die-python 0.1.0__cp39-cp39-win_amd64.whl

db/zip-file

@@ -0,0 +1,92 @@
+// Detect a zip archive.
+// Author: Jason Hood <jadoxa@yahoo.com.au>
+
+includeScript("archive-file");
+sName = "Zip";
+
+function detect_Zip(bFile, bShowOptions) {
+    var nOffset = 0;
+    if (bFile) {
+        // Don't know what this is, but I happened to have a file that started
+        // with it.
+        if (File.compare("'PK00'")) {
+            nOffset = 4;
+        }
+        if (Binary.compare("'PK'0708", nOffset)) {
+            sOptions = "extended";
+            bDetected = true;
+            return;
+        }
+    } else {
+        if (File.compareOverlay("'PK'0304")) {
+            nOffset = File.getOverlayOffset();
+        } else {
+            var nSize = File.getSize();
+            if (nSize < 64) {
+                return;
+            }
+            nSize -= 11;
+            nOffset = nSize;
+            if (!File.compare("'PK'0506'", nOffset)) {
+                if (nSize < 4096) {
+                    nOffset = 0;
+                } else {
+                    nOffset -= 4096;
+                    nSize = 4096;
+                }
+                nOffset = File.findSignature(nOffset, nSize, "'PK'0506");
+                if (nOffset == -1) {
+                    return;
+                }
+                var nBase = File.readDword(nOffset + 16);
+                nOffset -= File.readDword(nOffset + 12);
+                if (!File.compare("'PK'0102", nOffset)) {
+                    return;
+                }
+                nOffset += File.readDword(nOffset + 0x2a) - nBase;
+            }
+        }
+    }
+
+    if (File.compare("'PK'0304", nOffset)) {
+        bDetected = true;
+
+        if (File.findString(nOffset, 0x40, "META-INF/MANIFEST.MF") != -1) {
+            sOptions = sOptions.append("JAR"); // Java archive
+        }
+
+        if (File.findString(nOffset, 0x40, "classes.dex") != -1) {
+            sOptions = sOptions.append("APK"); // Android application package file
+        }
+
+        var nVer = 0;
+        if (!bShowOptions) {
+            // Just take the first file and assume it carries through.
+            if (File.readByte(nOffset + 6) & 1) {
+                sOptions = "encrypted";
+            }
+            nVer = File.readByte(nOffset + 4);
+        } else {
+            var bEncrypted = 0;
+            do {
+                var v = File.readByte(nOffset + 4);
+                if (v > nVer) {
+                    nVer = v;
+                }
+                if (!bEncrypted && (File.readByte(nOffset + 6) & 1)) {
+                    bEncrypted = 1;
+                }
+                var nPacked = File.readDword(nOffset + 0x12);
+                var nName = File.readWord(nOffset + 0x1A);
+                Archive.add(File.readDword(nOffset + 0x16), nPacked,
+                    nPacked == 0 && File.readByte(nOffset + 0x1E + nName - 1) == 0x2F);
+                nOffset += 0x1E + nName + File.readWord(nOffset + 0x1C) + nPacked;
+            } while (File.compare("'PK'0304", nOffset));
+            if (bEncrypted) {
+                sOptions = "encrypted";
+            }
+            sOptions = sOptions.append(Archive.contents());
+        }
+        sVersion = (nVer / 10).toFixed(1);
+    }
+}

db/zlib

@@ -0,0 +1,23 @@
+// Detect a ZLIB.
+// Author: LinXP
+
+function detect_zlib(bFile, nOffset, bShowOptions) {
+    var sInfo = "ZLIB compression";
+    if (bFile.compare("7801", nOffset)) {
+        if (bFile.isVerbose()) { sInfo += " fastest" }
+        sOptions = sOptions.append(sInfo);
+        return true;
+    } else if (bFile.compare("785E", nOffset)) {
+        if (bFile.isVerbose()) { sInfo += " fast" }
+        sOptions = sOptions.append(sInfo);
+        return true;
+    } else if (bFile.compare("789C", nOffset)) {
+        if (bFile.isVerbose()) { sInfo += " normal" }
+        sOptions = sOptions.append(sInfo);
+        return true;
+    } else if (bFile.compare("78DA", nOffset)) {
+        if (bFile.isVerbose()) { sInfo += " best" }
+        sOptions = sOptions.append(sInfo);
+        return true;
+    }
+}

