Basic Python project scaffold for dwarffi.
Project description
dwarffi
An authentic, DWARF-powered type interface for Python.
dwarffi allows you to interact with memory layouts using
Intermediate Symbol Files (ISF) generated from DWARF debug
information. It provides a CFFI-like experience without requiring header
files---instead, it uses the actual compiled structures from your
binaries.
Intermediate Symbol Files (ISF) are JSON representations of DWARF type
information. They capture the exact memory layout, including padding and
alignment, as defined in the original C code and compiled into the binary. You
can generate ISF files using the dwarf2json tool, which extracts DWARF info
from ELF binaries.
Read more about dwarf2json and ISF in the dwarf2json README.
🚀 Features
- DWARF-Native: No need to rewrite C headers. Just point to a
.jsonor.json.xzISF file (generated bydwarf2json). - Architecture Agnostic: Handles Big Endian (PowerPC/MIPS) and Little Endian (ARM/x86) transparently.
- Dynamic
cdef: Compile C code on the fly to generate types, with automatic debug-type retention to prevent compilers from stripping unused definitions. - Recursive Typedef Handling: Automatic resolution and decay of typedef chains.
- C-Style Magic:
- Pointer arithmetic (
ptr + 5) - Pointer subtraction (
ptr2 - ptr1) - Array slicing (
arr[1:5]) - Deep struct initialization via nested dictionaries
- Pointer arithmetic (
- Safety Semantics:
- Automatic bit-masking
- Sign extension
- C-style integer overflow/underflow behavior
- Anonymous Struct/Union Flattening: Access anonymous union members directly (ideal for register maps).
- ISF Export Support: Save dynamically generated ISFs to
.jsonor.json.xz.
📦 Installation
pip install dwarffi
Requirements for cdef()
To use dynamic compilation:
- A C compiler (
gcc,clang, or cross-compiler) dwarf2jsonavailable in your PATH
NOTE: For some compilers you may need to disable options for optimizing away unused debug types. For example, with gcc you can use
-fno-eliminate-unused-debug-types.
🛠️ Quick Start
1️⃣ CFFI-style cdef
from dwarffi import DFFI
ffi = DFFI()
ffi.cdef("""
struct sensor_data {
uint32_t timestamp;
int16_t readings[3];
uint8_t status;
};
""")
Create an instance:
sensor = ffi.new("struct sensor_data", {
"timestamp": 1234567,
"readings": [10, -5, 20],
"status": 0x01
})
print(f"Bytes: {sensor.to_bytes().hex()}")
print(f"Reading[1]: {sensor.readings[1]}") # -5
2️⃣ Embedded Architecture Analysis
ffi = DFFI("mips_be_target.json")
raw_data = bytearray(b'\x00\x00\x12\x34\xff\xff\xff\xfb')
cpu_ctx = ffi.from_buffer("struct cpu_context", raw_data)
print(hex(cpu_ctx.pc)) # 0x1234
print(cpu_ctx.status) # -5 (Sign-extended)
🧩 Advanced Usage
Anonymous Unions
ffi.cdef("""
struct reg_map {
union {
uint32_t ALL;
struct {
uint16_t LOW;
uint16_t HIGH;
};
};
};
""")
reg = ffi.new("struct reg_map")
reg.ALL = 0x12345678
print(hex(reg.HIGH)) # 0x1234
Pointer Arithmetic
ptr = ffi.cast("int *", 0x4000)
next_ptr = ptr + 1
print(hex(next_ptr.address))
⚙️ How It Works
dwarffi operates in three phases:
1. Parsing
Reads ISF JSON files that represent the DWARF type tree.
2. Type Synthesis
Builds Python representations of:
- Base types
- Structs
- Unions
- Enums
- Typedef chains
- Arrays
- Pointers
3. Memory Mapping
Uses Python's struct.pack and struct.unpack under the hood to:
- Convert Python integers into architecture-accurate byte layouts
- Apply endianness rules
- Respect alignment and padding
Instances are bound views into bytearrays. Field access directly reads/writes into the underlying buffer.
📚 Core API Reference
DFFI()
Create an empty instance or load an ISF file.
cdef(source, compiler="gcc", save_isf_to=None)
Compile C source → DWARF → ISF → load into current FFI.
new(ctype, init=None)
Allocate a new instance of a C type.
from_buffer(ctype, buffer)
Bind a type to existing memory.
sizeof(ctype)
Return size in bytes.
offsetof(ctype, field)
Return byte offset of a field.
cast(ctype, value)
Reinterpret memory or create pointer instances.
addressof(instance)
Return pointer to instance.
