mirror of https://github.com/WerWolv/ImHex-Patterns.git synced 2026-03-27 23:37:04 -05:00

Files

jfsbrito 13b97fc976 patterns/7z: Added 7Zip pattern (#128 )

* 7z.hexpat

This repository contains a custom pattern for the ImHex tool that enables the analysis of 7zip files. The pattern allows for a structured view of 7zip files within ImHex, providing insights into various aspects of the file structure.

- Identification of 7zip files: The custom pattern detects and identifies 7zip file types based on their signature.
- Extraction of key information: The pattern extracts important details from the 7zip file, such as the format version, CRC values, relative offset of the end header, and file size.
- Differentiation of compression methods: The pattern distinguishes between LZMA and LZMA2 compression methods used within the 7zip file.
- Visualization of start and end headers: The pattern helps in visualizing the start and end headers of the 7zip file, making it easier to navigate through its structure.

To use the custom pattern for analyzing 7zip files in ImHex, follow these steps:

1. Install ImHex: Ensure that you have ImHex installed on your system.
2. Open a 7zip file: Launch ImHex and open the 7zip file you want to analyze.
3. Apply the custom pattern: In the "Pattern" menu, select the custom pattern for 7zip file analysis and apply it.
4. Explore the file structure: ImHex will display the matched patterns, allowing you to explore the structure of the 7zip file with the extracted information.

Please note that this custom pattern is designed specifically for 7zip files and may not be suitable for other file formats.

Contributions to this custom pattern for 7zip file analysis are welcome. If you have any improvements, bug fixes, or suggestions, feel free to submit a pull request.

This custom pattern for ImHex is licensed under the [MIT License](LICENSE.md). You are free to modify and distribute this pattern as per the terms of the license.

We would like to acknowledge the developers of ImHex for providing an excellent tool for binary file analysis. The custom pattern for 7zip file analysis in this repository builds upon the capabilities of ImHex to enhance the understanding of 7zip file structures.

---

We hope you find this custom pattern useful for analyzing 7zip files using ImHex. If you encounter any issues or have any questions, please feel free to raise them in the "Issues" section of this repository.

Thanks!

* Added test file

---------

2023-06-19 23:08:42 +02:00

15 KiB

Raw Blame History

ImHex Database

This repository serves as a database for files to use with the ImHex Hex Editor. It currently contains

Patterns - Binary Format definitions for the Pattern Language
Pattern Libraries - Libraries that make using the Pattern Language easier
Magic Files - Custom magic file definitions for the use with libmagic
Encodings - Custom encodings in the .tbl format
Data Processor Nodes - Custom nodes made for ImHex's Data Processor
Themes - Custom themes for ImHex
Constants - Constants definition files
Scripts - Various scripts to generate code or automate some tasks
Yara - Custom Yara rules

Submissions

Most files in this repository have been submitted by the community. Please feel free to open a PR on your own and add files to it! Everything will immediately show up in ImHex's Content Store and gets bundled with the next release of ImHex.

