From efc76fd052b29cc0b23f89868384587b7d809ac3 Mon Sep 17 00:00:00 2001 From: Seth Hall Date: Fri, 22 Feb 2013 02:36:41 -0500 Subject: [PATCH 01/54] Initial groundwork for analyzer actions in file analysis framework. --- src/CMakeLists.txt | 5 +++ src/binpac_bro.h | 2 ++ src/file_analysis.bif | 1 + src/file_analysis/Info.cc | 2 ++ src/file_analysis/analyzers/PE.cc | 34 +++++++++++++++++++++ src/file_analysis/analyzers/PE.h | 31 +++++++++++++++++++ src/file_analysis/analyzers/pe-analyzer.pac | 16 ++++++++++ src/file_analysis/analyzers/pe-file.pac | 26 ++++++++++++++++ src/file_analysis/analyzers/pe.pac | 20 ++++++++++++ 9 files changed, 137 insertions(+) create mode 100644 src/file_analysis/analyzers/PE.cc create mode 100644 src/file_analysis/analyzers/PE.h create mode 100644 src/file_analysis/analyzers/pe-analyzer.pac create mode 100644 src/file_analysis/analyzers/pe-file.pac create mode 100644 src/file_analysis/analyzers/pe.pac diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt index 16de055e11..9f8f4106ec 100644 --- a/src/CMakeLists.txt +++ b/src/CMakeLists.txt @@ -176,6 +176,7 @@ macro(BINPAC_TARGET pacFile) COMMAND ${BinPAC_EXE} ARGS -q -d ${CMAKE_CURRENT_BINARY_DIR} -I ${CMAKE_CURRENT_SOURCE_DIR} + -I ${CMAKE_CURRENT_SOURCE_DIR}/file_analysis/analyzers ${CMAKE_CURRENT_SOURCE_DIR}/${pacFile} DEPENDS ${BinPAC_EXE} ${pacFile} ${BINPAC_AUXSRC} ${ARGN} @@ -222,6 +223,9 @@ binpac_target(syslog.pac binpac_target(modbus.pac modbus-protocol.pac modbus-analyzer.pac) +binpac_target(file_analysis/analyzers/pe.pac + file_analysis/analyzers/pe-file.pac file_analysis/analyzers/pe-analyzer.pac) + ######################################################################## ## bro target @@ -453,6 +457,7 @@ set(bro_SRCS file_analysis/InfoTimer.cc file_analysis/Action.h file_analysis/Extract.cc + file_analysis/analyzers/PE.cc nb_dns.c digest.h diff --git a/src/binpac_bro.h b/src/binpac_bro.h index dcdbe94f57..1f63808c10 100644 --- a/src/binpac_bro.h +++ b/src/binpac_bro.h @@ -7,6 +7,7 @@ class PortVal; #include "util.h" #include "Analyzer.h" +#include "file_analysis/Action.h" #include "Val.h" #include "event.bif.func_h" @@ -15,6 +16,7 @@ class PortVal; namespace binpac { typedef Analyzer* BroAnalyzer; +typedef file_analysis::Action BroFileAnalyzer; typedef Val* BroVal; typedef PortVal* BroPortVal; typedef StringVal* BroStringVal; diff --git a/src/file_analysis.bif b/src/file_analysis.bif index 546ac5103c..9afa2d96ab 100644 --- a/src/file_analysis.bif +++ b/src/file_analysis.bif @@ -57,6 +57,7 @@ enum Trigger %{ enum Action %{ ACTION_EXTRACT, + ACTION_PE_ANALYZER, %} function FileAnalysis::postpone_timeout%(file_id: string%): bool diff --git a/src/file_analysis/Info.cc b/src/file_analysis/Info.cc index 60729cd590..e7d8f7ada0 100644 --- a/src/file_analysis/Info.cc +++ b/src/file_analysis/Info.cc @@ -7,12 +7,14 @@ #include "Action.h" #include "Extract.h" +#include "analyzers/PE.h" using namespace file_analysis; // keep in order w/ declared enum values in file_analysis.bif static ActionInstantiator action_factory[] = { Extract::Instantiate, + PE_Analyzer::Instantiate, }; static TableVal* empty_conn_id_set() diff --git a/src/file_analysis/analyzers/PE.cc b/src/file_analysis/analyzers/PE.cc new file mode 100644 index 0000000000..66954ffa3e --- /dev/null +++ b/src/file_analysis/analyzers/PE.cc @@ -0,0 +1,34 @@ +#include + +#include "PE.h" +#include "pe_pac.h" +#include "util.h" + +using namespace file_analysis; + +PE_Analyzer::PE_Analyzer(Info* arg_info) + : Action(arg_info) + { + interp = new binpac::PE::File(this); + + // Close the reverse flow. + interp->FlowEOF(false); + } + +PE_Analyzer::~PE_Analyzer() + { + delete interp; + } + +Action* PE_Analyzer::Instantiate(const RecordVal* args, Info* info) + { + return new PE_Analyzer(info); + } + +void PE_Analyzer::DeliverStream(const u_char* data, uint64 len) + { + Action::DeliverStream(data, len); + + // Data is exclusively sent into the "up" flow. + interp->NewData(true, data, data + len); + } diff --git a/src/file_analysis/analyzers/PE.h b/src/file_analysis/analyzers/PE.h new file mode 100644 index 0000000000..34840c0e3b --- /dev/null +++ b/src/file_analysis/analyzers/PE.h @@ -0,0 +1,31 @@ +#ifndef FILE_ANALYSIS_PE_H +#define FILE_ANALYSIS_PE_H + +#include + +#include "Val.h" +#include "../Info.h" +#include "pe_pac.h" + +namespace file_analysis { + +/** + * An action to simply extract files to disk. + */ +class PE_Analyzer : Action { +public: + static Action* Instantiate(const RecordVal* args, Info* info); + + ~PE_Analyzer(); + + virtual void DeliverStream(const u_char* data, uint64 len); + +protected: + + PE_Analyzer(Info* arg_info); + binpac::PE::File* interp; +}; + +} // namespace file_analysis + +#endif diff --git a/src/file_analysis/analyzers/pe-analyzer.pac b/src/file_analysis/analyzers/pe-analyzer.pac new file mode 100644 index 0000000000..1a295f2d30 --- /dev/null +++ b/src/file_analysis/analyzers/pe-analyzer.pac @@ -0,0 +1,16 @@ + + +refine connection File += { + + function proc_sig(sig: bytestring) : bool + %{ + if ( strcmp("MZ", (const char *) ${sig}.data()) == 0 ) + printf("yep: %s\n", ${sig}.data()); + return true; + %} + +}; + +refine typeattr DOSStub += &let { + proc : bool = $context.connection.proc_sig(signature); +}; diff --git a/src/file_analysis/analyzers/pe-file.pac b/src/file_analysis/analyzers/pe-file.pac new file mode 100644 index 0000000000..4cec173ae3 --- /dev/null +++ b/src/file_analysis/analyzers/pe-file.pac @@ -0,0 +1,26 @@ + +type TheFile() = record { + barf: DOSStub; +} &byteorder=bigendian &length=-1; + +type DOSStub() = record { + signature : bytestring &length=2; + UsedBytesInTheLastPage : uint16; + FileSizeInPages : uint16; + NumberOfRelocationItems : uint16; + HeaderSizeInParagraphs : uint16; + MinimumExtraParagraphs : uint16; + MaximumExtraParagraphs : uint16; + InitialRelativeSS : uint16; + InitialSP : uint16; + Checksum : uint16; + InitialIP : uint16; + InitialRelativeCS : uint16; + AddressOfRelocationTable : uint16; + OverlayNumber : uint16; + Reserved : uint16[4]; + OEMid : uint16; + OEMinfo : uint16; + Reserved2 : uint16[10]; + AddressOfNewExeHeader : uint32; +} &byteorder=bigendian; \ No newline at end of file diff --git a/src/file_analysis/analyzers/pe.pac b/src/file_analysis/analyzers/pe.pac new file mode 100644 index 0000000000..be91643b21 --- /dev/null +++ b/src/file_analysis/analyzers/pe.pac @@ -0,0 +1,20 @@ +%include binpac.pac +%include bro.pac + +analyzer PE withcontext { + connection: File; + flow: Bytes; +}; + +connection File(bro_analyzer: BroFileAnalyzer) { + upflow = Bytes(true); + downflow = Bytes(false); +}; + +%include pe-file.pac + +flow Bytes(is_orig: bool) { + flowunit = TheFile() withcontext(connection, this); +} + +%include pe-analyzer.pac From b1f1b64ddea74d87dec665238ce7d02e58e1e243 Mon Sep 17 00:00:00 2001 From: Seth Hall Date: Thu, 14 Mar 2013 11:19:39 -0400 Subject: [PATCH 02/54] Checkpoint --- src/file_analysis/analyzers/PE.cc | 6 ++++-- src/file_analysis/analyzers/PE.h | 2 +- 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/src/file_analysis/analyzers/PE.cc b/src/file_analysis/analyzers/PE.cc index 66954ffa3e..622cbb945f 100644 --- a/src/file_analysis/analyzers/PE.cc +++ b/src/file_analysis/analyzers/PE.cc @@ -7,7 +7,7 @@ using namespace file_analysis; PE_Analyzer::PE_Analyzer(Info* arg_info) - : Action(arg_info) + : Action(arg_info, BifEnum::FileAnalysis::ACTION_PE_ANALYZER) { interp = new binpac::PE::File(this); @@ -25,10 +25,12 @@ Action* PE_Analyzer::Instantiate(const RecordVal* args, Info* info) return new PE_Analyzer(info); } -void PE_Analyzer::DeliverStream(const u_char* data, uint64 len) +bool PE_Analyzer::DeliverStream(const u_char* data, uint64 len) { Action::DeliverStream(data, len); // Data is exclusively sent into the "up" flow. interp->NewData(true, data, data + len); + + return true; } diff --git a/src/file_analysis/analyzers/PE.h b/src/file_analysis/analyzers/PE.h index 34840c0e3b..d511f3e9bf 100644 --- a/src/file_analysis/analyzers/PE.h +++ b/src/file_analysis/analyzers/PE.h @@ -18,7 +18,7 @@ public: ~PE_Analyzer(); - virtual void DeliverStream(const u_char* data, uint64 len); + virtual bool DeliverStream(const u_char* data, uint64 len); protected: From cb040b6da4bde97239552955d3a4c3af1e02dd56 Mon Sep 17 00:00:00 2001 From: Seth Hall Date: Mon, 1 Apr 2013 09:00:07 -0400 Subject: [PATCH 03/54] Checkpoint --- src/file_analysis.bif | 4 +++ src/file_analysis/ActionSet.cc | 4 +++ src/file_analysis/analyzers/PE.cc | 33 ++++++++++++++------- src/file_analysis/analyzers/PE.h | 8 +++-- src/file_analysis/analyzers/pe-analyzer.pac | 18 ++++++++--- src/file_analysis/analyzers/pe-file.pac | 6 ++-- src/file_analysis/analyzers/pe.pac | 14 ++++----- 7 files changed, 60 insertions(+), 27 deletions(-) diff --git a/src/file_analysis.bif b/src/file_analysis.bif index ba62e58855..6ded10b251 100644 --- a/src/file_analysis.bif +++ b/src/file_analysis.bif @@ -125,3 +125,7 @@ function FileAnalysis::eof%(source: string%): any file_mgr->EndOfFile(source->CheckString()); return 0; %} + +# Define file analysis framework events. + +event FileAnalysis::windows_pe_sig%(fi: FileAnalysis::Info, sig: string%); diff --git a/src/file_analysis/ActionSet.cc b/src/file_analysis/ActionSet.cc index 51cab26478..dabda1c931 100644 --- a/src/file_analysis/ActionSet.cc +++ b/src/file_analysis/ActionSet.cc @@ -5,6 +5,8 @@ #include "DataEvent.h" #include "Hash.h" +#include "analyzers/PE.h" + using namespace file_analysis; // keep in order w/ declared enum values in file_analysis.bif @@ -14,6 +16,8 @@ static ActionInstantiator action_factory[] = { SHA1::Instantiate, SHA256::Instantiate, DataEvent::Instantiate, + + PE_Analyzer::Instantiate, }; static void action_del_func(void* v) diff --git a/src/file_analysis/analyzers/PE.cc b/src/file_analysis/analyzers/PE.cc index 622cbb945f..e5b924e9fb 100644 --- a/src/file_analysis/analyzers/PE.cc +++ b/src/file_analysis/analyzers/PE.cc @@ -6,13 +6,11 @@ using namespace file_analysis; -PE_Analyzer::PE_Analyzer(Info* arg_info) - : Action(arg_info, BifEnum::FileAnalysis::ACTION_PE_ANALYZER) +PE_Analyzer::PE_Analyzer(RecordVal* args, Info* info, uint64 fsize) + : Action(args, info) { - interp = new binpac::PE::File(this); - - // Close the reverse flow. - interp->FlowEOF(false); + conn = new binpac::PE::MockConnection(this); + interp = new binpac::PE::File(conn, fsize); } PE_Analyzer::~PE_Analyzer() @@ -20,17 +18,32 @@ PE_Analyzer::~PE_Analyzer() delete interp; } -Action* PE_Analyzer::Instantiate(const RecordVal* args, Info* info) +Action* PE_Analyzer::Instantiate(RecordVal* args, Info* info) { - return new PE_Analyzer(info); + using BifType::Record::FileAnalysis::Info; + const char* field = "total_bytes"; + Val* filesize = info->GetVal()->Lookup(Info->FieldOffset(field)); + if ( ! filesize ) + // TODO: this should be a reporter message? or better yet stop relying on the file size. + return 0; + + bro_uint_t fsize = filesize->AsCount(); + return new PE_Analyzer(args, info, fsize); } bool PE_Analyzer::DeliverStream(const u_char* data, uint64 len) { Action::DeliverStream(data, len); - // Data is exclusively sent into the "up" flow. - interp->NewData(true, data, data + len); + try + { + interp->NewData(data, data + len); + } + catch ( const binpac::Exception& e ) + { + printf("Binpac exception: %s\n", e.c_msg()); + } + return true; } diff --git a/src/file_analysis/analyzers/PE.h b/src/file_analysis/analyzers/PE.h index d511f3e9bf..95b5083aff 100644 --- a/src/file_analysis/analyzers/PE.h +++ b/src/file_analysis/analyzers/PE.h @@ -14,16 +14,18 @@ namespace file_analysis { */ class PE_Analyzer : Action { public: - static Action* Instantiate(const RecordVal* args, Info* info); + static Action* Instantiate(RecordVal* args, Info* info); ~PE_Analyzer(); virtual bool DeliverStream(const u_char* data, uint64 len); protected: - - PE_Analyzer(Info* arg_info); + PE_Analyzer(RecordVal* args, Info* info, uint64 fsize); binpac::PE::File* interp; + binpac::PE::MockConnection* conn; + + uint64 fsize; }; } // namespace file_analysis diff --git a/src/file_analysis/analyzers/pe-analyzer.pac b/src/file_analysis/analyzers/pe-analyzer.pac index 1a295f2d30..77edfa3434 100644 --- a/src/file_analysis/analyzers/pe-analyzer.pac +++ b/src/file_analysis/analyzers/pe-analyzer.pac @@ -1,16 +1,26 @@ +%extern{ +#include "Event.h" +#include "file_analysis.bif.func_h" +%} -refine connection File += { +refine flow File += { function proc_sig(sig: bytestring) : bool %{ - if ( strcmp("MZ", (const char *) ${sig}.data()) == 0 ) - printf("yep: %s\n", ${sig}.data()); + //val_list* vl = new val_list; + //StringVal *sigval = new StringVal(${sig}.length(), (const char*) ${sig}.begin()); + //vl->append(sigval); + //mgr.QueueEvent(FileAnalysis::windows_pe_sig, vl); + + BifEvent::FileAnalysis::generate_windows_pe_sig((Analyzer *) connection()->bro_analyzer(), + (Val *) connection()->bro_analyzer()->GetInfo(), + new StringVal(${sig}.length(), (const char*) ${sig}.begin())); return true; %} }; refine typeattr DOSStub += &let { - proc : bool = $context.connection.proc_sig(signature); + proc : bool = $context.flow.proc_sig(signature); }; diff --git a/src/file_analysis/analyzers/pe-file.pac b/src/file_analysis/analyzers/pe-file.pac index 4cec173ae3..33cd1270f7 100644 --- a/src/file_analysis/analyzers/pe-file.pac +++ b/src/file_analysis/analyzers/pe-file.pac @@ -1,7 +1,7 @@ -type TheFile() = record { - barf: DOSStub; -} &byteorder=bigendian &length=-1; +type TheFile(fsize: uint64) = record { + dos_stub: DOSStub; +} &byteorder=bigendian &length=fsize; type DOSStub() = record { signature : bytestring &length=2; diff --git a/src/file_analysis/analyzers/pe.pac b/src/file_analysis/analyzers/pe.pac index be91643b21..9cd4f4f112 100644 --- a/src/file_analysis/analyzers/pe.pac +++ b/src/file_analysis/analyzers/pe.pac @@ -2,19 +2,19 @@ %include bro.pac analyzer PE withcontext { - connection: File; - flow: Bytes; + connection: MockConnection; + flow: File; }; -connection File(bro_analyzer: BroFileAnalyzer) { - upflow = Bytes(true); - downflow = Bytes(false); +connection MockConnection(bro_analyzer: BroFileAnalyzer) { + upflow = File(0); + downflow = File(0); }; %include pe-file.pac -flow Bytes(is_orig: bool) { - flowunit = TheFile() withcontext(connection, this); +flow File(fsize: uint64) { + flowunit = TheFile(fsize) withcontext(connection, this); } %include pe-analyzer.pac From d19b8b0266d6d8581792189d5ab0161ed15bb11b Mon Sep 17 00:00:00 2001 From: Seth Hall Date: Wed, 3 Apr 2013 00:51:33 -0400 Subject: [PATCH 04/54] Checkpoint for discussion. --- src/file_analysis.bif | 3 ++- src/file_analysis/analyzers/pe-analyzer.pac | 16 ++++++---------- src/file_analysis/analyzers/pe-file.pac | 5 +++-- 3 files changed, 11 insertions(+), 13 deletions(-) diff --git a/src/file_analysis.bif b/src/file_analysis.bif index 6ded10b251..89845e6f2c 100644 --- a/src/file_analysis.bif +++ b/src/file_analysis.bif @@ -128,4 +128,5 @@ function FileAnalysis::eof%(source: string%): any # Define file analysis framework events. -event FileAnalysis::windows_pe_sig%(fi: FileAnalysis::Info, sig: string%); +#event FileAnalysis::windows_pe_dosstub%(fi: FileAnalysis::Info, sig: string, checksum: count%); +event FileAnalysis::windows_pe_dosstub%(checksum: count%); diff --git a/src/file_analysis/analyzers/pe-analyzer.pac b/src/file_analysis/analyzers/pe-analyzer.pac index 77edfa3434..63f722b18c 100644 --- a/src/file_analysis/analyzers/pe-analyzer.pac +++ b/src/file_analysis/analyzers/pe-analyzer.pac @@ -6,21 +6,17 @@ refine flow File += { - function proc_sig(sig: bytestring) : bool + function proc_dosstub(stub: DOSStub) : bool %{ - //val_list* vl = new val_list; - //StringVal *sigval = new StringVal(${sig}.length(), (const char*) ${sig}.begin()); - //vl->append(sigval); - //mgr.QueueEvent(FileAnalysis::windows_pe_sig, vl); - - BifEvent::FileAnalysis::generate_windows_pe_sig((Analyzer *) connection()->bro_analyzer(), - (Val *) connection()->bro_analyzer()->GetInfo(), - new StringVal(${sig}.length(), (const char*) ${sig}.begin())); + BifEvent::FileAnalysis::generate_windows_pe_dosstub((Analyzer *) connection()->bro_analyzer(), + //(Val *) connection()->bro_analyzer()->GetInfo(), + //new StringVal(${stub.signature}.length(), (const char*) ${stub.signature}.begin()), + ${stub.HeaderSizeInParagraphs}); return true; %} }; refine typeattr DOSStub += &let { - proc : bool = $context.flow.proc_sig(signature); + proc : bool = $context.flow.proc_dosstub(this); }; diff --git a/src/file_analysis/analyzers/pe-file.pac b/src/file_analysis/analyzers/pe-file.pac index 33cd1270f7..50647b7275 100644 --- a/src/file_analysis/analyzers/pe-file.pac +++ b/src/file_analysis/analyzers/pe-file.pac @@ -1,7 +1,8 @@ type TheFile(fsize: uint64) = record { dos_stub: DOSStub; -} &byteorder=bigendian &length=fsize; + blah: bytestring &length=1316134912 &transient; +} &transient &byteorder=littleendian; type DOSStub() = record { signature : bytestring &length=2; @@ -23,4 +24,4 @@ type DOSStub() = record { OEMinfo : uint16; Reserved2 : uint16[10]; AddressOfNewExeHeader : uint32; -} &byteorder=bigendian; \ No newline at end of file +} &byteorder=littleendian &length=64; From 8beb75d985553a6a3cf36b0794f45fd494957e3a Mon Sep 17 00:00:00 2001 From: Seth Hall Date: Wed, 10 Apr 2013 22:57:54 -0400 Subject: [PATCH 05/54] Checkpoint. --- src/file_analysis.bif | 2 + src/file_analysis/ActionSet.cc | 2 + src/file_analysis/analyzers/PE.cc | 22 +++---- src/file_analysis/analyzers/PE.h | 4 +- src/file_analysis/analyzers/pe-analyzer.pac | 23 +++++-- src/file_analysis/analyzers/pe-file.pac | 73 +++++++++++++++++++-- src/file_analysis/analyzers/pe.pac | 8 +-- 7 files changed, 107 insertions(+), 27 deletions(-) diff --git a/src/file_analysis.bif b/src/file_analysis.bif index df4ed98a53..43aab3bb4f 100644 --- a/src/file_analysis.bif +++ b/src/file_analysis.bif @@ -153,3 +153,5 @@ function FileAnalysis::__eof%(source: string%): any #event FileAnalysis::windows_pe_dosstub%(fi: FileAnalysis::Info, sig: string, checksum: count%); event FileAnalysis::windows_pe_dosstub%(checksum: count%); +event FileAnalysis::windows_pe_timestamp%(ts: time%); + diff --git a/src/file_analysis/ActionSet.cc b/src/file_analysis/ActionSet.cc index 314650a210..d7b1dc9d11 100644 --- a/src/file_analysis/ActionSet.cc +++ b/src/file_analysis/ActionSet.cc @@ -16,6 +16,8 @@ static ActionInstantiator action_factory[] = { file_analysis::SHA1::Instantiate, file_analysis::SHA256::Instantiate, file_analysis::DataEvent::Instantiate, + + PE_Analyzer::Instantiate, }; static void action_del_func(void* v) diff --git a/src/file_analysis/analyzers/PE.cc b/src/file_analysis/analyzers/PE.cc index e5b924e9fb..daf679ce82 100644 --- a/src/file_analysis/analyzers/PE.cc +++ b/src/file_analysis/analyzers/PE.cc @@ -6,11 +6,11 @@ using namespace file_analysis; -PE_Analyzer::PE_Analyzer(RecordVal* args, Info* info, uint64 fsize) +PE_Analyzer::PE_Analyzer(RecordVal* args, Info* info) : Action(args, info) { conn = new binpac::PE::MockConnection(this); - interp = new binpac::PE::File(conn, fsize); + interp = new binpac::PE::File(conn); } PE_Analyzer::~PE_Analyzer() @@ -21,14 +21,14 @@ PE_Analyzer::~PE_Analyzer() Action* PE_Analyzer::Instantiate(RecordVal* args, Info* info) { using BifType::Record::FileAnalysis::Info; - const char* field = "total_bytes"; - Val* filesize = info->GetVal()->Lookup(Info->FieldOffset(field)); - if ( ! filesize ) - // TODO: this should be a reporter message? or better yet stop relying on the file size. - return 0; - - bro_uint_t fsize = filesize->AsCount(); - return new PE_Analyzer(args, info, fsize); + //const char* field = "total_bytes"; + //Val* filesize = info->GetVal()->Lookup(Info->FieldOffset(field)); + //if ( ! filesize ) + // // TODO: this should be a reporter message? or better yet stop relying on the file size. + // return 0; +// + //bro_uint_t fsize = filesize->AsCount(); + return new PE_Analyzer(args, info); } bool PE_Analyzer::DeliverStream(const u_char* data, uint64 len) @@ -42,8 +42,8 @@ bool PE_Analyzer::DeliverStream(const u_char* data, uint64 len) catch ( const binpac::Exception& e ) { printf("Binpac exception: %s\n", e.c_msg()); + return false; } - return true; } diff --git a/src/file_analysis/analyzers/PE.h b/src/file_analysis/analyzers/PE.h index 95b5083aff..34a76e7e00 100644 --- a/src/file_analysis/analyzers/PE.h +++ b/src/file_analysis/analyzers/PE.h @@ -21,11 +21,9 @@ public: virtual bool DeliverStream(const u_char* data, uint64 len); protected: - PE_Analyzer(RecordVal* args, Info* info, uint64 fsize); + PE_Analyzer(RecordVal* args, Info* info); binpac::PE::File* interp; binpac::PE::MockConnection* conn; - - uint64 fsize; }; } // namespace file_analysis diff --git a/src/file_analysis/analyzers/pe-analyzer.pac b/src/file_analysis/analyzers/pe-analyzer.pac index 63f722b18c..d0407f348a 100644 --- a/src/file_analysis/analyzers/pe-analyzer.pac +++ b/src/file_analysis/analyzers/pe-analyzer.pac @@ -6,17 +6,30 @@ refine flow File += { - function proc_dosstub(stub: DOSStub) : bool + function proc_dos_header(h: DOS_Header) : bool %{ BifEvent::FileAnalysis::generate_windows_pe_dosstub((Analyzer *) connection()->bro_analyzer(), //(Val *) connection()->bro_analyzer()->GetInfo(), - //new StringVal(${stub.signature}.length(), (const