blob-decoder 0.1.1

Identify and decode opaque forensic blobs of unknown type — scored, cited candidates, recursively unwrapping nested wrappers (base64 → gzip → binary-plist).
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35

#![allow(clippy::unwrap_used, clippy::expect_used)]
//! Recursive unwrapping: a base64 → gzip → JSON blob must report the whole chain.

mod common;

use blob_decoder::{identify, BlobKind};

#[test]
fn base64_of_gzip_of_json_reports_full_chain() {
    let Some(gz) = common::gzip(b"{\"nested\":true}") else {
        eprintln!("SKIP: gzip unavailable");
        return;
    };
    let Some(b64) = common::base64(&gz) else {
        eprintln!("SKIP: base64 unavailable");
        return;
    };
    let cands = identify(&b64);

    // Top reading: base64 wrapper.
    let top = &cands[0];
    assert_eq!(top.kind, BlobKind::Base64);

    // → gzip
    let gzip_chain = top.inner.as_ref().expect("base64 payload identified");
    assert_eq!(gzip_chain.best.kind, BlobKind::Gzip);

    // → json
    let json_chain = gzip_chain
        .best
        .inner
        .as_ref()
        .expect("gzip payload identified");
    assert_eq!(json_chain.best.kind, BlobKind::Json);
}