pub fn parse_magic_rule(input: &str) -> IResult<&str, MagicRule>Expand description
Parse a complete magic rule line from text format
Parses a complete magic rule in the format:
[>...]offset type [operator] value [message]
Where:
>...indicates child rule nesting level (optional)offsetis the byte offset to read fromtypeis the data type (byte, short, long, string, etc.)operatoris the comparison operator (=, !=, &) - defaults to = if omittedvalueis the expected value to compare againstmessageis the human-readable description (optional)
§Examples
use libmagic_rs::parser::grammar::parse_magic_rule;
use libmagic_rs::parser::ast::{MagicRule, OffsetSpec, TypeKind, Operator, Value};
// Basic rule
let input = "0 string \\x7fELF ELF executable";
let (_, rule) = parse_magic_rule(input).unwrap();
assert_eq!(rule.level, 0);
assert_eq!(rule.message, "ELF executable");
// Child rule
let input = ">4 byte 1 32-bit";
let (_, rule) = parse_magic_rule(input).unwrap();
assert_eq!(rule.level, 1);
assert_eq!(rule.message, "32-bit");§Errors
Returns a nom parsing error if:
- The offset specification is invalid
- The type specification is not recognized
- The operator is invalid (if present)
- The value cannot be parsed
- The input format doesn’t match the expected magic rule syntax