Common string operations (padding, chunks, base64)¶

Supports most common string operations e.g.:

  • packing/unpacking:

    p64(), p32(), p16(), p8()

    u64(), u32(), u16(), u8()

  • chunks: chunks_iter(), chunks()

chunks/chunks_iter¶

malduck.chunks_iter(s: T, n: int) → Iterator[T][source]¶

Yield successive n-sized chunks from s.

malduck.chunks(s: T, n: int) → List[T][source]¶

Return list of successive n-sized chunks from s.

asciiz/utf16z¶

malduck.asciiz(s: bytes) → bytes[source]¶

Treats s as null-terminated ASCII string

Parameters

s (bytes) – Buffer containing null-terminated ASCII string

malduck.utf16z(s: bytes) → bytes[source]¶

Treats s as null-terminated UTF-16 ASCII string

Parameters

s (bytes) – Buffer containing null-terminated UTF-16 string

Returns

ASCII string without ‘’ terminator

Return type

bytes

enhex/unhex¶

malduck.enhex(s: bytes) → bytes[source]¶

Changed in version 2.0.0: Renamed from malduck.hex()

malduck.unhex(s: Union[str, bytes]) → bytes[source]¶
malduck.uleb128(s: bytes) → Optional[Tuple[int, int]][source]¶

Unsigned Little-Endian Base 128

malduck.base64(s: Union[str, bytes]) → bytes¶

Base64 encoder/decoder

Padding (null/pkcs7)¶

malduck.pad(s: bytes, block_size: int) → bytes¶

Padding PKCS7/NULL

malduck.unpad(s: bytes) → bytes¶

Unpadding PKCS7/NULL

Packing/unpacking (p64/p32/p16/p8, u64/u32/u16/u8, bigint)¶

malduck.uint64(other: bytes, offset: int = 0, fixed: bool = True) → Union[malduck.ints.IntType, int, None]¶

Unpacks single value from provided buffer with little-endian order

Parameters
  • other (bytes) – Buffer object containing value to unpack

  • offset (int) – Buffer offset

  • fixed (bool (default: True)) – Convert to fixed-size integer (IntType instance)

Return type

IntType instance or None if there are not enough data to unpack

Warning

Fixed-size integer operations are 4-5 times slower than equivalent on built-in integer types

malduck.uint32(other: bytes, offset: int = 0, fixed: bool = True) → Union[malduck.ints.IntType, int, None]¶

Unpacks single value from provided buffer with little-endian order

Parameters
  • other (bytes) – Buffer object containing value to unpack

  • offset (int) – Buffer offset

  • fixed (bool (default: True)) – Convert to fixed-size integer (IntType instance)

Return type

IntType instance or None if there are not enough data to unpack

Warning

Fixed-size integer operations are 4-5 times slower than equivalent on built-in integer types

malduck.uint16(other: bytes, offset: int = 0, fixed: bool = True) → Union[malduck.ints.IntType, int, None]¶

Unpacks single value from provided buffer with little-endian order

Parameters
  • other (bytes) – Buffer object containing value to unpack

  • offset (int) – Buffer offset

  • fixed (bool (default: True)) – Convert to fixed-size integer (IntType instance)

Return type

IntType instance or None if there are not enough data to unpack

Warning

Fixed-size integer operations are 4-5 times slower than equivalent on built-in integer types

malduck.uint8(other: bytes, offset: int = 0, fixed: bool = True) → Union[malduck.ints.IntType, int, None]¶

Unpacks single value from provided buffer with little-endian order

Parameters
  • other (bytes) – Buffer object containing value to unpack

  • offset (int) – Buffer offset

  • fixed (bool (default: True)) – Convert to fixed-size integer (IntType instance)

Return type

IntType instance or None if there are not enough data to unpack

Warning

Fixed-size integer operations are 4-5 times slower than equivalent on built-in integer types

malduck.u64(other: bytes, offset: int = 0, fixed: bool = True) → Union[malduck.ints.IntType, int, None]¶

Unpacks single value from provided buffer with little-endian order

Parameters
  • other (bytes) – Buffer object containing value to unpack

  • offset (int) – Buffer offset

  • fixed (bool (default: True)) – Convert to fixed-size integer (IntType instance)

Return type

IntType instance or None if there are not enough data to unpack

Warning

Fixed-size integer operations are 4-5 times slower than equivalent on built-in integer types

malduck.u32(other: bytes, offset: int = 0, fixed: bool = True) → Union[malduck.ints.IntType, int, None]¶

Unpacks single value from provided buffer with little-endian order

Parameters
  • other (bytes) – Buffer object containing value to unpack

  • offset (int) – Buffer offset

  • fixed (bool (default: True)) – Convert to fixed-size integer (IntType instance)

Return type

IntType instance or None if there are not enough data to unpack

Warning

Fixed-size integer operations are 4-5 times slower than equivalent on built-in integer types

malduck.u16(other: bytes, offset: int = 0, fixed: bool = True) → Union[malduck.ints.IntType, int, None]¶

Unpacks single value from provided buffer with little-endian order

Parameters
  • other (bytes) – Buffer object containing value to unpack

  • offset (int) – Buffer offset

  • fixed (bool (default: True)) – Convert to fixed-size integer (IntType instance)

Return type

IntType instance or None if there are not enough data to unpack

Warning

Fixed-size integer operations are 4-5 times slower than equivalent on built-in integer types

malduck.u8(other: bytes, offset: int = 0, fixed: bool = True) → Union[malduck.ints.IntType, int, None]¶

Unpacks single value from provided buffer with little-endian order

Parameters
  • other (bytes) – Buffer object containing value to unpack

  • offset (int) – Buffer offset

  • fixed (bool (default: True)) – Convert to fixed-size integer (IntType instance)

Return type

IntType instance or None if there are not enough data to unpack

Warning

Fixed-size integer operations are 4-5 times slower than equivalent on built-in integer types

malduck.p64(v)[source]¶
malduck.p32(v)[source]¶
malduck.p16(v)[source]¶
malduck.p8(v)[source]¶
malduck.bigint.unpack(other: bytes, size: Optional[int] = None) → int¶

Unpacks bigint value from provided buffer with little-endian order

New in version 4.0.0: Use bigint.unpack instead of bigint() method

Parameters
  • other (bytes) – Buffer object containing value to unpack

  • size (bytes, optional) – Size of bigint in bytes

Return type

int

malduck.bigint.pack(other: int, size: Optional[int] = None) → bytes¶

Packs bigint value into bytes with little-endian order

New in version 4.0.0: Use bigint.pack instead of bigint() method

Parameters
  • other (int) – Value to be packed

  • size (bytes, optional) – Size of bigint in bytes

Return type

bytes

malduck.bigint.unpack_be(other: bytes, size: Optional[int] = None) → int¶

Unpacks bigint value from provided buffer with big-endian order

Parameters
  • other (bytes) – Buffer object containing value to unpack

  • size (bytes, optional) – Size of bigint in bytes

Return type

int

malduck.bigint.pack_be(other: int, size: Optional[int] = None) → bytes¶

Packs bigint value into bytes with big-endian order

New in version 4.0.0: Use bigint.pack instead of bigint() method

Parameters
  • other (int) – Value to be packed

  • size (bytes, optional) – Size of bigint in bytes

Return type

bytes

IPv4 inet_ntoa¶

malduck.ipv4(s: Union[bytes, int]) → Optional[str][source]¶

Decodes IPv4 address and returns dot-decimal notation

Parameters

s (int or bytes) – Buffer or integer value to be decoded as IPv4

Return type

str