├── .gitattributes ├── .github ├── FUNDING.yml ├── PULL_REQUEST_TEMPLATE │ └── pattern_template.md └── workflows │ ├── dispatch.yml │ └── tests.yml ├── .gitignore ├── .gitmodules ├── CMakeLists.txt ├── CONTRIBUTING.md ├── LICENSE ├── README.md ├── constants ├── _schema.json ├── crc16.json ├── crc32.json ├── http_status.json └── linux_errors.json ├── disassemblers ├── 8051.json └── jvm.json ├── encodings ├── arabic_iso.tbl ├── arabic_windows.tbl ├── ascii.tbl ├── ascii_ansi.tbl ├── ascii_oem.tbl ├── baltic_iso.tbl ├── baltic_windows.tbl ├── big5.tbl ├── cyrillic_cp866.tbl ├── cyrillic_iso.tbl ├── cyrillic_koi8_r.tbl ├── cyrillic_koi8_u.tbl ├── cyrillic_windows.tbl ├── eastern_europe_iso.tbl ├── eastern_europe_windows.tbl ├── ebcdic.tbl ├── euc_jp.tbl ├── euc_kr.tbl ├── gbk.tbl ├── greek_iso.tbl ├── greek_windows.tbl ├── hebrew_iso.tbl ├── hebrew_windows.tbl ├── iso_646.tbl ├── iso_6937.tbl ├── jis_x_0201.tbl ├── jis_x_0211.tbl ├── jis_x_0213.tbl ├── macintosh.tbl ├── ms932.tbl ├── pokegen1_en.tbl ├── pokegen3_en.tbl ├── shiftjis.tbl ├── thai.tbl ├── turkish_iso.tbl ├── turkish_windows.tbl ├── utf8.tbl └── vietnamese.tbl ├── includes ├── hex │ ├── core.pat │ ├── dec.pat │ ├── http.pat │ ├── impl │ │ └── imhex_check.pat │ ├── provider.pat │ └── type │ │ ├── encstr.pat │ │ ├── instruction.pat │ │ ├── json.pat │ │ └── mangled.pat ├── std │ ├── array.pat │ ├── attrs.pat │ ├── bit.pat │ ├── core.pat │ ├── ctype.pat │ ├── file.pat │ ├── fxpt.pat │ ├── hash.pat │ ├── io.pat │ ├── limits.pat │ ├── math.pat │ ├── mem.pat │ ├── ptr.pat │ ├── random.pat │ ├── string.pat │ ├── sys.pat │ └── time.pat └── type │ ├── base.pat │ ├── base64.pat │ ├── bcd.pat │ ├── byte.pat │ ├── color.pat │ ├── float16.pat │ ├── fmt.pat │ ├── guid.pat │ ├── ip.pat │ ├── leb128.pat │ ├── mac.pat │ ├── magic.pat │ ├── path.pat │ ├── size.pat │ ├── time.pat │ └── types │ ├── 010.pat │ ├── c.pat │ ├── linux.pat │ ├── rust.pat │ └── win32.pat ├── magic ├── nintendo_switch_magic └── portable_executable_magic ├── nodes ├── caesar.hexnode └── xor.hexnode ├── patterns ├── 3ds.hexpat ├── 7z.hexpat ├── Crashlvl.hexpat ├── adtfdat.hexpat ├── adts.hexpat ├── afe2.hexpat ├── ani.hexpat ├── ar.hexpat ├── arc.hexpat ├── aria2.hexpat ├── arm_cm_vtor.hexpat ├── bcss.hexpat ├── bencode.hexpat ├── bgcode.hexpat ├── binka.hexpat ├── blend.hexpat ├── bmp.hexpat ├── bplist.hexpat ├── bson.hexpat ├── bsp_goldsrc.hexpat ├── bzip3.hexpat ├── cab.hexpat ├── cchva.hexpat ├── ccpal.hexpat ├── ccvxl.hexpat ├── cda.hexpat ├── chm.hexpat ├── coff.hexpat ├── cpio.hexpat ├── credhist.hexpat ├── dds.hexpat ├── dex.hexpat ├── dicom.hexpat ├── dmg.hexpat ├── dmp64.hexpat ├── dpapiblob.hexpat ├── dpapimasterkey.hexpat ├── dsstore.hexpat ├── dted.hexpat ├── elf.hexpat ├── evtx.hexpat ├── fas_oskasoftware.hexpat ├── fas_oskasoftware_old.hexpat ├── fbx.hexpat ├── fdt.hexpat ├── flac.hexpat ├── flc.hexpat ├── flipper_settings.hexpat ├── fs.hexpat ├── fs │ ├── exfat.hexpat │ ├── ext4.hexpat │ ├── fat32.hexpat │ ├── ntfs.hexpat │ ├── pattern.hexpat │ └── refs.hexpat ├── gb.hexpat ├── gba.hexpat ├── gguf.hexpat ├── gif.hexpat ├── gltf.hexpat ├── gzip.hexpat ├── hinf_luas.hexpat ├── hinf_module.hexpat ├── hinf_tag.hexpat ├── hprof.hexpat ├── hsdt.hexpat ├── ico.hexpat ├── id3.hexpat ├── imah.hexpat ├── intel_hex.hexpat ├── ip.hexpat ├── ips.hexpat ├── iso.hexpat ├── java_class.hexpat ├── jpeg.hexpat ├── lcesave.hexpat ├── lnk.hexpat ├── loc.hexpat ├── lua51.hexpat ├── lua52.hexpat ├── lua53.hexpat ├── lua54.hexpat ├── lznt1.hexpat ├── macho.hexpat ├── max_v104.hexpat ├── midi.hexpat ├── minidump.hexpat ├── mo.hexpat ├── mp4.hexpat ├── msgpack.hexpat ├── msscmp.hexpat ├── nacp.hexpat ├── nbt.hexpat ├── nds.hexpat ├── ne.hexpat ├── nes.hexpat ├── notepad-cache.hexpat ├── notepadwindowstate.hexpat ├── nro.hexpat ├── ntag.hexpat ├── ogg.hexpat ├── optee_ta.hexpat ├── orp.hexpat ├── pbz.hexpat ├── pcap.hexpat ├── pcapng.hexpat ├── pck.hexpat ├── pcx.hexpat ├── pe.hexpat ├── pex.hexpat ├── pf.hexpat ├── pfs0.hexpat ├── pif.hexpat ├── pkm.hexpat ├── png.hexpat ├── prodinfo.hexpat ├── protobuf.hexpat ├── psafe3.hexpat ├── pyc.hexpat ├── pyinstaller.hexpat ├── qbcl.hexpat ├── qoi.hexpat ├── quantized-mesh.hexpat ├── rar.hexpat ├── ras.hexpat ├── rcf_v1_2.hexpat ├── rgbds.hexpat ├── rpm.hexpat ├── selinux.hexpat ├── selinuxpp.hexpat ├── shp.hexpat ├── shx.hexpat ├── sit5.hexpat ├── spirv.hexpat ├── sqlite3.hexpat ├── stdfv4.hexpat ├── stl.hexpat ├── sup.hexpat ├── swf.hexpat ├── tar.hexpat ├── tga.hexpat ├── thumbcache.hexpat ├── tiff.hexpat ├── ttf.hexpat ├── ubiquiti.hexpat ├── uefi.hexpat ├── uefi_boot_entry.hexpat ├── uf2.hexpat ├── upk-ue3.hexpat ├── usb.hexpat ├── valve_vpk.hexpat ├── vbmeta.hexpat ├── vdf.hexpat ├── veado.hexpat ├── vgm.hexpat ├── vhdx.hexpat ├── vox.hexpat ├── wad.hexpat ├── was_oskasoftware.hexpat ├── wav.hexpat ├── webp.hexpat ├── wintec_tes.hexpat ├── xbeh.hexpat ├── xci.hexpat ├── xgspak.hexpat ├── xgstexture.hexpat ├── xilinx_bit.hexpat ├── xilinx_bootgen.hexpat ├── zim.hexpat ├── zip.hexpat ├── zlib.hexpat └── zstd.hexpat ├── plugins └── extra-hashes.json ├── scripts ├── csv2tbl.py ├── extract_legacy_hexproj.py ├── ksy2pat.py ├── svd2pat.py └── utf8tblgen.py ├── tests ├── CMakeLists.txt ├── includes │ ├── CMakeLists.txt │ └── source │ │ └── main.cpp ├── magic │ ├── CMakeLists.txt │ └── source │ │ └── main.cpp └── patterns │ ├── CMakeLists.txt │ ├── source │ └── main.cpp │ └── test_data │ ├── 3ds.hexpat.3ds │ ├── 7z.hexpat.7z │ ├── CrashLvl.hexpat │ ├── adtfdat.hexpat.adtfdat │ ├── adts.hexpat.aac │ ├── afe2.hexpat.bin │ ├── ani.compatibility.hexpat.ani │ ├── ani.hexpat.ani │ ├── ar.hexpat.ar │ ├── arc.hexpat.arc │ ├── aria2.hexpat.aria2 │ ├── arm_cm_vtor.hexpat.bin │ ├── bcss.hexpat │ ├── test.bcss │ └── test.bcss_content │ ├── bencode.hexpat.torrent │ ├── bgcode.hexpat.bgcode │ ├── blend.hexpat │ ├── blend.hexpat.blend │ └── blend_zstd.hexpat.blend │ ├── bmp.hexpat.bmp │ ├── bplist.hexpat.bplist │ ├── bson.hexpat.bin │ ├── bsp_goldsrc.hexpat.bsp │ ├── bzip3.hexpat.bz3 │ ├── cab.hexpat.cab │ ├── ccvxl.hexpat.vxl │ ├── cda.hexpat.cda │ ├── chm.hexpat.chm │ ├── coff.hexpat.obj │ ├── cpio.hexpat.cpio │ ├── credhist.hexpat.bin │ ├── dds.hexpat.dds │ ├── dex.hexpat.dex │ ├── dicom.hexpat │ ├── jpeg-wsi.dcm │ └── le-explicit-vlp.dcm │ ├── dmg.hexpat.dmg │ ├── dmp64.hexpat.bin │ ├── dpapiblob.hexpat.bin │ ├── dpapimasterkey.hexpat.bin │ ├── dsstore.hexpat.dsstore │ ├── dted.hexpat.dt0 │ ├── elf.hexpat.elf │ ├── evtx.hexpat.evtx │ ├── ext4.hexpat.img │ ├── fbx.hexpat.fbx │ ├── fdt.hexpat.dtb │ ├── flac.hexpat.flac │ ├── flc.hexpat.flc │ ├── flipper_settings.hexpat │ ├── bt.settings │ ├── desktop.settings │ ├── dolphin.state │ ├── expansion.settings │ ├── infrared.settings │ └── notification.settings │ ├── fs.hexpat.img │ ├── gb.hexpat.gb │ ├── gguf.hexpat.gguf │ ├── gif.hexpat.gif │ ├── gltf.hexpat.glb │ ├── gzip.hexpat.gz │ ├── hinf_luas.hexpat.luas │ ├── hinf_module.hexpat.module │ ├── hinf_tag.hexpat.tag │ ├── hprof.hexpat.bin │ ├── hsdt.hexpat.hsdt │ ├── ico.hexpat.ico │ ├── id3.hexpat.mp3 │ ├── imah.hexpat.fw.sig │ ├── intel_hex.hexpat.hex │ ├── ips.hexpat.ips │ ├── iso.hexpat.iso │ ├── java_class.hexpat.class │ ├── jpeg.hexpat.jpeg │ ├── lcesave.hexpat │ ├── MC-TU033PreRelease_savegameDecompressed.dat │ └── MC-TU5-Release_savegameDecompressed.dat │ ├── lnk.hexpat.lnk │ ├── lua51.hexpat.lua │ ├── lua52.hexpat.lua │ ├── lua53.hexpat.lua │ ├── lua54.hexpat.lua │ ├── lznt1.hexpat.lznt1 │ ├── macho.hexpat.o │ ├── max_v104.hexpat.dta │ ├── midi.hexpat.mid │ ├── minidump.hexpat.dmp │ ├── mo.hexpat.mo │ ├── mp4.hexpat.mp4 │ ├── msgpack.hexpat.bin │ ├── nacp.hexpat.nacp │ ├── nbt.hexpat.nbt │ ├── ne.hexpat.exe │ ├── nes.hexpat.nes │ ├── notepad-cache.hexpat.bin │ ├── notepadwindowstate.hexpat.bin │ ├── nro.hexpat.nro │ ├── ntag.hexpat.bin │ ├── ogg.hexpat.ogg │ ├── orp.hexpat.orp │ ├── pcap.hexpat.pcap │ ├── pcapng.hexpat.bin │ ├── pck.hexpat.pck │ ├── pcx.hexpat.pcx │ ├── pe.hexpat.exe │ ├── pex.hexpat.pex │ ├── pfs0.hexpat.nsp │ ├── pif.hexpat.pif │ ├── pkm.hexpat.pkm │ ├── png.hexpat.png │ ├── protobuf.hexpat.bin │ ├── psafe3.hexpat.psafe3 │ ├── pyc.hexpat.pyc │ ├── pyinstaller.hexpat.elf │ ├── qoi.hexpat.qoi │ ├── rar.hexpat.rar │ ├── ras.hexpat.ras │ ├── rgbds.hexpat.o │ ├── selinux.hexpat.bin │ ├── selinuxpp.hexpat.pp │ ├── shp.hexpat.shp │ ├── shx.hexpat.shx │ ├── sit5.hexpat.sit │ ├── sqlite3.hexpat.db │ ├── stl.hexpat.stl │ ├── sup.hexpat.sup │ ├── swf.hexpat.swf │ ├── tar.hexpat.tar │ ├── tga.hexpat.tga │ ├── tiff.hexpat │ ├── bigtiff-be-tiled.tiff │ ├── bigtiff-le-stripped.tiff │ ├── classic-be-stripped.tiff │ ├── classic-le-stripped.tiff │ └── classic-le-tiled.tiff │ ├── ttf.hexpat.ttf │ ├── ubiquiti.hexpat.bin │ ├── uefi_boot_entry.hexpat.bin │ ├── uf2.hexpat.uf2 │ ├── usb.hexpat.bin │ ├── valve_vpk.hexpat.vpk │ ├── vbmeta.hexpat.img │ ├── vdf.hexpat.vdf │ ├── veado.hexpat.veado │ ├── vox.hexpat.vox │ ├── wad.hexpat.wad │ ├── was_oskasoftware.hexpat.was │ ├── wav.hexpat.wav │ ├── webp.hexpat.webp │ ├── xilinx_bootgen.hexpat.bin │ ├── zim.hexpat.zim │ ├── zip.hexpat │ └── regular.zip │ ├── zlib.hexpat.zlib │ └── zstd.hexpat.zst ├── themes ├── Nocturne.json ├── catppuccin-frappe.json ├── catppuccin-latte.json ├── catppuccin-macchiato.json ├── catppuccin-mocha.json ├── one_dark.json ├── solarized_dark.json └── vs_dark.json ├── tips ├── _schema.json ├── imhex.json └── re.json └── yara └── advanced_analysis ├── compiler.yar ├── cryptography.yar ├── environment.yar └── language.yar /.gitattributes: -------------------------------------------------------------------------------- 1 | *.pat linguist-language=Rust 2 | *.hexpat linguist-language=Rust 3 | 4 | tests/patterns/test_data/** binary 5 | -------------------------------------------------------------------------------- /.github/FUNDING.yml: -------------------------------------------------------------------------------- 1 | # Sponsor links 2 | 3 | patreon: werwolv 4 | custom: https://werwolv.net/donate 5 | github: WerWolv 6 | -------------------------------------------------------------------------------- /.github/PULL_REQUEST_TEMPLATE/pattern_template.md: -------------------------------------------------------------------------------- 1 | # Pattern 2 | 3 | [Information about your pattern] 4 | 5 | ## Checklist 6 | - [ ] A pattern for this format doesn't exist yet (or this PR improves the existing one) 7 | - [ ] The new pattern has been added to the relevant table in the Readme 8 | - [ ] The new pattern has a description pragma (`#pragma description My pattern Description here`) 9 | - [ ] The pattern was associated with all relevant MIME types (using `#pragma MIME mime-type` in the source code) 10 | - Make sure to never use `application/octet-stream` here as that means "Unidentifiable binary data" 11 | - [ ] A test file for this pattern has been added to [/tests/patterns/test_data](/tests/patterns/test_data) 12 | - Try to keep this file below ~ 1 MB 13 | -------------------------------------------------------------------------------- /.github/workflows/dispatch.yml: -------------------------------------------------------------------------------- 1 | name: "Dispatch" 2 | 3 | on: 4 | push: 5 | branches: [ '*' ] 6 | pull_request: 7 | branches: [ '*' ] 8 | repository_dispatch: 9 | types: [run_tests] 10 | workflow_dispatch: 11 | inputs: 12 | generate_docs: 13 | description: "Regenerate docs" 14 | required: false 15 | type: boolean 16 | 17 | jobs: 18 | tests: 19 | name: 🎯 Dispatch changes 20 | runs-on: ubuntu-24.04 21 | env: 22 | DISPATCH_TOKEN: ${{ secrets.DISPATCH_TOKEN }} 23 | permissions: 24 | actions: read 25 | contents: read 26 | security-events: write 27 | 28 | steps: 29 | - name: 🧰 Checkout 30 | uses: actions/checkout@v4 31 | with: 32 | submodules: recursive 33 | 34 | - name: 📄 Check changed include files 35 | id: changed-includes 36 | uses: tj-actions/changed-files@v45 37 | with: 38 | files: includes/**/*.pat 39 | 40 | - name: ✉️ Run Documentation generator 41 | if: ${{ env.DISPATCH_TOKEN != '' && (steps.changed-includes.outputs.any_changed == 'true' || inputs.generate_docs || github.event_name == 'repository_dispatch' ) }} 42 | uses: mvasigh/dispatch-action@main 43 | with: 44 | token: ${{ secrets.DISPATCH_TOKEN }} 45 | repo: Documentation 46 | owner: WerWolv 47 | event_type: update_pl_docs 48 | 49 | - name: ✉️ Update PatternLanguage Website 50 | if: ${{ env.DISPATCH_TOKEN != '' }} 51 | uses: mvasigh/dispatch-action@main 52 | with: 53 | token: ${{ secrets.DISPATCH_TOKEN }} 54 | repo: PatternLanguageWeb 55 | owner: WerWolv 56 | event_type: rebuild_wasm 57 | -------------------------------------------------------------------------------- /.github/workflows/tests.yml: -------------------------------------------------------------------------------- 1 | name: "Unit Tests" 2 | 3 | on: 4 | push: 5 | branches: [ '*' ] 6 | pull_request: 7 | branches: [ '*' ] 8 | repository_dispatch: 9 | types: [run_tests] 10 | 11 | jobs: 12 | tests: 13 | name: 🧪 Unit Tests 14 | runs-on: ubuntu-24.04 15 | permissions: 16 | actions: read 17 | contents: read 18 | security-events: write 19 | 20 | steps: 21 | - name: 🧰 Checkout 22 | uses: actions/checkout@v4 23 | with: 24 | submodules: recursive 25 | 26 | - name: ⬇️ Install dependencies 27 | run: | 28 | sudo apt update 29 | sudo apt install -y \ 30 | build-essential \ 31 | ccache \ 32 | gcc-14 \ 33 | g++-14 \ 34 | lld \ 35 | ${PKGCONF:-} \ 36 | cmake \ 37 | ninja-build \ 38 | python3 \ 39 | python3-pip \ 40 | libmagic-dev \ 41 | lcov 42 | 43 | sudo pip install jsonschema 44 | 45 | - name: 📜 Setup ccache 46 | uses: hendrikmuhs/ccache-action@v1 47 | with: 48 | key: ${{ runner.os }}-ccache-${{ github.run_id }} 49 | restore-keys: ${{ runner.os }}-ccache 50 | max-size: 1G 51 | 52 | - name: 🛠️ Build 53 | run: | 54 | mkdir -p build 55 | cd build 56 | CC=gcc-14 CXX=g++-14 cmake \ 57 | -DCMAKE_C_COMPILER_LAUNCHER=ccache \ 58 | -DCMAKE_CXX_COMPILER_LAUNCHER=ccache \ 59 | -DCMAKE_C_FLAGS="-fuse-ld=lld --coverage" \ 60 | -DCMAKE_CXX_FLAGS="-fuse-ld=lld --coverage" \ 61 | -DIMHEX_PATTERNS_ENABLE_UNIT_TESTS=ON \ 62 | -DLIBPL_ENABLE_TESTS=OFF \ 63 | -DLIBPL_ENABLE_CLI=OFF \ 64 | -G Ninja \ 65 | .. 66 | ninja unit_tests 67 | 68 | - name: 🧪 Perform Unit Tests 69 | run: | 70 | cd build 71 | ctest --output-on-failure -j 4 72 | 73 | - name: 📎 Validate JSON Files 74 | run: | 75 | cd constants 76 | for file in ./[!_schema.json]*; do jsonschema -i $file _schema.json; done 77 | cd .. 78 | 79 | cd tips 80 | for file in ./[!_schema.json]*; do jsonschema -i $file _schema.json; done 81 | cd .. 82 | -------------------------------------------------------------------------------- /.gitignore: -------------------------------------------------------------------------------- 1 | 2 | tests/cmake*/ 3 | tests/build*/ 4 | build/ 5 | 6 | .vscode/ 7 | .devcontainer/ 8 | .cache/ 9 | .idea/ 10 | .DS_Store 11 | 12 | compile_commands.json -------------------------------------------------------------------------------- /.gitmodules: -------------------------------------------------------------------------------- 1 | [submodule "rules"] 2 | path = yara/official_rules 3 | url = https://github.com/Yara-Rules/rules 4 | branch = master 5 | [submodule "patterns/ffx"] 6 | path = patterns/ffx 7 | url = https://gitlab.com/EvelynTSMG/imhex-ffx-pats.git 8 | [submodule "patterns/bastion"] 9 | path = patterns/bastion 10 | url = https://gitlab.com/EvelynTSMG/imhex-bastion-pats.git 11 | -------------------------------------------------------------------------------- /CMakeLists.txt: -------------------------------------------------------------------------------- 1 | cmake_minimum_required(VERSION 3.16) 2 | 3 | project(ImHex-Patterns) 4 | 5 | option(IMHEX_PATTERNS_ENABLE_UNIT_TESTS "Enable building unit tests for ImHex-Patterns" OFF) 6 | 7 | # if enabled, add a unit_test custom target for all the unit tests to be registered against 8 | if(IMHEX_PATTERNS_ENABLE_UNIT_TESTS) 9 | if(NOT TARGET unit_tests) 10 | enable_testing() 11 | add_custom_target(unit_tests) 12 | endif() 13 | endif() 14 | 15 | # If this has been manually cloned into another project, libpl may already have been set up 16 | if(NOT TARGET libpl) 17 | include(FetchContent) 18 | 19 | FetchContent_Declare( 20 | pattern_language 21 | GIT_REPOSITORY https://github.com/WerWolv/PatternLanguage 22 | GIT_TAG master 23 | ) 24 | 25 | FetchContent_MakeAvailable(pattern_language) 26 | endif() 27 | 28 | if(IMHEX_PATTERNS_ENABLE_UNIT_TESTS) 29 | add_subdirectory(tests) 30 | endif() -------------------------------------------------------------------------------- /CONTRIBUTING.md: -------------------------------------------------------------------------------- 1 | # Contributing 2 | 3 | Contributing to the Database is very simple. Fork this repository, add your new files (or changes to existing files) to the right folders and create a PR. 4 | When adding new files, please make sure to also add a link to them to the Table of Contents in the README.md file. That way the files can be discovered by others more easily. 5 | 6 | Thanks a lot for any additions or improvements :) 7 | 8 | ## Adding new Patterns 9 | 10 | When adding new patterns, if possible, please also add a test file named `.hexpat.` to the `/tests/patterns/test_data` directory. This allows our Unit Tests to be run against your code so we can make sure it stays up-to-date and doesn't break when changes are made to the PatternLanguage. 11 | Please try to keep these files as small as possible (~100kiB at most) so cloning stays fast. 12 | Please also make sure to not submit any test files that are under copyright such as game files, ROMs or files extracted from other programs. We don't want a DMCA takedown on this repo. 13 | -------------------------------------------------------------------------------- /constants/_schema.json: -------------------------------------------------------------------------------- 1 | { 2 | "definitions": {}, 3 | "$schema": "http://json-schema.org/draft-07/schema#", 4 | "$id": "https://example.com/object1655988398.json", 5 | "title": "Root", 6 | "type": "object", 7 | "required": [ 8 | "name", 9 | "values" 10 | ], 11 | "properties": { 12 | "name": { 13 | "$id": "#root/name", 14 | "title": "Name", 15 | "type": "string", 16 | "default": "", 17 | "examples": [ 18 | "Group description" 19 | ], 20 | "pattern": "^.*$" 21 | }, 22 | "values": { 23 | "$id": "#root/values", 24 | "title": "Values", 25 | "type": "array", 26 | "default": [], 27 | "items":{ 28 | "$id": "#root/values/items", 29 | "title": "Items", 30 | "type": "object", 31 | "required": [ 32 | "type", 33 | "value", 34 | "name" 35 | ], 36 | "properties": { 37 | "type": { 38 | "$id": "#root/values/items/type", 39 | "title": "Type", 40 | "type": "string", 41 | "default": "", 42 | "examples": [ 43 | "int16be", 44 | "int16le", 45 | "int10" 46 | ], 47 | "pattern": "^(int10|int16le|int16be)$" 48 | }, 49 | "value": { 50 | "$id": "#root/values/items/value", 51 | "title": "Value", 52 | "type": "string", 53 | "default": "", 54 | "examples": [ 55 | "ACDC" 56 | ], 57 | "pattern": "^([0-9a-fA-F]+)$" 58 | }, 59 | "name": { 60 | "$id": "#root/values/items/name", 61 | "title": "Name", 62 | "type": "string", 63 | "default": "", 64 | "examples": [ 65 | "Constant description" 66 | ], 67 | "pattern": "^.*$" 68 | } 69 | } 70 | } 71 | } 72 | } 73 | } 74 | -------------------------------------------------------------------------------- /constants/crc32.json: -------------------------------------------------------------------------------- 1 | { 2 | "name": "CRC32 Constants", 3 | "values": [ 4 | { 5 | "type": "int16be", 6 | "value": "04C11DB7", 7 | "name": "CRC-32 Polynomial" 8 | }, 9 | { 10 | "type": "int16be", 11 | "value": "04C11DB7", 12 | "name": "CRC-32/BZIP2 Polynomial" 13 | }, 14 | { 15 | "type": "int16be", 16 | "value": "1EDC6F41", 17 | "name": "CRC-32C Polynomial" 18 | }, 19 | { 20 | "type": "int16be", 21 | "value": "A833982B", 22 | "name": "CRC-32D Polynomial" 23 | }, 24 | { 25 | "type": "int16be", 26 | "value": "04C11DB7", 27 | "name": "CRC-32/MPEG-2 Polynomial" 28 | }, 29 | { 30 | "type": "int16be", 31 | "value": "04C11DB7", 32 | "name": "CRC-32/POSIX Polynomial" 33 | }, 34 | { 35 | "type": "int16be", 36 | "value": "814141AB", 37 | "name": "CRC-32Q Polynomial" 38 | }, 39 | { 40 | "type": "int16be", 41 | "value": "04C11DB7", 42 | "name": "CRC-32/JAMCRC Polynomial" 43 | }, 44 | { 45 | "type": "int16be", 46 | "value": "000000AF", 47 | "name": "CRC-32/XFER Polynomial" 48 | } 49 | ] 50 | } -------------------------------------------------------------------------------- /encodings/ascii.tbl: -------------------------------------------------------------------------------- 1 | 00=NUL 2 | 01=SOH 3 | 02=STX 4 | 03=ETX 5 | 04=EOT 6 | 05=ENQ 7 | 06=ACK 8 | 07=BEL 9 | 08=BS 10 | 09=TAB 11 | 0A=LF 12 | 0B=VT 13 | 0C=FF 14 | 0D=CR 15 | 0E=SO 16 | 0F=SI 17 | 10=DLE 18 | 11=DC1 19 | 12=DC2 20 | 13=DC3 21 | 14=DC4 22 | 15=NAK 23 | 16=SYN 24 | 17=ETB 25 | 18=CAN 26 | 19=EM 27 | 1A=SUB 28 | 1B=ESC 29 | 1C=FS 30 | 1D=GS 31 | 1E=RS 32 | 1F=US 33 | 20= 34 | 21=! 35 | 22=" 36 | 23=# 37 | 24=$ 38 | 25=% 39 | 26=& 40 | 27=' 41 | 28=( 42 | 29=) 43 | 2A=* 44 | 2B=+ 45 | 2C=, 46 | 2D=- 47 | 2E=. 48 | 2F=/ 49 | 30=0 50 | 31=1 51 | 32=2 52 | 33=3 53 | 34=4 54 | 35=5 55 | 36=6 56 | 37=7 57 | 38=8 58 | 39=9 59 | 3A=: 60 | 3B=; 61 | 3C=< 62 | 3D== 63 | 3E=> 64 | 3F=? 65 | 40=@ 66 | 41=A 67 | 42=B 68 | 43=C 69 | 44=D 70 | 45=E 71 | 46=F 72 | 47=G 73 | 48=H 74 | 49=I 75 | 4A=J 76 | 4B=K 77 | 4C=L 78 | 4D=M 79 | 4E=N 80 | 4F=O 81 | 50=P 82 | 51=Q 83 | 52=R 84 | 53=S 85 | 54=T 86 | 55=U 87 | 56=V 88 | 57=W 89 | 58=X 90 | 59=Y 91 | 5A=Z 92 | 5B=[ 93 | 5C=\ 94 | 5D=] 95 | 5E=^ 96 | 5F=_ 97 | 60=` 98 | 61=a 99 | 62=b 100 | 63=c 101 | 64=d 102 | 65=e 103 | 66=f 104 | 67=g 105 | 68=h 106 | 69=i 107 | 6A=j 108 | 6B=k 109 | 6C=l 110 | 6D=m 111 | 6E=n 112 | 6F=o 113 | 70=p 114 | 71=q 115 | 72=r 116 | 73=s 117 | 74=t 118 | 75=u 119 | 76=v 120 | 77=w 121 | 78=x 122 | 79=y 123 | 7A=z 124 | 7B={ 125 | 7C=| 126 | 7D=} 127 | 7E=~ 128 | 7F=DEL 129 | 80 130 | 81 131 | 82 132 | 83 133 | 84 134 | 85 135 | 86 136 | 87 137 | 88 138 | 89 139 | 8A 140 | 8B 141 | 8C 142 | 8D 143 | 8E 144 | 8F 145 | 90 146 | 91 147 | 92 148 | 93 149 | 94 150 | 95 151 | 96 152 | 97 153 | 98 154 | 99 155 | 9A 156 | 9B 157 | 9C 158 | 9D 159 | 9E 160 | 9F 161 | A0 162 | A1 163 | A2 164 | A3 165 | A4 166 | A5 167 | A6 168 | A7 169 | A8 170 | A9 171 | AA 172 | AB 173 | AC 174 | AD 175 | AE 176 | AF 177 | B0 178 | B1 179 | B2 180 | B3 181 | B4 182 | B5 183 | B6 184 | B7 185 | B8 186 | B9 187 | BA 188 | BB 189 | BC 190 | BD 191 | BE 192 | BF 193 | C0 194 | C1 195 | C2 196 | C3 197 | C4 198 | C5 199 | C6 200 | C7 201 | C8 202 | C9 203 | CA 204 | CB 205 | CC 206 | CD 207 | CE 208 | CF 209 | D0 210 | D1 211 | D2 212 | D3 213 | D4 214 | D5 215 | D6 216 | D7 217 | D8 218 | D9 219 | DA 220 | DB 221 | DC 222 | DD 223 | DE 224 | DF 225 | E0 226 | E1 227 | E2 228 | E3 229 | E4 230 | E5 231 | E6 232 | E7 233 | E8 234 | E9 235 | EA 236 | EB 237 | EC 238 | ED 239 | EE 240 | EF 241 | F0 242 | F1 243 | F2 244 | F3 245 | F4 246 | F5 247 | F6 248 | F7 249 | F8 250 | F9 251 | FA 252 | FB 253 | FC 254 | FD 255 | FE 256 | FF 257 | -------------------------------------------------------------------------------- /encodings/iso_646.tbl: -------------------------------------------------------------------------------- 1 | 00=NUL 2 | 01=SOH 3 | 02=STX 4 | 03=ETX 5 | 04=EOT 6 | 05=ENQ 7 | 06=ACK 8 | 07=BEL 9 | 08=BS 10 | 09=HT 11 | 0A=LF 12 | 0B=VT 13 | 0C=FF 14 | 0D=CR 15 | 0E=SO 16 | 0F=SI 17 | 10=DLE 18 | 11=DC1 19 | 12=DC2 20 | 13=DC3 21 | 14=DC4 22 | 15=NAK 23 | 16=SYN 24 | 17=ETB 25 | 18=CAN 26 | 19=EM 27 | 1A=SUB 28 | 1B=ESC 29 | 1C=FS 30 | 1D=GS 31 | 1E=RS 32 | 1F=US 33 | 20=SP 34 | 21=! 35 | 22=" 36 | 23= 37 | 24= 38 | 25=% 39 | 26=& 40 | 27=' 41 | 28=( 42 | 29=) 43 | 2A=* 44 | 2B=+ 45 | 2C=, 46 | 2D=- 47 | 2E=. 48 | 2F=/ 49 | 30=0 50 | 31=1 51 | 32=2 52 | 33=3 53 | 34=4 54 | 35=5 55 | 36=6 56 | 37=7 57 | 38=8 58 | 39=9 59 | 3A=: 60 | 3B=; 61 | 3C=< 62 | 3D== 63 | 3E=> 64 | 3F=? 65 | 40= 66 | 41=A 67 | 42=B 68 | 43=C 69 | 44=D 70 | 45=E 71 | 46=F 72 | 47=G 73 | 48=H 74 | 49=I 75 | 4A=J 76 | 4B=K 77 | 4C=L 78 | 4D=M 79 | 4E=N 80 | 4F=O 81 | 50=P 82 | 51=Q 83 | 52=R 84 | 53=S 85 | 54=T 86 | 55=U 87 | 56=V 88 | 57=W 89 | 58=X 90 | 59=Y 91 | 5A=Z 92 | 5B= 93 | 5C= 94 | 5D= 95 | 5E= 96 | 5F=_ 97 | 60= 98 | 61=a 99 | 62=b 100 | 63=c 101 | 64=d 102 | 65=e 103 | 66=f 104 | 67=g 105 | 68=h 106 | 69=i 107 | 6A=j 108 | 6B=k 109 | 6C=l 110 | 6D=m 111 | 6E=n 112 | 6F=o 113 | 70=p 114 | 71=q 115 | 72=r 116 | 73=s 117 | 74=t 118 | 75=u 119 | 76=v 120 | 77=w 121 | 78=x 122 | 79=y 123 | 7A=z 124 | 7B= 125 | 7C= 126 | 7D= 127 | 7E= 128 | 7F=DEL 129 | -------------------------------------------------------------------------------- /encodings/iso_6937.tbl: -------------------------------------------------------------------------------- 1 | 20= 2 | 21=! 3 | 22=" 4 | 23=# 5 | 24=$ 6 | 25=% 7 | 26=& 8 | 27=' 9 | 28=( 10 | 29=) 11 | 2A=* 12 | 2B=+ 13 | 2C=, 14 | 2D=- 15 | 2E=. 16 | 2F=/ 17 | 30=0 18 | 31=1 19 | 32=2 20 | 33=3 21 | 34=4 22 | 35=5 23 | 36=6 24 | 37=7 25 | 38=8 26 | 39=9 27 | 3A=: 28 | 3B=; 29 | 3C=< 30 | 3D== 31 | 3E=> 32 | 3F=? 33 | 40=@ 34 | 41=A 35 | 42=B 36 | 43=C 37 | 44=D 38 | 45=E 39 | 46=F 40 | 47=G 41 | 48=H 42 | 49=I 43 | 4A=J 44 | 4B=K 45 | 4C=L 46 | 4D=M 47 | 4E=N 48 | 4F=O 49 | 50=P 50 | 51=Q 51 | 52=R 52 | 53=S 53 | 54=T 54 | 55=U 55 | 56=V 56 | 57=W 57 | 58=X 58 | 59=Y 59 | 5A=Z 60 | 5B=[ 61 | 5C=\ 62 | 5D=] 63 | 5E=^ 64 | 5F=_ 65 | 60=` 66 | 61=a 67 | 62=b 68 | 63=c 69 | 64=d 70 | 65=e 71 | 66=f 72 | 67=g 73 | 68=h 74 | 69=i 75 | 6A=j 76 | 6B=k 77 | 6C=l 78 | 6D=m 79 | 6E=n 80 | 6F=o 81 | 70=p 82 | 71=q 83 | 72=r 84 | 73=s 85 | 74=t 86 | 75=u 87 | 76=v 88 | 77=w 89 | 78=x 90 | 79=y 91 | 7A=z 92 | 7B={ 93 | 7C=| 94 | 7D=} 95 | 7E=~ 96 | 7F= 97 | A0=  98 | A1=¡ 99 | A2=¢ 100 | A3=£ 101 | A5=¥ 102 | A7=§ 103 | A8=¤ 104 | A9=‘ 105 | AA=“ 106 | AB=« 107 | AC=← 108 | AD=↑ 109 | AE=→ 110 | AF=↓ 111 | B0=° 112 | B1=± 113 | B2=² 114 | B3=³ 115 | B4=× 116 | B5=µ 117 | B6=¶ 118 | B7=· 119 | B8=÷ 120 | B9=’ 121 | BA=” 122 | BB=» 123 | BC=¼ 124 | BD=½ 125 | BE=¾ 126 | BF=¿ 127 | C1=̀ 128 | C2=́ 129 | C3=̂ 130 | C4=̃ 131 | C5=̄ 132 | C6=̆ 133 | C7=̇ 134 | C8=̈ 135 | CA=̊ 136 | CB=̧ 137 | CD=̋ 138 | CE=̨ 139 | CF=̌ 140 | D0=― 141 | D1=¹ 142 | D2=® 143 | D3=© 144 | D4=™ 145 | D5=♪ 146 | D6=¬ 147 | D7=¦ 148 | DC=⅛ 149 | DD=⅜ 150 | DE=⅝ 151 | DF=⅞ 152 | E0=Ω 153 | E1=Æ 154 | E2=Đ 155 | E3=ª 156 | E4=Ħ 157 | E6=IJ 158 | E7=Ŀ 159 | E8=Ł 160 | E9=Ø 161 | EA=Œ 162 | EB=º 163 | EC=Þ 164 | ED=Ŧ 165 | EE=Ŋ 166 | EF=ʼn 167 | F0=ĸ 168 | F1=æ 169 | F2=đ 170 | F3=ð 171 | F4=ħ 172 | F5=ı 173 | F6=ij 174 | F7=ŀ 175 | F8=ł 176 | F9=ø 177 | FA=œ 178 | FB=ß 179 | FC=þ 180 | FD=ŧ 181 | FE=ŋ 182 | FF=­ 183 | -------------------------------------------------------------------------------- /encodings/jis_x_0201.tbl: -------------------------------------------------------------------------------- 1 | 20= 2 | 21=! 