public override FileFormat Match(FileFormatScanJob job) { if (FileFormatUtils.IsNullOrEmpty(job.StartBytes)) { return(null); } if (job.StartBytes.Length <= HeaderSize) { return(null); } var header = FileFormatUtils.Read <JFIFHeader>(job.StartBytes, 0, HeaderSize); if (!FileFormatUtils.MatchBytes(header.SOI, Signature)) { return(null); } var exif = FileFormatUtils.MatchBytes(header.App, EXIF); if (!FileFormatUtils.MatchBytes(header.App, JFIF) && exif) { return(null); } var fingerprint = new JPEGImageFormat(exif); return(fingerprint); }
protected virtual bool ValidateStartBytes(FileFormatScanJob job) { const string cacheKey = "IsEBML"; if (job.Cache.Exists(cacheKey)) { var cachedResult = job.Cache.Get <bool>(cacheKey); return(cachedResult); } var result = false; if (!FileFormatUtils.IsNullOrEmpty(job.StartBytes)) { if (FileFormatUtils.MatchBytes(job.StartBytes, 0, Signature)) { result = true; } } job.Cache.Set(cacheKey, result); return(result); }
public override FileFormat Match(FileFormatScanJob job) { if (FileFormatUtils.IsNullOrEmpty(job.StartBytes)) { return(null); } if (job.StartBytes.Length <= (BitmapFileHeaderSize + BitmapInfoHeaderSize)) { return(null); } var fileHeader = FileFormatUtils.Read <BitmapFileHeader>(job.StartBytes, 0, BitmapFileHeaderSize); if (!FileFormatUtils.MatchBytes(fileHeader.Signature, BitmapSignature)) { return(null); } var infoHeader = FileFormatUtils.Read <BitmapInfoHeader>(job.StartBytes, BitmapFileHeaderSize, BitmapInfoHeaderSize); if (infoHeader.Size != BitmapInfoHeaderSize) { return(null); } var fingerprint = new BitmapImageFormat(); return(fingerprint); }
public override FileFormat Match(FileFormatScanJob job) { if (!ValidateStartBytes(job)) { return(null); } foreach (var signature in _signatures) { if (FileFormatUtils.MatchBytes(job.StartBytes, 8, signature)) { var fingerprint = new ThreeGPFormat(); return(fingerprint); } } foreach (var signature in _secondSignatures) { if (FileFormatUtils.MatchBytes(job.StartBytes, 8, signature)) { var fingerprint = new ThreeGP2Format(); return(fingerprint); } } return(null); }
protected virtual bool ValidateStartBytes(FileFormatScanJob job) { const string cacheKey = "IsRIFF"; if (job.Cache.Exists(cacheKey)) { var cachedResult = job.Cache.Get <bool>(cacheKey); return(cachedResult); } var result = false; if (!FileFormatUtils.IsNullOrEmpty(job.StartBytes)) { if (job.StartBytes.Length > HeaderSize) { var header = FileFormatUtils.Read <RIFFHeader>(job.StartBytes); if (header.Signature == Signature) { result = true; } } } job.Cache.Set(cacheKey, result); return(result); }
protected override bool ValidateStartBytes(FileFormatScanJob job) { if (!base.ValidateStartBytes(job)) { return(false); } const string cacheKey = "IsWebM"; if (job.Cache.Exists(cacheKey)) { var cachedResult = job.Cache.Get <bool>(cacheKey); return(cachedResult); } var result = false; for (var i = 0; i < job.StartBytes.Length; i++) { if (job.StartBytes[i] == 0x77 && FileFormatUtils.MatchBytes(job.StartBytes, i, WebM)) { result = true; break; } } job.Cache.Set(cacheKey, result); return(result); }
public override FileFormat Match(FileFormatScanJob job) { if (FileFormatUtils.IsNullOrEmpty(job.StartBytes)) { return(null); } if (job.StartBytes.Length < HeaderSize) { return(null); } var header = FileFormatUtils.Read <Header>(job.StartBytes, 0, HeaderSize); if (!FileFormatUtils.MatchBytes(header.Signature, Signature)) { return(null); } if (!(header.VersionMajor == 1 && header.VersionMinor == 3)) { return(null); } var fingerprint = new CabinetFormat(); return(fingerprint); }
