4 ms·

I have to admit that using C syntax as a string to parse something from Python is definitely a choice. I'm not even sure I would use C structs to lay things out

• goeiedaggoeie 4mo ago
  in video/image space most code we deal with day to day is still C, lots more rust plugins in gstreamer ecosystem, but 90%+ still C
  • saagarjha 4mo ago
    Sure, but it's a greenfield Python script
  • flohofwoe 4mo ago
    The article is about disk images though :) But yeah, while I think the `cstruct` helper function to describe a binary data layout in Python is more elegant than the builtin alternatives, it would have been much less painful to just go with a minimal C command line program (or any other programming language where a struct directly maps to memory). Python and most other scripting languages have been built for manipulating text data, but suck when working with binary data.
• quietbritishjim 4mo ago
  I asked an LLM to rewrite it for me using the Python built-in struct module, and it gave me this: import sys import struct from collections import namedtuple # Bake the layout once into a reusable, precompiled object. HEADER = struct.Struct(">4sIIIQQ16sQQIIII") # struct only knows positions, not names — pair it with a namedtuple # to recover the named-field access that cstruct gives you for free. Header = namedtuple("Header", [ "magic", "field4", "field8", "fieldC", "field10", "field18", "field20", "field30", "field38", "field40", "field44", "field48", "field4C", ]) with open(sys.argv[1], "rb") as fh: header = Header._make(HEADER.unpack(fh.read(HEADER.size))) print(header) To me, this seems significantly less readable... less Pythonic, even. The printed output is also less readable.
  • saagarjha 4mo ago
    No I think Python's struct module is also really bad. My point is if you are making a new DSL for laying out arbitrary formats why not do something better than what we have
    • toast0 4mo ago
      I would assume dissect.cstruct was written for interopt with c programs using C structs, or to use formats documented as C structs. Not as a greenfield tool for arbitrary formats. C structs seem less bad than python structs, so why not use them? Especially why write a struct parser and create a DSL for it, when there's already one that you can use that uses a well known DSL you might already understand.
    • schamper 4mo ago
      Author here, this is a valid point but there are also valid reasons to choose C structures. The larger framework that this is a part of is primarily targeted towards people working in cybersecurity, not software engineers. Cybersecurity people are very often not great software engineers and there is a high throughput of “throwaway” scripts, or “make a quick hacky change”. C is commonly already well understood, a bespoke DSL usually is not and requires a learning step. You can “hit the ground running”, so to say. And, as a bonus, creating, say, a filesystem implementation is now often as easy as copy/pasting existing C structure definitions, either from the original source (which is usually C) or from reversing tools such as IDA/Ghidra. There’s no right or wrong way in my opinion, just preferences.
      • a_e_k 4mo ago
        I became a fan of Kaitai Struct [0] when doing some amateur sleuthing last year. It has a web-based IDE [1] for writing and testing structure definitions against hex dumps, and can generate binary parsers in Python (and many other languages) right from the Web IDE. [0] https://doc.kaitai.io/user_guide.html https://doc.kaitai.io/user_guide.html [1] https://ide.kaitai.io/devel/ https://ide.kaitai.io/devel/
    • quietbritishjim 4mo ago