From aa95f2cbb567ef1025647333c9241fbe1b738052 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Stucke?= <joerg.stucke@fkie.fraunhofer.de>
Date: Thu, 15 Aug 2024 15:06:21 +0200
Subject: [PATCH] added bneg unpacker

---
 .../plugins/unpacking/bneg/__init__.py        |   0
 .../plugins/unpacking/bneg/code/__init__.py   |   0
 .../plugins/unpacking/bneg/code/bneg.py       |  39 ++++++++++++++++++
 .../plugins/unpacking/bneg/test/__init__.py   |   0
 .../unpacking/bneg/test/data/test.bneg        | Bin 0 -> 35 bytes
 .../plugins/unpacking/bneg/test/test_bneg.py  |  27 ++++++++++++
 6 files changed, 66 insertions(+)
 create mode 100644 fact_extractor/plugins/unpacking/bneg/__init__.py
 create mode 100644 fact_extractor/plugins/unpacking/bneg/code/__init__.py
 create mode 100644 fact_extractor/plugins/unpacking/bneg/code/bneg.py
 create mode 100644 fact_extractor/plugins/unpacking/bneg/test/__init__.py
 create mode 100644 fact_extractor/plugins/unpacking/bneg/test/data/test.bneg
 create mode 100644 fact_extractor/plugins/unpacking/bneg/test/test_bneg.py

diff --git a/fact_extractor/plugins/unpacking/bneg/__init__.py b/fact_extractor/plugins/unpacking/bneg/__init__.py
new file mode 100644
index 00000000..e69de29b
diff --git a/fact_extractor/plugins/unpacking/bneg/code/__init__.py b/fact_extractor/plugins/unpacking/bneg/code/__init__.py
new file mode 100644
index 00000000..e69de29b
diff --git a/fact_extractor/plugins/unpacking/bneg/code/bneg.py b/fact_extractor/plugins/unpacking/bneg/code/bneg.py
new file mode 100644
index 00000000..2e4ca351
--- /dev/null
+++ b/fact_extractor/plugins/unpacking/bneg/code/bneg.py
@@ -0,0 +1,39 @@
+import struct
+from pathlib import Path
+
+NAME = 'Instar BNEG'
+MIME_PATTERNS = ['firmware/bneg']
+VERSION = '0.1.0'
+
+
+class BnegHeader:
+    def __init__(self, data: bytes):
+        (
+            self.magic,
+            self.major_version,
+            self.minor_version,
+            *self.partitions,
+        ) = struct.unpack('<4sIIII', data)
+
+    def to_dict(self):
+        return self.__dict__
+
+
+def unpack_function(file_path: str, tmp_dir: str) -> dict:
+    input_file = Path(file_path)
+    output_dir = Path(tmp_dir)
+    with input_file.open('rb') as fp:
+        header = BnegHeader(fp.read(20))
+        output = [f'Found BNEG v{header.major_version}.{header.minor_version}']
+        for index, partition in enumerate(header.partitions, start=1):
+            if partition:
+                (output_dir / f'partition_{index}.bin').write_bytes(fp.read(partition))
+                output.append(f'Unpacked partition {index} to partition_{index}.bin (size {partition})')
+
+    return {'output': '\n'.join(output)}
+
+
+# ----> Do not edit below this line <----
+def setup(unpack_tool):
+    for item in MIME_PATTERNS:
+        unpack_tool.register_plugin(item, (unpack_function, NAME, VERSION))
diff --git a/fact_extractor/plugins/unpacking/bneg/test/__init__.py b/fact_extractor/plugins/unpacking/bneg/test/__init__.py
new file mode 100644
index 00000000..e69de29b
diff --git a/fact_extractor/plugins/unpacking/bneg/test/data/test.bneg b/fact_extractor/plugins/unpacking/bneg/test/data/test.bneg
new file mode 100644
index 0000000000000000000000000000000000000000..5907bcb11b9e903c97fbc9a088cac55ef99b4573
GIT binary patch
literal 35
lcmZ?rb9HBAU|?VZVs;?r0OGX#{G`Mpu9DQ^5<??nE&x+I1`+@O

literal 0
HcmV?d00001

diff --git a/fact_extractor/plugins/unpacking/bneg/test/test_bneg.py b/fact_extractor/plugins/unpacking/bneg/test/test_bneg.py
new file mode 100644
index 00000000..8ba83ec1
--- /dev/null
+++ b/fact_extractor/plugins/unpacking/bneg/test/test_bneg.py
@@ -0,0 +1,27 @@
+from pathlib import Path
+
+from test.unit.unpacker.test_unpacker import TestUnpackerBase
+
+TEST_DATA_DIR = Path(__file__).parent / 'data'
+
+
+class TestInstarBnegUnpacker(TestUnpackerBase):
+
+    def test_unpacker_selection_generic(self):
+        self.check_unpacker_selection('firmware/bneg', 'Instar BNEG')
+
+    def test_extraction_bneg(self):
+        in_file = TEST_DATA_DIR / 'test.bneg'
+        assert in_file.is_file(), 'test file is missing'
+        files, meta = self.unpacker.extract_files_from_file(str(in_file), self.tmp_dir.name)
+        assert len(files) == 2  # noqa: PLR2004
+        assert 'output' in meta
+        assert 'size 7' in meta['output']
+        assert 'size 8' in meta['output']
+
+        file1 = Path(self.tmp_dir.name) / 'partition_1.bin'
+        assert file1.is_file()
+        assert file1.read_bytes() == b'foobar\n'
+        file2 = Path(self.tmp_dir.name) / 'partition_2.bin'
+        assert file2.is_file()
+        assert file2.read_bytes() == b'test123\n'