kaitai: all formats compiled and included

5 files changed, 889 insertions, 0 deletions

diff --git a/python/examples/kaitai/kaitai_struct_formats/log/__init__.py b/python/examples/kaitai/kaitai_struct_formats/log/__init__.py
new file mode 100644
index 00000000..e69de29b
--- /dev/null
+++ b/python/examples/kaitai/kaitai_struct_formats/log/__init__.py
diff --git a/python/examples/kaitai/kaitai_struct_formats/log/aix_utmp.py b/python/examples/kaitai/kaitai_struct_formats/log/aix_utmp.py
new file mode 100644
index 00000000..e731fc16
--- /dev/null
+++ b/python/examples/kaitai/kaitai_struct_formats/log/aix_utmp.py
@@ -0,0 +1,116 @@
+from __future__ import absolute_import
+# This is a generated file! Please edit source .ksy file and use kaitai-struct-compiler to rebuild
+
+from pkg_resources import parse_version
+from ...kaitaistruct import __version__ as ks_version, KaitaiStruct, KaitaiStream, BytesIO
+from enum import Enum
+import collections
+
+
+if parse_version(ks_version) < parse_version('0.7'):
+    raise Exception("Incompatible Kaitai Struct Python API: 0.7 or later is required, but you have %s" % (ks_version))
+
+class AixUtmp(KaitaiStruct):
+    """This spec can be used to parse utmp, wtmp and other similar as created by IBM AIX.
+    
+    .. seealso::
+       Source - https://www.ibm.com/support/knowledgecenter/en/ssw_aix_71/com.ibm.aix.files/utmp.h.htm
+    """
+
+    class EntryType(Enum):
+        empty = 0
+        run_lvl = 1
+        boot_time = 2
+        old_time = 3
+        new_time = 4
+        init_process = 5
+        login_process = 6
+        user_process = 7
+        dead_process = 8
+        accounting = 9
+    SEQ_FIELDS = ["records"]
+    def __init__(self, _io, _parent=None, _root=None):
+        self._io = _io
+        self._parent = _parent
+        self._root = _root if _root else self
+        self._debug = collections.defaultdict(dict)
+
+    def _read(self):
+        self._debug['records']['start'] = self._io.pos()
+        self.records = []
+        i = 0
+        while not self._io.is_eof():
+            if not 'arr' in self._debug['records']:
+                self._debug['records']['arr'] = []
+            self._debug['records']['arr'].append({'start': self._io.pos()})
+            _t_records = self._root.Record(self._io, self, self._root)
+            _t_records._read()
+            self.records.append(_t_records)
+            self._debug['records']['arr'][len(self.records) - 1]['end'] = self._io.pos()
+            i += 1
+
+        self._debug['records']['end'] = self._io.pos()
+
+    class Record(KaitaiStruct):
+        SEQ_FIELDS = ["user", "inittab_id", "device", "pid", "type", "timestamp", "exit_status", "hostname", "dbl_word_pad", "reserved_a", "reserved_v"]
+        def __init__(self, _io, _parent=None, _root=None):
+            self._io = _io
+            self._parent = _parent
+            self._root = _root if _root else self
+            self._debug = collections.defaultdict(dict)
+
+        def _read(self):
+            self._debug['user']['start'] = self._io.pos()
+            self.user = (self._io.read_bytes(256)).decode(u"ascii")
+            self._debug['user']['end'] = self._io.pos()
+            self._debug['inittab_id']['start'] = self._io.pos()
+            self.inittab_id = (self._io.read_bytes(14)).decode(u"ascii")
+            self._debug['inittab_id']['end'] = self._io.pos()
+            self._debug['device']['start'] = self._io.pos()
+            self.device = (self._io.read_bytes(64)).decode(u"ascii")
+            self._debug['device']['end'] = self._io.pos()
+            self._debug['pid']['start'] = self._io.pos()
+            self.pid = self._io.read_u8be()
+            self._debug['pid']['end'] = self._io.pos()
+            self._debug['type']['start'] = self._io.pos()
+            self.type = KaitaiStream.resolve_enum(self._root.EntryType, self._io.read_s2be())
+            self._debug['type']['end'] = self._io.pos()
+            self._debug['timestamp']['start'] = self._io.pos()
+            self.timestamp = self._io.read_s8be()
+            self._debug['timestamp']['end'] = self._io.pos()
+            self._debug['exit_status']['start'] = self._io.pos()
+            self.exit_status = self._root.ExitStatus(self._io, self, self._root)
+            self.exit_status._read()
+            self._debug['exit_status']['end'] = self._io.pos()
+            self._debug['hostname']['start'] = self._io.pos()
+            self.hostname = (self._io.read_bytes(256)).decode(u"ascii")
+            self._debug['hostname']['end'] = self._io.pos()
+            self._debug['dbl_word_pad']['start'] = self._io.pos()
+            self.dbl_word_pad = self._io.read_s4be()
+            self._debug['dbl_word_pad']['end'] = self._io.pos()
+            self._debug['reserved_a']['start'] = self._io.pos()
+            self.reserved_a = self._io.read_bytes(8)
+            self._debug['reserved_a']['end'] = self._io.pos()
+            self._debug['reserved_v']['start'] = self._io.pos()
+            self.reserved_v = self._io.read_bytes(24)
+            self._debug['reserved_v']['end'] = self._io.pos()
+
+
+    class ExitStatus(KaitaiStruct):
+        SEQ_FIELDS = ["termination_code", "exit_code"]
+        def __init__(self, _io, _parent=None, _root=None):
+            self._io = _io
+            self._parent = _parent
+            self._root = _root if _root else self
+            self._debug = collections.defaultdict(dict)
+
+        def _read(self):
+            self._debug['termination_code']['start'] = self._io.pos()
+            self.termination_code = self._io.read_s2be()
+            self._debug['termination_code']['end'] = self._io.pos()
+            self._debug['exit_code']['start'] = self._io.pos()
+            self.exit_code = self._io.read_s2be()
+            self._debug['exit_code']['end'] = self._io.pos()
+
+
+
diff --git a/python/examples/kaitai/kaitai_struct_formats/log/glibc_utmp.py b/python/examples/kaitai/kaitai_struct_formats/log/glibc_utmp.py
new file mode 100644
index 00000000..87852ae9
