die-python 0.4.0__cp313-abi3-win_amd64.whl

die/db/db/Binary/image.TIFF.1.sg

@@ -0,0 +1,186 @@
+// Detect It Easy: detection rule file
+// Author: LinXP
+// Status: WIP
+// doc-ref:
+
+init("image", "Tagged Image File Format (.TIFF)");
+
+function detect() {
+    if (Binary.getSize() >= 0x0E) {
+        bDetected = true;
+        switch (Binary.read_uint32(0x00, _BE)) {
+            case 0x4D4D002A:
+                var bEndian = _BE;
+                sOption("BE");
+                break;
+            case 0x49492A00:
+                var bEndian = _LE;
+                sOption("LE");
+                break;
+            default:
+                bDetected = false;
+        }
+
+        if (bDetected) {
+            var nOffset = Binary.read_uint32(0x04, bEndian);
+            var nTagCount = Binary.read_uint16(nOffset, bEndian);
+            nOffset += 2;
+            var nWidth, nHeight, nBPS, nCol, nComp;
+            while (nTagCount--) {
+                var nTag = Binary.read_uint16(nOffset, bEndian);
+                var nType = Binary.read_uint16(nOffset + 2, bEndian);
+                var nCount = Binary.read_uint32(nOffset + 4, bEndian);
+                switch (nTag) {
+                    case 0x100: // ImageWidth (256)
+                        nWidth = ReadTagValue(nType);
+                        break;
+
+                    case 0x101: // ImageLength (257)
+                        nHeight = ReadTagValue(nType);
+                        break;
+
+                    case 0x102: // BitsPerSample (258)
+                        nBPS = nCount * ReadTagValue(nType);
+                        break;
+
+                    case 0x103: // Compression (259)
+                        nComp = ReadTagValue(nType);
+                        break;
+
+                    case 0x106: // PhotometricInterpretation (262)
+                        nCol = ReadTagValue(nType);
+                        break;
+
+                    case 271: // Make (271)
+                        sOption("Make:" + ReadTagValue(nType));
+                        break;
+
+                    case 50706: // DNGVersion (50706)
+                        sName = "Digital Negative (.DNG)"
+                        break;
+                    default:
+
+                }
+                nOffset += 0x0C;
+
+            }
+
+
+            switch (nComp) {
+                case 1:
+                    sOption("Uncompressed");
+                    break;
+                case 2:
+                    sOption("Huffman");
+                    break;
+                case 3:
+                    sOption("Group 3");
+                    break;
+                case 4:
+                    sOption("Group 4");
+                    break;
+                case 5:
+                    sOption("LZW");
+                    break;
+                case 6:
+                    sOption("embedded JPEG (602Photo software)");
+                    break;
+                case 7:
+                    sOption("JPEG");
+                    break;
+                case 32771:
+                    sOption("Alchemy software type 6 unknown compression");
+                    break;
+                case 32773:
+                    sOption("PackBits");
+                    break;
+                case 32946:
+                    sOption("Deflate");
+                    break;
+                case 34690:
+                    sOption("LDF bitonal");
+                    break;
+                case 65000:
+                    sOption("Kodak DCR");
+                    sName = "Kodak DCS Pro SLR (.DCR)";
+                    break;
+            }
+            if (nWidth != 0 && nHeight != 0) {
+                sOption(nWidth + "x" + nHeight);
+            }
+            sOption(nBPS + "-bit ");
+            switch (nCol) {
+                case 0:
+                    sOption("W/B");
+                    break;
+                case 1:
+                    sOption("B/W");
+                    break;
+                case 2:
