Common string operations (padding, chunks, base64)

Supports most common string operations e.g.:

  • packing/unpacking:

    p64(), p32(), p16(), p8()

    u64(), u32(), u16(), u8()

  • chunks: chunks_iter(), chunks()

chunks/chunks_iter

malduck.chunks_iter(s, n)[source]

Yield successive n-sized chunks from s.

malduck.chunks(s, n)[source]

Return list of successive n-sized chunks from s.

asciiz/utf16z

malduck.asciiz(s)[source]

Treats s as null-terminated ASCII string

Parameters

s (bytes) – Buffer containing null-terminated ASCII string

malduck.utf16z(s)[source]

Treats s as null-terminated UTF-16 ASCII string

Parameters

s (bytes) – Buffer containing null-terminated UTF-16 string

Returns

ASCII string without ‘’ terminator

Return type

bytes

enhex/unhex

malduck.enhex(s)[source]

Changed in version 2.0.0: Renamed from malduck.hex()

malduck.unhex(s)[source]
malduck.uleb128(s)[source]

Unsigned Little-Endian Base 128

malduck.base64(s)

Base64 encoder/decoder

Padding (null/pkcs7)

malduck.pad(s, block_size)

Padding PKCS7/NULL

malduck.unpad(s)

Unpadding PKCS7/NULL

Packing/unpacking (p64/p32/p16/p8, u64/u32/u16/u8, bigint)

malduck.uint64(other, offset=0, fixed=True)

Unpacks single value from provided buffer with little-endian order

Parameters

  • other (bytes) – Buffer object containing value to unpack

  • offset (int) – Buffer offset

  • fixed (bool (default: True)) – Convert to fixed-size integer (IntType instance)

Return type

IntType instance or None if there are not enough data to unpack

Warning

Fixed-size integer operations are 4-5 times slower than equivalent on built-in integer types

malduck.uint32(other, offset=0, fixed=True)

Unpacks single value from provided buffer with little-endian order

Parameters

  • other (bytes) – Buffer object containing value to unpack

  • offset (int) – Buffer offset

  • fixed (bool (default: True)) – Convert to fixed-size integer (IntType instance)

Return type

IntType instance or None if there are not enough data to unpack

Warning

Fixed-size integer operations are 4-5 times slower than equivalent on built-in integer types

malduck.uint16(other, offset=0, fixed=True)

Unpacks single value from provided buffer with little-endian order

Parameters

  • other (bytes) – Buffer object containing value to unpack

  • offset (int) – Buffer offset

  • fixed (bool (default: True)) – Convert to fixed-size integer (IntType instance)

Return type

IntType instance or None if there are not enough data to unpack

Warning

Fixed-size integer operations are 4-5 times slower than equivalent on built-in integer types

malduck.uint8(other, offset=0, fixed=True)

Unpacks single value from provided buffer with little-endian order

Parameters

  • other (bytes) – Buffer object containing value to unpack

  • offset (int) – Buffer offset

  • fixed (bool (default: True)) – Convert to fixed-size integer (IntType instance)

Return type

IntType instance or None if there are not enough data to unpack

Warning

Fixed-size integer operations are 4-5 times slower than equivalent on built-in integer types

malduck.u64(other, offset=0, fixed=True)

Unpacks single value from provided buffer with little-endian order

Parameters

  • other (bytes) – Buffer object containing value to unpack

  • offset (int) – Buffer offset

  • fixed (bool (default: True)) – Convert to fixed-size integer (IntType instance)

Return type

IntType instance or None if there are not enough data to unpack

Warning

Fixed-size integer operations are 4-5 times slower than equivalent on built-in integer types

malduck.u32(other, offset=0, fixed=True)

Unpacks single value from provided buffer with little-endian order

Parameters

  • other (bytes) – Buffer object containing value to unpack

  • offset (int) – Buffer offset

  • fixed (bool (default: True)) – Convert to fixed-size integer (IntType instance)

Return type

IntType instance or None if there are not enough data to unpack

Warning

Fixed-size integer operations are 4-5 times slower than equivalent on built-in integer types

malduck.u16(other, offset=0, fixed=True)

Unpacks single value from provided buffer with little-endian order

Parameters

  • other (bytes) – Buffer object containing value to unpack

  • offset (int) – Buffer offset

  • fixed (bool (default: True)) – Convert to fixed-size integer (IntType instance)

Return type

IntType instance or None if there are not enough data to unpack

Warning

Fixed-size integer operations are 4-5 times slower than equivalent on built-in integer types

malduck.u8(other, offset=0, fixed=True)

Unpacks single value from provided buffer with little-endian order

Parameters

  • other (bytes) – Buffer object containing value to unpack

  • offset (int) – Buffer offset

  • fixed (bool (default: True)) – Convert to fixed-size integer (IntType instance)

Return type

IntType instance or None if there are not enough data to unpack

Warning

Fixed-size integer operations are 4-5 times slower than equivalent on built-in integer types

malduck.p64(v)[source]
malduck.p32(v)[source]
malduck.p16(v)[source]
malduck.p8(v)[source]
malduck.bigint(s, bitsize)[source]

IPv4 inet_ntoa

malduck.ipv4(s)[source]