Documentation ¶
Index ¶
- Constants
- Variables
- func ByteCountSI(b int64) string
- func FileSize(f afero.File) int64
- type EvaluateError
- type Field
- type FileLayout
- func (fl *FileLayout) DecryptData(encData []byte) ([]byte, error)
- func (fl *FileLayout) EvaluateExpression(in string, df *value.DataField) (int64, error)
- func (fl *FileLayout) EvaluateStringExpression(in string, df *value.DataField) (string, error)
- func (fl *FileLayout) ExpandVariables(s string, df *value.DataField) (string, error)
- func (fl *FileLayout) Extract(outDir string) error
- func (fl *FileLayout) GetAddressLengthPair(df *value.DataField) (int64, int64)
- func (fl *FileLayout) GetFieldValue(field *Field) interface{}
- func (fl *FileLayout) GetInt(s string, df *value.DataField) (int64, error)
- func (fl *FileLayout) GetLength(s string, df *value.DataField) (int, error)
- func (fl *FileLayout) GetOffset(query string, df *value.DataField) (int, error)
- func (fl *FileLayout) GetStruct(name string) (*Struct, error)
- func (fl *FileLayout) GetValue(s string, df *value.DataField) (string, []byte, error)
- func (fl *FileLayout) MappedBytes() int64
- func (fl *FileLayout) MatchedValue(s string, df *value.DataField) (string, error)
- func (fl *FileLayout) Present(cfg *PresentFileLayoutConfig)
- func (fl *FileLayout) PresentFieldValue(field *Field, b []byte) string
- func (fl *FileLayout) PresentFullString(cfg *PresentFileLayoutConfig) string
- func (fl *FileLayout) PresentStructureTree(structs []*Struct)
- func (fl *FileLayout) PresentType(df *value.DataField) string
- func (fl *FileLayout) ReadVariableLengthS64() (uint64, []byte, int64, error)
- func (fl *FileLayout) ReadVariableLengthU32() (uint32, []byte, int64, error)
- func (fl *FileLayout) ReadVariableLengthU64() (uint64, []byte, int64, error)
- type MapReaderConfig
- type MapperConfig
- type PresentFileLayoutConfig
- type Struct
Constants ¶
const ( DEBUG = false DEBUG_MAPPER = false DEBUG_OFFSET = false DEBUG_LABEL = false )
const DEBUG_READ = false
Variables ¶
var ( ErrParseStop = errors.New("manual parse stop") ErrParseContinue = errors.New("manual parse continue") )
var DEBUG_EVAL = false
Functions ¶
func ByteCountSI ¶
Types ¶
type EvaluateError ¶
type EvaluateError struct {
// contains filtered or unexported fields
}
an expression failed to evaluate
func (EvaluateError) Error ¶
func (e EvaluateError) Error() string
type Field ¶
type Field struct { Offset int64 Length int64 // on-disk endianness Endian string // underlying data structure Format value.DataField // matched patterns MatchedPatterns []value.MatchedPattern // filename for the next output data Outfile string // if set, data is imported from external file ImportFile string }
type FileLayout ¶
type FileLayout struct { Structs []*Struct // pointer to its internal yaml representation, so we can access "constants" DS *template.DataStructure // default extension Extension string // lastpath/filename-without-ext, eg "archives/zip" BaseName string // contains filtered or unexported fields }
parsed file data from a template "layout"
func MapFileToGivenTemplate ¶
func MapFileToGivenTemplate(cfg *MapperConfig) (fl *FileLayout, err error)
maps input file to template specified in cfg.TemplateFilename
func MapFileToMatchingTemplate ¶
func MapFileToMatchingTemplate(cfg *MapperConfig) (fl *FileLayout, err error)
maps input file to a matching template
func MapReader ¶
func MapReader(cfg *MapReaderConfig) (*FileLayout, error)
produces a list of fields with offsets and sizes from input reader based on data structure
func (*FileLayout) DecryptData ¶
func (fl *FileLayout) DecryptData(encData []byte) ([]byte, error)
func (*FileLayout) EvaluateExpression ¶
evaluates a math expression
func (*FileLayout) EvaluateStringExpression ¶
evaluates a string expression
func (*FileLayout) ExpandVariables ¶
replace variables with their values
func (*FileLayout) Extract ¶
func (fl *FileLayout) Extract(outDir string) error
Write data streams to outDir
func (*FileLayout) GetAddressLengthPair ¶
func (fl *FileLayout) GetAddressLengthPair(df *value.DataField) (int64, int64)
returns unitLength, totalLength (in bytes)
func (*FileLayout) GetFieldValue ¶
func (fl *FileLayout) GetFieldValue(field *Field) interface{}
returns a presentation of the value in the data type (field.Format.Kind)
func (*FileLayout) GetLength ¶
finds the first field named `structName`.`fieldName` returns: length,error
func (*FileLayout) GetOffset ¶
finds the first field named `structName`.`fieldName` returns: offset,error
func (*FileLayout) GetValue ¶
finds the first field named `structName`.`fieldName` returns: kind, bytes, error
func (*FileLayout) MappedBytes ¶
func (fl *FileLayout) MappedBytes() int64
return the number of mapped bytes
func (*FileLayout) MatchedValue ¶
returns the pattern matched value of field named `structName`.`fieldName`
func (*FileLayout) Present ¶
func (fl *FileLayout) Present(cfg *PresentFileLayoutConfig)
func (*FileLayout) PresentFieldValue ¶
func (fl *FileLayout) PresentFieldValue(field *Field, b []byte) string
presents the value of the data type (field.Format.Kind) in a human-readable form
func (*FileLayout) PresentFullString ¶
func (fl *FileLayout) PresentFullString(cfg *PresentFileLayoutConfig) string
used for tests, buffered, returns when presentation is fully rendered.
func (*FileLayout) PresentStructureTree ¶
func (fl *FileLayout) PresentStructureTree(structs []*Struct)
func (*FileLayout) PresentType ¶
func (fl *FileLayout) PresentType(df *value.DataField) string
presents the underlying type as it is known in the template format
func (*FileLayout) ReadVariableLengthS64 ¶
func (fl *FileLayout) ReadVariableLengthS64() (uint64, []byte, int64, error)
Codes integers in 7-bit chunks, little-endian order. The high-bit in each byte signifies if it is the last byte. used by system/macos/nibarchive
func (*FileLayout) ReadVariableLengthU32 ¶
func (fl *FileLayout) ReadVariableLengthU32() (uint32, []byte, int64, error)
this encoding is used by fonts/woff2 (UIntBase128) returns decoded value, raw bytes, byte length, error
func (*FileLayout) ReadVariableLengthU64 ¶
func (fl *FileLayout) ReadVariableLengthU64() (uint64, []byte, int64, error)
this encoding is used by archive/xz returns decoded value, raw bytes, byte length, error
type MapReaderConfig ¶
type MapperConfig ¶
type MapperConfig struct { F afero.File StartOffset int64 TemplateFilename string MeasureTime bool // only detect by magic, don't map Brief bool }
func (*MapperConfig) MatchesMagic ¶
func (cfg *MapperConfig) MatchesMagic(ds *template.DataStructure) (bool, string)
returns true if magic bytes and optionally file extension matches
type PresentFileLayoutConfig ¶
type Struct ¶
type Struct struct { // unique name of this instance of the struct Name string // child nodes Children []*Struct // additional decoration Label string Fields []Field // slice-based counter index, 0-based Index int // contains filtered or unexported fields }
parsed file data section from a template "struct"