From 36211448150dae91c47ee36fecda0156363dfcd5 Mon Sep 17 00:00:00 2001 From: Nik Date: Wed, 7 Sep 2022 14:42:38 +0200 Subject: [PATCH] patterns: Added BSON pattern --- README.md | 3 +- patterns/bson.hexpat | 128 +++++++++++++++++++++++ tests/patterns/test_data/bson.hexpat.bin | Bin 0 -> 174 bytes 3 files changed, 130 insertions(+), 1 deletion(-) create mode 100644 patterns/bson.hexpat create mode 100644 tests/patterns/test_data/bson.hexpat.bin diff --git a/README.md b/README.md index 89615f4..d48ebbc 100644 --- a/README.md +++ b/README.md @@ -9,7 +9,7 @@ Hex patterns, include patterns and magic files for the use with the ImHex Hex Ed | Name | MIME | Path | Description | |------|------|------|-------------| | BMP | `image/bmp` | `patterns/bmp.hexpat` | OS2/Windows Bitmap files | -| ELF | `application/x-executable`, `application/x-sharedlib` | `patterns/elf.hexpat` | ELF header in elf binaries | +| ELF | `application/x-executable` | `patterns/elf.hexpat` | ELF header in elf binaries | | PE | `application/x-dosexec` | `patterns/pe.hexpat` | PE header, COFF header, Standard COFF fields and Windows Specific fields | | Intel HEX | | `patterns/intel_hex.hexpat` | [Intel hexadecimal object file format definition]("https://en.wikipedia.org/wiki/Intel_HEX") | | MIDI | `audio/midi` | `patterns/midi.hexpat` | MIDI header, event fields provided | @@ -42,6 +42,7 @@ Hex patterns, include patterns and magic files for the use with the ImHex Hex Ed | Shell Link | `application/x-ms-shortcut` | `patterns/lnk.hexpat` | Windows Shell Link file format | | Xilinx BIT | | `patterns/xilinx_bit.hexpat` | Xilinx FPGA Bitstreams | | FLAC | `audio/flac` | `patterns/flac.hexpat` | Free Lossless Audio Codec, FLAC Audio Format | +| BSON | `application/bson` | `patterns/bson.hexpat` | BSON (Binary JSON) format | ### Scripts diff --git a/patterns/bson.hexpat b/patterns/bson.hexpat new file mode 100644 index 0000000..85f3026 --- /dev/null +++ b/patterns/bson.hexpat @@ -0,0 +1,128 @@ +#pragma MIME application/bson + +#include + +enum Type : u8 { + Double = 0x01, + String = 0x02, + EmbeddedDocument = 0x03, + Array = 0x04, + Binary = 0x05, + Undefined = 0x06, + ObjectId = 0x07, + Boolean = 0x08, + UTCDatetime = 0x09, + Null = 0x0A, + Regex = 0x0B, + DBPointer = 0x0C, + JavaScript = 0x0D, + Symbol = 0x0E, + JavaScriptWithScope = 0x0F, + Int32 = 0x10, + Timestamp = 0x11, + Int64 = 0x12, + Decimal128 = 0x13, + + MinKey = 0xFF, + MaxKey = 0x7F +}; + +enum Subtype : u8 { + GenericBinarySubtype = 0x00, + Function = 0x01, + BinaryOld = 0x02, + UUIDOld = 0x03, + UUID = 0x04, + MD5 = 0x05, + EncryptedBSONValue = 0x06, + CompressedBSONColumn = 0x07, + UserDefined = 0x80 +}; + +struct Binary { + s32 length; + Subtype subtype; + u8 data[length]; +}; + +struct String { + u32 length [[hidden]]; + char value[length]; +} [[sealed, format("format_string")]]; + +struct CString { + char value[]; +} [[sealed, format("format_string")]]; + +fn format_string(auto string) { + return string.value; +}; + +struct ObjectId { + type::time32_t timestamp; + u8 randomValue[5]; + u24 counter; +}; + +struct DBPointer { + String name; + ObjectId value; +}; + + +using Document; + +struct Element { + Type type; + + CString name; + + if (type == Type::Double) { + double value; + } else if (type == Type::String) { + String value; + } else if (type == Type::EmbeddedDocument) { + Document value; + } else if (type == Type::Array) { + Document value; + } else if (type == Type::Binary) { + Binary value; + } else if (type == Type::Undefined) { + /* undefined */ + } else if (type == Type::ObjectId) { + ObjectId value; + } else if (type == Type::Boolean) { + bool value; + } else if (type == Type::UTCDatetime) { + type::time64_t value; + } else if (type == Type::Null) { + /* null */ + } else if (type == Type::Regex) { + CString regexPattern; + CString regexOptions; + } else if (type == Type::DBPointer) { + DBPointer value; + } else if (type == Type::JavaScript) { + String value; + } else if (type == Type::Symbol) { + String value; + } else if (type == Type::JavaScriptWithScope) { + String value; + } else if (type == Type::Int32) { + s32 value; + } else if (type == Type::Timestamp) { + u64 value; + } else if (type == Type::Int64) { + s64 value; + } else if (type == Type::Decimal128) { + u128 value; + } +}; + +struct Document { + s32 listLength; + Element elements[while($ < ((addressof(this) + listLength) - 1))]; + padding[1]; +}; + +Document document @ 0x00; \ No newline at end of file diff --git a/tests/patterns/test_data/bson.hexpat.bin b/tests/patterns/test_data/bson.hexpat.bin new file mode 100644 index 0000000000000000000000000000000000000000..331a4c42c8978d3e543d779ed4cf3f548dfe7e34 GIT binary patch literal 174 zcmWm5yA1*{5Jl1F-31mz;DiJc=zu>F(uQB literal 0 HcmV?d00001