protected bool ValidateStartBytes(FileFormatScanJob job) { const string cacheKey = "IsZIP"; if (job.Cache.Exists(cacheKey)) { var cachedResult = job.Cache.Get <bool>(cacheKey); return(cachedResult); } var valid = false; if (!FileFormatUtils.IsNullOrEmpty(job.StartBytes)) { if (job.StartBytes.Length > ZipFileHeaderSize) { var header = FileFormatUtils.Read <ZipFileHeader>(job.StartBytes, 0, ZipFileHeaderSize); if (header.Signature == ZipFileSignature) { valid = true; } } } job.Cache.Set(cacheKey, valid); return(valid); }
public override FileFormat Match(FileFormatScanJob job) { if (FileFormatUtils.IsNullOrEmpty(job.StartBytes)) { return(null); } if (job.StartBytes.Length < Signature.Length) { return(null); } if (!FileFormatUtils.MatchBytes(job.StartBytes, Signature)) { return(null); } if (job.StartBytes[2] != 0x68 && job.StartBytes[2] != 0) { return(null); } if (job.StartBytes[3] < 0x31 && job.StartBytes[3] > 0x39) { return(null); } var fingerprint = new BZipFormat(); return(fingerprint); }
private bool ValidateStart(byte[] startBytes) { if ((Signature.Length + ChunkSize + HeaderChunkSize) > startBytes.Length) { return(false); } if (!FileFormatUtils.MatchBytes(startBytes, Signature)) { return(false); } using (var mem = new MemoryStream(startBytes)) { mem.Seek(Signature.Length, SeekOrigin.Begin); var chunk = FileFormatUtils.Read <Chunk>(mem); if (chunk.Type != IHDRType) { return(false); } } return(true); }
public override FileFormat Match(FileFormatScanJob job) { if (FileFormatUtils.IsNullOrEmpty(job.StartBytes)) { return(null); } if (!ValidateStart(job.StartBytes)) { return(null); } if (FileFormatUtils.IsNullOrEmpty(job.EndBytes)) { return(null); } if (!ValidateEnd(job.EndBytes)) { return(null); } var fingerprint = new PNGImageFormat(); return(fingerprint); }
public override FileFormat Match(FileFormatScanJob job) { if (!ValidateStartBytes(job)) return null; var header = FileFormatUtils.Read<RIFFHeader>(job.StartBytes); if (header.Type != Type) return null; var fingerprint = new AnimatedCursorFormat(); return fingerprint; }
public override FileFormat Match(FileFormatScanJob job) { if (FileFormatUtils.IsNullOrEmpty(job.StartBytes)) { return(null); } if (job.StartBytes.Length <= HeaderSize) { return(null); } var header = FileFormatUtils.Read <Header>(job.StartBytes, 0, HeaderSize); if (header.Magic != Magic) { return(null); } if (header.MagicClient != MagicClient) { return(null); } var format = PSTFormat.Unknown; if (header.Ver == 14 || header.Ver == 15) { format = PSTFormat.ANSI; } else if (header.Ver >= 23) { format = PSTFormat.Unicode; } if (header.VerClient != 19) { return(null); } if (header.PlatformCreate != 1 && header.PlatformAccess != 1) { return(null); } var fingerprint = new OutlookPSTFormat(format); return(fingerprint); }
private bool ValidateEnd(byte[] bytes) { if (bytes.Length < ChunkSize) { return(false); } var chunk = FileFormatUtils.Read <Chunk>(bytes, bytes.Length - 12, ChunkSize); if (chunk.Length != 0 && chunk.Type != IENDType) { return(false); } return(true); }
public static string GetMimeTypeFromZip(FileFormatScanJob job) { const string cacheKey = "ODF:MimeType"; if (job.Cache.Exists(cacheKey)) { var cachedResult = job.Cache.Get <string>(cacheKey); return(cachedResult); } var result = FileFormatUtils.GetFileFromZip(job.Stream, "mimetype"); job.Cache.Set(cacheKey, result); return(result); }
public static string GetContentTypesFromZip(FileFormatScanJob job) { const string cacheKey = "OOXML:ContentTypes"; if (job.Cache.Exists(cacheKey)) { var cachedResult = job.Cache.Get <string>(cacheKey); return(cachedResult); } var result = FileFormatUtils.GetFileFromZip(job.Stream, "[Content_Types].xml"); job.Cache.Set(cacheKey, result); return(result); }
public override FileFormat Match(FileFormatScanJob job) { if (!ValidateStartBytes(job)) { return(null); } var contentTypes = FileFormatUtils.GetFileFromZip(job.Stream, "MANIFEST.MF"); if (string.IsNullOrWhiteSpace(contentTypes)) { return(null); } var fingerprint = new JavaArchiveFormat(); return(fingerprint); }
