binwalk 3.1.0

Analyzes data for embedded file types
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56

use crate::common::crc32;
use crate::structures::common::{self, StructureError};

/// Parse and validate an XZ header, returns the header size
pub fn parse_xz_header(xz_data: &[u8]) -> Result<usize, StructureError> {
    const XZ_CRC_END: usize = 8;
    const XZ_CRC_START: usize = 6;
    const XZ_HEADER_SIZE: usize = 12;

    let xz_structure = vec![
        ("magic_p1", "u32"),
        ("magic_p2", "u16"),
        ("flags", "u16"),
        ("header_crc", "u32"),
    ];

    if let Ok(xz_header) = common::parse(xz_data, &xz_structure, "little") {
        if let Some(crc_data) = xz_data.get(XZ_CRC_START..XZ_CRC_END) {
            if crc32(crc_data) == (xz_header["header_crc"] as u32) {
                return Ok(XZ_HEADER_SIZE);
            }
        }
    }

    Err(StructureError)
}

/// Parse and validate an XZ footer, returns the footer size
pub fn parse_xz_footer(xz_data: &[u8]) -> Result<usize, StructureError> {
    const FOOTER_SIZE: usize = 12;
    const CRC_DATA_SIZE: usize = 6;
    const CRC_START_INDEX: usize = 4;

    let xz_footer_structure = vec![
        ("footer_crc", "u32"),
        ("backward_size", "u32"),
        ("flags", "u16"),
        ("magic", "u16"),
    ];

    // Parse the stream footer
    if let Ok(xz_footer) = common::parse(xz_data, &xz_footer_structure, "little") {
        // Calculate the start and end offsets of the CRC'd data
        let crc_start = CRC_START_INDEX;
        let crc_end = crc_start + CRC_DATA_SIZE;

        // Validate the stream footer
        if let Some(crc_data) = xz_data.get(crc_start..crc_end) {
            if crc32(crc_data) == (xz_footer["footer_crc"] as u32) {
                return Ok(FOOTER_SIZE);
            }
        }
    }

    Err(StructureError)
}