def __init__(self, header, data, fat, minifat, parent, mfsobj): self.extraAttr = None Struct.__init__(self,header, None, header.DirectoryEntry, data) self.fat = fat self.minifat = minifat invalidNameCounter = 1 if self.objectName[1] == "\x00": #Some compound file like MSI as invalid name this is an ugly way to test self.objectName = unicode(self.objectName[:self.nameLen - 2], 'UTF-16').encode('UTF-8') else: #global invalidNameCounter #invalidNameCounter += 1 self.objectName = str("Unknown-" + str(invalidNameCounter)).encode('UTF-8') try: self.objectType = self.Type[ord(self.objectType)] except KeyError: self.objectType = self.Type[0x0] if len(self.objectName) == 0 or self.objectType == 'TypeUnknown': return self.CLSID = UUID(self.CLSID) if len(self.objectName) and mfsobj: realSize = self.offsetsSize() if self.streamSize > realSize: streamSize = realSize else: streamSize = self.streamSize if self.objectName[0] <= "\x05": self.objectName = self.objectName[1:] Node.__init__(self, self.objectName, streamSize, None, mfsobj) self.__disown__() if self.objectType == "RootStorageObject": self.minifat.setRootStorageObject(self)
def __init__(self, stream, matchingSectionCLSID = None): #add some sectionCLSID to match to avoid parsing all section self.sectionList = [] vfile = stream.open() try: magic = vfile.read(2) if magic != "\xfe\xff": vfile.close() raise RuntimeError('Not a property stream') vfile.seek(0) data = vfile.read(28) self.header = Header(PropertySetStreamHeader) Struct.__init__(self, self.header, None, self.header.PropertySetStream, data) self.CLSID = UUID(self.CLSID) try : os = self.OSID[self.OSType] self.OSVersion = os + ' - ' + str(self.OSVersion & 0x00ff) + '.' + str(self.OSVersion >> 8) except KeyError: self.OSVersion = "Unknown" count = 0 vfile.seek(28) while count < self.SectionCount: sectionListData = vfile.read(20) sectionHeader = Struct(self.header, None, self.header.SectionList, sectionListData) sectionHeader.CLSID = UUID(sectionHeader.CLSID) currentSectionListOffset = vfile.tell() if not matchingSectionCLSID or (sectionHeader.CLSID in matchingSectionCLSID): vfile.seek(sectionHeader.Offset) data = vfile.read(8) sectionHeader.Section = Struct(self.header, None, self.header.Section, data) sectionHeader.Section.PropertyList = PropertyList() maxReadSize = stream.size() - vfile.tell() if maxReadSize <= 0: break if sectionHeader.Section.Length < maxReadSize: readSize = sectionHeader.Section.Length else: readSize = maxReadSize data = vfile.read(readSize) propertyCount = 0 while propertyCount < sectionHeader.Section.PropertyCount: propert = Struct(self.header, None, self.header.PropertyList, data[propertyCount*8:(propertyCount*8)+8]) sectionHeader.Section.PropertyList.append(propert) propertyCount += 1 vfile.seek(sectionHeader.Offset + propert.Offset) propert.Variant = MSVariant(vfile) self.sectionList.append(sectionHeader) vfile.seek(currentSectionListOffset) count += 1 except : vfile.close() raise vfile.close()
def readFibRgCsNew(self, vfile, header): #getting right nFib self.cswNew = unpack('H', vfile.read(2))[0] self.FibRgCswNew = None data = vfile.read(self.cswNew * 2) if self.cswNew == 0: self.nFib = self.FibBase.nFib elif self.cswNew * 2 == 4: self.FibRgCswNew = Struct(header, None, header.FibRgCswNewData2000, data) self.nFib = self.FibRgCswNew.nFibNew elif self.cswNew * 2 == 10: self.FibRgCswNew = Struct(header, None, header.FibRgCswNewData2007, data) self.nFib = self.FibRgCswNew.nFibNew
