polyfile-weave 0.5.5__py3-none-any.whl

polyfile/kaitai/parsers/microsoft_cfb.py

@@ -0,0 +1,293 @@
+# This is a generated file! Please edit source .ksy file and use kaitai-struct-compiler to rebuild
+
+from pkg_resources import parse_version
+import kaitaistruct
+from kaitaistruct import KaitaiStruct, KaitaiStream, BytesIO
+import collections
+from enum import Enum
+
+
+if parse_version(kaitaistruct.__version__) < parse_version('0.9'):
+    raise Exception("Incompatible Kaitai Struct Python API: 0.9 or later is required, but you have %s" % (kaitaistruct.__version__))
+
+class MicrosoftCfb(KaitaiStruct):
+    SEQ_FIELDS = ["header"]
+    def __init__(self, _io, _parent=None, _root=None):
+        self._io = _io
+        self._parent = _parent
+        self._root = _root if _root else self
+        self._debug = collections.defaultdict(dict)
+
+    def _read(self):
+        self._debug['header']['start'] = self._io.pos()
+        self.header = MicrosoftCfb.CfbHeader(self._io, self, self._root)
+        self.header._read()
+        self._debug['header']['end'] = self._io.pos()
+
+    class CfbHeader(KaitaiStruct):
+        SEQ_FIELDS = ["signature", "clsid", "version_minor", "version_major", "byte_order", "sector_shift", "mini_sector_shift", "reserved1", "size_dir", "size_fat", "ofs_dir", "transaction_seq", "mini_stream_cutoff_size", "ofs_mini_fat", "size_mini_fat", "ofs_difat", "size_difat", "difat"]
+        def __init__(self, _io, _parent=None, _root=None):
+            self._io = _io
+            self._parent = _parent
+            self._root = _root if _root else self
+            self._debug = collections.defaultdict(dict)
+
+        def _read(self):
+            self._debug['signature']['start'] = self._io.pos()
+            self.signature = self._io.read_bytes(8)
+            self._debug['signature']['end'] = self._io.pos()
+            if not self.signature == b"\xD0\xCF\x11\xE0\xA1\xB1\x1A\xE1":
+                raise kaitaistruct.ValidationNotEqualError(b"\xD0\xCF\x11\xE0\xA1\xB1\x1A\xE1", self.signature, self._io, u"/types/cfb_header/seq/0")
+            self._debug['clsid']['start'] = self._io.pos()
+            self.clsid = self._io.read_bytes(16)
+            self._debug['clsid']['end'] = self._io.pos()
+            if not self.clsid == b"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00":
+                raise kaitaistruct.ValidationNotEqualError(b"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", self.clsid, self._io, u"/types/cfb_header/seq/1")
+            self._debug['version_minor']['start'] = self._io.pos()
+            self.version_minor = self._io.read_u2le()
+            self._debug['version_minor']['end'] = self._io.pos()
+            self._debug['version_major']['start'] = self._io.pos()
+            self.version_major = self._io.read_u2le()
+            self._debug['version_major']['end'] = self._io.pos()
+            self._debug['byte_order']['start'] = self._io.pos()
+            self.byte_order = self._io.read_bytes(2)
+            self._debug['byte_order']['end'] = self._io.pos()
+            if not self.byte_order == b"\xFE\xFF":
+                raise kaitaistruct.ValidationNotEqualError(b"\xFE\xFF", self.byte_order, self._io, u"/types/cfb_header/seq/4")
+            self._debug['sector_shift']['start'] = self._io.pos()
+            self.sector_shift = self._io.read_u2le()
+            self._debug['sector_shift']['end'] = self._io.pos()
+            self._debug['mini_sector_shift']['start'] = self._io.pos()
+            self.mini_sector_shift = self._io.read_u2le()
+            self._debug['mini_sector_shift']['end'] = self._io.pos()
+            self._debug['reserved1']['start'] = self._io.pos()
+            self.reserved1 = self._io.read_bytes(6)
+            self._debug['reserved1']['end'] = self._io.pos()
+            self._debug['size_dir']['start'] = self._io.pos()
+            self.size_dir = self._io.read_s4le()
