infer/matchers/
archive.rs

Help
1/// Returns whether a buffer is an ePub.
2pub fn is_epub(buf: &[u8]) -> bool {
3    buf.len() > 57
4        && buf[0] == 0x50
5        && buf[1] == 0x4B
6        && buf[2] == 0x3
7        && buf[3] == 0x4
8        && buf[30] == 0x6D
9        && buf[31] == 0x69
10        && buf[32] == 0x6D
11        && buf[33] == 0x65
12        && buf[34] == 0x74
13        && buf[35] == 0x79
14        && buf[36] == 0x70
15        && buf[37] == 0x65
16        && buf[38] == 0x61
17        && buf[39] == 0x70
18        && buf[40] == 0x70
19        && buf[41] == 0x6C
20        && buf[42] == 0x69
21        && buf[43] == 0x63
22        && buf[44] == 0x61
23        && buf[45] == 0x74
24        && buf[46] == 0x69
25        && buf[47] == 0x6F
26        && buf[48] == 0x6E
27        && buf[49] == 0x2F
28        && buf[50] == 0x65
29        && buf[51] == 0x70
30        && buf[52] == 0x75
31        && buf[53] == 0x62
32        && buf[54] == 0x2B
33        && buf[55] == 0x7A
34        && buf[56] == 0x69
35        && buf[57] == 0x70
36}
37
38/// Returns whether a buffer is a zip archive.
39pub fn is_zip(buf: &[u8]) -> bool {
40    buf.len() > 3
41        && buf[0] == 0x50
42        && buf[1] == 0x4B
43        && (buf[2] == 0x3 || buf[2] == 0x5 || buf[2] == 0x7)
44        && (buf[3] == 0x4 || buf[3] == 0x6 || buf[3] == 0x8)
45}
46
47/// Returns whether a buffer is a tar archive.
48pub fn is_tar(buf: &[u8]) -> bool {
49    buf.len() > 261
50        && buf[257] == 0x75
51        && buf[258] == 0x73
52        && buf[259] == 0x74
53        && buf[260] == 0x61
54        && buf[261] == 0x72
55}
56
57/// Returns whether a buffer is a RAR archive.
58pub fn is_rar(buf: &[u8]) -> bool {
59    buf.len() > 6
60        && buf[0] == 0x52
61        && buf[1] == 0x61
62        && buf[2] == 0x72
63        && buf[3] == 0x21
64        && buf[4] == 0x1A
65        && buf[5] == 0x7
66        && (buf[6] == 0x0 || buf[6] == 0x1)
67}
68
69/// Returns whether a buffer is a gzip archive.
70pub fn is_gz(buf: &[u8]) -> bool {
71    buf.len() > 2 && buf[0] == 0x1F && buf[1] == 0x8B && buf[2] == 0x8
72}
73
74/// Returns whether a buffer is a bzip archive.
75pub fn is_bz2(buf: &[u8]) -> bool {
76    buf.len() > 2 && buf[0] == 0x42 && buf[1] == 0x5A && buf[2] == 0x68
77}
78
79/// Returns whether a buffer is a 7z archive.
80pub fn is_7z(buf: &[u8]) -> bool {
81    buf.len() > 5
82        && buf[0] == 0x37
83        && buf[1] == 0x7A
84        && buf[2] == 0xBC
85        && buf[3] == 0xAF
86        && buf[4] == 0x27
87        && buf[5] == 0x1C
88}
89
90/// Returns whether a buffer is a PDF.
91pub fn is_pdf(buf: &[u8]) -> bool {
92    buf.len() > 3 && buf[0] == 0x25 && buf[1] == 0x50 && buf[2] == 0x44 && buf[3] == 0x46
93}
94
95/// Returns whether a buffer is a SWF.
96pub fn is_swf(buf: &[u8]) -> bool {
97    buf.len() > 2 && (buf[0] == 0x43 || buf[0] == 0x46) && buf[1] == 0x57 && buf[2] == 0x53
98}
99
100/// Returns whether a buffer is an RTF.
101pub fn is_rtf(buf: &[u8]) -> bool {
102    buf.len() > 4
103        && buf[0] == 0x7B
104        && buf[1] == 0x5C
105        && buf[2] == 0x72
106        && buf[3] == 0x74
107        && buf[4] == 0x66
108}
109
110/// Returns whether a buffer is a Nintendo NES ROM.
111pub fn is_nes(buf: &[u8]) -> bool {
112    buf.len() > 3 && buf[0] == 0x4E && buf[1] == 0x45 && buf[2] == 0x53 && buf[3] == 0x1A
113}
114
115/// Returns whether a buffer is Google Chrome Extension
116pub fn is_crx(buf: &[u8]) -> bool {
117    buf.len() > 3 && buf[0] == 0x43 && buf[1] == 0x72 && buf[2] == 0x32 && buf[3] == 0x34
118}
119
120/// Returns whether a buffer is a CAB.
