tcpflow  1.6.1
About: tcpflow is a TCP/IP packet demultiplexer that captures data transmitted as part of TCP connections (flows), and stores the data in a way that is convenient for protocol analysis and debugging.
  Fossies Dox: tcpflow-1.6.1.tar.gz  ("unofficial" and yet experimental doxygen-generated source code documentation)  

Bulk_extractor_APIs

Files

file  sbuf.h
 
file  sbuf_stream.h
 
file  unicode_escape.h
 

Classes

struct  histogram_def
 
class  feature_recorder
 
class  pos0_t
 
class  managed_malloc< TYPE >
 
class  sbuf_t
 
class  sbuf_t::range_exception_t
 
class  sbuf_stream
 

Macros

#define BEAPI_SQLITE3   void
 
#define BEAPI_SQLITE3_STMT   void
 

Typedefs

typedef std::set< histogram_defhistogram_defs_t
 
typedef atomic_set< std::string > carve_cache_t
 
typedef atomic_histogram< std::string, uint64_t > mhistogram_t
 
typedef std::map< histogram_def, mhistogram_t * > mhistograms_t
 

Enumerations

enum  sbuf_t::byte_order_t { sbuf_t::BO_LITTLE_ENDIAN =0 , sbuf_t::BO_BIG_ENDIAN =1 }
 

Functions

bool operator< (const histogram_def &h1, const histogram_def &h2)
 
bool operator!= (const histogram_def &h1, const histogram_def &h2)
 
int64_t stoi64 (std::string str)
 
 pos0_t::pos0_t ()
 
 pos0_t::pos0_t (std::string s)
 
 pos0_t::pos0_t (std::string s, uint64_t o)
 
 pos0_t::pos0_t (const pos0_t &obj)
 
std::string pos0_t::str () const
 
bool pos0_t::isRecursive () const
 
std::string pos0_t::firstPart () const
 
std::string pos0_t::lastAddedPart () const
 
std::string pos0_t::alphaPart () const
 
uint64_t pos0_t::imageOffset () const
 
pos0_t pos0_t::shift (int64_t s) const
 
std::ostream & operator<< (std::ostream &os, const class pos0_t &pos0)
 
class pos0_t operator+ (pos0_t pos, const std::string &subdir)
 
class pos0_t operator+ (pos0_t pos, int64_t delta)
 
managed_mallocmanaged_malloc< TYPE >::operator= (const managed_malloc &)
 
 managed_malloc< TYPE >::managed_malloc (const managed_malloc &)
 
 managed_malloc< TYPE >::managed_malloc ()
 
 managed_malloc< TYPE >::managed_malloc (size_t bytes)
 
 managed_malloc< TYPE >::~managed_malloc ()
 
static size_t sbuf_t::min (size_t a, size_t b)
 
void sbuf_t::release ()
 
sbuf_tsbuf_t::operator= (const sbuf_t &that)
 
 sbuf_t::sbuf_t ()
 
 sbuf_t::sbuf_t (const sbuf_t &that)
 
 sbuf_t::sbuf_t (const pos0_t &that_pos0, const sbuf_t &that_sbuf)
 
 sbuf_t::sbuf_t (const sbuf_t &that_sbuf, size_t off)
 
 sbuf_t::sbuf_t (const sbuf_t &sbuf, size_t off, size_t len)
 
 sbuf_t::sbuf_t (const pos0_t &pos0_, const uint8_t *buf_, size_t bufsize_, size_t pagesize_, int fd_, bool should_unmap_, bool should_free_, bool should_close_)
 
 sbuf_t::sbuf_t (const pos0_t &pos0_, const uint8_t *buf_, size_t bufsize_, size_t pagesize_, bool should_free_)
 
sbuf_t sbuf_t::operator+ (size_t off) const
 
virtual sbuf_t::~sbuf_t ()
 
static sbuf_tsbuf_t::map_file (const std::string &fname)
 
static sbuf_tsbuf_t::map_file (const std::string &fname, int fd)
 
static void sbuf_t::set_map_file_delimiter (const std::string &new_delim)
 
size_t sbuf_t::size () const
 
size_t sbuf_t::left (size_t n) const
 
const sbuf_tsbuf_t::highest_parent () const
 
void sbuf_t::add_child (const sbuf_t &child) const
 
void sbuf_t::del_child (const sbuf_t &child) const
 
size_t sbuf_t::offset (const uint8_t *loc) const
 
std::string sbuf_t::asString () const
 
virtual const char * sbuf_t::range_exception_t::what () const throw ()
 
int sbuf_t::memcmp (const uint8_t *cbuf, size_t at, size_t len) const
 
uint8_t sbuf_t::operator[] (size_t i) const
 
ssize_t sbuf_t::find (uint8_t ch, size_t start) const
 
ssize_t sbuf_t::find (const char *str, size_t start) const
 
std::string sbuf_t::substr (size_t loc, size_t len) const
 
bool sbuf_t::is_constant (size_t loc, size_t len, uint8_t ch) const
 
bool sbuf_t::is_constant (uint8_t ch) const
 
template<class TYPE >
const TYPE * sbuf_t::get_struct_ptr (uint32_t pos) const
 
void sbuf_t::raw_dump (std::ostream &os, uint64_t start, uint64_t len) const
 
void sbuf_t::raw_dump (int fd, uint64_t start, uint64_t len) const
 
void sbuf_t::hex_dump (std::ostream &os, uint64_t start, uint64_t len) const
 
void sbuf_t::hex_dump (std::ostream &os) const
 
ssize_t sbuf_t::write (int fd, size_t loc, size_t len) const
 
ssize_t sbuf_t::write (FILE *f, size_t loc, size_t len) const
 
std::ostream & operator<< (std::ostream &os, const sbuf_t &sbuf)
 
 sbuf_stream::sbuf_stream (const sbuf_t &sbuf_)
 
 sbuf_stream::~sbuf_stream ()
 
void sbuf_stream::seek (size_t offset)
 
size_t sbuf_stream::tell ()
 
std::string validateOrEscapeUTF8 (const std::string &input, bool escape_bad_UTF8, bool escape_backslash)
 
static void feature_recorder::MAINTHREAD ()
 

