def createFields(self):
yield String(self, "signature", 17, "XM signature", charset="ASCII")
yield String(self, "title", 20, "XM title", charset="ASCII", strip=' ')
yield UInt8(self, "marker", "Marker (0x1A)")
yield String(self, "tracker_name", 20, "XM tracker name", charset="ASCII", strip=' ')
yield UInt8(self, "format_minor")
yield UInt8(self, "format_major")
yield filesizeHandler(UInt32(self, "header_size", "Header size (276)"))
yield UInt16(self, "song_length", "Length in patten order table")
yield UInt16(self, "restart", "Restart position")
yield UInt16(self, "channels", "Number of channels (2,4,6,8,10,...,32)")
yield UInt16(self, "patterns", "Number of patterns (max 256)")
yield UInt16(self, "instruments", "Number of instruments (max 128)")
yield Bit(self, "amiga_ftable", "Amiga frequency table")
yield Bit(self, "linear_ftable", "Linear frequency table")
yield Bits(self, "unused", 14)
yield UInt16(self, "tempo", "Default tempo")
yield UInt16(self, "bpm", "Default BPM")
yield GenericVector(self, "pattern_order", 256, UInt8, "order")
def createFields(self):
if 7 * 8 <= self.size:
yield UInt8(self, 'type')
yield String(self, 'codec', 6)
if self.parser:
yield from self.parser(self)
else:
size = (self.size - self.current_size) // 8
if size:
yield RawBytes(self, "raw", size)
def createFields(self):
yield Enum(UInt8(self, "charset"), self.charset_desc)
charset = getCharset(self["charset"])
yield CString(self, "mime", "MIME type", charset=charset)
yield CString(self, "filename", "File name", charset=charset)
yield CString(self, "description", "Content description", charset=charset)
size = (self.size - self.current_size) // 8
if not size:
return
yield String(self, "text", size, "Text", charset=charset)
def createFields(self):
yield Enum(UInt8(self, "charset"), self.charset_desc)
if self.current_size == self.size:
return
charset = getCharset(self["charset"])
yield CString(self, "title", "Title", charset=charset, strip=self.STRIP)
size = (self.size - self.current_size) // 8
if not size:
return
yield String(self, "text", size, "Text", charset=charset, strip=self.STRIP)
def parsePushData(parent, size):
while not parent.eof:
codeobj = UInt8(parent, "data_type[]")
yield codeobj
code = codeobj.value
if code not in TYPE_INFO:
raise ParserError("Unknown type in Push_Data : " + hex(code))
parser, name = TYPE_INFO[code]
if parser:
yield parser(parent, name)
def createFields(self):
yield textHandler(UInt8(self, "header", "Header"), hexadecimal)
if self["header"].value != 0xFF:
raise ParserError("JPEG: Invalid chunk header!")
yield textHandler(UInt8(self, "type", "Type"), hexadecimal)
tag = self["type"].value
# D0 - D7 inclusive are the restart markers
if tag in [self.TAG_SOI, self.TAG_EOI] + list(range(0xD0, 0xD8)):
return
yield UInt16(self, "size", "Size")
size = (self["size"].value - 2)
if 0 < size:
if self._parser:
yield self._parser(self,
"content",
"Chunk content",
size=size * 8)
else:
yield RawBytes(self, "data", size, "Data")
def createFields(self):
yield Enum(UInt8(self, "typecode"), TYPECODE_NAMES)
yield SerializedContent(self, "classDesc")
self.root.newHandle(self)
yield Int32(self, "size")
klass = VALUE_CLASS_MAP[
self.classDesc.className[1]] # className is [<elementType>
for i in range(self['size'].value):
yield klass(self, "value[]")
def parseDeclareFunctionV7(parent, size):
yield CString(parent, "name")
argCount = UInt16(parent, "arg_count")
yield argCount
yield UInt8(parent, "reg_count")
yield Bits(parent, "reserved", 7)
yield Bit(parent, "preload_global")
yield Bit(parent, "preload_parent")
yield Bit(parent, "preload_root")
yield Bit(parent, "suppress_super")
yield Bit(parent, "preload_super")
yield Bit(parent, "suppress_arguments")
yield Bit(parent, "preload_arguments")
yield Bit(parent, "suppress_this")
yield Bit(parent, "preload_this")
for i in range(argCount.value):
yield UInt8(parent, "register[]")
yield CString(parent, "arg[]")
yield UInt16(parent, "function_length")
def createFields(self):
# Type
yield Enum(UInt8(self, "type"), self.type_desc)
type = self["type"].value
# Code
field = UInt8(self, "code")
if type == 3:
field = Enum(field, self.reject_reason)
yield field
# Options
yield textHandler(UInt16(self, "checksum"), hexadecimal)
if type in (self.PING, self.PONG): # and self["code"].value == 0:
yield UInt16(self, "id")
yield UInt16(self, "seq_num")
# follow: ping data
elif type == self.REJECT:
yield NullBytes(self, "empty", 2)
yield UInt16(self, "hop_mtu", "Next-Hop MTU")
def createFields(self):
yield UInt8(self, "version")
yield NullBits(self, "flags", 24)
yield UInt32(
self,
"uniform_size",
description="Uniform size of each sample (0 if non-uniform)")
yield UInt32(self, "count", description="Number of samples")
if self['uniform_size'].value == 0:
for i in range(self['count'].value):
yield UInt32(self, "sample_size[]")
def createFields(self):
yield String(self, "jfif", 5, "JFIF string", charset="ASCII")
if self["jfif"].value != "JFIF\0":
raise ParserError(
"Stream doesn't look like JPEG chunk (wrong JFIF signature)")
yield UInt8(self, "ver_maj", "Major version")
yield UInt8(self, "ver_min", "Minor version")
yield Enum(UInt8(self, "units", "Units"), self.UNIT_NAME)
if self["units"].value == 0:
yield UInt16(self, "aspect_x", "Aspect ratio (X)")
yield UInt16(self, "aspect_y", "Aspect ratio (Y)")
else:
yield UInt16(self, "x_density", "X density")
yield UInt16(self, "y_density", "Y density")
yield UInt8(self, "thumb_w", "Thumbnail width")
yield UInt8(self, "thumb_h", "Thumbnail height")
thumb_size = self["thumb_w"].value * self["thumb_h"].value
if thumb_size != 0:
yield PaletteRGB(self, "thumb_palette", 256)
yield RawBytes(self, "thumb_data", thumb_size, "Thumbnail data")
def createFields(self):
if self.has_all_byte:
yield Enum(UInt8(self, "all_defined"), {0: 'False', 1: 'True'})
if self['all_defined'].value:
return
nbytes = alignValue(self.num, 8) // 8
ctr = 0
for i in range(nbytes):
for j in reversed(range(8)):
yield Bit(self, "bit[%d]" % (ctr + j))
ctr += 8
def createFields(self):
typ = self.stream.readBytes(self.absolute_address + 17 * 8, 1)
if typ == b'n':
yield PDFNumber(self, "byte_offset")
elif typ == b'f':
yield PDFNumber(self, "next_free_object_number")
else:
yield PDFNumber(self, "unknown_string")
yield PDFNumber(self, "generation_number")
yield UInt8(self, "type")
yield LineEnd(self, "line_end")
def createFields(self):
yield textHandler(UInt8(self, "signature", "IPTC signature (0x1c)"),
hexadecimal)
if self["signature"].value != 0x1C:
raise ParserError("Wrong IPTC signature")
yield textHandler(UInt8(self, "dataset_nb", "Dataset number"),
hexadecimal)
yield UInt8(self, "tag", "Tag")
yield IPTC_Size(self, "size", "Content size")
size = self["size"].value
if 0 < size:
if self.dataset_info:
cls = self.dataset_info[2]
else:
cls = None
if cls:
yield cls(self, "content")
else:
yield RawBytes(self, "content", size)
def createFields(self):
size = self.size // 8
if size > 2:
if size > 4:
yield UInt8(self, "cs", "10ms units, values from 0 to 199")
yield Bits(self, "2sec", 5, "seconds/2")
yield Bits(self, "min", 6, "minutes")
yield Bits(self, "hour", 5, "hours")
yield Bits(self, "day", 5, "(1-31)")
yield Bits(self, "month", 4, "(1-12)")
yield Bits(self, "year", 7, "(0 = 1980, 127 = 2107)")
def createFields(self):
yield UInt8(self, "tag")
yield UInt24(self, "size", "Content size")
yield UInt24(self, "timestamp", "Timestamp in millisecond")
yield NullBytes(self, "reserved", 4)
size = self["size"].value
if size:
if self.parser:
yield from self.parser(self, size)
else:
yield RawBytes(self, "content", size)
def createFields(self):
yield UInt32(self, "size")
yield textHandler(
UInt32(
self, "magic",
"0xe391c05f for normal PPT, 0xf3d1c4df for encrypted PPT"),
hexadecimal)
yield UInt32(self, "offsetToCurrentEdit",
"Offset in main stream to current edit field")
yield UInt16(self, "lenUserName", "Length of user name")
yield UInt16(self, "docFileVersion", "1012 for PP97+")
yield UInt8(self, "majorVersion", "3 for PP97+")
yield UInt8(self, "minorVersion", "0 for PP97+")
yield UInt16(self, "unknown")
yield String(self, "userName", self["lenUserName"].value,
"ANSI version of the username")
yield UInt32(
self, "relVersion",
"Release version: 8 for regular PPT file, 9 for multiple-master PPT file"
)
def createFields(self):
yield UInt8(self, "version")
yield NullBits(self, "flags", 24)
yield UInt32(self,
"count",
description="Total entries in sample time table")
for i in range(self['count'].value):
yield UInt32(self, "sample_count[]",
"Number of consecutive samples with this delta")
yield UInt32(self, "sample_delta[]",
"Decode time delta since last sample, in time-units")
def createFields(self):
# Header
yield UInt24(self, "size")
yield Enum(UInt8(self, "type"), EFI_SECTION_TYPE)
section_type = self["type"].value
if section_type == EFI_SECTION_COMPRESSION:
yield UInt32(self, "uncomp_len")
yield Enum(UInt8(self, "comp_type"), self.COMPRESSION_TYPE)
elif section_type == EFI_SECTION_FREEFORM_SUBTYPE_GUID:
yield GUID(self, "sub_type_guid")
elif section_type == EFI_SECTION_GUID_DEFINED:
yield GUID(self, "section_definition_guid")
yield UInt16(self, "data_offset")
yield UInt16(self, "attributes")
elif section_type == EFI_SECTION_USER_INTERFACE:
yield CString(self, "file_name", charset="UTF-16-LE")
elif section_type == EFI_SECTION_VERSION:
yield UInt16(self, "build_number")
yield CString(self, "version", charset="UTF-16-LE")
# Content
content_size = (self.size - self.current_size) // 8
if content_size == 0:
return
if section_type == EFI_SECTION_COMPRESSION:
compression_type = self["comp_type"].value
if compression_type == 1:
while not self.eof:
yield RawBytes(self, "compressed_content", content_size)
else:
while not self.eof:
yield FileSection(self, "section[]")
elif section_type == EFI_SECTION_FIRMWARE_VOLUME_IMAGE:
yield FirmwareVolume(self, "firmware_volume")
else:
yield RawBytes(
self, "content", content_size,
EFI_SECTION_TYPE.get(self["type"].value,
"Unknown Section Type"))
def createFields(self):
yield UInt8(self, "version", "Version")
yield UInt24(self, "flags")
flags = self["flags"].value
yield UInt32(self, "sample_count")
if flags & 0x1:
yield UInt32(self, "data_offset")
if flags & 0x4:
yield UInt32(self, "first_sample_flags")
for i in range(self["sample_count"].value):
yield TrackRunSample(self, "sample[]")
def DecoderConfigDescriptor(self):
yield UInt8(self, "objectTypeIndication")
yield Bits(self, "streamType", 6)
yield Bit(self, "upStream", 1)
yield NullBits(self, "reserved", 1)
yield UInt24(self, "bufferSizeDB")
yield UInt32(self, "maxBitrate")
yield UInt32(self, "avgBitrate")
# TODO
while not self.eof:
yield Descriptor(self, "descr[]")
def createFields(self):