def __init__(self, node): header = Header(MSDocHeader) self.node = node vfile = self.node.open() try : data = vfile.read(154) Struct.__init__(self, header, None, header.Fib, data) if self.FibBase.wIdent != 0xA5EC: vfile.close() raise RuntimeError("Header wIdent is invalid on stream " + str(self.node.absolute())) self.readFib(vfile, header) self.readFibRgCsNew(vfile, header) except : vfile.close() raise vfile.close() self.initBitField() self.setTableAndDataStream()
def __init__(self, node): header = Header(MSDocHeader) self.node = node vfile = self.node.open() try: data = vfile.read(154) Struct.__init__(self, header, None, header.Fib, data) if self.FibBase.wIdent != 0xA5EC: vfile.close() raise RuntimeError("Header wIdent is invalid on stream " + str(self.node.absolute())) self.readFib(vfile, header) self.readFibRgCsNew(vfile, header) except: vfile.close() raise vfile.close() self.initBitField() self.setTableAndDataStream()
def __init__(self, node, mfsobj): self.header = Header(OLEHeader) self.node = node self.mfsobj = mfsobj self.vfile = node.open() try : self.vfile.seek(0) data = self.vfile.read(self.header.CompoundDocumentHeader.ssize) except : self.vfile.close() raise self.vfile.close() Struct.__init__(self, self.header, None, self.header.CompoundDocumentHeader, data) if self.OLEHeaderSignature != self.OleSignature: raise Exception('OLE Header is not valid.') if self.SectorShift == 0x9: self.SectorSize = 512 elif self.SectorShift == 0xc: self.SectorSize = 4096 self.CLSID = UUID(self.CLSID) self.entries = []
def __init__(self, node): self.node = node self.vfile = node.open() self.attr = {} try : self.header = Header(self.PrefetchHeader) self.vfile.seek(0) magic_data = self.vfile.read(8) for magic, version, version_name in self.PrefetchMagic: if magic_data == magic: prefetch_version = getattr(self.header, version) self.version_name = version_name if not version: self.vfile.close return self.vfile.seek(0) self.data = self.vfile.read(prefetch_version.ssize) self.prefetch = Struct(self.header, self.vfile, prefetch_version, self.data) self.vfile.seek(self.prefetch.Standard.FirstFilePathBlock) self.data = self.vfile.read(self.prefetch.Standard.FirstFilePathSize) self.prefetchFileList = unicode(self.data.decode('utf-16')).split("\x00") try: self.prefetchFileList.remove('') except ValueError: pass self.prefetchFileList = map(lambda x : (x, str), self.prefetchFileList) self.vfile.seek(self.prefetch.Standard.VolumeInformationBlock.VolumePathOffset + self.prefetch.Standard.VolumeInformationBlock.pointer) self.volumePath = self.vfile.read(self.prefetch.Standard.VolumeInformationBlock.VolumePathLength *2).decode('UTF-16') self.VolumePrefetchList = [] self.vfile.seek(self.prefetch.Standard.VolumeInformationBlock.pointer + self.prefetch.Standard.VolumeInformationBlock.OffsetToFolderPaths) pathSize = unpack('h', self.vfile.read(2))[0] count = 0 while (pathSize > 0 and count < self.prefetch.Standard.VolumeInformationBlock.NumberOfFolderPaths): self.VolumePrefetchList.append((unicode(self.vfile.read(pathSize * 2+2)).decode('UTF-16'), str)) count += 1 pathSize = unpack('h', self.vfile.read(2))[0] self.vfile.close() except : #err_type, err_value, err_traceback = sys.exc_info() #for n in traceback.format_exception_only(err_type, err_value): #print n #for n in traceback.format_tb(err_traceback): #print n self.vfile.close() raise Exception("Init error")
def readFib(self, vfile, header): try: fibRgFcLcbVersion = self.VersionList[self.cbRgFcLcbSizeFibVersion[ self.cbRgFcLcb * 8]] except KeyError: raise Exception("No valid nFib/version") fibRgFcLcbVersionHeader = getattr(header, fibRgFcLcbVersion) data = vfile.read(fibRgFcLcbVersionHeader.ssize) currentc = Struct(header, None, fibRgFcLcbVersionHeader, data) setattr(self, fibRgFcLcbVersion, currentc) #After have reading so much MS header I started to write code as cryptic as them for x in range(self.cbRgFcLcbSizeFibVersion[self.cbRgFcLcb * 8] + 1, 5): currentc = getattr(currentc, self.VersionList[x]) setattr(self, self.VersionList[x], currentc)
def __init__(self, node): try: self.node = node self.vfile = node.open() self.header = Header(ShellLinkHeader) self.vfile.seek(0) self.data = self.vfile.read(self.header.ShellLinkHeader.ssize) self.shellLink = Struct(self.header, self.vfile, self.header.ShellLinkHeader, self.data) self.shellLink.FileAttributes = FlagsList( self.shellLink.FileAttributes, FileAttributesFlags) self.shellLink.LinkFlags = FlagsList(self.shellLink.LinkFlags, LinkFlags) self.shellLink.LinkCLSID = UUID(self.shellLink.LinkCLSID) try: self.shellLink.ShowCommand = ShowCommandFlagsMap[ self.shellLink.ShowCommand] except KeyError: self.shellLink.ShowCommand = str( hex(self.shellLink.ShowCommand)) if ("HasLinkTargetIDList", str) in self.shellLink.LinkFlags: self.getLinkTargetIDList() if ("HasLinkInfo", str) in self.shellLink.LinkFlags: self.getLinkInfo() for dataName in ("HasName", "HasRelativePath", "HasWorkingDir", "HasArguments", "HasIconLocation"): self.readStringData(dataName) if self.vfile.tell() < self.vfile.node().size(): self.getDataBlock() self.vfile.close() except: err_type, err_value, err_traceback = sys.exc_info() print traceback.format_exception_only(err_type, err_value) print traceback.format_tb(err_traceback) self.vfile.close()
def getLinkInfo(self): linkInfoStartOffset = self.vfile.tell() self.data = self.vfile.read(self.header.LinkInfo.ssize) self.linkInfo = Struct(self.header, self.vfile, self.header.LinkInfo, self.data) self.linkInfoAttr = {} self.linkInfoAttr["Link info header size"] = (self.linkInfo.HeaderSize, int) self.linkInfo.Flags = FlagsList(self.linkInfo.Flags, LinkInfoFlags) self.linkInfoAttr["Link info flags"] = (self.linkInfo.Flags, list) if ("VolumeIDAndLocalBasePath", str) in self.linkInfo.Flags: self.vfile.seek(linkInfoStartOffset + self.linkInfo.VolumeIDOffset) sizeMax = self.linkInfo.StructSize - self.vfile.tell() + linkInfoStartOffset buff = self.vfile.read(sizeMax) VolumeIDStruct = Struct(self.header, self.vfile, self.header.VolumeID, buff) VolumeIDAttr = {} try : VolumeIDAttr["Drive type"] = (DriveTypeMaps[VolumeIDStruct.DriveType], str) except KeyError: pass VolumeIDAttr["Drive serial number"] = (VolumeIDStruct.DriveSerialNumber, int) if VolumeIDStruct.LabelOffset != 0x14: pos = buff[VolumeIDStruct.LabelOffset:].find('\x00') if pos != -1: VolumeIDAttr["Volume label"] = (buff[VolumeIDStruct.LabelOffset:VolumeIDStruct.LabelOffset+pos+1], str) else: LabelOffsetUnicode = buff[16:20] VolumeIDAttr["Volume label (Unicode)"]= (UnicodeBuff(buff[LabelOffsetUnicode:]), str) if len(VolumeIDAttr): self.linkInfoAttr["Volume ID"] = (VolumeIDAttr, dict) self.vfile.seek(linkInfoStartOffset + self.linkInfo.LocalBasePathOffset) sizeMax = self.linkInfo.StructSize - self.vfile.tell() + linkInfoStartOffset buff = self.vfile.read(sizeMax) pos = buff.find('\x00') if pos != -1: self.linkInfoAttr["Local base path"] = (buff[:pos], str) if self.linkInfo.HeaderSize >= 0x24: self.vfile.seek(linkInfoStartOffset + self.linkInfo.LocalBasePathUnicode) sizeMax = self.linkInfo.StructSize - self.vfile.tell() + linkInfoStartOffset buff = self.vfile.read(sizeMax) self.linkInfoAttr["Local base path (Unicode)"] = (UnicodeBuff(buff), str) elif ("CommonNetworkRelativeLinkAndPathSuffix", str) in