public override FileFormat Match(FileFormatScanJob job)
{
if (FileFormatUtils.IsNullOrEmpty(job.StartBytes))
{
return(null);
}
if (job.StartBytes.Length <= HeaderSize)
{
return(null);
}
var header = FileFormatUtils.Read <JFIFHeader>(job.StartBytes, 0, HeaderSize);
if (!FileFormatUtils.MatchBytes(header.SOI, Signature))
{
return(null);
}
var exif = FileFormatUtils.MatchBytes(header.App, EXIF);
if (!FileFormatUtils.MatchBytes(header.App, JFIF) && exif)
{
return(null);
}
var fingerprint = new JPEGImageFormat(exif);
return(fingerprint);
}
protected virtual bool ValidateStartBytes(FileFormatScanJob job)
{
const string cacheKey = "IsEBML";
if (job.Cache.Exists(cacheKey))
{
var cachedResult = job.Cache.Get <bool>(cacheKey);
return(cachedResult);
}
var result = false;
if (!FileFormatUtils.IsNullOrEmpty(job.StartBytes))
{
if (FileFormatUtils.MatchBytes(job.StartBytes, 0, Signature))
{
result = true;
}
}
job.Cache.Set(cacheKey, result);
return(result);
}
public override FileFormat Match(FileFormatScanJob job)
{
if (FileFormatUtils.IsNullOrEmpty(job.StartBytes))
{
return(null);
}
if (job.StartBytes.Length <= (BitmapFileHeaderSize + BitmapInfoHeaderSize))
{
return(null);
}
var fileHeader = FileFormatUtils.Read <BitmapFileHeader>(job.StartBytes, 0, BitmapFileHeaderSize);
if (!FileFormatUtils.MatchBytes(fileHeader.Signature, BitmapSignature))
{
return(null);
}
var infoHeader = FileFormatUtils.Read <BitmapInfoHeader>(job.StartBytes, BitmapFileHeaderSize, BitmapInfoHeaderSize);
if (infoHeader.Size != BitmapInfoHeaderSize)
{
return(null);
}
var fingerprint = new BitmapImageFormat();
return(fingerprint);
}
public override FileFormat Match(FileFormatScanJob job)
{
if (!ValidateStartBytes(job))
{
return(null);
}
foreach (var signature in _signatures)
{
if (FileFormatUtils.MatchBytes(job.StartBytes, 8, signature))
{
var fingerprint = new ThreeGPFormat();
return(fingerprint);
}
}
foreach (var signature in _secondSignatures)
{
if (FileFormatUtils.MatchBytes(job.StartBytes, 8, signature))
{
var fingerprint = new ThreeGP2Format();
return(fingerprint);
}
}
return(null);
}
protected virtual bool ValidateStartBytes(FileFormatScanJob job)
{
const string cacheKey = "IsRIFF";
if (job.Cache.Exists(cacheKey))
{
var cachedResult = job.Cache.Get <bool>(cacheKey);
return(cachedResult);
}
var result = false;
if (!FileFormatUtils.IsNullOrEmpty(job.StartBytes))
{
if (job.StartBytes.Length > HeaderSize)
{
var header = FileFormatUtils.Read <RIFFHeader>(job.StartBytes);
if (header.Signature == Signature)
{
result = true;
}
}
}
job.Cache.Set(cacheKey, result);
return(result);
}
protected override bool ValidateStartBytes(FileFormatScanJob job)
{
if (!base.ValidateStartBytes(job))
{
return(false);
}
const string cacheKey = "IsWebM";
if (job.Cache.Exists(cacheKey))
{
var cachedResult = job.Cache.Get <bool>(cacheKey);
return(cachedResult);
}
var result = false;
for (var i = 0; i < job.StartBytes.Length; i++)
{
if (job.StartBytes[i] == 0x77 && FileFormatUtils.MatchBytes(job.StartBytes, i, WebM))
{
result = true;
break;
}
}
job.Cache.Set(cacheKey, result);
return(result);
}
public override FileFormat Match(FileFormatScanJob job)
{
if (FileFormatUtils.IsNullOrEmpty(job.StartBytes))
{
return(null);
}
if (job.StartBytes.Length < HeaderSize)
{
return(null);
}
var header = FileFormatUtils.Read <Header>(job.StartBytes, 0, HeaderSize);
if (!FileFormatUtils.MatchBytes(header.Signature, Signature))
{
return(null);
}
if (!(header.VersionMajor == 1 && header.VersionMinor == 3))
{
return(null);
}
var fingerprint = new CabinetFormat();
return(fingerprint);
}
protected bool ValidateStartBytes(FileFormatScanJob job)
{
const string cacheKey = "IsZIP";
if (job.Cache.Exists(cacheKey))
{
var cachedResult = job.Cache.Get <bool>(cacheKey);
return(cachedResult);
