From e510abe1e596097458586f57425f08c4d59c8b32 Mon Sep 17 00:00:00 2001 From: Petr Pucil Date: Sun, 3 Jan 2021 01:23:04 +0100 Subject: [PATCH] Reorder keys per style guide (using ksylint), trim trailing whitespace --- archive/android_img.ksy | 2 +- archive/lzh.ksy | 2 +- archive/phar_without_stub.ksy | 38 +-- archive/rar.ksy | 6 +- cad/monomakh_sapr_chg.ksy | 6 +- common/riff.ksy | 12 +- common/utf8_string.ksy | 2 +- database/dbf.ksy | 2 +- database/gettext_mo.ksy | 32 +-- database/sqlite3.ksy | 4 +- database/tsm.ksy | 82 +++---- executable/dex.ksy | 36 +-- executable/elf.ksy | 10 +- executable/java_class.ksy | 28 +-- executable/mach_o.ksy | 114 ++++----- executable/microsoft_pe.ksy | 8 +- executable/python_pyc_27.ksy | 16 +- executable/uefi_te.ksy | 26 +- filesystem/apm_partition_table.ksy | 8 +- filesystem/apple_single_double.ksy | 2 +- filesystem/btrfs_stream.ksy | 2 +- filesystem/cramfs.ksy | 2 +- filesystem/ext2.ksy | 6 +- filesystem/gpt_partition_table.ksy | 3 +- filesystem/iso9660.ksy | 2 +- filesystem/luks.ksy | 2 +- filesystem/lvm2.ksy | 10 +- filesystem/tr_dos_image.ksy | 2 +- filesystem/vdi.ksy | 6 +- filesystem/vmware_vmdk.ksy | 2 +- filesystem/zx_spectrum_tap.ksy | 6 +- firmware/andes_firmware.ksy | 4 +- firmware/ines.ksy | 2 +- firmware/uimage.ksy | 228 +++++++++--------- font/pcf_font.ksy | 22 +- font/ttf.ksy | 18 +- game/allegro_dat.ksy | 2 +- game/fallout2_dat.ksy | 2 +- game/fallout_dat.ksy | 2 +- game/gran_turismo_vol.ksy | 6 +- game/heaps_pak.ksy | 4 +- game/heroes_of_might_and_magic_agg.ksy | 2 +- game/quake_mdl.ksy | 2 +- game/quake_pak.ksy | 4 +- game/renderware_binary_stream.ksy | 2 +- game/saints_row_2_vpp_pc.ksy | 12 +- game/warcraft_2_pud.ksy | 2 +- hardware/mifare/mifare_classic.ksy | 10 +- image/bmp.ksy | 16 +- image/exif.ksy | 4 +- image/gif.ksy | 4 +- image/icc_4.ksy | 110 ++++----- image/ico.ksy | 2 +- image/nitf.ksy | 22 +- image/pcx.ksy | 2 +- image/pcx_dcx.ksy | 2 +- image/xwd.ksy | 2 +- log/aix_utmp.ksy | 110 ++++----- log/windows_evt_log.ksy | 2 +- machine_code/code_6502.ksy | 2 +- macos/ds_store.ksy | 22 +- macos/mac_os_resource_snd.ksy | 10 +- macos/resource_fork.ksy | 8 +- media/avi.ksy | 2 +- media/creative_voice_file.ksy | 2 +- media/genmidi_op2.ksy | 4 +- media/magicavoxel_vox.ksy | 84 ++++--- media/quicktime_mov.ksy | 2 +- media/standard_midi_file.ksy | 2 +- media/stl.ksy | 2 +- .../tracker_modules/fasttracker_xm_module.ksy | 10 +- media/vp8_ivf.ksy | 14 +- media/wav.ksy | 23 +- network/dns_packet.ksy | 2 +- network/hccap.ksy | 6 +- network/hccapx.ksy | 4 +- network/ipv6_packet.ksy | 2 +- network/microsoft_network_monitor_v2.ksy | 12 +- network/packet_ppi.ksy | 6 +- network/pcap.ksy | 2 +- network/protocol_body.ksy | 8 +- network/rtcp_payload.ksy | 5 +- network/rtpdump.ksy | 6 +- network/some_ip/some_ip.ksy | 48 ++-- network/some_ip/some_ip_container.ksy | 2 +- network/some_ip/some_ip_sd_entries.ksy | 12 +- network/some_ip/some_ip_sd_options.ksy | 38 +-- network/tls_client_hello.ksy | 2 +- network/websocket.ksy | 5 +- scientific/spectroscopy/avantes_roh60.ksy | 24 +- security/efivar_signature_list.ksy | 26 +- security/openpgp_message.ksy | 85 ++++--- serialization/bson.ksy | 4 +- serialization/google_protobuf.ksy | 2 +- serialization/msgpack.ksy | 3 +- serialization/php_serialized_value.ksy | 74 +++--- serialization/python_pickle.ksy | 96 ++++---- serialization/ruby_marshal.ksy | 2 +- windows/regf.ksy | 2 +- windows/windows_lnk_file.ksy | 8 +- windows/windows_resource_file.ksy | 8 +- windows/windows_systemtime.ksy | 2 +- 102 files changed, 877 insertions(+), 885 deletions(-) diff --git a/archive/android_img.ksy b/archive/android_img.ksy index cc99259ac..95bcb9ff3 100644 --- a/archive/android_img.ksy +++ b/archive/android_img.ksy @@ -1,11 +1,11 @@ meta: id: android_img title: Android Boot Image + file-extension: img tags: - archive - android license: CC0-1.0 - file-extension: img endian: le doc-ref: https://source.android.com/devices/bootloader/boot-image-header seq: diff --git a/archive/lzh.ksy b/archive/lzh.ksy index 30904456e..1847ea7e3 100644 --- a/archive/lzh.ksy +++ b/archive/lzh.ksy @@ -1,6 +1,5 @@ meta: id: lzh - endian: le application: LHA (AKA LHarc) by Yoshizaki Haruyasu file-extension: lzh xref: @@ -10,6 +9,7 @@ meta: license: CC0-1.0 imports: - /common/dos_datetime + endian: le doc: | LHA (LHarc, LZH) is a file format used by a popular freeware eponymous archiver, created in 1988 by Haruyasu Yoshizaki. Over the diff --git a/archive/phar_without_stub.ksy b/archive/phar_without_stub.ksy index bc46336c8..b8620ccf5 100644 --- a/archive/phar_without_stub.ksy +++ b/archive/phar_without_stub.ksy @@ -18,7 +18,7 @@ doc: | allow executing or including phar files as if they were regular PHP scripts. PHP 5.3 and later include the phar extension, which adds native support for reading and manipulating phar files. - + The phar format was originally developed as part of the PEAR library PHP_Archive, first released in 2005. Later, a native PHP extension named "phar" was developed, which was first released on PECL in 2007, @@ -26,25 +26,25 @@ doc: | superseded the PHP_Archive library, which has not been updated since 2010. The phar extension is also no longer released independently on PECL; it is now developed and released as part of PHP itself. - + Because of current limitations in Kaitai Struct (seekaitai-io/kaitai_struct#158 and kaitai-io/kaitai_struct#538), the executable PHP stub that precedes the rest of the archive is not handled by this spec. Before parsing a phar using this spec, the stub must be removed manually. - + A phar's stub is terminated by the special token `__HALT_COMPILER();` (which may be followed by at most one space, the PHP tag end `?>`, and an optional line terminator). The stub termination sequence is immediately followed by the remaining parts of the phar format, as described in this spec. - + The phar stub usually contains code that loads the phar and runs a contained PHP file, but this is not required. A minimal valid phar stub is `- (id_chars[0] >= 97 and id_chars[0] <= 122) or (id_chars[1] >= 97 and id_chars[1] <= 122) or (id_chars[2] >= 97 and id_chars[2] <= 122) or (id_chars[3] >= 97 and id_chars[3] <= 122) + doc: | + Check if chunk_id contains lowercase characters ([a-z], ASCII 97 = a, ASCII 122 = z). enums: fourcc: # little-endian diff --git a/common/utf8_string.ksy b/common/utf8_string.ksy index af4945625..b522edb3e 100644 --- a/common/utf8_string.ksy +++ b/common/utf8_string.ksy @@ -1,8 +1,8 @@ meta: id: utf8_string title: UTF-8-encoded string - license: CC0-1.0 file-extension: txt + license: CC0-1.0 doc: | UTF-8 is a popular character encoding scheme that allows to represent strings as sequence of code points defined in Unicode diff --git a/database/dbf.ksy b/database/dbf.ksy index 381dd7ade..75b31c2a6 100644 --- a/database/dbf.ksy +++ b/database/dbf.ksy @@ -1,7 +1,7 @@ meta: id: dbf - file-extension: dbf application: dBASE + file-extension: dbf xref: justsolve: DBF loc: fdd000325 diff --git a/database/gettext_mo.ksy b/database/gettext_mo.ksy index cb6124c99..b49aa67ad 100644 --- a/database/gettext_mo.ksy +++ b/database/gettext_mo.ksy @@ -1,16 +1,16 @@ meta: id: gettext_mo - file-extension: mo - encoding: UTF-8 title: gettext binary database application: - GNU gettext - libintl + file-extension: mo tags: - database - linux license: BSD-2-Clause ks-version: 0.9 + encoding: UTF-8 # Copyright (c) 2000, 2001 Citrus Project, # All rights reserved. @@ -69,7 +69,7 @@ types: pos: 0 type: lookup_iteration(current.next, query) if: not found - + hashtable_lookup: doc: | def lookup(s:str, t:gettext_mo.GettextMo): @@ -81,7 +81,7 @@ types: return e.current except: raise Exception("Not found "+s+" in the hashtable!") - + lookup(t.mo.originals[145].str, t) doc-ref: https://gitlab.com/worr/libintl/raw/master/src/lib/libintl/gettext.c params: @@ -122,18 +122,18 @@ types: '[0xde, 0x12, 0x04, 0x95]': le '[0x95, 0x04, 0x12, 0xde]': be seq: - - id: version - type: version - - id: num_translations - type: u4 - - id: ofs_originals - type: u4 - - id: ofs_translations - type: u4 - - id: num_hashtable_items - type: u4 - - id: ofs_hashtable_items - type: u4 + - id: version + type: version + - id: num_translations + type: u4 + - id: ofs_originals + type: u4 + - id: ofs_translations + type: u4 + - id: num_hashtable_items + type: u4 + - id: ofs_hashtable_items + type: u4 instances: originals: io: _root._io diff --git a/database/sqlite3.ksy b/database/sqlite3.ksy index f855d78b2..a55a434ab 100644 --- a/database/sqlite3.ksy +++ b/database/sqlite3.ksy @@ -1,10 +1,10 @@ meta: id: sqlite3 title: SQLite3 database file - endian: be + license: CC0-1.0 imports: - /common/vlq_base128_be - license: CC0-1.0 + endian: be doc: | SQLite3 is a popular serverless SQL engine, implemented as a library to be used within other applications. It keeps its databases as diff --git a/database/tsm.ksy b/database/tsm.ksy index 95b940da3..3f5484be0 100644 --- a/database/tsm.ksy +++ b/database/tsm.ksy @@ -2,8 +2,8 @@ meta: id: tsm title: InfluxDB TSM file application: InfluxDB - license: MIT file-extension: tsm + license: MIT endian: be doc: | InfluxDB is a scalable database optimized for storage of time @@ -19,8 +19,8 @@ seq: type: header instances: index: - type: index pos: _io.size - 8 + type: index types: header: seq: @@ -35,50 +35,50 @@ types: instances: entries: pos: offset + type: index_header repeat: until repeat-until: _io.pos == _io.size - 8 - type: index_header types: index_header: - seq: - - id: key_len - type: u2 - - id: key - type: str - encoding: UTF-8 - size: key_len - - id: type - type: u1 - - id: entry_count - type: u2 + seq: + - id: key_len + type: u2 + - id: key + type: str + encoding: UTF-8 + size: key_len + - id: type + type: u1 + - id: entry_count + type: u2 - - id: index_entries - type: index_entry - repeat: expr - repeat-expr: entry_count + - id: index_entries + type: index_entry + repeat: expr + repeat-expr: entry_count - types: - index_entry: - seq: - - id: min_time - type: u8 - - id: max_time - type: u8 - - id: block_offset - type: u8 - - id: block_size - type: u4 + types: + index_entry: + seq: + - id: min_time + type: u8 + - id: max_time + type: u8 + - id: block_offset + type: u8 + - id: block_size + type: u4 - types: - block_entry: - seq: - - id: crc32 - type: u4 - - id: data - size: _parent.block_size - 4 + types: + block_entry: + seq: + - id: crc32 + type: u4 + - id: data + size: _parent.block_size - 4 - instances: - block: - io: _root._io - type: block_entry - pos: block_offset + instances: + block: + io: _root._io + pos: block_offset + type: block_entry diff --git a/executable/dex.ksy b/executable/dex.ksy index ba45686db..6798d73fe 100644 --- a/executable/dex.ksy +++ b/executable/dex.ksy @@ -9,11 +9,11 @@ meta: - android - executable license: CC-BY-SA-3.0 - endian: le # Portions of this page are reproduced from work created and shared by Google and used # according to terms described in the Creative Commons 3.0 Attribution License. imports: - /common/vlq_base128_le + endian: le doc: | Android OS applications executables are typically stored in its own format, optimized for more efficient execution in Dalvik virtual @@ -28,10 +28,10 @@ seq: type: header_item instances: string_ids: + pos: header.string_ids_off type: string_id_item repeat: expr repeat-expr: header.string_ids_size - pos: header.string_ids_off doc: | string identifiers list. @@ -41,10 +41,10 @@ instances: This list must be sorted by string contents, using UTF-16 code point values (not in a locale-sensitive manner), and it must not contain any duplicate entries. type_ids: + pos: header.type_ids_off type: type_id_item repeat: expr repeat-expr: header.type_ids_size - pos: header.type_ids_off doc: | type identifiers list. @@ -53,10 +53,10 @@ instances: This list must be sorted by string_id index, and it must not contain any duplicate entries. proto_ids: + pos: header.proto_ids_off type: proto_id_item repeat: expr repeat-expr: header.proto_ids_size - pos: header.proto_ids_off doc: | method prototype identifiers list. @@ -66,10 +66,10 @@ instances: and then by argument list (lexicographic ordering, individual arguments ordered by type_id index). The list must not contain any duplicate entries. field_ids: + pos: header.field_ids_off type: field_id_item repeat: expr repeat-expr: header.field_ids_size - pos: header.field_ids_off doc: | field identifiers list. @@ -81,10 +81,10 @@ instances: The list must not contain any duplicate entries. method_ids: + pos: header.method_ids_off type: method_id_item repeat: expr repeat-expr: header.method_ids_size - pos: header.method_ids_off doc: | method identifiers list. @@ -97,10 +97,10 @@ instances: The list must not contain any duplicate entries. class_defs: + pos: header.class_defs_off type: class_def_item repeat: expr repeat-expr: header.class_defs_size - pos: header.class_defs_off doc: | class definitions list. @@ -110,10 +110,10 @@ instances: Furthermore, it is invalid for a definition for the same-named class to appear more than once in the list. #call_site_ids: + # pos: header.??? # type: call_site_id_item # repeat: expr # repeat-expr: header.??? - # pos: header.??? # doc: | # call site identifiers list. # @@ -140,8 +140,8 @@ instances: Different items have different alignment requirements, and padding bytes are inserted before each item if necessary to achieve proper alignment. map: - type: map_list pos: header.map_off + type: map_list types: header_item: seq: @@ -265,6 +265,7 @@ types: 0x12345678: endian_constant 0x78563412: reverse_endian_constant string_id_item: + -webide-representation: "{value.data} (offs={string_data_off})" seq: - id: string_data_off type: u4 @@ -275,6 +276,7 @@ types: There is no alignment requirement for the offset. types: string_data_item: + -webide-representation: "{data}" seq: - id: utf16_size type: vlq_base128_le @@ -282,14 +284,13 @@ types: size: utf16_size.value type: str encoding: ascii - -webide-representation: "{data}" instances: value: pos: string_data_off type: string_data_item -webide-parse-mode: eager - -webide-representation: "{value.data} (offs={string_data_off})" type_id_item: + -webide-representation: "{type_name}" seq: - id: descriptor_idx type: u4 @@ -300,8 +301,8 @@ types: type_name: value: _root.string_ids[descriptor_idx].value.data -webide-parse-mode: eager - -webide-representation: "{type_name}" proto_id_item: + -webide-representation: "shorty_idx={shorty_idx} return_type_idx={return_type_idx} parameters_off={parameters_off}" seq: - id: shorty_idx type: u4 @@ -334,8 +335,8 @@ types: return_type: value: _root.type_ids[return_type_idx].type_name doc: return type of this prototype - -webide-representation: "shorty_idx={shorty_idx} return_type_idx={return_type_idx} parameters_off={parameters_off}" field_id_item: + -webide-representation: "class_idx={class_idx} type_idx={type_idx} name_idx={name_idx}" seq: - id: class_idx type: u2 @@ -361,8 +362,8 @@ types: field_name: value: _root.string_ids[name_idx].value.data doc: the name of this field - -webide-representation: "class_idx={class_idx} type_idx={type_idx} name_idx={name_idx}" method_id_item: + -webide-representation: "class_idx={class_idx} proto_idx={proto_idx} name_idx={name_idx}" seq: - id: class_idx type: u2 @@ -388,8 +389,8 @@ types: method_name: value: _root.string_ids[name_idx].value.data doc: the name of this method - -webide-representation: "class_idx={class_idx} proto_idx={proto_idx} name_idx={name_idx}" class_def_item: + -webide-representation: "{access_flags} {type_name}" seq: - id: class_idx type: u4 @@ -481,7 +482,6 @@ types: pos: static_values_off type: encoded_array_item if: static_values_off != 0 - -webide-representation: "{access_flags} {type_name}" encoded_array_item: seq: - id: value @@ -519,6 +519,7 @@ types: Elements must be sorted in increasing order by string_id index. encoded_value: + -webide-representation: "{value_type}: {value} (arg={value_arg})" seq: - id: value_arg type: b3 @@ -546,7 +547,6 @@ types: value_type_enum::enum: u4 value_type_enum::array: encoded_array value_type_enum::annotation: encoded_annotation - -webide-representation: "{value_type}: {value} (arg={value_arg})" enums: value_type_enum: 0x00: byte @@ -683,6 +683,7 @@ types: The method_idx of a virtual method must not be the same as any direct method. map_item: + -webide-representation: "{type}: offs={offset}, size={size}" seq: - id: type type: u2 @@ -701,7 +702,6 @@ types: type: u4 doc: | offset from the start of the file to the items in question - -webide-representation: "{type}: offs={offset}, size={size}" enums: map_item_type: 0x0000: header_item diff --git a/executable/elf.ksy b/executable/elf.ksy index 3ff0b5038..5ba816110 100644 --- a/executable/elf.ksy +++ b/executable/elf.ksy @@ -312,8 +312,8 @@ types: dynamic: io: _root._io pos: offset - type: dynamic_section size: filesz + type: dynamic_section if: type == ph_type::dynamic flags_obj: type: phdr_type_flags(flags64|flags32) @@ -473,16 +473,16 @@ types: instances: program_headers: pos: program_header_offset - repeat: expr - repeat-expr: qty_program_header size: program_header_entry_size type: program_header + repeat: expr + repeat-expr: qty_program_header section_headers: pos: section_header_offset - repeat: expr - repeat-expr: qty_section_header size: section_header_entry_size type: section_header + repeat: expr + repeat-expr: qty_section_header strings: pos: section_headers[section_names_idx].ofs_body size: section_headers[section_names_idx].len_body diff --git a/executable/java_class.ksy b/executable/java_class.ksy index 8e8747337..e5b357901 100644 --- a/executable/java_class.ksy +++ b/executable/java_class.ksy @@ -1,12 +1,12 @@ meta: id: java_class - endian: be file-extension: class xref: justsolve: Java pronom: x-fmt/415 wikidata: Q2193155 license: CC0-1.0 + endian: be doc-ref: 'https://docs.oracle.com/javase/specs/jvms/se8/html/jvms-4.html#jvms-4.1' seq: - id: magic @@ -53,6 +53,7 @@ seq: repeat-expr: attributes_count types: constant_pool_entry: + doc-ref: 'https://docs.oracle.com/javase/specs/jvms/se8/html/jvms-4.html#jvms-4.4' seq: - id: tag type: u1 @@ -91,7 +92,6 @@ types: 15: method_handle 16: method_type 18: invoke_dynamic - doc-ref: 'https://docs.oracle.com/javase/specs/jvms/se8/html/jvms-4.html#jvms-4.4' class_cp_info: doc-ref: 'https://docs.oracle.com/javase/specs/jvms/se8/html/jvms-4.html#jvms-4.4.1' seq: @@ -139,31 +139,32 @@ types: name_and_type_as_info: value: _root.constant_pool[name_and_type_index - 1].cp_info.as string_cp_info: + doc-ref: 'https://docs.oracle.com/javase/specs/jvms/se8/html/jvms-4.html#jvms-4.4.3' seq: - id: string_index type: u2 - doc-ref: 'https://docs.oracle.com/javase/specs/jvms/se8/html/jvms-4.html#jvms-4.4.3' integer_cp_info: + doc-ref: 'https://docs.oracle.com/javase/specs/jvms/se8/html/jvms-4.html#jvms-4.4.4' seq: - id: value type: u4 - doc-ref: 'https://docs.oracle.com/javase/specs/jvms/se8/html/jvms-4.html#jvms-4.4.4' float_cp_info: + doc-ref: 'https://docs.oracle.com/javase/specs/jvms/se8/html/jvms-4.html#jvms-4.4.5' seq: - id: value type: f4 - doc-ref: 'https://docs.oracle.com/javase/specs/jvms/se8/html/jvms-4.html#jvms-4.4.5' long_cp_info: + doc-ref: 'https://docs.oracle.com/javase/specs/jvms/se8/html/jvms-4.html#jvms-4.4.5' seq: - id: value type: u8 - doc-ref: 'https://docs.oracle.com/javase/specs/jvms/se8/html/jvms-4.html#jvms-4.4.5' double_cp_info: + doc-ref: 'https://docs.oracle.com/javase/specs/jvms/se8/html/jvms-4.html#jvms-4.4.6' seq: - id: value type: f8 - doc-ref: 'https://docs.oracle.com/javase/specs/jvms/se8/html/jvms-4.html#jvms-4.4.6' name_and_type_cp_info: + doc-ref: 'https://docs.oracle.com/javase/specs/jvms/se8/html/jvms-4.html#jvms-4.4.6' seq: - id: name_index type: u2 @@ -178,8 +179,8 @@ types: value: _root.constant_pool[descriptor_index - 1].cp_info.as descriptor_as_str: value: descriptor_as_info.value - doc-ref: 'https://docs.oracle.com/javase/specs/jvms/se8/html/jvms-4.html#jvms-4.4.6' utf8_cp_info: + doc-ref: 'https://docs.oracle.com/javase/specs/jvms/se8/html/jvms-4.html#jvms-4.4.7' seq: - id: str_len type: u2 @@ -187,8 +188,8 @@ types: type: str size: str_len encoding: UTF-8 - doc-ref: 'https://docs.oracle.com/javase/specs/jvms/se8/html/jvms-4.html#jvms-4.4.7' method_handle_cp_info: + doc-ref: 'https://docs.oracle.com/javase/specs/jvms/se8/html/jvms-4.html#jvms-4.4.8' seq: - id: reference_kind type: u1 @@ -206,20 +207,20 @@ types: 7: invoke_special 8: new_invoke_special 9: invoke_interface - doc-ref: 'https://docs.oracle.com/javase/specs/jvms/se8/html/jvms-4.html#jvms-4.4.8' method_type_cp_info: + doc-ref: 'https://docs.oracle.com/javase/specs/jvms/se8/html/jvms-4.html#jvms-4.4.9' seq: - id: descriptor_index type: u2 - doc-ref: 'https://docs.oracle.com/javase/specs/jvms/se8/html/jvms-4.html#jvms-4.4.9' invoke_dynamic_cp_info: + doc-ref: 'https://docs.oracle.com/javase/specs/jvms/se8/html/jvms-4.html#jvms-4.4.10' seq: - id: bootstrap_method_attr_index type: u2 - id: name_and_type_index type: u2 - doc-ref: 'https://docs.oracle.com/javase/specs/jvms/se8/html/jvms-4.html#jvms-4.4.10' field_info: + doc-ref: 'https://docs.oracle.com/javase/specs/jvms/se8/html/jvms-4.html#jvms-4.5' seq: - id: access_flags type: u2 @@ -236,7 +237,6 @@ types: instances: name_as_str: value: _root.constant_pool[name_index - 1].cp_info.as.value - doc-ref: 'https://docs.oracle.com/javase/specs/jvms/se8/html/jvms-4.html#jvms-4.5' attribute_info: doc-ref: 'https://docs.oracle.com/javase/specs/jvms/se8/html/jvms-4.html#jvms-4.7' seq: @@ -351,6 +351,7 @@ types: - id: line_number type: u2 method_info: + doc-ref: 'https://docs.oracle.com/javase/specs/jvms/se8/html/jvms-4.html#jvms-4.6' seq: - id: access_flags type: u2 @@ -367,4 +368,3 @@ types: instances: name_as_str: value: _root.constant_pool[name_index - 1].cp_info.as.value - doc-ref: 'https://docs.oracle.com/javase/specs/jvms/se8/html/jvms-4.html#jvms-4.6' diff --git a/executable/mach_o.ksy b/executable/mach_o.ksy index 14a3e9b6f..ffb9c35ae 100644 --- a/executable/mach_o.ksy +++ b/executable/mach_o.ksy @@ -57,7 +57,7 @@ enums: 0x8: bundle # dynamically bound bundle file 0x9: dylib_stub # shared library stub for static linking only, no section contents 0xa: dsym # companion file with only debug sections - 0xb: kext_bundle # x86_64 kexts + 0xb: kext_bundle # x86_64 kexts load_command_type: # http://opensource.apple.com//source/xnu/xnu-1456.1.26/EXTERNAL_HEADERS/mach-o/loader.h 0x80000000: req_dyld @@ -114,6 +114,7 @@ enums: 0x32 : build_version # LC_BUILD_VERSION types: macho_flags: + -webide-representation: "{this:flags}" params: - id: value type: u4 @@ -192,7 +193,6 @@ types: value: value & 0x1000000 != 0 app_extension_safe: value: value & 0x2000000 != 0 - -webide-representation: "{this:flags}" mach_header: seq: - id: cputype @@ -217,6 +217,7 @@ types: type: macho_flags(flags) -webide-parse-mode: eager load_command: + -webide-representation: '{type}: {body}' seq: - id: type type: u4 @@ -269,7 +270,6 @@ types: 'load_command_type::routines' : routines_command 'load_command_type::build_version' : build_version_command 'load_command_type::segment' : segment_command - -webide-representation: '{type}: {body}' vm_prot: seq: - id: strip_read @@ -307,6 +307,7 @@ types: type: b24 doc: Reserved (unused) bits. uleb128: + -webide-representation: "{value:dec}" seq: - id: b1 type: u1 @@ -351,8 +352,8 @@ types: ((b9 % 128) << 56) + ((b8 & 0x80 == 0) ? 0 : ((b10 % 128) << 63)))))))))) -webide-parse-mode: eager - -webide-representation: "{value:dec}" segment_command_64: + -webide-representation: '{segname} ({initprot}): offs={fileoff}, size={filesize}' seq: - id: segname type: str @@ -381,6 +382,7 @@ types: repeat-expr: nsects types: section_64: + -webide-representation: '{sect_name}: offs={offset}, size={size}' seq: - id: sect_name -orig-id: sectname @@ -447,6 +449,7 @@ types: type: eh_frame_item repeat: eos eh_frame_item: + -webide-representation: '{body}' seq: - id: length type: u4 @@ -462,7 +465,6 @@ types: switch-on: id cases: 0: cie - -webide-representation: '{body}' types: char_chain: seq: @@ -472,6 +474,7 @@ types: type: char_chain if: chr != 0 cie: + -webide-representation: 'v:{version:dec} aug:{augmentation_string} code:{code_alignment_factor} data:{data_alignment_factor} returnReg:{return_address_register}' seq: - id: version type: u1 @@ -492,7 +495,6 @@ types: - id: augmentation type: augmentation_entry if: 'aug_str.chr == 122' - -webide-representation: 'v:{version:dec} aug:{augmentation_string} code:{code_alignment_factor} data:{data_alignment_factor} returnReg:{return_address_register}' augmentation_entry: seq: - id: length @@ -512,6 +514,7 @@ types: type: u8 repeat: eos cf_string: + -webide-representation: "isa={isa}, info={info}, data={data}, length={length}" seq: - id: isa type: u8 @@ -521,15 +524,13 @@ types: type: u8 - id: length type: u8 - -webide-representation: "isa={isa}, info={info}, data={data}, length={length}" cf_string_list: seq: - id: items type: cf_string repeat: eos - -webide-representation: '{sect_name}: offs={offset}, size={size}' - -webide-representation: '{segname} ({initprot}): offs={fileoff}, size={filesize}' dyld_info_command: + -webide-representation: 'rebase={rebase_off}, bind={bind_off}, weakBind={weak_bind_off}, lazyBind={lazy_bind_off}, export={export_off}' seq: - id: rebase_off type: u4 @@ -551,7 +552,6 @@ types: type: u4 - id: export_size type: u4 - -webide-representation: 'rebase={rebase_off}, bind={bind_off}, weakBind={weak_bind_off}, lazyBind={lazy_bind_off}, export={export_off}' instances: rebase: io: _root._io @@ -582,6 +582,7 @@ types: repeat-until: _.opcode == opcode::done types: rebase_item: + -webide-representation: "{opcode}, imm:{immediate}, uleb:{uleb}, skip:{skip}" seq: - id: opcode_and_immediate type: u1 @@ -604,7 +605,6 @@ types: immediate: value: "opcode_and_immediate & 0x0f" -webide-parse-mode: eager - -webide-representation: "{opcode}, imm:{immediate}, uleb:{uleb}, skip:{skip}" enums: opcode: 0x00: done @@ -617,6 +617,7 @@ types: 0x70: do_rebase_add_address_uleb 0x80: do_rebase_uleb_times_skipping_uleb bind_item: + -webide-representation: "{opcode}, imm:{immediate}, uleb:{uleb}, skip:{skip}, symbol:{symbol}" seq: - id: opcode_and_immediate type: u1 @@ -644,7 +645,6 @@ types: immediate: value: "opcode_and_immediate & 0x0f" -webide-parse-mode: eager - -webide-representation: "{opcode}, imm:{immediate}, uleb:{uleb}, skip:{skip}, symbol:{symbol}" bind_data: seq: - id: items @@ -657,6 +657,7 @@ types: type: bind_item repeat: eos export_node: + -webide-representation: "{children_count} children, term_size={terminal_size.value}" seq: - id: terminal_size type: uleb128 @@ -668,9 +669,9 @@ types: repeat-expr: children_count - id: terminal size: terminal_size.value - -webide-representation: "{children_count} children, term_size={terminal_size.value}" types: child: + -webide-representation: "{name}: {node_offset}" seq: - id: name type: strz @@ -681,7 +682,6 @@ types: value: pos: node_offset.value type: export_node - -webide-representation: "{name}: {node_offset}" enums: bind_opcode: 0x00: done @@ -698,6 +698,7 @@ types: 0xb0: do_bind_add_address_immediate_scaled 0xc0: do_bind_uleb_times_skipping_uleb symtab_command: + -webide-representation: "symbols: {n_syms:dec}, strtab: {str_off}" seq: - id: sym_off -orig-id: symoff @@ -727,9 +728,8 @@ types: strs: io: _root._io pos: str_off - type: str_table size: str_size - -webide-representation: "symbols: {n_syms:dec}, strtab: {str_off}" + type: str_table types: str_table: seq: @@ -743,6 +743,7 @@ types: repeat-until: _ == "" eos-error: false nlist_64: + -webide-representation: "un={un} type={type} sect={sect} desc={desc} value={value}" seq: - id: un type: u4 @@ -756,12 +757,12 @@ types: type: u8 instances: name: - type: strz pos: _parent.str_off + un + type: strz encoding: utf-8 if: un != 0 - -webide-representation: "un={un} type={type} sect={sect} desc={desc} value={value}" nlist: + -webide-representation: "un={un} type={type} sect={sect} desc={desc} value={value}" seq: - id: un type: u4 @@ -775,11 +776,10 @@ types: type: u4 instances: name: - type: strz pos: _parent.str_off + un + type: strz encoding: utf-8 if: un != 0 - -webide-representation: "un={un} type={type} sect={sect} desc={desc} value={value}" dysymtab_command: seq: - id: i_local_sym @@ -844,6 +844,7 @@ types: repeat: expr repeat-expr: n_indirect_syms lc_str: + -webide-representation: '{value}' seq: - id: length -orig-id: offset @@ -852,18 +853,18 @@ types: -orig-id: ptr type: strz encoding: UTF-8 - -webide-representation: '{value}' dylinker_command: + -webide-representation: '{name}' seq: - id: name type: lc_str - -webide-representation: '{name}' uuid_command: + -webide-representation: 'uuid={uuid}' seq: - id: uuid size: 16 - -webide-representation: 'uuid={uuid}' version: + -webide-representation: '{major:dec}.{minor:dec}' seq: - id: p1 type: u1 @@ -873,7 +874,6 @@ types: type: u1 - id: release type: u1 - -webide-representation: '{major:dec}.{minor:dec}' encryption_info_command: seq: - id: cryptoff @@ -908,33 +908,34 @@ types: type: lc_str routines_command_64: seq: - - id: init_address - type: u8 - - id: init_module - type: u8 - - id: reserved - size: 48 # u8 * 6 + - id: init_address + type: u8 + - id: init_module + type: u8 + - id: reserved + size: 48 # u8 * 6 routines_command: seq: - - id: init_address - type: u4 - - id: init_module - type: u4 - - id: reserved - size: 24 # u4 * 6 + - id: init_address + type: u4 + - id: init_module + type: u4 + - id: reserved + size: 24 # u4 * 6 version_min_command: + -webide-representation: 'v:{version}, r:{reserved}' seq: - id: version type: version - id: sdk type: version - -webide-representation: 'v:{version}, r:{reserved}' source_version_command: + -webide-representation: 'v:{version:dec}' seq: - id: version type: u8 - -webide-representation: 'v:{version:dec}' entry_point_command: + -webide-representation: 'entry_off={entry_off}, stack_size={stack_size}' seq: - id: entry_off -orig-id: entryoff @@ -942,8 +943,8 @@ types: - id: stack_size -orig-id: stacksize type: u8 - -webide-representation: 'entry_off={entry_off}, stack_size={stack_size}' dylib_command: + -webide-representation: '{name}' seq: - id: name_offset type: u4 @@ -956,16 +957,16 @@ types: - id: name type: strz encoding: utf-8 - -webide-representation: '{name}' rpath_command: + -webide-representation: '{path}' seq: - id: path_offset type: u4 - id: path type: strz encoding: utf-8 - -webide-representation: '{path}' linkedit_data_command: + -webide-representation: 'offs={data_off}, size={data_size}' seq: - id: data_off -orig-id: dataoff @@ -973,8 +974,8 @@ types: - id: data_size -orig-id: datasize type: u4 - -webide-representation: 'offs={data_off}, size={data_size}' code_signature_command: + -webide-representation: 'offs={data_off}, size={data_size}' seq: - id: data_off type: u4 @@ -984,9 +985,8 @@ types: code_signature: io: _root._io pos: data_off - type: cs_blob size: data_size - -webide-representation: 'offs={data_off}, size={data_size}' + type: cs_blob cs_blob: seq: - id: magic @@ -1061,9 +1061,9 @@ types: -webide-parse-mode: eager hashes: pos: hash_offset - 8 - hash_size * n_special_slots + size: hash_size repeat: expr repeat-expr: n_special_slots + n_code_slots - size: hash_size blob_index: seq: - id: type @@ -1073,8 +1073,8 @@ types: type: u4be instances: blob: - pos: offset - 8 io: _parent._io + pos: offset - 8 size-eos: true type: cs_blob enums: @@ -1088,6 +1088,7 @@ types: 0x1000: alternate_code_directories # CSSLOT_ALTERNATE_CODEDIRECTORIES 0x10000: signature_slot # CSSLOT_SIGNATURESLOT data: + -webide-representation: "{value}" seq: - id: length type: u4be @@ -1095,8 +1096,8 @@ types: size: length - id: padding size: 4 - (length & 3) - -webide-representation: "{value}" match: + -webide-representation: "{match_op} {data.value:str}" seq: - id: match_op type: u4be @@ -1115,8 +1116,8 @@ types: 6: greater_than 7: less_equal 8: greater_equal - -webide-representation: "{match_op} {data.value:str}" expr: + -webide-representation: '{data}' seq: - id: op type: u4be @@ -1166,34 +1167,34 @@ types: 0: left_cert types: ident_expr: + -webide-representation: "identifier {identifier.value:str}" seq: - id: identifier type: data - -webide-representation: "identifier {identifier.value:str}" apple_generic_anchor_expr: + -webide-representation: "anchor apple generic" instances: value: value: '"anchor apple generic"' - -webide-representation: "anchor apple generic" cert_slot_expr: seq: - id: value type: u4be enum: cert_slot and_expr: + -webide-representation: "({left}) AND ({right})" seq: - id: left type: expr - id: right type: expr - -webide-representation: "({left}) AND ({right})" or_expr: + -webide-representation: "({left}) OR ({right})" seq: - id: left type: expr - id: right type: expr - -webide-representation: "({left}) OR ({right})" anchor_hash_expr: seq: - id: cert_slot @@ -1214,6 +1215,7 @@ types: - id: match type: match cert_field_expr: + -webide-representation: "{cert_slot}[{data.value:str}] {match}" seq: - id: cert_slot type: u4be @@ -1222,8 +1224,8 @@ types: type: data - id: match type: match - -webide-representation: "{cert_slot}[{data.value:str}] {match}" cert_generic_expr: + -webide-representation: "{cert_slot}[{data.value:hex}] {match}" seq: - id: cert_slot type: u4be @@ -1232,8 +1234,6 @@ types: type: data - id: match type: match - -webide-representation: "{cert_slot}[{data.value:hex}] {match}" - -webide-representation: '{data}' requirement: seq: - id: kind @@ -1241,10 +1241,10 @@ types: - id: expr type: expr entitlement: + -webide-representation: "{data:str}" seq: - id: data size-eos: true - -webide-representation: "{data:str}" requirements_blob_index: seq: - id: type @@ -1254,8 +1254,8 @@ types: type: u4be instances: value: - type: cs_blob pos: offset - 8 + type: cs_blob enums: requirement_type: 1: host # kSecHostRequirementType diff --git a/executable/microsoft_pe.ksy b/executable/microsoft_pe.ksy index 22cb84dda..31b9e5076 100644 --- a/executable/microsoft_pe.ksy +++ b/executable/microsoft_pe.ksy @@ -58,9 +58,9 @@ types: instances: certificate_table: pos: optional_hdr.data_dirs.certificate_table.virtual_address - if: optional_hdr.data_dirs.certificate_table.virtual_address != 0 size: optional_hdr.data_dirs.certificate_table.size type: certificate_table + if: optional_hdr.data_dirs.certificate_table.virtual_address != 0 coff_header: doc-ref: 3.3. COFF File Header (Object and Image) seq: @@ -169,15 +169,15 @@ types: pos: 'name_zeroes == 0 ? _parent._parent.symbol_name_table_offset + name_offset : 0' type: str terminator: 0 - encoding: ascii eos-error: false + encoding: ascii if: name_zeroes == 0 name_from_short: pos: 0 type: str terminator: 0 - encoding: ascii eos-error: false + encoding: ascii if: name_zeroes != 0 name: value: 'name_zeroes == 0 ? name_from_offset : name_from_short' @@ -364,6 +364,7 @@ types: type: certificate_entry repeat: eos certificate_entry: + doc-ref: 'https://docs.microsoft.com/en-us/windows/desktop/debug/pe-format#the-attribute-certificate-table-image-only' enums: certificate_revision: 0x0100: @@ -410,4 +411,3 @@ types: -orig-id: bCertificate size: length - 8 doc: Contains a certificate, such as an Authenticode signature. - doc-ref: 'https://docs.microsoft.com/en-us/windows/desktop/debug/pe-format#the-attribute-certificate-table-image-only' diff --git