parser

Documentation

Index

• type Adjustment
• type Endianness
  • func (en Endianness) ByteOrder() binary.ByteOrder
  • func (en Endianness) MaybeSwapped(swap bool) Endianness
  • func (en Endianness) String() string
  • func (en Endianness) Swapped() Endianness
• type IndirectOffset
• type IntegerKind
• type IntegerTest
• type Kind
  • func (k Kind) String() string
• type KindFamily
• type LogFunc
• type Offset
  • func (o Offset) Equals(b Offset) bool
  • func (o Offset) String() string
• type OffsetType
• type ParseContext
  • func (ctx *ParseContext) Parse(magicReader io.Reader, book Spellbook) error
  • func (ctx *ParseContext) ParseAll(magdir string, book Spellbook) error
• type Rule
  • func (r Rule) String() string
• type SearchKind
• type Spellbook
  • func (sb Spellbook) AddRule(page string, rule Rule)
• type StringKind
• type SwitchCase
• type SwitchKind
• type UseKind

Types

type Adjustment

type Adjustment int

Adjustment describes which operation to apply to an offset

const (
	// AdjustmentNone is a no-op
	AdjustmentNone Adjustment = iota
	// AdjustmentAdd adds a value
	AdjustmentAdd
	// AdjustmentSub subtracts a value
	AdjustmentSub
	// AdjustmentMul multiplies by a value
	AdjustmentMul
	// AdjustmentDiv divides by a value
	AdjustmentDiv
)

type Endianness

type Endianness int

Endianness describes the order in which a multi-byte number is stored

const (
	// LittleEndian numbers are stored with the least significant byte first
	LittleEndian Endianness = iota
	// BigEndian numbers are stored with the most significant byte first
	BigEndian
)

func (Endianness) ByteOrder

func (en Endianness) ByteOrder() binary.ByteOrder

ByteOrder translates our in-house Endianness constant into a binary.ByteOrder decoder

func (Endianness) MaybeSwapped

func (en Endianness) MaybeSwapped(swap bool) Endianness

MaybeSwapped returns swapped endianness if swap is true

func (Endianness) String

func (en Endianness) String() string

func (Endianness) Swapped

func (en Endianness) Swapped() Endianness

Swapped returns LittleEndian if you give it BigEndian, and vice versa

type IndirectOffset

type IndirectOffset struct {
	IsRelative                 bool
	ByteWidth                  int
	Endianness                 Endianness
	OffsetAddress              int64
	OffsetAdjustmentType       Adjustment
	OffsetAdjustmentIsRelative bool
	OffsetAdjustmentValue      int64
}

IndirectOffset indicates where to look in a file to find the real offset

type IntegerKind

type IntegerKind struct {
	ByteWidth       int
	Endianness      Endianness
	Signed          bool
	DoAnd           bool
	AndValue        uint64
	IntegerTest     IntegerTest
	Value           int64
	MatchAny        bool
	AdjustmentType  Adjustment
	AdjustmentValue int64
}

IntegerKind describes how to perform a test on an integer

type IntegerTest

type IntegerTest int

IntegerTest describes which comparison to perform on an integer

const (
	// IntegerTestEqual tests that two integers have the same value
	IntegerTestEqual IntegerTest = iota
	// IntegerTestNotEqual tests that two integers have different values
	IntegerTestNotEqual
	// IntegerTestLessThan tests that one integer is less than the other
	IntegerTestLessThan
	// IntegerTestGreaterThan tests that one integer is greater than the other
	IntegerTestGreaterThan
	// IntegerTestAnd tests that all the bits in the pattern are set
	IntegerTestAnd
)

type Kind

type Kind struct {
	Family KindFamily
	Data   interface{}
}

Kind describes the type of tests a magic rule performs

func (Kind) String

func (k Kind) String() string

type KindFamily

type KindFamily int

KindFamily groups tests in families (all integer tests, for example)

const (
	// KindFamilyInteger tests numbers for equality, inequality, etc.
	KindFamilyInteger KindFamily = iota
	// KindFamilyString looks for a string, with casing and whitespace rules
	KindFamilyString
	// KindFamilySearch looks for a precise string in a slice of the target
	KindFamilySearch
	// KindFamilyDefault succeeds if no tests succeeded before on that level
	KindFamilyDefault
	// KindFamilyClear resets the matched flag for that level
	KindFamilyClear
	// KindFamilyName always succeeds
	KindFamilyName
	// KindFamilyUse acts like a subroutine call, to peruse another page of rules
	KindFamilyUse

	// KindFamilySwitch is a series of merged KindFamilyInteger
	KindFamilySwitch
)

type LogFunc

type LogFunc func(format string, args ...interface{})

LogFunc prints a debug message

type Offset

type Offset struct {
	OffsetType OffsetType
	IsRelative bool
	Direct     int64
	Indirect   *IndirectOffset
}

Offset describes where to look to compare something

func (Offset) Equals

func (o Offset) Equals(b Offset) bool

Equals returns true if and only if a and b point to exactly the same offset

func (Offset) String

func (o Offset) String() string

type OffsetType

type OffsetType int

OffsetType describes whether an offset is direct or indirect

const (
	// OffsetTypeIndirect is an offset read from somewhere in a file
	OffsetTypeIndirect OffsetType = iota
	// OffsetTypeDirect is an offset directly specified by the magic
	OffsetTypeDirect
)

type ParseContext

type ParseContext struct {
	Logf LogFunc
}

ParseContext holds state for the parser

func (*ParseContext) Parse

func (ctx *ParseContext) Parse(magicReader io.Reader, book Spellbook) error

Parse reads a magic rule file and puts it into a spell book

func (*ParseContext) ParseAll

func (ctx *ParseContext) ParseAll(magdir string, book Spellbook) error

ParseAll parses all the files in a directory and adds them to the same spellbook

type Rule

type Rule struct {
	Line        string
	Level       int
	Offset      Offset
	Kind        Kind
	Description []byte
}

Rule is a single magic rule

func (Rule) String

func (r Rule) String() string

type SearchKind

type SearchKind struct {
	Value  []byte
	MaxLen int64
}

SearchKind describes how to look for a fixed pattern

type Spellbook

type Spellbook map[string][]Rule

Spellbook contains a set of rules - at least one "" page, potentially others

func (Spellbook) AddRule

func (sb Spellbook) AddRule(page string, rule Rule)

AddRule appends a rule to the spellbook on the given page

type StringKind

type StringKind struct {
	Value  []byte
	Negate bool
	Flags  utils.StringTestFlags
}

StringKind describes how to match a string pattern

type SwitchCase

type SwitchCase struct {
	Value       int64
	Description []byte
}

type SwitchKind

type SwitchKind struct {
	ByteWidth  int
	Endianness Endianness
	Signed     bool
	Cases      []*SwitchCase
}

type UseKind

type UseKind struct {
	SwapEndian bool
	Page       string
}

UseKind describes which page of the spellbook to use, and whether or not to swap endianness