def createFields(self):
yield Bytes(self, "jmp", 3, "Jump instruction (to skip over header on boot)")
yield Bytes(self, "oem_name", 8, "OEM Name (padded with spaces)")
yield UInt16(self, "sector_size", "Bytes per sector")
yield UInt8 (self, "cluster_size", "Sectors per cluster")
yield UInt16(self, "reserved_sectors", "Reserved sector count (including boot sector)")
yield UInt8 (self, "fat_nb", "Number of file allocation tables")
yield UInt16(self, "max_root", "Maximum number of root directory entries")
yield UInt16(self, "sectors1", "Total sectors (if zero, use 'sectors2')")
yield UInt8 (self, "media_desc", "Media descriptor")
yield UInt16(self, "fat_size", "Sectors per FAT")
yield UInt16(self, "track_size", "Sectors per track")
yield UInt16(self, "head_nb", "Number of heads")
yield UInt32(self, "hidden", "Hidden sectors")
yield UInt32(self, "sectors2", "Total sectors (if greater than 65535)")
if self.parent.version == 32:
yield UInt32(self, "fat32_size", "Sectors per FAT")
yield UInt16(self, "fat_flags", "FAT Flags")
yield UInt16(self, "version", "Version")
yield UInt32(self, "root_start", "Cluster number of root directory start")
yield UInt16(self, "inf_sector", "Sector number of FS Information Sector")
yield UInt16(self, "boot_copy", "Sector number of a copy of this boot sector")
yield NullBytes(self, "reserved[]", 12, "Reserved")
yield UInt8(self, "phys_drv", "Physical drive number")
yield NullBytes(self, "reserved[]", 1, 'Reserved ("current head")')
yield UInt8(self, "sign", "Signature")
yield textHandler(UInt32(self, "serial", "ID (serial number)"), hexadecimal)
yield String(self, "label", 11, "Volume Label", strip=' ', charset="ASCII")
yield String(self, "fs_type", 8, "FAT file system type", strip=' ', charset="ASCII")
yield Bytes(self, "code", 510-self.current_size/8, "Operating system boot code")
yield Bytes(self, "trail_sig", 2, "Signature (0x55 0xAA)")
def createFields(self):
# Headers
yield String(self, "header", 6, "Header (Exif\\0\\0)", charset="ASCII")
if self["header"].value != "Exif\0\0":
raise ParserError("Invalid EXIF signature!")
yield String(self, "byte_order", 2, "Byte order", charset="ASCII")
if self["byte_order"].value not in ("II", "MM"):
raise ParserError("Invalid endian!")
if self["byte_order"].value == "II":
self.endian = LITTLE_ENDIAN
else:
self.endian = BIG_ENDIAN
yield UInt16(self, "version", "TIFF version number")
yield UInt32(self, "img_dir_ofs", "Next image directory offset")
while not self.eof:
addr = self.absolute_address + self.current_size
tag = self.stream.readBits(addr, 16, NETWORK_ENDIAN)
if tag == 0xFFD8:
size = (self._size - self.current_size) // 8
yield SubFile(self,
"thumbnail",
size,
"Thumbnail (JPEG file)",
mime_type="image/jpeg")
break
elif tag == 0xFFFF:
break
yield ExifIFD(self, "ifd[]", "IFD")
padding = self.seekBit(self._size)
if padding is not None:
yield padding
def createFields(self):
yield ZipVersion(self, "version_made_by", "Version made by")
for field in ZipStartCommonFields(self):
yield field
# Check unicode status
charset = zipGetCharset(self)
yield UInt16(self, "comment_length", "Comment length")
yield UInt16(self, "disk_number_start", "Disk number start")
yield UInt16(self, "internal_attr", "Internal file attributes")
yield UInt32(self, "external_attr", "External file attributes")
yield UInt32(self, "offset_header", "Relative offset of local header")
yield String(self,
"filename",
self["filename_length"].value,
"Filename",
charset=charset)
if 0 < self["extra_length"].value:
yield ExtraFields(self,
"extra",
size=self["extra_length"].value * 8,
description="Extra fields")
if 0 < self["comment_length"].value:
yield String(self,
"comment",
self["comment_length"].value,
"Comment",
charset=charset)
def createFields(self):
addr = self.absolute_address
len = self.stream.searchBytesLength(':', False, addr,
addr + (MAX_STRING_LENGTH + 1) * 8)
if len is None:
raise ParserError("Torrent: unable to find string separator (':')")
if not len:
raise ParserError("Torrent: error: no string length!")