a/executable/python_pyc_27.ksy b/executable/python_pyc_27.ksy index ae1c3fc9b..20a273fd6 100644 --- a/executable/python_pyc_27.ksy +++ b/executable/python_pyc_27.ksy @@ -43,6 +43,7 @@ types: type: op_arg repeat: eos op_arg: + -webide-representation: "{op_code} {arg}" seq: - id: op_code type: u1 @@ -50,7 +51,6 @@ types: - id: arg type: u2 if: "op_code.to_i >= op_code_enum::store_name.to_i" # store_name == have_arguments - -webide-representation: "{op_code} {arg}" enums: op_code_enum: 0 : stop_code @@ -173,6 +173,7 @@ types: 146: set_add 147: map_add code_object: + -webide-representation: "{name.value}" seq: - id: arg_count # argcount type: u4 @@ -203,13 +204,13 @@ types: type: u4 - id: lnotab type: py_object - -webide-representation: "{name.value}" enums: flags_enum: 0x04: has_args 0x08: has_kwargs 0x20: generator py_object: + -webide-representation: "{type}: {value}" seq: - id: type type: u1 @@ -227,16 +228,16 @@ types: "object_type::py_false": py_false "object_type::py_true": py_true "object_type::none": py_none - -webide-representation: "{type}: {value}" types: py_string: + -webide-representation: "{data}" seq: - id: length type: u4 - id: data size: length - -webide-representation: "{data}" interned_string: + -webide-representation: "{data}" seq: - id: length type: u4 @@ -244,13 +245,13 @@ types: type: str size: length encoding: utf-8 - -webide-representation: "{data}" string_ref: + -webide-representation: "#{interned_list_index:dec}" seq: - id: interned_list_index type: u4 - -webide-representation: "#{interned_list_index:dec}" unicode_string: + -webide-representation: "{data}" seq: - id: length type: u4 @@ -258,8 +259,8 @@ types: size: length type: str encoding: utf-8 - -webide-representation: "{data}" tuple: + -webide-representation: "{count:dec} items" seq: - id: count type: u4 @@ -267,7 +268,6 @@ types: type: py_object repeat: expr repeat-expr: count - -webide-representation: "{count:dec} items" py_none: -webide-representation: "None" py_true: diff --git a/executable/uefi_te.ksy b/executable/uefi_te.ksy index 76af3a9a0..ea0922663 100644 --- a/executable/uefi_te.ksy +++ b/executable/uefi_te.ksy @@ -8,25 +8,25 @@ meta: tags: - executable - firmware - ks-version: 0.7 license: CC0-1.0 + ks-version: 0.7 endian: le doc: | - This type of executables could be found inside the UEFI firmware. The UEFI - firmware is stored in SPI flash memory, which is a chip soldered on a - system’s motherboard. UEFI firmware is very modular: it usually contains - dozens, if not hundreds, of executables. To store all these separates files, - the firmware is laid out in volumes using the Firmware File System (FFS), a - file system specifically designed to store firmware images. The volumes - contain files that are identified by GUIDs and each of these files contain - one or more sections holding the data. One of these sections contains the - actual executable image. Most of the executable images follow the PE format. + This type of executables could be found inside the UEFI firmware. The UEFI + firmware is stored in SPI flash memory, which is a chip soldered on a + system’s motherboard. UEFI firmware is very modular: it usually contains + dozens, if not hundreds, of executables. To store all these separates files, + the firmware is laid out in volumes using the Firmware File System (FFS), a + file system specifically designed to store firmware images. The volumes + contain files that are identified by GUIDs and each of these files contain + one or more sections holding the data. One of these sections contains the + actual executable image. Most of the executable images follow the PE format. However, some of them follow the TE format. The Terse Executable (TE) image format was created as a mechanism to reduce - the overhead of the PE/COFF headers in PE32/PE32+ images, resulting in a - corresponding reduction of image sizes for executables running in the PI - (Platform Initialization) Architecture environment. Reducing image size + the overhead of the PE/COFF headers in PE32/PE32+ images, resulting in a + corresponding reduction of image sizes for executables running in the PI + (Platform Initialization) Architecture environment. Reducing image size provides an opportunity for use of a smaller system flash part. So the TE format is basically a stripped version of PE. diff --git a/filesystem/apm_partition_table.ksy b/filesystem/apm_partition_table.ksy index 9c03b010a..d5239382c 100644 --- a/filesystem/apm_partition_table.ksy +++ b/filesystem/apm_partition_table.ksy @@ -5,8 +5,8 @@ meta: - filesystem - macos license: CC0-1.0 - endian: be encoding: ascii + endian: be doc-ref: Specification taken from https://en.wikipedia.org/wiki/Apple_Partition_Map instances: sector_size: @@ -17,8 +17,8 @@ instances: partition_lookup: io: _root._io pos: _root.sector_size - type: partition_entry size: sector_size + type: partition_entry doc: | Every partition entry contains the number of partition entries. We parse the first entry, to know how many to parse, including the first one. @@ -26,8 +26,8 @@ instances: partition_entries: io: _root._io pos: _root.sector_size - type: partition_entry size: sector_size + type: partition_entry repeat: expr repeat-expr: _root.partition_lookup.number_of_partitions types: @@ -50,7 +50,7 @@ types: size: 0x20 - id: partition_type type: strz - size: 0x20 + size: 0x20 - id: data_start type: u4 doc: "First sector" diff --git a/filesystem/apple_single_double.ksy b/filesystem/apple_single_double.ksy index f2266976a..d970eeb89 100644 --- a/filesystem/apple_single_double.ksy +++ b/filesystem/apple_single_double.ksy @@ -1,7 +1,6 @@ meta: id: apple_single_double title: AppleSingle / AppleDouble - endian: be xref: forensicswiki: AppleDouble_header_file justsolve: AppleDouble @@ -11,6 +10,7 @@ meta: - filesystem - macos license: CC0-1.0 + endian: be doc: | AppleSingle and AppleDouble files are used by certain Mac applications (e.g. Finder) to store Mac-specific file attributes on diff --git a/filesystem/btrfs_stream.ksy b/filesystem/btrfs_stream.ksy index 2155872ce..2fef198f1 100644 --- a/filesystem/btrfs_stream.ksy +++ b/filesystem/btrfs_stream.ksy @@ -4,8 +4,8 @@ meta: tags: - filesystem - linux - endian: le license: CC0-1.0 + endian: le doc: | Btrfs is a copy on write file system based on B-trees focusing on fault tolerance, repair and easy administration. Btrfs is intended to address the lack of pooling, snapshots, checksums, and diff --git a/filesystem/cramfs.ksy b/filesystem/cramfs.ksy index 0e5934a9e..71f8ae205 100644 --- a/filesystem/cramfs.ksy +++ b/filesystem/cramfs.ksy @@ -87,7 +87,7 @@ types: value: (mode >> 3) & 0b0111 perm_o: value: mode & 0b0111 - # -- [size_gid] -- + # -- [size_gid] -- size: value: size_gid & 0xFFFFFF gid: diff --git a/filesystem/ext2.ksy b/filesystem/ext2.ksy index 9a887be4e..f1d6cb9b2 100644 --- a/filesystem/ext2.ksy +++ b/filesystem/ext2.ksy @@ -1,18 +1,18 @@ meta: id: ext2 title: ext2 filesystem + xref: + wikidata: Q283527 tags: - filesystem - linux - xref: - wikidata: Q283527 license: CC0-1.0 endian: le instances: # http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/tree/Documentation/filesystems/ext2.txt#n106 bg1: - type: block_group pos: 1024 + type: block_group root_dir: value: bg1.block_groups[0].inodes[1].as_dir types: diff --git a/filesystem/gpt_partition_table.ksy b/filesystem/gpt_partition_table.ksy index dfce06fb7..f61412a41 100644 --- a/filesystem/gpt_partition_table.ksy +++ b/filesystem/gpt_partition_table.ksy @@ -1,8 +1,8 @@ meta: id: gpt_partition_table title: GPT (GUID) partition table - endian: le license: CC0-1.0 + endian: le doc-ref: Specification taken from https://en.wikipedia.org/wiki/GUID_Partition_Table instances: sector_size: @@ -73,4 +73,3 @@ types: type: partition_entry repeat: expr repeat-expr: entries_count - diff --git a/filesystem/iso9660.ksy b/filesystem/iso9660.ksy index 4122af2c9..3c8bc3d1e 100644 --- a/filesystem/iso9660.ksy +++ b/filesystem/iso9660.ksy @@ -269,5 +269,5 @@ instances: sector_size: value: 2048 primary_vol_desc: - type: vol_desc pos: 0x010 * sector_size + type: vol_desc diff --git a/filesystem/luks.ksy b/filesystem/luks.ksy index dfc610de7..f4b3645b0 100644 --- a/filesystem/luks.ksy +++ b/filesystem/luks.ksy @@ -5,8 +5,8 @@ meta: - filesystem - linux license: CC0-1.0 - endian: be encoding: ASCII + endian: be doc: | Linux Unified Key Setup (LUKS) is a format specification for storing disk encryption parameters and up to 8 user keys (which can unlock the master key). diff --git a/filesystem/lvm2.ksy b/filesystem/lvm2.ksy index c2cfbb9b1..6f669b5e5 100644 --- a/filesystem/lvm2.ksy +++ b/filesystem/lvm2.ksy @@ -9,9 +9,9 @@ meta: tags: - filesystem - linux - endian: le - encoding: ascii license: GFDL-1.3+ + encoding: ascii + endian: le doc: | ### Building a test file @@ -24,13 +24,13 @@ doc: | sudo losetup -d /dev/loop1 ``` doc-ref: https://github.com/libyal/libvslvm/blob/master/documentation/Logical%20Volume%20Manager%20(LVM)%20format.asciidoc -instances: - sector_size: - value: 512 # TODO: how about 4k sectors? seq: - id: pv type: physical_volume doc: Physical volume +instances: + sector_size: + value: 512 # TODO: how about 4k sectors? types: physical_volume: seq: diff --git a/filesystem/tr_dos_image.ksy b/filesystem/tr_dos_image.ksy index 10dda3ac9..884ba91be 100644 --- a/filesystem/tr_dos_image.ksy +++ b/filesystem/tr_dos_image.ksy @@ -1,7 +1,7 @@ meta: id: tr_dos_image - file-extension: trd title: "TR-DOS flat-file disk image" + file-extension: trd license: CC0-1.0 endian: le doc: | diff --git a/filesystem/vdi.ksy b/filesystem/vdi.ksy index ad5026f6c..8b69cfc69 100644 --- a/filesystem/vdi.ksy +++ b/filesystem/vdi.ksy @@ -1,13 +1,13 @@ meta: id: vdi title: VirtualBox Disk Image - endian: le - encoding: utf-8 application: - VirtualBox - QEMU - VMWare Workstation license: GPL3.0+ + encoding: utf-8 + endian: le doc-ref: https://github.com/qemu/qemu/blob/master/block/vdi.c # - https://github.com/qemu/qemu/blob/master/block/vdi.c # - https://www.virtualbox.org/browser/vbox/trunk/src/VBox/Storage/VDI.cpp @@ -182,7 +182,7 @@ types: type: b15 - id: zero_expand type: b1 - - id: reserved1 + - id: reserved1 type: b6 - id: diff type: b1 diff --git a/filesystem/vmware_vmdk.ksy b/filesystem/vmware_vmdk.ksy index 4935c2f6e..7ed365f33 100644 --- a/filesystem/vmware_vmdk.ksy +++ b/filesystem/vmware_vmdk.ksy @@ -1,12 +1,12 @@ meta: id: vmware_vmdk - endian: le title: VMWare Virtual Disk file-extension: - vmdk xref: wikidata: Q2658179 license: CC0-1.0 + endian: le doc-ref: 'https://github.com/libyal/libvmdk/blob/master/documentation/VMWare%20Virtual%20Disk%20Format%20(VMDK).asciidoc#41-file-header' seq: - id: magic diff --git a/filesystem/zx_spectrum_tap.ksy b/filesystem/zx_spectrum_tap.ksy index e321949a0..8d641e8e4 100644 --- a/filesystem/zx_spectrum_tap.ksy +++ b/filesystem/zx_spectrum_tap.ksy @@ -1,12 +1,12 @@ meta: id: zx_spectrum_tap - file-extension: tap - endian: le - license: CC0-1.0 title: ZX Spectrum tape file + file-extension: tap xref: justsolve: TAP_(ZX_Spectrum) pronom: fmt/801 + license: CC0-1.0 + endian: le doc: | TAP files are used by emulators of ZX Spectrum computer (released in 1982 by Sinclair Research). TAP file stores blocks of data as if diff --git a/firmware/andes_firmware.ksy b/firmware/andes_firmware.ksy index 93e1cc4bb..1c2a8dfd5 100644 --- a/firmware/andes_firmware.ksy +++ b/firmware/andes_firmware.ksy @@ -1,9 +1,9 @@ meta: id: andes_firmware - endian: le title: Andes Firmware Image layout as seen in MT76 Wifi Chipsets - license: CC0-1.0 application: Firmware Image wifi chipset + license: CC0-1.0 + endian: le doc: Firmware image found with MediaTek MT76xx wifi chipsets. seq: - id: image_header diff --git a/firmware/ines.ksy b/firmware/ines.ksy index 62a3d1c81..f065c890f 100644 --- a/firmware/ines.ksy +++ b/firmware/ines.ksy @@ -2,8 +2,8 @@ meta: id: ines file-extension: nes - encoding: ASCII license: WTFPL + encoding: ASCII doc-ref: https://wiki.nesdev.com/w/index.php/INES seq: - id: header diff --git a/firmware/uimage.ksy b/firmware/uimage.ksy index ca9d9d9fb..868c8c542 100644 --- a/firmware/uimage.ksy +++ b/firmware/uimage.ksy @@ -1,8 +1,8 @@ meta: id: uimage - endian: be - license: CC0-1.0 title: U-Boot Image wrapper + license: CC0-1.0 + endian: be doc: | The new uImage format allows more flexibility in handling images of various types (kernel, ramdisk, etc.), it also enhances integrity protection of images @@ -48,177 +48,177 @@ types: type: strz enums: uimage_os: - 0: - id: invalid + 0: + id: invalid doc: Invalid OS - 1: - id: openbsd + 1: + id: openbsd doc: OpenBSD - 2: - id: netbsd + 2: + id: netbsd doc: NetBSD - 3: - id: freebsd + 3: + id: freebsd doc: FreeBSD - 4: - id: bsd4_4 + 4: + id: bsd4_4 doc: 4.4BSD - 5: - id: linux + 5: + id: linux doc: Linux - 6: - id: svr4 + 6: + id: svr4 doc: SVR4 - 7: - id: esix + 7: + id: esix doc: Esix - 8: - id: solaris + 8: + id: solaris doc: Solaris - 9: - id: irix + 9: + id: irix doc: Irix - 10: - id: sco + 10: + id: sco doc: SCO - 11: - id: dell + 11: + id: dell doc: Dell - 12: - id: ncr + 12: + id: ncr doc: NCR - 13: - id: lynxos + 13: + id: lynxos doc: LynxOS - 14: - id: vxworks + 14: + id: vxworks doc: VxWorks - 15: - id: psos + 15: + id: psos doc: pSOS - 16: - id: qnx + 16: + id: qnx doc: QNX - 17: - id: u_boot + 17: + id: u_boot doc: Firmware - 18: - id: rtems + 18: + id: rtems doc: RTEMS - 19: - id: artos + 19: + id: artos doc: ARTOS - 20: - id: unity + 20: + id: unity doc: Unity OS - 21: - id: integrity + 21: + id: integrity doc: INTEGRITY uimage_arch: - 0: - id: invalid + 0: + id: invalid doc: Invalid CPU - 1: - id: alpha + 1: + id: alpha doc: Alpha - 2: - id: arm + 2: + id: arm doc: ARM - 3: - id: i386 + 3: + id: i386 doc: Intel x86 - 4: - id: ia64 + 4: + id: ia64 doc: IA64 - 5: - id: mips + 5: + id: mips doc: MIPS - 6: - id: mips64 + 6: + id: mips64 doc: MIPS 64 Bit - 7: - id: ppc + 7: + id: ppc doc: PowerPC - 8: - id: s390 + 8: + id: s390 doc: IBM S390 - 9: - id: sh + 9: + id: sh doc: SuperH - 10: - id: sparc + 10: + id: sparc doc: Sparc - 11: - id: sparc64 + 11: + id: sparc64 doc: Sparc 64 Bit - 12: - id: m68k + 12: + id: m68k doc: M68K - 13: - id: nios + 13: + id: nios doc: Nios-32 - 14: - id: microblaze + 14: + id: microblaze doc: MicroBlaze - 15: - id: nios2 + 15: + id: nios2 doc: Nios-II - 16: - id: blackfin + 16: + id: blackfin doc: Blackfin - 17: - id: avr32 + 17: + id: avr32 doc: AVR32 - 18: - id: st200 + 18: + id: st200 doc: STMicroelectronics ST200 uimage_comp: - 0: + 0: id: none doc: No Compression Used - 1: - id: gzip + 1: + id: gzip doc: gzip Compression Used - 2: + 2: id: bzip2 doc: bzip2 Compression Used - 3: - id: lzma + 3: + id: lzma doc: lzma Compression Used - 4: - id: lzo + 4: + id: lzo doc: lzo Compression Used uimage_type: - 0: - id: invalid + 0: + id: invalid doc: Invalid Image - 1: - id: standalone + 1: + id: standalone doc: Standalone Program - 2: - id: kernel + 2: + id: kernel doc: OS Kernel Image - 3: - id: ramdisk + 3: + id: ramdisk doc: RAMDisk Image - 4: - id: multi + 4: + id: multi doc: Multi-File Image - 5: - id: firmware + 5: + id: firmware doc: Firmware Image - 6: - id: script + 6: + id: script doc: Script file - 7: - id: filesystem + 7: + id: filesystem doc: Filesystem Image (any type) - 8: - id: flatdt + 8: + id: flatdt doc: Binary Flat Device Tree Blob - 9: - id: kwbimage + 9: + id: kwbimage doc: Kirkwood Boot Image - 10: - id: imximage + 10: + id: imximage doc: Freescale IMXBoot Image diff --git a/font/pcf_font.ksy b/font/pcf_font.ksy index 0289abc36..c4879befe 100644 --- a/font/pcf_font.ksy +++ b/font/pcf_font.ksy @@ -5,9 +5,9 @@ meta: xref: justsolve: PCF wikidata: Q3398726 + ks-version: 0.9 imports: - /common/bytes_with_io - ks-version: 0.9 encoding: UTF-8 endian: le doc: | @@ -41,6 +41,7 @@ types: Table offers a offset + length pointer to a particular table. "Type" of table references certain enum. Applications can ignore enum values which they don't support. + -webide-representation: "{type}" seq: - id: type type: u4 @@ -69,13 +70,13 @@ types: 'types::swidths': swidths 'types::glyph_names': glyph_names # TODO: bdf_accelerators - -webide-representation: "{type}" types: properties: doc: | Array of properties (key-value pairs), used to convey different X11 settings of a font. Key is always an X font atom. doc-ref: 'https://fontforge.org/docs/techref/pcf-format.html#properties-table' + -webide-representation: "{num_props:dec} properties" seq: - id: format type: format @@ -96,7 +97,6 @@ types: doc: | Strings buffer. Never used directly, but instead is addressed by offsets from the properties. - -webide-representation: "{num_props:dec} properties" types: prop: doc: | @@ -107,6 +107,7 @@ types: Simple offset-based mechanism is employed to keep this type's sequence fixed-sized and thus have simple access to property key/value by index. + -webide-representation: "{name} => {str_value}/{int_value}" seq: - id: ofs_name type: u4 @@ -125,15 +126,15 @@ types: value in the strings buffer. instances: name: - pos: ofs_name io: _parent.strings._io + pos: ofs_name type: strz doc: | Name of the property addressed in the strings buffer. -webide-parse-mode: eager str_value: - pos: value_or_ofs_value io: _parent.strings._io + pos: value_or_ofs_value type: strz if: is_string != 0 doc: | @@ -148,14 +149,13 @@ types: -webide-parse-mode: eager # As of Kaitai Struct 0.9, `value` fails with: - # + # # "can't combine output types: StrFromBytesType(BytesTerminatedType(0,false,true,true,None),UTF-8) vs IntMultiType(false,Width4,Some(LittleEndian))" # # ... so currently it's commented out. #value: # value: '(is_string != 0) ? str_value : int_value' - -webide-representation: "{name} => {str_value}/{int_value}" bitmaps: doc: | Table containing uncompressed glyph bitmaps. @@ -207,6 +207,7 @@ types: doc: | Table containing scalable widths of characters. doc-ref: 'https://fontforge.org/docs/techref/pcf-format.html#the-scalable-widths-table' + -webide-representation: '{num_glyphs:dec} glyphs' seq: - id: format type: format @@ -219,11 +220,11 @@ types: doc: | The scalable width of a character is the width of the corresponding PostScript character in em-units (1/1000ths of an em). - -webide-representation: '{num_glyphs:dec} glyphs' glyph_names: doc: | Table containing character names for every glyph. doc-ref: 'https://fontforge.org/docs/techref/pcf-format.html#the-glyph-names-table' + -webide-representation: '{num_glyphs:dec} glyphs' seq: - id: format type: format @@ -243,19 +244,18 @@ types: type: bytes_with_io doc: | Strings buffer which contains all glyph names. - -webide-representation: '{num_glyphs:dec} glyphs' types: string_ref: + -webide-representation: '{value}' seq: - id: ofs_string type: u4 instances: value: - pos: ofs_string io: _parent.strings._io + pos: ofs_string type: strz -webide-parse-mode: eager - -webide-representation: '{value}' format: doc: | Table format specifier, always 4 bytes. Original implementation treats diff --git a/font/ttf.ksy b/font/ttf.ksy index f2102bc60..f02c6623a 100644 --- a/font/ttf.ksy +++ b/font/ttf.ksy @@ -1,7 +1,7 @@ meta: id: ttf - file-extension: ttf title: TrueType Font File + file-extension: ttf xref: justsolve: TrueType pronom: x-fmt/453 @@ -21,12 +21,12 @@ seq: repeat-expr: offset_table.num_tables types: fixed: + -webide-representation: '{major:dec}.