Variables

const std::string pos0_t::path
 
const uint64_t pos0_t::offset
 
TYPE * managed_malloc< TYPE >::buf
 
int sbuf_t::fd
 
bool sbuf_t::should_unmap
 
bool sbuf_t::should_free
 
bool sbuf_t::should_close
 
int sbuf_t::page_number
 
pos0_t sbuf_t::pos0
 
const sbuf_tsbuf_t::parent
 
int sbuf_t::children
 
const uint8_tsbuf_t::buf
 
size_t sbuf_t::bufsize
 
size_t sbuf_t::pagesize
 
static const std::string sbuf_t::U10001C
 
static std::string sbuf_t::map_file_delimiter
 
const sbuf_t sbuf_stream::sbuf
 
size_t sbuf_stream::offset
 
bool validateOrEscapeUTF8_validate
 

Comparision operations

bool operator< (const class pos0_t &pos0, const class pos0_t &pos1)
 
bool operator> (const class pos0_t &pos0, const class pos0_t &pos1)
 
bool operator== (const class pos0_t &pos0, const class pos0_t &pos1)
 

unsigned int Intel (littel-endian) readers

these get functions safely return an unsigned integer value for the offset of i, in Intel (little-endian) byte order or else throw sbuf_range_exception if out of range.

uint8_t sbuf_t::get8u (size_t i) const
 
uint16_t sbuf_t::get16u (size_t i) const
 
uint32_t sbuf_t::get32u (size_t i) const
 
uint64_t sbuf_t::get64u (size_t i) const
 

unsigned int Motorola (big-endian) readers

these get functions safely return an unsigned integer value for the offset of i, in Motorola (big-endian) byte order or else throw sbuf_range_exception if out of range.

uint8_t sbuf_t::get8uBE (size_t i) const
 
uint16_t sbuf_t::get16uBE (size_t i) const
 
uint32_t sbuf_t::get32uBE (size_t i) const
 
uint64_t sbuf_t::get64uBE (size_t i) const
 

signed int Intel (little-endian) readers

these get functions safely return a signed integer value for the offset of i, in Intel (little-endian) byte order or else throw sbuf_range_exception if out of range.

int8_t sbuf_t::get8i (size_t i) const
 
int16_t sbuf_t::get16i (size_t i) const
 
int32_t sbuf_t::get32i (size_t i) const
 
int64_t sbuf_t::get64i (size_t i) const
 

signed int Motorola (big-endian) readers

these get functions safely return a signed integer value for the offset of i, in Motorola (big-endian) byte order or else throw sbuf_range_exception if out of range.

int8_t sbuf_t::get8iBE (size_t i) const
 
int16_t sbuf_t::get16iBE (size_t i) const
 
int32_t sbuf_t::get32iBE (size_t i) const
 
int64_t sbuf_t::get64iBE (size_t i) const
 

unsigned int, byte-order specified readers

these get functions safely return an unsigned integer value for the offset of i, in the byte order of your choice or else throw sbuf_range_exception if out of range.

uint8_t sbuf_t::get8u (size_t i, byte_order_t bo) const
 
uint16_t sbuf_t::get16u (size_t i, byte_order_t bo) const
 
uint32_t sbuf_t::get32u (size_t i, byte_order_t bo) const
 
uint64_t sbuf_t::get64u (size_t i, byte_order_t bo) const
 

signed int, byte-order specified readers

these get functions safely return a signed integer value for the offset of i, in the byte order of your choice or else throw sbuf_range_exception if out of range.

int8_t sbuf_t::get8i (size_t i, byte_order_t bo) const
 
int16_t sbuf_t::get16i (size_t i, byte_order_t bo) const
 
int32_t sbuf_t::get32i (size_t i, byte_order_t bo) const
 
int64_t sbuf_t::get64i (size_t i, byte_order_t bo) const
 

string readers

These get functions safely read string

void sbuf_t::getUTF8 (size_t i, size_t num_octets_requested, std::string &utf8_string) const
 
void sbuf_t::getUTF8 (size_t i, std::string &utf8_string) const
 

wstring readers

These get functions safely read wstring

void sbuf_t::getUTF16 (size_t i, size_t num_code_units_requested, std::wstring &utf16_string) const
 
void sbuf_t::getUTF16 (size_t i, std::wstring &utf16_string) const
 
void sbuf_t::getUTF16 (size_t i, size_t num_code_units_requested, byte_order_t bo, std::wstring &utf16_string) const
 
void sbuf_t::getUTF16 (size_t i, byte_order_t bo, std::wstring &utf16_string) const
 

integer-based stream readers

uint8_t sbuf_stream::get8u ()
 
uint16_t sbuf_stream::get16u ()
 
uint32_t sbuf_stream::get32u ()
 
uint64_t sbuf_stream::get64u ()
 
uint8_t sbuf_stream::get8uBE ()
 
uint16_t sbuf_stream::get16uBE ()
 
uint32_t sbuf_stream::get32uBE ()
 
uint64_t sbuf_stream::get64uBE ()
 
uint8_t sbuf_stream::get8u (sbuf_t::byte_order_t bo)
 
uint16_t sbuf_stream::get16u (sbuf_t::byte_order_t bo)
 
uint32_t sbuf_stream::get32u (sbuf_t::byte_order_t bo)
 
uint64_t sbuf_stream::get64u (sbuf_t::byte_order_t bo)
 
int8_t sbuf_stream::get8i ()
 
int16_t sbuf_stream::get16i ()
 
int32_t sbuf_stream::get32i ()
 
int64_t sbuf_stream::get64i ()
 
int8_t sbuf_stream::get8iBE ()
 
int16_t sbuf_stream::get16iBE ()
 
int32_t sbuf_stream::get32iBE ()
 
int64_t sbuf_stream::get64iBE ()
 
int8_t sbuf_stream::get8i (sbuf_t::byte_order_t bo)
 
int16_t sbuf_stream::get16i (sbuf_t::byte_order_t bo)
 
int32_t sbuf_stream::get32i (sbuf_t::byte_order_t bo)
 
int64_t sbuf_stream::get64i (sbuf_t::byte_order_t bo)
 

string and wstring stream readers

void sbuf_stream::getUTF8 (string &utf8_string)
 
void sbuf_stream::getUTF8 (size_t num_octets_requested, string &utf8_string)
 
void sbuf_stream::getUTF16 (wstring &utf16_string)
 
void sbuf_stream::getUTF16 (size_t num_code_units_requested, wstring &utf16_string)
 

Detailed Description

pos0_t

Macro Definition Documentation

◆ BEAPI_SQLITE3

#define BEAPI_SQLITE3   void

feature_recorder.h:

System for recording features from the scanners into the feature files.

