diff options
Diffstat (limited to 'python/examples/kaitai/kaitai_struct_formats/windows')
7 files changed, 0 insertions, 2052 deletions
diff --git a/python/examples/kaitai/kaitai_struct_formats/windows/__init__.py b/python/examples/kaitai/kaitai_struct_formats/windows/__init__.py deleted file mode 100644 index e69de29b..00000000 --- a/python/examples/kaitai/kaitai_struct_formats/windows/__init__.py +++ /dev/null diff --git a/python/examples/kaitai/kaitai_struct_formats/windows/regf.py b/python/examples/kaitai/kaitai_struct_formats/windows/regf.py deleted file mode 100644 index 13145ad1..00000000 --- a/python/examples/kaitai/kaitai_struct_formats/windows/regf.py +++ /dev/null @@ -1,565 +0,0 @@ -from __future__ import absolute_import -# This is a generated file! Please edit source .ksy file and use kaitai-struct-compiler to rebuild - -from pkg_resources import parse_version -from ...kaitaistruct import __version__ as ks_version, KaitaiStruct, KaitaiStream, BytesIO -import collections -from enum import Enum - - -if parse_version(ks_version) < parse_version('0.7'): - raise Exception("Incompatible Kaitai Struct Python API: 0.7 or later is required, but you have %s" % (ks_version)) - -class Regf(KaitaiStruct): - """This spec allows to parse files used by Microsoft Windows family of - operating systems to store parts of its "registry". "Registry" is a - hierarchical database that is used to store system settings (global - configuration, per-user, per-application configuration, etc). - - Typically, registry files are stored in: - - * System-wide: several files in `%SystemRoot%\System32\Config\` - * User-wide: - * `%USERPROFILE%\Ntuser.dat` - * `%USERPROFILE%\Local Settings\Application Data\Microsoft\Windows\Usrclass.dat` (localized, Windows 2000, Server 2003 and Windows XP) - * `%USERPROFILE%\AppData\Local\Microsoft\Windows\Usrclass.dat` (non-localized, Windows Vista and later) - - Note that one typically can't access files directly on a mounted - filesystem with a running Windows OS. - - .. seealso:: - Source - https://github.com/libyal/libregf/blob/master/documentation/Windows%20NT%20Registry%20File%20(REGF)%20format.asciidoc - """ - SEQ_FIELDS = ["header", "hive_bins"] - def __init__(self, _io, _parent=None, _root=None): - self._io = _io - self._parent = _parent - self._root = _root if _root else self - self._debug = collections.defaultdict(dict) - - def _read(self): - self._debug['header']['start'] = self._io.pos() - self.header = self._root.FileHeader(self._io, self, self._root) - self.header._read() - self._debug['header']['end'] = self._io.pos() - self._debug['hive_bins']['start'] = self._io.pos() - self._raw_hive_bins = [] - self.hive_bins = [] - i = 0 - while not self._io.is_eof(): - if not 'arr' in self._debug['hive_bins']: - self._debug['hive_bins']['arr'] = [] - self._debug['hive_bins']['arr'].append({'start': self._io.pos()}) - self._raw_hive_bins.append(self._io.read_bytes(4096)) - io = KaitaiStream(BytesIO(self._raw_hive_bins[-1])) - _t_hive_bins = self._root.HiveBin(io, self, self._root) - _t_hive_bins._read() - self.hive_bins.append(_t_hive_bins) - self._debug['hive_bins']['arr'][len(self.hive_bins) - 1]['end'] = self._io.pos() - i += 1 - - self._debug['hive_bins']['end'] = self._io.pos() - - class Filetime(KaitaiStruct): - SEQ_FIELDS = ["value"] - def __init__(self, _io, _parent=None, _root=None): - self._io = _io - self._parent = _parent - self._root = _root if _root else self - self._debug = collections.defaultdict(dict) - - def _read(self): - self._debug['value']['start'] = self._io.pos() - self.value = self._io.read_u8le() - self._debug['value']['end'] = self._io.pos() - - - class HiveBin(KaitaiStruct): - SEQ_FIELDS = ["header", "cells"] - def __init__(self, _io, _parent=None, _root=None): - self._io = _io - self._parent = _parent - self._root = _root if _root else self - self._debug = collections.defaultdict(dict) - - def _read(self): - self._debug['header']['start'] = self._io.pos() - self.header = self._root.HiveBinHeader(self._io, self, self._root) - self.header._read() - self._debug['header']['end'] = self._io.pos() - self._debug['cells']['start'] = self._io.pos() - self.cells = [] - i = 0 - while not self._io.is_eof(): - if not 'arr' in self._debug['cells']: - self._debug['cells']['arr'] = [] - self._debug['cells']['arr'].append({'start': self._io.pos()}) - _t_cells = self._root.HiveBinCell(self._io, self, self._root) - _t_cells._read() - self.cells.append(_t_cells) - self._debug['cells']['arr'][len(self.cells) - 1]['end'] = self._io.pos() - i += 1 - - self._debug['cells']['end'] = self._io.pos() - - - class HiveBinHeader(KaitaiStruct): - SEQ_FIELDS = ["signature", "offset", "size", "unknown1", "unknown2", "timestamp", "unknown4"] - def __init__(self, _io, _parent=None, _root=None): - self._io = _io - self._parent = _parent - self._root = _root if _root else self - self._debug = collections.defaultdict(dict) - - def _read(self): - self._debug['signature']['start'] = self._io.pos() - self.signature = self._io.ensure_fixed_contents(b"\x68\x62\x69\x6E") - self._debug['signature']['end'] = self._io.pos() - self._debug['offset']['start'] = self._io.pos() - self.offset = self._io.read_u4le() - self._debug['offset']['end'] = self._io.pos() - self._debug['size']['start'] = self._io.pos() - self.size = self._io.read_u4le() - self._debug['size']['end'] = self._io.pos() - self._debug['unknown1']['start'] = self._io.pos() - self.unknown1 = self._io.read_u4le() - self._debug['unknown1']['end'] = self._io.pos() - self._debug['unknown2']['start'] = self._io.pos() - self.unknown2 = self._io.read_u4le() - self._debug['unknown2']['end'] = self._io.pos() - self._debug['timestamp']['start'] = self._io.pos() - self.timestamp = self._root.Filetime(self._io, self, self._root) - self.timestamp._read() - self._debug['timestamp']['end'] = self._io.pos() - self._debug['unknown4']['start'] = self._io.pos() - self.unknown4 = self._io.read_u4le() - self._debug['unknown4']['end'] = self._io.pos() - - - class HiveBinCell(KaitaiStruct): - SEQ_FIELDS = ["cell_size_raw", "identifier", "data"] - def __init__(self, _io, _parent=None, _root=None): - self._io = _io - self._parent = _parent - self._root = _root if _root else self - self._debug = collections.defaultdict(dict) - - def _read(self): - self._debug['cell_size_raw']['start'] = self._io.pos() - self.cell_size_raw = self._io.read_s4le() - self._debug['cell_size_raw']['end'] = self._io.pos() - self._debug['identifier']['start'] = self._io.pos() - self.identifier = (self._io.read_bytes(2)).decode(u"ascii") - self._debug['identifier']['end'] = self._io.pos() - self._debug['data']['start'] = self._io.pos() - _on = self.identifier - if _on == u"li": - self._raw_data = self._io.read_bytes(((self.cell_size - 2) - 4)) - io = KaitaiStream(BytesIO(self._raw_data)) - self.data = self._root.HiveBinCell.SubKeyListLi(io, self, self._root) - self.data._read() - elif _on == u"vk": - self._raw_data = self._io.read_bytes(((self.cell_size - 2) - 4)) - io = KaitaiStream(BytesIO(self._raw_data)) - self.data = self._root.HiveBinCell.SubKeyListVk(io, self, self._root) - self.data._read() - elif _on == u"lf": - self._raw_data = self._io.read_bytes(((self.cell_size - 2) - 4)) - io = KaitaiStream(BytesIO(self._raw_data)) - self.data = self._root.HiveBinCell.SubKeyListLhLf(io, self, self._root) - self.data._read() - elif _on == u"ri": - self._raw_data = self._io.read_bytes(((self.cell_size - 2) - 4)) - io = KaitaiStream(BytesIO(self._raw_data)) - self.data = self._root.HiveBinCell.SubKeyListRi(io, self, self._root) - self.data._read() - elif _on == u"lh": - self._raw_data = self._io.read_bytes(((self.cell_size - 2) - 4)) - io = KaitaiStream(BytesIO(self._raw_data)) - self.data = self._root.HiveBinCell.SubKeyListLhLf(io, self, self._root) - self.data._read() - elif _on == u"nk": - self._raw_data = self._io.read_bytes(((self.cell_size - 2) - 4)) - io = KaitaiStream(BytesIO(self._raw_data)) - self.data = self._root.HiveBinCell.NamedKey(io, self, self._root) - self.data._read() - elif _on == u"sk": - self._raw_data = self._io.read_bytes(((self.cell_size - 2) - 4)) - io = KaitaiStream(BytesIO(self._raw_data)) - self.data = self._root.HiveBinCell.SubKeyListSk(io, self, self._root) - self.data._read() - else: - self.data = self._io.read_bytes(((self.cell_size - 2) - 4)) - self._debug['data']['end'] = self._io.pos() - - class SubKeyListVk(KaitaiStruct): - - class DataTypeEnum(Enum): - reg_none = 0 - reg_sz = 1 - reg_expand_sz = 2 - reg_binary = 3 - reg_dword = 4 - reg_dword_big_endian = 5 - reg_link = 6 - reg_multi_sz = 7 - reg_resource_list = 8 - reg_full_resource_descriptor = 9 - reg_resource_requirements_list = 10 - reg_qword = 11 - - class VkFlags(Enum): - value_comp_name = 1 - SEQ_FIELDS = ["value_name_size", "data_size", "data_offset", "data_type", "flags", "padding", "value_name"] - def __init__(self, _io, _parent=None, _root=None): - self._io = _io - self._parent = _parent - self._root = _root if _root else self - self._debug = collections.defaultdict(dict) - - def _read(self): - self._debug['value_name_size']['start'] = self._io.pos() - self.value_name_size = self._io.read_u2le() - self._debug['value_name_size']['end'] = self._io.pos() - self._debug['data_size']['start'] = self._io.pos() - self.data_size = self._io.read_u4le() - self._debug['data_size']['end'] = self._io.pos() - self._debug['data_offset']['start'] = self._io.pos() - self.data_offset = self._io.read_u4le() - self._debug['data_offset']['end'] = self._io.pos() - self._debug['data_type']['start'] = self._io.pos() - self.data_type = KaitaiStream.resolve_enum(self._root.HiveBinCell.SubKeyListVk.DataTypeEnum, self._io.read_u4le()) - self._debug['data_type']['end'] = self._io.pos() - self._debug['flags']['start'] = self._io.pos() - self.flags = KaitaiStream.resolve_enum(self._root.HiveBinCell.SubKeyListVk.VkFlags, self._io.read_u2le()) - self._debug['flags']['end'] = self._io.pos() - self._debug['padding']['start'] = self._io.pos() - self.padding = self._io.read_u2le() - self._debug['padding']['end'] = self._io.pos() - if self.flags == self._root.HiveBinCell.SubKeyListVk.VkFlags.value_comp_name: - self._debug['value_name']['start'] = self._io.pos() - self.value_name = (self._io.read_bytes(self.value_name_size)).decode(u"ascii") - self._debug['value_name']['end'] = self._io.pos() - - - - class SubKeyListLhLf(KaitaiStruct): - SEQ_FIELDS = ["count", "items"] - def __init__(self, _io, _parent=None, _root=None): - self._io = _io - self._parent = _parent - self._root = _root if _root else self - self._debug = collections.defaultdict(dict) - - def _read(self): - self._debug['count']['start'] = self._io.pos() - self.count = self._io.read_u2le() - self._debug['count']['end'] = self._io.pos() - self._debug['items']['start'] = self._io.pos() - self.items = [None] * (self.count) - for i in range(self.count): - if not 'arr' in self._debug['items']: - self._debug['items']['arr'] = [] - self._debug['items']['arr'].append({'start': self._io.pos()}) - _t_items = self._root.HiveBinCell.SubKeyListLhLf.Item(self._io, self, self._root) - _t_items._read() - self.items[i] = _t_items - self._debug['items']['arr'][i]['end'] = self._io.pos() - - self._debug['items']['end'] = self._io.pos() - - class Item(KaitaiStruct): - SEQ_FIELDS = ["named_key_offset", "hash_value"] - def __init__(self, _io, _parent=None, _root=None): - self._io = _io - self._parent = _parent - self._root = _root if _root else self - self._debug = collections.defaultdict(dict) - - def _read(self): - self._debug['named_key_offset']['start'] = self._io.pos() - self.named_key_offset = self._io.read_u4le() - self._debug['named_key_offset']['end'] = self._io.pos() - self._debug['hash_value']['start'] = self._io.pos() - self.hash_value = self._io.read_u4le() - self._debug['hash_value']['end'] = self._io.pos() - - - - class SubKeyListSk(KaitaiStruct): - SEQ_FIELDS = ["unknown1", "previous_security_key_offset", "next_security_key_offset", "reference_count"] - def __init__(self, _io, _parent=None, _root=None): - self._io = _io - self._parent = _parent - self._root = _root if _root else self - self._debug = collections.defaultdict(dict) - - def _read(self): - self._debug['unknown1']['start'] = self._io.pos() - self.unknown1 = self._io.read_u2le() - self._debug['unknown1']['end'] = self._io.pos() - self._debug['previous_security_key_offset']['start'] = self._io.pos() - self.previous_security_key_offset = self._io.read_u4le() - self._debug['previous_security_key_offset']['end'] = self._io.pos() - self._debug['next_security_key_offset']['start'] = self._io.pos() - self.next_security_key_offset = self._io.read_u4le() - self._debug['next_security_key_offset']['end'] = self._io.pos() - self._debug['reference_count']['start'] = self._io.pos() - self.reference_count = self._io.read_u4le() - self._debug['reference_count']['end'] = self._io.pos() - - - class SubKeyListLi(KaitaiStruct): - SEQ_FIELDS = ["count", "items"] - def __init__(self, _io, _parent=None, _root=None): - self._io = _io - self._parent = _parent - self._root = _root if _root else self - self._debug = collections.defaultdict(dict) - - def _read(self): - self._debug['count']['start'] = self._io.pos() - self.count = self._io.read_u2le() - self._debug['count']['end'] = self._io.pos() - self._debug['items']['start'] = self._io.pos() - self.items = [None] * (self.count) - for i in range(self.count): - if not 'arr' in self._debug['items']: - self._debug['items']['arr'] = [] - self._debug['items']['arr'].append({'start': self._io.pos()}) - _t_items = self._root.HiveBinCell.SubKeyListLi.Item(self._io, self, self._root) - _t_items._read() - self.items[i] = _t_items - self._debug['items']['arr'][i]['end'] = self._io.pos() - - self._debug['items']['end'] = self._io.pos() - - class Item(KaitaiStruct): - SEQ_FIELDS = ["named_key_offset"] - def __init__(self, _io, _parent=None, _root=None): - self._io = _io - self._parent = _parent - self._root = _root if _root else self - self._debug = collections.defaultdict(dict) - - def _read(self): - self._debug['named_key_offset']['start'] = self._io.pos() - self.named_key_offset = self._io.read_u4le() - self._debug['named_key_offset']['end'] = self._io.pos() - - - - class NamedKey(KaitaiStruct): - - class NkFlags(Enum): - key_is_volatile = 1 - key_hive_exit = 2 - key_hive_entry = 4 - key_no_delete = 8 - key_sym_link = 16 - key_comp_name = 32 - key_prefef_handle = 64 - key_virt_mirrored = 128 - key_virt_target = 256 - key_virtual_store = 512 - unknown1 = 4096 - unknown2 = 16384 - SEQ_FIELDS = ["flags", "last_key_written_date_and_time", "unknown1", "parent_key_offset", "number_of_sub_keys", "number_of_volatile_sub_keys", "sub_keys_list_offset", "number_of_values", "values_list_offset", "security_key_offset", "class_name_offset", "largest_sub_key_name_size", "largest_sub_key_class_name_size", "largest_value_name_size", "largest_value_data_size", "unknown2", "key_name_size", "class_name_size", "unknown_string_size", "unknown_string"] - def __init__(self, _io, _parent=None, _root=None): - self._io = _io - self._parent = _parent - self._root = _root if _root else self - self._debug = collections.defaultdict(dict) - - def _read(self): - self._debug['flags']['start'] = self._io.pos() - self.flags = KaitaiStream.resolve_enum(self._root.HiveBinCell.NamedKey.NkFlags, self._io.read_u2le()) - self._debug['flags']['end'] = self._io.pos() - self._debug['last_key_written_date_and_time']['start'] = self._io.pos() - self.last_key_written_date_and_time = self._root.Filetime(self._io, self, self._root) - self.last_key_written_date_and_time._read() - self._debug['last_key_written_date_and_time']['end'] = self._io.pos() - self._debug['unknown1']['start'] = self._io.pos() - self.unknown1 = self._io.read_u4le() - self._debug['unknown1']['end'] = self._io.pos() - self._debug['parent_key_offset']['start'] = self._io.pos() - self.parent_key_offset = self._io.read_u4le() - self._debug['parent_key_offset']['end'] = self._io.pos() - self._debug['number_of_sub_keys']['start'] = self._io.pos() - self.number_of_sub_keys = self._io.read_u4le() - self._debug['number_of_sub_keys']['end'] = self._io.pos() - self._debug['number_of_volatile_sub_keys']['start'] = self._io.pos() - self.number_of_volatile_sub_keys = self._io.read_u4le() - self._debug['number_of_volatile_sub_keys']['end'] = self._io.pos() - self._debug['sub_keys_list_offset']['start'] = self._io.pos() - self.sub_keys_list_offset = self._io.read_u4le() - self._debug['sub_keys_list_offset']['end'] = self._io.pos() - self._debug['number_of_values']['start'] = self._io.pos() - self.number_of_values = self._io.read_u4le() - self._debug['number_of_values']['end'] = self._io.pos() - self._debug['values_list_offset']['start'] = self._io.pos() - self.values_list_offset = self._io.read_u4le() - self._debug['values_list_offset']['end'] = self._io.pos() - self._debug['security_key_offset']['start'] = self._io.pos() - self.security_key_offset = self._io.read_u4le() - self._debug['security_key_offset']['end'] = self._io.pos() - self._debug['class_name_offset']['start'] = self._io.pos() - self.class_name_offset = self._io.read_u4le() - self._debug['class_name_offset']['end'] = self._io.pos() - self._debug['largest_sub_key_name_size']['start'] = self._io.pos() - self.largest_sub_key_name_size = self._io.read_u4le() - self._debug['largest_sub_key_name_size']['end'] = self._io.pos() - self._debug['largest_sub_key_class_name_size']['start'] = self._io.pos() - self.largest_sub_key_class_name_size = self._io.read_u4le() - self._debug['largest_sub_key_class_name_size']['end'] = self._io.pos() - self._debug['largest_value_name_size']['start'] = self._io.pos() - self.largest_value_name_size = self._io.read_u4le() - self._debug['largest_value_name_size']['end'] = self._io.pos() - self._debug['largest_value_data_size']['start'] = self._io.pos() - self.largest_value_data_size = self._io.read_u4le() - self._debug['largest_value_data_size']['end'] = self._io.pos() - self._debug['unknown2']['start'] = self._io.pos() - self.unknown2 = self._io.read_u4le() - self._debug['unknown2']['end'] = self._io.pos() - self._debug['key_name_size']['start'] = self._io.pos() - self.key_name_size = self._io.read_u2le() - self._debug['key_name_size']['end'] = self._io.pos() - self._debug['class_name_size']['start'] = self._io.pos() - self.class_name_size = self._io.read_u2le() - self._debug['class_name_size']['end'] = self._io.pos() - self._debug['unknown_string_size']['start'] = self._io.pos() - self.unknown_string_size = self._io.read_u4le() - self._debug['unknown_string_size']['end'] = self._io.pos() - self._debug['unknown_string']['start'] = self._io.pos() - self.unknown_string = (self._io.read_bytes(self.unknown_string_size)).decode(u"ascii") - self._debug['unknown_string']['end'] = self._io.pos() - - - class SubKeyListRi(KaitaiStruct): - SEQ_FIELDS = ["count", "items"] - def __init__(self, _io, _parent=None, _root=None): - self._io = _io - self._parent = _parent - self._root = _root if _root else self - self._debug = collections.defaultdict(dict) - - def _read(self): - self._debug['count']['start'] = self._io.pos() - self.count = self._io.read_u2le() - self._debug['count']['end'] = self._io.pos() - self._debug['items']['start'] = self._io.pos() - self.items = [None] * (self.count) - for i in range(self.count): - if not 'arr' in self._debug['items']: - self._debug['items']['arr'] = [] - self._debug['items']['arr'].append({'start': self._io.pos()}) - _t_items = self._root.HiveBinCell.SubKeyListRi.Item(self._io, self, self._root) - _t_items._read() - self.items[i] = _t_items - self._debug['items']['arr'][i]['end'] = self._io.pos() - - self._debug['items']['end'] = self._io.pos() - - class Item(KaitaiStruct): - SEQ_FIELDS = ["sub_key_list_offset"] - def __init__(self, _io, _parent=None, _root=None): - self._io = _io - self._parent = _parent - self._root = _root if _root else self - self._debug = collections.defaultdict(dict) - - def _read(self): - self._debug['sub_key_list_offset']['start'] = self._io.pos() - self.sub_key_list_offset = self._io.read_u4le() - self._debug['sub_key_list_offset']['end'] = self._io.pos() - - - - @property - def cell_size(self): - if hasattr(self, '_m_cell_size'): - return self._m_cell_size if hasattr(self, '_m_cell_size') else None - - self._m_cell_size = ((-1 if self.cell_size_raw < 0 else 1) * self.cell_size_raw) - return self._m_cell_size if hasattr(self, '_m_cell_size') else None - - @property - def is_allocated(self): - if hasattr(self, '_m_is_allocated'): - return self._m_is_allocated if hasattr(self, '_m_is_allocated') else None - - self._m_is_allocated = self.cell_size_raw < 0 - return self._m_is_allocated if hasattr(self, '_m_is_allocated') else None - - - class FileHeader(KaitaiStruct): - - class FileType(Enum): - normal = 0 - transaction_log = 1 - - class FileFormat(Enum): - direct_memory_load = 1 - SEQ_FIELDS = ["signature", "primary_sequence_number", "secondary_sequence_number", "last_modification_date_and_time", "major_version", "minor_version", "type", "format", "root_key_offset", "hive_bins_data_size", "clustering_factor", "unknown1", "unknown2", "checksum", "reserved", "boot_type", "boot_recover"] - def __init__(self, _io, _parent=None, _root=None): - self._io = _io - self._parent = _parent - self._root = _root if _root else self - self._debug = collections.defaultdict(dict) - - def _read(self): - self._debug['signature']['start'] = self._io.pos() - self.signature = self._io.ensure_fixed_contents(b"\x72\x65\x67\x66") - self._debug['signature']['end'] = self._io.pos() - self._debug['primary_sequence_number']['start'] = self._io.pos() - self.primary_sequence_number = self._io.read_u4le() - self._debug['primary_sequence_number']['end'] = self._io.pos() - self._debug['secondary_sequence_number']['start'] = self._io.pos() - self.secondary_sequence_number = self._io.read_u4le() - self._debug['secondary_sequence_number']['end'] = self._io.pos() - self._debug['last_modification_date_and_time']['start'] = self._io.pos() - self.last_modification_date_and_time = self._root.Filetime(self._io, self, self._root) - self.last_modification_date_and_time._read() - self._debug['last_modification_date_and_time']['end'] = self._io.pos() - self._debug['major_version']['start'] = self._io.pos() - self.major_version = self._io.read_u4le() - self._debug['major_version']['end'] = self._io.pos() - self._debug['minor_version']['start'] = self._io.pos() - self.minor_version = self._io.read_u4le() - self._debug['minor_version']['end'] = self._io.pos() - self._debug['type']['start'] = self._io.pos() - self.type = KaitaiStream.resolve_enum(self._root.FileHeader.FileType, self._io.read_u4le()) - self._debug['type']['end'] = self._io.pos() - self._debug['format']['start'] = self._io.pos() - self.format = KaitaiStream.resolve_enum(self._root.FileHeader.FileFormat, self._io.read_u4le()) - self._debug['format']['end'] = self._io.pos() - self._debug['root_key_offset']['start'] = self._io.pos() - self.root_key_offset = self._io.read_u4le() - self._debug['root_key_offset']['end'] = self._io.pos() - self._debug['hive_bins_data_size']['start'] = self._io.pos() - self.hive_bins_data_size = self._io.read_u4le() - self._debug['hive_bins_data_size']['end'] = self._io.pos() - self._debug['clustering_factor']['start'] = self._io.pos() - self.clustering_factor = self._io.read_u4le() - self._debug['clustering_factor']['end'] = self._io.pos() - self._debug['unknown1']['start'] = self._io.pos() - self.unknown1 = self._io.read_bytes(64) - self._debug['unknown1']['end'] = self._io.pos() - self._debug['unknown2']['start'] = self._io.pos() - self.unknown2 = self._io.read_bytes(396) - self._debug['unknown2']['end'] = self._io.pos() - self._debug['checksum']['start'] = self._io.pos() - self.checksum = self._io.read_u4le() - self._debug['checksum']['end'] = self._io.pos() - self._debug['reserved']['start'] = self._io.pos() - self.reserved = self._io.read_bytes(3576) - self._debug['reserved']['end'] = self._io.pos() - self._debug['boot_type']['start'] = self._io.pos() - self.boot_type = self._io.read_u4le() - self._debug['boot_type']['end'] = self._io.pos() - self._debug['boot_recover']['start'] = self._io.pos() - self.boot_recover = self._io.read_u4le() - self._debug['boot_recover']['end'] = self._io.pos() - - - diff --git a/python/examples/kaitai/kaitai_struct_formats/windows/windows_lnk_file.py b/python/examples/kaitai/kaitai_struct_formats/windows/windows_lnk_file.py deleted file mode 100644 index 76bd391b..00000000 --- a/python/examples/kaitai/kaitai_struct_formats/windows/windows_lnk_file.py +++ /dev/null @@ -1,461 +0,0 @@ -from __future__ import absolute_import -# This is a generated file! Please edit source .ksy file and use kaitai-struct-compiler to rebuild - -from pkg_resources import parse_version -from ...kaitaistruct import __version__ as ks_version, KaitaiStruct, KaitaiStream, BytesIO -from enum import Enum -import collections - - -if parse_version(ks_version) < parse_version('0.7'): - raise Exception("Incompatible Kaitai Struct Python API: 0.7 or later is required, but you have %s" % (ks_version)) - -from windows_shell_items import WindowsShellItems -class WindowsLnkFile(KaitaiStruct): - """Windows .lnk files (AKA "shell link" file) are most frequently used - in Windows shell to create "shortcuts" to another files, usually for - purposes of running a program from some other directory, sometimes - with certain preconfigured arguments and some other options. - - .. seealso:: - Source - https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/MS-SHLLINK/[MS-SHLLINK].pdf - """ - - class WindowState(Enum): - normal = 1 - maximized = 3 - min_no_active = 7 - - class DriveTypes(Enum): - unknown = 0 - no_root_dir = 1 - removable = 2 - fixed = 3 - remote = 4 - cdrom = 5 - ramdisk = 6 - SEQ_FIELDS = ["header", "target_id_list", "info", "name", "rel_path", "work_dir", "arguments", "icon_location"] - def __init__(self, _io, _parent=None, _root=None): - self._io = _io - self._parent = _parent - self._root = _root if _root else self - self._debug = collections.defaultdict(dict) - - def _read(self): - self._debug['header']['start'] = self._io.pos() - self.header = self._root.FileHeader(self._io, self, self._root) - self.header._read() - self._debug['header']['end'] = self._io.pos() - if self.header.flags.has_link_target_id_list: - self._debug['target_id_list']['start'] = self._io.pos() - self.target_id_list = self._root.LinkTargetIdList(self._io, self, self._root) - self.target_id_list._read() - self._debug['target_id_list']['end'] = self._io.pos() - - if self.header.flags.has_link_info: - self._debug['info']['start'] = self._io.pos() - self.info = self._root.LinkInfo(self._io, self, self._root) - self.info._read() - self._debug['info']['end'] = self._io.pos() - - if self.header.flags.has_name: - self._debug['name']['start'] = self._io.pos() - self.name = self._root.StringData(self._io, self, self._root) - self.name._read() - self._debug['name']['end'] = self._io.pos() - - if self.header.flags.has_rel_path: - self._debug['rel_path']['start'] = self._io.pos() - self.rel_path = self._root.StringData(self._io, self, self._root) - self.rel_path._read() - self._debug['rel_path']['end'] = self._io.pos() - - if self.header.flags.has_work_dir: - self._debug['work_dir']['start'] = self._io.pos() - self.work_dir = self._root.StringData(self._io, self, self._root) - self.work_dir._read() - self._debug['work_dir']['end'] = self._io.pos() - - if self.header.flags.has_arguments: - self._debug['arguments']['start'] = self._io.pos() - self.arguments = self._root.StringData(self._io, self, self._root) - self.arguments._read() - self._debug['arguments']['end'] = self._io.pos() - - if self.header.flags.has_icon_location: - self._debug['icon_location']['start'] = self._io.pos() - self.icon_location = self._root.StringData(self._io, self, self._root) - self.icon_location._read() - self._debug['icon_location']['end'] = self._io.pos() - - - class LinkTargetIdList(KaitaiStruct): - """ - .. seealso:: - Section 2.2 - https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/MS-SHLLINK/[MS-SHLLINK].pdf - """ - SEQ_FIELDS = ["len_id_list", "id_list"] - def __init__(self, _io, _parent=None, _root=None): - self._io = _io - self._parent = _parent - self._root = _root if _root else self - self._debug = collections.defaultdict(dict) - - def _read(self): - self._debug['len_id_list']['start'] = self._io.pos() - self.len_id_list = self._io.read_u2le() - self._debug['len_id_list']['end'] = self._io.pos() - self._debug['id_list']['start'] = self._io.pos() - self._raw_id_list = self._io.read_bytes(self.len_id_list) - io = KaitaiStream(BytesIO(self._raw_id_list)) - self.id_list = WindowsShellItems(io) - self.id_list._read() - self._debug['id_list']['end'] = self._io.pos() - - - class StringData(KaitaiStruct): - SEQ_FIELDS = ["chars_str", "str"] - def __init__(self, _io, _parent=None, _root=None): - self._io = _io - self._parent = _parent - self._root = _root if _root else self - self._debug = collections.defaultdict(dict) - - def _read(self): - self._debug['chars_str']['start'] = self._io.pos() - self.chars_str = self._io.read_u2le() - self._debug['chars_str']['end'] = self._io.pos() - self._debug['str']['start'] = self._io.pos() - self.str = (self._io.read_bytes((self.chars_str * 2))).decode(u"UTF-16LE") - self._debug['str']['end'] = self._io.pos() - - - class LinkInfo(KaitaiStruct): - """ - .. seealso:: - Section 2.3 - https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/MS-SHLLINK/[MS-SHLLINK].pdf - """ - SEQ_FIELDS = ["len_all", "all"] - def __init__(self, _io, _parent=None, _root=None): - self._io = _io - self._parent = _parent - self._root = _root if _root else self - self._debug = collections.defaultdict(dict) - - def _read(self): - self._debug['len_all']['start'] = self._io.pos() - self.len_all = self._io.read_u4le() - self._debug['len_all']['end'] = self._io.pos() - self._debug['all']['start'] = self._io.pos() - self._raw_all = self._io.read_bytes((self.len_all - 4)) - io = KaitaiStream(BytesIO(self._raw_all)) - self.all = self._root.LinkInfo.All(io, self, self._root) - self.all._read() - self._debug['all']['end'] = self._io.pos() - - class VolumeIdBody(KaitaiStruct): - """ - .. seealso:: - Section 2.3.1 - https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/MS-SHLLINK/[MS-SHLLINK].pdf - """ - SEQ_FIELDS = ["drive_type", "drive_serial_number", "ofs_volume_label", "ofs_volume_label_unicode"] - def __init__(self, _io, _parent=None, _root=None): - self._io = _io - self._parent = _parent - self._root = _root if _root else self - self._debug = collections.defaultdict(dict) - - def _read(self): - self._debug['drive_type']['start'] = self._io.pos() - self.drive_type = KaitaiStream.resolve_enum(self._root.DriveTypes, self._io.read_u4le()) - self._debug['drive_type']['end'] = self._io.pos() - self._debug['drive_serial_number']['start'] = self._io.pos() - self.drive_serial_number = self._io.read_u4le() - self._debug['drive_serial_number']['end'] = self._io.pos() - self._debug['ofs_volume_label']['start'] = self._io.pos() - self.ofs_volume_label = self._io.read_u4le() - self._debug['ofs_volume_label']['end'] = self._io.pos() - if