{minor:dec}' seq: - id: major type: u2 - id: minor type: u2 - -webide-representation: '{major:dec}.{minor:dec}' offset_table: seq: - id: sfnt_version @@ -40,6 +40,7 @@ types: - id: range_shift type: u2 dir_table_entry: + -webide-representation: '{tag} [{length:dec}b]: {value}' seq: - id: tag type: str @@ -53,9 +54,9 @@ types: type: u4 instances: value: - size: length io: _root._io pos: offset + size: length type: switch-on: tag cases: @@ -72,11 +73,11 @@ types: "'post'": post "'name'": name -webide-parse-mode: eager - -webide-representation: '{tag} [{length:dec}b]: {value}' cmap: doc: > cmap - Character To Glyph Index Mapping Table This table defines the mapping of character codes to the glyph index values used in the font. + -webide-represetation: "hello" seq: - id: version_number type: u2 @@ -86,9 +87,9 @@ types: type: subtable_header repeat: expr repeat-expr: number_of_encoding_tables - -webide-represetation: "hello" types: subtable_header: + -webide-representation: "p:{platform_id:dec}, e:{encoding_id:dec}" seq: - id: platform_id type: u2 @@ -96,7 +97,6 @@ types: type: u2 - id: subtable_offset type: u4 - -webide-representation: "p:{platform_id:dec}, e:{encoding_id:dec}" instances: table: type: subtable @@ -766,6 +766,7 @@ types: format0: types: kerning_pair: + -webide-representation: '{left:dec}+{right:dec}: {value:dec}' seq: - id: left type: u2 @@ -773,7 +774,6 @@ types: type: u2 - id: value type: s2 - -webide-representation: '{left:dec}+{right:dec}: {value:dec}' seq: - id: pair_count type: u2 @@ -868,6 +868,7 @@ types: format20: types: pascal_string: + -webide-representation: "{value}" seq: - id: length type: u1 @@ -876,7 +877,6 @@ types: size: length encoding: ascii if: length != 0 - -webide-representation: "{value}" seq: - id: number_of_glyphs type: u2 @@ -921,6 +921,7 @@ types: doc-ref: https://developer.apple.com/fonts/TrueType-Reference-Manual/RM06/Chap6name.html types: name_record: + -webide-representation: "{ascii_value}" seq: - id: platform_id -orig-id: platformID @@ -959,7 +960,6 @@ types: pos: _parent.ofs_strings + ofs_str #if: encoding_id == 1 -webide-parse-mode: eager - -webide-representation: "{ascii_value}" seq: - id: format_selector -orig-id: format diff --git a/game/allegro_dat.ksy b/game/allegro_dat.ksy index 3e10f10b4..12ef28ce6 100644 --- a/game/allegro_dat.ksy +++ b/game/allegro_dat.ksy @@ -3,8 +3,8 @@ meta: title: Allegro data file application: Allegro library (v2.2-v4.4) license: CC0-1.0 - endian: be encoding: UTF-8 + endian: be doc: | Allegro library for C (mostly used for game and multimedia apps programming) used its own container file format. diff --git a/game/fallout2_dat.ksy b/game/fallout2_dat.ksy index 3a05cc986..aac6be7ec 100644 --- a/game/fallout2_dat.ksy +++ b/game/fallout2_dat.ksy @@ -1,8 +1,8 @@ meta: id: fallout2_dat - endian: le application: Fallout2 license: CC0-1.0 + endian: le types: pstr: seq: diff --git a/game/fallout_dat.ksy b/game/fallout_dat.ksy index 4b61b3bf5..9fc39520a 100644 --- a/game/fallout_dat.ksy +++ b/game/fallout_dat.ksy @@ -1,8 +1,8 @@ meta: id: fallout_dat - endian: be application: Fallout license: CC0-1.0 + endian: be seq: - id: folder_count type: u4 diff --git a/game/gran_turismo_vol.ksy b/game/gran_turismo_vol.ksy index 2b07a1a4f..cac9a202e 100644 --- a/game/gran_turismo_vol.ksy +++ b/game/gran_turismo_vol.ksy @@ -1,9 +1,9 @@ meta: id: gran_turismo_vol - endian: le - license: CC0-1.0 - file-extension: vol title: Gran Turismo File System (GTFS) + file-extension: vol + license: CC0-1.0 + endian: le seq: - id: magic contents: ["GTFS", 0, 0, 0, 0] diff --git a/game/heaps_pak.ksy b/game/heaps_pak.ksy index 221fac0bf..c73b5ca21 100644 --- a/game/heaps_pak.ksy +++ b/game/heaps_pak.ksy @@ -1,10 +1,10 @@ meta: id: heaps_pak - file-extension: pak application: Games based on Haxe Game Framework "Heaps" (e.g. Dead Cells) - endian: le + file-extension: pak license: MIT encoding: UTF-8 + endian: le doc-ref: 'https://github.com/HeapsIO/heaps/blob/2bbc2b386952dfd8856c04a854bb706a52cb4b58/hxd/fmt/pak/Reader.hx' seq: - id: header diff --git a/game/heroes_of_might_and_magic_agg.ksy b/game/heroes_of_might_and_magic_agg.ksy index b78f4f9e0..74ac989de 100644 --- a/game/heroes_of_might_and_magic_agg.ksy +++ b/game/heroes_of_might_and_magic_agg.ksy @@ -35,7 +35,7 @@ types: instances: filenames: pos: entries.last.offset + entries.last.size - type: filename size: 15 + type: filename repeat: expr repeat-expr: num_files diff --git a/game/quake_mdl.ksy b/game/quake_mdl.ksy index ef08fea9f..a85705c83 100644 --- a/game/quake_mdl.ksy +++ b/game/quake_mdl.ksy @@ -1,11 +1,11 @@ meta: id: quake_mdl - endian: le title: Quake 1 (idtech2) model format (MDL version 6) application: Quake 1 (idtech2) file-extension: mdl license: CC0-1.0 ks-version: 0.7 + endian: le seq: - id: header type: mdl_header diff --git a/game/quake_pak.ksy b/game/quake_pak.ksy index aa6a7c04f..8815c333e 100644 --- a/game/quake_pak.ksy +++ b/game/quake_pak.ksy @@ -1,7 +1,7 @@ meta: id: quake_pak - file-extension: pak application: Quake game engine + file-extension: pak license: CC0-1.0 endian: le doc-ref: 'https://quakewiki.org/wiki/.pak#Format_specification' @@ -37,6 +37,6 @@ types: type: u4 instances: body: + io: _root._io pos: ofs size: size - io: _root._io diff --git a/game/renderware_binary_stream.ksy b/game/renderware_binary_stream.ksy index fdad6d7fc..09666c362 100644 --- a/game/renderware_binary_stream.ksy +++ b/game/renderware_binary_stream.ksy @@ -223,7 +223,7 @@ types: - id: z type: f4 - id: radius - type: f4 + type: f4 enums: sections: 0x0001: struct diff --git a/game/saints_row_2_vpp_pc.ksy b/game/saints_row_2_vpp_pc.ksy index 5036b0ea0..c5b9521f0 100644 --- a/game/saints_row_2_vpp_pc.ksy +++ b/game/saints_row_2_vpp_pc.ksy @@ -1,10 +1,10 @@ meta: id: saints_row_2_vpp_pc - endian: le - encoding: UTF-8 - license: MIT title: Saints Rows 2 game packages file-extension: vpp_pc + license: MIT + encoding: UTF-8 + endian: le seq: - id: magic contents: [0xce, 0x0a, 0x89, 0x51, 0x04] @@ -74,16 +74,16 @@ types: type: s4 instances: filename: - pos: name_ofs io: _root.filenames._io + pos: name_ofs type: strz ext: - pos: ext_ofs io: _root.extensions._io + pos: ext_ofs type: strz body: - pos: _root.data_start + ofs_body io: _root._io + pos: _root.data_start + ofs_body size: len_body strings: seq: diff --git a/game/warcraft_2_pud.ksy b/game/warcraft_2_pud.ksy index 69f229ad2..9d449c6ee 100644 --- a/game/warcraft_2_pud.ksy +++ b/game/warcraft_2_pud.ksy @@ -1,8 +1,8 @@ meta: id: warcraft_2_pud title: Warcraft II map files - file-extension: pud application: Warcraft II engine + file-extension: pud xref: justsolve: Warcraft_II_PUD wikidata: Q28009492 diff --git a/hardware/mifare/mifare_classic.ksy b/hardware/mifare/mifare_classic.ksy index abc151d33..baa3c5db2 100644 --- a/hardware/mifare/mifare_classic.ksy +++ b/hardware/mifare/mifare_classic.ksy @@ -28,7 +28,7 @@ types: - id: manufacturer type: manufacturer if: has_manufacturer - + - id: data_filler -orig-id: abtData size: _io.size - _io.pos - 16 # sizeof(trailer) @@ -126,7 +126,7 @@ types: value: 4 ac_count_of_chunks: value: ac_bits*2 #6 - + types: access_conditions: seq: @@ -196,7 +196,7 @@ types: doc: "c3 c2 c1" inv_shift_val: value: (bits[0].n << 2) | (bits[1].n << 1) | bits[2].n - + types: ac_bit: params: @@ -209,7 +209,7 @@ types: value: (chunk >> i) & 1 b: value: n == 1 - + trailer_ac: params: - id: ac @@ -235,7 +235,7 @@ types: value: ac.val <= 0b110 write_key_a_required: value: ac.val == 0 - + write_key_b_required: value: (not read_key_a_required or read_key_b_required) and not ac.bits[0].b diff --git a/image/bmp.ksy b/image/bmp.ksy index 8823eb4cd..d23b5ba03 100644 --- a/image/bmp.ksy +++ b/image/bmp.ksy @@ -16,9 +16,9 @@ meta: wikidata: Q192869 tags: - windows - endian: le license: CC0-1.0 ks-version: 0.9 + endian: le # ks-opaque-types: true # uncomment if you provide an opaque type `bitmap` for bitmap data doc: | The **BMP file format**, also known as **bitmap image file** or **device independent @@ -393,8 +393,8 @@ types: type: u4 enum: intent - id: ofs_profile - doc: The offset, in bytes, from the beginning of the BITMAPV5HEADER structure to the start of the profile data. -orig-id: bV5ProfileData + doc: The offset, in bytes, from the beginning of the BITMAPV5HEADER structure to the start of the profile data. type: u4 - id: len_profile -orig-id: bV5ProfileSize @@ -452,8 +452,8 @@ types: - id: blue_mask type: u4 - id: alpha_mask - if: has_alpha_mask type: u4 + if: has_alpha_mask rgb_record: -orig-id: - RGB_TRIPLE @@ -469,8 +469,8 @@ types: - id: red type: u1 - id: reserved - if: has_reserved_field type: u1 + if: has_reserved_field -webide-representation: "rgb({red:dec}, {green:dec}, {blue:dec})" # Common types fixed_point_2_dot_30: @@ -583,20 +583,20 @@ enums: # https://docs.microsoft.com/en-us/windows/win32/api/wingdi/ns-wingdi-bitmapv5header#members 8: id: abs_colorimetric - doc: Maintains the white point. Matches the colors to their nearest color in the destination gamut. -orig-id: LCS_GM_ABS_COLORIMETRIC + doc: Maintains the white point. Matches the colors to their nearest color in the destination gamut. 1: id: business - doc: Maintains saturation. Used for business charts and other situations in which undithered colors are required. -orig-id: LCS_GM_BUSINESS + doc: Maintains saturation. Used for business charts and other situations in which undithered colors are required. 2: id: graphics - doc: Maintains colorimetric match. Used for graphic designs and named colors. -orig-id: LCS_GM_GRAPHICS + doc: Maintains colorimetric match. Used for graphic designs and named colors. 4: id: images - doc: Maintains contrast. Used for photographs and natural images. -orig-id: LCS_GM_IMAGES + doc: Maintains contrast. Used for photographs and natural images. header_type: # https://forums.adobe.com/servlet/JiveServlet/showImage/2-3273299-47801/BMP_Headers.png diff --git a/image/exif.ksy b/image/exif.ksy index d53a4dce7..5d26a10f1 100644 --- a/image/exif.ksy +++ b/image/exif.ksy @@ -20,8 +20,8 @@ types: type: u4 instances: ifd0: - type: ifd pos: ifd0_ofs + type: ifd types: ifd: seq: @@ -58,10 +58,10 @@ types: is_immediate_data: value: 'byte_length <= 4' data: + io: _root._io pos: ofs_or_data size: byte_length if: not is_immediate_data - io: _root._io enums: field_type_enum: 1: byte diff --git a/image/gif.ksy b/image/gif.ksy index fe735f44a..c31abc05b 100644 --- a/image/gif.ksy +++ b/image/gif.ksy @@ -1,7 +1,7 @@ meta: id: gif - file-extension: gif title: GIF (Graphics Interchange Format) image file + file-extension: gif xref: justsolve: GIF loc: fdd000133 @@ -9,8 +9,8 @@ meta: pronom: - fmt/3 - fmt/4 - endian: le license: CC0-1.0 + endian: le doc: | GIF (Graphics Interchange Format) is an image file format, developed in 1987. It became popular in 1990s as one of the main image formats diff --git a/image/icc_4.ksy b/image/icc_4.ksy index 97b5b2f3a..0c95c3c05 100644 --- a/image/icc_4.ksy +++ b/image/icc_4.ksy @@ -158,16 +158,16 @@ types: 0x41435449: actix_sytems_inc #ACTI 0x41444152: adara_technology_inc #ADAR 0x41444245: adobe_systems_incorporated #ADBE - 0x41444920: adi_systems_inc #ADI + 0x41444920: adi_systems_inc #ADI 0x41474641: agfa_graphics_nv #AGFA 0x414C4D44: alps_electric_usa_inc #ALMD 0x414C5053: alps_electric_usa_inc_2 #ALPS 0x414C574E: alwan_color_expertise #ALWN 0x414D5449: amiable_technologies_inc #AMTI - 0x414F4320: aoc_international_usa_ltd #AOC + 0x414F4320: aoc_international_usa_ltd #AOC 0x41504147: apago #APAG 0x4150504C: apple_computer_inc #APPL - 0x41535420: ast #AST + 0x41535420: ast #AST 0x41542654: atandt_computer_systems #AT&T 0x4241454C: barbieri_electronic #BAEL 0x62657267: bergdesign_incorporated #berg @@ -176,18 +176,18 @@ types: 0x42524B50: breakpoint_pty_limited #BRKP 0x42524F54: brother_industries_ltd #BROT 0x42554C4C: bull #BULL - 0x42555320: bus_computer_systems #BUS + 0x42555320: bus_computer_systems #BUS 0x432D4954: c_itoh #C-IT 0x43414D52: intel_corporation #CAMR 0x43414E4F: canon_inc_canon_development_americas_inc #CANO 0x43415252: carroll_touch #CARR 0x43415349: casio_computer_co_ltd #CASI 0x43425553: colorbus_pl #CBUS - 0x43454C20: crossfield #CEL + 0x43454C20: crossfield #CEL 0x43454C78: crossfield_2 #CELx 0x63657964: integrated_color_solutions_inc #ceyd - 0x43475320: cgs_publishing_technologies_international_gmbh #CGS - 0x43484D20: rochester_robotics #CHM + 0x43475320: cgs_publishing_technologies_international_gmbh #CGS + 0x43484D20: rochester_robotics #CHM 0x4349474C: colour_imaging_group_london #CIGL 0x43495449: citizen #CITI 0x434C3030: candela_ltd #CL00 @@ -200,24 +200,24 @@ types: 0x434F4D70: compeq_usa_focus_technology #COMp 0x434F4E52: conrac_display_products #CONR 0x434F5244: cordata_technologies_inc #CORD - 0x43505120: compaq_computer_corporation_2 #CPQ + 0x43505120: compaq_computer_corporation_2 #CPQ 0x4350524F: colorpro #CPRO - 0x43524E20: cornerstone #CRN - 0x43545820: ctx_international_inc #CTX + 0x43524E20: cornerstone #CRN + 0x43545820: ctx_international_inc #CTX 0x43564953: colorvision #CVIS - 0x43574320: fujitsu_laboratories_ltd #CWC + 0x43574320: fujitsu_laboratories_ltd #CWC 0x44415249: darius_technology_ltd #DARI 0x44415441: dataproducts #DATA - 0x44435020: dry_creek_photo #DCP + 0x44435020: dry_creek_photo #DCP 0x44435243: digital_contents_resource_center_chung_ang_university #DCRC 0x44454C4C: dell_computer_corporation #DELL - 0x44494320: dainippon_ink_and_chemicals #DIC + 0x44494320: dainippon_ink_and_chemicals #DIC 0x4449434F: diconix #DICO 0x44494749: digital #DIGI 0x444C2643: digital_light_and_color #DL&C 0x44504C47: doppelganger_llc #DPLG - 0x44532020: dainippon_screen #DS - 0x64732020: dainippon_screen_2 #ds + 0x44532020: dainippon_screen #DS + 0x64732020: dainippon_screen_2 #ds 0x44534F4C: doosol #DSOL 0x4455504E: dupont #DUPN 0x6475706E: dupont_2 #dupn @@ -228,61 +228,61 @@ types: 0x45564552: everex_systems_inc #EVER 0x45584143: exactcode_gmbh #EXAC 0x46414C43: falco_data_products_inc #FALC - 0x46462020: fuji_photo_film_coltd #FF + 0x46462020: fuji_photo_film_coltd #FF 0x46464549: fujifilm_electronic_imaging_ltd #FFEI 0x66666569: fujifilm_electronic_imaging_ltd_2 #ffei 0x666C7578: fluxdata_corporation #flux 0x464E5244: fnord_software #FNRD 0x464F5241: fora_inc #FORA 0x464F5245: forefront_technology_corporation #FORE - 0x46502A2A: fujitsu #FP - 0x46504120: waytech_development_inc #FPA + 0x46502A2A: fujitsu #FP + 0x46504120: waytech_development_inc #FPA 0x46554A49: fujitsu_2 #FUJI - 0x46582020: fuji_xerox_co_ltd #FX - 0x47434320: gcc_technologies_inc #GCC + 0x46582020: fuji_xerox_co_ltd #FX + 0x47434320: gcc_technologies_inc #GCC 0x4747534C: global_graphics_software_limited #GGSL - 0x474D4220: gretagmacbeth #GMB - 0x474D4720: gmg_gmbh_and_co_kg #GMG + 0x474D4220: gretagmacbeth #GMB + 0x474D4720: gmg_gmbh_and_co_kg #GMG 0x474F4C44: goldstar_technology_inc #GOLD 0x47505254: giantprint_pty_ltd #GPRT 0x47544D42: gretagmacbeth_2 #GTMB - 0x47564320: waytech_development_inc_2 #GVC + 0x47564320: waytech_development_inc_2 #GVC 0x4757324B: sony_corporation #GW2K - 0x48434920: hci #HCI - 0x48444D20: heidelberger_druckmaschinen_ag #HDM + 0x48434920: hci #HCI + 0x48444D20: heidelberger_druckmaschinen_ag #HDM 0x4845524D: hermes #HERM 0x48495441: hitachi_america_ltd #HITA 0x48695469: hiti_digital_inc #HiTi - 0x48502020: hewlett_packard #HP - 0x48544320: hitachi_ltd #HTC - 0x49424D20: ibm_corporation #IBM + 0x48502020: hewlett_packard #HP + 0x48544320: hitachi_ltd #HTC + 0x49424D20: ibm_corporation #IBM 0x49444E54: scitex_corporation_ltd #IDNT 0x49646E74: scitex_corporation_ltd_2 #Idnt - 0x49454320: hewlett_packard_2 #IEC + 0x49454320: hewlett_packard_2 #IEC 0x49495941: iiyama_north_america_inc #IIYA 0x494B4547: ikegami_electronics_inc #IKEG 0x494D4147: image_systems_corporation #IMAG - 0x494D4920: ingram_micro_inc #IMI + 0x494D4920: ingram_micro_inc #IMI 0x496E6361: inca_digital_printers_ltd #Inca 0x494E5443: intel_corporation_2 #INTC 0x494E544C: intl #INTL 0x494E5452: intra_electronics_usa_inc #INTR 