Infer.App (Infer v0.1.0) View Source

Application type matchers based on the magic number

Link to this section Summary

Functions

Takes the binary file contents as arguments. Returns true if it's a Common Object File Format.

Takes the binary file contents as arguments. Returns true if it's a Common Object File Format for i386 architecture.

Takes the binary file contents as arguments. Returns true if it's a Common Object File Format for Itanium architecture.

Takes the binary file contents as arguments. Returns true if it's a Common Object File Format for x64 architecture.

Takes the binary file contents as arguments. Returns true if it's a DER encoded X.509 certificate.

Takes the binary file contents as arguments. Returns true if it's a Dalvik Executable (DEX).

Takes the binary file contents as arguments. Returns true if it's a Optimized Dalvik Executable (ODEX).

Takes the binary file contents as arguments. Returns true if it's a EXE or DLL.

Takes the binary file contents as arguments. Returns true if it's a elf.

Takes the binary file contents as arguments. Returns true if it's a EXE or DLL.

Takes the binary file contents as arguments. Returns true if it's compiled java bytecode.

Takes the binary file contents as arguments. Returns true if it's LLVM bitcode.

Takes the binary file contents as arguments. Returns true if it's a Mach-O binary. Mach-O binaries can be one of four variants: x86, x64, PowerPC, "Fat" (x86 + PowerPC)

Takes the binary file contents as arguments. Returns true if it's a WASM.

Link to this section Functions

Specs

is_coff(binary()) :: boolean()

Takes the binary file contents as arguments. Returns true if it's a Common Object File Format.

Specs

is_coff_i386(binary()) :: boolean()

Takes the binary file contents as arguments. Returns true if it's a Common Object File Format for i386 architecture.

Specs

is_coff_ia64(binary()) :: boolean()

Takes the binary file contents as arguments. Returns true if it's a Common Object File Format for Itanium architecture.

Specs

is_coff_x64(binary()) :: boolean()

Takes the binary file contents as arguments. Returns true if it's a Common Object File Format for x64 architecture.

Specs

is_der(binary()) :: boolean()

Takes the binary file contents as arguments. Returns true if it's a DER encoded X.509 certificate.

See: https://github.com/ReFirmLabs/binwalk/blob/master/src/binwalk/magic/crypto#L25-L37 See: https://www.digitalocean.com/community/tutorials/openssl-essentials-working-with-ssl-certificates-private-keys-and-csrs

Examples

iex> binary = File.read!("test/app/sample.der")
iex> Infer.App.is_der(binary)
true

iex> binary = File.read!("test/app/sample.wasm")
iex> Infer.App.is_der(binary)
false

Specs

is_dex(binary()) :: boolean()

Takes the binary file contents as arguments. Returns true if it's a Dalvik Executable (DEX).

See: https://source.android.com/devices/tech/dalvik/dex-format#dex-file-magic

Specs

is_dey(binary()) :: boolean()

Takes the binary file contents as arguments. Returns true if it's a Optimized Dalvik Executable (ODEX).

See: https://source.android.com/devices/tech/dalvik/dex-format#dex-file-magic

Specs

is_dll(binary()) :: boolean()

Takes the binary file contents as arguments. Returns true if it's a EXE or DLL.

DLL and EXE share the same magic number.

Examples

iex> binary = File.read!("test/app/sample.exe")
iex> Infer.App.is_dll(binary)
true

iex> binary = File.read!("test/app/sample.wasm")
iex> Infer.App.is_dll(binary)
false

Specs

is_elf(binary()) :: boolean()

Takes the binary file contents as arguments. Returns true if it's a elf.

DLL and EXE share the same magic number.

Examples

iex> binary = File.read!("test/app/sample_elf")
iex> Infer.App.is_elf(binary)
true

iex> binary = File.read!("test/app/sample.wasm")
iex> Infer.App.is_elf(binary)
false

Specs

is_exe(binary()) :: boolean()

Takes the binary file contents as arguments. Returns true if it's a EXE or DLL.

DLL and EXE share the same magic number.

Examples

iex> binary = File.read!("test/app/sample.exe")
iex> Infer.App.is_exe(binary)
true

iex> binary = File.read!("test/app/sample.wasm")
iex> Infer.App.is_exe(binary)
false

Specs

is_java(binary()) :: boolean()

Takes the binary file contents as arguments. Returns true if it's compiled java bytecode.

Specs

is_llvm(binary()) :: boolean()

Takes the binary file contents as arguments. Returns true if it's LLVM bitcode.

Specs

is_mach(binary()) :: boolean()

Takes the binary file contents as arguments. Returns true if it's a Mach-O binary. Mach-O binaries can be one of four variants: x86, x64, PowerPC, "Fat" (x86 + PowerPC)

See: https://ilostmynotes.blogspot.com/2014/05/mach-o-filetype-identification.html

Examples

iex> binary = File.read!("test/app/sample_mach_fat")
iex> Infer.App.is_mach(binary)
true

iex> binary = File.read!("test/app/sample_mach_ppc")
iex> Infer.App.is_mach(binary)
true

iex> binary = File.read!("test/app/sample_mach_x64")
iex> Infer.App.is_mach(binary)
true

iex> binary = File.read!("test/app/sample_mach_x86")
iex> Infer.App.is_mach(binary)
true

iex> binary = File.read!("test/app/sample.wasm")
iex> Infer.App.is_mach(binary)
false

Specs

is_wasm(binary()) :: boolean()

Takes the binary file contents as arguments. Returns true if it's a WASM.

See: http://webassembly.github.io/spec/core/binary/modules.html#binary-magic

Examples

iex> binary = File.read!("test/app/sample.wasm")
iex> Infer.App.is_wasm(binary)
true

iex> binary = File.read!("test/app/sample.exe")
iex> Infer.App.is_wasm(binary)
false