vstruct Package

vstruct Package

class vstruct.VArray(elems=())

Bases: vstruct.VStruct

vsAddElement(elem)

Used to add elements to an array

class vstruct.VStruct

Bases: vstruct.primitives.v_base

The VStruct class is the bases for all groups of primitive fields which define a “structure”. Fields may be added with vsAddField() or simply added as attributes (provided you use a VStruct or one of the vstruct.primitives in the initial assignment.)

Example:

import vstruct from vstruct.primitives import *

vs = vstruct.VStruct() vs.fieldone = v_uint32() vs.fieldtwo = v_str(size=30)

bytes = vs.vsEmit()

tree(va=0, reprmax=None)

vsAddField(name, value)

vsAddParseCallback(fieldname, callback)

Register a callback which will be triggered when the field with the given name is set by the parser. This can be used to simplify auto-parsing to change fields sizes or whatnot during parsing.

(You may also name a method pcb_<FieldName> to get a callback for your struct.)

Example:

def updateLengthTarget(vs):

dostuff()

v.vsAddParseCallback(‘lenfield’, updateLengthTarget)

vsCalculate()

Calculate fields which need correction before emitting bytes etc...

(VStruct extenders may call this, then modify fields internally)

vsClearFields()

Clear all fields from the current vstruct object. This may be useful in specialized parsers which populate their structure on vsParse()

vsEmit()

Get back the byte sequence associated with this structure.

vsGetClassPath()

Return the entire class name (including module path).

vsGetField(name)

vsGetFields()

Get a list of (fieldname, fieldobj) tuples for all the kids in this VStruct (non-recursive)

Example:

for kidname, kidobj in x.vsGetFields():

print kidname

vsGetOffset(name)

Return the offset of a member (by name):

vsGetPrims()

return an order’d list of the primitive fields in this structure definition. This is recursive and will return the sub fields of all nested structures.

vsGetPrintInfo(offset=0, indent=0, top=True)

vsGetTypeName()

vsHasField(name)

Test weather this structure contains a field with the given name....

Example:

if x.vsHasField(‘woot’):

print ‘STRUCT HAS WOOT FIELD!’

vsInsertField(name, value, befname)

WARNING: vsInsertField does NOT honor field alignment! # FIXME (AND CAN MESS UP OTHER FIELDS ALIGNMENT!)

vsIsPrim()

vsParse(sbytes, offset=0)

For all the primitives contained within, allow them an opportunity to parse the given data and return the total offset...

Any method named pcb_<FieldName> will be called back when the specified field is set by the parser.

vsParseFd(fd)

Parse from the given file like object as input.

vsSetField(name, value)

Mostly for internal use...

class vstruct.VUnion

Bases: vstruct.VStruct

vsEmit()

vsGetPrintInfo(offset=0, indent=0, top=True)

vsParse(sbytes, offset=0)

For all the primitives contained within, allow them an opportunity to parse the given data and return the total offset...

Any method named pcb_<FieldName> will be called back when the specified field is set by the parser.

vstruct.getModuleNames()

vstruct.getStructNames(modname)

vstruct.getStructure(sname)

Return an instance of the specified structure. The structure name may be a definition that was added with addStructure() or a python path (ie. win32.TEB) of a definition from within vstruct.defs.

vstruct.isVstructType(x)

vstruct.resolve(impmod, nameparts)

Resolve the given (potentially nested) object from within a module.

vstruct.resolvepath(impmod, pathstr)

Resolve an object/module from within the given module by path name (ie. ‘foo.bar.baz’)

Example: x = resolvepath(vstruct.defs, ‘win32.SEH_SCOPETABLE’)

builder Module

VStruct builder! Used to serialize structure definitions etc...

class vstruct.builder.VStructBuilder(defs=(), enums=())

addVStructCtor(sname, ctor)

addVStructDef(vsdef)

addVStructEnumeration(enum)

addVStructNamespace(name, builder)

buildVStruct(vsname)

delVStructCtor(sname)

genVStructPyCode()

getVStructCtorNames()

getVStructNames(namespace=None)

getVStructNamespaceNames()

getVStructNamespaces()

hasVStructNamespace(namespace)

class vstruct.builder.VStructConstructor(builder, vsname)

cparse Module

primitives Module

class vstruct.primitives.GUID(guidstr=None)

Bases: vstruct.primitives.v_prim

vsEmit()

vsGetValue()

vsParse(fbytes, offset=0)

vsSetValue(guidstr)

class vstruct.primitives.v_base

Bases: object

vsCalculate()

vsGetMeta(name, defval=None)

vsGetTypeName()

vsIsPrim()

vsParse(bytes)

vsSetMeta(name, value)

class vstruct.primitives.v_bytes(size=0, vbytes=None)

Bases: vstruct.primitives.v_prim

v_bytes is used for fixed width byte fields.

