Skip to content

API

abc

All the abstract classes that you can rely on when you want to implement your own fields.

Field

class kifurushi.abc.Field()

The abstract base class that all fields must inherit.

clone(self)

Returns a copy of the field.

compute_value(self, data, packet=None)

Computes the field value from the raw bytes and returns remaining bytes to parse from data if any.

Parameters:

  • data:: The raw data currently being parsed by a packet object.
  • packet: The optional packet currently parsing the raw data bytes. It can be useful when the value of the current field depends on other fields.
default

Returns the default value of the field.

random_value(self)

Returns a valid random value for this field.

raw(self, packet=None)

Returns the representation of field value in bytes as it will be sent on the network.

Parameters:

  • packet: The optional packet currently parsing the raw data bytes. It can be useful when the computation of the field value depends on other fields.
size

Returns the size in bytes of the field.

struct_format

Returns the struct format used under the hood for computation of field value.

value

Returns the current value of the field.

value_was_computed

CommonField

class kifurushi.abc.CommonField(name, default, *, format, order='!')

A common interface for integer and fixed-size string fields.

Parameters:

  • name: The name of the field.
  • default: A default value for the field.
  • format: The format used by the struct module to allocate the correct size in bytes of the field value. The value provided is validated against the following regex: r'b|B|h|h|H|i|I|q|Q|\d+s'.
  • order: Order used to format raw data using the struct module. Defaults to "!" (network). Valid values are "!", "<" (little-endian), ">" (big-endian), "@" (native), "=" (standard).
clone(self)

Returns a copy of the field.

compute_value(self, data, packet=None)

Computes the field value from the raw bytes and returns remaining bytes to parse from data if any.

Parameters:

  • data:: The raw data currently being parsed by a packet object.
  • packet: The optional packet currently parsing the raw data bytes. It can be useful when the value of the current field depends on other fields.
default

Returns field's default value.

name

Returns field's name.

random_value(self)

Returns a valid random value according to the field format.

raw(self, packet=None)

Returns the representation of field value in bytes as it will be sent on the network.

Parameters:

  • packet: The optional packet currently parsing the raw data bytes. It can be useful when the computation of the field value depends on other fields.
size

Returns the size in bytes of the field.

struct_format

Returns the struct format used under the hood for computation of field value.

value

Returns field's value.

value_was_computed

VariableStringField

class kifurushi.abc.VariableStringField(name, default=NOTHING, max_length=None, order='!', *, decode=False)

A field representing string data when length is not known in advance.

Parameters:

  • name: The name of the field.
  • default: A default value for the field. Defaults to kifurushi or b'kifurushi' depending on the string type. See explanation of is_bytes parameter below.
  • length: An optional maximum length of the field.
  • order: Order used to format raw data using the struct module. Defaults to "!" (network). Valid values are "!", "<" (little-endian), ">" (big-endian), "@" (native), "=" (standard).
  • decode: keyword-only boolean parameter to know if this field represents raw bytes or utf-8 text. Defaults to False meaning it is bytes which is considered by default.
clone(self)

Returns a copy of the field.

compute_value(self, data, packet=None)

Sets internal string value and returns remaining bytes from data if any.

Parameters:

  • data:: The raw data currently being parsed by a packet object.
  • packet: The optional packet currently parsing the raw data bytes. For a variable string field, it may be useful because the length of the field often depends on another field and we can retrieve if from the packet.
default

Returns field's default value.

max_length

Returns the optional max length of the field.

name

Returns field's name

random_value(self)

Returns a random string or bytes. The length of the string is either the max length if given or the length of the default attribute.

raw(self, packet=None)

Returns the representation of field value in bytes as it will be sent on the network.

Parameters:

  • packet: The optional packet currently parsing the raw data bytes. It can be useful when the computation of the field value depends on other fields.
size

Returns the size in bytes of the field.

struct_format

Returns the struct format used under the hood for computation of raw internal value.

value

Returns internal string.

value_was_computed

packet

Classes and helper functions to deal with protocols.

Packet

class kifurushi.packet.Packet(**kwargs)
all_fields_are_computed

Returns True if all packet fields have been computed using from_bytes class method, False otherwise.

clone(self)

Returns a copy of the packet.

evolve(self, **kwargs)

Returns a new packet with attributes updated by arguments passed as input.

