Fixed-integer types

Object properties

class malduck.ints.IntType[source]

Fixed-size variant of long type with C-style operators and casting

Supports ctypes-like multiplication for unpacking tuple of values

IntTypes are derived from long type, so they are fully compatible with other numeric types

res = u32(0x8080FFFF) << 16 | 0xFFFF
> 0xFFFFFFFF
res = Int32(res)
> -1

Using IntTypes you don’t need to mask everything with 0xFFFFFFFF, only if you remember about appropriate casting.

from malduck import DWORD

def rol7_hash(name: bytes):
    hh = 0
    for c in name:
        hh = DWORD(x).rol(7) ^ c
    return x

def sdbm_hash(name: bytes):
    hh = 0
    for c in name:
        hh = DWORD(c) + (hh << 6) + (hh << 16) - hh
    return hh

Type coercion between native and fixed integers depends on LHS type:

UInt32 = UInt32 + int
int = int + UInt32

IntTypes can be multiplied like ctypes classes for unpacking tuple of values:

values = (BYTE * 3).unpack('\x01\x02\x03')

values -> (1, 2, 3)
pack()[source]

Pack value into bytes with little-endian order

pack_be()[source]

Pack value into bytes with big-endian order

rol(other)[source]

Bitwise rotate left

ror(other)[source]

Bitwise rotate right

classmethod unpack(other, offset=0, fixed=True)[source]

Unpacks single value from provided buffer with little-endian order

Parameters

  • other (bytes) – Buffer object containing value to unpack

  • offset (int) – Buffer offset

  • fixed (bool (default: True)) – Convert to fixed-size integer (IntType instance)

Return type

IntType instance or None if there are not enough data to unpack

Warning

Fixed-size integer operations are 4-5 times slower than equivalent on built-in integer types

classmethod unpack_be(other, offset=0, fixed=True)[source]

Unpacks single value from provided buffer with big-endian order

Parameters

  • other (bytes) – Buffer object containing value to unpack

  • offset (int) – Buffer offset

  • fixed (bool (default: True)) – Convert to fixed-size integer (IntType instance)

Return type

IntType instance or None if there are not enough data to unpack

Warning

Fixed-size integer operations are 4-5 times slower than equivalent on built-in integer types

class malduck.ints.IntTypeBase[source]

Base class representing all IntType instances

class malduck.ints.MultipliedIntTypeBase[source]

Base class representing all MultipliedIntType instances

class malduck.ints.MetaIntType[source]

Metaclass for IntType classes. Provides ctypes-like behavior e.g. (QWORD*8).unpack(…) returns tuple of 8 QWORDs

property invert_mask

Mask for sign bit

property mask

Mask for potentially overflowing operations

UInt64/UInt32/UInt16/UInt8 (QWORD/DWORD/WORD/BYTE)

malduck.QWORD

alias of malduck.ints.UInt64

malduck.DWORD

alias of malduck.ints.UInt32

malduck.WORD

alias of malduck.ints.UInt16

malduck.BYTE

alias of malduck.ints.UInt8

class malduck.ints.UInt64
class malduck.ints.UInt32
class malduck.ints.UInt16
class malduck.ints.UInt8

Int64/Int32/Int16/Int8

class malduck.ints.Int64
class malduck.ints.Int32
class malduck.ints.Int16
class malduck.ints.Int8