Skip to main content

ContainerInfo

autoit::format

Struct ContainerInfo 

Source 
pub struct ContainerInfo { /* private fields */ }
Expand description

Summary of recognized container-level facts.

Implementations§

Source§

impl ContainerInfo

Source

pub fn from_observations( input_kind: InputKind, encoding: Option<Encoding>, observations: &[Observation], ) -> Self

Builds container facts from recorded observations.

Folds the recorded observations into a single summary, capturing the signature offset, version marker, payload stream offsets, PE script resource, and packed markers. Observations without container facts (Observation::OuterPeHeaderFound, Observation::FirstFileRecordDecrypted, and Observation::KnownSubtypeDecrypted) are ignored.

§Arguments
  • input_kind - The recognized outer InputKind.
  • encoding - The recognized Encoding, if any.
  • observations - Observations to fold into the summary.
§Returns

A populated ContainerInfo.

Source

pub const fn input_kind(&self) -> InputKind

Returns recognized input kind.

§Returns

The InputKind recorded for this container.

Examples found in repository?
examples/dump.rs (line 76)
73fn print_container(binary: &AutoItBinary) {
74    let container = binary.container();
75    section("container");
76    field("input kind", format!("{:?}", container.input_kind()));
77    field("encoding", opt_debug(container.encoding()));
78    field(
79        "autoit signature offset",
80        container
81            .autoit_signature_offset()
82            .map_or_else(|| "none".to_string(), |offset| format!("{offset}")),
83    );
84    field(
85        "version marker",
86        container.version_marker().map_or_else(
87            || "none".to_string(),
88            |marker| format!("{:?} @ offset {}", marker.encoding, marker.offset),
89        ),
90    );
91    field(
92        "payload stream offsets",
93        if container.payload_stream_offsets().is_empty() {
94            "none".to_string()
95        } else {
96            format!("{:?}", container.payload_stream_offsets())
97        },
98    );
99
100    match container.pe_script_resource() {
101        None => field("pe script resource", "none".to_string()),
102        Some(resource) => {
103            println!("  pe script resource:");
104            subfield(
105                "type",
106                match resource.type_name {
107                    Some(name) => format!("{} ({name})", resource.type_id),
108                    None => resource.type_id.to_string(),
109                },
110            );
111            subfield("name", escape_inline(resource.name));
112            subfield(
113                "language id",
114                resource
115                    .language_id
116                    .map_or_else(|| "none".to_string(), |id| id.to_string()),
117            );
118            subfield("rva", format!("{:#x}", resource.rva));
119            subfield("file offset", resource.offset.to_string());
120            subfield("size", format!("{} bytes", resource.size));
121        }
122    }
123
124    if container.packed_markers().is_empty() {
125        field("packed markers", "none".to_string());
126    } else {
127        println!("  packed markers:");
128        for marker in container.packed_markers() {
129            println!("    {} @ offset {}", marker.name, marker.offset);
130        }
131    }
132}
Source

pub const fn encoding(&self) -> Option<Encoding>

Returns recognized encoding.

§Returns

Some with the recognized Encoding, or None when none was determined.

Examples found in repository?
examples/dump.rs (line 77)
73fn print_container(binary: &AutoItBinary) {
74    let container = binary.container();
75    section("container");
76    field("input kind", format!("{:?}", container.input_kind()));
77    field("encoding", opt_debug(container.encoding()));
78    field(
79        "autoit signature offset",
80        container
81            .autoit_signature_offset()
82            .map_or_else(|| "none".to_string(), |offset| format!("{offset}")),
83    );
84    field(
85        "version marker",
86        container.version_marker().map_or_else(
87            || "none".to_string(),
88            |marker| format!("{:?} @ offset {}", marker.encoding, marker.offset),
89        ),
90    );
91    field(
92        "payload stream offsets",
93        if container.payload_stream_offsets().is_empty() {
94            "none".to_string()
95        } else {
96            format!("{:?}", container.payload_stream_offsets())
97        },
98    );
99
100    match container.pe_script_resource() {
101        None => field("pe script resource", "none".to_string()),
102        Some(resource) => {
103            println!("  pe script resource:");
104            subfield(
105                "type",
106                match resource.type_name {
107                    Some(name) => format!("{} ({name})", resource.type_id),
108                    None => resource.type_id.to_string(),
109                },
110            );
111            subfield("name", escape_inline(resource.name));
112            subfield(
113                "language id",
114                resource
115                    .language_id
116                    .map_or_else(|| "none".to_string(), |id| id.to_string()),
117            );
118            subfield("rva", format!("{:#x}", resource.rva));
119            subfield("file offset", resource.offset.to_string());
120            subfield("size", format!("{} bytes", resource.size));
121        }
122    }
123
124    if container.packed_markers().is_empty() {
125        field("packed markers", "none".to_string());
126    } else {
127        println!("  packed markers:");
128        for marker in container.packed_markers() {
129            println!("    {} @ offset {}", marker.name, marker.offset);
130        }
131    }
132}
Source

pub const fn autoit_signature_offset(&self) -> Option<usize>

Returns AutoIt signature offset when present.

§Returns

Some with the file offset of the AU3! signature, or None when no signature was located.

Examples found in repository?
examples/dump.rs (line 81)
73fn print_container(binary: &AutoItBinary) {
74    let container = binary.container();
75    section("container");
76    field("input kind", format!("{:?}", container.input_kind()));
77    field("encoding", opt_debug(container.encoding()));
78    field(
79        "autoit signature offset",
80        container
81            .autoit_signature_offset()
82            .map_or_else(|| "none".to_string(), |offset| format!("{offset}")),
83    );
84    field(
85        "version marker",
86        container.version_marker().map_or_else(
87            || "none".to_string(),
88            |marker| format!("{:?} @ offset {}", marker.encoding, marker.offset),
89        ),
90    );
91    field(
92        "payload stream offsets",
93        if container.payload_stream_offsets().is_empty() {
94            "none".to_string()
95        } else {
96            format!("{:?}", container.payload_stream_offsets())
97        },
98    );
99
100    match container.pe_script_resource() {
101        None => field("pe script resource", "none".to_string()),
102        Some(resource) => {
103            println!("  pe script resource:");
104            subfield(
105                "type",
106                match resource.type_name {
107                    Some(name) => format!("{} ({name})", resource.type_id),
108                    None => resource.type_id.to_string(),
109                },
110            );
111            subfield("name", escape_inline(resource.name));
112            subfield(
113                "language id",
114                resource
115                    .language_id
116                    .map_or_else(|| "none".to_string(), |id| id.to_string()),
117            );
118            subfield("rva", format!("{:#x}", resource.rva));
119            subfield("file offset", resource.offset.to_string());
120            subfield("size", format!("{} bytes", resource.size));
121        }
122    }
123
124    if container.packed_markers().is_empty() {
125        field("packed markers", "none".to_string());
126    } else {
127        println!("  packed markers:");
128        for marker in container.packed_markers() {
129            println!("    {} @ offset {}", marker.name, marker.offset);
130        }
131    }
132}
Source

pub const fn version_marker(&self) -> Option<VersionMarkerInfo>

Returns version marker facts when present.

§Returns

Some with the VersionMarkerInfo, or None when no version marker was found.

Examples found in repository?
examples/dump.rs (line 86)
73fn print_container(binary: &AutoItBinary) {
74    let container = binary.container();
75    section("container");
76    field("input kind", format!("{:?}", container.input_kind()));
77    field("encoding", opt_debug(container.encoding()));
78    field(
79        "autoit signature offset",
80        container
81            .autoit_signature_offset()
82            .map_or_else(|| "none".to_string(), |offset| format!("{offset}")),
83    );
84    field(
85        "version marker",
86        container.version_marker().map_or_else(
87            || "none".to_string(),
88            |marker| format!("{:?} @ offset {}", marker.encoding, marker.offset),
89        ),
90    );
91    field(
92        "payload stream offsets",
93        if container.payload_stream_offsets().is_empty() {
94            "none".to_string()
95        } else {
96            format!("{:?}", container.payload_stream_offsets())
97        },
98    );
99
100    match container.pe_script_resource() {
101        None => field("pe script resource", "none".to_string()),
102        Some(resource) => {
103            println!("  pe script resource:");
104            subfield(
105                "type",
106                match resource.type_name {
107                    Some(name) => format!("{} ({name})", resource.type_id),
108                    None => resource.type_id.to_string(),
109                },
110            );
111            subfield("name", escape_inline(resource.name));
112            subfield(
113                "language id",
114                resource
115                    .language_id
116                    .map_or_else(|| "none".to_string(), |id| id.to_string()),
117            );
118            subfield("rva", format!("{:#x}", resource.rva));
119            subfield("file offset", resource.offset.to_string());
120            subfield("size", format!("{} bytes", resource.size));
121        }
122    }
123
124    if container.packed_markers().is_empty() {
125        field("packed markers", "none".to_string());
126    } else {
127        println!("  packed markers:");
128        for marker in container.packed_markers() {
129            println!("    {} @ offset {}", marker.name, marker.offset);
130        }
131    }
132}
Source

pub fn payload_stream_offsets(&self) -> &[usize]

Returns payload stream start offsets.