3 | 22=" 4 | 23=# 5 | 24=$ 6 | 25=% 7 | 26=& 8 | 27=' 9 | 28=( 10 | 29=) 11 | 2A=* 12 | 2B=+ 13 | 2C=, 14 | 2D=- 15 | 2E=. 16 | 2F=/ 17 | 30=0 18 | 31=1 19 | 32=2 20 | 33=3 21 | 34=4 22 | 35=5 23 | 36=6 24 | 37=7 25 | 38=8 26 | 39=9 27 | 3A=: 28 | 3B=; 29 | 3C=< 30 | 3D== 31 | 3E=> 32 | 3F=? 33 | 40=@ 34 | 41=A 35 | 42=B 36 | 43=C 37 | 44=D 38 | 45=E 39 | 46=F 40 | 47=G 41 | 48=H 42 | 49=I 43 | 4A=J 44 | 4B=K 45 | 4C=L 46 | 4D=M 47 | 4E=N 48 | 4F=O 49 | 50=P 50 | 51=Q 51 | 52=R 52 | 53=S 53 | 54=T 54 | 55=U 55 | 56=V 56 | 57=W 57 | 58=X 58 | 59=Y 59 | 5A=Z 60 | 5B=[ 61 | 5C=¥ 62 | 5D=] 63 | 5E=^ 64 | 5F=_ 65 | 60=` 66 | 61=a 67 | 62=b 68 | 63=c 69 | 64=d 70 | 65=e 71 | 66=f 72 | 67=g 73 | 68=h 74 | 69=i 75 | 6A=j 76 | 6B=k 77 | 6C=l 78 | 6D=m 79 | 6E=n 80 | 6F=o 81 | 70=p 82 | 71=q 83 | 72=r 84 | 73=s 85 | 74=t 86 | 75=u 87 | 76=v 88 | 77=w 89 | 78=x 90 | 79=y 91 | 7A=z 92 | 7B={ 93 | 7C=| 94 | 7D=} 95 | 7E=‾ 96 | A1=｡ 97 | A2=｢ 98 | A3=｣ 99 | A4=､ 100 | A5=･ 101 | A6=ｦ 102 | A7=ｧ 103 | A8=ｨ 104 | A9=ｩ 105 | AA=ｪ 106 | AB=ｫ 107 | AC=ｬ 108 | AD=ｭ 109 | AE=ｮ 110 | AF=ｯ 111 | B0=ｰ 112 | B1=ｱ 113 | B2=ｲ 114 | B3=ｳ 115 | B4=ｴ 116 | B5=ｵ 117 | B6=ｶ 118 | B7=ｷ 119 | B8=ｸ 120 | B9=ｹ 121 | BA=ｺ 122 | BB=ｻ 123 | BC=ｼ 124 | BD=ｽ 125 | BE=ｾ 126 | BF=ｿ 127 | C0=ﾀ 128 | C1=ﾁ 129 | C2=ﾂ 130 | C3=ﾃ 131 | C4=ﾄ 132 | C5=ﾅ 133 | C6=ﾆ 134 | C7=ﾇ 135 | C8=ﾈ 136 | C9=ﾉ 137 | CA=ﾊ 138 | CB=ﾋ 139 | CC=ﾌ 140 | CD=ﾍ 141 | CE=ﾎ 142 | CF=ﾏ 143 | D0=ﾐ 144 | D1=ﾑ 145 | D2=ﾒ 146 | D3=ﾓ 147 | D4=ﾔ 148 | D5=ﾕ 149 | D6=ﾖ 150 | D7=ﾗ 151 | D8=ﾘ 152 | D9=ﾙ 153 | DA=ﾚ 154 | DB=ﾛ 155 | DC=ﾜ 156 | DD=ﾝ 157 | DE=ﾞ 158 | DF=ﾟ 159 | -------------------------------------------------------------------------------- /encodings/jis_x_0211.tbl: -------------------------------------------------------------------------------- 1 | 00= 2 | 01= 3 | 02= 4 | 03= 5 | 04= 6 | 05= 7 | 06= 8 | 07= 9 | 08= 10 | 09= 11 | 0A= 12 | 13 | 0B= 14 | 0C= 15 | 0D= 16 | 17 | 0E= 18 | 0F= 19 | 10= 20 | 11= 21 | 12= 22 | 13= 23 | 14= 24 | 15= 25 | 16= 26 | 17= 27 | 18= 28 | 19= 29 | 1A= 30 | 1B= 31 | 1C= 32 | 1D= 33 | 1E= 34 | 1F= 35 | 20=  36 | 7F= 37 | 82=� 38 | 83=� 39 | 85=� 40 | 86=� 41 | 87=� 42 | 88=� 43 | 89=� 44 | 8A=� 45 | 8B=� 46 | 8C=� 47 | 8D=� 48 | 8E=� 49 | 8F=� 50 | 90=� 51 | 91=� 52 | 92=� 53 | 93=� 54 | 94=� 55 | 95=� 56 | 96=� 57 | 97=� 58 | 98=� 59 | 9A=� 60 | 9B=� 61 | 9C=� 62 | 9D=� 63 | 9E=� 64 | 9F=� 65 | -------------------------------------------------------------------------------- /includes/hex/core.pat: -------------------------------------------------------------------------------- 1 | #pragma once 2 | 3 | import hex.impl.imhex_check; 4 | 5 | /*! 6 | Core intrinsic functions to interact with the ImHex Hex Editor 7 | */ 8 | 9 | namespace auto hex::core { 10 | 11 | /** 12 | A type representing a selection in the hex editor 13 | */ 14 | struct Selection { 15 | bool valid; 16 | u64 address, size; 17 | }; 18 | 19 | /** 20 | Returns the current selection in the hex editor 21 | @return The current selection 22 | */ 23 | fn get_selection() { 24 | u128 selection = builtin::hex::core::get_selection(); 25 | 26 | Selection result; 27 | if (selection == u128(-1)) { 28 | result.valid = false; 29 | result.address = 0x00; 30 | result.size = 0x00; 31 | } else { 32 | result.valid = true; 33 | result.address = selection >> 64; 34 | result.size = selection & u64(-1); 35 | } 36 | 37 | return result; 38 | }; 39 | 40 | /** 41 | Add a file to the Virtual Filesystem 42 | @param path The name of the file 43 | @param pattern The pattern associated with the file 44 | */ 45 | fn add_virtual_file(str path, auto pattern) 46 | { 47 | builtin::hex::core::add_virtual_file(path, pattern); 48 | }; 49 | 50 | } 51 | -------------------------------------------------------------------------------- /includes/hex/http.pat: -------------------------------------------------------------------------------- 1 | #pragma once 2 | 3 | import hex.impl.imhex_check; 4 | 5 | /*! 6 | Library to do HTTP requests 7 | */ 8 | 9 | namespace auto hex::http { 10 | 11 | /** 12 | Performs a HTTP GET request to the given URL and returns the response body 13 | @param url URL to perform the request to 14 | @return Response body 15 | */ 16 | fn get(str url) { 17 | return builtin::hex::http::get(url); 18 | }; 19 | 20 | } -------------------------------------------------------------------------------- /includes/hex/impl/imhex_check.pat: -------------------------------------------------------------------------------- 1 | #ifndef __PL_UNIT_TESTS__ 2 | #ifndef __IMHEX__ 3 | 4 | #error This library is only available in the ImHex Hex editor 5 | 6 | #endif 7 | #endif -------------------------------------------------------------------------------- /includes/hex/provider.pat: -------------------------------------------------------------------------------- 1 | #pragma once 2 | 3 | import hex.impl.imhex_check; 4 | 5 | /*! 6 | Library to interact with the currently loaded provider. 7 | */ 8 | 9 | namespace auto hex::prv { 10 | 11 | 12 | /** 13 | Queries information from the currently loaded provider. The kind of information that's available depends on the provider that's loaded 14 | 15 | > **Available information** 16 | > - File Provider 17 | > - `file_path() -> str` 18 | > - `file_name() -> str` 19 | > - `file_extension() -> str` 20 | > - `creation_time() -> time_t` 21 | > - `access_time() -> time_t` 22 | > - `modification_time() -> time_t` 23 | > - `permissions() -> u16` 24 | > - Disk Provider 25 | > - `file_path() -> str` 26 | > - `sector_size() -> u128` 27 | > - GDB Provider 28 | > - `ip() -> str` 29 | > - `port() -> u16` 30 | > - Process Memory Provider 31 | > - `region_address(regionName) -> u64` 32 | > - `region_size(regionName) -> u64` 33 | > - `process_id() -> u32` 34 | > - `process_name() -> str` 35 | 36 | @param category Information category 37 | @param argument Extra argument to pass along 38 | */ 39 | fn get_information(str category, str argument = "") { 40 | return builtin::hex::prv::get_information(category, argument); 41 | }; 42 | 43 | } 44 | -------------------------------------------------------------------------------- /includes/hex/type/encstr.pat: -------------------------------------------------------------------------------- 1 | #pragma once 2 | 3 | import hex.impl.imhex_check; 4 | 5 | /*! 6 | Types to work with custom encoded strings using Thiny encoding definitions 7 | */ 8 | 9 | namespace auto hex::type { 10 | 11 | /** 12 | A string that was encoded using a custom encoding 13 | @tparam Data Pattern whose bytes are used in the decoding process 14 | @tparam EncodingDefinition A string containing a Thingy encoding definition as used by ImHex's custom encoding feature 15 | */ 16 | struct EncodedString { 17 | builtin::hex::dec::EncodedString string; 18 | } [[sealed, format("hex::type::impl::format_encoded_string")]]; 19 | 20 | namespace impl { 21 | 22 | fn format_encoded_string(ref auto string) { 23 | return string.string; 24 | }; 25 | } 26 | 27 | } 28 | 29 | -------------------------------------------------------------------------------- /includes/hex/type/json.pat: -------------------------------------------------------------------------------- 1 | #pragma once 2 | 3 | import hex.impl.imhex_check; 4 | 5 | /*! 6 | Types to decode JSON and JSON-like file formats into a pattern tree 7 | */ 8 | 9 | namespace auto hex::type { 10 | 11 | /** 12 | Type representing a JSON string 13 | @tparam Size size of the string 14 | */ 15 | struct Json { 16 | char __data[Size] [[hidden, no_unique_address]]; 17 | builtin::hex::dec::Json<__data> json [[merge]]; 18 | }; 19 | 20 | /** 21 | Type representing Bson data 22 | @tparam Size size of the data 23 | */ 24 | struct Bson { 25 | u8 __data[Size] [[hidden, no_unique_address]]; 26 | builtin::hex::dec::Bson<__data> bson [[merge]]; 27 | }; 28 | 29 | /** 30 | Type representing Cbor data 31 | @tparam Size size of the data 32 | */ 33 | struct Cbor { 34 | u8 __data[Size] [[hidden, no_unique_address]]; 35 | builtin::hex::dec::Cbor<__data> cbor [[merge]]; 36 | }; 37 | 38 | /** 39 | Type representing Bjdata data 40 | @tparam Size size of the data 41 | */ 42 | struct Bjdata { 43 | u8 __data[Size] [[hidden, no_unique_address]]; 44 | builtin::hex::dec::Bjdata<__data> bjdata [[merge]]; 45 | }; 46 | 47 | /** 48 | Type representing Msgpack data 49 | @tparam Size size of the data 50 | */ 51 | struct Msgpack { 52 | u8 __data[Size] [[hidden, no_unique_address]]; 53 | builtin::hex::dec::Msgpack<__data> msgpack [[merge]]; 54 | }; 55 | 56 | /** 57 | Type representing Ubjson data 58 | @tparam Size size of the data 59 | */ 60 | struct Ubjson { 61 | u8 __data[Size] [[hidden, no_unique_address]]; 62 | builtin::hex::dec::Ubjson<__data> ubjson [[merge]]; 63 | }; 64 | 65 | } 66 | 67 | -------------------------------------------------------------------------------- /includes/hex/type/mangled.pat: -------------------------------------------------------------------------------- 1 | #pragma once 2 | 3 | import std.io; 4 | import std.mem; 5 | 6 | import hex.impl.imhex_check; 7 | import hex.dec; 8 | 9 | /*! 10 | Types to automatically decode mangled names 11 | */ 12 | 13 | namespace auto hex::type { 14 | 15 | /** 16 | A mangled name string that gets demangled when displayed 17 | */ 18 | struct MangledName { 19 | char value[]; 20 | } [[sealed, format("hex::type::impl::format_mangled_name")]]; 21 | 22 | namespace impl { 23 | 24 | fn format_mangled_name(ref MangledName name) { 25 | return hex::dec::demangle(name.value); 26 | }; 27 | } 28 | 29 | } 30 | 31 | -------------------------------------------------------------------------------- /includes/std/array.pat: -------------------------------------------------------------------------------- 1 | #pragma once 2 | 3 | import std.sys; 4 | import std.core; 5 | 6 | /*! 7 | The array library contains a helper type to make it easier to create multi-dimensional arrays 8 | and pass arrays to functions as parameters. 9 | */ 10 | 11 | namespace auto std { 12 | 13 | /** 14 | Simple one dimensional array wrapper 15 | @tparam T The array types 16 | @tparam Size Number of entries in the array 17 | */ 18 | struct Array { 19 | T data[Size] [[inline]]; 20 | } [[format("std::impl::format_array")]]; 21 | 22 | /** 23 | Simple array wrapper for an array with a size in bytes 24 | @tparam T The array types 25 | @tparam NumBytes Number of bytes the array contains 26 | */ 27 | struct ByteSizedArray { 28 | u64 startAddress = $; 29 | T array[while($ - startAddress < NumBytes)] [[inline]]; 30 | 31 | std::assert($ - startAddress == NumBytes, "Not enough bytes available to fit a whole number of types"); 32 | } [[format("std::impl::format_array")]]; 33 | 34 | 35 | /** 36 | An interface type for getting the index of the currently processed element in an array. This is a nice wrapper around `std::core::array_index()` 37 | 38 | To use it, inherit from it and use the `this.index` field to get the index of the current element 39 | */ 40 | struct IIndexed { 41 | const u64 index = std::core::array_index(); 42 | }; 43 | 44 | namespace impl { 45 | 46 | fn format_array(ref auto array) { 47 | return "[ ... ]"; 48 | }; 49 | 50 | } 51 | 52 | } 53 | -------------------------------------------------------------------------------- /includes/std/bit.pat: -------------------------------------------------------------------------------- 1 | #pragma once 2 | 3 | import std.limits; 4 | 5 | /*! 6 | This library contains various helper functions for common bit operations. 7 | */ 8 | 9 | namespace auto std::bit { 10 | 11 | /** 12 | Calculates the number of 1 bits in a given number 13 | @param x The number 14 | @return The number of bits set to 1 in `x` 15 | */ 16 | fn popcount(u128 x) { 17 | const u128 a = 0x55555555555555555555555555555555; 18 | const u128 b = 0x33333333333333333333333333333333; 19 | const u128 c = 0x0F0F0F0F0F0F0F0F0F0F0F0F0F0F0F0F; 20 | 21 | x = (x & a) + ((x >> 1) & a); 22 | x = (x & b) + ((x >> 2) & b); 23 | x = (x & c) + ((x >> 4) & c); 24 | 25 | return x % 0xFF; 26 | }; 27 | 28 | /** 29 | Checks if only a single bit is set to 1 in a given number 30 | @param x The number 31 | @return True if there's a single bit set to 1 in `x`, false otherwise 32 | */ 33 | fn has_single_bit(u128 x) { 34 | return x != 0 && (x & (x - 1)) == 0; 35 | }; 36 | 37 | /** 38 | Rounds the given number up to the next bigger power of two 39 | @param x The number 40 | @return Next bigger power of two that can fit `x` 41 | */ 42 | fn bit_ceil(u128 x) { 43 | if (x == 0) return 0; 44 | 45 | u8 i; 46 | while ((1 << i) < x) 47 | i = i + 1; 48 | 49 | return 1 << i; 50 | }; 51 | 52 | /** 53 | Rounds the given number down to the next bigger power of two 54 | @param x The number 55 | @return Next smaller power of two 56 | */ 57 | fn bit_floor(u128 x) { 58 | if (x == 0) return 0; 59 | 60 | u8 i; 61 | while ((x >> i) > 0) 62 | i = i + 1; 63 | 64 | return 1 << (i - 1); 65 | }; 66 | 67 | } 68 | -------------------------------------------------------------------------------- /includes/std/io.pat: -------------------------------------------------------------------------------- 1 | #pragma once 2 | 3 | /*! 4 | The IO library allows formatting strings and outputting text to the console 5 | */ 6 | 7 | namespace auto std { 8 | 9 | /** 10 | Formats the given arguments using the format string and prints the result to the console 11 | This function uses the C++20 `std::format` or libfmt's `fmt::format` syntax. 12 | @param fmt Format string or any other value that can be converted to a string 13 | @param args Values to use in the formatting 14 | */ 15 | fn print(auto fmt, auto ... args) { 16 | builtin::std::print(fmt, args); 17 | }; 18 | 19 | /** 20 | Formats the given arguments using the format string and returns the result as a string 21 | This function uses the C++20 `std::format` or libfmt's `fmt::format` syntax. 22 | @param fmt Format string or any other value that can be converted to a string 23 | @param args Values to use in the formatting 24 | @return The formatted string 25 | */ 26 | fn format(auto fmt, auto ... args) { 27 | return builtin::std::format(fmt, args); 28 | }; 29 | 30 | 31 | /** 32 | Aborts evaluation of the code immediately and prints a error message to the console 33 | @param message The message to print 34 | */ 35 | fn error(str message) { 36 | builtin::std::error(message); 37 | }; 38 | 39 | /** 40 | Prints a warning message to the console 41 | @param message The message to print 42 | */ 43 | fn warning(str message) { 44 | builtin::std::warning(message); 45 | }; 46 | 47 | } -------------------------------------------------------------------------------- /includes/std/sys.pat: -------------------------------------------------------------------------------- 1 | #pragma once 2 | 3 | import std.io; 4 | 5 | /*! 6 | Basic helper functions 7 | */ 8 | 9 | namespace auto std { 10 | 11 | /** 12 | Asserts that a given value is true. If it's not, abort evaluation and print the given message to the console 13 | @param condition The condition that is required to be true 14 | @param message The message to print in case the assertion doesn't hold 15 | */ 16 | fn assert(bool condition, str message) { 17 | if (!condition) { 18 | std::error(std::format("assertion failed '{0}'", message)); 19 | } 20 | }; 21 | 22 | /** 23 | Asserts that a given value is true. If it's not, print the given message to the console as a warning 24 | @param condition The condition that is required to be true 25 | @param message The message to print in case the assertion doesn't hold 26 | */ 27 | fn assert_warn(bool condition, str message) { 28 | if (!condition) { 29 | std::warning(std::format("assertion failed '{0}'", message)); 30 | } 31 | }; 32 | 33 | 34 | /** 35 | Queries the value of a set environment variable given it's name 36 | @param name The name of the env variable 37 | @return The value of that variable 38 | */ 39 | fn env(str name) { 40 | return builtin::std::env(name); 41 | }; 42 | 43 | /** 44 | Returns the number of parameters in a parameter pack. 45 | @param pack The pack to check 46 | @return Number of parameters in `pack` 47 | */ 48 | fn sizeof_pack(auto ... pack) { 49 | return builtin::std::sizeof_pack(pack); 50 | }; 51 | 52 | /** 53 | Throws an error notifying the developer that the current code path is not implemented currently. 54 | */ 55 | fn unimplemented() { 56 | std::error("Unimplemented code path reached!"); 57 | }; 58 | 59 | } -------------------------------------------------------------------------------- /includes/type/base.pat: -------------------------------------------------------------------------------- 1 | #pragma once 2 | 3 | import std.io; 4 | import std.math; 5 | 6 | /*! 7 | Types used to change the base of the displayed integer value. 8 | Used like `type::Hex hexNumber;`, `type::Oct octalNumber;` 9 | */ 10 | 11 | namespace auto type { 12 | 13 | /** 14 | Integer type representing a Hexadecimal value. Displays its value in hexadecimal format. 15 | @tparam T Integer type to use 16 | */ 17 | using Hex = T [[format("type::impl::format_hex")]]; 18 | 19 | /** 20 | Integer type representing a Octal value. Displays its value in octal format. 21 | @tparam T Integer type to use 22 | */ 23 | using Oct = T [[format("type::impl::format_oct")]]; 24 | 25 | /** 26 | Integer type representing a Decimal value. Displays its value in decimal format. 27 | @tparam T Integer type to use 28 | */ 29 | using Dec = T [[format("type::impl::format_dec")]]; 30 | 31 | /** 32 | Integer type representing a Binary value. Displays its value in binary format. 33 | @tparam T Integer type to use 34 | */ 35 | using Bin = T [[format("type::impl::format_bin")]]; 36 | 37 | namespace impl { 38 | 39 | fn format_number(auto value, str fmt) { 40 | bool negative = value < 0; 41 | 42 | if (negative) 43 | return std::format("-" + fmt, std::math::abs(value)); 44 | else 45 | return std::format(fmt, value); 46 | }; 47 | 48 | fn format_hex(auto value) { return type::impl::format_number(value, "0x{:02X}"); }; 49 | fn format_oct(auto value) { return type::impl::format_number(value, "0o{:03o}"); }; 50 | fn format_dec(auto value) { return type::impl::format_number(value, "{}"); }; 51 | fn format_bin(auto value) { return type::impl::format_number(value, "0b{:08b}"); }; 52 | 53 | } 54 | 55 | } 56 | -------------------------------------------------------------------------------- /includes/type/base64.pat: -------------------------------------------------------------------------------- 1 | import std.io; 2 | import std.string; 3 | import std.mem; 4 | 5 | /*! 6 | Type representing a Base64 encoded string 7 | */ 8 | 9 | namespace auto type { 10 | 11 | /** 12 | Type representing a Base64 encoded string 13 | @tparam T String type 14 | */ 15 | struct Base64 { 16 | T string; 17 | } [[sealed, format("type::impl::transform_base64")]]; 18 | 19 | namespace impl { 20 | 21 | fn get_decoded_value(char c) { 22 | if (c >= 'A' && c <= 'Z') return c - 'A'; 23 | if (c >= 'a' && c <= 'z') return c - 'a' + 26; 24 | if (c >= '0' && c <= '9') return c - '0' + 52; 25 | if (c == '+') return 62; 26 | if (c == '/') return 63; 27 | return -1; // Invalid character 28 | }; 29 | 30 | fn decode_base64(str input) { 31 | u64 inputLength = std::string::length(input); 32 | str result; 33 | 34 | s32 val = 0; 35 | s32 bits = -8; 36 | for (u32 i = 0, i < inputLength, i += 1) { 37 | char c = input[i]; 38 | if (c == '=') 39 | break; 40 | 41 | s32 index = type::impl::get_decoded_value(c); 42 | if (index == -1) 43 | continue; 44 | 45 | val = (val << 6) + index; 46 | bits += 6; 47 | 48 | if (bits >= 0) { 49 | result += char((val >> bits) & 0xFF); 50 | bits -= 8; 51 | } 52 | } 53 | 54 | return result; 55 | }; 56 | 57 | fn transform_base64(ref auto base64) { 58 | return type::impl::decode_base64(base64.string); 59 | }; 60 | 61 | } 62 | 63 | } 64 | -------------------------------------------------------------------------------- /includes/type/bcd.pat: -------------------------------------------------------------------------------- 1 | #pragma once 2 | 3 | import std.io; 4 | 5 | /*! 6 | Type to decode a BCD (Binary Coded Decimal) number 7 | */ 8 | 9 | namespace auto type { 10 | 11 | /** 12 | Decodes a BCD value where one byte represents a single digit 13 | @tparam Digits Number of digits 14 | */ 15 | struct BCD { 16 | u8 bytes[Digits]; 17 | } [[sealed, format_read("type::impl::format_bcd")]]; 18 | 19 | namespace impl { 20 | 21 | fn format_bcd(ref auto bcd) { 22 | str result; 23 | 24 | for (u32 i = 0, i < sizeof(bcd.bytes), i += 1) { 25 | u8 byte = bcd.bytes[i]; 26 | if (byte >= 10) 27 | return "Invalid"; 28 | 29 | result += std::format("{}", byte); 30 | } 31 | 32 | return result; 33 | }; 34 | 35 | } 36 | 37 | } 38 | -------------------------------------------------------------------------------- /includes/type/byte.pat: -------------------------------------------------------------------------------- 1 | #pragma once 2 | 3 | import std.io; 4 | import std.core; 5 | 6 | /*! 7 | Types to display single bytes using various different representations 8 | */ 9 | 10 | namespace auto type { 11 | 12 | /** 13 | Type visualizing the value of each individual bit 14 | */ 15 | bitfield Bits { 16 | bit0 : 1; 17 | bit1 : 1; 18 | bit2 : 1; 19 | bit3 : 1; 20 | bit4 : 1; 21 | bit5 : 1; 22 | bit6 : 1; 23 | bit7 : 1; 24 | } [[format("type::impl::format_bits"), bitfield_order(std::core::BitfieldOrder::LeastToMostSignificant, 8)]]; 25 | 26 | /** 27 | Type visualizing the value of the two nibbles 28 | */ 29 | bitfield Nibbles { 30 | low : 4; 31 | high : 4; 32 | } [[format("type::impl::format_nibbles")]]; 33 | 34 | /** 35 | Type representing a single Byte. Decodes the byte as it's hexadecimal value, individual bits and nibbles 36 | */ 37 | union Byte { 38 | u8 value; 39 | Bits bits; 40 | Nibbles nibbles; 41 | } [[format("type::impl::format_byte"), single_color]]; 42 | 43 | 44 | namespace impl { 45 | 46 | fn format_byte(Byte byte) { 47 | return std::format("0x{0:02X} (0b{1:08b}) LSB:{2}, MSB:{3}", 48 | byte.value, 49 | byte.value, 50 | byte.bits.bit0, 51 | byte.bits.bit7); 52 | }; 53 | 54 | fn format_bits(Bits bits) { 55 | return std::format("0b{}{}{}{}{}{}{}{}", 56 | bits.bit7, 57 | bits.bit6, 58 | bits.bit5, 59 | bits.bit4, 60 | bits.bit6, 61 | bits.bit2, 62 | bits.bit1, 63 | bits.bit0); 64 | }; 65 | 66 | fn format_nibbles(Nibbles nibbles) { 67 | return std::format("{{ {0:0X}, {1:0X} }}", nibbles.high, nibbles.low); 68 | }; 69 | 70 | } 71 | 72 | } -------------------------------------------------------------------------------- /includes/type/float16.pat: -------------------------------------------------------------------------------- 1 | #pragma once 2 | 3 | import std.io; 4 | import std.math; 5 | import std.mem; 6 | 7 | /*! 8 | Type representing a 16 bit half precision floating point number 9 | */ 10 | 11 | namespace auto type { 12 | 13 | /** 14 | Type representing a 16 bit half precision floating point number 15 | */ 16 | using float16 = u16 [[format("type::impl::format_float16")]]; 17 | 18 | namespace impl { 19 | 20 | union U32ToFloatConverter { 21 | u32 intValue; 22 | float floatValue; 23 | }; 24 | 25 | fn format_float16(float16 value) { 26 | u32 sign = value >> 15; 27 | u32 exponent = (value >> 10) & 0x1F; 28 | u32 mantissa = value & 0x3FF; 29 | 30 | u32 result = 0x00; 31 | 32 | if (exponent == 0) { 33 | if (mantissa == 0) { 34 | result = sign << 31; 35 | } else { 36 | exponent = 0x7F - 14; 37 | 38 | while ((mantissa & (1 << 10)) == 0) { 39 | exponent -= 1; 40 | mantissa <<= 1; 41 | } 42 | 43 | mantissa &= 0x3FF; 44 | result = (sign << 31) | (exponent << 23) | (mantissa << 13); 45 | } 46 | } else if (exponent == 0x1F) { 47 | result = (sign << 31) | (0xFF << 23) | (mantissa << 13); 48 | } else { 49 | result = (sign << 31) | ((exponent + (0x7F - 15)) << 23) | (mantissa << 13); 50 | } 51 | 52 | std::mem::Reinterpreter converter; 53 | converter.from_value = result; 54 | 55 | return std::format("{}", converter.to_value); 56 | }; 57 | 58 | } 59 | 60 | } 61 | -------------------------------------------------------------------------------- /includes/type/fmt.pat: -------------------------------------------------------------------------------- 1 | #pragma once 2 | 3 | import std.io; 4 | 5 | /*! 6 | Type that allows specifying its format value using a format string. 7 | ## Usage 8 | 9 | The following code reads a u32 from the data and formats it as an upper case hexadecimal value with 10 | a minimum of 8 digits which is prefixed by 0x. 11 | 12 | The format string is the same as passed to `std::format()` and follows the libfmt specification. 13 | 14 | ```rust 15 | type::Formatted hex_formatted_integer @ 0x00; 16 | ``` 17 | */ 18 | 19 | namespace auto type { 20 | 21 | /** 22 | Arbitrarily formatted type 23 | @tparam T Type to format 24 | @tparam FormatString libfmt format string to format the value 25 | */ 26 | struct Formatted { 27 | T value; 28 | } [[sealed, format("type::impl::format_formatted"), transform("type::impl::transform_formatted")]]; 29 | 30 | namespace impl { 31 | 32 | fn format_formatted(ref auto formatted) { 33 | return std::format(formatted.FormatString, formatted.value); 34 | }; 35 | 36 | fn transform_formatted(ref auto formatted) { 37 | return formatted.value; 38 | }; 39 | 40 | } 41 | 42 | } 43 | -------------------------------------------------------------------------------- /includes/type/guid.pat: -------------------------------------------------------------------------------- 1 | #pragma once 2 | 3 | import std.io; 4 | 5 | /*! 