self.linkInfo.Flags: self.vfile.seek(linkInfoStartOffset + self.linkInfo.CommonNetworkRelativeLinkOffset) sizeMax = self.linkInfo.StructSize - self.vfile.tell() + linkInfoStartOffset buff = self.vfile.read(sizeMax) CommonNetworkRelativeLinkStruct = Struct(self.header, self.vfile, self.header.CommonNetworkRelativeLink, buff) CommonNetworkRelativeLinkAttr = {} CommonNetworkRelativeLinkStruct.LinkFlags = FlagsList(CommonNetworkRelativeLinkStruct.LinkFlags, CommonNetworkRelativeLinkFlags) CommonNetworkRelativeLinkAttr["Link flags"] = (CommonNetworkRelativeLinkStruct.LinkFlags, list) if ("ValidDevice", str) in CommonNetworkRelativeLinkStruct.LinkFlags: #XXX UNTESTED if CommonNetworkRelativeLinkStruct.NetNameOffset > 0x14: DeviceNameUnicodeOffset = unpack("I", buff[24:28])[0] pos = buff[DeviceNameUnicodeOffset:].find('\x00\x00') if pos != -1: CommonNetworkRelativeLinkAttr["Deivce name (unicode)"] = (unicode(buff[DeviceNameUnicodeOffset:DeviceNameUnicodeOffset+pos+3].decode('UTF-16')), str) else: pos = buff[CommonNetworkRelativeLinkStruct.DeviceNameOffset:].find('\x00') if pos != -1: CommonNetworkRelativeLinkAttr["Device name"] = (buff[CommonNetworkRelativeLinkStruct.DeviceNameOffset:CommonNetworkRelativeLinkStruct.DeviceNameOffset + pos+1], str) if ("ValidNetType", str) in CommonNetworkRelativeLinkStruct.LinkFlags: if CommonNetworkRelativeLinkStruct.NetNameOffset > 0x14: NetNameUnicodeOffset = unpack("I", buff[20:24])[0] pos = buff[NetNameUnicodeOffset:].find('\x00\x00') if pos != -1: CommonNetworkRelativeLinkAttr["Net name (unicode)"] = (unicode(buff[NetNameUnicodeOffset:NetNameUnicodeOffset+pos+3].decode('UTF-16')), str) else: pos = buff[CommonNetworkRelativeLinkStruct.NetNameOffset:].find('\x00') if pos != -1: CommonNetworkRelativeLinkAttr["Net name"] = (buff[CommonNetworkRelativeLinkStruct.NetNameOffset:CommonNetworkRelativeLinkStruct.NetNameOffset + pos+1], str) try: CommonNetworkRelativeLinkAttr["Provider type"] = (NetworkProviderType[CommonNetworkRelativeLinkStruct.NetworkProviderType], str) except KeyError: CommonNetworkRelativeLinkAttr["Provider type"] = (CommonNetworkRelativeLinkStruct.NetworkProviderType, int) self.vfile.seek(linkInfoStartOffset + self.linkInfo.CommonPathSuffixOffset) sizeMax = self.linkInfo.StructSize - self.vfile.tell() + linkInfoStartOffset buff = self.vfile.read(sizeMax) pos = buff.find('\x00') if pos != -1: self.linkInfoAttr["Common path suffix"] = (buff[:pos], str) if self.linkInfo.HeaderSize >= 0x24: pass #print "get unicode common suffix " if len(CommonNetworkRelativeLinkAttr): self.linkInfoAttr["Common network relative link"] = (CommonNetworkRelativeLinkAttr, dict) self.vfile.seek(linkInfoStartOffset + self.linkInfo.StructSize)
def getLinkInfo(self): linkInfoStartOffset = self.vfile.tell() self.data = self.vfile.read(self.header.LinkInfo.ssize) self.linkInfo = Struct(self.header, self.vfile, self.header.LinkInfo, self.data) self.linkInfoAttr = {} self.linkInfoAttr["Link info header size"] = (self.linkInfo.HeaderSize, int) self.linkInfo.Flags = FlagsList(self.linkInfo.Flags, LinkInfoFlags) self.linkInfoAttr["Link info flags"] = (self.linkInfo.Flags, list) if ("VolumeIDAndLocalBasePath", str) in self.linkInfo.Flags: self.vfile.seek(linkInfoStartOffset + self.linkInfo.VolumeIDOffset) sizeMax = self.linkInfo.StructSize - self.vfile.tell( ) + linkInfoStartOffset buff = self.vfile.read(sizeMax) VolumeIDStruct = Struct(self.header, self.vfile, self.header.VolumeID, buff) VolumeIDAttr = {} try: VolumeIDAttr["Drive type"] = ( DriveTypeMaps[VolumeIDStruct.DriveType], str) except KeyError: pass