patterns: Adding IPS pattern and fixed PE magic file (#153)

* Update pe.hexpat

New improvement

* Add ips.hexpat via upload

* Add ips.hexpat.ips via upload

* Added IPS to README

* Mentioned Windows in portable_executable_magic
This commit is contained in:
gmestanley
2023-08-26 19:38:30 -03:00
committed by GitHub
parent 86f93dfdaf
commit ba14dd0cb2
4 changed files with 32 additions and 1 deletions

View File

@@ -57,6 +57,7 @@ Everything will immediately show up in ImHex's Content Store and gets bundled wi
| ID3 | `audio/mpeg` | [`patterns/id3.hexpat`](patterns/id3.hexpat) | ID3 tags in MP3 files |
| Intel HEX | | [`patterns/intel_hex.hexpat`](patterns/intel_hex.hexpat) | [Intel hexadecimal object file format definition]("https://en.wikipedia.org/wiki/Intel_HEX") |
| IP | | [`patterns/ip.hexpat`](patterns/ip.hexpat) | Ethernet II Frames (IP Packets) |
| IPS | | [`patterns/ips.hexpat`](patterns/ips.hexpat) | IPS (International Patching System) files |
| ISO | | [`patterns/iso.hexpat`](patterns/iso.hexpat) | ISO 9660 file system |
| Java Class | `application/x-java-applet` | [`patterns/java_class.hexpat`](patterns/java_class.hexpat) | Java Class files |
| JPEG | `image/jpeg` | [`patterns/jpeg.hexpat`](patterns/jpeg.hexpat) | JPEG Image Format |

View File

@@ -1,4 +1,4 @@
# A libmagic database containing definition for PE files used by MS-DOS based systems
# A libmagic database containing definition for PE files used by MS-DOS/Windows based systems
# MS-DOS Portable Executable
0x0 string/b MZ MS-DOS Binary

30
patterns/ips.hexpat Normal file
View File

@@ -0,0 +1,30 @@
#include <std/mem.pat>
#include <std/string.pat>
#pragma endian big
u8 eofOffset = 3;
struct Hunk {
u24 offset;
u16 length;
if (length == 0) {
u16 runCount;
u8 payload;
}
else {
u8 payload[length];
}
};
struct IPS {
char signature[5];
if (std::mem::read_string(std::mem::size()-3, 3) != "EOF") {
eofOffset += 3;
}
Hunk hunks[while($ < std::mem::size()-eofOffset)];
char eof[3];
u24 truncatedSize[eofOffset>3];
};
IPS ips @ 0x00;

Binary file not shown.