§Returns

A slice of file offsets where record streams are expected to begin, in recording order.

Examples found in repository?
examples/dump.rs (line 93)
73fn print_container(binary: &AutoItBinary) {
74    let container = binary.container();
75    section("container");
76    field("input kind", format!("{:?}", container.input_kind()));
77    field("encoding", opt_debug(container.encoding()));
78    field(
79        "autoit signature offset",
80        container
81            .autoit_signature_offset()
82            .map_or_else(|| "none".to_string(), |offset| format!("{offset}")),
83    );
84    field(
85        "version marker",
86        container.version_marker().map_or_else(
87            || "none".to_string(),
88            |marker| format!("{:?} @ offset {}", marker.encoding, marker.offset),
89        ),
90    );
91    field(
92        "payload stream offsets",
93        if container.payload_stream_offsets().is_empty() {
94            "none".to_string()
95        } else {
96            format!("{:?}", container.payload_stream_offsets())
97        },
98    );
99
100    match container.pe_script_resource() {
101        None => field("pe script resource", "none".to_string()),
102        Some(resource) => {
103            println!("  pe script resource:");
104            subfield(
105                "type",
106                match resource.type_name {
107                    Some(name) => format!("{} ({name})", resource.type_id),
108                    None => resource.type_id.to_string(),
109                },
110            );
111            subfield("name", escape_inline(resource.name));
112            subfield(
113                "language id",
114                resource
115                    .language_id
116                    .map_or_else(|| "none".to_string(), |id| id.to_string()),
117            );
118            subfield("rva", format!("{:#x}", resource.rva));
119            subfield("file offset", resource.offset.to_string());
120            subfield("size", format!("{} bytes", resource.size));
121        }
122    }
123
124    if container.packed_markers().is_empty() {
125        field("packed markers", "none".to_string());
126    } else {
127        println!("  packed markers:");
128        for marker in container.packed_markers() {
129            println!("    {} @ offset {}", marker.name, marker.offset);
130        }
131    }
132}
Source

pub const fn pe_script_resource(&self) -> Option<PeScriptResourceInfo>

Returns PE script resource facts when present.

§Returns

Some with the PeScriptResourceInfo, or None when no PE script resource was found.

Examples found in repository?
examples/dump.rs (line 100)
73fn print_container(binary: &AutoItBinary) {
74    let container = binary.container();
75    section("container");
76    field("input kind", format!("{:?}", container.input_kind()));
77    field("encoding", opt_debug(container.encoding()));
78    field(
79        "autoit signature offset",
80        container
81            .autoit_signature_offset()
82            .map_or_else(|| "none".to_string(), |offset| format!("{offset}")),
83    );
84    field(
85        "version marker",
86        container.version_marker().map_or_else(
87            || "none".to_string(),
88            |marker| format!("{:?} @ offset {}", marker.encoding, marker.offset),
89        ),
90    );
91    field(
92        "payload stream offsets",
93        if container.payload_stream_offsets().is_empty() {
94            "none".to_string()
95        } else {
96            format!("{:?}", container.payload_stream_offsets())
97        },
98    );
99
100    match container.pe_script_resource() {
101        None => field("pe script resource", "none".to_string()),
102        Some(resource) => {
103            println!("  pe script resource:");
104            subfield(
105                "type",
106                match resource.type_name {
107                    Some(name) => format!("{} ({name})", resource.type_id),
108                    None => resource.type_id.to_string(),
109                },
110            );
111            subfield("name", escape_inline(resource.name));
112            subfield(
113                "language id",
114                resource
115                    .language_id
116                    .map_or_else(|| "none".to_string(), |id| id.to_string()),
117            );
118            subfield("rva", format!("{:#x}", resource.rva));
119            subfield("file offset", resource.offset.to_string());
120            subfield("size", format!("{} bytes", resource.size));
121        }
122    }
123
124    if container.packed_markers().is_empty() {
125        field("packed markers", "none".to_string());
126    } else {
127        println!("  packed markers:");
128        for marker in container.packed_markers() {
129            println!("    {} @ offset {}", marker.name, marker.offset);
130        }
131    }
132}
Source

pub fn packed_markers(&self) -> &[PackedMarkerInfo]

Returns packed-container markers found in the outer input.

§Returns

A slice of PackedMarkerInfo entries, in recording order.