Parameters:

kwargs: keyword-only arguments representing packet attributes with the value to set on them.

fields

Returns a copy of the list of fields composing the packet object.

from_bytes(data)

Creates a packet from bytes and returns it.

Parameters:

data: The raw bytes used to construct a packet object.

hexdump

Returns tcpdump / wireshark like hexadecimal view of the packet.

random_packet()

Returns a packet with fields having random values.

raw

Returns bytes corresponding to what will be sent on the network.

show(self)

Prints a clarified state of packet with type, current and default values of every field.

create_packet_class

kifurushi.packet.create_packet_class(name, fields)

Creates and returns a packet class.

Parameters:

name: The name of the class to create. fields: An iterable of fields that compose the packet.

extract_layers

kifurushi.packet.extract_layers(data, *args)

Extract various packet from raw binary data.

For example, imagine you want to send an ICMP ping request. You will probably need to create two Packet classes, ICMP and IP and send the sum of them over the network i.e something like socket.sendto(ICMP(...).raw + IP(...).raw, address).

Now you want to get the ICMP reply, how to get it? You can't use ICMP.from_bytes because you will have IP and ICMP returned all at once! The solution is to use extract_layers with code like the following: icmp, ip = extract_layers(socket.recvfrom(1024)[0], ICMP, IP)

Parameters:

  • data: The raw bytes to parse.
  • args: A list of Packet layers used to reconstruct the expected layers. You must provide at least one class, if not, you will get an error.

fields

Here is the list of all fields (except the mixins) defined in the project.

HexMixin

class kifurushi.fields.HexMixin(*, hex=False)

Mixin class to get hexadecimal representation of field value.

hex

Returns hex property value.

EnumMixin

class kifurushi.fields.EnumMixin(enumeration)
enumeration

Returns dict enumeration given friendly name to a specific value.

NumericField

class kifurushi.fields.NumericField(name, default, *, hex=False, format, order='!')

Base class for many integer fields.

Parameters:

  • name: The name of the field.
  • default: A default value for the field.
  • format: The format used by the struct module to allocate the correct size in bytes of the field value. The value provided is validated against the following regex: r'b|B|h|h|H|i|I|q|Q|\d+s'.
  • order: Order used to format raw data using the struct module. Defaults to "!" (network). Valid values are "!", "<" (little-endian), ">" (big-endian), "@" (native), "=" (standard).
clone(self)

Returns a copy of the field.

compute_value(self, data, packet=None)
default

Returns field's default value.

hex

Returns hex property value.

name

Returns field's name.

random_value(self)

Returns a valid random value according to the field format.

raw(self, packet=None)

Returns the representation of field value in bytes as it will be sent on the network.

Parameters:

  • packet: The optional packet currently parsing the raw data bytes. It can be useful when the computation of the field value depends on other fields.
size

Returns the size in bytes of the field.

struct_format

Returns the struct format used under the hood for computation of field value.

value

Returns field's value.

value_was_computed

ByteField

class kifurushi.fields.ByteField(name, default, *, hex=False, order='!')

Field class to represent one unsigned byte of network information.

clone(self)

Returns a copy of the field.

compute_value(self, data, packet=None)
default

Returns field's default value.

hex

Returns hex property value.

name

Returns field's name.

random_value(self)

Returns a valid random value according to the field format.

raw(self, packet=None)

Returns the representation of field value in bytes as it will be sent on the network.

Parameters:

  • packet: The optional packet currently parsing the raw data bytes. It can be useful when the computation of the field value depends on other fields.
size

Returns the size in bytes of the field.

struct_format

Returns the struct format used under the hood for computation of field value.

value

Returns field's value.

value_was_computed

ByteEnumField

class kifurushi.fields.ByteEnumField(name, default, enumeration, *, hex=False, order='!')

Similar to ByteField, but has a third mandatory field, a dict or enum mapping values to their name according to their meaning for the packet being forged / dissected. It will be used to pretty print value which can be useful when playing / debugging in the terminal.

clone(self)

Returns a copy of the field.

compute_value(self, data, packet=None)
default

Returns field's default value.

enumeration

Returns dict enumeration given friendly name to a specific value.

hex

Returns hex property value.

name

Returns field's name.

random_value(self)

Returns a valid random value according to the field format.

raw(self, packet=None)

Returns the representation of field value in bytes as it will be sent on the network.