char*) ${stub.signature}.begin()), - ${stub.HeaderSizeInParagraphs}); + //new StringVal(${h.signature}.length(), (const char*) ${h.signature}.begin()), + ${h.AddressOfNewExeHeader}-64); return true; %} + function proc_pe_header(h: IMAGE_NT_HEADERS) : bool + %{ + BifEvent::FileAnalysis::generate_windows_pe_timestamp((Analyzer *) connection()->bro_analyzer(), + //(Val *) connection()->bro_analyzer()->GetInfo(), + //new StringVal(${h.signature}.length(), (const char*) ${h.signature}.begin()), + ${h.FileHeader.TimeDateStamp}); + return true; + %} }; -refine typeattr DOSStub += &let { - proc : bool = $context.flow.proc_dosstub(this); +refine typeattr DOS_Header += &let { + proc : bool = $context.flow.proc_dos_header(this); }; + +refine typeattr IMAGE_NT_HEADERS += &let { + proc : bool = $context.flow.proc_pe_header(this); +}; + diff --git a/src/file_analysis/analyzers/pe-file.pac b/src/file_analysis/analyzers/pe-file.pac index 50647b7275..5854fd2bd8 100644 --- a/src/file_analysis/analyzers/pe-file.pac +++ b/src/file_analysis/analyzers/pe-file.pac @@ -1,10 +1,14 @@ -type TheFile(fsize: uint64) = record { - dos_stub: DOSStub; - blah: bytestring &length=1316134912 &transient; +type TheFile = record { + dos_header : DOS_Header; + dos_code : bytestring &length=(dos_header.AddressOfNewExeHeader - 64); + pe_header : IMAGE_NT_HEADERS; + pad : bytestring &length=1316134912 &transient; +} &let { + dos_code_len: uint32 = (dos_header.AddressOfNewExeHeader - 64); } &transient &byteorder=littleendian; -type DOSStub() = record { +type DOS_Header = record { signature : bytestring &length=2; UsedBytesInTheLastPage : uint16; FileSizeInPages : uint16; @@ -25,3 +29,64 @@ type DOSStub() = record { Reserved2 : uint16[10]; AddressOfNewExeHeader : uint32; } &byteorder=littleendian &length=64; + +type IMAGE_NT_HEADERS = record { + PESignature : uint32; + FileHeader : IMAGE_FILE_HEADER; + OptionalHeader : OPTIONAL_HEADER(FileHeader.SizeOfOptionalHeader); +} &byteorder=littleendian &length=FileHeader.SizeOfOptionalHeader+offsetof(OptionalHeader); + +type IMAGE_FILE_HEADER = record { + Machine : uint16; + NumberOfSections : uint16; + TimeDateStamp : uint32; + PointerToSymbolTable : uint32; + NumberOfSymbols : uint32; + SizeOfOptionalHeader : uint16; + Characteristics : uint16; +}; + +type OPTIONAL_HEADER(len: uint16) = record { + OptionalHeaderMagic : uint16; + Header : case OptionalHeaderMagic of { + 0x0b01 -> OptionalHeader32 : IMAGE_OPTIONAL_HEADER32; + 0x0b02 -> OptionalHeader64 : IMAGE_OPTIONAL_HEADER64; + default -> InvalidPEFile : bytestring &restofdata; + }; +} &length=len; + +type IMAGE_OPTIONAL_HEADER32 = record { + major_linker_version : uint8; + minor_linker_version : uint8; + size_of_code : uint32; + size_of_init_data : uint32; + size_of_uninit_data : uint32; + addr_of_entry_point : uint32; + base_of_code : uint32; + base_of_data : uint32; + image_base : uint32; + section_alignment : uint32; + file_alignment : uint32; + os_version_major : uint16; + os_version_minor : uint16; + major_image_version : uint16; + minor_image_version : uint16; + major_subsys_version : uint16; + minor_subsys_version : uint16; + win32_version : uint32; + size_of_image : uint32; + size_of_headers : uint32; + checksum : uint32; + subsystem : uint16; + dll_characteristics : uint16; + size_of_stack_reserve : uint32; + size_of_stack_commit : uint32; + size_of_heap_reserve : uint32; + size_of_heap_commit : uint32; + loader_flags : uint32; + number_of_rva_and_sizes : uint32; +} &byteorder=littleendian; + +type IMAGE_OPTIONAL_HEADER64 = record { + +} &byteorder=littleendian; diff --git a/src/file_analysis/analyzers/pe.pac b/src/file_analysis/analyzers/pe.pac index 9cd4f4f112..8a20fa3c62 100644 --- a/src/file_analysis/analyzers/pe.pac +++ b/src/file_analysis/analyzers/pe.pac @@ -7,14 +7,14 @@ analyzer PE withcontext { }; connection MockConnection(bro_analyzer: BroFileAnalyzer) { - upflow = File(0); - downflow = File(0); + upflow = File; + downflow = File; }; %include pe-file.pac -flow File(fsize: uint64) { - flowunit = TheFile(fsize) withcontext(connection, this); +flow File { + flowunit = TheFile withcontext(connection, this); } %include pe-analyzer.pac From 4cc9ca424322be2f53cf950f35eebe78c929f671 Mon Sep 17 00:00:00 2001 From: Seth Hall Date: Wed, 24 Apr 2013 12:56:20 -0400 Subject: [PATCH 06/54] Checkpoint --- scripts/base/init-bare.bro | 14 ++++ src/event.bif | 6 ++ src/file_analysis.bif | 7 -- src/file_analysis/ActionSet.cc | 2 +- src/file_analysis/analyzers/PE.cc | 33 +++++--- src/file_analysis/analyzers/PE.h | 9 ++- src/file_analysis/analyzers/pe-analyzer.pac | 56 ++++++++++--- src/file_analysis/analyzers/pe-file.pac | 89 +++++++++++++++------ src/types.bif | 5 ++ 9 files changed, 161 insertions(+), 60 deletions(-) diff --git a/scripts/base/init-bare.bro b/scripts/base/init-bare.bro index 7f4d29d26b..8a82fb98b3 100644 --- a/scripts/base/init-bare.bro +++ b/scripts/base/init-bare.bro @@ -2486,6 +2486,20 @@ type irc_join_info: record { ## .. bro:see:: irc_join_message type irc_join_list: set[irc_join_info]; +## Record for Portable Executable (PE) section headers. +type PESectionHeader: record { + name : string; + virtual_size : count; + virtual_addr : count; + size_of_raw_data : count; + ptr_to_raw_data : count; + non_used_ptr_to_relocs : count; + non_used_ptr_to_line_nums : count; + non_used_num_of_relocs : count; + non_used_num_of_line_nums : count; + characteristics : count; +}; + ## Deprecated. ## ## .. todo:: Remove. It's still declared internally but doesn't seem used anywhere diff --git a/src/event.bif b/src/event.bif index 08a2b64a84..fc9ca8df6a 100644 --- a/src/event.bif +++ b/src/event.bif @@ -7026,6 +7026,12 @@ event file_state_remove%(f: fa_file%); ## FileAnalysis::ACTION_SHA1 FileAnalysis::ACTION_SHA256 event file_hash%(f: fa_file, kind: string, hash: string%); + +event file_pe_dosstub%(f: fa_file, checksum: count%); +event file_pe_timestamp%(f: fa_file, ts: time%); +event file_pe_section_header%(f: fa_file, h: PESectionHeader%); + + ## Deprecated. Will be removed. event stp_create_endp%(c: connection, e: int, is_orig: bool%); diff --git a/src/file_analysis.bif b/src/file_analysis.bif index f7fbe14de9..b3e34f93d2 100644 --- a/src/file_analysis.bif +++ b/src/file_analysis.bif @@ -97,10 +97,3 @@ function set_file_handle%(handle: string%): any file_mgr->SetHandle(handle->CheckString()); return 0; %} - -# Define file analysis framework events. - -#event FileAnalysis::windows_pe_dosstub%(fi: FileAnalysis::Info, sig: string, checksum: count%); -event FileAnalysis::windows_pe_dosstub%(checksum: count%); -event FileAnalysis::windows_pe_timestamp%(ts: time%); - diff --git a/src/file_analysis/ActionSet.cc b/src/file_analysis/ActionSet.cc index fd7fa883eb..d8d057bec5 100644 --- a/src/file_analysis/ActionSet.cc +++ b/src/file_analysis/ActionSet.cc @@ -17,7 +17,7 @@ static ActionInstantiator action_factory[] = { file_analysis::SHA256::Instantiate, file_analysis::DataEvent::Instantiate, - PE_Analyzer::Instantiate, + file_analysis::PE_Analyzer::Instantiate, }; static void action_del_func(void* v) diff --git a/src/file_analysis/analyzers/PE.cc b/src/file_analysis/analyzers/PE.cc index daf679ce82..c15b6ba739 100644 --- a/src/file_analysis/analyzers/PE.cc +++ b/src/file_analysis/analyzers/PE.cc @@ -3,14 +3,16 @@ #include "PE.h" #include "pe_pac.h" #include "util.h" +#include "Event.h" using namespace file_analysis; -PE_Analyzer::PE_Analyzer(RecordVal* args, Info* info) - : Action(args, info) +PE_Analyzer::PE_Analyzer(RecordVal* args, File* file) + : Action(args, file) { conn = new binpac::PE::MockConnection(this); interp = new binpac::PE::File(conn); + done=false; } PE_Analyzer::~PE_Analyzer() @@ -18,23 +20,21 @@ PE_Analyzer::~PE_Analyzer() delete interp; } -Action* PE_Analyzer::Instantiate(RecordVal* args, Info* info) +Action* PE_Analyzer::Instantiate(RecordVal* args, File* file) { - using BifType::Record::FileAnalysis::Info; - //const char* field = "total_bytes"; - //Val* filesize = info->GetVal()->Lookup(Info->FieldOffset(field)); - //if ( ! filesize ) - // // TODO: this should be a reporter message? or better yet stop relying on the file size. - // return 0; -// - //bro_uint_t fsize = filesize->AsCount(); - return new PE_Analyzer(args, info); + return new PE_Analyzer(args, file); } bool PE_Analyzer::DeliverStream(const u_char* data, uint64 len) { - Action::DeliverStream(data, len); + printf("deliver stream\n"); + if (done) + { + printf("analyzer done\n"); + return false; + } + Action::DeliverStream(data, len); try { interp->NewData(data, data + len); @@ -47,3 +47,10 @@ bool PE_Analyzer::DeliverStream(const u_char* data, uint64 len) return true; } + +bool PE_Analyzer::EndOfFile() + { + printf("end of file!\n"); + done=true; + return false; + } diff --git a/src/file_analysis/analyzers/PE.h b/src/file_analysis/analyzers/PE.h index 34a76e7e00..6f25e19723 100644 --- a/src/file_analysis/analyzers/PE.h +++ b/src/file_analysis/analyzers/PE.h @@ -4,7 +4,7 @@ #include #include "Val.h" -#include "../Info.h" +#include "../File.h" #include "pe_pac.h" namespace file_analysis { @@ -14,16 +14,19 @@ namespace file_analysis { */ class PE_Analyzer : Action { public: - static Action* Instantiate(RecordVal* args, Info* info); + static Action* Instantiate(RecordVal* args, File* file); ~PE_Analyzer(); virtual bool DeliverStream(const u_char* data, uint64 len); + virtual bool EndOfFile(); + protected: - PE_Analyzer(RecordVal* args, Info* info); + PE_Analyzer(RecordVal* args, File* file); binpac::PE::File* interp; binpac::PE::MockConnection* conn; + bool done; }; } // namespace file_analysis diff --git a/src/file_analysis/analyzers/pe-analyzer.pac b/src/file_analysis/analyzers/pe-analyzer.pac index d0407f348a..18efc1d54a 100644 --- a/src/file_analysis/analyzers/pe-analyzer.pac +++ b/src/file_analysis/analyzers/pe-analyzer.pac @@ -1,26 +1,55 @@ %extern{ #include "Event.h" +#include "file_analysis/File.h" #include "file_analysis.bif.func_h" %} refine flow File += { - function proc_dos_header(h: DOS_Header) : bool + function proc_the_file(): bool %{ - BifEvent::FileAnalysis::generate_windows_pe_dosstub((Analyzer *) connection()->bro_analyzer(), - //(Val *) connection()->bro_analyzer()->GetInfo(), - //new StringVal(${h.signature}.length(), (const char*) ${h.signature}.begin()), - ${h.AddressOfNewExeHeader}-64); + printf("ending the flow!\n"); + connection()->bro_analyzer()->EndOfFile(); + connection()->FlowEOF(true); + connection()->FlowEOF(false); return true; %} - function proc_pe_header(h: IMAGE_NT_HEADERS) : bool + function proc_dos_header(h: DOS_Header): bool %{ - BifEvent::FileAnalysis::generate_windows_pe_timestamp((Analyzer *) connection()->bro_analyzer(), - //(Val *) connection()->bro_analyzer()->GetInfo(), - //new StringVal(${h.signature}.length(), (const char*) ${h.signature}.begin()), - ${h.FileHeader.TimeDateStamp}); + BifEvent::generate_file_pe_dosstub((Analyzer *) connection()->bro_analyzer(), + connection()->bro_analyzer()->GetFile()->GetVal()->Ref(), + ${h.AddressOfNewExeHeader}-64); + return true; + %} + + function proc_pe_header(h: IMAGE_NT_HEADERS): bool + %{ + BifEvent::generate_file_pe_timestamp((Analyzer *) connection()->bro_analyzer(), + connection()->bro_analyzer()->GetFile()->GetVal()->Ref(), + ${h.file_header.TimeDateStamp}); + return true; + %} + + + function proc_section_header(h: IMAGE_SECTION_HEADER): bool + %{ + RecordVal* section_header = new RecordVal(BifType::Record::PESectionHeader); + section_header->Assign(0, new StringVal(${h.name}.length(), (const char*) ${h.name}.data())); + section_header->Assign(1, new Val(${h.virtual_size}, TYPE_COUNT)); + section_header->Assign(2, new Val(${h.virtual_addr}, TYPE_COUNT)); + section_header->Assign(3, new Val(${h.size_of_raw_data}, TYPE_COUNT)); + section_header->Assign(4, new Val(${h.ptr_to_raw_data}, TYPE_COUNT)); + section_header->Assign(5, new Val(${h.non_used_ptr_to_relocs}, TYPE_COUNT)); + section_header->Assign(6, new Val(${h.non_used_ptr_to_line_nums}, TYPE_COUNT)); + section_header->Assign(7, new Val(${h.non_used_num_of_relocs}, TYPE_COUNT)); + section_header->Assign(8, new Val(${h.non_used_num_of_line_nums}, TYPE_COUNT)); + section_header->Assign(9, new Val(${h.characteristics}, TYPE_COUNT)); + + BifEvent::generate_file_pe_section_header((Analyzer *) connection()->bro_analyzer(), + connection()->bro_analyzer()->GetFile()->GetVal()->Ref(), + section_header); return true; %} }; @@ -33,3 +62,10 @@ refine typeattr IMAGE_NT_HEADERS += &let { proc : bool = $context.flow.proc_pe_header(this); }; +refine typeattr IMAGE_SECTION_HEADER += &let { + proc: bool = $context.flow.proc_section_header(this); +}; + +refine typeattr TheFile += &let { + proc: bool = $context.flow.proc_the_file(); +}; \ No newline at end of file diff --git a/src/file_analysis/analyzers/pe-file.pac b/src/file_analysis/analyzers/pe-file.pac index 5854fd2bd8..bedfb35204 100644 --- a/src/file_analysis/analyzers/pe-file.pac +++ b/src/file_analysis/analyzers/pe-file.pac @@ -1,12 +1,15 @@ type TheFile = record { - dos_header : DOS_Header; - dos_code : bytestring &length=(dos_header.AddressOfNewExeHeader - 64); - pe_header : IMAGE_NT_HEADERS; - pad : bytestring &length=1316134912 &transient; + dos_header : DOS_Header; + dos_code : bytestring &length=dos_code_len; + pe_header : IMAGE_NT_HEADERS; + sections_table : IMAGE_SECTION_HEADER[] &length=pe_header.file_header.NumberOfSections*40 &transient; + #pad : bytestring &length=offsetof(pe_header.data_directories + pe_header.data_directories[1].virtual_address); + #data_sections : DATA_SECTIONS[pe_header.file_header.NumberOfSections]; + #pad : bytestring &restofdata; } &let { - dos_code_len: uint32 = (dos_header.AddressOfNewExeHeader - 64); -} &transient &byteorder=littleendian; + dos_code_len: uint32 = dos_header.AddressOfNewExeHeader - 64; +} &byteorder=littleendian; type DOS_Header = record { signature : bytestring &length=2; @@ -32,9 +35,9 @@ type DOS_Header = record { type IMAGE_NT_HEADERS = record { PESignature : uint32; - FileHeader : IMAGE_FILE_HEADER; - OptionalHeader : OPTIONAL_HEADER(FileHeader.SizeOfOptionalHeader); -} &byteorder=littleendian &length=FileHeader.SizeOfOptionalHeader+offsetof(OptionalHeader); + file_header : IMAGE_FILE_HEADER; + OptionalHeader : IMAGE_OPTIONAL_HEADER(file_header.SizeOfOptionalHeader); +} &byteorder=littleendian &length=file_header.SizeOfOptionalHeader+offsetof(OptionalHeader); type IMAGE_FILE_HEADER = record { Machine : uint16; @@ -46,16 +49,8 @@ type IMAGE_FILE_HEADER = record { Characteristics : uint16; }; -type OPTIONAL_HEADER(len: uint16) = record { - OptionalHeaderMagic : uint16; - Header : case OptionalHeaderMagic of { - 0x0b01 -> OptionalHeader32 : IMAGE_OPTIONAL_HEADER32; - 0x0b02 -> OptionalHeader64 : IMAGE_OPTIONAL_HEADER64; - default -> InvalidPEFile : bytestring &restofdata; - }; -} &length=len; - -type IMAGE_OPTIONAL_HEADER32 = record { +type IMAGE_OPTIONAL_HEADER(len: uint16) = record { + magic : uint16; major_linker_version : uint8; minor_linker_version : uint8; size_of_code : uint32; @@ -79,14 +74,56 @@ type IMAGE_OPTIONAL_HEADER32 = record { checksum : uint32; subsystem : uint16; dll_characteristics : uint16; - size_of_stack_reserve : uint32; - size_of_stack_commit : uint32; - size_of_heap_reserve : uint32; - size_of_heap_commit : uint32; + mem: case magic of { + 0x0b01 -> i32 : MEM_INFO32; + 0x0b02 -> i64 : MEM_INFO64; + default -> InvalidPEFile : bytestring &length=0; + }; loader_flags : uint32; number_of_rva_and_sizes : uint32; -} &byteorder=littleendian; +} &byteorder=littleendian &length=len; -type IMAGE_OPTIONAL_HEADER64 = record { +type MEM_INFO32 = record { + size_of_stack_reserve : uint32; + size_of_stack_commit : uint32; + size_of_heap_reserve : uint32; + size_of_heap_commit : uint32; +} &byteorder=littleendian &length=16; -} &byteorder=littleendian; +type MEM_INFO64 = record { + size_of_stack_reserve : uint64; + size_of_stack_commit : uint64; + size_of_heap_reserve : uint64; + size_of_heap_commit : uint64; +} &byteorder=littleendian &length=32; + +type IMAGE_SECTION_HEADER = record { + name : bytestring &length=8; + virtual_size : uint32; + virtual_addr : uint32; + size_of_raw_data : uint32; + ptr_to_raw_data : uint32; + non_used_ptr_to_relocs : uint32; + non_used_ptr_to_line_nums : uint32; + non_used_num_of_relocs : uint16; + non_used_num_of_line_nums : uint16; + characteristics : uint32; +} &byteorder=littleendian &length=40; + + +type IMAGE_DATA_DIRECTORY = record { + virtual_address : uint32; + size : uint16; +}; + +type IMAGE_IMPORT_DIRECTORY = record { + rva_import_lookup_table : uint32; + time_date_stamp : uint32; + forwarder_chain : uint32; + rva_module_name : uint32; + rva_import_addr_table : uint32; +}; + +type DATA_SECTIONS = record { + blah: bytestring &length=10; +}; \ No newline at end of file diff --git a/src/types.bif b/src/types.bif index b69239487b..4999e221e5 100644 --- a/src/types.bif +++ b/src/types.bif @@ -163,6 +163,8 @@ type ModbusHeaders: record; type ModbusCoils: vector; type ModbusRegisters: vector; +type PESectionHeader: record; + module Log; enum Writer %{ @@ -248,6 +250,9 @@ enum Action %{ ## Deliver the file contents to the script-layer in an event. ACTION_DATA_EVENT, + + ## Windows executable analyzer + ACTION_PE_ANALYZER, %} module GLOBAL; From 317252b5aeec2c1e04c46a8bb37af53f6d1e5270 Mon Sep 17 00:00:00 2001 From: Seth Hall Date: Thu, 25 Apr 2013 13:44:12 -0400 Subject: [PATCH 07/54] Another checkpoint --- scripts/base/init-bare.bro | 35 +++++++++++++++++++++ src/binpac_bro.h | 4 +-- src/file_analysis/AnalyzerSet.cc | 2 ++ src/file_analysis/analyzers/PE.cc | 29 ++++++----------- src/file_analysis/analyzers/PE.h | 9 +++--- src/file_analysis/analyzers/pe-analyzer.pac | 5 +-- src/file_analysis/analyzers/pe-file.pac | 7 ++--- src/types.bif | 4 +++ 8 files changed, 62 insertions(+), 33 deletions(-) diff --git a/scripts/base/init-bare.bro b/scripts/base/init-bare.bro index b8993606d3..e99feeef76 100644 --- a/scripts/base/init-bare.bro +++ b/scripts/base/init-bare.bro @@ -2489,6 +2489,41 @@ type irc_join_info: record { ## .. bro:see:: irc_join_message type irc_join_list: set[irc_join_info]; +type PEHeader: record { +# Machine : count; +# TimeDateStamp : time; +# magic : uint16; +# major_linker_version : uint8; +# minor_linker_version : uint8; +# size_of_code : uint32; +# size_of_init_data : uint32; +# size_of_uninit_data : uint32; +# addr_of_entry_point : uint32; +# base_of_code : uint32; +# base_of_data : uint32; +# image_base : uint32; +# section_alignment : uint32; +# file_alignment : uint32; +# os_version_major : uint16; +# os_version_minor : uint16; +# major_image_version : uint16; +# minor_image_version : uint16; +# major_subsys_version : uint16; +# minor_subsys_version : uint16; +# win32_version : uint32; +# size_of_image : uint32; +# checksum : uint32; +# subsystem : uint16; +# mem: case magic of { +# 0x0b01 -> i32 : MEM_INFO32; +# 0x0b02 -> i64 : MEM_INFO64; +# default -> InvalidPEFile : empty; +# }; +# loader_flags : uint32; +# number_of_rva_and_sizes : uint32; +# +}; + ## Record for Portable Executable (PE) section headers. type PESectionHeader: record { name : string; diff --git a/src/binpac_bro.h b/src/binpac_bro.h index 1f63808c10..03857179f1 100644 --- a/src/binpac_bro.h +++ b/src/binpac_bro.h @@ -7,7 +7,7 @@ class PortVal; #include "util.h" #include "Analyzer.h" -#include "file_analysis/Action.h" +#include "file_analysis/Analyzer.h" #include "Val.h" #include "event.bif.func_h" @@ -16,7 +16,7 @@ class PortVal; namespace binpac { typedef Analyzer* BroAnalyzer; -typedef file_analysis::Action BroFileAnalyzer; +typedef file_analysis::Analyzer BroFileAnalyzer; typedef Val* BroVal; typedef PortVal* BroPortVal; typedef StringVal* BroStringVal; diff --git a/src/file_analysis/AnalyzerSet.cc b/src/file_analysis/AnalyzerSet.cc index bdf23c2446..5959279f61 100644 --- a/src/file_analysis/AnalyzerSet.cc +++ b/src/file_analysis/AnalyzerSet.cc @@ -4,6 +4,7 @@ #include "Extract.h" #include "DataEvent.h" #include "Hash.h" +#include "analyzers/PE.h" using namespace file_analysis; @@ -14,6 +15,7 @@ static AnalyzerInstantiator analyzer_factory[] = { file_analysis::SHA1::Instantiate, file_analysis::SHA256::Instantiate, file_analysis::DataEvent::Instantiate, + file_analysis::PE::Instantiate, }; static void analyzer_del_func(void* v) diff --git a/src/file_analysis/analyzers/PE.cc b/src/file_analysis/analyzers/PE.cc index c15b6ba739..662ea1f3e4 100644 --- a/src/file_analysis/analyzers/PE.cc +++ b/src/file_analysis/analyzers/PE.cc @@ -7,38 +7,29 @@ using namespace file_analysis; -PE_Analyzer::PE_Analyzer(RecordVal* args, File* file) - : Action(args, file) +PE::PE(RecordVal* args, File* file) + : file_analysis::Analyzer(args, file) { conn = new binpac::PE::MockConnection(this); interp = new binpac::PE::File(conn); done=false; } -PE_Analyzer::~PE_Analyzer() +PE::~PE() { delete interp; } -Action* PE_Analyzer::Instantiate(RecordVal* args, File* file) +bool PE::DeliverStream(const u_char* data, uint64 len) { - return new PE_Analyzer(args, file); - } - -bool PE_Analyzer::DeliverStream(const u_char* data, uint64 len) - { - printf("deliver stream\n"); - if (done) - { - printf("analyzer done\n"); - return false; - } - - Action::DeliverStream(data, len); try { interp->NewData(data, data + len); } + catch ( const binpac::HaltParser &e ) + { + return false; + } catch ( const binpac::Exception& e ) { printf("Binpac exception: %s\n", e.c_msg()); @@ -48,9 +39,9 @@ bool PE_Analyzer::DeliverStream(const u_char* data, uint64 len) return true; } -bool PE_Analyzer::EndOfFile() +bool PE::EndOfFile() { printf("end of file!\n"); - done=true; + //throw binpac::HaltParser(); return false; } diff --git a/src/file_analysis/analyzers/PE.h b/src/file_analysis/analyzers/PE.h index 6f25e19723..1fd67c22db 100644 --- a/src/file_analysis/analyzers/PE.h +++ b/src/file_analysis/analyzers/PE.h @@ -12,18 +12,19 @@ namespace file_analysis { /** * An action to simply extract files to disk. */ -class PE_Analyzer : Action { +class PE : public file_analysis::Analyzer { public: - static Action* Instantiate(RecordVal* args, File* file); + ~PE(); - ~PE_Analyzer(); + static file_analysis::Analyzer* Instantiate(RecordVal* args, File* file) + { return new PE(args, file); } virtual bool DeliverStream(const u_char* data, uint64 len); virtual bool EndOfFile(); protected: - PE_Analyzer(RecordVal* args, File* file); + PE(RecordVal* args, File* file); binpac::PE::File* interp; binpac::PE::MockConnection* conn; bool done; diff --git a/src/file_analysis/analyzers/pe-analyzer.pac b/src/file_analysis/analyzers/pe-analyzer.pac index 18efc1d54a..fdba29a5bb 100644 --- a/src/file_analysis/analyzers/pe-analyzer.pac +++ b/src/file_analysis/analyzers/pe-analyzer.pac @@ -9,10 +9,7 @@ refine flow File += { function proc_the_file(): bool %{ - printf("ending the flow!\n"); - connection()->bro_analyzer()->EndOfFile(); - connection()->FlowEOF(true); - connection()->FlowEOF(false); + throw binpac::HaltParser(); return true; %} diff --git a/src/file_analysis/analyzers/pe-file.pac b/src/file_analysis/analyzers/pe-file.pac index bedfb35204..84b26381b4 100644 --- a/src/file_analysis/analyzers/pe-file.pac +++ b/src/file_analysis/analyzers/pe-file.pac @@ -6,7 +6,6 @@ type TheFile = record { sections_table : IMAGE_SECTION_HEADER[] &length=pe_header.file_header.NumberOfSections*40 &transient; #pad : bytestring &length=offsetof(pe_header.data_directories + pe_header.data_directories[1].virtual_address); #data_sections : DATA_SECTIONS[pe_header.file_header.NumberOfSections]; - #pad : bytestring &restofdata; } &let { dos_code_len: uint32 = dos_header.AddressOfNewExeHeader - 64; } &byteorder=littleendian; @@ -75,9 +74,9 @@ type IMAGE_OPTIONAL_HEADER(len: uint16) = record { subsystem : uint16; dll_characteristics : uint16; mem: case magic of { - 0x0b01 -> i32 : MEM_INFO32; - 0x0b02 -> i64 : MEM_INFO64; - default -> InvalidPEFile : bytestring &length=0; + 0x0b01 -> i32 : MEM_INFO32; + 0x0b02 -> i64 : MEM_INFO64; + default -> InvalidPEFile : empty; }; loader_flags : uint32; number_of_rva_and_sizes : uint32; diff --git a/src/types.bif b/src/types.bif index fa9539dcbc..ca84794865 100644 --- a/src/types.bif +++ b/src/types.bif @@ -163,6 +163,7 @@ type ModbusHeaders: record; type ModbusCoils: vector; type ModbusRegisters: vector; +type PEHeader: record; type PESectionHeader: record; module Log; @@ -250,6 +251,9 @@ enum Analyzer %{ ## Deliver the file contents to the script-layer in an event. ANALYZER_DATA_EVENT, + + ## Pass the file to the PE analyzer. + ANALYZER_PE, %} module GLOBAL; From d1dd4cb688d1c3f63ddd00fc465a75a4f9999f64 Mon Sep 17 00:00:00 2001 From: Seth Hall Date: Wed, 15 May 2013 21:33:14 -0400 Subject: [PATCH 08/54] PE analyzer checkpoint --- scripts/base/init-bare.bro | 96 +++++++---- scripts/base/init-default.bro | 2 + src/event.bif | 8 +- src/file_analysis/analyzers/PE.cc | 2 - src/file_analysis/analyzers/pe-analyzer.pac | 168 +++++++++++++++++--- src/file_analysis/analyzers/pe-file.pac | 12 +- src/types.bif | 6 +- 7 files changed, 224 insertions(+), 70 deletions(-) diff --git a/scripts/base/init-bare.bro b/scripts/base/init-bare.bro index e99feeef76..3150dfc9e0 100644 --- a/scripts/base/init-bare.bro +++ b/scripts/base/init-bare.bro @@ -2489,43 +2489,67 @@ type irc_join_info: record { ## .. bro:see:: irc_join_message type irc_join_list: set[irc_join_info]; -type PEHeader: record { -# Machine : count; -# TimeDateStamp : time; -# magic : uint16; -# major_linker_version : uint8; -# minor_linker_version : uint8; -# size_of_code : uint32; -# size_of_init_data : uint32; -# size_of_uninit_data : uint32; -# addr_of_entry_point : uint32; -# base_of_code : uint32; -# base_of_data : uint32; -# image_base : uint32; -# section_alignment : uint32; -# file_alignment : uint32; -# os_version_major : uint16; -# os_version_minor : uint16; -# major_image_version : uint16; -# minor_image_version : uint16; -# major_subsys_version : uint16; -# minor_subsys_version : uint16; -# win32_version : uint32; -# size_of_image : uint32; -# checksum : uint32; -# subsystem : uint16; -# mem: case magic of { -# 0x0b01 -> i32 : MEM_INFO32; -# 0x0b02 -> i64 : MEM_INFO64; -# default -> InvalidPEFile : empty; -# }; -# loader_flags : uint32; -# number_of_rva_and_sizes : uint32; -# +module PE; +export { +type PE::DOSHeader: record { + signature : string; + used_bytes_in_last_page : count; + file_in_pages : count; + num_reloc_items : count; + header_in_paragraphs : count; + min_extra_paragraphs : count; + max_extra_paragraphs : count; + init_relative_ss : count; + init_sp : count; + checksum : count; + init_ip : count; + init_relative_cs : count; + addr_of_reloc_table : count; + overlay_num : count; + oem_id : count; + oem_info : count; + addr_of_new_exe_header : count; +}; + +type PE::FileHeader: record { + machine : count; + ts : time; + sym_table_ptr : count; + num_syms : count; + characteristics : set[count]; +}; + +type PE::OptionalHeader: record { + magic : count; + major_linker_version : count; + minor_linker_version : count; + size_of_code : count; + size_of_init_data : count; + size_of_uninit_data : count; + addr_of_entry_point : count; + base_of_code : count; + base_of_data : count; + image_base : count; + section_alignment : count; + file_alignment : count; + os_version_major : count; + os_version_minor : count; + major_image_version : count; + minor_image_version : count; + major_subsys_version : count; + minor_subsys_version : count; + win32_version : count; + size_of_image : count; + size_of_headers : count; + checksum : count; + subsystem : count; + dll_characteristics : set[count]; + loader_flags : count; + number_of_rva_and_sizes : count; }; ## Record for Portable Executable (PE) section headers. -type PESectionHeader: record { +type PE::SectionHeader: record { name : string; virtual_size : count; virtual_addr : count; @@ -2535,8 +2559,10 @@ type PESectionHeader: record { non_used_ptr_to_line_nums : count; non_used_num_of_relocs : count; non_used_num_of_line_nums : count; - characteristics : count; + characteristics : set[count]; }; +} +module GLOBAL; ## Deprecated. ## diff --git a/scripts/base/init-default.bro b/scripts/base/init-default.bro index 8b36899f10..ad66ab469b 100644 --- a/scripts/base/init-default.bro +++ b/scripts/base/init-default.bro @@ -44,4 +44,6 @@ @load base/protocols/ssl @load base/protocols/syslog +@load base/files/pe + @load base/misc/find-checksum-offloading diff --git a/src/event.bif b/src/event.bif index 7a99c20e37..30b3191734 100644 --- a/src/event.bif +++ b/src/event.bif @@ -7059,10 +7059,10 @@ event file_state_remove%(f: fa_file%); event file_hash%(f: fa_file, kind: string, hash: string%); -event file_pe_dosstub%(f: fa_file, checksum: count%); -event file_pe_timestamp%(f: fa_file, ts: time%); -event file_pe_section_header%(f: fa_file, h: PESectionHeader%); - +event pe_dos_header%(f: fa_file, h: PE::DOSHeader%); +event pe_file_header%(f: fa_file, h: PE::FileHeader%); +event pe_optional_header%(f: fa_file, h: PE::OptionalHeader%); +event pe_section_header%(f: fa_file, h: PE::SectionHeader%); ## Deprecated. Will be removed. event stp_create_endp%(c: connection, e: int, is_orig: bool%); diff --git a/src/file_analysis/analyzers/PE.cc b/src/file_analysis/analyzers/PE.cc index 662ea1f3e4..51db8fd232 100644 --- a/src/file_analysis/analyzers/PE.cc +++ b/src/file_analysis/analyzers/PE.cc @@ -41,7 +41,5 @@ bool PE::DeliverStream(const u_char* data, uint64 len) bool PE::EndOfFile() { - printf("end of file!\n"); - //throw binpac::HaltParser(); return false; } diff --git a/src/file_analysis/analyzers/pe-analyzer.pac b/src/file_analysis/analyzers/pe-analyzer.pac index fdba29a5bb..e6a39ae1dc 100644 --- a/src/file_analysis/analyzers/pe-analyzer.pac +++ b/src/file_analysis/analyzers/pe-analyzer.pac @@ -13,40 +13,156 @@ refine flow File += { return true; %} + function characteristics_to_bro(c: uint32, len: uint8): TableVal + %{ + uint64 mask = (len==16) ? 0xFFFF : 0xFFFFFFFF; + TableVal* char_set = new TableVal(internal_type("count_set")->AsTableType()); + for ( uint16 i=0; i < len; ++i ) + { + if ( ((c >> i) & 0x1) == 1 ) + { + Val *ch = new Val((1<Assign(ch, 0); + Unref(ch); + } + } + return char_set; + %} + function proc_dos_header(h: DOS_Header): bool %{ - BifEvent::generate_file_pe_dosstub((Analyzer *) connection()->bro_analyzer(), - connection()->bro_analyzer()->GetFile()->GetVal()->Ref(), - ${h.AddressOfNewExeHeader}-64); + if ( pe_dos_header ) + { + RecordVal* dh = new RecordVal(BifType::Record::PE::DOSHeader); + dh->Assign(0, new StringVal(${h.signature}.length(), (const char*) ${h.signature}.data())); + dh->Assign(1, new Val(${h.UsedBytesInTheLastPage}, TYPE_COUNT)); + dh->Assign(2, new Val(${h.FileSizeInPages}, TYPE_COUNT)); + dh->Assign(3, new Val(${h.NumberOfRelocationItems}, TYPE_COUNT)); + dh->Assign(4, new Val(${h.HeaderSizeInParagraphs}, TYPE_COUNT)); + dh->Assign(5, new Val(${h.MinimumExtraParagraphs}, TYPE_COUNT)); + dh->Assign(6, new Val(${h.MaximumExtraParagraphs}, TYPE_COUNT)); + dh->Assign(7, new Val(${h.InitialRelativeSS}, TYPE_COUNT)); + dh->Assign(8, new Val(${h.InitialSP}, TYPE_COUNT)); + dh->Assign(9, new Val(${h.Checksum}, TYPE_COUNT)); + dh->Assign(10, new Val(${h.InitialIP}, TYPE_COUNT)); + dh->Assign(11, new Val(${h.InitialRelativeCS}, TYPE_COUNT)); + dh->Assign(12, new Val(${h.AddressOfRelocationTable}, TYPE_COUNT)); + dh->Assign(13, new Val(${h.OverlayNumber}, TYPE_COUNT)); + dh->Assign(14, new Val(${h.OEMid}, TYPE_COUNT)); + dh->Assign(15, new Val(${h.OEMinfo}, TYPE_COUNT)); + dh->Assign(16, new Val(${h.AddressOfNewExeHeader}, TYPE_COUNT)); + + BifEvent::generate_pe_dos_header((Analyzer *) connection()->bro_analyzer(), + connection()->bro_analyzer()->GetFile()->GetVal()->Ref(), + dh); + } return true; %} - function proc_pe_header(h: IMAGE_NT_HEADERS): bool + function proc_nt_headers(h: IMAGE_NT_HEADERS): bool %{ - BifEvent::generate_file_pe_timestamp((Analyzer *) connection()->bro_analyzer(), - connection()->bro_analyzer()->GetFile()->GetVal()->Ref(), - ${h.file_header.TimeDateStamp}); + if ( ${h.PESignature} != 17744 ) // Number is uint32 version of "PE\0\0" + { + return false; + // FileViolation("PE Header signature is incorrect."); + } return true; %} + function proc_file_header(h: IMAGE_FILE_HEADER): bool + %{ + if ( pe_file_header ) + { + RecordVal* fh = new RecordVal(BifType::Record::PE::FileHeader); + fh->Assign(0, new Val(${h.Machine}, TYPE_COUNT)); + fh->Assign(1, new Val(static_cast(${h.TimeDateStamp}), TYPE_TIME)); + fh->Assign(2, new Val(${h.PointerToSymbolTable}, TYPE_COUNT)); + fh->Assign(3, new Val(${h.NumberOfSymbols}, TYPE_COUNT)); + fh->Assign(4, characteristics_to_bro(${h.Characteristics}, 16)); + BifEvent::generate_pe_file_header((Analyzer *) connection()->bro_analyzer(), + connection()->bro_analyzer()->GetFile()->GetVal()->Ref(), + fh); + } + + return true; + %} + + function proc_optional_header(h: IMAGE_OPTIONAL_HEADER): bool + %{ + if ( ${h.magic} != 0x10b && // normal pe32 executable + ${h.magic} != 0x107 && // rom image + ${h.magic} != 0x20b ) // pe32+ executable + { + return false; + // FileViolation("PE Optional Header magic is invalid."); + } + + if ( pe_optional_header ) + { + RecordVal* oh = new RecordVal(BifType::Record::PE::OptionalHeader); + + oh->Assign(0, new Val(${h.magic}, TYPE_COUNT)); + oh->Assign(1, new Val(${h.major_linker_version}, TYPE_COUNT)); + oh->Assign(2, new Val(${h.minor_linker_version}, TYPE_COUNT)); + oh->Assign(3, new Val(${h.size_of_code}, TYPE_COUNT)); + oh->Assign(4, new Val(${h.size_of_init_data}, TYPE_COUNT)); + oh->Assign(5, new Val(${h.size_of_uninit_data}, TYPE_COUNT)); + oh->Assign(6, new Val(${h.addr_of_entry_point}, TYPE_COUNT)); + oh->Assign(7, new Val(${h.base_of_code}, TYPE_COUNT)); + oh->Assign(8, new Val(${h.base_of_data}, TYPE_COUNT)); + oh->Assign(9, new Val(${h.image_base}, TYPE_COUNT)); + oh->Assign(10, new Val(${h.section_alignment}, TYPE_COUNT)); + oh->Assign(11, new Val(${h.file_alignment}, TYPE_COUNT)); + oh->Assign(12, new Val(${h.os_version_major}, TYPE_COUNT)); + oh->Assign(13, new Val(${h.os_version_minor}, TYPE_COUNT)); + oh->Assign(14, new Val(${h.major_image_version}, TYPE_COUNT)); + oh->Assign(15, new Val(${h.minor_image_version}, TYPE_COUNT)); + oh->Assign(16, new Val(${h.minor_subsys_version}, TYPE_COUNT)); + oh->Assign(17, new Val(${h.minor_subsys_version}, TYPE_COUNT)); + oh->Assign(18, new Val(${h.win32_version}, TYPE_COUNT)); + oh->Assign(19, new Val(${h.size_of_image}, TYPE_COUNT)); + oh->Assign(20, new Val(${h.size_of_headers}, TYPE_COUNT)); + oh->Assign(21, new Val(${h.checksum}, TYPE_COUNT)); + oh->Assign(22, new Val(${h.subsystem}, TYPE_COUNT)); + oh->Assign(23, characteristics_to_bro(${h.dll_characteristics}, 16)); + oh->Assign(24, new Val(${h.loader_flags}, TYPE_COUNT)); + oh->Assign(25, new Val(${h.number_of_rva_and_sizes}, TYPE_COUNT)); + BifEvent::generate_pe_optional_header((Analyzer *) connection()->bro_analyzer(), + connection()->bro_analyzer()->GetFile()->GetVal()->Ref(), + oh); + } + return true; + %} function proc_section_header(h: IMAGE_SECTION_HEADER): bool %{ - RecordVal* section_header = new RecordVal(BifType::Record::PESectionHeader); - section_header->Assign(0, new StringVal(${h.name}.length(), (const char*) ${h.name}.data())); - section_header->Assign(1, new Val(${h.virtual_size}, TYPE_COUNT)); - section_header->Assign(2, new Val(${h.virtual_addr}, TYPE_COUNT)); - section_header->Assign(3, new Val(${h.size_of_raw_data}, TYPE_COUNT)); - section_header->Assign(4, new Val(${h.ptr_to_raw_data}, TYPE_COUNT)); - section_header->Assign(5, new Val(${h.non_used_ptr_to_relocs}, TYPE_COUNT)); - section_header->Assign(6, new Val(${h.non_used_ptr_to_line_nums}, TYPE_COUNT)); - section_header->Assign(7, new Val(${h.non_used_num_of_relocs}, TYPE_COUNT)); - section_header->Assign(8, new Val(${h.non_used_num_of_line_nums}, TYPE_COUNT)); - section_header->Assign(9, new Val(${h.characteristics}, TYPE_COUNT)); + if ( pe_section_header ) + { + RecordVal* section_header = new RecordVal(BifType::Record::PE::SectionHeader); - BifEvent::generate_file_pe_section_header((Analyzer *) connection()->bro_analyzer(), - connection()->bro_analyzer()->GetFile()->GetVal()->Ref(), - section_header); + // Strip null characters from the end of the section name. + u_char* first_null = (u_char*) memchr(${h.name}.data(), 0, ${h.name}.length()); + uint16 name_len; + if ( first_null == NULL ) + name_len = ${h.name}.length(); + else + name_len = first_null - ${h.name}.data(); + section_header->Assign(0, new StringVal(name_len, (const char*) ${h.name}.data())); + + section_header->Assign(1, new Val(${h.virtual_size}, TYPE_COUNT)); + section_header->Assign(2, new Val(${h.virtual_addr}, TYPE_COUNT)); + section_header->Assign(3, new Val(${h.size_of_raw_data}, TYPE_COUNT)); + section_header->Assign(4, new Val(${h.ptr_to_raw_data}, TYPE_COUNT)); + section_header->Assign(5, new Val(${h.non_used_ptr_to_relocs}, TYPE_COUNT)); + section_header->Assign(6, new Val(${h.non_used_ptr_to_line_nums}, TYPE_COUNT)); + section_header->Assign(7, new Val(${h.non_used_num_of_relocs}, TYPE_COUNT)); + section_header->Assign(8, new Val(${h.non_used_num_of_line_nums}, TYPE_COUNT)); + section_header->Assign(9, characteristics_to_bro(${h.characteristics}, 32)); + + BifEvent::generate_pe_section_header((Analyzer *) connection()->bro_analyzer(), + connection()->bro_analyzer()->GetFile()->GetVal()->Ref(), + section_header); + } return true; %} }; @@ -56,7 +172,15 @@ refine typeattr DOS_Header += &let { }; refine typeattr IMAGE_NT_HEADERS += &let { - proc : bool = $context.flow.proc_pe_header(this); + proc : bool = $context.flow.proc_nt_headers(this); +}; + +refine typeattr IMAGE_FILE_HEADER += &let { + proc : bool = $context.flow.proc_file_header(this); +}; + +refine typeattr IMAGE_OPTIONAL_HEADER += &let { + proc : bool = $context.flow.proc_optional_header(this); }; refine typeattr IMAGE_SECTION_HEADER += &let { diff --git a/src/file_analysis/analyzers/pe-file.pac b/src/file_analysis/analyzers/pe-file.pac index 84b26381b4..5c56775538 100644 --- a/src/file_analysis/analyzers/pe-file.pac +++ b/src/file_analysis/analyzers/pe-file.pac @@ -6,8 +6,10 @@ type TheFile = record { sections_table : IMAGE_SECTION_HEADER[] &length=pe_header.file_header.NumberOfSections*40 &transient; #pad : bytestring &length=offsetof(pe_header.data_directories + pe_header.data_directories[1].virtual_address); #data_sections : DATA_SECTIONS[pe_header.file_header.NumberOfSections]; + data_sections : DATA_SECTIONS[] &length=data_len; } &let { dos_code_len: uint32 = dos_header.AddressOfNewExeHeader - 64; + data_len: uint32 = pe_header.optional_header.size_of_init_data; } &byteorder=littleendian; type DOS_Header = record { @@ -33,10 +35,10 @@ type DOS_Header = record { } &byteorder=littleendian &length=64; type IMAGE_NT_HEADERS = record { - PESignature : uint32; - file_header : IMAGE_FILE_HEADER; - OptionalHeader : IMAGE_OPTIONAL_HEADER(file_header.SizeOfOptionalHeader); -} &byteorder=littleendian &length=file_header.SizeOfOptionalHeader+offsetof(OptionalHeader); + PESignature : uint32; + file_header : IMAGE_FILE_HEADER; + optional_header : IMAGE_OPTIONAL_HEADER(file_header.SizeOfOptionalHeader) &length=file_header.SizeOfOptionalHeader; +} &byteorder=littleendian &length=file_header.SizeOfOptionalHeader+offsetof(optional_header); type IMAGE_FILE_HEADER = record { Machine : uint16; @@ -124,5 +126,5 @@ type IMAGE_IMPORT_DIRECTORY = record { }; type DATA_SECTIONS = record { - blah: bytestring &length=10; + blah: uint8; }; \ No newline at end of file diff --git a/src/types.bif b/src/types.bif index ca84794865..f43abf9a81 100644 --- a/src/types.bif +++ b/src/types.bif @@ -163,8 +163,10 @@ type ModbusHeaders: record; type ModbusCoils: vector; type ModbusRegisters: vector; -type PEHeader: record; -type PESectionHeader: record; +type PE::DOSHeader: record; +type PE::FileHeader: record; +type PE::OptionalHeader: record; +type PE::SectionHeader: record; module Log; From 7ff8c1ebdd01f69ccd664e347d801beb91ce2a31 Mon Sep 17 00:00:00 2001 From: Seth Hall Date: Wed, 15 May 2013 23:33:37 -0400 Subject: [PATCH 09/54] Add the PE analyzer back in as a registered file analyzer. --- src/file_analysis.bif | 3 +++ 1 file changed, 3 insertions(+) diff --git a/src/file_analysis.bif b/src/file_analysis.bif index cdece0d350..52ede9292e 100644 --- a/src/file_analysis.bif +++ b/src/file_analysis.bif @@ -25,6 +25,9 @@ enum Analyzer %{ ## Deliver the file contents to the script-layer in an event. ANALYZER_DATA_EVENT, + + ## Pass the file to the PE analyzer. + ANALYZER_PE, %} ## :bro:see:`FileAnalysis::postpone_timeout`. From a65966c2d1c500a59f05c48647deeff5a2f4391a Mon Sep 17 00:00:00 2001 From: Seth Hall Date: Wed, 15 May 2013 23:34:01 -0400 Subject: [PATCH 10/54] Make the dos code available in script land. --- src/event.bif | 1 + src/file_analysis/analyzers/pe-analyzer.pac | 15 +++++++++++++++ src/file_analysis/analyzers/pe-file.pac | 6 +++++- 3 files changed, 21 insertions(+), 1 deletion(-) diff --git a/src/event.bif b/src/event.bif index ae8ede439f..e43f979aa5 100644 --- a/src/event.bif +++ b/src/event.bif @@ -7060,6 +7060,7 @@ event file_hash%(f: fa_file, kind: string, hash: string%); event pe_dos_header%(f: fa_file, h: PE::DOSHeader%); +event pe_dos_code%(f: fa_file, code: string%); event pe_file_header%(f: fa_file, h: PE::FileHeader%); event pe_optional_header%(f: fa_file, h: PE::OptionalHeader%); event pe_section_header%(f: fa_file, h: PE::SectionHeader%); diff --git a/src/file_analysis/analyzers/pe-analyzer.pac b/src/file_analysis/analyzers/pe-analyzer.pac index e6a39ae1dc..341a3efbec 100644 --- a/src/file_analysis/analyzers/pe-analyzer.pac +++ b/src/file_analysis/analyzers/pe-analyzer.pac @@ -59,6 +59,17 @@ refine flow File += { return true; %} + function proc_dos_code(code: bytestring): bool + %{ + if ( pe_dos_code ) + { + BifEvent::generate_pe_dos_code((Analyzer *) connection()->bro_analyzer(), + connection()->bro_analyzer()->GetFile()->GetVal()->Ref(), + new StringVal(code.length(), (const char*) code.data())); + } + return true; + %} + function proc_nt_headers(h: IMAGE_NT_HEADERS): bool %{ if ( ${h.PESignature} != 17744 ) // Number is uint32 version of "PE\0\0" @@ -171,6 +182,10 @@ refine typeattr DOS_Header += &let { proc : bool = $context.flow.proc_dos_header(this); }; +refine typeattr DOS_Code += &let { + proc : bool = $context.flow.proc_dos_code(code); +}; + refine typeattr IMAGE_NT_HEADERS += &let { proc : bool = $context.flow.proc_nt_headers(this); }; diff --git a/src/file_analysis/analyzers/pe-file.pac b/src/file_analysis/analyzers/pe-file.pac index 5c56775538..041f2bbdb4 100644 --- a/src/file_analysis/analyzers/pe-file.pac +++ b/src/file_analysis/analyzers/pe-file.pac @@ -1,7 +1,7 @@ type TheFile = record { dos_header : DOS_Header; - dos_code : bytestring &length=dos_code_len; + dos_code : DOS_Code(dos_code_len); pe_header : IMAGE_NT_HEADERS; sections_table : IMAGE_SECTION_HEADER[] &length=pe_header.file_header.NumberOfSections*40 &transient; #pad : bytestring &length=offsetof(pe_header.data_directories + pe_header.data_directories[1].virtual_address); @@ -34,6 +34,10 @@ type DOS_Header = record { AddressOfNewExeHeader : uint32; } &byteorder=littleendian &length=64; +type DOS_Code(len: uint32) = record { + code : bytestring &length=len; +}; + type IMAGE_NT_HEADERS = record { PESignature : uint32; file_header : IMAGE_FILE_HEADER; From 1e098bae8d6a96bbfee23d5796014bb19fc8d428 Mon Sep 17 00:00:00 2001 From: Seth Hall Date: Sat, 27 Jul 2013 00:07:47 -0400 Subject: [PATCH 11/54] Moving the PE analyzer to the new plugin structure. --- .../{analyzers => analyzer/pe}/PE.cc | 0 .../{analyzers => analyzer/pe}/PE.h | 0 src/file_analysis/analyzer/pe/events.bif | 5 +++++ .../{analyzers => analyzer/pe}/pe-analyzer.pac | 0 .../{analyzers => analyzer/pe}/pe-file.pac | 16 ++++++++-------- .../{analyzers => analyzer/pe}/pe.pac | 0 6 files changed, 13 insertions(+), 8 deletions(-) rename src/file_analysis/{analyzers => analyzer/pe}/PE.cc (100%) rename src/file_analysis/{analyzers => analyzer/pe}/PE.h (100%) create mode 100644 src/file_analysis/analyzer/pe/events.bif rename src/file_analysis/{analyzers => analyzer/pe}/pe-analyzer.pac (100%) rename src/file_analysis/{analyzers => analyzer/pe}/pe-file.pac (88%) rename src/file_analysis/{analyzers => analyzer/pe}/pe.pac (100%) diff --git a/src/file_analysis/analyzers/PE.cc b/src/file_analysis/analyzer/pe/PE.cc similarity index 100% rename from src/file_analysis/analyzers/PE.cc rename to src/file_analysis/analyzer/pe/PE.cc diff --git a/src/file_analysis/analyzers/PE.h b/src/file_analysis/analyzer/pe/PE.h similarity index 100% rename from src/file_analysis/analyzers/PE.h rename to src/file_analysis/analyzer/pe/PE.h diff --git a/src/file_analysis/analyzer/pe/events.bif b/src/file_analysis/analyzer/pe/events.bif new file mode 100644 index 0000000000..b6ce808278 --- /dev/null +++ b/src/file_analysis/analyzer/pe/events.bif @@ -0,0 +1,5 @@ +event pe_dos_header%(f: fa_file, h: PE::DOSHeader%); +event pe_dos_code%(f: fa_file, code: string%); +event pe_file_header%(f: fa_file, h: PE::FileHeader%); +event pe_optional_header%(f: fa_file, h: PE::OptionalHeader%); +event pe_section_header%(f: fa_file, h: PE::SectionHeader%); \ No newline at end of file diff --git a/src/file_analysis/analyzers/pe-analyzer.pac b/src/file_analysis/analyzer/pe/pe-analyzer.pac similarity index 100% rename from src/file_analysis/analyzers/pe-analyzer.pac rename to src/file_analysis/analyzer/pe/pe-analyzer.pac diff --git a/src/file_analysis/analyzers/pe-file.pac b/src/file_analysis/analyzer/pe/pe-file.pac similarity index 88% rename from src/file_analysis/analyzers/pe-file.pac rename to src/file_analysis/analyzer/pe/pe-file.pac index 041f2bbdb4..ab7cdf5f8a 100644 --- a/src/file_analysis/analyzers/pe-file.pac +++ b/src/file_analysis/analyzer/pe/pe-file.pac @@ -1,12 +1,12 @@ -type TheFile = record { - dos_header : DOS_Header; - dos_code : DOS_Code(dos_code_len); - pe_header : IMAGE_NT_HEADERS; - sections_table : IMAGE_SECTION_HEADER[] &length=pe_header.file_header.NumberOfSections*40 &transient; - #pad : bytestring &length=offsetof(pe_header.data_directories + pe_header.data_directories[1].virtual_address); - #data_sections : DATA_SECTIONS[pe_header.file_header.NumberOfSections]; - data_sections : DATA_SECTIONS[] &length=data_len; +type TheFile(part: uint8) = record { + dos_header : DOS_Header; + dos_code : DOS_Code(dos_code_len); + pe_header : IMAGE_NT_HEADERS; + section_headers : IMAGE_SECTION_HEADER[] &length=pe_header.optional_header.size_of_headers; + #pad : bytestring &length=offsetof(pe_header.data_directories + pe_header.data_directories[1].virtual_address); + #data_sections : DATA_SECTIONS[pe_header.file_header.NumberOfSections]; + #data_sections : DATA_SECTIONS[] &length=data_len; } &let { dos_code_len: uint32 = dos_header.AddressOfNewExeHeader - 64; data_len: uint32 = pe_header.optional_header.size_of_init_data; diff --git a/src/file_analysis/analyzers/pe.pac b/src/file_analysis/analyzer/pe/pe.pac similarity index 100% rename from src/file_analysis/analyzers/pe.pac rename to src/file_analysis/analyzer/pe/pe.pac From 7ba51786e559383e4ad76374d50933c873d99029 Mon Sep 17 00:00:00 2001 From: Seth Hall Date: Sat, 27 Jul 2013 08:10:08 -0400 Subject: [PATCH 12/54] In progress checkpoint. Things are starting to work. --- scripts/base/files/pe/__load__.bro | 2 + scripts/base/files/pe/consts.bro | 149 ++++++++++++++++++ scripts/base/files/pe/main.bro | 86 ++++++++++ src/file_analysis/analyzer/CMakeLists.txt | 1 + src/file_analysis/analyzer/pe/CMakeLists.txt | 10 ++ src/file_analysis/analyzer/pe/Plugin.cc | 29 ++++ src/file_analysis/analyzer/pe/pe-analyzer.pac | 11 +- src/file_analysis/analyzer/pe/pe-file.pac | 2 +- 8 files changed, 284 insertions(+), 6 deletions(-) create mode 100644 scripts/base/files/pe/__load__.bro create mode 100644 scripts/base/files/pe/consts.bro create mode 100644 scripts/base/files/pe/main.bro create mode 100644 src/file_analysis/analyzer/pe/CMakeLists.txt create mode 100644 src/file_analysis/analyzer/pe/Plugin.cc diff --git a/scripts/base/files/pe/__load__.bro b/scripts/base/files/pe/__load__.bro new file mode 100644 index 0000000000..0098b81a7a --- /dev/null +++ b/scripts/base/files/pe/__load__.bro @@ -0,0 +1,2 @@ +@load ./consts +@load ./main \ No newline at end of file diff --git a/scripts/base/files/pe/consts.bro b/scripts/base/files/pe/consts.bro new file mode 100644 index 0000000000..4dc21ec179 --- /dev/null +++ b/scripts/base/files/pe/consts.bro @@ -0,0 +1,149 @@ + +module PE; + +export { + const machine_types: table[count] of string = { + [0x00] = "UNKNOWN", + [0x1d3] = "AM33", + [0x8664] = "AMD64", + [0x1c0] = "ARM", + [0x1c4] = "ARMNT", + [0xaa64] = "ARM64", + [0xebc] = "EBC", + [0x14c] = "I386", + [0x200] = "IA64", + [0x9041] = "M32R", + [0x266] = "MIPS16", + [0x366] = "MIPSFPU", + [0x466] = "MIPSFPU16", + [0x1f0] = "POWERPC", + [0x1f1] = "POWERPCFP", + [0x166] = "R4000", + [0x1a2] = "SH3", + [0x1a3] = "SH3DSP", + [0x1a6] = "SH4", + [0x1a8] = "SH5", + [0x1c2] = "THUMB", + [0x169] = "WCEMIPSV2" + } &default=function(i: count):string { return fmt("unknown-%d", i); }; + + const file_characteristics: table[count] of string = { + [0x1] = "RELOCS_STRIPPED", + [0x2] = "EXECUTABLE_IMAGE", + [0x4] = "LINE_NUMS_STRIPPED", + [0x8] = "LOCAL_SYMS_STRIPPED", + [0x10] = "AGGRESSIVE_WS_TRIM", + [0x20] = "LARGE_ADDRESS_AWARE", + [0x80] = "BYTES_REVERSED_LO", + [0x100] = "32BIT_MACHINE", + [0x200] = "DEBUG_STRIPPED", + [0x400] = "REMOVABLE_RUN_FROM_SWAP", + [0x800] = "NET_RUN_FROM_SWAP", + [0x1000] = "SYSTEM", + [0x2000] = "DLL", + [0x4000] = "UP_SYSTEM_ONLY", + [0x8000] = "BYTES_REVERSED_HI" + } &default=function(i: count):string { return fmt("unknown-%d", i); }; + + const dll_characteristics: table[count] of string = { + [0x40] = "DYNAMIC_BASE", + [0x80] = "FORCE_INTEGRITY", + [0x100] = "NX_COMPAT", + [0x200] = "NO_ISOLATION", + [0x400] = "NO_SEH", + [0x800] = "NO_BIND", + [0x2000] = "WDM_DRIVER", + [0x8000] = "TERMINAL_SERVER_AWARE" + } &default=function(i: count):string { return fmt("unknown-%d", i); }; + + const windows_subsystems: table[count] of string = { + [0] = "UNKNOWN", + [1] = "NATIVE", + [2] = "WINDOWS_GUI", + [3] = "WINDOWS_CUI", + [7] = "POSIX_CUI", + [9] = "WINDOWS_CE_GUI", + [10] = "EFI_APPLICATION", + [11] = "EFI_BOOT_SERVICE_DRIVER", + [12] = "EFI_RUNTIME_
DRIVER", + [13] = "EFI_ROM", + [14] = "XBOX" + } &default=function(i: count):string { return fmt("unknown-%d", i); }; + + const section_characteristics: table[count] of string = { + [0x8] = "TYPE_NO_PAD", + [0x20] = "CNT_CODE", + [0x40] = "CNT_INITIALIZED_DATA", + [0x80] = "CNT_UNINITIALIZED_DATA", + [0x100] = "LNK_OTHER", + [0x200] = "LNK_INFO", + [0x800] = "LNK_REMOVE", + [0x1000] = "LNK_COMDAT", + [0x8000] = "GPREL", + [0x20000] = "MEM_16BIT", + [0x40000] = "MEM_LOCKED", + [0x80000] = "MEM_PRELOAD", + [0x100000] = "ALIGN_1BYTES", + [0x200000] = "ALIGN_2BYTES", + [0x300000] = "ALIGN_4BYTES", + [0x400000] = "ALIGN_8BYTES", + [0x500000] = "ALIGN_16BYTES", + [0x600000] = "ALIGN_32BYTES", + [0x700000] = "ALIGN_64BYTES", + [0x800000] = "ALIGN_128BYTES", + [0x900000] = "ALIGN_256BYTES", + [0xa00000] = "ALIGN_512BYTES", + [0xb00000] = "ALIGN_1024BYTES", + [0xc00000] = "ALIGN_2048BYTES", + [0xd00000] = "ALIGN_4096BYTES", + [0xe00000] = "ALIGN_8192BYTES", + [0x1000000] = "LNK_NRELOC_OVFL", + [0x2000000] = "MEM_DISCARDABLE", + [0x4000000] = "MEM_NOT_CACHED", + [0x8000000] = "MEM_NOT_PAGED", + [0x10000000] = "MEM_SHARED", + [0x20000000] = "MEM_EXECUTE", + [0x40000000] = "MEM_READ", + [0x80000000] = "MEM_WRITE" + } &default=function(i: count):string { return fmt("unknown-%d", i); }; + + const os_versions: table[count, count] of string = { + [6,2] = "Windows 8", + [6,1] = "Windows 7", + [6,0] = "Windows Vista", + [5,2] = "Windows XP 64-Bit Edition", + [5,1] = "Windows XP", + [5,0] = "Windows 2000", + [4,90] = "Windows Me", + [4,1] = "Windows 98", + [4,0] = "Windows NT 4.0", + } &default=function(i: count, j: count):string { return fmt("unknown-%d.%d", i, j); }; + + const section_descs: table[string] of string = { + [".bss"] = "Uninitialized data", + [".cormeta"] = "CLR metadata that indicates that the object file contains managed code", + [".data"] = "Initialized data", + [".debug$F"] = "Generated FPO debug information", + [".debug$P"] = "Precompiled debug types", + [".debug$S"] = "Debug symbols", + [".debug$T"] = "Debug types", + [".drective"] = "Linker options", + [".edata"] = "Export tables", + [".idata"] = "Import tables", + [".idlsym"] = "Includes registered SEH to support IDL attributes", + [".pdata"] = "Exception information", + [".rdata"] = "Read-only initialized data", + [".reloc"] = "Image relocations", + [".rsrc"] = "Resource directory", + [".sbss"] = "GP-relative uninitialized data", + [".sdata"] = "GP-relative initialized data", + [".srdata"] = "GP-relative read-only data", + [".sxdata"] = "Registered exception handler data", + [".text"] = "Executable code", + [".tls"] = "Thread-local storage", + [".tls$"] = "Thread-local storage", + [".vsdata"] = "GP-relative initialized data", + [".xdata"] = "Exception information", + } &default=function(i: string):string { return fmt("unknown-%s", i); }; + +} diff --git a/scripts/base/files/pe/main.bro b/scripts/base/files/pe/main.bro new file mode 100644 index 0000000000..76ba04fc8c --- /dev/null +++ b/scripts/base/files/pe/main.bro @@ -0,0 +1,86 @@ + +module PE; + +export { + redef enum Log::ID += { LOG }; + + type Info: record { + ts: time &log; + fuid: string &log; + machine: string &log &optional; + compile_ts: time &log &optional; + os: string &log &optional; + subsystem: string &log &optional; + characteristics: set[string] &log &optional; + section_names: vector of string &log &optional; + }; + + + global set_file: hook(f: fa_file); +} + +redef record fa_file += { + pe: Info &optional; +}; + +event bro_init() &priority=5 + { + Log::create_stream(LOG, [$columns=Info]); + } + +hook set_file(f: fa_file) &priority=5 + { + if ( ! f?$pe ) + { + local c: set[string] = set(); + f$pe = [$ts=network_time(), $fuid=f$id, $characteristics=c]; + } + } + +event pe_dos_header(f: fa_file, h: PE::DOSHeader) &priority=5 + { + hook set_file(f); + } + +event pe_file_header(f: fa_file, h: PE::FileHeader) &priority=5 + { + hook set_file(f); + f$pe$compile_ts = h$ts; + f$pe$machine = machine_types[h$machine]; + for ( c in h$characteristics ) + add f$pe$characteristics[PE::file_characteristics[c]]; + } + +event pe_optional_header(f: fa_file, h: PE::OptionalHeader) &priority=5 + { + hook set_file(f); + f$pe$os = os_versions[h$os_version_major, h$os_version_minor]; + f$pe$subsystem = windows_subsystems[h$subsystem]; + } + +event pe_section_header(f: fa_file, h: PE::SectionHeader) &priority=5 + { + hook set_file(f); + + print h; + if ( ! f$pe?$section_names ) + f$pe$section_names = vector(); + f$pe$section_names[|f$pe$section_names|] = h$name; + } + +event file_state_remove(f: fa_file) + { + if ( f?$pe ) + Log::write(LOG, f$pe); + } + +event file_new(f: fa_file) + { + if ( f?$mime_type && f$mime_type == /application\/x-dosexec.*/ ) + { + #print "found a windows executable"; + FileAnalysis::add_analyzer(f, [$tag=FileAnalysis::ANALYZER_PE]); + #FileAnalysis::add_analyzer(f, [$tag=FileAnalysis::ANALYZER_EXTRACT, + # $extract_filename=fmt("exe-%d", ++blah_counter)]); + } + } diff --git a/src/file_analysis/analyzer/CMakeLists.txt b/src/file_analysis/analyzer/CMakeLists.txt index bfafcd2894..67929b77fd 100644 --- a/src/file_analysis/analyzer/CMakeLists.txt +++ b/src/file_analysis/analyzer/CMakeLists.txt @@ -1,3 +1,4 @@ add_subdirectory(data_event) add_subdirectory(extract) add_subdirectory(hash) +add_subdirectory(pe) diff --git a/src/file_analysis/analyzer/pe/CMakeLists.txt b/src/file_analysis/analyzer/pe/CMakeLists.txt new file mode 100644 index 0000000000..7fc89bfd51 --- /dev/null +++ b/src/file_analysis/analyzer/pe/CMakeLists.txt @@ -0,0 +1,10 @@ +include(BroPlugin) + +include_directories(BEFORE ${CMAKE_CURRENT_SOURCE_DIR} + ${CMAKE_CURRENT_BINARY_DIR}) + +bro_plugin_begin(Bro PE) +bro_plugin_cc(PE.cc Plugin.cc) +bro_plugin_bif(events.bif) +bro_plugin_pac(pe.pac pe-file.pac pe-analyzer.pac) +bro_plugin_end() diff --git a/src/file_analysis/analyzer/pe/Plugin.cc b/src/file_analysis/analyzer/pe/Plugin.cc new file mode 100644 index 0000000000..1cc33b5759 --- /dev/null +++ b/src/file_analysis/analyzer/pe/Plugin.cc @@ -0,0 +1,29 @@ +#include "plugin/Plugin.h" +#include "file_analysis/Component.h" + +#include "PE.h" + +namespace plugin { namespace Bro_PE { + +class Plugin : public plugin::Plugin { +protected: + void InitPreScript() + { + SetName("Bro::PE"); + SetVersion(-1); + SetAPIVersion(BRO_PLUGIN_API_VERSION); + SetDynamicPlugin(false); + + SetDescription("Portable Executable analyzer"); + + AddComponent(new ::file_analysis::Component("PE", + ::file_analysis::PE::Instantiate)); + + extern std::list > __bif_events_init(); + AddBifInitFunction(&__bif_events_init); + } +}; + +Plugin __plugin; + +} } diff --git a/src/file_analysis/analyzer/pe/pe-analyzer.pac b/src/file_analysis/analyzer/pe/pe-analyzer.pac index 341a3efbec..045f71c479 100644 --- a/src/file_analysis/analyzer/pe/pe-analyzer.pac +++ b/src/file_analysis/analyzer/pe/pe-analyzer.pac @@ -3,6 +3,7 @@ #include "Event.h" #include "file_analysis/File.h" #include "file_analysis.bif.func_h" +#include "events.bif.h" %} refine flow File += { @@ -52,7 +53,7 @@ refine flow File += { dh->Assign(15, new Val(${h.OEMinfo}, TYPE_COUNT)); dh->Assign(16, new Val(${h.AddressOfNewExeHeader}, TYPE_COUNT)); - BifEvent::generate_pe_dos_header((Analyzer *) connection()->bro_analyzer(), + BifEvent::generate_pe_dos_header((analyzer::Analyzer *) connection()->bro_analyzer(), connection()->bro_analyzer()->GetFile()->GetVal()->Ref(), dh); } @@ -63,7 +64,7 @@ refine flow File += { %{ if ( pe_dos_code ) { - BifEvent::generate_pe_dos_code((Analyzer *) connection()->bro_analyzer(), + BifEvent::generate_pe_dos_code((analyzer::Analyzer *) connection()->bro_analyzer(), connection()->bro_analyzer()->GetFile()->GetVal()->Ref(), new StringVal(code.length(), (const char*) code.data())); } @@ -90,7 +91,7 @@ refine flow File += { fh->Assign(2, new Val(${h.PointerToSymbolTable}, TYPE_COUNT)); fh->Assign(3, new Val(${h.NumberOfSymbols}, TYPE_COUNT)); fh->Assign(4, characteristics_to_bro(${h.Characteristics}, 16)); - BifEvent::generate_pe_file_header((Analyzer *) connection()->bro_analyzer(), + BifEvent::generate_pe_file_header((analyzer::Analyzer *) connection()->bro_analyzer(), connection()->bro_analyzer()->GetFile()->GetVal()->Ref(), fh); } @@ -138,7 +139,7 @@ refine flow File += { oh->Assign(23, characteristics_to_bro(${h.dll_characteristics}, 16)); oh->Assign(24, new Val(${h.loader_flags}, TYPE_COUNT)); oh->Assign(25, new Val(${h.number_of_rva_and_sizes}, TYPE_COUNT)); - BifEvent::generate_pe_optional_header((Analyzer *) connection()->bro_analyzer(), + BifEvent::generate_pe_optional_header((analyzer::Analyzer *) connection()->bro_analyzer(), connection()->bro_analyzer()->GetFile()->GetVal()->Ref(), oh); } @@ -170,7 +171,7 @@ refine flow File += { section_header->Assign(8, new Val(${h.non_used_num_of_line_nums}, TYPE_COUNT)); section_header->Assign(9, characteristics_to_bro(${h.characteristics}, 32)); - BifEvent::generate_pe_section_header((Analyzer *) connection()->bro_analyzer(), + BifEvent::generate_pe_section_header((analyzer::Analyzer *) connection()->bro_analyzer(), connection()->bro_analyzer()->GetFile()->GetVal()->Ref(), section_header); } diff --git a/src/file_analysis/analyzer/pe/pe-file.pac b/src/file_analysis/analyzer/pe/pe-file.pac index ab7cdf5f8a..03a25ce150 100644 --- a/src/file_analysis/analyzer/pe/pe-file.pac +++ b/src/file_analysis/analyzer/pe/pe-file.pac @@ -1,5 +1,5 @@ -type TheFile(part: uint8) = record { +type TheFile = record { dos_header : DOS_Header; dos_code : DOS_Code(dos_code_len); pe_header : IMAGE_NT_HEADERS; From 8ffa81f3908bd1634c74472b4b519fdfbbd8fe35 Mon Sep 17 00:00:00 2001 From: Vlad Grigorescu Date: Sat, 21 Jun 2014 13:30:14 -0400 Subject: [PATCH 13/54] Updated PE analyzer to work with changes in master. --- scripts/base/files/pe/main.bro | 2 +- src/file_analysis/analyzer/pe/PE.cc | 12 ++---------- src/file_analysis/analyzer/pe/pe-analyzer.pac | 2 -- 3 files changed, 3 insertions(+), 13 deletions(-) diff --git a/scripts/base/files/pe/main.bro b/scripts/base/files/pe/main.bro index 76ba04fc8c..f9ebc57297 100644 --- a/scripts/base/files/pe/main.bro +++ b/scripts/base/files/pe/main.bro @@ -79,7 +79,7 @@ event file_new(f: fa_file) if ( f?$mime_type && f$mime_type == /application\/x-dosexec.*/ ) { #print "found a windows executable"; - FileAnalysis::add_analyzer(f, [$tag=FileAnalysis::ANALYZER_PE]); + Files::add_analyzer(f, Files::ANALYZER_PE); #FileAnalysis::add_analyzer(f, [$tag=FileAnalysis::ANALYZER_EXTRACT, # $extract_filename=fmt("exe-%d", ++blah_counter)]); } diff --git a/src/file_analysis/analyzer/pe/PE.cc b/src/file_analysis/analyzer/pe/PE.cc index 51db8fd232..59fbad91df 100644 --- a/src/file_analysis/analyzer/pe/PE.cc +++ b/src/file_analysis/analyzer/pe/PE.cc @@ -1,14 +1,10 @@ -#include - #include "PE.h" -#include "pe_pac.h" -#include "util.h" -#include "Event.h" +#include "file_analysis/Manager.h" using namespace file_analysis; PE::PE(RecordVal* args, File* file) - : file_analysis::Analyzer(args, file) + : file_analysis::Analyzer(file_mgr->GetComponentTag("PE"), args, file) { conn = new binpac::PE::MockConnection(this); interp = new binpac::PE::File(conn); @@ -26,10 +22,6 @@ bool PE::DeliverStream(const u_char* data, uint64 len) { interp->NewData(data, data + len); } - catch ( const binpac::HaltParser &e ) - { - return false; - } catch ( const binpac::Exception& e ) { printf("Binpac exception: %s\n", e.c_msg()); diff --git a/src/file_analysis/analyzer/pe/pe-analyzer.pac b/src/file_analysis/analyzer/pe/pe-analyzer.pac index 045f71c479..619bffad53 100644 --- a/src/file_analysis/analyzer/pe/pe-analyzer.pac +++ b/src/file_analysis/analyzer/pe/pe-analyzer.pac @@ -2,7 +2,6 @@ %extern{ #include "Event.h" #include "file_analysis/File.h" -#include "file_analysis.bif.func_h" #include "events.bif.h" %} @@ -10,7 +9,6 @@ refine flow File += { function proc_the_file(): bool %{ - throw binpac::HaltParser(); return true; %} From d98b5b88b5e110d146ee3982b3d2210b2f1bbc2b Mon Sep 17 00:00:00 2001 From: Vlad Grigorescu Date: Sun, 22 Jun 2014 07:18:12 -0400 Subject: [PATCH 14/54] Parse PE section headers. --- scripts/base/files/pe/main.bro | 11 ++++++--- src/file_analysis/analyzer/pe/pe-analyzer.pac | 4 +++- src/file_analysis/analyzer/pe/pe-file.pac | 24 +++++++++++++++---- 3 files changed, 30 insertions(+), 9 deletions(-) diff --git a/scripts/base/files/pe/main.bro b/scripts/base/files/pe/main.bro index f9ebc57297..091c322990 100644 --- a/scripts/base/files/pe/main.bro +++ b/scripts/base/files/pe/main.bro @@ -39,11 +39,15 @@ hook set_file(f: fa_file) &priority=5 event pe_dos_header(f: fa_file, h: PE::DOSHeader) &priority=5 { + print "DOS header"; + print h; hook set_file(f); } event pe_file_header(f: fa_file, h: PE::FileHeader) &priority=5 { + print "File header"; + print h; hook set_file(f); f$pe$compile_ts = h$ts; f$pe$machine = machine_types[h$machine]; @@ -53,6 +57,8 @@ event pe_file_header(f: fa_file, h: PE::FileHeader) &priority=5 event pe_optional_header(f: fa_file, h: PE::OptionalHeader) &priority=5 { + print "Optional header"; + print h; hook set_file(f); f$pe$os = os_versions[h$os_version_major, h$os_version_minor]; f$pe$subsystem = windows_subsystems[h$subsystem]; @@ -60,6 +66,8 @@ event pe_optional_header(f: fa_file, h: PE::OptionalHeader) &priority=5 event pe_section_header(f: fa_file, h: PE::SectionHeader) &priority=5 { + print "Section header"; + print h; hook set_file(f); print h; @@ -78,9 +86,6 @@ event file_new(f: fa_file) { if ( f?