val = String(self, "length", len, "String length")
yield val
try:
len = int(val.value)
except ValueError:
len = -1
if len < 0:
raise ParserError(
"Invalid string length (%s)" %
makePrintable(val.value, "ASCII", to_unicode=True))
yield String(self, "separator", 1, "String length/value separator")
if not len:
self.info("Empty string: len=%i" % len)
return
if len < 512:
yield String(self,
"value",
len,
"String value",
charset="ISO-8859-1")
else:
# Probably raw data
yield RawBytes(self, "value", len, "Raw data")
def createUnpaddedFields(self):
yield String(self, "title", 28, strip='\0')
yield textHandler(UInt8(self, "marker[]"), hexadecimal)
for field in self.getFileVersionField():
yield field
yield UInt16(self, "num_orders")
yield UInt16(self, "num_instruments")
yield UInt16(self, "num_patterns")
for field in self.getFirstProperties():
yield field
yield String(self, "marker[]", 4)
for field in self.getLastProperties():
yield field
yield GenericVector(self, "channel_settings", 32, ChannelSettings,
"channel")
# Orders
yield GenericVector(self, "orders", self.getNumOrders(), UInt8,
"order")
for field in self.getHeaderEndFields():
yield field
def createFields(self):
yield String(self,
"header_id",
4,
"DataBase Header Markup (\"mhbd\")",
charset="ISO-8859-1")
yield UInt32(self, "header_length", "Header Length")
yield UInt32(self, "entry_length", "Entry Length")
yield UInt32(self, "unknown[]")
yield UInt32(self, "version_number", "Version Number")
yield UInt32(self, "child_number", "Number of Children")
yield UInt64(self, "id", "ID for this database")
yield UInt16(self, "unknown[]")
yield UInt32(self, "unknown[]")
yield UInt64(self, "unknown[]")
yield UInt16(self, "unknown[]")
yield UInt16(self, "hashing_scheme[]",
"Algorithm used to calculate the database hash")
yield NullBytes(self, "unknown[]", 20)
yield String(self, "language_id", 2, "Language ID")
yield UInt64(self, "persistent_id", "Library Persistent ID")
yield UInt32(self, "unknown[]")
yield UInt32(self, "unknown[]")
yield RawBytes(self, "hash[]", 20)
yield Int32(self, "timezone_offset[]", "Timezone offset in seconds")
yield UInt16(self, "unknown[]")
yield RawBytes(self, "iphone_hash[]", 45)
size = self["header_length"].value - self.current_size / 8
if size > 0:
yield NullBytes(self, "padding", size)
for i in xrange(self["child_number"].value):
yield DataSet(self, "dataset[]")
padding = self.seekByte(self["entry_length"].value, "entry padding")
if padding:
yield padding
def createFields(self):
