Common string operations (padding, chunks, base64)

Supports most common string operations e.g.:

• packing/unpacking:

  p64(), p32(), p16(), p8()

  u64(), u32(), u16(), u8()

• chunks: chunks_iter(), chunks()

chunks/chunks_iter

malduck.chunks_iter(s: T, n: int) → Iterator[T]

Yield successive n-sized chunks from s.

malduck.chunks(s: T, n: int) → List[T]

Return list of successive n-sized chunks from s.

asciiz/utf16z

malduck.asciiz(s: bytes) → bytes

Treats s as null-terminated ASCII string

Parameters

s (bytes) – Buffer containing null-terminated ASCII string

malduck.utf16z(s: bytes) → bytes

Treats s as null-terminated UTF-16 ASCII string

Parameters

s (bytes) – Buffer containing null-terminated UTF-16 string

Returns

ASCII string without ‘’ terminator

Return type

bytes

enhex/unhex

malduck.enhex(s: bytes) → bytes

Changed in version 2.0.0: Renamed from malduck.hex()

malduck.unhex(s: Union[str, bytes]) → bytes

malduck.uleb128(s: bytes) → Optional[Tuple[int, int]]

Unsigned Little-Endian Base 128

malduck.base64(s: Union[str, bytes]) → bytes

Base64 encoder/decoder

Padding (null/pkcs7)

malduck.pad(s: bytes, block_size: int) → bytes

Padding PKCS7/NULL

malduck.unpad(s: bytes) → bytes

Unpadding PKCS7/NULL

Packing/unpacking (p64/p32/p16/p8, u64/u32/u16/u8, bigint)

malduck.uint64(other: bytes, offset: int = 0, fixed: bool = True) → Union[malduck.ints.IntType, int, None]

Unpacks single value from provided buffer with little-endian order

Parameters

• other (bytes) – Buffer object containing value to unpack

• offset (int) – Buffer offset

• fixed (bool (default: True)) – Convert to fixed-size integer (IntType instance)

Return type

IntType instance or None if there are not enough data to unpack

Warning

Fixed-size integer operations are 4-5 times slower than equivalent on built-in integer types

malduck.uint32(other: bytes, offset: int = 0, fixed: bool = True) → Union[malduck.ints.IntType, int, None]

Unpacks single value from provided buffer with little-endian order

Parameters

• other (bytes) – Buffer object containing value to unpack

• offset (int) – Buffer offset

• fixed (bool (default: True)) – Convert to fixed-size integer (IntType instance)

Return type

IntType instance or None if there are not enough data to unpack

Warning

Fixed-size integer operations are 4-5 times slower than equivalent on built-in integer types

malduck.uint16(other: bytes, offset: int = 0, fixed: bool = True) → Union[malduck.ints.IntType, int, None]

Unpacks single value from provided buffer with little-endian order

Parameters

• other (bytes) – Buffer object containing value to unpack

• offset (int) – Buffer offset

• fixed (bool (default: True)) – Convert to fixed-size integer (IntType instance)

Return type

IntType instance or None if there are not enough data to unpack

Warning

Fixed-size integer operations are 4-5 times slower than equivalent on built-in integer types

malduck.uint8(other: bytes, offset: int = 0, fixed: bool = True) → Union[malduck.ints.IntType, int, None]

Unpacks single value from provided buffer with little-endian order

Parameters

• other (bytes) – Buffer object containing value to unpack

• offset (int) – Buffer offset

• fixed (bool (default: True)) – Convert to fixed-size integer (IntType instance)

Return type

IntType instance or None if there are not enough data to unpack

Warning

Fixed-size integer operations are 4-5 times slower than equivalent on built-in integer types

malduck.u64(other: bytes, offset: int = 0, fixed: bool = True) → Union[malduck.ints.IntType, int, None]

Unpacks single value from provided buffer with little-endian order

Parameters

• other (bytes) – Buffer object containing value to unpack

• offset (int) – Buffer offset

• fixed (bool (default: True)) – Convert to fixed-size integer (IntType instance)

Return type

IntType instance or None if there are not enough data to unpack

Warning

Fixed-size integer operations are 4-5 times slower than equivalent on built-in integer types

malduck.u32(other: bytes, offset: int = 0, fixed: bool = True) → Union[malduck.ints.IntType, int, None]

Unpacks single value from provided buffer with little-endian order

Parameters

• other (bytes) – Buffer object containing value to unpack

• offset (int) – Buffer offset

• fixed (bool (default: True)) – Convert to fixed-size integer (IntType instance)

Return type

IntType instance or None if there are not enough data to unpack

Warning

Fixed-size integer operations are 4-5 times slower than equivalent on built-in integer types

malduck.u16(other: bytes, offset: int = 0, fixed: bool = True) → Union[malduck.ints.IntType, int, None]

Unpacks single value from provided buffer with little-endian order

Parameters

• other (bytes) – Buffer object containing value to unpack

• offset (int) – Buffer offset

• fixed (bool (default: True)) – Convert to fixed-size integer (IntType instance)

Return type

IntType instance or None if there are not enough data to unpack

Warning

Fixed-size integer operations are 4-5 times slower than equivalent on built-in integer types

malduck.u8(other: bytes, offset: int = 0, fixed: bool = True) → Union[malduck.ints.IntType, int, None]

Unpacks single value from provided buffer with little-endian order

Parameters

• other (bytes) – Buffer object containing value to unpack

• offset (int) – Buffer offset

• fixed (bool (default: True)) – Convert to fixed-size integer (IntType instance)

Return type

IntType instance or None if there are not enough data to unpack

Warning

Fixed-size integer operations are 4-5 times slower than equivalent on built-in integer types

malduck.p64(v)

malduck.p32(v)

malduck.p16(v)

malduck.p8(v)

malduck.bigint.unpack(other: bytes, size: Optional[int] = None) → int

Unpacks bigint value from provided buffer with little-endian order

New in version 4.0.0: Use bigint.unpack instead of bigint() method

Parameters

• other (bytes) – Buffer object containing value to unpack

• size (bytes, optional) – Size of bigint in bytes

Return type

int

malduck.bigint.pack(other: int, size: Optional[int] = None) → bytes

Packs bigint value into bytes with little-endian order

New in version 4.0.0: Use bigint.pack instead of bigint() method

Parameters

• other (int) – Value to be packed

• size (bytes, optional) – Size of bigint in bytes

Return type

bytes

malduck.bigint.unpack_be(other: bytes, size: Optional[int] = None) → int

Unpacks bigint value from provided buffer with big-endian order

Parameters

• other (bytes) – Buffer object containing value to unpack

• size (bytes, optional) – Size of bigint in bytes

Return type

int

malduck.bigint.pack_be(other: int, size: Optional[int] = None) → bytes

Packs bigint value into bytes with big-endian order

New in version 4.0.0: Use bigint.pack instead of bigint() method

Parameters

• other (int) – Value to be packed

• size (bytes, optional) – Size of bigint in bytes

Return type

bytes

IPv4 inet_ntoa

malduck.ipv4(s: Union[bytes, int]) → Optional[str]

Decodes IPv4 address and returns dot-decimal notation

Parameters

s (int or bytes) – Buffer or integer value to be decoded as IPv4

Return type

str