VolumeIDAttr["Drive serial number"] = ( VolumeIDStruct.DriveSerialNumber, int) if VolumeIDStruct.LabelOffset != 0x14: pos = buff[VolumeIDStruct.LabelOffset:].find('\x00') if pos != -1: VolumeIDAttr["Volume label"] = ( buff[VolumeIDStruct. LabelOffset:VolumeIDStruct.LabelOffset + pos + 1], str) else: LabelOffsetUnicode = buff[16:20] VolumeIDAttr["Volume label (Unicode)"] = (UnicodeBuff( buff[LabelOffsetUnicode:]), str) if len(VolumeIDAttr): self.linkInfoAttr["Volume ID"] = (VolumeIDAttr, dict) self.vfile.seek(linkInfoStartOffset + self.linkInfo.LocalBasePathOffset) sizeMax = self.linkInfo.StructSize - self.vfile.tell( ) + linkInfoStartOffset buff = self.vfile.read(sizeMax) pos = buff.find('\x00') if pos != -1: self.linkInfoAttr["Local base path"] = (buff[:pos], str) if self.linkInfo.HeaderSize >= 0x24: self.vfile.seek(linkInfoStartOffset + self.linkInfo.LocalBasePathUnicode) sizeMax = self.linkInfo.StructSize - self.vfile.tell( ) + linkInfoStartOffset buff = self.vfile.read(sizeMax) self.linkInfoAttr["Local base path (Unicode)"] = ( UnicodeBuff(buff), str) elif ("CommonNetworkRelativeLinkAndPathSuffix", str) in self.linkInfo.Flags: self.vfile.seek(linkInfoStartOffset + self.linkInfo.CommonNetworkRelativeLinkOffset) sizeMax = self.linkInfo.StructSize - self.vfile.tell( ) + linkInfoStartOffset buff = self.vfile.read(sizeMax) CommonNetworkRelativeLinkStruct = Struct( self.header, self.vfile, self.header.CommonNetworkRelativeLink, buff) CommonNetworkRelativeLinkAttr = {} CommonNetworkRelativeLinkStruct.LinkFlags = FlagsList( CommonNetworkRelativeLinkStruct.LinkFlags, CommonNetworkRelativeLinkFlags) CommonNetworkRelativeLinkAttr["Link flags"] = ( CommonNetworkRelativeLinkStruct.LinkFlags, list) if ("ValidDevice", str) in CommonNetworkRelativeLinkStruct.LinkFlags: #XXX UNTESTED if CommonNetworkRelativeLinkStruct.NetNameOffset > 0x14: DeviceNameUnicodeOffset = unpack("I", buff[24:28])[0] pos = buff[DeviceNameUnicodeOffset:].find('\x00\x00') if pos != -1: CommonNetworkRelativeLinkAttr[ "Deivce name (unicode)"] = (unicode( buff[DeviceNameUnicodeOffset: DeviceNameUnicodeOffset + pos + 3].decode('UTF-16')), str) else: pos = buff[CommonNetworkRelativeLinkStruct. DeviceNameOffset:].find('\x00') if pos != -1: CommonNetworkRelativeLinkAttr["Device name"] = (buff[ CommonNetworkRelativeLinkStruct.DeviceNameOffset: CommonNetworkRelativeLinkStruct.DeviceNameOffset + pos + 1], str) if ("ValidNetType", str) in CommonNetworkRelativeLinkStruct.LinkFlags: if CommonNetworkRelativeLinkStruct.NetNameOffset > 0x14: NetNameUnicodeOffset = unpack("I", buff[20:24])[0] pos = buff[NetNameUnicodeOffset:].find('\x00\x00') if pos != -1: CommonNetworkRelativeLinkAttr["Net name (unicode)"] = ( unicode(buff[ NetNameUnicodeOffset:NetNameUnicodeOffset + pos + 3].decode('UTF-16')), str) else: pos = buff[CommonNetworkRelativeLinkStruct. NetNameOffset:].find('\x00') if pos != -1: CommonNetworkRelativeLinkAttr["Net name"] = ( buff[CommonNetworkRelativeLinkStruct. NetNameOffset:CommonNetworkRelativeLinkStruct. NetNameOffset + pos + 1], str) try: CommonNetworkRelativeLinkAttr["Provider type"] = ( NetworkProviderType[CommonNetworkRelativeLinkStruct. NetworkProviderType], str) except KeyError: CommonNetworkRelativeLinkAttr["Provider type"] = ( CommonNetworkRelativeLinkStruct.NetworkProviderType, int) self.vfile.seek(linkInfoStartOffset + self.linkInfo.CommonPathSuffixOffset) sizeMax = self.linkInfo.StructSize - self.vfile.tell( ) + linkInfoStartOffset buff = self.vfile.read(sizeMax) pos = buff.find('\x00') if pos != -1: self.linkInfoAttr["Common path suffix"] = (buff[:pos], str) if self.linkInfo.HeaderSize >= 0x24: pass #print "get unicode common suffix " if len(CommonNetworkRelativeLinkAttr): self.linkInfoAttr["Common network relative link"] = ( CommonNetworkRelativeLinkAttr, dict) self.vfile.seek(linkInfoStartOffset + self.linkInfo.StructSize)
