void scan_outlook(const class scanner_params &sp,const recursion_control_block &rcb)
{
assert(sp.sp_version==scanner_params::CURRENT_SP_VERSION);
if(sp.phase==scanner_params::PHASE_STARTUP) {
assert(sp.info->si_version==scanner_info::CURRENT_SI_VERSION);
sp.info->name = "outlook";
sp.info->author = "Simson L. Garfinkel";
sp.info->description = "Outlook Compressible Encryption";
sp.info->flags = scanner_info::SCANNER_DISABLED \
| scanner_info::SCANNER_RECURSE | scanner_info::SCANNER_DEPTH_0 \
| scanner_info::SCANNER_NO_ALL;
return;
}
if(sp.phase==scanner_params::PHASE_SCAN) {
const sbuf_t &sbuf = sp.sbuf;
const pos0_t &pos0 = sp.sbuf.pos0;
// dodge infinite recursion by refusing to operate on an OFE'd buffer
if(rcb.partName == pos0.lastAddedPart()) {
return;
}
// managed_malloc throws an exception if allocation fails.
managed_malloc<uint8_t>dbuf(sbuf.bufsize);
for(size_t ii = 0; ii < sbuf.bufsize; ii++) {
uint8_t ch = sbuf.buf[ii];
dbuf.buf[ii] = libpff_encryption_compressible[ ch ];
}
const pos0_t pos0_oce = pos0 + "OUTLOOK";
const sbuf_t child_sbuf(pos0_oce, dbuf.buf, sbuf.bufsize, sbuf.pagesize, false);
scanner_params child_params(sp, child_sbuf);
(*rcb.callback)(child_params); // recurse on deobfuscated buffer
}
}
int
main(int argc, char ** argv)
{
// Space for the children
struct Exclamation children[STEPCHILDREN];
// The parent
struct Exclamation parent;
// The handle
int handle;
// The parameters for the children
float width, height, xGap, ySlot;
parent.height = 160;
parent.width = 20;
parent.bottom = -79;
parent.left = -8;
// Get the paramters for a fractal step
child_params(&parent,
&width, &height,
&xGap, &ySlot);
// Recurse one step
fractal_step(width, height,
parent.left, parent.bottom,
xGap, ySlot,
children);
handle = start_drawing();
draw_children(STEPCHILDREN, children);
stop_drawing(handle);
return 0;
}
