Enum Observation 

pub enum Observation {
    OuterPeHeaderFound,
    AutoItSignatureFound {
        offset: usize,
    },
    VersionMarkerFound {
        encoding: Encoding,
        offset: usize,
    },
    PayloadStreamStartFound {
        offset: usize,
    },
    PeScriptResourceFound {
        type_id: u16,
        type_name: Option<&'static str>,
        name: &'static str,
        language_id: Option<u16>,
        rva: u32,
        offset: usize,
        size: u32,
    },
    PackedMarkerFound {
        name: &'static str,
        offset: usize,
    },
    FirstFileRecordDecrypted {
        encoding: Encoding,
        offset: usize,
    },
    KnownSubtypeDecrypted {
        encoding: Encoding,
        offset: usize,
        subtype: KnownSubtype,
    },
}

A concrete observation made while analyzing an AutoIt payload.

Variants

OuterPeHeaderFound

The outer input begins with an MZ PE header.

AutoItSignatureFound

The AutoIt AU3! signature prefix was found at the given file offset.

Fields

offset: usize

File offset where the AutoIt signature prefix begins.

VersionMarkerFound

A supported AutoIt version marker was found at the given file offset.

Fields

encoding: Encoding

Encoding represented by the version marker.

offset: usize

File offset where the version marker begins.

PayloadStreamStartFound

The offset where the AU3 record stream is expected to begin.

Fields

offset: usize

File offset where record parsing should begin.

PeScriptResourceFound

A PE RT_RCDATA resource named SCRIPT was found.

Fields

type_id: u16

PE resource type id.

type_name: Option<&'static str>

PE resource type name, when recognized.

name: &'static str

PE resource name.

language_id: Option<u16>

PE resource language id, when present.

rva: u32

Resource data RVA.

offset: usize

Resource data file offset.

size: u32

Resource data size in bytes.

PackedMarkerFound

A known packer marker was found in the outer container.

Fields

name: &'static str

Marker name.

offset: usize

File offset where the marker begins.

FirstFileRecordDecrypted

The first AU3 record type decrypted to FILE.

Fields

encoding: Encoding

Encoding profile used for decryption.

offset: usize

File offset of the encrypted FILE marker.

KnownSubtypeDecrypted

The first AU3 record subtype decrypted to a known script subtype.

Fields

encoding: Encoding

Encoding profile used for decryption.

offset: usize

File offset where the source record begins.

subtype: KnownSubtype

Known subtype that was recovered.

Trait Implementations

impl Clone for Observation

fn clone(&self) -> Observation

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for Observation

impl Debug for Observation

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for Observation

impl PartialEq for Observation

fn eq(&self, other: &Observation) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for Observation