Commit Graph

380 Commits

Author SHA1 Message Date
Antonio Vazquez
998655f74a patterns/PcapNG: Rewrite hexpat for bugfixing (#462)
PcapNG: Rewrite hexpat.

Co-authored-by: Nik <werwolv98@gmail.com>
2025-12-05 22:15:28 +01:00
haruse23
681b208aab pattern: Add Assassin's Creed: Unity's Forge files and Data files (Compressed and Decompressed) (#448)
* Add Capcom's Devil May Cry 3 HD .mod hexpat

Hex Pattern file for Capcom's Devil May Cry 3 HD Collection's .mod (3D Models) files

* Update DMC3 HD Mod.hexpat

* Update DMC3 HD Mod.hexpat

* Update DMC3 HD Mod.hexpat

* Add files via upload

* Update README.md

* Rename DMC3 HD Mod.hexpat to dmc3_hd_mod.hexpat

* Delete patterns/dmc3_hd_mod.hexpat

* Delete tests/patterns/test_data/dmc3_hd_mod.hexpat.mod

* Add files via upload

* Update dmc3_hd_mod.hexpat

* Add files via upload

* Update README.md

* Update README.md

* Update README.md

* Add files via upload

* Update ACU_FORGE.hexpat

* Update README.md

* Update and rename ACU_DATA_Compressed.hexpat to acu_data_compressed.hexpat

* Update and rename ACU_FORGE.hexpat to acu_forge.hexpat

* Update README.md

* Update acu_data_compressed.hexpat

* Update acu_data_compressed.hexpat

* Add files via upload

* Update and rename ACU_DATA_Decompressed.hexpat to acu_data_decompressed.hexpat

* Update README.md

* Update acu_data_compressed.hexpat

* Update README.md

* Delete patterns/acu_data_compressed.hexpat

* Delete patterns/acu_data_decompressed.hexpat

* Delete patterns/acu_forge.hexpat

* Create acu_forge.hexpat

* Add files via upload

* Update and rename ACU_DATA_Compressed.hexpat to acu_data_compressed.hexpat

* Update and rename ACU_DATA_Decompressed.hexpat to acu_data_decompressed.hexpat

* Update README.md

* Delete patterns/dmc3_hd_mod.hexpat

* Create dmc3_hd_mod.hexpat

* Update README.md

* Update dmc3_hd_mod.hexpat

* Update README.md

---------

Co-authored-by: Nik <werwolv98@gmail.com>
2025-12-05 22:02:07 +01:00
furidosu
64d86cbdd1 pattern: Add parquet.hexpat for Apache Parquet data file (#450)
* Add parquet.hexpat for Apache Parquet data file

> Apache Parquet is an open source, column-oriented data file format designed for efficient data storage and retrieval.
> -- https://parquet.apache.org

* Add parquet.hexpat test file

* Fix parquet.hexpat boolean parsing

* Fix parquet.hexpat ColumnChunkPlacer not placing last chunk

* Fix parquet.hexpat using VarInt = LEB128

---------

Co-authored-by: Nik <werwolv98@gmail.com>
2025-12-05 22:01:54 +01:00
adiee5
285a2fc7d1 pattern: Atari 8-bit binary format (XEX) (#453)
* add atari XEX format

* Update README.md

---------

Co-authored-by: Nik <werwolv98@gmail.com>
2025-12-05 22:01:41 +01:00
tympanicblock61
2a9676238f pattern: Add lua 4.0 pattern (#465)
* add lua 4.0 pattern

* fix offset the top level function is at

* Update README.md

---------

Co-authored-by: Nik <werwolv98@gmail.com>
2025-12-05 21:54:19 +01:00
Hrant
ee340409db patterns: Added APFS pattern (#400)
* updated APFS hexpat

* fix null feature

---------

Co-authored-by: Hrant Tadevosyan <Hrant.Tadevosyan@connectwise.com>
2025-12-05 21:19:37 +01:00
Fabian Neundorf
84dff0c886 patterns: Add json support for glb files (#412)
* patterns: Add json support for glb files

This makes it possible to separate display the different buffer views,
accessors and images (even visualizing them).

