vtypes/varint.go at master · Velocidex/vtypes · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
package vtypes

import (
	"encoding/json"
	"errors"
	"fmt"
	"io"

	"github.com/Velocidex/ordereddict"
	"www.velocidex.com/golang/vfilter"
)

type VarInt struct {
	base   uint64
	size   int
	offset int64
}

func (self VarInt) Size() int {
	return self.size
}

func (self VarInt) SizeOf() int {
	return self.size
}

func (self VarInt) EndOf() uint64 {
	return uint64(self.offset) + uint64(self.size)
}

func (self VarInt) OffsetOf() uint64 {
	return uint64(self.offset)
}

func (self VarInt) Value() interface{} {
	return self.base
}

func (self VarInt) ValueOf() interface{} {
	return self.Value()
}

func (self VarInt) MarshalJSON() ([]byte, error) {
	return json.Marshal(self.base)
}

type SVarInt struct {
	VarInt
}

func (self SVarInt) Value() interface{} {
	return int64(self.base)
}

func (self SVarInt) MarshalJSON() ([]byte, error) {
	return json.Marshal(int64(self.base))
}

type Leb128Parser struct{}

func (self *Leb128Parser) New(profile *Profile, options *ordereddict.Dict) (Parser, error) {
	return &Leb128Parser{}, nil
}

func (self *Leb128Parser) DebugString(scope vfilter.Scope, offset int64, reader io.ReaderAt) string {
	return fmt.Sprintf("[Leb128] %#0x", self.Parse(scope, reader, offset))
}

func (self *Leb128Parser) Parse(scope vfilter.Scope, reader io.ReaderAt, offset int64) interface{} {
	// We only support uint64 - max size 64 / 7 = 10  bytes
	buf := make([]byte, 10)

	n, err := reader.ReadAt(buf, offset)
	if n == 0 || (err != nil && !errors.Is(err, io.EOF)) {
		return 0
	}

	var res uint64
	for i := 0; i < len(buf); i++ {
		next := buf[i] & 0x80
		value := uint64(buf[i] & 0x7f)
		res |= value << (i * 7)
		if next == 0 {
			return VarInt{
				offset: offset,
				base:   res,
				size:   i + 1,
			}
		}
	}

	return VarInt{
		base:   res,
		offset: offset,
		size:   len(buf),
	}
}

type Sleb128Parser struct {
	Leb128Parser
}

func (self *Sleb128Parser) Parse(scope vfilter.Scope, reader io.ReaderAt, offset int64) interface{} {
	res := self.Leb128Parser.Parse(scope, reader, offset)
	res_vi, ok := res.(VarInt)
	if ok {
		return &SVarInt{res_vi}
	}
	return 0
}