size = self._size/8
# TODO: Strings charset?
if self.stream.readBytes(self.absolute_address, 9) == "PeakValue":
yield String(self, "text", 9, "Text")
size -= 9
yield String(self, "content", size, "Content")
def createFields(self):
yield String(self, "signature", 17, "XM signature", charset="ASCII")
yield String(self, "title", 20, "XM title", charset="ASCII", strip=' ')
yield UInt8(self, "marker", "Marker (0x1A)")
yield String(self,
"tracker_name",
20,
"XM tracker name",
charset="ASCII",
strip=' ')
yield UInt8(self, "format_minor")
yield UInt8(self, "format_major")
yield filesizeHandler(UInt32(self, "header_size", "Header size (276)"))
yield UInt16(self, "song_length", "Length in patten order table")
yield UInt16(self, "restart", "Restart position")
yield UInt16(self, "channels",
"Number of channels (2,4,6,8,10,...,32)")
yield UInt16(self, "patterns", "Number of patterns (max 256)")
yield UInt16(self, "instruments", "Number of instruments (max 128)")
yield Bit(self, "amiga_ftable", "Amiga frequency table")
yield Bit(self, "linear_ftable", "Linear frequency table")
yield Bits(self, "unused", 14)
yield UInt16(self, "tempo", "Default tempo")
yield UInt16(self, "bpm", "Default BPM")
yield GenericVector(self, "pattern_order", 256, UInt8, "order")
def createFields(self):
yield String(self,
"signature",
4,
'Format signature (".snd")',
charset="ASCII")
yield UInt32(self, "data_ofs", "Data offset")
yield filesizeHandler(UInt32(self, "data_size", "Data size"))
yield Enum(UInt32(self, "codec", "Audio codec"), self.CODEC_NAME)
yield displayHandler(
UInt32(self, "sample_rate", "Number of samples/second"),
humanFrequency)
yield UInt32(self, "channels", "Number of interleaved channels")
size = self["data_ofs"].value - self.current_size // 8
if 0 < size:
yield String(self,
"info",
size,
"Information",
strip=" \0",
charset="ISO-8859-1")
size = min(self["data_size"].value,
(self.size - self.current_size) // 8)
yield RawBytes(self, "audio_data", size, "Audio data")
def createFields(self):
yield String(self, "name", 20, strip='\0')
yield GenericVector(self, "samples", 31, SampleInfo, "info")
yield UInt8(self, "length")
yield UInt8(self, "played_patterns_count")
yield GenericVector(self, "patterns", 128, UInt8, "position")
yield String(self, "type", 4)
def createFields(self):
# Header
yield String(self, "magic", 3, "File magic code", charset="ASCII")
yield String(self, "version", 3, "GIF version", charset="ASCII")
yield ScreenDescriptor(self, "screen")
if self["screen/global_map"].value:
bpp = (self["screen/bpp"].value+1)
yield PaletteRGB(self, "color_map", 1 << bpp, "Color map")
self.color_map = self["color_map"]
else:
self.color_map = None
self.images = []
while True:
code = Enum(Character(self, "separator[]", "Separator code"), self.separator_name)
yield code
code = code.value
if code == "!":
yield Extension(self, "extensions[]")
elif code == ",":
yield Image(self, "image[]")
elif code == ";":
# GIF Terminator
break
else:
raise ParserError("Wrong GIF image separator: 0x%02X" % ord(code))
def createFields(self):
yield String(self, "game_title", 12, truncate="\0")
yield String(self, "game_code", 4)
yield String(self, "maker_code", 2)
yield UInt8(self, "unit_code")
yield UInt8(self, "device_code")
yield DeviceSize(self, "card_size")
yield String(self, "card_info", 9)
yield UInt8(self, "rom_version")
yield Bits(self, "unknown_flags[]", 2)
yield Bit(self, "autostart_flag")
yield Bits(self, "unknown_flags[]", 5)
yield UInt32(self, "arm9_source", "ARM9 ROM offset")
yield textHandler(UInt32(self, "arm9_execute_addr", "ARM9 entry address"), hexadecimal)
yield textHandler(UInt32(self, "arm9_copy_to_addr", "ARM9 RAM address"), hexadecimal)
yield UInt32(self, "arm9_bin_size", "ARM9 code size")
yield UInt32(self, "arm7_source", "ARM7 ROM offset")
yield textHandler(UInt32(self, "arm7_execute_addr", "ARM7 entry address"), hexadecimal)
yield textHandler(UInt32(self, "arm7_copy_to_addr", "ARM7 RAM address"), hexadecimal)
yield UInt32(self, "arm7_bin_size", "ARM7 code size")
yield UInt32(self, "filename_table_offset")
yield UInt32(self, "filename_table_size")
yield UInt32(self, "fat_offset")
yield UInt32(self, "fat_size")
yield UInt32(self, "arm9_overlay_src")
yield UInt32(self, "arm9_overlay_size")
yield UInt32(self, "arm7_overlay_src")
yield UInt32(self, "arm7_overlay_size")
yield textHandler(UInt32(self, "ctl_read_flags"), hexadecimal)
yield textHandler(UInt32(self, "ctl_init_flags"), hexadecimal)
yield UInt32(self, "banner_offset")
yield Crc16(self, "secure_crc16", self.stream.readBytes(0x4000*8, 0x4000))
yield UInt16(self, "rom_timeout")
yield UInt32(self, "arm9_unk_addr")
yield UInt32(self, "arm7_unk_addr")
yield UInt64(self, "unenc_mode_magic")
yield UInt32(self, "rom_size")
yield UInt32(self, "header_size")
yield RawBytes(self, "unknown[]", 36)
yield String(self, "passme_autoboot_detect", 4)
yield RawBytes(self, "unknown[]", 16)
yield RawBytes(self, "gba_logo", 156)
yield Crc16(self, "logo_crc16", self.stream.readBytes(0xc0*8, 156))
yield Crc16(self, "header_crc16", self.stream.readBytes(0, 350))
yield UInt32(self, "debug_rom_offset")
yield UInt32(self, "debug_size")
yield textHandler(UInt32(self, "debug_ram_address"), hexadecimal)
def createFields(self):
yield Enum(UInt8(self, "charset"), self.charset_desc)
yield String(self, "lang", 3, "Language", charset="ASCII")
charset = getCharset(self["charset"])
yield CString(self, "title", "Title", charset=charset, strip=self.STRIP)
size = (self.size - self.current_size) // 8
if not size:
return
yield String(self, "text", size, "Text", charset=charset, strip=self.STRIP)
def createFields(self):
yield UInt16(self, "length", "Length of this string")
if self.root.hasUnicodeNames():
yield String(self,
"data",
self["length"].value * 2,
charset="UTF-16-LE")
else:
yield String(self, "data", self["length"].value, charset="ASCII")
def createFields(self):
yield UInt32(self, "inodes_count", "Inodes count")
yield UInt32(self, "blocks_count", "Blocks count")
yield UInt32(self, "r_blocks_count", "Reserved blocks count")
yield UInt32(self, "free_blocks_count", "Free blocks count")
yield UInt32(self, "free_inodes_count", "Free inodes count")
yield UInt32(self, "first_data_block", "First data block")
yield UInt32(self, "log_block_size", "Block size")
yield UInt32(self, "log_frag_size", "Fragment size")
yield UInt32(self, "blocks_per_group", "Blocks per group")
yield UInt32(self, "frags_per_group", "Fragments per group")
yield UInt32(self, "inodes_per_group", "Inodes per group")
yield TimestampUnix32(self, "mtime", "Mount time")
yield TimestampUnix32(self, "wtime", "Write time")
yield UInt16(self, "mnt_count", "Mount count")
yield UInt16(self, "max_mnt_count", "Max mount count")
yield String(self, "magic", 2, "Magic number (0x53EF)")
yield Enum(UInt16(self, "state", "File system state"), self.state_desc)
yield Enum(UInt16(self, "errors", "Behaviour when detecting errors"),
self.error_handling_desc)
yield UInt16(self, "minor_rev_level", "Minor revision level")
yield TimestampUnix32(self, "last_check", "Time of last check")
yield textHandler(
UInt32(self, "check_interval", "Maximum time between checks"),
self.postMaxTime)
yield Enum(UInt32(self, "creator_os", "Creator OS"), self.os_name)
yield UInt32(self, "rev_level", "Revision level")
yield UInt16(self, "def_resuid", "Default uid for reserved blocks")
yield UInt16(self, "def_resgid", "Default gid for reserved blocks")
yield UInt32(self, "first_ino", "First non-reserved inode")
yield UInt16(self, "inode_size", "Size of inode structure")
yield UInt16(self, "block_group_nr",
"Block group # of this superblock")
yield UInt32(self, "feature_compat", "Compatible feature set")
yield UInt32(self, "feature_incompat", "Incompatible feature set")
yield UInt32(self, "feature_ro_compat",
"Read-only compatible feature set")
yield RawBytes(self, "uuid", 16, "128-bit uuid for volume")
yield String(self, "volume_name", 16, "Volume name", strip="\0")
yield String(self,
"last_mounted",
64,
"Directory where last mounted",
strip="\0")
yield UInt32(self, "compression",
"For compression (algorithm usage bitmap)")
yield UInt8(self, "prealloc_blocks",
"Number of blocks to try to preallocate")
yield UInt8(self, "prealloc_dir_blocks",
"Number to preallocate for directories")
yield UInt16(self, "padding", "Padding")
yield String(self, "journal_uuid", 16, "uuid of journal superblock")
yield UInt32(self, "journal_inum", "inode number of journal file")
yield UInt32(self, "journal_dev", "device number of journal file")
yield UInt32(self, "last_orphan", "start of list of inodes to delete")
yield RawBytes(self, "reserved", 197, "Reserved")
def createFields(self):
yield String(self, "signature", 4, "Signature (FORM)", charset="ASCII")
yield filesizeHandler(UInt32(self, "filesize"))
yield String(self,
"type",
4,
"Form type (AIFF or AIFC)",
charset="ASCII")
while not self.eof:
yield Chunk(self, "chunk[]")
def createFields(self):
yield String(self,
"start",
1,
"Dictionary start delimiter (d)",
charset="ASCII")
while self.stream.readBytes(self.absolute_address + self.current_size,
1) != "e":
yield DictionaryItem(self, "item[]")
yield String(self, "end", 1, "Dictionary end delimiter")
def createFields(self):
yield textHandler(UInt8(self, "version"), hexadecimal)
yield RawBytes(self, "flags", 3)
yield String(self, "subtype", 8)
yield String(self, "manufacturer", 4)
yield UInt32(self, "res_flags")
yield UInt32(self, "res_flags_mask")
if self.root.is_mpeg4:
yield CString(self, "name")
else:
yield PascalString8(self, "name")
def createFields(self):
yield textHandler(UInt32(self, "plugin_id1"), hexadecimal)
yield textHandler(UInt32(self, "plugin_id2"), hexadecimal)
yield UInt32(self, "input_routing")
yield UInt32(self, "output_routing")
yield GenericVector(self, "routing_info", 4, UInt32, "reserved")
yield String(self, "name", 32, strip='\0')
yield String(self,
"dll_name",
64,
desc="Original DLL name",
strip='\0')
def createFields(self):
yield UInt8(self, "version", "Version")
yield NullBits(self, "flags", 24)
yield String(self, "creator", 4)
yield String(self, "subtype", 4)
yield String(self, "manufacturer", 4)
yield UInt32(self, "res_flags")
yield UInt32(self, "res_flags_mask")
if self.root.is_mpeg4:
yield CString(self, "name", charset="UTF-8")
else:
yield PascalString8(self, "name")
def createFields(self):
yield String(self, "start", 1, "Integer start delimiter (i)", charset="ASCII")
# Find integer end
addr = self.absolute_address+self.current_size
len = self.stream.searchBytesLength('e', False, addr, addr+(MAX_INTEGER_SIZE+1)*8)
if len is None:
raise ParserError("Torrent: Unable to find integer end delimiter (e)!")
if not len:
raise ParserError("Torrent: error, empty integer!")
