Merge pull request #1889 in SNORT/snort3 from ~SHRARANG/snort3:file_magic to master

Squashed commit of the following:

commit 0deef444b0544a25550c7e7191ff51df06876d38
Author: Shravan Rangaraju <shrarang@cisco.com>
Date:   Tue Dec 10 12:41:18 2019 -0500

    file_magic: add file magic for .jar, .rar, .alz, .egg, .hwp and .swf files

diff --git a/lua/file_magic.lua b/lua/file_magic.lua
index 8c93cff5e8680f33b46b2bc406e93b04226bf71a..e4725bc047b595eefd24ab6c621e74648d3d182f 100644 (file)
--- a/lua/file_magic.lua
+++ b/lua/file_magic.lua
@@ -159,22 +159,14 @@ file_magic =
     { type = 'DMP', id = 279, category = 'System files', msg = 'Windows crash dump file', rev = 1, magic = { { content = '|4D 44 4D 50 93 A7|', offset = 0, }, }, },
     { type = 'DMP', id = 280, category = 'System files', msg = 'Windows crash dump file', rev = 1, magic = { { content = '|50 41 47 45 44 55 36 34|', offset = 0, }, }, },
     { type = 'DMP', id = 281, category = 'System files', msg = 'Windows crash dump file', rev = 1, magic = { { content = '|50 41 47 45 44 55 4D 50|', offset = 0, }, }, },
-    { type = 'PDF', id = 282, category = 'PDF files,Dynamic Analysis Capable,Local Malware Analysis Capable', msg = 'PDF file ', rev = 1, version = '1.0', magic = { { content = '| 25 50 44 46 2D 31 2E 30|', offset = 0, }, }, 
-},
-    { type = 'PDF', id = 283, category = 'PDF files,Dynamic Analysis Capable,Local Malware Analysis Capable', msg = 'PDF file ', rev = 1, version = '1.1', magic = { { content = '| 25 50 44 46 2D 31 2E 31|', offset = 0, }, }, 
-},
-    { type = 'PDF', id = 284, category = 'PDF files,Dynamic Analysis Capable,Local Malware Analysis Capable', msg = 'PDF file ', rev = 1, version = '1.2', magic = { { content = '| 25 50 44 46 2D 31 2E 32|', offset = 0, }, }, 
-},
-    { type = 'PDF', id = 285, category = 'PDF files,Dynamic Analysis Capable,Local Malware Analysis Capable', msg = 'PDF file ', rev = 1, version = '1.3', magic = { { content = '| 25 50 44 46 2D 31 2E 33|', offset = 0, }, }, 
-},
-    { type = 'PDF', id = 286, category = 'PDF files,Dynamic Analysis Capable,Local Malware Analysis Capable', msg = 'PDF file ', rev = 1, version = '1.4', magic = { { content = '| 25 50 44 46 2D 31 2E 34|', offset = 0, }, }, 
-},
-    { type = 'PDF', id = 287, category = 'PDF files,Dynamic Analysis Capable,Local Malware Analysis Capable', msg = 'PDF file ', rev = 1, version = '1.5', magic = { { content = '| 25 50 44 46 2D 31 2E 35|', offset = 0, }, }, 
-},
-    { type = 'PDF', id = 288, category = 'PDF files,Dynamic Analysis Capable,Local Malware Analysis Capable', msg = 'PDF file ', rev = 1, version = '1.6', magic = { { content = '| 25 50 44 46 2D 31 2E 36|', offset = 0, }, }, 
-},
-    { type = 'PDF', id = 289, category = 'PDF files,Dynamic Analysis Capable,Local Malware Analysis Capable', msg = 'PDF file ', rev = 1, version = '1.7', magic = { { content = '| 25 50 44 46 2D 31 2E 37|', offset = 0, }, }, 
-},
+    { type = 'PDF', id = 282, category = 'PDF files,Dynamic Analysis Capable,Local Malware Analysis Capable', msg = 'PDF file ', rev = 1, version = '1.0', magic = { { content = '| 25 50 44 46 2D 31 2E 30|', offset = 0, }, }, },
+    { type = 'PDF', id = 283, category = 'PDF files,Dynamic Analysis Capable,Local Malware Analysis Capable', msg = 'PDF file ', rev = 1, version = '1.1', magic = { { content = '| 25 50 44 46 2D 31 2E 31|', offset = 0, }, }, },
+    { type = 'PDF', id = 284, category = 'PDF files,Dynamic Analysis Capable,Local Malware Analysis Capable', msg = 'PDF file ', rev = 1, version = '1.2', magic = { { content = '| 25 50 44 46 2D 31 2E 32|', offset = 0, }, }, },
+    { type = 'PDF', id = 285, category = 'PDF files,Dynamic Analysis Capable,Local Malware Analysis Capable', msg = 'PDF file ', rev = 1, version = '1.3', magic = { { content = '| 25 50 44 46 2D 31 2E 33|', offset = 0, }, }, },
+    { type = 'PDF', id = 286, category = 'PDF files,Dynamic Analysis Capable,Local Malware Analysis Capable', msg = 'PDF file ', rev = 1, version = '1.4', magic = { { content = '| 25 50 44 46 2D 31 2E 34|', offset = 0, }, }, },
+    { type = 'PDF', id = 287, category = 'PDF files,Dynamic Analysis Capable,Local Malware Analysis Capable', msg = 'PDF file ', rev = 1, version = '1.5', magic = { { content = '| 25 50 44 46 2D 31 2E 35|', offset = 0, }, }, },
+    { type = 'PDF', id = 288, category = 'PDF files,Dynamic Analysis Capable,Local Malware Analysis Capable', msg = 'PDF file ', rev = 1, version = '1.6', magic = { { content = '| 25 50 44 46 2D 31 2E 36|', offset = 0, }, }, },
+    { type = 'PDF', id = 289, category = 'PDF files,Dynamic Analysis Capable,Local Malware Analysis Capable', msg = 'PDF file ', rev = 1, version = '1.7', magic = { { content = '| 25 50 44 46 2D 31 2E 37|', offset = 0, }, }, },
     { type = 'IntelHEX', id = 290, category = 'System files', msg = 'Binary files for Microcontroller/Other Chip based applications', rev = 1, magic = { { content = '| 3A 31 |', offset = 0, }, { content = '| 30 30 |', offset = 7, }, }, },
     { type = 'IntelHEX', id = 291, category = 'System files', msg = 'Binary files for Microcontroller/Other Chip based applications', rev = 1, magic = { { content = '| 3A 31 |', offset = 0, }, { content = '| 30 31 |', offset = 7, }, }, },
     { type = 'IntelHEX', id = 292, category = 'System files', msg = 'Binary files for Microcontroller/Other Chip based applications', rev = 1, magic = { { content = '| 3A 31 |', offset = 0, }, { content = '| 30 32 |', offset = 7, }, }, },
@@ -192,11 +184,17 @@ file_magic =
     { type = 'IntelHEX', id = 306, category = 'System files', msg = 'Binary files for Microcontroller/Other Chip based applications', rev = 1, magic = { { content = '| 3A 32 |', offset = 0, }, { content = '| 32 32 |', offset = 7, }, }, },
     { type = 'REG', id = 307, category = 'System files', msg = 'Windows Registry and Registry Undo files (REG)', rev = 1, magic = { { content = '| FF FE |', offset = 0, }, }, },
     { type = 'MSHTML', id = 308, category = 'Office Documents', msg = 'Proprietary layout engine for Microsoft Internet Explorer', rev = 1, magic = { { content = '| 3D 22 2D 2D 2D 2D 3D 5F |', offset = 60, }, }, },
-    { type = 'VB', id = 310, category = 'System files', msg = 'Microsoft Visual Basic files, including .cs, .vb, and .vbp', rev = 1, magic = { { content = '| EF BB BF |', offset = 0, }, }, },
     { type = 'VB', id = 311, category = 'System files', msg = 'Microsoft Visual Basic files, including .cs, .vb, and .vbp', rev = 1, magic = { { content = '| 54 79 70 65 3D 45 78 65 |', offset = 0, }, }, },
     { type = 'MP4', id = 313, category = 'Multimedia', msg = 'MPEG-4 video files', rev = 1, magic = { { content = '| 66 74 79 70 64 61 73 68 |', offset = 4, }, }, },
     { type = 'LNK', id = 314, category = 'Executables', msg = 'Microsoft Windows Shortcut Files', rev = 1, magic = { { content = '| 4C 00 00 00 01 14 02 00 |', offset = 0, }, }, },
     { type = 'SCR', id = 315, category = 'Executables', msg = 'Microsoft Windows Shortcut Files', rev = 1, magic = { { content = '| 44 43 4E 01 |', offset = 0, }, }, },
     { type = 'SCR', id = 316, category = 'Executables', msg = 'Microsoft Windows Shortcut Files', rev = 1, magic = { { content = '| 44 43 44 01 |', offset = 0, }, }, },
-    { type = 'MKV', id = 317, category = 'Multimedia', msg = 'Matroska stream file', rev = 1, magic = { { content = '| 1A 45 DF A3 01 00 00 00 00 00 00 23 42 86 81 01|', offset = 0, }, }, },
+    { type = 'MKV', id = 317, category = 'Multimedia', msg = 'Matroska stream file', rev = 1, magic = { { content = '| 1A 45 DF A3 01 00 00 00 00 00 00 23 42 86 81 01 |', offset = 0, }, }, },
+    { type = 'JAR', id = 318, category = 'Archive', msg = 'Java archive file', rev = 1, magic = { { content = '| 50 4B 03 04 |', offset = 0, }, { content = '| 63 6F 6E 74 65 6E 74 2F |', offset = 30, }, }, },
+    { type = 'JAR', id = 319, category = 'Archive', msg = 'Java archive file', rev = 1, magic = { { content = '| 50 4B 03 04 |', offset = 0, }, { content = '| 6F 70 74 69 6F 6E 73 2F |', offset = 30, }, }, },
+    { type = 'RAR', id = 320, category = 'Archive', msg = 'WinRAR compressed archive file', rev = 1, version = '1.1', magic = { { content = '| 52 61 72 21 1A 07 01 00 |', offset = 0, }, }, },
+    { type = 'ALZ', id = 321, category = 'Archive', msg = 'Archive file for Microsoft created using software ALZip', rev = 1, magic = { { content = '| 41 4C 5A 01 |', offset = 0, }, }, },
+    { type = 'EGG', id = 322, category = 'Archive', msg = 'Archive File for Microsoft created using software ALZip', rev = 1, magic = { { content = '| 45 47 47 41 |', offset = 0, }, }, },
+    { type = 'HWP', id = 323, category = 'Executables', msg = 'Hangul word processor file', rev = 1, version = '3.0', magic = { { content = '| 48 57 50 20 44 6F 63 75 6D 65 6E 74 20 46 69 6C 65 |', offset = 0, }, }, },
+    { type = 'SWF', id = 324, category = 'Multimedia', msg = 'Flash file', rev = 1, magic = { { content = '| 5A 57 53 |', offset = 0}, }, },
 }