There is one feature_recorder per feature file. It is used both to record the features and to perform the histogram calculation. (That should probably be moved to a different class.) It also also previously had the ability to do a merge sort, but we took that out because it was not necessary.

The feature recorders can also check the global alert_list to see if the feature should be written to the alert file. It's opened on demand and immediately flushed and closed. A special mutex is used to protect it.

Finally, the feature recorder supports the global stop_list, which is a list of features that are not written to the main file but are written to a stop list. That is implemented with a second feature_recorder.

There is one feature_recorder_set per process. The file assumes that bulk_extractor.h is being included.

Definition at line 53 of file feature_recorder.h.

◆ BEAPI_SQLITE3_STMT

#define BEAPI_SQLITE3_STMT   void

Definition at line 54 of file feature_recorder.h.

Typedef Documentation

◆ carve_cache_t

typedef atomic_set<std::string> carve_cache_t

Definition at line 116 of file feature_recorder.h.

◆ histogram_defs_t

typedef std::set<histogram_def> histogram_defs_t

Definition at line 97 of file feature_recorder.h.

◆ mhistogram_t

typedef atomic_histogram<std::string,uint64_t> mhistogram_t

Definition at line 119 of file feature_recorder.h.

◆ mhistograms_t

Definition at line 120 of file feature_recorder.h.

Enumeration Type Documentation

◆ byte_order_t

some get functions take byte_order_t as a specifier to indicate which endian format to use.

Enumerator
BO_LITTLE_ENDIAN 
BO_BIG_ENDIAN 

Definition at line 482 of file sbuf.h.

Function Documentation

◆ add_child()

void sbuf_t::add_child ( const sbuf_t child) const
inline

Definition at line 382 of file sbuf.h.

References sbuf_t::children.

Referenced by sbuf_t::sbuf_t().

◆ alphaPart()

std::string pos0_t::alphaPart ( ) const
inline

Definition at line 100 of file sbuf.h.

References pos0_t::path.

Referenced by feature_recorder::carve().

◆ asString()

std::string sbuf_t::asString ( ) const
inline

asString - returns the sbuf as a string

Definition at line 407 of file sbuf.h.

References sbuf_t::buf, and sbuf_t::bufsize.

◆ del_child()

void sbuf_t::del_child ( const sbuf_t child) const
inline

Definition at line 388 of file sbuf.h.

References sbuf_t::children.

Referenced by sbuf_t::~sbuf_t().

◆ find() [1/2]

ssize_t sbuf_t::find ( const char *  str,
size_t  start 
) const
inline

Find the next occurance of a char* string in the buffer starting at a give point. Return offset or -1 if there is none to find. This would benefit from a boyer-Moore implementation

Definition at line 555 of file sbuf.h.

References sbuf_t::buf, sbuf_t::bufsize, and sbuf_t::pagesize.

◆ find() [2/2]

ssize_t sbuf_t::find ( uint8_t  ch,
size_t  start 
) const
inline

Find the next occurance of a character in the buffer starting at a given point. return -1 if there is none to find.

Definition at line 542 of file sbuf.h.

References sbuf_t::buf, and sbuf_t::pagesize.

◆ firstPart()

std::string pos0_t::firstPart ( ) const
inline

Definition at line 90 of file sbuf.h.

References pos0_t::path.

◆ get16i() [1/4]

int16_t sbuf_stream::get16i ( )

Definition at line 103 of file sbuf_stream.cpp.

References sbuf_t::get16i(), sbuf_stream::offset, and sbuf_stream::sbuf.

◆ get16i() [2/4]

int16_t sbuf_stream::get16i ( sbuf_t::byte_order_t  bo)

Definition at line 151 of file sbuf_stream.cpp.

References sbuf_t::get16i(), sbuf_stream::offset, and sbuf_stream::sbuf.

◆ get16i() [3/4]

int16_t sbuf_t::get16i ( size_t  i) const
inline

Definition at line 109 of file sbuf_private.h.

References sbuf_t::get16u().

Referenced by sbuf_stream::get16i().

◆ get16i() [4/4]

int16_t sbuf_t::get16i ( size_t  i,
sbuf_t::byte_order_t  bo 
) const
inline

Definition at line 121 of file sbuf_private.h.

References sbuf_t::BO_LITTLE_ENDIAN, sbuf_t::get16u(), and sbuf_t::get16uBE().

◆ get16iBE() [1/2]

int16_t sbuf_stream::get16iBE ( )

Definition at line 127 of file sbuf_stream.cpp.

References sbuf_t::get16iBE(), sbuf_stream::offset, and sbuf_stream::sbuf.

◆ get16iBE() [2/2]

int16_t sbuf_t::get16iBE ( size_t  i) const
inline

Definition at line 113 of file sbuf_private.h.

References sbuf_t::get16uBE().

Referenced by sbuf_stream::get16iBE().

◆ get16u() [1/4]

uint16_t sbuf_stream::get16u ( )

Definition at line 31 of file sbuf_stream.cpp.

References sbuf_t::get16u(), sbuf_stream::offset, and sbuf_stream::sbuf.

◆ get16u() [2/4]

uint16_t sbuf_stream::get16u ( sbuf_t::byte_order_t  bo)

Definition at line 79 of file sbuf_stream.cpp.

References sbuf_t::get16u(), sbuf_stream::offset, and sbuf_stream::sbuf.

◆ get16u() [3/4]

uint16_t sbuf_t::get16u ( size_t  i) const
inline

Definition at line 25 of file sbuf_private.h.

References sbuf_t::buf, and sbuf_t::bufsize.

Referenced by sbuf_t::get16i(), sbuf_stream::get16u(), sbuf_t::get16u(), and sbuf_t::getUTF16().

◆ get16u() [4/4]

uint16_t sbuf_t::get16u ( size_t  i,
sbuf_t::byte_order_t  bo 
) const
inline

Definition at line 92 of file sbuf_private.h.

References sbuf_t::BO_LITTLE_ENDIAN, sbuf_t::get16u(), and sbuf_t::get16uBE().

◆ get16uBE() [1/2]

uint16_t sbuf_stream::get16uBE ( )

Definition at line 55 of file sbuf_stream.cpp.

References sbuf_t::get16uBE(), sbuf_stream::offset, and sbuf_stream::sbuf.

◆ get16uBE() [2/2]

uint16_t sbuf_t::get16uBE ( size_t  i) const
inline

◆ get32i() [1/4]

int32_t sbuf_stream::get32i ( )

Definition at line 108 of file sbuf_stream.cpp.

References sbuf_t::get32i(), sbuf_stream::offset, and sbuf_stream::sbuf.

◆ get32i() [2/4]

int32_t sbuf_stream::get32i ( sbuf_t::byte_order_t  bo)

Definition at line 156 of file sbuf_stream.cpp.

References sbuf_t::get32i(), sbuf_stream::offset, and sbuf_stream::sbuf.

◆ get32i() [3/4]

int32_t sbuf_t::get32i ( size_t  i) const
inline

Definition at line 110 of file sbuf_private.h.

References sbuf_t::get32u().

Referenced by sbuf_stream::get32i().

◆ get32i() [4/4]

int32_t sbuf_t::get32i ( size_t  i,
sbuf_t::byte_order_t  bo 
) const
inline

Definition at line 125 of file sbuf_private.h.

References sbuf_t::BO_LITTLE_ENDIAN, sbuf_t::get32u(), and sbuf_t::get32uBE().

◆ get32iBE() [1/2]

int32_t sbuf_stream::get32iBE ( )

Definition at line 132 of file sbuf_stream.cpp.

References sbuf_t::get32iBE(), sbuf_stream::offset, and sbuf_stream::sbuf.

◆ get32iBE() [2/2]

int32_t sbuf_t::get32iBE ( size_t  i) const
inline

Definition at line 114 of file sbuf_private.h.

References sbuf_t::get32uBE().

Referenced by sbuf_stream::get32iBE().

◆ get32u() [1/4]

uint32_t sbuf_stream::get32u ( )

Definition at line 36 of file sbuf_stream.cpp.

References sbuf_t::get32u(), sbuf_stream::offset, and sbuf_stream::sbuf.

◆ get32u() [2/4]

uint32_t sbuf_stream::get32u ( sbuf_t::byte_order_t  bo)

Definition at line 84 of file sbuf_stream.cpp.

References sbuf_t::get32u(), sbuf_stream::offset, and sbuf_stream::sbuf.

◆ get32u() [3/4]

uint32_t sbuf_t::get32u ( size_t  i) const
inline

Definition at line 32 of file sbuf_private.h.

References sbuf_t::buf, and sbuf_t::bufsize.

Referenced by sbuf_t::get32i(), sbuf_stream::get32u(), and sbuf_t::get32u().

◆ get32u() [4/4]

uint32_t sbuf_t::get32u ( size_t  i,
sbuf_t::byte_order_t  bo 
) const
inline

Definition at line 96 of file sbuf_private.h.

References sbuf_t::BO_LITTLE_ENDIAN, sbuf_t::get32u(), and sbuf_t::get32uBE().

◆ get32uBE() [1/2]

uint32_t sbuf_stream::get32uBE ( )

Definition at line 60 of file sbuf_stream.cpp.

References sbuf_t::get32uBE(), sbuf_stream::offset, and sbuf_stream::sbuf.

◆ get32uBE() [2/2]

uint32_t sbuf_t::get32uBE ( size_t  i) const
inline

◆ get64i() [1/4]

int64_t sbuf_stream::get64i ( )

Definition at line 113 of file sbuf_stream.cpp.

References sbuf_t::get64i(), sbuf_stream::offset, and sbuf_stream::sbuf.

◆ get64i() [2/4]

int64_t sbuf_stream::get64i ( sbuf_t::byte_order_t  bo)

Definition at line 161 of file sbuf_stream.cpp.

References sbuf_t::get64i(), sbuf_stream::offset, and sbuf_stream::sbuf.

◆ get64i() [3/4]

int64_t sbuf_t::get64i ( size_t  i) const
inline

Definition at line 111 of file sbuf_private.h.

References sbuf_t::get64u().

Referenced by sbuf_stream::get64i().

◆ get64i() [4/4]

int64_t sbuf_t::get64i ( size_t  i,
sbuf_t::byte_order_t  bo 
) const
inline

Definition at line 129 of file sbuf_private.h.

References sbuf_t::BO_LITTLE_ENDIAN, sbuf_t::get64u(), and sbuf_t::get64uBE().

◆ get64iBE() [1/2]

int64_t sbuf_stream::get64iBE ( )

Definition at line 137 of file sbuf_stream.cpp.

References sbuf_t::get64iBE(), sbuf_stream::offset, and sbuf_stream::sbuf.

◆ get64iBE() [2/2]

int64_t sbuf_t::get64iBE ( size_t  i) const
inline

Definition at line 115 of file sbuf_private.h.

References sbuf_t::get64uBE().

Referenced by sbuf_stream::get64iBE().

◆ get64u() [1/4]

uint64_t sbuf_stream::get64u ( )

Definition at line 41 of file sbuf_stream.cpp.

References sbuf_t::get64u(), sbuf_stream::offset, and sbuf_stream::sbuf.

◆ get64u() [2/4]

uint64_t sbuf_stream::get64u ( sbuf_t::byte_order_t  bo)

Definition at line 89 of file sbuf_stream.cpp.

References sbuf_t::get64u(), sbuf_stream::offset, and sbuf_stream::sbuf.