def getDataBlock(self): dataBlockHeader = Header(DataBlockHeader) pos = None while (self.vfile.tell() < self.vfile.node().size() - 4) and (pos != self.vfile.tell()): pos = self.vfile.tell() data = self.vfile.read(dataBlockHeader.DataBlockStandard.ssize) standard = Struct(dataBlockHeader, self.vfile, dataBlockHeader.DataBlockStandard, data) try: self.vfile.seek(pos) dataBlockType = ExtraDataBlockMaps[standard.BlockSignature] data = self.vfile.read(standard.BlockSize) try: setattr( self, dataBlockType, Struct(dataBlockHeader, self.vfile, getattr(dataBlockHeader, dataBlockType), data)) if dataBlockType == 'ConsoleDataBlock': self.ConsoleDataBlock.FillAttributes = FlagsList( self.ConsoleDataBlock.FillAttributes, FillAttributesFlags) self.ConsoleDataBlock.PopupFillAttributes = FlagsList( self.ConsoleDataBlock.PopupFillAttributes, FillAttributesFlags) try: self.ConsoleDataBlock.FontFamily = FontFamily[ self.ConsoleDataBlock.FontFamily] except KeyError: pass self.ConsoleDataBlock.FaceName = UnicodeBuff( self.ConsoleDataBlock.FaceName) if dataBlockType == 'TrackerDataBlock': self.TrackerDataBlock.DroidVolume = UUID( self.TrackerDataBlock.DroidVolume) self.TrackerDataBlock.DroidFile = UUID( self.TrackerDataBlock.DroidFile) self.TrackerDataBlock.DroidBirthVolume = UUID( self.TrackerDataBlock.DroidBirthVolume) self.TrackerDataBlock.DroidBirthFile = UUID( self.TrackerDataBlock.DroidBirthFile) #elif windowsvsita... #elif shindataBLock elif dataBlockType == 'EnvironmentVariableDataBlock': self.EnvironmentVariableDataBlock.TargetUnicode = UnicodeBuff( self.EnvironmentVariableDataBlock.TargetUnicode) elif dataBlockType == 'IconEnvironmentDataBlock': self.IconEnvironmentDataBlock.Environment.TargetUnicode = UnicodeBuff( self.IconEnvironmentDataBlock.Environment. TargetUnicode) elif dataBlockType == 'DarwinDataBlock': self.DarwinDataBlock.DataUnicode = UnicodeBuff( self.DarwinDataBlock.DataUnicode) elif dataBlockType == 'KnownFolderDataBlock': self.KnownFolderDataBlock.ID = UUID( self.KnownFolderDataBlock.ID) elif dataBlockType == 'PropertyStoreDataBlock': serializedPropertyHeader = Header( SerializedPropertyHeader) self.PropertyStoreSerializedAttr = {} while len(data) >= 32: self.PropertyStoreDataBlock.Property.FormatID = UUID( self.PropertyStoreDataBlock.Property.FormatID) if self.PropertyStoreDataBlock.Property.StorageSize and len( data) > 40: if self.PropertyStoreDataBlock.Property.FormatID != "D5CDD505-2E9C-101B-9397-08002B2CF9AE": serializedPropertyData = data[32:] IntegerName = Struct( serializedPropertyHeader, self.vfile, serializedPropertyHeader.IntegerName, serializedPropertyData) try: value = 'Undef Type' value = PropertyType[ IntegerName.TypedValue.Type] value = PropertyTypeConverter[value]( serializedPropertyData[13:]) except KeyError: pass self.PropertyStoreSerializedAttr[str( IntegerName.Id)] = (value, str) data = data[self.PropertyStoreDataBlock. Property.StorageSize:] if len(data) >= 32: setattr( self, dataBlockType, Struct( dataBlockHeader, self.vfile, getattr( dataBlockHeader, dataBlockType), data)) else: break else: #StringType break else: break except AttributeError, e: break #avoid infinite loop, possibly skip decodable data block except KeyError, e: if (dataBlockHeader.DataBlockStandard.ssize == 0) or (standard.BlockSize == 0): break