[File] magdir submission: Xamarin LZ4-compressed assemblies

[Christos Zoulas]

Added, thanks!

christos

> On Aug 14, 2023, at 2:03 AM, Gaelan Steele <gbs at canishe.com> wrote:
> 
> Hello,
> 
> Xamarin, a framework for writing Android (and iOS, but the format in question isn’t used there) apps using Microsoft’s .NET languages, stores bytecode in .dll files containing LZ4-compressed data and a custom header. The format is documented in a GitHub pull request[1]. This header begins with the magic number “XALZ” at position 0. A rule like this one will match it:
> 
> 0 string XALZ Xamarin LZ4-compressed assembly
> 
> Not submitting this as a proper patch because there are a few points I’m not sure about:
> 
> * Without this rule, these files are matched as “PlayStation Audio” due to the “XA” prefix; passing the above rule with -m seems to get the right rule, but I’m not sure if that’s reliable or just luck. Do I need some sort of strength line? (Ideally we’d improve the matching for PlayStation audio, but I don’t have any of those files around to test on.)
> 
> * Not quite sure where this rule should go; I suppose the closest match is “android”, but (a) this isn’t actually part of the Android platform, and (b) it seems possible that this format is reused for Xamarin iOS later.
> 
> Best wishes,
> Gaelan Steele
> 
> [1]: https://github.com/xamarin/xamarin-android/pull/4686
> --
> File mailing list
> File at astron.com
> https://mailman.astron.com/mailman/listinfo/file

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 235 bytes
Desc: Message signed with OpenPGP
URL: <https://mailman.astron.com/pipermail/file/attachments/20230914/ebb017ba/attachment.asc>