}
var valid = false;
if (!FileFormatUtils.IsNullOrEmpty(job.StartBytes))
{
if (job.StartBytes.Length > ZipFileHeaderSize)
{
var header = FileFormatUtils.Read <ZipFileHeader>(job.StartBytes, 0, ZipFileHeaderSize);
if (header.Signature == ZipFileSignature)
{
valid = true;
}
}
}
job.Cache.Set(cacheKey, valid);
return(valid);
}
public override FileFormat Match(FileFormatScanJob job)
{
if (FileFormatUtils.IsNullOrEmpty(job.StartBytes))
{
return(null);
}
if (job.StartBytes.Length < Signature.Length)
{
return(null);
}
if (!FileFormatUtils.MatchBytes(job.StartBytes, Signature))
{
return(null);
}
if (job.StartBytes[2] != 0x68 && job.StartBytes[2] != 0)
{
return(null);
}
if (job.StartBytes[3] < 0x31 && job.StartBytes[3] > 0x39)
{
return(null);
}
var fingerprint = new BZipFormat();
return(fingerprint);
}
private bool ValidateStart(byte[] startBytes)
{
if ((Signature.Length + ChunkSize + HeaderChunkSize) > startBytes.Length)
{
return(false);
}
if (!FileFormatUtils.MatchBytes(startBytes, Signature))
{
return(false);
}
using (var mem = new MemoryStream(startBytes))
{
mem.Seek(Signature.Length, SeekOrigin.Begin);
var chunk = FileFormatUtils.Read <Chunk>(mem);
if (chunk.Type != IHDRType)
{
return(false);
}
}
return(true);
}
public override FileFormat Match(FileFormatScanJob job)
{
if (FileFormatUtils.IsNullOrEmpty(job.StartBytes))
{
return(null);
}
if (!ValidateStart(job.StartBytes))
{
return(null);
}
if (FileFormatUtils.IsNullOrEmpty(job.EndBytes))
{
return(null);
}
if (!ValidateEnd(job.EndBytes))
{
return(null);
}
var fingerprint = new PNGImageFormat();
return(fingerprint);
}
public override FileFormat Match(FileFormatScanJob job)
{
if (!ValidateStartBytes(job))
return null;
var header = FileFormatUtils.Read<RIFFHeader>(job.StartBytes);
if (header.Type != Type)
return null;
var fingerprint = new AnimatedCursorFormat();
return fingerprint;
}
public override FileFormat Match(FileFormatScanJob job)
{
if (FileFormatUtils.IsNullOrEmpty(job.StartBytes))
{
return(null);
}
if (job.StartBytes.Length <= HeaderSize)
{
return(null);
}
var header = FileFormatUtils.Read <Header>(job.StartBytes, 0, HeaderSize);
if (header.Magic != Magic)
{
return(null);
}
if (header.MagicClient != MagicClient)
{
return(null);
}
var format = PSTFormat.Unknown;
if (header.Ver == 14 || header.Ver == 15)
{
format = PSTFormat.ANSI;
}
else if (header.Ver >= 23)
{
format = PSTFormat.Unicode;
}
if (header.VerClient != 19)
{
return(null);
}
if (header.PlatformCreate != 1 && header.PlatformAccess != 1)
{
return(null);
}
var fingerprint = new OutlookPSTFormat(format);
return(fingerprint);
}
private bool ValidateEnd(byte[] bytes)
{
if (bytes.Length < ChunkSize)
{
return(false);
}
var chunk = FileFormatUtils.Read <Chunk>(bytes, bytes.Length - 12, ChunkSize);
if (chunk.Length != 0 && chunk.Type != IENDType)
{
return(false);
}
return(true);
}
public static string GetMimeTypeFromZip(FileFormatScanJob job)
{
const string cacheKey = "ODF:MimeType";
if (job.Cache.Exists(cacheKey))
{
var cachedResult = job.Cache.Get <string>(cacheKey);
return(cachedResult);
}
var result = FileFormatUtils.GetFileFromZip(job.Stream, "mimetype");
job.Cache.Set(cacheKey, result);
return(result);
}
public static string GetContentTypesFromZip(FileFormatScanJob job)
{
const string cacheKey = "OOXML:ContentTypes";
if (job.Cache.Exists(cacheKey))
{
var cachedResult = job.Cache.Get <string>(cacheKey);
return(cachedResult);
}
var result = FileFormatUtils.GetFileFromZip(job.Stream, "[Content_Types].xml");
job.Cache.Set(cacheKey, result);
return(result);
}
public override FileFormat Match(FileFormatScanJob job)
{
if (!ValidateStartBytes(job))
{
return(null);
}
var contentTypes = FileFormatUtils.GetFileFromZip(job.Stream, "MANIFEST.MF");
if (string.IsNullOrWhiteSpace(contentTypes))