Parameters:

  • packet: The optional packet currently parsing the raw data bytes. It can be useful when the computation of the field value depends on other fields.
size

Returns the size in bytes of the field.

struct_format

Returns the struct format used under the hood for computation of field value.

value

Returns field's value.

value_was_computed

SignedByteField

class kifurushi.fields.SignedByteField(name, default, *, hex=False, order='!')

Field class to represent one signed byte of network information.

clone(self)

Returns a copy of the field.

compute_value(self, data, packet=None)
default

Returns field's default value.

hex

Returns hex property value.

name

Returns field's name.

random_value(self)

Returns a valid random value according to the field format.

raw(self, packet=None)

Returns the representation of field value in bytes as it will be sent on the network.

Parameters:

  • packet: The optional packet currently parsing the raw data bytes. It can be useful when the computation of the field value depends on other fields.
size

Returns the size in bytes of the field.

struct_format

Returns the struct format used under the hood for computation of field value.

value

Returns field's value.

value_was_computed

SignedByteEnumField

class kifurushi.fields.SignedByteEnumField(name, default, enumeration, *, hex=False, order='!')

Similar to SignedByteField, but has a third mandatory field, a dict or enum mapping values to their name according to their meaning for the packet being forged / dissected. it will be used to pretty print value which can be useful when playing / debugging in the terminal.

clone(self)

Returns a copy of the field.

compute_value(self, data, packet=None)
default

Returns field's default value.

enumeration

Returns dict enumeration given friendly name to a specific value.

hex

Returns hex property value.

name

Returns field's name.

random_value(self)

Returns a valid random value according to the field format.

raw(self, packet=None)

Returns the representation of field value in bytes as it will be sent on the network.

Parameters:

  • packet: The optional packet currently parsing the raw data bytes. It can be useful when the computation of the field value depends on other fields.
size

Returns the size in bytes of the field.

struct_format

Returns the struct format used under the hood for computation of field value.

value

Returns field's value.

value_was_computed

ShortField

class kifurushi.fields.ShortField(name, default, *, hex=False, order='!')

Field class to represent two unsigned bytes of network information.

clone(self)

Returns a copy of the field.

compute_value(self, data, packet=None)
default

Returns field's default value.

hex

Returns hex property value.

name

Returns field's name.

random_value(self)

Returns a valid random value according to the field format.

raw(self, packet=None)

Returns the representation of field value in bytes as it will be sent on the network.

Parameters:

  • packet: The optional packet currently parsing the raw data bytes. It can be useful when the computation of the field value depends on other fields.
size

Returns the size in bytes of the field.

struct_format

Returns the struct format used under the hood for computation of field value.

value

Returns field's value.

value_was_computed

ShortEnumField

class kifurushi.fields.ShortEnumField(name, default, enumeration, *, hex=False, order='!')

Similar to ShortField, but has a third mandatory field, a dict or enum mapping values to their name according to their meaning for the packet being forged / dissected. it will be used to pretty print value which can be useful when playing / debugging in the terminal.

clone(self)

Returns a copy of the field.

compute_value(self, data, packet=None)
default

Returns field's default value.

enumeration

Returns dict enumeration given friendly name to a specific value.

hex

Returns hex property value.

name

Returns field's name.

random_value(self)

Returns a valid random value according to the field format.

raw(self, packet=None)

Returns the representation of field value in bytes as it will be sent on the network.

Parameters:

  • packet: The optional packet currently parsing the raw data bytes. It can be useful when the computation of the field value depends on other fields.
size

Returns the size in bytes of the field.

struct_format

Returns the struct format used under the hood for computation of field value.

value

Returns field's value.

value_was_computed

SignedShortField

class kifurushi.fields.SignedShortField(name, default, *, hex=False, order='!')

Field class to represent two signed bytes of network information.

clone(self)

Returns a copy of the field.

compute_value(self, data, packet=None)
default

Returns field's default value.

hex

Returns hex property value.

name

Returns field's name.

random_value(self)

Returns a valid random value according to the field format.

raw(self, packet=None)

Returns the representation of field value in bytes as it will be sent on the network.