+                    sOption("RGB");
+                    break;
+                case 3:
+                    sOption("index");
+                    break;
+            }
+        }
+    }
+
+    function ReadTagValue(nType) {
+        var nTempValue = 0,
+            nTempOffset = 0;
+        switch (nType) {
+            case 1: // eBYTE
+                break;
+            case 2: // eASCII
+                nTempOffset = Binary.read_uint32(nOffset + 8, bEndian);
+                nTempValue = Binary.getString(nTempOffset, nCount);
+                return nTempValue;
+                break;
+            case 3: // eSHORT
+                if (nCount == 1) {
+                    nTempValue = Binary.read_uint16(nOffset + 8, bEndian);
+                    return nTempValue;
+                } else {
+                    nTempOffset = Binary.read_uint32(nOffset + 8, bEndian);
+                    while (nCount--) {
+                        nTempValue = Binary.read_uint16(nTempOffset, bEndian);
+                        nTempOffset += 2;
+                    }
+                    return nTempValue;
+                }
+                break;
+            case 4: // eLONG
+                if (nCount == 1) {
+                    nTempValue = Binary.read_uint32(nOffset + 8, bEndian);
+                    return nTempValue;
+                } else {
+                    nTempOffset = Binary.read_uint32(nOffset + 8, bEndian);
+                    while (nCount--) {
+                        nTempValue = Binary.read_uint32(nTempOffset, bEndian);
+                        nTempOffset += 4;
+                    }
+                    return nTempValue;
+                }
+                break;
+            case 5: // eRATIONAL
+                break;
+            case 6: // eSBYTE
+                break;
+            case 7: // eUNDEF
+                break;
+            case 8: // eSSHORT
+                break;
+            case 9: // eSLONG
+                break;
+            case 10: // eSRATIONAL
+                break;
+            case 11: // eFLOAT
+                break;
+            case 12: // eDOUBLE
+                break;
+        }
+    }
+
+    return result();
+}

die/db/db/Binary/image.XAR.1.sg

@@ -0,0 +1,31 @@
+// Detect It Easy: detection rule file
+// Author: LinXP
+// doc-ref: http://site.xara.com/support/docs/webformat/spec/XARFormatDocument.pdf
+init("image", "Xar Vector graphic file (.XAR)");
+
+function detect() {
+    if (Binary.getSize() >= 0x40) {
+        if (Binary.compare("'XARA'A3A30D0A")) {
+            bDetected = true;
+            var sProducer = Binary.getString(0x1F);
+            var sProducerVersion = Binary.getString(0x1F + sProducer.length + 1);
+            var sProducerBuild = Binary.getString(0x1F + sProducer.length + 1 + sProducerVersion.length + 1);
+            sName = sProducer + " Document (.XAR)";
+            sVersion = sProducerVersion;
+            if (Binary.isVerbose()) {
+                sOption("build:" + sProducerBuild);
+                switch (Binary.getString(0x10, 3)) {
+                    case 'CXW':
+                        sOption("Web file");
+                        break;
+                    case 'CXN':
+                        sOption("Paper-publishable file");
+                        break;
+                        //default: bDetected=false;
+                }
+            }
+        }
+    }
+
+    return result();
+}

die/db/db/Binary/img.VM.1.sg

@@ -0,0 +1,13 @@
+// Detect It Easy: detection rule file
+// Author: hypn0 <hypn0@mail.ru> & Arjan Onwezen
+
+init("format", "VMWare Virtual Disk (VMDK)");
+
+function detect() {
+    if (Binary.compare("'KDMV'01") || Binary.compare("'KDMV'02") || Binary.compare("'KDMV'03")) {
+        bDetected = true;
+        sVersion = "v" + File.read_uint8(4)
+    }
+
+    return result();
+}

die/db/db/Binary/overlays.6.sg

@@ -0,0 +1,367 @@
+// Detect It Easy: detection rule file
+// Author: hypn0 <hypn0@mail.ru>
+
+init("data", "");
+