die/__init__.py

@@ -0,0 +1,79 @@
+import enum
+import pathlib
+
+from typing import Generator, Optional, Union
+
+from ._die import __version__  # type: ignore
+from ._die import DieFlags as _DieFlags  # type: ignore
+from ._die import ScanFileA as _ScanFileA  # type: ignore
+from ._die import die_version, dielib_version  # type: ignore
+
+version_major, version_minor, version_patch = map(int, __version__.split("."))
+
+database_path = pathlib.Path(__path__[0]) / "db"
+"""Path to the DIE signature database"""
+
+
+class ScanFlags(enum.IntFlag):
+    ALL_TYPES_SCAN = _DieFlags.AlltypesScan.value
+    DEEP_SCAN = _DieFlags.Deepscan.value
+    HEURISTIC_SCAN = _DieFlags.HeuristicScan.value
+    RECURSIVE_SCAN = _DieFlags.RecursiveScan.value
+    RESULT_AS_CSV = _DieFlags.ResultAsCsv.value
+    RESULT_AS_JSON = _DieFlags.ResultAsJson.value
+    RESULT_AS_TSV = _DieFlags.ResultAsTsv.value
+    RESULT_AS_XML = _DieFlags.ResultAsXml.value
+    VERBOSE_FLAG = _DieFlags.Verbose.value
+
+
+def scan_file(
+    filepath: Union[pathlib.Path, str], flags: ScanFlags, database: str = ""
+) -> Optional[str]:
+    """
+    Scan the given file against the signature database
+
+    Arguments:
+        filepath: Union[pathlib.Path, str]
+        flags: ScanFlags
+        database: str = ""
+
+    Returns:
+        Optional[str]
+    """
+    # Check `filepath`
+    if isinstance(filepath, str):
+        _fpath = pathlib.Path(filepath)
+    elif isinstance(filepath, pathlib.Path):
+        _fpath = filepath
+    else:
+        raise TypeError
+    assert _fpath.exists()
+
+    # Check `database`
+    if not isinstance(database, str):
+        raise TypeError
+    else:
+        _db = database
+
+    res = _ScanFileA(str(_fpath), flags, _db)
+    if not res:
+        return None
+    return res.strip()
+
+
+def databases() -> Generator[pathlib.Path, None, None]:
+    """
+    Enumerate all databases
+
+    Returns:
+        Generator[pathlib.Path, None, None]
+    """
+
+    def __enum_db(root: pathlib.Path) -> Generator[pathlib.Path, None, None]:
+        for child in root.iterdir():
+            if child.is_file():
+                yield child
+            if child.is_dir():
+                yield from __enum_db(child)
+
+    return __enum_db(database_path)

die/db/db/ACE

@@ -0,0 +1,45 @@
+// Detect an ACE archive.
+// Author: Jason Hood <jadoxa@yahoo.com.au>
+/*
+   Only tested with 2.04.
+*/
+
+includeScript("archive-file");
+sName = "ACE";
+
+function detect_ACE(bFile, bShowOptions) {
+    var nOffset, nSize;
+    if (bFile) {
+        nOffset = 0;
+        nSize = File.getSize();
+    } else {
+        nOffset = File.getOverlayOffset();
+        nSize = File.getOverlaySize();
+    }
+    if (nSize > 48) {
+        if (File.compare("'**ACE**'", nOffset + 7)) {
+            bDetected = 1;
+            sVersion = "2";
+            if (File.readByte(nOffset + 6) & 0x80) {
+                sOptions = "solid";
+            }
+            if (File.compare("'UNREGISTERED'", nOffset + 32)) {
+                sOptions = sOptions.append("unregistered");
+            }
+            if (bShowOptions) {
+                // Not sure about this...
+                var nOffset = File.findSignature(nOffset + 0x20, 128, "000101");
+                if (nOffset != -1) {
+                    nOffset -= 3;
+                    while (nOffset < File.getSize()) {
+                        var nPacked = File.readDword(nOffset + 7);
+                        Archive.add(File.readDword(nOffset + 11), nPacked,
+                            File.readByte(nOffset + 19) & 16);
+                        nOffset += 0x23 + File.readWord(nOffset + 0x21) + nPacked;
+                    }
+                    sOptions = sOptions.append(Archive.contents());
+                }
+            }
+        }
+    }
+}