Parameters:

  • packet: The optional packet currently parsing the raw data bytes. It can be useful when the computation of the field value depends on other fields.
size

Returns the size in bytes of the field.

struct_format

Returns the struct format used under the hood for computation of field value.

value

Returns field's value.

value_was_computed

SignedShortEnumField

class kifurushi.fields.SignedShortEnumField(name, default, enumeration, *, hex=False, order='!')

Similar to SignedShortField, but has a third mandatory field, a dict or enum mapping values to their name according to their meaning for the packet being forged / dissected. it will be used to pretty print value which can be useful when playing / debugging in the terminal.

clone(self)

Returns a copy of the field.

compute_value(self, data, packet=None)
default

Returns field's default value.

enumeration

Returns dict enumeration given friendly name to a specific value.

hex

Returns hex property value.

name

Returns field's name.

random_value(self)

Returns a valid random value according to the field format.

raw(self, packet=None)

Returns the representation of field value in bytes as it will be sent on the network.

Parameters:

  • packet: The optional packet currently parsing the raw data bytes. It can be useful when the computation of the field value depends on other fields.
size

Returns the size in bytes of the field.

struct_format

Returns the struct format used under the hood for computation of field value.

value

Returns field's value.

value_was_computed

IntField

class kifurushi.fields.IntField(name, default, *, hex=False, order='!')

Field class to represent four unsigned bytes of network information.

clone(self)

Returns a copy of the field.

compute_value(self, data, packet=None)
default

Returns field's default value.

hex

Returns hex property value.

name

Returns field's name.

random_value(self)

Returns a valid random value according to the field format.

raw(self, packet=None)

Returns the representation of field value in bytes as it will be sent on the network.

Parameters:

  • packet: The optional packet currently parsing the raw data bytes. It can be useful when the computation of the field value depends on other fields.
size

Returns the size in bytes of the field.

struct_format

Returns the struct format used under the hood for computation of field value.

value

Returns field's value.

value_was_computed

IntEnumField

class kifurushi.fields.IntEnumField(name, default, enumeration, *, hex=False, order='!')

Similar to IntField, but has a third mandatory field, a dict or enum mapping values to their name according to their meaning for the packet being forged / dissected. it will be used to pretty print value which can be useful when playing / debugging in the terminal.

clone(self)

Returns a copy of the field.

compute_value(self, data, packet=None)
default

Returns field's default value.

enumeration

Returns dict enumeration given friendly name to a specific value.

hex

Returns hex property value.

name

Returns field's name.

random_value(self)

Returns a valid random value according to the field format.

raw(self, packet=None)

Returns the representation of field value in bytes as it will be sent on the network.

Parameters:

  • packet: The optional packet currently parsing the raw data bytes. It can be useful when the computation of the field value depends on other fields.
size

Returns the size in bytes of the field.

struct_format

Returns the struct format used under the hood for computation of field value.

value

Returns field's value.

value_was_computed

SignedIntField

class kifurushi.fields.SignedIntField(name, default, *, hex=False, order='!')

Field class to represent four signed bytes of network information.

clone(self)

Returns a copy of the field.

compute_value(self, data, packet=None)
default

Returns field's default value.

hex

Returns hex property value.

name

Returns field's name.

random_value(self)

Returns a valid random value according to the field format.

raw(self, packet=None)

Returns the representation of field value in bytes as it will be sent on the network.

Parameters:

  • packet: The optional packet currently parsing the raw data bytes. It can be useful when the computation of the field value depends on other fields.
size

Returns the size in bytes of the field.

struct_format

Returns the struct format used under the hood for computation of field value.

value

Returns field's value.

value_was_computed

SignedIntEnumField

class kifurushi.fields.SignedIntEnumField(name, default, enumeration, *, hex=False, order='!')

Similar to SignedIntField, but has a third mandatory field, a dict or enum mapping values to their name according to their meaning for the packet being forged / dissected. it will be used to pretty print value which can be useful when playing / debugging in the terminal.

clone(self)

Returns a copy of the field.

compute_value(self, data, packet=None)
default

Returns field's default value.

enumeration

Returns dict enumeration given friendly name to a specific value.

hex

Returns hex property value.

name

Returns field's name.

random_value(self)

Returns a valid random value according to the field format.

raw(self, packet=None)

Returns the representation of field value in bytes as it will be sent on the network.