+            self._debug['size_dir']['end'] = self._io.pos()
+            self._debug['size_fat']['start'] = self._io.pos()
+            self.size_fat = self._io.read_s4le()
+            self._debug['size_fat']['end'] = self._io.pos()
+            self._debug['ofs_dir']['start'] = self._io.pos()
+            self.ofs_dir = self._io.read_s4le()
+            self._debug['ofs_dir']['end'] = self._io.pos()
+            self._debug['transaction_seq']['start'] = self._io.pos()
+            self.transaction_seq = self._io.read_s4le()
+            self._debug['transaction_seq']['end'] = self._io.pos()
+            self._debug['mini_stream_cutoff_size']['start'] = self._io.pos()
+            self.mini_stream_cutoff_size = self._io.read_s4le()
+            self._debug['mini_stream_cutoff_size']['end'] = self._io.pos()
+            self._debug['ofs_mini_fat']['start'] = self._io.pos()
+            self.ofs_mini_fat = self._io.read_s4le()
+            self._debug['ofs_mini_fat']['end'] = self._io.pos()
+            self._debug['size_mini_fat']['start'] = self._io.pos()
+            self.size_mini_fat = self._io.read_s4le()
+            self._debug['size_mini_fat']['end'] = self._io.pos()
+            self._debug['ofs_difat']['start'] = self._io.pos()
+            self.ofs_difat = self._io.read_s4le()
+            self._debug['ofs_difat']['end'] = self._io.pos()
+            self._debug['size_difat']['start'] = self._io.pos()
+            self.size_difat = self._io.read_s4le()
+            self._debug['size_difat']['end'] = self._io.pos()
+            self._debug['difat']['start'] = self._io.pos()
+            self.difat = [None] * (109)
+            for i in range(109):
+                if not 'arr' in self._debug['difat']:
+                    self._debug['difat']['arr'] = []
+                self._debug['difat']['arr'].append({'start': self._io.pos()})
+                self.difat[i] = self._io.read_s4le()
+                self._debug['difat']['arr'][i]['end'] = self._io.pos()
+
+            self._debug['difat']['end'] = self._io.pos()
+
+
+    class FatEntries(KaitaiStruct):
+        SEQ_FIELDS = ["entries"]
+        def __init__(self, _io, _parent=None, _root=None):
+            self._io = _io
+            self._parent = _parent
+            self._root = _root if _root else self
+            self._debug = collections.defaultdict(dict)
+
+        def _read(self):
+            self._debug['entries']['start'] = self._io.pos()
+            self.entries = []
+            i = 0
+            while not self._io.is_eof():
+                if not 'arr' in self._debug['entries']:
+                    self._debug['entries']['arr'] = []
+                self._debug['entries']['arr'].append({'start': self._io.pos()})
+                self.entries.append(self._io.read_s4le())
+                self._debug['entries']['arr'][len(self.entries) - 1]['end'] = self._io.pos()
+                i += 1
+
+            self._debug['entries']['end'] = self._io.pos()
+
+
+    class DirEntry(KaitaiStruct):
+
+        class ObjType(Enum):
+            unknown = 0
+            storage = 1
+            stream = 2
+            root_storage = 5
+
+        class RbColor(Enum):
+            red = 0
+            black = 1
+        SEQ_FIELDS = ["name", "name_len", "object_type", "color_flag", "left_sibling_id", "right_sibling_id", "child_id", "clsid", "state", "time_create", "time_mod", "ofs", "size"]
+        def __init__(self, _io, _parent=None, _root=None):
+            self._io = _io
+            self._parent = _parent
+            self._root = _root if _root else self
+            self._debug = collections.defaultdict(dict)
+
+        def _read(self):
+            self._debug['name']['start'] = self._io.pos()
+            self.name = (self._io.read_bytes(64)).decode(u"UTF-16LE")
+            self._debug['name']['end'] = self._io.pos()
+            self._debug['name_len']['start'] = self._io.pos()
+            self.name_len = self._io.read_u2le()
+            self._debug['name_len']['end'] = self._io.pos()
+            self._debug['object_type']['start'] = self._io.pos()
+            self.object_type = KaitaiStream.resolve_enum(MicrosoftCfb.DirEntry.ObjType, self._io.read_u1())
+            self._debug['object_type']['end'] = self._io.pos()
+            self._debug['color_flag']['start'] = self._io.pos()
+            self.color_flag = KaitaiStream.resolve_enum(MicrosoftCfb.DirEntry.RbColor, self._io.read_u1())
+            self._debug['color_flag']['end'] = self._io.pos()
+            self._debug['left_sibling_id']['start'] = self._io.pos()
+            self.left_sibling_id = self._io.read_s4le()
+            self._debug['left_sibling_id']['end'] = self._io.pos()
+            self._debug['right_sibling_id']['start'] = self._io.pos()
+            self.right_sibling_id = self._io.read_s4le()
+            self._debug['right_sibling_id']['end'] = self._io.pos()
+            self._debug['child_id']['start'] = self._io.pos()
+            self.child_id = self._io.read_s4le()
+            self._debug['child_id']['end'] = self._io.pos()
+            self._debug['clsid']['start'] = self._io.pos()
+            self.clsid = self._io.read_bytes(16)
+            self._debug['clsid']['end'] = self._io.pos()
+            self._debug['state']['start'] = self._io.pos()
+            self.state = self._io.read_u4le()
+            self._debug['state']['end'] = self._io.pos()
+            self._debug['time_create']['start'] = self._io.pos()
+            self.time_create = self._io.read_u8le()
+            self._debug['time_create']['end'] = self._io.pos()
+            self._debug['time_mod']['start'] = self._io.pos()
+            self.time_mod = self._io.read_u8le()
+            self._debug['time_mod']['end'] = self._io.pos()
+            self._debug['ofs']['start'] = self._io.pos()
+            self.ofs = self._io.read_s4le()
+            self._debug['ofs']['end'] = self._io.pos()
+            self._debug['size']['start'] = self._io.pos()
+            self.size = self._io.read_u8le()
+            self._debug['size']['end'] = self._io.pos()
+
+        @property
+        def mini_stream(self):
+            if hasattr(self, '_m_mini_stream'):
+                return self._m_mini_stream if hasattr(self, '_m_mini_stream') else None
+
+            if self.object_type == MicrosoftCfb.DirEntry.ObjType.root_storage:
+                io = self._root._io
+                _pos = io.pos()
+                io.seek(((self.ofs + 1) * self._root.sector_size))
+                self._debug['_m_mini_stream']['start'] = io.pos()
+                self._m_mini_stream = io.read_bytes(self.size)
+                self._debug['_m_mini_stream']['end'] = io.pos()
+                io.seek(_pos)
+
+            return self._m_mini_stream if hasattr(self, '_m_mini_stream') else None
+
+        @property
+        def child(self):
+            if hasattr(self, '_m_child'):
+                return self._m_child if hasattr(self, '_m_child') else None
+
+            if self.child_id != -1:
+                io = self._root._io
+                _pos = io.pos()
+                io.seek((((self._root.header.ofs_dir + 1) * self._root.sector_size) + (self.child_id * 128)))
+                self._debug['_m_child']['start'] = io.pos()
+                self._m_child = MicrosoftCfb.DirEntry(io, self, self._root)
+                self._m_child._read()
+                self._debug['_m_child']['end'] = io.pos()
+                io.seek(_pos)
+
+            return self._m_child if hasattr(self, '_m_child') else None
+
+        @property
+        def left_sibling(self):
+            if hasattr(self, '_m_left_sibling'):
+                return self._m_left_sibling if hasattr(self, '_m_left_sibling') else None
+
+            if self.left_sibling_id != -1:
+                io = self._root._io
+                _pos = io.pos()
+                io.seek((((self._root.header.ofs_dir + 1) * self._root.sector_size) + (self.left_sibling_id * 128)))
+                self._debug['_m_left_sibling']['start'] = io.pos()
+                self._m_left_sibling = MicrosoftCfb.DirEntry(io, self, self._root)
+                self._m_left_sibling._read()
+                self._debug['_m_left_sibling']['end'] = io.pos()
+                io.seek(_pos)
+
+            return self._m_left_sibling if hasattr(self, '_m_left_sibling') else None
+
+        @property
+        def right_sibling(self):
+            if hasattr(self, '_m_right_sibling'):
+                return self._m_right_sibling if hasattr(self, '_m_right_sibling') else None
+
+            if self.right_sibling_id != -1:
+                io = self._root._io
+                _pos = io.pos()
+                io.seek((((self._root.header.ofs_dir + 1) * self._root.sector_size) + (self.right_sibling_id * 128)))
+                self._debug['_m_right_sibling']['start'] = io.pos()
+                self._m_right_sibling = MicrosoftCfb.DirEntry(io, self, self._root)
+                self._m_right_sibling._read()
+                self._debug['_m_right_sibling']['end'] = io.pos()
+                io.seek(_pos)
+
+            return self._m_right_sibling if hasattr(self, '_m_right_sibling') else None
+
+
+    @property
+    def sector_size(self):
+        if hasattr(self, '_m_sector_size'):
+            return self._m_sector_size if hasattr(self, '_m_sector_size') else None
+
+        self._m_sector_size = (1 << self.header.sector_shift)
+        return self._m_sector_size if hasattr(self, '_m_sector_size') else None
+
+    @property
+    def fat(self):
+        if hasattr(self, '_m_fat'):
+            return self._m_fat if hasattr(self, '_m_fat') else None
+
+        _pos = self._io.pos()
+        self._io.seek(self.sector_size)
+        self._debug['_m_fat']['start'] = self._io.pos()
+        self._raw__m_fat = self._io.read_bytes((self.header.size_fat * self.sector_size))
+        _io__raw__m_fat = KaitaiStream(BytesIO(self._raw__m_fat))
+        self._m_fat = MicrosoftCfb.FatEntries(_io__raw__m_fat, self, self._root)
+        self._m_fat._read()
+        self._debug['_m_fat']['end'] = self._io.pos()
+        self._io.seek(_pos)
+        return self._m_fat if hasattr(self, '_m_fat') else None
+
+    @property
+    def dir(self):
+        if hasattr(self, '_m_dir'):
+            return self._m_dir if hasattr(self, '_m_dir') else None
+
+        _pos = self._io.pos()
+        self._io.seek(((self.header.ofs_dir + 1) * self.sector_size))
+        self._debug['_m_dir']['start'] = self._io.pos()
+        self._m_dir = MicrosoftCfb.DirEntry(self._io, self, self._root)
+        self._m_dir._read()
+        self._debug['_m_dir']['end'] = self._io.pos()
+        self._io.seek(_pos)
+        return self._m_dir if hasattr(self, '_m_dir') else None
+
+

polyfile/kaitai/parsers/microsoft_network_monitor_v2.py

@@ -0,0 +1,309 @@
+# This is a generated file! Please edit source .ksy file and use kaitai-struct-compiler to rebuild
+
+from pkg_resources import parse_version
+import kaitaistruct
+from kaitaistruct import KaitaiStruct, KaitaiStream, BytesIO
+from enum import Enum
+import collections
+
+
+if parse_version(kaitaistruct.__version__) < parse_version('0.9'):
+    raise Exception("Incompatible Kaitai Struct Python API: 0.9 or later is required, but you have %s" % (kaitaistruct.__version__))
+
+from polyfile.kaitai.parsers import ethernet_frame
+from polyfile.kaitai.parsers import windows_systemtime
+class MicrosoftNetworkMonitorV2(KaitaiStruct):
+    """Microsoft Network Monitor (AKA Netmon) is a proprietary Microsoft's
+    network packet sniffing and analysis tool. It can save captured
+    traffic as .cap files, which usually contain the packets and may
+    contain some additional info - enhanced network info, calculated
+    statistics, etc.
+    
+    There are at least 2 different versions of the format: v1 and
+    v2. Netmon v3 seems to use the same file format as v1.
