Skip to content

Instantly share code, notes, and snippets.

@alexander-hanel
Last active September 7, 2023 18:46
Show Gist options
  • Star 1 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save alexander-hanel/deaa6548d0d788b9000499bb88cee49f to your computer and use it in GitHub Desktop.
Save alexander-hanel/deaa6548d0d788b9000499bb88cee49f to your computer and use it in GitHub Desktop.
Converts 16 bytes to a UUID using Microsoft's Variant 2 format.
import ctypes
class BYTE2UUID(ctypes.Structure):
"""
Variant 2 UUIDs
https://en.wikipedia.org/wiki/Universally_unique_identifier#Encoding
"""
_fields_ = [
("time_low", ctypes.c_uint), ("time_mid", ctypes.c_ushort), ("time_hi_and_version", ctypes.c_ushort),
("clock_seq_hi_and_res", ctypes.c_char * 2), ("node", ctypes.c_char * 6)
]
def __new__(cls, buffer):
return cls.from_buffer_copy(buffer)
def __init__(self, data):
self.uuid = "%08x-%04x-%04x-%04x-%012x" % (self.time_low, self.time_mid, self.time_hi_and_version,
int.from_bytes(self.clock_seq_hi_and_res, "big"), int.from_bytes(self.node, "big"))
return None
# example using IDA or replace "idc.get_bytes(here(), 16)" with b'\r*\xa6\x85\x17~_H\x9dOt\x9a(q\x93\xa6'
# p_data = BYTE2UUID(idc.get_bytes(here(), 16))
# print(p_data.uuid)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment