malstruct.lib package

Submodules

malstruct.lib.binary module

malstruct.lib.binary.integer2bits(number, width, signed=False)

Converts an integer into its binary representation in a bit-string. Width is the amount of bits to generate. Each bit is represented as either \x00 or \x01. The most significant bit is first, big-endian. This is reverse to bits2integer.

Examples:

>>> integer2bits(19, 8)
b'\x00\x00\x00\x01\x00\x00\x01\x01'

malstruct.lib.binary.integer2bytes(number, width, signed=False)

Converts an integer into a byte-string. This is reverse to bytes2integer.

Examples:

>>> integer2bytes(19, 4)
'\x00\x00\x00\x13'

malstruct.lib.binary.bits2integer(data, signed=False)

Converts a bit-string into an integer. Set signed to interpret the number as a 2-s complement signed integer. This is reverse to integer2bits.

Examples:

>>> bits2integer(b"\x01\x00\x00\x01\x01")
19

malstruct.lib.binary.bytes2integer(data, signed=False)

Converts a byte-string into an integer. This is reverse to integer2bytes.

Examples:

>>> bytes2integer(b'\x00\x00\x00\x13')
19

malstruct.lib.binary.bytes2bits(data)

Converts between bit-string and byte-string representations, both as bytes type.

Example:

>>> bytes2bits(b'ab')
b"\x00\x01\x01\x00\x00\x00\x00\x01\x00\x01\x01\x00\x00\x00\x01\x00"

malstruct.lib.binary.bits2bytes(data)

Converts between bit-string and byte-string representations, both as bytes type. Its length must be multiple of 8.

Example:

>>> bits2bytes(b"\x00\x01\x01\x00\x00\x00\x00\x01\x00\x01\x01\x00\x00\x00\x01\x00")
b'ab'

malstruct.lib.binary.swapbytes(data)

Performs an endianness swap on byte-string.

Example:

>>> swapbytes(b'abcd')
b'dcba'

malstruct.lib.binary.swapbytesinbits(data)

Performs an byte-swap within a bit-string. Its length must be multiple of 8.

Example:

>>> swapbytesinbits(b'0000000011111111')
b'1111111100000000'

malstruct.lib.binary.swapbitsinbytes(data)

Performs a bit-reversal on each byte within a byte-string.

Example:

>>> swapbitsinbytes(b"\xf0\x00")
b"\x0f\x00"

malstruct.lib.binary.hexlify(data)

Returns binascii.hexlify(data).

malstruct.lib.binary.unhexlify(data)

Returns binascii.unhexlify(data).

malstruct.lib.bitstream module

class malstruct.lib.bitstream.RestreamedBytesIO(substream, decoder, decoderunit, encoder, encoderunit)

Bases: object

read(count=None)

write(data)

close()

seek(at, whence=0)

seekable()

tell()

WARNING: tell is correct only on read-only and write-only instances.

tellable()

class malstruct.lib.bitstream.RebufferedBytesIO(substream, tailcutoff=None)

Bases: object

read(count=None)

write(data)

seek(at, whence=0)

seekable()

tell()

tellable()

cachedfrom()

cachedto()

malstruct.lib.containers module

malstruct.lib.containers.setGlobalPrintFullStrings(enabled=False)

When enabled, Container __str__ produces full content of bytes and unicode strings, otherwise and by default, it produces truncated output (16 bytes and 32 characters).

Parameters:

enabled – bool

malstruct.lib.containers.setGlobalPrintFalseFlags(enabled=False)

When enabled, Container __str__ that was produced by FlagsEnum parsing prints all values, otherwise and by default, it prints only the values that are True.

Parameters:

enabled – bool

malstruct.lib.containers.setGlobalPrintPrivateEntries(enabled=False)

When enabled, Container __str__ shows keys like _ _index _etc, otherwise and by default, it hides those keys. __repr__ never shows private entries.

Parameters:

enabled – bool

malstruct.lib.containers.recursion_lock(retval='<recursion detected>', lock_name='__recursion_lock__')

Used internally.

malstruct.lib.containers.value_to_string(value)

class malstruct.lib.containers.Container(*args, **kwargs)

Bases: dict

Generic ordered dictionary that allows both key and attribute access, and preserves key order by insertion. Adding keys is preferred using **entrieskw. Equality does NOT check item order. Also provides regex searching.

Example:

>>> Container()
>>> Container([("name", "anonymous"), ("age", 21)])
>>> Container(name="anonymous", age=21)
>>> Container(dict2)
>>> Container(container2)

>>> print(repr(obj))
Container(text='utf8 decoded string...', value=123)
>>> print(obj)
Container
    text = u'utf8 decoded string...' (total 22)
    value = 123

copy() → a shallow copy of D

search(pattern)

Searches a container (non-recursively) using regex.

search_all(pattern)

Searches a container (recursively) using regex.

class malstruct.lib.containers.ListContainer(iterable=(), /)

Bases: list

Generic container like list. Provides pretty-printing. Also provides regex searching.

