Commit 75bc2e85 by Dmitry Moiseev Committed by devttys0

Addes {string-len} macros to calculate string length

parent 519e7d37
......@@ -550,6 +550,8 @@ class Binwalk(object):
i_set_results_offset = False
magic_result = self.smart._parse_string_len(magic_result)
# Some file names are not NULL byte terminated, but rather their length is
# specified in a size field. To ensure these are not marked as invalid due to
# non-printable characters existing in the file name, parse the filename(s) and
......
......@@ -22,6 +22,7 @@ class SmartSignature:
'filename' : '%sfile-name:' % KEYWORD_DELIM_START,
'filesize' : '%sfile-size:' % KEYWORD_DELIM_START,
'raw-string' : '%sraw-string:' % KEYWORD_DELIM_START, # This one is special and must come last in a signature block
'string-len' : '%sstring-len:' % KEYWORD_DELIM_START,
'raw-size' : '%sraw-string-length:' % KEYWORD_DELIM_START,
'adjust' : '%soffset-adjust:' % KEYWORD_DELIM_START,
'delay' : '%sextract-delay:' % KEYWORD_DELIM_START,
......@@ -240,6 +241,27 @@ class SmartSignature:
# marked as invalid when it shouldn't be.
data = data[:data.find(self.KEYWORDS['raw-string'])].replace(self.KEYWORDS['raw-replace'], '"' + raw_string[:str2int(raw_size)] + '"')
return data
def _parse_string_len(self, data):
'''
Process {string-len} macros.
@data - String to parse.
Returns strings length.
'''
if not self.ignore_smart_signatures and self._is_valid(data):
# Get the raw string keyword arg
raw_string = self._get_keyword_arg(data, 'string-len')
# Was a string-len keyword specified?
if raw_string:
# Is the raw string length arg is a numeric value?
# Replace all instances of string-len in data with supplied string lenth
# Also strip out everything after the string-len keyword, including the keyword itself.
data = re.sub(self.KEYWORDS['string-len']+".+?%s" % self.KEYWORD_DELIM_END, str(len(raw_string)),data)
return data
def _strip_tags(self, data):
'''
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment