The following FixUp is required to use this Pit.

from Peach.fixup import Fixup

class Zeroed(Fixup):
        '''
        Zero out value
        '''

        def __init__(self):
                Fixup.__init__(self)

        def fixup(self):
                self.context.defaultValue = "0"
                zeroed = 0

                return zeroed

And the Peach Pit:

<?xml version="1.0" encoding="utf-8"?>
<Peach version="1.0" author="Jason Kratzer" site="http://www.flinkd.org">
  <Include ns="default" src="file:defaults.xml"/>
  <PythonPath path="c:\svn-peach\custom"/>
  <Import import="custom"/>

  <DataModel name="CABFileFormat">
    <Block name="cfHeader">
	  <String name="Signature" value="MSCF" token="true" mutable="false"/>
	  <Number name="Reserved1" size="32" value="0" endian="little" token="true"/>
	  <Number name="cbCabinet1" size="32" endian="little">
	    <Relation type="size" of="CABFileFormat" expressionGet="size+len(self.find('CodeSigned').value)" expressionSet="size-len(self.find('CodeSigned').value)"/>
	  </Number>
	  <Number name="Reserved2" size="32" value="0" endian="little" token="true"/>
	  <Number name="coffFiles" size="32" endian="little">
	    <Relation type="offset" of="CFFileBlock" />
	  </Number>
	  <Number name="Reserved3" size="32" value="0" endian="little" token="true"/>
	  <Number name="versionMinor" size="8" value="3" endian="little"/>
	  <Number name="versionMajor" size="8" value="1" endian="little"/>
	  <Number name="cFolders" size="16" endian="little">
	    <Relation type="count" of="CFFolderBlock"/>
	  </Number>
	  <Number name="cFiles" size="16" endian="little">
	    <Relation type="count" of="CFFileSubBlock"/>
	  </Number>
	  <Flags name="flags" size="16" endian="little">
	    <Flag position="0" size="1" name="cfhdrPREV_CABINET"/>
		<Flag position="1" size="1" name="cfhdrNEXT_CABINET"/>
		<Flag position="2" size="1" name="cfhdrRESERVE_PRESENT"/>
		<Flag position="3" size="1"/>
		<Flag position="4" size="12"/>
	  </Flags>
	  <Number name="setID" size="16" endian="little"/>
	  <Number name="iCabinet" size="16" endian="little"/>
	  <Number name="cbCFHeader" size="16" endian="little">
	    <Relation type="when" when="int(self.find('cfhdrRESERVE_PRESENT').defaultValue) != 0"/>
		<Relation type="size" of="abReserveHeader"/>
	  </Number>
  	  <Number name="cbCFFolder" size="8" endian="little">
	    <Relation type="when" when="int(self.find('cfhdrRESERVE_PRESENT').defaultValue) != 0"/>
		<Relation type="size" of="CABFileFormat.CFFolderBlock.abReserveFolder"/>
	  </Number>
  	  <Number name="cbCFData" size="8" endian="little">
	    <Relation type="when" when="int(self.find('cfhdrRESERVE_PRESENT').defaultValue) != 0"/>
		<!-- Currently broken.  Need to figure out how to place size relation on an array -->
		<!--<Relation type="size" of="CABFileFormat.CFDataBlock.CFDataSubBlock.abReserveData"/>-->
	  </Number>
	  <Blob name="abReserveHeader">
	    <Relation type="when" when="int(self.find('cfhdrRESERVE_PRESENT').defaultValue) != 0"/>
	  </Blob>
	  <String name="szCabinetPrev" nullTerminated="true">
	    <Relation type="when" when="int(self.find('cfhdrPREV_CABINET').defaultValue) != 0"/>
	  </String>
	  <String name="szDiskPrev" nullTerminated="true">
	    <Relation type="when" when="int(self.find('cfhdrPREV_CABINET').defaultValue) != 0"/>
	  </String>
  	  <String name="szCabinetNext" nullTerminated="true">
	    <Relation type="when" when="int(self.find('cfhdrNEXT_CABINET').defaultValue) != 0"/>
	  </String>
      <String name="szDiskNext" nullTerminated="true">
	    <Relation type="when" when="int(self.find('cfhdrNEXT_CABINET').defaultValue) != 0"/>
	  </String>
	</Block>
	
	<Block name="CFFolderBlock" minOccurs="1">
	  <Number name="coffCabStart" size="32" endian="little">
	    <Relation type="offset" of="CFDataBlock" />
      </Number>
	  <Number name="cCfData" size="16" endian="little">
	    <Relation type="count" of="CABFileFormat.CFDataBlock.CFDataSubBlock"/>
	  </Number>
	  <Choice name="typeCompress">
	    <Number name="tcompMASK_TYPE" size="16" endian="little" value="15"/> <!-- 0x000F -->
		<Number name="tcompTYPE_NONE" size="16" endian="little" value="0"/> <!-- 0x0001 -->
		<Number name="tcompTYPE_MSZIP" size="16" endian="little" value="1"/> <!-- 0x0002 -->
		<Number name="tcompTYPE_QUANTUM" size="16" endian="little" value="2"/> <!-- 0x0003 -->
		<Number name="tcompTYPE_LZX" size="16" endian="little" value="3"/> <!-- 0x0004 -->
	  </Choice>
      <Blob name="abReserveFolder">
	    <Relation type="when" when="int(self.find('cfhdrRESERVE_PRESENT').defaultValue) != 0"/>
	  </Blob>
	</Block>
	
	<Block name="CFFileBlock">
	    <Block name="CFFileSubBlock" minOccurs="1" maxOccurs="1024">
		  <Number name="cbFile" size="32" endian="little"/>
		  <Number name="uoffFolderStart" size="32" endian="little"/>
		  <Number name="iFolder" size="16" endian="little"/>
		  <Number name="date" size="16" endian="little"/>
		  <Number name="time" size="16" endian="little"/>
		  <Number name="attribs" size="16" endian="little"/> <!-- This could be set to <Flag> but doesn't appear necessary -->
		  <String name="szName" nullTerminated="true"/>
		</Block>
	</Block>
	
    <Block name="CFDataBlock">
	  <Block name="CFDataSubBlock" minOccurs="1" maxOccurs="1024">
	    <Number name="csum" size="32" endian="little" value="0">
		  <Fixup class="custom.Zeroed"/>
		</Number>
		<Number name="cbData" size="16" endian="little">
		  <Relation type="size" of="ab"/>
		</Number>
		<Number name="cbUncomp" size="16" endian="little"/>
		
        <!-- Currently broken.  Need to figure out how to place size relation on an array -->
		<!-- <Blob name="abReserveData" minOccurs="0"/> -->
		
		<Blob name="ab"/>
	  </Block>
      <Block name="CodeSigned">
	  <!-- It appears that a large number of CAB files are code signed.  This data isn't included in the spec.
	     we add a catch-all blob here to consume the remaining file data.  A datamodel could be developed for
		 the code signing. -->
	    <Blob name="codeSignedData" minOccurs="0" maxOuccurs="1024"/>
	  </Block>
	</Block>

  </DataModel>

<StateModel name="State" initialState="Initial">
  <State name="Initial">
    <Action type="open" />
    <Action name="WriteFile" type="output">
      <DataModel ref="CABFileFormat" />
	  <Data name="data" fileName="C:\svn-peach\test-5.cab"/>
    </Action>
    <Action type="close" />
    <Action type="call" method="ScoobySnacks"/>
  </State>
</StateModel>
        
<Agent name="LocalAgent">
  <Monitor class="debugger.WindowsDebugEngine">
    <Param name="CommandLine" value="&quot;C:\Program Files\Symantec\Symantec Endpoint Protection\DoScan.exe&quot; /cmdlinescan /scanfile &quot;C:\svn-peach\fuzzed.cab&quot;" />
    <Param name="StartOnCall" value="ScoobySnacks" />
  </Monitor>
  <!-- Peach 2.3: Attach to windows service -->
  <!--<Monitor class="debugger.WindowsDebugEngine">
    <Param name="ProcessName" value="SavUI.exe" />
  </Monitor>-->
  <!-- Can't use a service monitor on SEP services.  Access Denied.  Running peach as System results in the same -->
  <Monitor class="debugger.WindowsDebugEngine">
    <Param name="Service" value="Symantec AntiVirus" />
    <Param name="RestartOnEachTest" value="true" />
    <Param name="FaultOnEarlyExit" value="true" />
  </Monitor>
  <Monitor class="debugger.WindowsDebugEngine">
    <Param name="Service" value="ccEvtMgr" />
    <Param name="RestartOnEachTest" value="true" />
    <Param name="FaultOnEarlyExit" value="true" />
  </Monitor>
  <Monitor class="process.PageHeap">
    <Param name="Executable" value="DoScan.exe"/>
  </Monitor>
  <Monitor class="process.PageHeap">
    <Param name="Executable" value="Rtvscan.exe"/>
  </Monitor>
  <Monitor class="process.PageHeap">
    <Param name="Executable" value="ccSvcHst.exe"/>
  </Monitor>
</Agent>
        
<Test name="TheTest">
  <Agent ref="LocalAgent" />
  <StateModel ref="State"/>              
  <Publisher class="file.FileWriterLauncher">
    <Param name="fileName" value="fuzzed.cab" />
    <Param name="debugger" value="true"/>
  </Publisher>
</Test>
<Run name="DefaultRun">
  <Test ref="TheTest" />
  <Logger class="logger.Filesystem">
    <Param name="path" value="C:\logs" />
  </Logger>
</Run>
</Peach>