$mime_type && f$mime_type == /application\/x-dosexec.*/ ) { - #print "found a windows executable"; Files::add_analyzer(f, Files::ANALYZER_PE); - #FileAnalysis::add_analyzer(f, [$tag=FileAnalysis::ANALYZER_EXTRACT, - # $extract_filename=fmt("exe-%d", ++blah_counter)]); } } diff --git a/src/file_analysis/analyzer/pe/pe-analyzer.pac b/src/file_analysis/analyzer/pe/pe-analyzer.pac index 619bffad53..2b49cd2c23 100644 --- a/src/file_analysis/analyzer/pe/pe-analyzer.pac +++ b/src/file_analysis/analyzer/pe/pe-analyzer.pac @@ -9,6 +9,7 @@ refine flow File += { function proc_the_file(): bool %{ + printf("Processed\n"); return true; %} @@ -203,4 +204,5 @@ refine typeattr IMAGE_SECTION_HEADER += &let { refine typeattr TheFile += &let { proc: bool = $context.flow.proc_the_file(); -}; \ No newline at end of file +}; + diff --git a/src/file_analysis/analyzer/pe/pe-file.pac b/src/file_analysis/analyzer/pe/pe-file.pac index 03a25ce150..58278a7ffd 100644 --- a/src/file_analysis/analyzer/pe/pe-file.pac +++ b/src/file_analysis/analyzer/pe/pe-file.pac @@ -3,7 +3,7 @@ type TheFile = record { dos_header : DOS_Header; dos_code : DOS_Code(dos_code_len); pe_header : IMAGE_NT_HEADERS; - section_headers : IMAGE_SECTION_HEADER[] &length=pe_header.optional_header.size_of_headers; + section_headers : IMAGE_SECTIONS(pe_header.file_header.NumberOfSections); #pad : bytestring &length=offsetof(pe_header.data_directories + pe_header.data_directories[1].virtual_address); #data_sections : DATA_SECTIONS[pe_header.file_header.NumberOfSections]; #data_sections : DATA_SECTIONS[] &length=data_len; @@ -41,7 +41,7 @@ type DOS_Code(len: uint32) = record { type IMAGE_NT_HEADERS = record { PESignature : uint32; file_header : IMAGE_FILE_HEADER; - optional_header : IMAGE_OPTIONAL_HEADER(file_header.SizeOfOptionalHeader) &length=file_header.SizeOfOptionalHeader; + optional_header : IMAGE_OPTIONAL_HEADER(file_header.SizeOfOptionalHeader, file_header.NumberOfSections) &length=file_header.SizeOfOptionalHeader; } &byteorder=littleendian &length=file_header.SizeOfOptionalHeader+offsetof(optional_header); type IMAGE_FILE_HEADER = record { @@ -54,7 +54,7 @@ type IMAGE_FILE_HEADER = record { Characteristics : uint16; }; -type IMAGE_OPTIONAL_HEADER(len: uint16) = record { +type IMAGE_OPTIONAL_HEADER(len: uint16, number_of_sections: uint16) = record { magic : uint16; major_linker_version : uint8; minor_linker_version : uint8; @@ -80,12 +80,13 @@ type IMAGE_OPTIONAL_HEADER(len: uint16) = record { subsystem : uint16; dll_characteristics : uint16; mem: case magic of { - 0x0b01 -> i32 : MEM_INFO32; - 0x0b02 -> i64 : MEM_INFO64; + 267 -> i32 : MEM_INFO32; + 268 -> i64 : MEM_INFO64; default -> InvalidPEFile : empty; }; loader_flags : uint32; number_of_rva_and_sizes : uint32; + rvas : IMAGE_RVAS(number_of_rva_and_sizes); } &byteorder=littleendian &length=len; type MEM_INFO32 = record { @@ -102,6 +103,10 @@ type MEM_INFO64 = record { size_of_heap_commit : uint64; } &byteorder=littleendian &length=32; +type IMAGE_SECTIONS(num: uint16) = record { + sections : IMAGE_SECTION_HEADER[num]; +} &length=num*40; + type IMAGE_SECTION_HEADER = record { name : bytestring &length=8; virtual_size : uint32; @@ -129,6 +134,15 @@ type IMAGE_IMPORT_DIRECTORY = record { rva_import_addr_table : uint32; }; +type IMAGE_RVAS(num: uint32) = record { + rvas : IMAGE_RVA[num]; +} &length=num*8; + +type IMAGE_RVA = record { + virtual_address : uint32; + size : uint32; +} &length=8; + type DATA_SECTIONS = record { blah: uint8; }; \ No newline at end of file From ee3e885712ac84f13286a1e2a14ab080c5a537f0 Mon Sep 17 00:00:00 2001 From: Seth Hall Date: Fri, 13 Mar 2015 22:14:44 -0400 Subject: [PATCH 15/54] Lots of fixes for file type identification. - Plain text now identified with BOMs for UTF8,16,32 (even though 16 and 32 wouldn't get identified as plain text, oh-well) - X.509 certificates are now populating files.log with the mime type application/pkix-cert. - File signatures are split apart into file types to help group and organize signatures a bit better. - Normalized some FILE_ANALYSIS debug messages. - Improved Javascript detection. - Improved HTML detection. - Removed a bunch of bad signatures. - Merged a bunch of signatures that ultimately detected the same mime type. - Added detection for MS LNK files. - Added detection for cross-domain-policy XML files. - Added detection for SOAP envelopes. --- scripts/base/files/x509/main.bro | 3 + .../base/frameworks/files/magic/__load__.bro | 3 + .../base/frameworks/files/magic/archive.sig | 188 ++ .../base/frameworks/files/magic/general.sig | 138 +- scripts/base/frameworks/files/magic/image.sig | 178 ++ .../base/frameworks/files/magic/libmagic.sig | 1838 +---------------- .../base/frameworks/files/magic/msoffice.sig | 6 + scripts/base/frameworks/files/magic/video.sig | 218 ++ src/file_analysis/AnalyzerSet.cc | 36 +- src/file_analysis/File.cc | 6 +- src/file_analysis/Manager.cc | 6 +- .../Baseline/core.tunnels.teredo/http.log | 6 +- .../btest-doc.sphinx.mimestats#1 | 8 +- .../intel-all.log | 10 +- 14 files changed, 750 insertions(+), 1894 deletions(-) create mode 100644 scripts/base/frameworks/files/magic/archive.sig create mode 100644 scripts/base/frameworks/files/magic/image.sig create mode 100644 scripts/base/frameworks/files/magic/video.sig diff --git a/scripts/base/files/x509/main.bro b/scripts/base/files/x509/main.bro index 10445ad846..181607bf6c 100644 --- a/scripts/base/files/x509/main.bro +++ b/scripts/base/files/x509/main.bro @@ -47,6 +47,9 @@ redef record Files::Info += { event x509_certificate(f: fa_file, cert_ref: opaque of x509, cert: X509::Certificate) &priority=5 { + if ( ! f$info?$mime_type ) + f$info$mime_type = "application/pkix-cert"; + f$info$x509 = [$ts=f$info$ts, $id=f$id, $certificate=cert, $handle=cert_ref]; } diff --git a/scripts/base/frameworks/files/magic/__load__.bro b/scripts/base/frameworks/files/magic/__load__.bro index c6ee799a53..df03616ec2 100644 --- a/scripts/base/frameworks/files/magic/__load__.bro +++ b/scripts/base/frameworks/files/magic/__load__.bro @@ -1,3 +1,6 @@ @load-sigs ./general +@load-sigs ./archive +@load-sigs ./image +@load-sigs ./video @load-sigs ./msoffice @load-sigs ./libmagic diff --git a/scripts/base/frameworks/files/magic/archive.sig b/scripts/base/frameworks/files/magic/archive.sig new file mode 100644 index 0000000000..d8cc727540 --- /dev/null +++ b/scripts/base/frameworks/files/magic/archive.sig @@ -0,0 +1,188 @@ +signature file-tar { + file-magic /^[[:print:]\x00]{100}([[:digit:]\x20]{7}\x00){3}([[:digit:]\x20]{11}\x00){2}([[:digit:]\x00\x20]{7}[\x20\x00])[0-7\x00]/ + file-mime "application/x-tar", 100 +} + +# This is low priority so that files using zip as a +# container will be identified correctly. +signature file-zip { + file-mime "application/zip", 10 + file-magic /^PK\x03\x04.{2}/ +} + +# Multivolume Zip archive +signature file-multi-zip { + file-mime "application/zip", 10 + file-magic /^PK\x07\x08PK\x03\x04/ +} + +signature file-rar { + file-mime "application/x-rar", 70 + file-magic /^Rar!/ +} + +signature file-gzip { + file-mime "application/x-gzip", 100 + file-magic /\x1f\x8b/ +} + +signature file-ms-cab { + file-mime "application/vnd.ms-cab-compressed", 110 + file-magic /^MSCF\x00\x00\x00\x00/ +} + +# Mac OS X DMG files +signature file-dmg { + file-magic /^(\x78\x01\x73\x0D\x62\x62\x60|\x78\xDA\x63\x60\x18\x05|\x78\x01\x63\x60\x18\x05|\x78\xDA\x73\x0D|\x78[\x01\xDA]\xED[\xD0-\xD9])/ + file-mime "application/x-dmg", 100 +} + +# XAR (eXtensible ARchive) format. +# Mac OS X uses this for the .pkg format. +signature file-xar { + file-magic /^xar\!/ + file-mime "application/x-xar", 100 +} + +# RPM +signature file-magic-auto352 { + file-mime "application/x-rpm", 70 + file-magic /^(drpm|\xed\xab\xee\xdb)/ +} + +signature file-stuffit { + file-mime "application/x-stuffit", 70 + file-magic /^(SIT\x21|StuffIt)/ +} + +signature file-x-archive { + file-mime "application/x-archive", 70 + file-magic /^!?/ +} + +# ARC archive data +signature file-arc { + file-mime "application/x-arc", 70 + file-magic /([\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f]{2})([\x02-\x0a\x14\x48]\x1a)/ +} + +# EET archive +signature file-eet { + file-mime "application/x-eet", 70 + file-magic /^\x1e\xe7\xff\x00/ +} + +# Zoo archive +signature file-zoo { + file-mime "application/x-zoo", 70 + file-magic /^.{20}\xdc\xa7\xc4\xfd/ +} + +# >0 lelong&,=407642370 (0x184c2102), ["LZ4 compressed data, legacy format"], swap_endian=0 +signature file-magic-auto382 { + file-mime "application/x-lz4", 70 + file-magic /(\x02\x21\x4c\x18)/ +} + +# >0 lelong&,=407708164 (0x184d2204), ["LZ4 compressed data"], swap_endian=0 +signature file-magic-auto383 { + file-mime "application/x-lz4", 70 + file-magic /(\x04\x22\x4d\x18)/ +} + +# >0 string,=LRZI (len=4), ["LRZIP compressed data"], swap_endian=0 +# >>5 byte&,x, [".%d"], swap_endian=0 +signature file-magic-auto384 { + file-mime "application/x-lrzip", 1 + file-magic /(LRZI)(.{1})(.{1})/ +} + +# >0 string,=LZIP (len=4), ["lzip compressed data"], swap_endian=0 +signature file-magic-auto386 { + file-mime "application/x-lzip", 70 + file-magic /(LZIP)/ +} + +# >0 string/b,=MZ (len=2), [""], swap_endian=0 +# >>30 string,=Copyright 1989-1990 PKWARE Inc. (len=31), ["Self-extracting PKZIP archive"], swap_endian=0 +signature file-magic-auto434 { + file-mime "application/zip", 340 + file-magic /(MZ)(.{28})(Copyright 1989\x2d1990 PKWARE Inc\x2e)/ +} + +# >0 string/b,=MZ (len=2), [""], swap_endian=0 +# >>30 string,=PKLITE Copr. (len=12), ["Self-extracting PKZIP archive"], swap_endian=0 +signature file-magic-auto435 { + file-mime "application/zip", 150 + file-magic /(MZ)(.{28})(PKLITE Copr\x2e)/ +} + +# LHA archive (LZH) +signature file-lzh { + file-mime "application/x-lzh", 80 + file-magic /^.{2}-(lh[ abcdex0-9]|lz[s2-8]|lz[s2-8]|pm[s012]|pc1)-/ +} + +# >0 string,=WARC/ (len=5), ["WARC Archive"], swap_endian=0 +# >>5 string,x, ["version %.4s"], swap_endian=0 +signature file-magic-auto177 { + file-mime "application/warc", 1 + file-magic /(WARC\x2f)(.{0})/ +} + +# >0 string,=7z\274\257'\034 (len=6), ["7-zip archive data,"], swap_endian=0 +# >>7 byte&,x, [".%d"], swap_endian=0 +signature file-magic-auto150 { + file-mime "application/x-7z-compressed", 1 + file-magic /(7z\xbc\xaf\x27\x1c)(.{1})(.{1})/ +} + +# >0 ustring,=\3757zXZ\000 (len=6), ["XZ compressed data"], swap_endian=0 +signature file-magic-auto151 { + file-mime "application/x-xz", 90 + file-magic /(\xfd7zXZ\x00)/ +} +# >0 string/b,=MZ (len=2), [""], swap_endian=0 +# >>36 string,=LHa's SFX (len=9), [", LHa self-extracting archive"], swap_endian=0 +signature file-magic-auto436 { + file-mime "application/x-lha", 120 + file-magic /(MZ)(.{34})(LHa\x27s SFX)/ +} + +# >0 string/b,=MZ (len=2), [""], swap_endian=0 +# >>36 string,=LHA's SFX (len=9), [", LHa self-extracting archive"], swap_endian=0 +signature file-magic-auto437 { + file-mime "application/x-lha", 120 + file-magic /(MZ)(.{34})(LHA\x27s SFX)/ +} + +# >0 leshort&,=-5536 (0xea60), ["ARJ archive data"], swap_endian=0 +signature file-magic-auto467 { + file-mime "application/x-arj", 50 + file-magic /(\x60\xea)/ +} + +# >0 short&,=-14479 (0xc771), ["byte-swapped cpio archive"], swap_endian=0 +signature file-magic-auto479 { + file-mime "application/x-cpio", 50 + file-magic /((\x71\xc7)|(\xc7\x71))/ +} + +# >0 short&,=29127 (0x71c7), ["cpio archive"], swap_endian=0 +signature file-magic-auto480 { + file-mime "application/x-cpio", 50 + file-magic /((\xc7\x71)|(\x71\xc7))/ +} + +# >0 string,=\037\235 (len=2), ["compress'd data"], swap_endian=0 +signature file-magic-auto500 { + file-mime "application/x-compress", 50 + file-magic /(\x1f\x9d)/ +} + +# >0 lelong&00ffffff,=93 (0x0000005d), [""], swap_endian=0 +signature file-magic-auto218 { + file-mime "application/x-lzma", 71 + file-magic /(\x5d\x00\x00.)/ +} + diff --git a/scripts/base/frameworks/files/magic/general.sig b/scripts/base/frameworks/files/magic/general.sig index 500c4f7be0..e673fc86b6 100644 --- a/scripts/base/frameworks/files/magic/general.sig +++ b/scripts/base/frameworks/files/magic/general.sig @@ -1,18 +1,51 @@ # General purpose file magic signatures. +# Plaintext +# (Including BOMs for UTF-8, 16, and 32) signature file-plaintext { - file-magic /^([[:print:][:space:]]{10})/ - file-mime "text/plain", -20 + file-magic /^(\xef\xbb\xbf|(\x00\x00)?\xfe\xff|\xff\xfe(\x00\x00)?)?[[:space:]\x20-\x7E]{10}/ + file-mime "text/plain", -20 } -signature file-tar { - file-magic /^[[:print:]\x00]{100}([[:digit:]\x20]{7}\x00){3}([[:digit:]\x20]{11}\x00){2}([[:digit:]\x00\x20]{7}[\x20\x00])[0-7\x00]/ - file-mime "application/x-tar", 100 +signature file-xml { + file-mime "application/xml", 10 + file-magic /^[\x0d\x0a[:blank:]]*<\?xml / } -signature file-zip { - file-mime "application/zip", 10 - file-magic /^PK\x03\x04.{2}/ +signature file-xhtml { + file-mime "text/html", 100 + file-magic /^[\x0d\x0a[:blank:]]*<\?xml version[ =]['"].*<(![dD][oO][cC][tT][yY][pP][eE] {1,}[hH][tT][mM][lL]|[hH][tT][mM][lL])/ +} + +signature file-html { + file-mime "text/html", 49 + file-magic /^[\x0d\x0a[:blank:]]*)?/ +} + +signature file-javascript3 { + file-mime "application/javascript", 60 + # This seems to be a somewhat common idiom in javascript. + file-magic /^[\x0d\x0a[:blank:]]*for \(;;\);/ +} + +signature file-javascript4 { + file-mime "application/javascript", 60 + file-magic /^[\x0d\x0a[:blank:]]*document\.write(ln)?[:blank:]?\(/ +} + +signature file-javascript5 { + file-mime "application/javascript", 60 + file-magic /^\(function\(\)[[:blank:]\n]*\{/ +} + signature file-php { + file-mime "text/x-php", 60 + file-magic /^\x23\x21[^\n]{1,15}bin\/(env[[:space:]]+)?php/ +} + +signature file-php2 { file-magic /^.*<\?php/ file-mime "text/x-php", 40 } @@ -135,3 +191,23 @@ signature file-skp { file-magic /^\xFF\xFE\xFF\x0E\x53\x00\x6B\x00\x65\x00\x74\x00\x63\x00\x68\x00\x55\x00\x70\x00\x20\x00\x4D\x00\x6F\x00\x64\x00\x65\x00\x6C\x00/ file-mime "application/skp", 100 } + +signature file-elf-object { + file-mime "application/x-object", 50 + file-magic /\x7fELF[\x01\x02](\x01.{10}\x01\x00|\x02.{10}\x00\x01)/ +} + +signature file-elf { + file-mime "application/x-executable", 50 + file-magic /\x7fELF[\x01\x02](\x01.{10}\x02\x00|\x02.{10}\x00\x02)/ +} + +signature file-elf-sharedlib { + file-mime "application/x-sharedlib", 50 + file-magic /\x7fELF[\x01\x02](\x01.{10}\x03\x00|\x02.{10}\x00\x03)/ +} + +signature file-elf-coredump { + file-mime "application/x-coredump", 50 + file-magic /\x7fELF[\x01\x02](\x01.{10}\x04\x00|\x02.{10}\x00\x04)/ +} diff --git a/scripts/base/frameworks/files/magic/image.sig b/scripts/base/frameworks/files/magic/image.sig new file mode 100644 index 0000000000..ad4e7bbbe1 --- /dev/null +++ b/scripts/base/frameworks/files/magic/image.sig @@ -0,0 +1,178 @@ + +signature file-tiff { + file-mime "image/tiff", 70 + file-magic /^(MM\x00[\x2a\x2b]|II[\x2a\x2b]\x00)/ +} + +signature file-gif { + file-mime "image/gif", 70 + file-magic /^GIF8/ +} + + +# >0 beshort&,=-40 (0xffd8), ["JPEG image data"], swap_endian=0 +signature file-magic-auto427 { + file-mime "image/jpeg", 52 + file-magic /(\xff\xd8)/ +} + +signature file-bmp { + file-mime "image/x-ms-bmp", 50 + file-magic /BM.{12}[\x0c\x28\x40\x6c\x7c\x80]\x00/ +} + +signature file-ico { + file-magic /^\x00\x00\x01\x00/ + file-mime "image/x-icon", 70 +} + +signature file-cur { + file-magic /^\x00\x00\x02\x00/ + file-mime "image/x-cursor", 70 +} + +# >0 string,=8BPS (len=4), ["Adobe Photoshop Image"], swap_endian=0 +signature file-magic-auto289 { + file-mime "image/vnd.adobe.photoshop", 70 + file-magic /(8BPS)/ +} + +signature file-png { + file-mime "image/png", 110 + file-magic /^\x89PNG\x0d\x0a\x1a\x0a/ +} + +# JPEG 2000 +signature file-jp2 { + file-mime "image/jp2", 60 + file-magic /.{4}ftypjp2/ +} + +# JPEG 2000 +signature file-jp22 { + file-mime "image/jp2", 70 + file-magic /\x00\x00\x00\x0cjP \x0d\x0a\x87\x0a.{8}jp2 / +} + +# JPEG 2000 +signature file-jpx { + file-mime "image/jpx", 70 + file-magic /\x00\x00\x00\x0cjP \x0d\x0a\x87\x0a.{8}jpx / +} + +# JPEG 2000 +signature file-jpm { + file-mime "image/jpm", 70 + file-magic /\x00\x00\x00\x0cjP \x0d\x0a\x87\x0a.{8}jpm / +} + +# >0 string,=Xcur (len=4), ["Xcursor data"], swap_endian=0 +signature file-magic-auto271 { + file-mime "image/x-xcursor", 70 + file-magic /(Xcur)/ +} + +# >0 string,=IIN1 (len=4), ["NIFF image data"], swap_endian=0 +signature file-magic-auto282 { + file-mime "image/x-niff", 70 + file-magic /(IIN1)/ +} + +# >0 lelong&,=20000630 (0x01312f76), ["OpenEXR image data,"], swap_endian=0 +signature file-magic-auto291 { + file-mime "image/x-exr", 70 + file-magic /(\x76\x2f\x31\x01)/ +} + +# >0 string,=SDPX (len=4), ["DPX image data, big-endian,"], swap_endian=0 +signature file-magic-auto292 { + file-mime "image/x-dpx", 70 + file-magic /(SDPX)/ +} + +# >0 string,=CPC\262 (len=4), ["Cartesian Perceptual Compression image"], swap_endian=0 +signature file-magic-auto294 { + file-mime "image/x-cpi", 70 + file-magic /(CPC\xb2)/ +} + + +signature file-orf { + file-mime "image/x-olympus-orf", 70 + file-magic /IIR[OS]|MMOR/ +} + +# >0 string,=FOVb (len=4), ["Foveon X3F raw image data"], swap_endian=0 +signature file-magic-auto298 { + file-mime "image/x-x3f", 70 + file-magic /(FOVb)/ +} + +# >0 string,=PDN3 (len=4), ["Paint.NET image data"], swap_endian=0 +signature file-magic-auto299 { + file-mime "image/x-paintnet", 70 + file-magic /(PDN3)/ +} + +# >0 string,=RIFF (len=4), ["RIFF (little-endian) data"], swap_endian=0 +# >>8 string,=CDRA (len=4), [", Corel Draw Picture"], swap_endian=0 +signature file-magic-auto355 { + file-mime "image/x-coreldraw", 70 + file-magic /(RIFF)(.{4})(CDRA)/ +} + +# >0 string,=RIFF (len=4), ["RIFF (little-endian) data"], swap_endian=0 +# >>8 string,=CDR6 (len=4), [", Corel Draw Picture, version 6"], swap_endian=0 +signature file-magic-auto356 { + file-mime "image/x-coreldraw", 70 + file-magic /(RIFF)(.{4})(CDR6)/ +} + +# >0 string,=P7 (len=2), ["Netpbm PAM image file"], swap_endian=0 +signature file-magic-auto484 { + file-mime "image/x-portable-pixmap", 50 + file-magic /(P7)/ +} + +# >4 string/W,=jP (len=2), ["JPEG 2000 image"], swap_endian=0 +signature file-magic-auto497 { + file-mime "image/jp2", 50 + file-magic /(.{4})(jP)/ +} + +# DjVU Images +signature file-djvu { + file-mime "image/vnd.djvu", 70 + file-magic /AT\x26TFORM.{4}(DJV[MUI]|THUM)/ +} + +# DWG AutoDesk AutoCAD +signature file-dwg { + file-mime "image/vnd.dwg", 90 + file-magic /^(AC[12]\.|AC10)/ +} + +# >0 string,=gimp xcf (len=8), ["GIMP XCF image data,"], swap_endian=0 +signature file-magic-auto115 { + file-mime "image/x-xcf", 110 + file-magic /(gimp xcf)/ +} + +# >0 string/t,=[BitmapInfo2] (len=13), ["Polar Monitor Bitmap text"], swap_endian=0 +signature file-magic-auto62 { + file-mime "image/x-polar-monitor-bitmap", 160 + file-magic /(\x5bBitmapInfo2\x5d)/ +} + +# >0 string,=AWBM (len=4), [""], swap_endian=0 +# >>4 leshort&,<1981 (0x07bd), ["Award BIOS bitmap"], swap_endian=0 +signature file-magic-auto208 { + file-mime "image/x-award-bmp", 20 + file-magic /(AWBM)(.{2})/ +} + +# >0 string,=\021\006 (len=2), ["Award BIOS Logo, 136 x 84"], swap_endian=0 +signature file-magic-auto483 { + file-mime "image/x-award-bioslogo", 50 + file-magic /^\x11[\x06\x09]/ +} diff --git a/scripts/base/frameworks/files/magic/libmagic.sig b/scripts/base/frameworks/files/magic/libmagic.sig index 72ec40dff8..d18f6f01a6 100644 --- a/scripts/base/frameworks/files/magic/libmagic.sig +++ b/scripts/base/frameworks/files/magic/libmagic.sig @@ -56,42 +56,18 @@ signature file-magic-auto11 { file-magic /(\x3cmap ?version\x3d\x22freeplane)/ } -# >0 string/wt,=#! /usr/local/bin/nawk (len=22), ["new awk script text executable"], swap_endian=0 -signature file-magic-auto12 { - file-mime "text/x-nawk", 250 - file-magic /(\x23\x21 ?\x2fusr\x2flocal\x2fbin\x2fnawk)/ -} - -# >0 string/wt,=#! /usr/local/bin/gawk (len=22), ["GNU awk script text executable"], swap_endian=0 -signature file-magic-auto13 { - file-mime "text/x-gawk", 250 - file-magic /(\x23\x21 ?\x2fusr\x2flocal\x2fbin\x2fgawk)/ -} - # >0 string,=# PaCkAgE DaTaStReAm (len=20), ["pkg Datastream (SVR4)"], swap_endian=0 signature file-magic-auto19 { file-mime "application/x-svr4-package", 230 file-magic /(\x23 PaCkAgE DaTaStReAm)/ } -# >0 string,=Creative Voice File (len=19), ["Creative Labs voice data"], swap_endian=0 -signature file-magic-auto20 { - file-mime "audio/x-unknown", 220 - file-magic /(Creative Voice File)/ -} - # >0 string/t,=[KDE Desktop Entry] (len=19), ["KDE desktop entry"], swap_endian=0 signature file-magic-auto21 { file-mime "application/x-kdelnk", 220 file-magic /(\x5bKDE Desktop Entry\x5d)/ } -# >0 string,=!\n__________E (len=19), ["MIPS archive"], swap_endian=0 -signature file-magic-auto23 { - file-mime "application/x-archive", 220 - file-magic /(\x21\x3carch\x3e\x0a\x5f\x5f\x5f\x5f\x5f\x5f\x5f\x5f\x5f\x5fE)/ -} - # >0 string/t,=# KDE Config File (len=17), ["KDE config file"], swap_endian=0 signature file-magic-auto26 { file-mime "application/x-kdelnk", 200 @@ -111,18 +87,6 @@ signature file-magic-auto28 { file-magic /(riff\x2e\x91\xcf\x11\xa5\xd6\x28\xdb\x04\xc1\x00\x00)(.{8})(wave\xf3\xac\xd3\x11\x8c\xd1\x00\xc0O\x8e\xdb\x8a)/ } -# >0 string/wt,=#! /usr/bin/nawk (len=16), ["new awk script text executable"], swap_endian=0 -signature file-magic-auto29 { - file-mime "text/x-nawk", 190 - file-magic /(\x23\x21 ?\x2fusr\x2fbin\x2fnawk)/ -} - -# >0 string/wt,=#! /usr/bin/gawk (len=16), ["GNU awk script text executable"], swap_endian=0 -signature file-magic-auto31 { - file-mime "text/x-gawk", 190 - file-magic /(\x23\x21 ?\x2fusr\x2fbin\x2fgawk)/ -} - # >369 string,=MICROSOFT PIFEX\000 (len=16), ["Windows Program Information File"], swap_endian=0 signature file-magic-auto32 { file-mime "application/x-dosexec", 190 @@ -147,23 +111,6 @@ signature file-magic-auto36 { file-magic /(Extended Module\x3a)/ } -# >0 string/t,=0 string/t,=0 string,=0 string/t,=>20 search/wc/1000,=0 string/t,=>15 string,>\000 (len=1), [""], swap_endian=0 -# >>>19 search/Wctb/4096,=0 string/t,=>15 string,>\000 (len=1), [""], swap_endian=0 -# >>>19 search/Wctb/4096,=0 string/t,=>15 string,>\000 (len=1), [""], swap_endian=0 # >>>19 search/4096,=0 string/t,=>15 string,>\000 (len=1), [""], swap_endian=0 -# >>>19 search/Wctb/4096,=0 string/c,=BEGIN:VCALENDAR (len=15), ["vCalendar calendar file"], swap_endian=0 signature file-magic-auto47 { file-mime "text/calendar", 180 file-magic /(BEGIN\x3aVCALENDAR)/ } -# >4 string,=Standard Jet DB (len=15), ["Microsoft Access Database"], swap_endian=0 -signature file-magic-auto48 { - file-mime "application/x-msaccess", 180 - file-magic /(.{4})(Standard Jet DB)/ -} - -# >4 string,=Standard ACE DB (len=15), ["Microsoft Access Database"], swap_endian=0 -signature file-magic-auto49 { - file-mime "application/x-msaccess", 180 - file-magic /(.{4})(Standard ACE DB)/ -} - # >0 string/w,=#VRML V2.0 utf8 (len=15), ["ISO/IEC 14772 VRML 97 file"], swap_endian=0 signature file-magic-auto50 { file-mime "model/vrml", 180 file-magic /(\x23VRML ?V2\x2e0 ?utf8)/ } -# >0 string/wt,=#! /usr/bin/awk (len=15), ["awk script text executable"], swap_endian=0 -signature file-magic-auto51 { - file-mime "text/x-awk", 180 - file-magic /(\x23\x21 ?\x2fusr\x2fbin\x2fawk)/ -} - # >0 string,=MAS_UTrack_V00 (len=14), [""], swap_endian=0 # >>14 string,>/0 (len=2), ["ultratracker V1.%.1s module sound data"], swap_endian=0 signature file-magic-auto53 { @@ -309,12 +214,6 @@ signature file-magic-auto61 { file-magic /(.{39})(\x3cgmr\x3aWorkbook)/ } -# >0 string/t,=[BitmapInfo2] (len=13), ["Polar Monitor Bitmap text"], swap_endian=0 -signature file-magic-auto62 { - file-mime "image/x-polar-monitor-bitmap", 160 - file-magic /(\x5bBitmapInfo2\x5d)/ -} - # >0 string,=SplineFontDB: (len=13), ["Spline Font Database "], swap_endian=0 signature file-magic-auto63 { file-mime "application/vnd.font-fontforge-sfd", 160 @@ -333,33 +232,6 @@ signature file-magic-auto65 { file-magic /([rR][eE][tT][uU][rR][nN]\x2d[pP][aA][tT][hH]\x3a)/ } -# >0 string,=\000\000\000\fjP \r\n\207\n (len=12), ["JPEG 2000"], swap_endian=0 -# >>20 string,=jp2 (len=4), ["Part 1 (JP2)"], swap_endian=0 -signature file-magic-auto66 { - file-mime "image/jp2", 70 - file-magic /(\x00\x00\x00\x0cjP \x0d\x0a\x87\x0a)(.{8})(jp2 )/ -} - -# >0 string,=\000\000\000\fjP \r\n\207\n (len=12), ["JPEG 2000"], swap_endian=0 -# >>20 string,=jpx (len=4), ["Part 2 (JPX)"], swap_endian=0 -signature file-magic-auto67 { - file-mime "image/jpx", 70 - file-magic /(\x00\x00\x00\x0cjP \x0d\x0a\x87\x0a)(.{8})(jpx )/ -} - -# >0 string,=\000\000\000\fjP \r\n\207\n (len=12), ["JPEG 2000"], swap_endian=0 -# >>20 string,=jpm (len=4), ["Part 6 (JPM)"], swap_endian=0 -signature file-magic-auto68 { - file-mime "image/jpm", 70 - file-magic /(\x00\x00\x00\x0cjP \x0d\x0a\x87\x0a)(.{8})(jpm )/ -} - -# >0 string,=\000\000\000\fjP \r\n\207\n (len=12), ["JPEG 2000"], swap_endian=0 -# >>20 string,=mjp2 (len=4), ["Part 3 (MJ2)"], swap_endian=0 -signature file-magic-auto69 { - file-mime "video/mj2", 70 - file-magic /(\x00\x00\x00\x0cjP \x0d\x0a\x87\x0a)(.{8})(mjp2)/ -} # >0 string/w,=0 string/wt,=#! /bin/nawk (len=12), ["new awk script text executable"], swap_endian=0 -signature file-magic-auto72 { - file-mime "text/x-nawk", 150 - file-magic /(\x23\x21 ?\x2fbin\x2fnawk)/ -} - -# >0 string/wt,=#! /bin/gawk (len=12), ["GNU awk script text executable"], swap_endian=0 -signature file-magic-auto73 { - file-mime "text/x-gawk", 150 - file-magic /(\x23\x21 ?\x2fbin\x2fgawk)/ -} - -# >0 string/wt,=#! /bin/awk (len=11), ["awk script text executable"], swap_endian=0 -signature file-magic-auto75 { - file-mime "text/x-awk", 140 - file-magic /(\x23\x21 ?\x2fbin\x2fawk)/ -} - # >0 string,=filedesc:// (len=11), ["Internet Archive File"], swap_endian=0 signature file-magic-auto76 { file-mime "application/x-ia-arc", 140 @@ -447,12 +301,6 @@ signature file-magic-auto88 { file-magic /(.*)(\x2d\x2d\x2d )(.*)(\x0a)(.*)(\x2b\x2b\x2b )(.*)(\x0a)(.*)(\x40\x40)/ } -# >0 string/t,=Received: (len=9), ["RFC 822 mail text"], swap_endian=0 -signature file-magic-auto89 { - file-mime "message/rfc822", 120 - file-magic /(Received\x3a)/ -} - # >0 string,=0 string,=AT&TFORM (len=8), [""], swap_endian=0 -# >>12 string,=DJVM (len=4), ["DjVu multiple page document"], swap_endian=0 -signature file-magic-auto95 { - file-mime "image/vnd.djvu", 70 - file-magic /(AT\x26TFORM)(.{4})(DJVM)/ -} - -# >0 string,=AT&TFORM (len=8), [""], swap_endian=0 -# >>12 string,=DJVU (len=4), ["DjVu image or single page document"], swap_endian=0 -signature file-magic-auto96 { - file-mime "image/vnd.djvu", 70 - file-magic /(AT\x26TFORM)(.{4})(DJVU)/ -} - -# >0 string,=AT&TFORM (len=8), [""], swap_endian=0 -# >>12 string,=DJVI (len=4), ["DjVu shared document"], swap_endian=0 -signature file-magic-auto97 { - file-mime "image/vnd.djvu", 70 - file-magic /(AT\x26TFORM)(.{4})(DJVI)/ -} - -# >0 string,=AT&TFORM (len=8), [""], swap_endian=0 -# >>12 string,=THUM (len=4), ["DjVu page thumbnails"], swap_endian=0 -signature file-magic-auto98 { - file-mime "image/vnd.djvu", 70 - file-magic /(AT\x26TFORM)(.{4})(THUM)/ -} - # >0 string/t,=#! rnews (len=8), ["batched news text"], swap_endian=0 signature file-magic-auto99 { file-mime "message/rfc822", 110 file-magic /(\x23\x21 rnews)/ } -# >0 string/b,=MSCF\000\000\000\000 (len=8), ["Microsoft Cabinet archive data"], swap_endian=0 -signature file-magic-auto100 { - file-mime "application/vnd.ms-cab-compressed", 110 - file-magic /(MSCF\x00\x00\x00\x00)/ -} - # >21 string/c,=!SCREAM! (len=8), ["Screamtracker 2 module sound data"], swap_endian=0 signature file-magic-auto102 { file-mime "audio/x-mod", 110 @@ -573,12 +387,6 @@ signature file-magic-auto109 { file-magic /(\x89HDF\x0d\x0a\x1a\x0a)/ } -# >0 string,=\211PNG\r\n\032\n (len=8), ["PNG image data"], swap_endian=0 -signature file-magic-auto110 { - file-mime "image/png", 110 - file-magic /(\x89PNG\x0d\x0a\x1a\x0a)/ -} - # >36 string,=acspSUNW (len=8), ["Sun KCMS ICC Profile"], swap_endian=0 signature file-magic-auto111 { file-mime "application/vnd.iccprofile", 110 @@ -603,36 +411,18 @@ signature file-magic-auto114 { file-magic /(.{36})(acspAPPL)/ } -# >0 string,=gimp xcf (len=8), ["GIMP XCF image data,"], swap_endian=0 -signature file-magic-auto115 { - file-mime "image/x-xcf", 110 - file-magic /(gimp xcf)/ -} - # >512 string,=R\000o\000o\000t\000 (len=8), ["Hangul (Korean) Word Processor File 2000"], swap_endian=0 signature file-magic-auto116 { file-mime "application/x-hwp", 110 file-magic /(.{512})(R\x00o\x00o\x00t\x00)/ } -# >257 string,=ustar \000 (len=8), ["GNU tar archive"], swap_endian=0 -#signature file-magic-auto117 { -# file-mime "application/x-tar", 110 -# file-magic /(.{257})(ustar \x00)/ -#} - # >0 string,=0 string,=PK\a\bPK\003\004 (len=8), ["Zip multi-volume archive data, at least PKZIP v2.50 to extract"], swap_endian=0 -signature file-magic-auto119 { - file-mime "application/zip", 110 - file-magic /(PK\x07\x08PK\x03\x04)/ -} - # >0 string/b,=WordPro\000 (len=8), ["Lotus WordPro"], swap_endian=0 signature file-magic-auto121 { file-mime "application/vnd.lotus-wordpro", 110 @@ -645,12 +435,6 @@ signature file-magic-auto122 { file-magic /(Article)/ } -# >0 string,=\037\213 (len=2), ["gzip compressed data"], swap_endian=0 -signature file-magic-auto123 { - file-mime "application/x-gzip", 100 - file-magic /(\x1f\x8b)/ -} - # >0 string/t,=Pipe to (len=7), ["mail piping text"], swap_endian=0 signature file-magic-auto124 { file-mime "message/rfc822", 100 @@ -663,18 +447,6 @@ signature file-magic-auto125 { file-magic /(\x2eRMF\x00\x00\x00)/ } -# >0 string,=StuffIt (len=7), ["StuffIt Archive"], swap_endian=0 -signature file-magic-auto126 { - file-mime "application/x-stuffit", 100 - file-magic /(StuffIt)/ -} - -# >0 string,=! (len=7), ["current ar archive"], swap_endian=0 -signature file-magic-auto127 { - file-mime "application/x-archive", 100 - file-magic /(\x21\x3carch\x3e)/ -} - # >0 string,=P5 (len=2), [""], swap_endian=0 # >>3 regex,=[0-9]{1,50} (len=12), [", size = %sx"], swap_endian=0 # >>>3 regex,= [0-9]{1,50} (len=12), ["%s"], swap_endian=0 @@ -699,151 +471,12 @@ signature file-magic-auto130 { file-magic /(P4)(.{1})([0-9]{1,50} )( [0-9]{1,50})/ } -# >257 string,=ustar\000 (len=6), ["POSIX tar archive"], swap_endian=0 -#signature file-magic-auto131 { -# file-mime "application/x-tar", 90 -# file-magic /(.{257})(ustar\x00)/ -#} - -# >0 string,=AC1.40 (len=6), ["DWG AutoDesk AutoCAD Release 1.40"], swap_endian=0 -signature file-magic-auto132 { - file-mime "image/vnd.dwg", 90 - file-magic /(AC1\x2e40)/ -} - -# >0 string,=AC1.50 (len=6), ["DWG AutoDesk AutoCAD Release 2.05"], swap_endian=0 -signature file-magic-auto133 { - file-mime "image/vnd.dwg", 90 - file-magic /(AC1\x2e50)/ -} - -# >0 string,=AC2.10 (len=6), ["DWG AutoDesk AutoCAD Release 2.10"], swap_endian=0 -signature file-magic-auto134 { - file-mime "image/vnd.dwg", 90 - file-magic /(AC2\x2e10)/ -} - -# >0 string,=AC2.21 (len=6), ["DWG AutoDesk AutoCAD Release 2.21"], swap_endian=0 -signature file-magic-auto135 { - file-mime "image/vnd.dwg", 90 - file-magic /(AC2\x2e21)/ -} - -# >0 string,=AC2.22 (len=6), ["DWG AutoDesk AutoCAD Release 2.22"], swap_endian=0 -signature file-magic-auto136 { - file-mime "image/vnd.dwg", 90 - file-magic /(AC2\x2e22)/ -} - -# >0 string,=AC1001 (len=6), ["DWG AutoDesk AutoCAD Release 2.22"], swap_endian=0 -signature file-magic-auto137 { - file-mime "image/vnd.dwg", 90 - file-magic /(AC1001)/ -} - -# >0 string,=AC1002 (len=6), ["DWG AutoDesk AutoCAD Release 2.50"], swap_endian=0 -signature file-magic-auto138 { - file-mime "image/vnd.dwg", 90 - file-magic /(AC1002)/ -} - -# >0 string,=AC1003 (len=6), ["DWG AutoDesk AutoCAD Release 2.60"], swap_endian=0 -signature file-magic-auto139 { - file-mime "image/vnd.dwg", 90 - file-magic /(AC1003)/ -} - -# >0 string,=AC1004 (len=6), ["DWG AutoDesk AutoCAD Release 9"], swap_endian=0 -signature file-magic-auto140 { - file-mime "image/vnd.dwg", 90 - file-magic /(AC1004)/ -} - -# >0 string,=AC1006 (len=6), ["DWG AutoDesk AutoCAD Release 10"], swap_endian=0 -signature file-magic-auto141 { - file-mime "image/vnd.dwg", 90 - file-magic /(AC1006)/ -} - -# >0 string,=AC1009 (len=6), ["DWG AutoDesk AutoCAD Release 11/12"], swap_endian=0 -signature file-magic-auto142 { - file-mime "image/vnd.dwg", 90 - file-magic /(AC1009)/ -} - -# >0 string,=AC1012 (len=6), ["DWG AutoDesk AutoCAD Release 13"], swap_endian=0 -signature file-magic-auto143 { - file-mime "image/vnd.dwg", 90 - file-magic /(AC1012)/ -} - -# >0 string,=AC1014 (len=6), ["DWG AutoDesk AutoCAD Release 14"], swap_endian=0 -signature file-magic-auto144 { - file-mime "image/vnd.dwg", 90 - file-magic /(AC1014)/ -} - -# >0 string,=AC1015 (len=6), ["DWG AutoDesk AutoCAD 2000/2002"], swap_endian=0 -signature file-magic-auto145 { - file-mime "image/vnd.dwg", 90 - file-magic /(AC1015)/ -} - -# >0 string,=AC1018 (len=6), ["DWG AutoDesk AutoCAD 2004/2005/2006"], swap_endian=0 -signature file-magic-auto146 { - file-mime "image/vnd.dwg", 90 - file-magic /(AC1018)/ -} - -# >0 string,=AC1021 (len=6), ["DWG AutoDesk AutoCAD 2007/2008/2009"], swap_endian=0 -signature file-magic-auto147 { - file-mime "image/vnd.dwg", 90 - file-magic /(AC1021)/ -} - -# >0 string,=AC1024 (len=6), ["DWG AutoDesk AutoCAD 2010/2011/2012"], swap_endian=0 -signature file-magic-auto148 { - file-mime "image/vnd.dwg", 90 - file-magic /(AC1024)/ -} - -# >0 string,=AC1027 (len=6), ["DWG AutoDesk AutoCAD 2013/2014"], swap_endian=0 -signature file-magic-auto149 { - file-mime "image/vnd.dwg", 90 - file-magic /(AC1027)/ -} - -# >0 string,=7z\274\257'\034 (len=6), ["7-zip archive data,"], swap_endian=0 -# >>7 byte&,x, [".%d"], swap_endian=0 -signature file-magic-auto150 { - file-mime "application/x-7z-compressed", 1 - file-magic /(7z\xbc\xaf\x27\x1c)(.{1})(.{1})/ -} - -# >0 ustring,=\3757zXZ\000 (len=6), ["XZ compressed data"], swap_endian=0 -signature file-magic-auto151 { - file-mime "application/x-xz", 90 - file-magic /(\xfd7zXZ\x00)/ -} - # >0 string,=0 string,=GIF94z (len=6), ["ZIF image (GIF+deflate alpha)"], swap_endian=0 -signature file-magic-auto153 { - file-mime "image/x-unknown", 90 - file-magic /(GIF94z)/ -} - -# >0 string,=FGF95a (len=6), ["FGF image (GIF+deflate beta)"], swap_endian=0 -signature file-magic-auto154 { - file-mime "image/x-unknown", 90 - file-magic /(FGF95a)/ -} - # >0 string/t,=# xmcd (len=6), ["xmcd database file for kscd"], swap_endian=0 signature file-magic-auto155 { file-mime "text/x-xmcd", 90 @@ -968,81 +601,6 @@ signature file-magic-auto174 { file-magic /(.{60})(RINEX)(.{15})(.*)(XXRINEXO)/ } -# Doubt it's going to be common to have this many bytes buffered. -# >37633 string,=CD001 (len=5), ["ISO 9660 CD-ROM filesystem data (raw 2352 byte sectors)"], swap_endian=0 -#signature file-magic-auto175 { -# file-mime "application/x-iso9660-image", 80 -# file-magic /(.{37633})(CD001)/ -#} - -# >2 string,=-lhd- (len=5), ["LHa 2.x? archive data [lhd]"], swap_endian=0 -signature file-magic-auto176 { - file-mime "application/x-lha", 80 - file-magic /(.{2})(\x2dlhd\x2d)/ -} - -# >0 string,=WARC/ (len=5), ["WARC Archive"], swap_endian=0 -# >>5 string,x, ["version %.4s"], swap_endian=0 -signature file-magic-auto177 { - file-mime "application/warc", 1 - file-magic /(WARC\x2f)(.{0})/ -} - -# >0 string,=AC1.3 (len=5), ["DWG AutoDesk AutoCAD Release 1.3"], swap_endian=0 -signature file-magic-auto178 { - file-mime "image/vnd.dwg", 80 - file-magic /(AC1\x2e3)/ -} - -# >2 string,=-lh - (len=5), ["LHa 2.x? archive data [lh ]"], swap_endian=0 -signature file-magic-auto179 { - file-mime "application/x-lha", 80 - file-magic /(.{2})(\x2dlh \x2d)/ -} - -# >0 string,=AC1.2 (len=5), ["DWG AutoDesk AutoCAD Release 1.2"], swap_endian=0 -signature file-magic-auto180 { - file-mime "image/vnd.dwg", 80 - file-magic /(AC1\x2e2)/ -} - -# >0 string,=MC0.0 (len=5), ["DWG AutoDesk AutoCAD Release 1.0"], swap_endian=0 -signature file-magic-auto181 { - file-mime "image/vnd.dwg", 80 - file-magic /(MC0\x2e0)/ -} - -# >2 string,=-lzs- (len=5), ["LHa/LZS archive data [lzs]"], swap_endian=0 -signature file-magic-auto182 { - file-mime "application/x-lha", 80 - file-magic /(.{2})(\x2dlzs\x2d)/ -} - -# >2 string,=-lz5- (len=5), ["LHarc 1.x archive data [lz5]"], swap_endian=0 -signature file-magic-auto183 { - file-mime "application/x-lharc", 80 - file-magic /(.{2})(\x2dlz5\x2d)/ -} - -# Doubt it's going to be common to have this many bytes buffered. -# >32769 string,=CD001 (len=5), ["#"], swap_endian=0 -#signature file-magic-auto184 { -# file-mime "application/x-iso9660-image", 80 -# file-magic /(.{32769})(CD001)/ -#} - -# >2 string,=-lh3- (len=5), ["LHa 2.x? archive data [lh3]"], swap_endian=0 -signature file-magic-auto185 { - file-mime "application/x-lha", 80 - file-magic /(.{2})(\x2dlh3\x2d)/ -} - -# >2 string,=-lh2- (len=5), ["LHa 2.x? archive data [lh2]"], swap_endian=0 -signature file-magic-auto186 { - file-mime "application/x-lha", 80 - file-magic /(.{2})(\x2dlh2\x2d)/ -} - # >0 string,=\000\001\000\000\000 (len=5), ["TrueType font data"], swap_endian=0 signature file-magic-auto187 { file-mime "application/x-font-ttf", 80 @@ -1073,66 +631,18 @@ signature file-magic-auto194 { file-magic /(From\x3a)/ } -# >2 string,=-lh7- (len=5), ["LHa (2.x)/LHark archive data [lh7]"], swap_endian=0 -signature file-magic-auto195 { - file-mime "application/x-lha", 80 - file-magic /(.{2})(\x2dlh7\x2d)/ -} - # >0 string,={\rtf (len=5), ["Rich Text Format data,"], swap_endian=0 signature file-magic-auto196 { file-mime "text/rtf", 80 file-magic /(\x7b\x5crtf)/ } -# >2 string,=-lh6- (len=5), ["LHa (2.x) archive data [lh6]"], swap_endian=0 -signature file-magic-auto197 { - file-mime "application/x-lha", 80 - file-magic /(.{2})(\x2dlh6\x2d)/ -} - -# >2 string,=-lh5- (len=5), ["LHa (2.x) archive data [lh5]"], swap_endian=0 -signature file-magic-auto198 { - file-mime "application/x-lha", 80 - file-magic /(.{2})(\x2dlh5\x2d)/ -} - -# >2 string,=-lh4- (len=5), ["LHa (2.x) archive data [lh4]"], swap_endian=0 -signature file-magic-auto199 { - file-mime "application/x-lha", 80 - file-magic /(.{2})(\x2dlh4\x2d)/ -} - -# >2 string,=-lz4- (len=5), ["LHarc 1.x archive data [lz4]"], swap_endian=0 -signature file-magic-auto200 { - file-mime "application/x-lharc", 80 - file-magic /(.{2})(\x2dlz4\x2d)/ -} - -# >2 string,=-lh1- (len=5), ["LHarc 1.x/ARX archive data [lh1]"], swap_endian=0 -signature file-magic-auto201 { - file-mime "application/x-lharc", 80 - file-magic /(.{2})(\x2dlh1\x2d)/ -} - -# >2 string,=-lh0- (len=5), ["LHarc 1.x/ARX archive data [lh0]"], swap_endian=0 -signature file-magic-auto202 { - file-mime "application/x-lharc", 80 - file-magic /(.{2})(\x2dlh0\x2d)/ -} - # >0 string,=%FDF- (len=5), ["FDF document"], swap_endian=0 signature file-magic-auto203 { file-mime "application/vnd.fdf", 80 file-magic /(\x25FDF\x2d)/ } -# >0 belong&,=443 (0x000001bb), [""], swap_endian=0 -signature file-magic-auto204 { - file-mime "video/mpeg", 71 - file-magic /(\x00\x00\x01\xbb)/ -} - # The non-sequential offsets and use of bitmask and relational operators # made this difficult to autogenerate. Can see about manually creating # the correct character class later. @@ -1145,31 +655,6 @@ signature file-magic-auto204 { # file-magic /(.{4})(.*)([\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff])(.*)([\x00\x01\x02\x03\x04\x05])(.*)([\x00\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff])/ #} -# >0 belong&,=432 (0x000001b0), [""], swap_endian=0 -signature file-magic-auto206 { - file-mime "video/mp4v-es", 71 - file-magic /(\x00\x00\x01\xb0)/ -} - -# >0 belong&,=437 (0x000001b5), [""], swap_endian=0 -signature file-magic-auto207 { - file-mime "video/mp4v-es", 71 - file-magic /(\x00\x00\x01\xb5)/ -} - -# >0 string,=AWBM (len=4), [""], swap_endian=0 -# >>4 leshort&,<1981 (0x07bd), ["Award BIOS bitmap"], swap_endian=0 -signature file-magic-auto208 { - file-mime "image/x-award-bmp", 20 - file-magic /(AWBM)(.{2})/ -} - -# >0 belong&,=435 (0x000001b3), [""], swap_endian=0 -signature file-magic-auto209 { - file-mime "video/mpv", 71 - file-magic /(\x00\x00\x01\xb3)/ -} - # Converting bitmask to character class might make the regex # unfriendly to humans. # >0 belong&ffffffffff5fff10,=1195376656 (0x47400010), [""], swap_endian=0 @@ -1178,40 +663,6 @@ signature file-magic-auto209 { # file-magic /(.{4})/ #} -# >0 belong&,=1 (0x00000001), [""], swap_endian=0 -# >>4 byte&0000001f,=0x07, [""], swap_endian=0 -signature file-magic-auto211 { - file-mime "video/h264", 41 - file-magic /(\x00\x00\x00\x01)([\x07\x27\x47\x67\x87\xa7\xc7\xe7])/ -} - -# >0 belong&ffffffffffffff00,=256 (0x00000100), [""], swap_endian=0 -# >>3 byte&,=0xba, ["MPEG sequence"], swap_endian=0 -signature file-magic-auto213 { - file-mime "video/mpeg", 40 - file-magic /(\x00\x00\x01\xba)/ -} - -# >0 belong&ffffffffffffff00,=256 (0x00000100), [""], swap_endian=0 -# >>3 byte&,=0xb0, ["MPEG sequence, v4"], swap_endian=0 -signature file-magic-auto214 { - file-mime "video/mpeg4-generic", 40 - file-magic /(\x00\x00\x01\xb0)/ -} - -# >0 belong&ffffffffffffff00,=256 (0x00000100), [""], swap_endian=0 -# >>3 byte&,=0xb5, ["MPEG sequence, v4"], swap_endian=0 -signature file-magic-auto215 { - file-mime "video/mpeg4-generic", 40 - file-magic /(\x00\x00\x01\xb5)/ -} - -# >0 belong&ffffffffffffff00,=256 (0x00000100), [""], swap_endian=0 -# >>3 byte&,=0xb3, ["MPEG sequence"], swap_endian=0 -signature file-magic-auto216 { - file-mime "video/mpeg", 40 - file-magic /(\x00\x00\x01\xb3)/ -} # >0 lelong&,=4 (0x00000004), [""], swap_endian=0 # >>104 lelong&,=4 (0x00000004), ["X11 SNF font data, LSB first"], swap_endian=0 @@ -1220,12 +671,6 @@ signature file-magic-auto217 { file-magic /(\x04\x00\x00\x00)(.{100})(\x04\x00\x00\x00)/ } -# >0 lelong&00ffffff,=93 (0x0000005d), [""], swap_endian=0 -signature file-magic-auto218 { - file-mime "application/x-lzma", 71 - file-magic /(\x5d\x00\x00.)/ -} - # This didn't auto-generate correctly due to non-sequential offsets and # use of bitwise/relational comparisons. At a glance: may not be # that common/useful, leaving for later. @@ -1285,22 +730,6 @@ signature file-magic-auto223 { file-magic /(\x3bELC)([\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff])/ } -# >0 belong&,=440786851 (0x1a45dfa3), [""], swap_endian=0 -# >>4 search/4096,=B\202 (len=2), [""], swap_endian=0 -# >>>&1 string,=webm (len=4), ["WebM"], swap_endian=0 -signature file-magic-auto224 { - file-mime "video/webm", 70 - file-magic /(\x1a\x45\xdf\xa3)(.