void de_fmtutil_handle_SAUCE(deark *c, dbuf *f, struct de_SAUCE_info *si) { de_module_params mparams; de_zeromem(&mparams, sizeof(de_module_params)); mparams.out_params.obj1 = (void*)si; de_run_module_by_id_on_slice(c, "sauce", &mparams, f, 0, f->len); }
// flags: // 0 = default behavior (currently: decode unless -opt extractplist was used) void de_fmtutil_handle_plist(deark *c, dbuf *f, i64 pos, i64 len, de_finfo *fi, unsigned int flags) { if(de_get_ext_option_bool(c, "extractplist", 0)) { dbuf_create_file_from_slice(f, pos, len, fi?NULL:"plist", fi, DE_CREATEFLAG_IS_AUX); return; } de_run_module_by_id_on_slice(c, "plist", NULL, f, pos, len); }
// If oparams is not NULL, if must be initialized by the caller. If the data is // decoded, oparams will be used by the submodule, and values may be returned in // it. // flags: // 0 = default behavior (currently: always decode) // 1 = always write to file // 2 = this came from our TIFF-encapsulated format void de_fmtutil_handle_photoshop_rsrc2(deark *c, dbuf *f, i64 pos, i64 len, unsigned int flags, struct de_module_out_params *oparams) { int should_decode; int should_extract; int extract_fmt = 1; // 0=raw, 1=TIFF-wrapped if(flags&0x1) { should_decode = 0; should_extract = 1; } else if(de_get_ext_option_bool(c, "extract8bim", 0)) { should_extract = 1; should_decode = 0; if(flags&0x2) { // Avoid "extracting" in a way that would just recreate the exact same file. extract_fmt = 0; } } else { should_decode = 1; should_extract = 0; } if(should_decode) { de_module_params *mparams = NULL; mparams = de_malloc(c, sizeof(de_module_params)); mparams->in_params.codes = "R"; if(oparams) { // Since mparams->out_params is an embedded struct, not a pointer, // we have to copy oparam's fields to and from it. mparams->out_params = *oparams; // struct copy } de_run_module_by_id_on_slice(c, "psd", mparams, f, pos, len); if(oparams) { *oparams = mparams->out_params; // struct copy } de_free(c, mparams); } if(should_extract && extract_fmt==0) { dbuf_create_file_from_slice(f, pos, len, "8bim", NULL, DE_CREATEFLAG_IS_AUX); } else if(should_extract && extract_fmt==1) { wrap_in_tiff(c, f, pos, len, "Deark extracted 8BIM", 34377, "8bimtiff", DE_CREATEFLAG_IS_AUX); } }
static void handle_embedded_file(deark *c, lctx *d, de_int64 offset, de_int64 len) { de_byte buf[16]; const char *ext; int extract_this_file; int is_pic; de_dbg(c, "embedded file at %d, len=%d\n", (int)offset, (int)len); is_pic = 0; ext = "bin"; extract_this_file = 0; if(len>0 && c->extract_level>=2) extract_this_file = 1; // As far as I can tell, there's no way to tell the type of an // embedded file, except by sniffing it. de_read(buf, offset, 16); if(len>=8) { if(!de_memcmp(buf, "PIC\xdc\x30\x30", 6)) { // Looks like a PIC file is_pic = 1; ext = "pic"; extract_this_file = 1; } } if(extract_this_file) { if(is_pic && d->convert_images) { // Convert PIC to PNG. // For consistency, this option shouldn't exist. But I'm not sure that // PIC files embedded in APP files are really the same as PIC files on // their own. They might need special handling. Until I'm sure they don't, // I'll leave this option here. de_run_module_by_id_on_slice(c, "psionpic", NULL, c->infile, offset, len); } else { // Just extract the file dbuf_create_file_from_slice(c->infile, offset, len, ext, NULL, is_pic?0:DE_CREATEFLAG_IS_AUX); } } else { de_dbg(c, "(not extracting this file)\n"); } }