6 | Types to deal with UUIDs (Universally Unique Identifiers) / GUIDs (Globally Unique Identifiers) as described in RFC 4122 7 | */ 8 | 9 | namespace auto type { 10 | 11 | /** 12 | Type representing a GUID value 13 | */ 14 | struct GUID { 15 | u32 time_low; 16 | u16 time_mid; 17 | u16 time_high_and_version; 18 | u8 clock_seq_and_reserved; 19 | u8 clock_seq_low; 20 | u8 node[6]; 21 | } [[sealed, format("type::impl::format_guid")]]; 22 | 23 | /** 24 | Alias name for GUID 25 | */ 26 | using UUID = GUID; 27 | 28 | namespace impl { 29 | 30 | fn format_guid(GUID guid) { 31 | bool valid = ((le u16(guid.time_high_and_version) >> 12) <= 5) && (((guid.clock_seq_and_reserved >> 4) >= 8) || ((guid.clock_seq_and_reserved >> 4) == 0)); 32 | 33 | return std::format("{}{{{:08X}-{:04X}-{:04X}-{:02X}{:02X}-{:02X}{:02X}{:02X}{:02X}{:02X}{:02X}}}", 34 | valid ? "" : "Invalid ", 35 | le u32(guid.time_low), 36 | le u16(guid.time_mid), 37 | le u16(guid.time_high_and_version), 38 | guid.clock_seq_and_reserved, 39 | guid.clock_seq_low, 40 | guid.node[0], 41 | guid.node[1], 42 | guid.node[2], 43 | guid.node[3], 44 | guid.node[4], 45 | guid.node[5]); 46 | }; 47 | 48 | } 49 | 50 | } -------------------------------------------------------------------------------- /includes/type/ip.pat: -------------------------------------------------------------------------------- 1 | #pragma once 2 | 3 | import std.io; 4 | import std.string; 5 | 6 | /*! 7 | Types used to decode IP addresses 8 | */ 9 | 10 | namespace auto type { 11 | 12 | /** 13 | A 4 byte IPv4 Address as described in RFC 791 14 | */ 15 | struct IPv4Address { 16 | u8 bytes[4]; 17 | } [[sealed, format("type::impl::format_ipv4_address")]]; 18 | 19 | /** 20 | A 16 byte IPv6 Address as described in RFC 8200 21 | */ 22 | struct IPv6Address { 23 | be u16 words[8]; 24 | } [[sealed, format("type::impl::format_ipv6_address")]]; 25 | 26 | namespace impl { 27 | 28 | fn format_ipv4_address(IPv4Address address) { 29 | return std::format("{}.{}.{}.{}", 30 | address.bytes[0], 31 | address.bytes[1], 32 | address.bytes[2], 33 | address.bytes[3]); 34 | }; 35 | 36 | fn format_ipv6_address(IPv6Address address) { 37 | str result; 38 | 39 | bool hadZeros = false; 40 | s8 startIndex = -1; 41 | 42 | for (u8 i = 0, i < 8, i += 1) { 43 | if (address.words[i] == 0x00 && !hadZeros) { 44 | hadZeros = true; 45 | startIndex = i; 46 | 47 | while (i < 7) { 48 | if (address.words[i + 1] != 0x00) 49 | break; 50 | i += 1; 51 | } 52 | 53 | if (startIndex == 0 || i == 7) 54 | result += ":"; 55 | } else { 56 | result += std::format("{:X}", address.words[i]); 57 | } 58 | 59 | result += ":"; 60 | } 61 | 62 | return std::string::substr(result, 0, std::string::length(result) - 1); 63 | }; 64 | 65 | } 66 | 67 | } 68 | -------------------------------------------------------------------------------- /includes/type/leb128.pat: -------------------------------------------------------------------------------- 1 | #pragma once 2 | 3 | import std.io; 4 | import std.mem; 5 | 6 | /*! 7 | Types used to decode Little Endian Base 128 numbers used to store large numbers as space efficiently as possible 8 | */ 9 | 10 | namespace auto type { 11 | 12 | /** 13 | Base LEB128 type. Use `uLEB128` and `sLEB128` instead. 14 | */ 15 | struct LEB128Base { 16 | u8 array[while($ == addressof(this) || std::mem::read_unsigned($-1, 1) & 0x80 != 0)] [[hidden]]; 17 | } [[sealed]]; 18 | 19 | /** 20 | A unsigned variant of a LEB128 number 21 | */ 22 | using uLEB128 = LEB128Base [[format("type::impl::format_uleb128"), transform("type::impl::transform_uleb128")]]; 23 | 24 | /** 25 | A signed variant of a LEB128 number 26 | */ 27 | using sLEB128 = LEB128Base [[format("type::impl::format_sleb128"), transform("type::impl::transform_sleb128")]]; 28 | 29 | /** 30 | Legacy alias for uLEB128 31 | */ 32 | using LEB128 = uLEB128; 33 | 34 | namespace impl { 35 | 36 | fn transform_uleb128_array(ref auto array) { 37 | u128 res = array[0] & 0x7f; 38 | for(u8 i = 1, array[i-1] & 0x80 != 0, i+=1) { 39 | res |= u128(array[i] & 0x7f) << 7 * i; 40 | } 41 | return res; 42 | }; 43 | 44 | fn transform_sleb128_array(ref auto array) { 45 | s128 res = type::impl::transform_uleb128_array(array); 46 | if (res & 1 << ((sizeof(array) / sizeof(u8)) * 7 - 1) != 0) { 47 | res |= ~0 << (sizeof(array) / sizeof(u8)) * 7; 48 | } 49 | return res; 50 | }; 51 | 52 | fn format_uleb128(ref auto leb128) { 53 | u128 res = type::impl::transform_uleb128_array(leb128.array); 54 | return std::format("{} ({:#x})", res, res); 55 | }; 56 | 57 | fn transform_uleb128(ref auto leb128) { 58 | return type::impl::transform_uleb128_array(leb128.array); 59 | }; 60 | 61 | fn format_sleb128(ref auto leb128) { 62 | s128 res = type::impl::transform_sleb128_array(leb128.array); 63 | return std::format("{} ({:#x})", res, res); 64 | }; 65 | 66 | fn transform_sleb128(ref auto leb128) { 67 | return type::impl::transform_sleb128_array(leb128.array); 68 | }; 69 | 70 | } 71 | 72 | } 73 | -------------------------------------------------------------------------------- /includes/type/mac.pat: -------------------------------------------------------------------------------- 1 | #pragma once 2 | 3 | import std.io; 4 | 5 | /*! 6 | Types used to decode MAC Addresses 7 | */ 8 | 9 | namespace auto type { 10 | 11 | /** 12 | A MAC Address as used in the Internet Protocol 13 | */ 14 | struct MACAddress { 15 | u8 bytes[6]; 16 | } [[sealed, format("type::impl::format_mac_address")]]; 17 | 18 | namespace impl { 19 | 20 | fn format_mac_address(MACAddress address) { 21 | return std::format("{:02X}:{:02X}:{:02X}:{:02X}:{:02X}:{:02X}", 22 | address.bytes[0], 23 | address.bytes[1], 24 | address.bytes[2], 25 | address.bytes[3], 26 | address.bytes[4], 27 | address.bytes[5]); 28 | }; 29 | 30 | } 31 | 32 | } -------------------------------------------------------------------------------- /includes/type/magic.pat: -------------------------------------------------------------------------------- 1 | import std.string; 2 | import std.sys; 3 | import std.io; 4 | import std.ctype; 5 | 6 | /*! 7 | Types used to parse and enforce specific magic numbers 8 | */ 9 | 10 | namespace auto type 11 | { 12 | 13 | /** 14 | Escapes all bytes in a string to only contain printable characters. All non-printable bytes will be transformed to sequences in the form form \xFF 15 | @param value Byte array to escape 16 | @return Escaped string 17 | */ 18 | fn escape_bytes(ref auto value) { 19 | str result; 20 | for (u32 i = 0, i < sizeof(value), i += 1) 21 | { 22 | char c = value[i]; 23 | 24 | if (std::ctype::isprint(c)) 25 | result += c; 26 | else 27 | result += std::format("\\x{:02X}", u8(c)); 28 | } 29 | return result; 30 | }; 31 | 32 | /** 33 | A Magic number. Throws an error if the magic number does not match the expected value 34 | @tparam ExpectedValue A string representing the expected value 35 | */ 36 | struct Magic { 37 | char value[std::string::length(ExpectedValue)]; 38 | std::assert(value == ExpectedValue, std::format("Invalid magic value! Expected \"{}\", got \"{}\" at position 0x{:X}", type::escape_bytes(ExpectedValue), type::escape_bytes(value), $ - std::string::length(ExpectedValue))); 39 | } [[sealed, format("type::impl::format_magic")]]; 40 | namespace impl { 41 | fn format_magic(ref auto magic) { 42 | return std::format("\"{}\"", type::escape_bytes(magic.value)); 43 | }; 44 | } 45 | } -------------------------------------------------------------------------------- /includes/type/path.pat: -------------------------------------------------------------------------------- 1 | import std.mem; 2 | 3 | /*! 4 | Types dealing with various kinds of resource paths 5 | */ 6 | 7 | namespace auto type { 8 | 9 | /** 10 | Type representing a single path segment. Use the `Path` type instead of using this on its own 11 | @tparam Delimiter The delimiter sequence used to separate two path segments 12 | */ 13 | struct PathSegment { 14 | char string[while(std::mem::read_string($, std::string::length(Delimiter)) != Delimiter && std::mem::read_unsigned($, 1) != 0x00)]; 15 | char separator [[hidden]]; 16 | 17 | if (separator == 0x00) { 18 | $ -= 1; 19 | break; 20 | } 21 | } [[sealed, format("type::impl::format_path_segment")]]; 22 | 23 | /** 24 | A generic type representing a path with an arbitrary delimiter 25 | @tparam Delimiter The delimiter sequence used to separate two path segments 26 | */ 27 | struct Path { 28 | PathSegment segments[while(true)]; 29 | } [[format("type::impl::format_path")]]; 30 | 31 | /** 32 | A type representing a Unix path using a '/' forward slash as delimiter 33 | */ 34 | using UnixPath = Path<"/">; 35 | 36 | /** 37 | A type representing a DOS path using a '\\' backslash as delimiter 38 | */ 39 | using DOSPath = Path<"\\">; 40 | 41 | namespace impl { 42 | 43 | fn format_path_segment(ref auto segment) { 44 | return segment.string; 45 | }; 46 | 47 | fn format_path(ref auto path) { 48 | return std::mem::read_string($, sizeof(path)); 49 | }; 50 | 51 | } 52 | 53 | } 54 | -------------------------------------------------------------------------------- /includes/type/size.pat: -------------------------------------------------------------------------------- 1 | import std.io; 2 | 3 | /*! 4 | Types used to pretty print size values 5 | */ 6 | 7 | namespace auto type { 8 | 9 | /** 10 | A generic size type which displays its value in Bytes (or kiB, MiB, GiB, TiB, PiB, EiB if larger) 11 | @tparam T Underlying type 12 | */ 13 | using Size = T [[format("type::impl::size_formatter")]]; 14 | 15 | /** 16 | A 8 bit size type 17 | */ 18 | using Size8 = Size; 19 | /** 20 | A 16 bit size type 21 | */ 22 | using Size16 = Size; 23 | /** 24 | A 32 bit size type 25 | */ 26 | using Size32 = Size; 27 | /** 28 | A 64 bit size type 29 | */ 30 | using Size64 = Size; 31 | /** 32 | A 128 bit size type 33 | */ 34 | using Size128 = Size; 35 | 36 | namespace impl { 37 | 38 | fn size_formatter(u128 size) { 39 | double sizeFloat = size; 40 | 41 | u32 i = 0; 42 | while (sizeFloat >= 1024 && i <= 6) { 43 | i += 1; 44 | sizeFloat /= 1024; 45 | } 46 | 47 | if (i == 0) { 48 | if (size == 1) 49 | return std::format("{} Byte", size); 50 | else 51 | return std::format("{} Bytes", size); 52 | } else { 53 | str result = std::format("{:.3f} ", sizeFloat); 54 | 55 | if (i == 1) 56 | return result + "kiB"; 57 | else if (i == 2) 58 | return result + "MiB"; 59 | else if (i == 3) 60 | return result + "GiB"; 61 | else if (i == 4) 62 | return result + "TiB"; 63 | else if (i == 5) 64 | return result + "PiB"; 65 | else 66 | return result + "EiB"; 67 | } 68 | }; 69 | 70 | } 71 | 72 | } -------------------------------------------------------------------------------- /includes/type/time.pat: -------------------------------------------------------------------------------- 1 | #pragma once 2 | 3 | import std.io; 4 | import std.time; 5 | 6 | /*! 7 | Types used to decode various different time formats 8 | */ 9 | 10 | namespace auto type { 11 | 12 | /** 13 | A 32 bit Unix time value 14 | */ 15 | using time32_t = u32 [[format("type::impl::format_time_t")]]; 16 | 17 | /** 18 | Alias name for `time32_t` 19 | */ 20 | using time_t = time32_t; 21 | 22 | /** 23 | A 64 bit Unix time value 24 | */ 25 | using time64_t = u64 [[format("type::impl::format_time_t")]]; 26 | 27 | /** 28 | A DOS Date value 29 | */ 30 | using DOSDate = u16 [[format("type::impl::format_dosdate")]]; 31 | 32 | /** 33 | A DOS Time value 34 | */ 35 | using DOSTime = u16 [[format("type::impl::format_dostime")]]; 36 | 37 | /** 38 | A 64bit FILETIME value 39 | */ 40 | using FILETIME = u64 [[format("type::impl::format_filetime_as_unix")]]; 41 | 42 | namespace impl { 43 | 44 | fn format_time_t(u128 value) { 45 | return std::time::format(std::time::to_utc(value)); 46 | }; 47 | 48 | fn format_dosdate(u16 value) { 49 | return std::time::format_dos_date(std::time::to_dos_date(value)); 50 | }; 51 | 52 | fn format_dostime(u16 value) { 53 | return std::time::format_dos_time(std::time::to_dos_time(value)); 54 | }; 55 | 56 | fn format_filetime_as_unix(u64 value) { 57 | return std::time::filetime_to_unix(value); 58 | }; 59 | 60 | } 61 | 62 | } 63 | -------------------------------------------------------------------------------- /includes/type/types/010.pat: -------------------------------------------------------------------------------- 1 | #pragma once 2 | 3 | /*! 4 | Alias types to make it easier to move template definitions over from 010 Editor to ImHex 5 | */ 6 | 7 | // Explicitly don't add these types to the `type` namespace for usability 8 | // namespace auto type { 9 | 10 | // using char = s8; 11 | using byte = s8; 12 | using CHAR = s8; 13 | using BYTE = s8; 14 | 15 | using uchar = u8; 16 | using ubyte = u8; 17 | using UCHAR = u8; 18 | using UBYTE = u8; 19 | 20 | 21 | using short = s16; 22 | using int16 = s16; 23 | using SHORT = s16; 24 | using INT16 = s16; 25 | 26 | using ushort = u16; 27 | using uint16 = u16; 28 | using USHORT = u16; 29 | using UINT16 = u16; 30 | using WORD = u16; 31 | 32 | using int = s32; 33 | using int32 = s32; 34 | using long = s32; 35 | using INT = s32; 36 | using INT32 = s32; 37 | using LONG = s32; 38 | 39 | using uint = u32; 40 | using uint32 = u32; 41 | using ulong = u32; 42 | using UINT = u32; 43 | using UINT32 = u32; 44 | using ULONG = u32; 45 | using DWORD = u32; 46 | 47 | using int64 = s64; 48 | using quad = s64; 49 | using QUAD = s64; 50 | using INT64 = s64; 51 | using __int64 = s64; 52 | 53 | using uint64 = u64; 54 | using uquad = u64; 55 | using UQUAD = u64; 56 | using UINT64 = u64; 57 | using QWORD = u64; 58 | using __uint64 = u64; 59 | 60 | // using float = float; 61 | using FLOAT = float; 62 | 63 | // using double = double; 64 | using DOUBLE = double; 65 | 66 | // } 67 | -------------------------------------------------------------------------------- /includes/type/types/c.pat: -------------------------------------------------------------------------------- 1 | #pragma once 2 | 3 | /*! 4 | Alias definitions for all C stdint and regular data types 5 | */ 6 | 7 | // Explicitly don't add these types to the `type` namespace for usability 8 | // namespace auto type { 9 | 10 | using uint8_t = u8; 11 | using uint16_t = u16; 12 | using uint32_t = u32; 13 | using uint64_t = u64; 14 | using __uint64_t = u64; 15 | using uint128_t = u128; 16 | using __uint128_t = u128; 17 | 18 | using int8_t = s8; 19 | using int16_t = s16; 20 | using int32_t = s32; 21 | using int64_t = s64; 22 | using __int64_t = s64; 23 | using int128_t = s128; 24 | using __int128_t = s128; 25 | 26 | using size_t = u64; 27 | using ssize_t = s64; 28 | 29 | using uintptr_t = u64; 30 | using intptr_t = s64; 31 | using ptrdiff_t = s64; 32 | 33 | // using char = char; 34 | using wchar_t = char16; 35 | using char8_t = char; 36 | using char16_t = char16; 37 | using char32_t = u32; 38 | 39 | using short = s16; 40 | using int = s32; 41 | using long = s32; 42 | 43 | // } -------------------------------------------------------------------------------- /includes/type/types/linux.pat: -------------------------------------------------------------------------------- 1 | #pragma once 2 | 3 | /*! 4 | Various data types used in the Linux Kernel 5 | */ 6 | 7 | // Explicitly don't add these types to the `type` namespace for usability 8 | // namespace auto type { 9 | 10 | using le16 = le u16; 11 | using be16 = be u16; 12 | using le32 = le u32; 13 | using be32 = be u32; 14 | using le64 = le u64; 15 | using be64 = be u64; 16 | 17 | // } -------------------------------------------------------------------------------- /includes/type/types/rust.pat: -------------------------------------------------------------------------------- 1 | #pragma once 2 | 3 | /*! 4 | Alias definitions for Rust's data types 5 | */ 6 | 7 | // Explicitly don't add these types to the `type` namespace for usability 8 | // namespace auto type { 9 | 10 | // using u8 = u8; 11 | // using u16 = u16; 12 | // using u32 = u32; 13 | // using u64 = u64; 14 | // using u128 = u128; 15 | 16 | using i8 = s8; 17 | using i16 = s16; 18 | using i32 = s32; 19 | using i64 = s64; 20 | using i128 = s128; 21 | 22 | using f32 = float; 23 | using f64 = double; 24 | 25 | using usize = u64; 26 | using isize = i64; 27 | 28 | // } -------------------------------------------------------------------------------- /includes/type/types/win32.pat: -------------------------------------------------------------------------------- 1 | #pragma once 2 | 3 | /*! 4 | Alias definitions for various type names used in Windows applications 5 | */ 6 | 7 | // Explicitly don't add these types to the `type` namespace for usability 8 | // namespace auto type { 9 | 10 | using BYTE = u8; 11 | using WORD = u16; 12 | using DWORD = u32; 13 | using QWORD = u64; 14 | using DWORDLONG = u64; 15 | using DWORD32 = u32; 16 | using DWORD64 = u64; 17 | 18 | using INT = s32; 19 | using UINT = u32; 20 | using FLOAT = float; 21 | using SHORT = s16; 22 | using USHORT = u16; 23 | using BOOL = bool; 24 | using BOOLEAN = bool; 25 | 26 | using INT8 = s8; 27 | using INT16 = s16; 28 | using INT32 = s32; 29 | using INT64 = s64; 30 | using UINT8 = u8; 31 | using UINT16 = u16; 32 | using UINT32 = u32; 33 | using UINT64 = u64; 34 | 35 | using LONG = s32; 36 | using ULONG = u32; 37 | using LONG32 = s32; 38 | using ULONG32 = u32; 39 | using LONG64 = s64; 40 | using ULONG64 = u64; 41 | using LONGLONG = s64; 42 | using ULONGLONG = u64; 43 | 44 | using SIZE_T = u64; 45 | using SSIZE_T = s64; 46 | 47 | using UCHAR = u8; 48 | using CHAR = char; 49 | using CCHAR = char; 50 | 51 | using ATOM = WORD; 52 | using PVOID = SIZE_T; 53 | using HANDLE = PVOID; 54 | using HINSTANCE = HANDLE; 55 | using HRESULT = LONG; 56 | 57 | // } -------------------------------------------------------------------------------- /magic/nintendo_switch_magic: -------------------------------------------------------------------------------- 1 | # A libmagic database containing definitions for files used by Nintendo consoles 2 | 3 | # Nintendo Switch NRO file 4 | 0x10 string NRO0 Nintendo Switch NRO file 5 | >0x08 string HOMEBREW (Homebrew) 6 | >0x18 long x (Size %d) 7 | 8 | # Nintendo Switch NSO file 9 | 0x00 string NSO0 Nintendo Switch NSO file 10 | >0x04 long x Version %d 11 | >0x0C long x Flags %08x 12 | 13 | # Nintendo Switch NCA file 14 | 0x200 string NCA Nintendo Switch NCA file 15 | >0x203 byte x Version %c 16 | >0x204 byte 0 System NCA 17 | >0x204 byte 1 Gamecard NCA 18 | >0x210 quad x ProgramId %016llx -------------------------------------------------------------------------------- /magic/portable_executable_magic: -------------------------------------------------------------------------------- 1 | # A libmagic database containing definition for PE files used by MS-DOS/Windows based systems 2 | 3 | # MS-DOS Portable Executable 4 | 0x0 string/b MZ MS-DOS Binary 5 | >(0x3c.l) string/b PE\0\0 Portable Executable 6 | !:mime application/x-dosexec 7 | -------------------------------------------------------------------------------- /patterns/afe2.hexpat: -------------------------------------------------------------------------------- 1 | #pragma author WerWolv 2 | #pragma description Nintendo Switch Atmosphère CFW Fatal Error log 3 | 4 | #pragma magic [ 41 46 45 30 ] @ 0x00 5 | #pragma magic [ 41 46 45 31 ] @ 0x00 6 | #pragma magic [ 41 46 45 32 ] @ 0x00 7 | 8 | #pragma endian little 9 | 10 | import std.io; 11 | import std.sys; 12 | 13 | #define ATMOSPHERE_REBOOT_TO_FATAL_MAGIC "AFE2" 14 | #define ATMOSPHERE_REBOOT_TO_FATAL_MAGIC_1 "AFE1" 15 | #define ATMOSPHERE_REBOOT_TO_FATAL_MAGIC_0 "AFE0" 16 | 17 | #define AMS_FATAL_ERROR_MAX_STACKTRACE 0x20 18 | #define AMS_FATAL_ERROR_MAX_STACKDUMP 0x100 19 | #define AMS_FATAL_ERROR_TLS_SIZE 0x100 20 | 21 | struct gprs_named { 22 | u64 gprs[29]; 23 | u64 fp; 24 | u64 lr; 25 | u64 sp; 26 | }; 27 | 28 | union gprs { 29 | u64 gprs[32]; 30 | gprs_named named; 31 | }; 32 | 33 | struct atmosphere_fatal_error_ctx { 34 | char magic[4]; 35 | u32 error_desc; 36 | u64 program_id; 37 | gprs gprs; 38 | u64 pc; 39 | u64 module_base; 40 | u32 pstate; 41 | u32 afsr0; 42 | u32 afsr1; 43 | u32 esr; 44 | u64 far; 45 | u64 report_identifier; /* Normally just system tick */ 46 | u64 stack_trace_size; 47 | u64 stack_dump_size; 48 | u64 stack_trace[AMS_FATAL_ERROR_MAX_STACKTRACE]; 49 | u8 stack_dump[AMS_FATAL_ERROR_MAX_STACKDUMP]; 50 | u8 tls[AMS_FATAL_ERROR_TLS_SIZE]; 51 | }; 52 | 53 | atmosphere_fatal_error_ctx ctx @ 0x00; 54 | 55 | std::assert(ctx.magic == ATMOSPHERE_REBOOT_TO_FATAL_MAGIC || 56 | ctx.magic == ATMOSPHERE_REBOOT_TO_FATAL_MAGIC_1 || 57 | ctx.magic == ATMOSPHERE_REBOOT_TO_FATAL_MAGIC_0, 58 | "File is not a valid Atmosphere fatal error binary!"); 59 | 60 | std::assert_warn(ctx.magic == ATMOSPHERE_REBOOT_TO_FATAL_MAGIC, 61 | "Atmosphere fatal error binary is for an older version!"); 62 | 63 | 64 | std::print("Error Description: 0x{:04X}", ctx.error_desc); 65 | std::print("Program ID: {:016X}", ctx.program_id); 66 | -------------------------------------------------------------------------------- /patterns/ani.hexpat: -------------------------------------------------------------------------------- 1 | #pragma description Windows animated cursor 2 | #pragma MIME application/x-navi-animation 3 | #pragma endian little 4 | 5 | import std.io; 6 | import std.mem; 7 | 8 | bitfield HeaderFlags { 9 | icon : 1; 10 | sequence : 1; 11 | padding: 30; 12 | }; 13 | 14 | struct anih { 15 | u32 struct_size; 16 | u32 stored_frames; 17 | u32 animation_steps; 18 | u32 w; 19 | u32 h; 20 | u32 bits; 21 | u32 planes; 22 | u32 default_jiffies; 23 | HeaderFlags flags; 24 | }; 25 | 26 | struct rate { 27 | u32 jiffies[parent.size / 4]; 28 | }; 29 | 30 | struct seq { 31 | u32 index[parent.size / 4]; 32 | }; 33 | 34 | struct RiffChunk { 35 | char signature[4]; 36 | u32 size; 37 | if (signature == "RIFF" || signature == "LIST") { 38 | char type[4]; 39 | 40 | // Compatible with error size defined in ani files 41 | u32 remain = sizeof($) - addressof(type); 42 | u32 marked = size > remain ? remain : size; 43 | 44 | RiffChunk chunks[while($ - addressof(type) < marked)]; 45 | } else if (signature[0] == 'I' && parent.type == "INFO") { 46 | char info[size]; 47 | } else if (signature == "anih") { 48 | anih anih [[inline]]; 49 | } else if (signature == "rate") { 50 | rate rate [[inline]]; 51 | } else if (signature == "seq ") { 52 | seq seq [[inline]]; 53 | } else { 54 | std::mem::Bytes data; 55 | } 56 | padding[size % 2]; 57 | } [[format_read("read_chunk")]]; 58 | 59 | fn read_chunk(RiffChunk chunk) { 60 | if (chunk.signature == "RIFF" || chunk.signature == "LIST") { 61 | return std::format("{}<{}> ({})", chunk.signature, chunk.type, chunk.size); 62 | } else { 63 | str ret = std::format("{} ({})", chunk.signature, chunk.size); 64 | try { 65 | ret += std::format(" \"{}\"", chunk.info); 66 | } catch {} 67 | return ret; 68 | } 69 | }; 70 | 71 | RiffChunk riff @ 0; 72 | -------------------------------------------------------------------------------- /patterns/ar.hexpat: -------------------------------------------------------------------------------- 1 | #pragma author WerWolv 2 | #pragma description GNU Static library archive 3 | 4 | #pragma MIME application/x-archive 5 | 6 | import std.string; 7 | import std.mem; 8 | import std.sys; 9 | 10 | struct ARFile { 11 | char file_name[16]; 12 | char modification_timestamp[12]; 13 | char owner_id[6]; 14 | char group_id[6]; 15 | char file_mode[8]; 16 | char file_size[10]; 17 | u16 end_marker; 18 | 19 | if (end_marker == 0x0A60) { 20 | u8 data[std::string::parse_int(this.file_size, 10)]; 21 | padding[sizeof(data) & 1]; 22 | } 23 | }; 24 | 25 | char signature[8] @ 0x00; 26 | if (signature == "!\r") { 27 | std::error("Archive file got corrupted due to CRLF line ending conversion!"); 28 | } 29 | std::assert(signature == "!\n", "File is not a valid archive!"); 30 | 31 | ARFile files[while($ < std::mem::size())] @ $; 32 | -------------------------------------------------------------------------------- /patterns/arc.hexpat: -------------------------------------------------------------------------------- 1 | #pragma author DexrnZacAttack 2 | #pragma description Minecraft LCE ARC File 3 | #pragma endian big 4 | 5 | import std.string; 6 | #ifdef __IMHEX__ 7 | import hex.core; 8 | #endif 9 | 10 | struct Table { 11 | u16 nameSize; 12 | char fileName[nameSize]; 13 | u32 offset; 14 | u32 size; 15 | u8 file[size] @ offset; 16 | #ifdef __IMHEX__ 17 | hex::core::add_virtual_file(fileName, file); 18 | #endif 19 | } [[name(std::string::to_string(fileName))]]; 20 | 21 | struct ARC { 22 | u32 count; 23 | Table table[count]; 24 | }; 25 | 26 | ARC arc @ 0x00; 27 | -------------------------------------------------------------------------------- /patterns/aria2.hexpat: -------------------------------------------------------------------------------- 1 | #pragma author itsmeow 2 | #pragma description aria2 Control File 3 | 4 | #pragma endian big 5 | 6 | /* 7 | Format sourced from: 8 | https://aria2.github.io/manual/en/html/technical-notes.html#control-file-aria2-format 9 | 10 | Version 0 files are not supported by default 11 | However parsing one is as simple as changing to #pragma endian ittle 12 | and resolving any errors resulting from that by adding be prefixes to struct fields. 