Crate blob_decoder 

blob-decoder — identify and decode opaque forensic blobs of unknown type.

Hand it raw bytes; it reports what they are, decodes them, and returns scored, cited candidates — recursively unwrapping nested wrappers (a base64’d, gzip’d binary-plist is reported as the full Base64 → Gzip → BinaryPlist chain).

The actual decoding is delegated to mature crates (plist, base64, hex, uuid, flate2, snap, serde_json); this crate adds only the orchestration layer: identify → dispatch → score → recursively unwrap, plus a clean forensic result type.

Epistemics

A blob is often underdetermined: bytes that are valid hex are frequently also valid base64, and a run of ASCII is technically decodable as base64 to gibberish. blob-decoder never asserts a single verdict — it returns every plausible reading with an honest Confidence, and a low-confidence reading lowers the rank, never hides the finding.

Example

// gzip magic (0x1f 0x8b) → identified as a Gzip wrapper.
let gz = b"\x1f\x8b\x08\x00\x00\x00\x00\x00";
let cands = blob_decoder::identify(gz);
assert_eq!(cands[0].kind, blob_decoder::BlobKind::Gzip);

Re-exports

pub use identify::identify;

pub use identify::identify_with_limits;

Modules

identify

The orchestration engine: identify → dispatch → score → recursively unwrap.

Structs

Candidate

One scored, cited candidate reading of a blob. A wrapper candidate nests the identification of its decoded payload in Candidate::inner, so a base64 → gzip → binary-plist blob reports the whole chain.

DecodedChain

The decoded payload of a wrapper Candidate: how many bytes it produced and the best reading of those bytes.

Limits

Resource bounds for identify_with_limits — the guard against decompression bombs and infinitely-nested wrappers on untrusted input.

Enums

BlobKind

A recognised (or unrecognised) blob type.

Confidence

How strongly the evidence supports a reading. Ordered Low < Medium < High so candidates sort best-first by descending confidence.

Constants

VERSION

The engine’s version (CARGO_PKG_VERSION), for callers that surface it.