◆ get64u() [3/4]

uint64_t sbuf_t::get64u ( size_t  i) const
inline

Definition at line 41 of file sbuf_private.h.

References sbuf_t::buf, and sbuf_t::bufsize.

Referenced by sbuf_t::get64i(), sbuf_stream::get64u(), and sbuf_t::get64u().

◆ get64u() [4/4]

uint64_t sbuf_t::get64u ( size_t  i,
sbuf_t::byte_order_t  bo 
) const
inline

Definition at line 100 of file sbuf_private.h.

References sbuf_t::BO_LITTLE_ENDIAN, sbuf_t::get64u(), and sbuf_t::get64uBE().

◆ get64uBE() [1/2]

uint64_t sbuf_stream::get64uBE ( )

Definition at line 65 of file sbuf_stream.cpp.

References sbuf_t::get64uBE(), sbuf_stream::offset, and sbuf_stream::sbuf.

◆ get64uBE() [2/2]

uint64_t sbuf_t::get64uBE ( size_t  i) const
inline

◆ get8i() [1/4]

int8_t sbuf_stream::get8i ( )

Definition at line 98 of file sbuf_stream.cpp.

References sbuf_t::get8i(), sbuf_stream::offset, and sbuf_stream::sbuf.

◆ get8i() [2/4]

int8_t sbuf_stream::get8i ( sbuf_t::byte_order_t  bo)

Definition at line 146 of file sbuf_stream.cpp.

References sbuf_t::get8i(), sbuf_stream::offset, and sbuf_stream::sbuf.

◆ get8i() [3/4]

int8_t sbuf_t::get8i ( size_t  i) const
inline

Signed get interfaces simply call the unsigned interfaces and the return gets cast.

Definition at line 108 of file sbuf_private.h.

References sbuf_t::get8u().

Referenced by sbuf_stream::get8i().

◆ get8i() [4/4]

int8_t sbuf_t::get8i ( size_t  i,
sbuf_t::byte_order_t  bo 
) const
inline

Definition at line 117 of file sbuf_private.h.

References sbuf_t::BO_LITTLE_ENDIAN, sbuf_t::get8u(), and sbuf_t::get8uBE().

◆ get8iBE() [1/2]

int8_t sbuf_stream::get8iBE ( )

Definition at line 122 of file sbuf_stream.cpp.

References sbuf_t::get8iBE(), sbuf_stream::offset, and sbuf_stream::sbuf.

◆ get8iBE() [2/2]

int8_t sbuf_t::get8iBE ( size_t  i) const
inline

Definition at line 112 of file sbuf_private.h.

References sbuf_t::get8uBE().

Referenced by sbuf_stream::get8iBE().

◆ get8u() [1/4]

uint8_t sbuf_stream::get8u ( )

Definition at line 26 of file sbuf_stream.cpp.

References sbuf_t::get8u(), sbuf_stream::offset, and sbuf_stream::sbuf.

◆ get8u() [2/4]

uint8_t sbuf_stream::get8u ( sbuf_t::byte_order_t  bo)

Definition at line 74 of file sbuf_stream.cpp.

References sbuf_t::get8u(), sbuf_stream::offset, and sbuf_stream::sbuf.

◆ get8u() [3/4]

uint8_t sbuf_t::get8u ( size_t  i) const
inline

Unsigned get interfaces

Definition at line 20 of file sbuf_private.h.

References sbuf_t::buf, and sbuf_t::bufsize.

Referenced by sbuf_t::get8i(), sbuf_stream::get8u(), sbuf_t::get8u(), and sbuf_t::getUTF8().

◆ get8u() [4/4]

uint8_t sbuf_t::get8u ( size_t  i,
sbuf_t::byte_order_t  bo 
) const
inline

Definition at line 88 of file sbuf_private.h.

References sbuf_t::BO_LITTLE_ENDIAN, sbuf_t::get8u(), and sbuf_t::get8uBE().

◆ get8uBE() [1/2]

uint8_t sbuf_stream::get8uBE ( )

Definition at line 50 of file sbuf_stream.cpp.

References sbuf_t::get8uBE(), sbuf_stream::offset, and sbuf_stream::sbuf.

◆ get8uBE() [2/2]

uint8_t sbuf_t::get8uBE ( size_t  i) const
inline

Definition at line 54 of file sbuf_private.h.

References sbuf_t::buf, and sbuf_t::bufsize.

Referenced by sbuf_t::get8i(), sbuf_t::get8iBE(), sbuf_t::get8u(), and sbuf_stream::get8uBE().

◆ get_struct_ptr()

template<class TYPE >
const TYPE* sbuf_t::get_struct_ptr ( uint32_t  pos) const
inline

Definition at line 578 of file sbuf.h.

References sbuf_t::buf, and sbuf_t::bufsize.

◆ getUTF16() [1/6]

void sbuf_t::getUTF16 ( size_t  i,
byte_order_t  bo,
std::wstring &  utf16_string 
) const

Read UTF-16 format code units using the specified byte order into wstring up to but not including \U0000.

Definition at line 371 of file sbuf.cpp.

References sbuf_t::bufsize, and sbuf_t::get16u().

◆ getUTF16() [2/6]

void sbuf_t::getUTF16 ( size_t  i,
size_t  num_code_units_requested,
byte_order_t  bo,
std::wstring &  utf16_string 
) const

Read the requested number of UTF-16 format code units using the specified byte order into wstring including any \U0000.

Definition at line 346 of file sbuf.cpp.

References sbuf_t::bufsize, and sbuf_t::get16u().

◆ getUTF16() [3/6]

void sbuf_t::getUTF16 ( size_t  i,
size_t  num_code_units_requested,
std::wstring &  utf16_string 
) const

Read the requested number of UTF-16 format code units into wstring including any \U0000.

Definition at line 297 of file sbuf.cpp.

References sbuf_t::bufsize, and sbuf_t::get16u().

Referenced by sbuf_stream::getUTF16().

◆ getUTF16() [4/6]

void sbuf_t::getUTF16 ( size_t  i,
std::wstring &  utf16_string 
) const

Read UTF-16 format code units into wstring up to but not including \U0000.