vsEmit()

vsParse(fbytes, offset=0)

vsSetLength(size)

vsSetValue(val)

class vstruct.primitives.v_enum

class vstruct.primitives.v_int16(value=0, bigend=False)

Bases: vstruct.primitives.v_number

class vstruct.primitives.v_int24(value=0, bigend=False)

Bases: vstruct.primitives.v_number

class vstruct.primitives.v_int32(value=0, bigend=False)

Bases: vstruct.primitives.v_number

class vstruct.primitives.v_int64(value=0, bigend=False)

Bases: vstruct.primitives.v_number

class vstruct.primitives.v_int8(value=0, bigend=False)

Bases: vstruct.primitives.v_number

class vstruct.primitives.v_number(value=0, bigend=False)

Bases: vstruct.primitives.v_prim

vsEmit()

Emit the bytes for this numeric type...

vsGetValue()

vsParse(fbytes, offset=0)

Parse the given numeric type from the given bytes...

vsSetValue(value)

Assure that the value is long() able for all numeric types.

class vstruct.primitives.v_prim

Bases: vstruct.primitives.v_base

vsEmit()

Return the actual bytes which represent this field

vsGetTypeName()

vsGetValue()

Get the type specific value for this field. (Used by the structure dereference method to return a python native for the field by name)

vsIsPrim()

vsParse(bytes, offset=0)

Parser for primitives which assumes we are calling parse directly.

vsParseFd(fd)

vsSetLength(size)

Set the length of this primitive type. This may be used to dynamically update the length of string fields, etc...

vsSetValue(value)

Set the type specific value for this field.

class vstruct.primitives.v_ptr(value=0, bigend=False)

Bases: vstruct.primitives.v_size_t

class vstruct.primitives.v_ptr32(value=0, bigend=False)

Bases: vstruct.primitives.v_ptr

class vstruct.primitives.v_ptr64(value=0, bigend=False)

Bases: vstruct.primitives.v_ptr

class vstruct.primitives.v_size_t(value=0, bigend=False)

Bases: vstruct.primitives.v_number

class vstruct.primitives.v_str(size=4, val='')

Bases: vstruct.primitives.v_prim

A string placeholder class which will automagically return up to a null terminator (and will keep it’s size by null padding when assigned to)

vsEmit()

vsGetValue()

vsParse(fbytes, offset=0)

vsSetLength(size)

vsSetValue(val)

class vstruct.primitives.v_uint16(value=0, bigend=False)

Bases: vstruct.primitives.v_number

class vstruct.primitives.v_uint24(value=0, bigend=False)

Bases: vstruct.primitives.v_number

class vstruct.primitives.v_uint32(value=0, bigend=False)

Bases: vstruct.primitives.v_number

class vstruct.primitives.v_uint64(value=0, bigend=False)

Bases: vstruct.primitives.v_number

class vstruct.primitives.v_uint8(value=0, bigend=False)

Bases: vstruct.primitives.v_number

class vstruct.primitives.v_wstr(size=4, encode='utf-16le', val='')

Bases: vstruct.primitives.v_str

Unicode variant of the above string class

NOTE: the size paramater is in WCHARs!

vsEmit()

vsGetValue()

vsParse(fbytes, offset=0)

vsSetValue(val)

class vstruct.primitives.v_zstr(val='')

Bases: vstruct.primitives.v_prim

A string placeholder class which will automagically return up to a null terminator dynamically.

vsEmit()

vsGetValue()

vsParse(fbytes, offset=0)

vsSetLength(size)

vsSetValue(val)

unittest Module

vstruct.unittest.test(vs, hexstr)

vstruct.unittest.updatelen(vs)

class vstruct.unittest.woot

Bases: vstruct.VStruct

pcb_lenfield()

Submodules

• constants Package
  • constants Package
  • ntstatus Module
• defs Package
  • defs Package
  • dns Module
  • elf Module
  • gif Module
  • inet Module
  • kdcom Module
  • pcap Module
  • pe Module
  • rar Module
  • win32 Module
  • Submodules
    • arm7 Package
      • arm7 Package
    • macho Package
      • macho Package
      • const Module
      • fat Module
      • loader Module
      • stabs Module
    • windows Package
      • windows Package
      • Submodules
        • win_5_1_i386 Package
          • ntdll Module
          • ntoskrnl Module
          • win32k Module
        • win_5_2_i386 Package
          • ntdll Module
          • ntoskrnl Module
          • win32k Module
        • win_6_1_amd64 Package
          • ntdll Module
          • ntoskrnl Module
          • win32k Module
        • win_6_1_i386 Package
          • ntdll Module
          • ntoskrnl Module
          • win32k Module
        • win_6_1_wow64 Package
          • ntdll Module
• qt Package
  • qt Package