binwalk 3.1.0

Analyzes data for embedded file types
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72

use crate::structures::common::{self, StructureError};
use crc32_v2;

/// JFFS2 node header size
pub const JFFS2_NODE_STRUCT_SIZE: usize = 12;

/// Structure for storing useful JFFS node info
#[derive(Debug, Default, Clone)]
pub struct JFFS2Node {
    pub size: usize,
    pub node_type: u16,
    pub endianness: String,
}

/// Parse a JFFS2 node header
pub fn parse_jffs2_node_header(node_data: &[u8]) -> Result<JFFS2Node, StructureError> {
    // Expected JFFS2 node magic
    const JFFS2_CORRECT_MAGIC: usize = 0x1985;

    // Number of header bytes over which the header CRC is calculated
    const JFFS2_HEADER_CRC_SIZE: usize = 8;

    let jffs2_node_structure = vec![
        ("magic", "u16"),
        ("type", "u16"),
        ("size", "u32"),
        ("crc", "u32"),
    ];

    let mut node = JFFS2Node {
        ..Default::default()
    };

    // Try little endian first
    node.endianness = "little".to_string();

    // Parse the node header
    if let Ok(mut node_header) = common::parse(node_data, &jffs2_node_structure, &node.endianness) {
        // If the node header magic isn't correct, try parsing the header as big endian
        if node_header["magic"] != JFFS2_CORRECT_MAGIC {
            node.endianness = "big".to_string();
            match common::parse(node_data, &jffs2_node_structure, &node.endianness) {
                Err(_) => {
                    return Err(StructureError);
                }
                Ok(node_header_be) => {
                    node_header = node_header_be.clone();
                }
            }
        }

        // Node magic must be correct at this point, else this node is invalid
        if node_header["magic"] == JFFS2_CORRECT_MAGIC {
            // Calculate the node header CRC
            let node_calculated_crc = jffs2_node_crc(&node_data[0..JFFS2_HEADER_CRC_SIZE]);

            // Validate the node header CRC
            if node_calculated_crc == node_header["crc"] {
                node.size = node_header["size"];
                node.node_type = node_header["type"] as u16;
                return Ok(node);
            }
        }
    }

    Err(StructureError)
}

/// CRC calculation for JFFS
fn jffs2_node_crc(file_data: &[u8]) -> usize {
    (crc32_v2::crc32(0xFFFFFFFF, file_data) ^ 0xFFFFFFFF) as usize
}