0x494F434F: iocomm_international_technology_corporation #IOCO - 0x49505320: infoprint_solutions_company #IPS + 0x49505320: infoprint_solutions_company #IPS 0x49524953: scitex_corporation_ltd_3 #IRIS 0x49726973: scitex_corporation_ltd_4 #Iris 0x69726973: scitex_corporation_ltd_5 #iris - 0x49534C20: ichikawa_soft_laboratory #ISL + 0x49534C20: ichikawa_soft_laboratory #ISL 0x49544E4C: itnl #ITNL - 0x49564d20: ivm #IVM + 0x49564d20: ivm #IVM 0x49574154: iwatsu_electric_co_ltd #IWAT 0x4A534654: jetsoft_development #JSFT - 0x4A564320: jvc_information_products_co #JVC + 0x4A564320: jvc_information_products_co #JVC 0x4B415254: scitex_corporation_ltd_6 #KART 0x4B617274: scitex_corporation_ltd_7 #Kart 0x6B617274: scitex_corporation_ltd_8 #kart - 0x4B464320: kfc_computek_components_corporation #KFC - 0x4B4C4820: klh_computers #KLH + 0x4B464320: kfc_computek_components_corporation #KFC + 0x4B4C4820: klh_computers #KLH 0x4B4D4844: konica_minolta_holdings_inc #KMHD 0x4B4E4341: konica_corporation #KNCA 0x4B4F4441: kodak #KODA @@ -314,15 +314,15 @@ types: 0x4D534654: microsoft_corporation #MSFT 0x4D55544F: mutoh_industries_ltd #MUTO 0x4E414E41: nanao_usa_corporation #NANA - 0x4E454320: nec_corporation #NEC + 0x4E454320: nec_corporation #NEC 0x4E455850: nexpress_solutions_llc #NEXP 0x4E495353: nissei_sangyo_america_ltd #NISS 0x4E4B4F4E: nikon_corporation #NKON 0x6F623464: erdt_systems_gmbh_and_co_kg_2 #ob4d 0x6F626963: medigraph_gmbh #obic - 0x4F434520: oce_technologies_bv #OCE + 0x4F434520: oce_technologies_bv #OCE 0x4F434543: ocecolor #OCEC - 0x4F4B4920: oki #OKI + 0x4F4B4920: oki #OKI 0x4F4B4944: okidata #OKID 0x4F4B4950: okidata_2 #OKIP 0x4F4C4956: olivetti #OLIV @@ -332,8 +332,8 @@ types: 0x5041434B: packard_bell #PACK 0x50414E41: matsushita_electric_industrial_co_ltd #PANA 0x50414E54: pantone_inc #PANT - 0x50424E20: packard_bell_2 #PBN - 0x50465520: pfu_limited #PFU + 0x50424E20: packard_bell_2 #PBN + 0x50465520: pfu_limited #PFU 0x5048494C: philips_consumer_electronics_co #PHIL 0x504E5458: hoya_corporation_pentax_imaging_systems_division #PNTX 0x504F6E65: phase_one_a_s #POne @@ -341,22 +341,22 @@ types: 0x5052494E: princeton_graphic_systems #PRIN 0x50524950: princeton_publishing_labs #PRIP 0x514C5558: qlux #QLUX - 0x514D5320: qms_inc #QMS + 0x514D5320: qms_inc #QMS 0x51504344: qpcard_ab #QPCD 0x51554144: quadlaser #QUAD 0x71756279: qubyx_sarl #quby 0x51554D45: qume_corporation #QUME 0x52414449: radius_inc #RADI 0x52444478: integrated_color_solutions_inc_2 #RDDx - 0x52444720: roland_dg_corporation #RDG + 0x52444720: roland_dg_corporation #RDG 0x5245444D: redms_group_inc #REDM 0x52454C49: relisys #RELI 0x52474D53: rolf_gierling_multitools #RGMS 0x5249434F: ricoh_corporation #RICO 0x524E4C44: edmund_ronald #RNLD 0x524F5941: royal #ROYA - 0x52504320: ricoh_printing_systemsltd #RPC - 0x52544C20: royal_information_electronics_co_ltd #RTL + 0x52504320: ricoh_printing_systemsltd #RPC + 0x52544C20: royal_information_electronics_co_ltd #RTL 0x53414D50: sampo_corporation_of_america #SAMP 0x53414D53: samsung_inc #SAMS 0x53414E54: jaime_santana_pomares #SANT @@ -365,10 +365,10 @@ types: 0x73636974: scitex_corporation_ltd_11 #scit 0x5343524E: dainippon_screen_3 #SCRN 0x7363726E: dainippon_screen_4 #scrn - 0x53445020: scitex_corporation_ltd_12 #SDP - 0x53647020: scitex_corporation_ltd_13 #Sdp - 0x73647020: scitex_corporation_ltd_14 #sdp - 0x53454320: samsung_electronics_coltd #SEC + 0x53445020: scitex_corporation_ltd_12 #SDP + 0x53647020: scitex_corporation_ltd_13 #Sdp + 0x73647020: scitex_corporation_ltd_14 #sdp + 0x53454320: samsung_electronics_coltd #SEC 0x5345494B: seiko_instruments_usa_inc #SEIK 0x5345496B: seikosha #SEIk 0x53475559: scanguycom #SGUY @@ -379,25 +379,25 @@ types: 0x536F6E79: sony_corporation_3 #Sony 0x5350434C: spectracal #SPCL 0x53544152: star #STAR - 0x53544320: sampo_technology_corporation #STC + 0x53544320: sampo_technology_corporation #STC 0x54414C4F: talon_technology_corporation #TALO 0x54414E44: tandy #TAND 0x54415455: tatung_co_of_america_inc #TATU 0x54415841: taxan_america_inc #TAXA - 0x54445320: tokyo_denshi_sekei_kk #TDS + 0x54445320: tokyo_denshi_sekei_kk #TDS 0x5445434F: teco_information_systems_inc #TECO 0x54454752: tegra #TEGR 0x54454B54: tektronix_inc #TEKT - 0x54492020: texas_instruments #TI + 0x54492020: texas_instruments #TI 0x544D4B52: typemaker_ltd #TMKR 0x544F5342: toshiba_corp #TOSB 0x544F5348: toshiba_inc #TOSH 0x544F544B: totoku_electric_co_ltd #TOTK 0x54524955: triumph #TRIU 0x54534254: toshiba_tec_corporation #TSBT - 0x54545820: ttx_computer_products_inc #TTX - 0x54564D20: tvm_professional_monitor_corporation #TVM - 0x54572020: tw_casper_corporation #TW + 0x54545820: ttx_computer_products_inc #TTX + 0x54564D20: tvm_professional_monitor_corporation #TVM + 0x54572020: tw_casper_corporation #TW 0x554C5358: ulead_systems #ULSX 0x554E4953: unisys #UNIS 0x55545A46: utz_fehlau_and_sohn #UTZF diff --git a/image/ico.ksy b/image/ico.ksy index 18a49aca7..ffcd5bc6a 100644 --- a/image/ico.ksy +++ b/image/ico.ksy @@ -4,8 +4,8 @@ meta: file-extension: ico tags: - windows - endian: le license: CC0-1.0 + endian: le doc: | Microsoft Windows uses specific file format to store applications icons - ICO. This is a container that contains one or more image diff --git a/image/nitf.ksy b/image/nitf.ksy index b2b84445c..163e85199 100644 --- a/image/nitf.ksy +++ b/image/nitf.ksy @@ -10,10 +10,10 @@ meta: - ntf.r3 - ntf.r4 - ntf.r5 + license: MIT ks-version: 0.8 encoding: UTF-8 endian: be - license: MIT doc: | The NITF (National Image Transition Format) format is a file format developed by the U.S. Government for storing imagery, e.g. from satellites. @@ -32,7 +32,7 @@ seq: - id: image_segments type: image_segment(_index) repeat: expr - repeat-expr: header.num_image_segments.to_i + repeat-expr: header.num_image_segments.to_i - id: graphics_segments type: graphics_segment(_index) repeat: expr @@ -286,9 +286,6 @@ types: params: - id: idx type: u2 - instances: - has_mask: - value: image_sub_header.img_compression.substring(0, 1) == 'M' or image_sub_header.img_compression.substring(1, 2) == 'M' seq: - id: image_sub_header type: image_sub_header @@ -298,6 +295,9 @@ types: - id: image_data_field if: has_mask size: _parent.header.linfo[idx].length_image_segment.to_i - image_data_mask.total_size + instances: + has_mask: + value: image_sub_header.img_compression.substring(0, 1) == 'M' or image_sub_header.img_compression.substring(1, 2) == 'M' image_sub_header: seq: - id: file_part_type @@ -504,17 +504,17 @@ types: value: "(tpxcdlnth % 8 == 0 ? tpxcdlnth : tpxcdlnth + (8 - tpxcdlnth % 8)) / 8" bmrtmr_count: value: > - _parent.image_sub_header.num_blocks_per_row.to_i * _parent.image_sub_header.num_blocks_per_col.to_i * - (_parent.image_sub_header.img_mode != 'S' ? - 1 : + _parent.image_sub_header.num_blocks_per_row.to_i * _parent.image_sub_header.num_blocks_per_col.to_i * + (_parent.image_sub_header.img_mode != 'S' ? + 1 : (_parent.image_sub_header.num_bands.to_i != 0 ? - _parent.image_sub_header.num_bands.to_i : + _parent.image_sub_header.num_bands.to_i : _parent.image_sub_header.num_multispectral_bands.to_i)) has_bmr: value: bmrlnth != 0 has_tmr: value: tmrlnth != 0 - bmrbnd_size: + bmrbnd_size: value: "has_bmr ? bmrtmr_count * 4 : 0" tmrbnd_size: value: "has_tmr ? bmrtmr_count * 4 : 0" @@ -738,6 +738,7 @@ types: type: str size: des_defined_subheader_fields_len.to_i data_sub_header_streaming: + doc: 'Streaming file Header Data Extension Segment Subheader' seq: - id: des_base type: data_sub_header_base @@ -763,7 +764,6 @@ types: type: str size: 7 doc: 'A repeat of sfh_l1.' - doc: 'Streaming file Header Data Extension Segment Subheader' reserved_extension_segment: params: - id: idx diff --git a/image/pcx.ksy b/image/pcx.ksy index b9227c900..c8bb18845 100644 --- a/image/pcx.ksy +++ b/image/pcx.ksy @@ -37,10 +37,10 @@ seq: size: 128 instances: palette_256: - doc-ref: http://web.archive.org/web/20100206055706/http://www.qzx.com/pc-gpe/pcx.txt - "VGA 256 Color Palette Information" pos: _io.size - 769 type: t_palette_256 if: hdr.version == versions::v3_0 and hdr.bits_per_pixel == 8 and hdr.num_planes == 1 + doc-ref: http://web.archive.org/web/20100206055706/http://www.qzx.com/pc-gpe/pcx.txt - "VGA 256 Color Palette Information" types: header: doc-ref: http://web.archive.org/web/20100206055706/http://www.qzx.com/pc-gpe/pcx.txt - "ZSoft .PCX FILE HEADER FORMAT" diff --git a/image/pcx_dcx.ksy b/image/pcx_dcx.ksy index 7d29511a3..8d919c532 100644 --- a/image/pcx_dcx.ksy +++ b/image/pcx_dcx.ksy @@ -7,9 +7,9 @@ meta: pronom: x-fmt/348 wikidata: Q28205890 license: CC0-1.0 - endian: le imports: - pcx + endian: le doc: | DCX is a simple extension of PCX image format allowing to bundle many PCX images (typically, pages of a document) in one file. It saw diff --git a/image/xwd.ksy b/image/xwd.ksy index 99357c23a..0e6454522 100644 --- a/image/xwd.ksy +++ b/image/xwd.ksy @@ -1,9 +1,9 @@ meta: id: xwd - endian: be title: xwd (X Window Dump) bitmap image application: xwd license: CC0-1.0 + endian: be doc: | xwd is a file format written by eponymous X11 screen capture application (xwd stands for "X Window Dump"). Typically, an average diff --git a/log/aix_utmp.ksy b/log/aix_utmp.ksy index fbf5bf1e6..7b7f69b20 100644 --- a/log/aix_utmp.ksy +++ b/log/aix_utmp.ksy @@ -12,63 +12,63 @@ seq: types: record: seq: - - id: user - -orig-id: ut_user - doc: User login name - size: 256 - type: str - encoding: ascii - - id: inittab_id - -orig-id: ut_id - doc: /etc/inittab id - size: 14 - type: str - encoding: ascii - - id: device - -orig-id: ut_line - doc: device name (console, lnxx) - size: 64 - type: str - encoding: ascii - - id: pid - -orig-id: ut_pid - type: u8 - doc: process id - - id: type - -orig-id: ut_type - type: s2 - doc: Type of login - enum: entry_type - - id: timestamp - -orig-id: ut_time - type: s8 - doc: time entry was made - - id: exit_status - -orig-id: ut_exit - type: exit_status - doc: the exit status of a process marked as DEAD PROCESS - - id: hostname - -orig-id: ut_host - size: 256 - doc: host name - type: str - encoding: ascii - - id: dbl_word_pad - type: s4 - - id: reserved_a - size: 8 - - id: reserved_v - size: 24 + - id: user + -orig-id: ut_user + doc: User login name + size: 256 + type: str + encoding: ascii + - id: inittab_id + -orig-id: ut_id + doc: /etc/inittab id + size: 14 + type: str + encoding: ascii + - id: device + -orig-id: ut_line + doc: device name (console, lnxx) + size: 64 + type: str + encoding: ascii + - id: pid + -orig-id: ut_pid + type: u8 + doc: process id + - id: type + -orig-id: ut_type + type: s2 + doc: Type of login + enum: entry_type + - id: timestamp + -orig-id: ut_time + type: s8 + doc: time entry was made + - id: exit_status + -orig-id: ut_exit + type: exit_status + doc: the exit status of a process marked as DEAD PROCESS + - id: hostname + -orig-id: ut_host + size: 256 + doc: host name + type: str + encoding: ascii + - id: dbl_word_pad + type: s4 + - id: reserved_a + size: 8 + - id: reserved_v + size: 24 exit_status: seq: - - id: termination_code - -orig-id: e_termination - type: s2 - doc: process termination status - - id: exit_code - -orig-id: e_exit - type: s2 - doc: process exit status + - id: termination_code + -orig-id: e_termination + type: s2 + doc: process termination status + - id: exit_code + -orig-id: e_exit + type: s2 + doc: process exit status enums: entry_type: 0: empty diff --git a/log/windows_evt_log.ksy b/log/windows_evt_log.ksy index e4ce12d80..40ba91f4e 100644 --- a/log/windows_evt_log.ksy +++ b/log/windows_evt_log.ksy @@ -8,7 +8,6 @@ meta: license: CC0-1.0 ks-version: 0.9 endian: le -doc-ref: https://msdn.microsoft.com/en-us/library/bb309026(v=vs.85).aspx doc: | EVT files are Windows Event Log files written by older Windows operating systems (2000, XP, 2003). They are used as binary log @@ -31,6 +30,7 @@ doc: | records. There are several usage scenarios (non-wrapping vs wrapping log files) which result in slightly different organization of records. +doc-ref: https://msdn.microsoft.com/en-us/library/bb309026(v=vs.85).aspx seq: - id: header type: header diff --git a/machine_code/code_6502.ksy b/machine_code/code_6502.ksy index 2e51e2ca1..a34b1b0a1 100644 --- a/machine_code/code_6502.ksy +++ b/machine_code/code_6502.ksy @@ -1,7 +1,7 @@ meta: id: code_6502 - endian: le license: CC0-1.0 + endian: le doc: | This spec can be used to disassemble raw stream of 6502 CPU machine code into individual operations. Each operation includes an opcode diff --git a/macos/ds_store.ksy b/macos/ds_store.ksy index 316cae8d4..735b6196e 100644 --- a/macos/ds_store.ksy +++ b/macos/ds_store.ksy @@ -109,6 +109,11 @@ types: params: - id: idx type: u8 + instances: + master_block: + pos: _parent.block_addresses[_parent.directory_entries[idx].block_id].offset + size: _parent.block_addresses[_parent.directory_entries[idx].block_id].size + type: master_block types: master_block: seq: @@ -131,11 +136,6 @@ types: io: _root._io pos: _root.buddy_allocator_body.block_addresses[block_id].offset type: block - instances: - master_block: - pos: _parent.block_addresses[_parent.directory_entries[idx].block_id].offset - size: _parent.block_addresses[_parent.directory_entries[idx].block_id].size - type: master_block block: seq: - id: mode @@ -159,6 +159,12 @@ types: if: mode > 0 - id: record type: record + instances: + block: + io: _root._io + pos: _root.buddy_allocator_body.block_addresses[block_id].offset + type: block + if: mode > 0 types: record: seq: @@ -203,12 +209,6 @@ types: - id: value size: 4 type: str - instances: - block: - io: _root._io - pos: _root.buddy_allocator_body.block_addresses[block_id].offset - type: block - if: mode > 0 instances: rightmost_block: io: _root._io diff --git a/macos/mac_os_resource_snd.ksy b/macos/mac_os_resource_snd.ksy index 60dd1f93e..6e56bc922 100644 --- a/macos/mac_os_resource_snd.ksy +++ b/macos/mac_os_resource_snd.ksy @@ -2,16 +2,16 @@ meta: id: mac_os_resource_snd title: Classic MacOS Sound Resource application: Sound Manager - endian: be - license: MIT xref: - wikidata: Q7564684 mac-os-resource-type: 'snd ' -doc-ref: "https://developer.apple.com/library/archive/documentation/mac/pdf/Sound/Sound_Manager.pdf" + wikidata: Q7564684 + license: MIT + endian: be doc: | Sound resources were introduced in Classic MacOS with the Sound Manager program. They can contain sound commands to generate sounds with given frequencies as well as sampled sound data. They are mostly found in resource forks, but can occasionally appear standalone or embedded in other files. +doc-ref: "https://developer.apple.com/library/archive/documentation/mac/pdf/Sound/Sound_Manager.pdf" seq: - id: format type: u2 @@ -169,11 +169,11 @@ types: value: _root.midi_note_to_frequency[midi_note] #TODO: If https://github.com/kaitai-io/kaitai_struct/issues/216 is implemented: #TODO: value: (2 ** ((midi_note - 69) / 12)) * 440 + if: midi_note >= 0 and midi_note < 128 doc: | base frequency of sample in Hz Calculated with the formula (2 ** ((midi_note - 69) / 12)) * 440 doc-ref: https://en.wikipedia.org/wiki/MIDI_tuning_standard - if: midi_note >= 0 and midi_note < 128 sound_header_type: pos: start_ofs + 20 type: u1 diff --git a/macos/resource_fork.ksy b/macos/resource_fork.ksy index 1c1a2600d..e7686ac49 100644 --- a/macos/resource_fork.ksy +++ b/macos/resource_fork.ksy @@ -85,8 +85,8 @@ seq: instances: data_blocks_with_io: pos: header.ofs_data_blocks - type: bytes_with_io size: header.len_data_blocks + type: bytes_with_io doc: | Use `data_blocks` instead, unless you need access to this instance's `_io`. @@ -108,8 +108,8 @@ instances: or when resources are added or grown so that more space is needed in the data area. resource_map: pos: header.ofs_resource_map - type: resource_map size: header.len_resource_map + type: resource_map doc: The resource file's resource map. types: file_header: @@ -198,13 +198,13 @@ types: instances: type_list_and_reference_lists: pos: ofs_type_list - type: type_list_and_reference_lists size: ofs_names - ofs_type_list + type: type_list_and_reference_lists doc: The resource map's resource type list, followed by the resource reference list area. names_with_io: pos: ofs_names - type: bytes_with_io size-eos: true + type: bytes_with_io doc: | Use `names` instead, unless you need access to this instance's `_io`. diff --git a/media/avi.ksy b/media/avi.ksy index 9027a6f4e..a7f7f9df8 100644 --- a/media/avi.ksy +++ b/media/avi.ksy @@ -1,6 +1,5 @@ meta: id: avi - endian: le title: Microsoft AVI file xref: justsolve: AVI @@ -11,6 +10,7 @@ meta: - windows license: CC0-1.0 ks-version: 0.7 + endian: le doc-ref: https://msdn.microsoft.com/en-us/library/ms779636.aspx seq: - id: magic1 diff --git a/media/creative_voice_file.ksy b/media/creative_voice_file.ksy index a143914a9..a028ee2bd 100644 --- a/media/creative_voice_file.ksy +++ b/media/creative_voice_file.ksy @@ -3,8 +3,8 @@ meta: title: Creative Voice File file-extension: - voc - endian: le license: CC0-1.0 + endian: le doc: | Creative Voice File is a container file format for digital audio wave data. Initial revisions were able to support only unsigned diff --git a/media/genmidi_op2.ksy b/media/genmidi_op2.ksy index 160b66a93..f4a7d9a7a 100644 --- a/media/genmidi_op2.ksy +++ b/media/genmidi_op2.ksy @@ -3,8 +3,8 @@ meta: title: GENMIDI.OP2 OPL2 sound bank file-extension: op2 license: CC0-1.0 - endian: le encoding: ASCII + endian: le doc: | GENMIDI.OP2 is a sound bank file used by players based on DMX sound library to play MIDI files with General MIDI instruments using OPL2 @@ -14,7 +14,7 @@ doc: | Major users of DMX sound library include: * Original Doom game engine (and games based on it: Heretic, Hexen, Strife, Chex Quest) - * Raptor: Call of the Shadows + * Raptor: Call of the Shadows doc-ref: http://www.fit.vutbr.cz/~arnost/muslib/op2_form.zip http://doom.wikia.com/wiki/GENMIDI seq: - id: magic diff --git a/media/magicavoxel_vox.ksy b/media/magicavoxel_vox.ksy index 9814ee4cb..dee5b6d77 100644 --- a/media/magicavoxel_vox.ksy +++ b/media/magicavoxel_vox.ksy @@ -1,11 +1,11 @@ meta: id: magicavoxel_vox - file-extension: vox + title: MagicaVoxel File application: MagicaVoxel - endian: le + file-extension: vox license: MIT - title: MagicaVoxel File ks-version: 0.9 # for doc-ref array + endian: le doc-ref: - https://ephtracy.github.io/ MagicaVoxel Homepage - https://github.com/ephtracy/voxel-model/blob/master/MagicaVoxel-file-format-vox.txt Format Description @@ -69,7 +69,7 @@ types: repeat: expr repeat-expr: 256 voxel: - seq: + seq: - id: x type: u1 - id: y @@ -90,41 +90,41 @@ types: type: u1 matt: seq: - - id: id - type: u4 - - id: material_type - type: u4 - enum: material_type - - id: material_weight - type: f4 - - id: property_bits - type: u4 - # .to_i not implemented for C# runtime yet - #enum: property_bits_type - - id: plastic - if: has_plastic - type: f4 - - id: roughness - if: has_roughness - type: f4 - - id: specular - if: has_specular - type: f4 - - id: ior - if: has_ior - type: f4 - - id: attenuation - if: has_attenuation - type: f4 - - id: power - if: has_power - type: f4 - - id: glow - if: has_glow - type: f4 - - id: is_total_power - if: has_is_total_power - type: f4 + - id: id + type: u4 + - id: material_type + type: u4 + enum: material_type + - id: material_weight + type: f4 + - id: property_bits + type: u4 + # .to_i not implemented for C# runtime yet + #enum: property_bits_type + - id: plastic + if: has_plastic + type: f4 + - id: roughness + if: has_roughness + type: f4 + - id: specular + if: has_specular + type: f4 + - id: ior + if: has_ior + type: f4 + - id: attenuation + if: has_attenuation + type: f4 + - id: power + if: has_power + type: f4 + - id: glow + if: has_glow + type: f4 + - id: is_total_power + if: has_is_total_power + type: f4 instances: has_plastic: value: '(property_bits & 1) != 0' @@ -142,7 +142,7 @@ types: value: '(property_bits & 64) != 0' has_is_total_power: value: '(property_bits & 128) != 0' -enums: +enums: chunk_type: 0x4d41494e: main 0x5041434b: pack @@ -167,7 +167,7 @@ enums: # Support for constant lists would be useful here for the default color palette when the RGBA chunk is missing # instances: # default_palette: -# value: [ +# value: [ # 0x00000000, 0xffffffff, 0xffccffff, 0xff99ffff, 0xff66ffff, 0xff33ffff, 0xff00ffff, 0xffffccff, 0xffccccff, 0xff99ccff, 0xff66ccff, 0xff33ccff, 0xff00ccff, 0xffff99ff, 0xffcc99ff, 0xff9999ff,> # 0xff6699ff, 0xff3399ff, 0xff0099ff, 0xffff66ff, 0xffcc66ff, 0xff9966ff, 0xff6666ff, 0xff3366ff, 0xff0066ff, 0xffff33ff, 0xffcc33ff, 0xff9933ff, 0xff6633ff, 0xff3333ff, 0xff0033ff, 0xffff00ff,> # 0xffcc00ff, 0xff9900ff, 0xff6600ff, 0xff3300ff, 0xff0000ff, 0xffffffcc, 0xffccffcc, 0xff99ffcc, 0xff66ffcc, 0xff33ffcc, 0xff00ffcc, 0xffffcccc, 0xffcccccc, 0xff99cccc, 0xff66cccc, 0xff33cccc,> @@ -185,5 +185,3 @@ enums: # 0xff000022, 0xff000011, 0xff00ee00, 0xff00dd00, 0xff00bb00, 0xff00aa00, 0xff008800, 0xff007700, 0xff005500, 0xff004400, 0xff002200, 0xff001100, 0xffee0000, 0xffdd0000, 0xffbb0000, 0xffaa0000,> # 0xff880000, 0xff770000, 0xff550000, 0xff440000, 0xff220000, 0xff110000, 0xffeeeeee, 0xffdddddd, 0xffbbbbbb, 0xffaaaaaa, 0xff888888, 0xff777777, 0xff555555, 0xff444444, 0xff222222, 0xff111111> #] - - diff --git a/media/quicktime_mov.ksy b/media/quicktime_mov.ksy index 03acc3950..852dd9681 100644 --- a/media/quicktime_mov.ksy +++ b/media/quicktime_mov.ksy @@ -176,7 +176,7 @@ enums: 0x656c7374: elst 0x66726565: free 0x66747970: ftyp - 0x68646c72: hdlr + 0x68646c72: hdlr 0x696f6473: iods 0x6d646174: mdat 0x6d646864: mdhd diff --git a/media/standard_midi_file.ksy b/media/standard_midi_file.ksy index 9521a99bb..74a6d6e44 100644 --- a/media/standard_midi_file.ksy +++ b/media/standard_midi_file.ksy @@ -5,7 +5,6 @@ meta: - mid - midi - smf - license: CC0-1.0 xref: justsolve: MIDI loc: @@ -14,6 +13,7 @@ meta: mime: audio/midi pronom: x-fmt/230 wikidata: Q10610388 + license: CC0-1.0 imports: - /common/vlq_base128_be endian: be diff --git a/media/stl.ksy b/media/stl.ksy index 20ec79e93..3bd8ef15c 100644 --- a/media/stl.ksy +++ b/media/stl.ksy @@ -1,11 +1,11 @@ meta: id: stl - endian: le application: 3D Systems Stereolithography file-extension: stl xref: wikidata: Q1238229 license: CC0-1.0 + endian: le doc: | STL files are used to represent simple 3D models, defined using triangular 3D faces. diff --git a/media/tracker_modules/fasttracker_xm_module.ksy b/media/tracker_modules/fasttracker_xm_module.ksy index 5593695d9..028fa08ea 100644 --- a/media/tracker_modules/fasttracker_xm_module.ksy +++ b/media/tracker_modules/fasttracker_xm_module.ksy @@ -209,28 +209,28 @@ types: type: u1 - id: num_panning_points type: u1 - + - id: volume_sustain_point type: u1 - id: volume_loop_start_point type: u1 - id: volume_loop_end_point type: u1 - + - id: panning_sustain_point type: u1 - id: panning_loop_start_point type: u1 - id: panning_loop_end_point type: u1 - + - id: volume_type type: u1 enum: type - id: panning_type type: u1 enum: type - + - id: vibrato_type type: u1 - id: vibrato_sweep @@ -287,7 +287,7 @@ types: type: u4 - id: sample_loop_length type: u4 - + - id: volume type: u1 - id: fine_tune diff --git a/media/vp8_ivf.ksy b/media/vp8_ivf.ksy index 8abcd5840..980740e36 100644 --- a/media/vp8_ivf.ksy +++ b/media/vp8_ivf.ksy @@ -1,10 +1,10 @@ meta: id: vp8_ivf - file-extension: ivf - endian: le title: VP8 raw file - ks-version: 0.7 + file-extension: ivf license: CC0-1.0 + ks-version: 0.7 + endian: le doc: | IVF is a simple container format for raw VP8 data, which is an open and royalty-free video compression format, currently developed by @@ -25,16 +25,16 @@ seq: doc: Normally the header length is 32 byte - id: codec contents: VP80 - doc: Name of the codec e.g. 'VP80' for VP8 + doc: Name of the codec e.g. 'VP80' for VP8 - id: width type: u2 - doc: The (initial) width of the video, every keyframe may change the resolution + doc: The (initial) width of the video, every keyframe may change the resolution - id: height type: u2 doc: The (initial) height of the video, every keyframe may change the resolution - id: framerate type: u4 - doc: the (framerate * timescale) e.g. for 30 fps -> 30000 + doc: the (framerate * timescale) e.g. for 30 fps -> 30000 - id: timescale type: u4 doc: the timescale is a divider of the seconds (VPX is integer math only) mostly 1000 @@ -52,7 +52,7 @@ seq: repeat-expr: num_frames ## payload end -## type definitions +## type definitions types: blocks: seq: diff --git a/media/wav.ksy b/media/wav.ksy index e9998ae6b..100e0c2df 100644 --- a/media/wav.ksy +++ b/media/wav.ksy @@ -43,8 +43,8 @@ instances: parent_chunk_data: io: chunk.data_slot._io pos: 0 - if: is_riff_chunk type: 'riff::parent_chunk_data' + if: is_riff_chunk form_type: value: parent_chunk_data.form_type enum: fourcc @@ -53,9 +53,9 @@ instances: subchunks: io: parent_chunk_data.subchunks_slot._io pos: 0 - if: is_form_type_wave type: chunk_type repeat: eos + if: is_form_type_wave types: chunk_type: seq: @@ -170,16 +170,6 @@ types: size-eos: true format_chunk_type: - instances: - is_extensible: - value: w_format_tag == w_format_tag_type::extensible - is_basic_pcm: - value: w_format_tag == w_format_tag_type::pcm - is_basic_float: - value: w_format_tag == w_format_tag_type::ieee_float - is_cb_size_meaningful: - value: not is_basic_pcm and cb_size != 0 - seq: - id: w_format_tag type: u2 @@ -203,6 +193,15 @@ types: - id: channel_mask_and_subformat type: channel_mask_and_subformat_type if: is_extensible + instances: + is_extensible: + value: w_format_tag == w_format_tag_type::extensible + is_basic_pcm: + value: w_format_tag == w_format_tag_type::pcm + is_basic_float: + value: w_format_tag == w_format_tag_type::ieee_float + is_cb_size_meaningful: + value: not is_basic_pcm and cb_size != 0 channel_mask_and_subformat_type: seq: diff --git a/network/dns_packet.ksy b/network/dns_packet.ksy index e6de06b3b..734fd40a4 100644 --- a/network/dns_packet.ksy +++ b/network/dns_packet.ksy @@ -4,8 +4,8 @@ meta: xref: rfc: 1035 license: CC0-1.0 - endian: be encoding: utf-8 + endian: be doc: | (No support for Auth-Name + Add-Name for simplicity) seq: diff --git a/network/hccap.ksy b/network/hccap.ksy index 23a03fe6e..cdf63f976 100644 --- a/network/hccap.ksy +++ b/network/hccap.ksy @@ -1,13 +1,13 @@ meta: id: hccap title: Hashcat capture file (old version) - license: Unlicense - file-extension: hccap application: - Hashcat - aircrack-ng - endian: le + file-extension: hccap + license: Unlicense encoding: utf-8 + endian: le doc: | Native format of Hashcat password "recovery" utility. diff --git a/network/hccapx.ksy b/network/hccapx.ksy index c3c275bfd..572f60e00 100644 --- a/network/hccapx.ksy +++ b/network/hccapx.ksy @@ -1,12 +1,12 @@ meta: id: hccapx title: Hashcat capture file - license: Unlicense application: - Hashcat - aircrack-ng - endian: le file-extension: hccapx + license: Unlicense + endian: le doc: | Native format of Hashcat password "recovery" utility doc-ref: https://hashcat.net/wiki/doku.php?id=hccapx diff --git a/network/ipv6_packet.ksy b/network/ipv6_packet.ksy index eb35f8641..f977b655a 100644 --- a/network/ipv6_packet.ksy +++ b/network/ipv6_packet.ksy @@ -3,9 +3,9 @@ meta: title: IPv6 network packet license: CC0-1.0 ks-version: 0.8 - endian: be imports: - /network/protocol_body + endian: be seq: - id: version type: b4 diff --git a/network/microsoft_network_monitor_v2.ksy b/network/microsoft_network_monitor_v2.ksy index fed50579d..4a18551d1 100644 --- a/network/microsoft_network_monitor_v2.ksy +++ b/network/microsoft_network_monitor_v2.ksy @@ -1,13 +1,13 @@ meta: id: microsoft_network_monitor_v2 - file-extension: cap application: Microsoft Network Monitor, v2.x + file-extension: cap license: CC0-1.0 ks-version: 0.7 - endian: le imports: - /network/ethernet_frame - /windows/windows_systemtime + endian: le doc: | Microsoft Network Monitor (AKA Netmon) is a proprietary Microsoft's network packet sniffing and analysis tool. It can save captured @@ -60,10 +60,10 @@ seq: type: u4 instances: frame_table: - doc: Index that is used to access individual captured frames - type: frame_index pos: frame_table_ofs size: frame_table_len + type: frame_index + doc: Index that is used to access individual captured frames types: frame_index: seq: @@ -80,10 +80,10 @@ types: type: u4 instances: body: - doc: Frame body itself + io: _root._io pos: ofs type: frame - io: _root._io + doc: Frame body itself frame: doc: | A container for actually captured network data. Allow to diff --git a/network/packet_ppi.ksy b/network/packet_ppi.ksy index af12e9234..3c133db61 100644 --- a/network/packet_ppi.ksy +++ b/network/packet_ppi.ksy @@ -1,16 +1,16 @@ meta: id: packet_ppi - endian: le + license: CC0-1.0 imports: - /network/ethernet_frame - license: CC0-1.0 + endian: le doc: | PPI is a standard for link layer packet encapsulation, proposed as generic extensible container to store both captured in-band data and out-of-band data. Originally it was developed to provide 802.11n radio information, but can be used for other purposes as well. - Sample capture: https://wiki.wireshark.org/SampleCaptures?action=AttachFile&do=get&target=Http.cap + Sample capture: https://wiki.wireshark.org/SampleCaptures?action=AttachFile&do=get&target=Http.cap doc-ref: https://www.cacetech.com/documents/PPI_Header_format_1.0.1.pdf PPI header format spec, section 3 seq: - id: header diff --git a/network/pcap.ksy b/network/pcap.ksy index 466be2a3e..9afb73d9b 100644 --- a/network/pcap.ksy +++ b/network/pcap.ksy @@ -8,10 +8,10 @@ meta: justsolve: PCAP license: CC0-1.0 ks-version: 0.8 - endian: le imports: - /network/ethernet_frame - /network/packet_ppi + endian: le doc: | PCAP (named after libpcap / winpcap) is a popular format for saving network traffic grabbed by network sniffers. It is typically diff --git a/network/protocol_body.ksy b/network/protocol_body.ksy index 628cfc91d..5b9fe2342 100644 --- a/network/protocol_body.ksy +++ b/network/protocol_body.ksy @@ -26,10 +26,6 @@ params: - id: protocol_num type: u1 doc: Protocol number as an integer. -instances: - protocol: - value: protocol_num - enum: protocol_enum seq: - id: body type: @@ -42,6 +38,10 @@ seq: 'protocol_enum::ipv4': ipv4_packet 'protocol_enum::ipv6': ipv6_packet 'protocol_enum::ipv6_nonxt': no_next_header +instances: + protocol: + value: protocol_num + enum: protocol_enum types: no_next_header: doc: Dummy type for IPv6 "no next header" type, which signifies end of headers chain. diff --git a/network/rtcp_payload.ksy b/network/rtcp_payload.ksy index a67900f9d..7a112a5b7 100644 --- a/network/rtcp_payload.ksy +++ b/network/rtcp_payload.ksy @@ -134,8 +134,8 @@ types: size-eos: true instances: fmt: - enum: rtpfb_subtype value: _parent.subtype + enum: rtpfb_subtype rtpfb_transport_feedback_packet: seq: @@ -191,8 +191,8 @@ types: size-eos: true instances: fmt: - enum: psfb_subtype value: _parent.subtype + enum: psfb_subtype psfb_afb_packet: seq: @@ -263,4 +263,3 @@ enums: 4: tmmbn 5: rrr 15: transport_feedback - diff --git a/network/rtpdump.ksy b/network/rtpdump.ksy index 41e5c6d44..9a2ca9f46 100644 --- a/network/rtpdump.ksy +++ b/network/rtpdump.ksy @@ -2,12 +2,12 @@ meta: id: rtpdump title: Rtpdump (rtptools) file-extension: - - rtp - - rtpdump + - rtp + - rtpdump license: Unlicense - endian: be imports: - /network/rtp_packet + endian: be doc: | rtpdump is a format used by rtptools to record and replay rtp data from network capture. diff --git a/network/some_ip/some_ip.ksy b/network/some_ip/some_ip.ksy index d1233c68c..ec3baa77e 100644 --- a/network/some_ip/some_ip.ksy +++ b/network/some_ip/some_ip.ksy @@ -4,12 +4,12 @@ meta: license: CC0-1.0 ks-version: 0.9 endian: be - imports: + imports: - /network/some_ip/some_ip_sd doc: | - SOME/IP (Scalable service-Oriented MiddlewarE over IP) is an automotive/embedded - communication protocol which supports remoteprocedure calls, event notifications + SOME/IP (Scalable service-Oriented MiddlewarE over IP) is an automotive/embedded + communication protocol which supports remoteprocedure calls, event notifications and the underlying serialization/wire format. doc-ref: https://www.autosar.org/fileadmin/user_upload/standards/foundation/19-11/AUTOSAR_PRS_SOMEIPProtocol.pdf @@ -26,7 +26,7 @@ seq: types: header: - seq: + seq: - id: message_id type: message_id size: 4 @@ -36,42 +36,42 @@ types: - id: length type: u4 doc: | - [PRS_SOMEIP_00042] Length field shall contain the length in Byte + [PRS_SOMEIP_00042] Length field shall contain the length in Byte starting from Request ID/Client ID until the end of the SOME/IP message. - id: request_id type: request_id size: 4 doc: | - The Request ID allows a provider and subscriber to differentiate + The Request ID allows a provider and subscriber to differentiate multiple parallel uses of the same method, event, getter or setter. - id: protocol_version type: u1 - doc: | - The Protocol Version identifies the used SOME/IP Header format + doc: | + The Protocol Version identifies the used SOME/IP Header format (not including the Payload format). - id: interface_version type: u1 doc: | - Interface Version shall be an 8 Bit field that contains the + Interface Version shall be an 8 Bit field that contains the MajorVersion of the Service Interface. - id: message_type type: u1 enum: message_type_enum - doc: | - The Message Type field is used to differentiate different types of + doc: | + The Message Type field is used to differentiate different types of messages. doc-ref: AUTOSAR_PRS_SOMEIPProtocol.pdf - Table 4.4 - id: return_code type: u1 enum: return_code_enum doc: | - The Return Code shall be used to signal whether a request was + The Return Code shall be used to signal whether a request was successfully processed. doc-ref: AUTOSAR_PRS_SOMEIPProtocol.pdf - Table 4.5 - types: + types: message_id: - seq: + seq: - id: service_id type: u2 doc: Service ID @@ -89,20 +89,20 @@ types: doc: Event ID doc-ref: AUTOSAR_PRS_SOMEIPProtocol.pdf - Table 4.6 doc: | - [PRS_SOMEIP_00035] The assignment of the Message ID shall be up to - the user. However, the Message ID shall be unique for the whole + [PRS_SOMEIP_00035] The assignment of the Message ID shall be up to + the user. However, the Message ID shall be unique for the whole system (i.e. the vehicle). TheMessage ID is similar to a CAN ID and should be handled via a comparable process. [PRS_SOMEIP_00038] Message IDs of method calls shall be structured in - the ID with 2^16 services with 2^15 methods. + the ID with 2^16 services with 2^15 methods. doc-ref: AUTOSAR_PRS_SOMEIPProtocol.pdf 4.1.1.1 Message ID - + instances: value: pos: 0 type: u4 - doc: The value provides the undissected Message ID - + doc: The value provides the undissected Message ID + request_id: seq: - id: client_id @@ -110,22 +110,22 @@ types: - id: session_id type: u2 doc: | - The Request ID allows a provider and subscriber to differentiate + The Request ID allows a provider and subscriber to differentiate multiple parallel usesof the same method, event, getter or setter. doc-ref: AUTOSAR_PRS_SOMEIPProtocol.pdf - section 4.1.1.3 Request ID - + instances: value: pos: 0 type: u4 - doc: The value provides the undissected Request ID + doc: The value provides the undissected Request ID instances: is_valid_service_discovery: value: message_id.value == 0xffff8100 and protocol_version == 0x01 