From 5bde5d446b73f4457a4a83e9db1177f6d52689ce Mon Sep 17 00:00:00 2001 From: Kostya Shishkov Date: Thu, 5 Feb 2026 18:54:05 +0100 Subject: [PATCH] detect: add an entry for MOV in MacBinary II without mdat atom --- nihav-registry/src/detect.rs | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/nihav-registry/src/detect.rs b/nihav-registry/src/detect.rs index 41702ed..a92afa9 100644 --- a/nihav-registry/src/detect.rs +++ b/nihav-registry/src/detect.rs @@ -253,6 +253,14 @@ const DETECTORS: &[DetectConditions] = &[ CheckItem{offs: 0x7B, cond: &CC::Eq(Arg::Byte(0x81))}, CheckItem{offs: 0x84, cond: &CC::Or(&CC::Str(b"mdat"), &CC::Str(b"moov"))}], }, + DetectConditions { + demux_name: "mov-macbin", + extensions: ".mov,.bin", + conditions: &[CheckItem{offs: 0, cond: &CC::Eq(Arg::Byte(0))}, + CheckItem{offs: 0x41, cond: &CC::Str(b"MooVPrMr")}, + CheckItem{offs: 0x7A, cond: &CC::Eq(Arg::Byte(0x81))}, + CheckItem{offs: 0x7B, cond: &CC::Eq(Arg::Byte(0x81))}], + }, DetectConditions { demux_name: "mov-resfork", extensions: ".mov", -- 2.39.5