# This tag has too many variant forms.
if '/tags/' in self.path:
yield UInt32(self, "count")
for i in xrange(self['count'].value):
yield METATAG(self, "tag[]")
elif self.stream.readBits(self.absolute_address, 32, self.endian) == 0:
yield UInt8(self, "version")
yield Bits(self, "flags", 24)
yield AtomList(self, "tags")
else:
yield AtomList(self, "tags")
def createFields(self):
yield Bytes(self, "jump", 3, "Intel x86 jump instruction")
yield String(self, "name", 8)
yield BiosParameterBlock(self, "bios", "BIOS parameters")
yield textHandler(UInt8(self, "physical_drive", "(0x80)"), hexadecimal)
yield NullBytes(self, "current_head", 1)
yield textHandler(UInt8(self, "ext_boot_sig", "Extended boot signature (0x80)"), hexadecimal)
yield NullBytes(self, "unused", 1)
yield UInt64(self, "nb_sectors")
yield UInt64(self, "mft_cluster", "Cluster location of MFT data")
yield UInt64(self, "mftmirr_cluster", "Cluster location of copy of MFT")
yield UInt8(self, "cluster_per_mft", "MFT record size in clusters")
yield NullBytes(self, "reserved[]", 3)
yield UInt8(self, "cluster_per_index", "Index block size in clusters")
yield NullBytes(self, "reserved[]", 3)
yield textHandler(UInt64(self, "serial_number"), hexadecimal)
yield textHandler(UInt32(self, "checksum", "Boot sector checksum"), hexadecimal)
yield Bytes(self, "boot_code", 426)
yield Bytes(self, "mbr_magic", 2, r"Master boot record magic number (\x55\xAA)")
def createFields(self):
yield UInt8(self, "version", "Version")
yield NullBits(self, "flags", 24)
yield String(self, "creator", 4)
yield String(self, "subtype", 4)
yield String(self, "manufacturer", 4)
yield UInt32(self, "res_flags")
yield UInt32(self, "res_flags_mask")
if self.root.is_mpeg4:
yield CString(self, "name", charset="UTF-8")
else:
yield PascalString8(self, "name")
def createFields(self):
yield String(self, 'capture_pattern', 4, charset="ASCII")
if self['capture_pattern'].value != self.MAGIC:
self.warning(
'Invalid signature. An Ogg page must start with "%s".' %
self.MAGIC)
yield UInt8(self, 'stream_structure_version')
yield Bit(self, 'continued_packet')
yield Bit(self, 'first_page')
yield Bit(self, 'last_page')
yield NullBits(self, 'unused', 5)
yield UInt64(self, 'abs_granule_pos')
yield textHandler(UInt32(self, 'serial'), hexadecimal)
yield UInt32(self, 'page')
yield textHandler(UInt32(self, 'checksum'), hexadecimal)
yield UInt8(self, 'lacing_size')
if self.lacing_size:
yield Lacing(self, "lacing", size=self.lacing_size * 8)
yield Segments(self,
"segments",
size=self._size - self._current_size)
def createFields(self):
yield UInt8(self, "configurationVersion")
yield UInt8(self, "AVCProfileIndication")
yield UInt8(self, "profile_compatibility")
yield UInt8(self, "AVCLevelIndication")
yield NullBits(self, "reserved[]", 6)
yield Bits(self, "lengthSizeMinusOne", 2)
yield NullBits(self, "reserved[]", 3)
yield Bits(self, "numOfSequenceParameterSets", 5)
for i in range(self["numOfSequenceParameterSets"].value):
yield PascalString16(self, "sequenceParameterSetNALUnit[]")
yield UInt8(self, "numOfPictureParameterSets")
for i in range(self["numOfPictureParameterSets"].value):
yield PascalString16(self, "pictureParameterSetNALUnit[]")
if self['AVCProfileIndication'].value in (100, 110, 122, 144) and not self.eof:
yield NullBits(self, "reserved[]", 6)
yield Bits(self, "chroma_format", 2)
yield NullBits(self, "reserved[]", 5)
yield Bits(self, "bit_depth_luma_minus8", 3)
yield NullBits(self, "reserved[]", 5)
yield Bits(self, "bit_depth_chroma_minus8", 3)
yield UInt8(self, "numOfSequenceParameterSetExt")
for i in range(self["numOfSequenceParameterSetExt"].value):
yield PascalString16(self, "sequenceParameterSetExtNALUnit[]")
def createFields(self):
yield UInt16(self, "signature", "PE optional header signature (0x010b)")
# TODO: Support PE32+ (signature=0x020b)
if self["signature"].value != 0x010b:
raise ParserError("Invalid PE optional header signature")
yield UInt8(self, "maj_lnk_ver", "Major linker version")
yield UInt8(self, "min_lnk_ver", "Minor linker version")
