Add Structure method to determine field size#274
Add Structure method to determine field size#274shizmob wants to merge 2 commits intoerocarrera:masterfrom
Conversation
|
Overall this looks okay to me, it mostly depends on how we feel about adding an additional dictionary for keeping track of field sizes. I haven't really checked to see how much overhead it adds in terms of memory use (which perhaps we could start using |
|
I tried to resolve the merge conflicts using the web editor, and I know that in the web editor there were no merge conflict markers remaining -- and yet the merge commit made has those markers. This will require some manual fixing to bring it up to date with the current pefile master branch:
|
|
I believe I got this updated to work with the latest master branch. It looks like it does change some function signatures (return values from I'm not finding other code on GitHub that calls set_format and references pefile, other than repositories that just have a copy of pefile.py in them. I'd like to get thoughts from a few other people on if they think this potential breaking change seems okay or not. |
j-t-1
left a comment
There was a problem hiding this comment.
Seems okay.
This comment puts it well: #274 (comment). The checks took under ten minutes, so nothing stands out. A call graph may help, clarifying where the functions containing these classes are instantiated.
| """ | ||
|
|
||
| def __init__(self, format, name=None, file_offset=None): | ||
| # Format is forced little endian, for big endian non-Intel platforms |
There was a problem hiding this comment.
To match the output order of set_format, this can be reordered:
self.__format_str__ = "<"
self.__unpacked_data_elms__ = []
self.__field_offsets__ = {}
self.__field_sizes__ = {}
self.__keys__ = []
self.__format_length__ = 0
Outside of this PR we could put __format_length__ after __format_str__. Although it is a breaking change of set_format for small readability increase.
This PR adds the method
Structure.sizeof_field()to determine the size of a single field within the structure. I've found this useful to avoid hardcoding certain assumptions, especially with PE32 vs PE32+ in mind.