//
// binsieve.c
//
// Copyright 2007, Anthony Dunk
//
// This program is a file reverse engineering tool whose purpose is to
// automatically detect values in the header section of a file, and to
// report values which fall within the chosen range of acceptible values.
// This is a quick first step to understanding a new file format. Further
// work to analyse the format should then be undertaken using a tool
// such as HexToolkit (http://adunk.ozehosting.com/software/HexView.html)
//
// HISTORY:
// 30 July 2007 - Initial version, Anthony Dunk.
//

#include <stdio.h>
#include <float.h>


void Swap4(void *p)
{
    unsigned char *data = (unsigned char *)p;
    unsigned char tmp = data[0];
    data[0] = data[3];
    data[3] = tmp;
    tmp = data[1];
    data[1] = data[2];
    data[2] = tmp;
}

void Swap8(void *p)
{
    unsigned char *data = (unsigned char *)p;
    unsigned char tmp = data[0];
    data[0] = data[7];
    data[7] = tmp;
    tmp = data[1];
    data[1] = data[6];
    data[6] = tmp;
    tmp = data[2];
    data[2] = data[5];
    data[5] = tmp;
    tmp = data[3];
    data[3] = data[4];
    data[4] = tmp;
}

int main (int argc, char *argv[])
{
   FILE *fin;
   int i;
   unsigned char *buf;
   char *string;
   char *pFilename;
   int nArg = 1;
   int SEARCH_NUMBER_ALIGN    = 1;
   int SEARCH_NUMBER_SWAP     = 0;
   int BLOCKSIZE              = 1024;
   int SEARCH_MIN_NUMBER      = -10000000;
   int SEARCH_MAX_NUMBER      =  10000000;
   double SEARCH_SMALL_FLOAT  =  0.00000001;
   int SEARCH_MIN_STRING_LEN  =  3;
   int DO_INT = 0;
   int DO_FLOAT = 0;
   int DO_DOUBLE = 0;
   int DO_STRING = 0;

   if (argc<2)
   {
       printf("This program searchs for numbers and strings in a binary file.\n\n");
       printf("USAGE: binsieve [-all] [-int] [-float] [-double] [-string]\n"
              "                [-swap] [-align n] [-length m] [-min a] [-max b]\n"
              "                [-smallfloat s] [-minstrlen c] <inputfile>\n\n");
       printf("-int        Search for 4-byte integer values\n");
       printf("-float      Search for 4-byte float values\n");
       printf("-double     Search for 8-byte double values\n");
       printf("-string     Search for strings\n");
       printf("-all        All of the above (Default)\n");
       printf("-swap       Byte-swap numeric values\n");
       printf("-align      Only look for numeric values on n-byte boundaries (default=1)\n");
       printf("-length     Look at first m bytes of file only (default=1024)\n");
       printf("-min        Only report numeric values greater than this value (Default=-10^7)\n");
       printf("-max        Only report numeric values less than this value (Default = 10^7)\n");
       printf("-smallfloat Don't report float/double values smaller than +/- s (Default=10^-8)\n");
       printf("-minstrlen  Don't report strings less than c characters long (Default=3)\n");
       return 1;
   }

   while (nArg<argc)
   {
      if (strcmp(argv[nArg],"-swap")==0) SEARCH_NUMBER_SWAP=1;
      else if (strcmp(argv[nArg],"-align")==0)
      {
         nArg++;
         SEARCH_NUMBER_ALIGN = atoi(argv[nArg]);
      }
      else if (strcmp(argv[nArg],"-length")==0)
      {
         nArg++;
         BLOCKSIZE = atoi(argv[nArg]);
      }
      else if (strcmp(argv[nArg],"-min")==0)
      {
         nArg++;
         SEARCH_MIN_NUMBER = atoi(argv[nArg]);
      }
      else if (strcmp(argv[nArg],"-max")==0)
      {
         nArg++;
         SEARCH_MAX_NUMBER = atoi(argv[nArg]);
      }
      else if (strcmp(argv[nArg],"-minstrlen")==0)
      {
         nArg++;
         SEARCH_MIN_STRING_LEN = atoi(argv[nArg]);
      }
      else if (strcmp(argv[nArg],"-smallfloat")==0)
      {
         nArg++;
         SEARCH_SMALL_FLOAT = atof(argv[nArg]);
      }
      else if (strcmp(argv[nArg],"-all")==0)
      {
         DO_INT = 1;
         DO_FLOAT = 1;
         DO_DOUBLE = 1;
         DO_STRING = 1;
      }
      else if (strcmp(argv[nArg],"-int")==0)
      {
         DO_INT = 1;
      }
      else if (strcmp(argv[nArg],"-float")==0)
      {
         DO_FLOAT = 1;
      }
      else if (strcmp(argv[nArg],"-double")==0)
      {
         DO_DOUBLE = 1;
      }
      else if (strcmp(argv[nArg],"-string")==0)
      {
         DO_STRING = 1;
      }
      else pFilename = argv[nArg];
      nArg++;
   }