+function detect() {
+    if (Binary.isOverlay()) {
+        if (Binary.compare("'aWAW'")) {
+            sName = "CreateInstall data";
+            bDetected = true;
+        } else if (Binary.compare("';!@Install@!UTF-8!'")) {
+            sName = "7-zip Installer data";
+            bDetected = true;
+        } else if (Binary.compare("00'TMSAMVOH'")) {
+            sName = "ActiveMark protector data";
+            bDetected = true;
+        } else if (Binary.compare("....................'MSCF'00")) {
+            sName = "Actual Installer data";
+            bDetected = true;
+        } else if (Binary.compare("'10JP'")) {
+            sName = "Adveractive Installer data";
+            bDetected = true;
+        } else if (Binary.compare("'EWETAR DATA FILE!! VER 1.00 <<<>>>'")) {
+            sName = "Aeco Systems installer data";
+            bDetected = true;
+        } else if (Binary.compare("c0ab........60ea")) {
+            sName = "ARJSFX32 data";
+            bDetected = true;
+        } else if (Binary.compare("67570402")) {
+            sName = "ARQ archive";
+            bDetected = true;
+        } else if (Binary.compare("0b0bafaf0b0ba4")) {
+            sName = "AutoPlay Media Studio installer data";
+            bDetected = true;
+        } else if (Binary.compare("'wwgT)'") || Binary.compare("..120100....0000")) {
+            sName = "ClickTeam installer data";
+            bDetected = true;
+        } else if (Binary.compare("'CK16'")) {
+            sName = "CrypKey Installer archive";
+            bDetected = true;
+        } else if (Binary.compare("........'DIMDMSCF'")) {
+            sName = "Dimd SFX data";
+            sOptions = "CAB";
+            bDetected = true;
+        } else if (Binary.compare("'[metadata]'")) {
+            sName = "distutils installer data";
+            bDetected = true;
+        } else if (Binary.compare("b297e169")) {
+            sName = "Envoy Packager data";
+            bDetected = true;
+        } else if (Binary.compare("'EPSF'")) {
+            sName = "Eschalon Installer archive";
+            bDetected = true;
+        } else if (Binary.compare("........'SPIS'1a'LH5'")) {
+            sName = "GPInstall data";
+            sOptions = "SPIS LH5";
+            bDetected = true;
+        } else if (Binary.compare("'zlb'1A") || Binary.compare("'idska32'1A")) {
+            sName = "Inno Setup Installer data";
+            bDetected = true;
+        } else if (Binary.compare("'Inno Setup Messages'")) {
+            sName = "Inno Setup uninstall data";
+            bDetected = true;
+        } else if (Binary.compare("'1CNT'")) {
+            sName = "LucasArts Update Installer data";
+            bDetected = true;
+        } else if (Binary.compare("'MPU'0d")) {
+            sName = "MP-ZipTool SFX32 data";
+            bDetected = true;
+        } else if (Binary.compare("'MPQ'1a20")) {
+            sName = "MPQ archive";
+            bDetected = true;
+        } else if (Binary.compare("'PK??NOS_PO'") || Binary.compare("'NOS_PO'")) {
+            sName = "NOS Installer data";
+            bDetected = true;
+        } else if (Binary.compare("970300000201")) {
+            sName = "Pantaray QSetup data";
+            sVersion = "10.x";
+            bDetected = true;
+        } else if (Binary.compare("370700000201")) {
+            sName = "Pantaray QSetup data";
+            sVersion = "11.x";
+            bDetected = true;
+        } else if (Binary.compare("04'PBG'")) {
+            sName = "Paquet archive";
+            bDetected = true;
+        } else if (Binary.compare("'PB'................................'7z'")) {
+            sName = "Paquet Builder";
+            sOptions = "7zip";
+            bDetected = true;
+        } else if (Binary.compare("'qres'")) {
+            sName = "QT installer data";
+            bDetected = true;
+        } else if (Binary.compare("4B2A9A") || Binary.compare("4B2A84")) {
+            sName = "RTPatch archive";
+            bDetected = true;
