fox-it / dissect.cstruct_legacy

A no-nonsense c-like structure parsing library for Python
MIT License
239 stars 25 forks source link

Offset Issue #19

Open LloydLabs opened 2 years ago

LloydLabs commented 2 years ago

The offset doesn't seem to change when a child structure is used, e.g. from the sample code in the README this is generated:

{'name': 'field_1', 'type': uint8, 'bits': None, 'offset': 0}
{'name': 'field_2', 'type': char[5], 'bits': None, 'offset': 1}
{'name': 'field_3', 'type': char[field_1 & 1 * 5], 'bits': None, 'offset': 6}
{'name': 'field_4', 'type': Example[2], 'bits': None, 'offset': None}
{'name': 'field_lol', 'type': uint8, 'bits': None, 'offset': None}
Schamper commented 2 years ago

In this case, field_3 has a dynamic length (it's dependent on the value of field_1), so we can't calculate the offset of any fields that follow. We can only know the real size of field_3 while parsing data. If you were to change the definition of field_3 to something static, like char[8], you can see that the remaining fields have their offset properly calculated.

LloydLabs commented 2 years ago

After field_1 has been read, should this not be taken into consideration for calculating the offset when another field references for it's size?

It'd be a useful addition :)

Schamper commented 2 years ago

Can you elaborate? It's already being taken into account when parsing data, or do you mean to store that information somewhere where you can see it later? We already have something similar, where after parsing some bytes you get an Instance object which has a _sizes attribute that contains the sizes of all the parsed fields. Do you mean to have the properly calculated offsets available in this final object?