diff options
| author | Andrew Lamoureux <andrew@vector35.com> | 2019-03-18 17:34:09 -0400 |
|---|---|---|
| committer | Rusty Wagner <rusty@vector35.com> | 2019-03-20 13:00:17 -0400 |
| commit | 815f5485eb50eff3b483a6bcc0c3d3d11569f8ca (patch) | |
| tree | 5128136ac86971ed8729e8c19cb00bcf8f220acc /python/examples/kaitai/kaitai_struct_formats/windows | |
| parent | 8e9322ed8b5826dd62bc931d83e0828d42f7969f (diff) | |
kaitai: all formats compiled and included
Diffstat (limited to 'python/examples/kaitai/kaitai_struct_formats/windows')
7 files changed, 2052 insertions, 0 deletions
diff --git a/python/examples/kaitai/kaitai_struct_formats/windows/__init__.py b/python/examples/kaitai/kaitai_struct_formats/windows/__init__.py new file mode 100644 index 00000000..e69de29b --- /dev/null +++ b/python/examples/kaitai/kaitai_struct_formats/windows/__init__.py diff --git a/python/examples/kaitai/kaitai_struct_formats/windows/regf.py b/python/examples/kaitai/kaitai_struct_formats/windows/regf.py new file mode 100644 index 00000000..13145ad1 --- /dev/null +++ b/python/examples/kaitai/kaitai_struct_formats/windows/regf.py @@ -0,0 +1,565 @@ +from __future__ import absolute_import +# This is a generated file! Please edit source .ksy file and use kaitai-struct-compiler to rebuild + +from pkg_resources import parse_version +from ...kaitaistruct import __version__ as ks_version, KaitaiStruct, KaitaiStream, BytesIO +import collections +from enum import Enum + + +if parse_version(ks_version) < parse_version('0.7'): + raise Exception("Incompatible Kaitai Struct Python API: 0.7 or later is required, but you have %s" % (ks_version)) + +class Regf(KaitaiStruct): + """This spec allows to parse files used by Microsoft Windows family of + operating systems to store parts of its "registry". "Registry" is a + hierarchical database that is used to store system settings (global + configuration, per-user, per-application configuration, etc). + + Typically, registry files are stored in: + + * System-wide: several files in `%SystemRoot%\System32\Config\` + * User-wide: + * `%USERPROFILE%\Ntuser.dat` + * `%USERPROFILE%\Local Settings\Application Data\Microsoft\Windows\Usrclass.dat` (localized, Windows 2000, Server 2003 and Windows XP) + * `%USERPROFILE%\AppData\Local\Microsoft\Windows\Usrclass.dat` (non-localized, Windows Vista and later) + + Note that one typically can't access files directly on a mounted + filesystem with a running Windows OS. + + .. seealso:: + Source - https://github.com/libyal/libregf/blob/master/documentation/Windows%20NT%20Registry%20File%20(REGF)%20format.asciidoc + """ + SEQ_FIELDS = ["header", "hive_bins"] + def __init__(self, _io, _parent=None, _root=None): + self._io = _io + self._parent = _parent + self._root = _root if _root else self + self._debug = collections.defaultdict(dict) + + def _read(self): + self._debug['header']['start'] = self._io.pos() + self.header = self._root.FileHeader(self._io, self, self._root) + self.header._read() + self._debug['header']['end'] = self._io.pos() + self._debug['hive_bins']['start'] = self._io.pos() + self._raw_hive_bins = [] + self.hive_bins = [] + i = 0 + while not self._io.is_eof(): + if not 'arr' in self._debug['hive_bins']: + self._debug['hive_bins']['arr'] = [] + self._debug['hive_bins']['arr'].append({'start': self._io.pos()}) + self._raw_hive_bins.append(self._io.read_bytes(4096)) + io = KaitaiStream(BytesIO(self._raw_hive_bins[-1])) + _t_hive_bins = self._root.HiveBin(io, self, self._root) + _t_hive_bins._read() + self.hive_bins.append(_t_hive_bins) + self._debug['hive_bins']['arr'][len(self.hive_bins) - 1]['end'] = self._io.pos() + i += 1 + + self._debug['hive_bins']['end'] = self._io.pos() + + class Filetime(KaitaiStruct): + SEQ_FIELDS = ["value"] + def __init__(self, _io, _parent=None, _root=None): + self._io = _io + self._parent = _parent + self._root = _root if _root else self + self._debug = collections.defaultdict(dict) + + def _read(self): + self._debug['value']['start'] = self._io.pos() + self.value = self._io.read_u8le() + self._debug['value']['end'] = self._io.pos() + + + class HiveBin(KaitaiStruct): + SEQ_FIELDS = ["header", "cells"] + def __init__(self, _io, _parent=None, _root=None): + self._io = _io + self._parent = _parent + self._root = _root if _root else self + self._debug = collections.defaultdict(dict) + + def _read(self): + self._debug['header']['start'] = self._io.pos() + self.header = self._root.HiveBinHeader(self._io, self, self._root) + self.header._read() + self._debug['header']['end'] = self._io.pos() + self._debug['cells']['start'] = self._io.pos() + self.cells = [] + i = 0 + while not self._io.is_eof(): + if not 'arr' in self._debug['cells']: + self._debug['cells']['arr'] = [] + self._debug['cells']['arr'].append({'start': self._io.pos()}) + _t_cells = self._root.HiveBinCell(self._io, self, self._root) + _t_cells._read() + self.cells.append(_t_cells) + self._debug['cells']['arr'][len(self.cells) - 1]['end'] = self._io.pos() + i += 1 + + self._debug['cells']['end'] = self._io.pos() + + + class HiveBinHeader(KaitaiStruct): + SEQ_FIELDS = ["signature", "offset", "size", "unknown1", "unknown2", "timestamp", "unknown4"] + def __init__(self, _io, _parent=None, _root=None): + self._io = _io + self._parent = _parent + self._root = _root if _root else self + self._debug = collections.defaultdict(dict) + + def _read(self): + self._debug['signature']['start'] = self._io.pos() + self.signature = self._io.ensure_fixed_contents(b"\x68\x62\x69\x6E") + self._debug['signature']['end'] = self._io.pos() + self._debug['offset']['start'] = self._io.pos() + self.offset = self._io.read_u4le() + self._debug['offset']['end'] = self._io.pos() + self._debug['size']['start'] = self._io.pos() + self.size = self._io.read_u4le() + self._debug['size']['end'] = self._io.pos() + self._debug['unknown1']['start'] = self._io.pos() + self.unknown1 = self._io.read_u4le() + self._debug['unknown1']['end'] = self._io.pos() + self._debug['unknown2']['start'] = self._io.pos() + self.unknown2 = self._io.read_u4le() + self._debug['unknown2']['end'] = self._io.pos() + self._debug['timestamp']['start'] = self._io.pos() + self.timestamp = self._root.Filetime(self._io, self, self._root) + self.timestamp._read() + self._debug['timestamp']['end'] = self._io.pos() + self._debug['unknown4']['start'] = self._io.pos() + self.unknown4 = self._io.read_u4le() + self._debug['unknown4']['end'] = self._io.pos() + + + class HiveBinCell(KaitaiStruct): + SEQ_FIELDS = ["cell_size_raw", "identifier", "data"] + def __init__(self, _io, _parent=None, _root=None): + self._io = _io + self._parent = _parent + self._root = _root if _root else self + self._debug = collections.defaultdict(dict) + + def _read(self): + self._debug['cell_size_raw']['start'] = self._io.pos() + self.cell_size_raw = self._io.read_s4le() + self._debug['cell_size_raw']['end'] = self._io.pos() + self._debug['identifier']['start'] = self._io.pos() + self.identifier = (self._io.read_bytes(2)).decode(u"ascii") + self._debug['identifier']['end'] = self._io.pos() + self._debug['data']['start'] = self._io.pos() + _on = self.identifier + if _on == u"li": + self._raw_data = self._io.read_bytes(((self.cell_size - 2) - 4)) + io = KaitaiStream(BytesIO(self._raw_data)) + self.data = self._root.HiveBinCell.SubKeyListLi(io, self, self._root) + self.data._read() + elif _on == u"vk": + self._raw_data = self._io.read_bytes(((self.cell_size - 2) - 4)) + io = KaitaiStream(BytesIO(self._raw_data)) + self.data = self._root.HiveBinCell.SubKeyListVk(io, self, self._root) + self.data._read() + elif _on == u"lf": + self._raw_data = self._io.read_bytes(((self.cell_size - 2) - 4)) + io = KaitaiStream(BytesIO(self._raw_data)) + self.data = self._root.HiveBinCell.SubKeyListLhLf(io, self, self._root) + self.data._read() + elif _on == u"ri": + self._raw_data = self._io.read_bytes(((self.cell_size - 2) - 4)) + io = KaitaiStream(BytesIO(self._raw_data)) + self.data = self._root.HiveBinCell.SubKeyListRi(io, self, self._root) + self.data._read() + elif _on == u"lh": + self._raw_data = self._io.read_bytes(((self.cell_size - 2) - 4)) + io = KaitaiStream(BytesIO(self._raw_data)) + self.data = self._root.HiveBinCell.SubKeyListLhLf(io, self, self._root) + self.data._read() + elif _on == u"nk": + self._raw_data = self._io.read_bytes(((self.cell_size - 2) - 4)) + io = KaitaiStream(BytesIO(self._raw_data)) + self.data = self._root.HiveBinCell.NamedKey(io, self, self._root) + self.data._read() + elif _on == u"sk": + self._raw_data = self._io.read_bytes(((self.cell_size - 2) - 4)) + io = KaitaiStream(BytesIO(self._raw_data)) + self.data = self._root.HiveBinCell.SubKeyListSk(io, self, self._root) + self.data._read() + else: + self.data = self._io.read_bytes(((self.cell_size - 2) - 4)) + self._debug['data']['end'] = self._io.pos() + + class SubKeyListVk(KaitaiStruct): + + class DataTypeEnum(Enum): + reg_none = 0 + reg_sz = 1 + reg_expand_sz = 2 + reg_binary = 3 + reg_dword = 4 + reg_dword_big_endian = 5 + reg_link = 6 + reg_multi_sz = 7 + reg_resource_list = 8 + reg_full_resource_descriptor = 9 + reg_resource_requirements_list = 10 + reg_qword = 11 + + class VkFlags(Enum): + value_comp_name = 1 + SEQ_FIELDS = ["value_name_size", "data_size", "data_offset", "data_type", "flags", "padding", "value_name"] + def __init__(self, _io, _parent=None, _root=None): + self._io = _io + self._parent = _parent + self._root = _root if _root else self + self._debug = collections.defaultdict(dict) + + def _read(self): + self._debug['value_name_size']['start'] = self._io.pos() + self.value_name_size = self._io.read_u2le() + self._debug['value_name_size']['end'] = self._io.pos() + self._debug['data_size']['start'] = self._io.pos() + self.data_size = self._io.read_u4le() + self._debug['data_size']['end'] = self._io.pos() + self._debug['data_offset']['start'] = self._io.pos() + self.data_offset = self._io.read_u4le() + self._debug['data_offset']['end'] = self._io.pos() + self._debug['data_type']['start'] = self._io.pos() + self.data_type = KaitaiStream.resolve_enum(self._root.HiveBinCell.SubKeyListVk.DataTypeEnum, self._io.read_u4le()) + self._debug['data_type']['end'] = self._io.pos() + self._debug['flags']['start'] = self._io.pos() + self.flags = KaitaiStream.resolve_enum(self._root.HiveBinCell.SubKeyListVk.VkFlags, self._io.read_u2le()) + self._debug['flags']['end'] = self._io.pos() + self._debug['padding']['start'] = self._io.pos() + self.padding = self._io.read_u2le() + self._debug['padding']['end'] = self._io.pos() + if self.flags == self._root.HiveBinCell.SubKeyListVk.VkFlags.value_comp_name: + self._debug['value_name']['start'] = self._io.pos() + self.value_name = (self._io.read_bytes(self.value_name_size)).decode(u"ascii") + self._debug['value_name']['end'] = self._io.pos() + + + + class SubKeyListLhLf(KaitaiStruct): + SEQ_FIELDS = ["count", "items"] + def __init__(self, _io, _parent=None, _root=None): + self._io = _io + self._parent = _parent + self._root = _root if _root else self + self._debug = collections.defaultdict(dict) + + def _read(self): + self._debug['count']['start'] = self._io.pos() + self.count = self._io.read_u2le() + self._debug['count']['end'] = self._io.pos() + self._debug['items']['start'] = self._io.pos() + self.items = [None] * (self.count) + for i in range(self.count): + if not 'arr' in self._debug['items']: + self._debug['items']['arr'] = [] + self._debug['items']['arr'].append({'start': self._io.pos()}) + _t_items = self._root.HiveBinCell.SubKeyListLhLf.Item(self._io, self, self._root) + _t_items._read() + self.items[i] = _t_items + self._debug['items']['arr'][i]['end'] = self._io.pos() + + self._debug['items']['end'] = self._io.pos() + + class Item(KaitaiStruct): + SEQ_FIELDS = ["named_key_offset", "hash_value"] + def __init__(self, _io, _parent=None, _root=None): + self._io = _io + self._parent = _parent + self._root = _root if _root else self + self._debug = collections.defaultdict(dict) + + def _read(self): + self._debug['named_key_offset']['start'] = self._io.pos() + self.named_key_offset = self._io.read_u4le() + self._debug['named_key_offset']['end'] = self._io.pos() + self._debug['hash_value']['start'] = self._io.pos() + self.hash_value = self._io.read_u4le() + self._debug['hash_value']['end'] = self._io.pos() + + + + class SubKeyListSk(KaitaiStruct): + SEQ_FIELDS = ["unknown1", "previous_security_key_offset", "next_security_key_offset", "reference_count"] + def __init__(self, _io, _parent=None, _root=None): + self._io = _io + self._parent = _parent + self._root = _root if _root else self + self._debug = collections.defaultdict(dict) + + def _read(self): + self._debug['unknown1']['start'] = self._io.pos() + self.unknown1 = self._io.read_u2le() + self._debug['unknown1']['end'] = self._io.pos() + self._debug['previous_security_key_offset']['start'] = self._io.pos() + self.previous_security_key_offset = self._io.read_u4le() + self._debug['previous_security_key_offset']['end'] = self._io.pos() + self._debug['next_security_key_offset']['start'] = self._io.pos() + self.next_security_key_offset = self._io.read_u4le() + self._debug['next_security_key_offset']['end'] = self._io.pos() + self._debug['reference_count']['start'] = self._io.pos() + self.reference_count = self._io.read_u4le() + self._debug['reference_count']['end'] = self._io.pos() + + + class SubKeyListLi(KaitaiStruct): + SEQ_FIELDS = ["count", "items"] + def __init__(self, _io, _parent=None, _root=None): + self._io = _io + self._parent = _parent + self._root = _root if _root else self + self._debug = collections.defaultdict(dict) + + def _read(self): + self._debug['count']['start'] = self._io.pos() + self.count = self._io.read_u2le() + self._debug['count']['end'] = self._io.pos() + self._debug['items']['start'] = self._io.pos() + self.items = [None] * (self.count) + for i in range(self.count): + if not 'arr' in self._debug['items']: + self._debug['items']['arr'] = [] + self._debug['items']['arr'].append({'start': self._io.pos()}) + _t_items = self._root.HiveBinCell.SubKeyListLi.Item(self._io, self, self._root) + _t_items._read() + self.items[i] = _t_items + self._debug['items']['arr'][i]['end'] = self._io.pos() + + self._debug['items']['end'] = self._io.pos() + + class Item(KaitaiStruct): + SEQ_FIELDS = ["named_key_offset"] + def __init__(self, _io, _parent=None, _root=None): + self._io = _io + self._parent = _parent + self._root = _root if _root else self + self._debug = collections.defaultdict(dict) + + def _read(self): + self._debug['named_key_offset']['start'] = self._io.pos() + self.named_key_offset = self._io.read_u4le() + self._debug['named_key_offset']['end'] = self._io.pos() + + + + class NamedKey(KaitaiStruct): + + class NkFlags(Enum): + key_is_volatile = 1 + key_hive_exit = 2 + key_hive_entry = 4 + key_no_delete = 8 + key_sym_link = 16 + key_comp_name = 32 + key_prefef_handle = 64 + key_virt_mirrored = 128 + key_virt_target = 256 + key_virtual_store = 512 + unknown1 = 4096 + unknown2 = 16384 + SEQ_FIELDS = ["flags", "last_key_written_date_and_time", "unknown1", "parent_key_offset", "number_of_sub_keys", "number_of_volatile_sub_keys", "sub_keys_list_offset", "number_of_values", "values_list_offset", "security_key_offset", "class_name_offset", "largest_sub_key_name_size", "largest_sub_key_class_name_size", "largest_value_name_size", "largest_value_data_size", "unknown2", "key_name_size", "class_name_size", "unknown_string_size", "unknown_string"] + def __init__(self, _io, _parent=None, _root=None): + self._io = _io + self._parent = _parent + self._root = _root if _root else self + self._debug = collections.defaultdict(dict) + + def _read(self): + self._debug['flags']['start'] = self._io.pos() + self.flags = KaitaiStream.resolve_enum(self._root.HiveBinCell.NamedKey.NkFlags, self._io.read_u2le()) + self._debug['flags']['end'] = self._io.pos() + self._debug['last_key_written_date_and_time']['start'] = self._io.pos() + self.last_key_written_date_and_time = self._root.Filetime(self._io, self, self._root) + self.last_key_written_date_and_time._read() + self._debug['last_key_written_date_and_time']['end'] = self._io.pos() + self._debug['unknown1']['start'] = self._io.pos() + self.unknown1 = self._io.read_u4le() + self._debug['unknown1']['end'] = self._io.pos() + self._debug['parent_key_offset']['start'] = self._io.pos() + self.parent_key_offset = self._io.read_u4le() + self._debug['parent_key_offset']['end'] = self._io.pos() + self._debug['number_of_sub_keys']['start'] = self._io.pos() + self.number_of_sub_keys = self._io.read_u4le() + self._debug['number_of_sub_keys']['end'] = self._io.pos() + self._debug['number_of_volatile_sub_keys']['start'] = self._io.pos() + self.number_of_volatile_sub_keys = self._io.read_u4le() + self._debug['number_of_volatile_sub_keys']['end'] = self._io.pos() + self._debug['sub_keys_list_offset']['start'] = self._io.pos() + self.sub_keys_list_offset = self._io.read_u4le() + self._debug['sub_keys_list_offset']['end'] = self._io.pos() + self._debug['number_of_values']['start'] = self._io.pos() + self.number_of_values = self._io.read_u4le() + self._debug['number_of_values']['end'] = self._io.pos() + self._debug['values_list_offset']['start'] = self._io.pos() + self.values_list_offset = self._io.read_u4le() + self._debug['values_list_offset']['end'] = self._io.pos() + self._debug['security_key_offset']['start'] = self._io.pos() + self.security_key_offset = self._io.read_u4le() + self._debug['security_key_offset']['end'] = self._io.pos() + self._debug['class_name_offset']['start'] = self._io.pos() + self.class_name_offset = self._io.read_u4le() + self._debug['class_name_offset']['end'] = self._io.pos() + self._debug['largest_sub_key_name_size']['start'] = self._io.pos() + self.largest_sub_key_name_size = self._io.read_u4le() + self._debug['largest_sub_key_name_size']['end'] = self._io.pos() + self._debug['largest_sub_key_class_name_size']['start'] = self._io.pos() + self.largest_sub_key_class_name_size = self._io.read_u4le() + self._debug['largest_sub_key_class_name_size']['end'] = self._io.pos() + self._debug['largest_value_name_size']['start'] = self._io.pos() + self.largest_value_name_size = self._io.read_u4le() + self._debug['largest_value_name_size']['end'] = self._io.pos() + self._debug['largest_value_data_size']['start'] = self._io.pos() + self.largest_value_data_size = self._io.read_u4le() + self._debug['largest_value_data_size']['end'] = self._io.pos() + self._debug['unknown2']['start'] = self._io.pos() + self.unknown2 = self._io.read_u4le() + self._debug['unknown2']['end'] = self._io.pos() + self._debug['key_name_size']['start'] = self._io.pos() + self.key_name_size = self._io.read_u2le() + self._debug['key_name_size']['end'] = self._io.pos() + self._debug['class_name_size']['start'] = self._io.pos() + self.class_name_size = self._io.read_u2le() + self._debug['class_name_size']['end'] = self._io.pos() + self._debug['unknown_string_size']['start'] = self._io.pos() + self.unknown_string_size = self._io.read_u4le() + self._debug['unknown_string_size']['end'] = self._io.pos() + self._debug['unknown_string']['start'] = self._io.pos() + self.unknown_string = (self._io.read_bytes(self.unknown_string_size)).decode(u"ascii") + self._debug['unknown_string']['end'] = self._io.pos() + + + class SubKeyListRi(KaitaiStruct): + SEQ_FIELDS = ["count", "items"] + def __init__(self, _io, _parent=None, _root=None): + self._io = _io + self._parent = _parent + self._root = _root if _root else self + self._debug = collections.defaultdict(dict) + + def _read(self): + self._debug['count']['start'] = self._io.pos() + self.count = self._io.read_u2le() + self._debug['count']['end'] = self._io.pos() + self._debug['items']['start'] = self._io.pos() + self.items = [None] * (self.count) + for i in range(self.count): + if not 'arr' in self._debug['items']: + self._debug['items']['arr'] = [] + self._debug['items']['arr'].append({'start': self._io.pos()}) + _t_items = self._root.HiveBinCell.SubKeyListRi.Item(self._io, self, self._root) + _t_items._read() + self.items[i] = _t_items + self._debug['items']['arr'][i]['end'] = self._io.pos() + + self._debug['items']['end'] = self._io.pos() + + class Item(KaitaiStruct): + SEQ_FIELDS = ["sub_key_list_offset"] + def __init__(self, _io, _parent=None, _root=None): + self._io = _io + self._parent = _parent + self._root = _root if _root else self + self._debug = collections.defaultdict(dict) + + def _read(self): + self._debug['sub_key_list_offset']['start'] = self._io.pos() + self.sub_key_list_offset = self._io.read_u4le() + self._debug['sub_key_list_offset']['end'] = self._io.pos() + + + + @property + def cell_size(self): + if hasattr(self, '_m_cell_size'): + return self._m_cell_size if hasattr(self, '_m_cell_size') else None + + self._m_cell_size = ((-1 if self.cell_size_raw < 0 else 1) * self.cell_size_raw) + return self._m_cell_size if hasattr(self, '_m_cell_size') else None + + @property + def is_allocated(self): + if hasattr(self, '_m_is_allocated'): + return self._m_is_allocated if hasattr(self, '_m_is_allocated') else None + + self._m_is_allocated = self.cell_size_raw < 0 + return self._m_is_allocated if hasattr(self, '_m_is_allocated') else None + + + class FileHeader(KaitaiStruct): + + class FileType(Enum): + normal = 0 + transaction_log = 1 + + class FileFormat(Enum): + direct_memory_load = 1 + SEQ_FIELDS = ["signature", "primary_sequence_number", "secondary_sequence_number", "last_modification_date_and_time", "major_version", "minor_version", "type", "format", "root_key_offset", "hive_bins_data_size", "clustering_factor", "unknown1", "unknown2", "checksum", "reserved", "boot_type", "boot_recover"] + def __init__(self, _io, _parent=None, _root=None): + self._io = _io + self._parent = _parent + self._root = _root if _root else self + self._debug = collections.defaultdict(dict) + + def _read(self): + self._debug['signature']['start'] = self._io.pos() + self.signature = self._io.ensure_fixed_contents(b"\x72\x65\x67\x66") + self._debug['signature']['end'] = self._io.pos() + self._debug['primary_sequence_number']['start'] = self._io.pos() + self.primary_sequence_number = self._io.read_u4le() + self._debug['primary_sequence_number']['end'] = self._io.pos() + self._debug['secondary_sequence_number']['start'] = self._io.pos() + self.secondary_sequence_number = self._io.read_u4le() + self._debug['secondary_sequence_number']['end'] = self._io.pos() + self._debug['last_modification_date_and_time']['start'] = self._io.pos() + self.last_modification_date_and_time = self._root.Filetime(self._io, self, self._root) + self.last_modification_date_and_time._read() + self._debug['last_modification_date_and_time']['end'] = self._io.pos() + self._debug['major_version']['start'] = self._io.pos() + self.major_version = self._io.read_u4le() + self._debug['major_version']['end'] = self._io.pos() + self._debug['minor_version']['start'] = self._io.pos() + self.minor_version = self._io.read_u4le() + self._debug['minor_version']['end'] = self._io.pos() + self._debug['type']['start'] = self._io.pos() + self.type = KaitaiStream.resolve_enum(self._root.FileHeader.FileType, self._io.read_u4le()) + self._debug['type']['end'] = self._io.pos() + self._debug['format']['start'] = self._io.pos() + self.format = KaitaiStream.resolve_enum(self._root.FileHeader.FileFormat, self._io.read_u4le()) + self._debug['format']['end'] = self._io.pos() + self._debug['root_key_offset']['start'] = self._io.pos() + self.root_key_offset = self._io.read_u4le() + self._debug['root_key_offset']['end'] = self._io.pos() + self._debug['hive_bins_data_size']['start'] = self._io.pos() + self.hive_bins_data_size = self._io.read_u4le() + self._debug['hive_bins_data_size']['end'] = self._io.pos() + self._debug['clustering_factor']['start'] = self._io.pos() + self.clustering_factor = self._io.read_u4le() + self._debug['clustering_factor']['end'] = self._io.pos() + self._debug['unknown1']['start'] = self._io.pos() + self.unknown1 = self._io.read_bytes(64) + self._debug['unknown1']['end'] = self._io.pos() + self._debug['unknown2']['start'] = self._io.pos() + self.unknown2 = self._io.read_bytes(396) + self._debug['unknown2']['end'] = self._io.pos() + self._debug['checksum']['start'] = self._io.pos() + self.checksum = self._io.read_u4le() + self._debug['checksum']['end'] = self._io.pos() + self._debug['reserved']['start'] = self._io.pos() + self.reserved = self._io.read_bytes(3576) + self._debug['reserved']['end'] = self._io.pos() + self._debug['boot_type']['start'] = self._io.pos() + self.boot_type = self._io.read_u4le() + self._debug['boot_type']['end'] = self._io.pos() + self._debug['boot_recover']['start'] = self._io.pos() + self.boot_recover = self._io.read_u4le() + self._debug['boot_recover']['end'] = self._io.pos() + + + diff --git a/python/examples/kaitai/kaitai_struct_formats/windows/windows_lnk_file.py b/python/examples/kaitai/kaitai_struct_formats/windows/windows_lnk_file.py new file mode 100644 index 00000000..76bd391b --- /dev/null +++ b/python/examples/kaitai/kaitai_struct_formats/windows/windows_lnk_file.py @@ -0,0 +1,461 @@ +from __future__ import absolute_import +# This is a generated file! Please edit source .ksy file and use kaitai-struct-compiler to rebuild + +from pkg_resources import parse_version +from ...kaitaistruct import __version__ as ks_version, KaitaiStruct, KaitaiStream, BytesIO +from enum import Enum +import collections + + +if parse_version(ks_version) < parse_version('0.7'): + raise Exception("Incompatible Kaitai Struct Python API: 0.7 or later is required, but you have %s" % (ks_version)) + +from windows_shell_items import WindowsShellItems +class WindowsLnkFile(KaitaiStruct): + """Windows .lnk files (AKA "shell link" file) are most frequently used + in Windows shell to create "shortcuts" to another files, usually for + purposes of running a program from some other directory, sometimes + with certain preconfigured arguments and some other options. + + .. seealso:: + Source - https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/MS-SHLLINK/[MS-SHLLINK].pdf + """ + + class WindowState(Enum): + normal = 1 + maximized = 3 + min_no_active = 7 + + class DriveTypes(Enum): + unknown = 0 + no_root_dir = 1 + removable = 2 + fixed = 3 + remote = 4 + cdrom = 5 + ramdisk = 6 + SEQ_FIELDS = ["header", "target_id_list", "info", "name", "rel_path", "work_dir", "arguments", "icon_location"] + def __init__(self, _io, _parent=None, _root=None): + self._io = _io + self._parent = _parent + self._root = _root if _root else self + self._debug = collections.defaultdict(dict) + + def _read(self): + self._debug['header']['start'] = self._io.pos() + self.header = self._root.FileHeader(self._io, self, self._root) + self.header._read() + self._debug['header']['end'] = self._io.pos() + if self.header.flags.has_link_target_id_list: + self._debug['target_id_list']['start'] = self._io.pos() + self.target_id_list = self._root.LinkTargetIdList(self._io, self, self._root) + self.target_id_list._read() + self._debug['target_id_list']['end'] = self._io.pos() + + if self.header.flags.has_link_info: + self._debug['info']['start'] = self._io.pos() + self.info = self._root.LinkInfo(self._io, self, self._root) + self.info._read() + self._debug['info']['end'] = self._io.pos() + + if self.header.flags.has_name: + self._debug['name']['start'] = self._io.pos() + self.name = self._root.StringData(self._io, self, self._root) + self.name._read() + self._debug['name']['end'] = self._io.pos() + + if self.header.flags.has_rel_path: + self._debug['rel_path']['start'] = self._io.pos() + self.rel_path = self._root.StringData(self._io, self, self._root) + self.rel_path._read() + self._debug['rel_path']['end'] = self._io.pos() + + if self.header.flags.has_work_dir: + self._debug['work_dir']['start'] = self._io.pos() + self.work_dir = self._root.StringData(self._io, self, self._root) + self.work_dir._read() + self._debug['work_dir']['end'] = self._io.pos() + + if self.header.flags.has_arguments: + self._debug['arguments']['start'] = self._io.pos() + self.arguments = self._root.StringData(self._io, self, self._root) + self.arguments._read() + self._debug['arguments']['end'] = self._io.pos() + + if self.header.flags.has_icon_location: + self._debug['icon_location']['start'] = self._io.pos() + self.icon_location = self._root.StringData(self._io, self, self._root) + self.icon_location._read() + self._debug['icon_location']['end'] = self._io.pos() + + + class LinkTargetIdList(KaitaiStruct): + """ + .. seealso:: + Section 2.2 - https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/MS-SHLLINK/[MS-SHLLINK].pdf + """ + SEQ_FIELDS = ["len_id_list", "id_list"] + def __init__(self, _io, _parent=None, _root=None): + self._io = _io + self._parent = _parent + self._root = _root if _root else self + self._debug = collections.defaultdict(dict) + + def _read(self): + self._debug['len_id_list']['start'] = self._io.pos() + self.len_id_list = self._io.read_u2le() + self._debug['len_id_list']['end'] = self._io.pos() + self._debug['id_list']['start'] = self._io.pos() + self._raw_id_list = self._io.read_bytes(self.len_id_list) + io = KaitaiStream(BytesIO(self._raw_id_list)) + self.id_list = WindowsShellItems(io) + self.id_list._read() + self._debug['id_list']['end'] = self._io.pos() + + + class StringData(KaitaiStruct): + SEQ_FIELDS = ["chars_str", "str"] + def __init__(self, _io, _parent=None, _root=None): + self._io = _io + self._parent = _parent + self._root = _root if _root else self + self._debug = collections.defaultdict(dict) + + def _read(self): + self._debug['chars_str']['start'] = self._io.pos() + self.chars_str = self._io.read_u2le() + self._debug['chars_str']['end'] = self._io.pos() + self._debug['str']['start'] = self._io.pos() + self.str = (self._io.read_bytes((self.chars_str * 2))).decode(u"UTF-16LE") + self._debug['str']['end'] = self._io.pos() + + + class LinkInfo(KaitaiStruct): + """ + .. seealso:: + Section 2.3 - https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/MS-SHLLINK/[MS-SHLLINK].pdf + """ + SEQ_FIELDS = ["len_all", "all"] + def __init__(self, _io, _parent=None, _root=None): + self._io = _io + self._parent = _parent + self._root = _root if _root else self + self._debug = collections.defaultdict(dict) + + def _read(self): + self._debug['len_all']['start'] = self._io.pos() + self.len_all = self._io.read_u4le() + self._debug['len_all']['end'] = self._io.pos() + self._debug['all']['start'] = self._io.pos() + self._raw_all = self._io.read_bytes((self.len_all - 4)) + io = KaitaiStream(BytesIO(self._raw_all)) + self.all = self._root.LinkInfo.All(io, self, self._root) + self.all._read() + self._debug['all']['end'] = self._io.pos() + + class VolumeIdBody(KaitaiStruct): + """ + .. seealso:: + Section 2.3.1 - https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/MS-SHLLINK/[MS-SHLLINK].pdf + """ + SEQ_FIELDS = ["drive_type", "drive_serial_number", "ofs_volume_label", "ofs_volume_label_unicode"] + def __init__(self, _io, _parent=None, _root=None): + self._io = _io + self._parent = _parent + self._root = _root if _root else self + self._debug = collections.defaultdict(dict) + + def _read(self): + self._debug['drive_type']['start'] = self._io.pos() + self.drive_type = KaitaiStream.resolve_enum(self._root.DriveTypes, self._io.read_u4le()) + self._debug['drive_type']['end'] = self._io.pos() + self._debug['drive_serial_number']['start'] = self._io.pos() + self.drive_serial_number = self._io.read_u4le() + self._debug['drive_serial_number']['end'] = self._io.pos() + self._debug['ofs_volume_label']['start'] = self._io.pos() + self.ofs_volume_label = self._io.read_u4le() + self._debug['ofs_volume_label']['end'] = self._io.pos() + if self.is_unicode: + self._debug['ofs_volume_label_unicode']['start'] = self._io.pos() + self.ofs_volume_label_unicode = self._io.read_u4le() + self._debug['ofs_volume_label_unicode']['end'] = self._io.pos() + + + @property + def is_unicode(self): + if hasattr(self, '_m_is_unicode'): + return self._m_is_unicode if hasattr(self, '_m_is_unicode') else None + + self._m_is_unicode = self.ofs_volume_label == 20 + return self._m_is_unicode if hasattr(self, '_m_is_unicode') else None + + @property + def volume_label_ansi(self): + if hasattr(self, '_m_volume_label_ansi'): + return self._m_volume_label_ansi if hasattr(self, '_m_volume_label_ansi') else None + + if not (self.is_unicode): + _pos = self._io.pos() + self._io.seek((self.ofs_volume_label - 4)) + self._debug['_m_volume_label_ansi']['start'] = self._io.pos() + self._m_volume_label_ansi = (self._io.read_bytes_term(0, False, True, True)).decode(u"cp437") + self._debug['_m_volume_label_ansi']['end'] = self._io.pos() + self._io.seek(_pos) + + return self._m_volume_label_ansi if hasattr(self, '_m_volume_label_ansi') else None + + + class All(KaitaiStruct): + """ + .. seealso:: + Section 2.3 - https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/MS-SHLLINK/[MS-SHLLINK].pdf + """ + SEQ_FIELDS = ["len_header", "header"] + def __init__(self, _io, _parent=None, _root=None): + self._io = _io + self._parent = _parent + self._root = _root if _root else self + self._debug = collections.defaultdict(dict) + + def _read(self): + self._debug['len_header']['start'] = self._io.pos() + self.len_header = self._io.read_u4le() + self._debug['len_header']['end'] = self._io.pos() + self._debug['header']['start'] = self._io.pos() + self._raw_header = self._io.read_bytes((self.len_header - 8)) + io = KaitaiStream(BytesIO(self._raw_header)) + self.header = self._root.LinkInfo.Header(io, self, self._root) + self.header._read() + self._debug['header']['end'] = self._io.pos() + + @property + def volume_id(self): + if hasattr(self, '_m_volume_id'): + return self._m_volume_id if hasattr(self, '_m_volume_id') else None + + if self.header.flags.has_volume_id_and_local_base_path: + _pos = self._io.pos() + self._io.seek((self.header.ofs_volume_id - 4)) + self._debug['_m_volume_id']['start'] = self._io.pos() + self._m_volume_id = self._root.LinkInfo.VolumeIdSpec(self._io, self, self._root) + self._m_volume_id._read() + self._debug['_m_volume_id']['end'] = self._io.pos() + self._io.seek(_pos) + + return self._m_volume_id if hasattr(self, '_m_volume_id') else None + + @property + def local_base_path(self): + if hasattr(self, '_m_local_base_path'): + return self._m_local_base_path if hasattr(self, '_m_local_base_path') else None + + if self.header.flags.has_volume_id_and_local_base_path: + _pos = self._io.pos() + self._io.seek((self.header.ofs_local_base_path - 4)) + self._debug['_m_local_base_path']['start'] = self._io.pos() + self._m_local_base_path = self._io.read_bytes_term(0, False, True, True) + self._debug['_m_local_base_path']['end'] = self._io.pos() + self._io.seek(_pos) + + return self._m_local_base_path if hasattr(self, '_m_local_base_path') else None + + + class VolumeIdSpec(KaitaiStruct): + """ + .. seealso:: + Section 2.3.1 - https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/MS-SHLLINK/[MS-SHLLINK].pdf + """ + SEQ_FIELDS = ["len_all", "body"] + def __init__(self, _io, _parent=None, _root=None): + self._io = _io + self._parent = _parent + self._root = _root if _root else self + self._debug = collections.defaultdict(dict) + + def _read(self): + self._debug['len_all']['start'] = self._io.pos() + self.len_all = self._io.read_u4le() + self._debug['len_all']['end'] = self._io.pos() + self._debug['body']['start'] = self._io.pos() + self._raw_body = self._io.read_bytes((self.len_all - 4)) + io = KaitaiStream(BytesIO(self._raw_body)) + self.body = self._root.LinkInfo.VolumeIdBody(io, self, self._root) + self.body._read() + self._debug['body']['end'] = self._io.pos() + + + class LinkInfoFlags(KaitaiStruct): + """ + .. seealso:: + Section 2.3 - https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/MS-SHLLINK/[MS-SHLLINK].pdf + """ + SEQ_FIELDS = ["reserved1", "has_common_net_rel_link", "has_volume_id_and_local_base_path", "reserved2"] + def __init__(self, _io, _parent=None, _root=None): + self._io = _io + self._parent = _parent + self._root = _root if _root else self + self._debug = collections.defaultdict(dict) + + def _read(self): + self._debug['reserved1']['start'] = self._io.pos() + self.reserved1 = self._io.read_bits_int(6) + self._debug['reserved1']['end'] = self._io.pos() + self._debug['has_common_net_rel_link']['start'] = self._io.pos() + self.has_common_net_rel_link = self._io.read_bits_int(1) != 0 + self._debug['has_common_net_rel_link']['end'] = self._io.pos() + self._debug['has_volume_id_and_local_base_path']['start'] = self._io.pos() + self.has_volume_id_and_local_base_path = self._io.read_bits_int(1) != 0 + self._debug['has_volume_id_and_local_base_path']['end'] = self._io.pos() + self._debug['reserved2']['start'] = self._io.pos() + self.reserved2 = self._io.read_bits_int(24) + self._debug['reserved2']['end'] = self._io.pos() + + + class Header(KaitaiStruct): + """ + .. seealso:: + Section 2.3 - https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/MS-SHLLINK/[MS-SHLLINK].pdf + """ + SEQ_FIELDS = ["flags", "ofs_volume_id", "ofs_local_base_path", "ofs_common_net_rel_link", "ofs_common_path_suffix", "ofs_local_base_path_unicode", "ofs_common_path_suffix_unicode"] + def __init__(self, _io, _parent=None, _root=None): + self._io = _io + self._parent = _parent + self._root = _root if _root else self + self._debug = collections.defaultdict(dict) + + def _read(self): + self._debug['flags']['start'] = self._io.pos() + self.flags = self._root.LinkInfo.LinkInfoFlags(self._io, self, self._root) + self.flags._read() + self._debug['flags']['end'] = self._io.pos() + self._debug['ofs_volume_id']['start'] = self._io.pos() + self.ofs_volume_id = self._io.read_u4le() + self._debug['ofs_volume_id']['end'] = self._io.pos() + self._debug['ofs_local_base_path']['start'] = self._io.pos() + self.ofs_local_base_path = self._io.read_u4le() + self._debug['ofs_local_base_path']['end'] = self._io.pos() + self._debug['ofs_common_net_rel_link']['start'] = self._io.pos() + self.ofs_common_net_rel_link = self._io.read_u4le() + self._debug['ofs_common_net_rel_link']['end'] = self._io.pos() + self._debug['ofs_common_path_suffix']['start'] = self._io.pos() + self.ofs_common_path_suffix = self._io.read_u4le() + self._debug['ofs_common_path_suffix']['end'] = self._io.pos() + if not (self._io.is_eof()): + self._debug['ofs_local_base_path_unicode']['start'] = self._io.pos() + self.ofs_local_base_path_unicode = self._io.read_u4le() + self._debug['ofs_local_base_path_unicode']['end'] = self._io.pos() + + if not (self._io.is_eof()): + self._debug['ofs_common_path_suffix_unicode']['start'] = self._io.pos() + self.ofs_common_path_suffix_unicode = self._io.read_u4le() + self._debug['ofs_common_path_suffix_unicode']['end'] = self._io.pos() + + + + + class LinkFlags(KaitaiStruct): + """ + .. seealso:: + Section 2.1.1 - https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/MS-SHLLINK/[MS-SHLLINK].pdf + """ + SEQ_FIELDS = ["is_unicode", "has_icon_location", "has_arguments", "has_work_dir", "has_rel_path", "has_name", "has_link_info", "has_link_target_id_list", "_unnamed8", "reserved", "keep_local_id_list_for_unc_target", "_unnamed11"] + def __init__(self, _io, _parent=None, _root=None): + self._io = _io + self._parent = _parent + self._root = _root if _root else self + self._debug = collections.defaultdict(dict) + + def _read(self): + self._debug['is_unicode']['start'] = self._io.pos() + self.is_unicode = self._io.read_bits_int(1) != 0 + self._debug['is_unicode']['end'] = self._io.pos() + self._debug['has_icon_location']['start'] = self._io.pos() + self.has_icon_location = self._io.read_bits_int(1) != 0 + self._debug['has_icon_location']['end'] = self._io.pos() + self._debug['has_arguments']['start'] = self._io.pos() + self.has_arguments = self._io.read_bits_int(1) != 0 + self._debug['has_arguments']['end'] = self._io.pos() + self._debug['has_work_dir']['start'] = self._io.pos() + self.has_work_dir = self._io.read_bits_int(1) != 0 + self._debug['has_work_dir']['end'] = self._io.pos() + self._debug['has_rel_path']['start'] = self._io.pos() + self.has_rel_path = self._io.read_bits_int(1) != 0 + self._debug['has_rel_path']['end'] = self._io.pos() + self._debug['has_name']['start'] = self._io.pos() + self.has_name = self._io.read_bits_int(1) != 0 + self._debug['has_name']['end'] = self._io.pos() + self._debug['has_link_info']['start'] = self._io.pos() + self.has_link_info = self._io.read_bits_int(1) != 0 + self._debug['has_link_info']['end'] = self._io.pos() + self._debug['has_link_target_id_list']['start'] = self._io.pos() + self.has_link_target_id_list = self._io.read_bits_int(1) != 0 + self._debug['has_link_target_id_list']['end'] = self._io.pos() + self._debug['_unnamed8']['start'] = self._io.pos() + self._unnamed8 = self._io.read_bits_int(16) + self._debug['_unnamed8']['end'] = self._io.pos() + self._debug['reserved']['start'] = self._io.pos() + self.reserved = self._io.read_bits_int(5) + self._debug['reserved']['end'] = self._io.pos() + self._debug['keep_local_id_list_for_unc_target']['start'] = self._io.pos() + self.keep_local_id_list_for_unc_target = self._io.read_bits_int(1) != 0 + self._debug['keep_local_id_list_for_unc_target']['end'] = self._io.pos() + self._debug['_unnamed11']['start'] = self._io.pos() + self._unnamed11 = self._io.read_bits_int(2) + self._debug['_unnamed11']['end'] = self._io.pos() + + + class FileHeader(KaitaiStruct): + """ + .. seealso:: + Section 2.1 - https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/MS-SHLLINK/[MS-SHLLINK].pdf + """ + SEQ_FIELDS = ["len_header", "link_clsid", "flags", "file_attrs", "time_creation", "time_access", "time_write", "target_file_size", "icon_index", "show_command", "hotkey", "reserved"] + def __init__(self, _io, _parent=None, _root=None): + self._io = _io + self._parent = _parent + self._root = _root