self.is_unicode: - self._debug['ofs_volume_label_unicode']['start'] = self._io.pos() - self.ofs_volume_label_unicode = self._io.read_u4le() - self._debug['ofs_volume_label_unicode']['end'] = self._io.pos() - - - @property - def is_unicode(self): - if hasattr(self, '_m_is_unicode'): - return self._m_is_unicode if hasattr(self, '_m_is_unicode') else None - - self._m_is_unicode = self.ofs_volume_label == 20 - return self._m_is_unicode if hasattr(self, '_m_is_unicode') else None - - @property - def volume_label_ansi(self): - if hasattr(self, '_m_volume_label_ansi'): - return self._m_volume_label_ansi if hasattr(self, '_m_volume_label_ansi') else None - - if not (self.is_unicode): - _pos = self._io.pos() - self._io.seek((self.ofs_volume_label - 4)) - self._debug['_m_volume_label_ansi']['start'] = self._io.pos() - self._m_volume_label_ansi = (self._io.read_bytes_term(0, False, True, True)).decode(u"cp437") - self._debug['_m_volume_label_ansi']['end'] = self._io.pos() - self._io.seek(_pos) - - return self._m_volume_label_ansi if hasattr(self, '_m_volume_label_ansi') else None - - - class All(KaitaiStruct): - """ - .. seealso:: - Section 2.3 - https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/MS-SHLLINK/[MS-SHLLINK].pdf - """ - SEQ_FIELDS = ["len_header", "header"] - def __init__(self, _io, _parent=None, _root=None): - self._io = _io - self._parent = _parent - self._root = _root if _root else self - self._debug = collections.defaultdict(dict) - - def _read(self): - self._debug['len_header']['start'] = self._io.pos() - self.len_header = self._io.read_u4le() - self._debug['len_header']['end'] = self._io.pos() - self._debug['header']['start'] = self._io.pos() - self._raw_header = self._io.read_bytes((self.len_header - 8)) - io = KaitaiStream(BytesIO(self._raw_header)) - self.header = self._root.LinkInfo.Header(io, self, self._root) - self.header._read() - self._debug['header']['end'] = self._io.pos() - - @property - def volume_id(self): - if hasattr(self, '_m_volume_id'): - return self._m_volume_id if hasattr(self, '_m_volume_id') else None - - if self.header.flags.has_volume_id_and_local_base_path: - _pos = self._io.pos() - self._io.seek((self.header.ofs_volume_id - 4)) - self._debug['_m_volume_id']['start'] = self._io.pos() - self._m_volume_id = self._root.LinkInfo.VolumeIdSpec(self._io, self, self._root) - self._m_volume_id._read() - self._debug['_m_volume_id']['end'] = self._io.pos() - self._io.seek(_pos) - - return self._m_volume_id if hasattr(self, '_m_volume_id') else None - - @property - def local_base_path(self): - if hasattr(self, '_m_local_base_path'): - return self._m_local_base_path if hasattr(self, '_m_local_base_path') else None - - if self.header.flags.has_volume_id_and_local_base_path: - _pos = self._io.pos() - self._io.seek((self.header.ofs_local_base_path - 4)) - self._debug['_m_local_base_path']['start'] = self._io.pos() - self._m_local_base_path = self._io.read_bytes_term(0, False, True, True) - self._debug['_m_local_base_path']['end'] = self._io.pos() - self._io.seek(_pos) - - return self._m_local_base_path if hasattr(self, '_m_local_base_path') else None - - - class VolumeIdSpec(KaitaiStruct): - """ - .. seealso:: - Section 2.3.1 - https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/MS-SHLLINK/[MS-SHLLINK].pdf - """ - SEQ_FIELDS = ["len_all", "body"] - def __init__(self, _io, _parent=None, _root=None): - self._io = _io - self._parent = _parent - self._root = _root if _root else self - self._debug = collections.defaultdict(dict) - - def _read(self): - self._debug['len_all']['start'] = self._io.pos() - self.len_all = self._io.read_u4le() - self._debug['len_all']['end'] = self._io.pos() - self._debug['body']['start'] = self._io.pos() - self._raw_body = self._io.read_bytes((self.len_all - 4)) - io = KaitaiStream(BytesIO(self._raw_body)) - self.body = self._root.LinkInfo.VolumeIdBody(io, self, self._root) - self.body._read() - self._debug['body']['end'] = self._io.pos() - - - class LinkInfoFlags(KaitaiStruct): - """ - .. seealso:: - Section 2.3 - https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/MS-SHLLINK/[MS-SHLLINK].pdf - """ - SEQ_FIELDS = ["reserved1", "has_common_net_rel_link", "has_volume_id_and_local_base_path", "reserved2"] - def __init__(self, _io, _parent=None, _root=None): - self._io = _io - self._parent = _parent - self._root = _root if _root else self - self._debug = collections.defaultdict(dict) - - def _read(self): - self._debug['reserved1']['start'] = self._io.pos() - self.reserved1 = self._io.read_bits_int(6) - self._debug['reserved1']['end'] = self._io.pos() - self._debug['has_common_net_rel_link']['start'] = self._io.pos() - self.has_common_net_rel_link = self._io.read_bits_int(1) != 0 - self._debug['has_common_net_rel_link']['end'] = self._io.pos() - self._debug['has_volume_id_and_local_base_path']['start'] = self._io.pos() - self.has_volume_id_and_local_base_path = self._io.read_bits_int(1) != 0 - self._debug['has_volume_id_and_local_base_path']['end'] = self._io.pos() - self._debug['reserved2']['start'] = self._io.pos() - self.reserved2 = self._io.read_bits_int(24) - self._debug['reserved2']['end'] = self._io.pos() - - - class Header(KaitaiStruct): - """ - .. seealso:: - Section 2.3 - https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/MS-SHLLINK/[MS-SHLLINK].pdf - """ - SEQ_FIELDS = ["flags", "ofs_volume_id", "ofs_local_base_path", "ofs_common_net_rel_link", "ofs_common_path_suffix", "ofs_local_base_path_unicode", "ofs_common_path_suffix_unicode"] - def __init__(self, _io, _parent=None, _root=None): - self._io = _io - self._parent = _parent - self._root = _root if _root else self - self._debug = collections.defaultdict(dict) - - def _read(self): - self._debug['flags']['start'] = self._io.pos() - self.flags = self._root.LinkInfo.LinkInfoFlags(self._io, self, self._root) - self.flags._read() - self._debug['flags']['end'] = self._io.pos() - self._debug['ofs_volume_id']['start'] = self._io.pos() - self.ofs_volume_id = self._io.read_u4le() - self._debug['ofs_volume_id']['end'] = self._io.pos() - self._debug['ofs_local_base_path']['start'] = self._io.pos() - self.ofs_local_base_path = self._io.read_u4le() - self._debug['ofs_local_base_path']['end'] = self._io.pos() - self._debug['ofs_common_net_rel_link']['start'] = self._io.pos() - self.ofs_common_net_rel_link = self._io.read_u4le() - self._debug['ofs_common_net_rel_link']['end'] = self._io.pos() - self._debug['ofs_common_path_suffix']['start'] = self._io.pos() - self.ofs_common_path_suffix = self._io.read_u4le() - self._debug['ofs_common_path_suffix']['end'] = self._io.pos() - if not (self._io.is_eof()): - self._debug['ofs_local_base_path_unicode']['start'] = self._io.pos() - self.ofs_local_base_path_unicode = self._io.read_u4le() - self._debug['ofs_local_base_path_unicode']['end'] = self._io.pos() - - if not (self._io.is_eof()): - self._debug['ofs_common_path_suffix_unicode']['start'] = self._io.pos() - self.ofs_common_path_suffix_unicode = self._io.read_u4le() - self._debug['ofs_common_path_suffix_unicode']['end'] = self._io.pos() - - - - - class LinkFlags(KaitaiStruct): - """ - .. seealso:: - Section 2.1.1 - https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/MS-SHLLINK/[MS-SHLLINK].pdf - """ - SEQ_FIELDS = ["is_unicode", "has_icon_location", "has_arguments", "has_work_dir", "has_rel_path", "has_name", "has_link_info", "has_link_target_id_list", "_unnamed8", "reserved", "keep_local_id_list_for_unc_target", "_unnamed11"] - def __init__(self, _io, _parent=None, _root=None): - self._io = _io - self._parent = _parent - self._root = _root if _root else self - self._debug = collections.defaultdict(dict) - - def _read(self): - self._debug['is_unicode']['start'] = self._io.pos() - self.is_unicode = self._io.read_bits_int(1) != 0 - self._debug['is_unicode']['end'] = self._io.pos() - self._debug['has_icon_location']['start'] = self._io.pos() - self.has_icon_location = self._io.read_bits_int(1) != 0 - self._debug['has_icon_location']['end'] = self._io.pos() - self._debug['has_arguments']['start'] = self._io.pos() - self.has_arguments = self._io.read_bits_int(1) != 0 - self._debug['has_arguments']['end'] = self._io.pos() - self._debug['has_work_dir']['start'] = self._io.pos() - self.has_work_dir = self._io.read_bits_int(1) != 0 - self._debug['has_work_dir']['end'] = self._io.pos() - self._debug['has_rel_path']['start'] = self._io.pos() - self.has_rel_path = self._io.read_bits_int(1) != 0 - self._debug['has_rel_path']['end'] = self._io.pos() - self._debug['has_name']['start'] = self._io.pos() - self.has_name = self._io.read_bits_int(1) != 0 - self._debug['has_name']['end'] = self._io.pos() - self._debug['has_link_info']['start'] = self._io.pos() - self.has_link_info = self._io.read_bits_int(1) != 0 - self._debug['has_link_info']['end'] = self._io.pos() - self._debug['has_link_target_id_list']['start'] = self._io.pos() - self.has_link_target_id_list = self._io.read_bits_int(1) != 0 - self._debug['has_link_target_id_list']['end'] = self._io.pos() - self._debug['_unnamed8']['start'] = self._io.pos() - self._unnamed8 = self._io.read_bits_int(16) - self._debug['_unnamed8']['end'] = self._io.pos() - self._debug['reserved']['start'] = self._io.pos() - self.reserved = self._io.read_bits_int(5) - self._debug['reserved']['end'] = self._io.pos() - self._debug['keep_local_id_list_for_unc_target']['start'] = self._io.pos() - self.keep_local_id_list_for_unc_target = self._io.read_bits_int(1) != 0 - self._debug['keep_local_id_list_for_unc_target']['end'] = self._io.pos() - self._debug['_unnamed11']['start'] = self._io.pos() - self._unnamed11 = self._io.read_bits_int(2) - self._debug['_unnamed11']['end'] = self._io.pos() - - - class FileHeader(KaitaiStruct): - """ - .. seealso:: - Section 2.1 - https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/MS-SHLLINK/[MS-SHLLINK].pdf - """ - SEQ_FIELDS = ["len_header", "link_clsid", "flags", "file_attrs", "time_creation", "time_access", "time_write", "target_file_size", "icon_index", "show_command", "hotkey", "reserved"] - def __init__(self, _io, _parent=None, _root=None): - self._io = _io - self._parent = _parent - self._root = _root if _root else self - self._debug = collections.defaultdict(dict) - - def _read(self): - self._debug['len_header']['start'] = self._io.pos() - self.len_header = self._io.ensure_fixed_contents(b"\x4C\x00\x00\x00") - self._debug['len_header']['end'] = self._io.pos() - self._debug['link_clsid']['start'] = self._io.pos() - self.link_clsid = self._io.ensure_fixed_contents(b"\x01\x14\x02\x00\x00\x00\x00\x00\xC0\x00\x00\x00\x00\x00\x00\x46") - self._debug['link_clsid']['end'] = self._io.pos() - self._debug['flags']['start'] = self._io.pos() - self._raw_flags = self._io.read_bytes(4) - io = KaitaiStream(BytesIO(self._raw_flags)) - self.flags = self._root.LinkFlags(io, self, self._root) - self.flags._read() - self._debug['flags']['end'] = self._io.pos() - self._debug['file_attrs']['start'] = self._io.pos() - self.file_attrs = self._io.read_u4le() - self._debug['file_attrs']['end'] = self._io.pos() - self._debug['time_creation']['start'] = self._io.pos() - self.time_creation = self._io.read_u8le() - self._debug['time_creation']['end'] = self._io.pos() - self._debug['time_access']['start'] = self._io.pos() - self.time_access = self._io.read_u8le() - self._debug['time_access']['end'] = self._io.pos() - self._debug['time_write']['start'] = self._io.pos() - self.time_write = self._io.read_u8le() - self._debug['time_write']['end'] = self._io.pos() - self._debug['target_file_size']['start'] = self._io.pos() - self.target_file_size = self._io.read_u4le() - self._debug['target_file_size']['end'] = self._io.pos() - self._debug['icon_index']['start'] = self._io.pos() - self.icon_index = self._io.read_s4le() - self._debug['icon_index']['end'] = self._io.pos() - self._debug['show_command']['start'] = self._io.pos() - self.show_command = KaitaiStream.resolve_enum(self._root.WindowState, self._io.read_u4le()) - self._debug['show_command']['end'] = self._io.pos() - self._debug['hotkey']['start'] = self._io.pos() - self.hotkey = self._io.read_u2le() - self._debug['hotkey']['end'] = self._io.pos() - self._debug['reserved']['start'] = self._io.pos() - self.reserved = self._io.ensure_fixed_contents(b"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00") - self._debug['reserved']['end'] = self._io.pos() - - - diff --git a/python/examples/kaitai/kaitai_struct_formats/windows/windows_minidump.py b/python/examples/kaitai/kaitai_struct_formats/windows/windows_minidump.py deleted file mode 100644 index b2846588..00000000 --- a/python/examples/kaitai/kaitai_struct_formats/windows/windows_minidump.py +++ /dev/null @@ -1,541 +0,0 @@ -from __future__ import absolute_import -# This is a generated file! Please edit source .ksy file and use kaitai-struct-compiler to rebuild - -from pkg_resources import parse_version -from ...kaitaistruct import __version__ as ks_version, KaitaiStruct, KaitaiStream, BytesIO -from enum import Enum -import collections - - -if parse_version(ks_version) < parse_version('0.7'): - raise Exception("Incompatible Kaitai Struct Python API: 0.7 or later is required, but you have %s" % (ks_version)) - -class WindowsMinidump(KaitaiStruct): - """Windows MiniDump (MDMP) file provides a concise way to store process - core dumps, which is useful for debugging. Given its small size, - modularity, some cross-platform features and native support in some - debuggers, it is particularly useful for crash reporting, and is - used for that purpose in Windows and Google Chrome projects. - - The file itself is a container, which contains a number of typed - "streams", which contain some data according to its type attribute. - - .. seealso:: - Source - https://msdn.microsoft.com/en-us/library/ms680378(VS.85).aspx - """ - - class StreamTypes(Enum): - unused = 0 - reserved_0 = 1 - reserved_1 = 2 - thread_list = 3 - module_list = 4 - memory_list = 5 - exception = 6 - system_info = 7 - thread_ex_list = 8 - memory_64_list = 9 - comment_a = 10 - comment_w = 11 - handle_data = 12 - function_table = 13 - unloaded_module_list = 14 - misc_info = 15 - memory_info_list = 16 - thread_info_list = 17 - handle_operation_list = 18 - SEQ_FIELDS = ["magic1", "magic2", "version", "num_streams", "ofs_streams", "checksum", "timestamp", "flags"] - def __init__(self, _io, _parent=None, _root=None): - self._io = _io - self._parent = _parent - self._root = _root if _root else self - self._debug = collections.defaultdict(dict) - - def _read(self): - self._debug['magic1']['start'] = self._io.pos() - self.magic1 = self._io.ensure_fixed_contents(b"\x4D\x44\x4D\x50") - self._debug['magic1']['end'] = self._io.pos() - self._debug['magic2']['start'] = self._io.pos() - self.magic2 = self._io.ensure_fixed_contents(b"\x93\xA7") - self._debug['magic2']['end'] = self._io.pos() - self._debug['version']['start'] = self._io.pos() - self.version = self._io.read_u2le() - self._debug['version']['end'] = self._io.pos() - self._debug['num_streams']['start'] = self._io.pos() - self.num_streams = self._io.read_u4le() - self._debug['num_streams']['end'] = self._io.pos() - self._debug['ofs_streams']['start'] = self._io.pos() - self.ofs_streams = self._io.read_u4le() - self._debug['ofs_streams']['end'] = self._io.pos() - self._debug['checksum']['start'] = self._io.pos() - self.checksum = self._io.read_u4le() - self._debug['checksum']['end'] = self._io.pos() - self._debug['timestamp']['start'] = self._io.pos() - self.timestamp = self._io.read_u4le() - self._debug['timestamp']['end'] = self._io.pos() - self._debug['flags']['start'] = self._io.pos() - self.flags = self._io.read_u8le() - self._debug['flags']['end'] = self._io.pos() - - class ThreadList(KaitaiStruct): - """ - .. seealso:: - Source - https://msdn.microsoft.com/en-us/library/ms680515(v=vs.85).aspx - """ - SEQ_FIELDS = ["num_threads", "threads"] - def __init__(self, _io, _parent=None, _root=None): - self._io = _io - self._parent = _parent - self._root = _root if _root else self - self._debug = collections.defaultdict(dict) - - def _read(self): - self._debug['num_threads']['start'] = self._io.pos() - self.num_threads = self._io.read_u4le() - self._debug['num_threads']['end'] = self._io.pos() - self._debug['threads']['start'] = self._io.pos() - self.threads = [None] * (self.num_threads) - for i in range(self.num_threads): - if not 'arr' in self._debug['threads']: - self._debug['threads']['arr'] = [] - self._debug['threads']['arr'].append({'start': self._io.pos()}) - _t_threads = self._root.Thread(self._io, self, self._root) - _t_threads._read() - self.threads[i] = _t_threads - self._debug['threads']['arr'][i]['end'] = self._io.pos() - - self._debug['threads']['end'] = self._io.pos() - - - class LocationDescriptor(KaitaiStruct): - """ - .. seealso:: - Source - https://msdn.microsoft.com/en-us/library/ms680383(v=vs.85).aspx - """ - SEQ_FIELDS = ["len_data", "ofs_data"] - def __init__(self, _io, _parent=None, _root=None): - self._io = _io - self._parent = _parent - self._root = _root if _root else self - self._debug = collections.defaultdict(dict) - - def _read(self): - self._debug['len_data']['start'] = self._io.pos() - self.len_data = self._io.read_u4le() - self._debug['len_data']['end'] = self._io.pos() - self._debug['ofs_data']['start'] = self._io.pos() - self.ofs_data = self._io.read_u4le() - self._debug['ofs_data']['end'] = self._io.pos() - - @property - def data(self): - if hasattr(self, '_m_data'): - return self._m_data if hasattr(self, '_m_data') else None - - io = self._root._io - _pos = io.pos() - io.seek(self.ofs_data) - self._debug['_m_data']['start'] = io.pos() - self._m_data = io.read_bytes(self.len_data) - self._debug['_m_data']['end'] = io.pos() - io.seek(_pos) - return self._m_data if hasattr(self, '_m_data') else None - - - class MinidumpString(KaitaiStruct): - """Specific string serialization scheme used in MiniDump format is - actually a simple 32-bit length-prefixed UTF-16 string. - - .. seealso:: - Source - https://msdn.microsoft.com/en-us/library/ms680395(v=vs.85).aspx - """ - SEQ_FIELDS = ["len_str", "str"] - def __init__(self, _io, _parent=None, _root=None): - self._io = _io - self._parent = _parent - self._root = _root if _root else self - self._debug = collections.defaultdict(dict) - - def _read(self): - self._debug['len_str']['start'] = self._io.pos() - self.len_str = self._io.read_u4le() - self._debug['len_str']['end'] = self._io.pos() - self._debug['str']['start'] = self._io.pos() - self.str = (self._io.read_bytes(self.len_str)).decode(u"UTF-16LE") - self._debug['str']['end'] = self._io.pos() - - - class SystemInfo(KaitaiStruct): - """"System info" stream provides basic information about the - hardware and operating system which produces this dump. - - .. seealso:: - Source - https://msdn.microsoft.com/en-us/library/ms680396(v=vs.85).aspx - """ - - class CpuArchs(Enum): - intel = 0 - arm = 5 - ia64 = 6 - amd64 = 9 - unknown = 65535 - SEQ_FIELDS = ["cpu_arch", "cpu_level", "cpu_revision", "num_cpus", "os_type", "os_ver_major", "os_ver_minor", "os_build", "os_platform", "ofs_service_pack", "os_suite_mask", "reserved2"] - def __init__(self, _io, _parent=None, _root=None): - self._io = _io - self._parent = _parent - self._root = _root if _root else self - self._debug = collections.defaultdict(dict) - - def _read(self): - self._debug['cpu_arch']['start'] = self._io.pos() - self.cpu_arch = KaitaiStream.resolve_enum(self._root.SystemInfo.CpuArchs, self._io.read_u2le()) - self._debug['cpu_arch']['end'] = self._io.pos() - self._debug['cpu_level']['start'] = self._io.pos() - self.cpu_level = self._io.read_u2le() - self._debug['cpu_level']['end'] = self._io.pos() - self._debug['cpu_revision']['start'] = self._io.pos() - self.cpu_revision = self._io.read_u2le() - self._debug['cpu_revision']['end'] = self._io.pos() - self._debug['num_cpus']['start'] = self._io.pos() - self.num_cpus = self._io.read_u1() - self._debug['num_cpus']['end'] = self._io.pos() - self._debug['os_type']['start'] = self._io.pos() - self.os_type = self._io.read_u1() - self._debug['os_type']['end'] = self._io.pos() - self._debug['os_ver_major']['start'] = self._io.pos() - self.os_ver_major = self._io.read_u4le() - self._debug['os_ver_major']['end'] = self._io.pos() - self._debug['os_ver_minor']['start'] = self._io.pos() - self.os_ver_minor = self._io.read_u4le() - self._debug['os_ver_minor']['end'] = self._io.pos() - self._debug['os_build']['start'] = self._io.pos() - self.os_build = self._io.read_u4le() - self._debug['os_build']['end'] = self._io.pos() - self._debug['os_platform']['start'] = self._io.pos() - self.os_platform = self._io.read_u4le() - self._debug['os_platform']['end'] = self._io.pos() - self._debug['ofs_service_pack']['start'] = self._io.pos() - self.ofs_service_pack = self._io.read_u4le() - self._debug['ofs_service_pack']['end'] = self._io.pos() - self._debug['os_suite_mask']['start'] = self._io.pos() - self.os_suite_mask = self._io.read_u2le() - self._debug['os_suite_mask']['end'] = self._io.pos() - self._debug['reserved2']['start'] = self._io.pos() - self.reserved2 = self._io.read_u2le() - self._debug['reserved2']['end'] = self._io.pos() - - @property - def service_pack(self): - if hasattr(self, '_m_service_pack'): - return self._m_service_pack if hasattr(self, '_m_service_pack') else None - - if self.ofs_service_pack > 0: - io = self._root._io - _pos = io.pos() - io.seek(self.ofs_service_pack) - self._debug['_m_service_pack']['start'] = io.pos() - self._m_service_pack = self._root.MinidumpString(io, self, self._root) - self._m_service_pack._read() - self._debug['_m_service_pack']['end'] = io.pos() - io.seek(_pos) - - return self._m_service_pack if hasattr(self, '_m_service_pack') else None - - - class ExceptionRecord(KaitaiStruct): - """ - .. seealso:: - Source - https://msdn.microsoft.com/en-us/library/ms680367(v=vs.85).aspx - """ - SEQ_FIELDS = ["code", "flags", "inner_exception", "addr", "num_params", "reserved", "params"] - def __init__(self, _io, _parent=None, _root=None): - self._io = _io - self._parent = _parent - self._root = _root if _root else self - self._debug = collections.defaultdict(dict) - - def _read(self): - self._debug['code']['start'] = self._io.pos() - self.code = self._io.read_u4le() - self._debug['code']['end'] = self._io.pos() - self._debug['flags']['start'] = self._io.pos() - self.flags = self._io.read_u4le() - self._debug['flags']['end'] = self._io.pos() - self._debug['inner_exception']['start'] = self._io.pos() - self.inner_exception = self._io.read_u8le() - self._debug['inner_exception']['end'] = self._io.pos() - self._debug['addr']['start'] = self._io.pos() - self.addr = self._io.read_u8le() - self._debug['addr']['end'] = self._io.pos() - self._debug['num_params']['start'] = self._io.pos() - self.num_params = self._io.read_u4le() - self._debug['num_params']['end'] = self._io.pos() - self._debug['reserved']['start'] = self._io.pos() - self.reserved = self._io.read_u4le() - self._debug['reserved']['end'] = self._io.pos() - self._debug['params']['start'] = self._io.pos() - self.params = [None] * (15) - for i in range(15): - if not 'arr' in self._debug['params']: - self._debug['params']['arr'] = [] - self._debug['params']['arr'].append({'start': self._io.pos()}) - self.params[i] = self._io.read_u8le() - self._debug['params']['arr'][i]['end'] = self._io.pos() - - self._debug['params']['end'] = self._io.pos() - - - class MiscInfo(KaitaiStruct): - """ - .. seealso:: - Source - https://msdn.microsoft.com/en-us/library/ms680389(v=vs.85).aspx - """ - SEQ_FIELDS = ["len_info", "flags1", "process_id", "process_create_time", "process_user_time", "process_kernel_time", "cpu_max_mhz", "cpu_cur_mhz", "cpu_limit_mhz", "cpu_max_idle_state", "cpu_cur_idle_state"] - def __init__(self, _io, _parent=None, _root=None): - self._io = _io - self._parent = _parent - self._root = _root if _root else self - self._debug = collections.defaultdict(dict) - - def _read(self): - self._debug['len_info']['start'] = self._io.pos() - self.len_info = self._io.read_u4le() - self._debug['len_info']['end'] = self._io.pos() - self._debug['flags1']['start'] = self._io.pos() - self.flags1 = self._io.read_u4le() - self._debug['flags1']['end'] = self._io.pos() - self._debug['process_id']['start'] = self._io.pos() - self.process_id = self._io.read_u4le() - self._debug['process_id']['end'] = self._io.pos() - self._debug['process_create_time']['start'] = self._io.pos() - self.process_create_time = self._io.read_u4le() - self._debug['process_create_time']['end'] = self._io.pos() - self._debug['process_user_time']['start'] = self._io.pos() - self.process_user_time = self._io.read_u4le() - self._debug['process_user_time']['end'] = self._io.pos() - self._debug['process_kernel_time']['start'] = self._io.pos() - self.process_kernel_time = self._io.read_u4le() - self._debug['process_kernel_time']['end'] = self._io.pos() - self._debug['cpu_max_mhz']['start'] = self._io.pos() - self.cpu_max_mhz = self._io.read_u4le() - self._debug['cpu_max_mhz']['end'] = self._io.pos() - self._debug['cpu_cur_mhz']['start'] = self._io.pos() - self.cpu_cur_mhz = self._io.read_u4le() - self._debug['cpu_cur_mhz']['end'] = self._io.pos() - self._debug['cpu_limit_mhz']['start'] = self._io.pos() - self.cpu_limit_mhz = self._io.read_u4le() - self._debug['cpu_limit_mhz']['end'] = self._io.pos() - self._debug['cpu_max_idle_state']['start'] = self._io.pos() - self.cpu_max_idle_state = self._io.read_u4le() - self._debug['cpu_max_idle_state']['end'] = self._io.pos() - self._debug['cpu_cur_idle_state']['start'] = self._io.pos() - self.cpu_cur_idle_state = self._io.read_u4le() - self._debug['cpu_cur_idle_state']['end'] = self._io.pos() - - - class Dir(KaitaiStruct): - """ - .. seealso:: - Source - https://msdn.microsoft.com/en-us/library/ms680365(v=vs.85).aspx - """ - SEQ_FIELDS = ["stream_type", "len_data", "ofs_data"] - def __init__(self, _io, _parent=None, _root=None): - self._io = _io - self._parent = _parent - self._root = _root if _root else self - self._debug = collections.defaultdict(dict) - - def _read(self): - self._debug['stream_type']['start'] = self._io.pos() - self.stream_type = KaitaiStream.resolve_enum(self._root.StreamTypes, self._io.read_u4le()) - self._debug['stream_type']['end'] = self._io.pos() - self._debug['len_data']['start'] = self._io.pos() - self.len_data = self._io.read_u4le() - self._debug['len_data']['end'] = self._io.pos() - self._debug['ofs_data']['start'] = self._io.pos() - self.ofs_data = self._io.read_u4le() - self._debug['ofs_data']['end'] = self._io.pos() - - @property - def data(self): - if hasattr(self, '_m_data'): - return self._m_data if hasattr(self, '_m_data') else None - - _pos = self._io.pos() - self._io.seek(self.ofs_data) - self._debug['_m_data']['start'] = self._io.pos() - _on = self.stream_type - if _on == self._root.StreamTypes.memory_list: - self._raw__m_data = self._io.read_bytes(self.len_data) - io = KaitaiStream(BytesIO(self._raw__m_data)) - self._m_data = self._root.MemoryList(io, self, self._root) - self._m_data._read() - elif _on == self._root.StreamTypes.misc_info: - self._raw__m_data = self._io.read_bytes(self.len_data) - io = KaitaiStream(BytesIO(self._raw__m_data)) - self._m_data = self._root.MiscInfo(io, self, self._root) - self._m_data._read() - elif _on == self._root.StreamTypes.thread_list: - self._raw__m_data = self._io.read_bytes(self.len_data) - io = KaitaiStream(BytesIO(self._raw__m_data)) - self._m_data = self._root.ThreadList(io, self, self._root) - self._m_data._read() - elif _on == self._root.StreamTypes.exception: - self._raw__m_data = self._io.read_bytes(self.len_data) - io = KaitaiStream(BytesIO(self._raw__m_data)) - self._m_data = self._root.ExceptionStream(io, self, self._root) - self._m_data._read() - elif _on == self._root.StreamTypes.system_info: - self._raw__m_data = self._io.read_bytes(self.len_data) - io = KaitaiStream(BytesIO(self._raw__m_data)) - self._m_data = self._root.SystemInfo(io, self, self._root) - self._m_data._read() - else: - self._m_data = self._io.read_bytes(self.len_data) - self._debug['_m_data']['end'] = self._io.pos() - self._io.seek(_pos) - return self._m_data if hasattr(self, '_m_data') else None - - - class Thread(KaitaiStruct): - """ - .. seealso:: - Source - https://msdn.microsoft.com/en-us/library/ms680517(v=vs.85).aspx - """ - SEQ_FIELDS = ["thread_id", "suspend_count", "priority_class", "priority", "teb", "stack", "thread_context"] - def __init__(self, _io, _parent=None, _root=None): - self._io = _io - self._parent = _parent - self._root = _root if _root else self - self._debug = collections.defaultdict(dict) - - def _read(self): - self._debug['thread_id']['start'] = self._io.pos() - self.thread_id = self._io.read_u4le() - self._debug['thread_id']['end'] = self._io.pos() - self._debug['suspend_count']['start'] = self._io.pos() - self.suspend_count = self._io.read_u4le() - self._debug['suspend_count']['end'] = self._io.pos() - self._debug['priority_class']['start'] = self._io.pos() - self.priority_class = self._io.read_u4le() - self._debug['priority_class']['end'] = self._io.pos() - self._debug['priority']['start'] = self._io.pos() - self.priority = self._io.read_u4le() - self._debug['priority']['end'] = self._io.pos() - self._debug['teb']['start'] = self._io.pos() - self.teb = self._io.read_u8le() - self._debug['teb']['end'] = self._io.pos() - self._debug['stack']['start'] = self._io.pos() - self.stack = self._root.MemoryDescriptor(self._io, self, self._root) - self.stack._read() - self._debug['stack']['end'] = self._io.pos() - self._debug['thread_context']['start'] = self._io.pos() - self.thread_context = self._root.LocationDescriptor(self._io, self, self._root) - self.thread_context._read() - self._debug['thread_context']['end'] = self._io.pos() - - - class MemoryList(KaitaiStruct): - """ - .. seealso:: - Source - https://msdn.microsoft.com/en-us/library/ms680387(v=vs.85).aspx - """ - SEQ_FIELDS = ["num_mem_ranges", "mem_ranges"] - def __init__(self, _io, _parent=None, _root=None): - self._io = _io - self._parent = _parent - self._root = _root if _root else self - self._debug = collections.defaultdict(dict) - - def _read(self): - self._debug['num_mem_ranges']['start'] = self._io.pos() - self.num_mem_ranges = self._io.read_u4le() - self._debug['num_mem_ranges']['end'] = self._io.pos() - self._debug['mem_ranges']['start'] = self._io.pos() - self.mem_ranges = [None] * (self.num_mem_ranges) - for i in range(self.num_mem_ranges): - if not 'arr' in self._debug['mem_ranges']: - self._debug['mem_ranges']['arr'] = [] - self._debug['mem_ranges']['arr'].append({'start': self._io.pos()}) - _t_mem_ranges = self._root.MemoryDescriptor(self._io, self, self._root) - _t_mem_ranges._read() - self.mem_ranges[i] = _t_mem_ranges - self._debug['mem_ranges']['arr'][i]['end'] = self._io.pos() - - self._debug['mem_ranges']['end'] = self._io.pos() - - - class MemoryDescriptor(KaitaiStruct): - """ - .. seealso:: - Source - https://msdn.microsoft.com/en-us/library/ms680384(v=vs.85).aspx - """ - SEQ_FIELDS = ["addr_memory_range", "memory"] - def __init__(self, _io, _parent=None, _root=None): - self._io = _io - self._parent = _parent - self._root = _root if _root else self - self._debug = collections.defaultdict(dict) - - def _read(self): - self._debug['addr_memory_range']['start'] = self._io.pos() - self.addr_memory_range = self._io.read_u8le() - self._debug['addr_memory_range']['end'] = self._io.pos() - self._debug['memory']['start'] = self._io.pos() - self.memory = self._root.LocationDescriptor(self._io, self, self._root) - self.memory._read() - self._debug['memory']['end'] = self._io.pos() - - - class ExceptionStream(KaitaiStruct): - """ - .. seealso:: - Source - https://msdn.microsoft.com/en-us/library/ms680368(v=vs.85).aspx - """ - SEQ_FIELDS = ["thread_id", "reserved", "exception_rec", "thread_context"] - def __init__(self, _io, _parent=None, _root=None): - self._io = _io - self._parent = _parent - self._root = _root if _root else self - self._debug = collections.defaultdict(dict) - - def _read(self): - self._debug['thread_id']['start'] = self._io.pos() - self.thread_id = self._io.read_u4le() - self._debug['thread_id']['end'] = self._io.pos() - self._debug['reserved']['start'] = self._io.pos() - self.reserved = self._io.read_u4le() - self._debug['reserved']['end'] = self._io.pos() - self._debug['exception_rec']['start'] = self._io.pos() - self.exception_rec = self._root.ExceptionRecord(self._io, self, self._root) - self.exception_rec._read() - self._debug['exception_rec']['end'] = self._io.pos() - self._debug['thread_context']['start'] = self._io.pos() - self.thread_context = self._root.LocationDescriptor(self._io, self, self._root) - self.thread_context._read() - self._debug['thread_context']['end'] = self._io.pos() - - - @property - def streams(self): - if hasattr(self, '_m_streams'): - return self._m_streams if hasattr(self, '_m_streams') else None - - _pos = self._io.pos() - self._io.seek(self.ofs_streams) - self._debug['_m_streams']['start'] = self._io.pos() - self._m_streams = [None] * (self.num_streams) - for i in range(self.num_streams): - if not 'arr' in self._debug['_m_streams']: - self._debug['_m_streams']['arr'] = [] - self._debug['_m_streams']['arr'].append({'start': self._io.pos()}) - _t__m_streams = self._root.Dir(self._io, self, self._root) - _t__m_streams._read() - self._m_streams[i] = _t__m_streams - self._debug['_m_streams']['arr'][i]['end'] = self._io.pos() - - self._debug['_m_streams']['end'] = self._io.pos() - self._io.seek(_pos) - return self._m_streams if hasattr(self, '_m_streams') else None - - diff --git a/python/examples/kaitai/kaitai_struct_formats/windows/windows_resource_file.py b/python/examples/kaitai/kaitai_struct_formats/windows/windows_resource_file.py deleted file mode 100644 index 5026cb0f..00000000 --- a/python/examples/kaitai/kaitai_struct_formats/windows/windows_resource_file.py +++ /dev/null @@ -1,243 +0,0 @@ -from __future__ import absolute_import -# This is a generated file! Please edit source .ksy file and use kaitai-struct-compiler to rebuild - -from pkg_resources import parse_version -from ...kaitaistruct import __version__ as ks_version, KaitaiStruct, KaitaiStream, BytesIO -import collections -from enum import Enum - - -if parse_version(ks_version) < parse_version('0.7'): - raise Exception("Incompatible Kaitai Struct Python API: 0.7 or later is required, but you have %s" % (ks_version)) - -class WindowsResourceFile(KaitaiStruct): - """Windows resource file (.res) are binary bundles of - "resources". Resource has some sort of ID (numerical or string), - type (predefined or user-defined), and raw value. Resource files can - be seen standalone (as .res file), or embedded inside PE executable - (.exe, .dll) files. - - Typical use cases include: - - * providing information about the application (such as title, copyrights, etc) - * embedding icon(s) to be displayed in file managers into .exe - * adding non-code data into the binary, such as menus, dialog forms, - cursor images, fonts, various misc bitmaps, and locale-aware - strings - - Windows provides special API to access "resources" from a binary. - - Normally, resources files are created with `rc` compiler: it takes a - .rc file (so called "resource-definition script") + all the raw - resource binary files for input, and outputs .res file. That .res - file can be linked into an .exe / .dll afterwards using a linker. - - Internally, resource file is just a sequence of individual resource - definitions. RC tool ensures that first resource (#0) is always - empty. - """ - SEQ_FIELDS = ["resources"] - def __init__(self, _io, _parent=None, _root=None): - self._io = _io - self._parent = _parent - self._root = _root if _root else self - self._debug = collections.defaultdict(dict) - - def _read(self): - self._debug['resources']['start'] = self._io.pos() - self.resources = [] - i = 0 - while not self._io.is_eof(): - if not 'arr' in self._debug['resources']: - self._debug['resources']['arr'] = [] - self._debug['resources']['arr'].append({'start': self._io.pos()}) - _t_resources = self._root.Resource(self._io, self, self._root) - _t_resources._read() - self.resources.append(_t_resources) - self._debug['resources']['arr'][len(self.resources) - 1]['end'] = self._io.pos() - i += 1 - - self._debug['resources']['end'] = self._io.pos() - - class Resource(KaitaiStruct): - """Each resource has a `type` and a `name`, which can be used to - identify it, and a `value`. Both `type` and `name` can be a - number or a string. - - .. seealso:: - Source - https://msdn.microsoft.com/en-us/library/windows/desktop/ms648027.aspx - """ - - class PredefTypes(Enum): - cursor = 1 - bitmap = 2 - icon = 3 - menu = 4 - dialog = 5 - string = 6 - fontdir = 7 - font = 8 - accelerator = 9 - rcdata = 10 - messagetable = 11 - group_cursor = 12 - group_icon = 14 - version = 16 - dlginclude = 17 - plugplay = 19 - vxd = 20 - anicursor = 21 - aniicon = 22 - html = 23 - manifest = 24 - SEQ_FIELDS = ["value_size", "header_size", "type", "name", "padding1", "format_version", "flags", "language", "value_version", "characteristics", "value", "padding2"] - def __init__(self, _io, _parent=None, _root=None): - self._io = _io - self._parent = _parent - self._root = _root if _root else self - self._debug = collections.defaultdict(dict) - - def _read(self): - self._debug['value_size']['start'] = self._io.pos() - self.value_size = self._io.read_u4le() - self._debug['value_size']['end'] = self._io.pos() - self._debug['header_size']['start'] = self._io.pos() - self.header_size = self._io.read_u4le() - self._debug['header_size']['end'] = self._io.pos() - self._debug['type']['start'] = self._io.pos() - self.type = self._root.UnicodeOrId(self._io, self, self._root) - self.type._read() - self._debug['type']['end'] = self._io.pos() - self._debug['name']['start'] = self._io.pos() - self.name = self._root.UnicodeOrId(self._io, self, self._root) - self.name._read() - self._debug['name']['end'] = self._io.pos() - self._debug['padding1']['start'] = self._io.pos() - self.padding1 = self._io.read_bytes(((4 - self._io.pos()) % 4)) - self._debug['padding1']['end'] = self._io.pos() - self._debug['format_version']['start'] = self._io.pos() - self.format_version = self._io.read_u4le() - self._debug['format_version']['end'] = self._io.pos() - self._debug['flags']['start'] = self._io.pos() - self.flags = self._io.read_u2le() - self._debug['flags']['end'] = self._io.pos() - self._debug['language']['start'] = self._io.pos() - self.language = self._io.read_u2le() - self._debug['language']['end'] = self._io.pos() - self._debug['value_version']['start'] = self._io.pos() - self.value_version = self._io.read_u4le() - self._debug['value_version']['end'] = self._io.pos() - self._debug['characteristics']['start'] = self._io.pos() - self.characteristics = self._io.read_u4le() - self._debug['characteristics']['end'] = self._io.pos() - self._debug['value']['start'] = self._io.pos() - self.value = self._io.read_bytes(self.value_size) - self._debug['value']['end'] = self._io.pos() - self._debug['padding2']['start'] = self._io.pos() - self.padding2 = self._io.read_bytes(((4 - self._io.pos()) % 4)) - self._debug['padding2']['end'] = self._io.pos() - - @property - def type_as_predef(self): - """Numeric type IDs in range of [0..0xff] are reserved for - system usage in Windows, and there are some predefined, - well-known values in that range. This instance allows to get - it as enum value, if applicable. - """ - if hasattr(self, '_m_type_as_predef'): - return self._m_type_as_predef if hasattr(self, '_m_type_as_predef') else None - - if ((not (self.type.is_string)) and (self.type.as_numeric <= 255)) : - self._m_type_as_predef = KaitaiStream.resolve_enum(self._root.Resource.PredefTypes, self.type.as_numeric) - - return self._m_type_as_predef if hasattr(self, '_m_type_as_predef') else None - - - class UnicodeOrId(KaitaiStruct): - """Resources use a special serialization of names and types: they - can be either a number or a string. - - Use `is_string` to check which kind we've got here, and then use - `as_numeric` or `as_string` to get relevant value. - """ - SEQ_FIELDS = ["first", "as_numeric", "rest", "noop"] - def __init__(self, _io, _parent=None, _root=None): - self._io = _io - self._parent = _parent - self._root = _root if _root else self - self._debug = collections.defaultdict(dict) - - def _read(self): - if self.save_pos1 >= 0: - self._debug['first']['start'] = self._io.pos() - self.first = self._io.read_u2le() - self._debug['first']['end'] = self._io.pos() - - if not (self.is_string): - self._debug['as_numeric']['start'] = self._io.pos() - self.as_numeric = self._io.read_u2le() - self._debug['as_numeric']['end'] = self._io.pos() - - if self.is_string: - self._debug['rest']['start'] = self._io.pos() - self.rest = [] - i = 0 - while True: - if not 'arr' in self._debug['rest']: - self._debug['rest']['arr'] = [] - self._debug['rest']['arr'].append({'start': self._io.pos()}) - _ = self._io.read_u2le() - self.rest.append(_) - self._debug['rest']['arr'][len(self.rest) - 1]['end'] = self._io.pos() - if _ == 0: - break - i += 1 - self._debug['rest']['end'] = self._io.pos() - - if ((self.is_string) and (self.save_pos2 >= 0)) : - self._debug['noop']['start'] = self._io.pos() - self.noop = self._io.read_bytes(0) - self._debug['noop']['end'] = self._io.pos() - - - @property - def save_pos1(self): - if hasattr(self, '_m_save_pos1'): - return self._m_save_pos1 if hasattr(self, '_m_save_pos1') else None - - self._m_save_pos1 = self._io.pos() - return self._m_save_pos1 if hasattr(self, '_m_save_pos1') else None - - @property - def save_pos2(self): - if hasattr(self, '_m_save_pos2'): - return self._m_save_pos2 if hasattr(self, '_m_save_pos2') else None - - self._m_save_pos2 = self._io.pos() - return self._m_save_pos2 if hasattr(self, '_m_save_pos2') else None - - @property - def is_string(self): - if hasattr(self, '_m_is_string'): - return self._m_is_string if hasattr(self, '_m_is_string') else None - - self._m_is_string = self.first != 65535 - return self._m_is_string if hasattr(self, '_m_is_string') else None - - @property - def as_string(self): - if hasattr(self, '_m_as_string'): - return self._m_as_string if hasattr(self, '_m_as_string') else None - - if self.is_string: - _pos = self._io.pos() - self._io.seek(self.save_pos1) - self._debug['_m_as_string']['start'] = self._io.pos() - self._m_as_string = (self._io.read_bytes(((self.save_pos2 - self.save_pos1) - 2))).decode(u"UTF-16LE") - self._debug['_m_as_string']['end'] = self._io.pos() - self._io.seek(_pos) - - return self._m_as_string if hasattr(self, '_m_as_string') else None - - - diff --git a/python/examples/kaitai/kaitai_struct_formats/windows/windows_shell_items.py b/python/examples/kaitai/kaitai_struct_formats/windows/windows_shell_items.py deleted file mode 100644 index a1805915..00000000 --- a/python/examples/kaitai/kaitai_struct_formats/windows/windows_shell_items.py +++ /dev/null @@ -1,190 +0,0 @@ -from __future__ import absolute_import -# This is a generated file! Please edit source .ksy file and use kaitai-struct-compiler to rebuild - -from pkg_resources import parse_version -from ...kaitaistruct import __version__ as ks_version, KaitaiStruct, KaitaiStream, BytesIO -import collections - - -if parse_version(ks_version) < parse_version('0.7'): - raise Exception("Incompatible Kaitai Struct Python API: 0.7 or later is required, but you have %s" % (ks_version)) - -class WindowsShellItems(KaitaiStruct): - """Windows Shell Items (AKA "shellbags") is an undocumented set of - structures used internally within Windows to identify paths in - Windows Folder Hierarchy. It is widely used in Windows Shell (and - most visible in File Explorer), both as in-memory and in-file - structures. Some formats embed them, namely: - - * Windows Shell link files (.lnk) Windows registry - * Windows registry "ShellBags" keys - - The format is mostly undocumented, and is known to vary between - various Windows versions. - - .. seealso:: - Source - https://github.com/libyal/libfwsi/blob/master/documentation/Windows%20Shell%20Item%20format.asciidoc - """ - SEQ_FIELDS = ["items"] - def __init__(self, _io, _parent=None, _root=None): - self._io = _io - self._parent = _parent - self._root = _root if _root else self - self._debug = collections.defaultdict(dict) - - def _read(self): - self._debug['items']['start'] = self._io.pos() - self.items = [] - i = 0 - while True: - if not 'arr' in self._debug['items']: - self._debug['items']['arr'] = [] - self._debug['items']['arr'].append({'start': self._io.pos()}) - _t_items = self._root.ShellItem(self._io, self, self._root) - _t_items._read() - _ = _t_items - self.items.append(_) - self._debug['items']['arr'][len(self.items) - 1]['end'] = self._io.pos() - if _.len_data == 0: - break - i += 1 - self._debug['items']['end'] = self._io.pos() - - class ShellItemData(KaitaiStruct): - SEQ_FIELDS = ["code", "body1", "body2"] - def __init__(self, _io, _parent=None, _root=None): - self._io = _io - self._parent = _parent - self._root = _root if _root else self - self._debug = collections.defaultdict(dict) - - def _read(self): - self._debug['code']['start'] = self._io.pos() - self.code = self._io.read_u1() - self._debug['code']['end'] = self._io.pos() - self._debug['body1']['start'] = self._io.pos() - _on = self.code - if _on == 31: - self.body1 = self._root.RootFolderBody(self._io, self, self._root) - self.body1._read() - self._debug['body1']['end'] = self._io.pos() - self._debug['body2']['start'] = self._io.pos() - _on = (self.code & 112) - if _on == 32: - self.body2 = self._root.VolumeBody(self._io, self, self._root) - self.body2._read() - elif _on == 48: - self.body2 = self._root.FileEntryBody(self._io, self, self._root) - self.body2._read() - self._debug['body2']['end'] = self._io.pos() - - - class ShellItem(KaitaiStruct): - """ - .. seealso:: - Section 2.2.2 - https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/MS-SHLLINK/[MS-SHLLINK].pdf - """ - SEQ_FIELDS = ["len_data", "data"] - def __init__(self, _io, _parent=None, _root=None): - self._io = _io - self._parent = _parent - self._root = _root if _root else self - self._debug = collections.defaultdict(dict) - - def _read(self): - self._debug['len_data']['start'] = self._io.pos() - self.len_data = self._io.read_u2le() - self._debug['len_data']['end'] = self._io.pos() - if self.len_data >= 2: - self._debug['data']['start'] = self._io.pos() - self._raw_data = self._io.read_bytes((self.len_data - 2)) - io = KaitaiStream(BytesIO(self._raw_data)) - self.data = self._root.ShellItemData(io, self, self._root) - self.data._read() - self._debug['data']['end'] = self._io.pos() - - - - class RootFolderBody(KaitaiStruct): - """ - .. seealso:: - Source - https://github.com/libyal/libfwsi/blob/master/documentation/Windows%20Shell%20Item%20format.asciidoc#32-root-folder-shell-item - """ - SEQ_FIELDS = ["sort_index", "shell_folder_id"] - def __init__(self, _io, _parent=None, _root=None): - self._io = _io - self._parent = _parent - self._root = _root if _root else self - self._debug = collections.defaultdict(dict) - - def _read(self): - self._debug['sort_index']['start'] = self._io.pos() - self.sort_index = self._io.read_u1() - self._debug['sort_index']['end'] = self._io.pos() - self._debug['shell_folder_id']['start'] = self._io.pos() - self.shell_folder_id = self._io.read_bytes(16) - self._debug['shell_folder_id']['end'] = self._io.pos() - - - class VolumeBody(KaitaiStruct): - """ - .. seealso:: - Source - https://github.com/libyal/libfwsi/blob/master/documentation/Windows%20Shell%20Item%20format.asciidoc#33-volume-shell-item - """ - SEQ_FIELDS = ["flags"] - def __init__(self, _io, _parent=None, _root=None): - self._io = _io - self._parent = _parent - self._root = _root if _root else self - self._debug = collections.defaultdict(dict) - - def _read(self): - self._debug['flags']['start'] = self._io.pos() - self.flags = self._io.read_u1() - self._debug['flags']['end'] = self._io.pos() - - - class FileEntryBody(KaitaiStruct): - """ - .. seealso:: - Source - https://github.com/libyal/libfwsi/blob/master/documentation/Windows%20Shell%20Item%20format.asciidoc#34-file-entry-shell-item - """ - SEQ_FIELDS = ["_unnamed0", "file_size", "last_mod_time", "file_attrs"] - def __init__(self, _io, _parent=None, _root=None): - self._io = _io - self._parent = _parent - self._root = _root if _root else self - self._debug = collections.defaultdict(dict) - - def _read(self): - self._debug['_unnamed0']['start'] = self._io.pos() - self._unnamed0 = self._io.read_u1() - self._debug['_unnamed0']['end'] = self._io.pos() - self._debug['file_size']['start'] = self._io.pos() - self.file_size = self._io.read_u4le() - self._debug['file_size']['end'] = self._io.pos() - self._debug['last_mod_time']['start'] = self._io.pos() - self.last_mod_time = self._io.read_u4le() - self._debug['last_mod_time']['end'] = self._io.pos() - self._debug['file_attrs']['start'] = self._io.pos() - self.file_attrs = self._io.read_u2le() - self._debug['file_attrs']['end'] = self._io.pos() - - @property - def is_dir(self): - if hasattr(self, '_m_is_dir'): - return self._m_is_dir if hasattr(self, '_m_is_dir') else None - - self._m_is_dir = (self._parent.code & 1) != 0 - return self._m_is_dir if hasattr(self, '_m_is_dir') else None - - @property - def is_file(self): - if hasattr(self, '_m_is_file'): - return self._m_is_file if hasattr(self, '_m_is_file') else None - - self._m_is_file = (self._parent.code & 2) != 0 - return self._m_is_file if hasattr(self, '_m_is_file') else None - - - diff --git a/python/examples/kaitai/kaitai_struct_formats/windows/windows_systemtime.py b/python/examples/kaitai/kaitai_struct_formats/windows/windows_systemtime.py deleted file mode 100644 index 4d3e288b..00000000 --- a/python/examples/kaitai/kaitai_struct_formats/windows/windows_systemtime.py +++ /dev/null @@ -1,52 +0,0 @@ -from __future__ import absolute_import -# This is a generated file! Please edit source .ksy file and use kaitai-struct-compiler to rebuild - -from pkg_resources import parse_version -from ...kaitaistruct import __version__ as ks_version, KaitaiStruct, KaitaiStream, BytesIO -import collections - - -if parse_version(ks_version) < parse_version('0.7'): - raise Exception("Incompatible Kaitai Struct Python API: 0.7 or later is required, but you have %s" % (ks_version)) - -class WindowsSystemtime(KaitaiStruct): - """Microsoft Windows SYSTEMTIME structure, stores individual components - of date and time as individual fields, up to millisecond precision. - - .. seealso:: - Source - https://msdn.microsoft.com/en-us/library/windows/desktop/ms724950.aspx - """ - SEQ_FIELDS = ["year", "month", "dow", "day", "hour", "min", "sec", "msec"] - def __init__(self, _io, _parent=None, _root=None): - self._io = _io - self._parent = _parent - self._root = _root if _root else self - self._debug = collections.defaultdict(dict) - - def _read(self): - self._debug['year']['start'] = self._io.pos() - self.year = self._io.read_u2le() - self._debug['year']['end'] = self._io.pos() - self._debug['month']['start'] = self._io.pos() - self.month = self._io.read_u2le() - self._debug['month']['end'] = self._io.pos() - self._debug['dow']['start'] = self._io.pos() - self.dow = self._io.read_u2le() - self._debug['dow']['end'] = self._io.pos() - self._debug['day']['start'] = self._io.pos() - self.day = self._io.read_u2le() - self._debug['day']['end'] = self._io.pos() - self._debug['hour']['start'] = self._io.pos() - self.hour = self._io.read_u2le() - self._debug['hour']['end'] = self._io.pos() - self._debug['min']['start'] = self._io.pos() - self.min = self._io.read_u2le() - self._debug['min']['end'] = self._io.pos() - self._debug['sec']['start'] = self._io.pos() - self.sec = self._io.read_u2le() - self._debug['sec']['end'] = self._io.pos() - self._debug['msec']['start'] = self._io.pos() - self.msec = self._io.read_u2le() - self._debug['msec']['end'] = self._io.pos() - - |