Common string operations (padding, chunks, base64)

Supports most common string operations e.g.:

  • packing/unpacking:

    p64(), p32(), p16(), p8()

    u64(), u32(), u16(), u8()

  • chunks: chunks_iter(), chunks()

chunks/chunks_iter

malduck.chunks_iter(s: T, n: int) → Iterator[T][source]

Yield successive n-sized chunks from s.

malduck.chunks(s: T, n: int) → List[T][source]

Return list of successive n-sized chunks from s.

asciiz/utf16z

malduck.asciiz(s: bytes) → bytes[source]

Treats s as null-terminated ASCII string

Parameters:

s (bytes) – Buffer containing null-terminated ASCII string

malduck.utf16z(s: bytes) → bytes[source]

Treats s as null-terminated UTF-16 ASCII string

Parameters:

s (bytes) – Buffer containing null-terminated UTF-16 string

Returns:

ASCII string without ‘' terminator

Return type:

bytes

enhex/unhex

malduck.enhex(s: bytes) → bytes[source]

Changed in version 2.0.0: Renamed from malduck.hex()

malduck.unhex(s: str | bytes) → bytes[source]
malduck.uleb128(s: bytes) → Tuple[int, int] | None[source]

Unsigned Little-Endian Base 128

malduck.base64(s: str | bytes) → bytes

Base64 encoder/decoder

Padding (null/pkcs7)

malduck.pad(s: bytes, block_size: int) → bytes

Padding PKCS7/NULL

malduck.unpad(s: bytes) → bytes

Unpadding PKCS7/NULL

Packing/unpacking (p64/p32/p16/p8, u64/u32/u16/u8, bigint)

malduck.uint64(other: bytes, offset: int = 0, fixed: bool = True) → IntType | int | None

Unpacks single value from provided buffer with little-endian order

Parameters:

  • other (bytes) – Buffer object containing value to unpack

  • offset (int) – Buffer offset

  • fixed (bool (default: True)) – Convert to fixed-size integer (IntType instance)

Return type:

IntType instance or None if there are not enough data to unpack

Warning

Fixed-size integer operations are 4-5 times slower than equivalent on built-in integer types

malduck.uint32(other: bytes, offset: int = 0, fixed: bool = True) → IntType | int | None

Unpacks single value from provided buffer with little-endian order

Parameters:

  • other (bytes) – Buffer object containing value to unpack

  • offset (int) – Buffer offset

  • fixed (bool (default: True)) – Convert to fixed-size integer (IntType instance)

Return type:

IntType instance or None if there are not enough data to unpack

Warning

Fixed-size integer operations are 4-5 times slower than equivalent on built-in integer types

malduck.uint16(other: bytes, offset: int = 0, fixed: bool = True) → IntType | int | None

Unpacks single value from provided buffer with little-endian order

Parameters:

  • other (bytes) – Buffer object containing value to unpack

  • offset (int) – Buffer offset

  • fixed (bool (default: True)) – Convert to fixed-size integer (IntType instance)

Return type:

IntType instance or None if there are not enough data to unpack

Warning

Fixed-size integer operations are 4-5 times slower than equivalent on built-in integer types

malduck.uint8(other: bytes, offset: int = 0, fixed: bool = True) → IntType | int | None

Unpacks single value from provided buffer with little-endian order

Parameters:

  • other (bytes) – Buffer object containing value to unpack

  • offset (int) – Buffer offset

  • fixed (bool (default: True)) – Convert to fixed-size integer (IntType instance)

Return type:

IntType instance or None if there are not enough data to unpack

Warning

Fixed-size integer operations are 4-5 times slower than equivalent on built-in integer types

malduck.u64(other: bytes, offset: int = 0, fixed: bool = True) → IntType | int | None

Unpacks single value from provided buffer with little-endian order

Parameters:

  • other (bytes) – Buffer object containing value to unpack

  • offset (int) – Buffer offset

  • fixed (bool (default: True)) – Convert to fixed-size integer (IntType instance)

Return type:

IntType instance or None if there are not enough data to unpack

Warning

Fixed-size integer operations are 4-5 times slower than equivalent on built-in integer types

malduck.u32(other: bytes, offset: int = 0, fixed: bool = True) → IntType | int | None

Unpacks single value from provided buffer with little-endian order

Parameters:

  • other (bytes) – Buffer object containing value to unpack

  • offset (int) – Buffer offset

  • fixed (bool (default: True)) – Convert to fixed-size integer (IntType instance)

Return type:

IntType instance or None if there are not enough data to unpack

Warning

Fixed-size integer operations are 4-5 times slower than equivalent on built-in integer types

malduck.u16(other: bytes, offset: int = 0, fixed: bool = True) → IntType | int | None

Unpacks single value from provided buffer with little-endian order

Parameters:

  • other (bytes) – Buffer object containing value to unpack

  • offset (int) – Buffer offset

  • fixed (bool (default: True)) – Convert to fixed-size integer (IntType instance)

Return type:

IntType instance or None if there are not enough data to unpack

Warning

Fixed-size integer operations are 4-5 times slower than equivalent on built-in integer types

malduck.u8(other: bytes, offset: int = 0, fixed: bool = True) → IntType | int | None

Unpacks single value from provided buffer with little-endian order

Parameters:

  • other (bytes) – Buffer object containing value to unpack

  • offset (int) – Buffer offset

  • fixed (bool (default: True)) – Convert to fixed-size integer (IntType instance)

Return type:

IntType instance or None if there are not enough data to unpack

Warning

Fixed-size integer operations are 4-5 times slower than equivalent on built-in integer types

malduck.p64(v)[source]
malduck.p32(v)[source]
malduck.p16(v)[source]
malduck.p8(v)[source]
malduck.bigint.unpack(other: bytes, size: int | None = None) → int

Unpacks bigint value from provided buffer with little-endian order

New in version 4.0.0: Use bigint.unpack instead of bigint() method

Parameters:

  • other (bytes) – Buffer object containing value to unpack

  • size (bytes, optional) – Size of bigint in bytes

Return type:

int

malduck.bigint.pack(other: int, size: int | None = None) → bytes

Packs bigint value into bytes with little-endian order

New in version 4.0.0: Use bigint.pack instead of bigint() method

Parameters:

  • other (int) – Value to be packed

  • size (bytes, optional) – Size of bigint in bytes

Return type:

bytes

malduck.bigint.unpack_be(other: bytes, size: int | None = None) → int

Unpacks bigint value from provided buffer with big-endian order

Parameters:

  • other (bytes) – Buffer object containing value to unpack

  • size (bytes, optional) – Size of bigint in bytes

Return type:

int

malduck.bigint.pack_be(other: int, size: int | None = None) → bytes

Packs bigint value into bytes with big-endian order

New in version 4.0.0: Use bigint.pack instead of bigint() method

Parameters:

  • other (int) – Value to be packed

  • size (bytes, optional) – Size of bigint in bytes

Return type:

bytes

IPv4 inet_ntoa

malduck.ipv4(s: bytes | int) → str | None[source]

Decodes IPv4 address and returns dot-decimal notation

Parameters:

s (int or bytes) – Buffer or integer value to be decoded as IPv4

Return type:

str