forked from davidquesada/ibtool
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathnib.hexproj
138 lines (123 loc) · 19 KB
/
nib.hexproj
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
providers 775 0 0 0 003106 5 providers/10.json 664 0 356 0 004444 0 {
"settings": {
"baseAddress": 0,
"currPage": 0,
"displayName": "minimal.nib",
"path": "samples/minimal.nib",
"type": "hex.builtin.provider.file"
},
"type": "hex.builtin.provider.file"
} providers 775 0 0 0 003106 5 providers/providers.json 664 0 47 0 006156 0 {
"providers": [
10
]
} challenge 775 0 0 0 003013 5 challenge/unlocked.json 664 0 32 0 005644 0 {
"achievements": []
} 10 775 0 0 0 001311 5 10/pattern_source_code.hexpat 664 0 3664 0 007063 0 import std.mem;
using FlexNumber;
fn flex_value(ref FlexNumber num) {
u32 res = 0;
for (u8 i=0, i < sizeof(num.values), i=i+1){
res = res + ((num.values[i] & 0x7f) << (i*7));
}
return res;
};
struct FlexNumber {
u32 _location = $;
u8 values[while($ == _location || std::mem::read_unsigned($-1, 1) & 0x80 == 0)] [[hidden]];
} [[format_read("flex_value"),transform("flex_value")]];
struct Class {
FlexNumber length;
u8 tp;
char name[length];
};
struct ObjectEntry {
FlexNumber class_idx;
FlexNumber address;
FlexNumber size;
};
struct Key {
FlexNumber length;
char value[length];
};
enum Encoding : u8 {
Byte = 0,
Short = 1,
Word = 2,
DWord = 3,
False = 4,
True = 5,
Float = 6,
Double = 7,
String = 8,
Nil = 9,
Object = 10,
};
struct Value {
FlexNumber key_idx;
Encoding encoding;
match(encoding) {
(Encoding::Byte): u8 value;
(Encoding::Short): u16 value;
(Encoding::Word): u32 value;
(Encoding::DWord): u64 value;
(Encoding::Float): float value;
(Encoding::Double): double value;
(Encoding::String): {
FlexNumber length;
char string[length];
}
(Encoding::Object): u32 obj_idx;
}
};
struct Section {
u32 obj_count;
u32 address;
};
struct Header {
u32 size;
u32 section_count = (size-1)/2;
Section sections[section_count];
};
char magic[10]@0;
u32 num_headers@10;
Header headers[num_headers]@14;
Section cls_section = headers[0].sections[3];
Class cls[cls_section.obj_count] @ cls_section.address;
Section objs_section = headers[0].sections[0];
ObjectEntry objs[objs_section.obj_count] @ objs_section.address;
Section keys_section = headers[0].sections[1];
Key keys[keys_section.obj_count] @ keys_section.address;
Section vals_section = headers[0].sections[2];
Value vals[vals_section.obj_count] @ vals_section.address; 10 775 0 0 0 001311 5 10/data_information.json 664 0 1075 0 006024 0 {
"hex.builtin.information_section.info_analysis": {
"annotations": true,
"block_size": 0,
"enabled": true
},
"hex.builtin.information_section.magic": {
"enabled": true
},
"hex.builtin.information_section.provider_information": {
"enabled": true
},
"hex.builtin.information_section.relationship_analysis": {
"brightness": 0.5,
"enabled": true,
"filter": 1,
"sample_size": 36864
},
"hex.yara.information_section.advanced_data_info": {
"enabled": true
}
} 10 775 0 0 0 001311 5 10/bookmarks.json 664 0 27 0 004332 0 {
"bookmarks": []
} 10 775 0 0 0 001311 5 10/data_processor.json 664 0 44 0 005351 0 {
"links": {},
"nodes": {}
} 10 775 0 0 0 001311 5 10/highlight_rules.json 664 0 2 0 005434 0 [] 10 775 0 0 0 001311 5 10/hashes.json 664 0 24 0 003612 0 {
"hashes": []
} 10 775 0 0 0 001311 5 10/yara.json 664 0 23 0 003272 0 {
"rules": []
} IMHEX_METADATA 664 0 12 0 003256 0 HEX
1.35.4