yield String(self, "value", len, "Integer value", charset="ASCII")
yield String(self, "end", 1, "Integer end delimiter")
def createFields(self):
yield self.getType()
yield String(self, "filename", 12, strip='\0')
for field in self.getInstrumentFields():
yield field
yield String(self, "name", 28, strip='\0')
yield String(self,
"marker",
4,
"Either 'SCRS' or '(empty)'",
strip='\0')
def createFields(self):
yield String(self,
"header_id",
4,
"Data Object Header Markup (\"mhod\")",
charset="ISO-8859-1")
yield UInt32(self, "header_length", "Header Length")
yield UInt32(self, "entry_length", "Entry Length")
yield Enum(UInt32(self, "type", "type"), self.type_name)
if (self["type"].value < 15) or (self["type"].value >= 200):
yield UInt32(self, "unknown[]")
yield UInt32(self, "unknown[]")
yield UInt32(self, "position", "Position")
yield UInt32(self, "length", "String Length in bytes")
yield UInt32(self, "unknown[]")
yield UInt32(self, "unknown[]")
yield String(self,
"string",
self["length"].value,
"String Data",
charset="UTF-16-LE")
elif (self["type"].value < 17):
yield UInt32(self, "unknown[]")
yield UInt32(self, "unknown[]")
yield String(self,
"string",
self._size / 8 - self["header_length"].value,
"String Data",
charset="UTF-8")
elif (self["type"].value == 52):
yield UInt32(self, "unknown[]", "unk1")
yield UInt32(self, "unknown[]", "unk2")
yield Enum(UInt32(self, "sort_index_type", "Sort Index Type"),
self.mhod52_sort_index_type_name)
yield UInt32(self, "entry_count", "Entry Count")
indexes_size = self["entry_count"].value * 4
padding_offset = self["entry_length"].value - indexes_size
padding = self.seekByte(padding_offset, "header padding")
if padding:
yield padding
for i in xrange(self["entry_count"].value):
yield UInt32(self, "index[" + str(i) + "]",
"Index of the " + str(i) + "nth mhit")
else:
padding = self.seekByte(self["header_length"].value,
"header padding")
if padding:
yield padding
padding = self.seekBit(self._size, "entry padding")
if padding:
yield padding
def createFields(self):
yield UInt8(self, "size")
self._size = (self['size'].value + 1) * 8
yield Enum(UInt8(self, "type"), self.STREAMTYPE)
if self['type'].display.startswith('V'): # Video
yield Enum(
Bits(self, "resolution", 4), {
1: '480i',
2: '576i',
3: '480p',
4: '1080i',
5: '720p',
6: '1080p',
7: '576p'
})
yield Enum(
Bits(self, "fps", 4), {
1: '24/1.001',
2: '24',
3: '25',
4: '30/1.001',
6: '50',
7: '60/1.001'
})
yield Enum(UInt8(self, "aspect_ratio"), {
0x20: '4:3',
0x30: '16:9'
})
elif self['type'].display.startswith('A'): # Audio
yield Enum(Bits(self, "channel_layout", 4), {
1: 'Mono',
3: 'Stereo',
6: 'Multi',
12: 'Combi'
})
yield Enum(
Bits(self, "sample_rate", 4), {
1: '48KHz',
4: '96KHz',
5: '192KHz',
12: '48-192KHz',
14: '48-96KHz'
})
yield Enum(String(self, "language", 3), ISO639_2)
elif self['type'].display.startswith('T'): # Text subtitle
yield UInt8(self, "unknown[]")
yield Enum(String(self, "language", 3), ISO639_2)
elif self['type'].display.startswith('S'): # Graphics
yield Enum(String(self, "language", 3), ISO639_2)
else:
pass
def createFields(self):
yield String(self, "magic", 4)
yield String(self, "version", 4, strip='\0')
yield textHandler(UInt32(self, "checksum"), hexadecimal)
yield RawBytes(self,
"signature",
20,
description="SHA1 sum over all subsequent data")
yield filesizeHandler(UInt32(self, "filesize"))
yield UInt32(self, "size", description="Header size")
self._size = self['size'].value * 8
yield textHandler(UInt32(self, "endian"), hexadecimal)
yield UInt32(self, "link_count")
yield UInt32(self, "link_offset")
yield UInt32(self, "map_offset", description="offset to map footer")
yield UInt32(self,
"string_count",
description="number of entries in string table")
yield UInt32(self,
"string_offset",
description="offset to string table")
yield UInt32(self,
"type_desc_count",
description="number of entries in type descriptor table")
yield UInt32(self,
"type_desc_offset",
description="offset to type descriptor table")
yield UInt32(
self,
"meth_desc_count",
description="number of entries in method descriptor table")
yield UInt32(self,
"meth_desc_offset",
description="offset to method descriptor table")
yield UInt32(self,
"field_count",
description="number of entries in field table")
yield UInt32(self, "field_offset", description="offset to field table")
yield UInt32(self,
"method_count",
description="number of entries in method table")
yield UInt32(self,
"method_offset",
description="offset to method table")
yield UInt32(self,
"class_count",
description="number of entries in class table")
yield UInt32(self, "class_offset", description="offset to class table")
yield UInt32(self, "data_size", description="size of data region")
yield UInt32(self, "data_offset", description="offset to data region")
def createFields(self):
if not self.LFN:
yield String(self, "name", 8, "DOS file name (padded with spaces)",
strip=' ', charset="ASCII")
yield String(self, "ext", 3, "DOS file extension (padded with spaces)",
strip=' ', charset="ASCII")
yield Bit(self, "read_only")
yield Bit(self, "hidden")
yield Bit(self, "system")
yield Bit(self, "volume_label")
yield Bit(self, "directory")
yield Bit(self, "archive")
yield Bit(self, "device")
yield Bit(self, "unused")
yield RawBytes(self, "reserved", 1, "Something about the case")
yield Date(self, "create")
yield Date(self, "access")
if self.parent.parent.version > 16:
yield UInt16(self, "cluster_hi")
else:
yield UInt16(self, "ea_index")
yield Date(self, "modify")
yield UInt16(self, "cluster_lo")
size = UInt32(self, "size")
yield size
if self.process:
del self.process
target_size = size.value
if self["directory"].value:
if target_size:
size.error("(FAT) value must be zero")
target_size = 0
elif not target_size:
return
self.target_size = 8 * target_size
yield InodeLink(self, "data")
else:
yield UInt8(self, "seq_no", "Sequence Number")
yield String(self, "name[]", 10, "(5 UTF-16 characters)",
charset="UTF-16-LE")
yield UInt8(self, "magic", "Magic number (15)")
yield NullBytes(self, "reserved", 1, "(always 0)")
yield UInt8(self, "checksum", "Checksum of DOS file name")
yield String(self, "name[]", 12, "(6 UTF-16 characters)",
charset="UTF-16-LE")
yield UInt16(self, "first_cluster", "(always 0)")
yield String(self, "name[]", 4, "(2 UTF-16 characters)",
charset="UTF-16-LE")
def createFields(self):
bytes = self.stream.readBytes(self.absolute_address, 4)
if bytes == "\0R\0\0":
charset = "UTF-16-BE"
else:
charset = "UTF-16-LE"
yield String(self, "name", 64, charset=charset, truncate="\0")
yield UInt16(self, "namelen", "Length of the name")
yield Enum(UInt8(self, "type", "Property type"), self.TYPE_NAME)
yield Enum(UInt8(self, "decorator", "Decorator"), self.DECORATOR_NAME)
yield SECT(self, "left")
yield SECT(self, "right")
yield SECT(self, "child",
"Child node (valid for storage and root types)")
yield GUID(self, "clsid",
"CLSID of this storage (valid for storage and root types)")
yield NullBytes(self, "flags", 4, "User flags")
yield TimestampWin64(
self, "creation",
"Creation timestamp(valid for storage and root types)")
yield TimestampWin64(
self, "lastmod",
"Modify timestamp (valid for storage and root types)")
yield SECT(
self, "start",