Unfortunately the data within the JSON gets sometimes corrupted and this
is the reason, why it parses the JSON multiple times at some places.

* Use original style and only single json variable

* patterns: Reuse json from global variable in gltf

* patterns: Check component type in gltf only once

* patterns: Fix gltf pattern and add formatting

Removes the duplicate definition of `component_type_t` and also removes
the need to pass the `component_type` to `stride_type_t`.
2025-12-05 21:19:19 +01:00
F01TECH
28a297582b patterns: Added DFIR Patterns (#442)
* Added /DFIR/ with patterns

Added /DFIR/ sub-directory.
Contains modified versions of built-in patterns for semi-automated Disk/Volume/Filesystem parsing geared towards Digital Forensics.
Originals in /fs/ should remain in tact for spot placement.

* DFIR_README.md

* DFIR_README.md

* DFIR_README.md

* DISK_PARSER.hexpat

* DISK_PARSER.hexpat

* FAT32.hexpat

* exFAT.hexpat

* README.md

Added DFIR related hexpats to table.

* README.md

---------

Co-authored-by: Xtreme-Liberty <59177844+Xtreme-Liberty@users.noreply.github.com>
2025-12-05 21:18:56 +01:00
Lexi Mayfield
681b1a1ded patterns: Add support for KTX 1.0 textures (#451)
* Commit patterns I've collected

- AppleSingle/AppleDouble pattern, used for macOS resource forks.
- MAME CHD file format, currently only supports v5.
- KEX Engine proprietary TARC format, used by various Nightdive games.

* Add to README

* Add pattern for KTX 1.0 file

* Use import, add reference ktx file

* Add to README
2025-12-05 21:17:01 +01:00
Stephen Hewitt
0a09efdd20 patterns: Pattern for DOS EXE files (#452)
* Initial DOS file

* Update README.md

* Update README.md

* More README

* More README

* Add DOS EXE

From: https://clasqm.github.io/freedos-repo/Games.html

Name: Champ Galagon
2025-12-05 21:16:36 +01:00
gmestanley
0d8bd76c2c patterns: Improvements to NES & IPS, add SNES, NSF, NSFe (#455)
* Add credit to ne.hexpat

* Add many changes to nes.hexpat

* Fixing dependance on variables declared in if statement

* Added mappers and inline to NES 2.0 header, removed needless parenthesises

* Add files via upload

* Add files via upload

* Create nsf.hexpat

* Used full name of the SNES on description

* Add SNES, NSF & NSFe, new description for NES

* Removing erroneous condition in ips.hexpat's truncatedSize

* Removing unnecessary std.string import in ips.hexpat

* Added both locations for sections in PE, clearer variable names, reorganized DOS stub

* Delete patterns/nsfe.hexpat

* Delete patterns/nsfmetadata.hexpat

* Added chunks from NSFe to NSF

* Added NSFe

* Fix size of truncatedSize in ips.hexpat

---------

Co-authored-by: Nik <werwolv98@gmail.com>
2025-12-05 21:15:50 +01:00
Lucia
a525160243 patterns: Added pattern for PopCap's Lua bytecode (#458)
* patterns: Added PopCap's proprietary Lua bytecode pattern.

* updated README to include new pattern

* fixed README link

* patterns/popcap_luc.hexpat: fixed comments and sources

* patterns/popcap_luc.hexpat: Changed datatype of filename to be more clear about its structure

* patterns/popcap_luc.hexpat: fixed improper handling of Nil type and added test file
2025-12-05 21:14:53 +01:00
Dexrn ZacAttack
c3946d33a7 patterns/java_class: Add class versions up to j26 (#459) 2025-12-05 21:14:31 +01:00
Khoo Hao Yit
cc7eb7d764 patterns: Add support for Unity Asset Bundle (#461) 2025-12-05 21:14:08 +01:00
Gal1leo Gal1lei
53384a4a54 patterns: Added Windows Notepad State File Parser (#463) 2025-12-05 21:12:45 +01:00
gmestanley
a35004665f patterns: Credit to NE and improvements on NES (#445)
* Add credit to ne.hexpat

* Add many changes to nes.hexpat

* Fixing dependance on variables declared in if statement

---------

Co-authored-by: Nik <werwolv98@gmail.com>
2025-09-22 07:15:37 +02:00
Tim Schneeberger
4fc11f1b91 patterns: Add ESP32 image pattern (#449)
Co-authored-by: Nik <werwolv98@gmail.com>
2025-09-21 09:30:38 +00:00
ODeux
7a9a5097a2 patterns: Add Python Pickle Pattern (#446)
* Add pickle pattern file

* Add test file

* Update README.md

---------

Co-authored-by: Nik <werwolv98@gmail.com>
2025-09-21 11:17:40 +02:00
Nik
0e67ee102b patterns/ico: Disable BMP processing until issues in the pattern language have been resolved 2025-09-21 10:44:20 +02:00
Zackary Newman
69077b919d patterns/ext4: Increase pattern limit to 2 GiB (#440) 2025-09-12 22:42:55 +02:00
Nightowl
297f611fed patterns: Add terminfo pattern (#437)
* patterns/terminfo: Add pattern for compiled term info entry files.

This adds support for the compiled (legacy and extended) term info entry files that are used for determining terminal capabilities.

* Add .bin extension to the terminfo test file.
2025-09-09 22:39:59 +02:00
DmitriLeon2000
b24ae36638 patterns: Add .gmf (Game Maker 3.x Data) pattern file and its test files (#438)
* Add .fas and .was pattern files (Oska DeskMates)

* Update .was pattern file

* Update .was/.wa3 pattern file

* Update README.md

* Update README.md

* Update .fas & .was pattern files

* Update README.md

* Update fas_oskasoftware_old.hexpat

* Added WAS test file

* Update WAS test file

* Update was_oskasoftware.hexpat

* Update was_oskasoftware.hexpat

* Update fas_oskasoftware_old.hexpat

* Update fas_oskasoftware.hexpat

* Update README.md

Replacing backward slashes with forward ones in the `WAS` row.

* Update fas_oskasoftware_old.hexpat

* Update was_oskasoftware.hexpat

* Add files via upload

* Add Game Maker 3.x Data pattern

* Update gmf.hexpat
2025-09-09 18:22:02 +02:00
Zackary Newman
50d776f497 patterns/ext4: Fix group descriptor table location for non-1024 block sizes (#439) 2025-09-09 18:21:12 +02:00
Nik
75bcb487ee patterns/ico: Fixed duplicate variable name 2025-09-01 22:22:43 +02:00
Ivy Fan-Chiang
fb214600ec patterns/ico: Add embedded BMP and PNG parsing to ICO pattern (#426)
Co-authored-by: Nik <werwolv98@gmail.com>
2025-08-31 14:32:21 +02:00
Kris Dekeyser
d95390ea42 patterns/jpeg: added support for extra data in APP0 section (#417)
Apple Multi-Picture Format JPEGs often have 4 extra bytes in the APP0 section. The pattern now skips any extra bytes beyond the fixed APP0 data.

Co-authored-by: Nik <werwolv98@gmail.com>
2025-08-31 11:40:27 +02:00
Marc Jones
284ca8d325 patterns: Add UEFI Firmare Volume Variable Store pattern (#421)
* Add UEFI Firmare Volume Variable Store pattern

Add a pattern for UEFI Firmare Volume Variable store.
This file type is commonly used with virtual machine UEFI variable files,
like OVMF.fd used with QEMU. You could also extract a UEFI firmware binary
from a flash device, search for the FV Variable Store, and set this pattern
to the FV address.

Signed-off-by: Marc Jones <marcj303@gmail.com>

* Fixed description pragma

---------

Signed-off-by: Marc Jones <marcj303@gmail.com>
Co-authored-by: Nik <werwolv98@gmail.com>
2025-08-31 11:38:32 +02:00
ODeux
6630180276 patterns: Add .NET BinaryFormatter pattern (#416)
* Add dotnet BinaryFormatter pattern

* Add dotnet BinaryFormatter test

* Update README.md

---------

Co-authored-by: Nik <werwolv98@gmail.com>
2025-08-31 11:37:59 +02:00
Henri Asseily
ff68d1e23d patterns: Added Apple IIGS SHR + SHR 3200 + SHR PWA Animation pattern (#432)
* Added SHR pattern

* Added IIGS SHR animation test file

* Added pattern to readme

* Added description and author

---------

Co-authored-by: Nik <werwolv98@gmail.com>
2025-08-31 11:36:00 +02:00
Tom Arrow
70dd55aa6b patterns/q3demo: Quake 3 demos: Handle corrupted files more gracefully (#414)
Quake 3 demos: Basic safeguard against corrupted files

Co-authored-by: Tom <tomarrowtomarrow@hotmail.com>
2025-08-31 11:31:20 +02:00
DmitriLeon2000
76f850c543 patterns/fas/was: Update FAS, WAS/WA3 pattern files and README.md (#425)
* Add .fas and .was pattern files (Oska DeskMates)

* Update .was pattern file

* Update .was/.wa3 pattern file

* Update README.md

* Update README.md

* Update .fas & .was pattern files

* Update README.md

* Update fas_oskasoftware_old.hexpat

* Added WAS test file

* Update WAS test file

* Update was_oskasoftware.hexpat

* Update was_oskasoftware.hexpat

* Update fas_oskasoftware_old.hexpat

* Update fas_oskasoftware.hexpat

* Update README.md

Replacing backward slashes with forward ones in the `WAS` row.

* Update fas_oskasoftware_old.hexpat

* Update was_oskasoftware.hexpat
2025-08-31 11:28:45 +02:00
MicroBlock
74c06b74f7 patterns/lua53: Fix lua53 long string (#427)
Update lua53.hexpat
2025-08-31 11:27:59 +02:00
Vemmi
f13d9d3894 patterns/upk-ue3: Add magic pragma (#436) 2025-08-31 11:23:09 +02:00
mjarduk
c4c75a9ab2 patterns: Add a pattern for Roblox .pack files (#435)
* Added the .pack format

* Clarified some fields by changing the naming
2025-08-25 22:22:32 +02:00
Lexi Mayfield
7fd79ec9fd patterns: Added AppleSingle, AppleDouble, CHD, TARC patterns (#431)
* Commit patterns I've collected

- AppleSingle/AppleDouble pattern, used for macOS resource forks.
- MAME CHD file format, currently only supports v5.
- KEX Engine proprietary TARC format, used by various Nightdive games.

* Add to README
2025-08-20 19:32:11 +02:00
Mark Jansen
6b9f39cc21 patterns: Add SDB pattern (#424)
Co-authored-by: Nik <werwolv98@gmail.com>
2025-08-15 17:16:50 +02:00
Stephen Hewitt
9207282bcf patterns: Added Commodore BASIC (#428)
* Commodore BASIC

* Update desc

* I made it

* Implemented suggestion

* Implemented suggestion

* Test file

* Rename file

---------

Co-authored-by: Nik <werwolv98@gmail.com>
2025-08-02 20:13:35 +02:00
Dominik Tamiołło
bc35349e0f PEF - fix export count calculation (#418)
* Initial version of PEF