Hex Patterns

Name	MIME	Path	Description
7Z		`patterns/7z.hexpat`	7z File Format
AFE2		`patterns/afe2.hexpat`	Nintendo Switch Atmosphère CFW Fatal Error log
AR	`application/x-archive`	`patterns/ar.hexpat`	Static library archive files
ARM VTOR		`patterns/arm_cm_vtor.hexpat`	ARM Cortex M Vector Table Layout
Bencode	`application/x-bittorrent`	`patterns/bencode.hexpat`	Bencode encoding, used by Torrent files
BMP	`image/bmp`	`patterns/bmp.hexpat`	OS2/Windows Bitmap files
BSON	`application/bson`	`patterns/bson.hexpat`	BSON (Binary JSON) format
BSP		`patterns/bsp_goldsrc.hexpat`	GoldSrc engine maps format (used in Half-Life 1)
CCHVA		`patterns/cchva.hexpat`	Command and Conquer Voxel Animation
CCVXL		`patterns/ccvxl.hexpat`	Command and Conquer Voxel Model
CCPAL		`patterns/ccpal.hexpat`	Command and Conquer Voxel Palette
CDA		`patterns/cda.hexpat`	Compact Disc Audio track
CHM		`patterns/chm.hexpat`	Windows HtmlHelp Data (ITSF / CHM)
COFF	`application/x-coff`	`patterns/coff.hexpat`	Common Object File Format (COFF) executable
CPIO	`application/x-cpio`	`patterns/cpio.hexpat`	Old Binary CPIO Format
CrashLvl		`patterns/Crashlvl.hexpat`	Crash Bandicoot - Back in Time (fan game) User created flashback tapes level format
DDS	`image/vnd-ms.dds`	`patterns/dds.hexpat`	DirectDraw Surface
DEX		`patterns/dex.hexpat`	Dalvik EXecutable Format
DMG		`patterns/dmg.hexpat`	Apple Disk Image Trailer (DMG)
DS_Store	`application/octet-stream`	`patterns/dsstore.hexpat`	.DS_Store file format
DTA		`patterns/max_v104.hexpat`	Mechanized Assault and Exploration v1.04 (strategy game) save file format
ELF	`application/x-executable`	`patterns/elf.hexpat`	ELF header in elf binaries
EVTX		`patterns/evtx.hexpat`	MS Windows Vista Event Log
FDT		`patterns/fdt.hexpat`	Flat Linux Device Tree blob
File System		`patterns/fs.hexpat`	Drive File System
FLAC	`audio/flac`	`patterns/flac.hexpat`	Free Lossless Audio Codec, FLAC Audio Format
GB	`application/x-gameboy-rom`	`patterns/gb.hexpat`	Gameboy ROM
GIF	`image/gif`	`patterns/gif.hexpat`	GIF image files
GZIP	`application/gzip`	`patterns/gzip.hexpat`	GZip compressed data format
ICO		`patterns/ico.hexpat`	Icon (.ico) or Cursor (.cur) files
ID3	`audio/mpeg`	`patterns/id3.hexpat`	ID3 tags in MP3 files
Intel HEX		`patterns/intel_hex.hexpat`	Intel hexadecimal object file format definition
IP		`patterns/ip.hexpat`	Ethernet II Frames (IP Packets)
ISO		`patterns/iso.hexpat`	ISO 9660 file system
Java Class	`application/x-java-applet`	`patterns/java_class.hexpat`	Java Class files
JPEG	`image/jpeg`	`patterns/jpeg.hexpat`	JPEG Image Format
Lua 5.4		`patterns/lua54.hexpat`	Lua 5.4 bytecode
