2.3. Data Structure
A Data Structure is composed structure- and field-nodes. Structure-nodes can
contain other nodes, field-nodes cannot contain other nodes. With
structure-nodes you define the structure of the data, whereas field-nodes are
used to display the data.
The nodes are rendered into a dataview. Fields are rendered into leaves where
you can edit the data. Structure-node are rendered into 0-n folders, containg
the fields. During rendering each node has a bitoffset and a bitsize.
Below are pictures of the configuration dialogs for the different
DefinitionNodes and examples.
Structures
Static Structure
Defines structure which is repeated a fixed number of times.
Example:
Pointer Structure
Defines a structure which is repeated a variable number of times. The number
of repeats is calculated by evaluating a pointer into the data. This number
can then be modified by a first addition (substraction), a multiplication and
a second addition (substraction). The result is the number of repeats . The
minimum number of repeats is zero.
Example: The number of repeats is stored 2 bytes before the structure. So the
offset is ThisNode:-2.0 bits (= this.node:-2 bytes). The number is two bytes
long and stored as a big endian without sign.
Delimited Structure
Defines a variable length structure. The end of the structure is marked by a
delimiter.The bitsize of the structures is calculated by searching for the
defined delimiter. The delimiter is not included in the calculated bitsize.
The children of this node are rendered as often as they fit into the
calculated bitsize.
Example:
Conditional Structure
Defines a branching point in the structure. Each child of this structure is a
possible branch. You define a pointer into the data and assign a value to each
child. If the value matches the data the corresponding child is rendered and
the other children are ignored. If none matches the default child is
rendered.
Example: Data inside an ip v4 packet. The bitoffset of the pointer is -0xB
bytes from the location of this structure. This is the protocol field in the
ip packet. Two hex 8-bit values are defined and assigned to udp and tcp. If
the both dont match the data in the protocol field the default child RawData
is used.
Fields
Static Field
This is the most simple field. It defines a chunk of data with a fixed bitsize.
Example: The MTime field of the gzip structure. The data is 4 bytes long and
displayed as a little endian hex dword.
Pointer Field
Defines a chunk of data with a variable bitsize. The bitsize is
calculated by evaluating a pointer into the data. This number can then be
modified by a first addition (substraction), a multiplication and a second
addition (substraction). The result is the bitsize of the field. The
minimum bitsize is zero.
Example: Here the Pointerfield is the data inside an udp packet. The number we
read at offset ThisNode:-4.0 is the size of the whole udp packet in bytes. To
get the data size in bits we have to subtract the headersize of the udp packet
(in this case 8 bytes) and multiply by 8 to get bitsize.
Delimited Field
Defines a chunk of data with a variable bitsize. The end of the data is
marked by a delimiter. The bitsize of the field is calculated by searching
for the defined delimiter. The delimiter is not included in the calculated
bitsize.
Example: This is the definition for a c-style string. The delimiter is 0x00
and we display the result in ascii. We choose to display the delimiter, too.
So we modify the calculated bitsize by adding 8.
Value Field
Defines a small chunk of data with a fixed bitsize and a predefined
number of values to choose from when editing this data.
Example: The Operating System byte in the gzip structure. It is 8 bits long
and there are 8 possible values to choose from.