summaryrefslogtreecommitdiff
path: root/python/examples/kaitai/windows_shell_items.py
diff options
context:
space:
mode:
authorAndrew Lamoureux <andrew@vector35.com>2019-03-19 17:32:44 -0400
committerRusty Wagner <rusty@vector35.com>2019-03-20 13:00:17 -0400
commit24ead55316ac8497df5842caf4e1d51f2b799787 (patch)
tree3dfdfae8a076445c9d24bf6d1b40e57f36ebf94a /python/examples/kaitai/windows_shell_items.py
parent411acbaa4a1d217e731d3df0b189445117be3b26 (diff)
kaitai: adjustments and rearrangements for python2/3 compat
Diffstat (limited to 'python/examples/kaitai/windows_shell_items.py')
-rw-r--r--python/examples/kaitai/windows_shell_items.py189
1 files changed, 189 insertions, 0 deletions
diff --git a/python/examples/kaitai/windows_shell_items.py b/python/examples/kaitai/windows_shell_items.py
new file mode 100644
index 00000000..93a1ccbc
--- /dev/null
+++ b/python/examples/kaitai/windows_shell_items.py
@@ -0,0 +1,189 @@
+# This is a generated file! Please edit source .ksy file and use kaitai-struct-compiler to rebuild
+
+from pkg_resources import parse_version
+from .kaitaistruct import __version__ as ks_version, KaitaiStruct, KaitaiStream, BytesIO
+import collections
+
+
+if parse_version(ks_version) < parse_version('0.7'):
+ raise Exception("Incompatible Kaitai Struct Python API: 0.7 or later is required, but you have %s" % (ks_version))
+
+class WindowsShellItems(KaitaiStruct):
+ """Windows Shell Items (AKA "shellbags") is an undocumented set of
+ structures used internally within Windows to identify paths in
+ Windows Folder Hierarchy. It is widely used in Windows Shell (and
+ most visible in File Explorer), both as in-memory and in-file
+ structures. Some formats embed them, namely:
+
+ * Windows Shell link files (.lnk) Windows registry
+ * Windows registry "ShellBags" keys
+
+ The format is mostly undocumented, and is known to vary between
+ various Windows versions.
+
+ .. seealso::
+ Source - https://github.com/libyal/libfwsi/blob/master/documentation/Windows%20Shell%20Item%20format.asciidoc
+ """
+ SEQ_FIELDS = ["items"]
+ def __init__(self, _io, _parent=None, _root=None):
+ self._io = _io
+ self._parent = _parent
+ self._root = _root if _root else self
+ self._debug = collections.defaultdict(dict)
+
+ def _read(self):
+ self._debug['items']['start'] = self._io.pos()
+ self.items = []
+ i = 0
+ while True:
+ if not 'arr' in self._debug['items']:
+ self._debug['items']['arr'] = []
+ self._debug['items']['arr'].append({'start': self._io.pos()})
+ _t_items = self._root.ShellItem(self._io, self, self._root)
+ _t_items._read()
+ _ = _t_items
+ self.items.append(_)
+ self._debug['items']['arr'][len(self.items) - 1]['end'] = self._io.pos()
+ if _.len_data == 0:
+ break
+ i += 1
+ self._debug['items']['end'] = self._io.pos()
+
+ class ShellItemData(KaitaiStruct):
+ SEQ_FIELDS = ["code", "body1", "body2"]
+ def __init__(self, _io, _parent=None, _root=None):
+ self._io = _io
+ self._parent = _parent
+ self._root = _root if _root else self
+ self._debug = collections.defaultdict(dict)
+
+ def _read(self):
+ self._debug['code']['start'] = self._io.pos()
+ self.code = self._io.read_u1()
+ self._debug['code']['end'] = self._io.pos()
+ self._debug['body1']['start'] = self._io.pos()
+ _on = self.code
+ if _on == 31:
+ self.body1 = self._root.RootFolderBody(self._io, self, self._root)
+ self.body1._read()
+ self._debug['body1']['end'] = self._io.pos()
+ self._debug['body2']['start'] = self._io.pos()
+ _on = (self.code & 112)
+ if _on == 32:
+ self.body2 = self._root.VolumeBody(self._io, self, self._root)
+ self.body2._read()
+ elif _on == 48:
+ self.body2 = self._root.FileEntryBody(self._io, self, self._root)
+ self.body2._read()
+ self._debug['body2']['end'] = self._io.pos()
+
+
+ class ShellItem(KaitaiStruct):
+ """
+ .. seealso::
+ Section 2.2.2 - https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/MS-SHLLINK/[MS-SHLLINK].pdf
+ """
+ SEQ_FIELDS = ["len_data", "data"]
+ def __init__(self, _io, _parent=None, _root=None):
+ self._io = _io
+ self._parent = _parent
+ self._root = _root if _root else self
+ self._debug = collections.defaultdict(dict)
+
+ def _read(self):
+ self._debug['len_data']['start'] = self._io.pos()
+ self.len_data = self._io.read_u2le()
+ self._debug['len_data']['end'] = self._io.pos()
+ if self.len_data >= 2:
+ self._debug['data']['start'] = self._io.pos()
+ self._raw_data = self._io.read_bytes((self.len_data - 2))
+ io = KaitaiStream(BytesIO(self._raw_data))
+ self.data = self._root.ShellItemData(io, self, self._root)
+ self.data._read()
+ self._debug['data']['end'] = self._io.pos()
+
+
+
+ class RootFolderBody(KaitaiStruct):
+ """
+ .. seealso::
+ Source - https://github.com/libyal/libfwsi/blob/master/documentation/Windows%20Shell%20Item%20format.asciidoc#32-root-folder-shell-item
+ """
+ SEQ_FIELDS = ["sort_index", "shell_folder_id"]
+ def __init__(self, _io, _parent=None, _root=None):
+ self._io = _io
+ self._parent = _parent
+ self._root = _root if _root else self
+ self._debug = collections.defaultdict(dict)
+
+ def _read(self):
+ self._debug['sort_index']['start'] = self._io.pos()
+ self.sort_index = self._io.read_u1()
+ self._debug['sort_index']['end'] = self._io.pos()
+ self._debug['shell_folder_id']['start'] = self._io.pos()
+ self.shell_folder_id = self._io.read_bytes(16)
+ self._debug['shell_folder_id']['end'] = self._io.pos()
+
+
+ class VolumeBody(KaitaiStruct):
+ """
+ .. seealso::
+ Source - https://github.com/libyal/libfwsi/blob/master/documentation/Windows%20Shell%20Item%20format.asciidoc#33-volume-shell-item
+ """
+ SEQ_FIELDS = ["flags"]
+ def __init__(self, _io, _parent=None, _root=None):
+ self._io = _io
+ self._parent = _parent
+ self._root = _root if _root else self
+ self._debug = collections.defaultdict(dict)
+
+ def _read(self):
+ self._debug['flags']['start'] = self._io.pos()
+ self.flags = self._io.read_u1()
+ self._debug['flags']['end'] = self._io.pos()
+
+
+ class FileEntryBody(KaitaiStruct):
+ """
+ .. seealso::
+ Source - https://github.com/libyal/libfwsi/blob/master/documentation/Windows%20Shell%20Item%20format.asciidoc#34-file-entry-shell-item
+ """
+ SEQ_FIELDS = ["_unnamed0", "file_size", "last_mod_time", "file_attrs"]
+ def __init__(self, _io, _parent=None, _root=None):
+ self._io = _io
+ self._parent = _parent
+ self._root = _root if _root else self
+ self._debug = collections.defaultdict(dict)
+
+ def _read(self):
+ self._debug['_unnamed0']['start'] = self._io.pos()
+ self._unnamed0 = self._io.read_u1()
+ self._debug['_unnamed0']['end'] = self._io.pos()
+ self._debug['file_size']['start'] = self._io.pos()
+ self.file_size = self._io.read_u4le()
+ self._debug['file_size']['end'] = self._io.pos()
+ self._debug['last_mod_time']['start'] = self._io.pos()
+ self.last_mod_time = self._io.read_u4le()
+ self._debug['last_mod_time']['end'] = self._io.pos()
+ self._debug['file_attrs']['start'] = self._io.pos()
+ self.file_attrs = self._io.read_u2le()
+ self._debug['file_attrs']['end'] = self._io.pos()
+
+ @property
+ def is_dir(self):
+ if hasattr(self, '_m_is_dir'):
+ return self._m_is_dir if hasattr(self, '_m_is_dir') else None
+
+ self._m_is_dir = (self._parent.code & 1) != 0
+ return self._m_is_dir if hasattr(self, '_m_is_dir') else None
+
+ @property
+ def is_file(self):
+ if hasattr(self, '_m_is_file'):
+ return self._m_is_file if hasattr(self, '_m_is_file') else None
+
+ self._m_is_file = (self._parent.code & 2) != 0
+ return self._m_is_file if hasattr(self, '_m_is_file') else None
+
+
+