Parameters:

  • packet: The optional packet currently parsing the raw data bytes. It can be useful when the computation of the field value depends on other fields.
size

Returns the size in bytes of the field.

struct_format

Returns the struct format used under the hood for computation of field value.

value

Returns field's value.

value_was_computed

LongField

class kifurushi.fields.LongField(name, default, *, hex=False, order='!')

Field class to represent eight unsigned bytes of network information.

clone(self)

Returns a copy of the field.

compute_value(self, data, packet=None)
default

Returns field's default value.

hex

Returns hex property value.

name

Returns field's name.

random_value(self)

Returns a valid random value according to the field format.

raw(self, packet=None)

Returns the representation of field value in bytes as it will be sent on the network.

Parameters:

  • packet: The optional packet currently parsing the raw data bytes. It can be useful when the computation of the field value depends on other fields.
size

Returns the size in bytes of the field.

struct_format

Returns the struct format used under the hood for computation of field value.

value

Returns field's value.

value_was_computed

LongEnumField

class kifurushi.fields.LongEnumField(name, default, enumeration, *, hex=False, order='!')

Similar to LongField, but has a third mandatory field, a dict or enum mapping values to their name according to their meaning for the packet being forged / dissected. it will be used to pretty print value which can be useful when playing / debugging in the terminal.

clone(self)

Returns a copy of the field.

compute_value(self, data, packet=None)
default

Returns field's default value.

enumeration

Returns dict enumeration given friendly name to a specific value.

hex

Returns hex property value.

name

Returns field's name.

random_value(self)

Returns a valid random value according to the field format.

raw(self, packet=None)

Returns the representation of field value in bytes as it will be sent on the network.

Parameters:

  • packet: The optional packet currently parsing the raw data bytes. It can be useful when the computation of the field value depends on other fields.
size

Returns the size in bytes of the field.

struct_format

Returns the struct format used under the hood for computation of field value.

value

Returns field's value.

value_was_computed

SignedLongField

class kifurushi.fields.SignedLongField(name, default, *, hex=False, order='!')

Field class to represent eight signed bytes of network information.

clone(self)

Returns a copy of the field.

compute_value(self, data, packet=None)
default

Returns field's default value.

hex

Returns hex property value.

name

Returns field's name.

random_value(self)

Returns a valid random value according to the field format.

raw(self, packet=None)

Returns the representation of field value in bytes as it will be sent on the network.

Parameters:

  • packet: The optional packet currently parsing the raw data bytes. It can be useful when the computation of the field value depends on other fields.
size

Returns the size in bytes of the field.

struct_format

Returns the struct format used under the hood for computation of field value.

value

Returns field's value.

value_was_computed

SignedLongEnumField

class kifurushi.fields.SignedLongEnumField(name, default, enumeration, *, hex=False, order='!')

Similar to ByteField, but has a third mandatory field, a dict or enum mapping values to their name according to their meaning for the packet being forged / dissected. it will be used to pretty print value which can be useful when playing / debugging in the terminal.

clone(self)

Returns a copy of the field.

compute_value(self, data, packet=None)
default

Returns field's default value.

enumeration

Returns dict enumeration given friendly name to a specific value.

hex

Returns hex property value.

name

Returns field's name.

random_value(self)

Returns a valid random value according to the field format.

raw(self, packet=None)

Returns the representation of field value in bytes as it will be sent on the network.

Parameters:

  • packet: The optional packet currently parsing the raw data bytes. It can be useful when the computation of the field value depends on other fields.
size

Returns the size in bytes of the field.

struct_format

Returns the struct format used under the hood for computation of field value.

value

Returns field's value.

value_was_computed

FixedStringField

class kifurushi.fields.FixedStringField(name, default, length, *, decode=False)

A field representing string data when length known in advance.