+    
+    .. seealso::
+       Source - https://learn.microsoft.com/en-us/windows/win32/netmon2/capturefile-header-values
+    """
+
+    class Linktype(Enum):
+        null_linktype = 0
+        ethernet = 1
+        ax25 = 3
+        ieee802_5 = 6
+        arcnet_bsd = 7
+        slip = 8
+        ppp = 9
+        fddi = 10
+        ppp_hdlc = 50
+        ppp_ether = 51
+        atm_rfc1483 = 100
+        raw = 101
+        c_hdlc = 104
+        ieee802_11 = 105
+        frelay = 107
+        loop = 108
+        linux_sll = 113
+        ltalk = 114
+        pflog = 117
+        ieee802_11_prism = 119
+        ip_over_fc = 122
+        sunatm = 123
+        ieee802_11_radiotap = 127
+        arcnet_linux = 129
+        apple_ip_over_ieee1394 = 138
+        mtp2_with_phdr = 139
+        mtp2 = 140
+        mtp3 = 141
+        sccp = 142
+        docsis = 143
+        linux_irda = 144
+        user0 = 147
+        user1 = 148
+        user2 = 149
+        user3 = 150
+        user4 = 151
+        user5 = 152
+        user6 = 153
+        user7 = 154
+        user8 = 155
+        user9 = 156
+        user10 = 157
+        user11 = 158
+        user12 = 159
+        user13 = 160
+        user14 = 161
+        user15 = 162
+        ieee802_11_avs = 163
+        bacnet_ms_tp = 165
+        ppp_pppd = 166
+        gprs_llc = 169
+        gpf_t = 170
+        gpf_f = 171
+        linux_lapd = 177
+        bluetooth_hci_h4 = 187
+        usb_linux = 189
+        ppi = 192
+        ieee802_15_4 = 195
+        sita = 196
+        erf = 197
+        bluetooth_hci_h4_with_phdr = 201
+        ax25_kiss = 202
+        lapd = 203
+        ppp_with_dir = 204
+        c_hdlc_with_dir = 205
+        frelay_with_dir = 206
+        ipmb_linux = 209
+        ieee802_15_4_nonask_phy = 215
+        usb_linux_mmapped = 220
+        fc_2 = 224
+        fc_2_with_frame_delims = 225
+        ipnet = 226
+        can_socketcan = 227
+        ipv4 = 228
+        ipv6 = 229
+        ieee802_15_4_nofcs = 230
+        dbus = 231
+        dvb_ci = 235
+        mux27010 = 236
+        stanag_5066_d_pdu = 237
+        nflog = 239
+        netanalyzer = 240
+        netanalyzer_transparent = 241
+        ipoib = 242
+        mpeg_2_ts = 243
+        ng40 = 244
+        nfc_llcp = 245
+        infiniband = 247
+        sctp = 248
+        usbpcap = 249
+        rtac_serial = 250
+        bluetooth_le_ll = 251
+        netlink = 253
+        bluetooth_linux_monitor = 254
+        bluetooth_bredr_bb = 255
+        bluetooth_le_ll_with_phdr = 256
+        profibus_dl = 257
+        pktap = 258
+        epon = 259
+        ipmi_hpm_2 = 260
+        zwave_r1_r2 = 261
+        zwave_r3 = 262
+        wattstopper_dlm = 263
+        iso_14443 = 264
+    SEQ_FIELDS = ["signature", "version_minor", "version_major", "mac_type", "time_capture_start", "frame_table_ofs", "frame_table_len", "user_data_ofs", "user_data_len", "comment_ofs", "comment_len", "statistics_ofs", "statistics_len", "network_info_ofs", "network_info_len", "conversation_stats_ofs", "conversation_stats_len"]
+    def __init__(self, _io, _parent=None, _root=None):
+        self._io = _io
+        self._parent = _parent
+        self._root = _root if _root else self
+        self._debug = collections.defaultdict(dict)
+
+    def _read(self):
+        self._debug['signature']['start'] = self._io.pos()
+        self.signature = self._io.read_bytes(4)
+        self._debug['signature']['end'] = self._io.pos()
+        if not self.signature == b"\x47\x4D\x42\x55":
+            raise kaitaistruct.ValidationNotEqualError(b"\x47\x4D\x42\x55", self.signature, self._io, u"/seq/0")
+        self._debug['version_minor']['start'] = self._io.pos()
+        self.version_minor = self._io.read_u1()
+        self._debug['version_minor']['end'] = self._io.pos()
+        self._debug['version_major']['start'] = self._io.pos()
+        self.version_major = self._io.read_u1()
