Fixed-integer types

Object properties

class malduck.ints.IntType(value: Any)

Fixed-size variant of int type with C-style operators and casting

Supports ctypes-like multiplication for unpacking tuple of values

• Unsigned types:

  UInt64 (QWORD), UInt32 (DWORD), UInt16 (WORD), UInt8 (BYTE or CHAR)

• Signed types:

  Int64, Int32, Int16, Int8

IntTypes are derived from int type, so they are fully compatible with other numeric types

res = u32(0x8080FFFF) << 16 | 0xFFFF
> 0xFFFFFFFF
res = Int32(res)
> -1

Using IntTypes you don’t need to mask everything with 0xFFFFFFFF, only if you remember about appropriate casting.

from malduck import DWORD

def rol7_hash(name: bytes):
    hh = 0
    for c in name:
        hh = DWORD(x).rol(7) ^ c
    return x

def sdbm_hash(name: bytes):
    hh = 0
    for c in name:
        hh = DWORD(c) + (hh << 6) + (hh << 16) - hh
    return hh

Type coercion between native and fixed integers depends on LHS type:

UInt32 = UInt32 + int
int = int + UInt32

IntTypes can be multiplied like ctypes classes for unpacking tuple of values:

values = (BYTE * 3).unpack('\x01\x02\x03')

values -> (1, 2, 3)

pack() → bytes

Pack value into bytes with little-endian order

pack_be() → bytes

Pack value into bytes with big-endian order

rol(other) → IntType

Bitwise rotate left

ror(other) → IntType

Bitwise rotate right

classmethod unpack(other: bytes, offset: int = 0, fixed: bool = True) → IntType | int | None

Unpacks single value from provided buffer with little-endian order

Parameters:

• other (bytes) – Buffer object containing value to unpack

• offset (int) – Buffer offset

• fixed (bool (default: True)) – Convert to fixed-size integer (IntType instance)

Return type:

IntType instance or None if there are not enough data to unpack

Warning

Fixed-size integer operations are 4-5 times slower than equivalent on built-in integer types

classmethod unpack_be(other: bytes, offset: int = 0, fixed: bool = True) → IntType | int | None

Unpacks single value from provided buffer with big-endian order

Parameters:

• other (bytes) – Buffer object containing value to unpack

• offset (int) – Buffer offset

• fixed (bool (default: True)) – Convert to fixed-size integer (IntType instance)

Return type:

IntType instance or None if there are not enough data to unpack

Warning

Fixed-size integer operations are 4-5 times slower than equivalent on built-in integer types

class malduck.ints.IntTypeBase

Base class representing all IntType instances

class malduck.ints.MultipliedIntTypeBase

Base class representing all MultipliedIntType instances

class malduck.ints.MetaIntType

Metaclass for IntType classes. Provides ctypes-like behavior e.g. (QWORD*8).unpack(…) returns tuple of 8 QWORDs

property invert_mask: int

Mask for sign bit

property mask: int

Mask for potentially overflowing operations

UInt64/UInt32/UInt16/UInt8 (QWORD/DWORD/WORD/BYTE)

malduck.QWORD

alias of UInt64

malduck.DWORD

alias of UInt32

malduck.WORD

alias of UInt16

malduck.BYTE

alias of UInt8

class malduck.ints.UInt64(value: Any)

class malduck.ints.UInt32(value: Any)

class malduck.ints.UInt16(value: Any)

class malduck.ints.UInt8(value: Any)

Int64/Int32/Int16/Int8

class malduck.ints.Int64(value: Any)

class malduck.ints.Int32(value: Any)

class malduck.ints.Int16(value: Any)

class malduck.ints.Int8(value: Any)