Commit Graph

340 Commits

Author SHA1 Message Date
ruokeqx
0b75336638 feat(pcapng): add support for Decryption Secrets Block (#411)
feat(pcapng): add support for Decryption Secrets Block
2025-06-19 05:13:43 -07:00
Dominik Tamiołło
103d434cc5 Add PEF (Preffered Executable Format) support (#406)
* Initial version of PEF

* add pef test file

---------

Co-authored-by: paxcut <53811119+paxcut@users.noreply.github.com>
2025-06-17 22:24:54 -07:00
Fabian Neundorf
7716b9d6e7 patterns: Add support for smk (#399)
* patterns: Add support for smk

* patterns: Use builtin function and separate SMK struct

---------

Co-authored-by: paxcut <53811119+paxcut@users.noreply.github.com>
2025-06-17 14:57:36 -07:00
Tom Arrow
ad1e300674 Quake 3 Engine demo pattern & test file (#402)
* Quake 3 Engine demo pattern & test file

* Quake 3 Engine demo: Increase limits (demo files can be big) and additional condition

* Quake 3 demo specify little endian

* Quake 3 demo format: Add message type detection

* Quake 3 demo format: Read serverTime for snapshot messages

* Quake 3 demo pattern: fixed bug/typo/sleepy coding

* Quake 3 demo pattern: Ability to read CS_SERVERINFO

* Quake 3 demo pattern: Read CS_SYSTEMINFO as well

* Quake 3 demo pattern: Read first serverCommand per message

* Added Quake 3 engine demo pattern to readme

* Change Quake 3 engine demo entry in readme table

---------

Co-authored-by: Tom <tomarrowtomarrow@hotmail.com>
2025-06-17 02:06:24 -07:00
zn123
e918ce52b9 Add flv.hexpat (#401)
* Add flv.hexpat

https://veovera.org/docs/enhanced/enhanced-rtmp-v2#flv-file-format-overview

* test flv.hexpat

* Update README.md

add flv patterns

* Update flv.hexpat

Optimize spaces

* Update flv.hexpat

fix
2025-06-16 20:25:54 -07:00
Nik
db4d62aa20 patterns/fs: Refactor all partition types into a FS module 2025-05-25 19:51:32 +02:00
WerWolv
d96bfbb942 tests: Execute and test format functions 2025-05-25 12:43:21 +02:00
Nik
6b279b8375 patterns/exfat: Fixed eval depth error 2025-05-17 16:07:11 +02:00
Khoo Hao Yit
a692b22ecc patterns: Add support for exFAT (#398) 2025-05-17 13:13:35 +02:00
Claudius Coenen
2ae0499293 patterns/wintec_tes: Slightly nicer formatting in a list of entries (#397)
slightly nicer formatting in a list of entries
2025-05-16 20:25:04 +02:00
thrasher
bd06987e8e patterns/zip: Add zip64 support (#395)
Co-authored-by: Nik <werwolv98@gmail.com>
2025-05-15 21:22:20 +02:00
Fabian Neundorf
74e08623f1 patterns: Add support for flc/flic files (#396)
* patterns: Add support for flc/flic files

* patterns: Add #pragma description for flc

---------

Co-authored-by: Nik <werwolv98@gmail.com>
2025-05-15 20:17:13 +02:00
Nik
a860c396fa patterns: Added Java HPROF pattern 2025-05-15 17:23:06 +02:00
Nik
da934e2045 patterns/optee_ta: Fixed missing author and description pragmas 2025-05-15 08:07:13 +02:00
Nik
394ef80611 patterns: Added OPTEE Trusted Application format 2025-05-13 22:17:05 +02:00
Grant Kim
2ce182b1b3 patterns/tiff: Tags for DNG and TIFF extensions (#376)
Add Tags for DNG and TIFF extensions

References: https://www.loc.gov/preservation/digital/formats/content/tiff_tags.shtml
https://helpx.adobe.com/camera-raw/digital-negative.html

Co-authored-by: Nik <werwolv98@gmail.com>
2025-05-10 13:59:22 +02:00
Glenn Hartmann
6cadad3d1f pattern/protobuf: Allow parsing of nested messages (#378)
Mostly this enables attempted recursive parsing of submessages. Note
that it is inherently impossible to determine the underlying data type
for LengthDelimited for sure, so this is a best-effort attempt. The user
can disable recursive submessage parsing via Settings.

Other minor changes:
* added #pragma MIME and #pragma endian directives
* enabled UTF-8 display for LengthDelimited types
* added signed LEB128 display for Varint types (although this doesn't
  seem to be working on my test case)
* swapped if/else-if structure for match
* fail upon receiving unknown or unsupported WireType

Co-authored-by: Nik <werwolv98@gmail.com>
2025-05-10 13:53:01 +02:00
David Schneider
7ad9cd4f41 patterns: Added support for GNU MO files (#383) 2025-05-10 11:49:02 +00:00
0xZ3R0
bcaeef31d7 pattern: Added DJI Firmware Pattern (#392)
* added IM*H pattern

* improved README
2025-05-10 13:35:14 +02:00
Niketin
ee8d2f50b7 pattern/bencode: Various fixes (#393)
* Fix bencode dictionary

When parsing a bencode dictionary, the end character 'e' was never
consumed. This caused a misinterpretation of the character as struct Value of
an unknown type 'e'.

* Fix bencode list

A list was not included in the Value's parsing logic so it may have
been mistakenly parsed as a string.

* Fix std::ctype::isprint not including space

The space character, 0x20, is considered as a printable character in ASCII
and in >=C89. Adding it to the range of std::ctype::isprint also fixes
other std::ctype functions that use it.

* Fix bencode byte string formatting

Byte strings do not render nicely in pattern data's value column if they
contain non-printable characters. This commit makes the value of byte
strings to be surrounded by quotation marks, and renders a warning text
without quotation marks if the byte string contains non-printable
characters.
2025-05-10 13:34:36 +02:00
DEREFERENC3D
5b8dde19a9 patterns: Added definition for the OpenRGB profile format (#387)
patterns: Add definition for the OpenRGB profile format (up to version 5)
2025-05-10 13:34:16 +02:00
Dhash Shrivathsa
0b0eff0cb6 pattern/macho: Load Commands should include additional specializations (LoadDyLib) (#386)
* add additional command specialization

* address PR feedback
2025-05-10 13:34:01 +02:00
Enaium
3185503be1 patterns: Added valve vpk pattern (#384) 2025-05-10 10:29:50 +00:00
Sabhya
3a64207e58 pattern: Added pcapng capture file pattern (#385)
add: pcapng hexpat
2025-05-10 12:26:39 +02:00
bluisblu
c94d42d5c0 patterns: Added Radcore Cement v1.2 file pattern (#382)
* Add Radcore Cement file pattern

* Update pattern list in README.md
2025-05-10 11:57:51 +02:00
Caleb Denio
45c4c1d35b patterns/uf2: Added magic number (#379) 2025-05-10 11:54:29 +02:00
Shadlock0133
5ed9c0fd4d patterns/elf: use Rel{a} structs for parsing REL{A} section data (#375) 2025-05-10 11:52:35 +02:00
C3pa
11d373319f pattern/pe: Check for imageNameRVA in pe.hexpat before reading imageName (#372) 2025-05-10 11:52:00 +02:00
Jonathan Ostrus
e7d366571d pattern/pex: Added formatter for opcode and some other name cleanups (#371) 2025-05-10 11:51:43 +02:00
Caleb Denio
b6df1742b6 patterns: Add ZIM pattern (#367)
* Add ZIM pattern file

* Add test file

* namespace!
2025-05-10 11:51:04 +02:00
Jake Ryan
0b9e83ff8a patterns: Add support for MagicaVoxel .vox files (#390)
* patterns: Added support for MagicaVoxel .vox files

* Fixed incorrect IMAP field size and added basic chunk size mismatch detection and recovery.

* Fixed pattern for "_r" values and added RotationToMat3.

* Added test vox file.

---------

Co-authored-by: paxcut <53811119+paxcut@users.noreply.github.com>
2025-04-30 08:55:53 -07:00
Hrant
89307ba8a5 added NTFS pattern (#391)
Thank you!

* added NTFS pattern

* improved the PR

* remove test-data & fixed sd

---------

Co-authored-by: Hrant Tadevosyan <Hrant.Tadevosyan@connectwise.com>
2025-04-30 04:00:52 -07:00
ZHANG Yuntian
537ce67895 patterns/partition_table: Added basic MBR and GPT patterns (#358)
Both are conbined into a single pattern due to how GPT always has a pseudo MBR to maintain backward compatibility.
2025-03-24 07:15:25 +01:00
Scrivener07
1771c1f077 patterns: Added support for PEX Papyrus executables (#370)
Added support for PEX, Bethesda's Papyrus executable for compiled script files.
- Skyrim
- Fallout 4
- Fallout 76
- Starfield

Co-authored-by: Jonathan Ostrus <12855515+jbostrus@users.noreply.github.com>
2025-03-23 11:30:43 +01:00
Caleb
cef20e24a7 patterns/zip: Fix 0x5455 extended timestamp fields crash, improve date/time presentation (#363)
Co-authored-by: Nik <werwolv98@gmail.com>
2025-03-22 13:57:42 +01:00
Andreas Wallner
8e7cfd9442 patterns: Add STDFv4 pattern (#326) 2025-03-22 13:54:50 +01:00
5ec1cff
d0ba754dc2 patterns/zip: Handling padded extra fields (#369)
* Handling unresolved extra fields

* Update zip.hexpat

* Update zip.hexpat

* Update zip.hexpat
2025-03-22 13:54:26 +01:00
mheimlich
9f92c38ecf patterns: Add ADTFDAT pattern (#368) 2025-03-22 13:52:59 +01:00
Geky
0844e07056 patterns: Added DS Cartridge Header pattern, updated pyc versions (#366)
* add support for cartridge size type $54

Added support for cartridge size type $54, corresponding to 1.5 MiB (96 banks).

* add missing license

* Add GBA Cartridge Header

* Update README.md

Added GBA information to README.md and corrected a typo.

* Add DS Cartridge Header

* Update ReadMe.md

* Update pyc.hexpat

Included additional versions
2025-03-22 13:51:46 +01:00
Eddy S.
5bc66df14f patterns/elf: Set endianness globally (#362) 2025-03-22 13:50:17 +01:00
MrMcX
7310a10214 patterns: Add pattern for microsoft prefetch files (uncompressed SCCA format only) (#361)
* Add pattern for microsoft prefetch files (uncompressed SCCA format only)

* Update pf.hexpat

Add longer explanation
2025-03-22 13:49:50 +01:00
MrMcX
34ee3107e2 patterns: Implement Windows thumbcache pattern (#359)
* Implement Windows thumbcache pattern

* Include thumbcache pattern in README.md

* Update thumbcache.hexpat

- Use English warning text
- handle unknown file version
- add thanks to joachimmetz
- create virtual file
- use more elegant magic type

* Update thumbcache.hexpat

- Use padding data type for paddings

* Update thumbcache.hexpat

- make pattern more robust against single erroneous cache record
2025-03-22 13:48:57 +01:00
Shadlock0133
c4378ffb14 patterns/elf: Use e_shstrndx to get section names instead of guessing (#357) 2025-03-22 13:47:43 +01:00
eli_w
5ad7f0c1e7 patterns/ani: Improved compatibility with error size defined in ani files (#354) 2025-03-22 13:46:49 +01:00
Mrmaxmeier
df97fc7257 patterns/includes: More misc cleanups (#353)
* patterns/zip: simplify find_sequence_in_range check

hex(340282366920938463463374607431768211455) =
0xffffffffffffffffffffffffffffffff

* patterns/7z: use Magic<> for signature, add pragma

* patterns/{nro, ogg}: use Magic<> for signature

* patterns/ttf: refactor, check magic

Use the "Field field @ position;" syntax instead of saving and restoring
the cursor position.

* readme: fix copy-paste error in pattern listing
2025-03-22 13:46:06 +01:00
Vemmi
3ad263783d patterns: Added Unreal Engine 3 UPK pattern (#352)
* patterns: Add unreal 3 upk pattern

* readme: Add link to upk-ue3.hexpat
2025-03-22 13:45:25 +01:00
Ilya Sorochan
5ccd431320 patterns: Added RPM pattern (#350) 2025-03-22 13:44:55 +01:00
paxcut
375145e759 include/std: std::ptr::relative_to_base_section not working anymore (#349)
Fixes #348 

In issue #348 it is stated that the pattern fails to find the variable baseAddress in the parent of the parent of the attribute function. One parent is required to access the variables on the pattern that is using the attribute.

That pattern is used in the pattern that contains baseAddress as a pointer to an array of the children pattern and that seems to require an extra parent level to be added in order to access baseAddress without errors. The fix was tested on an xbe file extracted from an xbox cd rom and while it failed without the fix as stated in issue 348 with the fix it ran to completion without issues.
2025-02-16 12:52:01 +01:00
paxcut
71eeed981d patterns/protobuf: Remove global variables
In issue #346 it is noted that the format functions return the same value repeatidly and erroneously. This is due to the use of global variables which result on only their last value being used in format functions due to their delayed evaluation. Fixed by using local variables instead. Also remove tabs from the file and an unused tags variable.
2025-01-30 20:24:11 +01:00
Fabian Neundorf
e779b88a58 patterns/iso: Fix incorrect condition (#344) 2025-01-23 21:44:44 +01:00