            yield FCLCB(self, "unknown[]")