Skip to content

Commit 7015b27

Browse files
authored
Add more binary magic signatures to is_bin() in data ##analysis
1 parent 848264c commit 7015b27

1 file changed

Lines changed: 22 additions & 6 deletions

File tree

libr/anal/data.c

Lines changed: 22 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -191,17 +191,33 @@ static ut64 is_pointer(RAnal *anal, const ut8 *buf, int size) {
191191
}
192192

193193
static bool is_bin(const ut8 *buf, int size) {
194-
// TODO: add more magic signatures heres
195194
if (size >= 4) {
196195
if (!memcmp (buf, "\xcf\xfa\xed\xfe", 4)) {
197-
return true;
196+
return true; // Mach-O 64-bit
198197
}
199-
if (!memcmp (buf, "\x7f\x45\x4c\x46", 4)) { // \x7fELF
200-
return true;
198+
if (!memcmp (buf, "\xce\xfa\xed\xfe", 4)) {
199+
return true; // Mach-O 32-bit
200+
}
201+
if (!memcmp (buf, "\xbe\xba\xfe\xca", 4)) {
202+
return true; // Mach-O fat binary
203+
}
204+
if (!memcmp (buf, "\x7f\x45\x4c\x46", 4)) {
205+
return true; // ELF
206+
}
207+
if (!memcmp (buf, "\xca\xfe\xba\xbe", 4)) {
208+
return true; // Java class or Mach-O fat (big-endian)
209+
}
210+
if (!memcmp (buf, "dex\n", 4)) {
211+
return true; // DEX (Android Dalvik)
212+
}
213+
if (!memcmp (buf, "\x00\x61\x73\x6d", 4)) {
214+
return true; // WebAssembly
201215
}
202216
}
203-
if ((size >= 2 && !memcmp (buf, "MZ", 2))) {
204-
return true;
217+
if (size >= 2) {
218+
if (!memcmp (buf, "MZ", 2)) {
219+
return true; // PE/DOS
220+
}
205221
}
206222
return false;
207223
}

0 commit comments

Comments
 (0)