+        } else if (Binary.compare("e0e0e1e1e2e2e3e3e4e4e5e5e6e6e7e7")) {
+            sName = "Setup Factory installer data";
+            sVersion = "8.x, 9.x";
+            bDetected = true;
+        } else if (Binary.compare("e0e1e2e3e4e5e6")) {
+            sName = "Setup Factory installer data";
+            sVersion = "4.x, 5.x";
+            bDetected = true;
+        } else if (Binary.compare("67155234ff4d3642")) {
+            sName = "STATICSUP installer data";
+            bDetected = true;
+        } else if (Binary.compare("'ESIV'") || Binary.compare("'SIVM'", 0xf000)) {
+            sName = "Vise Installer data";
+            bDetected = true;
+        } else if (Binary.compare("'RsDl'")) {
+            sName = "WinImage SFX data";
+            bDetected = true;
+        } else if (Binary.compare("'IMP'0a")) {
+            sName = "IMP archive";
+            bDetected = true;
+        } else if (Binary.compare("'@Daisy@Lucy@xyzzy@'................1f8b08")) {
+            sName = "WinPatch Apply Program data";
+            sOptions = "gzip";
+            bDetected = true;
+        } else if (Binary.compare("'@Daisy@Lucy@xyzzy@'1f8b08")) {
+            sName = "WinPatch Apply Program data";
+            sOptions = "gzip";
+            bDetected = true;
+        } else if (Binary.compare("'***messages***'")) {
+            sName = "WinRAR Installer data";
+            bDetected = true;
+        } else if (Binary.compare("fffe2a002a002a006d0065007300730061006700650073002a002a002a00")) {
+            sName = "WinRAR Installer data";
+            sVersion = "5.x";
+            bDetected = true;
+        }
+        /* else if(Binary.compare("'Rar!'"))
+        {
+            sName="RAR archive";
+            bDetected=1;
+        } */
+        else if (Binary.compare("'MPV*'")) {
+            sName = "ZipCentral SFX-32 data";
+            bDetected = true;
+        } else if (Binary.compare("'[20/20]'")) {
+            sName = "PCInstall data";
+            bDetected = true;
+        } else if (Binary.compare("'ISSetupStream'")) {
+            sName = "InstallShield data";
+            sVersion = "18.x";
+            bDetected = true;
+        } else if (Binary.compare("'FWS'") || Binary.compare("'CWS'")) {
+            sName = "Adobe Flash";
+            bDetected = true;
+        } else if (Binary.compare("'Smart Install Maker v'")) {
+            sName = "Smart Install Maker data";
+            sVersion = Binary.getString(Binary.getOverlayOffset() + 0x17);
+            bDetected = true;
+        } else if (Binary.compare("....0000dcedbd")) {
+            sName = "PackageForTheWeb data";
+            sOptions = "InstallShield";
+            bDetected = true;
+        } else if (Binary.compare("'00000000000000BD00000000000000010000000000000001'", 0x19a0)) {
+            sName = "Autodesk Self-Extract data";
+            bDetected = true;
+        } else if (Binary.compare("c0dececb8d8d8d8d")) {
+            sName = "Ghost Installer archive";
+            sOptions = "xored MSCF, mask: 8D";
+            bDetected = true;
+        } else if (Binary.compare("02060a0405fd59")) {
+            sName = "CreateInstall data";
+            sVersion = "2003.3.5";
+            bDetected = true;
+        } else if (Binary.compare("'RWMV'")) {
+            sName = "VMWare Installation Launcher data";
+            bDetected = true;
+        } else if (Binary.compare("........'GRCSETUPINFORMATION'")) {
+            sName = "Codegear Installer data";
+            bDetected = true;
+        } else if (Binary.compare("'xvm'0003")) {
+            sName = "Spoon Studio data";
+            bDetected = true;
+        } else if (Binary.compare("2f30ee1f5e4ee51e")) {
+            sName = "Advanced Installer data";
+            sOptions = "MS Compound-like format";
+            bDetected = true;
+        } else if (Binary.compare("'^OPT'")) {
+            var ArcOffset = Binary.findString(Binary.getOverlayOffset(), 0x50, "^ARC");
+            if (ArcOffset != -1) {