Definition at line 322 of file sbuf.cpp.

References sbuf_t::bufsize, and sbuf_t::get16u().

◆ getUTF16() [5/6]

void sbuf_stream::getUTF16 ( size_t  num_code_units_requested,
wstring &  utf16_string 
)

Definition at line 186 of file sbuf_stream.cpp.

References sbuf_t::getUTF16(), sbuf_stream::offset, and sbuf_stream::sbuf.

◆ getUTF16() [6/6]

void sbuf_stream::getUTF16 ( wstring &  utf16_string)

Definition at line 191 of file sbuf_stream.cpp.

References sbuf_t::getUTF16(), sbuf_stream::offset, and sbuf_stream::sbuf.

◆ getUTF8() [1/4]

void sbuf_t::getUTF8 ( size_t  i,
size_t  num_octets_requested,
std::string &  utf8_string 
) const

Read the requested number of UTF-8 format string octets including any \0.

Definition at line 257 of file sbuf.cpp.

References sbuf_t::buf, and sbuf_t::bufsize.

Referenced by sbuf_stream::getUTF8().

◆ getUTF8() [2/4]

void sbuf_t::getUTF8 ( size_t  i,
std::string &  utf8_string 
) const

Read UTF-8 format code octets into string up to but not including \0.

Definition at line 275 of file sbuf.cpp.

References sbuf_t::bufsize, and sbuf_t::get8u().

◆ getUTF8() [3/4]

void sbuf_stream::getUTF8 ( size_t  num_octets_requested,
string &  utf8_string 
)

Definition at line 170 of file sbuf_stream.cpp.

References sbuf_t::getUTF8(), sbuf_stream::offset, and sbuf_stream::sbuf.

◆ getUTF8() [4/4]

void sbuf_stream::getUTF8 ( string &  utf8_string)

Definition at line 175 of file sbuf_stream.cpp.

References sbuf_t::getUTF8(), sbuf_stream::offset, and sbuf_stream::sbuf.

◆ hex_dump() [1/2]

void sbuf_t::hex_dump ( std::ostream &  os) const

Definition at line 189 of file sbuf.cpp.

References sbuf_t::bufsize, and sbuf_t::hex_dump().

◆ hex_dump() [2/2]

void sbuf_t::hex_dump ( std::ostream &  os,
uint64_t  start,
uint64_t  len 
) const

hexdump the sbuf.

Definition at line 121 of file sbuf.cpp.

References sbuf_t::bufsize, and hexch().

Referenced by sbuf_t::hex_dump(), tcpdemux::process_ip4(), and be13::plugin::process_sbuf().

◆ highest_parent()

const sbuf_t * sbuf_t::highest_parent ( ) const

Definition at line 80 of file sbuf.cpp.

References sbuf_t::parent.

◆ imageOffset()

uint64_t pos0_t::imageOffset ( ) const
inline

Definition at line 116 of file sbuf.h.

References pos0_t::offset, pos0_t::path, and stoi64().

Referenced by feature_recorder::besql_stmt::insert_feature().

◆ is_constant() [1/2]

bool sbuf_t::is_constant ( size_t  loc,
size_t  len,
uint8_t  ch 
) const

Definition at line 179 of file sbuf.cpp.

◆ is_constant() [2/2]

bool sbuf_t::is_constant ( uint8_t  ch) const
inline

Definition at line 573 of file sbuf.h.

References sbuf_t::is_constant().

Referenced by sbuf_t::is_constant().

◆ isRecursive()

bool pos0_t::isRecursive ( ) const
inline

Definition at line 87 of file sbuf.h.

References pos0_t::path.

◆ lastAddedPart()

std::string pos0_t::lastAddedPart ( ) const
inline

Definition at line 95 of file sbuf.h.

References pos0_t::path.

◆ left()

size_t sbuf_t::left ( size_t  n) const
inline

Definition at line 379 of file sbuf.h.

References sbuf_t::bufsize.

Referenced by sbuf_t::memcmp().

◆ MAINTHREAD()

◆ managed_malloc() [1/3]

template<class TYPE >
managed_malloc< TYPE >::managed_malloc ( )
private

◆ managed_malloc() [2/3]

template<class TYPE >
managed_malloc< TYPE >::managed_malloc ( const managed_malloc< TYPE > &  )
private

◆ managed_malloc() [3/3]

template<class TYPE >
managed_malloc< TYPE >::managed_malloc ( size_t  bytes)
inline

Definition at line 192 of file sbuf.h.

◆ map_file() [1/2]

sbuf_t * sbuf_t::map_file ( const std::string &  fname)
static

Definition at line 22 of file sbuf.cpp.

References sbuf_t::fd, O_BINARY, and sbuf_t::should_close.

Referenced by tcpdemux::post_process().

◆ map_file() [2/2]

sbuf_t * sbuf_t::map_file ( const std::string &  fname,
int  fd 
)
static

◆ memcmp()

int sbuf_t::memcmp ( const uint8_t cbuf,
size_t  at,
size_t  len 
) const
inline

The following get functions read integer and string types or else throw an sbuf_range_exception if out of range.

Definition at line 11 of file sbuf_private.h.

References sbuf_t::buf, and sbuf_t::left().

Referenced by scan_http().

◆ min()

static size_t sbuf_t::min ( size_t  a,
size_t  b 
)
inlinestatic

Definition at line 229 of file sbuf.h.

◆ offset()

size_t sbuf_t::offset ( const uint8_t loc) const
inline

Find the offset of a byte

Definition at line 397 of file sbuf.h.

References sbuf_t::buf, and sbuf_t::bufsize.

◆ operator!=()

bool operator!= ( const histogram_def h1,
const histogram_def h2 
)
inline

◆ operator+() [1/3]

class pos0_t operator+ ( pos0_t  pos,
const std::string &  subdir 
)
inline

Append a string (subdir). The current offset is a prefix to the subdir.

Definition at line 140 of file sbuf.h.

References pos0_t::offset, and pos0_t::path.

◆ operator+() [2/3]

class pos0_t operator+ ( pos0_t  pos,
int64_t  delta 
)
inline

Adding an offset

Definition at line 140 of file sbuf.h.

