From f2d85fd5061bbe533fc63f4999144d55334fe92c Mon Sep 17 00:00:00 2001 From: WerWolv Date: Thu, 3 Dec 2020 21:49:54 +0100 Subject: [PATCH] Uploaded currently available files --- includes/cstdint.hexpat | 14 +++++ magic/nintendo_switch_magic | 18 ++++++ patterns/elf.hexpat | 49 ++++++++++++++++ patterns/pe.hexpat | 112 ++++++++++++++++++++++++++++++++++++ 4 files changed, 193 insertions(+) create mode 100644 includes/cstdint.hexpat create mode 100644 magic/nintendo_switch_magic create mode 100644 patterns/elf.hexpat create mode 100644 patterns/pe.hexpat diff --git a/includes/cstdint.hexpat b/includes/cstdint.hexpat new file mode 100644 index 0000000..45ab480 --- /dev/null +++ b/includes/cstdint.hexpat @@ -0,0 +1,14 @@ +using uint8_t = u8; +using uint16_t = u16; +using uint32_t = u32; +using uint64_t = u64; +using uint128_t = u128; + +using int8_t = s8; +using int16_t = s16; +using int32_t = s32; +using int64_t = s64; +using int128_t = s128; + +using size_t = u32; +using ssize_t = s32; \ No newline at end of file diff --git a/magic/nintendo_switch_magic b/magic/nintendo_switch_magic new file mode 100644 index 0000000..f9ee574 --- /dev/null +++ b/magic/nintendo_switch_magic @@ -0,0 +1,18 @@ +# A libmagic database containing definitions for files used by Nintendo consoles + +# Nintendo Switch NRO file +0x10 string NRO0 Nintendo Switch NRO file +>0x08 string HOMEBREW (Homebrew) +>0x18 long x (Size %d) + +# Nintendo Switch NSO file +0x00 string NSO0 Nintendo Switch NSO file +>0x04 long x Version %d +>0x0C long x Flags %08x + +# Nintendo Switch NCA file +0x200 string NCA Nintendo Switch NCA file +>0x203 byte x Version %c +>0x204 byte 0 System NCA +>0x204 byte 1 Gamecard NCA +>0x210 quad x ProgramId %016llx \ No newline at end of file diff --git a/patterns/elf.hexpat b/patterns/elf.hexpat new file mode 100644 index 0000000..a9708d3 --- /dev/null +++ b/patterns/elf.hexpat @@ -0,0 +1,49 @@ +#pragma MIME application/x-executable + +using Elf32_Addr = u32; +using Elf32_Half = u16; +using Elf32_Off = u32; +using Elf32_Sword = s32; +using Elf32_Word = u32; + +using Elf64_Addr = u64; +using Elf64_Half = u16; +using Elf64_Off = u64; +using Elf64_Sword = s32; +using Elf64_Word = u32; + +struct Elf32_Ehdr { + Elf32_Word e_ident; + Elf32_Half e_type; + Elf32_Half e_machine; + Elf32_Word e_version; + Elf32_Addr e_entry; + Elf32_Off e_phoff; + Elf32_Off e_shoff; + Elf32_Word e_flags; + Elf32_Half e_ehsize; + Elf32_Half e_phentsize; + Elf32_Half e_phnum; + Elf32_Half e_shentsize; + Elf32_Half e_shnum; + Elf32_Half e_shstrndx; +}; + +struct Elf64_Ehdr { + Elf64_Word e_ident; + Elf64_Half e_type; + Elf64_Half e_machine; + Elf64_Word e_version; + Elf64_Addr e_entry; + Elf64_Off e_phoff; + Elf64_Off e_shoff; + Elf64_Word e_flags; + Elf64_Half e_ehsize; + Elf64_Half e_phentsize; + Elf64_Half e_phnum; + Elf64_Half e_shentsize; + Elf64_Half e_shnum; + Elf64_Half e_shstrndx; +}; + +Elf64_Ehdr header @ 0x00; \ No newline at end of file diff --git a/patterns/pe.hexpat b/patterns/pe.hexpat new file mode 100644 index 0000000..e8d91eb --- /dev/null +++ b/patterns/pe.hexpat @@ -0,0 +1,112 @@ +#pragma MIME application/x-dosexec + +enum MachineType : u16 { + Unknown = 0x00, + AM33 = 0x1D3, + AMD64 = 0x8664, + ARM = 0x1C0, + ARM64 = 0xAA64, + ARMNT = 0x1C4, + EBC = 0xEBC, + I386 = 0x14C, + IA64 = 0x200, + M32R = 0x9041, + MIPS16 = 0x266, + MIPSFPU = 0x366, + MIPSFPU16 = 0x466, + POWERPC = 0x1F0, + POWERPCFP = 0x1F1, + R4000 = 0x166, + RISCV32 = 0x5032, + RISCV64 = 0x5064, + RISCV128 = 0x5128, + SH3 = 0x1A2, + SH3DSP = 0x1A3, + SH4 = 0x1A6, + SH5 = 0x1A8, + THUMB = 0x1C2, + WCEMIPSV2 = 0x169 +}; + +bitfield Characteristics { + stripped : 1; + executableImage : 1; + lineNumsStripped : 1; + localSymsStripped : 1; + aggressiveWsTrim : 1; + largeAddressAware : 1; + reserved : 1; + bytesReversedLo : 1; + is32BitMachine : 1; + debugStripped : 1; + removableRunFromSwap : 1; + netRunFromSwap : 1; + system : 1; + dll : 1; + upSystemOnly : 1; + bytesReversedHi : 1; +}; + +struct OptionalHeader { + u16 magic; + u8 majorLinkerVersion; + u8 minorLinkerVersion; + u32 sizeOfCode; + u32 sizeOfInitializedData; + u32 sizeOfUninitializedData; + u32 addressOfEntryPoint; + u32 baseOfCode; + u32 baseOfData; + u32 imageBase; + u32 sectionAlignment; + u32 fileAlignment; + u16 majorOperatingSystemVersion; + u16 minorOperatingSystemVersion; + u16 majorImageVersion; + u16 minorImageVersion; + u16 majorSubsystemVersion; + u16 minorSubSystemVersion; + u32 win32VersionValue; + u32 sizeOfImage; + u32 sizeOfHeaders; + u32 checksum; + u16 subsystem; + u16 dllCharacteristics; + u32 sizeOfStackReserve; + u32 sizeOfStackCommit; + u32 sizeOfHeapReserve; + u32 sizeOfHeapCommit; + u32 loaderFlags; + u32 numberOfRvaAndSizes; +}; + +struct COFFHeader { + u32 signature; + MachineType machine; + u16 numberOfSections; + u32 timeDateStamp; + u32 pointerToSymbolTable; + u32 numberOfSymbolTable; + u16 sizeOfOptionalHeader; + Characteristics characteristics; + OptionalHeader optionalHeader; +}; + +struct DOSHeader { + u16 signature; + u8 header[0x3A]; + COFFHeader *coffHeaderPointer : u32; +}; + +struct DOSStub { + u8 code[14]; + s8 message[0x27]; + u8 data[11]; +}; + +struct PEHeader { + DOSHeader dosHeader; + DOSStub dosStub; +}; + +PEHeader peHeader @ 0x00; \ No newline at end of file