import io from .matcher import SignatureMatcher, Match class SquashFS(SignatureMatcher): """ Finding a Squash file system https://dr-emann.github.io/squashfs/ superblock -> compression options -> data blocks & fragments -> inode table -> directory table -> fragment table -> export table -> uid/gid lookup table -> xattr table """ def __init__(self, file): self.name = "SquashFS" self.signature = b'hsqs' super().__init__(file) def is_valid(self): for match in self.search(): start = match header = io.BytesIO(self.file[start:start+ 4*5 + 2*6 + 8*8]) magic = header.read(4) inode = header.read(4) modification_time = header.read(4) block_size = header.read(4) fragment_entry_count = header.read(4) compression_id = header.read(2) block_log = header.read(2) flags = header.read(2) id_count = header.read(2) version_major = header.read(2) version_minor = header.read(2) root_inode_ref = header.read(8) bytes_used = header.read(8) id_table_start = header.read(8) xattr_id_table_start = header.read(8) inode_table_start = header.read(8) directory_table_start = header.read(8) fragment_table_start = header.read(8) export_table_start = header.read(8) # size how to get? self.matches += [Match(start, 0)] return len(self.matches) != 0