def unpack_dataruns(str): dataruns = [] numruns = 0 pos = 0 prevoffset = 0 error = '' c_uint8 = ctypes.c_uint8 class Length_bits(ctypes.LittleEndianStructure): _fields_ = [ ("lenlen", c_uint8, 4), ("offlen", c_uint8, 4), ] class Lengths(ctypes.Union): _fields_ = [("b", Length_bits), ("asbyte", c_uint8)] lengths = Lengths() #mftutils.hexdump(str,':',16) while (True): lengths.asbyte = struct.unpack("B", str[pos])[0] pos += 1 if lengths.asbyte == 0x00: break if (lengths.b.lenlen > 6 or lengths.b.lenlen == 0): error = "Datarun oddity." break len = bitparse.parse_little_endian_signed(str[pos:pos + lengths.b.lenlen]) # print lengths.b.lenlen, lengths.b.offlen, len pos += lengths.b.lenlen if (lengths.b.offlen > 0): offset = bitparse.parse_little_endian_signed(str[pos:pos + lengths.b.offlen]) offset = offset + prevoffset prevoffset = offset pos += lengths.b.offlen else: # Sparse offset = 0 pos += 1 dataruns.append([len, offset]) numruns += 1 # print "Lenlen: %d Offlen: %d Len: %d Offset: %d" % (lengths.b.lenlen, lengths.b.offlen, len, offset) return numruns, dataruns, error
def unpack_dataruns(str): dataruns = [] numruns = 0 pos = 0 prevoffset = 0 error = '' c_uint8 = ctypes.c_uint8 class Length_bits(ctypes.LittleEndianStructure): _fields_ = [ ("lenlen", c_uint8, 4), ("offlen", c_uint8, 4), ] class Lengths(ctypes.Union): _fields_ = [("b", Length_bits), ("asbyte", c_uint8)] lengths = Lengths() #mftutils.hexdump(str,':',16) while (True): lengths.asbyte = struct.unpack("B",str[pos])[0] pos += 1 if lengths.asbyte == 0x00: break if (lengths.b.lenlen > 6 or lengths.b.lenlen == 0): error = "Datarun oddity." break len = bitparse.parse_little_endian_signed(str[pos:pos+lengths.b.lenlen]) # print lengths.b.lenlen, lengths.b.offlen, len pos += lengths.b.lenlen if (lengths.b.offlen > 0): offset = bitparse.parse_little_endian_signed(str[pos:pos+lengths.b.offlen]) offset = offset + prevoffset prevoffset = offset pos += lengths.b.offlen else: # Sparse offset = 0 pos += 1 dataruns.append([len, offset]) numruns += 1 # print "Lenlen: %d Offlen: %d Len: %d Offset: %d" % (lengths.b.lenlen, lengths.b.offlen, len, offset) return numruns, dataruns, error