Documentation ¶
Index ¶
- type Adjustment
- type Endianness
- type GUIDKind
- type IndirectOffset
- type IntegerKind
- type IntegerTest
- type Kind
- type KindFamily
- type LogFunc
- type Offset
- type OffsetType
- type PStringKind
- type ParseContext
- type RegexKind
- type Rule
- type SearchKind
- type Spellbook
- type StringKind
- type SwitchCase
- type SwitchKind
- type UseKind
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Adjustment ¶
type Adjustment int
Adjustment describes which operation to apply to an offset
const ( // AdjustmentNone is a no-op AdjustmentNone Adjustment = iota // AdjustmentAdd adds a value AdjustmentAdd // AdjustmentSub subtracts a value AdjustmentSub // AdjustmentMul multiplies by a value AdjustmentMul // AdjustmentDiv divides by a value AdjustmentDiv AdjustmentAnd )
type Endianness ¶
type Endianness int
Endianness describes the order in which a multi-byte number is stored
const ( // LittleEndian numbers are stored with the least significant byte first LittleEndian Endianness = iota // BigEndian numbers are stored with the most significant byte first BigEndian )
func (Endianness) ByteOrder ¶
func (en Endianness) ByteOrder() binary.ByteOrder
ByteOrder translates our in-house Endianness constant into a binary.ByteOrder decoder
func (Endianness) MaybeSwapped ¶
func (en Endianness) MaybeSwapped(swap bool) Endianness
MaybeSwapped returns swapped endianness if swap is true
func (Endianness) String ¶
func (en Endianness) String() string
func (Endianness) Swapped ¶
func (en Endianness) Swapped() Endianness
Swapped returns LittleEndian if you give it BigEndian, and vice versa
type IndirectOffset ¶
type IndirectOffset struct { IsRelative bool ByteWidth int Endianness Endianness OffsetAddress int64 OffsetAdjustmentType Adjustment OffsetAdjustmentIsRelative bool OffsetAdjustmentValue int64 }
IndirectOffset indicates where to look in a file to find the real offset
type IntegerKind ¶
type IntegerKind struct { ByteWidth int Endianness Endianness Signed bool DoAnd bool AndValue uint64 IntegerTest IntegerTest Value uint64 MatchAny bool AdjustmentType Adjustment AdjustmentValue int64 }
IntegerKind describes how to perform a test on an integer
type IntegerTest ¶
type IntegerTest int
IntegerTest describes which comparison to perform on an integer
const ( // IntegerTestEqual tests that two integers have the same value IntegerTestEqual IntegerTest = iota // IntegerTestNotEqual tests that two integers have different values IntegerTestNotEqual // IntegerTestLessThan tests that one integer is less than the other IntegerTestLessThan // IntegerTestGreaterThan tests that one integer is greater than the other IntegerTestGreaterThan // IntegerTestAnd tests that all the bits in the pattern are set IntegerTestAnd // IntegerTestNOTAnd tests that all the bits in the pattern are not set IntegerTestNOTAnd )
type Kind ¶
type Kind struct { Family KindFamily Data interface{} }
Kind describes the type of tests a magic rule performs
type KindFamily ¶
type KindFamily int
KindFamily groups tests in families (all integer tests, for example)
const ( // KindFamilyInteger tests numbers for equality, inequality, etc. KindFamilyInteger KindFamily = iota // KindFamilyString looks for a string, with casing and whitespace rules KindFamilyString // KindFamilyRegex looks for a string, with casing and whitespace rules KindFamilySearch // KindFamilyDefault succeeds if no tests succeeded before on that level KindFamilyDefault // KindFamilyClear resets the matched flag for that level KindFamilyClear // KindFamilyName always succeeds KindFamilyName // KindFamilyUse acts like a subroutine call, to peruse another page of rules KindFamilyUse // KindFamilySwitch is a series of merged KindFamilyInteger KindFamilySwitch KindFamilyRegex // KindFamilySearch looks for a precise string in a slice of the target KindFamilyPString // KindFamilyPString succeeds if no tests succeeded before on that level KindFamilyGUID )
type Offset ¶
type Offset struct { OffsetType OffsetType IsRelative bool Direct int64 Indirect *IndirectOffset }
Offset describes where to look to compare something
type OffsetType ¶
type OffsetType int
OffsetType describes whether an offset is direct or indirect
const ( // OffsetTypeIndirect is an offset read from somewhere in a file OffsetTypeIndirect OffsetType = iota // OffsetTypeDirect is an offset directly specified by the magic OffsetTypeDirect )
type PStringKind ¶
type ParseContext ¶
type ParseContext struct {
Logf LogFunc
}
ParseContext holds state for the parser
type RegexKind ¶
type RegexKind struct { Value []byte MaxLen int64 Flags wizardry.RegexTestFlags }
RegexKind describes how to match a regex pattern
type SearchKind ¶
SearchKind describes how to look for a fixed pattern
type StringKind ¶
type StringKind struct { Value []byte Negate bool Flags wizardry.StringTestFlags }
StringKind describes how to match a string pattern
type SwitchCase ¶
type SwitchKind ¶
type SwitchKind struct { ByteWidth int Endianness Endianness Signed bool Cases []*SwitchCase }