pysap.utils.fields module

class pysap.utils.fields.ASN1F_CHOICE_SAFE(name, default, *args, **kwargs)

Bases: ASN1F_CHOICE

m2i(pkt, s)

Try to safely extract an ASN1_Packet from the choices list.

Raises:

ASN1_Error – if unable to parse the packet using any of the given choices

class pysap.utils.fields.AdjustableFieldLenField(name, default, length_of=None)

Bases: Field

addfield(pkt, s, val)

Add an internal value to a string

Copy the network representation of field val (belonging to layer pkt) to the raw string packet s, and return the new string packet.

adjust

count_of

getfield(pkt, s)

Extract an internal value from a string

Extract from the raw packet s the field value belonging to layer pkt.

Returns a two-element list, first the raw packet string after having removed the extracted field, second the extracted field itself in internal representation.

i2m(pkt, x)

Convert internal value to machine value

length_of

class pysap.utils.fields.ByteMultiEnumKeysField(name: str, default: int, enum: Dict[I, Dict[I, str]], depends_on: Callable[[Packet | None], I], fmt: str = 'H')

Bases: MultiEnumField

MultiEnumField that picks a reduced number of values. Used for fuzzing Byte fields with reduced number of values.

randval()

Return a volatile object whose value is both random and suitable for this field

class pysap.utils.fields.IntToStrField(name, default, length=11)

Bases: Field

Custom field from int to str values, with a variable length

format

getfield(pkt, s)

Extract an internal value from a string

Extract from the raw packet s the field value belonging to layer pkt.

Returns a two-element list, first the raw packet string after having removed the extracted field, second the extracted field itself in internal representation.

i2count(pkt, x)

Convert internal value to a number of elements usable by a FieldLenField. Always 1 except for list fields

i2m(pkt, x)

Convert internal value to machine value

length

m2i(pkt, x)

Convert machine value to internal value

class pysap.utils.fields.LESignedByteField(name, default)

Bases: Field

class pysap.utils.fields.LESignedLongField(name, default)

Bases: Field

class pysap.utils.fields.LESignedShortField(name, default)

Bases: Field

class pysap.utils.fields.MutablePacketField(name, default, length_from, get_class, evaluators=None)

Bases: StrLenField

Packet field that mutates the class according to a list of evaluators. The evaluators are run against the packet and given to a class getter.

If the class can’t be found, the field is treated as a StrLenField.

evaluators

get_class(pkt)

i2m(pkt, i)

Convert internal value to machine value

length_from

m2i(pkt, m)

Convert machine value to internal value

class pysap.utils.fields.PacketListStopField(name, default, cls, count_from=None, length_from=None, stop=None)

Bases: PacketListField

Custom field that contains a list of packets until a ‘stop’ condition is met.

count_from

getfield(pkt, s)

Extract an internal value from a string

Extract from the raw packet s the field value belonging to layer pkt.

Returns a two-element list, first the raw packet string after having removed the extracted field, second the extracted field itself in internal representation.

length_from

stop

class pysap.utils.fields.PacketNoPadded(_pkt, /)

Bases: Packet

Regular scapy packet with no padding.

aliastypes = [<class 'pysap.utils.fields.PacketNoPadded'>, <class 'scapy.packet.Packet'>]

extract_padding(s)

DEV: to be overloaded to extract current layer’s padding.

Parameters:

s (str) – the current layer

Returns:

a couple of strings (actual layer, padding)

class pysap.utils.fields.RandByteReduced

Bases: RandNum

RandByte that only returns random values between 0 and x2a. Used while performing some fuzz to reduce the test cases space.

class pysap.utils.fields.StrEncodedPaddedField(name, default, encoding='utf-16', padd=b'\x0c', fmt='H', remain=0)

Bases: StrField

addfield(pkt, s, val)

Add an internal value to a string

Copy the network representation of field val (belonging to layer pkt) to the raw string packet s, and return the new string packet.

encoding

getfield(pkt, s)

Extract an internal value from a string

Extract from the raw packet s the field value belonging to layer pkt.