+                if (Binary.compare("1f8b08", ArcOffset + 4)) {
+                    sName = "Adobe SVG Installer";
+                    sOptions = "gzip";
+                    bDetected = true;
+                }
+            }
+        } else if (Binary.compare("07d26cbf2159abaa0100000000")) {
+            sName = "Chilkat ZIP Self-Extractor data";
+            bDetected = true;
+        } else if (Binary.compare("'IST'00")) {
+            sName = "Dolphin Virtual Machine data";
+            sVersion = "5.0";
+            bDetected = true;
+        } else if (Binary.compare("'@._P-DATA_.@'")) {
+            sName = "CodeFusion Wizard data";
+            bDetected = true;
+        } else if (Binary.compare("'ASWsetupFPkgFil3'")) {
+            sName = "avast! Antivirus installer data";
+            bDetected = true;
+        } else if (Binary.compare("5b3e")) {
+            var ArcOffset = Binary.findSignature(Binary.getOverlayOffset(), 0x500, "'PK'0304");
+            if (ArcOffset != -1) {
+                sName = "InstallAnywhere data";
+                sOptions = "zip";
+                bDetected = true;
+            }
+        } else if (Binary.compare("........efbeadde'NullsoftInst'")) {
+            sName = "NSIS data";
+            bDetected = true;
+        } else if (Binary.compare("................fec1cd666ebccf01fec1cd666ebccf0100..............78da")) {
+            sName = "Internet Download Manager installer data";
+            sOptions = "zlib";
+            bDetected = true;
+        } else if (Binary.compare("d513e4e801000000")) {
+            sName = "Install4j installer data";
+            bDetected = true;
+        } else if (Binary.compare("efbbbf';!@Install@!UTF-8!'")) {
+            sName = "7-zip Installer data";
+            bDetected = true;
+        } else if (Binary.compare("'UM'030a00")) {
+            sName = "Sony Windows installer data";
+            bDetected = true;
+        } else if (Binary.compare("7b00320030003700320036003300370037002d00")) {
+            sName = "ADS Self Extractor data";
+            bDetected = true;
+        } else if (Binary.findSignature(Binary.getOverlayOffset(), Math.min(0x100, Binary.getOverlaySize()), "7b00320030003700320036003300370037002d00") != -1) {
+            sName = "ADS Self Extractor data";
+            bDetected = true;
+        } else if (Binary.compare("276327631226097513180178")) {
+            sName = "Chaos Software installer data";
+            bDetected = true;
+        } else if (Binary.compare("'OWS9G1'", 0xb)) {
+            sName = "Gentee installer data";
+            bDetected = true;
+        } else if (Binary.compare("'SQ5SFX'")) {
+            sName = "Squeez SFX data";
+            bDetected = true;
+        } else if (Binary.compare("'Inno Setup Setup Data'")) {
+            sName = "Inno Setup data";
+            bDetected = true;
+        } else if (Binary.findSignature(Binary.getOverlayOffset(), Math.min(0x100, Binary.getOverlaySize()), "'MSCF00000000'") != -1) {
+            sName = "CAB archive";
+            bDetected = true;
+        } else if (Binary.findSignature(Binary.getOverlayOffset(), Math.min(0x100, Binary.getOverlaySize()), "'ISc('") != -1) {
+            sName = "InstallShield archive";
+            bDetected = true;
+        } else if (Binary.compare("'ExcelsiorII1'")) {
+            sName = "Excelsior installer data";
+            bDetected = true;
+        } else if (Binary.compare("'InstallShield'00")) {
+            sName = "InstallShield data";
+            sOptions = "2.x-3.x";
+            bDetected = true;
+        } else if (Binary.compare("'wwwwI'874712")) {
+            sName = "Multimedia Fusion installer data";
+            bDetected = true;
+        } else if (Binary.compare("'PIMPFILE'00")) {
+            sName = "PIMP installer data";
+            bDetected = true;
+        } else if (Binary.compare("'tiz1'........78da")) {
+            sName = "Tarma installer data";
+            sOptions = "zlib";
+            bDetected = true;