public override FileFormat Match(FileFormatScanJob job) { if (!ValidateStartBytes(job)) { return(null); } var header = FileFormatUtils.Read <RIFFHeader>(job.StartBytes); if (header.Type != Type) { return(null); } var fingerprint = new AVIFormat(); return(fingerprint); }
private bool ValidateStartBytes(byte[] bytes) { if (FileFormatUtils.IsNullOrEmpty(bytes)) { return(false); } if (bytes.Length < 20) { return(false); } if (!FileFormatUtils.MatchBytes(bytes, StartSignature)) { return(false); } return(true); }
private bool ValidateEndBytes(byte[] bytes) { if (FileFormatUtils.IsNullOrEmpty(bytes)) { return(false); } if (bytes.Length < EndSignature.Length) { return(false); } if (!FileFormatUtils.MatchBytes(bytes, bytes.Length - EndSignature.Length, EndSignature)) { return(false); } return(true); }
public override FileFormat Match(FileFormatScanJob job) { if (!ValidateStartBytes(job)) { return(null); } var contentTypes = FileFormatUtils.GetFileFromZip(job.Stream, "[Content_Types].xml"); if (string.IsNullOrWhiteSpace(contentTypes)) { return(null); } if (contentTypes.IndexOf("<Default Extension=\"nuspec\" ContentType=\"application/octet\" />", StringComparison.Ordinal) == -1) { return(null); } var hasNuspec = false; using (var archive = new ZipArchive(job.Stream, ZipArchiveMode.Read, true)) { foreach (var entry in archive.Entries) { if (entry.Name.EndsWith(".nuspec", StringComparison.Ordinal)) { hasNuspec = true; break; } } } if (!hasNuspec) { return(null); } var fingerprint = new NuGetPackageFormat(); return(fingerprint); }
public override FileFormat Match(FileFormatScanJob job) { if (FileFormatUtils.IsNullOrEmpty(job.StartBytes)) { return(null); } if (job.StartBytes.Length <= Signature.Length) { return(null); } if (!FileFormatUtils.MatchBytes(job.StartBytes, Signature)) { return(null); } var fingerprint = new SevenZipFormat(); return(fingerprint); }
public override FileFormat Match(FileFormatScanJob job) { if (FileFormatUtils.IsNullOrEmpty(job.StartBytes)) { return(null); } if (!FileFormatUtils.MatchBytes(job.StartBytes, Signature)) { return(null); } if (job.StartBytes[4] != 0x01 && job.StartBytes[4] != 0x04 && job.StartBytes[4] != 0x05) { return(null); } var fingerprint = new FlashVideoFormat(); return(fingerprint); }
public override FileFormat Match(FileFormatScanJob job) { if (FileFormatUtils.IsNullOrEmpty(job.StartBytes)) { return(null); } if (job.StartBytes.Length < 20) { return(null); } if (!FileFormatUtils.MatchBytes(job.StartBytes, 4, Signature)) { return(null); } var fingerprint = new AccessDatabaseFormat(); return(fingerprint); }
public override FileFormat Match(FileFormatScanJob job) { if (FileFormatUtils.IsNullOrEmpty(job.StartBytes)) { return(null); } if (job.StartBytes.Length < 1024) { return(null); } if (!FileFormatUtils.MatchBytes(job.StartBytes, 0, Signature)) { return(null); } var fingerprint = new BasicAudioFormat(); return(fingerprint); }
public override FileFormat Match(FileFormatScanJob job) { if (FileFormatUtils.IsNullOrEmpty(job.StartBytes)) { return(null); } if (job.StartBytes.Length <= HeaderSize) { return(null); } if (!FileFormatUtils.MatchBytes(job.StartBytes, EightySevenSignature) && !FileFormatUtils.MatchBytes(job.StartBytes, EightyNineSignature)) { return(null); } var fingerprint = new GIFImageFormat(); return(fingerprint); }
public override FileFormat Match(FileFormatScanJob job) { if (!ValidateStartBytes(job)) { return(null); } var mimeType = FileFormatUtils.GetFileFromZip(job.Stream, "mimetype"); if (string.IsNullOrWhiteSpace(mimeType)) { return(null); } if (mimeType.IndexOf(EPubFormat.ContentType, StringComparison.Ordinal) == -1) { return(null); } var fingerprint = new EPubFormat(); return(fingerprint); }