die/db/db/APK/PackageName.1.sg

@@ -0,0 +1,15 @@
+// DIE's signature file
+
+init("package", "");
+
+function detect(bShowType, bShowVersion, bShowOptions) {
+    var _sName = APK.getAndroidManifestRecord("package");
+
+    if (_sName != "") {
+        sName = _sName;
+        sVersion = APK.getAndroidManifestRecord("android:versionName");
+        bDetected = true;
+    }
+
+    return result(bShowType, bShowVersion, bShowOptions);
+}

die/db/db/APK/SingleJar.3.sg

@@ -0,0 +1,10 @@
+// DIE's signature file
+
+init("tool", "SingleJar");
+
+function detect(bShowType, bShowVersion, bShowOptions) {
+
+    bDetected = APK.getManifestRecord("Created-By") == "singlejar";
+
+    return result(bShowType, bShowVersion, bShowOptions);
+}

die/db/db/APK/_APK.0.sg

@@ -0,0 +1,15 @@
+// DIE's signature file
+
+init("operation system", "Android");
+
+function detect(bShowType, bShowVersion, bShowOptions) {
+    if (APK.isVerbose()) {
+        sName = APK.getOperationSystemName();
+        sVersion = APK.getOperationSystemVersion();
+        sOptions = APK.getOperationSystemOptions();
+
+        bDetected = true;
+    }
+
+    return result(bShowType, bShowVersion, bShowOptions);
+}

die/db/db/APK/_init

@@ -0,0 +1,4 @@
+var File = APK;
+var X = APK;
+
+includeScript("result-general");

die/db/db/Archive/_init

@@ -0,0 +1,4 @@
+var File = Archive;
+var X = Archive;
+
+includeScript("result-general");

die/db/db/Binary/Amiga loadable.1.sg

@@ -0,0 +1,16 @@
+// https://github.com/horsicq/Detect-It-Easy signature file
+// Author: Kaens (TG @kaens)
+
+init("format", "");
+
+function detect(bShowType, bShowVersion, bShowOptions) {
+    if (Binary.compare("000003F300")) {
+        bDetected = true;
+        sName = "Amiga loadable file";
+    } else if (Binary.compare("000003E700")) {
+        bDetected = true;
+        sName = "Amiga object/library file";
+    }
+
+    return result(bShowType, bShowVersion, bShowOptions);
+}

die/db/db/Binary/Empty.1.sg

@@ -0,0 +1,11 @@
+// DIE's signature file
+
+init("format", "empty file");
+
+function detect(bShowType, bShowVersion, bShowOptions) {
+    if (Binary.getSize() == 0) {
+        bDetected = true;
+    }
+
+    return result(bShowType, bShowVersion, bShowOptions);
+}

die/db/db/Binary/Img.UDIF.1.sg

@@ -0,0 +1,15 @@
+// DIE's signature file
+
+init("format", "Universal Disk Image Format");
+
+function detect(bShowType, bShowVersion, bShowOptions) {
+    if (Binary.compare("7801730d62626060")) {
+        sOptions = "read-only zlib-compressed";
+        bDetected = true;
+    } else if (Binary.compare("45520200") && Binary.compare("'disk image'", 0x410)) {
+        sOptions = "read/write";
+        bDetected = true;
+    }
+
+    return result(bShowType, bShowVersion, bShowOptions);
+}

die/db/db/Binary/RIFF.1.sg

@@ -0,0 +1,19 @@
+// DIE's signature file
+// Author: hypn0 <hypn0@mail.ru>
+
+init("format", "");
+
+function detect(bShowType, bShowVersion, bShowOptions) {
+    if (Binary.compare("'RIFF'........'CDR'")) {
+        sName = "CorelDraw graphics (.CDR)";
+        bDetected = true;
+    } else if (Binary.compare("'RIFF'........'AVI '")) {
+        sName = "AVI";
+        bDetected = true;
+    } else if (Binary.compare("'RIFF'........'WEBPVP8'")) {
+        sName = "WebP";
+        bDetected = true;
+    }
+
+    return result(bShowType, bShowVersion, bShowOptions);
+}