Struct dectree_rs::SignatureDecisionTree

pub struct SignatureDecisionTree<T>
where
    T: Clone + Default,
{ /* private fields */ }

Represents a decision tree that can be used to search for signatures. This is a tree structure that can be used to search for signatures in a binary blob. The tree is built by adding signatures to the tree and then searching for them.

use dectree_rs::SignatureDecisionTree;
 
let mut tree = SignatureDecisionTree::new();
tree.add_signature(vec![0x55, 0xe9, 0xd8, 0x01, 0xfe, 0xff, 0x32, 0x77, 0x89, 0x4f, 0x55], None, None);
tree.add_signature(vec![0x55, 0xe9, 0xd8, 0x01, 0xfe, 0xff, 0x32], None, None);
tree.add_signature(vec![0x55, 0xe9, 0xd8, 0x01, 0xfe, 0x00], None, None);
assert_eq!(tree.get_signature(vec![0x55, 0xe9, 0xd8, 0x01, 0xfe, 0xff, 0x32, 0x00, 0x99, 0x36, 0x5f, 0x21, 0xfd], None), Some(()));
assert_eq!(tree.get_signature(vec![0x55, 0xe9, 0xd8, 0x01, 0xfe, 0xff, 0x32], None), Some(()));
assert_eq!(tree.get_signature(vec![0x55, 0xe9, 0xd8, 0x01, 0xfe, 0x00], None), Some(()));
assert_eq!(tree.get_signature(vec![0x55], None), None);

Implementations

impl<T> SignatureDecisionTree<T>

where T: Clone + Default,

pub fn new() -> Self

Create a new SignatureDecisionTree.

pub fn add_signature( &mut self, bytes: Vec<u8>, masks: Option<Vec<u8>>, val: Option<T> )

Add a signature to the search tree. If masks goes unspecified, it will be assumed to be all ones vec![0xff; bytes.len()].

Additionally, you may specify val as the object to get back with tree.get_signature().

pub fn is_signature(&self, bytes: Vec<u8>, offset: Option<i32>) -> bool

Check if a signature is in the search tree.

pub fn get_signature(&self, bytes: Vec<u8>, offset: Option<i32>) -> Option<T>

Get the object associated with a signature in the search tree.

Trait Implementations

impl<T> Clone for SignatureDecisionTree<T>

where T: Clone + Default + Clone,

fn clone(&self) -> SignatureDecisionTree<T>

Returns a copy of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl<T> Debug for SignatureDecisionTree<T>

where T: Clone + Default + Debug,

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<T> Default for SignatureDecisionTree<T>

where T: Clone + Default + Default,

fn default() -> SignatureDecisionTree<T>

Returns the “default value” for a type.