class LdrDataEntry(MemStruct):
"""
+0x000 InLoadOrderLinks : _LIST_ENTRY
+0x008 InMemoryOrderLinks : _LIST_ENTRY
+0x010 InInitializationOrderLinks : _LIST_ENTRY
+0x018 DllBase : Ptr32 Void
+0x01c EntryPoint : Ptr32 Void
+0x020 SizeOfImage : Uint4B
+0x024 FullDllName : _UNICODE_STRING
+0x02c BaseDllName : _UNICODE_STRING
+0x034 Flags : Uint4B
+0x038 LoadCount : Uint2B
+0x03a TlsIndex : Uint2B
+0x03c HashLinks : _LIST_ENTRY
+0x03c SectionPointer : Ptr32 Void
+0x040 CheckSum : Uint4B
+0x044 TimeDateStamp : Uint4B
+0x044 LoadedImports : Ptr32 Void
+0x048 EntryPointActivationContext : Ptr32 Void
+0x04c PatchInformation : Ptr32 Void
"""
fields = [
("InLoadOrderLinks", ListEntry),
("InMemoryOrderLinks", ListEntry),
("InInitializationOrderLinks", ListEntry),
("DllBase", Ptr("<I", Void())),
("EntryPoint", Ptr("<I", Void())),
("SizeOfImage", Num("<I")),
("FullDllName", UnicodeString),
("BaseDllName", UnicodeString),
("Flags", Array(Num("B"), 4)),
("LoadCount", Num("H")),
("TlsIndex", Num("H")),
("union1",
Union([
("HashLinks", Ptr("<I", Void())),
("SectionPointer", Ptr("<I", Void())),
])),
("CheckSum", Num("<I")),
("union2",
Union([
("TimeDateStamp", Num("<I")),
("LoadedImports", Ptr("<I", Void())),
])),
("EntryPointActivationContext", Ptr("<I", Void())),
("PatchInformation", Ptr("<I", Void())),
]
class UniStruct(MemStruct):
fields = [
("one", Num("B")),
("union", Union([
("instruct", InStruct),
("i", Num(">I")),
])),
("last", Num("B")),
]
class Anon(MemStruct):
fields = [
("a", Num("B")),
# If a field name evaluates to False ("" or None for example) and the
# field type is a Struct subclass (Struct, Union, BitField), the field
# is considered as an anonymous struct or union. Therefore, Anon will
# have b1, b2 and c1, c2 attributes in that case.
("", Union([("b1", Num("B")), ("b2", Num("H"))])),
("", Struct("", [("c1", Num("B")), ("c2", Num("B"))])),
("d", Num("B")),
]
class NT_TIB(MemStruct):
"""
+00 struct _EXCEPTION_REGISTRATION_RECORD *ExceptionList
+04 void *StackBase
+08 void *StackLimit
+0c void *SubSystemTib
+10 void *FiberData
+10 uint32 Version
+14 void *ArbitraryUserPointer
+18 struct _NT_TIB *Self
"""
fields = [
("ExceptionList", Ptr("<I", EXCEPTION_REGISTRATION_RECORD)),
("StackBase", Ptr("<I", Void())),
("StackLimit", Ptr("<I", Void())),
("SubSystemTib", Ptr("<I", Void())),
(None, Union([("FiberData", Ptr("<I", Void())),
("Version", Num("<I"))])),
("ArbitraryUserPointer", Ptr("<I", Void())),
("Self", Ptr("<I", Self())),
]
assert Ptr(">I", MyStruct) != Ptr("<I", MyStruct)
assert Ptr("I", MyStruct) != Ptr("I", MyStruct2)
assert MyStruct.get_type() == MyStruct.get_type()
assert MyStruct.get_type() != MyStruct2.get_type()
assert Array(Num("H"), 12) == Array(Num("H"), 12)
assert Array(Num("H"), 11) != Array(Num("H"), 12)
assert Array(Num("I"), 12) != Array(Num("H"), 12)
assert Struct("a", [("f1", Num("B")), ("f2", Num("H"))]) == \
Struct("a", [("f1", Num("B")), ("f2", Num("H"))])
assert Struct("a", [("f2", Num("B")), ("f2", Num("H"))]) != \
Struct("a", [("f1", Num("B")), ("f2", Num("H"))])
assert Struct("a", [("f1", Num("B")), ("f2", Num("H"))]) != \
Struct("a", [("f1", Num("I")), ("f2", Num("H"))])
assert Struct("a", [("f1", Num("B")), ("f2", Num("H"))]) != \
Struct("b", [("f1", Num("B")), ("f2", Num("H"))])
assert Union([("f1", Num("B")), ("f2", Num("H"))]) == \
Union([("f1", Num("B")), ("f2", Num("H"))])
assert Union([("f2", Num("B")), ("f2", Num("H"))]) != \
Union([("f1", Num("B")), ("f2", Num("H"))])
assert Union([("f1", Num("B")), ("f2", Num("H"))]) != \
Union([("f1", Num("I")), ("f2", Num("H"))])
assert Bits(Num("I"), 3, 8) == Bits(Num("I"), 3, 8)
assert Bits(Num("I"), 3, 8) != Bits(Num("I"), 3, 8)
assert Bits(Num("H"), 2, 8) != Bits(Num("I"), 3, 8)
assert Bits(Num("I"), 3, 7) != Bits(Num("I"), 3, 8)
assert BitField(Num("B"), [("f1", 2), ("f2", 4), ("f3", 1)]) == \
BitField(Num("B"), [("f1", 2), ("f2", 4), ("f3", 1)])
assert BitField(Num("H"), [("f1", 2), ("f2", 4), ("f3", 1)]) != \
BitField(Num("B"), [("f1", 2), ("f2", 4), ("f3", 1)])
assert BitField(Num("B"), [("f2", 2), ("f2", 4), ("f3", 1)]) != \
BitField(Num("B"), [("f1", 2), ("f2", 4), ("f3", 1)])