+        self._debug['version_major']['end'] = self._io.pos()
+        self._debug['mac_type']['start'] = self._io.pos()
+        self.mac_type = KaitaiStream.resolve_enum(MicrosoftNetworkMonitorV2.Linktype, self._io.read_u2le())
+        self._debug['mac_type']['end'] = self._io.pos()
+        self._debug['time_capture_start']['start'] = self._io.pos()
+        self.time_capture_start = windows_systemtime.WindowsSystemtime(self._io)
+        self.time_capture_start._read()
+        self._debug['time_capture_start']['end'] = self._io.pos()
+        self._debug['frame_table_ofs']['start'] = self._io.pos()
+        self.frame_table_ofs = self._io.read_u4le()
+        self._debug['frame_table_ofs']['end'] = self._io.pos()
+        self._debug['frame_table_len']['start'] = self._io.pos()
+        self.frame_table_len = self._io.read_u4le()
+        self._debug['frame_table_len']['end'] = self._io.pos()
+        self._debug['user_data_ofs']['start'] = self._io.pos()
+        self.user_data_ofs = self._io.read_u4le()
+        self._debug['user_data_ofs']['end'] = self._io.pos()
+        self._debug['user_data_len']['start'] = self._io.pos()
+        self.user_data_len = self._io.read_u4le()
+        self._debug['user_data_len']['end'] = self._io.pos()
+        self._debug['comment_ofs']['start'] = self._io.pos()
+        self.comment_ofs = self._io.read_u4le()
+        self._debug['comment_ofs']['end'] = self._io.pos()
+        self._debug['comment_len']['start'] = self._io.pos()
+        self.comment_len = self._io.read_u4le()
+        self._debug['comment_len']['end'] = self._io.pos()
+        self._debug['statistics_ofs']['start'] = self._io.pos()
+        self.statistics_ofs = self._io.read_u4le()
+        self._debug['statistics_ofs']['end'] = self._io.pos()
+        self._debug['statistics_len']['start'] = self._io.pos()
+        self.statistics_len = self._io.read_u4le()
+        self._debug['statistics_len']['end'] = self._io.pos()
+        self._debug['network_info_ofs']['start'] = self._io.pos()
+        self.network_info_ofs = self._io.read_u4le()
+        self._debug['network_info_ofs']['end'] = self._io.pos()
+        self._debug['network_info_len']['start'] = self._io.pos()
+        self.network_info_len = self._io.read_u4le()
+        self._debug['network_info_len']['end'] = self._io.pos()
+        self._debug['conversation_stats_ofs']['start'] = self._io.pos()
+        self.conversation_stats_ofs = self._io.read_u4le()
+        self._debug['conversation_stats_ofs']['end'] = self._io.pos()
+        self._debug['conversation_stats_len']['start'] = self._io.pos()
+        self.conversation_stats_len = self._io.read_u4le()
+        self._debug['conversation_stats_len']['end'] = self._io.pos()
+
+    class FrameIndex(KaitaiStruct):
+        SEQ_FIELDS = ["entries"]
+        def __init__(self, _io, _parent=None, _root=None):
+            self._io = _io
+            self._parent = _parent
+            self._root = _root if _root else self
+            self._debug = collections.defaultdict(dict)
+
+        def _read(self):
+            self._debug['entries']['start'] = self._io.pos()
+            self.entries = []
+            i = 0
+            while not self._io.is_eof():
+                if not 'arr' in self._debug['entries']:
+                    self._debug['entries']['arr'] = []
+                self._debug['entries']['arr'].append({'start': self._io.pos()})
+                _t_entries = MicrosoftNetworkMonitorV2.FrameIndexEntry(self._io, self, self._root)
+                _t_entries._read()
+                self.entries.append(_t_entries)
+                self._debug['entries']['arr'][len(self.entries) - 1]['end'] = self._io.pos()
+                i += 1
+
+            self._debug['entries']['end'] = self._io.pos()
+
+
+    class FrameIndexEntry(KaitaiStruct):
+        """Each index entry is just a pointer to where the frame data is
+        stored in the file.
