1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
pub fn is_wasm(buf: &[u8]) -> bool {
buf.len() >= 8
&& buf[0] == 0x00
&& buf[1] == 0x61
&& buf[2] == 0x73
&& buf[3] == 0x6D
&& buf[4] == 0x01
&& buf[5] == 0x00
&& buf[6] == 0x00
&& buf[7] == 0x00
}
pub fn is_exe(buf: &[u8]) -> bool {
buf.len() > 1 && buf[0] == 0x4D && buf[1] == 0x5A
}
pub fn is_dll(buf: &[u8]) -> bool {
is_exe(buf)
}
pub fn is_elf(buf: &[u8]) -> bool {
buf.len() > 52 && buf[0] == 0x7F && buf[1] == 0x45 && buf[2] == 0x4C && buf[3] == 0x46
}
pub fn is_java(buf: &[u8]) -> bool {
buf.len() >= 8
&& buf[0] == 0x43
&& buf[1] == 0x41
&& buf[2] == 0x76
&& buf[3] == 0x45
&& ((buf[4] == 0x42 && buf[5] == 0x01 && buf[6] == 0x42 && buf[7] == 0x45)
|| (buf[4] == 0x44 && buf[5] == 0x30 && buf[6] == 0x30 && buf[7] == 0x44))
}
pub fn is_llvm(buf: &[u8]) -> bool {
buf.len() >= 2 && buf[0] == 0x42 && buf[1] == 0x43
}
pub fn is_mach(buf: &[u8]) -> bool {
if buf.len() < 4 {
return false;
}
match buf[0..4] {
[width, 0xfa, 0xed, 0xfe] if width == 0xcf || width == 0xce => true,
[0xfe, 0xed, 0xfa, width] if width == 0xcf || width == 0xce => true,
[0xca, 0xfe, 0xba, 0xbe] => true,
_ => false,
}
}
pub fn is_dex(buf: &[u8]) -> bool {
buf.len() > 36
&& buf[0] == 0x64 && buf[1] == 0x65 && buf[2] == 0x78 && buf[3] == 0x0A
&& buf[36] == 0x70
}
pub fn is_dey(buf: &[u8]) -> bool {
buf.len() > 100
&& buf[0] == 0x64 && buf[1] == 0x65 && buf[2] == 0x79 && buf[3] == 0x0A
&& is_dex(&buf[40..100])
}
pub fn is_der(buf: &[u8]) -> bool {
buf.len() > 2 && buf[0] == 0x30 && buf[1] == 0x82
}
pub fn is_coff_i386(buf: &[u8]) -> bool {
buf.len() > 2 && buf[0] == 0x4C && buf[1] == 0x01
}
pub fn is_coff_x64(buf: &[u8]) -> bool {
buf.len() > 2 && buf[0] == 0x64 && buf[1] == 0x86
}
pub fn is_coff_ia64(buf: &[u8]) -> bool {
buf.len() > 2 && buf[0] == 0x00 && buf[1] == 0x02
}
pub fn is_coff(buf: &[u8]) -> bool {
is_coff_x64(buf) || is_coff_i386(buf) || is_coff_ia64(buf)
}