[Synalyze It Pro: Timestamp Data Type Script] For displaying and manipulating the timestamp header bytes in a Python bytecode (pyc) file. #synalyzeitpro #userscript #python #bytecode

Timestamp.py

# Data type script for displaying and manipulating the 
# timestamp header bytes in a Python bytcode (pyc) file.
#
# pyc header
#                 8                16
# +-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+ 
# |X|X|X|X|0|D|0|A| |T|I|M|E|S|T|M|P|
# +-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+ 
#  \______/\______/ \_______________/
#    inc.    cr/lf      timestamp
# 
# Author: Andre Berg
# 
# You can change the TIME_FORMAT constant below to the 
# format you are most comfortable with. By default it 
# will use an ISO-8601 date time format.
# 

import time, struct
import datetime

ASCTIME_FORMAT = "%a %b  %d %H:%M:%S %Y"
ISODATE_FORMAT = "%Y-%m-%d %H:%M:%S"
TIME_FORMAT = ISODATE_FORMAT

def parseByteRange(element, byteView, bitPos, bitLength, results):
    # this method parses data starting at bitPos, bitLength bits are remaining
    """parseByteRange method"""

    tsBytes = byteView.readUnsignedInt(bitPos/8, 4, ENDIAN_LITTLE)
    stamp = str(time.strftime(TIME_FORMAT, time.localtime(tsBytes)))

    # create and set new value
    value = Value()
    value.setString(stamp)

    # how many bytes were processed?
    processedBytes = 4
    iteration = 0

    results.addElement(element, processedBytes, iteration, value)

    # return number of processed bytes
    return processedBytes

def fillByteRange(value, byteArray, bitPos, bitLength):
    # this method translates edited values back to the file
    """fillByteRange method"""
    
    editedString = value.getString()
    newStamp = int(time.mktime(time.strptime(editedString, TIME_FORMAT)))
    newBytes = struct.pack('I', newStamp)
    
    # write an integer back to file
    byteArray.fillRange(bitPos/8, 4, newBytes)