defmodule Infer.App do
  @moduledoc """
  Application type matchers based on the [magic number](https://en.wikipedia.org/wiki/Magic_number_(programming))
  """

  @doc """
  Takes the binary file contents as arguments. Returns `true` if it's a WASM.

  See: http://webassembly.github.io/spec/core/binary/modules.html#binary-magic

  ## Examples

      iex> binary = File.read!("test/app/sample.wasm")
      iex> Infer.App.wasm?(binary)
      true

      iex> binary = File.read!("test/app/sample.exe")
      iex> Infer.App.wasm?(binary)
      false

  """
  @spec wasm?(binary()) :: boolean()
  def wasm?(<<0x00, 0x61, 0x73, 0x6D, 0x01, 0x00, 0x00, 0x00, _rest::binary>>), do: true
  def wasm?(_binary), do: false

  @doc """
  Takes the binary file contents as arguments. Returns `true` if it's a EXE or DLL.

  DLL and EXE share the same magic number.

  ## Examples

      iex> binary = File.read!("test/app/sample.exe")
      iex> Infer.App.exe?(binary)
      true

      iex> binary = File.read!("test/app/sample.wasm")
      iex> Infer.App.exe?(binary)
      false

  """
  @spec exe?(binary()) :: boolean()
  def exe?(<<0x4D, 0x5A, _rest::binary>>), do: true
  def exe?(_binary), do: false

  @doc """
  Takes the binary file contents as arguments. Returns `true` if it's a EXE or DLL.

  DLL and EXE share the same magic number.

  ## Examples

      iex> binary = File.read!("test/app/sample.exe")
      iex> Infer.App.dll?(binary)
      true

      iex> binary = File.read!("test/app/sample.wasm")
      iex> Infer.App.dll?(binary)
      false

  """
  @spec dll?(binary()) :: boolean()
  def dll?(<<0x4D, 0x5A, _rest::binary>>), do: true
  def dll?(_binary), do: false

  @doc """
  Takes the binary file contents as arguments. Returns `true` if it's a elf.

  DLL and EXE share the same magic number.

  ## Examples

      iex> binary = File.read!("test/app/sample_elf")
      iex> Infer.App.elf?(binary)
      true

      iex> binary = File.read!("test/app/sample.wasm")
      iex> Infer.App.elf?(binary)
      false

  """
  @spec elf?(binary()) :: boolean()
  def elf?(<<0x7F, 0x45, 0x4C, 0x46, _rest::binary>> = binary) when byte_size(binary) > 52, do: true
  def elf?(_binary), do: false

  @doc """
  Takes the binary file contents as arguments. Returns `true` if it's compiled java bytecode.
  """
  @spec java?(binary()) :: boolean()
  def java?(<<0x43, 0x41, 0x76, 0x45, 0x42, 0x01, 0x42, 0x45, _rest::binary>>), do: true
  def java?(<<0x43, 0x41, 0x76, 0x45, 0x44, 0x30, 0x30, 0x44, _rest::binary>>), do: true
  def java?(_binary), do: false

  @doc """
  Takes the binary file contents as arguments. Returns `true` if it's LLVM bitcode.
  """
  @spec llvm?(binary()) :: boolean()
  def llvm?(<<0x42, 0x43, _rest::binary>>), do: true
  def llvm?(_binary), do: false

  @doc """
  Takes the binary file contents as arguments. Returns `true` if it's a Mach-O binary.
  Mach-O binaries can be one of four variants: x86, x64, PowerPC, "Fat" (x86 + PowerPC)

  See: https://ilostmynotes.blogspot.com/2014/05/mach-o-filetype-identification.html

  ## Examples

      iex> binary = File.read!("test/app/sample_mach_fat")
      iex> Infer.App.mach?(binary)
      true

      iex> binary = File.read!("test/app/sample_mach_ppc")
      iex> Infer.App.mach?(binary)
      true

      iex> binary = File.read!("test/app/sample_mach_x64")
      iex> Infer.App.mach?(binary)
      true

      iex> binary = File.read!("test/app/sample_mach_x86")
      iex> Infer.App.mach?(binary)
      true

      iex> binary = File.read!("test/app/sample.wasm")
      iex> Infer.App.mach?(binary)
      false

  """
  @spec mach?(binary()) :: boolean()
  def mach?(<<width, 0xFA, 0xED, 0xFE, _rest::binary>>) when width in [0xCF, 0xCE], do: true
  def mach?(<<0xFE, 0xED, 0xFA, width, _rest::binary>>) when width in [0xCF, 0xCE], do: true
  def mach?(<<0xCA, 0xFE, 0xBA, 0xBE, _rest::binary>>), do: true
  def mach?(_binary), do: false

  @doc """
  Takes the binary file contents as arguments. Returns `true` if it's a Dalvik Executable (DEX).

  See: https://source.android.com/devices/tech/dalvik/dex-format#dex-file-magic
  """
  @spec dex?(binary()) :: boolean()
  def dex?(<<0x64, 0x65, 0x78, 0x0A, _data::binary-size(32), 0x70, _rest::binary>>), do: true
  def dex?(_binary), do: false

  @doc """
  Takes the binary file contents as arguments. Returns `true` if it's a Optimized Dalvik Executable (ODEX).

  See: https://source.android.com/devices/tech/dalvik/dex-format#dex-file-magic
  """
  @spec dey?(binary()) :: boolean()
  def dey?(<<0x64, 0x65, 0x79, 0x0A, _data::binary-size(36), dex::binary-size(60), _rest::binary>>), do: dex?(dex)
  def dey?(_binary), do: false

  @doc """
  Takes the binary file contents as arguments. Returns `true` if it's a DER encoded X.509 certificate.

  See: https://github.com/ReFirmLabs/binwalk/blob/master/src/binwalk/magic/crypto#L25-L37
  See: https://www.digitalocean.com/community/tutorials/openssl-essentials-working-with-ssl-certificates-private-keys-and-csrs

  ## Examples

      iex> binary = File.read!("test/app/sample.der")
      iex> Infer.App.der?(binary)
      true

      iex> binary = File.read!("test/app/sample.wasm")
      iex> Infer.App.der?(binary)
      false

  """
  @spec der?(binary()) :: boolean()
  def der?(<<0x30, 0x82, _rest::binary>>), do: true
  def der?(_binary), do: false

  @doc """
  Takes the binary file contents as arguments. Returns `true` if it's a Common Object File Format for i386 architecture.
  """
  @spec coff_i386?(binary()) :: boolean()
  def coff_i386?(<<0x4C, 0x01, _rest::binary>>), do: true
  def coff_i386?(_binary), do: false

  @doc """
  Takes the binary file contents as arguments. Returns `true` if it's a Common Object File Format for x64 architecture.
  """
  @spec coff_x64?(binary()) :: boolean()
  def coff_x64?(<<0x64, 0x86, _rest::binary>>), do: true
  def coff_x64?(_binary), do: false

  @doc """
  Takes the binary file contents as arguments. Returns `true` if it's a Common Object File Format for Itanium architecture.
  """
  @spec coff_ia64?(binary()) :: boolean()
  def coff_ia64?(<<0x00, 0x02, _rest::binary>>), do: true
  def coff_ia64?(_binary), do: false

  @doc """
  Takes the binary file contents as arguments. Returns `true` if it's a Common Object File Format.
  """
  @spec coff?(binary()) :: boolean()
  def coff?(binary), do: coff_x64?(binary) || coff_i386?(binary) || coff_ia64?(binary)
end