   if (DO_INT==0 && DO_FLOAT==0 && DO_DOUBLE==0 && DO_STRING==0)
   {
      DO_INT=1; DO_FLOAT=1; DO_DOUBLE=1; DO_STRING=1;
   }


   // Allocate buffers
   buf = (unsigned char *)malloc(BLOCKSIZE);
   string = (char *)malloc(BLOCKSIZE);
   if (buf==NULL || string==NULL)
   {
      printf("Could not allocate buffers!\n\n");
      return 1;
   }

   fin = fopen(pFilename,"rb");
   if (fin==NULL)
   {
     printf("Could not open %s!\n\n",pFilename);
     return 1;
   }
   BLOCKSIZE = fread(buf,1,BLOCKSIZE,fin);
   fclose(fin);

   if (BLOCKSIZE==0)
   {
      printf("No data read!\n\n");
      return 1;
   }

   printf("\nProcessing %s:\n",pFilename);


 if (DO_INT)
 {
   // Search for valid ints
   printf("\nINT (4 bytes):\n");
   for (i=0; i<BLOCKSIZE-sizeof(int); i+=SEARCH_NUMBER_ALIGN)
   {
       int val;
       memcpy(&val,buf+i,sizeof(int));
       if (SEARCH_NUMBER_SWAP)
       {
          Swap4(&val);
       }
       if (val!=0 && val>SEARCH_MIN_NUMBER && val<SEARCH_MAX_NUMBER)
       {
           printf("%04x: %d\n",i,val);
       }
   }
  }

  if (DO_FLOAT)
  {
   // Search for valid floats
   printf("\nFLOAT (4 bytes):\n");
   for (i=0; i<BLOCKSIZE-sizeof(float); i+=SEARCH_NUMBER_ALIGN)
   {
       float val;
       memcpy(&val,buf+i,4);
       if (SEARCH_NUMBER_SWAP)
       {
          Swap4(&val);
       }
       if ((val>SEARCH_SMALL_FLOAT || val<-SEARCH_SMALL_FLOAT) &&
           val>(float)SEARCH_MIN_NUMBER && val<(float)SEARCH_MAX_NUMBER)
       {
           printf("%04x: %f\n",i,val);
       }
   }
  }

  if (DO_DOUBLE)
  {
   // Search for valid doubles
   printf("\nDOUBLE (8 bytes):\n");
   for (i=0; i<BLOCKSIZE-sizeof(double); i+=SEARCH_NUMBER_ALIGN)
   {
       double val;
       memcpy(&val,buf+i,sizeof(double));
       if (SEARCH_NUMBER_SWAP)
       {
          Swap8(&val);
       }
       if ((val>SEARCH_SMALL_FLOAT || val<-SEARCH_SMALL_FLOAT) &&
           val>(double)SEARCH_MIN_NUMBER && val<(double)SEARCH_MAX_NUMBER)
       {
           printf("%04x: %f\n",i,val);
       }
   }
  }

  if (DO_STRING)
  {
   // Search for strings
   printf("\nSTRINGS:\n");
   {
    int nStringStart = -1;
    int nStringSize = 0;
    for (i=0; i<BLOCKSIZE-1; i++)
    {
      char c=buf[i];
      if (c>=0x20 && c<0x7f)
      {
         if (nStringStart==-1) nStringStart=i;
         string[nStringSize++]=c;
      }
      else
      {
         if (nStringSize>=SEARCH_MIN_STRING_LEN)
         {
            string[nStringSize]=0;
            printf("%04x: %s\n",nStringStart,string);
         }
         nStringStart=-1;
         nStringSize = 0;
      }
    }
   }
  }

  free(buf);
  free(string);
  return 0;
}