13 | */ 14 | 15 | struct AriaInFlight { 16 | u32 index; 17 | u32 length; 18 | u32 bitfield_piece_length; 19 | u8 bitfield_p[bitfield_piece_length]; 20 | }; 21 | 22 | struct AriaHeader { 23 | u16 version; 24 | u32 extension; 25 | u32 infohash_length; 26 | u8 infohash[infohash_length]; 27 | u32 piece_length; 28 | u64 total_length; 29 | u64 upload_length; 30 | u32 bitfield_length; 31 | u8 bitfield_d[bitfield_length]; 32 | u32 inflight_count; 33 | AriaInFlight inflights[inflight_count]; 34 | }; 35 | 36 | AriaHeader aria_header @ 0x00; -------------------------------------------------------------------------------- /patterns/arm_cm_vtor.hexpat: -------------------------------------------------------------------------------- 1 | #pragma author WerWolv 2 | #pragma description ARM Cortex M Vector Table Layout 3 | 4 | #pragma endian little 5 | 6 | import std.io; 7 | import std.mem; 8 | 9 | #define VTOR 0x00000000 10 | #define EXTERNAL_INTERRUPT_COUNT 64 11 | 12 | using Address = u32; 13 | 14 | struct Exceptions { 15 | Address reset [[name("Reset Handler")]]; 16 | Address nmi [[name("Non-maskable Interrupt Handler")]]; 17 | Address hard_fault [[name("HardFault Handler")]]; 18 | Address mem_manage [[name("Memory Protection Error Handler")]]; 19 | Address bus_fault [[name("Bus Fault Handler")]]; 20 | Address usage_fault [[name("UsageFault (Instruction Execution fault) Handler")]]; 21 | Address reserved_1[4] [[hidden]]; 22 | Address sv_call [[name("Synchronous Supervisor Call (SVC Instruction) Handler")]]; 23 | Address debug_monitor [[name("Synchronous Debug Event Handler")]]; 24 | Address reserved_2[1] [[hidden]]; 25 | Address pend_sv [[name("Asynchronous Supervisor Call Handler")]]; 26 | Address sys_tick [[name("System Timer Tick Handler")]]; 27 | }; 28 | 29 | struct ExternalInterrupts { 30 | Address external_interrupt[EXTERNAL_INTERRUPT_COUNT] [[inline]]; 31 | }; 32 | 33 | struct VectorTable { 34 | Address initial_sp [[name("Initial Stack Pointer Value")]]; 35 | Exceptions exceptions [[inline, name("Exceptions")]]; 36 | ExternalInterrupts external_interrupts [[name("External Interrupts")]]; 37 | }; 38 | 39 | VectorTable vector_table @ VTOR; 40 | 41 | fn main() { 42 | u32 table_size = sizeof(vector_table); 43 | 44 | u32 default_handler_address = 0x00; 45 | 46 | for (u32 i = 4, i < table_size, i = i + 4) { 47 | u32 occurrences = 0; 48 | for (u32 j = 4, j < table_size, j = j + 4) { 49 | if (std::mem::read_unsigned(i, 4) == std::mem::read_unsigned(j, 4)) { 50 | occurrences = occurrences + 1; 51 | 52 | if (occurrences > 1) 53 | default_handler_address = std::mem::read_unsigned(i, 4); 54 | } 55 | } 56 | } 57 | 58 | if (default_handler_address != 0x00) 59 | std::print("Default Handler implementation at 0x{:08X}", default_handler_address); 60 | }; -------------------------------------------------------------------------------- /patterns/bencode.hexpat: -------------------------------------------------------------------------------- 1 | #pragma author WerWolv 2 | #pragma description Torrent data (Bencode) 3 | 4 | #pragma MIME application/x-bittorrent 5 | 6 | import std.ctype; 7 | import std.mem; 8 | import std.string; 9 | 10 | namespace bencode { 11 | 12 | struct ASCIIDecimal { 13 | char value[while(std::ctype::isdigit(std::mem::read_unsigned($, 1)))]; 14 | } [[sealed, format("bencode::format_ascii_decimal"), transform("bencode::format_ascii_decimal")]]; 15 | 16 | fn format_ascii_decimal(ASCIIDecimal adsasd) { 17 | return std::string::parse_int(adsasd.value, 10); 18 | }; 19 | 20 | enum Type : u8 { 21 | Integer = 'i', 22 | Dictionary = 'd', 23 | List = 'l', 24 | 25 | String0 = '0', 26 | String1 = '1', 27 | String2 = '2', 28 | String3 = '3', 29 | String4 = '4', 30 | String5 = '5', 31 | String6 = '6', 32 | String7 = '7', 33 | String8 = '8', 34 | String9 = '9' 35 | }; 36 | 37 | struct String { 38 | ASCIIDecimal length; 39 | char separator [[hidden]]; 40 | char value[length]; 41 | } [[sealed, format("bencode::format_string")]]; 42 | 43 | fn format_string(String string) { 44 | for (u64 i = 0, i < string.length, i = i + 1) { 45 | if (!std::ctype::isprint(string.value[i])) { 46 | return "Contains non-printable characters"; 47 | } 48 | } 49 | return std::format("\"{}\"", string.value); 50 | }; 51 | 52 | using Bencode; 53 | using Value; 54 | 55 | struct DictionaryEntry { 56 | String key; 57 | Value value; 58 | }; 59 | 60 | struct Value { 61 | Type type; 62 | 63 | if (type == Type::Dictionary) { 64 | DictionaryEntry entry[while(std::mem::read_unsigned($, 1) != 'e')]; 65 | char end; 66 | } else if (type == Type::List) { 67 | Value entry[while(std::mem::read_unsigned($, 1) != 'e')]; 68 | char end; 69 | } else if (type == Type::Integer) { 70 | ASCIIDecimal value; 71 | char end; 72 | } else { 73 | $ -= 1; 74 | String value; 75 | } 76 | }; 77 | 78 | struct Bencode { 79 | Value value[while(!std::mem::eof())] [[inline]]; 80 | char end; 81 | }; 82 | 83 | } 84 | 85 | bencode::Bencode bencode @ 0x00; 86 | -------------------------------------------------------------------------------- /patterns/binka.hexpat: -------------------------------------------------------------------------------- 1 | #pragma author DexrnZacAttack 2 | #pragma description RAD Game Tools BINKA (Bink Audio) 3 | #pragma magic [31 46 43 42] @ 0x00 4 | 5 | import std.string; 6 | import std.math; 7 | import type.magic; 8 | 9 | fn getDuration(u32 duration_ts, u32 sample_rate) { 10 | return float(duration_ts) / float(sample_rate); 11 | }; 12 | 13 | struct Binka { 14 | type::Magic<"1FCB"> magic; 15 | u8; // can't get this to change anything when using ffprobe 16 | u8 channel_count [[name(std::format("Channel Count: {}", this))]]; 17 | u16 sample_rate [[name(std::format("Sample Rate: {}", this))]]; 18 | u32 duration_ts [[name(std::format("Duration: {}s", std::math::floor(getDuration(this, sample_rate))))]]; 19 | u32; 20 | u32 size [[name(std::format("File Size: {} bytes", this))]]; 21 | u8 data[size - 20]; 22 | }; 23 | 24 | Binka binka @ 0x00; 25 | -------------------------------------------------------------------------------- /patterns/bzip3.hexpat: -------------------------------------------------------------------------------- 1 | #pragma author Sewer56 2 | #pragma description Parses BZip3 compression (file format) by Kamila Szewczyk 3 | #pragma MIME application/x-bzip3 4 | #pragma endian little 5 | #pragma magic [42 5A 33 76 31] @ 0x00 6 | import std.mem; 7 | 8 | // Helper function for bit counting 9 | fn popcount(u8 b) { 10 | u32 count = 0; 11 | while (b != 0) { 12 | count = count + (b & 1); 13 | b = b >> 1; 14 | } 15 | return count; 16 | }; 17 | 18 | // Frame header structure 19 | struct FrameHeader { 20 | char magic[5]; // "BZ3v1" 21 | u32 blockSize; // Maximum block size 22 | }; 23 | 24 | // Small block header (for blocks < 64 bytes) 25 | struct SmallBlock { 26 | u32 crc32; // CRC32 checksum 27 | u32 literal; // Always 0xFFFFFFFF for small blocks 28 | u8 data[parent.compressedSize - 8]; // Uncompressed data 29 | }; 30 | 31 | // Regular block (blocks > 64 bytes) 32 | struct Block { 33 | u32 crc32; // CRC32 checksum of uncompressed data 34 | u32 bwtIndex; // Burrows-Wheeler transform index 35 | u8 model; // Compression model flags 36 | 37 | if ((model & 0x02) != 0) 38 | u32 lzpSize; // Size after LZP compression 39 | if ((model & 0x04) != 0) 40 | u32 rleSize; // Size after RLE compression 41 | 42 | u8 data[parent.compressedSize - (popcount(model) * 4 + 9)]; 43 | }; 44 | 45 | // Main block structure 46 | struct Chunk { 47 | u32 compressedSize; // Size of compressed block 48 | u32 origSize; // Original uncompressed size 49 | 50 | if (origSize < 64) { 51 | SmallBlock block; 52 | } else { 53 | Block block; 54 | } 55 | }; 56 | 57 | // Main parsing structure 58 | struct BZip3File { 59 | FrameHeader header; 60 | // Read blocks until end of file 61 | Chunk chunks[while(!std::mem::eof())]; 62 | }; 63 | 64 | BZip3File file @ 0x0; -------------------------------------------------------------------------------- /patterns/cchva.hexpat: -------------------------------------------------------------------------------- 1 | #pragma description Command and Conquer Voxel Animation 2 | 3 | // Command and conquer voxel animation format 4 | 5 | struct vec4_s { 6 | float x [[color("FF0000")]]; 7 | float y [[color("00FF00")]]; 8 | float z [[color("0000FF")]]; 9 | float w [[color("FFFF00")]]; 10 | }; 11 | 12 | struct mat3x4_s { 13 | vec4_s row[3]; 14 | }; 15 | 16 | struct name_s { 17 | char buffer[16] [[color("EECCCC")]]; 18 | }; 19 | 20 | struct hva_s { 21 | name_s name; 22 | u32 numFrames; 23 | u32 numNodes; 24 | name_s nodeNames[numNodes]; 25 | }; 26 | 27 | struct frame_s { 28 | mat3x4_s mat[hva.numNodes]; 29 | }; 30 | 31 | hva_s hva @0x00; 32 | frame_s frames[hva.numFrames] @sizeof(hva); 33 | -------------------------------------------------------------------------------- /patterns/ccpal.hexpat: -------------------------------------------------------------------------------- 1 | #pragma description Command and Conquer Voxel Palette 2 | 3 | // Command and conquer palette format 4 | 5 | struct Color { 6 | u8 r; 7 | u8 g; 8 | u8 b; 9 | }; 10 | 11 | struct Palette { 12 | Color colors[256]; 13 | }; 14 | 15 | Palette pal @0x00; 16 | -------------------------------------------------------------------------------- /patterns/ccvxl.hexpat: -------------------------------------------------------------------------------- 1 | #pragma description Command and Conquer Voxel Model 2 | 3 | // Command and Conquer voxel model format 4 | 5 | struct vec4_s { 6 | float x [[color("FF0000")]]; 7 | float y [[color("00FF00")]]; 8 | float z [[color("0000FF")]]; 9 | float w [[color("FFFF00")]]; 10 | }; 11 | 12 | struct vec3_s { 13 | float x [[color("FF0000")]]; 14 | float y [[color("00FF00")]]; 15 | float z [[color("0000FF")]]; 16 | }; 17 | 18 | struct mat3x4_s { 19 | vec4_s row[3]; 20 | }; 21 | 22 | struct name_s { 23 | char buffer[16] [[color("EECCCC")]]; 24 | }; 25 | 26 | struct color_s { 27 | u8 r; 28 | u8 g; 29 | u8 b; 30 | }; 31 | 32 | struct vxl_limb_header_s { 33 | name_s name; 34 | s32 limb_number; 35 | u32 _reserved1; 36 | u32 _reserved2; 37 | }; 38 | 39 | struct vxl_limb_tailer_s { 40 | u32 span_start_offset; 41 | u32 span_end_offset; 42 | u32 span_data_offset; 43 | float scale; 44 | mat3x4_s matrix; 45 | vec3_s min_bounds; 46 | vec3_s max_bounds; 47 | u8 xsize; 48 | u8 ysize; 49 | u8 zsize; 50 | u8 normal_type; 51 | }; 52 | 53 | struct vxl_s { 54 | name_s name; 55 | u32 palette_count; 56 | u32 limb_count; 57 | u32 tailer_count; 58 | u32 body_size; 59 | u8 remap_start_index; 60 | u8 remap_end_index; 61 | color_s internal_palette[256]; 62 | vxl_limb_header_s _headers[limb_count]; 63 | u8 body[body_size]; 64 | vxl_limb_tailer_s _tailers[limb_count]; 65 | }; 66 | 67 | struct frame_s { 68 | mat3x4_s mat[hva.numNodes]; 69 | }; 70 | 71 | vxl_s vxl @0x00; 72 | -------------------------------------------------------------------------------- /patterns/cda.hexpat: -------------------------------------------------------------------------------- 1 | #pragma description Compact Disc Audio track 2 | #pragma magic [ 52 49 46 46 ] @ 0x00 3 | 4 | struct Header { 5 | u32 RIFF; 6 | s32 size; 7 | u32 CDDA; 8 | u32 fmt; 9 | u32 lenghtofthechunck; 10 | u16 versionofcdformat; 11 | u16 numberofrange; 12 | u32 identifier; 13 | }; 14 | 15 | 16 | struct DataInfo { 17 | u32 range; 18 | u32 duration; 19 | u8 rangepositionframes; 20 | u8 rangepositionseconds; 21 | u8 rangepositionminutes; 22 | u8 nullbyte; 23 | u8 durationtrackframes; 24 | u8 durationtrackseconds; 25 | u8 durationtrackminutes; 26 | u8 nullbytee; 27 | }; 28 | 29 | 30 | Header header @ 0; 31 | DataInfo data @ 0x1C; 32 | -------------------------------------------------------------------------------- /patterns/cpio.hexpat: -------------------------------------------------------------------------------- 1 | #pragma author WerWolv 2 | #pragma description Old Binary CPIO 3 | 4 | import type.base; 5 | 6 | import std.time; 7 | import std.core; 8 | import std.sys; 9 | import std.mem; 10 | 11 | #pragma MIME application/x-cpio 12 | 13 | namespace old_binary { 14 | 15 | using Time = u32 [[format("old_binary::format_time")]]; 16 | 17 | fn swap_32bit(u32 value) { 18 | return ((value >> 16) & 0xFFFF) | ((value & 0xFFFF) << 16); 19 | }; 20 | 21 | fn format_time(u32 value) { 22 | return std::time::format(std::time::to_utc(old_binary::swap_32bit(value))); 23 | }; 24 | 25 | using SwappedU32 = u32 [[transform("old_binary::swap_32bit"), format("old_binary::swap_32bit")]]; 26 | 27 | bitfield Mode { 28 | x : 3; 29 | w : 3; 30 | r : 3; 31 | sticky : 1; 32 | sgid : 1; 33 | suid : 1; 34 | file_type : 4; 35 | }; 36 | 37 | struct CpioHeader { 38 | type::Oct magic; 39 | if (magic == be u16(0o070707)) 40 | std::core::set_endian(std::mem::Endian::Big); 41 | else if (magic == le u16(0o070707)) 42 | std::core::set_endian(std::mem::Endian::Little); 43 | else 44 | std::error("Invalid CPIO Magic!"); 45 | 46 | u16 dev; 47 | u16 ino; 48 | Mode mode; 49 | u16 uid; 50 | u16 gid; 51 | u16 nlink; 52 | u16 rdev; 53 | Time mtime; 54 | u16 namesize; 55 | SwappedU32 filesize; 56 | }; 57 | 58 | struct Cpio { 59 | CpioHeader header; 60 | char pathname[header.namesize % 2 == 0 ? header.namesize : header.namesize + 1]; 61 | u8 data[header.filesize % 2 == 0 ? header.filesize : header.filesize + 1]; 62 | 63 | if (pathname == "TRAILER!!!\x00\x00") 64 | break; 65 | }; 66 | 67 | } 68 | 69 | old_binary::Cpio cpio[while(true)] @ 0x00; 70 | -------------------------------------------------------------------------------- /patterns/dmg.hexpat: -------------------------------------------------------------------------------- 1 | #pragma description Apple Disk Image Trailer (DMG) 2 | #pragma magic [ 6B 6F 6C 79 ] @ -512 3 | 4 | #pragma endian big 5 | 6 | import type.magic; 7 | import type.size; 8 | import type.guid; 9 | import std.mem; 10 | 11 | // Parse DMG Structure per http://newosxbook.com/DMG.html 12 | // 13 | // UDIFResourceFile starts at size(file) - 512 14 | struct UDIFResourceFile { 15 | type::Magic<"koly"> Signature; // Magic ('koly') 16 | u32 Version; // Current version is 4 17 | type::Size HeaderSize; // sizeof(this), always 512 18 | u32 Flags; 19 | u64 RunningDataForkOffset; // 20 | u64 DataForkOffset; // Data fork offset (usually 0, beginning of file) 21 | type::Size DataForkLength; // Size of data fork (usually up to the XMLOffset, below) 22 | u64 RsrcForkOffset; // Resource fork offset, if any 23 | type::Size RsrcForkLength; // Resource fork length, if any 24 | u32 SegmentNumber; // Usually 1, may be 0 25 | u32 SegmentCount; // Usually 1, may be 0 26 | 27 | type::GUID SegmentID; // 128-bit GUID identifier of segment (if SegmentNumber !=0) 28 | 29 | u32 DataChecksumType; // Data fork 30 | type::Size DataChecksumSize; // Checksum Information 31 | u32 DataChecksum[32]; // Up to 128-bytes (32 x 4) of checksum 32 | 33 | u64 XMLOffset; // Offset of property list in DMG, from beginning 34 | type::Size XMLLength; // Length of property list 35 | u8 Reserved1[120]; // 120 reserved bytes - zeroed 36 | 37 | u32 ChecksumType; // Master 38 | type::Size ChecksumSize; // Checksum information 39 | u32 Checksum[32]; // Up to 128-bytes (32 x 4) of checksum 40 | 41 | u32 ImageVariant; // Commonly 1 42 | u64 SectorCount; // Size of DMG when expanded, in sectors 43 | 44 | u32 reserved2; // 0 45 | u32 reserved3; // 0 46 | u32 reserved4; // 0 47 | }; 48 | 49 | 50 | UDIFResourceFile trailer @ std::mem::size() - 512; 51 | 52 | char metadata_plist[trailer.XMLLength] @ trailer.XMLOffset; -------------------------------------------------------------------------------- /patterns/evtx.hexpat: -------------------------------------------------------------------------------- 1 | #pragma description MS Windows Vista Event Log 2 | #pragma MIME application/x-ms-evtx 3 | #pragma endian little 4 | 5 | struct Header { 6 | char signature[0x8]; 7 | u64 first_chunk_number; 8 | u64 last_chunk_number; 9 | u64 next_record_identifier; 10 | u32 header_size; 11 | u16 minor_format_version; 12 | u16 major_format_version; 13 | u16 header_block_size; 14 | u16 number_of_chunks; 15 | u8 unknown[0x4C]; 16 | u32 file_Flag; 17 | u32 checkSum; 18 | u8 unknown2[3968]; 19 | }; 20 | 21 | struct BinaryXML{ 22 | u8 fragment_header_token; 23 | u8 major_version; 24 | u8 minor_version; 25 | u8 flags; 26 | }; 27 | 28 | struct Event_Record{ 29 | u32 signature; 30 | u32 size; 31 | u64 event_record_identifier; 32 | u64 written_data_amd_time; 33 | BinaryXML binaryxml; 34 | }; 35 | 36 | struct Chunk{ 37 | char signature[0x8]; 38 | u64 first_event_record_number; 39 | u64 last_event_record_number; 40 | u64 first_event_record_identifier; 41 | u64 last_event_record_identifier; 42 | u32 header_size; 43 | u32 last_event_record_data_offset; 44 | u32 free_space_offset; 45 | u32 event_records_checksum; 46 | u8 unknown[64]; 47 | u32 unknown2; 48 | u32 checksum; 49 | u8 common_string_offset_array[256]; 50 | u8 templatePtr[128]; 51 | Event_Record event_record; 52 | }; 53 | 54 | struct Evtx { 55 | Header header; 56 | Chunk chunk; 57 | }; 58 | 59 | Evtx evtx @ 0x00; 60 | -------------------------------------------------------------------------------- /patterns/fas_oskasoftware_old.hexpat: -------------------------------------------------------------------------------- 1 | #pragma author DmitriLeon2000 2 | #pragma description Oska Software DeskMates FAS (Frames and Sequences) file (Oska DeskMate versions 1.3 and 2.06) 3 | #pragma endian little 4 | 5 | enum Compression : u32 { 6 | BI_RGB, 7 | BI_RLE8, 8 | BI_RLE4, 9 | BI_BITFIELDS, 10 | BI_JPEG, 11 | BI_PNG, 12 | BI_ALPHABITFIELDS, 13 | BI_CMYK, 14 | BI_CMYKRLE8, 15 | BI_CMYKRLE4, 16 | }; 17 | 18 | struct Colors { 19 | u8 blue; 20 | u8 green; 21 | u8 red; 22 | u8 reserved; 23 | }; 24 | 25 | struct FASHeader { 26 | s32 width; // width of the animation (in pixels) 27 | s32 height; // height of the animation (in pixels) 28 | u16 reserved1; 29 | u16 reserved2; 30 | u16 frameSizeCombined; // a sum of frameSizeColor and frameSizeMask 31 | u16 frameSizeColor; // size of the animation ((frameWidth * 4 + 31) // 32 * 4 * frameHeight) 32 | u16 frameSizeMask; // size of the animation's mask ((frameWidth * 1 + 31) // 32 * 4 * frameHeight) 33 | u16 headerCount; // amount of DIB headers 34 | }; 35 | 36 | struct BitmapInfoHeader { // bog-standard BitmapInfoHeaderV1 37 | u32 biSize; 38 | s32 biWidth; 39 | s32 biHeight; 40 | u16 biPlanes; 41 | u16 biBitCount; 42 | Compression compression; 43 | u32 biSizeImage; 44 | s32 biXPelsPerMeter; 45 | s32 biYPelsPerMeter; 46 | u32 biClrUsed; 47 | u32 biClrImportant; 48 | }; 49 | 50 | struct BitmapInfo { 51 | BitmapInfoHeader header; 52 | le u32 colorMap[header.biClrUsed == 0 ? 53 | 1 << header.biBitCount : header.biClrUsed]; 54 | }; 55 | 56 | struct AnimSequence { 57 | char name[]; 58 | char sequence[]; 59 | }; 60 | 61 | struct SeqHeader { 62 | le u32 size; 63 | le u32 count; 64 | le u32 strPointers[count*2]; 65 | }; 66 | 67 | struct Frame { 68 | u8 colorBitmap[fas.fasHeader.frameSizeColor]; 69 | u8 maskBitmap[fas.fasHeader.frameSizeMask]; 70 | }; 71 | 72 | struct FramesHeader { 73 | le u32 count; 74 | le s16 frameID[count]; 75 | }; 76 | 77 | struct FAS { 78 | FASHeader fasHeader; 79 | BitmapInfo dibHeaders[fasHeader.headerCount]; 80 | SeqHeader seqHeader; 81 | AnimSequence sequences[seqHeader.count]; 82 | FramesHeader framesHeader; 83 | }; 84 | 85 | 86 | FAS fas @ 0x00; 87 | Frame frames[fas.framesHeader.count] @ $; 88 | -------------------------------------------------------------------------------- /patterns/gzip.hexpat: -------------------------------------------------------------------------------- 1 | #pragma author WerWolv 2 | #pragma description GZip compressed data 3 | 4 | #pragma MIME application/gzip 5 | 6 | import type.time; 7 | import type.size; 8 | import std.core; 9 | import std.mem; 10 | 11 | using BitfieldOrder = std::core::BitfieldOrder; 12 | 13 | bitfield Flags { 14 | FTEXT : 1; 15 | FHCRC : 1; 16 | FEXTRA : 1; 17 | FNAME : 1; 18 | FCOMMENT : 1; 19 | } [[bitfield_order(BitfieldOrder::LeastToMostSignificant, 8)]]; 20 | 21 | bitfield ExtraFlags { 22 | padding : 1; 23 | maximumCompression : 1; 24 | fastestCompression : 1; 25 | padding : 5; 26 | }; 27 | 28 | enum CompressionMethod : u8 { 29 | Reserved = 0 ... 7, 30 | Deflate = 8 31 | }; 32 | 33 | enum OperatingSystemID : u8 { 34 | FATFileSystem = 0x00, 35 | Amiga = 0x01, 36 | VMS = 0x02, 37 | Unix = 0x03, 38 | VM_CMS = 0x04, 39 | AtariTOS = 0x05, 40 | HPFSFileSystem = 0x06, 41 | Macintosh = 0x07, 42 | ZSystem = 0x08, 43 | CP_M = 0x09, 44 | TOPS_20 = 0x0A, 45 | NTFSFileSystem = 0x0B, 46 | QDOS = 0x0C, 47 | AcordRISCOS = 0x0D, 48 | Unknown = 0xFF 49 | }; 50 | 51 | struct GZip { 52 | u16 signature; 53 | CompressionMethod compressionMethod; 54 | Flags flags; 55 | type::time32_t modificationTime; 56 | ExtraFlags extraFlags; 57 | OperatingSystemID operatingSystemId; 58 | 59 | if (flags.FEXTRA) { 60 | u16 extraLength; 61 | u8 extraField[extraLength]; 62 | } 63 | 64 | if (flags.FNAME) { 65 | char originalFileName[]; 66 | } 67 | 68 | if (flags.FCOMMENT) { 69 | char comment[]; 70 | } 71 | 72 | if (flags.FHCRC) { 73 | u16 crc16; 74 | } 75 | 76 | u8 data[while($ < std::mem::size() - 8)] [[sealed]]; 77 | 78 | u32 crc32; 79 | type::Size isize; 80 | }; 81 | 82 | GZip gzip @ 0x00; -------------------------------------------------------------------------------- /patterns/hinf_module.hexpat: -------------------------------------------------------------------------------- 1 | #pragma author Surasia 2 | #pragma description Halo Infinite Module 3 | #pragma array_limit 0 4 | #pragma pattern_limit 0 5 | #pragma magic [ 6D 6F 68 64 ] @ 0x00 6 | 7 | import std.string; 8 | 9 | struct ModuleHeader 10 | { 11 | char magic[4]; 12 | s32 version; 13 | s64 moduleId; 14 | u32 fileCount; 15 | s32 manifest0Count; 16 | s32 manifest1Count; 17 | s32 manifest2Count; 18 | s32 resourceIndex; 19 | u32 stringSize; 20 | u32 resourceCount; 21 | u32 blockCount; 22 | u64 buildVersion; 23 | s64 hd1Delta; 24 | u64 dataSize; 25 | }; 26 | 27 | 28 | struct ModuleFile 29 | { 30 | u32 resourceCount; 31 | s32 parentIndex; 32 | s16 pad; 33 | u16 blockCount; 34 | s32 blockIndex; 35 | s32 resourceIndex; 36 | char class[4] [[format("std::string::reverse")]]; 37 | u64 dataOffsetBytes; 38 | u64 dataOffset = dataOffsetBytes & 0x0000FFFFFFFFFFFF [[export]]; 39 | u16 dataOffsetFlags = dataOffsetBytes >> 48 [[export]]; 40 | u32 totalCompressedSize; 41 | u32 totalUncompressedSize; 42 | u32 globalTagId; 43 | u32 uncompressedHeaderSize; 44 | u32 uncompressedTagDataSize; 45 | u32 uncompressedResourceDataSize; 46 | u32 uncompressedActualResourceDataSize; 47 | u32 resourceBlockCount; 48 | u32 nameOffset; 49 | s32 parentResource; 50 | u64 assetChecksum; 51 | u64 assetId; 52 | }; 53 | 54 | 55 | struct ModuleBlock 56 | { 57 | u32 compressedOffset; 58 | u32 compressedSize; 59 | u32 decompressedOffset; 60 | u32 decompressedSize; 61 | bool compressed; 62 | s24 pad; 63 | }; 64 | 65 | 66 | struct Module 67 | { 68 | ModuleHeader module_header; 69 | ModuleFile files[module_header.fileCount]; 70 | $ = $ + 8; 71 | s32 resources[module_header.resourceCount]; 72 | ModuleBlock blocks[module_header.blockCount]; 73 | padding[while($[$] == 0)]; 74 | std::print("Compressed Tag Data starts at: {}", $); 75 | }; 76 | 77 | 78 | Module module_root @ 0x00; -------------------------------------------------------------------------------- /patterns/hsdt.hexpat: -------------------------------------------------------------------------------- 1 | // Analyzed and reverse engineered by xtex 2 | #pragma author xtex 3 | 4 | #pragma description HiSilicon HSDT device-tree table 5 | #pragma endian little 6 | #pragma magic [ 48 53 44 54 ] @ 0x00 7 | 8 | import std.sys; 9 | import std.mem; 10 | 11 | u32 dt_hdr_offset; 12 | if (std::mem::read_unsigned(4096, 4, std::mem::Endian::Little) == 0x54445348) { 13 | // for DTS dumped from UPDATE.APP 14 | // everything is offseted 4096 bytes 15 | dt_hdr_offset = 0x1000; 16 | } else { 17 | // for DTS dumped from Huawei device 18 | // /dev/block/bootdevice/by-name/dts 19 | dt_hdr_offset = 0; 20 | } 21 | 22 | struct dt_table_t { 23 | u32 magic [[comment("should always be 0x54445348")]]; 24 | std::assert(magic == 0x54445348, "bad dt_table_t magic"); 25 | u32 version [[comment("should always be 1")]]; 26 | u32 num_entries; 27 | }; 28 | 29 | struct dt_entry_t { // 0x28 bytes 30 | u8 board_id[4] [[sealed, format("format_board_id")]]; 31 | // in my reverse project, undefined0 is always zero 32 | // and is not used by the fastboot 33 | u32 undefined0 [[sealed]]; 34 | std::assert_warn(undefined0 == 0, "undefined0 is not zero"); 35 | u32 dtb_len; 36 | // VRL is for verifying the DTB 37 | // set VRL to 0 to skip verifying 38 | u32 vrl_len; 39 | u32 dtb_offset; 40 | u32 vrl_offset; 41 | u8 undefined1[16] [[sealed]]; 42 | 43 | // the real GZIPped DTB should start at dtb_offset + 4096 44 | u8 dtb[dtb_len] @ (dtb_offset + 4096 + dt_hdr_offset) [[sealed]]; 45 | if (vrl_len != 0) 46 | u8 vrl[vrl_len] @ (vrl_offset + dt_hdr_offset) [[sealed]]; 47 | } [[format("format_dt_entry")]]; 48 | 49 | fn format_dt_entry(auto dt_entry) { 50 | if (dt_entry.vrl_len != 0) { 51 | return std::format( 52 | "{}, with VRL", 53 | format_board_id(dt_entry.board_id) 54 | ); 55 | } else { 56 | return format_board_id(dt_entry.board_id); 57 | } 58 | }; 59 | 60 | fn format_board_id(auto board_id) { 61 | return std::format( 62 | "<0x{:02x} 0x{:02x} 0x{:02x} 0x{:02x}>", 63 | board_id[0], board_id[1], 64 | board_id[2], board_id[3] 65 | ); 66 | }; 67 | 68 | dt_table_t dt_hdr @ (dt_hdr_offset + 0x0); 69 | dt_entry_t dt_entries[dt_hdr.num_entries] @ (dt_hdr_offset + 0xc); 70 | -------------------------------------------------------------------------------- /patterns/ico.hexpat: -------------------------------------------------------------------------------- 1 | #pragma author WerWolv 2 | #pragma description Windows Icon (.ico) or Cursor (.cur) 3 | 4 | #pragma endian little 5 | 6 | import std.sys; 7 | 8 | #pragma MIME image/vnd.microsoft.icon 9 | #pragma MIME image/x-icon 10 | #pragma MIME image/icon 11 | #pragma MIME image/ico 12 | #pragma MIME text/ico 13 | #pragma MIME application/ico 14 | 15 | enum ImageType : u16 { 16 | Icon = 1, 17 | Cursor = 2 18 | }; 19 | 20 | struct ICONDIR { 21 | u16 reserved [[hidden]]; 22 | ImageType type; 23 | u16 num_images; 24 | }; 25 | 26 | struct ImageData { 27 | u8 data[parent.image_data_size] [[inline]]; 28 | }; 29 | 30 | struct ICONDIRENTRY { 31 | u8 width, height; 32 | u8 num_colors; 33 | u8 reserved [[hidden]]; 34 | 35 | if (header.type == ImageType::Icon) { 36 | u16 color_planes; 37 | u16 bits_per_pixel; 38 | } else if (header.type == ImageType::Cursor) { 39 | u16 horizontal_hotspot_coordinate; 40 | u16 vertical_hotspot_coordinate; 41 | } 42 | 43 | u32 image_data_size; 44 | ImageData *image_data : u32; 45 | }; 46 | 47 | ICONDIR header @ 0x00; 48 | ICONDIRENTRY images[header.num_images] @ $; 49 | 50 | std::assert(header.reserved == 0x00, "Invalid ICO header"); -------------------------------------------------------------------------------- /patterns/imah.hexpat: -------------------------------------------------------------------------------- 1 | #pragma author Hrant (0xZ3R0) 2 | #pragma description DJI Encrypted/Signed Firmware (IM*H) 3 | #pragma endian little 4 | 5 | // refs: 6 | // - "Challenges in Dynamic Analysis of Drone Firmware and Its Solutions" (DOI: 10.1109/ACCESS.2024.3425604) 7 | // - "Drone Security and the Mysterious Case of DJI’s DroneID" (DOI: 10.14722/ndss.2023.24217) 8 | // - https://github.com/o-gs/dji-firmware-tools 9 | 10 | struct imah_chunk_header { 11 | s8 id[4]; 12 | u32 offset; 13 | u32 size; 14 | u32 attrib; 15 | u64 address; 16 | u8 reserved[8]; 17 | }; 18 | 19 | struct imah_header { 20 | s8 magic[4]; 21 | u32 header_version; 22 | u32 size; 23 | u8 reserved[4]; 24 | u32 header_size; 25 | u32 signature_size; 26 | u32 payload_size; 27 | u32 target_size; 28 | u8 os; 29 | u8 arch; 30 | u8 compression; 31 | u8 anti_version; 32 | u32 auth_alg; 33 | u8 auth_key[4]; 34 | u8 enc_key[4]; 35 | u8 scram_key[16]; 36 | s8 name[32]; 37 | u8 type[4]; 38 | u32 version; 39 | u32 date; 40 | u32 encr_cksum; 41 | u8 reserved2[16]; 42 | s8 userdata[16]; 43 | u8 entry[8]; 44 | u32 plain_cksum; 45 | u32 chunk_num; 46 | u8 payload_digest[32]; 47 | }; 48 | 49 | imah_header header @ 0x00; 50 | imah_chunk_header chunks[header.chunk_num] @ addressof (header) + sizeof (header); 51 | u8 signature[header.signature_size] @ addressof (chunks) + sizeof (chunks); 52 | u8 payload_start @ addressof (signature) + sizeof (signature); 53 | -------------------------------------------------------------------------------- /patterns/intel_hex.hexpat: -------------------------------------------------------------------------------- 1 | #pragma description Intel hex 2 | 3 | /* If you have no delimiters between data records then remove 4 | * the null_bytes field in the data_packet struct. 5 | * Set the array at the bottom to the highest index + 1 in the Pattern Data view 6 | * NOTE: these were ascii hex values for me, so use the calculator tool to convert 7 | * values 8 | */ 9 | #pragma endian big 10 | #pragma MIME text/x-hex 11 | 12 | import std.mem; 13 | 14 | enum FileType: u16 { 15 | Data = 0x3030, 16 | EOF = 0x3031, 17 | Extended_Segment_Address = 0x3032, 18 | Start_Segment_Address = 0x3033, 19 | Extended_Linear_Address = 0x3034, 20 | Start_Linear_Address = 0x3035 21 | }; 22 | 23 | struct Bytes { 24 | u8 HOB [[color("00FF6699")]]; 25 | u8 LOB [[color("00FF6699")]]; 26 | }; 27 | 28 | struct data_packet { 29 | char start_code [[color("00EFECCA")]]; 30 | Bytes byte_count [[color("00A9CBB7")]]; 31 | u32 address [[color("00F7FF58")]]; 32 | FileType recordType [[color("00FF934F")]]; 33 | 34 | // both not A 35 | if (byte_count.HOB < 65 && byte_count.LOB < 65) { 36 | u16 data[((byte_count.HOB - 48) * 16) 37 | + (byte_count.LOB - 48)] [[color("0095B46A")]]; 38 | // HOB is A but LOB is not 39 | } else if (byte_count.HOB >= 65 && byte_count.LOB < 65) { 40 | u16 data[((byte_count.HOB - 55) * 16) 41 | + (byte_count.LOB - 48)] [[color("0095B46A")]]; 42 | // LOB is A but HOB is not 43 | } else if (byte_count.HOB < 65 && byte_count.LOB >= 65) { 44 | u16 data[((byte_count.HOB - 48) * 16) 45 | + (byte_count.LOB - 55)] [[color("0095B46A")]]; 46 | // both are A 47 | } else { 48 | u16 data[((byte_count.HOB - 55) * 16) 49 | + (byte_count.LOB - 55)] [[color("0095B46A")]]; 50 | } 51 | 52 | u16 checksum [[color("0045F0DF")]]; 53 | u8 line_ending_1 [[color("005E565A")]]; 54 | if (line_ending_1 == '\r') 55 | u8 line_ending_2 [[color("005E565A")]]; 56 | }; 57 | 58 | data_packet data[while(!std::mem::eof())] @ 0x00; 59 | -------------------------------------------------------------------------------- /patterns/ips.hexpat: -------------------------------------------------------------------------------- 1 | #pragma author gmestanley 2 | #pragma description IPS (International Patching System) 3 | #pragma magic [ 50 41 54 43 48 ] @ 0x00 4 | 5 | #pragma endian big 6 | 7 | import std.mem; 8 | import std.string; 9 | 10 | struct Hunk { 11 | u24 offset; 12 | u16 length; 13 | if (!length) { 14 | u16 runCount; 15 | u8 payload; 16 | } 17 | else { 18 | u8 payload[length]; 19 | } 20 | }; 21 | 22 | struct IPS { 23 | char signature[5]; 24 | Hunk hunks[while($ < std::mem::size() - (3 + 3 * (std::mem::read_string(std::mem::size()-3, 3) != "EOF")))]; 25 | char eof[3]; 26 | u24 truncatedSize[3+(std::mem::read_string(std::mem::size()-3, 3) != "EOF")>3]; 27 | }; 28 | 29 | IPS ips @ 0x00; 30 | -------------------------------------------------------------------------------- /patterns/loc.hexpat: -------------------------------------------------------------------------------- 1 | #pragma author DexrnZacAttack 2 | #pragma description Minecraft LCE LOC file 3 | 4 | #pragma endian big 5 | #pragma array_limit 0 6 | #pragma pattern_limit 0 7 | 8 | import std.string; 9 | 10 | struct Keys { 11 | bool useUniqueIDs; 12 | u32 count; 13 | u32 key[count]; 14 | }; 15 | 16 | struct LangIds { 17 | u16 len; 18 | char id[len]; 19 | u32 unk; 20 | } [[name(id)]]; 21 | 22 | struct LocString { 23 | u16 keySize; 24 | char key[keySize]; 25 | } [[name(std::string::to_string(key))]]; 26 | 27 | struct Language { 28 | u32 read; 29 | if (read > 0) 30 | u8 unk; 31 | u16 len; 32 | char id[len]; 33 | u32 count; 34 | LocString strings[count]; 35 | } [[name(id)]]; 36 | 37 | struct Loc { 38 | u32 version; 39 | u32 count; 40 | if (version == 2) 41 | Keys keys; 42 | LangIds ids[count]; 43 | Language language[count]; 44 | }; 45 | 46 | Loc loc @ 0x00; 47 | -------------------------------------------------------------------------------- /patterns/mo.hexpat: -------------------------------------------------------------------------------- 1 | #pragma author dvob 2 | #pragma description GNU Machine Object (MO) files containing translations for gettext 3 | 4 | // https://www.gnu.org/software/gettext/manual/html_node/MO-Files.html 5 | 6 | import std.core; 7 | import std.io; 8 | 9 | struct strPtr { 10 | u32 length; 11 | u32 offset; 12 | char string[length] @ offset; 13 | }; 14 | 15 | struct file { 16 | be u32 magic; 17 | if ( magic == 0x950412de ) 18 | std::core::set_endian(std::mem::Endian::Big); 19 | else if ( magic == 0xde120495) 20 | std::core::set_endian(std::mem::Endian::Little); 21 | else 22 | std::error("Invalid MO Magic!"); 23 | 24 | u16 majorVersion; 25 | u16 minorVersion; 26 | u32 count; 27 | u32 msgIdOffset; 28 | u32 msgStrOffset; 29 | u32 hashSize; 30 | u32 hashOffset; 31 | 32 | u32 hashTable[hashSize] @ hashOffset; 33 | strPtr msgIDTable[count] @ msgIdOffset; 34 | strPtr msgStrTable[count] @ msgStrOffset; 35 | }; 36 | 37 | file moFile @ 0x0; 38 | -------------------------------------------------------------------------------- /patterns/msscmp.hexpat: -------------------------------------------------------------------------------- 1 | #pragma author DexrnZacAttack 2 | #pragma description MSSCMP (Miles Sound System Compressed Archive) 3 | #pragma magic [ 42 41 4E 4B ] @ 0x00 4 | #pragma magic [ 4B 4E 41 42 ] @ 0x00 5 | #pragma array_limit 0 6 | #pragma pattern_limit 0 7 | 8 | import type.magic; 9 | import std.core; 10 | #ifdef __IMHEX__ 11 | import hex.core; 12 | #endif 13 | 14 | struct FileDataEntry { 15 | u32 nameOffset; 16 | char name[] @ nameOffset; 17 | u32 folderOffset; 18 | char folder[] @ folderOffset; 19 | le u32 fileDataOffset; 20 | padding[8]; 21 | u32 sampleRate; 22 | u32 fileSize; 23 | u8 data[fileSize] @ fileDataOffset; 24 | #ifdef __IMHEX__ 25 | hex::core::add_virtual_file(std::string::to_string(name) + ".binka", data); 26 | #endif 27 | }; 28 | 29 | struct Index2Entry { 30 | u32 entryOffset; 31 | u32 fStructureOffset; 32 | FileDataEntry fileDataEntry @ entryOffset; 33 | }; 34 | 35 | struct MsscmpEntry { 36 | char name[12]; 37 | Index2Entry entries[parent.header.index2EntryCount] @ parent.header.index1LastEntryOffset + 4; 38 | }; 39 | 40 | 41 | struct Header { 42 | padding[4]; // unk 43 | T fileDataOffset; 44 | padding[8]; // unk 45 | T index1Offset; 46 | T index1LastEntryOffset; 47 | if (sizeof(T) == 4) 48 | padding[8]; 49 | else 50 | padding[16]; 51 | 52 | T unkOffset; 53 | T index1EntryCount; 54 | 55 | if (sizeof(T) == 4) 56 | padding[8]; 57 | else 58 | padding[4]; 59 | 60 | u32 index2EntryCount; 61 | }; 62 | 63 | using OldGenHeader = Header; 64 | using NewGenHeader = Header; 65 | 66 | struct MSSCMP { 67 | char magic[4]; 68 | if (magic == "BANK") 69 | std::core::set_endian(std::mem::Endian::Big); 70 | else if (magic == "KNAB") 71 | std::core::set_endian(std::mem::Endian::Little); 72 | else 73 | std::error("Magic does not match BANK or KNAB"); 74 | 75 | u32 check1 @ 0x1c [[hidden]]; // use this to check if old gen or new gen 76 | u32 check2 @ 0x20 [[hidden]]; 77 | 78 | if (check1 == check2) 79 | OldGenHeader header; 80 | else 81 | NewGenHeader header; 82 | MsscmpEntry entry; 83 | }; 84 | 85 | MSSCMP msscmp @ 0x00; 86 | -------------------------------------------------------------------------------- /patterns/nbt.hexpat: -------------------------------------------------------------------------------- 1 | #pragma author WerWolv 2 | #pragma description Minecraft NBT 3 | 4 | import std.sys; 5 | 6 | #pragma endian big 7 | 8 | enum Tag : u8 { 9 | End = 0, 10 | Byte = 1, 11 | Short = 2, 12 | Int = 3, 13 | Long = 4, 14 | Float = 5, 15 | Double = 6, 16 | ByteArray = 7, 17 | String = 8, 18 | List = 9, 19 | Compound = 10, 20 | IntArray = 11, 21 | LongArray = 12 22 | }; 23 | 24 | using Element; 25 | 26 | struct Value { 27 | if (parent.tag == Tag::Byte) 28 | s8 value; 29 | else if (parent.tag == Tag::Short) 30 | s16 value; 31 | else if (parent.tag == Tag::Int) 32 | s32 value; 33 | else if (parent.tag == Tag::Long) 34 | s64 value; 35 | else if (parent.tag == Tag::Float) 36 | float value; 37 | else if (parent.tag == Tag::Double) 38 | double value; 39 | else if (parent.tag == Tag::ByteArray) { 40 | s32 arrayLength; 41 | s8 value[arrayLength] [[sealed]]; 42 | } else if (parent.tag == Tag::String) { 43 | u16 stringLength; 44 | char value[stringLength]; 45 | } else if (parent.tag == Tag::List) { 46 | Tag tag; 47 | s32 listLength; 48 | Value values[listLength] [[static]]; 49 | } else if (parent.tag == Tag::Compound) { 50 | Element values[while(true)]; 51 | } else if (parent.tag == Tag::IntArray){ 52 | s32 arrayLength; 53 | s32 value[arrayLength] [[sealed]]; 54 | } else if (parent.tag == Tag::LongArray) { 55 | s32 arrayLength; 56 | s64 value[arrayLength] [[sealed]]; 57 | } else { 58 | std::error(std::format("Invalid tag {:02X}", TypeTag)); 59 | } 60 | } [[inline]]; 61 | 62 | struct Element { 63 | Tag tag; 64 | if (tag == Tag::End) 65 | break; 66 | else { 67 | 68 | u16 nameLength; 69 | char name[nameLength]; 70 | 71 | Value value; 72 | } 73 | }; 74 | 75 | struct NBT { 76 | Element element[while(true)] [[inline]]; 77 | }; 78 | 79 | NBT nbt @ 0x00; 80 | -------------------------------------------------------------------------------- /patterns/nes.hexpat: -------------------------------------------------------------------------------- 1 | #pragma author gmestanley 2 | #pragma description Nintendo Entertainment System ROM (.nes) 3 | #pragma MIME application/x-nes-rom 4 | 5 | import std.mem; 6 | import std.string; 7 | 8 | bitfield iNES07Flags { 9 | mirroringIsVertical : 1; 10 | batterybackedPRGRAM : 1; 11 | trainerOf512Bytes : 1; 12 | ignoreMirroring : 1; 13 | mapperLowerNybble : 4; 14 | vsUnisystem : 1; 15 | playchoice10 : 1; 16 | nes2Format : 2 [[name("nes2.0Format")]]; 17 | mapperHigherNybble : 4; 18 | } [[name("iNES0.7Flags")]]; 19 | 20 | bitfield Flags9 { 21 | isPAL : 1; 22 | padding : 7; 23 | }; 24 | 25 | bitfield Flags10 { 26 | tvSystem : 2; 27 | padding : 2; 28 | prgRAM : 1; 29 | busConflicts : 1; 30 | padding : 2; 31 | }; 32 | 33 | struct iNESFlags { 34 | iNES07Flags ines07Flags [[name("ines0.7Flags")]]; 35 | if (!ines07Flags.nes2Format) { 36 | u8 prgRAM8KBMultiplier; 37 | Flags9 flags9; 38 | Flags10 flags10; 39 | restLength = 5; 40 | } 41 | else { 42 | restLength = 9; 43 | } 44 | }; 45 | 46 | u8 restLength; 47 | 48 | struct Header { 49 | char identifier[4]; 50 | u8 prgROM16KBMultiplier; 51 | u8 chrROM8KBMultiplier; 52 | iNESFlags inesFlags; 53 | char rest[restLength]; 54 | }; 55 | 56 | Header header @ 0x00; 57 | 58 | enum EncodingType : u8 { 59 | ASCII = 1 60 | }; 61 | 62 | struct OfficialHeader { 63 | char title[16] [[hex::spec_name("Title Registration Area")]]; 64 | u16 programChecksum; 65 | u16 characterChecksum; 66 | u8 memorySize [[hex::spec_name("Cartridge Memory Size")]]; 67 | u8 cartridgeType; 68 | EncodingType encodingType [[hex::spec_name("Registration Character Type Distinction")]]; 69 | u8 titleLength [[hex::spec_name("Registration Characters Count")]]; 70 | u8 makerID [[hex::spec_name("Maker Code")]]; 71 | u8 complementaryChecksum; 72 | }; 73 | 74 | union OfficialHeaderUnion { 75 | u8 miscellaneousData[26]; 76 | OfficialHeader officialHeader; 77 | }; 78 | 79 | struct PRGROM { 80 | u8 data[16384*header.prgROM16KBMultiplier-32]; 81 | OfficialHeaderUnion officialHeaderUnion; 82 | u16 nmi; 83 | u16 entryPoint; 84 | u16 externalIRQ; 85 | }; 86 | 87 | PRGROM prgROM @ sizeof(header); 88 | u8 chrROM[8192*header.chrROM8KBMultiplier] @ sizeof(header)+sizeof(prgROM); -------------------------------------------------------------------------------- /patterns/notepad-cache.hexpat: -------------------------------------------------------------------------------- 1 | #pragma author sethhall 2 | #pragma description Windows Notepad Cache Files 3 | #pragma magic [ 4E 50 00 ] @ 0x00 4 | 5 | // This was written based on the following blog post: 6 | // https://u0041.co/posts/articals/exploring-windows-artifacts-notepad-files/ 7 | 8 | import type.leb128; 9 | import type.time; 10 | import type.magic; 11 | import std.time; 12 | 13 | using uLEB128 = type::uLEB128; 14 | 15 | enum Encodings: u8 { 16 | ANSI = 0x01, 17 | UTF_16LE = 0x02, 18 | UTF_16BE = 0x03, 19 | UTF_8BOM = 0x04, 20 | UTF_8 = 0x05, 21 | }; 22 | 23 | enum LineEndings: u8 { 24 | CRLF = 0x01, 25 | CR = 0x02, 26 | LF = 0x03, 27 | }; 28 | 29 | struct ConfigBlock { 30 | bool word_wrap; 31 | bool rtl; 32 | bool show_unicode; 33 | uLEB128 version; 34 | u16 unknown; 35 | }; 36 | 37 | struct UnsavedChunk { 38 | uLEB128 cursor_position; 39 | uLEB128 deletion_number; 40 | uLEB128 addition_number; 41 | char16 chars[addition_number]; 42 | char crc32[4] [[format("hash_format"), comment("CRC32 hash of the entire unsaved chunk structure")]]; 43 | }; 44 | 45 | struct Notepad_File { 46 | type::Magic<"NP\0"> signature [[comment("File signature")]]; 47 | bool is_saved; 48 | if ( is_saved ) { 49 | uLEB128 path_length; 50 | char16 path[path_length] [[comment("Path of saved file on disk")]]; 51 | uLEB128 file_size; 52 | Encodings encoding; 53 | LineEndings line_endings; 54 | uLEB128 last_write [[format("format_filetime")]]; 55 | char sha256[32] [[format("hash_format")]]; 56 | u8 unknown1; 57 | } 58 | u8 unknown2; 59 | uLEB128 selection_start; 60 | uLEB128 selection_end; 61 | ConfigBlock config_block; 62 | type::uLEB128 content_length; 63 | char16 content[content_length]; 64 | bool contain_unsaved_data; 65 | char crc32[4] [[format("hash_format")]]; 66 | UnsavedChunk unsaved_chunks[while(!std::mem::eof())]; 67 | }; 68 | 69 | fn hash_format(auto bytes) { 70 | str hash_hex; 71 | for(u8 i=0, i < sizeof(bytes), i+=1) { 72 | hash_hex = hash_hex + std::format("{:02X}",bytes[i]); 73 | } 74 | return hash_hex; 75 | }; 76 | 77 | fn format_filetime(uLEB128 data) { 78 | // We will only support dates back to the epoch 79 | std::time::Time time64 = std::time::to_utc((data / 10000000.0) - 11644473600.0); 80 | return std::time::format(time64, "%c"); 81 | }; 82 | 83 | Notepad_File file @ $; -------------------------------------------------------------------------------- /patterns/notepadwindowstate.hexpat: -------------------------------------------------------------------------------- 1 | #pragma author ogmini https://github.com/ogmini 2 | #pragma description Windows 11 Notepad Window State file 3 | #pragma magic [ 4E 50 ] @ 0x00 4 | // File found at %localappdata%/Packages/Microsoft.WindowsNotepad_8wekyb3d8bbwe/LocalState/WindowState 5 | 6 | #include 7 | #include 8 | #include 9 | #include 10 | 11 | using ul = type::uLEB128; 12 | using int = u32; 13 | 14 | struct Tab 15 | { 16 | u128 GUID; 17 | }; 18 | 19 | struct WindowState 20 | { 21 | char HeaderIdentifier[2]; // NP 22 | ul SequenceNumber; 23 | ul BytesToCRC32; 24 | u8 Delim[1]; 25 | ul NumberTabs; 26 | 27 | Tab Tabs[NumberTabs]; 28 | 29 | ul ActiveTab; 30 | 31 | int CoordTopLeftX; 32 | int CoordTopLeftY; 33 | 34 | int CoordBottomRightX; 35 | int CoordBottomRightY; 36 | 37 | int WindowSizeWidth; 38 | int WindowSizeHeight; 39 | 40 | u8 Delim2[1]; 41 | 42 | int CRC32; 43 | 44 | u8 SlackSpace[while(!std::mem::eof())]; 45 | }; 46 | 47 | 48 | 49 | 50 | // -- Declaration -- 51 | 52 | WindowState state @ 0x0; 53 | -------------------------------------------------------------------------------- /patterns/nro.hexpat: -------------------------------------------------------------------------------- 1 | #pragma author WerWolv 2 | #pragma description Nintendo Switch NRO 3 | #pragma magic [ 4E 52 4F 30 ] @ 0x10 4 | 5 | import std.io; 6 | import std.sys; 7 | import type.magic; 8 | 9 | struct MOD0 { 10 | char magic[4]; 11 | u32 dynamic_offset [[name(".dynamic offset")]]; 12 | u32 bss_start_offset [[name(".bss start offset")]]; 13 | u32 bss_end_offset [[name(".bss end offset")]]; 14 | u32 eh_frane_hdr_start_offset [[name(".eh_frame_hdr start offset")]]; 15 | u32 eh_frane_hdr_end_offset [[name(".eh_frame_hdr end offset")]]; 16 | u32 runtime_generated_module_object_offset; 17 | }; 18 | 19 | struct Start { 20 | padding[4]; 21 | MOD0 *mod0 : u32; 22 | char hb_magic[8]; 23 | }; 24 | 25 | struct SegmentHeader { 26 | u32 offset; 27 | u32 size; 28 | }; 29 | 30 | struct Header { 31 | type::Magic<"NRO0"> magic; 32 | u32 version; 33 | u32 file_size; 34 | u32 flags; 35 | SegmentHeader segment_header_1[3]; 36 | u32 bss_size; 37 | padding[4]; 38 | u8 module_id[0x20]; 39 | u32 dso_handle_offset; 40 | padding[4]; 41 | SegmentHeader segment_header_2[3]; 42 | }; 43 | 44 | struct AssetSection { 45 | u8 *asset_offset : u64 [[pointer_base("asset_ptr")]]; 46 | u64 size; 47 | }; 48 | 49 | struct AssetHeader { 50 | if (is_homebrew()) { 51 | char magic[4]; 52 | u32 version; 53 | AssetSection icon; 54 | AssetSection nacp; 55 | AssetSection romfs; 56 | } 57 | }; 58 | 59 | 60 | fn asset_ptr(u128 offset) { 61 | return header.file_size; 62 | }; 63 | 64 | fn is_homebrew() { 65 | return start.hb_magic == "HOMEBREW"; 66 | }; 67 | 68 | 69 | Start start @ 0x00; 70 | Header header @ $; 71 | 72 | AssetHeader assets @ header.file_size; 73 | 74 | fn main() { 75 | if (is_homebrew()) 76 | std::print("This is a Homebrew NRO!"); 77 | }; -------------------------------------------------------------------------------- /patterns/ogg.hexpat: -------------------------------------------------------------------------------- 1 | #pragma author WerWolv 2 | #pragma description OGG Audio 3 | 4 | #pragma MIME audio/ogg 5 | 6 | import std.core; 7 | import std.mem; 8 | import type.magic; 9 | 10 | bitfield HeaderType { 11 | Continuation : 1; 12 | BeginOfStream : 1; 13 | EndOfStream : 1; 14 | }; 15 | 16 | struct SegmentData { 17 | u8 data[parent.segmentTable[std::core::array_index()]]; 18 | }; 19 | 20 | struct Ogg { 21 | type::Magic<"OggS"> capturePattern; 22 | u8 version; 23 | HeaderType headerType; 24 | u64 granulePosition; 25 | u32 bitstreamSerialNumber; 26 | u32 pageSequenceNumber; 27 | u32 checksum; 28 | u8 pageSegments; 29 | u8 segmentTable[pageSegments]; 30 | SegmentData data[pageSegments]; 31 | }; 32 | 33 | Ogg ogg[while(!std::mem::eof())] @ 0x00; 34 | -------------------------------------------------------------------------------- /patterns/pbz.hexpat: -------------------------------------------------------------------------------- 1 | // Apple pbz compressed file 2 | // Used by Apple on .xip files and OTA updates, 3 | // and can be created with macOS compression_tool. 4 | // 5 | // Copyright (c) 2023 Nicolás Alvarez 6 | // 7 | // SPDX-License-Identifier: GPL-2.0-or-later 8 | 9 | #pragma author Nicolás Alvarez 10 | #pragma description Apple pbz 11 | #pragma magic [ 70 62 7A ] @ 0x00 12 | 13 | import std.mem; 14 | import type.magic; 15 | 16 | #pragma endian big 17 | 18 | #define SHOW_DATA 0 19 | 20 | enum CompressionType: char { 21 | ZLIB = 'z', 22 | LZMA = 'x', 23 | LZ4 = '4', 24 | LZFSE = 'e' 25 | }; 26 | 27 | struct Chunk { 28 | u64 uncompressed_size; 29 | u64 compressed_size; 30 | if (SHOW_DATA) { 31 | u8 data[compressed_size] [[sealed]]; 32 | } else { 33 | padding[compressed_size]; 34 | } 35 | }; 36 | 37 | struct PBZ { 38 | type::Magic<"pbz"> magic; 39 | CompressionType compression; 40 | u64 chunk_size; 41 | Chunk chunks[while(!std::mem::eof())]; 42 | }; 43 | 44 | PBZ pbz @ 0; 45 | -------------------------------------------------------------------------------- /patterns/pcx.hexpat: -------------------------------------------------------------------------------- 1 | #pragma author WerWolv 2 | #pragma description PCX Image 3 | 4 | #pragma MIME application/x-pcx 5 | 6 | import std.io; 7 | 8 | enum Encoding : u8 { 9 | NoEncoding = 0x00, 10 | RunLengthEncoding = 0x01 11 | }; 12 | 13 | enum PaletteType : u16 { 14 | MonochromeOrColorInformation = 0x01, 15 | GrayscaleInformation = 0x02 16 | }; 17 | 18 | enum Version : u8 { 19 | V2_5 = 0x00, 20 | V2_8WithPalette = 0x02, 21 | V2_8_WithoutPalette = 0x03, 22 | PaintbrushForWindows = 0x04, 23 | V3_0 = 0x05 24 | }; 25 | 26 | struct Header { 27 | u8 magic; 28 | Version version; 29 | Encoding encoding; 30 | u8 bitsPerPixel; 31 | u16 xMin, yMin; 32 | u16 xMax, yMax; 33 | u16 hdpi, vdpi; 34 | }; 35 | 36 | struct RGB8 { 37 | u8 r, g, b; 38 | } [[sealed, color(std::format("{:02X}{:02X}{:02X}", this.r, this.g, this.b))]]; 39 | 40 | struct Palette { 41 | RGB8 color[16]; 42 | }; 43 | 44 | struct PCX { 45 | Header header; 46 | Palette palette; 47 | padding[1]; 48 | u8 numPlanes; 49 | u16 bytesPerLine; 50 | PaletteType paletteType; 51 | u16 hres, vres; 52 | padding[54]; 53 | }; 54 | 55 | PCX pcx @ 0x00; -------------------------------------------------------------------------------- /patterns/pfs0.hexpat: -------------------------------------------------------------------------------- 1 | #pragma author WerWolv 2 | #pragma description Nintendo Switch PFS0 archive (.nsp) 3 | #pragma magic [ 50 46 53 30 ] @ 0x00 4 | 5 | import type.magic; 6 | import type.size; 7 | 8 | import std.core; 9 | 10 | struct FileEntry { 11 | u64 dataOffset; 12 | type::Size dataSize; 13 | u32 nameOffset; 14 | padding[4]; 15 | }; 16 | 17 | struct String { 18 | char value[]; 19 | }; 20 | 21 | struct Header { 22 | type::Magic<"PFS0"> magic; 23 | u32 numFiles; 24 | type::Size stringTableSize; 25 | padding[4]; 26 | 27 | FileEntry fileEntryTable[numFiles]; 28 | String strings[numFiles]; 29 | }; 30 | 31 | struct File { 32 | char name[] @ addressof(parent.header.strings) + parent.header.fileEntryTable[std::core::array_index()].nameOffset; 33 | u8 data[parent.header.fileEntryTable[std::core::array_index()].dataSize] @ parent.header.fileEntryTable[std::core::array_index()].dataOffset [[sealed]]; 34 | }; 35 | 36 | struct PFS0 { 37 | Header header; 38 | 39 | File files[header.numFiles]; 40 | }; 41 | 42 | PFS0 pfs0 @ 0x00; -------------------------------------------------------------------------------- /patterns/pif.hexpat: -------------------------------------------------------------------------------- 1 | #pragma description PIF Image 2 | 3 | /* PIF - Portable Image Format 4 | * 5 | * Basic decoder for the PIF file structure 6 | * https://github.com/gfcwfzkm/PIF-Image-Format 7 | */ 8 | 9 | #pragma MIME image/pif 10 | #pragma endian little 11 | 12 | enum imageType_t : u16 { 13 | RGB888 = 0x433C, 14 | RGB565 = 0xE5C5, 15 | RGB332 = 0x1E53, 16 | RGB16C = 0xB895, 17 | BLWH = 0x7DAA, 18 | IND24 = 0x4952, 19 | IND16 = 0x4947, 20 | IND8 = 0x4942 21 | }; 22 | 23 | enum compression_t : u16 { 24 | NO_COMPRESSION = 0, 25 | RLE_COMPRESSION = 0x7DDE 26 | }; 27 | 28 | struct PIFFileHeader { 29 | char Signature[4]; 30 | u32 FileSize; 31 | u32 ImageOffset; 32 | }; 33 | 34 | struct PIFInfoHeader { 35 | imageType_t ImageType; 36 | u16 BitsPerPixel; 37 | u16 ImageWidth; 38 | u16 ImageHeight; 39 | u32 ImageSize; 40 | u16 ColorTableSize; 41 | compression_t Compression; 42 | }; 43 | 44 | struct PIF { 45 | PIFFileHeader PIF_FileHeader; 46 | PIFInfoHeader PIF_ImageHeader; 47 | 48 | if (PIF_ImageHeader.ImageType == imageType_t::IND24) 49 | { 50 | u24 ColorTable[PIF_ImageHeader.ColorTableSize/3]; 51 | } 52 | else if (PIF_ImageHeader.ImageType == imageType_t::IND16) 53 | { 54 | u16 ColorTable[PIF_ImageHeader.ColorTableSize/2]; 55 | } 56 | else if (PIF_ImageHeader.ImageType == imageType_t::IND8) 57 | { 58 | u8 ColorTable[PIF_ImageHeader.ColorTableSize]; 59 | } 60 | 61 | if ((PIF_ImageHeader.ImageType == imageType_t::RGB888) || 62 | (PIF_ImageHeader.ImageType == imageType_t::IND24)) 63 | { 64 | u24 ImageData[(PIF_FileHeader.FileSize - PIF_FileHeader.ImageOffset)/3]; 65 | } 66 | else if ((PIF_ImageHeader.ImageType == imageType_t::RGB565) || 67 | (PIF_ImageHeader.ImageType == imageType_t::IND16)) 68 | { 69 | u16 ImageData[(PIF_FileHeader.FileSize - PIF_FileHeader.ImageOffset)/2]; 70 | } 71 | else if ((PIF_ImageHeader.ImageType == imageType_t::RGB332) || 72 | (PIF_ImageHeader.ImageType == imageType_t::IND8)) 73 | { 74 | u8 ImageData[(PIF_FileHeader.FileSize - PIF_FileHeader.ImageOffset)/1]; 75 | } 76 | }; 77 | 78 | PIF pif @ 0x00; 79 | -------------------------------------------------------------------------------- /patterns/pkm.hexpat: -------------------------------------------------------------------------------- 1 | #pragma author applecuckoo 2 | #pragma description PKM (PacKMan) files containing ETC (Ericsson Texture Compression) 3 | #pragma endian big 4 | #pragma magic [ 50 4B 4D 20 ] @ 0x00 5 | 6 | enum PKMFormat : u16 { 7 | ETC1_RGB_NO_MIPMAPS, 8 | ETC2PACKAGE_RGB_NO_MIPMAPS, 9 | ETC2PACKAGE_RGBA_NO_MIPMAPS_OLD, 10 | ETC2PACKAGE_RGBA_NO_MIPMAPS, 11 | ETC2PACKAGE_RGBA1_NO_MIPMAPS, 12 | ETC2PACKAGE_R_NO_MIPMAPS, 13 | ETC2PACKAGE_RG_NO_MIPMAPS, 14 | ETC2PACKAGE_R_SIGNED_NO_MIPMAPS, 15 | ETC2PACKAGE_RG_SIGNED_NO_MIPMAPS 16 | }; 17 | 18 | struct PKMHeader { 19 | char id[4]; 20 | char version[2]; 21 | PKMFormat pkm_format; 22 | u16 width; 23 | u16 height; 24 | u16 original_width; 25 | u16 original_height; 26 | }; 27 | 28 | PKMHeader pkm_header @ 0x00 [[comment("PKM file header"), name("Header")]]; -------------------------------------------------------------------------------- /patterns/psafe3.hexpat: -------------------------------------------------------------------------------- 1 | // Password Safe V3 2 | // Only a small part of the file is unencrypted. 3 | 4 | #pragma endian little 5 | #pragma description Password Safe V3 6 | #pragma magic [ 50 57 53 33 ] @ 0x00 7 | 8 | import std.mem; 9 | import std.sys; 10 | 11 | struct Prologue { 12 | u8 SALT[32]; 13 | u32 ITER; 14 | u8 HPP[32] [[name("H(P')")]]; 15 | u8 B1[16]; 16 | u8 B2[16]; 17 | u8 B3[16]; 18 | u8 B4[16]; 19 | u8 IV[16]; 20 | }; 21 | 22 | struct EOF { 23 | u8 HMAC[32]; 24 | }; 25 | 26 | char magic[4] @ 0x00; 27 | std::assert(magic == "PWS3", "Invalid file: bad tag!"); 28 | char marker[16] @ std::mem::size() - 48; 29 | std::assert(marker == "PWS3-EOFPWS3-EOF", "Invalid file: bad end marker!"); 30 | 31 | Prologue prologue @ 0x04; 32 | u8 HMAC[32] @ std::mem::size() - 32; 33 | 34 | EOF eof @ std::mem::size() - 48; -------------------------------------------------------------------------------- /patterns/qbcl.hexpat: -------------------------------------------------------------------------------- 1 | #pragma description Qubicle voxel scene project 2 | 3 | // Qubicle QBCL format 4 | 5 | struct String { 6 | u32 len; 7 | char string[len]; 8 | }; 9 | 10 | struct Matrix { 11 | u32 sizex; 12 | u32 sizey; 13 | u32 sizez; 14 | s32 tx; 15 | s32 ty; 16 | s32 tz; 17 | float pivotx; 18 | float pivoty; 19 | float pivotz; 20 | u32 compressedDataSize; 21 | u8 zip[compressedDataSize]; 22 | }; 23 | 24 | // Rotation matrix according to wikipedia 25 | // https://en.wikipedia.org/wiki/Rotation_matrix#Basic_rotations 26 | struct Matrices { 27 | float row1[3]; 28 | float row2[3]; 29 | float row3[3]; 30 | }; 31 | 32 | using Node; 33 | 34 | struct Model { 35 | Matrices rotation; 36 | u32 childCount; 37 | Node nodes[childCount]; 38 | }; 39 | 40 | struct Compound { 41 | Matrix matrix; 42 | u32 childCount; 43 | Node nodes[childCount]; 44 | }; 45 | 46 | struct Node { 47 | u32 type; 48 | u32 unknown; 49 | String name; 50 | u8 visible; 51 | u8 unknown2; 52 | u8 locked; 53 | if (type == 0) { 54 | Matrix matrix; 55 | } else if (type == 1) { 56 | Model model; 57 | } else if (type == 2) { 58 | Compound compound; 59 | } 60 | }; 61 | 62 | struct Header { 63 | u32 magic; 64 | u32 version; 65 | u32 fileversion; 66 | u32 thumbwidth; 67 | u32 thumbheight; 68 | char bgra[thumbwidth * thumbheight * 4]; 69 | String title; 70 | String desc; 71 | String metadata; 72 | String author; 73 | String company; 74 | String website; 75 | String copyright; 76 | // Maybe change and creation time? 77 | double time1; 78 | double time2; 79 | Node node; 80 | }; 81 | 82 | Header hdr @0x00; 83 | -------------------------------------------------------------------------------- /patterns/qoi.hexpat: -------------------------------------------------------------------------------- 1 | #pragma description QOI image 2 | 3 | #pragma MIME image/qoi 4 | #pragma endian big 5 | 6 | import std.mem; 7 | 8 | namespace qoi { 9 | 10 | enum channels_t : u8 { 11 | RGB = 3, 12 | RGBA = 4 13 | }; 14 | 15 | enum color_space_t : u8 { 16 | sRGB = 0, 17 | linear = 1 18 | }; 19 | 20 | struct header_t { 21 | char magic[4]; 22 | u32 width; 23 | u32 height; 24 | channels_t channels; 25 | color_space_t color_space; 26 | }; 27 | 28 | enum tags_t : u8 { 29 | index = 0b00000000 ... 0b00111111, 30 | diff = 0b01000000 ... 0b01111111, 31 | luma = 0b10000000 ... 0b10111111, 32 | run = 0b11000000 ... 0b11111101, 33 | rgb = 0b11111110, 34 | rgba = 0b11111111, 35 | }; 36 | 37 | bitfield op_index { 38 | tag: 2; 39 | index: 6; 40 | } [[color("0000FF")]]; 41 | 42 | bitfield op_diff { 43 | tag: 2; 44 | dr: 2; 45 | dg: 2; 46 | db: 2; 47 | } [[color("FFFFFF")]]; 48 | 49 | bitfield op_luma { 50 | tag: 2; 51 | diff_green: 6; 52 | dr_dg: 4; 53 | db_dg: 4; 54 | } [[color("FFFF00")]]; 55 | 56 | bitfield op_run { 57 | tag: 2; 58 | run_length: 6; 59 | } [[color("00FF00")]]; 60 | 61 | struct op_rgb { 62 | u8 tag; 63 | u8 red; 64 | u8 green; 65 | u8 blue; 66 | } [[color("FF7700")]]; 67 | 68 | struct op_rgba { 69 | u8 tag; 70 | u8 red; 71 | u8 green; 72 | u8 blue; 73 | u8 alpha; 74 | } [[color("FF0000")]]; 75 | 76 | u8 op_type; 77 | fn get_op_type() { 78 | op_type = std::mem::read_unsigned($, 1); 79 | if (op_type < tags_t::rgb) 80 | op_type &= 0b11000000; 81 | }; 82 | 83 | struct op_t { 84 | qoi::get_op_type(); 85 | if (op_type == tags_t::index) op_index; 86 | else if (op_type == tags_t::diff) op_diff; 87 | else if (op_type == tags_t::luma) op_luma; 88 | else if (op_type == tags_t::run) op_run; 89 | else if (op_type == tags_t::rgb) op_rgb; 90 | else if (op_type == tags_t::rgba) op_rgba; 91 | }; 92 | 93 | struct file_t { 94 | header_t header; 95 | op_t data[while(!std::mem::eof())]; 96 | }; 97 | 98 | } // namespace qoi 99 | 100 | qoi::file_t qoi_picture @ 0x0; 101 | -------------------------------------------------------------------------------- /patterns/ras.hexpat: -------------------------------------------------------------------------------- 1 | #pragma author Fl3ch4 2 | #pragma description RAS image 3 | #pragma MIME image/x-sun-raster 4 | #pragma endian big 5 | 6 | 7 | import std.mem; 8 | import type.magic; 9 | 10 | 11 | struct RAS{ 12 | 13 | //Magic Bytes 14 | type::Magic<"\x59\xa6\x6a\x95"> signature; 15 | 16 | //BE -> px -> mm 17 | u32 width [[name("Width")]]; 18 | u32 height [[name("Height")]]; 19 | 20 | //BE 21 | u32 depth; 22 | u32 length; 23 | u32 type; 24 | u32 colorMapType; 25 | u32 colorMapLenght; 26 | 27 | //Data Viewer 28 | u8 image_data[length]; 29 | }; 30 | 31 | RAS header @0x00; 32 | -------------------------------------------------------------------------------- /patterns/rcf_v1_2.hexpat: -------------------------------------------------------------------------------- 1 | // Ported from LRCFB @ https://donutteam.com/@lucasc190/releases 2 | // Tested with files from: 3 | // - Hulk (PS2) 4 | // - Tetris Worlds (Gamecube) 5 | // - The Simpsons Hit and Run (PC) 6 | 7 | #pragma author blu 8 | #pragma description Radcore Cement Library file header (.rcf) v1.2 9 | 10 | import std.core; 11 | import type.time; 12 | 13 | struct DataEntry { 14 | u32 hash; 15 | u32 position; 16 | u32 size; 17 | }; 18 | 19 | struct NameEntry { 20 | le u32 length; 21 | char name[length]; 22 | le type::time32_t time; 23 | }; 24 | 25 | struct Header { 26 | char signature[32]; 27 | u8 version_major; 28 | u8 version_minor; 29 | bool is_bigendian; // true for gamecube 30 | u8 unk_0; //always "1" according to LRCFB 31 | if (is_bigendian) { 32 | std::core::set_endian(std::mem::Endian::Big); 33 | } 34 | u32 alignment; 35 | u32 unk_1; 36 | u32 directory_position; 37 | $ = directory_position; 38 | s32 data_count; 39 | u32 names_position; 40 | u32 data_position; 41 | le u32 data_pointer; 42 | DataEntry data_entries[data_count]; 43 | $ = names_position; 44 | le u32 names_count; 45 | le u32 names_pointer; 46 | NameEntry name_entries[names_count]; 47 | }; 48 | 49 | Header header @ 0x00; 50 | -------------------------------------------------------------------------------- /patterns/selinuxpp.hexpat: -------------------------------------------------------------------------------- 1 | #pragma description SE Linux package 2 | 3 | // SE Linux Policy Package 4 | // Extension: PP 5 | // https://github.com/SELinuxProject/selinux/blob/master/libsepol/src/module.c 6 | 7 | #pragma magic [ 8F FF 7C F9 ] @ 0x00 8 | #pragma endian little 9 | import std.sys; 10 | 11 | enum section_types : u32 { 12 | file_context = 0xf97cff90, 13 | module = 0xf97cff8d, 14 | user = 0x097cff91, 15 | user_extra = 0x097cff92, 16 | netfilter = 0x097cff93, 17 | }; 18 | 19 | struct section_s { 20 | section_types *type : u32; 21 | }; 22 | 23 | struct header_s { 24 | u32 magic; 25 | std::assert(magic == 0xf97cff8f, "invalid magic"); 26 | u32 version; 27 | u32 sections_count; 28 | section_s sections[sections_count]; 29 | }; 30 | 31 | header_s header @ 0x00; 32 | -------------------------------------------------------------------------------- /patterns/shx.hexpat: -------------------------------------------------------------------------------- 1 | #pragma author Calcoph 2 | #pragma description ESRI shapefile indices 3 | #pragma magic [ 00 00 27 0A ] @ 0x00 4 | 5 | // Spec: 6 | // https://www.esri.com/content/dam/esrisites/sitecore-archive/Files/Pdfs/library/whitepapers/pdfs/shapefile.pdf 7 | 8 | enum ShapeType: u32 { 9 | Null = 0, 10 | Point = 1, 11 | PolyLine = 3, 12 | Polygon = 5, 13 | MultiPoint = 8, 14 | PointZ = 11, 15 | PolyLineZ = 13, 16 | PolygonZ = 15, 17 | MultiPointZ = 18, 18 | PointM = 21, 19 | PolyLineM = 23, 20 | PolygonM = 25, 21 | MultiPointM = 28, 22 | MultiPatch = 32, 23 | }; 24 | 25 | 26 | struct Header { 27 | be u32 magic; // 9994 28 | padding[20]; // unused 29 | be u32 file_length; // in 16-bit words (including header) 30 | u32 version; // 1000 31 | ShapeType shape_type; 32 | // Bounding box 33 | double bb_xmin; 34 | double bb_ymin; 35 | double bb_xmax; 36 | double bb_ymax; 37 | double bb_zmin; 38 | double bb_zmax; 39 | double bb_mmin; 40 | double bb_mmax; 41 | }; 42 | 43 | struct Record { 44 | u32 offset; 45 | u32 content_length; 46 | }; 47 | 48 | struct IndexFile { 49 | Header header; 50 | Record records[while($ < header.file_length * 2)]; 51 | }; 52 | 53 | IndexFile file @ 0x00; 54 | -------------------------------------------------------------------------------- /patterns/stl.hexpat: -------------------------------------------------------------------------------- 1 | #pragma author WerWolv 2 | #pragma description STL 3D Model 3 | 4 | #pragma MIME model/stl 5 | #pragma MIME model/x.stl-binary 6 | #pragma MIME model/x.stl-ascii 7 | #pragma MIME application/sla 8 | 9 | import std.sys; 10 | import std.mem; 11 | import std.core; 12 | 13 | struct Vector3f { 14 | float x, y, z; 15 | } [[static, format("format_vector3f")]]; 16 | 17 | fn format_vector3f(Vector3f vec) { 18 | return std::format("[ {}, {}, {} ]", vec.x, vec.y, vec.z); 19 | }; 20 | 21 | struct Triangle { 22 | Vector3f normal; 23 | Vector3f points[3]; 24 | u16 flags; 25 | } [[static]]; 26 | 27 | struct BinarySTLHeader { 28 | char caption[while($[$] != 0x00 && $ - addressof(this) < 80)]; 29 | padding[80 - sizeof(caption)]; 30 | u32 triangleCount; 31 | }; 32 | 33 | struct STL { 34 | if (std::mem::read_string(0, 6) == "solid ") 35 | std::warning("ASCII STL file!"); 36 | else { 37 | BinarySTLHeader header; 38 | Triangle triangles[header.triangleCount]; 39 | } 40 | }; 41 | 42 | STL stl @ 0x00; 43 | 44 | /* Visualize the 3D Model */ 45 | 46 | struct Vertex { 47 | Vector3f points[3] @ addressof(stl.triangles[std::core::array_index()].points); 48 | }; 49 | 50 | struct Model { 51 | Vertex vertices[stl.header.triangleCount]; 52 | } [[highlight_hidden, sealed, hex::visualize("3d", vertices, null)]]; 53 | 54 | Model model @ 0x00; 55 | -------------------------------------------------------------------------------- /patterns/swf.hexpat: -------------------------------------------------------------------------------- 1 | #pragma author saturnaliam 2 | #pragma description Shockwave Flash Movie (SWF) 3 | #pragma endian little 4 | #pragma MIME application/x-shockwave-flash 5 | 6 | import type.magic; 7 | 8 | // RECTs are more complicated, but for the header, 9 | // this works fine. 10 | bitfield Rect { 11 | nSize : 5 [[name("N Size")]]; 12 | signed xMin : 15 [[name("X Min")]]; 13 | signed xMax : 15 [[name("X Max")]]; 14 | signed yMin : 15 [[name("Y Min")]]; 15 | signed yMax : 15 [[name("Y Max")]]; 16 | }; 17 | 18 | 19 | struct Header { 20 | char compressionSignature [[name("Compression"), comment("F - Uncompressed\nC - zlib Compressed\nZ - LZMA compressed")]]; 21 | type::Magic<"WS"> signature [[name("Signature")]]; 22 | u8 swfVersion [[name("SWF Version")]]; 23 | u32 bytesSize [[name("Uncompressed Size")]]; 24 | be Rect rect [[name("Frame Size"), comment("Needs to be uncompressed to have the correct value.")]]; 25 | padding[1]; 26 | u8 frameRate [[name("Framerate"), comment("Needs to be uncompressed to have the correct value.")]]; 27 | u16 frameCount [[name("Frame Count"), comment("Needs to be uncompressed to have the correct value.")]]; 28 | }; 29 | 30 | Header header @ 0x00; -------------------------------------------------------------------------------- /patterns/tga.hexpat: -------------------------------------------------------------------------------- 1 | #pragma description Truevision TGA/TARGA image 2 | 3 | #pragma MIME image/tga 4 | #pragma endian little 5 | 6 | import std.mem; 7 | 8 | struct ColorMapSpec { 9 | u16 entryIndex; 10 | u16 entryLength; 11 | u8 bpp; 12 | } [[static]]; 13 | 14 | bitfield ImageDesc { 15 | alphaDepth : 4; 16 | orderRightToLeft : 1; 17 | orderTopToBottom : 1; 18 | padding : 2; 19 | }; 20 | 21 | struct ImageSpec { 22 | u16 xOrigin; 23 | u16 yOrigin; 24 | u16 width; 25 | u16 height; 26 | u8 depth; 27 | ImageDesc imageDesc; 28 | } [[static]]; 29 | 30 | enum ColorMapType : u8 { 31 | None, 32 | ColorPalette, 33 | }; 34 | 35 | enum ImageType : u8 { 36 | NoData, 37 | UncompressedColorMapped, 38 | UncompressedRGB, 39 | UncompressedGreyscale, 40 | RLEColorMapped = 9, 41 | RLERGB, 42 | RLEGreyscale, 43 | // huffman + delta + rle 44 | CompressedColorMapped = 32, 45 | // huffman + delta + rle, 4-pass quadtree-type 46 | CompressedColorMapped4Pass, 47 | }; 48 | 49 | fn GetImageDataSize(ImageSpec imSpec) { 50 | return imSpec.height * imSpec.width * (imSpec.depth / 8); 51 | }; 52 | 53 | fn GetColorMapDataSize(ColorMapSpec cmSpec) { 54 | return cmSpec.entryLength * (cmSpec.bpp / 8); 55 | }; 56 | 57 | struct Header { 58 | u8 idLength; 59 | ColorMapType colorMapType; 60 | ImageType imageType; 61 | ColorMapSpec colorMapSpec; 62 | ImageSpec imageSpec; 63 | char imageId[idLength]; 64 | 65 | if (colorMapType == ColorMapType::ColorPalette) { 66 | u8 colorMapData[GetColorMapDataSize(colorMapSpec)]; 67 | } 68 | 69 | u8 imageData[GetImageDataSize(imageSpec)]; 70 | }; 71 | 72 | struct Footer { 73 | u32 extensionOffset; 74 | u32 developerDirectoryOffset; 75 | char signature[0x10]; 76 | char dot; 77 | char zero; 78 | }; 79 | 80 | u8 visualizer[std::mem::size()] @ 0x00 [[sealed, hex::visualize("image", this)]]; 81 | Header header @ 0x0; 82 | Footer footer @ std::mem::size() - 0x1A; 83 | -------------------------------------------------------------------------------- /patterns/ubiquiti.hexpat: -------------------------------------------------------------------------------- 1 | #pragma description Ubiquiti Firmware (update) image 2 | 3 | #pragma endian big 4 | #pragma magic [ 55 42 4E 54 ] @ 0x00 5 | 6 | import std.mem; 7 | import std.sys; 8 | 9 | // Ubiquiti Firmware related structs 10 | // More information here: https://dl.ubnt.com/firmwares/XN-fw/v5.6.3/GPL.UBNT.v5.6.3.tar.bz2 11 | 12 | /* 13 | * Block types of a default firmware file file: 14 | * - UBNT := header 15 | * - PART := partition 16 | * - EXEC := additional data block 17 | * - END. := default end block 18 | * - ENDS := signed end block using RSA 2048 bit 19 | */ 20 | #define TYPE_UBNT "UBNT" 21 | #define TYPE_PART "PART" 22 | #define TYPE_EXEC "EXEC" 23 | #define TYPE_END "END." 24 | #define TYPE_SIGNED_END "ENDS" 25 | 26 | namespace ubnt { 27 | struct UBNT { 28 | char version[256]; 29 | u32 crc32; 30 | }; 31 | 32 | struct PART { 33 | char name[16]; 34 | padding[12]; 35 | u32 memaddr; 36 | u32 index; 37 | u32 baseaddr; 38 | u32 entryaddr; 39 | u32 data_size; 40 | u32 part_size; 41 | u8 data[this.data_size]; 42 | u32 crc32; 43 | }; 44 | 45 | struct EXEC { 46 | char name[16]; 47 | u8 reserved[28]; 48 | u32 size; 49 | u32 size2; 50 | u32 crc32; 51 | u8 data[this.size]; 52 | }; 53 | 54 | struct END { 55 | u32 crc32; 56 | }; 57 | 58 | struct ENDS { 59 | u8 data[256]; 60 | }; 61 | } 62 | 63 | 64 | struct Block { 65 | char type[4]; 66 | 67 | if (type == TYPE_UBNT) { 68 | ubnt::UBNT header; 69 | } 70 | else if (type == TYPE_PART) { 71 | ubnt::PART partition; 72 | } 73 | else if (type == TYPE_EXEC) { 74 | ubnt::EXEC data; 75 | } 76 | else if (type == TYPE_END) { 77 | ubnt::END end; 78 | } 79 | else if (type == TYPE_SIGNED_END) { 80 | ubnt::ENDS end; 81 | } 82 | 83 | // REVISIT: change the type to u32 84 | padding[4]; 85 | }; 86 | 87 | // Greedy parsing of Block structs 88 | Block blocks[while(!std::mem::eof())] @ 0x00; 89 | 90 | std::assert(blocks[0].type == TYPE_UBNT, 91 | "File is not a valid Ubiquiti firmare file!"); 92 | 93 | std::print("Version: {}", blocks[0].header.version); -------------------------------------------------------------------------------- /patterns/uefi.hexpat: -------------------------------------------------------------------------------- 1 | #pragma description UEFI efivars 2 | 3 | #define WIN_CERT_TYPE_PKCS_SIGNED_DATA 0x0002 4 | #define WIN_CERT_TYPE_EFI_PKCS115 0x0EF0 5 | #define WIN_CERT_TYPE_EFI_GUID 0x0EF1 6 | 7 | struct EFI_TIME { 8 | u16 Year; // 1900 – 9999 9 | u8 Month; // 1 – 12 10 | u8 Day; // 1 – 31 11 | u8 Hour; // 0 – 23 12 | u8 Minute; // 0 – 59 13 | u8 Second; // 0 – 59 14 | u8 Pad1; 15 | u32 Nanosecond; // 0 – 999,999,999 16 | s16 TimeZone; // -1440 to 1440 or 2047 17 | u8 Daylight; 18 | u8 Pad2; 19 | }; 20 | 21 | struct EFI_GUID { 22 | u32 Data1; 23 | u16 Data2; 24 | u16 Data3; 25 | u8 Data4[8]; 26 | }; 27 | 28 | struct WIN_CERTIFICATE { 29 | u32 Length; 30 | u16 Revision; 31 | u16 CertificateType; 32 | //u8 Certificate[]; 33 | }; 34 | 35 | struct WIN_CERTIFICATE_UEFI_GUID { 36 | WIN_CERTIFICATE Hdr; 37 | EFI_GUID CertType; 38 | u8 CertData[Hdr.Length-SizeofWIN_CERTIFICATE_UEFI_GUID]; 39 | }; 40 | #define SizeofWIN_CERTIFICATE_UEFI_GUID 24 41 | 42 | struct EFI_VARIABLE_AUTHENTICATION_2 { 43 | EFI_TIME TimeStamp; 44 | WIN_CERTIFICATE_UEFI_GUID AuthInfo; 45 | }; 46 | 47 | struct EFI_SIGNATURE_DATA { 48 | EFI_GUID SignatureOwner; 49 | u8 SignatureData[1076]; 50 | }; 51 | 52 | struct EFI_SIGNATURE_LIST { 53 | EFI_GUID SignatureType; 54 | u32 SignatureListSize; 55 | u32 SignatureHeaderSize; 56 | u32 SignatureSize; 57 | u8 SignatureHeader[SignatureHeaderSize]; 58 | EFI_SIGNATURE_DATA Signatures; 59 | }; 60 | 61 | 62 | struct dbx_esl { 63 | EFI_VARIABLE_AUTHENTICATION_2 Auth; 64 | EFI_SIGNATURE_LIST x509_1; 65 | }; 66 | 67 | dbx_esl header @ 0x00; 68 | -------------------------------------------------------------------------------- /patterns/uefi_boot_entry.hexpat: -------------------------------------------------------------------------------- 1 | // subsections in this pattern refer to subsections in the 2 | // UEFI Specification Release 2.10 from Aug 29 2022 3 | 4 | #pragma author iTrooz 5 | #pragma description UEFI Boot Entry (Load option) 6 | 7 | import std.io; 8 | import type.guid; 9 | 10 | // subsection 10.3.5.1 11 | struct HARD_DRIVE { 12 | u32 partitionNumber; 13 | u64 partitionStart; 14 | u64 partitionSize; 15 | type::GUID partitionSig; 16 | u8 format; 17 | u8 sigType; 18 | }; 19 | 20 | // subsection 10.3.5.4 21 | struct FILE_PATH { 22 | char16 path[]; 23 | }; 24 | 25 | // subsection 10.3.1 26 | enum MEDIA_DEVICE_PATH_SUBTYPE : u8 { 27 | HARD_DRIVE = 0x01, 28 | FILE_PATH = 0x04, 29 | }; 30 | 31 | enum DEVICE_PATH_TYPE : u8 { 32 | MEDIA_DEVICE_PATH = 0x04, 33 | }; 34 | 35 | // subsection 10.2 36 | // EFI_DEVICE_PATH_PROTOCOL 37 | struct DEVICE_PATH { 38 | u8 type; 39 | u8 subtype; 40 | // length of this DEVICE_PATH structure 41 | u16 length; 42 | // the size of the data is the size of the structure minus the fields we know. 43 | // not always used 44 | u16 dataSize = length-1-1-2; 45 | 46 | match (type, subtype) { 47 | (DEVICE_PATH_TYPE::MEDIA_DEVICE_PATH, MEDIA_DEVICE_PATH_SUBTYPE::HARD_DRIVE): HARD_DRIVE data; 48 | (DEVICE_PATH_TYPE::MEDIA_DEVICE_PATH, MEDIA_DEVICE_PATH_SUBTYPE::FILE_PATH): FILE_PATH data; 49 | (_, _): u8 data[dataSize]; 50 | } 51 | }; 52 | 53 | // subsections 3.1.3 54 | // EFI_LOAD_OPTION 55 | struct LOAD_OPTION { 56 | u32 attributes; 57 | // length of the filePathList data 58 | u16 filePathLength; 59 | char16 description[]; 60 | 61 | u64 startOffset = $; 62 | DEVICE_PATH filePathList[while($ - startOffset < filePathLength)]; 63 | u8 optionalData; 64 | }; 65 | 66 | // on Linux, variables are found in /sys/firmware/efi/efivars, 67 | // and will be prefixed by their attributes 68 | struct EFI_VAR { 69 | u32 attributes; 70 | LOAD_OPTION loadOption; 71 | }; 72 | 73 | 74 | EFI_VAR data @0x0; 75 | -------------------------------------------------------------------------------- /patterns/valve_vpk.hexpat: -------------------------------------------------------------------------------- 1 | #pragma author Enaium 2 | #pragma description Valve VPK 3 | 4 | import std.io; 5 | import std.mem; 6 | import std.string; 7 | 8 | struct string { 9 | char text[while(std::mem::read_unsigned($, 1) != 0x0)]; 10 | u8 end [[hidden]]; 11 | if (text == "") { 12 | break; 13 | } 14 | }; 15 | 16 | struct entry { 17 | string name; 18 | u32 crc; 19 | u16 preload_bytes; 20 | u16 archive_index; 21 | u32 entry_offset; 22 | u32 entry_length; 23 | u16 terminator; 24 | 25 | if (preload_bytes > 0x0) { 26 | u8 preload[preload_bytes]; 27 | } 28 | 29 | if (archive_index == 0x7fff) { 30 | u8 data[entry_length] @ entry_offset; 31 | } 32 | }; 33 | 34 | struct path { 35 | string name; 36 | entry entry[while(true)]; 37 | }; 38 | 39 | struct extension { 40 | string name; 41 | path path[while(true)]; 42 | }; 43 | 44 | struct header { 45 | u32 signature; 46 | u32 version; 47 | u32 tree_size; 48 | 49 | if (version == 0x2) { 50 | u32 file_data_section_size; 51 | u32 archive_md5_section_size; 52 | u32 ohter_md5_section_size; 53 | u32 signature_section_size; 54 | } 55 | }; 56 | 57 | struct vpk { 58 | header header; 59 | extension extension[while(true)]; 60 | }; 61 | 62 | vpk vpk @ 0x0; -------------------------------------------------------------------------------- /patterns/vdf.hexpat: -------------------------------------------------------------------------------- 1 | #pragma author WerWolv 2 | #pragma description Valve Binary Value Data Format (.vdf) 3 | 4 | #pragma eval_depth 0x10000 5 | 6 | import std.mem; 7 | import std.sys; 8 | 9 | enum Type : u8 { 10 | Set = 0x00, 11 | String = 0x01, 12 | Integer = 0x02, 13 | EndSet = 0x08 14 | }; 15 | 16 | struct Entry { 17 | Type type; 18 | 19 | char name[]; 20 | 21 | if (type == Type::Set) { 22 | Entry entries[while (std::mem::read_unsigned($, 1) != Type::EndSet)]; 23 | Type endSet [[hidden]]; 24 | std::assert(endSet == Type::EndSet, "Invalid end of set byte!"); 25 | } 26 | else if (type == Type::Integer) 27 | u32 value; 28 | else if (type == Type::String) { 29 | char value[]; 30 | } 31 | }; 32 | 33 | struct Set { 34 | Entry entry [[inline]]; 35 | Type endSet [[hidden]]; 36 | std::assert(endSet == Type::EndSet, "Invalid end of set byte!"); 37 | }; 38 | 39 | Set set[while (std::mem::read_unsigned($ - 1, 1) != Type::EndSet)] @ 0x00; -------------------------------------------------------------------------------- /patterns/wad.hexpat: -------------------------------------------------------------------------------- 1 | #pragma author WerWolv 2 | #pragma description DOOM WAD Archive 3 | #pragma magic [ 50 57 41 44 ] @ 0x00 4 | 5 | import type.magic; 6 | import type.size; 7 | 8 | enum WADType : char { 9 | Internal = 'I', 10 | Patch = 'P' 11 | }; 12 | 13 | struct FileLump { 14 | u32 filePos; 15 | type::Size size; 16 | char name[8]; 17 | 18 | u8 data[size] @ filePos [[sealed]]; 19 | }; 20 | 21 | struct WAD { 22 | WADType type; 23 | type::Magic<"WAD"> identification; 24 | u32 numLumps; 25 | FileLump *infoTable[numLumps] : u32; 26 | }; 27 | 28 | WAD wad @ 0x00; -------------------------------------------------------------------------------- /patterns/was_oskasoftware.hexpat: -------------------------------------------------------------------------------- 1 | #pragma author DmitriLeon2000 2 | #pragma description Oska Software DeskMates WAS/WA3 (WAVE/MP3 Set) 3 | #pragma endian little 4 | 5 | import type.size; 6 | 7 | struct Sound { 8 | char name[]; 9 | u32 length; 10 | u8 data[length]; 11 | }; 12 | 13 | struct Header { 14 | type::Size size; 15 | u32 count; 16 | u32 pointers[count * 2]; 17 | }; 18 | 19 | struct WAS { 20 | Header header; 21 | Sound sounds[header.count]; 22 | }; 23 | 24 | WAS was @ 0x00; -------------------------------------------------------------------------------- /patterns/xilinx_bit.hexpat: -------------------------------------------------------------------------------- 1 | #pragma author WerWolv 2 | #pragma description Xilinx FPGA Bitstream 3 | 4 | import std.mem; 5 | import std.io; 6 | 7 | struct Flags { 8 | be u16 length; 9 | u8 value[length]; 10 | }; 11 | 12 | struct TLV { 13 | char tag[parent.keySize]; 14 | be u16 length; 15 | char value[length]; 16 | }; 17 | 18 | struct Command { 19 | be u32 value; 20 | } [[static, sealed, format("format_command")]]; 21 | 22 | fn format_command(Command command) { 23 | u32 x = command.value; 24 | 25 | if (x == 0x20000000) return "NOP"; 26 | if (x == 0xAA995566) return "SYNC"; 27 | if (x == 0x000000BB) return "Bus Width Sync"; 28 | if (x == 0x11220044) return "Bus Width Detect"; 29 | if (x == 0x30002001) return "Write to FAR"; 30 | if (x == 0x28006000) return "Write to FDRO"; 31 | if (x == 0x30000001) return "Write to CRC"; 32 | if (x == 0x30018001) return "Write to IDCODE"; 33 | if (x == 0x30004000) return "Write to FDRI"; 34 | if (x == 0x30008001) return "Write to CMD"; 35 | 36 | if ((x & 0xF0000000) == 0x30000000) 37 | return std::format("Write to Register {}", (x & 0x0003E000) >> 13); 38 | 39 | return std::format("0x{:08X}", x); 40 | }; 41 | 42 | struct Commands { 43 | char tag[parent.keySize]; 44 | be u32 length; 45 | Command commands[length / 4]; 46 | }; 47 | 48 | struct Header { 49 | Flags flags; 50 | be u16 keySize; 51 | TLV tlv[4]; 52 | Commands data; 53 | }; 54 | 55 | Header header @ 0x00; -------------------------------------------------------------------------------- /patterns/zim.hexpat: -------------------------------------------------------------------------------- 1 | #pragma endian little 2 | #pragma description ZIM file format 3 | #pragma magic [ 5A 49 4D 04 ] @ 0x00 4 | 5 | u32 maxEntries in; 6 | 7 | import std.string; 8 | import std.mem; 9 | import std.math; 10 | import std.core; 11 | 12 | struct Header { 13 | char signature[4]; 14 | u16 majorVersion; 15 | u16 minorVersion; 16 | u128 uid; 17 | u32 entryCount, clusterCount; 18 | u64 pathPtrPos, titlePtrPos, clusterPtrPos, mimeListPos; 19 | u32 mainPage; 20 | u32 layoutPage; 21 | u64 checksumPos; 22 | }; 23 | 24 | 25 | Header header @ 0x00; 26 | std::string::NullString mimeTypes[while(std::mem::read_unsigned($, 1) != 0x00)] @ header.mimeListPos; 27 | 28 | fn mimename(u16 index) { 29 | if(index == 0xFFFF) { 30 | return "redirect"; 31 | } else { 32 | return mimeTypes[index]; 33 | } 34 | }; 35 | 36 | enum CompressionType : u8 { 37 | None = 0x01, 38 | LZMA2 = 0x04, 39 | zstd = 0x05 40 | }; 41 | 42 | bitfield ClusterInfo { 43 | CompressionType compression: 4; 44 | offsetSize: 1; 45 | } [[bitfield_order(std::core::BitfieldOrder::LeastToMostSignificant, 8)]]; 46 | 47 | struct Cluster { 48 | ClusterInfo info; 49 | } [[inline]]; 50 | 51 | struct ClusterPointer { 52 | Cluster *cluster: u64; 53 | } [[inline]]; 54 | 55 | struct Entry { 56 | u16 mimetype [[format("mimename")]]; 57 | u8 parameterlen [[hidden]]; 58 | char _namespace [[name("namespace")]]; 59 | u32 revision; 60 | if (mimetype == 0xFFFF) { 61 | u32 redirectIndex; 62 | } else { 63 | u32 clusterNumber; 64 | ClusterPointer cluster @ (header.clusterPtrPos + clusterNumber * 8); 65 | u32 blobNumber; 66 | } 67 | 68 | std::string::NullString path; 69 | std::string::NullString title; 70 | padding[parameterlen]; 71 | } [[inline]]; 72 | 73 | struct EntryPointer { 74 | Entry *entry : u64; 75 | } [[inline]]; 76 | 77 | EntryPointer pathPointerList[std::math::min(header.entryCount, maxEntries == 0 ? 1500 : maxEntries)] @ header.pathPtrPos; 78 | u32 titlePointerList[header.entryCount] @ header.titlePtrPos; 79 | 80 | -------------------------------------------------------------------------------- /patterns/zlib.hexpat: -------------------------------------------------------------------------------- 1 | #pragma description ZLIB compressed data 2 | 3 | #pragma MIME application/zlib 4 | 5 | import std.core; 6 | import std.sys; 7 | 8 | #define HEADER_SIZE 2 9 | #define CSUM_SIZE 4 10 | 11 | using BitfieldOrder = std::core::BitfieldOrder; 12 | 13 | /// Entire stream minus header (2) and checksum (4) 14 | u64 data_len = std::mem::size(); 15 | 16 | if (data_len > (HEADER_SIZE + CSUM_SIZE)) { 17 | data_len -= (HEADER_SIZE + CSUM_SIZE); 18 | } else { 19 | data_len = 0; 20 | } 21 | 22 | /// Compression method; only Deflate is used 23 | enum CM: u8 { 24 | Deflate = 8, 25 | Reserved = 15, 26 | }; 27 | 28 | /// Compression level 29 | enum Level: u8 { 30 | Fastest = 0, 31 | Fast = 1, 32 | Default = 2, 33 | Smallest = 3, // slowest 34 | }; 35 | 36 | // Compression method & flags 37 | bitfield Header { 38 | CM method : 4; 39 | info: 4; 40 | fcheck: 5; 41 | bool fdict: 1; 42 | Level flevel: 2; 43 | } [[bitfield_order(BitfieldOrder::LeastToMostSignificant, 16)]]; 44 | 45 | 46 | /// Validate the header's checksum 47 | fn validate_hdr_checksum(Header hdr) { 48 | // Reassemble as a 2-byte big endian value 49 | u16 value = ( 50 | (u8(hdr.method) << 8) + 51 | (hdr.info << 12) + 52 | (hdr.fcheck << 0) + 53 | (hdr.fdict << 5) + 54 | (u8(hdr.flevel) << 6) 55 | ); 56 | 57 | if (value % 31 == 0) { 58 | std::print("Zlib header checksum OK. Value: {}", value); 59 | } else { 60 | std::warning(std::format("Zlib header checksum failed! Value: {}", value)); 61 | } 62 | }; 63 | 64 | /// Representation of a Zlib stream 65 | struct Zlib { 66 | /// Configuration 67 | Header header; 68 | 69 | if (header.fdict) { 70 | /// Adler checksum of the optional dictionary 71 | u32 dict; 72 | } 73 | 74 | /// Compressed data 75 | u8 data[data_len]; 76 | /// Adler-32 checksum of uncompressed data 77 | u32 checksum; 78 | }; 79 | 80 | 81 | // start parsing at the beginning of stream 82 | Zlib zlib @ 0x00; 83 | 84 | // Only mode 8 (deflate) is recognized 85 | std::assert_warn( 86 | zlib.header.method == CM::Deflate, 87 | "Unrecognized compression method" 88 | ); 89 | 90 | validate_hdr_checksum(zlib.header); 91 | -------------------------------------------------------------------------------- /plugins/extra-hashes.json: -------------------------------------------------------------------------------- 1 | { 2 | "name": "Extra Hashes", 3 | "desc": "Plugin adding many extra hash functions", 4 | "author": "WerWolv", 5 | "versions": { 6 | "v1.27.1": { 7 | "windows": { 8 | "url": "https://github.com/WerWolv/ImHex-Hashes-Plugin/releases/download/v1.0.0/extra_hashes-windows.hexplug", 9 | "hash": "a6113762463d5823b6f3e17d82a00aee2efadc6525c94265b7b8e4deca90e70e" 10 | } 11 | } 12 | } 13 | } -------------------------------------------------------------------------------- /scripts/csv2tbl.py: -------------------------------------------------------------------------------- 1 | import csv 2 | import sys 3 | 4 | if len(sys.argv) != 2: 5 | print(f"Usage: {sys.argv[0]} ") 6 | exit() 7 | 8 | fileName = sys.argv[1] 9 | 10 | index = 0x00 11 | with open(f"{fileName}.tbl", "w", encoding="utf-8") as outFile: 12 | with open(fileName) as file: 13 | reader = csv.reader(file) 14 | for row in reader: 15 | for cell in row: 16 | if cell != "": 17 | try: 18 | number = int(cell, 16) 19 | if number <= 0x1F: 20 | lut = [ "NUL", "SOH", "STX", "ETX", "EOT", "ENQ", "ACK", "BEL", "BS", "TAB", "LF", "VT", "FF", "CR", "SO", "SI", "DLE", "DC1", "DC2", "DC3", "DC4", "NAK", "SYN", "ETB", "CAN", "EM", "SUB", "ESC", "FS", "GS", "RS", "US"] 21 | print(f"{index:02X}={lut[number]}", file=outFile) 22 | elif number == 0x7F: 23 | print(f"{index:02X}=DEL", file=outFile) 24 | else: 25 | if chr(number) == chr(0xFFFD): 26 | raise Exception 27 | 28 | print(f"{index:02X}={chr(number)}", file=outFile) 29 | except Exception: 30 | print(f"{index:02X}", file=outFile) 31 | index += 1 -------------------------------------------------------------------------------- /scripts/extract_legacy_hexproj.py: -------------------------------------------------------------------------------- 1 | import json 2 | import sys 3 | from pathlib import Path 4 | 5 | def extractData(projectName, jsonData, objectName, extension): 6 | if objectName in jsonData: 7 | with open(f"./{projectName}.{extension}", mode="w", encoding="utf-8") as output: 8 | output.write(jsonData[objectName]) 9 | 10 | def main(): 11 | if len(sys.argv) != 2 or not str(sys.argv[1]).endswith(".hexproj"): 12 | print(f"Usage: {sys.argv[0]} ") 13 | exit(1) 14 | 15 | projectPath = sys.argv[1] 16 | with open(projectPath, mode="r", encoding="utf-8") as file: 17 | jsonData = json.loads(file.read()) 18 | 19 | projectName = Path(projectPath).stem 20 | 21 | extractData(projectName, jsonData, "dataProcessor", "hexnode") 22 | extractData(projectName, jsonData, "pattern", "hexpat") 23 | 24 | if "bookmarks" in jsonData: 25 | with open(f"./{projectName}.hexbm", mode="w", encoding="utf-8") as output: 26 | jsonOutput = {} 27 | jsonOutput["bookmarks"] = jsonData["bookmarks"] 28 | 29 | output.write(json.dumps(jsonOutput, indent=4)) 30 | 31 | if "filePath" in jsonData: 32 | print(f"Project file used file {jsonData['filePath']}") 33 | 34 | if __name__ == "__main__": 35 | main() 36 | -------------------------------------------------------------------------------- /scripts/utf8tblgen.py: -------------------------------------------------------------------------------- 1 | for i in range(0, 0x10FFFE): 2 | try: 3 | string = "" 4 | string += chr(i) 5 | 6 | if not string.isprintable(): 7 | continue 8 | print(f"{string.encode('utf-8').hex().upper()}={string}") 9 | except Exception as e: 10 | print(e) 11 | pass -------------------------------------------------------------------------------- /tests/CMakeLists.txt: -------------------------------------------------------------------------------- 1 | cmake_minimum_required(VERSION 3.16) 2 | 3 | set(CMAKE_CXX_STANDARD 20) 4 | 5 | add_subdirectory(patterns) 6 | add_subdirectory(includes) 7 | add_subdirectory(magic) -------------------------------------------------------------------------------- /tests/includes/CMakeLists.txt: -------------------------------------------------------------------------------- 1 | cmake_minimum_required(VERSION 3.16) 2 | 3 | project(includes_test) 4 | 5 | set(TOP_LEVEL "${CMAKE_CURRENT_SOURCE_DIR}/../..") 6 | 7 | file(GLOB INCLUDES 8 | "${TOP_LEVEL}/includes/*/*.pat" 9 | ) 10 | 11 | set(PATTERN_INCLUDES "${TOP_LEVEL}/includes") 12 | 13 | add_executable(includes_test 14 | source/main.cpp 15 | ) 16 | 17 | target_include_directories(includes_test PRIVATE include) 18 | target_link_libraries(includes_test PRIVATE libpl fmt::fmt-header-only) 19 | 20 | set_target_properties(includes_test PROPERTIES RUNTIME_OUTPUT_DIRECTORY ${CMAKE_BINARY_DIR}/bin) 21 | 22 | message(STATUS "Adding Include Tests") 23 | foreach (include IN LISTS INCLUDES) 24 | file(RELATIVE_PATH INCLUDE_NAME ${PATTERN_INCLUDES} ${include}) 25 | 26 | set(TEST_NAME "Includes/${INCLUDE_NAME}") 27 | 28 | add_test(NAME ${TEST_NAME} COMMAND includes_test "${INCLUDE_NAME}" "${include}" "${PATTERN_INCLUDES}" WORKING_DIRECTORY ${CMAKE_BINARY_DIR}/bin) 29 | set_tests_properties(${TEST_NAME} PROPERTIES SKIP_RETURN_CODE 77) 30 | endforeach () 31 | add_dependencies(unit_tests ${PROJECT_NAME}) -------------------------------------------------------------------------------- /tests/magic/CMakeLists.txt: -------------------------------------------------------------------------------- 1 | cmake_minimum_required(VERSION 3.16) 2 | 3 | project(magic_test) 4 | 5 | set(TOP_LEVEL "${CMAKE_CURRENT_SOURCE_DIR}/../..") 6 | 7 | set(MAGIC_FOLDER "${TOP_LEVEL}/magic") 8 | file(GLOB MAGIC_FILES 9 | "${MAGIC_FOLDER}/*" 10 | ) 11 | 12 | add_executable(magic_test 13 | source/main.cpp 14 | ) 15 | 16 | find_package(PkgConfig REQUIRED) 17 | pkg_search_module(MAGIC libmagic>=5.39 REQUIRED) 18 | 19 | target_include_directories(magic_test PRIVATE include ${MAGIC_INCLUDE_DIRS}) 20 | target_link_libraries(magic_test PRIVATE libpl ${MAGIC_LINK_LIBRARIES} fmt::fmt-header-only) 21 | 22 | set_target_properties(magic_test PROPERTIES RUNTIME_OUTPUT_DIRECTORY ${CMAKE_BINARY_DIR}/bin) 23 | 24 | message(STATUS "Adding Magic Tests") 25 | foreach (magic_file IN LISTS MAGIC_FILES) 26 | file(RELATIVE_PATH MAGIC_NAME ${MAGIC_FOLDER} ${magic_file}) 27 | 28 | set(TEST_NAME "Magic/${MAGIC_NAME}") 29 | 30 | add_test(NAME ${TEST_NAME} COMMAND magic_test "${MAGIC_NAME}" "${magic_file}" WORKING_DIRECTORY ${CMAKE_BINARY_DIR}/bin) 31 | set_tests_properties(${TEST_NAME} PROPERTIES SKIP_RETURN_CODE 77) 32 | endforeach () 33 | add_dependencies(unit_tests ${PROJECT_NAME}) -------------------------------------------------------------------------------- /tests/magic/source/main.cpp: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | 4 | #include 5 | #include 6 | 7 | #include 8 | 9 | #define EXIT_SKIP 77 10 | 11 | int main(int argc, char **argv) { 12 | // Any number of arguments other than 3 are invalid 13 | if (argc != 3) 14 | return EXIT_FAILURE; 15 | 16 | // Extract command line arguments 17 | const std::string magicName = argv[1]; 18 | const std::fs::path magicFilePath = argv[2]; 19 | 20 | fmt::print("Running test {} on test file {}\n", magicName, magicFilePath.filename().string()); 21 | 22 | magic_t ctx = magic_open(MAGIC_NONE); 23 | ON_SCOPE_EXIT { magic_close(ctx); }; 24 | 25 | if (ctx == nullptr) 26 | return EXIT_FAILURE; 27 | 28 | if (magic_compile(ctx, magicFilePath.string().c_str()) != 0) { 29 | fmt::print("Error during compilation: {}\n", magic_error(ctx)); 30 | return EXIT_FAILURE; 31 | } 32 | 33 | return EXIT_SUCCESS; 34 | } -------------------------------------------------------------------------------- /tests/patterns/CMakeLists.txt: -------------------------------------------------------------------------------- 1 | cmake_minimum_required(VERSION 3.16) 2 | 3 | project(patterns_tests) 4 | 5 | set(TOP_LEVEL "${CMAKE_CURRENT_SOURCE_DIR}/../..") 6 | 7 | file(GLOB PATTERNS 8 | "${TOP_LEVEL}/patterns/*.hexpat" 9 | ) 10 | 11 | set(PATTERN_INCLUDES "${TOP_LEVEL}/includes") 12 | 13 | add_executable(patterns_tests 14 | source/main.cpp 15 | ) 16 | 17 | target_include_directories(patterns_tests PRIVATE include) 18 | target_link_libraries(patterns_tests PRIVATE libpl fmt::fmt-header-only) 19 | 20 | set_target_properties(patterns_tests PROPERTIES RUNTIME_OUTPUT_DIRECTORY ${CMAKE_BINARY_DIR}/bin) 21 | 22 | message(STATUS "Adding Pattern Tests") 23 | foreach (pattern IN LISTS PATTERNS) 24 | get_filename_component(PATTERN_NAME ${pattern} NAME) 25 | 26 | file(GLOB TEST_FILES "${CMAKE_CURRENT_SOURCE_DIR}/test_data/${PATTERN_NAME}/*") 27 | if (NOT TEST_FILES) 28 | file(GLOB TEST_FILES "${CMAKE_CURRENT_SOURCE_DIR}/test_data/${PATTERN_NAME}.*") 29 | list(SUBLIST TEST_FILES 0 1 TEST_FILES) 30 | endif () 31 | 32 | if (TEST_FILES) 33 | foreach (TEST_FILE IN LISTS TEST_FILES) 34 | get_filename_component(TEST_FILENAME ${TEST_FILE} NAME) 35 | set(TEST_NAME "Patterns/${PATTERN_NAME}/${TEST_FILENAME}") 36 | add_test(NAME ${TEST_NAME} COMMAND patterns_tests "${PATTERN_NAME}" "${pattern}" "${PATTERN_INCLUDES}" "${TEST_FILE}" WORKING_DIRECTORY ${CMAKE_BINARY_DIR}/bin) 37 | set_tests_properties(${TEST_NAME} PROPERTIES SKIP_RETURN_CODE 77) 38 | endforeach () 39 | else () 40 | set(TEST_NAME "Patterns/${PATTERN_NAME}") 41 | add_test(NAME ${TEST_NAME} COMMAND patterns_tests "${PATTERN_NAME}" "${pattern}" "${PATTERN_INCLUDES}" WORKING_DIRECTORY ${CMAKE_BINARY_DIR}/bin) 42 | set_tests_properties(${TEST_NAME} PROPERTIES SKIP_RETURN_CODE 77) 43 | message(STATUS " No test file available for ${PATTERN_NAME} pattern") 44 | endif () 45 | endforeach () 46 | add_dependencies(unit_tests ${PROJECT_NAME}) 47 | -------------------------------------------------------------------------------- /tests/patterns/test_data/3ds.hexpat.3ds: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/3ds.hexpat.3ds -------------------------------------------------------------------------------- /tests/patterns/test_data/7z.hexpat.7z: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/7z.hexpat.7z -------------------------------------------------------------------------------- /tests/patterns/test_data/adtfdat.hexpat.adtfdat: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/adtfdat.hexpat.adtfdat -------------------------------------------------------------------------------- /tests/patterns/test_data/adts.hexpat.aac: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/adts.hexpat.aac -------------------------------------------------------------------------------- /tests/patterns/test_data/afe2.hexpat.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/afe2.hexpat.bin -------------------------------------------------------------------------------- /tests/patterns/test_data/ani.compatibility.hexpat.ani: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/ani.compatibility.hexpat.ani -------------------------------------------------------------------------------- /tests/patterns/test_data/ani.hexpat.ani: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/ani.hexpat.ani -------------------------------------------------------------------------------- /tests/patterns/test_data/ar.hexpat.ar: -------------------------------------------------------------------------------- 1 | ! 2 | test.txt/ 0 0 0 644 12 ` 3 | Hello World 4 | -------------------------------------------------------------------------------- /tests/patterns/test_data/arc.hexpat.arc: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/arc.hexpat.arc -------------------------------------------------------------------------------- /tests/patterns/test_data/aria2.hexpat.aria2: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/aria2.hexpat.aria2 -------------------------------------------------------------------------------- /tests/patterns/test_data/arm_cm_vtor.hexpat.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/arm_cm_vtor.hexpat.bin -------------------------------------------------------------------------------- /tests/patterns/test_data/bcss.hexpat/test.bcss: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/bcss.hexpat/test.bcss -------------------------------------------------------------------------------- /tests/patterns/test_data/bcss.hexpat/test.bcss_content: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/bcss.hexpat/test.bcss_content -------------------------------------------------------------------------------- /tests/patterns/test_data/bencode.hexpat.torrent: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/bencode.hexpat.torrent -------------------------------------------------------------------------------- /tests/patterns/test_data/bgcode.hexpat.bgcode: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/bgcode.hexpat.bgcode -------------------------------------------------------------------------------- /tests/patterns/test_data/blend.hexpat/blend.hexpat.blend: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/blend.hexpat/blend.hexpat.blend -------------------------------------------------------------------------------- /tests/patterns/test_data/blend.hexpat/blend_zstd.hexpat.blend: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/blend.hexpat/blend_zstd.hexpat.blend -------------------------------------------------------------------------------- /tests/patterns/test_data/bmp.hexpat.bmp: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/bmp.hexpat.bmp -------------------------------------------------------------------------------- /tests/patterns/test_data/bplist.hexpat.bplist: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/bplist.hexpat.bplist -------------------------------------------------------------------------------- /tests/patterns/test_data/bson.hexpat.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/bson.hexpat.bin -------------------------------------------------------------------------------- /tests/patterns/test_data/bsp_goldsrc.hexpat.bsp: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/bsp_goldsrc.hexpat.bsp -------------------------------------------------------------------------------- /tests/patterns/test_data/bzip3.hexpat.bz3: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/bzip3.hexpat.bz3 -------------------------------------------------------------------------------- /tests/patterns/test_data/cab.hexpat.cab: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/cab.hexpat.cab -------------------------------------------------------------------------------- /tests/patterns/test_data/ccvxl.hexpat.vxl: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/ccvxl.hexpat.vxl -------------------------------------------------------------------------------- /tests/patterns/test_data/cda.hexpat.cda: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/cda.hexpat.cda -------------------------------------------------------------------------------- /tests/patterns/test_data/chm.hexpat.chm: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/chm.hexpat.chm -------------------------------------------------------------------------------- /tests/patterns/test_data/coff.hexpat.obj: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/coff.hexpat.obj -------------------------------------------------------------------------------- /tests/patterns/test_data/cpio.hexpat.cpio: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/cpio.hexpat.cpio -------------------------------------------------------------------------------- /tests/patterns/test_data/credhist.hexpat.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/credhist.hexpat.bin -------------------------------------------------------------------------------- /tests/patterns/test_data/dds.hexpat.dds: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/dds.hexpat.dds -------------------------------------------------------------------------------- /tests/patterns/test_data/dex.hexpat.dex: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/dex.hexpat.dex -------------------------------------------------------------------------------- /tests/patterns/test_data/dicom.hexpat/jpeg-wsi.dcm: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/dicom.hexpat/jpeg-wsi.dcm -------------------------------------------------------------------------------- /tests/patterns/test_data/dicom.hexpat/le-explicit-vlp.dcm: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/dicom.hexpat/le-explicit-vlp.dcm -------------------------------------------------------------------------------- /tests/patterns/test_data/dmg.hexpat.dmg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/dmg.hexpat.dmg -------------------------------------------------------------------------------- /tests/patterns/test_data/dmp64.hexpat.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/dmp64.hexpat.bin -------------------------------------------------------------------------------- /tests/patterns/test_data/dpapiblob.hexpat.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/dpapiblob.hexpat.bin -------------------------------------------------------------------------------- /tests/patterns/test_data/dpapimasterkey.hexpat.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/dpapimasterkey.hexpat.bin -------------------------------------------------------------------------------- /tests/patterns/test_data/dsstore.hexpat.dsstore: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/dsstore.hexpat.dsstore -------------------------------------------------------------------------------- /tests/patterns/test_data/dted.hexpat.dt0: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/dted.hexpat.dt0 -------------------------------------------------------------------------------- /tests/patterns/test_data/elf.hexpat.elf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/elf.hexpat.elf -------------------------------------------------------------------------------- /tests/patterns/test_data/evtx.hexpat.evtx: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/evtx.hexpat.evtx -------------------------------------------------------------------------------- /tests/patterns/test_data/ext4.hexpat.img: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/ext4.hexpat.img -------------------------------------------------------------------------------- /tests/patterns/test_data/fbx.hexpat.fbx: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/fbx.hexpat.fbx -------------------------------------------------------------------------------- /tests/patterns/test_data/fdt.hexpat.dtb: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/fdt.hexpat.dtb -------------------------------------------------------------------------------- /tests/patterns/test_data/flac.hexpat.flac: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/flac.hexpat.flac -------------------------------------------------------------------------------- /tests/patterns/test_data/flc.hexpat.flc: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/flc.hexpat.flc -------------------------------------------------------------------------------- /tests/patterns/test_data/flipper_settings.hexpat/bt.settings: -------------------------------------------------------------------------------- 1 |  -------------------------------------------------------------------------------- /tests/patterns/test_data/flipper_settings.hexpat/desktop.settings: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/flipper_settings.hexpat/desktop.settings -------------------------------------------------------------------------------- /tests/patterns/test_data/flipper_settings.hexpat/dolphin.state: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/flipper_settings.hexpat/dolphin.state -------------------------------------------------------------------------------- /tests/patterns/test_data/flipper_settings.hexpat/expansion.settings: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/flipper_settings.hexpat/expansion.settings -------------------------------------------------------------------------------- /tests/patterns/test_data/flipper_settings.hexpat/infrared.settings: -------------------------------------------------------------------------------- 1 |  -------------------------------------------------------------------------------- /tests/patterns/test_data/flipper_settings.hexpat/notification.settings: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/flipper_settings.hexpat/notification.settings -------------------------------------------------------------------------------- /tests/patterns/test_data/fs.hexpat.img: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/fs.hexpat.img -------------------------------------------------------------------------------- /tests/patterns/test_data/gb.hexpat.gb: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/gb.hexpat.gb -------------------------------------------------------------------------------- /tests/patterns/test_data/gguf.hexpat.gguf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/gguf.hexpat.gguf -------------------------------------------------------------------------------- /tests/patterns/test_data/gif.hexpat.gif: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/gif.hexpat.gif -------------------------------------------------------------------------------- /tests/patterns/test_data/gltf.hexpat.glb: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/gltf.hexpat.glb -------------------------------------------------------------------------------- /tests/patterns/test_data/gzip.hexpat.gz: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/gzip.hexpat.gz -------------------------------------------------------------------------------- /tests/patterns/test_data/hinf_luas.hexpat.luas: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/hinf_luas.hexpat.luas -------------------------------------------------------------------------------- /tests/patterns/test_data/hinf_module.hexpat.module: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/hinf_module.hexpat.module -------------------------------------------------------------------------------- /tests/patterns/test_data/hinf_tag.hexpat.tag: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/hinf_tag.hexpat.tag -------------------------------------------------------------------------------- /tests/patterns/test_data/hprof.hexpat.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/hprof.hexpat.bin -------------------------------------------------------------------------------- /tests/patterns/test_data/hsdt.hexpat.hsdt: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/hsdt.hexpat.hsdt -------------------------------------------------------------------------------- /tests/patterns/test_data/ico.hexpat.ico: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/ico.hexpat.ico -------------------------------------------------------------------------------- /tests/patterns/test_data/id3.hexpat.mp3: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/id3.hexpat.mp3 -------------------------------------------------------------------------------- /tests/patterns/test_data/imah.hexpat.fw.sig: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/imah.hexpat.fw.sig -------------------------------------------------------------------------------- /tests/patterns/test_data/intel_hex.hexpat.hex: -------------------------------------------------------------------------------- 1 | :020000040000FA 2 | :100000000200765388CF5389F0438901438E04EF71 3 | :100010006012C28C758CA0758A4CC28DD28C308DCA 4 | :10002000FD1F80EBC28C22AF88758800758D3475FA 5 | :0A0030008B348F882243B280222215 6 | :10003B0002010512026812003512024812028412E4 7 | :10004B00029D12028B12005C1202921202A102029A 8 | :10005B00A5AF885388AF758CBC758D96EF5440FE59 9 | :07006B00EF54104E42882201 10 | :1000730002022D120039787FE4F6D8FD7581200243 11 | :1000830000C0020189E493A3F8E493A34003F6803C 12 | :1000930001F208DFF48029E493A3F85407240CC881 13 | :1000A300C333C4540F4420C8834004F4568001462C 14 | :1000B300F6DFE4800B01020408102040809002A9BF 15 | :1000C300E47E019360BCA3FF543F30E509541FFE57 16 | :1000D300E493A360010ECF54C025E060A840B8E4C8 17 | :1000E30093A3FAE493A3F8E493A3C8C582C8CAC54B 18 | :1000F30083CAF0A3C8C582C8CAC583CADFE9DEE7DD 19 | :1001030080BEC0E0C0D0C20320C255E5C054F02475 20 | :1001130080603E24C0601624E07041850BC253C248 21 | :10012300FEA201E43342C2C2C5D202803530C113FC 22 | :1001330030020AC20220012A850AC28025D2C4C223 23 | :1001430000801FD2C4D2C50509E5097015050880D2 24 | :100153001185C20CC200C2C1D2C48006D203800280 25 | :10016300D20330031A53C17F43C180C2C5C2C4C284 26 | :10017300C1C200C203D2960509E50970020508C28F 27 | :10018300C0D0D0D0E03212003E20802D75E340C2B3 28 | :1001930081E4FFEFC394FF7480948050030F80F3D6 29 | :1001A300D2813081FDE4FFEFC3940A7480948050C0 30 | :1001B300030F80F3E4F5E380D0120218D296E4F53E 31 | :1001C3000DF508F509850D0A750BF0120254750B30 32 | :1001D300F012023BE50C650A60080509E5097002A7 33 | :1001E3000508D3E5099400E50894004004D29680FD 34 | :1001F30002B296050D7F3212000380C9E5915404C3 35 | :100203005391FB75953875949E75933875929E43FB 36 | :10021300910442912212026F1202761200271201F8 37 | :10022300FF12025E12029902027D53C17F43C18015 38 | :1002330053917FC2C5C200322000FDD200D201D249 39 | :10024300C52000FD22E4F5A9E5A95480648070F877 40 | :10025300222000FDD200C201D2C522758E0175890C 41 | :100263002043884022E4F5A753D9BF22E4F5A775BC 42 | :10027300A5402275E34075E1042275E68175A880E7 43 | :100283002275A41075D4CF2275E34075E10522755C 44 | :1002930089224388402275C1DD2275D5072275C1A5 45 | :0902A300C02243981022C10200A0 46 | :00000001FF 47 | -------------------------------------------------------------------------------- /tests/patterns/test_data/ips.hexpat.ips: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/ips.hexpat.ips -------------------------------------------------------------------------------- /tests/patterns/test_data/iso.hexpat.iso: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/iso.hexpat.iso -------------------------------------------------------------------------------- /tests/patterns/test_data/java_class.hexpat.class: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/java_class.hexpat.class -------------------------------------------------------------------------------- /tests/patterns/test_data/jpeg.hexpat.jpeg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/jpeg.hexpat.jpeg -------------------------------------------------------------------------------- /tests/patterns/test_data/lcesave.hexpat/MC-TU033PreRelease_savegameDecompressed.dat: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/lcesave.hexpat/MC-TU033PreRelease_savegameDecompressed.dat -------------------------------------------------------------------------------- /tests/patterns/test_data/lcesave.hexpat/MC-TU5-Release_savegameDecompressed.dat: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/lcesave.hexpat/MC-TU5-Release_savegameDecompressed.dat -------------------------------------------------------------------------------- /tests/patterns/test_data/lnk.hexpat.lnk: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/lnk.hexpat.lnk -------------------------------------------------------------------------------- /tests/patterns/test_data/lua51.hexpat.lua: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/lua51.hexpat.lua -------------------------------------------------------------------------------- /tests/patterns/test_data/lua52.hexpat.lua: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/lua52.hexpat.lua -------------------------------------------------------------------------------- /tests/patterns/test_data/lua53.hexpat.lua: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/lua53.hexpat.lua -------------------------------------------------------------------------------- /tests/patterns/test_data/lua54.hexpat.lua: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/lua54.hexpat.lua -------------------------------------------------------------------------------- /tests/patterns/test_data/lznt1.hexpat.lznt1: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/lznt1.hexpat.lznt1 -------------------------------------------------------------------------------- /tests/patterns/test_data/macho.hexpat.o: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/macho.hexpat.o -------------------------------------------------------------------------------- /tests/patterns/test_data/max_v104.hexpat.dta: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/max_v104.hexpat.dta -------------------------------------------------------------------------------- /tests/patterns/test_data/midi.hexpat.mid: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/midi.hexpat.mid -------------------------------------------------------------------------------- /tests/patterns/test_data/minidump.hexpat.dmp: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/minidump.hexpat.dmp -------------------------------------------------------------------------------- /tests/patterns/test_data/mo.hexpat.mo: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/mo.hexpat.mo -------------------------------------------------------------------------------- /tests/patterns/test_data/mp4.hexpat.mp4: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/mp4.hexpat.mp4 -------------------------------------------------------------------------------- /tests/patterns/test_data/msgpack.hexpat.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/msgpack.hexpat.bin -------------------------------------------------------------------------------- /tests/patterns/test_data/nacp.hexpat.nacp: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/nacp.hexpat.nacp -------------------------------------------------------------------------------- /tests/patterns/test_data/nbt.hexpat.nbt: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/nbt.hexpat.nbt -------------------------------------------------------------------------------- /tests/patterns/test_data/ne.hexpat.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/ne.hexpat.exe -------------------------------------------------------------------------------- /tests/patterns/test_data/nes.hexpat.nes: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/nes.hexpat.nes -------------------------------------------------------------------------------- /tests/patterns/test_data/notepad-cache.hexpat.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/notepad-cache.hexpat.bin -------------------------------------------------------------------------------- /tests/patterns/test_data/notepadwindowstate.hexpat.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/notepadwindowstate.hexpat.bin -------------------------------------------------------------------------------- /tests/patterns/test_data/nro.hexpat.nro: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/nro.hexpat.nro -------------------------------------------------------------------------------- /tests/patterns/test_data/ntag.hexpat.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/ntag.hexpat.bin -------------------------------------------------------------------------------- /tests/patterns/test_data/ogg.hexpat.ogg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/ogg.hexpat.ogg -------------------------------------------------------------------------------- /tests/patterns/test_data/orp.hexpat.orp: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/orp.hexpat.orp -------------------------------------------------------------------------------- /tests/patterns/test_data/pcap.hexpat.pcap: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/pcap.hexpat.pcap -------------------------------------------------------------------------------- /tests/patterns/test_data/pcapng.hexpat.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/pcapng.hexpat.bin -------------------------------------------------------------------------------- /tests/patterns/test_data/pck.hexpat.pck: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/pck.hexpat.pck -------------------------------------------------------------------------------- /tests/patterns/test_data/pcx.hexpat.pcx: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/pcx.hexpat.pcx -------------------------------------------------------------------------------- /tests/patterns/test_data/pe.hexpat.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/pe.hexpat.exe -------------------------------------------------------------------------------- /tests/patterns/test_data/pex.hexpat.pex: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/pex.hexpat.pex -------------------------------------------------------------------------------- /tests/patterns/test_data/pfs0.hexpat.nsp: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/pfs0.hexpat.nsp -------------------------------------------------------------------------------- /tests/patterns/test_data/pif.hexpat.pif: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/pif.hexpat.pif -------------------------------------------------------------------------------- /tests/patterns/test_data/pkm.hexpat.pkm: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/pkm.hexpat.pkm -------------------------------------------------------------------------------- /tests/patterns/test_data/png.hexpat.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/png.hexpat.png -------------------------------------------------------------------------------- /tests/patterns/test_data/protobuf.hexpat.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/protobuf.hexpat.bin -------------------------------------------------------------------------------- /tests/patterns/test_data/psafe3.hexpat.psafe3: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/psafe3.hexpat.psafe3 -------------------------------------------------------------------------------- /tests/patterns/test_data/pyc.hexpat.pyc: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/pyc.hexpat.pyc -------------------------------------------------------------------------------- /tests/patterns/test_data/pyinstaller.hexpat.elf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/pyinstaller.hexpat.elf -------------------------------------------------------------------------------- /tests/patterns/test_data/qoi.hexpat.qoi: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/qoi.hexpat.qoi -------------------------------------------------------------------------------- /tests/patterns/test_data/rar.hexpat.rar: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/rar.hexpat.rar -------------------------------------------------------------------------------- /tests/patterns/test_data/ras.hexpat.ras: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/ras.hexpat.ras -------------------------------------------------------------------------------- /tests/patterns/test_data/rgbds.hexpat.o: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/rgbds.hexpat.o -------------------------------------------------------------------------------- /tests/patterns/test_data/selinux.hexpat.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/selinux.hexpat.bin -------------------------------------------------------------------------------- /tests/patterns/test_data/selinuxpp.hexpat.pp: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/selinuxpp.hexpat.pp -------------------------------------------------------------------------------- /tests/patterns/test_data/shp.hexpat.shp: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/shp.hexpat.shp -------------------------------------------------------------------------------- /tests/patterns/test_data/shx.hexpat.shx: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/shx.hexpat.shx -------------------------------------------------------------------------------- /tests/patterns/test_data/sit5.hexpat.sit: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/sit5.hexpat.sit -------------------------------------------------------------------------------- /tests/patterns/test_data/sqlite3.hexpat.db: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/sqlite3.hexpat.db -------------------------------------------------------------------------------- /tests/patterns/test_data/stl.hexpat.stl: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/stl.hexpat.stl -------------------------------------------------------------------------------- /tests/patterns/test_data/sup.hexpat.sup: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/sup.hexpat.sup -------------------------------------------------------------------------------- /tests/patterns/test_data/swf.hexpat.swf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/swf.hexpat.swf -------------------------------------------------------------------------------- /tests/patterns/test_data/tar.hexpat.tar: -------------------------------------------------------------------------------- 1 | test.txt0000777000000000000000000000001314350522532007466 0ustar Hello World -------------------------------------------------------------------------------- /tests/patterns/test_data/tga.hexpat.tga: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/tga.hexpat.tga -------------------------------------------------------------------------------- /tests/patterns/test_data/tiff.hexpat/bigtiff-be-tiled.tiff: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/tiff.hexpat/bigtiff-be-tiled.tiff -------------------------------------------------------------------------------- /tests/patterns/test_data/tiff.hexpat/bigtiff-le-stripped.tiff: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/tiff.hexpat/bigtiff-le-stripped.tiff -------------------------------------------------------------------------------- /tests/patterns/test_data/tiff.hexpat/classic-be-stripped.tiff: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/tiff.hexpat/classic-be-stripped.tiff -------------------------------------------------------------------------------- /tests/patterns/test_data/tiff.hexpat/classic-le-stripped.tiff: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/tiff.hexpat/classic-le-stripped.tiff -------------------------------------------------------------------------------- /tests/patterns/test_data/tiff.hexpat/classic-le-tiled.tiff: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/tiff.hexpat/classic-le-tiled.tiff -------------------------------------------------------------------------------- /tests/patterns/test_data/ttf.hexpat.ttf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/ttf.hexpat.ttf -------------------------------------------------------------------------------- /tests/patterns/test_data/ubiquiti.hexpat.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/ubiquiti.hexpat.bin -------------------------------------------------------------------------------- /tests/patterns/test_data/uefi_boot_entry.hexpat.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/uefi_boot_entry.hexpat.bin -------------------------------------------------------------------------------- /tests/patterns/test_data/uf2.hexpat.uf2: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/uf2.hexpat.uf2 -------------------------------------------------------------------------------- /tests/patterns/test_data/usb.hexpat.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/usb.hexpat.bin -------------------------------------------------------------------------------- /tests/patterns/test_data/valve_vpk.hexpat.vpk: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/valve_vpk.hexpat.vpk -------------------------------------------------------------------------------- /tests/patterns/test_data/vbmeta.hexpat.img: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/vbmeta.hexpat.img -------------------------------------------------------------------------------- /tests/patterns/test_data/vdf.hexpat.vdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/vdf.hexpat.vdf -------------------------------------------------------------------------------- /tests/patterns/test_data/veado.hexpat.veado: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/veado.hexpat.veado -------------------------------------------------------------------------------- /tests/patterns/test_data/vox.hexpat.vox: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/vox.hexpat.vox -------------------------------------------------------------------------------- /tests/patterns/test_data/wad.hexpat.wad: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/wad.hexpat.wad -------------------------------------------------------------------------------- /tests/patterns/test_data/was_oskasoftware.hexpat.was: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/was_oskasoftware.hexpat.was -------------------------------------------------------------------------------- /tests/patterns/test_data/wav.hexpat.wav: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/wav.hexpat.wav -------------------------------------------------------------------------------- /tests/patterns/test_data/webp.hexpat.webp: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/webp.hexpat.webp -------------------------------------------------------------------------------- /tests/patterns/test_data/xilinx_bootgen.hexpat.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/xilinx_bootgen.hexpat.bin -------------------------------------------------------------------------------- /tests/patterns/test_data/zim.hexpat.zim: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/zim.hexpat.zim -------------------------------------------------------------------------------- /tests/patterns/test_data/zip.hexpat/regular.zip: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/zip.hexpat/regular.zip -------------------------------------------------------------------------------- /tests/patterns/test_data/zlib.hexpat.zlib: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/zlib.hexpat.zlib -------------------------------------------------------------------------------- /tests/patterns/test_data/zstd.hexpat.zst: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WerWolv/ImHex-Patterns/db4d62aa2090b002bc506d41442a2d3edc33353d/tests/patterns/test_data/zstd.hexpat.zst -------------------------------------------------------------------------------- /tips/_schema.json: -------------------------------------------------------------------------------- 1 | { 2 | "definitions": {}, 3 | "$schema": "http://json-schema.org/draft-07/schema#", 4 | "$id": "https://example.com/object1655988771.json", 5 | "title": "Root", 6 | "type": "object", 7 | "required": [ 8 | "name", 9 | "tips" 10 | ], 11 | "properties": { 12 | "name": { 13 | "$id": "#root/name", 14 | "title": "Name", 15 | "type": "string", 16 | "default": "", 17 | "examples": [ 18 | "Tips category" 19 | ], 20 | "pattern": "^.*$" 21 | }, 22 | "tips": { 23 | "$id": "#root/tips", 24 | "title": "Tips", 25 | "type": "array", 26 | "default": [], 27 | "items":{ 28 | "$id": "#root/tips/items", 29 | "title": "Items", 30 | "type": "string", 31 | "default": "", 32 | "examples": [ 33 | "Some interesting tip" 34 | ], 35 | "pattern": "^.*$" 36 | } 37 | } 38 | } 39 | } 40 | -------------------------------------------------------------------------------- /tips/imhex.json: -------------------------------------------------------------------------------- 1 | { 2 | "name" : "ImHex", 3 | "tips" : [ 4 | "Try pressing CTRL + Shift + P to open the command palette!", 5 | "The data processor allows pre-processing of the binary input data before it's displayed without modifying the original data.", 6 | "Take a closer look at the Splash screen :)", 7 | "Check out the WerWolv/ImHex-Patterns repository for pre-made patterns and more!", 8 | "ImHex can be easily extended with plugins through its API." 9 | ] 10 | } -------------------------------------------------------------------------------- /tips/re.json: -------------------------------------------------------------------------------- 1 | { 2 | "name" : "Reverse Engineering", 3 | "tips" : [ 4 | "Reverse Engineering a foreign file format becomes a lot easier if you know some values that should be stored in there.", 5 | "Ghidra, binwalk, Unicorn, x86dbg, DetectItEasy, Dependencies and CheatEngine are other fantastic and free reverse engineering tools!", 6 | "ALWAYS read the documentation if there is one. It will save you a lot of time.", 7 | "Tools are what you make of them, practice makes perfect.", 8 | "Looking for patterns and repeating structures in binary data is always a good start.", 9 | "The entropy graph is an easy way to quickly figure out where interesting data is stored and if the data is encrypted or compressed." 10 | ] 11 | } 12 | -------------------------------------------------------------------------------- /yara/advanced_analysis/compiler.yar: -------------------------------------------------------------------------------- 1 | rule CompilerMSVC { 2 | meta: 3 | category = "Compiler" 4 | name = "MSVC" 5 | 6 | strings: 7 | $iostreams_mangled_name = "$basic_iostream@DU" ascii 8 | $std_namespace = "@@std@@" ascii 9 | 10 | condition: 11 | any of them 12 | } 13 | 14 | rule CompilerGCC { 15 | meta: 16 | category = "Compiler" 17 | name = "GCC" 18 | 19 | strings: 20 | $iostreams_mangled_name = "_ZSt4cout" ascii 21 | $std_namespace = "_ZSt" ascii 22 | $gcc_version = "GCC: (GNU) " ascii 23 | 24 | condition: 25 | 2 of them 26 | } 27 | 28 | rule CompilerClang { 29 | meta: 30 | category = "Compiler" 31 | name = "Clang" 32 | 33 | strings: 34 | $iostreams_mangled_name = "_ZSt4cout" ascii 35 | $std_namespace = "_ZSt" ascii 36 | $clang_version = "clang version " ascii 37 | 38 | condition: 39 | 2 of them 40 | } -------------------------------------------------------------------------------- /yara/advanced_analysis/environment.yar: -------------------------------------------------------------------------------- 1 | rule EnvironmentMingw { 2 | meta: 3 | category = "Environment" 4 | name = "MinGW" 5 | 6 | strings: 7 | $mingw_runtime = "Mingw runtime failure" ascii 8 | $mingw64_runtime = "Mingw-w64 runtime failure:" ascii fullword 9 | $msys2 = "Built by MSYS2 project" ascii 10 | 11 | condition: 12 | 2 of them 13 | } 14 | 15 | rule EnvironmentWin32 { 16 | meta: 17 | category = "Environment" 18 | name = "Win32" 19 | 20 | strings: 21 | $kernel32 = "KERNEL32.dll" ascii 22 | $user32 = "USER32.dll" ascii 23 | $advapi32 = "ADVAPI32.dll" ascii 24 | $ole32 = "OLE32.dll" ascii 25 | $oleaut32 = "OLEAUT32.dll" ascii 26 | $shell32 = "SHELL32.dll" ascii 27 | $shlwapi = "SHLWAPI.dll" ascii 28 | $comctl32 = "COMCTL32.dll" ascii 29 | $comdlg32 = "COMDLG32.dll" ascii 30 | $gdi32 = "GDI32.dll" ascii 31 | $imm32 = "IMM32.dll" ascii 32 | $msvcrt = "MSVCRT.dll" ascii 33 | 34 | condition: 35 | 4 of them 36 | } -------------------------------------------------------------------------------- /yara/advanced_analysis/language.yar: -------------------------------------------------------------------------------- 1 | rule LanguageCpp { 2 | meta: 3 | category = "Programming Language" 4 | name = "C++" 5 | 6 | strings: 7 | $exception_windows = "_CxxThrowException" ascii fullword 8 | $iostreams = "iostream" ascii 9 | 10 | condition: 11 | any of them 12 | } 13 | 14 | rule LanguageC { 15 | meta: 16 | category = "Programming Language" 17 | name = "C++" 18 | 19 | strings: 20 | $printf = "printf" ascii 21 | $scanf = "scanf" ascii 22 | $malloc = "malloc" ascii 23 | $calloc = "calloc" ascii 24 | $realloc = "realloc" ascii 25 | $free = "free" ascii 26 | 27 | condition: 28 | any of them and not LanguageCpp 29 | } 30 | 31 | rule LanguageRust { 32 | meta: 33 | category = "Programming Language" 34 | name = "Rust" 35 | 36 | strings: 37 | $option_unwrap = "called `Option::unwrap()` on a `None`" ascii 38 | $result_unwrap = "called `Result::unwrap()` on an `Err`" ascii 39 | $panic_1 = "panicked at" ascii 40 | $panic_2 = "thread '' panicked at" ascii 41 | $panic_3 = "thread panicked while processing panic. aborting." ascii 42 | $panicking_file = "panicking.rs" ascii fullword 43 | 44 | condition: 45 | any of them 46 | } 47 | 48 | rule LanguageGo { 49 | meta: 50 | category = "Programming Language" 51 | name = "Go" 52 | 53 | strings: 54 | $max_procs = "runtime.GOMAXPROCS" ascii fullword 55 | $panic = "runtime.gopanic" ascii fullword 56 | $go_root = "runtime.GOROOT" ascii fullword 57 | 58 | condition: 59 | any of them 60 | 61 | } --------------------------------------------------------------------------------