and interface_version == 0x01 and message_type == message_type_enum::notification and return_code == return_code_enum::ok doc: auxillary value doc-ref: AUTOSAR_PRS_SOMEIPServiceDiscoveryProtocol.pdf - section 4.1.2.1 General Requirements - + enums: message_type_enum: 0x00 : request diff --git a/network/some_ip/some_ip_container.ksy b/network/some_ip/some_ip_container.ksy index a740c887e..cfd41457e 100644 --- a/network/some_ip/some_ip_container.ksy +++ b/network/some_ip/some_ip_container.ksy @@ -4,7 +4,7 @@ meta: license: CC0-1.0 ks-version: 0.9 endian: be - imports: + imports: - /network/some_ip/some_ip seq: diff --git a/network/some_ip/some_ip_sd_entries.ksy b/network/some_ip/some_ip_sd_entries.ksy index b34ac8e50..ac4f75194 100644 --- a/network/some_ip/some_ip_sd_entries.ksy +++ b/network/some_ip/some_ip_sd_entries.ksy @@ -6,10 +6,10 @@ meta: endian: be doc: | - The entries are used to synchronize the state of services instances and the + The entries are used to synchronize the state of services instances and the Publish/-Subscribe handling. doc-ref: | - https://www.autosar.org/fileadmin/user_upload/standards/foundation/19-11/AUTOSAR_PRS_SOMEIPServiceDiscoveryProtocol.pdf + https://www.autosar.org/fileadmin/user_upload/standards/foundation/19-11/AUTOSAR_PRS_SOMEIPServiceDiscoveryProtocol.pdf - section 4.1.2.3 Entry Format seq: @@ -31,7 +31,7 @@ types: entry_types::subscribe : sd_eventgroup_entry entry_types::subscribe_ack : sd_eventgroup_entry - types: + types: sd_entry_header: seq: - id: type @@ -53,12 +53,12 @@ types: type: u1 - id: ttl type: b24 - + sd_service_entry: seq: - id: minor_version type: u4 - + sd_eventgroup_entry: seq: - id: reserved @@ -71,7 +71,7 @@ types: type: b4 - id: event_group_id type: u2 - + enums: entry_types: 0x00 : find diff --git a/network/some_ip/some_ip_sd_options.ksy b/network/some_ip/some_ip_sd_options.ksy index afb49c83c..aee956c7c 100644 --- a/network/some_ip/some_ip_sd_options.ksy +++ b/network/some_ip/some_ip_sd_options.ksy @@ -4,10 +4,10 @@ meta: license: CC0-1.0 ks-version: 0.9 endian: be - + doc: | - FormatOptions are used to transport additional information to the entries. - This includes forinstance the information how a service instance is + FormatOptions are used to transport additional information to the entries. + This includes forinstance the information how a service instance is reachable (IP-Address, TransportProtocol, Port Number). doc-ref: | https://www.autosar.org/fileadmin/user_upload/standards/foundation/19-11/AUTOSAR_PRS_SOMEIPServiceDiscoveryProtocol.pdf @@ -17,7 +17,7 @@ seq: - id: entries type: sd_option repeat: eos - + types: sd_option: seq: @@ -35,7 +35,7 @@ types: option_types::ipv6_multicast_option : sd_ipv6_multicast_option option_types::ipv4_sd_endpoint_option : sd_ipv4_sd_endpoint_option option_types::ipv6_sd_endpoint_option : sd_ipv6_sd_endpoint_option - + types: sd_option_header: seq: @@ -44,7 +44,7 @@ types: - id: type type: u1 enum: option_types - + sd_configuration_option: seq: - id: reserved @@ -52,13 +52,13 @@ types: - id: configurations type: sd_config_strings_container size: _parent.header.length - 1 - + sd_config_strings_container: seq: - id: config_strings type: sd_config_string repeat: eos - + sd_config_string: seq: - id: length @@ -67,7 +67,7 @@ types: type: sd_config_kv_pair size: length if: length != 0 - + sd_config_kv_pair: seq: - id: key @@ -76,10 +76,10 @@ types: encoding: ASCII - id: value type: str - size-eos: true + size-eos: true encoding: ASCII - - + + sd_load_balancing_option: seq: - id: reserved @@ -88,7 +88,7 @@ types: type: u2 - id: weight type: u2 - + sd_ipv4_endpoint_option: seq: - id: reserved @@ -101,7 +101,7 @@ types: type: u1 - id: port type: u2 - + sd_ipv6_endpoint_option: seq: - id: reserved @@ -114,7 +114,7 @@ types: type: u1 - id: port type: u2 - + sd_ipv4_multicast_option: seq: - id: reserved @@ -127,7 +127,7 @@ types: type: u1 - id: port type: u2 - + sd_ipv6_multicast_option: seq: - id: reserved @@ -140,7 +140,7 @@ types: type: u1 - id: port type: u2 - + sd_ipv4_sd_endpoint_option: seq: - id: reserved @@ -153,7 +153,7 @@ types: type: u1 - id: port type: u2 - + sd_ipv6_sd_endpoint_option: seq: - id: reserved @@ -166,7 +166,7 @@ types: type: u1 - id: port type: u2 - + enums: option_types: 0x01 : configuration_option diff --git a/network/tls_client_hello.ksy b/network/tls_client_hello.ksy index 0bdf538b5..ffc171892 100644 --- a/network/tls_client_hello.ksy +++ b/network/tls_client_hello.ksy @@ -1,7 +1,7 @@ meta: id: tls_client_hello - endian: be license: MIT + endian: be seq: - id: version diff --git a/network/websocket.ksy b/network/websocket.ksy index 04d3194dd..ae0abf4fd 100644 --- a/network/websocket.ksy +++ b/network/websocket.ksy @@ -3,8 +3,8 @@ meta: title: WebSocket xref: rfc: 6455 - endian: be license: CC0-1.0 + endian: be doc: | The WebSocket protocol establishes a two-way communication channel via TCP. Messages are made up of one or more dataframes, and are delineated by @@ -75,7 +75,7 @@ types: type: str encoding: UTF-8 if: '_root.initial_frame.header.opcode == opcode::text' - + enums: opcode: 0: continuation @@ -94,4 +94,3 @@ enums: 0xD: reserved_control_d 0xE: reserved_control_e 0xF: reserved_control_f - diff --git a/scientific/spectroscopy/avantes_roh60.ksy b/scientific/spectroscopy/avantes_roh60.ksy index ee4d937ed..e8bc98efb 100644 --- a/scientific/spectroscopy/avantes_roh60.ksy +++ b/scientific/spectroscopy/avantes_roh60.ksy @@ -4,31 +4,31 @@ meta: license: CC0-1.0 endian: le doc: | - Avantes USB spectrometers are supplied with a Windows binary which + Avantes USB spectrometers are supplied with a Windows binary which generates one ROH and one RCM file when the user clicks "Save - experiment". In the version of 6.0, the ROH file contains a header - of 22 four-byte floats, then the spectrum as a float array and a - footer of 3 floats. The first and last pixel numbers are specified in the - header and determine the (length+1) of the spectral data. In the tested - files, the length is (2032-211-1)=1820 pixels, but Kaitai determines this + experiment". In the version of 6.0, the ROH file contains a header + of 22 four-byte floats, then the spectrum as a float array and a + footer of 3 floats. The first and last pixel numbers are specified in the + header and determine the (length+1) of the spectral data. In the tested + files, the length is (2032-211-1)=1820 pixels, but Kaitai determines this automatically anyway. The wavelength calibration is stored as a polynomial with coefficients of 'wlintercept', 'wlx1', ... 'wlx4', the argument of which is the - (pixel number + 1), as found out by comparing with the original + (pixel number + 1), as found out by comparing with the original Avantes converted data files. There is no intensity calibration saved, - but it is recommended to do it in your program - the CCD in the spectrometer - is so uneven that one should prepare exact pixel-to-pixel calibration curves + but it is recommended to do it in your program - the CCD in the spectrometer + is so uneven that one should prepare exact pixel-to-pixel calibration curves to get reasonable spectral results. - The rest of the header floats is not known to the author. Note that the + The rest of the header floats is not known to the author. Note that the newer version of Avantes software has a different format, see also https://kr.mathworks.com/examples/matlab/community/20341-reading-spectra-from-avantes-binary-files-demonstration The RCM file contains the user-specified comment, so it may be useful - for automatic conversion of data. You may wish to divide the spectra by + for automatic conversion of data. You may wish to divide the spectra by the integration time before comparing them. - + Written and tested by Filip Dominec, 2017-2018 seq: - id: unknown1 diff --git a/security/efivar_signature_list.ksy b/security/efivar_signature_list.ksy index fbbf7f222..909d8b4df 100644 --- a/security/efivar_signature_list.ksy +++ b/security/efivar_signature_list.ksy @@ -57,57 +57,57 @@ types: type: signature_data instances: is_cert_sha256: + value: signature_type == [0x26, 0x16, 0xc4, 0xc1, 0x4c, 0x50, 0x92, 0x40, 0xac, 0xa9, 0x41, 0xf9, 0x36, 0x93, 0x43, 0x28] doc: SHA-256 hash doc-ref: EFI_CERT_SHA256_GUID - value: signature_type == [0x26, 0x16, 0xc4, 0xc1, 0x4c, 0x50, 0x92, 0x40, 0xac, 0xa9, 0x41, 0xf9, 0x36, 0x93, 0x43, 0x28] is_cert_rsa2048_key: + value: signature_type == [0xe8, 0x66, 0x57, 0x3c, 0x9c, 0x26, 0x34, 0x4e, 0xaa, 0x14, 0xed, 0x77, 0x6e, 0x85, 0xb3, 0xb6] doc: RSA-2048 key (only the modulus since the public key exponent is known to be 0x10001) doc-ref: EFI_CERT_RSA2048_GUID - value: signature_type == [0xe8, 0x66, 0x57, 0x3c, 0x9c, 0x26, 0x34, 0x4e, 0xaa, 0x14, 0xed, 0x77, 0x6e, 0x85, 0xb3, 0xb6] is_cert_rsa2048_sha256: + value: signature_type == [0x90, 0x61, 0xb3, 0xe2, 0x9b, 0x87, 0x3d, 0x4a, 0xad, 0x8d, 0xf2, 0xe7, 0xbb, 0xa3, 0x27, 0x84] doc: RSA-2048 signature of a SHA-256 hash doc-ref: EFI_CERT_RSA2048_SHA256_GUID - value: signature_type == [0x90, 0x61, 0xb3, 0xe2, 0x9b, 0x87, 0x3d, 0x4a, 0xad, 0x8d, 0xf2, 0xe7, 0xbb, 0xa3, 0x27, 0x84] is_cert_sha1: + value: signature_type == [0x12, 0xa5, 0x6c, 0x82, 0x10, 0xcf, 0xc9, 0x4a, 0xb1, 0x87, 0xbe, 0x01, 0x49, 0x66, 0x31, 0xbd] doc: SHA-1 hash doc-ref: EFI_CERT_SHA1_GUID - value: signature_type == [0x12, 0xa5, 0x6c, 0x82, 0x10, 0xcf, 0xc9, 0x4a, 0xb1, 0x87, 0xbe, 0x01, 0x49, 0x66, 0x31, 0xbd] is_cert_rsa2048_sha1: + value: signature_type == [0x4f, 0x44, 0xf8, 0x67, 0x43, 0x87, 0xf1, 0x48, 0xa3, 0x28, 0x1e, 0xaa, 0xb8, 0x73, 0x60, 0x80] doc: RSA-2048 signature of a SHA-1 hash doc-ref: EFI_CERT_RSA2048_SHA1_GUID - value: signature_type == [0x4f, 0x44, 0xf8, 0x67, 0x43, 0x87, 0xf1, 0x48, 0xa3, 0x28, 0x1e, 0xaa, 0xb8, 0x73, 0x60, 0x80] is_cert_x509: + value: signature_type == [0xa1, 0x59, 0xc0, 0xa5, 0xe4, 0x94, 0xa7, 0x4a, 0x87, 0xb5, 0xab, 0x15, 0x5c, 0x2b, 0xf0, 0x72] doc: X.509 certificate doc-ref: EFI_CERT_X509_GUID - value: signature_type == [0xa1, 0x59, 0xc0, 0xa5, 0xe4, 0x94, 0xa7, 0x4a, 0x87, 0xb5, 0xab, 0x15, 0x5c, 0x2b, 0xf0, 0x72] is_cert_sha224: + value: signature_type == [0x33, 0x52, 0x6e, 0x0b, 0x5c, 0xa6, 0xc9, 0x44, 0x94, 0x07, 0xd9, 0xab, 0x83, 0xbf, 0xc8, 0xbd] doc: SHA-224 hash doc-ref: EFI_CERT_SHA224_GUID - value: signature_type == [0x33, 0x52, 0x6e, 0x0b, 0x5c, 0xa6, 0xc9, 0x44, 0x94, 0x07, 0xd9, 0xab, 0x83, 0xbf, 0xc8, 0xbd] is_cert_sha384: + value: signature_type == [0x07, 0x53, 0x3e, 0xff, 0xd0, 0x9f, 0xc9, 0x48, 0x85, 0xf1, 0x8a, 0xd5, 0x6c, 0x70, 0x1e, 0x01] doc: SHA-384 hash doc-ref: EFI_CERT_SHA384_GUID - value: signature_type == [0x07, 0x53, 0x3e, 0xff, 0xd0, 0x9f, 0xc9, 0x48, 0x85, 0xf1, 0x8a, 0xd5, 0x6c, 0x70, 0x1e, 0x01] is_cert_sha512: + value: signature_type == [0xae, 0x0f, 0x3e, 0x09, 0xc4, 0xa6, 0x50, 0x4f, 0x9f, 0x1b, 0xd4, 0x1e, 0x2b, 0x89, 0xc1, 0x9a] doc: SHA-512 hash doc-ref: EFI_CERT_SHA512_GUID - value: signature_type == [0xae, 0x0f, 0x3e, 0x09, 0xc4, 0xa6, 0x50, 0x4f, 0x9f, 0x1b, 0xd4, 0x1e, 0x2b, 0x89, 0xc1, 0x9a] is_cert_sha256_x509: + value: signature_type == [0x92, 0xa4, 0xd2, 0x3b, 0xc0, 0x96, 0x79, 0x40, 0xb4, 0x20, 0xfc, 0xf9, 0x8e, 0xf1, 0x03, 0xed] doc: SHA256 hash of an X.509 certificate's To-Be-Signed contents, and a time of revocation doc-ref: EFI_CERT_X509_SHA256_GUID - value: signature_type == [0x92, 0xa4, 0xd2, 0x3b, 0xc0, 0x96, 0x79, 0x40, 0xb4, 0x20, 0xfc, 0xf9, 0x8e, 0xf1, 0x03, 0xed] is_cert_sha384_x509: + value: signature_type == [0x6e, 0x87, 0x76, 0x70, 0xc2, 0x80, 0xe6, 0x4e, 0xaa, 0xd2, 0x28, 0xb3, 0x49, 0xa6, 0x86, 0x5b] doc: SHA384 hash of an X.509 certificate's To-Be-Signed contents, and a time of revocation doc-ref: EFI_CERT_X509_SHA384_GUID - value: signature_type == [0x6e, 0x87, 0x76, 0x70, 0xc2, 0x80, 0xe6, 0x4e, 0xaa, 0xd2, 0x28, 0xb3, 0x49, 0xa6, 0x86, 0x5b] is_cert_sha512_x509: + value: signature_type == [0x63, 0xbf, 0x6d, 0x44, 0x02, 0x25, 0xda, 0x4c, 0xbc, 0xfa, 0x24, 0x65, 0xd2, 0xb0, 0xfe, 0x9d] doc: SHA512 hash of an X.509 certificate's To-Be-Signed contents, and a time of revocation doc-ref: EFI_CERT_X509_SHA512_GUID - value: signature_type == [0x63, 0xbf, 0x6d, 0x44, 0x02, 0x25, 0xda, 0x4c, 0xbc, 0xfa, 0x24, 0x65, 0xd2, 0xb0, 0xfe, 0x9d] is_cert_der_pkcs7: + value: signature_type == [0x9d, 0xd2, 0xaf, 0x4a, 0xdf, 0x68, 0xee, 0x49, 0x8a, 0xa9, 0x34, 0x7d, 0x37, 0x56, 0x65, 0xa7] doc: "DER-encoded PKCS #7 version 1.5 [RFC2315]" doc-ref: EFI_CERT_TYPE_PKCS7_GUID - value: signature_type == [0x9d, 0xd2, 0xaf, 0x4a, 0xdf, 0x68, 0xee, 0x49, 0x8a, 0xa9, 0x34, 0x7d, 0x37, 0x56, 0x65, 0xa7] signature_data: doc-ref: EFI_SIGNATURE_DATA seq: diff --git a/security/openpgp_message.ksy b/security/openpgp_message.ksy index 5c581e0e9..819001923 100644 --- a/security/openpgp_message.ksy +++ b/security/openpgp_message.ksy @@ -1,8 +1,7 @@ meta: id: openpgp_message title: OpenPGP message - license: MIT - file-extension: + file-extension: - gpg - pub - pgp @@ -10,14 +9,15 @@ meta: justsolve: PGP rfc: 4880 wikidata: Q2141493 - endian: be + license: MIT encoding: UTF-8 + endian: be doc: The OpenPGP Message Format is a format to store encryption and signature keys for emails. doc-ref: https://tools.ietf.org/html/rfc4880 seq: - - id: packets - type: packet - repeat: eos + - id: packets + type: packet + repeat: eos types: packet: -webide-representation: '{packet_type_old}' @@ -38,16 +38,16 @@ types: type: b2 if: not new_packet_format - id: body - type: + type: switch-on: new_packet_format cases: #true: new_packet false: old_packet - + old_packet: seq: - id: len - type: + type: switch-on: _parent.len_type cases: 0: u1 @@ -64,7 +64,7 @@ types: packet_tags::public_subkey_packet: public_key_packet packet_tags::secret_key_packet: secret_key_packet packet_tags::secret_subkey_packet: public_key_packet - + public_key_packet: seq: - id: version @@ -82,7 +82,7 @@ types: type: u2 - id: rsa_e size: 3 - + user_id_packet: seq: - id: user_id @@ -90,7 +90,7 @@ types: type: str signature_packet: - seq: + seq: - id: version type: u1 # enum: TODO switch? @@ -119,7 +119,7 @@ types: type: u2 - id: signature size-eos: true - + secret_key_packet: seq: - id: public_key @@ -132,13 +132,13 @@ types: if: string_to_key >= 254 - id: secret_key size-eos: true - + subpackets: seq: - id: subpacketss type: subpacket repeat: eos - + subpacket: seq: - id: len @@ -148,7 +148,7 @@ types: enum: subpacket_types - id: content size: len.len - 1 - type: + type: switch-on: subpacket_type cases: subpacket_types::signature_creation_time: signature_creation_time @@ -173,7 +173,7 @@ types: subpacket_types::features: features subpacket_types::signature_target: signature_target subpacket_types::embedded_signature: embedded_signature - + len_subpacket: -webide-representation: '{len}' seq: @@ -188,63 +188,63 @@ types: instances: len: value: 'first_octet < 192 ? first_octet : ((first_octet >= 192 and first_octet < 255) ? (((first_octet - 192) << 8) + second_octet + 192) : scalar)' - + signature_creation_time: seq: - id: time type: u4 - + issuer: seq: - id: keyid type: u8 - + key_expiration_time: seq: - id: time type: u4 - + preferred_hash_algorithms: seq: - id: algorithm type: u1 enum: hash_algorithms repeat: eos - + preferred_compression_algorithms: seq: - id: algorithm type: u1 enum: compression_algorithms repeat: eos - + signature_expiration_time: seq: - id: time type: u4 - + exportable_certification: seq: - id: exportable type: u1 - + revocable: seq: - id: revocable type: u1 - + trust_signature: seq: - id: level type: u1 - id: amount type: u1 - + regular_expression: seq: - id: regex type: strz - + revocation_key: seq: - id: class @@ -254,7 +254,7 @@ types: type: u1 - id: fingerprint size: 20 - + notation_data: seq: - id: flags @@ -262,7 +262,7 @@ types: - id: len_name type: u2 - id: len_value - type: u2 + type: u2 - id: name size: len_name - id: value @@ -274,13 +274,13 @@ types: type: u1 enum: server_flags repeat: eos - + preferred_key_server: seq: - id: uri type: str size-eos: true - + primary_user_id: seq: - id: user_id @@ -291,20 +291,20 @@ types: - id: uri type: str size-eos: true - + key_flags: seq: - id: flag type: u1 enum: key_flags repeat: eos - + signers_user_id: seq: - id: user_id type: str size-eos: true - + reason_for_revocation: seq: - id: revocation_code @@ -313,12 +313,12 @@ types: - id: reason type: str size-eos: true - + features: seq: - id: flags size-eos: true - + signature_target: seq: - id: public_key_algorithm @@ -329,12 +329,12 @@ types: enum: hash_algorithms - id: hash size-eos: true - + embedded_signature: seq: - id: signature_packet type: signature_packet - + enums: packet_tags: 0: reserved_a_packet_tag_must_not_have_this_value @@ -446,7 +446,7 @@ enums: 108: private_experimental_algorithm_08 109: private_experimental_algorithm_09 110: private_experimental_algorithm_10 - + subpacket_types: 0: reserved 1: reserved @@ -481,10 +481,10 @@ enums: 30: features 31: signature_target 32: embedded_signature - + server_flags: 0x80: no_modify - + key_flags: 0x01: this_key_may_be_used_to_certify_other_keys 0x02: this_key_may_be_used_to_sign_data @@ -505,4 +505,3 @@ enums: 102: private_use_3 103: private_use_4 110: private_use_11 - diff --git a/serialization/bson.ksy b/serialization/bson.ksy index 99213271a..7352b0e92 100644 --- a/serialization/bson.ksy +++ b/serialization/bson.ksy @@ -4,8 +4,8 @@ meta: xref: justsolve: BSON wikidata: Q2661480 - endian: le license: CC0-1.0 + endian: le doc: > BSON, short for Binary JSON, is a binary-encoded serialization of JSON-like documents. Like JSON, BSON supports the embedding of documents and arrays within other documents and arrays. BSON also contains extensions that allow representation of data types that are not part of the JSON spec. For example, BSON has a Date type and a BinData type. BSON can be compared to binary interchange formats, like Protocol Buffers. BSON is more "schemaless" than Protocol Buffers, which can give it an advantage in flexibility but also a slight disadvantage in space efficiency (BSON has overhead for field names within the serialized data). @@ -162,7 +162,7 @@ types: 0x01: number_double 0x02: string 0x03: document - 0x04: array #The document for an array is a normal BSON document with integer values for the keys, starting with 0 and continuing sequentially. For example, the array ['red', 'blue'] would be encoded as the document {'0': 'red', '1': 'blue'}. The keys must be in ascending numerical order. + 0x04: array #The document for an array is a normal BSON document with integer values for the keys, starting with 0 and continuing sequentially. For example, the array ['red', 'blue'] would be encoded as the document {'0': 'red', '1': 'blue'}. The keys must be in ascending numerical order. 