--- /dev/null
+++ b/python/examples/kaitai/kaitai_struct_formats/log/glibc_utmp.py
@@ -0,0 +1,114 @@
+from __future__ import absolute_import
+# This is a generated file! Please edit source .ksy file and use kaitai-struct-compiler to rebuild
+
+from pkg_resources import parse_version
+from ...kaitaistruct import __version__ as ks_version, KaitaiStruct, KaitaiStream, BytesIO
+from enum import Enum
+import collections
+
+
+if parse_version(ks_version) < parse_version('0.7'):
+    raise Exception("Incompatible Kaitai Struct Python API: 0.7 or later is required, but you have %s" % (ks_version))
+
+class GlibcUtmp(KaitaiStruct):
+
+    class EntryType(Enum):
+        empty = 0
+        run_lvl = 1
+        boot_time = 2
+        new_time = 3
+        old_time = 4
+        init_process = 5
+        login_process = 6
+        user_process = 7
+        dead_process = 8
+        accounting = 9
+    SEQ_FIELDS = ["records"]
+    def __init__(self, _io, _parent=None, _root=None):
+        self._io = _io
+        self._parent = _parent
+        self._root = _root if _root else self
+        self._debug = collections.defaultdict(dict)
+
+    def _read(self):
+        self._debug['records']['start'] = self._io.pos()
+        self._raw_records = []
+        self.records = []
+        i = 0
+        while not self._io.is_eof():
+            if not 'arr' in self._debug['records']:
+                self._debug['records']['arr'] = []
+            self._debug['records']['arr'].append({'start': self._io.pos()})
+            self._raw_records.append(self._io.read_bytes(384))
+            io = KaitaiStream(BytesIO(self._raw_records[-1]))
+            _t_records = self._root.Record(io, self, self._root)
+            _t_records._read()
+            self.records.append(_t_records)
+            self._debug['records']['arr'][len(self.records) - 1]['end'] = self._io.pos()
+            i += 1
+
+        self._debug['records']['end'] = self._io.pos()
+
+    class Record(KaitaiStruct):
+        SEQ_FIELDS = ["ut_type", "pid", "line", "id", "user", "host", "exit", "session", "tv", "addr_v6", "reserved"]
+        def __init__(self, _io, _parent=None, _root=None):
+            self._io = _io
+            self._parent = _parent
+            self._root = _root if _root else self
+            self._debug = collections.defaultdict(dict)
+
+        def _read(self):
+            self._debug['ut_type']['start'] = self._io.pos()
+            self.ut_type = KaitaiStream.resolve_enum(self._root.EntryType, self._io.read_s4le())
+            self._debug['ut_type']['end'] = self._io.pos()
+            self._debug['pid']['start'] = self._io.pos()
+            self.pid = self._io.read_u4le()
+            self._debug['pid']['end'] = self._io.pos()
+            self._debug['line']['start'] = self._io.pos()
+            self.line = (self._io.read_bytes(32)).decode(u"UTF-8")
+            self._debug['line']['end'] = self._io.pos()
+            self._debug['id']['start'] = self._io.pos()
+            self.id = (self._io.read_bytes(4)).decode(u"UTF-8")
+            self._debug['id']['end'] = self._io.pos()
+            self._debug['user']['start'] = self._io.pos()
+            self.user = (self._io.read_bytes(32)).decode(u"UTF-8")
+            self._debug['user']['end'] = self._io.pos()
+            self._debug['host']['start'] = self._io.pos()
+            self.host = (self._io.read_bytes(256)).decode(u"UTF-8")
+            self._debug['host']['end'] = self._io.pos()
+            self._debug['exit']['start'] = self._io.pos()
+            self.exit = self._io.read_u4le()
+            self._debug['exit']['end'] = self._io.pos()
+            self._debug['session']['start'] = self._io.pos()
+            self.session = self._io.read_s4le()
+            self._debug['session']['end'] = self._io.pos()
+            self._debug['tv']['start'] = self._io.pos()
+            self.tv = self._root.Timeval(self._io, self, self._root)
+            self.tv._read()
+            self._debug['tv']['end'] = self._io.pos()
+            self._debug['addr_v6']['start'] = self._io.pos()
+            self.addr_v6 = self._io.read_bytes(16)
+            self._debug['addr_v6']['end'] = self._io.pos()
+            self._debug['reserved']['start'] = self._io.pos()
+            self.reserved = self._io.read_bytes(20)
+            self._debug['reserved']['end'] = self._io.pos()
+
+
+    class Timeval(KaitaiStruct):
+        SEQ_FIELDS = ["sec", "usec"]
+        def __init__(self, _io, _parent=None, _root=None):
+            self._io = _io
+            self._parent = _parent
+            self._root = _root if _root else self
+            self._debug = collections.defaultdict(dict)
+
+        def _read(self):
+            self._debug['sec']['start'] = self._io.pos()
+            self.sec = self._io.read_s4le()
+            self._debug['sec']['end'] = self._io.pos()
+            self._debug['usec']['start'] = self._io.pos()
+            self.usec = self._io.read_s4le()
+            self._debug['usec']['end'] = self._io.pos()
+
+
+
diff --git a/python/examples/kaitai/kaitai_struct_formats/log/systemd_journal.py b/python/examples/kaitai/kaitai_struct_formats/log/systemd_journal.py
new file mode 100644
index 00000000..61d6fa93
--- /dev/null
+++ b/python/examples/kaitai/kaitai_struct_formats/log/systemd_journal.py
@@ -0,0 +1,359 @@
+from __future__ import absolute_import
+# This is a generated file! Please edit source .ksy file and use kaitai-struct-compiler to rebuild
+
+from pkg_resources import parse_version
+from ...kaitaistruct import __version__ as ks_version, KaitaiStruct, KaitaiStream, BytesIO
+from enum import Enum
+import collections
+
+
+if parse_version(ks_version) < parse_version('0.7'):
+    raise Exception("Incompatible Kaitai Struct Python API: 0.7 or later is required, but you have %s" % (ks_version))
+
+class SystemdJournal(KaitaiStruct):
+    """systemd, a popular user-space system/service management suite on Linux,
+    offers logging functionality, storing incoming logs in a binary journal
+    format.