Parameters:

  • name: The name of the field.
  • default: A default value for the field.
  • length: The length of the field.
  • decode: keyword-only boolean parameter to know if this field represents raw bytes or utf-8 text. Defaults to False meaning it is bytes which is considered by default.
clone(self)

Returns a copy of the field.

compute_value(self, data, packet=None)
default

Returns field's default value.

name

Returns field's name.

random_value(self)

Returns a random string.

raw(self, packet=None)

Returns bytes encoded value of the internal string.

size

Returns the size in bytes of the field.

struct_format

Returns the struct format used under the hood for computation of field value.

value

Returns internal string.

value_was_computed

FieldPart

class kifurushi.fields.FieldPart(name, default, size, enumeration=None, *, hex=False)

This class represents information to combine to form a BitsField object (signed byte, signed short, etc..).

Parameters:

  • name: The name of field part.
  • default: The default value of the field part.
  • size: The number of bits this field part will take in the concrete field.
  • enumeration: A dict or enum.Enum enumeration given friendly name to a specific value. This attribute is optional.
clone(self)
default

Returns the default value of the field part.

enumeration

Returns dict enumeration given friendly name to a specific value.

hex

Returns hex property value.

name

Returns the name of the field part.

size

Returns the number of bits this object will take in the BitsField object.

value

Returns the current value of the field part.

BitsField

class kifurushi.fields.BitsField(parts, format, *, hex=False, order='!')

A field representing bytes where where some bits have a specific meaning like we can see in IPV4 or TCP headers.

Parameters:

  • parts: The list of FieldPart used to compose the field object.
  • format: The struct format used to represent the field in its binary representation. Valid values are "B" (1 byte), "H" (2 bytes), "I" (4 bytes) and "Q" (8 bytes).

For example, if we take the IPV4 header the first byte contains two information, the version (4 bits) and the IHL (4bits). To represent it we can define a field like the following: BitsField([FieldPart('version', 4, 4), FieldPart('IHL', 5, 4)], format='B')

clone(self)

Returns a copy if the field ensuring that parts attribute of the cloned object is not a shallow copy.

compute_value(self, data, packet=None)

Sets internal value of each field part and returns remaining bytes if any.

default
get_field_part_value(self, name)

Returns the value of a field part identified by its name.

Parameters:

  • name: The name of the field part whose value is requested.
hex

Returns hex property value.

parts

Returns the list of field parts of this field.

random_value(self)
raw(self, packet=None)
set_field_part_value(self, name, value)

Sets the value of a field part identified by its name.

Parameters:

  • name: The name of the field part whose value must be set.
  • value: The value to set to the field part.
size
struct_format
value

Returns the integer value corresponding to this field.

value_as_tuple

Returns the value of each field part in a tuple.

value_was_computed

ByteBitsField

class kifurushi.fields.ByteBitsField(parts, *, hex=False, order='!')

A specialized BitsField class dealing with one unsigned byte field.

clone(self)

Returns a copy if the field ensuring that parts attribute of the cloned object is not a shallow copy.

compute_value(self, data, packet=None)

Sets internal value of each field part and returns remaining bytes if any.

default
get_field_part_value(self, name)

Returns the value of a field part identified by its name.

Parameters:

  • name: The name of the field part whose value is requested.
hex

Returns hex property value.

parts

Returns the list of field parts of this field.

random_value(self)
raw(self, packet=None)
set_field_part_value(self, name, value)

Sets the value of a field part identified by its name.

Parameters:

  • name: The name of the field part whose value must be set.
  • value: The value to set to the field part.
size
struct_format
value

Returns the integer value corresponding to this field.

value_as_tuple

Returns the value of each field part in a tuple.

value_was_computed

ShortBitsField

class kifurushi.fields.ShortBitsField(parts, *, hex=False, order='!')

A specialized BitsField class dealing with a two unsigned bytes field.

clone(self)

Returns a copy if the field ensuring that parts attribute of the cloned object is not a shallow copy.

compute_value(self, data, packet=None)

Sets internal value of each field part and returns remaining bytes if any.

default
get_field_part_value(self, name)

Returns the value of a field part identified by its name.

Parameters:

  • name: The name of the field part whose value is requested.
hex

Returns hex property value.

parts

Returns the list of field parts of this field.

random_value(self)
raw(self, packet=None)
set_field_part_value(self, name, value)

Sets the value of a field part identified by its name.