◆ operator+() [3/3]

sbuf_t sbuf_t::operator+ ( size_t  off) const
inline

the + operator returns a new sbuf that is i bytes in and, therefore, i bytes smaller. Note:

  1. We assume that pagesize is always smaller than or equal to bufsize.
  2. The child sbuf uses the parent's memory. If the parent gets deleted, the child points to invalid data.
  3. If i is bigger than pagesize, then an sbuf is returned with 0 bytes in the page and all of the margin.

    (Because we won't return what's in the margin as page data.)

Definition at line 356 of file sbuf.h.

References sbuf_t::sbuf_t().

◆ operator<() [1/2]

bool operator< ( const class pos0_t pos0,
const class pos0_t pos1 
)
inline

Definition at line 163 of file sbuf.h.

References pos0_t::offset, and pos0_t::path.

◆ operator<() [2/2]

bool operator< ( const histogram_def h1,
const histogram_def h2 
)
inline

◆ operator<<() [1/2]

std::ostream& operator<< ( std::ostream &  os,
const class pos0_t pos0 
)
inline

iostream support for the pos0_t

Definition at line 140 of file sbuf.h.

◆ operator<<() [2/2]

std::ostream& operator<< ( std::ostream &  os,
const sbuf_t sbuf 
)

◆ operator=() [1/2]

template<class TYPE >
managed_malloc& managed_malloc< TYPE >::operator= ( const managed_malloc< TYPE > &  )
private

◆ operator=() [2/2]

sbuf_t& sbuf_t::operator= ( const sbuf_t that)
private

◆ operator==()

bool operator== ( const class pos0_t pos0,
const class pos0_t pos1 
)
inline

Definition at line 175 of file sbuf.h.

References pos0_t::offset, and pos0_t::path.

◆ operator>()

bool operator> ( const class pos0_t pos0,
const class pos0_t pos1 
)
inline

Definition at line 169 of file sbuf.h.

References pos0_t::offset, and pos0_t::path.

◆ operator[]()

uint8_t sbuf_t::operator[] ( size_t  i) const
inline

The [] operator safely returns what's at index [i] or else returns 0 if out of range. We made a decision that this would not throw the exception Notice that we don't need to check to see if i<0 because i is unsigned.

Definition at line 533 of file sbuf.h.

References sbuf_t::buf, and sbuf_t::bufsize.

◆ pos0_t() [1/4]

pos0_t::pos0_t ( )
inlineexplicit

Definition at line 75 of file sbuf.h.

Referenced by pos0_t::shift().

◆ pos0_t() [2/4]

pos0_t::pos0_t ( const pos0_t obj)
inline

Definition at line 78 of file sbuf.h.

◆ pos0_t() [3/4]

pos0_t::pos0_t ( std::string  s)
inline

Definition at line 76 of file sbuf.h.

◆ pos0_t() [4/4]

pos0_t::pos0_t ( std::string  s,
uint64_t  o 
)
inline

Definition at line 77 of file sbuf.h.

◆ raw_dump() [1/2]

void sbuf_t::raw_dump ( int  fd2,
uint64_t  start,
uint64_t  len 
) const

rawdump the sbuf to a file descriptor

Definition at line 102 of file sbuf.cpp.

References sbuf_t::buf, sbuf_t::bufsize, and sbuf_t::write().

◆ raw_dump() [2/2]

void sbuf_t::raw_dump ( std::ostream &  os,
uint64_t  start,
uint64_t  len 
) const

These are largely for debugging, but they also support the BEViewer. Dump the sbuf to a stream.

rawdump the sbuf to an ostream.

Definition at line 92 of file sbuf.cpp.

References sbuf_t::buf, and sbuf_t::bufsize.

◆ release()

void sbuf_t::release ( )
inlineprivate

◆ sbuf_stream()

sbuf_stream::sbuf_stream ( const sbuf_t sbuf_)

Definition at line 9 of file sbuf_stream.cpp.

◆ sbuf_t() [1/7]

sbuf_t::sbuf_t ( )
inlineexplicit

Make an empty sbuf. It's used for situations where an sbuf is needed but not referenced

Definition at line 258 of file sbuf.h.

Referenced by sbuf_t::map_file(), and sbuf_t::operator+().

◆ sbuf_t() [2/7]

sbuf_t::sbuf_t ( const pos0_t pos0_,
const uint8_t buf_,
size_t  bufsize_,
size_t  pagesize_,
bool  should_free_ 
)
inlineexplicit

Definition at line 337 of file sbuf.h.

◆ sbuf_t() [3/7]

sbuf_t::sbuf_t ( const pos0_t pos0_,
const uint8_t buf_,
size_t  bufsize_,
size_t  pagesize_,
int  fd_,
bool  should_unmap_,
bool  should_free_,
bool  should_close_ 
)
inlineexplicit

Allocators that allocate from memory Allocate a new buffer of a given size for filling. This is the one case where buf is written into... This should probably be a subclass mutable_sbuf_t() for clarity.

Definition at line 327 of file sbuf.h.

◆ sbuf_t() [4/7]

sbuf_t::sbuf_t ( const pos0_t that_pos0,
const sbuf_t that_sbuf 
)
inlineexplicit

Make an sbuf from a parent but with a different path.

Definition at line 283 of file sbuf.h.

References sbuf_t::add_child(), and sbuf_t::parent.

◆ sbuf_t() [5/7]

sbuf_t::sbuf_t ( const sbuf_t sbuf,
size_t  off,
size_t  len 
)
inlineexplicit

Allocate from an existing sbuf. The allocated buf MUST be freed before the source, since no copy is made...

Definition at line 306 of file sbuf.h.

References sbuf_t::add_child(), and sbuf_t::parent.

◆ sbuf_t() [6/7]

sbuf_t::sbuf_t ( const sbuf_t that)
inline

Child allocators — allocate an sbuf from another sbuf Make an sbuf from a parent. note: don't add an 'explicit' — it causes problems.

Definition at line 272 of file sbuf.h.

References sbuf_t::add_child(), and sbuf_t::parent.

