analyze iaf file

read-iaf.rb

require './iaf-data'
HEADER = "\x66\x4D\x41\x49\x00\x00\x05\x00\x01\x00\x00\x00"
PASSWORD_SEED = "\x75\x18\x15\x14"
PASSWORD_HEADER = "\x01\x01"
MAX_FIELD_LENGTH = 4096

def decode_password(data)
  pos = 0
  if PASSWORD_HEADER.size > data.size
    puts 'Premature end of data while reading password header'
    exit
  end
  pos = PASSWORD_HEADER.size

  if pos + 4 > data.size
    puts 'Premature end of data while reading password_len'
    exit
  end
  password_len = data[pos, 4].unpack('V*')[0]
  pos += 4

  if pos + password_len != data.size
    puts 'Malformed password record'
    exit
  end

  seed = PASSWORD_SEED
  ret = ''
  while pos < data.size
    fill = pos + 4 > data.size ? pos + 4 - data.size : 0
    seed = ("\x00" * fill + seed[fill, seed.size]).unpack('V*')[0]
    d = ("\x00" * fill + data[pos, 4 - fill]).unpack('V*')[0]
    pos += 4 - fill
    ret += [(d ^ seed)].pack('V*')[fill, (d ^ seed).size].to_s
    seed = [d ^ seed].pack('V*')
  end
  ret
end

io = File.binread(ARGV[0])
pos = 0

if HEADER.size > io.size
  puts 'Premature end of data while reading header'
  exit
end
pos = HEADER.size

data = {}
while pos < io.size
  if pos + 4 > io.size
    puts 'Premature end of data while reading field_id'
    exit
  end
  field_id = io[pos, 4].unpack('V*')[0]
  pos += 4

  if pos + 4 > io.size
    puts 'Premature end of data while reading field_len'
    exit
  end
  field_len = io[pos, 4].unpack('V*')[0]
  pos += 4

  if pos + field_len > io.size
    puts 'Premature end of data while reading field'
    exit
  end
  if pos + field_len > MAX_FIELD_LENGTH
    puts "Excessive field length: #{field_len}"
    exit
  end
  field = io[pos, field_len]
  pos += field_len

  next unless IAF_DATA[field_id]
  next if field == ' '
  if IAF_DATA[field_id]['format'] == 'ulong'
    field = field.unpack('V*')[0].to_i
  end
  if IAF_DATA[field_id]['type'] == 'password'
    field = decode_password field
  end
  if IAF_DATA[field_id]['type'] == 'bool'
    field = field == 0
  end
  data[field_id] = field
end

IAF_DATA.each do|id, value|
  next unless data[id]
  puts "#{value['name']}: #{data[id]}"
end