* add pef test file

* Fixed export hash slot count calculation

---------

Co-authored-by: paxcut <53811119+paxcut@users.noreply.github.com>
2025-07-08 15:21:07 -07:00
Nik
fed5db4109 Add Capcom's Devil May Cry 3 HD .mod hexpat (#415)
* Add Capcom's Devil May Cry 3 HD .mod hexpat

Hex Pattern file for Capcom's Devil May Cry 3 HD Collection's .mod (3D Models) files

* Update DMC3 HD Mod.hexpat

* Update DMC3 HD Mod.hexpat

* Update DMC3 HD Mod.hexpat

* Add files via upload

* Update README.md

* Rename DMC3 HD Mod.hexpat to dmc3_hd_mod.hexpat

* Delete patterns/dmc3_hd_mod.hexpat

* Delete tests/patterns/test_data/dmc3_hd_mod.hexpat.mod

* Add files via upload

* Update dmc3_hd_mod.hexpat

---------

Co-authored-by: haruse23 <mrjokeromar123@outlook.com>
2025-07-08 14:51:54 -07:00
klirktag
1d41392215 Add support for medium and large mp4 files (#413)
add support for medium and large mp4
2025-06-29 07:33:48 -07:00
ruokeqx
0b75336638 feat(pcapng): add support for Decryption Secrets Block (#411)
feat(pcapng): add support for Decryption Secrets Block
2025-06-19 05:13:43 -07:00
Dominik Tamiołło
103d434cc5 Add PEF (Preffered Executable Format) support (#406)
* Initial version of PEF

* add pef test file

---------

Co-authored-by: paxcut <53811119+paxcut@users.noreply.github.com>
2025-06-17 22:24:54 -07:00
Fabian Neundorf
7716b9d6e7 patterns: Add support for smk (#399)
* patterns: Add support for smk

* patterns: Use builtin function and separate SMK struct

---------

Co-authored-by: paxcut <53811119+paxcut@users.noreply.github.com>
2025-06-17 14:57:36 -07:00
Tom Arrow
ad1e300674 Quake 3 Engine demo pattern & test file (#402)
* Quake 3 Engine demo pattern & test file

* Quake 3 Engine demo: Increase limits (demo files can be big) and additional condition

* Quake 3 demo specify little endian

* Quake 3 demo format: Add message type detection

* Quake 3 demo format: Read serverTime for snapshot messages

* Quake 3 demo pattern: fixed bug/typo/sleepy coding

* Quake 3 demo pattern: Ability to read CS_SERVERINFO

* Quake 3 demo pattern: Read CS_SYSTEMINFO as well

* Quake 3 demo pattern: Read first serverCommand per message

* Added Quake 3 engine demo pattern to readme

* Change Quake 3 engine demo entry in readme table

---------

Co-authored-by: Tom <tomarrowtomarrow@hotmail.com>
2025-06-17 02:06:24 -07:00
zn123
e918ce52b9 Add flv.hexpat (#401)
* Add flv.hexpat

https://veovera.org/docs/enhanced/enhanced-rtmp-v2#flv-file-format-overview

* test flv.hexpat

* Update README.md

add flv patterns

* Update flv.hexpat

Optimize spaces

* Update flv.hexpat

fix
2025-06-16 20:25:54 -07:00
Nik
db4d62aa20 patterns/fs: Refactor all partition types into a FS module 2025-05-25 19:51:32 +02:00
WerWolv
d96bfbb942 tests: Execute and test format functions 2025-05-25 12:43:21 +02:00
Nik
6b279b8375 patterns/exfat: Fixed eval depth error 2025-05-17 16:07:11 +02:00
Khoo Hao Yit
a692b22ecc patterns: Add support for exFAT (#398) 2025-05-17 13:13:35 +02:00
Claudius Coenen
2ae0499293 patterns/wintec_tes: Slightly nicer formatting in a list of entries (#397)
slightly nicer formatting in a list of entries
2025-05-16 20:25:04 +02:00