+    
+    On live Linux system running systemd, these journals are typically located at:
+    
+    * /run/log/journal/machine-id/*.journal (volatile, lost after reboot)
+    * /var/log/journal/machine-id/*.journal (persistent, but disabled by default on Debian / Ubuntu)
+    
+    .. seealso::
+       Source - https://www.freedesktop.org/wiki/Software/systemd/journal-files/
+    """
+
+    class State(Enum):
+        offline = 0
+        online = 1
+        archived = 2
+    SEQ_FIELDS = ["header", "objects"]
+    def __init__(self, _io, _parent=None, _root=None):
+        self._io = _io
+        self._parent = _parent
+        self._root = _root if _root else self
+        self._debug = collections.defaultdict(dict)
+
+    def _read(self):
+        self._debug['header']['start'] = self._io.pos()
+        self._raw_header = self._io.read_bytes(self.len_header)
+        io = KaitaiStream(BytesIO(self._raw_header))
+        self.header = self._root.Header(io, self, self._root)
+        self.header._read()
+        self._debug['header']['end'] = self._io.pos()
+        self._debug['objects']['start'] = self._io.pos()
+        self.objects = [None] * (self.header.num_objects)
+        for i in range(self.header.num_objects):
+            if not 'arr' in self._debug['objects']:
+                self._debug['objects']['arr'] = []
+            self._debug['objects']['arr'].append({'start': self._io.pos()})
+            _t_objects = self._root.JournalObject(self._io, self, self._root)
+            _t_objects._read()
+            self.objects[i] = _t_objects
+            self._debug['objects']['arr'][i]['end'] = self._io.pos()
+
+        self._debug['objects']['end'] = self._io.pos()
+
+    class Header(KaitaiStruct):
+        SEQ_FIELDS = ["signature", "compatible_flags", "incompatible_flags", "state", "reserved", "file_id", "machine_id", "boot_id", "seqnum_id", "len_header", "len_arena", "ofs_data_hash_table", "len_data_hash_table", "ofs_field_hash_table", "len_field_hash_table", "ofs_tail_object", "num_objects", "num_entries", "tail_entry_seqnum", "head_entry_seqnum", "ofs_entry_array", "head_entry_realtime", "tail_entry_realtime", "tail_entry_monotonic", "num_data", "num_fields", "num_tags", "num_entry_arrays"]
+        def __init__(self, _io, _parent=None, _root=None):
+            self._io = _io
+            self._parent = _parent
+            self._root = _root if _root else self
+            self._debug = collections.defaultdict(dict)
+
+        def _read(self):
+            self._debug['signature']['start'] = self._io.pos()
+            self.signature = self._io.ensure_fixed_contents(b"\x4C\x50\x4B\x53\x48\x48\x52\x48")
+            self._debug['signature']['end'] = self._io.pos()
+            self._debug['compatible_flags']['start'] = self._io.pos()
+            self.compatible_flags = self._io.read_u4le()
+            self._debug['compatible_flags']['end'] = self._io.pos()
+            self._debug['incompatible_flags']['start'] = self._io.pos()
+            self.incompatible_flags = self._io.read_u4le()
+            self._debug['incompatible_flags']['end'] = self._io.pos()
+            self._debug['state']['start'] = self._io.pos()
+            self.state = KaitaiStream.resolve_enum(self._root.State, self._io.read_u1())
+            self._debug['state']['end'] = self._io.pos()
+            self._debug['reserved']['start'] = self._io.pos()
+            self.reserved = self._io.read_bytes(7)
+            self._debug['reserved']['end'] = self._io.pos()
+            self._debug['file_id']['start'] = self._io.pos()
+            self.file_id = self._io.read_bytes(16)
+            self._debug['file_id']['end'] = self._io.pos()
+            self._debug['machine_id']['start'] = self._io.pos()
+            self.machine_id = self._io.read_bytes(16)
+            self._debug['machine_id']['end'] = self._io.pos()
+            self._debug['boot_id']['start'] = self._io.pos()
+            self.boot_id = self._io.read_bytes(16)
+            self._debug['boot_id']['end'] = self._io.pos()
+            self._debug['seqnum_id']['start'] = self._io.pos()
+            self.seqnum_id = self._io.read_bytes(16)
+            self._debug['seqnum_id']['end'] = self._io.pos()
+            self._debug['len_header']['start'] = self._io.pos()
+            self.len_header = self._io.read_u8le()
+            self._debug['len_header']['end'] = self._io.pos()
+            self._debug['len_arena']['start'] = self._io.pos()
+            self.len_arena = self._io.read_u8le()
+            self._debug['len_arena']['end'] = self._io.pos()
+            self._debug['ofs_data_hash_table']['start'] = self._io.pos()
+            self.ofs_data_hash_table = self._io.read_u8le()
+            self._debug['ofs_data_hash_table']['end'] = self._io.pos()
+            self._debug['len_data_hash_table']['start'] = self._io.pos()
+            self.len_data_hash_table = self._io.read_u8le()
+            self._debug['len_data_hash_table']['end'] = self._io.pos()
+            self._debug['ofs_field_hash_table']['start'] = self._io.pos()
+            self.ofs_field_hash_table = self._io.read_u8le()
+            self._debug['ofs_field_hash_table']['end'] = self._io.pos()
+            self._debug['len_field_hash_table']['start'] = self._io.pos()
+            self.len_field_hash_table = self._io.read_u8le()
