frnsc-prefetch 0.13.3

Pure rust windows prefetch parser implementation
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49

use forensic_rs::prelude::ForensicResult;

pub mod lz77;
pub mod xpress_huff;

#[repr(u32)]
#[derive(Debug, Clone)]
pub enum CompressionAlgorithm {
    CompressionFormatNone = 0x0000,
    CompressionFormatDefault = 0x0001,
    CompressionFormatLznt1 = 0x0002,
    CompressionFormatXpress = 0x0003,
    CompressionFormatXpressHuff = 0x0004,
}

impl From<u32> for CompressionAlgorithm {
    fn from(value: u32) -> Self {
        match value {
            1 => CompressionAlgorithm::CompressionFormatDefault,
            2 => CompressionAlgorithm::CompressionFormatLznt1,
            3 => CompressionAlgorithm::CompressionFormatXpress,
            4 => CompressionAlgorithm::CompressionFormatXpressHuff,
            _ => CompressionAlgorithm::CompressionFormatNone,
        }
    }
}

pub fn decompress(
    in_buf: &[u8],
    out_buf: &mut Vec<u8>,
    algorithm: CompressionAlgorithm,
) -> ForensicResult<()> {
    match algorithm {
        CompressionAlgorithm::CompressionFormatNone => {
            out_buf.copy_from_slice(in_buf);
        }
        CompressionAlgorithm::CompressionFormatDefault => {
            return Err(forensic_rs::err::ForensicError::Other(
                "Default compression algorithm not supported".into(),
            ))
        }
        CompressionAlgorithm::CompressionFormatLznt1 => lz77::decompress(in_buf, out_buf)?,
        CompressionAlgorithm::CompressionFormatXpress => xpress_huff::decompress(in_buf, out_buf)?, // Can't happen
        CompressionAlgorithm::CompressionFormatXpressHuff => {
            xpress_huff::decompress(in_buf, out_buf)?
        }
    }
    Ok(())
}