Scanners for RIFF, IFF and similar

[NebularNerd]

Hi @cdgriffith,

Thinking ahead for the scanners, when it comes to wrapper formats such a RIFF, IFF and similar would you like them grouped by the wrapper format? So regardless of if it's a WEBP, WAV or CorelDraw image it's handled under a riff_scanner, likewise for IFF and CBF (used for lots of MS stuff including .msg #119).

This would reduce the amount of scanners as we would only need the RIFF entry bytes to pass testing to one scanner, but the complexity of the scanner would increase as they would need to handle a variety of sub-formats under the parent.

[NebularNerd]

I think CBF certainly needs a combined scanner looking at the way it works, it should be fairly simple to implement. Essentially it's a complicated fat-a-like image. that might be a good next project.

EDIT 17/12:
CFBF (Compound File Binary Format) scanner in progress 😁
I think container style scanners are the way to go, for example these need a fair bit to decode the header, but once done I can just make a name wrangler for each CLSID file type using a universal base.

'M:\Downloads\example.msg' : .msg
Total Possible Matches: 1

        Deepscan Match
        Name: Outlook Item File [Type:Email CFBF:v3]
        Confidence: 100%
        Extension: .msg
        Mime Type: application/vnd.ms-outlook
        Byte Match: b'\xd0\xcf\x11\xe0\xa1\xb1\x1a\xe1'
        Offset: 0

[cdgriffith]

Hey @NebularNerd as heads up I do have github copilot enabled now on these repos, so if you write out very clear descriptions of what you want added, can just throw the coding agents at the tasks :)

[NebularNerd]

Hey @NebularNerd as heads up I do have github copilot enabled now on these repos, so if you write out very clear descriptions of what you want added, can just throw the coding agents at the tasks :)

The CFBF stuff is simple/tricky I have a basic CLSID matcher already working (that was pretty easy). But trying to dig out other info is tricky as you have non-Microsoft stuff which does not adhere to the standards, for Outlook .msg you can't tell which app wrote the file easily/reliably as it's all very dependant on if the message was sent, is it really a message and so forth. Similar issues apply to Excel and so forth. I'm using a little AI help to overcome some of these trickier issues but even they fail to get it right.