static int do_picture_ole_static_rendition(deark *c, lctx *d, struct para_info *pinfo, int rendition_idx, i64 pos1, i64 *bytes_consumed) { i64 pos = pos1; i64 stringlen; struct de_stringreaderdata *srd_typename = NULL; pos += 4; // 0x00000501 pos += 4; // "type" (probably already read by caller) stringlen = de_getu32le_p(&pos); srd_typename = dbuf_read_string(c->infile, pos, stringlen, 260, DE_CONVFLAG_STOP_AT_NUL, DE_ENCODING_ASCII); de_dbg(c, "typename: \"%s\"", ucstring_getpsz(srd_typename->str)); pos += stringlen; if(!de_strcmp(srd_typename->sz, "DIB")) { pos += 12; de_dbg_indent(c, 1); de_run_module_by_id_on_slice(c, "dib", NULL, c->infile, pos, pinfo->thisparapos+pinfo->thisparalen-pos); de_dbg_indent(c, -1); } else if(!de_strcmp(srd_typename->sz, "METAFILEPICT")) { i64 dlen; pos += 8; // ?? dlen = de_getu32le_p(&pos); de_dbg(c, "metafile size: %d", (int)dlen); // Includes "mfp", apparently pos += 8; // "mfp" struct dbuf_create_file_from_slice(c->infile, pos, dlen-8, "wmf", NULL, 0); } else if(!de_strcmp(srd_typename->sz, "BITMAP")) { do_static_bitmap(c, d, pinfo, pos); } else { de_warn(c, "Static OLE picture type \"%s\" is not supported", ucstring_getpsz(srd_typename->str)); } de_destroy_stringreaderdata(c, srd_typename); return 0; }
// Extracts Exif if extract_level>=2, or "extractexif" option is set. // Otherwise decodes. void de_fmtutil_handle_exif2(deark *c, i64 pos, i64 len, u32 *returned_flags, u32 *orientation, u32 *exifversion) { int user_opt; de_module_params *mparams = NULL; if(returned_flags) { *returned_flags = 0; } user_opt = de_get_ext_option_bool(c, "extractexif", -1); if(user_opt==1 || (c->extract_level>=2 && user_opt!=0)) { // Writing raw Exif data isn't very useful, but do so if requested. dbuf_create_file_from_slice(c->infile, pos, len, "exif.tif", NULL, DE_CREATEFLAG_IS_AUX); // Caller will have to reprocess the Exif file to extract anything from it. return; } mparams = de_malloc(c, sizeof(de_module_params)); mparams->in_params.codes = "E"; de_run_module_by_id_on_slice(c, "tiff", mparams, c->infile, pos, len); if(returned_flags) { // FIXME: It's an unfortunate bug that returned_flags does not work if // extract_level>=2, but for now there's no reasonable way to fix it. // We have to process -- not extract -- the Exif chunk if we want to // know what's in it. *returned_flags = mparams->out_params.flags; if((mparams->out_params.flags & 0x20) && orientation) { *orientation = mparams->out_params.uint1; } if((mparams->out_params.flags & 0x40) && exifversion) { *exifversion = mparams->out_params.uint2; } } de_free(c, mparams); }
// Either extract the IPTC data to a file, or drill down into it. // flags: // 0 = default behavior (currently: depends on c->extract_level and options) // 2 = this came from our TIFF-encapsulated format void de_fmtutil_handle_iptc(deark *c, dbuf *f, i64 pos, i64 len, unsigned int flags) { int should_decode; int should_extract; int user_opt; int extract_fmt = 1; // 0=raw, 1=TIFF-wrapped if(len<1) return; user_opt = de_get_ext_option_bool(c, "extractiptc", -1); if(user_opt==1 || (c->extract_level>=2 && user_opt!=0)) { should_decode = 0; should_extract = 1; if(flags&0x2) { // Avoid "extracting" in a way that would just recreate the exact same file. extract_fmt = 0; } } else { should_decode = 1; should_extract = 0; } if(should_decode) { de_run_module_by_id_on_slice(c, "iptc", NULL, f, pos, len); } if(should_extract && extract_fmt==0) { dbuf_create_file_from_slice(f, pos, len, "iptc", NULL, DE_CREATEFLAG_IS_AUX); } else if(should_extract && extract_fmt==1) { wrap_in_tiff(c, f, pos, len, "Deark extracted IPTC", 33723, "iptctiff", DE_CREATEFLAG_IS_AUX); } }