Skip to main content

parse_magic_rule

Function parse_magic_rule 

Source
pub fn parse_magic_rule(input: &str) -> IResult<&str, MagicRule>
Expand description

Parse a complete magic rule line from text format

Parses a complete magic rule in the format: [>...]offset type [operator] value [message]

Where:

  • >... indicates child rule nesting level (optional)
  • offset is the byte offset to read from
  • type is the data type (byte, short, long, string, etc.)
  • operator is the comparison operator (=, !=, &) - defaults to = if omitted
  • value is the expected value to compare against
  • message is the human-readable description (optional)

§Examples

use libmagic_rs::parser::grammar::parse_magic_rule;
use libmagic_rs::parser::ast::{MagicRule, OffsetSpec, TypeKind, Operator, Value};

// Basic rule
let input = "0 string \\x7fELF ELF executable";
let (_, rule) = parse_magic_rule(input).unwrap();
assert_eq!(rule.level, 0);
assert_eq!(rule.message, "ELF executable");

// Child rule
let input = ">4 byte 1 32-bit";
let (_, rule) = parse_magic_rule(input).unwrap();
assert_eq!(rule.level, 1);
assert_eq!(rule.message, "32-bit");

§Errors

Returns a nom parsing error if:

  • The offset specification is invalid
  • The type specification is not recognized
  • The operator is invalid (if present)
  • The value cannot be parsed
  • The input format doesn’t match the expected magic rule syntax