+            self._debug['len_field_hash_table']['end'] = self._io.pos()
+            self._debug['ofs_tail_object']['start'] = self._io.pos()
+            self.ofs_tail_object = self._io.read_u8le()
+            self._debug['ofs_tail_object']['end'] = self._io.pos()
+            self._debug['num_objects']['start'] = self._io.pos()
+            self.num_objects = self._io.read_u8le()
+            self._debug['num_objects']['end'] = self._io.pos()
+            self._debug['num_entries']['start'] = self._io.pos()
+            self.num_entries = self._io.read_u8le()
+            self._debug['num_entries']['end'] = self._io.pos()
+            self._debug['tail_entry_seqnum']['start'] = self._io.pos()
+            self.tail_entry_seqnum = self._io.read_u8le()
+            self._debug['tail_entry_seqnum']['end'] = self._io.pos()
+            self._debug['head_entry_seqnum']['start'] = self._io.pos()
+            self.head_entry_seqnum = self._io.read_u8le()
+            self._debug['head_entry_seqnum']['end'] = self._io.pos()
+            self._debug['ofs_entry_array']['start'] = self._io.pos()
+            self.ofs_entry_array = self._io.read_u8le()
+            self._debug['ofs_entry_array']['end'] = self._io.pos()
+            self._debug['head_entry_realtime']['start'] = self._io.pos()
+            self.head_entry_realtime = self._io.read_u8le()
+            self._debug['head_entry_realtime']['end'] = self._io.pos()
+            self._debug['tail_entry_realtime']['start'] = self._io.pos()
+            self.tail_entry_realtime = self._io.read_u8le()
+            self._debug['tail_entry_realtime']['end'] = self._io.pos()
+            self._debug['tail_entry_monotonic']['start'] = self._io.pos()
+            self.tail_entry_monotonic = self._io.read_u8le()
+            self._debug['tail_entry_monotonic']['end'] = self._io.pos()
+            if not (self._io.is_eof()):
+                self._debug['num_data']['start'] = self._io.pos()
+                self.num_data = self._io.read_u8le()
+                self._debug['num_data']['end'] = self._io.pos()
+
+            if not (self._io.is_eof()):
+                self._debug['num_fields']['start'] = self._io.pos()
+                self.num_fields = self._io.read_u8le()
+                self._debug['num_fields']['end'] = self._io.pos()
+
+            if not (self._io.is_eof()):
+                self._debug['num_tags']['start'] = self._io.pos()
+                self.num_tags = self._io.read_u8le()
+                self._debug['num_tags']['end'] = self._io.pos()
+
+            if not (self._io.is_eof()):
+                self._debug['num_entry_arrays']['start'] = self._io.pos()
+                self.num_entry_arrays = self._io.read_u8le()
+                self._debug['num_entry_arrays']['end'] = self._io.pos()
+
+
+
+    class JournalObject(KaitaiStruct):
+        """
+        .. seealso::
+           Source - https://www.freedesktop.org/wiki/Software/systemd/journal-files/#objects
+        """
+
+        class ObjectTypes(Enum):
+            unused = 0
+            data = 1
+            field = 2
+            entry = 3
+            data_hash_table = 4
+            field_hash_table = 5
+            entry_array = 6
+            tag = 7
+        SEQ_FIELDS = ["padding", "object_type", "flags", "reserved", "len_object", "payload"]
+        def __init__(self, _io, _parent=None, _root=None):
+            self._io = _io
+            self._parent = _parent
+            self._root = _root if _root else self
+            self._debug = collections.defaultdict(dict)
+
+        def _read(self):
+            self._debug['padding']['start'] = self._io.pos()
+            self.padding = self._io.read_bytes(((8 - self._io.pos()) % 8))
+            self._debug['padding']['end'] = self._io.pos()
+            self._debug['object_type']['start'] = self._io.pos()
+            self.object_type = KaitaiStream.resolve_enum(self._root.JournalObject.ObjectTypes, self._io.read_u1())
+            self._debug['object_type']['end'] = self._io.pos()
+            self._debug['flags']['start'] = self._io.pos()
+            self.flags = self._io.read_u1()
+            self._debug['flags']['end'] = self._io.pos()
+            self._debug['reserved']['start'] = self._io.pos()
+            self.reserved = self._io.read_bytes(6)
+            self._debug['reserved']['end'] = self._io.pos()
+            self._debug['len_object']['start'] = self._io.pos()
+            self.len_object = self._io.read_u8le()
+            self._debug['len_object']['end'] = self._io.pos()
+            self._debug['payload']['start'] = self._io.pos()
+            _on = self.object_type
+            if _on == self._root.JournalObject.ObjectTypes.data:
+                self._raw_payload = self._io.read_bytes((self.len_object - 16))
+                io = KaitaiStream(BytesIO(self._raw_payload))
+                self.payload = self._root.DataObject(io, self, self._root)
+                self.payload._read()
+            else:
+                self.payload = self._io.read_bytes((self.len_object - 16))
+            self._debug['payload']['end'] = self._io.pos()
+
+
+    class DataObject(KaitaiStruct):
+        """Data objects are designed to carry log payload, typically in
+        form of a "key=value" string in `payload` attribute.
