From c204696209c861ed672558afe13182c67b099939 Mon Sep 17 00:00:00 2001
From: Daniel Stinson-Diess <dstindiess@gmail.com>
Date: Sun, 8 Jan 2023 09:11:57 -0600
Subject: [PATCH] patterns/dmg: Added DMG pattern (#70)

---
 README.md           |  1 +
 patterns/dmg.hexpat | 50 +++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 51 insertions(+)
 create mode 100644 patterns/dmg.hexpat

diff --git a/README.md b/README.md
index d24338d..9a60708 100644
--- a/README.md
+++ b/README.md
@@ -62,6 +62,7 @@ Hex patterns, include patterns and magic files for the use with the ImHex Hex Ed
 | COFF | `application/x-coff` | [`patterns/coff.hexpat`](patterns/coff.hexpat) | Common Object File Format (COFF) executable |
 | Mach-O | `application/x-mach-binary` | [`patterns/macho.hexpat`](patterns/macho.hexpat) | Mach-O executable |
 | CHM | | [`patterns/chm.hexpat`](patterns/chm.hexpat) | Windows HtmlHelp Data (ITSF / CHM) |
+| DMG | | [`patterns/dmg.hexpat`](patterns/dmg.hexpat) | Apple Disk Image Trailer (DMG) |
 
 ### Scripts
 
diff --git a/patterns/dmg.hexpat b/patterns/dmg.hexpat
new file mode 100644
index 0000000..a1f4dff
--- /dev/null
+++ b/patterns/dmg.hexpat
@@ -0,0 +1,50 @@
+#pragma MIME application/octet-stream
+#pragma endian big
+
+#include <type/magic.pat>
+#include <type/size.pat>
+#include <type/guid.pat>
+#include <std/mem.pat>
+
+// Parse DMG Structure per http://newosxbook.com/DMG.html
+//
+// UDIFResourceFile starts at size(file) - 512
+struct UDIFResourceFile {
+    type::Magic<"koly"> Signature;  // Magic ('koly')
+    u32 Version;                    // Current version is 4
+    type::Size<u32> HeaderSize;     // sizeof(this), always 512
+    u32 Flags;
+    u64 RunningDataForkOffset;      // 
+    u64 DataForkOffset;             // Data fork offset (usually 0, beginning of file)
+    type::Size<u64> DataForkLength; // Size of data fork (usually up to the XMLOffset, below)
+    u64 RsrcForkOffset;             // Resource fork offset, if any
+    type::Size<u64> RsrcForkLength; // Resource fork length, if any
+    u32 SegmentNumber;              // Usually 1, may be 0
+    u32 SegmentCount;               // Usually 1, may be 0
+    type::GUID SegmentID;           // 128-bit GUID identifier of segment (if SegmentNumber !=0)
+    
+
+    u32 DataChecksumType;               // Data fork 
+    type::Size<u32> DataChecksumSize;   // Checksum Information
+    u32 DataChecksum[DataChecksumSize]; // Up to 128-bytes (32 x 4) of checksum
+
+    u64 XMLOffset;              // Offset of property list in DMG, from beginning
+    type::Size<u64> XMLLength;  // Length of property list
+    u8  Reserved1[120];         // 120 reserved bytes - zeroed
+
+    u32 ChecksumType;               // Master
+    type::Size<u32> ChecksumSize;   // Checksum information
+    u32 Checksum[ChecksumSize];     // Up to 128-bytes (32 x 4) of checksum
+
+    u32 ImageVariant;          // Commonly 1
+    u64 SectorCount;           // Size of DMG when expanded, in sectors
+
+    u32 reserved2;             // 0
+    u32 reserved3;             // 0 
+    u32 reserved4;             // 0
+};
+
+
+UDIFResourceFile trailer @ std::mem::size() - 512;
+
+char metadata_plist[trailer.XMLLength] @ trailer.XMLOffset;