Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 2 additions & 3 deletions AGENTS.md
Original file line number Diff line number Diff line change
Expand Up @@ -208,15 +208,15 @@ cargo test --doc # Test documentation examples
### Currently Implemented (v0.1.0)

- **Offsets**: Absolute and from-end specifications (indirect and relative are parsed but not yet evaluated)
- **Types**: `byte`, `short`, `long`, `quad`, `float`, `double`, `string` with endianness support; unsigned variants `ubyte`, `ushort`/`ubeshort`/`uleshort`, `ulong`/`ubelong`/`ulelong`, `uquad`/`ubequad`/`ulequad`; float/double endian variants `befloat`/`lefloat`, `bedouble`/`ledouble`; types are signed by default (libmagic-compatible)
- **Types**: `byte`, `short`, `long`, `quad`, `float`, `double`, `string` with endianness support; unsigned variants `ubyte`, `ushort`/`ubeshort`/`uleshort`, `ulong`/`ubelong`/`ulelong`, `uquad`/`ubequad`/`ulequad`; float/double endian variants `befloat`/`lefloat`, `bedouble`/`ledouble`; 32-bit date/timestamp types `date`/`ldate`/`bedate`/`beldate`/`ledate`/`leldate`; 64-bit date/timestamp types `qdate`/`qldate`/`beqdate`/`beqldate`/`leqdate`/`leqldate`; date values formatted as `"Www Mmm DD HH:MM:SS YYYY"` matching GNU `file` output; types are signed by default (libmagic-compatible)
- **Operators**: `=` (equal), `!=` (not equal), `<` (less than), `>` (greater than), `<=` (less equal), `>=` (greater equal), `&` (bitwise AND with optional mask), `^` (bitwise XOR), `~` (bitwise NOT), `x` (any value)
- **Nested Rules**: Hierarchical rule evaluation with proper indentation
- **String Matching**: Exact string matching with null-termination

### Planned Features (v1.0+)

- Regex type: Pattern matching with binary-safe regex support
- Additional types: floats, doubles, dates
- Additional types: pascal strings
- Search type: Multi-pattern string searching

### Future Enhancement: Binary-Safe Regex Handling
Expand All @@ -240,7 +240,6 @@ impl BinaryRegex for regex::bytes::Regex {

- No regex/search pattern matching
- 64-bit integer types: `quad`/`uquad`, `bequad`/`ubequad`, `lequad`/`ulequad` are implemented; `qquad` (128-bit) is not yet supported
- No date/time types (date, qdate, ldate, qldate)
- String evaluation reads until first NUL or end-of-buffer by default; `max_length: Some(_)` is supported internally but no dedicated fixed-length string parser syntax exists yet

### Operators
Expand Down
104 changes: 104 additions & 0 deletions Cargo.lock

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

1 change: 1 addition & 0 deletions Cargo.toml
Original file line number Diff line number Diff line change
Expand Up @@ -145,6 +145,7 @@ path = "src/main.rs"
[dependencies]
byteorder = "1.5.0"
cfg-if = "1.0.4"
chrono = { version = "0.4.41", default-features = false, features = ["std", "clock"] }
clap = { version = "4.5.60", features = ["derive"] }
clap-stdin = "0.8.1"
clap_complete = "4.5.66"
Expand Down
2 changes: 1 addition & 1 deletion ROADMAP.md
Original file line number Diff line number Diff line change
Expand Up @@ -32,7 +32,7 @@ See [GitHub Milestones](https://github.com/EvilBit-Labs/libmagic-rs/milestones)
- [ ] Convert `evaluator/types.rs` to directory module ([#63](https://github.com/EvilBit-Labs/libmagic-rs/issues/63))
- [ ] Regex and search types ([#39](https://github.com/EvilBit-Labs/libmagic-rs/issues/39))
- [ ] Float and double types ([#40](https://github.com/EvilBit-Labs/libmagic-rs/issues/40))
- [ ] Date and timestamp types ([#41](https://github.com/EvilBit-Labs/libmagic-rs/issues/41))
- [x] Date and timestamp types ([#41](https://github.com/EvilBit-Labs/libmagic-rs/issues/41))
- [ ] Pascal string type ([#43](https://github.com/EvilBit-Labs/libmagic-rs/issues/43))
- [ ] Meta-types: default, clear, name, use, indirect ([#42](https://github.com/EvilBit-Labs/libmagic-rs/issues/42))

Expand Down
28 changes: 14 additions & 14 deletions docs/src/api-reference.md
Original file line number Diff line number Diff line change
Expand Up @@ -287,13 +287,13 @@ Value types for matching.
use libmagic_rs::Value;
```

| Variant | Description |
| ---------------- | ------------------------------------------------------- |
| `Uint(u64)` | Unsigned integer |
| `Int(i64)` | Signed integer |
| `Float(f64)` | Floating-point value (added in v0.5.0) |
| `Bytes(Vec<u8>)` | Byte sequence |
| `String(String)` | String value |
| Variant | Description |
| ---------------- | -------------------------------------- |
| `Uint(u64)` | Unsigned integer |
| `Int(i64)` | Signed integer |
| `Float(f64)` | Floating-point value (added in v0.5.0) |
| `Bytes(Vec<u8>)` | Byte sequence |
| `String(String)` | String value |

The `Value` enum derives `PartialEq` but no longer derives `Eq` (removed in v0.5.0 to support floating-point values).

Expand Down Expand Up @@ -411,14 +411,14 @@ Result from internal evaluation.
use libmagic_rs::evaluator::MatchResult;
```

| Field | Type | Description |
| ------------ | -------- | ------------------------------------- |
| `message` | `String` | Match description |
| `offset` | `usize` | Match offset |
| `level` | `u32` | Rule level |
| `value` | `Value` | Matched value |
| Field | Type | Description |
| ------------ | ---------- | ----------------------------------------- |
| `message` | `String` | Match description |
| `offset` | `usize` | Match offset |
| `level` | `u32` | Rule level |
| `value` | `Value` | Matched value |
| `type_kind` | `TypeKind` | Type used to read value (added in v0.5.0) |
| `confidence` | `f64` | Confidence score |
| `confidence` | `f64` | Confidence score |

## Output Module

Expand Down
36 changes: 34 additions & 2 deletions src/evaluator/strength.rs
Original file line number Diff line number Diff line change
Expand Up @@ -78,9 +78,9 @@ pub fn calculate_default_strength(rule: &MagicRule) -> i32 {
if max_length.is_some() { base + 5 } else { base }
}
// 64-bit types are most specific among numerics
TypeKind::Quad { .. } | TypeKind::Double { .. } => 16,
TypeKind::Quad { .. } | TypeKind::Double { .. } | TypeKind::QDate { .. } => 16,
// 32-bit types are fairly specific
TypeKind::Long { .. } | TypeKind::Float { .. } => 15,
TypeKind::Long { .. } | TypeKind::Float { .. } | TypeKind::Date { .. } => 15,
// 16-bit integers are moderately specific
TypeKind::Short { .. } => 10,
// Single bytes are least specific
Expand Down Expand Up @@ -431,6 +431,38 @@ mod tests {
assert_eq!(strength, 36);
}

#[test]
fn test_strength_type_date() {
let rule = make_rule(
TypeKind::Date {
endian: Endianness::Big,
utc: true,
},
Operator::Equal,
OffsetSpec::Absolute(0),
Value::Uint(0),
);
let strength = calculate_default_strength(&rule);
// Date: 15, Equal: 10, Absolute: 10, Numeric: 0 = 35
assert_eq!(strength, 35);
}

#[test]
fn test_strength_type_qdate() {
let rule = make_rule(
TypeKind::QDate {
endian: Endianness::Little,
utc: false,
},
Operator::Equal,
OffsetSpec::Absolute(0),
Value::Uint(0),
);
let strength = calculate_default_strength(&rule);
// QDate: 16, Equal: 10, Absolute: 10, Numeric: 0 = 36
assert_eq!(strength, 36);
}

#[test]
fn test_strength_type_string() {
let rule = make_rule(
Expand Down
Loading
Loading