+        """
+        SEQ_FIELDS = ["ofs"]
+        def __init__(self, _io, _parent=None, _root=None):
+            self._io = _io
+            self._parent = _parent
+            self._root = _root if _root else self
+            self._debug = collections.defaultdict(dict)
+
+        def _read(self):
+            self._debug['ofs']['start'] = self._io.pos()
+            self.ofs = self._io.read_u4le()
+            self._debug['ofs']['end'] = self._io.pos()
+
+        @property
+        def body(self):
+            """Frame body itself."""
+            if hasattr(self, '_m_body'):
+                return self._m_body if hasattr(self, '_m_body') else None
+
+            io = self._root._io
+            _pos = io.pos()
+            io.seek(self.ofs)
+            self._debug['_m_body']['start'] = io.pos()
+            self._m_body = MicrosoftNetworkMonitorV2.Frame(io, self, self._root)
+            self._m_body._read()
+            self._debug['_m_body']['end'] = io.pos()
+            io.seek(_pos)
+            return self._m_body if hasattr(self, '_m_body') else None
+
+
+    class Frame(KaitaiStruct):
+        """A container for actually captured network data. Allow to
+        timestamp individual frames and designates how much data from
+        the original packet was actually written into the file.
+        
+        .. seealso::
+           Source - https://learn.microsoft.com/en-us/windows/win32/netmon2/frame
+        """
+        SEQ_FIELDS = ["ts_delta", "orig_len", "inc_len", "body"]
+        def __init__(self, _io, _parent=None, _root=None):
+            self._io = _io
+            self._parent = _parent
+            self._root = _root if _root else self
+            self._debug = collections.defaultdict(dict)
+
+        def _read(self):
+            self._debug['ts_delta']['start'] = self._io.pos()
+            self.ts_delta = self._io.read_u8le()
+            self._debug['ts_delta']['end'] = self._io.pos()
+            self._debug['orig_len']['start'] = self._io.pos()
+            self.orig_len = self._io.read_u4le()
+            self._debug['orig_len']['end'] = self._io.pos()
+            self._debug['inc_len']['start'] = self._io.pos()
+            self.inc_len = self._io.read_u4le()
+            self._debug['inc_len']['end'] = self._io.pos()
+            self._debug['body']['start'] = self._io.pos()
+            _on = self._root.mac_type
+            if _on == MicrosoftNetworkMonitorV2.Linktype.ethernet:
+                self._raw_body = self._io.read_bytes(self.inc_len)
+                _io__raw_body = KaitaiStream(BytesIO(self._raw_body))
+                self.body = ethernet_frame.EthernetFrame(_io__raw_body)
+                self.body._read()
+            else:
+                self.body = self._io.read_bytes(self.inc_len)
+            self._debug['body']['end'] = self._io.pos()
+
+
+    @property
+    def frame_table(self):
+        """Index that is used to access individual captured frames."""
+        if hasattr(self, '_m_frame_table'):
+            return self._m_frame_table if hasattr(self, '_m_frame_table') else None
+
+        _pos = self._io.pos()
+        self._io.seek(self.frame_table_ofs)
+        self._debug['_m_frame_table']['start'] = self._io.pos()
+        self._raw__m_frame_table = self._io.read_bytes(self.frame_table_len)
+        _io__raw__m_frame_table = KaitaiStream(BytesIO(self._raw__m_frame_table))
+        self._m_frame_table = MicrosoftNetworkMonitorV2.FrameIndex(_io__raw__m_frame_table, self, self._root)
+        self._m_frame_table._read()
+        self._debug['_m_frame_table']['end'] = self._io.pos()
+        self._io.seek(_pos)
+        return self._m_frame_table if hasattr(self, '_m_frame_table') else None
+
+