Parameters:

  • name: The name of the field part whose value must be set.
  • value: The value to set to the field part.
size
struct_format
value

Returns the integer value corresponding to this field.

value_as_tuple

Returns the value of each field part in a tuple.

value_was_computed

IntBitsField

class kifurushi.fields.IntBitsField(parts, *, hex=False, order='!')

A specialized BitsField class dealing with a four unsigned bytes field.

clone(self)

Returns a copy if the field ensuring that parts attribute of the cloned object is not a shallow copy.

compute_value(self, data, packet=None)

Sets internal value of each field part and returns remaining bytes if any.

default
get_field_part_value(self, name)

Returns the value of a field part identified by its name.

Parameters:

  • name: The name of the field part whose value is requested.
hex

Returns hex property value.

parts

Returns the list of field parts of this field.

random_value(self)
raw(self, packet=None)
set_field_part_value(self, name, value)

Sets the value of a field part identified by its name.

Parameters:

  • name: The name of the field part whose value must be set.
  • value: The value to set to the field part.
size
struct_format
value

Returns the integer value corresponding to this field.

value_as_tuple

Returns the value of each field part in a tuple.

value_was_computed

LongBitsField

class kifurushi.fields.LongBitsField(parts, *, hex=False, order='!')

A specialized BitsField class dealing with an eight unsigned bytes field.

clone(self)

Returns a copy if the field ensuring that parts attribute of the cloned object is not a shallow copy.

compute_value(self, data, packet=None)

Sets internal value of each field part and returns remaining bytes if any.

default
get_field_part_value(self, name)

Returns the value of a field part identified by its name.

Parameters:

  • name: The name of the field part whose value is requested.
hex

Returns hex property value.

parts

Returns the list of field parts of this field.

random_value(self)
raw(self, packet=None)
set_field_part_value(self, name, value)

Sets the value of a field part identified by its name.

Parameters:

  • name: The name of the field part whose value must be set.
  • value: The value to set to the field part.
size
struct_format
value

Returns the integer value corresponding to this field.

value_as_tuple

Returns the value of each field part in a tuple.

value_was_computed

ConditionalField

class kifurushi.fields.ConditionalField(field, condition)
clone(self)
compute_value(self, data, packet=None)

Optionally computes the field value from the raw bytes and returns remaining bytes to parse from data if any. The self._condition callback is used to determine if you need to treat data.

Parameters:

  • data:: The raw data currently being parsed by a packet object.
  • packet: The optional packet currently parsing the raw data bytes. It can be useful when the value of the current field depends on other fields.
condition
default
random_value(self)
raw(self, packet=None)

Returns the representation of field value in bytes as it will be sent on the network.

Parameters:

  • packet: The optional packet currently parsing the raw data bytes. It is used to check if the inner field should return its raw value or not.
size
struct_format
value
value_was_computed

random values

There are some utility functions to help you get a random but correct value for the field type you choose.

rand_bytes

kifurushi.utils.random_values.rand_bytes()

Returns an unsigned random byte value.

rand_signed_bytes

kifurushi.utils.random_values.rand_signed_bytes()

Returns a signed random byte value.

rand_short

kifurushi.utils.random_values.rand_short()

Returns an unsigned random short value.

rand_signed_short

kifurushi.utils.random_values.rand_signed_short()

Returns a signed random short value.

rand_int

kifurushi.utils.random_values.rand_int()

Returns an unsigned random int value.

rand_signed_int

kifurushi.utils.random_values.rand_signed_int()

Returns a signed random int value.

rand_long

kifurushi.utils.random_values.rand_long()

Returns an unsigned random long value.

rand_signed_long

kifurushi.utils.random_values.rand_signed_long()

Returns a signed random int value.

rand_string

kifurushi.utils.random_values.rand_string(length=None, characters=None)

Returns a random string given.

Parameters:

  • length: The length of the desired random string. If not given a random value will be computed using random.randint(20, 150).
  • characters: A string with characters that will be used to form the random string. If not given, defaults to string.ascii_letters.

There are also constants if you need to check some numeric values or implement custom fields.

network helpers

checksum

kifurushi.utils.network.checksum(data)

Returns the checksum of the given data.

Parameters:

  • data: The bytes to parse.

hexdump

kifurushi.utils.network.hexdump(data)

Returns tcpdump / wireshark like hexadecimal view of the given data.

Parameters:

  • data: The bytes to parse.