additional item_type

mandiant · Aug 25, 2024 · 886b211 · 886b211
1 parent 2ab72e2
commit 886b211
Show file tree

Hide file tree

Showing 3 changed files with 10 additions and 10 deletions.
diff --git a/Cargo.toml b/Cargo.toml
@@ -7,8 +7,8 @@ edition = "2021"
 
 [dependencies]
 nom = "7.1.3"
-serde_json = "1.0.122"
-serde = { version = "1.0.205", features = ["derive"] }
+serde_json = "1.0.127"
+serde = { version = "1.0.209", features = ["derive"] }
 log = "0.4.22"
 lz4_flex = "0.11.3"
 byteorder = "1.5.0"

diff --git a/src/chunks/firehose/firehose_log.rs b/src/chunks/firehose/firehose_log.rs
@@ -332,8 +332,8 @@ impl FirehosePreamble {
             }
         }
 
-        // 0x81 Added in macOS Sequioa
-        let private_strings: Vec<u8> = vec![0x21, 0x25, 0x35, 0x31, 0x41, 0x81];
+        // 0x81 and 0xf1 Added in macOS Sequioa
+        let private_strings: Vec<u8> = vec![0x21, 0x25, 0x35, 0x31, 0x41, 0x81, 0xf1];
         let private_number = 0x1;
         // Now at the end of firehose item types.
         // Remaining data (if any) contains strings for the string item types
@@ -404,7 +404,7 @@ impl FirehosePreamble {
         data: &'a [u8],
         firehose_item_data: &mut FirehoseItemData,
     ) -> nom::IResult<&'a [u8], ()> {
-        let private_strings: Vec<u8> = vec![0x21, 0x25, 0x41, 0x35, 0x31, 0x81];
+        let private_strings: Vec<u8> = vec![0x21, 0x25, 0x41, 0x35, 0x31, 0x81, 0xf1];
         let private_number = 0x1;
 
         let mut private_string_start = data;
@@ -738,7 +738,7 @@ impl FirehosePreamble {
 
         // Firehose string item values
         let string_item: Vec<u8> = vec![
-            0x20, 0x21, 0x22, 0x25, 0x40, 0x41, 0x42, 0x30, 0x31, 0x32, 0xf2, 0x35, 0x81,
+            0x20, 0x21, 0x22, 0x25, 0x40, 0x41, 0x42, 0x30, 0x31, 0x32, 0xf2, 0x35, 0x81, 0xf1,
         ];
         let private_number = 0x1;
         // String and private number items metadata is 4 bytes

diff --git a/src/parser.rs b/src/parser.rs
@@ -411,10 +411,10 @@ mod tests {
     #[test]
     fn test_collect_shared_strings_system() {
         let shared_strings_results = collect_shared_strings_system().unwrap();
-        assert!(shared_strings_results[0].ranges.len() > 1000);
-        assert!(shared_strings_results[0].uuids.len() > 1000);
-        assert!(shared_strings_results[0].number_ranges > 1000);
-        assert!(shared_strings_results[0].number_uuids > 1000);
+        assert!(shared_strings_results[0].ranges.len() > 1);
+        assert!(shared_strings_results[0].uuids.len() > 1);
+        assert!(shared_strings_results[0].number_ranges > 1);
+        assert!(shared_strings_results[0].number_uuids > 1);
     }
 
     #[test]