synalysis / Grammars

Grammars for Synalyze It! and Hexinator
MIT License
92 stars 14 forks source link

Could you publish the specification for the grammars syntax? #5

Open KOLANICH opened 6 years ago

KOLANICH commented 6 years ago

I mean that there is enough information in the grammars themselves, but something is still unclear:

synalysis commented 6 years ago
KOLANICH commented 6 years ago

Thank you.

Pascal strings: https://en.wikipedia.org/wiki/String_(computer_science)#Length-prefixed

I know that they are length prefixed. But the length may differ. Is the length 1-byte?

for values with mustmatch set the constraints set by fixedvalues and min/max value are used. If none of the fixedvalues is found or the value is not between min/max value the enclosing structure is not applied.

This is the especially valuable clarification, since I expected a bit different behavior (raising an error when a signature is not matched).

BTW, the software I develop is https://github.com/KOLANICH/synalysis2kaitai .

synalysis commented 6 years ago

For multi-byte encodings like UTF-16 the length is 2 bytes. However, Pascal strings are usually prefixed with a single byte length. These built-in data types work in many cases - for more special requirements data types can be parsed with Python or Lua scripts.

In chapter 6 of https://www.synalyze-it.com/Synalyze_It_Manual.pdf you find some additional information regarding "mustmatch". So for structures with variable element order the parser can automatically select the one that should be used - where all constraints are met.

KOLANICH commented 6 years ago

Thank you for the info. Could you also clarify what do valueexpression, floating,lengthoffset, disabled and debug do?

synalysis commented 6 years ago

valueexpression: for structures it determines what should be displayed as value in the parsing results tree. For elements it allows to show a different value than the one that was parsed in the file. For elements it's not used much. For structures it's useful because you can avoid opening structures in the parsing results but still see what they're about.

floating can be ignored. The idea was to mark structures as floating which can appear at different places in a file.

lengthoffset can also be ignored.

disabled elements or structures are simply ignored while parsing.

debug can be set for structures in order to get additional log messages while parsing a file. This makes grammar development easier because you see only parsing messages of a certain structure and not for all.

KOLANICH commented 6 years ago

Could you clarify, please:

?

KOLANICH commented 5 years ago

@synalysis