:py:mod:`dissect.cstruct.cstruct`
=================================

.. py:module:: dissect.cstruct.cstruct


Module Contents
---------------

Classes
~~~~~~~

.. autoapisummary::

   dissect.cstruct.cstruct.cstruct



Functions
~~~~~~~~~

.. autoapisummary::
   :nosignatures:

   dissect.cstruct.cstruct.ctypes
   dissect.cstruct.cstruct.ctypes_type



.. py:class:: cstruct(endian: str = '<', pointer: Optional[str] = None)


   Main class of cstruct. All types are registered in here.

   :param endian: The endianness to use when parsing.
   :param pointer: The pointer type to use for Pointers.

   .. py:attribute:: DEF_CSTYLE
      :value: 1

      

   .. py:attribute:: DEF_LEGACY
      :value: 2

      

   .. py:method:: __getattr__(attr: str) -> Any


   .. py:method:: addtype(name: str, type_: dissect.cstruct.types.BaseType, replace: bool = False) -> None

      Add a type or type reference.

      :param name: Name of the type to be added.
      :param type_: The type to be added. Can be a str reference to another type
                    or a compatible type class.

      :raises ValueError: If the type already exists.


   .. py:method:: load(definition: str, deftype: int = None, **kwargs) -> cstruct

      Parse structures from the given definitions using the given definition type.

      Definitions can be parsed using different parsers. Currently, there's
      only one supported parser - DEF_CSTYLE. Parsers can add types and
      modify this cstruct instance. Arguments can be passed to parsers
      using kwargs.

      The CSTYLE parser was recently replaced with token based parser,
      instead of a strictly regex based one. The old parser is still available
      by using DEF_LEGACY.

      :param definition: The definition to parse.
      :param deftype: The definition type to parse the definitions with.
      :param \*\*kwargs: Keyword arguments for parsers.


   .. py:method:: loadfile(path: str, deftype: int = None, **kwargs) -> None

      Load structure definitions from a file.

      The given path will be read and parsed using the .load() function.

      :param path: The path to load definitions from.
      :param deftype: The definition type to parse the definitions with.
      :param \*\*kwargs: Keyword arguments for parsers.


   .. py:method:: read(name: str, stream: BinaryIO) -> Any

      Parse data using a given type.

      :param name: Type name to read.
      :param stream: File-like object or byte string to parse.

      :returns: The parsed data.


   .. py:method:: resolve(name: str) -> dissect.cstruct.types.BaseType

      Resolve a type name to get the actual type object.

      Types can be referenced using different names. When we want
      the actual type object, we need to resolve these references.

      :param name: Type name to resolve.

      :returns: The resolved type object.

      :raises ResolveError: If the type can't be resolved.



.. py:function:: ctypes(structure: dissect.cstruct.types.Structure) -> ctypes.Structure

   Create ctypes structures from cstruct structures.


.. py:function:: ctypes_type(type_: dissect.cstruct.types.BaseType) -> Any