1use core::mem;
4
5use crate::endian::{LittleEndian as LE, U32};
6use crate::pe;
7use crate::pod::bytes_of_slice;
8use crate::read::{Bytes, ReadRef};
9
10#[derive(Debug, Clone, Copy)]
12pub struct RichHeaderInfo<'data> {
13 pub offset: usize,
15 pub length: usize,
20 pub xor_key: u32,
25 masked_entries: &'data [pe::MaskedRichHeaderEntry],
26}
27
28#[derive(Debug, Clone, Copy)]
32#[repr(C)]
33pub struct RichHeaderEntry {
34 pub comp_id: u32,
36 pub count: u32,
38}
39
40impl<'data> RichHeaderInfo<'data> {
41 pub fn parse<R: ReadRef<'data>>(data: R, nt_header_offset: u64) -> Option<Self> {
43 let data = data.read_bytes_at(0, nt_header_offset).map(Bytes).ok()?;
46 let end_marker_offset = memmem(data.0, b"Rich", 4)?;
47 let xor_key = *data.read_at::<U32<LE>>(end_marker_offset + 4).ok()?;
48
49 let masked_start_marker = U32::new(LE, 0x536e_6144 ^ xor_key.get(LE));
51 let start_header = [masked_start_marker, xor_key, xor_key, xor_key];
52 let start_sequence = bytes_of_slice(&start_header);
53 let start_marker_offset = memmem(&data.0[..end_marker_offset], start_sequence, 4)?;
54
55 let items_offset = start_marker_offset + start_sequence.len();
57 let items_len = end_marker_offset - items_offset;
58 let item_count = items_len / mem::size_of::<pe::MaskedRichHeaderEntry>();
59 let items = data.read_slice_at(items_offset, item_count).ok()?;
60 Some(RichHeaderInfo {
61 offset: start_marker_offset,
62 length: end_marker_offset - start_marker_offset + 8,
64 xor_key: xor_key.get(LE),
65 masked_entries: items,
66 })
67 }
68
69 pub fn unmasked_entries(&self) -> impl Iterator<Item = RichHeaderEntry> + 'data {
71 let xor_key = self.xor_key;
72 self.masked_entries
73 .iter()
74 .map(move |entry| RichHeaderEntry {
75 comp_id: entry.masked_comp_id.get(LE) ^ xor_key,
76 count: entry.masked_count.get(LE) ^ xor_key,
77 })
78 }
79}
80
81fn memmem(data: &[u8], needle: &[u8], align: usize) -> Option<usize> {
85 let mut offset = 0;
86 loop {
87 if data.get(offset..)?.get(..needle.len())? == needle {
88 return Some(offset);
89 }
90 offset += align;
91 }
92}