Skip to content

Commit

Permalink
patterns: Adding IPS pattern and fixed PE magic file (#153)
Browse files Browse the repository at this point in the history
* Update pe.hexpat

New improvement

* Add ips.hexpat via upload

* Add ips.hexpat.ips via upload

* Added IPS to README

* Mentioned Windows in portable_executable_magic
  • Loading branch information
gmestanley authored Aug 26, 2023
1 parent 86f93df commit ba14dd0
Show file tree
Hide file tree
Showing 4 changed files with 32 additions and 1 deletion.
1 change: 1 addition & 0 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -57,6 +57,7 @@ Everything will immediately show up in ImHex's Content Store and gets bundled wi
| ID3 | `audio/mpeg` | [`patterns/id3.hexpat`](patterns/id3.hexpat) | ID3 tags in MP3 files |
| Intel HEX | | [`patterns/intel_hex.hexpat`](patterns/intel_hex.hexpat) | [Intel hexadecimal object file format definition]("https://en.wikipedia.org/wiki/Intel_HEX") |
| IP | | [`patterns/ip.hexpat`](patterns/ip.hexpat) | Ethernet II Frames (IP Packets) |
| IPS | | [`patterns/ips.hexpat`](patterns/ips.hexpat) | IPS (International Patching System) files |
| ISO | | [`patterns/iso.hexpat`](patterns/iso.hexpat) | ISO 9660 file system |
| Java Class | `application/x-java-applet` | [`patterns/java_class.hexpat`](patterns/java_class.hexpat) | Java Class files |
| JPEG | `image/jpeg` | [`patterns/jpeg.hexpat`](patterns/jpeg.hexpat) | JPEG Image Format |
Expand Down
2 changes: 1 addition & 1 deletion magic/portable_executable_magic
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
# A libmagic database containing definition for PE files used by MS-DOS based systems
# A libmagic database containing definition for PE files used by MS-DOS/Windows based systems

# MS-DOS Portable Executable
0x0 string/b MZ MS-DOS Binary
Expand Down
30 changes: 30 additions & 0 deletions patterns/ips.hexpat
Original file line number Diff line number Diff line change
@@ -0,0 +1,30 @@
#include <std/mem.pat>
#include <std/string.pat>

#pragma endian big

u8 eofOffset = 3;

struct Hunk {
u24 offset;
u16 length;
if (length == 0) {
u16 runCount;
u8 payload;
}
else {
u8 payload[length];
}
};

struct IPS {
char signature[5];
if (std::mem::read_string(std::mem::size()-3, 3) != "EOF") {
eofOffset += 3;
}
Hunk hunks[while($ < std::mem::size()-eofOffset)];
char eof[3];
u24 truncatedSize[eofOffset>3];
};

IPS ips @ 0x00;
Binary file added tests/patterns/test_data/ips.hexpat.ips
Binary file not shown.

0 comments on commit ba14dd0

Please sign in to comment.