Mach-O	`application/x-mach-binary`	`patterns/macho.hexpat`	Mach-O executable
MIDI	`audio/midi`	`patterns/midi.hexpat`	MIDI header, event fields provided
MiniDump	`application/x-dmp`	`patterns/minidump.hexpat`	Windows MiniDump files
mp4	`video/mp4`	`patterns/mp4.hexpat`	MPEG-4 Part 14 digital multimedia container format
msgpack	`application/x-msgpack`	`patterns/msgpack.hexpat`	MessagePack binary serialization format
NACP		`patterns/nacp.hexpat`	Nintendo Switch NACP files
NBT		`patterns/nbt.hexpat`	Minecraft NBT format
NE		`patterns/ne.hexpat`	NE header and Standard NE fields
NRO		`patterns/nro.hexpat`	Nintendo Switch NRO files
NTAG		`patterns/ntag.hexpat`	NTAG213/NTAG215/NTAG216, NFC Forum Type 2 Tag compliant IC
OGG	`audio/ogg`	`patterns/ogg.hexpat`	OGG Audio format
PCAP	`application/vnd.tcpdump.pcap`	`patterns/pcap.hexpat`	pcap header and packets
PCX	`application/x-pcx`	`patterns/pcx.hexpat`	PCX Image format
PE	`application/x-dosexec`	`patterns/pe.hexpat`	PE header, COFF header, Standard COFF fields and Windows Specific fields
PFS0		`patterns/pfs0.hexpat`	Nintendo Switch PFS0 archive (NSP files)
PIF	`image/pif`	`patterns/pif.hexpat`	PIF Image Format
PNG	`image/png`	`patterns/png.hexpat`	PNG image files
PRODINFO		`patterns/prodinfo.hexpat`	Nintendo Switch PRODINFO
Protobuf		`patterns/protobuf.hexpat`	Google Protobuf encoding
QBCL		`patterns/qbcl.hexpat`	Qubicle voxel scene project file
QOI	`image/qoi`	`patterns/qoi.hexpat`	QOI image files
Shell Link	`application/x-ms-shortcut`	`patterns/lnk.hexpat`	Windows Shell Link file format
SPIRV		`patterns/spirv.hexpat`	SPIR-V header and instructions
STL	`model/stl`	`patterns/stl.hexpat`	STL 3D Model format
StuffItV5	`application/x-stuffit`	`patterns/sit5.hexpat`	StuffIt V5 archive
TAR	`application/x-tar`	`patterns/tar.hexpat`	Tar file format
TIFF	`image/tiff`	`patterns/tiff.hexpat`	Tag Image File Format
TGA	`image/tga`	`patterns/tga.hexpat`	Truevision TGA/TARGA image
UEFI		`patterns/uefi.hexpat``	UEFI structs for parsing efivars
UF2		`patterns/uf2.hexpat`	USB Flashing Format
VDF		`patterns/vdf.hexpat`	Binary Value Data Format (.vdf) files
VHDX		`patterns/vhdx.hexpat`	Microsoft Hyper-V Virtual Hard Disk format
WAV	`audio/x-wav`	`patterns/wav.hexpat`	RIFF header, WAVE header, PCM header
WAD		`patterns/wad.hexpat`	DOOM WAD Archive
XBEH	`audio/x-xbox-executable`	`patterns/xbeh.hexpat`	Xbox executable
XCI		`patterns/xci.hexpat`	Nintendo Switch XCI cardridge ROM
Xilinx BIT		`patterns/xilinx_bit.hexpat`	Xilinx FPGA Bitstreams
ZIP	`application/zip`	`patterns/zip.hexpat`	End of Central Directory Header, Central Directory File Headers
ZSTD	`application/zstd`	`patterns/zstd.hexpat`	Zstandard compressed data format