0x05: bin_data #This is the most commonly used binary subtype and should be the 'default' for drivers and tools. 0x06: undefined 0x07: object_id diff --git a/serialization/google_protobuf.ksy b/serialization/google_protobuf.ksy index f71b29ec6..64a934726 100644 --- a/serialization/google_protobuf.ksy +++ b/serialization/google_protobuf.ksy @@ -5,7 +5,6 @@ meta: ks-version: 0.7 imports: - /common/vlq_base128_le -doc-ref: https://developers.google.com/protocol-buffers/docs/encoding doc: | Google Protocol Buffers (AKA protobuf) is a popular data serialization scheme used for communication protocols, data storage, @@ -34,6 +33,7 @@ doc: | required, which fields may be repeated or constitute a map, what restrictions are placed on fields usage in a single message, what are the fields' default values, etc, etc. +doc-ref: https://developers.google.com/protocol-buffers/docs/encoding seq: - id: pairs type: pair diff --git a/serialization/msgpack.ksy b/serialization/msgpack.ksy index 3b62de30e..8ad2a8def 100644 --- a/serialization/msgpack.ksy +++ b/serialization/msgpack.ksy @@ -1,8 +1,8 @@ meta: id: msgpack title: MessagePack (msgpack) serialization format - endian: be license: CC0-1.0 + endian: be doc: | MessagePack (msgpack) is a system to serialize arbitrary structured data into a compact binary stream. @@ -191,4 +191,3 @@ types: type: msgpack - id: value type: msgpack - diff --git a/serialization/php_serialized_value.ksy b/serialization/php_serialized_value.ksy index 46a63fdb0..e5c2ef717 100644 --- a/serialization/php_serialized_value.ksy +++ b/serialization/php_serialized_value.ksy @@ -17,7 +17,7 @@ doc: | The only PHP values not supported by this format are *resources*, which usually correspond to native file or connection handles and cannot be meaningfully serialized. - + There is no official documentation for this data format; this spec was created based on the PHP source code and the behavior of `serialize`/`unserialize`. PHP makes no guarantees about compatibility of @@ -98,7 +98,7 @@ enums: id: php_3_object doc: | An `object` value (without a class name), as serialized by PHP 3. - + PHP 4 through 7.3 included code to deserialize PHP 3 objects, which has now been removed from the development repo and will likely no longer be included in PHP 7.4. However, apparently this code @@ -118,13 +118,14 @@ enums: 0x31: true # '1' types: null_contents: - seq: - - id: semicolon - contents: ';' doc: | The contents of a null value (`value_type::null`). This structure contains no actual data, since there is only a single `NULL` value. + seq: + - id: semicolon + contents: ';' bool_contents: + doc: The contents of a boolean value (`value_type::bool`). seq: - id: colon contents: ':' @@ -139,8 +140,11 @@ types: value: value: 'value_dec == bool_value::true' doc: The value of the `bool`, parsed as a boolean. - doc: The contents of a boolean value (`value_type::bool`). int_contents: + doc: | + The contents of an integer-like value: + either an actual integer (`value_type::int`) or a reference + (`value_type::variable_reference`, `value_type::object_reference`). seq: - id: colon contents: ':' @@ -152,11 +156,8 @@ types: value: value: value_dec.to_i doc: The value of the `int`, parsed as an integer. - doc: | - The contents of an integer-like value: - either an actual integer (`value_type::int`) or a reference - (`value_type::variable_reference`, `value_type::object_reference`). float_contents: + doc: The contents of a floating-point value. seq: - id: colon contents: ':' @@ -166,14 +167,20 @@ types: doc: | The value of the `float`, in ASCII decimal, as generated by PHP's usual double-to-string conversion. In particular, this means that: - + * A decimal point may not be included (for integral numbers) * The number may use exponent notation (e. g. `1.0E+16`) * Positive and negative infinity are represented as `INF` and `-INF`, respectively * Not-a-number is represented as `NAN` - doc: The contents of a floating-point value. length_prefixed_quoted_string: + doc: | + A quoted string prefixed with its length. + + Despite the quotes surrounding the string data, it can contain + arbitrary bytes, which are never escaped in any way. + This does not cause any ambiguities when parsing - the bounds of + the string are determined only by the length field, not by the quotes. seq: - id: len_data_dec type: str @@ -194,14 +201,12 @@ types: doc: | The length of the string's contents in bytes, parsed as an integer. The quotes are not counted in this size number. - doc: | - A quoted string prefixed with its length. - - Despite the quotes surrounding the string data, it can contain - arbitrary bytes, which are never escaped in any way. - This does not cause any ambiguities when parsing - the bounds of - the string are determined only by the length field, not by the quotes. string_contents: + doc: | + The contents of a string value. + + Note: PHP strings can contain arbitrary byte sequences. + They are not necessarily valid text in any specific encoding. seq: - id: colon contents: ':' @@ -213,12 +218,8 @@ types: value: value: string.data doc: The value of the string, as a byte array. - doc: | - The contents of a string value. - - Note: PHP strings can contain arbitrary byte sequences. - They are not necessarily valid text in any specific encoding. mapping_entry: + doc: A mapping entry consisting of a key and a value. seq: - id: key type: php_serialized_value @@ -226,8 +227,8 @@ types: - id: value type: php_serialized_value doc: The value of the entry. - doc: A mapping entry consisting of a key and a value. count_prefixed_mapping: + doc: A mapping (a sequence of key-value pairs) prefixed with its size. seq: - id: num_entries_dec type: str @@ -247,8 +248,8 @@ types: value: num_entries_dec.to_i doc: | The number of key-value pairs in the mapping, parsed as an integer. - doc: A mapping (a sequence of key-value pairs) prefixed with its size. array_contents: + doc: The contents of an array value. seq: - id: colon contents: ':' @@ -257,8 +258,10 @@ types: doc: | The array's elements. Keys must be of type `int` or `string`, values may have any type. - doc: The contents of an array value. php_3_object_contents: + doc: | + The contents of a PHP 3 object value. Unlike its counterpart in PHP 4 + and above, it does not contain a class name. seq: - id: colon contents: ':' @@ -267,10 +270,10 @@ types: doc: | The object's properties. Keys must be of type `string`, values may have any type. - doc: | - The contents of a PHP 3 object value. Unlike its counterpart in PHP 4 - and above, it does not contain a class name. object_contents: + doc: | + The contents of an object value serialized in the default format. + Unlike its PHP 3 counterpart, it contains a class name. seq: - id: colon1 contents: ':' @@ -284,10 +287,10 @@ types: doc: | The object's properties. Keys ust be of type `string`, values may have any type. - doc: | - The contents of an object value serialized in the default format. - Unlike its PHP 3 counterpart, it contains a class name. custom_serialized_object_contents: + doc: | + The contents of an object value that implements a custom + serialized format using `Serializable`. seq: - id: colon1 contents: ':' @@ -308,7 +311,7 @@ types: size: len_data doc: | The custom serialized data. The braces are not included. - + Although the surrounding braces make it look like a regular serialized object, this field is actually more similar to a string: it can contain arbitrary data that is not required to follow @@ -321,6 +324,3 @@ types: doc: | The length of the serialized data in bytes, parsed as an integer. The braces are not counted in this length number. - doc: | - The contents of an object value that implements a custom - serialized format using `Serializable`. diff --git a/serialization/python_pickle.ksy b/serialization/python_pickle.ksy index 8d94002d3..27e7338a8 100644 --- a/serialization/python_pickle.ksy +++ b/serialization/python_pickle.ksy @@ -5,11 +5,11 @@ meta: file-extension: - pickle - pkl - license: CC0-1.0 - endian: le xref: justsolve: Pickle wikidata: Q7190889 + license: CC0-1.0 + endian: le doc: | Python Pickle format serializes Python objects to a byte stream, as a sequence of operations to run on the Pickle Virtual Machine. @@ -130,94 +130,89 @@ types: are determined by the value of the opcode. decimalnl_short: - seq: - - id: val - type: str - encoding: ascii - terminator: 0x0a # "\n" doc: | Integer or boolean, encoded with the ASCII characters [0-9-]. The values '00' and '01' encode the Python values `False` and `True`. Normally a value would not contain leading '0' characters. + seq: + - id: val + type: str + encoding: ascii + terminator: 0x0a # "\n" decimalnl_long: + doc: Integer, encoded with the ASCII chracters [0-9-], followed by 'L'. seq: - id: val type: str encoding: ascii terminator: 0x0a # "\n" - doc: Integer, encoded with the ASCII chracters [0-9-], followed by 'L'. # TODO Can kaitai express constraint that these are quoted? stringnl: + doc: Quoted string, possibly containing Python string escapes. seq: - id: val type: str encoding: ascii terminator: 0x0a # "\n" - doc: Quoted string, possibly containing Python string escapes. stringnl_noescape: + doc: Unquoted string, does not contain string escapes. seq: - id: val type: str encoding: ascii terminator: 0x0a # "\n" - doc: Unquoted string, does not contain string escapes. stringnl_noescape_pair: + doc: Pair of unquoted, unescaped strings. seq: - id: val1 type: stringnl_noescape - id: val2 type: stringnl_noescape - doc: Pair of unquoted, unescaped strings. unicodestringnl: + doc: Unquoted string, containing Python Unicode escapes. seq: - id: val type: str encoding: ascii terminator: 0x0a # "\n" - doc: Unquoted string, containing Python Unicode escapes. floatnl: + doc: | + Double float, encoded with the ASCII characters [0-9.e+-], '-inf', 'inf', + or 'nan'. seq: - id: val type: str encoding: ascii terminator: 0x0a # "\n" - doc: | - Double float, encoded with the ASCII characters [0-9.e+-], '-inf', 'inf', - or 'nan'. long1: - seq: - - id: len - type: u1 - - id: val - size: len doc: | Large signed integer, in the range -2**(8*255-1) to 2**(8*255-1)-1, encoded as two's complement. - - long4: seq: - id: len - type: u4 + type: u1 - id: val size: len + + long4: doc: | Large signed integer, in the range -2**(8*2**32-1) to 2**(8*2**32-1)-1, encoded as two's complement. - - string1: seq: - id: len - type: u1 + type: u4 - id: val size: len + + string1: doc: | Length prefixed string, between 0 and 255 bytes long. Encoding is unspecified. @@ -233,14 +228,13 @@ types: - `pickle.Unpickler` objects default to ASCII, which can be overriden - `pickletools.dis` uses latin1, and cannot be overriden doc-ref: https://github.com/python/cpython/blob/bb8071a4/Lib/pickle.py#L486-L495 - - string4: seq: - id: len - # Not a typo, the length really is a signed integer - type: s4 + type: u1 - id: val size: len + + string4: doc: | Length prefixed string, between 0 and 2**31-1 bytes long. Encoding is unspecified. @@ -250,29 +244,30 @@ types: See the documentation for `string1` for further detail about encodings. doc-ref: https://github.com/python/cpython/blob/bb8071a4/Lib/pickle.py#L486-L495 + seq: + - id: len + # Not a typo, the length really is a signed integer + type: s4 + - id: val + size: len bytes1: + doc: Length prefixed byte string, between 0 and 255 bytes long. seq: - id: len type: u1 - id: val size: len - doc: Length prefixed byte string, between 0 and 255 bytes long. bytes4: + doc: Length prefixed string, between 0 and 2**32-1 bytes long seq: - id: len type: u4 - id: val size: len - doc: Length prefixed string, between 0 and 2**32-1 bytes long bytes8: - seq: - - id: len - type: u8 - - id: val - size: len doc: | Length prefixed string, between 0 and 2**64-1 bytes long. @@ -280,19 +275,25 @@ types: large enough to need this type. Such a pickle could not be unpickled on a 32-bit build of Python, because the string would be larger than `sys.maxsize`. - - bytearray8: seq: - id: len type: u8 - id: val size: len + + bytearray8: doc: | Length prefixed string, between 0 and 2**64-1 bytes long. The contents are deserilised into a `bytearray` object. + seq: + - id: len + type: u8 + - id: val + size: len unicodestring1: + doc: Length prefixed string, between 0 and 255 bytes long seq: - id: len type: u1 @@ -300,9 +301,9 @@ types: type: str encoding: utf8 size: len - doc: Length prefixed string, between 0 and 255 bytes long unicodestring4: + doc: Length prefixed string, between 0 and 2**32-1 bytes long seq: - id: len type: u4 @@ -310,16 +311,8 @@ types: type: str encoding: utf8 size: len - doc: Length prefixed string, between 0 and 2**32-1 bytes long unicodestring8: - seq: - - id: len - type: u8 - - id: val - type: str - encoding: utf8 - size: len doc: | Length prefixed string, between 0 and 2**64-1 bytes long. @@ -327,6 +320,13 @@ types: large enough to need this type. Such a pickle could not be unpickled on a 32-bit build of Python, because the string would be larger than `sys.maxsize`. + seq: + - id: len + type: u8 + - id: val + type: str + encoding: utf8 + size: len no_arg: doc: Some opcodes take no argument, this empty type is used for them. diff --git a/serialization/ruby_marshal.ksy b/serialization/ruby_marshal.ksy index 206490895..6eb39cc73 100644 --- a/serialization/ruby_marshal.ksy +++ b/serialization/ruby_marshal.ksy @@ -1,7 +1,7 @@ meta: id: ruby_marshal - endian: le license: CC0-1.0 + endian: le doc: | Ruby's Marshal module allows serialization and deserialization of many standard and arbitrary Ruby objects in a compact binary diff --git a/windows/regf.ksy b/windows/regf.ksy index 3d53b2b0d..d6c6e756f 100644 --- a/windows/regf.ksy +++ b/windows/regf.ksy @@ -98,6 +98,7 @@ types: type: u4 doc: Contains number of bytes hive_bin_cell: + -webide-representation: "{identifier}" seq: - id: cell_size_raw type: s4 @@ -117,7 +118,6 @@ types: "'ri'": sub_key_list_ri "'vk'": sub_key_list_vk "'sk'": sub_key_list_sk - -webide-representation: "{identifier}" instances: cell_size: value: "(cell_size_raw < 0 ? -1 : +1) * cell_size_raw" diff --git a/windows/windows_lnk_file.ksy b/windows/windows_lnk_file.ksy index 6beabe20b..af6508ea9 100644 --- a/windows/windows_lnk_file.ksy +++ b/windows/windows_lnk_file.ksy @@ -7,10 +7,10 @@ meta: mime: application/x-ms-shortcut pronom: x-fmt/428 license: CC0-1.0 - endian: le - encoding: cp437 imports: - windows_shell_items + encoding: cp437 + endian: le doc: | Windows .lnk files (AKA "shell link" file) are most frequently used in Windows shell to create "shortcuts" to another files, usually for @@ -48,8 +48,8 @@ seq: if: header.flags.has_icon_location types: file_header: - doc-ref: 'https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/MS-SHLLINK/[MS-SHLLINK].pdf Section 2.1' -orig-id: ShellLinkHeader + doc-ref: 'https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/MS-SHLLINK/[MS-SHLLINK].pdf Section 2.1' seq: - id: len_header -orig-id: HeaderSize @@ -136,7 +136,7 @@ types: doc-ref: 'https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/MS-SHLLINK/[MS-SHLLINK].pdf Section 2.2' seq: - id: len_id_list - -orig-id: IDListSize + -orig-id: IDListSize type: u2 - id: id_list -orig-id: IDList diff --git a/windows/windows_resource_file.ksy b/windows/windows_resource_file.ksy index 68a22eeea..e7ef88a75 100644 --- a/windows/windows_resource_file.ksy +++ b/windows/windows_resource_file.ksy @@ -85,14 +85,14 @@ types: size: (4 - _io.pos) % 4 instances: type_as_predef: + value: type.as_numeric + enum: predef_types + if: not type.is_string and type.as_numeric <= 0xff doc: | Numeric type IDs in range of [0..0xff] are reserved for system usage in Windows, and there are some predefined, well-known values in that range. This instance allows to get it as enum value, if applicable. - value: type.as_numeric - enum: predef_types - if: not type.is_string and type.as_numeric <= 0xff enums: predef_types: # https://msdn.microsoft.com/en-us/library/windows/desktop/ms648009.aspx @@ -151,7 +151,7 @@ types: value: first != 0xffff as_string: pos: save_pos1 - type: str size: save_pos2 - save_pos1 - 2 + type: str encoding: UTF-16LE if: is_string diff --git a/windows/windows_systemtime.ksy b/windows/windows_systemtime.ksy index d28f82c77..03e08728c 100644 --- a/windows/windows_systemtime.ksy +++ b/windows/windows_systemtime.ksy @@ -1,8 +1,8 @@ meta: id: windows_systemtime - endian: le title: Microsoft Windows SYSTEMTIME structure license: CC0-1.0 + endian: le doc: | Microsoft Windows SYSTEMTIME structure, stores individual components of date and time as individual fields, up to millisecond precision.