frnsc-prefetch 0.13.3

Pure rust windows prefetch parser implementation
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127

use forensic_rs::err::ForensicResult;
use std::mem;

const LZNT1_COMPRESSED_FLAG: usize = 0x8000;

macro_rules! load16le {
    ($dst:expr,$src:expr,$idx:expr) => {{
        $dst = (u32::from($src[$idx + 1]) << 8 | u32::from($src[$idx])) as usize;
    }};
}

pub fn decompress2_push(in_buf: &[u8], out_buf: &mut Vec<u8>) -> ForensicResult<()> {
    let mut out_idx: usize = 0;
    let mut in_idx: usize = 0;

    let mut header: usize;
    let mut length: usize;
    let mut chunk_len: usize;
    let mut offset: usize;

    let mut _block_id = 0;

    // We don't want to compute those values at each round.
    let in_buf_max_size = in_buf.len();

    while in_idx < in_buf_max_size {
        let in_chunk_base = in_idx;
        // compressed chunk header (2 bytes)
        load16le!(header, in_buf, in_idx);
        in_idx += mem::size_of::<u16>();
        chunk_len = (header & 0xfff) + 1;

        if chunk_len > (in_buf_max_size - in_idx) {
            return Err(forensic_rs::err::ForensicError::BadFormat);
        }

        if header & LZNT1_COMPRESSED_FLAG != 0 {
            let in_base_idx = in_idx;
            let out_base_idx = out_idx;

            let mut flag_bit = 0;
            let mut flags = in_buf[in_idx];
            in_idx += mem::size_of::<u8>();

            while (in_idx - in_base_idx) < chunk_len {
                if in_idx >= in_buf_max_size {
                    break;
                }

                if (flags & (1 << flag_bit)) == 0 {
                    if in_idx >= in_buf_max_size || (in_idx - in_base_idx) >= chunk_len {
                        break;
                    }

                    out_buf.push(in_buf[in_idx]);
                    out_idx += mem::size_of::<u8>();
                    in_idx += mem::size_of::<u8>();
                } else {
                    let copy_token;

                    if in_idx >= in_buf_max_size || (in_idx - in_base_idx) >= chunk_len {
                        break;
                    }

                    load16le!(copy_token, in_buf, in_idx);
                    in_idx += mem::size_of::<u16>();

                    let mut pos = out_idx - out_base_idx - 1;
                    let mut l_mask = 0xFFF;
                    let mut o_shift = 12;

                    while pos >= 0x10 {
                        l_mask >>= 1;
                        o_shift -= 1;
                        pos >>= 1;
                    }

                    length = (copy_token & l_mask) + 3;
                    offset = (copy_token >> o_shift) + 1;

                    if offset > out_idx {
                        return Err(forensic_rs::err::ForensicError::BadFormat);
                    }

                    /*
                    if (out_idx + length) >= out_buf_max_size {
                        length = out_buf_max_size - out_idx;
                    }
                    */

                    for _i in 0..length {
                        if offset > out_idx {
                            return Err(forensic_rs::err::ForensicError::BadFormat);
                        }

                        out_buf.push(out_buf[out_idx - offset]);
                        out_idx += mem::size_of::<u8>();
                    }
                }

                flag_bit = (flag_bit + 1) % 8;

                if flag_bit == 0 {
                    if (in_idx - in_base_idx) >= chunk_len {
                        break;
                    }
                    flags = in_buf[in_idx];
                    in_idx += mem::size_of::<u8>();
                }
            }
        } else {
            // Not compressed
            for _i in 0..chunk_len {
                out_buf.push(in_buf[in_idx]);
                out_idx += mem::size_of::<u8>();
                in_idx += mem::size_of::<u8>();
            }
        }

        in_idx = in_chunk_base + 2 + chunk_len;
        _block_id += 1;
    }

    Ok(())
}