[File] Detect YAFFS images
flx at obfusk.net
Mon Jan 23 23:44:31 UTC 2023
* Fabian Zaremba <fabian at youremail.eu> [2023-01-23 23:45]:
> Am I correct in assuming that removing the ulelong / ubelong lines for the
> invalid enum values (0 & >5) will not further reduce false positives?
AFAIK that is correct. Since these matches happen after the message
"YAFFS filesystem root entry, ... endian" has already been output.
Of course it would probably be possible to write the magic entry in
such a way that it avoids false positives from invalid enum values if
you really wanted to. But I suspect the 72 bits initial match you
have now is enough.
More information about the File