if _root else self + self._debug = collections.defaultdict(dict) + + def _read(self): + self._debug['len_header']['start'] = self._io.pos() + self.len_header = self._io.ensure_fixed_contents(b"\x4C\x00\x00\x00") + self._debug['len_header']['end'] = self._io.pos() + self._debug['link_clsid']['start'] = self._io.pos() + self.link_clsid = self._io.ensure_fixed_contents(b"\x01\x14\x02\x00\x00\x00\x00\x00\xC0\x00\x00\x00\x00\x00\x00\x46") + self._debug['link_clsid']['end'] = self._io.pos() + self._debug['flags']['start'] = self._io.pos() + self._raw_flags = self._io.read_bytes(4) + io = KaitaiStream(BytesIO(self._raw_flags)) + self.flags = self._root.LinkFlags(io, self, self._root) + self.flags._read() + self._debug['flags']['end'] = self._io.pos() + self._debug['file_attrs']['start'] = self._io.pos() + self.file_attrs = self._io.read_u4le() + self._debug['file_attrs']['end'] = self._io.pos() + self._debug['time_creation']['start'] = self._io.pos() + self.time_creation = self._io.read_u8le() + self._debug['time_creation']['end'] = self._io.pos() + self._debug['time_access']['start'] = self._io.pos() + self.time_access = self._io.read_u8le() + self._debug['time_access']['end'] = self._io.pos() + self._debug['time_write']['start'] = self._io.pos() + self.time_write = self._io.read_u8le() + self._debug['time_write']['end'] = self._io.pos() + self._debug['target_file_size']['start'] = self._io.pos() + self.target_file_size = self._io.read_u4le() + self._debug['target_file_size']['end'] = self._io.pos() + self._debug['icon_index']['start'] = self._io.pos() + self.icon_index = self._io.read_s4le() + self._debug['icon_index']['end'] = self._io.pos() + self._debug['show_command']['start'] = self._io.pos() + self.show_command = KaitaiStream.resolve_enum(self._root.WindowState, self._io.read_u4le()) + self._debug['show_command']['end'] = self._io.pos() + self._debug['hotkey']['start'] = self._io.pos() + self.hotkey = self._io.read_u2le() + self._debug['hotkey']['end'] = self._io.pos() + self._debug['reserved']['start'] = self._io.pos() + self.reserved = self._io.ensure_fixed_contents(b"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00") + self._debug['reserved']['end'] = self._io.pos() + + + diff --git a/python/examples/kaitai/kaitai_struct_formats/windows/windows_minidump.py b/python/examples/kaitai/kaitai_struct_formats/windows/windows_minidump.py new file mode 100644 index 00000000..b2846588 --- /dev/null +++ b/python/examples/kaitai/kaitai_struct_formats/windows/windows_minidump.py @@ -0,0 +1,541 @@ +from __future__ import absolute_import +# This is a generated file! Please edit source .ksy file and use kaitai-struct-compiler to rebuild + +from pkg_resources import parse_version +from ...kaitaistruct import __version__ as ks_version, KaitaiStruct, KaitaiStream, BytesIO +from enum import Enum +import collections + + +if parse_version(ks_version) < parse_version('0.7'): + raise Exception("Incompatible Kaitai Struct Python API: 0.7 or later is required, but you have %s" % (ks_version)) + +class WindowsMinidump(KaitaiStruct): + """Windows MiniDump (MDMP) file provides a concise way to store process + core dumps, which is useful for debugging. Given its small size, + modularity, some cross-platform features and native support in some + debuggers, it is particularly useful for crash reporting, and is + used for that purpose in Windows and Google Chrome projects. + + The file itself is a container, which contains a number of typed + "streams", which contain some data according to its type attribute. + + .. seealso:: + Source - https://msdn.microsoft.com/en-us/library/ms680378(VS.85).aspx + """ + + class StreamTypes(Enum): + unused = 0 + reserved_0 = 1 + reserved_1 = 2 + thread_list = 3 + module_list = 4 + memory_list = 5 + exception = 6 + system_info = 7 + thread_ex_list = 8 + memory_64_list = 9 + comment_a = 10 + comment_w = 11 + handle_data = 12 + function_table = 13 + unloaded_module_list = 14 + misc_info = 15 + memory_info_list = 16 + thread_info_list = 17 + handle_operation_list = 18 + SEQ_FIELDS = ["magic1", "magic2", "version", "num_streams", "ofs_streams", "checksum", "timestamp", "flags"] + def __init__(self, _io, _parent=None, _root=None): + self._io = _io + self._parent = _parent + self._root = _root if _root else self + self._debug = collections.defaultdict(dict) + + def _read(self): + self._debug['magic1']['start'] = self._io.pos() + self.magic1 = self._io.ensure_fixed_contents(b"\x4D\x44\x4D\x50") + self._debug['magic1']['end'] = self._io.pos() + self._debug['magic2']['start'] = self._io.pos() + self.magic2 = self._io.ensure_fixed_contents(b"\x93\xA7") + self._debug['magic2']['end'] = self._io.pos() + self._debug['version']['start'] = self._io.pos() + self.version = self._io.read_u2le() + self._debug['version']['end'] = self._io.pos() + self._debug['num_streams']['start'] = self._io.pos() + self.num_streams = self._io.read_u4le() + self._debug['num_streams']['end'] = self._io.pos() + self._debug['ofs_streams']['start'] = self._io.pos() + self.ofs_streams = self._io.read_u4le() + self._debug['ofs_streams']['end'] = self._io.pos() + self._debug['checksum']['start'] = self._io.pos() + self.checksum = self._io.read_u4le() + self._debug['checksum']['end'] = self._io.pos() + self._debug['timestamp']['start'] = self._io.pos() + self.timestamp = self._io.read_u4le() + self._debug['timestamp']['end'] = self._io.pos() + self._debug['flags']['start'] = self._io.pos() + self.flags = self._io.read_u8le() + self._debug['flags']['end'] = self._io.pos() + + class ThreadList(KaitaiStruct): + """ + .. seealso:: + Source - https://msdn.microsoft.com/en-us/library/ms680515(v=vs.85).aspx + """ + SEQ_FIELDS = ["num_threads", "threads"] + def __init__(self, _io, _parent=None, _root=None): + self._io = _io + self._parent = _parent + self._root = _root if _root else self + self._debug = collections.defaultdict(dict) + + def _read(self): + self._debug['num_threads']['start'] = self._io.pos() + self.num_threads = self._io.read_u4le() + self._debug['num_threads']['end'] = self._io.pos() + self._debug['threads']['start'] = self._io.pos() + self.threads = [None] * (self.num_threads) + for i in range(self.num_threads): + if not 'arr' in self._debug['threads']: + self._debug['threads']['arr'] = [] + self._debug['threads']['arr'].append({'start': self._io.pos()}) + _t_threads = self._root.Thread(self._io, self, self._root) + _t_threads._read() + self.threads[i] = _t_threads + self._debug['threads']['arr'][i]['end'] = self._io.pos() + + self._debug['threads']['end'] = self._io.pos() + + + class LocationDescriptor(KaitaiStruct): + """ + .. seealso:: + Source - https://msdn.microsoft.com/en-us/library/ms680383(v=vs.85).aspx + """ + SEQ_FIELDS = ["len_data", "ofs_data"] + def __init__(self, _io, _parent=None, _root=None): + self._io = _io + self._parent = _parent + self._root = _root if _root else self + self._debug = collections.defaultdict(dict) + + def _read(self): + self._debug['len_data']['start'] = self._io.pos() + self.len_data = self._io.read_u4le() + self._debug['len_data']['end'] = self._io.pos() + self._debug['ofs_data']['start'] = self._io.pos() + self.ofs_data = self._io.read_u4le() + self._debug['ofs_data']['end'] = self._io.pos() + + @property + def data(self): + if hasattr(self, '_m_data'): + return self._m_data if hasattr(self, '_m_data') else None + + io = self._root._io + _pos = io.pos() + io.seek(self.ofs_data) + self._debug['_m_data']['start'] = io.pos() + self._m_data = io.read_bytes(self.len_data) + self._debug['_m_data']['end'] = io.pos() + io.seek(_pos) + return self._m_data if hasattr(self, '_m_data') else None + + + class MinidumpString(KaitaiStruct): + """Specific string serialization scheme used in MiniDump format is + actually a simple 32-bit length-prefixed UTF-16 string. + + .. seealso:: + Source - https://msdn.microsoft.com/en-us/library/ms680395(v=vs.85).aspx + """ + SEQ_FIELDS = ["len_str", "str"] + def __init__(self, _io, _parent=None, _root=None): + self._io = _io + self._parent = _parent + self._root = _root if _root else self + self._debug = collections.defaultdict(dict) + + def _read(self): + self._debug['len_str']['start'] = self._io.pos() + self.len_str = self._io.read_u4le() + self._debug['len_str']['end'] = self._io.pos() + self._debug['str']['start'] = self._io.pos() + self.str = (self._io.read_bytes(self.len_str)).decode(u"UTF-16LE") + self._debug['str']['end'] = self._io.pos() + + + class SystemInfo(KaitaiStruct): + """"System info" stream provides basic information about the + hardware and operating system which produces this dump. + + .. seealso:: + Source - https://msdn.microsoft.com/en-us/library/ms680396(v=vs.85).aspx + """ + + class CpuArchs(Enum): + intel = 0 + arm = 5 + ia64 = 6 + amd64 = 9 + unknown = 65535 + SEQ_FIELDS = ["cpu_arch", "cpu_level", "cpu_revision", "num_cpus", "os_type", "os_ver_major", "os_ver_minor", "os_build", "os_platform", "ofs_service_pack", "os_suite_mask", "reserved2"] + def __init__(self, _io, _parent=None, _root=None): + self._io = _io + self._parent = _parent + self._root = _root if _root else self + self._debug = collections.defaultdict(dict) + + def _read(self): + self._debug['cpu_arch']['start'] = self._io.pos() + self.cpu_arch = KaitaiStream.resolve_enum(self._root.SystemInfo.CpuArchs, self._io.read_u2le()) + self._debug['cpu_arch']['end'] = self._io.pos() + self._debug['cpu_level']['start'] = self._io.pos() + self.cpu_level = self._io.read_u2le() + self._debug['cpu_level']['end'] = self._io.pos() + self._debug['cpu_revision']['start'] = self._io.pos() + self.cpu_revision = self._io.read_u2le() + self._debug['cpu_revision']['end'] = self._io.pos() + self._debug['num_cpus']['start'] = self._io.pos() + self.num_cpus = self._io.read_u1() + self._debug['num_cpus']['end'] = self._io.pos() + self._debug['os_type']['start'] = self._io.pos() + self.os_type = self._io.read_u1() + self._debug['os_type']['end'] = self._io.pos() + self._debug['os_ver_major']['start'] = self._io.pos() + self.os_ver_major = self._io.read_u4le() + self._debug['os_ver_major']['end'] = self._io.pos() + self._debug['os_ver_minor']['start'] = self._io.pos() + self.os_ver_minor = self._io.read_u4le() + self._debug['os_ver_minor']['end'] = self._io.pos() + self._debug['os_build']['start'] = self._io.pos() + self.os_build = self._io.read_u4le() + self._debug['os_build']['end'] = self._io.pos() + self._debug['os_platform']['start'] = self._io.pos() + self.os_platform = self._io.read_u4le() + self._debug['os_platform']['end'] = self._io.pos() + self._debug['ofs_service_pack']['start'] = self._io.pos() + self.ofs_service_pack = self._io.read_u4le() + self._debug['ofs_service_pack']['end'] = self._io.pos() + self._debug['os_suite_mask']['start'] = self._io.pos() + self.os_suite_mask = self._io.read_u2le() + self._debug['os_suite_mask']['end'] = self._io.pos() + self._debug['reserved2']['start'] = self._io.pos() + self.reserved2 = self._io.read_u2le() + self._debug['reserved2']['end'] = self._io.pos() + + @property + def service_pack(self): + if hasattr(self, '_m_service_pack'): + return self._m_service_pack if hasattr(self, '_m_service_pack') else None + + if self.ofs_service_pack > 0: + io = self._root._io + _pos = io.pos() + io.seek(self.ofs_service_pack) + self._debug['_m_service_pack']['start'] = io.pos() + self._m_service_pack = self._root.MinidumpString(io, self, self._root) + self._m_service_pack._read() + self._debug['_m_service_pack']['end'] = io.pos() + io.seek(_pos) + + return self._m_service_pack if hasattr(self, '_m_service_pack') else None + + + class ExceptionRecord(KaitaiStruct): + """ + .. seealso:: + Source - https://msdn.microsoft.com/en-us/library/ms680367(v=vs.85).aspx + """ + SEQ_FIELDS = ["code", "flags", "inner_exception", "addr", "num_params", "reserved", "params"] + def __init__(self, _io, _parent=None, _root=None): + self._io = _io + self._parent = _parent + self._root = _root if _root else self + self._debug = collections.defaultdict(dict) + + def _read(self): + self._debug['code']['start'] = self._io.pos() + self.code = self._io.read_u4le() + self._debug['code']['end'] = self._io.pos() + self._debug['flags']['start'] = self._io.pos() + self.flags = self._io.read_u4le() + self._debug['flags']['end'] = self._io.pos() + self._debug['inner_exception']['start'] = self._io.pos() + self.inner_exception = self._io.read_u8le() + self._debug['inner_exception']['end'] = self._io.pos() + self._debug['addr']['start'] = self._io.pos() + self.addr = self._io.read_u8le() + self._debug['addr']['end'] = self._io.pos() + self._debug['num_params']['start'] = self._io.pos() + self.num_params = self._io.read_u4le() + self._debug['num_params']['end'] = self._io.pos() + self._debug['reserved']['start'] = self._io.pos() + self.reserved = self._io.read_u4le() + self._debug['reserved']['end'] = self._io.pos() + self._debug['params']['start'] = self._io.pos() + self.params = [None] * (15) + for i in range(15): + if not 'arr' in self._debug['params']: + self._debug['params']['arr'] = [] + self._debug['params']['arr'].append({'start': self._io.pos()}) + self.params[i] = self._io.read_u8le() + self._debug['params']['arr'][i]['end'] = self._io.pos() + + self._debug['params']['end'] = self._io.pos() + + + class MiscInfo(KaitaiStruct): + """ + .. seealso:: + Source - https://msdn.microsoft.com/en-us/library/ms680389(v=vs.85).aspx + """ + SEQ_FIELDS = ["len_info", "flags1", "process_id", "process_create_time", "process_user_time", "process_kernel_time", "cpu_max_mhz", "cpu_cur_mhz", "cpu_limit_mhz", "cpu_max_idle_state", "cpu_cur_idle_state"] + def __init__(self, _io, _parent=None, _root=None): + self._io = _io + self._parent = _parent + self._root = _root if _root else self + self._debug = collections.defaultdict(dict) + + def _read(self): + self._debug['len_info']['start'] = self._io.pos() + self.len_info = self._io.read_u4le() + self._debug['len_info']['end'] = self._io.pos() + self._debug['flags1']['start'] = self._io.pos() + self.flags1 = self._io.read_u4le() + self._debug['flags1']['end'] = self._io.pos() + self._debug['process_id']['start'] = self._io.pos() + self.process_id = self._io.read_u4le() + self._debug['process_id']['end'] = self._io.pos() + self._debug['process_create_time']['start'] = self._io.pos() + self.process_create_time = self._io.read_u4le() + self._debug['process_create_time']['end'] = self._io.pos() + self._debug['process_user_time']['start'] = self._io.pos() + self.process_user_time = self._io.read_u4le() + self._debug['process_user_time']['end'] = self._io.pos() + self._debug['process_kernel_time']['start'] = self._io.pos() + self.process_kernel_time = self._io.read_u4le() + self._debug['process_kernel_time']['end'] = self._io.pos() + self._debug['cpu_max_mhz']['start'] = self._io.pos() + self.cpu_max_mhz = self._io.read_u4le() + self._debug['cpu_max_mhz']['end'] = self._io.pos() + self._debug['cpu_cur_mhz']['start'] = self._io.pos() + self.cpu_cur_mhz = self._io.read_u4le() + self._debug['cpu_cur_mhz']['end'] = self._io.pos() + self._debug['cpu_limit_mhz']['start'] = self._io.pos() + self.cpu_limit_mhz = self._io.read_u4le() + self._debug['cpu_limit_mhz']['end'] = self._io.pos() + self._debug['cpu_max_idle_state']['start'] = self._io.pos() + self.cpu_max_idle_state = self._io.read_u4le() + self._debug['cpu_max_idle_state']['end'] = self._io.pos() + self._debug['cpu_cur_idle_state']['start'] = self._io.pos() + self.cpu_cur_idle_state = self._io.read_u4le() + self._debug['cpu_cur_idle_state']['end'] = self._io.pos() + + + class Dir(KaitaiStruct): + """ + .. seealso:: + Source - https://msdn.microsoft.com/en-us/library/ms680365(v=vs.85).aspx + """ + SEQ_FIELDS = ["stream_type", "len_data", "ofs_data"] + def __init__(self, _io, _parent=None, _root=None): + self._io = _io + self._parent = _parent + self._root = _root if _root else self + self._debug = collections.defaultdict(dict) + + def _read(self): + self._debug['stream_type']['start'] = self._io.pos() + self.stream_type = KaitaiStream.resolve_enum(self._root.StreamTypes, self._io.read_u4le()) + self._debug['stream_type']['end'] = self._io.pos() + self._debug['len_data']['start'] = self._io.pos() + self.len_data = self._io.read_u4le() + self._debug['len_data']['end'] = self._io.pos() + self._debug['ofs_data']['start'] = self._io.pos() + self.ofs_data = self._io.read_u4le() + self._debug['ofs_data']['end'] = self._io.pos() + + @property + def data(self): + if hasattr(self, '_m_data'): + return self._m_data if hasattr(self, '_m_data') else None + + _pos = self._io.pos() + self._io.seek(self.ofs_data) + self._debug['_m_data']['start'] = self._io.pos() + _on = self.stream_type + if _on == self._root.StreamTypes.memory_list: + self._raw__m_data = self._io.read_bytes(self.len_data) + io = KaitaiStream(BytesIO(self._raw__m_data)) + self._m_data = self._root.MemoryList(io, self, self._root) + self._m_data._read() + elif _on == self._root.StreamTypes.misc_info: + self._raw__m_data = self._io.read_bytes(self.len_data) + io = KaitaiStream(BytesIO(self._raw__m_data)) + self._m_data = self._root.MiscInfo(io, self, self._root) + self._m_data._read() + elif _on == self._root.StreamTypes.thread_list: + self._raw__m_data = self._io.read_bytes(self.len_data) + io = KaitaiStream(BytesIO(self._raw__m_data)) + self._m_data = self._root.ThreadList(io, self, self._root) + self._m_data._read() + elif _on == self._root.StreamTypes.exception: + self._raw__m_data = self._io.read_bytes(self.len_data) + io = KaitaiStream(BytesIO(self._raw__m_data)) + self._m_data = self._root.ExceptionStream(io, self, self._root) + self._m_data._read() + elif _on == self._root.StreamTypes.system_info: + self._raw__m_data = self._io.read_bytes(self.len_data) + io = KaitaiStream(BytesIO(self._raw__m_data)) + self._m_data = self._root.SystemInfo(io, self, self._root) + self._m_data._read() + else: + self._m_data = self._io.read_bytes(self.len_data) + self._debug['_m_data']['end'] = self._io.pos() + self._io.seek(_pos) + return self._m_data if hasattr(self, '_m_data') else None + + + class Thread(KaitaiStruct): + """ + .. seealso:: + Source - https://msdn.microsoft.com/en-us/library/ms680517(v=vs.85).aspx + """ + SEQ_FIELDS = ["thread_id", "suspend_count", "priority_class", "priority", "teb", "stack", "thread_context"] + def __init__(self, _io, _parent=None, _root=None): + self._io = _io + self._parent = _parent + self._root = _root if _root else self + self._debug = collections.defaultdict(dict) + + def _read(self): + self._debug['thread_id']['start'] = self._io.pos() + self.thread_id = self._io.read_u4le() + self._debug['thread_id']['end'] = self._io.pos() + self._debug['suspend_count']['start'] = self._io.pos() + self.suspend_count = self._io.read_u4le() + self._debug['suspend_count']['end'] = self._io.pos() + self._debug['priority_class']['start'] = self._io.pos() + self.priority_class = self._io.read_u4le() + self._debug['priority_class']['end'] = self._io.pos() + self._debug['priority']['start'] = self._io.pos() + self.priority = self._io.read_u4le() + self._debug['priority']['end'] = self._io.pos() + self._debug['teb']['start'] = self._io.pos() + self.teb = self._io.read_u8le() + self._debug['teb']['end'] = self._io.pos() + self._debug['stack']['start'] = self._io.pos() + self.stack = self._root.MemoryDescriptor(self._io, self, self._root) + self.stack._read() + self._debug['stack']['end'] = self._io.pos() + self._debug['thread_context']['start'] = self._io.pos() + self.thread_context = self._root.LocationDescriptor(self._io, self, self._root) + self.thread_context._read() + self._debug['thread_context']['end'] = self._io.pos() + + + class MemoryList(KaitaiStruct): + """ + .. seealso:: + Source - https://msdn.microsoft.com/en-us/library/ms680387(v=vs.85).aspx + """ + SEQ_FIELDS = ["num_mem_ranges", "mem_ranges"] + def __init__(self, _io, _parent=None, _root=None): + self._io = _io + self._parent = _parent + self._root = _root if _root else self + self._debug = collections.defaultdict(dict) + + def _read(self): + self._debug['num_mem_ranges']['start'] = self._io.pos() + self.num_mem_ranges = self._io.read_u4le() + self._debug['num_mem_ranges']['end'] = self._io.pos() + self._debug['mem_ranges']['start'] = self._io.pos() + self.mem_ranges = [None] * (self.num_mem_ranges) + for i in range(self.num_mem_ranges): + if not 'arr' in self._debug['mem_ranges']: + self._debug['mem_ranges']['arr'] = [] + self._debug['mem_ranges']['arr'].append({'start': self._io.pos()}) + _t_mem_ranges = self._root.MemoryDescriptor(self._io, self, self._root) + _t_mem_ranges._read() + self.mem_ranges[i] = _t_mem_ranges + self._debug['mem_ranges']['arr'][i]['end'] = self._io.pos() + + self._debug['mem_ranges']['end'] = self._io.pos() + + + class MemoryDescriptor(KaitaiStruct): + """ + .. seealso:: + Source - https://msdn.microsoft.com/en-us/library/ms680384(v=vs.85).aspx + """ + SEQ_FIELDS = ["addr_memory_range", "memory"] + def __init__(self, _io, _parent=None, _root=None): + self._io = _io + self._parent = _parent + self._root = _root if _root else self + self._debug = collections.defaultdict(dict) + + def _read(self): + self._debug['addr_memory_range']['start'] = self._io.pos() + self.addr_memory_range = self._io.read_u8le() + self._debug['addr_memory_range']['end'] = self._io.pos() + self._debug['memory']['start'] = self._io.pos() + self.memory = self._root.LocationDescriptor(self._io, self, self._root) + self.memory._read() + self._debug['memory']['end'] = self._io.pos() + + + class ExceptionStream(KaitaiStruct): + """ + .. seealso:: + Source - https://msdn.microsoft.com/en-us/library/ms680368(v=vs.85).aspx + """ + SEQ_FIELDS = ["thread_id", "reserved", "exception_rec", "thread_context"] + def __init__(self, _io, _parent=None, _root=None): + self._io = _io + self._parent = _parent + self._root = _root if _root else self + self._debug = collections.defaultdict(dict) + + def _read(self): + self._debug['thread_id']['start'] = self._io.pos() + self.thread_id = self._io.read_u4le() + self._debug['thread_id']['end'] = self._io.pos() + self._debug['reserved']['start'] = self._io.pos() + self.reserved = self._io.read_u4le() + self._debug['reserved']['end'] = self._io.pos() + self._debug['exception_rec']['start'] = self._io.pos() + self.exception_rec = self._root.ExceptionRecord(self._io, self, self._root) + self.exception_rec._read() + self._debug['exception_rec']['end'] = self._io.pos() + self._debug['thread_context']['start'] = self._io.pos() + self.thread_context = self._root.LocationDescriptor(self._io, self, self._root) + self.thread_context._read() + self._debug['thread_context']['end'] = self._io.pos() + + + @property + def streams(self): + if hasattr(self, '_m_streams'): + return self._m_streams if hasattr(self, '_m_streams') else None + + _pos = self._io.pos() + self._io.seek(self.ofs_streams) + self._debug['_m_streams']['start'] = self._io.pos() + self._m_streams = [None] * (self.num_streams) + for i in range(self.num_streams): + if not 'arr' in self._debug['_m_streams']: + self._debug['_m_streams']['arr'] = [] + self._debug['_m_streams']['arr'].append({'start': self._io.pos()}) + _t__m_streams = self._root.Dir(self._io, self, self._root) + _t__m_streams._read() + self._m_streams[i] = _t__m_streams + self._debug['_m_streams']['arr'][i]['end'] = self._io.pos() + + self._debug['_m_streams']['end'] = self._io.pos() + self._io.seek(_pos) + return self._m_streams if hasattr(self, '_m_streams') else None + + diff --git a/python/examples/kaitai/kaitai_struct_formats/windows/windows_resource_file.py b/python/examples/kaitai/kaitai_struct_formats/windows/windows_resource_file.py new file mode 100644 index 00000000..5026cb0f --- /dev/null +++ b/python/examples/kaitai/kaitai_struct_formats/windows/windows_resource_file.py @@ -0,0 +1,243 @@ +from __future__ import absolute_import +# This is a generated file! Please edit source .ksy file and use kaitai-struct-compiler to rebuild + +from pkg_resources import parse_version +from ...kaitaistruct import __version__ as ks_version, KaitaiStruct, KaitaiStream, BytesIO +import collections +from enum import Enum + + +if parse_version(ks_version) < parse_version('0.7'): + raise Exception("Incompatible Kaitai Struct Python API: 0.7 or later is required, but you have %s" % (ks_version)) + +class WindowsResourceFile(KaitaiStruct): + """Windows resource file (.res) are binary bundles of + "resources". Resource has some sort of ID (numerical or string), + type (predefined or user-defined), and raw value. Resource files can + be seen standalone (as .res file), or embedded inside PE executable + (.exe, .dll) files. + + Typical use cases include: + + * providing information about the application (such as title, copyrights, etc) + * embedding icon(s) to be displayed in file managers into .exe + * adding non-code data into the binary, such as menus, dialog forms, + cursor images, fonts, various misc bitmaps, and locale-aware + strings + + Windows provides special API to access "resources" from a binary. + + Normally, resources files are created with `rc` compiler: it takes a + .rc file (so called "resource-definition script") + all the raw + resource binary files for input, and outputs .res file. That .res + file can be linked into an .exe / .dll afterwards using a linker. + + Internally, resource file is just a sequence of individual resource + definitions. RC tool ensures that first resource (#0) is always + empty. + """ + SEQ_FIELDS = ["resources"] + def __init__(self, _io, _parent=None, _root=None): + self._io = _io + self._parent = _parent + self._root = _root if _root else self + self._debug = collections.defaultdict(dict) + + def _read(self): + self._debug['resources']['start'] = self._io.pos() + self.resources = [] + i = 0 + while not self._io.is_eof(): + if not 'arr' in self._debug['resources']: + self._debug['resources']['arr'] = [] + self._debug['resources']['arr'].append({'start': self._io.pos()}) + _t_resources = self._root.Resource(self._io, self, self._root) + _t_resources._read() + self.resources.append(_t_resources) + self._debug['resources']['arr'][len(self.resources) - 1]['end'] = self._io.pos() + i += 1 + + self._debug['resources']['end'] = self._io.pos() + + class Resource(KaitaiStruct): + """Each resource has a `type` and a `name`, which can be used to + identify it, and a `value`. Both `type` and `name` can be a + number or a string. + + .. seealso:: + Source - https://msdn.microsoft.com/en-us/library/windows/desktop/ms648027.aspx + """ + + class PredefTypes(Enum): + cursor = 1 + bitmap = 2 + icon = 3 + menu = 4 + dialog = 5 + string = 6 + fontdir = 7 + font = 8 + accelerator = 9 + rcdata = 10 + messagetable = 11 + group_cursor = 12 + group_icon = 14 + version = 16 + dlginclude = 17 + plugplay = 19 + vxd = 20 + anicursor = 21 + aniicon = 22 + html = 23 + manifest = 24 + SEQ_FIELDS = ["value_size", "header_size", "type", "name", "padding1", "format_version", "flags", "language", "value_version", "characteristics", "value", "padding2"] + def __init__(self, _io, _parent=None, _root=None): + self._io = _io + self._parent = _parent + self._root = _root if _root else self + self._debug = collections.defaultdict(dict) + + def _read(self): + self._debug['value_size']['start'] = self._io.pos() + self.value_size = self._io.read_u4le() + self._debug['value_size']['end'] = self._io.pos() + self._debug['header_size']['start'] = self._io.pos() + self.header_size = self._io.read_u4le() + self._debug['header_size']['end'] = self._io.pos() + self._debug['type']['start'] = self._io.pos() + self.type = self._root.UnicodeOrId(self._io, self, self._root) + self.type._read() + self._debug['type']['end'] = self._io.pos() + self._debug['name']['start'] = self._io.pos() + self.name = self._root.UnicodeOrId(self._io, self, self._root) + self.name._read() + self._debug['name']['end'] = self._io.pos() + self._debug['padding1']['start'] = self._io.pos() + self.padding1 = self._io.read_bytes(((4 - self._io.pos()) % 4)) + self._debug['padding1']['end'] = self._io.pos() + self._debug['format_version']['start'] = self._io.pos() + self.format_version = self._io.read_u4le() + self._debug['format_version']['end'] = self._io.pos() + self._debug['flags']['start'] = self._io.pos() + self.flags = self._io.read_u2le() + self._debug['flags']['end'] = self._io.pos() + self._debug['language']['start'] = self._io.pos() + self.language = self._io.read_u2le() + self._debug['language']['end'] = self._io.pos() + self._debug['value_version']['start'] = self._io.pos() + self.value_version = self._io.read_u4le() + self._debug['value_version']['end'] = self._io.pos() + self._debug['characteristics']['start'] = self._io.pos() + self.characteristics = self._io.read_u4le() + self._debug['characteristics']['end'] = self._io.pos() + self._debug['value']['start'] = self._io.pos() + self.value = self._io.read_bytes(self.value_size) + self._debug['value']['end'] = self._io.pos() + self._debug['padding2']['start'] = self._io.pos() + self.padding2 = self._io.read_bytes(((4 - self._io.pos()) % 4)) + self._debug['padding2']['end'] = self._io.pos() + + @property + def type_as_predef(self): + """Numeric type IDs in range of [0..0xff] are reserved for + system usage in Windows, and there are some predefined, + well-known values in that range. This instance allows to get + it as enum value, if applicable. + """ + if hasattr(self, '_m_type_as_predef'): + return self._m_type_as_predef if hasattr(self, '_m_type_as_predef') else None + + if ((not (self.type.is_string)) and (self.type.as_numeric <= 255)) : + self._m_type_as_predef = KaitaiStream.resolve_enum(self._root.Resource.PredefTypes, self.type.as_numeric) + + return self._m_type_as_predef if hasattr(self, '_m_type_as_predef') else None + + + class UnicodeOrId(KaitaiStruct): + """Resources use a special serialization of names and types: they + can be either a number or a string. + + Use `is_string` to check which kind we've got here, and then use + `as_numeric` or `as_string` to get relevant value. + """ + SEQ_FIELDS = ["first", "as_numeric", "rest", "noop"] + def __init__(self, _io, _parent=None, _root=None): + self._io = _io + self._parent = _parent + self._root = _root if _root else self + self._debug = collections.defaultdict(dict) + + def _read(self): + if self.save_pos1 >= 0: + self._debug['first']['start'] = self._io.pos() + self.first = self._io.read_u2le() + self._debug['first']['end'] = self._io.pos() + + if not (self.is_string): + self._debug['as_numeric']['start'] = self._io.pos() + self.as_numeric = self._io.read_u2le() + self._debug['as_numeric']['end'] = self._io.pos() + + if self.is_string: + self._debug['rest']['start'] = self._io.pos() + self.rest = [] + i = 0 + while True: + if not 'arr' in self._debug['rest']: + self._debug['rest']['arr'] = [] + self._debug['rest']['arr'].append({'start': self._io.pos()}) + _ = self._io.read_u2le() + self.rest.append(_) + self._debug['rest']['arr'][len(self.rest) - 1]['end'] = self._io.pos() + if _ == 0: + break + i += 1 + self._debug['rest']['end'] = self._io.pos() + + if ((self.is_string) and (self.save_pos2 >= 0)) : + self._debug['noop']['start'] = self._io.pos() + self.noop = self._io.read_bytes(0) + self._debug['noop']['end'] = self._io.pos() + + + @property + def save_pos1(self): + if hasattr(self, '_m_save_pos1'): + return self._m_save_pos1 if hasattr(self, '_m_save_pos1') else None + + self._m_save_pos1 = self._io.pos() + return self._m_save_pos1 if hasattr(self, '_m_save_pos1') else None + + @property + def save_pos2(self): + if hasattr(self, '_m_save_pos2'): + return self._m_save_pos2 if hasattr(self, '_m_save_pos2') else None + + self._m_save_pos2 = self._io.pos() + return self._m_save_pos2 if hasattr(self, '_m_save_pos2') else None + + @property + def is_string(self): + if hasattr(self, '_m_is_string'): + return self._m_is_string if hasattr(self, '_m_is_string') else None + + self._m_is_string = self.first != 65535 + return self._m_is_string if hasattr(self, '_m_is_string') else None + + @property + def as_string(self): + if hasattr(self, '_m_as_string'): + return self._m_as_string if hasattr(self, '_m_as_string') else None + + if self.is_string: + _pos = self._io.pos() + self._io.seek(self.save_pos1) + self._debug['_m_as_string']['start'] = self._io.pos() + self._m_as_string = (self._io.read_bytes(((self.save_pos2 - self.save_pos1) - 2))).decode(u"UTF-16LE") + self._debug['_m_as_string']['end'] = self._io.pos() + self._io.seek(_pos) + + return self._m_as_string if hasattr(self, '_m_as_string') else None + + + diff --git a/python/examples/kaitai/kaitai_struct_formats/windows/windows_shell_items.py b/python/examples/kaitai/kaitai_struct_formats/windows/windows_shell_items.py new file mode 100644 index 00000000..a1805915 --- /dev/null +++ b/python/examples/kaitai/kaitai_struct_formats/windows/windows_shell_items.py @@ -0,0 +1,190 @@ +from __future__ import absolute_import +# This is a generated file! Please edit source .ksy file and use kaitai-struct-compiler to rebuild + +from pkg_resources import parse_version +from ...kaitaistruct import __version__ as ks_version, KaitaiStruct, KaitaiStream, BytesIO +import collections + + +if parse_version(ks_version) < parse_version('0.7'): + raise Exception("Incompatible Kaitai Struct Python API: 0.7 or later is required, but you have %s" % (ks_version)) + +class WindowsShellItems(KaitaiStruct): + """Windows Shell Items (AKA "shellbags") is an undocumented set of + structures used internally within Windows to identify paths in + Windows Folder Hierarchy. It is widely used in Windows Shell (and + most visible in File Explorer), both as in-memory and in-file + structures. Some formats embed them, namely: + + * Windows Shell link files (.lnk) Windows registry + * Windows registry "ShellBags" keys + + The format is mostly undocumented, and is known to vary between + various Windows versions. + + .. seealso:: + Source - https://github.com/libyal/libfwsi/blob/master/documentation/Windows%20Shell%20Item%20format.asciidoc + """ + SEQ_FIELDS = ["items"] + def __init__(self, _io, _parent=None, _root=None): + self._io = _io + self._parent = _parent + self._root = _root if _root else self + self._debug = collections.defaultdict(dict) + + def _read(self): + self._debug['items']['start'] = self._io.pos() + self.items = [] + i = 0 + while True: + if not 'arr' in self._debug['items']: + self._debug['items']['arr'] = [] + self._debug['items']['arr'].append({'start': self._io.pos()}) + _t_items = self._root.ShellItem(self._io, self, self._root) + _t_items._read() + _ = _t_items + self.items.append(_) + self._debug['items']['arr'][len(self.items) - 1]['end'] = self._io.pos() + if _.len_data == 0: + break + i += 1 + self._debug['items']['end'] = self._io.pos() + + class ShellItemData(KaitaiStruct): + SEQ_FIELDS = ["code", "body1", "body2"] + def __init__(self, _io, _parent=None, _root=None): + self._io = _io + self._parent = _parent + self._root = _root if _root else self + self._debug = collections.defaultdict(dict) + + def _read(self): + self._debug['code']['start'] = self._io.pos() + self.code = self._io.read_u1() + self._debug['code']['end'] = self._io.pos() + self._debug['body1']['start'] = self._io.pos() + _on = self.code + if _on == 31: + self.body1 = self._root.RootFolderBody(self._io, self, self._root) + self.body1._read() + self._debug['body1']['end'] = self._io.pos() + self._debug['body2']['start'] = self._io.pos() + _on = (self.code & 112) + if _on == 32: + self.body2 = self._root.VolumeBody(self._io, self, self._root) + self.body2._read() + elif _on == 48: + self.body2 = self._root.FileEntryBody(self._io, self, self._root) + self.body2._read() + self._debug['body2']['end'] = self._io.pos() + + + class ShellItem(KaitaiStruct): + """ + .. seealso:: + Section 2.2.2 - https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/MS-SHLLINK/[MS-SHLLINK].pdf + """ + SEQ_FIELDS = ["len_data", "data"] + def __init__(self, _io, _parent=None, _root=None): + self._io = _io + self._parent = _parent + self._root = _root if _root else self + self._debug = collections.defaultdict(dict) + + def _read(self): + self._debug['len_data']['start'] = self._io.pos() + self.len_data = self._io.read_u2le() + self._debug['len_data']['end'] = self._io.pos() + if self.len_data >= 2: + self._debug['data']['start'] = self._io.pos() + self._raw_data = self._io.read_bytes((self.len_data - 2)) + io = KaitaiStream(BytesIO(self._raw_data)) + self.data = self._root.ShellItemData(io, self, self._root) + self.data._read() + self._debug['data']['end'] = self._io.pos() + + + + class RootFolderBody(KaitaiStruct): + """ + .. seealso:: + Source - https://github.com/libyal/libfwsi/blob/master/documentation/Windows%20Shell%20Item%20format.asciidoc#32-root-folder-shell-item + """ + SEQ_FIELDS = ["sort_index", "shell_folder_id"] + def __init__(self, _io, _parent=None, _root=None): + self._io = _io + self._parent = _parent + self._root = _root if _root else self + self._debug = collections.defaultdict(dict) + + def _read(self): + self._debug['sort_index']['start'] = self._io.pos() + self.sort_index = self._io.read_u1() + self._debug['sort_index']['end'] = self._io.pos() + self._debug['shell_folder_id']['start'] = self._io.pos() + self.shell_folder_id = self._io.read_bytes(16) + self._debug['shell_folder_id']['end'] = self._io.pos() + + + class VolumeBody(KaitaiStruct): + """ + .. seealso:: + Source - https://github.com/libyal/libfwsi/blob/master/documentation/Windows%20Shell%20Item%20format.asciidoc#33-volume-shell-item + """ + SEQ_FIELDS = ["flags"] + def __init__(self, _io, _parent=None, _root=None): + self._io = _io + self._parent = _parent + self._root = _root if _root else self + self._debug = collections.defaultdict(dict) + + def _read(self): + self._debug['flags']['start'] = self._io.pos() + self.flags = self._io.read_u1() + self._debug['flags']['end'] = self._io.pos() + + + class FileEntryBody(KaitaiStruct): + """ + .. seealso:: + Source - https://github.com/libyal/libfwsi/blob/master/documentation/Windows%20Shell%20Item%20format.asciidoc#34-file-entry-shell-item + """ + SEQ_FIELDS = ["_unnamed0", "file_size", "last_mod_time", "file_attrs"] + def __init__(self, _io, _parent=None, _root=None): + self._io = _io + self._parent = _parent + self._root = _root if _root else self + self._debug = collections.defaultdict(dict) + + def _read(self): + self._debug['_unnamed0']['start'] = self._io.pos() + self._unnamed0 = self._io.read_u1() + self._debug['_unnamed0']['end'] = self._io.pos() + self._debug['file_size']['start'] = self._io.pos() + self.file_size = self._io.read_u4le() + self._debug['file_size']['end'] = self._io.pos() + self._debug['last_mod_time']['start'] = self._io.pos() + self.last_mod_time = self._io.read_u4le() + self._debug['last_mod_time']['end'] = self._io.pos() + self._debug['file_attrs']['start'] = self._io.pos() + self.file_attrs = self._io.read_u2le() + self._debug['file_attrs']['end'] = self._io.pos() + + @property + def is_dir(self): + if hasattr(self, '_m_is_dir'): + return self._m_is_dir if hasattr(self, '_m_is_dir') else None + + self._m_is_dir = (self._parent.code & 1) != 0 + return self._m_is_dir if hasattr(self, '_m_is_dir') else None + + @property + def is_file(self): + if hasattr(self, '_m_is_file'): + return self._m_is_file if hasattr(self, '_m_is_file') else None + + self._m_is_file = (self._parent.code & 2) != 0 + return self._m_is_file if hasattr(self, '_m_is_file') else None + + + diff --git a/python/examples/kaitai/kaitai_struct_formats/windows/windows_systemtime.py b/python/examples/kaitai/kaitai_struct_formats/windows/windows_systemtime.py new file mode 100644 index 00000000..4d3e288b --- /dev/null +++ b/python/examples/kaitai/kaitai_struct_formats/windows/windows_systemtime.py @@ -0,0 +1,52 @@ +from __future__ import absolute_import +# This is a generated file! Please edit source .ksy file and use kaitai-struct-compiler to rebuild + +from pkg_resources import parse_version +from ...kaitaistruct import __version__ as ks_version, KaitaiStruct, KaitaiStream, BytesIO +import collections + + +if parse_version(ks_version) < parse_version('0.7'): + raise Exception("Incompatible Kaitai Struct Python API: 0.7 or later is required, but you have %s" % (ks_version)) + +class WindowsSystemtime(KaitaiStruct): + """Microsoft Windows SYSTEMTIME structure, stores individual components + of date and time as individual fields, up to millisecond precision. + + .. seealso:: + Source - https://msdn.microsoft.com/en-us/library/windows/desktop/ms724950.aspx + """ + SEQ_FIELDS = ["year", "month", "dow", "day", "hour", "min", "sec", "msec"] + def __init__(self, _io, _parent=None, _root=None): + self._io = _io + self._parent = _parent + self._root = _root if _root else self + self._debug = collections.defaultdict(dict) + + def _read(self): + self._debug['year']['start'] = self._io.pos() + self.year = self._io.read_u2le() + self._debug['year']['end'] = self._io.pos() + self._debug['month']['start'] = self._io.pos() + self.month = self._io.read_u2le() + self._debug['month']['end'] = self._io.pos() + self._debug['dow']['start'] = self._io.pos() + self.dow = self._io.read_u2le() + self._debug['dow']['end'] = self._io.pos() + self._debug['day']['start'] = self._io.pos() + self.day = self._io.read_u2le() + self._debug['day']['end'] = self._io.pos() + self._debug['hour']['start'] = self._io.pos() + self.hour = self._io.read_u2le() + self._debug['hour']['end'] = self._io.pos() + self._debug['min']['start'] = self._io.pos() + self.min = self._io.read_u2le() + self._debug['min']['end'] = self._io.pos() + self._debug['sec']['start'] = self._io.pos() + self.sec = self._io.read_u2le() + self._debug['sec']['end'] = self._io.pos() + self._debug['msec']['start'] = self._io.pos() + self.msec = self._io.read_u2le() + self._debug['msec']['end'] = self._io.pos() + + |