Skip to content

Instantly share code, notes, and snippets.

@aggieben
Created September 13, 2019 20:14
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save aggieben/a4ade68e2bbbc150805b52d74ea2107d to your computer and use it in GitHub Desktop.
Save aggieben/a4ade68e2bbbc150805b52d74ea2107d to your computer and use it in GitHub Desktop.
use nom::{IResult, dbg_dmp};
use nom::bytes::complete::{tag};
use nom::number::complete::le_u32;
fn has_msdos_header(input:&[u8]) -> IResult<&[u8], u32> {
const DOS_BEGIN : [u8; 60] =
[0x4d, 0x5a, 0x90, 0x00, 0x03, 0x00, 0x00, 0x00,
0x04, 0x00, 0x00, 0x00, 0xff, 0xff, 0x00, 0x00,
0xb8, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x40, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00];
const DOS_END : [u8; 64] =
[0x0e, 0x1f, 0xba, 0x0e, 0x00, 0xb4, 0x09, 0xcd,
0x21, 0xb8, 0x01, 0x4c, 0xcd, 0x21, 0x54, 0x68,
0x69, 0x73, 0x20, 0x70, 0x72, 0x6f, 0x67, 0x72,
0x61, 0x6d, 0x20, 0x63, 0x61, 0x6e, 0x6e, 0x6f,
0x74, 0x20, 0x62, 0x64, 0x20, 0x72, 0x75, 0x6e,
0x20, 0x69, 0x6e, 0x20, 0x44, 0x4f, 0x53, 0x20,
0x6d, 0x6f, 0x64, 0x65, 0x2e, 0x0d, 0x0d, 0x0a,
0x24, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00];
let (input, _) = tag(&DOS_BEGIN[..])(input)?;
let (input, lfa) = le_u32(input)?;
let (input, _) = tag(&DOS_END[..])(input)?;
Ok((input, lfa))
}
#[cfg(test)]
mod tests {
use super::*;
#[test]
fn pe_has_msdos_header_ok() {
let assembly_bytes = include_bytes!("../data/Newtonsoft.Json.dll");
println!("Opened Newtonsoft.Json.dll; {} bytes", assembly_bytes.len());
let result = has_msdos_header(&assembly_bytes[..]);
match &result {
Ok((rem, lfa)) =>
println!("Result: Ok, remaining input: {} bytes; lfa: {}", rem.len(), lfa),
Err(nom::Err::Error((_, kind))) =>
println!("Result: Err, error: {:?}", kind),
_ =>
println!("Other error.")
}
assert!(result.is_ok());
}
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment