Added BIN firmware header signature

src/magic.rs

@@ -877,6 +877,17 @@ pub fn patterns() -> Vec<signatures::common::Signature> {
             description: signatures::tplink::RTOS_DESCRIPTION.to_string(),
             extractor: None,
         },
+        // BIN firmware header
+        signatures::common::Signature {
+            name: "binhdr".to_string(),
+            short: false,
+            magic_offset: 0,
+            always_display: false,
+            magic: signatures::binhdr::bin_hdr_magic(),
+            parser: signatures::binhdr::bin_hdr_parser,
+            description: signatures::binhdr::DESCRIPTION.to_string(),
+            extractor: None,
+        },
     ];
 
     binary_signatures

src/signatures.rs

@@ -108,6 +108,7 @@
 pub mod aes;
 pub mod androidsparse;
 pub mod arcadyan;
+pub mod binhdr;
 pub mod bzip2;
 pub mod cab;
 pub mod cfe;

src/signatures/binhdr.rs

@@ -0,0 +1,41 @@
+use crate::signatures::common::{SignatureError, SignatureResult, CONFIDENCE_MEDIUM};
+use crate::structures::binhdr::parse_bin_header;
+
+/// Human readable description
+pub const DESCRIPTION: &str = "BIN firmware header";
+
+/// BIN header magic bytes
+pub fn bin_hdr_magic() -> Vec<Vec<u8>> {
+    vec![b"U2ND".to_vec()]
+}
+
+/// Validates the BIN header
+pub fn bin_hdr_parser(file_data: &[u8], offset: usize) -> Result<SignatureResult, SignatureError> {
+    const MAGIC_OFFSET: usize = 14;
+
+    // Successful return value
+    let mut result = SignatureResult {
+        offset,
+        description: DESCRIPTION.to_string(),
+        confidence: CONFIDENCE_MEDIUM,
+        ..Default::default()
+    };
+
+    if offset >= MAGIC_OFFSET {
+        result.offset = offset - MAGIC_OFFSET;
+
+        if let Ok(bin_header) = parse_bin_header(&file_data[result.offset..]) {
+            result.description = format!(
+                "{}, board ID: {}, hardware revision: {}, firmware version: {}.{}",
+                result.description,
+                bin_header.board_id,
+                bin_header.hardware_revision,
+                bin_header.firmware_version_major,
+                bin_header.firmware_version_minor,
+            );
+            return Ok(result);
+        }
+    }
+
+    Err(SignatureError)
+}

src/structures.rs

@@ -97,6 +97,7 @@
 //! ```
 
 pub mod androidsparse;
+pub mod binhdr;
 pub mod cab;
 pub mod chk;
 pub mod common;

src/structures/binhdr.rs

@@ -0,0 +1,60 @@
+use crate::common::get_cstring;
+use crate::structures::common::{self, StructureError};
+use std::collections::HashMap;
+
+/// Struct to store BIN header info
+pub struct BINHeader {
+    pub board_id: String,
+    pub hardware_revision: String,
+    pub firmware_version_major: usize,
+    pub firmware_version_minor: usize,
+}
+
+/// Parses a BIN header
+pub fn parse_bin_header(bin_hdr_data: &[u8]) -> Result<BINHeader, StructureError> {
+    // The data strcuture is preceeded by a 4-byte board ID string
+    const STRUCTURE_OFFSET: usize = 4;
+
+    let bin_hdr_structure = vec![
+        ("reserved1", "u32"),
+        ("build_date", "u32"),
+        ("firmware_version_major", "u8"),
+        ("firmware_version_minor", "u8"),
+        ("magic", "u32"),
+        ("hardware_id", "u8"),
+        ("reserved2", "u24"),
+        ("reserved3", "u64"),
+    ];
+
+    let known_hardware_ids: HashMap<usize, &str> =
+        HashMap::from([(0, "4702"), (1, "4712"), (2, "4712L"), (3, "4704")]);
+
+    // Parse the header
+    if let Some(structure_data) = bin_hdr_data.get(STRUCTURE_OFFSET..) {
+        if let Ok(header) = common::parse(structure_data, &bin_hdr_structure, "little") {
+            // Make sure the reserved fields are NULL
+            if header["reserved1"] == 0 && header["reserved2"] == 0 && header["reserved3"] == 0 {
+                // Make sure the reported hardware ID is valid
+                if known_hardware_ids.contains_key(&header["hardware_id"]) {
+                    // Get the board ID string, which immediately preceeds the data structure
+                    if let Some(board_id_bytes) = bin_hdr_data.get(0..STRUCTURE_OFFSET) {
+                        let board_id = get_cstring(board_id_bytes);
+
+                        // The board ID string should be 4 bytes in length
+                        if board_id.len() == STRUCTURE_OFFSET {
+                            return Ok(BINHeader {
+                                board_id,
+                                hardware_revision: known_hardware_ids[&header["hardware_id"]]
+                                    .to_string(),
+                                firmware_version_major: header["firmware_version_major"],
+                                firmware_version_minor: header["firmware_version_minor"],
+                            });
+                        }
+                    }
+                }
+            }
+        }
+    }
+
+    Err(StructureError)
+}