Hi
I am trying to read the first few bytes from a binary file and match it to various magic headers. However, if I was searching for Microsoft Office (docx etc) documents, both the headers for zip and Microsoft Office will match since newer Microsoft Office documents are considered zip files as well. How do I get only the more precise match instead of both?
use memmem::*;
....
fn search_headers(file_bytes: &[u8])
{
let vec_mac = hex!("CFFAEDFE").to_vec();
let vec_mz = hex!("4D5A").to_vec();
let vec_zip = hex!("504B0304").to_vec();
let vec_ms = hex!("504B030414000600").to_vec();
let vec_array = [vec_mac,
vec_mz,
vec_zip,
vec_ms
];
for file_array in vec_array.iter()
{
let fileheader = memmem::TwoWaySearcher::new(&file_array);
let search_output = fileheader.search_in(&file_bytes[..20]);
match search_output
{
Some(retval) =>
{
println!("\tFound matching file type");
println!("\tmatching array {:02X?}", file_array);
println!();
}
None =>
{
println!();
continue;
}
}
}
}