ducky.util module

class ducky.util.BinaryFile(logger, stream)

Bases: object

Base class of all classes that represent “binary” files - binaries, core dumps. It provides basic methods for reading and writing structures.

static do_open(logger, path, mode='rb', klass=None)

static open(*args, **kwargs)

read_struct(st_class)

Read structure from current position in file.

Returns:instance of class st_class with content read from file Return type:st_class

setup()

write_struct(st)

Write structure into file at the current position.

Parameters:st (class) – ctype-based structure

class ducky.util.Flags

Bases: object

classmethod create(**kwargs)

classmethod encoding()

classmethod from_encoding(encoding)

classmethod from_int(u)

classmethod from_string(s)

load_encoding(encoding)

load_int(u)

load_string(s)

save_encoding(encoding)

to_encoding()

to_int()

to_string()

class ducky.util.Formatter

Bases: string.Formatter

format_field(value, format_spec)

format_int(format_spec, value)

class ducky.util.LRUCache(logger, size, *args, **kwargs)

Bases: collections.OrderedDict

Simple LRU cache, based on OrderedDict, with limited size. When limit is reached, the least recently inserted item is removed.

Parameters:

• logger (logging.Logger) – logger object instance should use for logging.
• size (int) – maximal number of entries allowed.

get_object(key)

The real workhorse - responsible for getting requested item from outside when it’s not present in cache. Called by __missing__ method. This method itself makes no changes to cache at all.

make_space()

This method is called when there is no free space in cache. It’s responsible for freeing at least one slot, upper limit of removed entries is not enforced.

class ducky.util.StringTable

Bases: object

Simple string table, used by many classes operating with files (core, binaries, ...). String can be inserted into table and read, each has its starting offset and its end is marked with null byte ().

Thsi is a helper class - it makes working with string, e.g. section and symbol names, much easier.

get_string(offset)

Read string from table.

Parameters:offset (int) – offset of the first character from the beginning of the table Returns:string Return type:string

put_string(s)

Insert new string into table. String is appended at the end of internal buffer, and terminating zero byte () is appended to mark end of string.

Returns:offset of inserted string Return type:int

class ducky.util.SymbolTable(binary)

Bases: dict

get_symbol(name)

ducky.util.align(boundary, n)

ducky.util.isfile(o)

ducky.util.sizeof_fmt(n, suffix='B', max_unit='Zi')

ducky.util.str2int(s)