Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

signatures: Fix ISO 9960 signature

Browse source 
This signature only really works when default_file_bof_buffer_size is bumped
to a sufficient value (40k).
This commit is contained in:
Arne Welzel 2024-02-21 10:28:25 +01:00
parent 036bcfe919
commit d2409dd432
4 changed files with 30 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

13
scripts/base/frameworks/files/magic/general.sig
View file

@ -297,8 +297,17 @@ signature file-windows-minidump {
file-magic /^MDMP/
}
# ISO 9660 disk image
# ISO 9660 disk image: First 16 sectors (2k) are arbitrary data.
# The following sector is a volume descriptor with magic string "CD001"
# at offset 1: 16 * 2048 + 1 = 32769
signature file-iso9660 {
file-mime "application/x-iso9660-image", 99
file-magic /CD001/
file-magic /^.{32769}CD001/
}
# ISO 9660 disk image, magic string match in next volume descriptor.
# 17 * 2048 + 1 = 34817
signature file-iso9660-2 {
file-mime "application/x-iso9660-image", 99
file-magic /^.{34817}CD001/
}