Example:

>>> ListContainer()
>>> ListContainer([1, 2, 3])

>>> obj
ListContainer([1, 2, 3])
>>> print(repr(obj))
ListContainer([1, 2, 3])
>>> print(obj)
ListContainer
    1
    2
    3

search(pattern)

Searches a container (non-recursively) using regex.

search_all(pattern)

Searches a container (recursively) using regex.

malstruct.lib.custombase64 module

Custom Base64 related utility

malstruct.lib.custombase64.b64encode(data, alphabet=None)

Base64 encode :param data: data. :param alphabet: custom alphabet or standard alphabet. :return: base64 encoded data.

>>> b64encode('hello world')
'aGVsbG8gd29ybGQ='
>>> custom_alphabet = b'EFGHQRSTUVWefghijklmnopIJKLMNOPABCDqrstuvwxyXYZabcdz0123456789+/='
>>> b64encode('hello world', alphabet=custom_alphabet)
'LSoXMS8BO29dMSj='

malstruct.lib.custombase64.b64decode(data, alphabet=None)

Base64 decode (pads characters if necessary) :param data: base64 encoded data. :param alphabet: custom alphabet or standard alphabet. :return: base64 decoded data.

>>> b64decode('aGVsbG8gd29ybGQ=')
'hello world'
>>> custom_alphabet = b'EFGHQRSTUVWefghijklmnopIJKLMNOPABCDqrstuvwxyXYZabcdz0123456789+/='
>>> b64decode('LSoXMS8BO29dMSj=', alphabet=custom_alphabet)
'hello world'
>>> b64decode('LSoXMS8BO29dMSj', alphabet=custom_alphabet)
'hello world'

malstruct.lib.custombase64.b32encode(data, alphabet=None)

Base32 encodes :param data: data :param alphabet: custom alphabet or standard alphabet. :return: base32 encoded data.

>>> b32encode('hello world')
'NBSWY3DPEB3W64TMMQ======'
>>> custom_alphabet = 'FGHIJQ345RSTUVWXYKLMABCDENOPZ267='
>>> b32encode('hello world', alphabet=custom_alphabet)
'VGLCEPIXJGPC6ZMUUY======'

malstruct.lib.custombase64.b32decode(data, alphabet=None)

Base32 decode (pads characters if necessary) :param data: base32 encoded data. :param alphabet: custom alphabet or standard alphabet. :return: base32 decoded data.

>>> b32decode('NBSWY3DPEB3W64TMMQ======')
'hello world'
>>> custom_alphabet = 'FGHIJQ345RSTUVWXYKLMABCDENOPZ267='
>>> b32decode('VGLCEPIXJGPC6ZMUUY======', alphabet=custom_alphabet)
'hello world'
>>> b32decode('VGLCEPIXJGPC6ZMUUY', alphabet=custom_alphabet)
'hello world'

malstruct.lib.custombase64.b16encode(data, alphabet=None)

Base16 encodes :param data: data :param alphabet: custom alphabet or standard alphabet. :return: base16 encoded data.

>>> b16encode('hello world')
'68656C6C6F20776F726C64'
>>> custom_alphabet = '78BDE0123F459A6C'
>>> b16encode('hello world', alphabet=custom_alphabet)
'131019191CB7221C2B191E'

malstruct.lib.custombase64.b16decode(data, alphabet=None)

Base16 decode :param data: base16 encoded data. :param alphabet: custom alphabet or standard alphabet. :return: base16 decoded data.

>>> b16decode('68656C6C6F20776F726C64')
'hello world'
>>> custom_alphabet = '78BDE0123F459A6C'
>>> b16decode('131019191CB7221C2B191E', alphabet=custom_alphabet)
'hello world'

malstruct.lib.hexd module

class malstruct.lib.hexd.HexDisplayedInteger

Bases: int

Used internally.

static new(intvalue, fmtstr)

class malstruct.lib.hexd.HexDisplayedBytes

Bases: bytes

Used internally.

class malstruct.lib.hexd.HexDisplayedDict

Bases: dict

Used internally.

class malstruct.lib.hexd.HexDumpDisplayedBytes

Bases: bytes

Used internally.

class malstruct.lib.hexd.HexDumpDisplayedDict

Bases: dict

Used internally.

malstruct.lib.hexd.hexdump(data, linesize)

Turns bytes into a unicode string of the format:

>>>print(hexdump(b'0' * 100, 16))
hexundump(\"\"\"
0000   30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30   0000000000000000
0010   30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30   0000000000000000
0020   30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30   0000000000000000
0030   30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30   0000000000000000
0040   30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30   0000000000000000
0050   30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30   0000000000000000
0060   30 30 30 30                                       0000
\"\"\")

malstruct.lib.hexd.hexundump(data, linesize)

Reverse of hexdump.

Module contents