Scripts

Name	Path	Description
svd2pat	`scripts/svd2pat.py`	Converts a ARM .svd register MMIO definition file into a pattern
csv2tbl	`scripts/csv2tbl.py`	Converts a 010 editor CSV encoding file into a table file

Pattern Libraries

Name	Path	Description
libstd	`includes/std/*`	Pattern Language Standard Libaray
libtype	`includes/type/*`	Various custom types with special formatters
libhex	`includes/hex/*`	Functions to interact with ImHex

Yara rules

Name	Path	Description
Official Rules	`yara/official_rules/*`	Official Yara rules repository

Magic files

Name	Path	Description
Nintendo Switch	`magic/nintendo_switch_magic`	Identifies common file types used on the Nintendo Switch
Portable Executable	`magic/portable_executable_magic`	Identifies PE files used on Windows

Constants files

Name	Path	Description
CRC-16	`constants/crc16.json`	Constants associated with CRC-16 operations
CRC-32	`constants/crc32.json`	Constants associated with CRC-32 operations
HTTP-Codes	`constants/http_status.json`	HTTP Status code values
Linux Error Codes	`constants/linux_errors.json`	Values of Linux error results

Encoding files

Name	Path	Description
Arabic ISO	`encodings/arabic_iso.tbl`	Arabic ISO encoding
Arabic Windows	`encodings/arabic_windows.tbl`	Arabic Windows encoding
ASCII	`encodings/ascii.tbl`	Regular ASCII encoding
ASCII+ANSI	`encodings/ascii_ansi.tbl`	Extended ASCII encoding
ASCII+OEM	`encodings/ascii_oem.tbl`	ASCII encoding with Windows OEM characters
Baltic ISO	`encodings/baltic_iso.tbl`	Baltic ISO encoding
Baltic Windows	`encodings/baltic_windows.tbl`	Baltic Windows encoding
Cyrillic ISO	`encodings/cyrillic_iso.tbl`	Cyrillic ISO encoding
Cyrillic Windows	`encodings/cyrillic_windows.tbl`	Cyrillic Windows encoding
Cyrillic KOI8-R	`encodings/cyrillic_koi8_r.tbl`	Cyrillic KOI8-R encoding (Russian Characters)
Cyrillic KOI8-U	`encodings/cyrillic_koi8_u.tbl`	Cyrillic KOI8-U encoding (Ukranian Characters)
Eastern Europe ISO	`encodings/eastern_europe_iso.tbl`	Eastern Europe ISO encoding
Eastern Europe Windows	`encodings/eastern_europe_windows.tbl`	Eastern Europe Windows encoding
EBCDIC	`encodings/ebcdic.tbl`	Extended Binary Coded Decimal Interchange Code, developed by IBM for their Main Frames
EUC-JP	`encodings/euc_jp.tbl`	EUC-JP encoding with NEC special and IBM extended characters
EUC-KR	`encodings/euc_kr.tbl`	EUC-KR encoding
Greek ISO	`encodings/greek_iso.tbl`	Greek ISO encoding
Greek Windows	`encodings/greek_windows.tbl`	Greek Windows encoding
Hebrew ISO	`encodings/hebrew_iso.tbl`	Hebrew ISO encoding
Hebrew Windows	`encodings/hebrew_windows.tbl`	Hebrew Windows encoding
ISO/IEC 646	`encodings/iso_646.tbl`	ISO/IEC 646 encoding, an older version of ASCII
ISO/IEC 6937	`encodings/iso_6937.tbl`	ISO/IEC 6937 encoding, an extension of ASCII containing additional character
JIS 0201	`encodings/jis_x_0201.tbl`	JIS X 0201 encoding in UTF-8
JIS X 0211	`encodings/jis_x_0211.tbl`	JIS X 0211 encoding in UTF-8
JIS 0213	`encodings/jis_x_0213.tbl`	JIS X 0213 encoding in UTF-8
Macintosh	`encodings/macintosh.tbl`	Macintosh character encoding used by the Kermit protocol
Pokémon (English, Generation 1)	`encodings/pokegen1_en.tbl`	Character encoding used by the English generation 1 Pokémon games
Pokémon (English, Generation 3)	`encodings/pokegen3_en.tbl`	Character encoding used by the English generation 3 Pokémon games
Shift-JIS UTF-8	`encodings/shiftjis.tbl`	Shift-JIS encoding in UTF-8
Thai	`encodings/thai.tbl`	Thai character encoding
Turkish ISO	`encodings/turkish_iso.tbl`	Turkish ISO encoding
Turkish Windows	`encodings/turkish_windows.tbl`	Turkish Windows encoding
UTF-8	`encodings/utf8.tbl`	UTF-8 encoding
Vietnamese	`encodings/vietnamese.tbl`	Vietnamese character encoding

Data Processor Nodes

Name	Path	Description
Caesar Cipher	`nodes/caesar.hexnode`	Simple adjustable per-byte Caecar Cipher (ROT)
XOR Cipher	`nodes/xor.hexnode`	XORs a input with a repeating XOR pad

Themes

Name	Path	Description
Visual Studio Dark	`themes/vs_dark.json`	Theme similar to Visual Studio's Dark theme
Solarized Dark	`themes/solarized_dark.json`	Solarized Dark Theme

15 KiB Raw Blame History