Merge pull request #777 from ReFirmLabs/encrpted_img

Added encrpted_img signature

src/magic.rs

@@ -1042,6 +1042,17 @@ pub fn patterns() -> Vec<signatures::common::Signature> {
             description: signatures::logfs::DESCRIPTION.to_string(),
             extractor: None,
         },
+        // encrpted_img
+        signatures::common::Signature {
+            name: "encrpted_img".to_string(),
+            short: true,
+            magic_offset: 0,
+            always_display: false,
+            magic: signatures::encrpted_img::encrpted_img_magic(),
+            parser: signatures::encrpted_img::encrpted_img_parser,
+            description: signatures::encrpted_img::DESCRIPTION.to_string(),
+            extractor: None,
+        },
     ];
 
     binary_signatures

src/signatures.rs

@@ -133,6 +133,7 @@ pub mod dxbc;
 pub mod ecos;
 pub mod efigpt;
 pub mod elf;
+pub mod encrpted_img;
 pub mod ext;
 pub mod fat;
 pub mod gif;

src/signatures/encrpted_img.rs

@@ -0,0 +1,32 @@
+use crate::signatures::common::{
+    SignatureError, SignatureResult, CONFIDENCE_LOW, CONFIDENCE_MEDIUM,
+};
+
+/// Human readable description
+pub const DESCRIPTION: &str = "D-Link Encrpted Image";
+
+/// encrpted_img firmware images always start with these bytes
+pub fn encrpted_img_magic() -> Vec<Vec<u8>> {
+    vec![b"encrpted_img".to_vec()]
+}
+
+/// Validates the encrpted_img header
+pub fn encrpted_img_parser(
+    _file_data: &[u8],
+    offset: usize,
+) -> Result<SignatureResult, SignatureError> {
+    // Successful return value
+    let mut result = SignatureResult {
+        offset,
+        description: DESCRIPTION.to_string(),
+        confidence: CONFIDENCE_MEDIUM,
+        ..Default::default()
+    };
+
+    // Nothing to really validate here
+    if offset != 0 {
+        result.confidence = CONFIDENCE_LOW;
+    }
+
+    Ok(result)
+}