dissect.cstruct_legacy icon indicating copy to clipboard operation
dissect.cstruct_legacy copied to clipboard

Offset Issue

Open LloydLabs opened this issue 3 years ago • 3 comments

The offset doesn't seem to change when a child structure is used, e.g. from the sample code in the README this is generated:

{'name': 'field_1', 'type': uint8, 'bits': None, 'offset': 0}
{'name': 'field_2', 'type': char[5], 'bits': None, 'offset': 1}
{'name': 'field_3', 'type': char[field_1 & 1 * 5], 'bits': None, 'offset': 6}
{'name': 'field_4', 'type': Example[2], 'bits': None, 'offset': None}
{'name': 'field_lol', 'type': uint8, 'bits': None, 'offset': None}

LloydLabs avatar Jan 22 '22 18:01 LloydLabs

In this case, field_3 has a dynamic length (it's dependent on the value of field_1), so we can't calculate the offset of any fields that follow. We can only know the real size of field_3 while parsing data. If you were to change the definition of field_3 to something static, like char[8], you can see that the remaining fields have their offset properly calculated.

Schamper avatar Jan 25 '22 13:01 Schamper

After field_1 has been read, should this not be taken into consideration for calculating the offset when another field references for it's size?

It'd be a useful addition :)

LloydLabs avatar Jan 25 '22 23:01 LloydLabs

Can you elaborate? It's already being taken into account when parsing data, or do you mean to store that information somewhere where you can see it later? We already have something similar, where after parsing some bytes you get an Instance object which has a _sizes attribute that contains the sizes of all the parsed fields. Do you mean to have the properly calculated offsets available in this final object?

Schamper avatar Jan 28 '22 16:01 Schamper