yield filesizeHandler(UInt32(self, "size_code", "Size of code"))
yield filesizeHandler(UInt32(self, "size_init_data", "Size of initialized data"))
yield filesizeHandler(UInt32(self, "size_uninit_data", "Size of uninitialized data"))
yield textHandler(UInt32(self, "entry_point", "Address (RVA) of the code entry point"), hexadecimal)
yield textHandler(UInt32(self, "base_code", "Base (RVA) of code"), hexadecimal)
yield textHandler(UInt32(self, "base_data", "Base (RVA) of data"), hexadecimal)
yield textHandler(UInt32(self, "image_base", "Image base (RVA)"), hexadecimal)
yield filesizeHandler(UInt32(self, "sect_align", "Section alignment"))
yield filesizeHandler(UInt32(self, "file_align", "File alignment"))
yield UInt16(self, "maj_os_ver", "Major OS version")
yield UInt16(self, "min_os_ver", "Minor OS version")
yield UInt16(self, "maj_img_ver", "Major image version")
yield UInt16(self, "min_img_ver", "Minor image version")
yield UInt16(self, "maj_subsys_ver", "Major subsystem version")
yield UInt16(self, "min_subsys_ver", "Minor subsystem version")
yield NullBytes(self, "reserved", 4)
yield filesizeHandler(UInt32(self, "size_img", "Size of image"))
yield filesizeHandler(UInt32(self, "size_hdr", "Size of headers"))
yield textHandler(UInt32(self, "checksum"), hexadecimal)
yield Enum(UInt16(self, "subsystem"), self.SUBSYSTEM_NAME)
yield UInt16(self, "dll_flags")
yield filesizeHandler(UInt32(self, "size_stack_reserve"))
yield filesizeHandler(UInt32(self, "size_stack_commit"))
yield filesizeHandler(UInt32(self, "size_heap_reserve"))
yield filesizeHandler(UInt32(self, "size_heap_commit"))
yield UInt32(self, "loader_flags")
yield UInt32(self, "nb_directory", "Number of RVA and sizes")
for index in xrange(self["nb_directory"].value):
try:
name = self.DIRECTORY_NAME[index]
except KeyError:
name = "data_dir[%u]" % index
yield DataDirectory(self, name)
def createFields(self):
yield UInt8(self, "version")
yield NullBits(self, "flags", 24)
yield RawBytes(self, "SystemID", 16)
if self["version"].value > 0:
yield UInt32(self, "KID_Count")
for i in range(self["KID_Count"].value):
yield RawBytes(self, "KID[]", 16)
yield UInt32(self, "DataSize")
yield RawBytes(self, "Data", self["DataSize"].value)
def specialHeader(s, is_file):
yield filesizeHandler(
UInt32(s, "compressed_size", "Compressed size (bytes)"))
yield filesizeHandler(
UInt32(s, "uncompressed_size", "Uncompressed size (bytes)"))
yield Enum(UInt8(s, "host_os", "Operating system used for archiving"),
OS_NAME)
yield textHandler(UInt32(s, "crc32", "File CRC32"), hexadecimal)
yield TimeDateMSDOS32(s, "ftime", "Date and time (MS DOS format)")
yield textHandler(
UInt8(s, "version", "RAR version needed to extract file"),
formatRARVersion)
yield Enum(UInt8(s, "method", "Packing method"), COMPRESSION_NAME)
yield filesizeHandler(UInt16(s, "filename_length", "File name size"))
if s["host_os"].value in (OS_MSDOS, OS_WIN32):
yield MSDOSFileAttr32(s, "file_attr", "File attributes")
else:
yield textHandler(UInt32(s, "file_attr", "File attributes"),
hexadecimal)
# Start additional field from unrar
if s["flags/is_large"].value:
yield filesizeHandler(
UInt64(s, "large_size", "Extended 64bits filesize"))
# End additional field
size = s["filename_length"].value
if size > 0:
if s["flags/is_unicode"].value:
charset = "UTF-8"
else:
charset = "ISO-8859-15"
yield String(s, "filename", size, "Filename", charset=charset)
# Start additional fields from unrar - file only
if is_file:
if s["flags/has_salt"].value:
yield textHandler(UInt8(s, "salt", "Salt"), hexadecimal)
if s["flags/has_ext_time"].value:
yield ExtTime(s, "extra_time", "Extra time info")
def createFields(self):
yield UInt8(self, "version")
yield NullBits(self, "flags", 24)
yield UInt32(self,
"count",
description="Total entries in sample time table")
for i in range(self['count'].value):
yield UInt32(self, "sample_count[]",
"Number of consecutive samples with this offset")
yield UInt32(
self, "sample_offset[]",
"Difference between decode time and composition time of this sample, in time-units"
)
