identify

package
v10.0.45 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Mar 6, 2026 License: MIT Imports: 18 Imported by: 0

Documentation

Overview

wrap libmagic for easier use in identify module

Index

Constants

including text formats is ~10x more expensive (uncomment for speed up) //| "magicmime.MAGIC_NO_CHECK_TEXT"

View Source
const MAX_INDICATOR_BUFFERED_BYTES_SIZE = 32000

Max size of the start of the file to buffer for identification (32kB)

View Source
const MAX_YARA_SCAN_TIME_SECONDS = 10

Max number of seconds to allow yara to scan a file for.

View Source
const MIN_POINTS = 15
View Source
const MaxRegen = 100
View Source
const POINTS_STRONG = 15
View Source
const POINTS_WEAK = 1

Variables

View Source
var ErrMismatch = errors.New("failed to match id")

Functions

This section is empty.

Types

type IdMapping

type IdMapping struct {
	Id        string
	Legacy    string
	Extension string
}

type Identified

type Identified struct {
	FileFormat    string
	FileExtension string
	Mimes         []string
	Magics        []string
	Mime          string
	Magic         string
}

type Identify

type Identify struct {
	Version uint32

	Id_Mappings     []IdMapping
	Id_Mappings_Map map[string]IdMapping

	Yara_Scanner *yara.Scanner

	Rules []struct {
		Id        string
		Extension string
		Magic     string
		MagicC    *regexp.Regexp
		Mime      string
		MimeC     *regexp.Regexp
	}

	Refine_Rules []RefinedRule
	Indicators   []struct {
		Id         string
		Trigger_On []string
		RE_Strong  []string
		RE_StrongC []*regexp.Regexp
		RE_Weak    []string
		RE_WeakC   []*regexp.Regexp
	}
	Trusted_Mimes map[string]string

	RefineRulesMapping map[string]refineFunction
	// contains filtered or unexported fields
}

func NewIdentify

func NewIdentify() (*Identify, error)

func (*Identify) Find

func (cfg *Identify) Find(contentPath string) (Identified, error)

* Identify returns the standardised file type descriptor for the given input.

type MagicWrap

type MagicWrap struct {
	// contains filtered or unexported fields
}

func NewMagicWrap

func NewMagicWrap() *MagicWrap

func (*MagicWrap) CalcMagicsFromBytes

func (mw *MagicWrap) CalcMagicsFromBytes(buf []byte) []string

Calculate the file magic from a buffer of bytes.

func (*MagicWrap) CalcMagicsFromPath

func (mw *MagicWrap) CalcMagicsFromPath(filePath string) []string

Calculate the file magic from a filepath.

func (*MagicWrap) CalcMimesFromBytes

func (mw *MagicWrap) CalcMimesFromBytes(buf []byte) []string

Calculate the mime type from a buffer of bytes.

func (*MagicWrap) CalcMimesFromPath

func (mw *MagicWrap) CalcMimesFromPath(filePath string) []string

Calculate the mime type from a file path.

type RefinedRule

type RefinedRule struct {
	Function_Name      string
	Trigger_On         []string
	Run_On_func_Output bool
}

type YaraScanCallback

type YaraScanCallback struct {
	// contains filtered or unexported fields
}

func (*YaraScanCallback) RuleMatching

func (ysc *YaraScanCallback) RuleMatching(curCtx *yara.ScanContext, rule *yara.Rule) (bool, error)

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL