mirror of
https://github.com/wader/fq.git
synced 2024-12-23 05:13:30 +03:00
8e0dde03d0
This will allow passing both cli options and format options to sub decoder. Ex: pass keylog option to a tls decoder when decoding a pcap. Ex: pass decode options to a format inside a http body inside a pcap. Add ArgAs method to lookup argument based on type. This also makes the format decode function have same signature as sub decoders in the decode API. This change decode.Format a bit: DecodeFn is now just func(d *D) any DecodeInArg renamed to DefaultInArg
51 lines
1.5 KiB
Go
51 lines
1.5 KiB
Go
package ar
|
|
|
|
import (
|
|
"github.com/wader/fq/format"
|
|
"github.com/wader/fq/pkg/decode"
|
|
"github.com/wader/fq/pkg/interp"
|
|
"github.com/wader/fq/pkg/scalar"
|
|
)
|
|
|
|
var probeFormat decode.Group
|
|
|
|
func init() {
|
|
interp.RegisterFormat(decode.Format{
|
|
Name: format.AR,
|
|
Description: "Unix archive",
|
|
Groups: []string{format.PROBE},
|
|
DecodeFn: decodeAr,
|
|
Dependencies: []decode.Dependency{
|
|
{Names: []string{format.PROBE}, Group: &probeFormat},
|
|
},
|
|
})
|
|
}
|
|
|
|
func decodeAr(d *decode.D) any {
|
|
d.FieldUTF8("signature", 8, d.StrAssert("!<arch>\n"))
|
|
d.FieldArray("files", func(d *decode.D) {
|
|
for !d.End() {
|
|
d.FieldStruct("file", func(d *decode.D) {
|
|
d.FieldUTF8("identifier", 16, scalar.ActualTrimSpace)
|
|
d.FieldUTF8("modification_timestamp", 12, scalar.ActualTrimSpace, scalar.TryStrSymParseUint(10))
|
|
d.FieldUTF8("owner_id", 6, scalar.ActualTrimSpace, scalar.TryStrSymParseUint(10))
|
|
d.FieldUTF8("group_id", 6, scalar.ActualTrimSpace, scalar.TryStrSymParseUint(10))
|
|
d.FieldUTF8("file_mode", 8, scalar.ActualTrimSpace, scalar.TryStrSymParseUint(8)) // Octal
|
|
sizeStr := d.FieldScalarUTF8("file_size", 10, scalar.ActualTrimSpace, scalar.TryStrSymParseUint(10))
|
|
if sizeStr.Sym == nil {
|
|
d.Fatalf("could not decode file_size")
|
|
}
|
|
size := int64(sizeStr.SymUint()) * 8
|
|
d.FieldUTF8("ending_characters", 2)
|
|
d.FieldFormatOrRawLen("data", size, probeFormat, nil)
|
|
padding := d.AlignBits(16)
|
|
if padding > 0 {
|
|
d.FieldRawLen("padding", int64(padding))
|
|
}
|
|
})
|
|
}
|
|
})
|
|
|
|
return nil
|
|
}
|