Returns a two-element list, first the raw packet string after having removed the extracted field, second the extracted field itself in internal representation.

h2i(pkt, x)

Convert human value to internal value

i2h(pkt, x)

Convert internal value to human value

padd

remain

class pysap.utils.fields.StrFixedLenDecodedField(name: str, default: bytes | None, length: int | None = None, length_from: Callable[[Packet], int] | None = None)

Bases: StrFixedLenField

StrFixedLenField that decodes bytes to str in show() output.

i2repr(pkt, x)

Convert internal value to a nice representation

class pysap.utils.fields.StrFixedLenPaddedField(name, default, length=None, length_from=None, padd=' ', encoding=None)

Bases: StrFixedLenField

Packet field that has a fixed length and is padded with a given character.

The optional encoding parameter enables transparent decoding of fields that carry multi-byte character encodings in a fixed-width byte buffer. This is required for SAP NetWeaver RFC SDK (NWRFC) connections, where fixed-length string fields are encoded in UTF-16LE rather than ASCII.

When encoding is set:

• getfield() attempts to decode the raw bytes with encoding and strips trailing null and space padding from the decoded string. If decoding fails the raw bytes are returned unchanged (graceful fallback).

• addfield() encodes a str value with encoding, padding with NUL bytes, before writing.

addfield(pkt, s, val)

Add an internal value to a string

Copy the network representation of field val (belonging to layer pkt) to the raw string packet s, and return the new string packet.

encoding

getfield(pkt, s)

Extract an internal value from a string

Extract from the raw packet s the field value belonging to layer pkt.

Returns a two-element list, first the raw packet string after having removed the extracted field, second the extracted field itself in internal representation.

length_from

padd

class pysap.utils.fields.StrNullDecodedField(name: str, default: I | None, fmt: str = 'H', remain: int = 0)

Bases: StrNullField

StrNullField that decodes bytes to str in show() output.

i2repr(pkt, x)

Convert internal value to a nice representation

class pysap.utils.fields.StrNullFixedLenField(name, default, length=None, length_from=None, max_length=None, null_terminated=None)

Bases: StrFixedLenField

Packet field that has a fixed length and is conditionally null-terminated.

addfield(pkt, s, val)

Add an internal value to a string

Copy the network representation of field val (belonging to layer pkt) to the raw string packet s, and return the new string packet.

getfield(pkt, s)

Extract an internal value from a string

Extract from the raw packet s the field value belonging to layer pkt.

Returns a two-element list, first the raw packet string after having removed the extracted field, second the extracted field itself in internal representation.

i2repr(pkt, v)

Convert internal value to a nice representation

length_from

max_length

null_terminated

randval()

Return a volatile object whose value is both random and suitable for this field

class pysap.utils.fields.StrNullFixedLenPaddedField(name, default, length=None, length_from=None, padd=' ')

Bases: StrFixedLenField

Packet field that has a fixed length and is padded with a given character and null terminated.

addfield(pkt, s, val)

Add an internal value to a string

Copy the network representation of field val (belonging to layer pkt) to the raw string packet s, and return the new string packet.

getfield(pkt, s)

Extract an internal value from a string

Extract from the raw packet s the field value belonging to layer pkt.

Returns a two-element list, first the raw packet string after having removed the extracted field, second the extracted field itself in internal representation.

i2repr(pkt, v)

Convert internal value to a nice representation

length_from

padd

class pysap.utils.fields.TimestampField(name: str, default: int)

Bases: LongField

Timestamp field

i2h(pkt, x)

Convert internal value to human value

pysap.utils.fields.saptimestamp_to_datetime(timestamp)

Converts a timestamp in “SAP format” to a datetime object. Time zone looks to be fixed at GMT+1.