1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
//!
//! # Usage
//!
//! ```rust
//! use binrw::BinReaderExt;
//! use chrono::prelude::*;
//! use flow_record::{FlowRecord, RecordPack, Record, Serializer, RECORDSTREAM_MAGIC};
//! use flow_record_derive::Record;
//! use std::io::{Cursor,Seek,SeekFrom};
//! 
//! #[derive(Record)]
//! struct SampleStruct {
//!     int_value: u32,
//!     str_value: String,
//!     dtm_value: DateTime<Utc>
//! }
//!
//! let sample_struct = SampleStruct {
//!     int_value: 42,
//!     str_value: "forty two".into(),
//!     dtm_value: Utc.with_ymd_and_hms(2020, 1, 1, 0, 0, 0).unwrap(),
//! };
//!
//! let mut ser = Serializer::new(Vec::new());
//! ser.serialize(sample_struct).unwrap();
//!
//! ```
//! 
//! That's basically all. The next steps are only necessary to validate
//! if all data were written correctly. You can ignore this, if you just want
//! to export the binary data.
//! 
//! ```rust
//!# use binrw::BinReaderExt;
//!# use chrono::prelude::*;
//!# use flow_record::{FlowRecord, RecordPack, Record, Serializer, RECORDSTREAM_MAGIC};
//!# use flow_record_derive::Record;
//!# use std::io::{Cursor,Seek,SeekFrom};
//!# #[derive(Record)]
//!# struct SampleStruct {
//!#     int_value: u32,
//!#     str_value: String,
//!#     dtm_value: DateTime<Utc>
//!# }
//!# let sample_struct = SampleStruct {
//!#     int_value: 42,
//!#     str_value: "forty two".into(),
//!#     dtm_value: Utc.with_ymd_and_hms(2020, 1, 1, 0, 0, 0).unwrap(),
//!# };
//!# let mut ser = Serializer::new(Vec::new());
//!# ser.serialize(sample_struct).unwrap();
//!# let mut raw_data = Cursor::new(ser.into_inner());
//! // omit the header
//! raw_data.seek(SeekFrom::Start((4+2+RECORDSTREAM_MAGIC.len()).try_into().unwrap()));
//!
//! let descriptor_record: FlowRecord = raw_data.read_be().unwrap();
//! let data_record: FlowRecord = raw_data.read_be().unwrap();
//!
//! let descriptor = RecordPack::try_from(Value::from(descriptor_record)).unwrap();
//! let data = RecordPack::try_from(Value::from(data_record)).unwrap()
//!                 .inner().clone();
//!
//! assert_eq!(data,
//!        Value::Array(vec![
//!            Value::Integer(1.into()), // record pack type
//!            Value::Array(vec![
//!                Value::Array(vec![    // reference to record descriptor
//!                    Value::String("SampleStruct".into()),  // struct name
//!                    Value::Integer(114706890.into())       // struct hash
//!                ]),
//!                Value::Array(vec![   // actual data
//!                    Value::Integer(42.into()),
//!                    Value::String("forty two".into()),
//!                    Value::Integer(1577836800.into())
//!                ])
//!            ])
//!        ]));
//! ```
pub mod artifacts;
mod flow_record;
mod record_pack_type;
mod serializer;

pub use record_pack_type::*;
pub use serializer::DfirSerializer as Serializer;

pub use flow_record::*;
pub use flow_record_common::*;
pub use serializer::RECORDSTREAM_MAGIC;