*)(B\x82)(.{1})(webm)/ -} - -# >0 belong&,=440786851 (0x1a45dfa3), [""], swap_endian=0 -# >>4 search/4096,=B\202 (len=2), [""], swap_endian=0 -# >>>&1 string,=matroska (len=8), ["Matroska data"], swap_endian=0 -signature file-magic-auto225 { - file-mime "video/x-matroska", 110 - file-magic /(\x1a\x45\xdf\xa3)(.*)(B\x82)(.{1})(matroska)/ -} - # >0 string,=PK\003\004 (len=4), [""], swap_endian=0 # >>4 byte&,=0x14, [""], swap_endian=0 # >>>30 string,=doc.kml (len=7), ["Compressed Google KML Document, including resources."], swap_endian=0 @@ -1502,37 +931,6 @@ signature file-magic-auto245 { file-magic /(PK\x03\x04)(.{22})(\x08\x00\x00\x00mimetypeapplication\x2f)(epub\x2bzip)/ } -# >0 belong&,=442 (0x000001ba), [""], swap_endian=0 -# >>4 byte&,&0x40, [""], swap_endian=0 -signature file-magic-auto250 { - file-mime "video/mp2p", 21 - file-magic /(\x00\x00\x01\xba)([\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff])/ -} - -# >0 belong&,=442 (0x000001ba), [""], swap_endian=0 -# >>4 byte&,^0x40, [""], swap_endian=0 -signature file-magic-auto251 { - file-mime "video/mpeg", 21 - file-magic /(\x00\x00\x01\xba)([\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf])/ -} - -# >0 string,=MOVI (len=4), ["Silicon Graphics movie file"], swap_endian=0 -signature file-magic-auto252 { - file-mime "video/x-sgi-movie", 70 - file-magic /(MOVI)/ -} - -# >4 string,=moov (len=4), ["Apple QuickTime"], swap_endian=0 -signature file-magic-auto253 { - file-mime "video/quicktime", 70 - file-magic /(.{4})(moov)/ -} - -# >4 string,=mdat (len=4), ["Apple QuickTime movie (unoptimized)"], swap_endian=0 -signature file-magic-auto254 { - file-mime "video/quicktime", 70 - file-magic /(.{4})(mdat)/ -} # >4 string,=idsc (len=4), ["Apple QuickTime image (fast start)"], swap_endian=0 signature file-magic-auto255 { @@ -1546,82 +944,6 @@ signature file-magic-auto256 { file-magic /(.{4})(pckg)/ } -# >4 string,=ftyp (len=4), ["ISO Media"], swap_endian=0 -# >>8 string,=isom (len=4), [", MPEG v4 system, version 1"], swap_endian=0 -signature file-magic-auto257 { - file-mime "video/mp4", 70 - file-magic /(.{4})(ftyp)(isom)/ -} - -# >4 string,=ftyp (len=4), ["ISO Media"], swap_endian=0 -# >>8 string,=mp41 (len=4), [", MPEG v4 system, version 1"], swap_endian=0 -signature file-magic-auto258 { - file-mime "video/mp4", 70 - file-magic /(.{4})(ftyp)(mp41)/ -} - -# >4 string,=ftyp (len=4), ["ISO Media"], swap_endian=0 -# >>8 string,=mp42 (len=4), [", MPEG v4 system, version 2"], swap_endian=0 -signature file-magic-auto259 { - file-mime "video/mp4", 70 - file-magic /(.{4})(ftyp)(mp42)/ -} - -# >4 string,=ftyp (len=4), ["ISO Media"], swap_endian=0 -# >>8 string/W,=jp2 (len=3), [", JPEG 2000"], swap_endian=0 -signature file-magic-auto260 { - file-mime "image/jp2", 60 - file-magic /(.{4})(ftyp)(jp2)/ -} - -# >4 string,=ftyp (len=4), ["ISO Media"], swap_endian=0 -# >>8 string,=3ge (len=3), [", MPEG v4 system, 3GPP"], swap_endian=0 -signature file-magic-auto261 { - file-mime "video/3gpp", 60 - file-magic /(.{4})(ftyp)(3ge)/ -} - -# >4 string,=ftyp (len=4), ["ISO Media"], swap_endian=0 -# >>8 string,=3gg (len=3), [", MPEG v4 system, 3GPP"], swap_endian=0 -signature file-magic-auto262 { - file-mime "video/3gpp", 60 - file-magic /(.{4})(ftyp)(3gg)/ -} - -# >4 string,=ftyp (len=4), ["ISO Media"], swap_endian=0 -# >>8 string,=3gp (len=3), [", MPEG v4 system, 3GPP"], swap_endian=0 -signature file-magic-auto263 { - file-mime "video/3gpp", 60 - file-magic /(.{4})(ftyp)(3gp)/ -} - -# >4 string,=ftyp (len=4), ["ISO Media"], swap_endian=0 -# >>8 string,=3gs (len=3), [", MPEG v4 system, 3GPP"], swap_endian=0 -signature file-magic-auto264 { - file-mime "video/3gpp", 60 - file-magic /(.{4})(ftyp)(3gs)/ -} - -# >4 string,=ftyp (len=4), ["ISO Media"], swap_endian=0 -# >>8 string,=3g2 (len=3), [", MPEG v4 system, 3GPP2"], swap_endian=0 -signature file-magic-auto265 { - file-mime "video/3gpp2", 60 - file-magic /(.{4})(ftyp)(3g2)/ -} - -# >4 string,=ftyp (len=4), ["ISO Media"], swap_endian=0 -# >>8 string,=mmp4 (len=4), [", MPEG v4 system, 3GPP Mobile"], swap_endian=0 -signature file-magic-auto266 { - file-mime "video/mp4", 70 - file-magic /(.{4})(ftyp)(mmp4)/ -} - -# >4 string,=ftyp (len=4), ["ISO Media"], swap_endian=0 -# >>8 string,=avc1 (len=4), [", MPEG v4 system, 3GPP JVT AVC"], swap_endian=0 -signature file-magic-auto267 { - file-mime "video/3gpp", 70 - file-magic /(.{4})(ftyp)(avc1)/ -} # >4 string,=ftyp (len=4), ["ISO Media"], swap_endian=0 # >>8 string/W,=M4A (len=3), [", MPEG v4 system, iTunes AAC-LC"], swap_endian=0 @@ -1644,12 +966,6 @@ signature file-magic-auto270 { file-magic /(.{4})(ftyp)(qt)/ } -# >0 string,=Xcur (len=4), ["Xcursor data"], swap_endian=0 -signature file-magic-auto271 { - file-mime "image/x-xcursor", 70 - file-magic /(Xcur)/ -} - # >0 string,=ADIF (len=4), ["MPEG ADIF, AAC"], swap_endian=0 signature file-magic-auto272 { file-mime "audio/x-hx-aac-adif", 70 @@ -1662,17 +978,6 @@ signature file-magic-auto273 { file-magic /(\x30\x26\xb2\x75)/ } -# >0 string,=\212MNG (len=4), ["MNG video data,"], swap_endian=0 -signature file-magic-auto274 { - file-mime "video/x-mng", 70 - file-magic /(\x8aMNG)/ -} - -# >0 string,=\213JNG (len=4), ["JNG video data,"], swap_endian=0 -signature file-magic-auto275 { - file-mime "video/x-jng", 70 - file-magic /(\x8bJNG)/ -} # >0 string,=MAC (len=4), ["Monkey's Audio compressed format"], swap_endian=0 signature file-magic-auto276 { @@ -1713,114 +1018,24 @@ signature file-magic-auto281 { file-magic /(fLaC)/ } -# >0 string,=IIN1 (len=4), ["NIFF image data"], swap_endian=0 -signature file-magic-auto282 { - file-mime "image/x-niff", 70 - file-magic /(IIN1)/ -} - -# >0 string,=MM\000* (len=4), ["TIFF image data, big-endian"], swap_endian=0 -signature file-magic-auto283 { - file-mime "image/tiff", 70 - file-magic /(MM\x00\x2a)/ -} - -# >0 string,=II*\000 (len=4), ["TIFF image data, little-endian"], swap_endian=0 -signature file-magic-auto284 { - file-mime "image/tiff", 70 - file-magic /(II\x2a\x00)/ -} - -# >0 string,=MM\000+ (len=4), ["Big TIFF image data, big-endian"], swap_endian=0 -signature file-magic-auto285 { - file-mime "image/tiff", 70 - file-magic /(MM\x00\x2b)/ -} - -# >0 string,=II+\000 (len=4), ["Big TIFF image data, little-endian"], swap_endian=0 -signature file-magic-auto286 { - file-mime "image/tiff", 70 - file-magic /(II\x2b\x00)/ -} - -# >0 string,=GIF8 (len=4), ["GIF image data"], swap_endian=0 -signature file-magic-auto287 { - file-mime "image/gif", 70 - file-magic /(GIF8)/ -} - # >128 string,=DICM (len=4), ["DICOM medical imaging data"], swap_endian=0 signature file-magic-auto288 { file-mime "application/dicom", 70 file-magic /(.{128})(DICM)/ } -# >0 string,=8BPS (len=4), ["Adobe Photoshop Image"], swap_endian=0 -signature file-magic-auto289 { - file-mime "image/vnd.adobe.photoshop", 70 - file-magic /(8BPS)/ -} - # >0 string,=IMPM (len=4), ["Impulse Tracker module sound data -"], swap_endian=0 signature file-magic-auto290 { file-mime "audio/x-mod", 70 file-magic /(IMPM)/ } -# >0 lelong&,=20000630 (0x01312f76), ["OpenEXR image data,"], swap_endian=0 -signature file-magic-auto291 { - file-mime "image/x-exr", 70 - file-magic /(\x76\x2f\x31\x01)/ -} - -# >0 string,=SDPX (len=4), ["DPX image data, big-endian,"], swap_endian=0 -signature file-magic-auto292 { - file-mime "image/x-dpx", 70 - file-magic /(SDPX)/ -} - # >0 belong&,=235082497 (0x0e031301), ["Hierarchical Data Format (version 4) data"], swap_endian=0 signature file-magic-auto293 { file-mime "application/x-hdf", 70 file-magic /(\x0e\x03\x13\x01)/ } -# >0 string,=CPC\262 (len=4), ["Cartesian Perceptual Compression image"], swap_endian=0 -signature file-magic-auto294 { - file-mime "image/x-cpi", 70 - file-magic /(CPC\xb2)/ -} - -# >0 string,=MMOR (len=4), ["Olympus ORF raw image data, big-endian"], swap_endian=0 -signature file-magic-auto295 { - file-mime "image/x-olympus-orf", 70 - file-magic /(MMOR)/ -} - -# >0 string,=IIRO (len=4), ["Olympus ORF raw image data, little-endian"], swap_endian=0 -signature file-magic-auto296 { - file-mime "image/x-olympus-orf", 70 - file-magic /(IIRO)/ -} - -# >0 string,=IIRS (len=4), ["Olympus ORF raw image data, little-endian"], swap_endian=0 -signature file-magic-auto297 { - file-mime "image/x-olympus-orf", 70 - file-magic /(IIRS)/ -} - -# >0 string,=FOVb (len=4), ["Foveon X3F raw image data"], swap_endian=0 -signature file-magic-auto298 { - file-mime "image/x-x3f", 70 - file-magic /(FOVb)/ -} - -# >0 string,=PDN3 (len=4), ["Paint.NET image data"], swap_endian=0 -signature file-magic-auto299 { - file-mime "image/x-paintnet", 70 - file-magic /(PDN3)/ -} - # >0 belong&,=-17957139 (0xfeedfeed), ["Java KeyStore"], swap_endian=0 signature file-magic-auto302 { file-mime "application/x-java-keystore", 70 @@ -1911,12 +1126,6 @@ signature file-magic-auto316 { file-magic /(\x2e\x72\x61\xfd)/ } -# >0 string,=CTMF (len=4), ["Creative Music (CMF) data"], swap_endian=0 -signature file-magic-auto317 { - file-mime "audio/x-unknown", 70 - file-magic /(CTMF)/ -} - # >0 string,=MThd (len=4), ["Standard MIDI data"], swap_endian=0 signature file-magic-auto318 { file-mime "audio/midi", 70 @@ -2035,36 +1244,6 @@ signature file-magic-auto334 { file-magic /(\x2esnd)(.{8})(\x00\x00\x00\x17)/ } -# >0 string,=SIT! (len=4), ["StuffIt Archive (data)"], swap_endian=0 -signature file-magic-auto335 { - file-mime "application/x-stuffit", 70 - file-magic /(SIT\x21)/ -} - -# >0 string,= (len=4), ["System V Release 1 ar archive"], swap_endian=0 -signature file-magic-auto337 { - file-mime "application/x-archive", 70 - file-magic /(\x3car\x3e)/ -} - -# >0 lelong&ffffffff8080ffff,=2074 (0x0000081a), ["ARC archive data, dynamic LZW"], swap_endian=0 -signature file-magic-auto338 { - file-mime "application/x-arc", 70 - file-magic /([\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f]{2})(\x08\x1a)/ -} - -# >0 lelong&ffffffff8080ffff,=2330 (0x0000091a), ["ARC archive data, squashed"], swap_endian=0 -signature file-magic-auto339 { - file-mime "application/x-arc", 70 - file-magic /([\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f]{2})(\x09\x1a)/ -} - -# >0 lelong&ffffffff8080ffff,=538 (0x0000021a), ["ARC archive data, uncompressed"], swap_endian=0 -signature file-magic-auto340 { - file-mime "application/x-arc", 70 - file-magic /([\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f]{2})(\x02\x1a)/ -} - # >0 lelong&,=270539386 (0x10201a7a), ["Symbian installation file (Symbian OS 9.x)"], swap_endian=0 signature file-magic-auto341 { file-mime "x-epoc/x-sisx-app", 70 @@ -2077,72 +1256,6 @@ signature file-magic-auto342 { file-magic /(.{8})(\x19\x04\x00\x10)/ } -# >0 lelong&ffffffff8080ffff,=794 (0x0000031a), ["ARC archive data, packed"], swap_endian=0 -signature file-magic-auto343 { - file-mime "application/x-arc", 70 - file-magic /([\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f]{2})(\x03\x1a)/ -} - -# >0 belong&,=518520576 (0x1ee7ff00), ["EET archive"], swap_endian=0 -signature file-magic-auto344 { - file-mime "application/x-eet", 70 - file-magic /(\x1e\xe7\xff\x00)/ -} - -# >0 lelong&ffffffff8080ffff,=1050 (0x0000041a), ["ARC archive data, squeezed"], swap_endian=0 -signature file-magic-auto345 { - file-mime "application/x-arc", 70 - file-magic /([\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f]{2})(\x04\x1a)/ -} - -# >0 lelong&ffffffff8080ffff,=1562 (0x0000061a), ["ARC archive data, crunched"], swap_endian=0 -signature file-magic-auto346 { - file-mime "application/x-arc", 70 - file-magic /([\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f]{2})(\x06\x1a)/ -} - -# >0 lelong&ffffffff8080ffff,=2586 (0x00000a1a), ["PAK archive data"], swap_endian=0 -signature file-magic-auto347 { - file-mime "application/x-arc", 70 - file-magic /([\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f]{2})(\x0a\x1a)/ -} - -# >0 lelong&ffffffff8080ffff,=5146 (0x0000141a), ["ARC+ archive data"], swap_endian=0 -signature file-magic-auto348 { - file-mime "application/x-arc", 70 - file-magic /([\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f]{2})(\x14\x1a)/ -} - -# >20 lelong&,=-37443620 (0xfdc4a7dc), ["Zoo archive data"], swap_endian=0 -signature file-magic-auto349 { - file-mime "application/x-zoo", 70 - file-magic /(.{20})(\xdc\xa7\xc4\xfd)/ -} - -# >0 string,=Rar! (len=4), ["RAR archive data,"], swap_endian=0 -signature file-magic-auto350 { - file-mime "application/x-rar", 70 - file-magic /(Rar\x21)/ -} - -# >0 lelong&ffffffff8080ffff,=18458 (0x0000481a), ["HYP archive data"], swap_endian=0 -signature file-magic-auto351 { - file-mime "application/x-arc", 70 - file-magic /([\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f]{2})(\x48\x1a)/ -} - -# >0 string,=drpm (len=4), ["Delta RPM"], swap_endian=0 -signature file-magic-auto352 { - file-mime "application/x-rpm", 70 - file-magic /(drpm)/ -} - -# >0 belong&,=-307499301 (0xedabeedb), ["RPM"], swap_endian=0 -signature file-magic-auto353 { - file-mime "application/x-rpm", 70 - file-magic /(\xed\xab\xee\xdb)/ -} - # >0 string,=RIFF (len=4), ["RIFF (little-endian) data"], swap_endian=0 # >>8 string,=WAVE (len=4), [", WAVE audio"], swap_endian=0 signature file-magic-auto354 { @@ -2150,20 +1263,6 @@ signature file-magic-auto354 { file-magic /(RIFF)(.{4})(WAVE)/ } -# >0 string,=RIFF (len=4), ["RIFF (little-endian) data"], swap_endian=0 -# >>8 string,=CDRA (len=4), [", Corel Draw Picture"], swap_endian=0 -signature file-magic-auto355 { - file-mime "image/x-coreldraw", 70 - file-magic /(RIFF)(.{4})(CDRA)/ -} - -# >0 string,=RIFF (len=4), ["RIFF (little-endian) data"], swap_endian=0 -# >>8 string,=CDR6 (len=4), [", Corel Draw Picture, version 6"], swap_endian=0 -signature file-magic-auto356 { - file-mime "image/x-coreldraw", 70 - file-magic /(RIFF)(.{4})(CDR6)/ -} - # >0 string,=RIFF (len=4), ["RIFF (little-endian) data"], swap_endian=0 # >>8 string,=AVI (len=4), [", AVI"], swap_endian=0 signature file-magic-auto357 { @@ -2290,36 +1389,12 @@ signature file-magic-auto381 { file-magic /(\x3cMML)/ } -# >0 lelong&,=407642370 (0x184c2102), ["LZ4 compressed data, legacy format"], swap_endian=0 -signature file-magic-auto382 { - file-mime "application/x-lz4", 70 - file-magic /(\x02\x21\x4c\x18)/ -} - -# >0 lelong&,=407708164 (0x184d2204), ["LZ4 compressed data"], swap_endian=0 -signature file-magic-auto383 { - file-mime "application/x-lz4", 70 - file-magic /(\x04\x22\x4d\x18)/ -} - -# >0 string,=LRZI (len=4), ["LRZIP compressed data"], swap_endian=0 -# >>5 byte&,x, [".%d"], swap_endian=0 -signature file-magic-auto384 { - file-mime "application/x-lrzip", 1 - file-magic /(LRZI)(.{1})(.{1})/ -} - # >0 string,=OggS (len=4), ["Ogg data"], swap_endian=0 signature file-magic-auto385 { file-mime "application/ogg", 70 file-magic /(OggS)/ } -# >0 string,=LZIP (len=4), ["lzip compressed data"], swap_endian=0 -signature file-magic-auto386 { - file-mime "application/x-lzip", 70 - file-magic /(LZIP)/ -} # >0 belong&,=-889270259 (0xcafed00d), ["JAR compressed with pack200,"], swap_endian=0 # >>4 byte&,x, ["%d"], swap_endian=0 @@ -2335,13 +1410,6 @@ signature file-magic-auto388 { file-magic /(\xca\xfe\xd0\x0d)(.{1})/ } -# >0 regex,=^( |\t){0,50}def {1,50}[a-zA-Z]{1,100} (len=38), [""], swap_endian=0 -# >>&0 regex,= {0,50}\(([a-zA-Z]|,| ){1,500}\):$ (len=34), ["Python script text executable"], swap_endian=0 -signature file-magic-auto389 { - file-mime "text/x-python", 64 - file-magic /(.*)(( |\t){0,50}def {1,50}[a-zA-Z]{1,100})( {0,50}\(([a-zA-Z]|,| ){1,500}\):$)/ -} - # >0 search/4096,=\documentstyle (len=14), ["LaTeX document text"], swap_endian=0 signature file-magic-auto390 { file-mime "text/x-tex", 62 @@ -2383,56 +1451,12 @@ signature file-magic-auto395 { file-magic /(DOC)(.{40})([\x16])/ } -# >0 search/w/1,=#! /usr/local/bin/php (len=21), ["PHP script text executable"], swap_endian=0 -signature file-magic-auto396 { - file-mime "text/x-php", 61 - file-magic /(.*)(\x23\x21 ?\x2fusr\x2flocal\x2fbin\x2fphp)/ -} - -# >0 search/1,=eval '(exit $?0)' && eval 'exec (len=31), ["Perl script text"], swap_endian=0 -signature file-magic-auto397 { - file-mime "text/x-perl", 61 - file-magic /(.*)(eval \x27\x28exit \x24\x3f0\x29\x27 \x26\x26 eval \x27exec)/ -} - -# >0 regex,=^[ \t]*require[ \t]'[A-Za-z_/]+' (len=30), [""], swap_endian=0 -# >>0 regex,=include [A-Z]|def [a-z]| do$ (len=28), [""], swap_endian=0 -# >>>0 regex,=^[ \t]*end([ \t]*[;#].*)?$ (len=24), ["Ruby script text"], swap_endian=0 -signature file-magic-auto398 { - file-mime "text/x-ruby", 54 - file-magic /(.*)([ \x09]*require[ \x09]'[A-Za-z_\x2f]+')(include [A-Z]|def [a-z]| do$)(^[ \x09]*end([ \x09]*[;#].*)?$)/ -} - -# >0 search/1,=eval "exec /usr/local/bin/perl (len=30), ["Perl script text"], swap_endian=0 -signature file-magic-auto399 { - file-mime "text/x-perl", 60 - file-magic /(.*)(eval \x22exec \x2fusr\x2flocal\x2fbin\x2fperl)/ -} - -# >0 string,=FLV (len=3), ["Macromedia Flash Video"], swap_endian=0 -signature file-magic-auto400 { - file-mime "video/x-flv", 60 - file-magic /(FLV)/ -} - # >0 string,=MP+ (len=3), ["Musepack audio"], swap_endian=0 signature file-magic-auto401 { file-mime "audio/x-musepack", 60 file-magic /(MP\x2b)/ } -# >0 string,=PBF (len=3), ["PBF image (deflate compression)"], swap_endian=0 -signature file-magic-auto402 { - file-mime "image/x-unknown", 60 - file-magic /(PBF)/ -} - -# >0 string,=SBI (len=3), ["SoundBlaster instrument data"], swap_endian=0 -signature file-magic-auto403 { - file-mime "audio/x-unknown", 60 - file-magic /(SBI)/ -} - # >0 string,=\004%! (len=3), ["PostScript document text"], swap_endian=0 signature file-magic-auto405 { file-mime "application/postscript", 60 @@ -2445,32 +1469,12 @@ signature file-magic-auto406 { file-magic /(BZh)/ } -# >0 regex,=^[ \t]*(class|module)[ \t][A-Z] (len=29), [""], swap_endian=0 -# >>0 regex,=(modul|includ)e [A-Z]|def [a-z] (len=31), [""], swap_endian=0 -# >>>0 regex,=^[ \t]*end([ \t]*[;#].*)?$ (len=24), ["Ruby module source text"], swap_endian=0 -signature file-magic-auto407 { - file-mime "text/x-ruby", 54 - file-magic /(.*)([ \x09]*(class|module)[ \x09][A-Z])((modul|includ)e [A-Z]|def [a-z])(^[ \x09]*end([ \x09]*[;#].*)?$)/ -} - -# >0 regex/20,=^\.[A-Za-z0-9][A-Za-z0-9][ \t] (len=29), ["troff or preprocessor input text"], swap_endian=0 -#signature file-magic-auto411 { -# file-mime "text/troff", 59 -# file-magic /(^\.[A-Za-z0-9][A-Za-z0-9][ \x09])/ -#} - # >0 search/4096,=\documentclass (len=14), ["LaTeX 2e document text"], swap_endian=0 signature file-magic-auto412 { file-mime "text/x-tex", 59 file-magic /(.*)(\x5cdocumentclass)/ } -# >0 regex,=^from\s+(\w|\.)+\s+import.*$ (len=28), ["Python script text executable"], swap_endian=0 -signature file-magic-auto413 { - file-mime "text/x-python", 58 - file-magic /(.*)(from\s+(\w|\.)+\s+import.*$)/ -} - # >0 search/4096,=\contentsline (len=13), ["LaTeX table of contents"], swap_endian=0 signature file-magic-auto414 { file-mime "text/x-tex", 58 @@ -2489,117 +1493,30 @@ signature file-magic-auto416 { file-magic /(.*)(\x5csection)/ } -# >0 regex/20,=^\.[A-Za-z0-9][A-Za-z0-9]$ (len=26), ["troff or preprocessor input text"], swap_endian=0 -#signature file-magic-auto417 { -# file-mime "text/troff", 56 -# file-magic /(^\.[A-Za-z0-9][A-Za-z0-9]$)/ -#} - -# >0 search/w/1,=#! /usr/bin/php (len=15), ["PHP script text executable"], swap_endian=0 -signature file-magic-auto418 { - file-mime "text/x-php", 55 - file-magic /(.*)(\x23\x21 ?\x2fusr\x2fbin\x2fphp)/ -} - # >0 search/4096,=\setlength (len=10), ["LaTeX document text"], swap_endian=0 signature file-magic-auto419 { file-mime "text/x-tex", 55 file-magic /(.*)(\x5csetlength)/ } -# >0 search/1,=eval "exec /usr/bin/perl (len=24), ["Perl script text"], swap_endian=0 -signature file-magic-auto420 { - file-mime "text/x-perl", 54 - file-magic /(.*)(eval \x22exec \x2fusr\x2fbin\x2fperl)/ -} - # >0 search/1,=Common subdirectories: (len=23), ["diff output text"], swap_endian=0 signature file-magic-auto422 { file-mime "text/x-diff", 53 file-magic /(.*)(Common subdirectories\x3a )/ } -# >0 search/w/1,=#! /usr/local/bin/wish (len=22), ["Tcl/Tk script text executable"], swap_endian=0 -signature file-magic-auto425 { - file-mime "text/x-tcl", 52 - file-magic /(.*)(\x23\x21 ?\x2fusr\x2flocal\x2fbin\x2fwish)/ -} - # >0 search/4096,=(custom-set-variables (len=22), ["Lisp/Scheme program text"], swap_endian=0 signature file-magic-auto426 { file-mime "text/x-lisp", 52 file-magic /(.*)(\x28custom\x2dset\x2dvariables )/ } -# >0 beshort&,=-40 (0xffd8), ["JPEG image data"], swap_endian=0 -signature file-magic-auto427 { - file-mime "image/jpeg", 52 - file-magic /(\xff\xd8)/ -} - -# >0 search/1,=#!/usr/bin/env nodejs (len=21), ["Node.js script text executable"], swap_endian=0 -signature file-magic-auto429 { - file-mime "application/javascript", 51 - file-magic /(.*)(\x23\x21\x2fusr\x2fbin\x2fenv nodejs)/ -} - -# >0 search/w/1,=#! /usr/local/bin/tcl (len=21), ["Tcl script text executable"], swap_endian=0 -signature file-magic-auto430 { - file-mime "text/x-tcl", 51 - file-magic /(.*)(\x23\x21 ?