mirror of
https://github.com/WerWolv/ImHex-Patterns.git
synced 2026-03-27 23:37:04 -05:00
patterns: Adding IPS pattern and fixed PE magic file (#153)
* Update pe.hexpat New improvement * Add ips.hexpat via upload * Add ips.hexpat.ips via upload * Added IPS to README * Mentioned Windows in portable_executable_magic
This commit is contained in:
@@ -57,6 +57,7 @@ Everything will immediately show up in ImHex's Content Store and gets bundled wi
|
||||
| ID3 | `audio/mpeg` | [`patterns/id3.hexpat`](patterns/id3.hexpat) | ID3 tags in MP3 files |
|
||||
| Intel HEX | | [`patterns/intel_hex.hexpat`](patterns/intel_hex.hexpat) | [Intel hexadecimal object file format definition]("https://en.wikipedia.org/wiki/Intel_HEX") |
|
||||
| IP | | [`patterns/ip.hexpat`](patterns/ip.hexpat) | Ethernet II Frames (IP Packets) |
|
||||
| IPS | | [`patterns/ips.hexpat`](patterns/ips.hexpat) | IPS (International Patching System) files |
|
||||
| ISO | | [`patterns/iso.hexpat`](patterns/iso.hexpat) | ISO 9660 file system |
|
||||
| Java Class | `application/x-java-applet` | [`patterns/java_class.hexpat`](patterns/java_class.hexpat) | Java Class files |
|
||||
| JPEG | `image/jpeg` | [`patterns/jpeg.hexpat`](patterns/jpeg.hexpat) | JPEG Image Format |
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
# A libmagic database containing definition for PE files used by MS-DOS based systems
|
||||
# A libmagic database containing definition for PE files used by MS-DOS/Windows based systems
|
||||
|
||||
# MS-DOS Portable Executable
|
||||
0x0 string/b MZ MS-DOS Binary
|
||||
|
||||
30
patterns/ips.hexpat
Normal file
30
patterns/ips.hexpat
Normal file
@@ -0,0 +1,30 @@
|
||||
#include <std/mem.pat>
|
||||
#include <std/string.pat>
|
||||
|
||||
#pragma endian big
|
||||
|
||||
u8 eofOffset = 3;
|
||||
|
||||
struct Hunk {
|
||||
u24 offset;
|
||||
u16 length;
|
||||
if (length == 0) {
|
||||
u16 runCount;
|
||||
u8 payload;
|
||||
}
|
||||
else {
|
||||
u8 payload[length];
|
||||
}
|
||||
};
|
||||
|
||||
struct IPS {
|
||||
char signature[5];
|
||||
if (std::mem::read_string(std::mem::size()-3, 3) != "EOF") {
|
||||
eofOffset += 3;
|
||||
}
|
||||
Hunk hunks[while($ < std::mem::size()-eofOffset)];
|
||||
char eof[3];
|
||||
u24 truncatedSize[eofOffset>3];
|
||||
};
|
||||
|
||||
IPS ips @ 0x00;
|
||||
BIN
tests/patterns/test_data/ips.hexpat.ips
Normal file
BIN
tests/patterns/test_data/ips.hexpat.ips
Normal file
Binary file not shown.
Reference in New Issue
Block a user