"Starting SECT of the stream (valid for stream and root types)")
if self["/header/bb_shift"].value == 9:
yield filesizeHandler(
UInt32(self, "size",
"Size in bytes (valid for stream and root types)"))
yield NullBytes(self, "padding", 4)
else:
yield filesizeHandler(
UInt64(self, "size",
"Size in bytes (valid for stream and root types)"))
def createFields(self):
LONG = Int32
yield UInt32(self, "type", "Record type (always 1)")
yield UInt32(self, "size", "Size of the header in bytes")
yield RECT32(self, "Bounds", "Inclusive bounds")
yield RECT32(self, "Frame", "Inclusive picture frame")
yield textHandler(UInt32(self, "signature", "Signature ID (always 0x464D4520)"), hexadecimal)
yield UInt16(self, "min_ver", "Minor version")
yield UInt16(self, "maj_ver", "Major version")
yield UInt32(self, "file_size", "Size of the file in bytes")
yield UInt32(self, "NumOfRecords", "Number of records in the metafile")
yield UInt16(self, "NumOfHandles", "Number of handles in the handle table")
yield NullBytes(self, "reserved", 2)
yield UInt32(self, "desc_size", "Size of description in 16-bit words")
yield UInt32(self, "desc_ofst", "Offset of description string in metafile")
yield UInt32(self, "nb_colors", "Number of color palette entries")
yield LONG(self, "width_px", "Width of reference device in pixels")
yield LONG(self, "height_px", "Height of reference device in pixels")
yield LONG(self, "width_mm", "Width of reference device in millimeters")
yield LONG(self, "height_mm", "Height of reference device in millimeters")
# Read description (if any)
offset = self["desc_ofst"].value
current = (self.absolute_address + self.current_size) // 8
size = self["desc_size"].value * 2
if offset == current and size:
yield String(self, "description", size, charset="UTF-16-LE", strip="\0 ")
# Read padding (if any)
size = self["size"].value - self.current_size//8
if size:
yield RawBytes(self, "padding", size)
def parseCommon(self):
yield UInt16(self, "nb_channel")
yield UInt32(self, "nb_sample")
yield UInt16(self, "sample_size")
yield Float80(self, "sample_rate")
yield Enum(String(self, "codec", 4, strip="\0", charset="ASCII"),
CODEC_NAME)
def createFields(self):
yield textHandler(UInt32(self, "crc32"), hexadecimal)
yield UInt16(self, "size")
yield UInt16(
self, "uncompressed_size",
"If this is 0, this block is continued in a subsequent cabinet")
if self["/flags/has_reserved"].value and self[
"/reserved_data_size"].value:
yield RawBytes(self, "reserved_data",
self["/reserved_data_size"].value,
"Per-datablock reserved area")
compr_method = self.parent.folder["compr_method"].value
if compr_method == 0: # Uncompressed
yield RawBytes(self, "data", self["size"].value, "Folder Data")
self.parent.uncompressed_data += self["data"].value
elif compr_method == 1: # MSZIP
yield String(self, "mszip_signature", 2, "MSZIP Signature (CK)")
yield DeflateBlock(self, "deflate_block",
self.parent.uncompressed_data)
padding = paddingSize(self.current_size, 8)
if padding:
yield PaddingBits(self, "padding[]", padding)
self.parent.uncompressed_data = self["deflate_block"].uncomp_data
elif compr_method == 2: # Quantum
yield RawBytes(self, "compr_data", self["size"].value,
"Compressed Folder Data")
elif compr_method == 3: # LZX
group = getattr(self.parent.folder, "lzx_group", None)
field = CustomFragment(self, "data", self["size"].value * 8,
LZXStream, "LZX data fragment", group)
self.parent.folder.lzx_group = field.group
yield field
def __init__(self, parent, name, nbytes, description=None, strip=' \0', charset='ISO-8859-1', *args, **kwargs):
String.__init__(self, parent, name, nbytes, description, strip, charset, *args, **kwargs)