121pub fn is_cab(buf: &[u8]) -> bool {
122    buf.len() > 3
123        && ((buf[0] == 0x4D && buf[1] == 0x53 && buf[2] == 0x43 && buf[3] == 0x46)
124            || (buf[0] == 0x49 && buf[1] == 0x53 && buf[2] == 0x63 && buf[3] == 0x28))
125}
126
127/// Returns whether a buffer is a eot octet stream.
128pub fn is_eot(buf: &[u8]) -> bool {
129    buf.len() > 35
130        && buf[34] == 0x4C
131        && buf[35] == 0x50
132        && ((buf[8] == 0x02 && buf[9] == 0x00 && buf[10] == 0x01)
133            || (buf[8] == 0x01 && buf[9] == 0x00 && buf[10] == 0x00)
134            || (buf[8] == 0x02 && buf[9] == 0x00 && buf[10] == 0x02))
135}
136
137/// Returns whether a buffer is postscript.
138pub fn is_ps(buf: &[u8]) -> bool {
139    buf.len() > 1 && buf[0] == 0x25 && buf[1] == 0x21
140}
141
142/// Returns whether a buffer is xz archive.
143pub fn is_xz(buf: &[u8]) -> bool {
144    buf.len() > 5
145        && buf[0] == 0xFD
146        && buf[1] == 0x37
147        && buf[2] == 0x7A
148        && buf[3] == 0x58
149        && buf[4] == 0x5A
150        && buf[5] == 0x00
151}
152
153/// Returns whether a buffer is a sqlite3 database.
154///
155/// # Example
156///
157/// ```rust
158/// use std::fs;
159/// assert!(infer::archive::is_sqlite(&fs::read("testdata/sample.db").unwrap()));
160/// ```
161pub fn is_sqlite(buf: &[u8]) -> bool {
162    buf.len() > 3 && buf[0] == 0x53 && buf[1] == 0x51 && buf[2] == 0x4C && buf[3] == 0x69
163}
164
165/// Returns whether a buffer is a deb archive.
166pub fn is_deb(buf: &[u8]) -> bool {
167    buf.len() > 20
168        && buf[0] == 0x21
169        && buf[1] == 0x3C
170        && buf[2] == 0x61
171        && buf[3] == 0x72
172        && buf[4] == 0x63
173        && buf[5] == 0x68
174        && buf[6] == 0x3E
175        && buf[7] == 0x0A
176        && buf[8] == 0x64
177        && buf[9] == 0x65
178        && buf[10] == 0x62
179        && buf[11] == 0x69
180        && buf[12] == 0x61
181        && buf[13] == 0x6E
182        && buf[14] == 0x2D
183        && buf[15] == 0x62
184        && buf[16] == 0x69
185        && buf[17] == 0x6E
186        && buf[18] == 0x61
187        && buf[19] == 0x72
188        && buf[20] == 0x79
189}
190
191/// Returns whether a buffer is a ar archive.
192pub fn is_ar(buf: &[u8]) -> bool {
193    buf.len() > 6
194        && buf[0] == 0x21
195        && buf[1] == 0x3C
196        && buf[2] == 0x61
197        && buf[3] == 0x72
198        && buf[4] == 0x63
199        && buf[5] == 0x68
200        && buf[6] == 0x3E
201}
202
203/// Returns whether a buffer is a z archive.
204pub fn is_z(buf: &[u8]) -> bool {
205    buf.len() > 1 && buf[0] == 0x1F && (buf[1] == 0xA0 || buf[1] == 0x9D)
206}
207
208/// Returns whether a buffer is a lzip archive.
209pub fn is_lz(buf: &[u8]) -> bool {
210    buf.len() > 3 && buf[0] == 0x4C && buf[1] == 0x5A && buf[2] == 0x49 && buf[3] == 0x50
211}
212
213/// Returns whether a buffer is an RPM.
214pub fn is_rpm(buf: &[u8]) -> bool {
215    buf.len() > 96 && buf[0] == 0xED && buf[1] == 0xAB && buf[2] == 0xEE && buf[3] == 0xDB
216}
217
218/// Returns whether a buffer is a dcm archive.
219pub fn is_dcm(buf: &[u8]) -> bool {
220    buf.len() > 131 && buf[128] == 0x44 && buf[129] == 0x49 && buf[130] == 0x43 && buf[131] == 0x4D
221}
222
223/// Returns whether a buffer is a Zstd archive.
224pub fn is_zst(buf: &[u8]) -> bool {
225    buf.len() > 3 && buf[0] == 0x28 && buf[1] == 0xB5 && buf[2] == 0x2F && buf[3] == 0xFD
226}
infer/matchers/archive.rs

infer/matchers/
archive.rs