{
return(null);
}
var fingerprint = new JavaArchiveFormat();
return(fingerprint);
}
public override FileFormat Match(FileFormatScanJob job)
{
if (!ValidateStartBytes(job))
{
return(null);
}
var header = FileFormatUtils.Read <RIFFHeader>(job.StartBytes);
if (header.Type != Type)
{
return(null);
}
var fingerprint = new AVIFormat();
return(fingerprint);
}
private bool ValidateStartBytes(byte[] bytes)
{
if (FileFormatUtils.IsNullOrEmpty(bytes))
{
return(false);
}
if (bytes.Length < 20)
{
return(false);
}
if (!FileFormatUtils.MatchBytes(bytes, StartSignature))
{
return(false);
}
return(true);
}
private bool ValidateEndBytes(byte[] bytes)
{
if (FileFormatUtils.IsNullOrEmpty(bytes))
{
return(false);
}
if (bytes.Length < EndSignature.Length)
{
return(false);
}
if (!FileFormatUtils.MatchBytes(bytes, bytes.Length - EndSignature.Length, EndSignature))
{
return(false);
}
return(true);
}
public override FileFormat Match(FileFormatScanJob job)
{
if (!ValidateStartBytes(job))
{
return(null);
}
var contentTypes = FileFormatUtils.GetFileFromZip(job.Stream, "[Content_Types].xml");
if (string.IsNullOrWhiteSpace(contentTypes))
{
return(null);
}
if (contentTypes.IndexOf("<Default Extension=\"nuspec\" ContentType=\"application/octet\" />", StringComparison.Ordinal) == -1)
{
return(null);
}
var hasNuspec = false;
using (var archive = new ZipArchive(job.Stream, ZipArchiveMode.Read, true))
{
foreach (var entry in archive.Entries)
{
if (entry.Name.EndsWith(".nuspec", StringComparison.Ordinal))
{
hasNuspec = true;
break;
}
}
}
if (!hasNuspec)
{
return(null);
}
var fingerprint = new NuGetPackageFormat();
return(fingerprint);
}
public override FileFormat Match(FileFormatScanJob job)
{
if (FileFormatUtils.IsNullOrEmpty(job.StartBytes))
{
return(null);
}
if (job.StartBytes.Length <= Signature.Length)
{
return(null);
}
if (!FileFormatUtils.MatchBytes(job.StartBytes, Signature))
{
return(null);
}
var fingerprint = new SevenZipFormat();
return(fingerprint);
}
public override FileFormat Match(FileFormatScanJob job)
{
if (FileFormatUtils.IsNullOrEmpty(job.StartBytes))
{
return(null);
}
if (!FileFormatUtils.MatchBytes(job.StartBytes, Signature))
{
return(null);
}
if (job.StartBytes[4] != 0x01 && job.StartBytes[4] != 0x04 && job.StartBytes[4] != 0x05)
{
return(null);
}
var fingerprint = new FlashVideoFormat();
return(fingerprint);
}
public override FileFormat Match(FileFormatScanJob job)
{
if (FileFormatUtils.IsNullOrEmpty(job.StartBytes))
{
return(null);
}
if (job.StartBytes.Length < 20)
{
return(null);
}
if (!FileFormatUtils.MatchBytes(job.StartBytes, 4, Signature))
{
return(null);
}
var fingerprint = new AccessDatabaseFormat();
return(fingerprint);
}
public override FileFormat Match(FileFormatScanJob job)
{
if (FileFormatUtils.IsNullOrEmpty(job.StartBytes))
{
return(null);
}
if (job.StartBytes.Length < 1024)
{
return(null);
}
if (!FileFormatUtils.MatchBytes(job.StartBytes, 0, Signature))
{
return(null);
}
var fingerprint = new BasicAudioFormat();
return(fingerprint);
}
public override FileFormat Match(FileFormatScanJob job)
{
if (FileFormatUtils.IsNullOrEmpty(job.StartBytes))
{
return(null);
}
if (job.StartBytes.Length <= HeaderSize)
{
return(null);
}
if (!FileFormatUtils.MatchBytes(job.StartBytes, EightySevenSignature) && !FileFormatUtils.MatchBytes(job.StartBytes, EightyNineSignature))
{
return(null);
}
var fingerprint = new GIFImageFormat();
return(fingerprint);
}
public override FileFormat Match(FileFormatScanJob job)
{
if (!ValidateStartBytes(job))
{
return(null);
}
var mimeType = FileFormatUtils.GetFileFromZip(job.Stream, "mimetype");
if (string.IsNullOrWhiteSpace(mimeType))
{
return(null);
}
if (mimeType.IndexOf(EPubFormat.ContentType, StringComparison.Ordinal) == -1)
{
return(null);
}
var fingerprint = new EPubFormat();
return(fingerprint);
}
public override FileFormat Match(FileFormatScanJob job)
{
if (FileFormatUtils.IsNullOrEmpty(job.StartBytes))
{
return(null);
}
if (job.StartBytes.Length < 1024)
{
return(null);
}
FlashCompressionType?compressionType = null;
if (FileFormatUtils.MatchBytes(job.StartBytes, FwsSignature))
{
compressionType = FlashCompressionType.Uncompressed;
}
else if (FileFormatUtils.MatchBytes(job.StartBytes, CwsSignature))
{
compressionType = FlashCompressionType.CompressedZlib;
}
else if (FileFormatUtils.MatchBytes(job.StartBytes, ZwsSignature))
{
compressionType = FlashCompressionType.CompressedLZMA;
}
if (compressionType == null)
{
return(null);
}
var fingerprint = new FlashFormat(compressionType.Value);
return(fingerprint);
}
public override FileFormat Match(FileFormatScanJob job)
{
if (FileFormatUtils.IsNullOrEmpty(job.StartBytes))
{
return(null);
}
if (job.StartBytes.Length < DOSHeaderSize + 64 + FileHeaderSize + OptionalHeader64Size)
{
return(null);
}
var dosHeader = FileFormatUtils.Read <DOSHeader>(job.StartBytes, 0, DOSHeaderSize);
if (dosHeader.e_magic != DOSMagicNumber)
{
return(null);
}
if (dosHeader.e_lfanew == 0 ||
dosHeader.e_lfanew >= (256 * (1024 * 1024)) ||
dosHeader.e_lfanew % 4 != 0 ||
dosHeader.e_lfanew < DOSHeaderSize ||
dosHeader.e_lfanew >= job.StartBytes.Length)
{
return(null);
}
if (dosHeader.e_lfanew < DOSHeaderSize)
{
return(null);
}
var stubOffset = DOSHeaderSize;
var stubSize = dosHeader.e_lfanew - DOSHeaderSize;
if ((stubOffset + stubSize) >= job.StartBytes.Length)
{
return(null);
}
var fileHeaderOffset = stubOffset + stubSize;
var fileHeader = FileFormatUtils.Read <FileHeader>(job.StartBytes, fileHeaderOffset, FileHeaderSize);
if (fileHeader.Signature != PEMagicNumber)
{
return(null);
}
var optHeaderOffset = fileHeaderOffset + FileHeaderSize;
var magic = FileFormatUtils.ReadUInt16(job.StartBytes, optHeaderOffset);
var is32bit = (magic == (ushort)MagicType.PE32);
var is64bit = (magic == (ushort)MagicType.PE32plus);
if (!is32bit && !is64bit)
{
return(null);
}
DataDirectory clrDataDirectory;
if (is32bit)
{
if (optHeaderOffset + OptionalHeader32Size >= job.StartBytes.Length)
{
return(null);
}
var optHeader = FileFormatUtils.Read <OptionalHeader32>(job.StartBytes, optHeaderOffset, OptionalHeader32Size);
clrDataDirectory = optHeader.CLRRuntimeHeader;
}
else
{
if (optHeaderOffset + OptionalHeader64Size >= job.StartBytes.Length)
{
return(null);
}
var optHeader = FileFormatUtils.Read <OptionalHeader64>(job.StartBytes, optHeaderOffset, OptionalHeader64Size);
clrDataDirectory = optHeader.CLRRuntimeHeader;
}
var isCLR = (clrDataDirectory.Size > 0 && clrDataDirectory.VirtualAddress > 0);
var fingerprint = new PortableExecutableFormat(is32bit ? PEImageFormat._32Bit : PEImageFormat._64Bit, isCLR);
return(fingerprint);
}
private bool ValidateEndBytes(byte[] bytes)
{
if (FileFormatUtils.IsNullOrEmpty(bytes))
{
return(false);
}
if (bytes.Length < MinEndSignatureLength)
{
return(false);
}
foreach (var sig in EndSignatures)
{
if (FileFormatUtils.MatchBytes(bytes, bytes.Length - sig.Length, sig))
{
return(true);
}
}
var locker = new object();
var matchFound = false;
// Might as well do this in parallel
Parallel.ForEach(EndSignatures, sig =>
{
lock (locker)
{
if (matchFound)
{
return;
}
}
// Could probably replace this with Span<> one day
using (var stream = new MemoryStream(bytes))
{
var buffer = new byte[sig.Length];
var offset = bytes.Length - sig.Length;
while (offset >= 0)
{
stream.Seek(offset, SeekOrigin.Begin);
var numRead = stream.Read(buffer, 0, buffer.Length);
if (numRead < buffer.Length)
{
break;
}
if (FileFormatUtils.MatchBytes(buffer, sig))
{
lock (locker)
{
matchFound = true;
}
return;
}
offset--;
}
}
});
return(matchFound);
}