◆ sbuf_t() [7/7]

sbuf_t::sbuf_t ( const sbuf_t that_sbuf,
size_t  off 
)
inline

make an sbuf from a parent but with an indent.

Definition at line 294 of file sbuf.h.

◆ seek()

void sbuf_stream::seek ( size_t  offset)

Definition at line 15 of file sbuf_stream.cpp.

References sbuf_stream::offset.

◆ set_map_file_delimiter()

static void sbuf_t::set_map_file_delimiter ( const std::string &  new_delim)
inlinestatic

Definition at line 373 of file sbuf.h.

References sbuf_t::map_file_delimiter.

Referenced by main().

◆ shift()

pos0_t pos0_t::shift ( int64_t  s) const
inline

Return a new position that's been shifted by an offset

Definition at line 125 of file sbuf.h.

References pos0_t::offset, pos0_t::path, pos0_t::pos0_t(), and stoi64().

Referenced by feature_recorder::write(), and feature_recorder::write0().

◆ size()

size_t sbuf_t::size ( ) const
inline

Definition at line 378 of file sbuf.h.

References sbuf_t::bufsize.

Referenced by scan_http().

◆ stoi64()

int64_t stoi64 ( std::string  str)
inline

Definition at line 62 of file sbuf.h.

Referenced by pos0_t::imageOffset(), and pos0_t::shift().

◆ str()

std::string pos0_t::str ( ) const
inline

◆ substr()

std::string sbuf_t::substr ( size_t  loc,
size_t  len 
) const

Definition at line 172 of file sbuf.cpp.

References sbuf_t::buf, and sbuf_t::bufsize.

Referenced by feature_recorder::write_buf().

◆ tell()

size_t sbuf_stream::tell ( )

Definition at line 19 of file sbuf_stream.cpp.

References sbuf_stream::offset.

◆ validateOrEscapeUTF8()

std::string validateOrEscapeUTF8 ( const std::string &  input,
bool  escape_bad_UTF8,
bool  escape_backslash 
)

◆ what()

virtual const char* sbuf_t::range_exception_t::what ( ) const
throw (
)
inlinevirtual

Definition at line 418 of file sbuf.h.

◆ write() [1/2]

ssize_t sbuf_t::write ( FILE *  f,
size_t  loc,
size_t  len 
) const

Definition at line 164 of file sbuf.cpp.

References sbuf_t::buf, and sbuf_t::bufsize.

◆ write() [2/2]

ssize_t sbuf_t::write ( int  fd,
size_t  loc,
size_t  len 
) const

Definition at line 156 of file sbuf.cpp.

References sbuf_t::buf, and sbuf_t::bufsize.

Referenced by feature_recorder::carve(), and sbuf_t::raw_dump().

◆ ~managed_malloc()

template<class TYPE >
managed_malloc< TYPE >::~managed_malloc ( )
inline

Definition at line 193 of file sbuf.h.

References managed_malloc< TYPE >::buf.

◆ ~sbuf_stream()

sbuf_stream::~sbuf_stream ( )

Definition at line 12 of file sbuf_stream.cpp.

◆ ~sbuf_t()

virtual sbuf_t::~sbuf_t ( )
inlinevirtual

Definition at line 360 of file sbuf.h.

References sbuf_t::children, sbuf_t::del_child(), sbuf_t::parent, and sbuf_t::release().

Variable Documentation

◆ buf [1/2]

template<class TYPE >
TYPE* managed_malloc< TYPE >::buf

Definition at line 191 of file sbuf.h.

Referenced by feature_recorder::printf(), and managed_malloc< TYPE >::~managed_malloc().

◆ buf [2/2]

◆ bufsize

◆ children

int sbuf_t::children
mutable

Definition at line 239 of file sbuf.h.

Referenced by sbuf_t::add_child(), sbuf_t::del_child(), and sbuf_t::~sbuf_t().

◆ fd

int sbuf_t::fd
private

Definition at line 224 of file sbuf.h.

Referenced by sbuf_t::map_file(), and sbuf_t::release().

◆ map_file_delimiter

std::string sbuf_t::map_file_delimiter
static

Definition at line 372 of file sbuf.h.

Referenced by sbuf_t::map_file(), and sbuf_t::set_map_file_delimiter().

◆ offset [1/2]

const uint64_t pos0_t::offset

◆ offset [2/2]

◆ page_number

int sbuf_t::page_number

Definition at line 234 of file sbuf.h.

Referenced by operator<<(), and sbuf_t::release().

◆ pagesize

size_t sbuf_t::pagesize

◆ parent

const sbuf_t* sbuf_t::parent
private

Definition at line 237 of file sbuf.h.

Referenced by sbuf_t::highest_parent(), sbuf_t::sbuf_t(), and sbuf_t::~sbuf_t().

◆ path

◆ pos0

◆ sbuf

◆ should_close

bool sbuf_t::should_close

Definition at line 228 of file sbuf.h.

Referenced by sbuf_t::map_file(), and sbuf_t::release().

◆ should_free

bool sbuf_t::should_free

Definition at line 227 of file sbuf.h.

Referenced by sbuf_t::map_file(), and sbuf_t::release().

◆ should_unmap

bool sbuf_t::should_unmap

Definition at line 226 of file sbuf.h.

Referenced by sbuf_t::map_file(), and sbuf_t::release().

◆ U10001C

const std::string sbuf_t::U10001C
static

Map a file; falls back to read if mmap is not available

Definition at line 371 of file sbuf.h.

◆ validateOrEscapeUTF8_validate

bool validateOrEscapeUTF8_validate
extern

validateOrEscapeUTF8 Input: UTF8 string (possibly corrupt) Input: do_escape, indicating whether invalid encodings shall be escaped. Note:

  • if not escaping but an invalid encoding is present and DEBUG_PEDANTIC is set, then assert() is called.
  • DO NOT USE wchar_t because it is 16-bits on Windows and 32-bits on Unix. Output:

UTF8 string. If do_escape is set, then corruptions are escaped in \xFF notation where FF is a hex character.

Definition at line 117 of file unicode_escape.cpp.

Referenced by validateOrEscapeUTF8().