+        } else if (Binary.compare("'XXataDfOnigeB'")) {
+            sName = "I-D Media installer data";
+            bDetected = true;
+        } else if (Binary.compare("'This is the end of the executable'")) {
+            sName = "SwiftView installer data";
+            bDetected = true;
+        } else if (Binary.compare("1f8b08", 0x3000)) {
+            sName = "BulletProofSoft installer data";
+            sOptions = "gzip";
+            bDetected = true;
+        } else if (Binary.compare("'AddD'03")) {
+            sName = "SecuROM data";
+            var nOffset = Binary.getOverlayOffset();
+            sVersion = Binary.getString(nOffset + 8);
+            bDetected = true;
+        } else if (Binary.compare("'NB09'")) {
+            sName = "CodeView 4.10 debug information";
+            bDetected = true;
+        } else if (Binary.compare("'NB11'")) {
+            sName = "CodeView 5.0 debug information";
+            bDetected = true;
+        } else if (Binary.compare("'NB10'")) {
+            sName = "PDB 2.0 file link";
+            bDetected = true;
+        } else if (Binary.compare("'RSDS'")) {
+            sName = "PDB 7.0 file link";
+            bDetected = true;
+        } else if (Binary.compare("'[(*|*)]MZ'")) {
+            sName = "Mioplanet installer executable+data"
+            bDetected = true;
+        } else if (Binary.compare("'MPV'")) {
+            sName = "DelZip SFX data";
+            bDetected = true;
+        } else if (Binary.compare("'MPU'00")) {
+            sName = "CoffeeCup SFX data";
+            bDetected = true;
+        } else if (Binary.compare("'<KRZIP FILE BEGINS HERE>'")) {
+            sName = "KRZIP archive";
+            bDetected = true;
+        } else if (Binary.compare("..........87000001........5d0000800000")) {
+            sName = "Smart Install Maker data";
+            bDetected = true;
+        } else if (Binary.compare("'RS'")) {
+            sName = "AOLSetup data";
+            bDetected = true;
+        } else if (Binary.compare("'TGCF'")) {
+            sName = "Setup-Specialist archive";
+            bDetected = true;
+        } else if (Binary.compare("a3484bbe986c4aa9")) {
+            sName = "AutoIt compiled script";
+            sVersion = "2.XX-3.XX";
+            bDetected = true;
+        } else if (Binary.compare("'MSCF'00000000")) {
+            sName = "CAB archive";
+            bDetected = true;
+        } else if (Binary.compare("'PK'0304")) {
+            sName = "ZIP archive";
+            bDetected = true;
+        } else if (Binary.compare("'$_BIM_CONFIG_START_$")) {
+            sName = "Bytessence Install Maker data";
+            bDetected = true;
+        } else if (Binary.compare("........'.eh_frame'00")) {
+            sName = "BitRock installer data";
+            bDetected = true;
+        } else if (Binary.compare("09050000")) {
+            sName = "ThinApp data";
+            bDetected = true;
+        } else if (Binary.compare("BDA6EEE9F9EDEFEDE5ED")) {
+            sName = "Hamrick Software XOR-ed ZIP";
+            bDetected = true;
+        } else if (Binary.compare("000000000000000038e8020000000000")) {
+            sName = "Box Stub installer data";
+            bDetected = true;
+        } else if (Binary.compare("a7870800")) {
+            sName = "Install Factory data";
+            bDetected = true;
+        } else if (Binary.compare("a7870800")) {
+            sName = "Install Factory data";
+            bDetected = true;
+        }
+
+        /* var ArcOffset=Binary.findSignature(Binary.getOverlayOffset(),0x400, "'|http:'");
+        if(ArcOffset!=-1)
+        {
+            sName="Pantaray QSetup data";
+            sVersion="6.x";
+            bDetected=1;
+        }
+        var ArcOffset=Binary.findSignature(Binary.getOverlayOffset(),0x400, "'|www.'");
+        if(ArcOffset!=-1)
+        {
+            sName="Pantaray QSetup data";
+            sVersion="8.x";
+            bDetected=1;
+        } */
+    }
+
+    return result();
+}