\x2fusr\x2flocal\x2fbin\x2ftcl)/ -} - -# This didn't autogenerate well due to indirect offset, bitmasking, and -# relational comparisons. -# >0 leshort&fffffffffffffefe,=0 (0x0000), [""], swap_endian=0 -# >>4 ulelong&fcfffe00,=0 (0x00000000), [""], swap_endian=0 -# >>>68 ulelong&,>87 (0x00000057), [""], swap_endian=0 -# >>>>68 (lelong,-1), ubelong&ffe0c519,=4194328 (0x00400018), ["Windows Precompiled iNF"], swap_endian=0 -#signature file-magic-auto431 { -# file-mime "application/x-pnf", 70 -# file-magic /(.{2})(.{2})(.{4})(.{60})(.{4})(.{4})/ -#} - -# >0 search/w/1,=#! /usr/local/bin/lua (len=21), ["Lua script text executable"], swap_endian=0 -signature file-magic-auto432 { - file-mime "text/x-lua", 51 - file-magic /(.*)(\x23\x21 ?\x2fusr\x2flocal\x2fbin\x2flua)/ -} - # >0 string/b,=MZ (len=2), [""], swap_endian=0 signature file-magic-auto433 { file-mime "application/x-dosexec", 51 file-magic /(MZ)/ } -# >0 string/b,=MZ (len=2), [""], swap_endian=0 -# >>30 string,=Copyright 1989-1990 PKWARE Inc. (len=31), ["Self-extracting PKZIP archive"], swap_endian=0 -signature file-magic-auto434 { - file-mime "application/zip", 340 - file-magic /(MZ)(.{28})(Copyright 1989\x2d1990 PKWARE Inc\x2e)/ -} - -# >0 string/b,=MZ (len=2), [""], swap_endian=0 -# >>30 string,=PKLITE Copr. (len=12), ["Self-extracting PKZIP archive"], swap_endian=0 -signature file-magic-auto435 { - file-mime "application/zip", 150 - file-magic /(MZ)(.{28})(PKLITE Copr\x2e)/ -} - -# >0 string/b,=MZ (len=2), [""], swap_endian=0 -# >>36 string,=LHa's SFX (len=9), [", LHa self-extracting archive"], swap_endian=0 -signature file-magic-auto436 { - file-mime "application/x-lha", 120 - file-magic /(MZ)(.{34})(LHa\x27s SFX)/ -} - -# >0 string/b,=MZ (len=2), [""], swap_endian=0 -# >>36 string,=LHA's SFX (len=9), [", LHa self-extracting archive"], swap_endian=0 -signature file-magic-auto437 { - file-mime "application/x-lha", 120 - file-magic /(MZ)(.{34})(LHA\x27s SFX)/ -} - # >0 beshort&fffffffffffffffe,=-6 (0xfffa), [""], swap_endian=0 # >>2 byte&fffffffffffffff0,=0x10, ["MPEG ADTS, layer III, v1, 32 kbps"], swap_endian=0 signature file-magic-auto438 { @@ -2698,64 +1615,6 @@ signature file-magic-auto451 { file-magic /(\xff[\xfa\xfb])([\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef])/ } -# >4 leshort&,=-20719 (0xaf11), [""], swap_endian=0 -# >>8 leshort&,=320 (0x0140), [""], swap_endian=0 -# >>>10 leshort&,=200 (0x00c8), [""], swap_endian=0 -# >>>>12 leshort&,=8 (0x0008), ["FLI animation, 320x200x8"], swap_endian=0 -signature file-magic-auto452 { - file-mime "video/x-fli", 50 - file-magic /(.{4})(\x11\xaf)(.{2})(\x40\x01)(\xc8\x00)(\x08\x00)/ -} - -# >4 leshort&,=-20718 (0xaf12), [""], swap_endian=0 -# >>12 leshort&,=8 (0x0008), ["FLC animation"], swap_endian=0 -signature file-magic-auto453 { - file-mime "video/x-flc", 50 - file-magic /(.{4})(\x12\xaf)(.{6})(\x08\x00)/ -} - -# >0 string,=BM (len=2), [""], swap_endian=0 -# >>14 leshort&,=12 (0x000c), ["PC bitmap, OS/2 1.x format"], swap_endian=0 -signature file-magic-auto454 { - file-mime "image/x-ms-bmp", 50 - file-magic /(BM)(.{12})(\x0c\x00)/ -} - -# >0 string,=BM (len=2), [""], swap_endian=0 -# >>14 leshort&,=64 (0x0040), ["PC bitmap, OS/2 2.x format"], swap_endian=0 -signature file-magic-auto455 { - file-mime "image/x-ms-bmp", 50 - file-magic /(BM)(.{12})(\x40\x00)/ -} - -# >0 string,=BM (len=2), [""], swap_endian=0 -# >>14 leshort&,=40 (0x0028), ["PC bitmap, Windows 3.x format"], swap_endian=0 -signature file-magic-auto456 { - file-mime "image/x-ms-bmp", 50 - file-magic /(BM)(.{12})(\x28\x00)/ -} - -# >0 string,=BM (len=2), [""], swap_endian=0 -# >>14 leshort&,=124 (0x007c), ["PC bitmap, Windows 98/2000 and newer format"], swap_endian=0 -signature file-magic-auto457 { - file-mime "image/x-ms-bmp", 50 - file-magic /(BM)(.{12})(\x7c\x00)/ -} - -# >0 string,=BM (len=2), [""], swap_endian=0 -# >>14 leshort&,=108 (0x006c), ["PC bitmap, Windows 95/NT4 and newer format"], swap_endian=0 -signature file-magic-auto458 { - file-mime "image/x-ms-bmp", 50 - file-magic /(BM)(.{12})(\x6c\x00)/ -} - -# >0 string,=BM (len=2), [""], swap_endian=0 -# >>14 leshort&,=128 (0x0080), ["PC bitmap, Windows NT/2000 format"], swap_endian=0 -signature file-magic-auto459 { - file-mime "image/x-ms-bmp", 50 - file-magic /(BM)(.{12})(\x80\x00)/ -} - # >20 string,=45 (len=2), [""], swap_endian=0 # >>0 regex/1,=(^[0-9]{5})[acdnp][^bhlnqsu-z] (len=30), ["MARC21 Bibliographic"], swap_endian=0 signature file-magic-auto460 { @@ -2786,37 +1645,7 @@ signature file-magic-auto463 { # >0 search/4096,=\begin (len=6), ["LaTeX document text"], swap_endian=0 signature file-magic-auto464 { file-mime "text/x-tex", 51 - file-magic /(.*)(\x5cbegin)/ -} - -# >0 search/4096,=\input (len=6), ["TeX document text"], swap_endian=0 -signature file-magic-auto465 { - file-mime "text/x-tex", 51 - file-magic /(.*)(\x5cinput)/ -} - -# >0 leshort&,=-24712 (0x9f78), ["TNEF"], swap_endian=0 -signature file-magic-auto466 { - file-mime "application/vnd.ms-tnef", 50 - file-magic /(\x78\x9f)/ -} - -# >0 leshort&,=-5536 (0xea60), ["ARJ archive data"], swap_endian=0 -signature file-magic-auto467 { - file-mime "application/x-arj", 50 - file-magic /(\x60\xea)/ -} - -# >0 search/1,=eval "exec /bin/perl (len=20), ["Perl script text"], swap_endian=0 -signature file-magic-auto468 { - file-mime "text/x-perl", 50 - file-magic /(.*)(eval \x22exec \x2fbin\x2fperl)/ -} - -# >0 search/1,=#! /usr/bin/env perl (len=20), ["Perl script text executable"], swap_endian=0 -signature file-magic-auto469 { - file-mime "text/x-perl", 50 - file-magic /(.*)(\x23\x21 \x2fusr\x2fbin\x2fenv perl)/ + file-magic /.*\x5c(input|begin)/ } # >0 beshort&,=-26368 (0x9900), ["PGP key public ring"], swap_endian=0 @@ -2869,42 +1698,6 @@ signature file-magic-auto478 { file-magic /((^[0-9]{5})[acdn][w])((^.{21})([^0]{2}))/ } -# >0 short&,=-14479 (0xc771), ["byte-swapped cpio archive"], swap_endian=0 -signature file-magic-auto479 { - file-mime "application/x-cpio", 50 - file-magic /((\x71\xc7)|(\xc7\x71))/ -} - -# >0 short&,=29127 (0x71c7), ["cpio archive"], swap_endian=0 -signature file-magic-auto480 { - file-mime "application/x-cpio", 50 - file-magic /((\xc7\x71)|(\x71\xc7))/ -} - -# >0 string,=\n( (len=2), ["Emacs v18 byte-compiled Lisp data"], swap_endian=0 -#signature file-magic-auto481 { -# file-mime "application/x-elc", 50 -# file-magic /(\x0a\x28)/ -#} - -# >0 string,=\021\t (len=2), ["Award BIOS Logo, 136 x 126"], swap_endian=0 -signature file-magic-auto482 { - file-mime "image/x-award-bioslogo", 50 - file-magic /(\x11\x09)/ -} - -# >0 string,=\021\006 (len=2), ["Award BIOS Logo, 136 x 84"], swap_endian=0 -signature file-magic-auto483 { - file-mime "image/x-award-bioslogo", 50 - file-magic /(\x11\x06)/ -} - -# >0 string,=P7 (len=2), ["Netpbm PAM image file"], swap_endian=0 -signature file-magic-auto484 { - file-mime "image/x-portable-pixmap", 50 - file-magic /(P7)/ -} - # >0 beshort&ffffffffffffffe0,=22240 (0x56e0), ["MPEG-4 LOAS"], swap_endian=0 signature file-magic-auto485 { file-mime "audio/x-mp4a-latm", 50 @@ -2941,12 +1734,6 @@ signature file-magic-auto490 { file-magic /(\xff[\xfc\xfd])/ } -# >0 search/1,=#! /usr/bin/env wish (len=20), ["Tcl/Tk script text executable"], swap_endian=0 -signature file-magic-auto491 { - file-mime "text/x-tcl", 50 - file-magic /(.*)(\x23\x21 \x2fusr\x2fbin\x2fenv wish)/ -} - # >0 beshort&,=-26367 (0x9901), ["GPG key public ring"], swap_endian=0 signature file-magic-auto492 { file-mime "application/x-gnupg-keyring", 50 @@ -2959,79 +1746,12 @@ signature file-magic-auto493 { file-magic /(\xf7\x02)/ } -## >2 string,=\000\021 (len=2), ["TeX font metric data"], swap_endian=0 -#signature file-magic-auto494 { -# file-mime "application/x-tex-tfm", 50 -# file-magic /(.{2})(\x00\x11)/ -#} -# -## >2 string,=\000\022 (len=2), ["TeX font metric data"], swap_endian=0 -#signature file-magic-auto495 { -# file-mime "application/x-tex-tfm", 50 -# file-magic /(.{2})(\x00\x12)/ -#} - # >0 beshort&,=-31486 (0x8502), ["GPG encrypted data"], swap_endian=0 signature file-magic-auto496 { file-mime "text/PGP", 50 file-magic /(\x85\x02)/ } -# >4 string/W,=jP (len=2), ["JPEG 2000 image"], swap_endian=0 -signature file-magic-auto497 { - file-mime "image/jp2", 50 - file-magic /(.{4})(jP)/ -} - -# Not specific enough. -# >0 regex,=^template[ \t\n]+ (len=15), ["C++ source text"], swap_endian=0 -#signature file-magic-auto498 { -# file-mime "text/x-c++", 50 -# file-magic /(.*)(template[ \x09\x0a]+)/ -#} - -# >0 search/c/1,=0 string,=\037\235 (len=2), ["compress'd data"], swap_endian=0 -signature file-magic-auto500 { - file-mime "application/x-compress", 50 - file-magic /(\x1f\x9d)/ -} - -# >0 string,=\037\036 (len=2), ["packed data"], swap_endian=0 -#signature file-magic-auto501 { -# file-mime "application/octet-stream", 50 -# file-magic /(\x1f\x1e)/ -#} - -# >0 short&,=7967 (0x1f1f), ["old packed data"], swap_endian=0 -#signature file-magic-auto502 { -# file-mime "application/octet-stream", 50 -# file-magic /((\x1f\x1f)|(\x1f\x1f))/ -#} - -# >0 short&,=8191 (0x1fff), ["compacted data"], swap_endian=0 -#signature file-magic-auto503 { -# file-mime "application/octet-stream", 50 -# file-magic /((\xff\x1f)|(\x1f\xff))/ -#} - -# >0 string,=\377\037 (len=2), ["compacted data"], swap_endian=0 -#signature file-magic-auto504 { -# file-mime "application/octet-stream", 50 -# file-magic /(\xff\x1f)/ -#} - -# >0 short&,=-13563 (0xcb05), ["huf output"], swap_endian=0 -#signature file-magic-auto505 { -# file-mime "application/octet-stream", 50 -# file-magic /((\x05\xcb)|(\xcb\x05))/ -#} - # >34 string,=LP (len=2), ["Embedded OpenType (EOT)"], swap_endian=0 signature file-magic-auto506 { file-mime "application/vnd.ms-fontobject", 50 @@ -3044,130 +1764,12 @@ signature file-magic-auto507 { file-magic /(\x0b\x77)/ } -# >0 search/1,=#!/usr/bin/env node (len=19), ["Node.js script text executable"], swap_endian=0 -signature file-magic-auto508 { - file-mime "application/javascript", 49 - file-magic /(.*)(\x23\x21\x2fusr\x2fbin\x2fenv node)/ -} - -# >0 search/1,=#!/usr/bin/env wish (len=19), ["Tcl/Tk script text executable"], swap_endian=0 -signature file-magic-auto509 { - file-mime "text/x-tcl", 49 - file-magic /(.*)(\x23\x21\x2fusr\x2fbin\x2fenv wish)/ -} - -# >0 regex,=^[ \t]{0,50}\.asciiz (len=19), ["assembler source text"], swap_endian=0 -signature file-magic-auto510 { - file-mime "text/x-asm", 49 - file-magic /(^[ \x09]{0,50}\.(asciiz|asciz|section|globl|align|even|byte|file|type))/ -} - -# >0 regex,=^[ \t]{0,50}\.globl (len=18), ["assembler source text"], swap_endian=0 -#signature file-magic-auto517 { -# file-mime "text/x-asm", 48 -# file-magic /(^[ \x09]{0,50}\.globl)/ -#} - -# >0 regex,=^[ \t]{0,50}\.text (len=17), ["assembler source text"], swap_endian=0 -#signature file-magic-auto523 { -# file-mime "text/x-asm", 47 -# file-magic /(^[ \x09]{0,50}\.text)/ -#} - -# >0 regex,=^[ \t]{0,50}\.even (len=17), ["assembler source text"], swap_endian=0 -#signature file-magic-auto524 { -# file-mime "text/x-asm", 47 -# file-magic /(^[ \x09]{0,50}\.even)/ -#} - -# >0 regex,=^[ \t]{0,50}\.byte (len=17), ["assembler source text"], swap_endian=0 -#signature file-magic-auto525 { -# file-mime "text/x-asm", 47 -# file-magic /(^[ \x09]{0,50}\.byte)/ -#} - -# >0 regex,=^[ \t]{0,50}\.file (len=17), ["assembler source text"], swap_endian=0 -#signature file-magic-auto526 { -# file-mime "text/x-asm", 47 -# file-magic /(^[ \x09]{0,50}\.file)/ -#} - -# >0 regex,=^[ \t]{0,50}\.type (len=17), ["assembler source text"], swap_endian=0 -#signature file-magic-auto527 { -# file-mime "text/x-asm", 47 -# file-magic /(^[ \x09]{0,50}\.type)/ -#} - - -# >0 search/1,=#!/usr/bin/env perl (len=19), ["Perl script text executable"], swap_endian=0 -signature file-magic-auto511 { - file-mime "text/x-perl", 49 - file-magic /(.*)(\x23\x21\x2fusr\x2fbin\x2fenv perl)/ -} - -# >0 search/Wct/4096,=0 regex,=^virtual[ \t\n]+ (len=14), ["C++ source text"], swap_endian=0 -#signature file-magic-auto513 { -# file-mime "text/x-c++", 49 -# file-magic /(.*)(virtual[ \x09\x0a]+)/ -#} - -# >0 search/1,=#! /usr/bin/env lua (len=19), ["Lua script text executable"], swap_endian=0 -signature file-magic-auto514 { - file-mime "text/x-lua", 49 - file-magic /(.*)(\x23\x21 \x2fusr\x2fbin\x2fenv lua)/ -} - -# >0 search/1,=#! /usr/bin/env tcl (len=19), ["Tcl script text executable"], swap_endian=0 -signature file-magic-auto516 { - file-mime "text/x-tcl", 49 - file-magic /(.*)(\x23\x21 \x2fusr\x2fbin\x2fenv tcl)/ -} -# >0 search/1,=#!/usr/bin/env tcl (len=18), ["Tcl script text executable"], swap_endian=0 -signature file-magic-auto518 { - file-mime "text/x-tcl", 48 - file-magic /(.*)(\x23\x21\x2fusr\x2fbin\x2fenv tcl)/ -} - -# >0 search/1,=#!/usr/bin/env lua (len=18), ["Lua script text executable"], swap_endian=0 -signature file-magic-auto519 { - file-mime "text/x-lua", 48 - file-magic /(.*)(\x23\x21\x2fusr\x2fbin\x2fenv lua)/ -} - -# >0 search/w/1,=#!/usr/bin/nodejs (len=17), ["Node.js script text executable"], swap_endian=0 -signature file-magic-auto521 { - file-mime "application/javascript", 47 - file-magic /(.*)(\x23\x21\x2fusr\x2fbin\x2fnodejs)/ -} - -# >0 regex,=^class[ \t\n]+ (len=12), ["C++ source text"], swap_endian=0 -#signature file-magic-auto522 { -# file-mime "text/x-c++", 47 -# file-magic /(.*)(class[ \x09\x0a]+[[:alnum:]_]+)(.*)(\x7b)(.*)(public:)/ -#} - # >0 search/1,=This is Info file (len=17), ["GNU Info text"], swap_endian=0 signature file-magic-auto528 { file-mime "text/x-info", 47 file-magic /(.*)(This is Info file)/ } -# >0 regex/s,=\`(\r\n|;|[[]|\377\376) (len=15), [""], swap_endian=0 -# >>&0 search/8192,=[ (len=1), [""], swap_endian=0 -# >>>&0 regex/c,=^(autorun)]\r\n (len=13), [""], swap_endian=0 -# >>>>&0 ubyte&,=0x5b, ["INItialization configuration"], swap_endian=0 -signature file-magic-auto529 { - file-mime "application/x-wine-extension-ini", 40 - file-magic /(\`(\x0d\x0a|;|[[]|\xff\xfe))(.*)(\x5b)(^([aA][uU][tT][oO][rR][uU][nN])]\x0d\x0a)([\x5b])/ -} - # >0 regex/s,=\`(\r\n|;|[[]|\377\376) (len=15), [""], swap_endian=0 # >>&0 search/8192,=[ (len=1), [""], swap_endian=0 # >>>&0 regex/c,=^(autorun)]\r\n (len=13), [""], swap_endian=0 @@ -3185,70 +1787,6 @@ signature file-magic-auto531 { file-magic /(\`(\x0d\x0a|;|[[]|\xff\xfe))(.*)(\x5b)(^([vV][eE][rR][sS][iI][oO][nN]|[sS][tT][rR][iI][nN][gG][sS])])/ } -# >0 regex/s,=\`(\r\n|;|[[]|\377\376) (len=15), [""], swap_endian=0 -# >>&0 search/8192,=[ (len=1), [""], swap_endian=0 -# >>>&0 regex/c,=^(WinsockCRCList|OEMCPL)] (len=25), ["Windows setup INFormation"], swap_endian=0 -signature file-magic-auto532 { - file-mime "text/inf", 55 - file-magic /(\`(\x0d\x0a|;|[[]|\xff\xfe))(.*)(\x5b)(^([Ww][iI][nN][sS][oO][cC][kK][Cc][Rr][Cc][Ll][iI][sS][tT]|[Oo][Ee][Mm][Cc][Pp][Ll])])/ -} - -# >0 regex/s,=\`(\r\n|;|[[]|\377\376) (len=15), [""], swap_endian=0 -# >>&0 search/8192,=[ (len=1), [""], swap_endian=0 -# >>>&0 regex/c,=^(.ShellClassInfo|DeleteOnCopy|LocalizedFileNames)] (len=51), ["Windows desktop.ini"], swap_endian=0 -signature file-magic-auto533 { - file-mime "application/x-wine-extension-ini", 81 - file-magic /(\`(\x0d\x0a|;|[[]|\xff\xfe))(.*)(\x5b)(^(.[Ss][hH][eE][lL][lL][Cc][lL][aA][sS][sS][Ii][nN][fF][oO]|[Dd][eE][lL][eE][tT][eE][Oo][nN][Cc][oO][pP][yY]|[Ll][oO][cC][aA][lL][iI][zZ][eE][dD][Ff][iI][lL][eE][Nn][aA][mM][eE][sS])])/ -} - -# >0 regex/s,=\`(\r\n|;|[[]|\377\376) (len=15), [""], swap_endian=0 -# >>&0 search/8192,=[ (len=1), [""], swap_endian=0 -# >>>&0 regex/c,=^(don't load)] (len=14), ["Windows CONTROL.INI"], swap_endian=0 -signature file-magic-auto534 { - file-mime "application/x-wine-extension-ini", 44 - file-magic /(\`(\x0d\x0a|;|[[]|\xff\xfe))(.*)(\x5b)(^([dD][oO][nN]'[tT] [lL][oO][aA][dD])])/ -} - -# >0 regex/s,=\`(\r\n|;|[[]|\377\376) (len=15), [""], swap_endian=0 -# >>&0 search/8192,=[ (len=1), [""], swap_endian=0 -# >>>&0 regex/c,=^(ndishlp\$|protman\$|NETBEUI\$)] (len=33), ["Windows PROTOCOL.INI"], swap_endian=0 -signature file-magic-auto535 { - file-mime "application/x-wine-extension-ini", 63 - file-magic /(\`(\x0d\x0a|;|[[]|\xff\xfe))(.*)(\x5b)(^([nN][dD][iI][sS][hH][lL][pP]\$|[pP][rR][oO][tT][mM][aA][nN]\$|[Nn][Ee][Tt][Bb][Ee][Uu][Ii]\$)])/ -} - -# >0 regex/s,=\`(\r\n|;|[[]|\377\376) (len=15), [""], swap_endian=0 -# >>&0 search/8192,=[ (len=1), [""], swap_endian=0 -# >>>&0 regex/c,=^(windows|Compatibility|embedding)] (len=35), ["Windows WIN.INI"], swap_endian=0 -signature file-magic-auto536 { - file-mime "application/x-wine-extension-ini", 65 - file-magic /(\`(\x0d\x0a|;|[[]|\xff\xfe))(.*)(\x5b)(^([wW][iI][nN][dD][oO][wW][sS]|[Cc][oO][mM][pP][aA][tT][iI][bB][iI][lL][iI][tT][yY]|[eE][mM][bB][eE][dD][dD][iI][nN][gG])])/ -} - -# >0 regex/s,=\`(\r\n|;|[[]|\377\376) (len=15), [""], swap_endian=0 -# >>&0 search/8192,=[ (len=1), [""], swap_endian=0 -# >>>&0 regex/c,=^(boot|386enh|drivers)] (len=23), ["Windows SYSTEM.INI"], swap_endian=0 -signature file-magic-auto537 { - file-mime "application/x-wine-extension-ini", 53 - file-magic /(\`(\x0d\x0a|;|[[]|\xff\xfe))(.*)(\x5b)(^([bB][oO][oO][tT]|386[eE][nN][hH]|[dD][rR][iI][vV][eE][rR][sS])])/ -} - -# >0 regex/s,=\`(\r\n|;|[[]|\377\376) (len=15), [""], swap_endian=0 -# >>&0 search/8192,=[ (len=1), [""], swap_endian=0 -# >>>&0 regex/c,=^(SafeList)] (len=12), ["Windows IOS.INI"], swap_endian=0 -signature file-magic-auto538 { - file-mime "application/x-wine-extension-ini", 42 - file-magic /(\`(\x0d\x0a|;|[[]|\xff\xfe))(.*)(\x5b)(^([Ss][aA][fF][eE][Ll][iI][sS][tT])])/ -} - -# >0 regex/s,=\`(\r\n|;|[[]|\377\376) (len=15), [""], swap_endian=0 -# >>&0 search/8192,=[ (len=1), [""], swap_endian=0 -# >>>&0 regex/c,=^(boot loader)] (len=15), ["Windows boot.ini"], swap_endian=0 -signature file-magic-auto539 { - file-mime "application/x-wine-extension-ini", 45 - file-magic /(\`(\x0d\x0a|;|[[]|\xff\xfe))(.*)(\x5b)(^([bB][oO][oO][tT] [lL][oO][aA][dD][eE][rR])])/ -} - # >0 regex/s,=\`(\r\n|;|[[]|\377\376) (len=15), [""], swap_endian=0 # >>&0 search/8192,=[ (len=1), [""], swap_endian=0 # >>>&0 ubequad&ffdfffdfffdfffdf,=24207144355233875 (0x0056004500520053), [""], swap_endian=0 @@ -3288,138 +1826,26 @@ signature file-magic-auto543 { file-magic /(\`(\x0d\x0a|;|[[]|\xff\xfe))(.*)(\x5b)(.*)(\x5b)(\x00[\x56\x76]\x00[\x45\x65]\x00[\x52\x72]\x00[\x53\x73])(\x00[\x49\x69]\x00[\x4f\x6f]\x00[\x4e\x6e]\x00\x5d)/ } +# >0 regex/s,=\`(\r\n|;|[[]|\377\376) (len=15), [""], swap_endian=0 +# >>&0 search/8192,=[ (len=1), [""], swap_endian=0 +# >>>&0 regex/c,=^(WinsockCRCList|OEMCPL)] (len=25), ["Windows setup INFormation"], swap_endian=0 +signature file-magic-auto532 { + file-mime "text/inf", 55 + file-magic /(\`(\x0d\x0a|;|[[]|\xff\xfe))(.*)(\x5b)(^([Ww][iI][nN][sS][oO][cC][kK][Cc][Rr][Cc][Ll][iI][sS][tT]|[Oo][Ee][Mm][Cc][Pp][Ll])])/ +} + # >0 search/1,=0 search/w/1,=#! /usr/bin/wish (len=16), ["Tcl/Tk script text executable"], swap_endian=0 -signature file-magic-auto545 { - file-mime "text/x-tcl", 46 - file-magic /(.*)(\x23\x21 ?\x2fusr\x2fbin\x2fwish)/ -} - -# >0 search/w/1,=#! /usr/bin/lua (len=15), ["Lua script text executable"], swap_endian=0 -signature file-magic-auto547 { - file-mime "text/x-lua", 45 - file-magic /(.*)(\x23\x21 ?\x2fusr\x2fbin\x2flua)/ -} - -# >0 search/w/1,=#! /usr/bin/tcl (len=15), ["Tcl script text executable"], swap_endian=0 -signature file-magic-auto548 { - file-mime "text/x-tcl", 45 - file-magic /(.*)(\x23\x21 ?\x2fusr\x2fbin\x2ftcl)/ -} - -# >0 search/wct/4096,=0 search/wct/4096,=0 search/w/1,=#!/usr/bin/node (len=15), ["Node.js script text executable"], swap_endian=0 -signature file-magic-auto551 { - file-mime "application/javascript", 45 - file-magic /(.*)(\x23\x21\x2fusr\x2fbin\x2fnode)/ -} - -# >0 search/wct/1,=0 search/1,=\input texinfo (len=14), ["Texinfo source text"], swap_endian=0 -signature file-magic-auto553 { - file-mime "text/x-texinfo", 44 - file-magic /(.*)(\x5cinput texinfo)/ -} - -# Not specific enough. -# >0 regex,=^private: (len=9), ["C++ source text"], swap_endian=0 -#signature file-magic-auto554 { -# file-mime "text/x-c++", 44 -# file-magic /(.*)(private:)/ -#} - -# >0 search/4096,=def __init__ (len=12), [""], swap_endian=0 -# >>&0 search/64,=self (len=4), ["Python script text executable"], swap_endian=0 -signature file-magic-auto555 { - file-mime "text/x-python", 38 - file-magic /(.*)(def \x5f\x5finit\x5f\x5f)(.*)(self)/ -} - -# >0 search/wct/4096,=0 regex,=^extern[ \t\n]+ (len=13), ["C source text"], swap_endian=0 -#signature file-magic-auto557 { -# file-mime "text/x-c", 43 -# file-magic /(.*)(extern[ \x09\x0a]+)/ -#} - # >0 search/4096,=% -*-latex-*- (len=13), ["LaTeX document text"], swap_endian=0 signature file-magic-auto558 { file-mime "text/x-tex", 43 file-magic /(.*)(\x25 \x2d\x2a\x2dlatex\x2d\x2a\x2d)/ } -# Doesn't seem specific enough. -# >0 regex,=^double[ \t\n]+ (len=13), ["C source text"], swap_endian=0 -#signature file-magic-auto559 { -# file-mime "text/x-c", 43 -# file-magic /(^double[ \x09\x0a]+)/ -#} - -# >0 regex,=^struct[ \t\n]+ (len=13), ["C source text"], swap_endian=0 -#signature file-magic-auto560 { -# file-mime "text/x-c", 43 -# file-magic /(.*)(struct[ \x09\x0a]+)/ -#} - -# >0 search/w/1,=#!/bin/nodejs (len=13), ["Node.js script text executable"], swap_endian=0 -signature file-magic-auto561 { - file-mime "application/javascript", 43 - file-magic /(.*)(\x23\x21\x2fbin\x2fnodejs)/ -} - -# Not specific enough. -# >0 regex,=^public: (len=8), ["C++ source text"], swap_endian=0 -#signature file-magic-auto562 { -# file-mime "text/x-c++", 43 -# file-magic /(.*)(public:)/ -#} - -# >0 search/wct/4096,=