Skip to content
Closed
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 11 additions & 0 deletions src/magic.rs
Original file line number Diff line number Diff line change
Expand Up @@ -159,6 +159,17 @@ pub fn patterns() -> Vec<signatures::common::Signature> {
description: signatures::hashes::SHA256_DESCRIPTION.to_string(),
extractor: None,
},
// md5 constants
signatures::common::Signature {
name: "md5".to_string(),
short: false,
magic_offset: 0,
always_display: false,
magic: signatures::hashes::md5_magic(),
parser: signatures::hashes::md5_parser,
description: signatures::hashes::MD5_DESCRIPTION.to_string(),
extractor: None,
},
// cpio
signatures::common::Signature {
name: "cpio".to_string(),
Expand Down
28 changes: 28 additions & 0 deletions src/signatures/hashes.rs
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,7 @@ const HASH_MAGIC_LEN: usize = 16;
/// Human readable descriptions
pub const CRC32_DESCRIPTION: &str = "CRC32 polynomial table";
pub const SHA256_DESCRIPTION: &str = "SHA256 hash constants";
pub const MD5_DESCRIPTION: &str = "MD5 hash constants";

/// CRC32 contstants
pub fn crc32_magic() -> Vec<Vec<u8>> {
Expand All @@ -29,6 +30,17 @@ pub fn sha256_magic() -> Vec<Vec<u8>> {
]
}

/// MD5 constants
pub fn md5_magic() -> Vec<Vec<u8>> {
// Order matters! See hash_endianness().
vec![
// Big endian
b"\xd7\x6a\xa4\x78\xe8\xc7\xb7\x56\x24\x20\x70\xdb\xc1\xbd\xce\xee".to_vec(),
// Little endian
b"\x78\xa4\x6a\xd7\x56\xb7\xc7\xe8\xdb\x70\x20\x24\xee\xce\xbd\xc1".to_vec(),
]
}

pub fn crc32_parser(file_data: &[u8], offset: usize) -> Result<SignatureResult, SignatureError> {
// Just return a success with some extra description info
let result = SignatureResult {
Expand Down Expand Up @@ -61,6 +73,22 @@ pub fn sha256_parser(file_data: &[u8], offset: usize) -> Result<SignatureResult,
Ok(result)
}

pub fn md5_parser(file_data: &[u8], offset: usize) -> Result<SignatureResult, SignatureError> {
// Just return a success with some extra description info
let result = SignatureResult {
description: format!(
"{}, {} endian",
MD5_DESCRIPTION,
hash_endianess(file_data, offset, md5_magic())
),
offset,
size: HASH_MAGIC_LEN,
..Default::default()
};

Ok(result)
}

/// Detects hash contstant endianess
fn hash_endianess(file_data: &[u8], offset: usize, magics: Vec<Vec<u8>>) -> String {
let mut endianness: String = "little".to_string();
Expand Down
Loading