debugger, -db drop into an interactive debugger for libmagic file definition matching and PolyFile parsing

man 5 magic. PolyFile implements an interactive debugger for stepping through the DSL specifications, modeled after You can read the minimal and—as we have discovered in our cleanroom implementation— incomplete documentation by runningdemangle Demangle C++ function names in the CFG (requires that PolyFile was installed with the `demangle` option, or that the `cxxfilt` Python module is installed.) For each semantic type in the input file, collect the functions that operated on bytes from that type; no-debug-python by default, the `--debugger` option will break on custom matchers and prompt to debug using PDB. This option will suppress those prompts. identification rather than the libmagic file definitions. This proved to be very slow (since TrID has many duplicate

GDB. You can enter this debugger by passing the --debugger or -db argument to PolyFile. It is useful for both

It can be invoked programmatically by running: from polyfile.magic import MagicMatcher with open ( "file_to_test" , "rb" ) as f : # the default instance automatically loads all file definitions for match in MagicMatcher . DEFAULT_INSTANCE . match ( f . read ()): for mimetype in match . mimetypes : print ( f "Matched MIME: { mimetype } " ) print ( f "Match string: { match !s} " )

For the CFG generation options, only render functions that participated in dataflow. `--dataflow 10` means that only functions in the dataflow related to byte 10 should be included. `--dataflow 10:30` means that only functions operating on bytes 10 through 29 should be included. The beginning or end of a range can be omitted and will default to the beginning and end of the file, respectively. Multiple `--dataflow` ranges can be specified. `--dataflow :` will render the CFG only with functions that operated on tainted bytes. Omitting `--dataflow` will produce a CFG containing all functions. definition, determine why a specific file fails to be classified as the expected MIME type, or step through a parser. PolyFile has an interactive debugger both for its file matching and parsing. It can be used to debug a libmagic pattern To be used in conjunction with `--dataflow`. If enabled, only functions in the dataflow graph if they operated on the tainted bytes. This can result in a disjoint dataflow graph.curl -v --silent https://www.sultanik.com/files/ESultanikResume.pdf | polyfile --html ESultanikResume.html - Optional path to output a Graphviz .dot file representing the type hierarchy extracted from PolyFile Full usage instructions follow: usage: polyfile [-h] [--format {file,mime,html,json,sbud}] [--output OUTPUT] polymerge can also optionally emit a Graphviz .dot file or rendered PDF of the runtime control-flow graph recorded cfg CFG, -c CFG Optional path to output a Graphviz .dot file representing the control flow graph of the program trace