Reading binary data

[Fredrik Lundh]

"David M" wrote:

> What are u_ini16_t and comp_t?

comp_t is explained in the file you posted:

> /*
>  comp_t is a 16-bit "floating" point number with a 3-bit base 8
>  exponent and a 13-bit fraction. See linux/kernel/acct.c for the
>  specific encoding system used.
> */
>
> typedef u_int16_t comp_t;

as the comment says, comp_t is a 16-bit value.  you can read it in as
an integer, but you have to convert it to a floating point according to
the encoding mentioned above.

the typedef says that comp_t is stored as a u_int16_t, which means
that it's 16-bit value too.  judging from the name, and the fields using
it, it's safe to assume that it's an unsigned 16-bit integer.

> And what about the enum section?

it just defines a bunch of symbolic values; AFORK is 1, ASU is 2, etc.

> enum
>  {
>    AFORK = 0x01, /* Has executed fork, but no exec.  */
>    ASU = 0x02, /* Used super-user privileges.  */
>    ACORE = 0x08, /* Dumped core.  */
>    AXSIG = 0x10 /* Killed by a signal.  */
>  };

at this point, you should be able to do a little experimentation.  read in
a couple of bytes (64 bytes should be enough), print them out, and try
to see if you can match the bytes with the description above.

    import struct

    f = open(filename, "rb")

    data = f.read(64)

    # hex dump
    print data.encode("hex")

    # list of decimal byte values
    print map(ord, data)

    # struct test (keep adding type codes until you're sorted everything out)
    format = "BHHHHHH"
    print struct.unpack(format, struct.calcsize(format))

</F>