[File] Detect YAFFS images
FC Stegerman
flx at obfusk.net
Mon Jan 23 22:28:23 UTC 2023
* Fabian Zaremba <fabian at youremail.eu> [2023-01-23 22:49]:
Just a suggestion: for BE, requiring a match of the 3 null bytes at
the start as well would reduce the chance of a false positive; e.g.
0x4 string \x00\x00\x00\x01\xFF\xFF
>0 string \x00\x00\x00 YAFFS filesystem root entry, big endian,
>>0 ubelong 0 {invalid}(unknown type id)
>>0 ubelong 1 type file,
[remainder elided]
NB: I haven't tested this.
- FC
More information about the File
mailing list