+        
+        .. seealso::
+           Source - https://www.freedesktop.org/wiki/Software/systemd/journal-files/#dataobjects
+        """
+        SEQ_FIELDS = ["hash", "ofs_next_hash", "ofs_head_field", "ofs_entry", "ofs_entry_array", "num_entries", "payload"]
+        def __init__(self, _io, _parent=None, _root=None):
+            self._io = _io
+            self._parent = _parent
+            self._root = _root if _root else self
+            self._debug = collections.defaultdict(dict)
+
+        def _read(self):
+            self._debug['hash']['start'] = self._io.pos()
+            self.hash = self._io.read_u8le()
+            self._debug['hash']['end'] = self._io.pos()
+            self._debug['ofs_next_hash']['start'] = self._io.pos()
+            self.ofs_next_hash = self._io.read_u8le()
+            self._debug['ofs_next_hash']['end'] = self._io.pos()
+            self._debug['ofs_head_field']['start'] = self._io.pos()
+            self.ofs_head_field = self._io.read_u8le()
+            self._debug['ofs_head_field']['end'] = self._io.pos()
+            self._debug['ofs_entry']['start'] = self._io.pos()
+            self.ofs_entry = self._io.read_u8le()
+            self._debug['ofs_entry']['end'] = self._io.pos()
+            self._debug['ofs_entry_array']['start'] = self._io.pos()
+            self.ofs_entry_array = self._io.read_u8le()
+            self._debug['ofs_entry_array']['end'] = self._io.pos()
+            self._debug['num_entries']['start'] = self._io.pos()
+            self.num_entries = self._io.read_u8le()
+            self._debug['num_entries']['end'] = self._io.pos()
+            self._debug['payload']['start'] = self._io.pos()
+            self.payload = self._io.read_bytes_full()
+            self._debug['payload']['end'] = self._io.pos()
+
+        @property
+        def next_hash(self):
+            if hasattr(self, '_m_next_hash'):
+                return self._m_next_hash if hasattr(self, '_m_next_hash') else None
+
+            if self.ofs_next_hash != 0:
+                io = self._root._io
+                _pos = io.pos()
+                io.seek(self.ofs_next_hash)
+                self._debug['_m_next_hash']['start'] = io.pos()
+                self._m_next_hash = self._root.JournalObject(io, self, self._root)
+                self._m_next_hash._read()
+                self._debug['_m_next_hash']['end'] = io.pos()
+                io.seek(_pos)
+
+            return self._m_next_hash if hasattr(self, '_m_next_hash') else None
+
+        @property
+        def head_field(self):
+            if hasattr(self, '_m_head_field'):
+                return self._m_head_field if hasattr(self, '_m_head_field') else None
+
+            if self.ofs_head_field != 0:
+                io = self._root._io
+                _pos = io.pos()
+                io.seek(self.ofs_head_field)
+                self._debug['_m_head_field']['start'] = io.pos()
+                self._m_head_field = self._root.JournalObject(io, self, self._root)
+                self._m_head_field._read()
+                self._debug['_m_head_field']['end'] = io.pos()
+                io.seek(_pos)
+
+            return self._m_head_field if hasattr(self, '_m_head_field') else None
+
+        @property
+        def entry(self):
+            if hasattr(self, '_m_entry'):
+                return self._m_entry if hasattr(self, '_m_entry') else None
+
+            if self.ofs_entry != 0:
+                io = self._root._io
+                _pos = io.pos()
+                io.seek(self.ofs_entry)
+                self._debug['_m_entry']['start'] = io.pos()
+                self._m_entry = self._root.JournalObject(io, self, self._root)
+                self._m_entry._read()
+                self._debug['_m_entry']['end'] = io.pos()
+                io.seek(_pos)
+
+            return self._m_entry if hasattr(self, '_m_entry') else None
+
+        @property
+        def entry_array(self):
+            if hasattr(self, '_m_entry_array'):
+                return self._m_entry_array if hasattr(self, '_m_entry_array') else None
+
+            if self.ofs_entry_array != 0:
+                io = self._root._io
+                _pos = io.pos()
+                io.seek(self.ofs_entry_array)
+                self._debug['_m_entry_array']['start'] = io.pos()
+                self._m_entry_array = self._root.JournalObject(io, self, self._root)
+                self._m_entry_array._read()
+                self._debug['_m_entry_array']['end'] = io.pos()
+                io.seek(_pos)
+
+            return self._m_entry_array if hasattr(self, '_m_entry_array') else None
+
+
+    @property
+    def len_header(self):
+        """Header length is used to set substream size, as it thus required
+        prior to declaration of header.
+        """
+        if hasattr(self, '_m_len_header'):
+            return self._m_len_header if hasattr(self, '_m_len_header') else None
+
+        _pos = self._io.pos()
+        self._io.seek(88)
+        self._debug['_m_len_header']['start'] = self._io.pos()
+        self._m_len_header = self._io.read_u8le()
+        self._debug['_m_len_header']['end'] = self._io.pos()
+        self._io.seek(_pos)
+        return self._m_len_header if hasattr(self, '_m_len_header') else None
+
+    @property
+    def data_hash_table(self):
+        if hasattr(self, '_m_data_hash_table'):
+            return self._m_data_hash_table if hasattr(self, '_m_data_hash_table') else None
+
+        _pos = self._io.pos()
+        self._io.seek(self.header.ofs_data_hash_table)
+        self._debug['_m_data_hash_table']['start'] = self._io.pos()
+        self._m_data_hash_table = self._io.read_bytes(self.header.len_data_hash_table)
+        self._debug['_m_data_hash_table']['end'] = self._io.pos()
+        self._io.seek(_pos)
+        return self._m_data_hash_table if hasattr(self, '_m_data_hash_table') else None
+
+    @property
+    def field_hash_table(self):
+        if hasattr(self, '_m_field_hash_table'):
+            return self._m_field_hash_table if hasattr(self, '_m_field_hash_table') else None
+
+        _pos = self._io.pos()
+        self._io.seek(self.header.ofs_field_hash_table)
+        self._debug['_m_field_hash_table']['start'] = self._io.pos()
+        self._m_field_hash_table = self._io.read_bytes(self.header.len_field_hash_table)
+        self._debug['_m_field_hash_table']['end'] = self._io.pos()
+        self._io.seek(_pos)
+        return self._m_field_hash_table if hasattr(self, '_m_field_hash_table') else None
+
+
diff --git a/python/examples/kaitai/kaitai_struct_formats/log/windows_evt_log.py b/python/examples/kaitai/kaitai_struct_formats/log/windows_evt_log.py
new file mode 100644
index 00000000..5e12d111
--- /dev/null
+++ b/python/examples/kaitai/kaitai_struct_formats/log/windows_evt_log.py
@@ -0,0 +1,300 @@
+from __future__ import absolute_import
+# This is a generated file! Please edit source .ksy file and use kaitai-struct-compiler to rebuild
+
+from pkg_resources import parse_version
+from ...kaitaistruct import __version__ as ks_version, KaitaiStruct, KaitaiStream, BytesIO
+import collections
+from enum import Enum
+
+
+if parse_version(ks_version) < parse_version('0.7'):
+    raise Exception("Incompatible Kaitai Struct Python API: 0.7 or later is required, but you have %s" % (ks_version))
+
+class WindowsEvtLog(KaitaiStruct):
+    """EVT files are Windows Event Log files written by older Windows
+    operating systems (2000, XP, 2003). They are used as binary log
+    files by several major Windows subsystems and
+    applications. Typically, several of them can be found in
+    `%WINDIR%\system32\config` directory:
+    
+    * Application = `AppEvent.evt`
+    * System = `SysEvent.evt`
+    * Security = `SecEvent.evt`
+    
+    Alternatively, one can export any system event log as distinct .evt
+    file using relevant option in Event Viewer application.
+    
+    A Windows application can submit an entry into these logs using
+    [ReportEvent](https://msdn.microsoft.com/en-us/library/aa363679(v=vs.85).aspx)
+    function of Windows API.
+    
+    Internally, EVT files consist of a fixed-size header and event
+    records. There are several usage scenarios (non-wrapping vs wrapping
+    log files) which result in slightly different organization of
+    records.
+    
+    .. seealso::
+       Source - https://msdn.microsoft.com/en-us/library/bb309026(v=vs.85).aspx
+    """
+    SEQ_FIELDS = ["header", "records"]
+    def __init__(self, _io, _parent=None, _root=None):
+        self._io = _io
+        self._parent = _parent
+        self._root = _root if _root else self
+        self._debug = collections.defaultdict(dict)
+
+    def _read(self):
+        self._debug['header']['start'] = self._io.pos()
+        self.header = self._root.Header(self._io, self, self._root)
+        self.header._read()
+        self._debug['header']['end'] = self._io.pos()
+        self._debug['records']['start'] = self._io.pos()
+        self.records = []
+        i = 0
+        while not self._io.is_eof():
+            if not 'arr' in self._debug['records']:
+                self._debug['records']['arr'] = []
+            self._debug['records']['arr'].append({'start': self._io.pos()})
+            _t_records = self._root.Record(self._io, self, self._root)
+            _t_records._read()
+            self.records.append(_t_records)
+            self._debug['records']['arr'][len(self.records) - 1]['end'] = self._io.pos()
+            i += 1
+
+        self._debug['records']['end'] = self._io.pos()
+
+    class Header(KaitaiStruct):
+        """
+        .. seealso::
+           Source - https://msdn.microsoft.com/en-us/library/bb309024(v=vs.85).aspx
+        """
+        SEQ_FIELDS = ["len_header", "magic", "version_major", "version_minor", "ofs_start", "ofs_end", "cur_rec_idx", "oldest_rec_idx", "len_file_max", "flags", "retention", "len_header_2"]
+        def __init__(self, _io, _parent=None, _root=None):
+            self._io = _io
+            self._parent = _parent
+            self._root = _root if _root else self
+            self._debug = collections.defaultdict(dict)
+
+        def _read(self):
+            self._debug['len_header']['start'] = self._io.pos()
+            self.len_header = self._io.read_u4le()
+            self._debug['len_header']['end'] = self._io.pos()
+            self._debug['magic']['start'] = self._io.pos()
+            self.magic = self._io.ensure_fixed_contents(b"\x4C\x66\x4C\x65")
+            self._debug['magic']['end'] = self._io.pos()
+            self._debug['version_major']['start'] = self._io.pos()
+            self.version_major = self._io.read_u4le()
+            self._debug['version_major']['end'] = self._io.pos()
+            self._debug['version_minor']['start'] = self._io.pos()
+            self.version_minor = self._io.read_u4le()
+            self._debug['version_minor']['end'] = self._io.pos()
+            self._debug['ofs_start']['start'] = self._io.pos()
+            self.ofs_start = self._io.read_u4le()
+            self._debug['ofs_start']['end'] = self._io.pos()
+            self._debug['ofs_end']['start'] = self._io.pos()
+            self.ofs_end = self._io.read_u4le()
+            self._debug['ofs_end']['end'] = self._io.pos()
+            self._debug['cur_rec_idx']['start'] = self._io.pos()
+            self.cur_rec_idx = self._io.read_u4le()
+            self._debug['cur_rec_idx']['end'] = self._io.pos()
+            self._debug['oldest_rec_idx']['start'] = self._io.pos()
+            self.oldest_rec_idx = self._io.read_u4le()
+            self._debug['oldest_rec_idx']['end'] = self._io.pos()
+            self._debug['len_file_max']['start'] = self._io.pos()
+            self.len_file_max = self._io.read_u4le()
+            self._debug['len_file_max']['end'] = self._io.pos()
+            self._debug['flags']['start'] = self._io.pos()
+            self.flags = self._root.Header.Flags(self._io, self, self._root)
+            self.flags._read()
+            self._debug['flags']['end'] = self._io.pos()
+            self._debug['retention']['start'] = self._io.pos()
+            self.retention = self._io.read_u4le()
+            self._debug['retention']['end'] = self._io.pos()
+            self._debug['len_header_2']['start'] = self._io.pos()
+            self.len_header_2 = self._io.read_u4le()
+            self._debug['len_header_2']['end'] = self._io.pos()
+
+        class Flags(KaitaiStruct):
+            SEQ_FIELDS = ["reserved", "archive", "log_full", "wrap", "dirty"]
+            def __init__(self, _io, _parent=None, _root=None):
+                self._io = _io
+                self._parent = _parent
+                self._root = _root if _root else self
+                self._debug = collections.defaultdict(dict)
+
+            def _read(self):
+                self._debug['reserved']['start'] = self._io.pos()
+                self.reserved = self._io.read_bits_int(28)
+                self._debug['reserved']['end'] = self._io.pos()
+                self._debug['archive']['start'] = self._io.pos()
+                self.archive = self._io.read_bits_int(1) != 0
+                self._debug['archive']['end'] = self._io.pos()
+                self._debug['log_full']['start'] = self._io.pos()
+                self.log_full = self._io.read_bits_int(1) != 0
+                self._debug['log_full']['end'] = self._io.pos()
+                self._debug['wrap']['start'] = self._io.pos()
+                self.wrap = self._io.read_bits_int(1) != 0
+                self._debug['wrap']['end'] = self._io.pos()
+                self._debug['dirty']['start'] = self._io.pos()
+                self.dirty = self._io.read_bits_int(1) != 0
+                self._debug['dirty']['end'] = self._io.pos()
+
+
+
+    class Record(KaitaiStruct):
+        """
+        .. seealso::
+           Source - https://msdn.microsoft.com/en-us/library/windows/desktop/aa363646(v=vs.85).aspx
+        """
+        SEQ_FIELDS = ["len_record", "type", "body", "len_record2"]
+        def __init__(self, _io, _parent=None, _root=None):
+            self._io = _io
+            self._parent = _parent
+            self._root = _root if _root else self
+            self._debug = collections.defaultdict(dict)
+
+        def _read(self):
+            self._debug['len_record']['start'] = self._io.pos()
+            self.len_record = self._io.read_u4le()
+            self._debug['len_record']['end'] = self._io.pos()
+            self._debug['type']['start'] = self._io.pos()
+            self.type = self._io.read_u4le()
+            self._debug['type']['end'] = self._io.pos()
+            self._debug['body']['start'] = self._io.pos()
+            _on = self.type
+            if _on == 1699505740:
+                self._raw_body = self._io.read_bytes((self.len_record - 12))
+                io = KaitaiStream(BytesIO(self._raw_body))
+                self.body = self._root.RecordBody(io, self, self._root)
+                self.body._read()
+            elif _on == 286331153:
+                self._raw_body = self._io.read_bytes((self.len_record - 12))
+                io = KaitaiStream(BytesIO(self._raw_body))
+                self.body = self._root.CursorRecordBody(io, self, self._root)
+                self.body._read()
+            else:
+                self.body = self._io.read_bytes((self.len_record - 12))
+            self._debug['body']['end'] = self._io.pos()
+            self._debug['len_record2']['start'] = self._io.pos()
+            self.len_record2 = self._io.read_u4le()
+            self._debug['len_record2']['end'] = self._io.pos()
+
+
+    class RecordBody(KaitaiStruct):
+        """
+        .. seealso::
+           Source - https://msdn.microsoft.com/en-us/library/windows/desktop/aa363646(v=vs.85).aspx
+        """
+
+        class EventTypes(Enum):
+            error = 1
+            audit_failure = 2
+            audit_success = 3
+            info = 4