public override FileFormat Match(FileFormatScanJob job) { if (FileFormatUtils.IsNullOrEmpty(job.StartBytes)) { return(null); } if (job.StartBytes.Length < 1024) { return(null); } FlashCompressionType?compressionType = null; if (FileFormatUtils.MatchBytes(job.StartBytes, FwsSignature)) { compressionType = FlashCompressionType.Uncompressed; } else if (FileFormatUtils.MatchBytes(job.StartBytes, CwsSignature)) { compressionType = FlashCompressionType.CompressedZlib; } else if (FileFormatUtils.MatchBytes(job.StartBytes, ZwsSignature)) { compressionType = FlashCompressionType.CompressedLZMA; } if (compressionType == null) { return(null); } var fingerprint = new FlashFormat(compressionType.Value); return(fingerprint); }
public override FileFormat Match(FileFormatScanJob job) { if (FileFormatUtils.IsNullOrEmpty(job.StartBytes)) { return(null); } if (job.StartBytes.Length < DOSHeaderSize + 64 + FileHeaderSize + OptionalHeader64Size) { return(null); } var dosHeader = FileFormatUtils.Read <DOSHeader>(job.StartBytes, 0, DOSHeaderSize); if (dosHeader.e_magic != DOSMagicNumber) { return(null); } if (dosHeader.e_lfanew == 0 || dosHeader.e_lfanew >= (256 * (1024 * 1024)) || dosHeader.e_lfanew % 4 != 0 || dosHeader.e_lfanew < DOSHeaderSize || dosHeader.e_lfanew >= job.StartBytes.Length) { return(null); } if (dosHeader.e_lfanew < DOSHeaderSize) { return(null); } var stubOffset = DOSHeaderSize; var stubSize = dosHeader.e_lfanew - DOSHeaderSize; if ((stubOffset + stubSize) >= job.StartBytes.Length) { return(null); } var fileHeaderOffset = stubOffset + stubSize; var fileHeader = FileFormatUtils.Read <FileHeader>(job.StartBytes, fileHeaderOffset, FileHeaderSize); if (fileHeader.Signature != PEMagicNumber) { return(null); } var optHeaderOffset = fileHeaderOffset + FileHeaderSize; var magic = FileFormatUtils.ReadUInt16(job.StartBytes, optHeaderOffset); var is32bit = (magic == (ushort)MagicType.PE32); var is64bit = (magic == (ushort)MagicType.PE32plus); if (!is32bit && !is64bit) { return(null); } DataDirectory clrDataDirectory; if (is32bit) { if (optHeaderOffset + OptionalHeader32Size >= job.StartBytes.Length) { return(null); } var optHeader = FileFormatUtils.Read <OptionalHeader32>(job.StartBytes, optHeaderOffset, OptionalHeader32Size); clrDataDirectory = optHeader.CLRRuntimeHeader; } else { if (optHeaderOffset + OptionalHeader64Size >= job.StartBytes.Length) { return(null); } var optHeader = FileFormatUtils.Read <OptionalHeader64>(job.StartBytes, optHeaderOffset, OptionalHeader64Size); clrDataDirectory = optHeader.CLRRuntimeHeader; } var isCLR = (clrDataDirectory.Size > 0 && clrDataDirectory.VirtualAddress > 0); var fingerprint = new PortableExecutableFormat(is32bit ? PEImageFormat._32Bit : PEImageFormat._64Bit, isCLR); return(fingerprint); }
private bool ValidateEndBytes(byte[] bytes) { if (FileFormatUtils.IsNullOrEmpty(bytes)) { return(false); } if (bytes.Length < MinEndSignatureLength) { return(false); } foreach (var sig in EndSignatures) { if (FileFormatUtils.MatchBytes(bytes, bytes.Length - sig.Length, sig)) { return(true); } } var locker = new object(); var matchFound = false; // Might as well do this in parallel Parallel.ForEach(EndSignatures, sig => { lock (locker) { if (matchFound) { return; } } // Could probably replace this with Span<> one day using (var stream = new MemoryStream(bytes)) { var buffer = new byte[sig.Length]; var offset = bytes.Length - sig.Length; while (offset >= 0) { stream.Seek(offset, SeekOrigin.Begin); var numRead = stream.Read(buffer, 0, buffer.Length); if (numRead < buffer.Length) { break; } if (FileFormatUtils.MatchBytes(buffer, sig)) { lock (locker) { matchFound = true; } return; } offset--; } } }); return(matchFound); }