Examples found in repository?
examples/dump.rs (line 124)
73fn print_container(binary: &AutoItBinary) {
74    let container = binary.container();
75    section("container");
76    field("input kind", format!("{:?}", container.input_kind()));
77    field("encoding", opt_debug(container.encoding()));
78    field(
79        "autoit signature offset",
80        container
81            .autoit_signature_offset()
82            .map_or_else(|| "none".to_string(), |offset| format!("{offset}")),
83    );
84    field(
85        "version marker",
86        container.version_marker().map_or_else(
87            || "none".to_string(),
88            |marker| format!("{:?} @ offset {}", marker.encoding, marker.offset),
89        ),
90    );
91    field(
92        "payload stream offsets",
93        if container.payload_stream_offsets().is_empty() {
94            "none".to_string()
95        } else {
96            format!("{:?}", container.payload_stream_offsets())
97        },
98    );
99
100    match container.pe_script_resource() {
101        None => field("pe script resource", "none".to_string()),
102        Some(resource) => {
103            println!("  pe script resource:");
104            subfield(
105                "type",
106                match resource.type_name {
107                    Some(name) => format!("{} ({name})", resource.type_id),
108                    None => resource.type_id.to_string(),
109                },
110            );
111            subfield("name", escape_inline(resource.name));
112            subfield(
113                "language id",
114                resource
115                    .language_id
116                    .map_or_else(|| "none".to_string(), |id| id.to_string()),
117            );
118            subfield("rva", format!("{:#x}", resource.rva));
119            subfield("file offset", resource.offset.to_string());
120            subfield("size", format!("{} bytes", resource.size));
121        }
122    }
123
124    if container.packed_markers().is_empty() {
125        field("packed markers", "none".to_string());
126    } else {
127        println!("  packed markers:");
128        for marker in container.packed_markers() {
129            println!("    {} @ offset {}", marker.name, marker.offset);
130        }
131    }
132}

Trait Implementations§

Source§

impl Clone for ContainerInfo

Source§

fn clone(&self) -> ContainerInfo

Returns a duplicate of the value. Read more
1.0.0 (const: unstable) · Source§

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source. Read more
Source§

impl Debug for ContainerInfo

Source§

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter. Read more
Source§

impl Eq for ContainerInfo

Source§

impl PartialEq for ContainerInfo

Source§

fn eq(&self, other: &ContainerInfo) -> bool

Equality operator ==. Read more
1.0.0 (const: unstable) · Source§

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=. Read more
Source§

impl StructuralPartialEq for ContainerInfo

Auto Trait Implementations§

Blanket Implementations§

Source§

impl<T> Any for T
where T: 'static + ?Sized,

Source§

fn type_id(&self) -> TypeId

Gets the TypeId of self. Read more
Source§

impl<T> Borrow<T> for T
where T: ?Sized,

Source§

fn borrow(&self) -> &T

Immutably borrows from an owned value. Read more
Source§

impl<T> BorrowMut<T> for T
where T: ?Sized,

Source§

fn borrow_mut(&mut self) -> &mut T

Mutably borrows from an owned value. Read more
Source§

impl<T> CloneToUninit for T
where T: Clone,

Source§

unsafe fn clone_to_uninit(&self, dest: *mut u8)

🔬This is a nightly-only experimental API. (clone_to_uninit)
Performs copy-assignment from self to dest. Read more
Source§

impl<T> From<T> for T

Source§

fn from(t: T) -> T

Returns the argument unchanged.

Source§

impl<T, U> Into<U> for T
where U: From<T>,

Source§

fn into(self) -> U

Calls U::from(self).

That is, this conversion is whatever the implementation of From<T> for U chooses to do.

Source§

impl<T> ToOwned for T
where T: Clone,

Source§

type Owned = T

The resulting type after obtaining ownership.
Source§

fn to_owned(&self) -> T

Creates owned data from borrowed data, usually by cloning. Read more
Source§

fn clone_into(&self, target: &mut T)

Uses borrowed data to replace owned data, usually by cloning. Read more
Source§

impl<T, U> TryFrom<U> for T
where U: Into<T>,

Source§

type Error = Infallible

The type returned in the event of a conversion error.
Source§

fn try_from(value: U) -> Result<T, <T as TryFrom<U>>::Error>

Performs the conversion.
Source§

impl<T, U> TryInto<U> for T
where U: TryFrom<T>,

Source§

type Error = <U as TryFrom<T>>::Error

The type returned in the event of a conversion error.
Source§

fn try_into(self) -> Result<U, <U as TryFrom<T>>::Error>

Performs the conversion.