+            warning = 5
+        SEQ_FIELDS = ["idx", "time_generated", "time_written", "event_id", "event_type", "num_strings", "event_category", "reserved", "ofs_strings", "len_user_sid", "ofs_user_sid", "len_data", "ofs_data"]
+        def __init__(self, _io, _parent=None, _root=None):
+            self._io = _io
+            self._parent = _parent
+            self._root = _root if _root else self
+            self._debug = collections.defaultdict(dict)
+
+        def _read(self):
+            self._debug['idx']['start'] = self._io.pos()
+            self.idx = self._io.read_u4le()
+            self._debug['idx']['end'] = self._io.pos()
+            self._debug['time_generated']['start'] = self._io.pos()
+            self.time_generated = self._io.read_u4le()
+            self._debug['time_generated']['end'] = self._io.pos()
+            self._debug['time_written']['start'] = self._io.pos()
+            self.time_written = self._io.read_u4le()
+            self._debug['time_written']['end'] = self._io.pos()
+            self._debug['event_id']['start'] = self._io.pos()
+            self.event_id = self._io.read_u4le()
+            self._debug['event_id']['end'] = self._io.pos()
+            self._debug['event_type']['start'] = self._io.pos()
+            self.event_type = KaitaiStream.resolve_enum(self._root.RecordBody.EventTypes, self._io.read_u2le())
+            self._debug['event_type']['end'] = self._io.pos()
+            self._debug['num_strings']['start'] = self._io.pos()
+            self.num_strings = self._io.read_u2le()
+            self._debug['num_strings']['end'] = self._io.pos()
+            self._debug['event_category']['start'] = self._io.pos()
+            self.event_category = self._io.read_u2le()
+            self._debug['event_category']['end'] = self._io.pos()
+            self._debug['reserved']['start'] = self._io.pos()
+            self.reserved = self._io.read_bytes(6)
+            self._debug['reserved']['end'] = self._io.pos()
+            self._debug['ofs_strings']['start'] = self._io.pos()
+            self.ofs_strings = self._io.read_u4le()
+            self._debug['ofs_strings']['end'] = self._io.pos()
+            self._debug['len_user_sid']['start'] = self._io.pos()
+            self.len_user_sid = self._io.read_u4le()
+            self._debug['len_user_sid']['end'] = self._io.pos()
+            self._debug['ofs_user_sid']['start'] = self._io.pos()
+            self.ofs_user_sid = self._io.read_u4le()
+            self._debug['ofs_user_sid']['end'] = self._io.pos()
+            self._debug['len_data']['start'] = self._io.pos()
+            self.len_data = self._io.read_u4le()
+            self._debug['len_data']['end'] = self._io.pos()
+            self._debug['ofs_data']['start'] = self._io.pos()
+            self.ofs_data = self._io.read_u4le()
+            self._debug['ofs_data']['end'] = self._io.pos()
+
+        @property
+        def user_sid(self):
+            if hasattr(self, '_m_user_sid'):
+                return self._m_user_sid if hasattr(self, '_m_user_sid') else None
+
+            _pos = self._io.pos()
+            self._io.seek((self.ofs_user_sid - 8))
+            self._debug['_m_user_sid']['start'] = self._io.pos()
+            self._m_user_sid = self._io.read_bytes(self.len_user_sid)
+            self._debug['_m_user_sid']['end'] = self._io.pos()
+            self._io.seek(_pos)
+            return self._m_user_sid if hasattr(self, '_m_user_sid') else None
+
+        @property
+        def data(self):
+            if hasattr(self, '_m_data'):
+                return self._m_data if hasattr(self, '_m_data') else None
+
+            _pos = self._io.pos()
+            self._io.seek((self.ofs_data - 8))
+            self._debug['_m_data']['start'] = self._io.pos()
+            self._m_data = self._io.read_bytes(self.len_data)
+            self._debug['_m_data']['end'] = self._io.pos()
+            self._io.seek(_pos)
+            return self._m_data if hasattr(self, '_m_data') else None
+
+
+    class CursorRecordBody(KaitaiStruct):
+        """
+        .. seealso::
+           Source - http://www.forensicswiki.org/wiki/Windows_Event_Log_(EVT)#Cursor_Record
+        """
+        SEQ_FIELDS = ["magic", "ofs_first_record", "ofs_next_record", "idx_next_record", "idx_first_record"]
+        def __init__(self, _io, _parent=None, _root=None):
+            self._io = _io
+            self._parent = _parent
+            self._root = _root if _root else self
+            self._debug = collections.defaultdict(dict)
+
+        def _read(self):
+            self._debug['magic']['start'] = self._io.pos()
+            self.magic = self._io.ensure_fixed_contents(b"\x22\x22\x22\x22\x33\x33\x33\x33\x44\x44\x44\x44")
+            self._debug['magic']['end'] = self._io.pos()
+            self._debug['ofs_first_record']['start'] = self._io.pos()
+            self.ofs_first_record = self._io.read_u4le()
+            self._debug['ofs_first_record']['end'] = self._io.pos()
+            self._debug['ofs_next_record']['start'] = self._io.pos()
+            self.ofs_next_record = self._io.read_u4le()
+            self._debug['ofs_next_record']['end'] = self._io.pos()
+            self._debug['idx_next_record']['start'] = self._io.pos()
+            self.idx_next_record = self._io.read_u4le()
+            self._debug['idx_next_record']['end'] = self._io.pos()
+            self._debug['idx_first_record']['start'] = self._io.pos()
+            self.idx_first_record = self._io.read_u4le()
+            self._debug['idx_first_record']['end'] = self._io.pos()
+
+
+