oletools icon indicating copy to clipboard operation
oletools copied to clipboard

ftguess: add strict/safe mode to match extension to file formats

Open decalage2 opened this issue 3 months ago • 0 comments

add an exefilter-like mode, to recognize file types in a stricter/safer way by matching file extension and content, and avoid issue with polyglots:

  1. if the filename has an extension, find all the formats matching that extension
  2. then check each of those formats, if they recognise the file content with a proper structure
  3. if none of the formats matches the file extension, issue a warning that the format is incorrect or not supported, or the file extension is incorrect
  4. otherwise if the filename has no extension, or a generic extension like ".bin" or an extension not known by ftguess, guess the file type with the usual ftguess algorithm (and display a warning)

With this mode, ftguess will enforce that a file has a proper extension matching its content.

decalage2 avatar Mar 21 '24 22:03 decalage2