[File] Detect YAFFS images

[FC Stegerman]

* FC Stegerman <flx at obfusk.net> [2023-01-24 00:44]:
> * Fabian Zaremba <fabian at youremail.eu> [2023-01-23 23:45]:
> > Am I correct in assuming that removing the ulelong / ubelong lines for the
> > invalid enum values (0 & >5) will not further reduce false positives?
> 
> AFAIK that is correct.  Since these matches happen after the message
> "YAFFS filesystem root entry, ... endian" has already been output.
> 
> Of course it would probably be possible to write the magic entry in
> such a way that it avoids false positives from invalid enum values if
> you really wanted to.  But I suspect the 72 bits initial match you
> have now is enough.

I wrote (and attached) a v3 patch that only recognises valid enums :)

NB: if you decide to use it, please test it, since I did not.

- FC
-------------- next part --------------
A non-text attachment was scrubbed...
Name: yaffs_v3.patch
Type: text/x-diff
Size: 2510 bytes
Desc: not available
URL: <https://mailman.astron.com/pipermail/file/attachments/20230124/e59c3431/attachment.bin>