51 lines
1.6 KiB
Python
51 lines
1.6 KiB
Python
import io
|
|
from .matcher import SignatureMatcher, Match
|
|
|
|
class SquashFS(SignatureMatcher):
|
|
"""
|
|
Finding a Squash file system
|
|
https://dr-emann.github.io/squashfs/
|
|
|
|
superblock
|
|
-> compression options
|
|
-> data blocks & fragments
|
|
-> inode table
|
|
-> directory table
|
|
-> fragment table
|
|
-> export table
|
|
-> uid/gid lookup table
|
|
-> xattr table
|
|
"""
|
|
def __init__(self, file):
|
|
self.name = "SquashFS"
|
|
self.signature = b'hsqs'
|
|
super().__init__(file)
|
|
|
|
def is_valid(self):
|
|
for match in self.search():
|
|
start = match
|
|
header = io.BytesIO(self.file[start:start+ 4*5 + 2*6 + 8*8])
|
|
magic = header.read(4)
|
|
inode = header.read(4)
|
|
modification_time = header.read(4)
|
|
block_size = header.read(4)
|
|
fragment_entry_count = header.read(4)
|
|
compression_id = header.read(2)
|
|
block_log = header.read(2)
|
|
flags = header.read(2)
|
|
id_count = header.read(2)
|
|
version_major = header.read(2)
|
|
version_minor = header.read(2)
|
|
root_inode_ref = header.read(8)
|
|
bytes_used = header.read(8)
|
|
id_table_start = header.read(8)
|
|
xattr_id_table_start = header.read(8)
|
|
inode_table_start = header.read(8)
|
|
directory_table_start = header.read(8)
|
|
fragment_table_start = header.read(8)
|
|
export_table_start = header.read(8)
|
|
|
|
# size how to get?
|
|
self.matches += [Match(start, 0)]
|
|
return len(self.matches) != 0
|