[File] Detect YAFFS images

FC Stegerman flx at obfusk.net
Mon Jan 23 22:28:23 UTC 2023

* Fabian Zaremba <fabian at youremail.eu> [2023-01-23 22:49]:

Just a suggestion: for BE, requiring a match of the 3 null bytes at
the start as well would reduce the chance of a false positive; e.g.

0x4     string     \x00\x00\x00\x01\xFF\xFF
>0      string     \x00\x00\x00               YAFFS filesystem root entry, big endian,
>>0     ubelong    0                          {invalid}(unknown type id)
>>0     ubelong    1                          type file,
[remainder elided]

NB: I haven't tested this.

- FC

More information about the File mailing list