binwalk 3.1.0

Analyzes data for embedded file types
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61

use crate::common::get_cstring;
use crate::structures::common::{self, StructureError};

/// Storage struct for CHK header info
#[derive(Debug, Clone, Default)]
pub struct CHKHeader {
    pub header_size: usize,
    pub kernel_size: usize,
    pub rootfs_size: usize,
    pub board_id: String,
}

/// Parse a CHK firmware header
pub fn parse_chk_header(header_data: &[u8]) -> Result<CHKHeader, StructureError> {
    // Somewhat arbitrarily chosen
    const MAX_EXPECTED_HEADER_SIZE: usize = 100;

    let chk_header_structure = vec![
        ("magic", "u32"),
        ("header_size", "u32"),
        ("unknown", "u64"),
        ("kernel_checksum", "u32"),
        ("rootfs_checksum", "u32"),
        ("rootfs_size", "u32"),
        ("kernel_size", "u32"),
        ("image_checksum", "u32"),
        ("header_checksum", "u32"),
        // Board ID string follows
    ];

    // Size of the fixed-length portion of the header structure
    let struct_size: usize = common::size(&chk_header_structure);

    // Parse the CHK header
    if let Ok(chk_header) = common::parse(header_data, &chk_header_structure, "big") {
        // Validate the reported header size
        if chk_header["header_size"] > struct_size
            && chk_header["header_size"] <= MAX_EXPECTED_HEADER_SIZE
        {
            // Read in the board ID string which immediately follows the fixed size structure and extends to the end of the header
            let board_id_start: usize = struct_size;
            let board_id_end: usize = chk_header["header_size"];

            if let Some(board_id_raw_bytes) = header_data.get(board_id_start..board_id_end) {
                let board_id_string = get_cstring(board_id_raw_bytes);

                // We expect that there must be a valid board ID string
                if !board_id_string.is_empty() {
                    return Ok(CHKHeader {
                        board_id: board_id_string.clone(),
                        header_size: chk_header["header_size"],
                        kernel_size: chk_header["kernel_size"],
                        rootfs_size: chk_header["rootfs_size"],
                    });
                }
            }
        }
    }

    Err(StructureError)
}