🤝 Contributing
Contributions are welcome!
python -m venv .venv
source .venv/bin/activate
pip install -e ".[dev]"
pytest
Project details
Release history Release notifications | RSS feed
Download files
Download the file for your platform. If you're not sure which to choose, learn more about installing packages.
Source Distribution
Built Distribution
Filter files by name, interpreter, ABI, and platform.
If you're not sure about the file name format, learn more about wheel file names.
Copy a direct link to the current filters
File details
Details for the file dwarffi-0.0.3.tar.gz.
File metadata
- Download URL: dwarffi-0.0.3.tar.gz
- Upload date:
- Size: 31.7 kB
- Tags: Source
- Uploaded using Trusted Publishing? Yes
- Uploaded via: twine/6.1.0 CPython/3.13.7
File hashes
| Algorithm | Hash digest | |
|---|---|---|
| SHA256 |
de7e78dd8e6f632d738a2d32f331e17b06a114ee0c199ceb71a030800c4f33b8
|
|
| MD5 |
d9de7d05dd61fec15e62c4ff70d18593
|
|
| BLAKE2b-256 |
688ea36f863aeff54cc0111062429a0b39a7db30da3097611fc9b6469c483bac
|
Provenance
The following attestation bundles were made for dwarffi-0.0.3.tar.gz:
Publisher:
publish.yml on rehosting/dwarffi
-
Statement:
-
Statement type:
https://in-toto.io/Statement/v1 -
Predicate type:
https://docs.pypi.org/attestations/publish/v1 -
Subject name:
dwarffi-0.0.3.tar.gz -
Subject digest:
de7e78dd8e6f632d738a2d32f331e17b06a114ee0c199ceb71a030800c4f33b8 - Sigstore transparency entry: 983916770
- Sigstore integration time:
-
Permalink:
rehosting/dwarffi@8dbdd65f1baf0385286dd499768c610959b2fb98 -
Branch / Tag:
refs/heads/main - Owner: https://github.com/rehosting
-
Access:
private
-
Token Issuer:
https://token.actions.githubusercontent.com -
Runner Environment:
github-hosted -
Publication workflow:
publish.yml@8dbdd65f1baf0385286dd499768c610959b2fb98 -
Trigger Event:
push
-
Statement type:
File details
Details for the file dwarffi-0.0.3-py3-none-any.whl.
File metadata
- Download URL: dwarffi-0.0.3-py3-none-any.whl
- Upload date:
- Size: 22.4 kB
- Tags: Python 3
- Uploaded using Trusted Publishing? Yes
- Uploaded via: twine/6.1.0 CPython/3.13.7
File hashes
| Algorithm | Hash digest | |
|---|---|---|
| SHA256 |
300b10b2dfe5268279a3c96a28afea5cbd34f505f531e92627ee5616f9584949
|
|
| MD5 |
b5872e68cb0a0683c20a8bf4dcbdd17f
|
|
| BLAKE2b-256 |
56d91452e6aac4bd15a8d8bb4a55a64400143c19f7f043e6d9fe9af5c8ef78e1
|
Provenance
The following attestation bundles were made for dwarffi-0.0.3-py3-none-any.whl:
Publisher:
publish.yml on rehosting/dwarffi
-
Statement:
-
Statement type:
https://in-toto.io/Statement/v1 -
Predicate type:
https://docs.pypi.org/attestations/publish/v1 -
Subject name:
dwarffi-0.0.3-py3-none-any.whl -
Subject digest:
300b10b2dfe5268279a3c96a28afea5cbd34f505f531e92627ee5616f9584949 - Sigstore transparency entry: 983916775
- Sigstore integration time:
-
Permalink:
rehosting/dwarffi@8dbdd65f1baf0385286dd499768c610959b2fb98 -
Branch / Tag:
refs/heads/main - Owner: https://github.com/rehosting
-
Access:
private
-
Token Issuer:
https://token.actions.githubusercontent.com -
Runner Environment:
github-hosted -
Publication workflow:
publish.yml@8dbdd65f1baf0385286dd499768c610959b2fb98 -
Trigger Event:
push
-
Statement type: