def __init__(self, parent, name, desc=None): Field.__init__(self, parent, name, description=desc) val = "" count = 1 off = 1 while not parent.eof: char = parent.stream.readBytes(self.absolute_address + 8 * off, 1) # Non-ASCII if not char.isalpha() or char == '\\': off += 1 continue if char == '(': count += 1 if char == ')': count -= 1 # Parenthesis block = 0 => end of string if count == 0: off += 1 break # Add it to the string val += char self._size = 8 * off self.createValue = lambda: val
def __init__(self, parent, name, tree, description=""): Field.__init__(self, parent, name, 0, description) endian = self.parent.endian stream = self.parent.stream addr = self.absolute_address value = 0 met_ff = False while (self.size, value) not in tree: if addr % 8 == 0: last_byte = stream.readBytes(addr - 8, 1) if last_byte == '\xFF': next_byte = stream.readBytes(addr, 1) if next_byte != '\x00': raise FieldError( "Unexpected byte sequence %r!" % (last_byte + next_byte)) addr += 8 # hack hack hack met_ff = True self._description = "[skipped 8 bits after 0xFF] " bit = stream.readBits(addr, 1, endian) value <<= 1 value += bit self._size += 1 addr += 1 self.createValue = lambda: value self.realvalue = tree[(self.size, value)] if met_ff: self._size += 8
def __init__(self, parent, name, description=None): Field.__init__(self, parent, name, description=description) value = 0 size = 0 shift = 0 while True: byteValue = self._parent.stream.readBytes( self.absolute_address + (size * 8), 1)[0] haveMoreData = (byteValue & 0x80) if size == 0: isNegative = (byteValue & 0x40) value = (byteValue & 0x3f) shift += 6 else: value = value | ((byteValue & 0x7f) << shift) shift += 7 size += 1 assert size < 100, "IntVBE is too large" if not(haveMoreData): break if isNegative: value *= -1 self._size = size * 8 self.createValue = lambda: value
def __init__(self, parent, name, tree, description=""): Field.__init__(self, parent, name, 0, description) endian = self.parent.endian stream = self.parent.stream addr = self.absolute_address value = 0 met_ff = False while (self.size, value) not in tree: if addr % 8 == 0: last_byte = stream.readBytes(addr - 8, 1) if last_byte == b'\xFF': next_byte = stream.readBytes(addr, 1) if next_byte != b'\x00': raise FieldError("Unexpected byte sequence %r!" % (last_byte + next_byte)) addr += 8 # hack hack hack met_ff = True self._description = "[skipped 8 bits after 0xFF] " bit = stream.readBits(addr, 1, endian) value <<= 1 value += bit self._size += 1 addr += 1 self.createValue = lambda: value self.realvalue = tree[(self.size, value)] if met_ff: self._size += 8
def __init__(self, parent, name, desc=None): Field.__init__(self, parent, name, description=desc) if parent.stream.readBytes(self.absolute_address, 4) == "true": self._size = 4 self.createValue = lambda: True elif parent.stream.readBytes(self.absolute_address, 5) == "false": self._size = 5 self.createValue = lambda: False raise NotABool
def __init__(self, parent, name, desc=None): Field.__init__(self, parent, name, description=desc) if parent.stream.readBytes(self.absolute_address, 4) == b"true": self._size = 4 self.createValue = lambda: True elif parent.stream.readBytes(self.absolute_address, 5) == b"false": self._size = 5 self.createValue = lambda: False raise NotABool
def __init__(self, parent, name, max_size=None, description=None): Field.__init__(self, parent, name, size=0, description=description) value = 0 addr = self.absolute_address while max_size is None or self._size < max_size: byte = parent.stream.readBits(addr, 8, LITTLE_ENDIAN) value += byte self._size += 8 if byte != 0xff: break addr += 8 self.createValue = lambda: value
def __init__(self, parent, name, description=None): Field.__init__(self, parent, name, 8, description) stream = self._parent.stream addr = self.absolute_address value = stream.readBits(addr, 8, BIG_ENDIAN) if 128 <= value: nbits = (value & 127) * 8 if not nbits: raise ParserError("ASN.1: invalid ASN integer size (zero)") if 64 < nbits: # Arbitrary limit to catch errors raise ParserError("ASN.1: ASN integer is limited to 64 bits") self._size = 8 + nbits value = stream.readBits(addr + 8, nbits, BIG_ENDIAN) self.createValue = lambda: value
def __init__(self, parent, name, max_size=None, description=None): Field.__init__(self, parent, name, size=8, description=description) value = 0 addr = self.absolute_address mask = 0x80 firstByte = parent.stream.readBits(addr, 8, LITTLE_ENDIAN) for i in xrange(8): addr += 8 if not (firstByte & mask): value += ((firstByte & (mask - 1)) << (8 * i)) break value |= (parent.stream.readBits(addr, 8, LITTLE_ENDIAN) << (8 * i)) mask >>= 1 self._size += 8 self.createValue = lambda: value
def __init__(self, parent, name, description=None): Field.__init__(self, parent, name, 0, description) endian = self.parent.endian stream = self.parent.stream addr = self.absolute_address value = 0 while True: bit = stream.readBits(addr, 1, endian) addr += 1 self._size += 1 if not bit: break value += 1 self._value = value
def __init__(self, parent, name, max_size=None, description=None): Field.__init__(self, parent, name, size=8, description=description) value = 0 addr = self.absolute_address mask = 0x80 firstByte = parent.stream.readBits(addr, 8, LITTLE_ENDIAN) for i in range(8): addr += 8 if not (firstByte & mask): value += ((firstByte & (mask - 1)) << (8 * i)) break value |= (parent.stream.readBits(addr, 8, LITTLE_ENDIAN) << (8 * i)) mask >>= 1 self._size += 8 self.createValue = lambda: value
def _getField(self, name, const): field = Field._getField(self, name, const) if field is None: if name in self._fields: field = self._fields[name] elif self._field_generator is not None and not const: field = self._feedUntil(name) return field
def __init__(self, parent, name, tree, description=None): Field.__init__(self, parent, name, 0, description) endian = self.parent.endian stream = self.parent.stream addr = self.absolute_address value = 0 while (self.size, value) not in tree: if self.size > 256: raise ParserError("Huffman code too long!") bit = stream.readBits(addr, 1, endian) value <<= 1 value += bit self._size += 1 addr += 1 self.huffvalue = value self.realvalue = tree[(self.size, value)]
def getField(self, key, const=True): if isinstance(key, (int, long)): if key < 0: raise KeyError("Key must be positive!") if not const: self.readFirstFields(key + 1) if len(self._fields.values) <= key: raise MissingField(self, key) return self._fields.values[key] return Field.getField(self, key, const)
def __init__(self, parent, name, description=None): Field.__init__(self, parent, name, description=description) value = 0 size = 0 while True: byteValue = self._parent.stream.readBytes( self.absolute_address + (size * 8), 1)[0] haveMoreData = (byteValue & 0x80) value = value | ((byteValue & 0x7f) << (size * 7)) size += 1 assert size < 100, "UIntVBE is too large" if not(haveMoreData): break self._size = size * 8 self.createValue = lambda: value
def getField(self, key, const=True): if isinstance(key, int): if key < 0: raise KeyError("Key must be positive!") if not const: self.readFirstFields(key + 1) if len(self._fields.values) <= key: raise MissingField(self, key) return self._fields.values[key] return Field.getField(self, key, const)
def __init__(self, parent, name, desc=None): Field.__init__(self, parent, name, description=desc) if parent.stream.readBytes(self.absolute_address, 1) != '/': raise ParserError("Unknown PDFName '%s'" % parent.stream.readBytes(self.absolute_address, 10)) size = getElementEnd(parent, offset=1) # other_size = getElementEnd(parent, '[')-1 # if size is None or (other_size is not None and other_size < size): # size = other_size for limit in self.LIMITS: other_size = getElementEnd(parent, limit, 1) if other_size is not None: other_size -= 1 if size is None or other_size < size: # self.info("New size: %u" % other_size) size = other_size self._size = 8 * (size + 1) # Value should be without the initial '/' and final ' ' self.createValue = lambda: parent.stream.readBytes(self.absolute_address + 8, size).strip(' ')
def __init__(self, parent, name, desc=None): Field.__init__(self, parent, name, description=desc) # Get size size = getElementEnd(parent) for limit in self.LIMITS: other_size = getElementEnd(parent, limit) if other_size is not None: other_size -= 1 if size is None or other_size < size: size = other_size self._size = 8 * size # Get value val = parent.stream.readBytes(self.absolute_address, size) self.info("Number: size=%u value='%s'" % (size, val)) if val.find('.') != -1: self.createValue = lambda: float(val) else: self.createValue = lambda: int(val)
def __init__(self, parent, name, desc=None): Field.__init__(self, parent, name, description=desc) # Get size size = getElementEnd(parent) for limit in self.LIMITS: other_size = getElementEnd(parent, limit) if other_size is not None: other_size -= 1 if size is None or other_size < size: size = other_size self._size = 8 * size # Get value val = parent.stream.readBytes(self.absolute_address, size) self.info("Number: size=%u value='%s'" % (size, val)) if val.find(b'.') != -1: self.createValue = lambda: float(val) else: self.createValue = lambda: int(val)
def __init__(self, parent, name, description=None): Field.__init__(self, parent, name, 8, description) endian = self._parent.endian stream = self._parent.stream addr = self.absolute_address value = 0 byte = stream.readBits(addr, 8, endian) while byte & 0x80: value <<= 7 value += (byte & 0x7f) self._size += 8 if 64 < self._size: raise ParserError("CHM: CWord is limited to 64 bits") addr += 8 byte = stream.readBits(addr, 8, endian) value <<= 7 value += byte self.createValue = lambda: value
def __init__(self, parent, name, desc=None): Field.__init__(self, parent, name, description=desc) if parent.stream.readBytes(self.absolute_address, 1) != b'/': raise ParserError( "Unknown PDFName '%s'" % parent.stream.readBytes(self.absolute_address, 10)) size = getElementEnd(parent, offset=1) # other_size = getElementEnd(parent, '[')-1 # if size is None or (other_size is not None and other_size < size): # size = other_size for limit in self.LIMITS: other_size = getElementEnd(parent, limit, 1) if other_size is not None: other_size -= 1 if size is None or other_size < size: # self.info("New size: %u" % other_size) size = other_size self._size = 8 * (size + 1) # Value should be without the initial '/' and final ' ' self.createValue = lambda: parent.stream.readBytes( self.absolute_address + 8, size).strip(b' ')
def __init__(self, parent, name, length, description="Raw data"): assert issubclass(parent.__class__, Field) if not (0 < length <= MAX_LENGTH): raise FieldError("Invalid RawBytes length (%s)!" % length) Field.__init__(self, parent, name, length * 8, description) self._display = None
def __init__(self, parent, name, description=None): Field.__init__(self, parent, name, 128, description)
def __init__(self, parent, name, desc=None): Field.__init__(self, parent, name, description=desc) self._size = 8 * getElementEnd(parent, '>') self.createValue = lambda: parent.stream.readBytes( self.absolute_address + 8, (self._size // 8) - 1)
def __init__(self, parent, name, desc=None): Field.__init__(self, parent, name, size=24, description=desc) addr = self.absolute_address val = parent.stream.readBits(addr, 8, LITTLE_ENDIAN) << 20 val += parent.stream.readBits(addr + 8, 16, LITTLE_ENDIAN) << 4 self.createValue = lambda: val
def __init__(self, parent, name, *args, **kw): Field.__init__(self, parent, name, 0, *args, **kw)
def __init__(self, parent, name, desc=None): Field.__init__(self, parent, name, description=desc) self._size = 8 * getElementEnd(parent, '>') self.createValue = lambda: parent.stream.readBytes(self.absolute_address + 8, (self._size // 8) - 1)
def __init__(self, parent, name, size, description=None): """ Constructor: see L{Field.__init__} for parameter description """ Field.__init__(self, parent, name, size, description)